From ff0457aa9563d80fa737945f6b652dfa34f97a70 Mon Sep 17 00:00:00 2001 From: Nestori Date: Fri, 18 Apr 2025 14:41:13 +0300 Subject: [PATCH] v0.9.8 --- AADInternals.psd1 | 7 +- AccessToken.ps1 | 772 +- AccessToken_utils.ps1 | 462 +- CommonUtils.ps1 | 343 +- Microsoft.Identity.Client.dll | Bin 0 -> 1639496 bytes Microsoft.Identity.Client.xml | 21295 +++++++++++++++++++++ Microsoft.IdentityModel.Abstractions.dll | Bin 0 -> 18976 bytes Microsoft.IdentityModel.Abstractions.xml | 297 + PRT.ps1 | 468 +- PRT_Utils.ps1 | 190 +- SPO.ps1 | 147 +- SPO_utils.ps1 | 146 - 12 files changed, 23305 insertions(+), 822 deletions(-) create mode 100644 Microsoft.Identity.Client.dll create mode 100644 Microsoft.Identity.Client.xml create mode 100644 Microsoft.IdentityModel.Abstractions.dll create mode 100644 Microsoft.IdentityModel.Abstractions.xml diff --git a/AADInternals.psd1 b/AADInternals.psd1 index 4b59781..e4dafcc 100644 --- a/AADInternals.psd1 +++ b/AADInternals.psd1 @@ -4,7 +4,7 @@ RootModule = 'AADInternals.psm1' # Version number of this module. - ModuleVersion = '0.9.7' + ModuleVersion = '0.9.8' # Supported PSEditions # CompatiblePSEditions = @() @@ -19,7 +19,7 @@ CompanyName = 'Gerenios Ltd' # Copyright statement for this module - Copyright = '(c) 2018 - 2024 Nestori Syynimaa (@DrAzureAD). Distributed under MIT license.' + Copyright = '(c) 2018 - 2025 Nestori Syynimaa (@DrAzureAD). Distributed under MIT license.' # Description of the functionality provided by this module Description = 'The AADInternals PowerShell Module utilises several internal features of Azure Active Directory, Office 365, and related admin tools. @@ -279,9 +279,6 @@ DISCLAIMER: Functionality provided through this module are not supported by Micr "Test-SARAPort" "Resolve-SARAHost" - # SPO_utils.ps1 - "Get-SPOAuthenticationHeader" - # SPO.ps1 "Get-SPOSiteUsers" "Get-SPOSiteGroups" diff --git a/AccessToken.ps1 b/AccessToken.ps1 index 49cec1b..0ae7f4b 100644 --- a/AccessToken.ps1 +++ b/AccessToken.ps1 @@ -213,6 +213,8 @@ function Get-AccessTokenForAADGraph [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [Parameter(Mandatory=$False)] [String]$Tenant, [switch]$SaveToCache, @@ -221,12 +223,32 @@ function Get-AccessTokenForAADGraph [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -Tenant $Tenant -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -Tenant $Tenant -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -277,6 +299,8 @@ function Get-AccessTokenForMSGraph [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [Parameter(Mandatory=$False)] [String]$Tenant, [switch]$SaveToCache, @@ -284,11 +308,32 @@ function Get-AccessTokenForMSGraph [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Credentials $Credentials -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Tenant $Tenant -OTPSecretKey $OTPSecretKey -TAP $TAP -SaveToMgCache $SaveToMgCache + Get-AccessToken -Credentials $Credentials -Resource "https://graph.microsoft.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Tenant $Tenant -OTPSecretKey $OTPSecretKey -TAP $TAP -SaveToMgCache $SaveToMgCache -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -341,15 +386,38 @@ function Get-AccessTokenForPTA [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Credentials $Credentials -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Credentials $Credentials -Resource "https://proxy.cloudwebappproxy.net/registerapp" -ClientId "cb1056e2-e479-49de-ae31-7812af012ed8" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -402,15 +470,38 @@ function Get-AccessTokenForOfficeApps [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Credentials $Credentials -Resource "https://officeapps.live.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Credentials $Credentials -Resource "https://officeapps.live.com" -ClientId "1b730954-1685-4b74-9bfd-dac224a7b894" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -463,6 +554,8 @@ function Get-AccessTokenForEXO [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [ValidateSet("https://graph.microsoft.com","https://outlook.office365.com","https://outlook.office.com","https://substrate.office.com")] @@ -470,12 +563,33 @@ function Get-AccessTokenForEXO [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # Office app has the required rights to Exchange Online - Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Credentials $Credentials -Resource $Resource -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -Domain $Domain -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -531,6 +645,8 @@ function Get-AccessTokenForEXOPS [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] @@ -542,12 +658,33 @@ function Get-AccessTokenForEXOPS [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # Office app has the required rights to Exchange Online - Get-AccessToken -Credentials $Credentials -Resource "https://outlook.office365.com" -ClientId "a0c73c16-a7e3-4564-9a95-2bdf47383716" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Credentials $Credentials -Resource "https://outlook.office365.com" -ClientId "a0c73c16-a7e3-4564-9a95-2bdf47383716" -SAMLToken $SAMLToken -KerberosTicket $KerberosTicket -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -589,16 +726,39 @@ function Get-AccessTokenForSARA [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # Office app has the required rights to Exchange Online - Get-AccessToken -Resource "https://api.diagnostics.office.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://api.diagnostics.office.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -640,8 +800,8 @@ function Get-AccessTokenForOneDrive #> [cmdletbinding()] Param( - [Parameter(Mandatory=$True)] - [String]$Tenant, + [Parameter(Mandatory=$False)] + [String]$Tenant="Common", [Parameter(ParameterSetName='Credentials',Mandatory=$False)] [System.Management.Automation.PSCredential]$Credentials, [Parameter(ParameterSetName='PRT',Mandatory=$True)] @@ -654,15 +814,38 @@ function Get-AccessTokenForOneDrive [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "https://$Tenant-my.sharepoint.com/" -ClientId "ab9b8c07-8f02-4f72-87fa-80105867a763" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://$Tenant-my.sharepoint.com/" -ClientId "ab9b8c07-8f02-4f72-87fa-80105867a763" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -721,17 +904,40 @@ function Get-AccessTokenForAzureCoreManagement [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://management.core.windows.net/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -798,7 +1004,28 @@ function Get-AccessTokenForSPO [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { @@ -807,7 +1034,7 @@ function Get-AccessTokenForSPO #$clientId = "9bc3ab49-b65d-410a-85ad-de819febfddc" # SPO Management shell $clientId = "d3590ed6-52b3-4102-aeff-aad2292ab01c" # Microsoft Office - $graphTokens = Get-AccessToken -Resource "https://graph.microsoft.com" -ClientId $clientId -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True -OTPSecretKey $OTPSecretKey -TAP $TAP + $graphTokens = Get-AccessToken -Resource "https://graph.microsoft.com" -ClientId $clientId -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True -OTPSecretKey $OTPSecretKey -TAP $TAP -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH # Get SPO root site url $response = Call-MSGraphAPI -AccessToken $graphTokens[0] -ApiVersion Beta -API "sites/root" -QueryString "select=webUrl" @@ -860,14 +1087,37 @@ function Get-AccessTokenForMySignins [String]$KerberosTicket, [Parameter(ParameterSetName='Kerberos',Mandatory=$True)] [String]$Domain, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - return Get-AccessToken -ClientId 1b730954-1685-4b74-9bfd-dac224a7b894 -Resource "0000000c-0000-0000-c000-000000000000" -ForceMFA $true -Credentials $Credentials -SaveToCache $SaveToCache -KerberosTicket $KerberosTicket -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -ClientId 1b730954-1685-4b74-9bfd-dac224a7b894 -Resource "0000000c-0000-0000-c000-000000000000" -ForceMFA $true -Credentials $Credentials -SaveToCache $SaveToCache -KerberosTicket $KerberosTicket -Domain $Domain -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -935,6 +1185,8 @@ function Get-AccessTokenForAADJoin [switch]$UseDeviceCode, [Parameter(ParameterSetName='BPRT',Mandatory=$True)] [string]$BPRT, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [Parameter(Mandatory=$False)] [String]$Tenant, [switch]$SaveToCache, @@ -942,7 +1194,28 @@ function Get-AccessTokenForAADJoin [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { @@ -952,7 +1225,7 @@ function Get-AccessTokenForAADJoin } else { - Get-AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -ForceMFA $ForceMFA -BPRT $BPRT -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -ClientID "1b730954-1685-4b74-9bfd-dac224a7b894" -Resource "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -ForceMFA $ForceMFA -BPRT $BPRT -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } } @@ -1052,11 +1325,32 @@ function Get-AccessTokenForIntuneMDM [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -ClientId "29d9ed98-a469-4536-ade2-f981bc1d605e" -Resource $Resource -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Certificate $Certificate -PfxFileName $PfxFileName -PfxPassword $PfxPassword -BPRT $BPRT -ForceMFA $ForceMFA -TransportKeyFileName $TransportKeyFileName -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -ClientId "29d9ed98-a469-4536-ade2-f981bc1d605e" -Resource $Resource -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -Certificate $Certificate -PfxFileName $PfxFileName -PfxPassword $PfxPassword -BPRT $BPRT -ForceMFA $ForceMFA -TransportKeyFileName $TransportKeyFileName -OTPSecretKey $OTPSecretKey -TAP $TAP -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1113,18 +1407,41 @@ function Get-AccessTokenForCloudShell [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # First, get an access token for admin.microsoft.com - $response = Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + $response = Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH if([string]::IsNullOrEmpty($response.Tenant)) { @@ -1132,7 +1449,7 @@ function Get-AccessTokenForCloudShell } # Get access token for management.core.windows.net using Admin API - Get-AccessTokenUsingAdminAPI -AccessToken $access_token -Resource "https://management.core.windows.net/" -SaveToCache $SaveToCache + Get-AccessTokenUsingAdminAPI -AccessToken $access_token -Resource "https://management.core.windows.net/" -SaveToCache $SaveToCache -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE } } @@ -1188,6 +1505,8 @@ function Get-AccessTokenForTeams [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, @@ -1197,11 +1516,32 @@ function Get-AccessTokenForTeams [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource $Resource -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource $Resource -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1262,15 +1602,36 @@ function Get-AccessTokenForAADIAMAPI [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # First get the access token for AADGraph - $AccessTokens = Get-AccessToken -Resource "https://graph.windows.net" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True + $AccessTokens = Get-AccessToken -Resource "https://graph.windows.net" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -IncludeRefreshToken $True -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH # Get the actual token - $AccessToken = Get-AccessTokenWithRefreshToken -Resource "74658136-14ec-4630-ad9b-26e160ff0fc6" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SaveToCache $SaveToCache -RefreshToken $AccessTokens[1] -TenantId (Read-Accesstoken $AccessTokens[0]).tid + $AccessToken = Get-AccessTokenWithRefreshToken -Resource "74658136-14ec-4630-ad9b-26e160ff0fc6" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -SaveToCache $SaveToCache -RefreshToken $AccessTokens[1] -TenantId (Read-Accesstoken $AccessTokens[0]).tid -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE if(!$SaveToCache) { @@ -1328,17 +1689,40 @@ function Get-AccessTokenForMSCommerce [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "aeb86249-8ea3-49e2-900b-54cc8e308f85" -ClientId "3d5cffa9-04da-4657-8cab-c7f074657cad" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "aeb86249-8ea3-49e2-900b-54cc8e308f85" -ClientId "3d5cffa9-04da-4657-8cab-c7f074657cad" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1391,18 +1775,41 @@ function Get-AccessTokenForMSPartner [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { # The correct client id would be 4990cffe-04e8-4e8b-808a-1175604b879f but that flow doesn't work :( - Get-AccessToken -Resource "fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "fa3d9a0c-3fb0-42cc-9193-47c7ecd2edbd" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1455,17 +1862,40 @@ function Get-AccessTokenForAdmin [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://admin.microsoft.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1518,17 +1948,40 @@ function Get-AccessTokenForOneNote [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "https://onenote.com" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://onenote.com" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1581,17 +2034,40 @@ function Get-AccessTokenForAccessPackages [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "https://elm.iga.azure.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "https://elm.iga.azure.com" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1621,7 +2097,7 @@ function Get-AccessTokenForWHfB [System.Management.Automation.PSCredential]$Credentials, [switch]$SaveToCache, [Parameter(Mandatory=$False)] - [String]$Tenant, + [String]$Tenant="common", [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] @@ -1630,7 +2106,7 @@ function Get-AccessTokenForWHfB Process { # Prompt credentials as that's the only allowed method - $response = Prompt-Credentials -ClientID "dd762716-544d-4aeb-a526-687b73838a22" -Resource "urn:ms-drs:enterpriseregistration.windows.net" -RefreshTokenCredential $PRTToken -ForceNGCMFA $True -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP + $response = Prompt-Credentials -ClientID "dd762716-544d-4aeb-a526-687b73838a22" -Resource "urn:ms-drs:enterpriseregistration.windows.net" -RefreshTokenCredential $PRTToken -ForceNGCMFA $True -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -Tenant $Tenant $parsedAccessToken = Read-Accesstoken -AccessToken $response.access_token if([string]::IsNullOrEmpty($parsedAccessToken.DeviceId)) @@ -1696,17 +2172,40 @@ function Get-AccessTokenForCompliance [String]$Domain, [Parameter(ParameterSetName='DeviceCode',Mandatory=$True)] [switch]$UseDeviceCode, + [Parameter(ParameterSetName='MSAL',Mandatory=$True)] + [switch]$UseMSAL, [switch]$SaveToCache, [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] [string]$OTPSecretKey, [Parameter(Mandatory=$False)] - [string]$TAP + [string]$TAP, + + # PRT + SessionKey + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [String]$RefreshToken, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$True)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$False)] + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(ParameterSetName='PRT_Skey',Mandatory=$False)] + [Parameter(ParameterSetName='PRT_Settings',Mandatory=$True)] + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [switch]$CAE, + + # ESTS + [Parameter(ParameterSetName='ESTS',Mandatory=$True)] + [string]$ESTSAUTH ) Process { - Get-AccessToken -Resource "80ccca67-54bd-44ab-8625-4b79c4dc7775" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP + Get-AccessToken -Resource "80ccca67-54bd-44ab-8625-4b79c4dc7775" -ClientId "1fec8e78-bce4-4aaf-ab1b-5451cc387264" -KerberosTicket $KerberosTicket -Domain $Domain -SAMLToken $SAMLToken -Credentials $Credentials -SaveToCache $SaveToCache -Tenant $Tenant -PRTToken $PRTToken -UseDeviceCode $UseDeviceCode -OTPSecretKey $OTPSecretKey -TAP $TAP -UseMSAL $UseMSAL -RefreshToken $RefreshToken -SessionKey $SessionKey -Settings $Settings -CAE $CAE -ESTSAUTH $ESTSAUTH } } @@ -1746,7 +2245,7 @@ function Get-AccessToken [Parameter(Mandatory=$True)] [String]$ClientId, [Parameter(Mandatory=$False)] - [String]$Tenant, + [String]$Tenant="common", [Parameter(Mandatory=$False)] [String]$KerberosTicket, [Parameter(Mandatory=$False)] @@ -1790,7 +2289,22 @@ function Get-AccessToken [Parameter(Mandatory=$False)] [string]$ESTSAUTH, [Parameter(Mandatory=$False)] - [string]$SubScope + [string]$SubScope, + [Parameter(Mandatory=$False)] + [bool]$UseMSAL=$false, + + # PRT + SessionKey + [Parameter(Mandatory=$False)] + [String]$RefreshToken, + [Parameter(Mandatory=$False)] + [String]$SessionKey, + [Parameter(Mandatory=$False)] + $Settings, + + # Continuous Access Evaluation + [Parameter(Mandatory=$False)] + [bool]$CAE + ) Begin { @@ -1818,42 +2332,68 @@ function Get-AccessToken } Process { - - + # Check the tenant id + if([string]::IsNullOrEmpty($Tenant)) + { + $Tenant = "common" + } if(![String]::IsNullOrEmpty($KerberosTicket)) # Check if we got the kerberos token { # Get token using the kerberos token - if([string]::IsNullOrEmpty($Tenant)) - { - $Tenant = "common" - } $OAuthInfo = Get-AccessTokenWithKerberosTicket -KerberosTicket $KerberosTicket -Domain $Domain -Resource $Resource -ClientId $ClientId -Tenant $Tenant $access_token = $OAuthInfo.access_token } elseif(![String]::IsNullOrEmpty($PRTToken)) # Check if we got a PRT token { # Get token using the PRT token - $OAuthInfo = Get-AccessTokenWithPRT -Cookie $PRTToken -Resource $Resource -ClientId $ClientId -Tenant $Tenant + $OAuthInfo = Get-AccessTokenWithPRTToken -Cookie $PRTToken -Resource $Resource -ClientId $ClientId -Tenant $Tenant -SubScope $SubScope + $access_token = $OAuthInfo.access_token + } + # Check if we got a PRT and session key + elseif(![String]::IsNullOrEmpty($Settings) -or (![String]::IsNullOrEmpty($RefreshToken) -and ![String]::IsNullOrEmpty($SessionKey))) + { + if($Settings) + { + $RefreshToken = $Settings.refresh_token + $SessionKey = $Settings.session_key + } + + # Get token using the PRT token + $OAuthInfo = Get-AccessTokenWithSignedPRTRequest -Resource $Resource -ClientId $ClientId -SubScope $SubScope -RefreshToken $RefreshToken -SessionKey $SessionKey -CAE $CAE $access_token = $OAuthInfo.access_token } elseif($UseDeviceCode) # Check if we want to use device code flow { # Get token using device code - $OAuthInfo = Get-AccessTokenUsingDeviceCode -Resource $Resource -ClientId $ClientId -Tenant $Tenant + $OAuthInfo = Get-AccessTokenUsingDeviceCode -Resource $Resource -ClientId $ClientId -Tenant $Tenant -CAE $CAE $access_token = $OAuthInfo.access_token } elseif($UseIMDS) # Check if we want to use IMDS { # Get token using Azure Instance Metadata Service (IMDS) - $access_token = Get-AccessTokenUsingIMDS -ClientId $MsiClientId -ObjectId $MsiObjectId -AzureResourceId $MsiResId -Resource $Resource + $OAuthInfo = @{ + "refresh_token" = $null + "access_token" = Get-AccessTokenUsingIMDS -ClientId $MsiClientId -ObjectId $MsiObjectId -AzureResourceId $MsiResId -Resource $Resource + } + $access_token = $OAuthInfo.access_token } elseif(![String]::IsNullOrEmpty($BPRT)) # Check if we got a BPRT { # Get token using BPRT $OAuthInfo = @{ "refresh_token" = $BPRT - "access_token" = Get-AccessTokenWithRefreshToken -Resource "urn:ms-drs:enterpriseregistration.windows.net" -ClientId "b90d5b8f-5503-4153-b545-b31cecfaece2" -TenantId "Common" -RefreshToken $BPRT -SubScope $SubScope + "access_token" = Get-AccessTokenWithRefreshToken -Resource "urn:ms-drs:enterpriseregistration.windows.net" -ClientId "b90d5b8f-5503-4153-b545-b31cecfaece2" -TenantId "Common" -RefreshToken $BPRT -SubScope $SubScope -CAE $CAE + } + $access_token = $OAuthInfo.access_token + } + elseif($UseMSAL) # Use MSAL + { + # Get token using Microsoft Authentication Library + $response = Get-AccessTokenUsingMSAL -TenantId $Tenant -ClientId $ClientId -Resource $Resource -RedirectUri $RedirectUri -SubScope $SubScope -CAE $CAE + $OAuthInfo = @{ + "refresh_token" = $null + "access_token" = $response.AccessToken } $access_token = $OAuthInfo.access_token } @@ -1867,7 +2407,7 @@ function Get-AccessToken elseif(![string]::IsNullOrEmpty($ESTSAUTH)) { # Get token using ESTSAUTH - $OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -RedirectURI $RedirectUri -SubScope $SubScope -ESTSAUTH $ESTSAUTH + $OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -RedirectURI $RedirectUri -SubScope $SubScope -ESTSAUTH $ESTSAUTH -CAE $CAE } else { @@ -1877,11 +2417,11 @@ function Get-AccessToken ($ClientId -eq "29d9ed98-a469-4536-ade2-f981bc1d605e" -and $Resource -eq "https://enrollment.manage.microsoft.com/") <# MDM #> ) { - $OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope + $OAuthInfo = Prompt-Credentials -Resource $Resource -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope -CAE $CAE } else { - $OAuthInfo = Prompt-Credentials -Resource "https://graph.windows.net" -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope + $OAuthInfo = Prompt-Credentials -Resource "https://graph.windows.net" -ClientId $ClientId -Tenant $Tenant -ForceMFA $ForceMFA -ForceNGCMFA $ForceNGCMFA -Credentials $Credentials -OTPSecretKey $OTPSecretKey -TAP $TAP -RedirectURI $RedirectUri -SubScope $SubScope -CAE $CAE } # Just return null @@ -1907,7 +2447,7 @@ function Get-AccessToken # If the token client id or resource is different than requested, get correct one using refresh token if(($ParsedToken.appid -ne $ClientId) -or ($ParsedToken.aud -ne $Resource)) { - $tokens = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientId -TenantId $tenant_id -RefreshToken $RefreshToken -SaveToCache $SaveToCache -IncludeRefreshToken $true -SubScope $SubScope + $tokens = Get-AccessTokenWithRefreshToken -Resource $Resource -ClientId $ClientId -TenantId $tenant_id -RefreshToken $RefreshToken -SaveToCache $SaveToCache -IncludeRefreshToken $true -SubScope $SubScope -CAE $CAE $OAuthInfo = [pscustomobject]@{ "access_token" = $tokens[0] "refresh_token" = $tokens[1] @@ -2058,7 +2598,9 @@ function Get-AccessTokenWithRefreshToken [Parameter(Mandatory=$False)] [bool]$IncludeRefreshToken = $false, [Parameter(Mandatory=$False)] - [String]$SubScope + [String]$SubScope, + [Parameter(Mandatory=$False)] + [bool]$CAE ) Process { @@ -2071,6 +2613,12 @@ function Get-AccessTokenWithRefreshToken "scope"= "openid" } + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + if($ClientId -eq "ab9b8c07-8f02-4f72-87fa-80105867a763") # OneDrive Sync Engine { $url = "https://login.windows.net/common/oauth2/token" @@ -2142,7 +2690,9 @@ function Get-AccessTokenUsingDeviceCode [Parameter(Mandatory=$False)] [String]$Tenant, [Parameter(Mandatory=$False)] - [String]$Resource="https://graph.windows.net" + [String]$Resource="https://graph.windows.net", + [Parameter(Mandatory=$False)] + [bool]$CAE ) Process { @@ -2176,6 +2726,12 @@ function Get-AccessTokenUsingDeviceCode "resource" = $Resource } + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + # Loop while pending or until timeout exceeded while($continue) @@ -2221,84 +2777,6 @@ function Get-AccessTokenUsingDeviceCode } } -# Gets the access token using an authorization code -# Feb 12th 2021 -function Get-AccessTokenWithAuthorizationCode -{ - [cmdletbinding()] - Param( - [String]$Resource, - [Parameter(Mandatory=$True)] - [String]$ClientId, - [Parameter(Mandatory=$True)] - [String]$TenantId, - [Parameter(Mandatory=$True)] - [String]$AuthorizationCode, - [Parameter(Mandatory=$False)] - [bool]$SaveToCache = $false, - [Parameter(Mandatory=$False)] - [bool]$IncludeRefreshToken = $false, - [Parameter(Mandatory=$False)] - [String]$RedirectUri, - [Parameter(Mandatory=$False)] - [String]$CodeVerifier - ) - Process - { - $headers = @{ - } - - # Set the body for API call - $body = @{ - "resource"= $Resource - "client_id"= $ClientId - "grant_type"= "authorization_code" - "code"= $AuthorizationCode - "scope"= "openid profile email" - } - if(![string]::IsNullOrEmpty($RedirectUri)) - { - $body["redirect_uri"] = $RedirectUri - $headers["Origin"] = $RedirectUri - } - - if(![string]::IsNullOrEmpty($CodeVerifier)) - { - $body["code_verifier"] = $CodeVerifier - $body["code_challenge_method"] = "S256" - } - - if($ClientId -eq "ab9b8c07-8f02-4f72-87fa-80105867a763") # OneDrive Sync Engine - { - $url = "https://login.windows.net/common/oauth2/token" - } - else - { - $url = "https://login.microsoftonline.com/$TenantId/oauth2/token" - } - - # Debug - Write-Debug "ACCESS TOKEN BODY: $($body | Out-String)" - - # Set the content type and call the API - $contentType = "application/x-www-form-urlencoded" - $response = Invoke-RestMethod -UseBasicParsing -Uri $url -ContentType $contentType -Method POST -Body $body -Headers $headers - - # Debug - Write-Debug "ACCESS TOKEN RESPONSE: $response" - - # Save the tokens to cache - if($SaveToCache) - { - Write-Verbose "ACCESS TOKEN: SAVE TO CACHE" - Add-AccessTokenToCache -AccessToken $response.access_token -RefreshToken $response.refresh_token -ShowCache $false - } - - # Return - return $response.access_token - } -} - # Gets the access token using device SAML token # Feb 18th 2021 function Get-AccessTokenWithDeviceSAML @@ -2713,7 +3191,7 @@ function Get-AppConsentInfo .Example PS C:\>$creds = Get-Credential - PS C:\>Get-AppConsentInfo -Credentials $creds -ClientId "5a2d9517-0fe6-48ea-b09c-3c5ae4a3e7dc" + PS C:\>Get-AADIntAppConsentInfo -Credentials $creds -ClientId "5a2d9517-0fe6-48ea-b09c-3c5ae4a3e7dc" Name : www.myo365.site VerifiedPublisher : Gerenios Oy diff --git a/AccessToken_utils.ps1 b/AccessToken_utils.ps1 index 73292b8..3be005a 100644 --- a/AccessToken_utils.ps1 +++ b/AccessToken_utils.ps1 @@ -643,13 +643,7 @@ function Is-AccessTokenValid $dataToVerify="{0}.{1}" -f $header,$payload $dataBin = [text.encoding]::UTF8.GetBytes($dataToVerify) - # Remove the Base64 URL encoding from the signature and add padding - $signature=$signature.Replace("-","+").Replace("_","/") - while ($signature.Length % 4) - { - $signature += "=" - } - $signBytes = [convert]::FromBase64String($signature) + $signBytes = Convert-B64ToByteArray -B64 $signature # Extract the modulus and exponent from the certificate for($a=0;$a -lt $certBin.Length ; $a++) @@ -739,7 +733,9 @@ function Get-OAuthInfoUsingSAML [Parameter(Mandatory=$True)] [String]$Resource, [Parameter(Mandatory=$False)] - [String]$ClientId="1b730954-1685-4b74-9bfd-dac224a7b894" + [String]$ClientId="1b730954-1685-4b74-9bfd-dac224a7b894", + [Parameter(Mandatory=$False)] + [bool]$CAE ) Begin { @@ -764,6 +760,12 @@ function Get-OAuthInfoUsingSAML "scope"="openid" } + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + # Debug Write-Debug "FED AUTHENTICATION BODY: $($body | Out-String)" @@ -782,317 +784,6 @@ function Get-OAuthInfoUsingSAML } } -# Return OAuth information for the given user -function Get-OAuthInfo -{ - [cmdletbinding()] - Param( - [Parameter(Mandatory=$True)] - [System.Management.Automation.PSCredential]$Credentials, - [Parameter(Mandatory=$True)] - [String]$Resource, - [Parameter(Mandatory=$False)] - [String]$ClientId="1b730954-1685-4b74-9bfd-dac224a7b894", - [Parameter(Mandatory=$False)] - [String]$Tenant="common" - ) - Begin - { - # Create the headers. We like to be seen as Outlook. - $headers = @{ - "User-Agent" = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; Tablet PC 2.0; Microsoft Outlook 16.0.4266)" - } - - if([string]::IsNullOrEmpty($Tenant)) - { - $Tenant="common" - } - } - Process - { - # Get the user realm - $userRealm = Get-UserRealm($Credentials.UserName) - - # Check the authentication type - if($userRealm.account_type -eq "Unknown") - { - Write-Error "User type of $($Credentials.Username) is Unknown!" - return $null - } - elseif($userRealm.account_type -eq "Managed") - { - # If authentication type is managed, we authenticate directly against Microsoft Online - # with user name and password to get access token - - # Create a body for REST API request - $body = @{ - "resource"=$Resource - "client_id"=$ClientId - "grant_type"="password" - "username"=$Credentials.UserName - "password"=$Credentials.GetNetworkCredential().Password - "scope"="openid" - } - - # Debug - Write-Debug "AUTHENTICATION BODY: $($body | Out-String)" - - # Set the content type and call the Microsoft Online authentication API - $contentType="application/x-www-form-urlencoded" - try - { - $jsonResponse=Invoke-RestMethod -UseBasicParsing -Uri "https://login.microsoftonline.com/$Tenant/oauth2/token" -ContentType $contentType -Method POST -Body $body -Headers $headers - } - catch - { - Throw ($_.ErrorDetails.Message | convertfrom-json).error_description - } - } - else - { - # If authentication type is Federated, we must first authenticate against the identity provider - # to fetch SAML token and then get access token from Microsoft Online - - # Get the federation metadata url from user realm - $federation_metadata_url=$userRealm.federation_metadata_url - - # Call the API to get metadata - [xml]$response=Invoke-RestMethod -UseBasicParsing -Uri $federation_metadata_url - - # Get the url of identity provider endpoint. - # Note! Tested only with AD FS - others may or may not work - $federation_url=($response.definitions.service.port | where name -eq "UserNameWSTrustBinding_IWSTrustFeb2005Async").address.location - - # login.live.com - # TODO: Fix - #$federation_url=$response.EntityDescriptor.RoleDescriptor[1].PassiveRequestorEndpoint.EndpointReference.Address - - # Set credentials and other needed variables - $username=$Credentials.UserName - $password=$Credentials.GetNetworkCredential().Password - $created=(Get-Date).ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") - $expires=(Get-Date).AddMinutes(10).ToUniversalTime().toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") - $message_id=(New-Guid).ToString() - $user_id=(New-Guid).ToString() - - # Set headers - $headers = @{ - "SOAPAction"="http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue" - "Host"=$federation_url.Split("/")[2] - "client-request-id"=(New-Guid).toString() - } - - # Debug - Write-Debug "FED AUTHENTICATION HEADERS: $($headers | Out-String)" - - # Create the SOAP envelope - $envelope=@" - - - http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue - urn:uuid:$message_id - - http://www.w3.org/2005/08/addressing/anonymous - - $federation_url - - - $created - $expires - - - $username - $password - - - - - - - - urn:federation:MicrosoftOnline - - - http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey - http://schemas.xmlsoap.org/ws/2005/02/trust/Issue - - - -"@ - # Debug - Write-Debug "FED AUTHENTICATION: $envelope" - - # Set the content type and call the authentication service - $contentType="application/soap+xml" - [xml]$xmlResponse=Invoke-RestMethod -UseBasicParsing -Uri $federation_url -ContentType $contentType -Method POST -Body $envelope -Headers $headers - - # Get the SAML token from response and encode it with Base64 - $samlToken=$xmlResponse.Envelope.Body.RequestSecurityTokenResponse.RequestedSecurityToken.Assertion.OuterXml - $encodedSamlToken= [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($samlToken)) - - $jsonResponse = Get-OAuthInfoUsingSAML -SAMLToken $samlToken -Resource $Resource -ClientId $ClientId - } - - # Debug - Write-Debug "AUTHENTICATION JSON: $($jsonResponse | Out-String)" - - # Return - $jsonResponse - } -} - -# Parse access token and return it as PS object -function Read-Accesstoken -{ -<# - .SYNOPSIS - Extract details from the given Access Token - - .DESCRIPTION - Extract details from the given Access Token and returns them as PS Object - - .Parameter AccessToken - The Access Token. - - .Example - PS C:\>$token=Get-AADIntReadAccessTokenForAADGraph - PS C:\>Parse-AADIntAccessToken -AccessToken $token - - aud : https://graph.windows.net - iss : https://sts.windows.net/f2b2ba53-ed2a-4f4c-a4c3-85c61e548975/ - iat : 1589477501 - nbf : 1589477501 - exp : 1589481401 - acr : 1 - aio : ASQA2/8PAAAALe232Yyx9l= - amr : {pwd} - appid : 1b730954-1685-4b74-9bfd-dac224a7b894 - appidacr : 0 - family_name : company - given_name : admin - ipaddr : 107.210.220.129 - name : admin company - oid : 1713a7bf-47ba-4826-a2a7-bbda9fabe948 - puid : 100354 - rh : 0QfALA. - scp : user_impersonation - sub : BGwHjKPU - tenant_region_scope : NA - tid : f2b2ba53-ed2a-4f4c-a4c3-85c61e548975 - unique_name : admin@company.onmicrosoft.com - upn : admin@company.onmicrosoft.com - uti : -EWK6jMDrEiAesWsiAA - ver : 1.0 - - .Example - PS C:\>Parse-AADIntAccessToken -AccessToken $token -Validate - - Read-Accesstoken : Access Token is expired - At line:1 char:1 - + Read-Accesstoken -AccessToken $at -Validate -verbose - + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException - + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Read-Accesstoken - - aud : https://graph.windows.net - iss : https://sts.windows.net/f2b2ba53-ed2a-4f4c-a4c3-85c61e548975/ - iat : 1589477501 - nbf : 1589477501 - exp : 1589481401 - acr : 1 - aio : ASQA2/8PAAAALe232Yyx9l= - amr : {pwd} - appid : 1b730954-1685-4b74-9bfd-dac224a7b894 - appidacr : 0 - family_name : company - given_name : admin - ipaddr : 107.210.220.129 - name : admin company - oid : 1713a7bf-47ba-4826-a2a7-bbda9fabe948 - puid : 100354 - rh : 0QfALA. - scp : user_impersonation - sub : BGwHjKPU - tenant_region_scope : NA - tid : f2b2ba53-ed2a-4f4c-a4c3-85c61e548975 - unique_name : admin@company.onmicrosoft.com - upn : admin@company.onmicrosoft.com - uti : -EWK6jMDrEiAesWsiAA - ver : 1.0 -#> - [cmdletbinding()] - Param( - [Parameter(Mandatory=$True,ValueFromPipeline)] - [String]$AccessToken, - [Parameter()] - [Switch]$ShowDate, - [Parameter()] - [Switch]$Validate - - ) - Process - { - if([string]::IsNullOrEmpty($AccessToken)) - { - Write-Warning "Unable to read access token (null or empty)" - return $null - } - # Token sections - $sections = $AccessToken.Split(".") - if($sections.Count -eq 5) - { - Write-Warning "JWE token, expected JWS. Unable to parse." - return - } - $header = $sections[0] - $payload = $sections[1] - $signature = $sections[2] - - # Convert the token to string and json - $payloadString = Convert-B64ToText -B64 $payload - $payloadObj=$payloadString | ConvertFrom-Json - - if($ShowDate) - { - # Show dates - $payloadObj.exp=($epoch.Date.AddSeconds($payloadObj.exp)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") - $payloadObj.iat=($epoch.Date.AddSeconds($payloadObj.iat)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") - $payloadObj.nbf=($epoch.Date.AddSeconds($payloadObj.nbf)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") - } - - if($Validate) - { - # Check the signature - if((Is-AccessTokenValid -AccessToken $AccessToken)) - { - Write-Verbose "Access Token signature successfully verified" - } - else - { - Write-Error "Access Token signature could not be verified" - } - - # Check the timestamp - if((Is-AccessTokenExpired -AccessToken $AccessToken)) - { - Write-Error "Access Token is expired" - } - else - { - Write-Verbose "Access Token is not expired" - } - - } - - # Debug - Write-Debug "PARSED ACCESS TOKEN: $($payloadObj | Out-String)" - - # Return - $payloadObj - } -} - - # Prompts for credentials and gets the access token # Supports MFA. function Prompt-Credentials @@ -1103,7 +794,7 @@ function Prompt-Credentials [String]$Resource, [Parameter(Mandatory=$False)] [String]$ClientId, - [Parameter(Mandatory=$False)] + [Parameter(Mandatory=$True)] [String]$Tenant, [Parameter(Mandatory=$False)] [bool]$ForceMFA=$false, @@ -1122,7 +813,9 @@ function Prompt-Credentials [Parameter(Mandatory=$False)] [string]$SubScope, [Parameter(Mandatory=$False)] - [string]$ESTSAUTH + [string]$ESTSAUTH, + [Parameter(Mandatory=$False)] + [bool]$CAE ) Process { @@ -1154,6 +847,12 @@ function Prompt-Credentials "scope"="openid" } + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + # Debug Write-Debug "AUTHENTICATION BODY: $($body | Out-String)" @@ -1165,7 +864,7 @@ function Prompt-Credentials } try { - $response=Invoke-RestMethod -UseBasicParsing -Uri "https://login.microsoftonline.com/common/oauth2/token" -Method POST -Body $body -Headers $headers + $response=Invoke-RestMethod -UseBasicParsing -Uri "https://login.microsoftonline.com/$tenant/oauth2/token" -Method POST -Body $body -Headers $headers } catch { @@ -1200,6 +899,13 @@ function Prompt-Credentials redirect_uri = $RedirectURI } + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + + # Headers $headers = @{ "Content-Type" = "application/x-www-form-urlencoded" @@ -3158,4 +2864,116 @@ function Get-TenantLoginUrl } } } +} + +# Jan 13th 2025 +# Get access token using MSAL +function Get-AccessTokenUsingMSAL +{ + [cmdletbinding()] + Param( + [Parameter(Mandatory=$false)] + [String]$TenantId="common", + [Parameter(Mandatory=$true)] + [String]$Resource, + [Parameter(Mandatory=$true)] + [String]$ClientId, + [Parameter(Mandatory=$false)] + [String]$RedirectUri, + [Parameter(Mandatory=$false)] + [String]$SubScope, + [Parameter(Mandatory=$false)] + [bool]$CAE + ) + Begin + { + # Load MSAL dll + Add-Type -Path "$PSScriptRoot\Microsoft.Identity.Client.dll" + } + Process + { + if([string]::IsNullOrEmpty($RedirectUri)) + { + $RedirectUri = Get-AuthRedirectUrl -ClientId $ClientId -Resource $Resource + } + + $options = [Microsoft.Identity.Client.PublicClientApplicationOptions]::new() + $options.ClientId = $ClientId + $options.TenantId = $TenantId + $options.RedirectUri = $RedirectUri + $options.AzureCloudInstance = Get-MSALAzureScope -SubScope $SubScope + + if($CAE) + { + $options.ClientCapabilities = [string[]]"cp1" + } + + $builder = [Microsoft.Identity.Client.PublicClientApplicationBuilder]::CreateWithApplicationOptions($options) + $app = $builder.Build() + $tokenParameters = $app.AcquireTokenInteractive([string[]]"$Resource/.default") + $result = $tokenParameters.ExecuteAsync() + + return $result.Result + } +} + + +# Jan 13th 2025 +# Returns MSAL Azure Scope based on subscope +function Get-MSALAzureScope +{ + [cmdletbinding()] + Param( + [Parameter(Mandatory=$false)] + [String]$SubScope + ) + Process + { + # Return AzureCloudInstance + # Ref: https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.azurecloudinstance?view=msal-dotnet-latest + switch($SubScope) + { + "DOD" # DoD + { + return 4 + } + "DODCON" # GCC-High + { + return 4 + } + default # Commercial/GCC + { + return 1 + } + } + } +} + +# Returns CAE claims +# Feb 5th 2024 +function Get-CAEClaims +{ + [cmdletbinding()] + Param( + [Parameter(Mandatory=$false)] + [String]$SubScope + ) + Process + { + # Claims + $claims = @{ + "access_token" = @{ + "xms_cc" = @{ + "values" = @("cp1") + } + } + "id_token" = @{ + "xms_cc" = @{ + "values" = @("cp1") + } + } + } + + return ConvertTo-Json -InputObject $claims -Depth 10 -Compress + } } \ No newline at end of file diff --git a/CommonUtils.ps1 b/CommonUtils.ps1 index 59ca38a..053e7ad 100644 --- a/CommonUtils.ps1 +++ b/CommonUtils.ps1 @@ -569,9 +569,18 @@ Function Convert-PEMToRSA process { $pemReader = [Org.BouncyCastle.OpenSsl.PemReader]::new([System.IO.StringReader]::new($PEM)) - $keys = $pemReader.ReadObject() + $RSA = $pemReader.ReadObject() - $RSAParameters = [Org.BouncyCastle.Security.DotNetUtilities]::ToRSAParameters($keys.Private) + # Certificate + if($RSA.GetType().Name -eq "X509Certificate") + { + $RSAParameters = [Org.BouncyCastle.Security.DotNetUtilities]::ToRSAParameters($RSA.GetPublicKey()) + } + # Privatekey + else + { + $RSAParameters = [Org.BouncyCastle.Security.DotNetUtilities]::ToRSAParameters($RSA.Private) + } $pemReader.Reader.Dispose() @@ -1162,14 +1171,26 @@ function Get-Digest [cmdletbinding()] Param( [Parameter(Mandatory=$True)] - [String]$Data + [PSObject]$Data ) Process { + if($Data -is [String]) + { + $binData = [text.encoding]::UTF8.GetBytes([String]$Data) + } + elseif($Data -is [Byte[]]) + { + $binData = $Data + } + else + { + Throw "Data must be either String or ByteArray" + } # Compute SHA1 digest $SHA1 = [System.Security.Cryptography.SHA1Managed]::Create() - $digest = $SHA1.ComputeHash([text.encoding]::UTF8.GetBytes($Data)) + $digest = $SHA1.ComputeHash($binData) $SHA1.Dispose() @@ -1693,11 +1714,11 @@ function Get-BinaryContent #return [System.IO.File]::ReadAllBytes([System.IO.Path]::GetFullPath($Path)) if($PSVersionTable.PSVersion.Major -ge 6) { - Get-Content -Path $Path -AsByteStream -Raw + Get-Content -Path $Path -AsByteStream -Raw -ErrorAction $ErrorActionPreference } else { - Get-Content -Path $Path -Encoding Byte + Get-Content -Path $Path -Encoding Byte -ErrorAction $ErrorActionPreference } } } @@ -1716,11 +1737,11 @@ function Set-BinaryContent { if($PSVersionTable.PSVersion.Major -ge 6) { - Set-Content -Path $Path -Value $Value -AsByteStream + Set-Content -Path $Path -Value $Value -AsByteStream -ErrorAction $ErrorActionPreference } else { - Set-Content -Path $Path -Value $Value -Encoding Byte + Set-Content -Path $Path -Value $Value -Encoding Byte -ErrorAction $ErrorActionPreference } } } @@ -1869,11 +1890,11 @@ function Set-UserAgent Sets the User-Agent AADInternals will use in requests. .DESCRIPTION - Sets a pre configured User-Agent for a specific device that AADInternals will use in requests. Supported devices: 'Windows','MacOS','Linux','iOS','Android'. + Sets a pre configured User-Agent for a specific device that AADInternals will use in requests. Supported devices: 'Windows','MacOS','Linux','iOS','Android','Default'. To persist, use Save-AADIntConfiguration after setting the User-Agent .Parameter UserAgent - One of 'Windows','MacOS','Linux','iOS','Android' + One of 'Windows','MacOS','Linux','iOS','Android','Default' .Example PS C:\>Set-AADIntUserAgent -Device Windows @@ -1887,7 +1908,7 @@ function Set-UserAgent [cmdletbinding()] param( [parameter(Mandatory=$true)] - [ValidateSet('Windows','MacOS','Linux','iOS','Android')] + [ValidateSet('Windows','MacOS','Linux','iOS','Android','Default')] [string]$Device ) Begin @@ -1898,6 +1919,7 @@ function Set-UserAgent "Linux" = "Mozilla/5.0 (X11; Linux x86_64)" "iOS" = "Mozilla/5.0 (iPhone; CPU iPhone OS 16_5 like Mac OS X)" "Android" = "Mozilla/5.0 (Linux; Android 10)" + "Default" = "AADInternals" } } Process @@ -2594,4 +2616,303 @@ function Convert-SIDtoObjectID Throw "Invalid SID. SID must start with S-1-12-1" } } +} + +# Create a new self-signed certificate +# Jan 31st 2021 +function New-Certificate +{ +<# + .SYNOPSIS + Creates a new self signed certificate. + + .DESCRIPTION + Creates a new self signed certificate for the given subject name and returns it as System.Security.Cryptography.X509Certificates.X509Certificate2 or exports directly to .pfx and .cer files. + The certificate is valid for 100 years. + + .Parameter SubjectName + The subject name of the certificate, MUST start with CN= + + .Parameter Export + Export the certificate (PFX and CER) instead of returning the certificate object. The .pfx file does not have a password. + + .Example + PS C:\>$certificate = New-AADIntCertificate -SubjectName "CN=MyCert" + + .Example + PS C:\>$certificate = New-AADIntCertificate -SubjectName "CN=MyCert" + + PS C:\>$certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx) | Set-Content MyCert.pfx -Encoding Byte + + .Example + PS C:\>$certificate = New-AADIntCertificate -SubjectName "CN=MyCert" + + PS C:\>$certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert) | Set-Content MyCert.cer -Encoding Byte + + .Example + PS C:\>New-AADIntCertificate -SubjectName "CN=MyCert" -Export + + Certificate successfully exported: + CN=MyCert.pfx + CN=MyCert.cer +#> + [cmdletbinding()] + + param( + [parameter(Mandatory=$true,ValueFromPipeline)] + [ValidatePattern("[c|C][n|N]=.+")] # Must start with CN= + [String]$SubjectName, + [Switch]$Export + ) + Process + { + # Create a private key + $rsa = [System.Security.Cryptography.RSA]::Create(2048) + + # Initialize the Certificate Signing Request object + $req = [System.Security.Cryptography.X509Certificates.CertificateRequest]::new($SubjectName, $rsa, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1) + $req.CertificateExtensions.Add([System.Security.Cryptography.X509Certificates.X509BasicConstraintsExtension]::new($true,$false,0,$true)) + $req.CertificateExtensions.Add([System.Security.Cryptography.X509Certificates.X509SubjectKeyIdentifierExtension]::new($req.PublicKey,$false)) + + # Create a self-signed certificate + $selfSigned = $req.CreateSelfSigned((Get-Date).ToUniversalTime().AddMinutes(-5),(Get-Date).ToUniversalTime().AddYears(100)) + + + # Store the private key to so that it can be exported + $cspParameters = [System.Security.Cryptography.CspParameters]::new() + $cspParameters.ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider" + $cspParameters.ProviderType = 24 + $cspParameters.KeyContainerName ="AADInternals" + + # Set the private key + $privateKey = [System.Security.Cryptography.RSACryptoServiceProvider]::new(2048,$cspParameters) + $privateKey.ImportParameters($rsa.ExportParameters($true)) + $selfSigned.PrivateKey = $privateKey + + if($Export) + { + Set-BinaryContent -Path "$SubjectName.pfx" -Value $selfSigned.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx) + Set-BinaryContent -Path "$SubjectName.cer" -Value $selfSigned.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert) + + # Print out information + Write-Host "Certificate successfully exported:" + Write-Host " $SubjectName.pfx" + Write-Host " $SubjectName.cer" + } + else + { + return $selfSigned + } + } +} + + +# Parse access token and return it as PS object +function Read-Accesstoken +{ +<# + .SYNOPSIS + Extract details from the given Access Token + + .DESCRIPTION + Extract details from the given Access Token and returns them as PS Object + + .Parameter AccessToken + The Access Token. + + .Example + PS C:\>$token=Get-AADIntReadAccessTokenForAADGraph + PS C:\>Parse-AADIntAccessToken -AccessToken $token + + aud : https://graph.windows.net + iss : https://sts.windows.net/f2b2ba53-ed2a-4f4c-a4c3-85c61e548975/ + iat : 1589477501 + nbf : 1589477501 + exp : 1589481401 + acr : 1 + aio : ASQA2/8PAAAALe232Yyx9l= + amr : {pwd} + appid : 1b730954-1685-4b74-9bfd-dac224a7b894 + appidacr : 0 + family_name : company + given_name : admin + ipaddr : 107.210.220.129 + name : admin company + oid : 1713a7bf-47ba-4826-a2a7-bbda9fabe948 + puid : 100354 + rh : 0QfALA. + scp : user_impersonation + sub : BGwHjKPU + tenant_region_scope : NA + tid : f2b2ba53-ed2a-4f4c-a4c3-85c61e548975 + unique_name : admin@company.onmicrosoft.com + upn : admin@company.onmicrosoft.com + uti : -EWK6jMDrEiAesWsiAA + ver : 1.0 + + .Example + PS C:\>Parse-AADIntAccessToken -AccessToken $token -Validate + + Read-Accesstoken : Access Token is expired + At line:1 char:1 + + Read-Accesstoken -AccessToken $at -Validate -verbose + + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException + + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Read-Accesstoken + + aud : https://graph.windows.net + iss : https://sts.windows.net/f2b2ba53-ed2a-4f4c-a4c3-85c61e548975/ + iat : 1589477501 + nbf : 1589477501 + exp : 1589481401 + acr : 1 + aio : ASQA2/8PAAAALe232Yyx9l= + amr : {pwd} + appid : 1b730954-1685-4b74-9bfd-dac224a7b894 + appidacr : 0 + family_name : company + given_name : admin + ipaddr : 107.210.220.129 + name : admin company + oid : 1713a7bf-47ba-4826-a2a7-bbda9fabe948 + puid : 100354 + rh : 0QfALA. + scp : user_impersonation + sub : BGwHjKPU + tenant_region_scope : NA + tid : f2b2ba53-ed2a-4f4c-a4c3-85c61e548975 + unique_name : admin@company.onmicrosoft.com + upn : admin@company.onmicrosoft.com + uti : -EWK6jMDrEiAesWsiAA + ver : 1.0 +#> + [cmdletbinding()] + Param( + [Parameter(Mandatory=$True,ValueFromPipeline)] + [String]$AccessToken, + [Parameter()] + [Switch]$ShowDate, + [Parameter()] + [Switch]$Validate + + ) + Process + { + if([string]::IsNullOrEmpty($AccessToken)) + { + Write-Warning "Unable to read access token (null or empty)" + return $null + } + # Token sections + $sections = $AccessToken.Split(".") + + # Check if this is JWE + if($sections.Count -eq 5) + { + Write-Warning "JWE token, expected JWS. Unable to parse." + return + } + $header = $sections[0] + $payload = $sections[1] + $signature = $sections[2] + + # Convert the token to string and json + $payloadString = Convert-B64ToText -B64 $payload + $payloadObj=$payloadString | ConvertFrom-Json + + if($ShowDate) + { + # Show dates + $payloadObj.exp=($epoch.Date.AddSeconds($payloadObj.exp)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") + $payloadObj.iat=($epoch.Date.AddSeconds($payloadObj.iat)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") + $payloadObj.nbf=($epoch.Date.AddSeconds($payloadObj.nbf)).toString("yyyy-MM-ddTHH:mm:ssZ").Replace(".",":") + } + + if($Validate) + { + # Check the signature + if((Is-AccessTokenValid -AccessToken $AccessToken)) + { + Write-Verbose "Access Token signature successfully verified" + } + else + { + Write-Error "Access Token signature could not be verified" + } + + # Check the timestamp + if((Is-AccessTokenExpired -AccessToken $AccessToken)) + { + Write-Error "Access Token is expired" + } + else + { + Write-Verbose "Access Token is not expired" + } + + } + + # Debug + Write-Debug "PARSED ACCESS TOKEN: $($payloadObj | Out-String)" + + # Return + $payloadObj + } +} + +# Converts the given B64 encoded RSA cert or private key to PEM +# Jan 29th 2025 +Function Convert-B64RSAToPem +{ + [cmdletbinding()] + param( + [parameter(Mandatory=$true,ValueFromPipeline)] + [String]$RSA, + [parameter(Mandatory=$false,ValueFromPipeLine)] + [ValidateSet("RSA PRIVATE KEY","CERTIFICATE")] + [String]$Type = "CERTIFICATE" + ) + Process + { + $PEM = "-----BEGIN $Type-----`n" + + $p = 0 + while($p -lt $RSA.Length) + { + $s = $p + $l = 64 + $c = $RSA.Length - $p + if($c -lt 64) + { + $l = $c + } + $line = $RSA.Substring($s,$l) + $PEM += "$line`n" + + $p += 64 + } + + $PEM += "-----END $Type-----`n" + + return $PEM + + } +} + +# Gets the thumbprint of the given B64 encoded RSA certificate +# Jan 29th 2025 +Function Get-B64RSAThumbprint +{ + [cmdletbinding()] + param( + [parameter(Mandatory=$true,ValueFromPipeline)] + [String]$RSA + ) + Process + { + $binRSA = [byte[]](Convert-B64ToByteArray -B64 $RSA) + $thumbprint = Get-Digest -Data $binRSA + + return $thumbprint + } } \ No newline at end of file diff --git a/Microsoft.Identity.Client.dll b/Microsoft.Identity.Client.dll new file mode 100644 index 0000000000000000000000000000000000000000..d21fb04e829863f726543934465179bc8af60317 GIT binary patch literal 1639496 zcmb@v37i~7`99v;-P3dIk<9MS%qE*;Hi2v^b8L@IFCQRK)v2MO}W+^S<4)J-eF)zW;wdnSHC?_pP_y zdh4yTtGZvZ@jA<~EX&33*=H^5V}Sg(M*dF!X9vg~#ZPot_ou%;|6?sjeSQ83=bb;& zcX7>sdF{-L`p!Oc^Jafb-&yDM)wXW#JAZTEp)WnY?;`(Y=M1#BXZ8+7AG6M~j%snN zN6tL_T~Th2TMPPHTb5eZH+n3qO|eh^7U4dIXYtQW3EQeS5gz~W-x|B zfi34;wgvISzaEy0Wrg1He|?s9#z1YPb~ccz8_JeJ4PoPn;I2fEhOjx$akfOrCUC&q2F-Tl zh`ZV@76X*r6*WBD9%ZDk;hJCBmK_wxVp&~FUF&+37Yb(+Rd4(4ELdVY1#HN8-rTbs zch{L4GHzl+E0VUCI|P>|E{%9Px%`iwSInM04CZ31fL{L9%ua8!N10LT<}SBf$-1K- zYqMN$a27%zMaXdzrW<};Nri|K;KxDeaJMxuX*y8^s4BLkkD)%ZZYV6{AVd>*H;?>ww&jI+ zdCA*QA9>*0pk2T~N>dDaw&{Yvq-0#`TIyIALMEIbtAaAh*R!#(p*0!SW?R0!JmjTs z?n;ywXA`RX>0KUzp*0h!tao$32m;x}ZCSS~f%^WA)S-9n`O80Nr^F@fq__<7b*%y9 z3$M!BV(G+yoiF7xPVT1Uou6e6AOZE$yEI`P0*LM_YrE$4uH|KlYs@baaJ6J{fqyrI zCq1Xz+=GC*732oi{~%Cpk7be-FX^+_{b{OXwO|~vF_ypqT( z%p>E4d7xUuJa!|G23GQDeJtZuJWumTMtP*HMN2e~18ub7{aD29`||H{+uTcSH!|Pl zb`AaX#r}Q3lvd5K!dyPo9KF9e`r+p2N1CG_ZH|7dIr?!%&$Ta{Vb$7^u^R3ZK$@3Q zpKI+4_e5iNb`*KW+`_<2+k6sB9swJfBUW;o^nkev{k z2N5ZqWjAI1Y2Y;TtL!~c#OS2;sXz z2uF}~=rII-HH5zm;h#eI13+}#!UK1owooJ)7cVEOX^zusf?#mcnqv2OD ze4K`Th7Z;7#SE|0@Meb5=`by4Jmy#pU&8QV8pc4~VqT=-5r$u^;Vldwq2a9z!zPr| zhsrhkYj|&lk7qbE`R)b89H`WV44)w3EsGf5pm@56S+C)}7(Sfg+8ZKI3oGuYsM--2 zF0-xQ?(Q~clL?N|ZC=KZ)H!rv$CPy{u5)eG=`Od8{HVq97CQdz02#a6(_|bY=ZCy* z#dYJnZp7<&2Gz_wx*bg>d7zuMT9Joqt`M1EJC|%Fu(_H-_zEFkLis$`KM(wN#E$;o zwNOQz6KDH4iyQeG-IKlj$k*{F?*yV2)wJ;d;>Z-#)p92jF+166ryG?9<#wpUGh1;0*HjeL`~$kGU2(($hb zZo;6aWv*JSLs6Mgz8cHS@zt@=9ITF5T}_a9B_z6)MXvvS1S-XHF6pDadA$Q|$=Y#L z?f~GoC4C#9`pdY@Az$rKa~VS=+i~;e@>qVWOw>Q$ik|EV|hl&!rJTE<~d(x8xw)GYZU6lN*{T4N~ zV_yu+wZAd6A4AVF#9qIawh>y%&|HRAF|>ps=;785VF;a z)&nNin1jj!6&*8Io3cPf%lR(YDy_APoM@$nskg9V4sNbPTH6gI2}FG_6bU1HTro6O z1m7oth#xS34%#(8Y=nNq&|$>ghjcS-cjU%UrGuynR~{08j%y->1lC6@b@MjrQ82e? zy2jdCstw7|SE(EcV9E|_xaP;qmurBZAP^A6**v-;*ZedhJxUT$Bw>(r&0`ViXCx6t zBT9)IOCobS6=@jYYLwteFrxe)1R*$@;aq^pB^D|H{E16<_?B(49bo!_wITU4USS}G zSxI5vndQ0mC>dq#*1Mr(k23Wpa~|BTXG5v>dREWl&}bXvq^z4Er?Vjk3(J9Il5);R zLW;?F+mE2MpCd(XV92TMLVEufi1oY2R8y`q@=Jt|b&v6ii}Kr_Zn4~acfuTl%$(Xy z4c3z5KLNJ0~<@ErF(OdCMw ze8#RU&SQsRwr6Ku|2Ih2mFP^EyJ5NwnJo4#xSwGAPlB-gr*_9QxUx40~s#|*?VzK=mpmuUfXH$C(nn%aeHRn`1tJrxB zCyxssc|Ud&%wLer4tfSVgpGu3eG&lT ze?^AU2LFaYKom)sflgd(6GhT-B>g=~^$(^ZiX_Z2C$7VZBIyK@-WR31gQ zl8CYxsRr63I!!e6kIIqPy#LE`d`I%IgYOD-g6|2;1>Y7}SF*`K0?NUd8Dlw+NoymM z8O)@OnE>71Kxc_YV-@s_2D+W-nM5zQ{WK%!lZ6L;YG{3jXmnSChS@`Of@oL{rHRUd zM#?&QmSy>d=xhhy6zBwx2+Rdv7g$%aLFri*#!O2~R3~#_AGB`l-#raqz#fe2^$w;m zrl1eT+Uh0fq%nU~KS0xOgpdFbXGRDK0D(o4TiWd8m%GlaWvw!+A9)-Wz`Q3A8hFkd=joZqBQ)@wKh9H_ z$RjlHY>G0M01#MuVML`Z24S<=u!WP!x1tVUxJ+`)#6_bhKyE~IYs(-yM8w4 zGO$-|kNd2uBRW&7m+52laOYmDpm(501I6?}hlVh2q7dble6^Lcy~80PS;l5Ga~OeZ zB5TpcO~r4algvq+KJ948E8$P;BWjod(sGe0S&4s)xk&e!m4RJfn8@#Qk9kCZ2#X7RM?;nkO}L1%x={6QhW5}V6Pfz&467i zy5ZQWX?7k3L+U8I40>)8-QNS<=QirM@{*XL^2-iV#WL9bA6Hh4SQr-TNx7yXqTkDu zyQ1V$_hY$!tOny{DruQiJ5;rJusU!{=)g(Xo`vzmvpA?U+^i(?DtMwbPi&91Jo}BR zH+Ohl3RrY;@_P;7&G^BK1xDea8-VCcjOA#SYy!%laX>EIMN@gy3GYipBtmY}3 zU0p8bg9eU)9j4ktkqmF=G8ipZX`F{y)@4@5RaWm3s6zjPNw}`gI_4*6i*xIex zu=%if$&xeIHvd8S;4bL%GnJe@SEoBtWoEitwevG#);Y3Sxf00w4B6j`O9d1ZO}0l8WEP-8fiJnQtZE6YpBKIz8Bi2`UiBKWaJ(wE56rh~-;8w8 zo^fK;*~RR*;^J&#nD(?Rd#Y)J@vn@P!Q3>~1KTk5sk9=1iA4s;RNAyj2vV}x2Vos$ z-BM&?JU{ccE`-f0#jLlR0k$Ven`DY)m?9Zf3FfK2C7W(ce`{zy$%?cgT+mto8;)S= zz;0hQhtM)jfd=sC{9ffr&+h=a6}g3(;pvIi0s7FUvAuU`n(op&FjyY+<_>hhSqA#c z#;z^$;Bw+;j(UkUF3fK-{!IMIV>y+Fx)+h}9yr6)hNjLBAx|{bM!i=`QNMr*5_jXQ zbMU(qKRbj`xV*K~9m^fdPQeYWg-(I{zw8tU(J5eVm5DlqY@<`?1opzVa$DFbz(3%w z^HMvRD0JBiHK`qI`36qUO89J4s!5dq4Ou31gx20D)70&p8l#=}{f1?V+IlxsKwF>Z z#dPpO6=H3@H@T;_jwWZpou;s38z}spgdc`SvEw#C{%F(kWu4Ag?m%dj4$a8+to>+L z)|HO5EtTKIHkD~DW9Iiyv?Q(ZJW+NrlibPuel=ZEo@SPsEQclm%Sl3cG7z%VE{e)C z$&|DsmTwluqCMD=8pDq0DB<3jN*-!>F*Up}kC^qo66F@IVYR1(807T?@hEr54{Nyx*}G9O|A$R5LYCGEA~Lk$Q8%OC-e{T@o6@r7@rb$ZEh;8>u`KZ zgyR$ZloCTfRk2ORM)Rhdo*kv1WZS96rt44$vqxLAXs~tBZ#XPwP@%()E90p$jz0&) zydI7~^<0iFvM?ylJ&89ykbOE*I9@&UgIl57;zr%z5j4iJWTgjiV7Pof4qaeZ99$Vla^;b8M`7$iteRbE+%0!IJ7b}mCuWfe9pkr>b^CZ`m{`Jk!wX#PW zQ!U!K*}6B;y67Wd&~bG6pCZtik*Y+=iVE9E1LR zCG_XNXlBCxv~sfAMmF+l=P<=y)Z@@5COm~Evoc)*rrG}95g1HR(f3S1HdT^uge09NuSL9F)Ox?zz+>VX33l>PxZr0+8V;|;26Dx zMc`Q!UEuBp+^1KgJz=z%4ws5iyxpLG0$;Hs3d{%tJ<2I-7gr{Ix-V`g3_517^d6hL z5_rgAb7k#S()K(_QAVppr{Osj1h}>=Z3`DbM?ENrj4FrbsoT{`wYq0p)m2cu)wwg{D$$n3cokv2lunK;5W1je{9oF9c`bRbNxf)QIs~NV%y+S zyVlkg)i2Kic#gRb51SWOTl*iWVIn2ZL1SitFzyESm-pA5!2a@}E^hkEAaP5xzdYaO zz61hjrQB%jFVC?3tOUFfXoO8KY0CLA2amaAZGa-1Mc}|(UHSmb!{hURPW5C7f%ABp z7OThKV>$379+t3e&uj1tTRL26jC1!6JRuMDHp2_Jh2@9vVuc1PdwoEKxs*IYcFkKF zp|>)0h3#}C1c{!5$?QZxX?BMjh%`B7!G(M2ID2azrndcOkPuZqNF?-3So=WF0k*To z!#$gQSpj@#oAR(CqYo-t%WfWk3H!fLYL8CjXah8~5`^#qRV z6Hn6M*+E|JFiQZ5AWIPv00NCX+EAW7aU)o0;MqFPGikF}XwQ@972|RyZC(ovaxNX` znY4K=H1J$D&NE3Lp@9c$!Khr5c!UO?(Q%$h`Unj?myh#I(no0EsgLta%1dbAK?fV@ zGf9rnHrb=w!NWaTc&!&Oq9|7OE14Y6@)uUI)!d1mH4qFauO@|6ECFm&UI~P$z@Oy# zUloCXDDGgQ=XT9NL|Q@;QDCgU7I2n92cgL@6lMbANP8V%fonCTp&QBs#8KqcfM%bF zw1Om}NP0a<`$nYwNFs`)H;{x4G8MRzB%-*Xj%6D*`@R0!o6rX2Kr%7dS$;P!i+d#D|DPHAt(dzs@yl$dCUTTlsWV zjOFx306H81eF}hX13-@lpo0LgtpU&#?Co#IU#U-f`+W2f(wuE6uawn}dBE(E?T!A_ zmg!F`%57c=B%b#tG4FUaf?nw~1DjwxcKf@_34b+IH#;;T$GuMIF6mx1F&)e2T2IHskGr_ z-FuME$HO(xseguqH4))`B%CRPkC1S1MEC#+#|q(NB&>}H?@FZzthYA$**K!y>{vNEjBvM@e{5M7WiNlZEgg35Q37yGb}* z2oI3(;)w7W63!LEy(G|&Xp&LJ0=k&vKM1mzi2)zBfiXWA;TZ5=Cb*9fhiQP%fPVxe z`6xY@KSl!W%z%%)fx9olG2kC5xKBkm27HtX^>GKa0$H_UOnMNfekTb>MFhsA|8VN> zCjphIDHxN^!>NCOgrg$@W72atqaQ{PQx<3Re&VEwD^l9IQ@@J|Um7K3Ogayzem4on zL_E6{__ zUV?ct&X}6(LBZpjk#myRSVt4J`yJOmS0Z?#A_-?_J^x?~{@wnokrL-xlc{vp%_ht> zR7&PrS2HxOw?wf}cmxYeJzr{w+Rdnz=M79CN zpG%;Z$lxh84pbv>dUfxFGK_G%d(}y>jT0s(qyGoWOyWTuDLM|SGp}>}KZ;xqgKeF* zIYH&xLO#8^umkFmV}yg{t2U@$G7BfqD|zKq2ew#A3P(|KYDoUGNWL1(?Knflu@xFS z;`5XYmB}%}vG!HNDw)i}>HkF~LuZog(Q84e9PRjj2ObalWQ@eIFFl$A=X@F~a){Sw zy@+GogZSyy-VSsaO!TUwBnwIC|3jsF`fSf0eG{eQxY}QV*P+{>yUkPz9XLZwB&+8- zF!_IDO1C4~eXO%}00Ska#QmP%i8fXZr#D+Mm9+UZsnU)={^4+RzYBErQQNv5zA*@& zz`7RggVl}OAkycw^Ik}!!e)dW4zMw6&%iM|Y6fg#+)|-^Qci~_WeZD$cv3WO=vq-- zD|_oyOmxL0KBwrUXgioh`xK4Y40)d1HE&`g!(Nh`@OLqY!<|Y=m^VhGZYA-YZ2@K6 zhyBXP8npI|BkNmU3OW)|S^K%x@6a|@NZ<3HsKe>B#&Rc$Bgy1Xy6%IpTa8of_9#(Z zsm_$l2~pK4>Do`P&g-<4#Z+M!_`Rg%#8HmF^8xO9ktwrA>GdHKr{*A&sIGKpS|*c_ znU+z3GFz0zaB>Nml9n@0|9wcveQa$?Y>!%bka>s5B&sXZnTgtHCTyegIx&iog&U5P zDQTs;@1#uZ+iny+Wxgpx24vnXGKuPH?QE54DD-TVA%%K6%3?Szg-l7yxvGB;Wujr8 zEHd9fJ!MdV%=e2-qPp5T+hqOwf^)Zae{zo~p7a>do#0 zT6?o@49gUL2{N52Rvlp%VaLTcq~Gij7(#`odV%=m-v8M`|E6t{N0r zT?2@D8Z8e^pGCSlMprRqUix@<>1f?OpiR(H{q^AH9ABoAccOcgbrj|_nSdyg zWHR~Vi1ZVZh$2a*ljt`!75d9eKom(bq5Nq?dXyxhNct$?gfp8&aZ&SGLauTo0A88< zV(zLrY(O9&iehAj{edV4OqwzQQ6zl^&|vsHRassG`9G(8z$XRf9rGvx8PD|dnIGmVXG6QnoAqp}jlK4thWw8S ztYtgGy?ERF3L5YHHC|;9+k9u+u;otAYUmBGe3m^$SG%5T&IxpaZh>x)7nln=1=f|# z^g>gdYh^5Umi9#`!2U6rmq;2rz#UDnJGg#Bd&Ur)chHbHzC1=L37w81L1m=S41lE;oiYkk- zSovwwH7e_0tfy~D8aw#5KqvUFKsWe~z+CW%z`C-TK9$K>;~ct6f3>g@%-Z(oH{siO zw*rA(z~h8p$2_eQgC||h6yVw0v5d#DB+ooCZbQ}$9GvA8-ENY+?ci+!o#1AHx!|n= z>q<8BRVT(8I_df9LsZtwSszzP8asHcKqq*ez+7;pz`Byn0+q#>IiL3bgcixcan*02 zOiR45m5hEHF8ssP4M50mxI1=sOJ4FZTt?&!w%jl&3pL>zdA>w_*pwm>OffE$@FQW(smP%rSqY9|Ma? zlv~W?i~rvG1o(VqM>;^Ft&{J2+IJ6RZ=M3)Tv(E7@Q+MO7G^P%kf0 zS)15yPn0xvaFReLSTE2GHVDiGCkU)7o2jTw#>|Cmzm2i!=$Op2C5;`NBhU$6CeRJe z6_^Xo5?EI@Q&pLaO^^xyWSK?JQzVTYoF>o-P8H||rwhylCkw1An;B40r9ehEc6Fej^7ko}&UC9P>B_?WCW zNE$oXDbNY75ts|E7FbuZS+24en;`3iSQ#IbG;_RU#wL^z zn;{L~E=n3Z=o9D!^9AODc>?Q7Hv6b7#wO^sJ|^ofNn;0h3v_~e1m=Pd2&^mFtWa5u z#bmMnI!R@T|NUIj*ugIZI>8eH-Qbr3bHU>R>&j;KRhf)U@IUl74WIssq`{pefllx> zfo||sfw-F_u&!(d9R}^kn97V#b$=92bz8Uv7y03^=5-O<`LE=jlO6n8pcDK?U@mw< zU|q?)z{@-sGd|mQJdYoTc{uSrHfkRKwR^GL<>I92l)VII$jEIas*KqvUGz+CWefpsPG zB_Yg%F|&1I9*>22Wa4?8rg^-Ac|0q!?7#|b)e_ojO!H7O->$?w7&Dhm%;RTa9&PbF zPS-pxXCAJ|w1Y&LhZpAI2&^lauQOpDj2S#lX!f7S!#q0Td7Pnn)R{+GWZ6MRpcAwT z%mpcdbtUu7P0WKavwdP7KM(Vm8PDTP%>z$aGeL*QvV$1{onWTGT+lACu4J=D^I*)p zig`R^(^oydt?g&n$JMvBVfW-~7yz&^{}zEQ_u(GF*kkJfs_(K ze2<8Ylz13k$@hIEKSAYsgEIsH{iuUN&5!6Zau3~1e z1H9h^CR!tC%=FM48$qL@pozY?cu6tWPe@|sfElaV6#`r{n`zNT6BZnSN6oT0={Os+ z7#D{q)95DgI99g%69~UD7QY=~{zxBs2Lg5-7IDq@P=aboZn3nMH^z{~y$AQ!=ve*& zu*)%1OaSDL3%6%lQ5CJ_MPZWfKu#F^?s$;W`O=j54U^I&sj=HZs6{vkRvB^?vvRpR zXV5LQmuI+h2i=}_Jo6KLd%7^V+#Y2C!qd~-0mK9Q|KKmSMsMU={{Wot&AL1LuuGxm zjUiN1#CQ|tt>n#;HxWAwj02(RNqUCImO~Yfu$`WbZlY&nhugD}M+GwI>l4*kyI@8bt;T$b|so_+S&gO+d9wN}W}n#?bo6?Y>I=aZ(F z4q%VcNkU$67@T{caJ*FS8$wYBWH^5dpH=2fQ9Ooo*MwC><)1COk;BD0PjxH|ACv^i zshk~QdNyXf{Bp-DC#dEtRY`Y4VS{;%)TXq7q&Wihi#IS*N!sq?l}C6!F!4UXRO zr;^?h=wA^3g!8j(O?z%Q+1d^?`;4nY*apZSaS^_2LVOwj(!w z&h)wV?)HW33S{p-3eTso5jw{#V(fU0&6b$ndSv~dZd=y54LjitAaeIS+?||>LjMCT zCW28oiqm2YNAW*^cj(Xf0~N$J+)j^|sx4JqwBq1Yv3yn78J8dlw#F

h006SkNnpa!s?48G2$23N&-{gdFIk=w-{G4>Ze*rwrXsep3c+ z=#I%rrPk&QbZYhW4x}|OZxA+J(o<`dB_zm5FKYQ{t+?aatTDn6L z&SsJ;=^?m0rT&JQnj9e63y{Bm!!L%==YgYdc-?I30t_B@Sy*ZaWH|awg*yQBP2jx+ zKRkpM$nbOhpylc;_=j%ApJegW6}e>b=+zvh5Lw+%3XG1(xvOu4xFp<}JzKK4W%X5n zL)g%aJo`C#$(=o`Q+6}?uYU~Qd;`+4df%oGYn`1VF8f_Ff zp*hT8X|*}HlRQ~Wt`s0uyEg1vS zz>z65-}e%;1>|r*njIgIVg={5d^X8R({$dskA{gDe?HbSyOP=PA~>%(hu50h zCtquB$9>{->^^Z??-N7au@-sHbyHi$iA20WV!GCx!D0i;{uXJ|*+h6dIULXykGJ4? zFQ5f?Mgv-`%+Y8Rw&ZV)x8yHOYPLi7PC|tP+gnM9L`h4IW$|1C+|$kdML7Hp6zyW0 zj_SpV^l=f}uqsO8RDFXyg=(Ywov%zl#7Hqhc2#^yq_;f-wG@3ilE4p>wd_j^CXjWcay$ zLu_yu2v^L&_&9JJLIdlD+68y&>RTZIFz%_25@+8a*7Nqe(QnyzoI0 z15<2>jAm!Ijyv-WFTk1Ov$JRn37z<8ktoB_A(JEyEuDl4hob@sk*McC9LaceG3?2I zPGKP9^bYLh%p2Ihe9{y>kIT_QmKReHJ4if^L&+4x42j217-#mi=js|o2B3ZIUR}S4 zjD78S8k0mi=3viO{xzmF2gZko!iHVNt+>l;j+dI(VZ0}Ne%-`498EiP`KntCdW9MG zNXTtmX4F{T9ow|L!>}8l!pO2t`?fOP7xIFZb*0a#3aad2C)^6}NA;?Oa3PI#V$*aa zU%E~6t`|H!-i|KO@PTUS4lv%wUQixhTj6nIj2rgKCrQ#N?u4~|wfdk5T#LhLpR~R0= z2Y)i?g`_;U*`8XtcEXJ4GU$Yf#kPnguk+RF9D5pO2*)e4IFa;rbs;~#rm}d-iUIsx zw4#8&3szqT3oyF+wFnI1&>CY)2I}~G%D_cKM=0Xl6?k<`@vMQR_9U_0O;6b4tf=5-~8a2m-frV%JJfR|kym2qcJKiC6p$<5f^Z%uG<(8{d|eB!b-1f|%HRcY zgf@c>*+f?=^qr^;H0M>F6UvV=O%=M5<)kWrOW&ACVVqCl9Y6aqqz)6&6WQdd^V#*P zSCt2%^3*;U)o<;O2w}7G0n8}PXZdIRCUqn|5lZ*kh5`=4s8w~7f~-_S=|g8W(PXL~ zkq#qC{h%@ZWi_SeY#@x-%7UI*T|{cCGy zq8Vbr>TNsFwr8tjnIW+l`wd6V0bB?@LPM)KZ&z!w+8foiHg)VYgpK?sIL@B*%xXxf zw8&A~@|PjYwXlmK|D586wL1`Uisj*Ta}cQFwTBU@v=egh`Qp9jx6}9vz%gOpxY@112dfBsTe7Xiw6=8dVia{d3V#G_rT33 zE||8R+tka-V~MdGx?~&sm9F(R^a>Y=oxk3w>|J;z$>J3Uu?t@4RnEYBNpzj~6x25AmTHh73fVI zn4~@Y42GJjo}`Kf8&z~E*wAcbpZRLQGw_o=WK_`rUM;g^;BXqgT;9@T_10+Mzjb0c z%hyJhZ7vP0)YwW6t#BqQMXj)YQvD1a0@NN1V7q)-P5j#2FEQ{rpN1G2*by2 zdwv4v--@biOI7MY40njFuB9Mc_SBVb}UYyY_Z!Cp|XI zPu;^Y*^7;1(*Lfd?cN*B|4u`G{DR!Vc_oLV zBM6jJSD&UxJSg~>gtn}h;bEb9o`+q`fYxUH*gfujP4-iSz3Rdq!D=CkN!CN|=s zr`Yv)x}yV2n&ZSvY;&T*Xf--q?0wy>3QcWxygnMJ)FJ8Z1}#_M_) zzP@)rlS1*{rcNQ++elx}N4>E=e~4pSTKYJQrA?&r&FNzM;7rA}!f&J`r>1dWWJZLP zdMv*bhdLO07PrHcj?rPiJ3sV zdV7}k|L7f8bw?)SysiubUBdd%5ioA}#vXjp_8<3vA0O z!v#TRorv}Iu6YA|n(y1<3PujP6yycfZEkVt;HEfw*(qUc!WhctJ}_|5o{8t+^;{}` zij?c3H)6Ltax~{WJQ3K9QWLJhteO++_rn7j=I=W8>8lY?k+EYpI0aEzn{{iig9Ur_ zC2wt5j?d)%_)LEp_u1!Z@UdaOEb>|!`W{TR@or+SDY1?{0`}XMb^ExvE+l+g0<+`{ zUOYX{J}F;G-K~j>>DH{98G0{{J*6r$V8UT}Gje9=4-lEIgcgh|jXn05#??$VIggj_ zGtd_=XOy6dc=S$)z-qkqi-zLiYc5lo_tZ8Hu{>jhtFM=0)z_8I;$%=Jn^C#t6SL`_ zL6mSP7aC;R62|hMmTzwB(7RBDsmff}T#ND)myTex%b4r%N8ZMn8RB4^uADYWOjm2R zwb>@ET63^TYgnJW_#Dc4?D8(WrtG#z`)sRLXWR3&N_+Ua%}lmk72_1MA#Rd(@#>z} zI`k>{W2#bcFWd{I!N0@T49g2?GeaLmY|7$wWILLR*U>0mM^rpKZ_22g$7)?O?ApH? z#p}@G&4?E-=1?)`ohi;+$z*4$B$lfo=ef%D1lnAx(&cV0F5NV|6Q@X9GN{sT0GqCy zF)49ZHk)lOQ?^m2Y*;20^4OfN&RA>8X0C`SGf4bZCx`3y$;N>*1(R7o;$%jq-70? zY5m3OFSN{Af+&tewp1U9!XLGl{MrujH#$oma>DQ?xAbOL!bf8|7M_gZ0j=d&8S_G= z*+rK|E5RqfFxN>~?}g+Mj!`-)MP~#GdKikY9(;UU%lODwEDhqFb7f3BV)GE}ptyw$ zUA$6=YBo-Pj$wF|10y!HV-oS4IJ07As!{}8jpdXz^lSXV>7&)R3oH#BF@!<0c>=#E zT5H`eFHek>z`?OhW@28#QM$R%WqeUoh|ywrRgH`3a1UEg8^u*CE?ILd86ug5VUgM_ zq~uj*G&sUsbsja;%~kwls!ojm$yG*^I&#`*lY?Wu;pq?VKk9BEk6YjZF|M`m#!y-q z);&PSyi}$lGN;9PJdWb{ZZx-2xGs%9DnUh7;%3L!j9vY*F}~fZT6nrI8GhneKc%(& zt07UN%26nd!OxCH)>ZDig~#fu+*ylfvCAAwmhkYY=CKRAM{@Shk#iLnQD5wyEq0<^ zGn};GX$v`~vndQam`|V04ZOq4r(p|kMH~0_kZuV+7Vr}8?qN9`3?72)Bd4ZXv5Lgh z39E_H0KU|_MDo}Bw3zE>!ccm!qX4~hd0jzC`0Pf`!pP(tbr{{#lBeXDKwd@nm!^HS zUd~d+G(MdmTV-JROq^vUeUcM>yqh&#M}g(<4Hjg#UxS6&=>@RK+2LZly&YE%RGK-7 z9>6utIj|Q0xs~<2`96DKsWWfzAnix1``Potf%DJLN>?Uwn^8Pwtb*xn5`u=yd!lmM zwF?_zQDRj?2|Q@Rj9AxJ&sUFEPS!(FqKC*9Js5%>cQ*3I)Tj{_J@#+taqK1U=@>8n?$$jj)v6w($5<{@DhPmcoa0csJW^i1(Euju>& zO3RJ+OB2*ih-0Q(nZG61dTp*HIj+a8t)>t_X?$A54YXv&Np#t6D5P^wcoxohMMqpjp%~~xNV~zW4 zuDoaE6_9N^xPJgG8?Pr&)o{UjFVzU4iyCE9ov?x4uTdF}!jYUw=MlW()Q=aLA7Jr=Jk!m}9{p8FJlZRDLw_9zXIFvqjYYU(6TkLqVMw6iOHrTU#~&ZH6b zwHWw>Jl~OA7rP*r-!d0-IiitcVq;2rqg7!Cfp!(e*E3`27`2&gF&q9v+PEG3Q=k(( zEzk}AB`^{ETOjWE39Ku-S*NCBOifn{`#!C{Gs1Eu3=UmrpTo8~8q4>;BF_%~C(sGT z1iAsff{AP5iQrj@=YszTtSdV|EY2!pY;wCeOLH|lG*6e`bxA`2W$Bl`3i`wSo zu+i`(Bd=mAwb6@^t{&4hBRbhZn?T&N6X*u*0&_uHU|rex!E@@!*km2Cu_Ob|t0(DL zz=rHpI*!J4d`+{CK}^TI=wJsu0-c~B&<$n@%mq1tb!Fpc(WxV2s$-K|zC5fxb5(PG z+hh676nS=lm$9I}oS;jf8*~cH1v3QJm5m>MXMT)Lw#kj5O>l-*=WNxe-imEbQ|F5- z0`zIQM(#u%FdkE>n&RKAI~;Fq^uKdN4?CDA&kWlf^Vx!Cynb!|kz=;=P&aZP%BvqG9VDF#Ml(&x-81??UAmyt`Sx<&QU;DQ6#F3CS5O&(!Qfv z*DGSW8qviL77KKOvOqT|3CsnH1lEH7ADuD6J;qR5oGjz(#3 zW7-4ld3cBA9;&Y%vA#RX<{gb}-YMCLj3}EX&kr;$#^m=faSi#{M&6ES9s>d|%S5IL zZEg?8J$pM7q6y&cN(M`T(5=}h-UUn{l-HEkD;s&;F?C+>=qdBs5$1K-aw+DSCO(b@`Jr`NugAC34gsL-J+STPdeXQ5OuIe9^{hV=!aKi6X zI`UaHOu}6AVP=Rer-v!*JPZKn8*h%Zc`XA?Uh_I7MdfTNAHKg%QLg!TWSl!1#<>%r zC{a|3Cc#%vBlr!G;7>(@@f0hx`Uj>E+@#gcDDi_#EWYQ;H|AwtT1>l5V{*}{VA6*M z!^vnV9H56}dK#{fP`*!#q-g$mWz2{75g)aK{RHBjL;~?nB7uouNMJ4)6j)bwgV`i~ znXxH+`I@KzpVb0HZRe_3zN&kAh+eF`BOzWzt)x25D z9+|GmE;mGW`6gAOy+72j_x;ah@0Uf1ztt!Y`|H=m%JU~#%h3>x-k@xFQlqSYpA-q-B~*5MBtWo8}Xq*P=6?MU6=JtzX5z!m5Qp1?$q6qpNa zfpul)RDoq@Ov?`ca4en!yBe~c;$BPK;$B#n%gQ?ARe9C(_vmvRxka$BE#QhfRr0Pq z-&ro-rWq%;x|NidL^qBK)kL1Y`yeTalK6ztD0UQG?9gjxHiEC+djU~O;LAxUZi;u2 z2pZ(ykbIhxU(#B84|eHBzKX`eZd}GQ@vtw^e;S$O&E(j!_LcnBp zu}{VJh>n_j^n#Y9*xiV|poPm0yn9quV*D@zUs!5BK_@Z4q0Yb7THyvS?V&L>akrS* zHn)HqD-aPOFDCZ!;@b>fxPlX1?TsZ>an!#Xh6B2%CyqW@(GT0RX2sC8dr(Gx4+6Ey z63VwB!f?@O68I18a|R&)HSNRB1Y#b3<&vf^2AU>}o!S&z9LA>KguNOKwUxyQH*Cx^ zuumv&Rj3j5Ifu&NU&!ua+QwU+e=Y4~dpw9r>nmyGXZKOxIJ&Ol7ABWvH_@BVv^6WSj-=9>X&=473 zn8`1FRNvph^JZ^g9_mYG<{CsnUvsEJEC_UMtKy(t4a^srkib0^`2@QQd?u4J)=2>JAwz| z>YAwKm>wj>B0Gw2HaQ|<3=$t_$eTPFuEqs7l@MQa<+-%?=Ba|ez$hx~9(=CvhfEVC z0iLU$c)~(F;hto3K^K!P>$fRna~0PtJC^V??8HPxUjuoFiS1(r7K==bBc0X*s+OA( zQB6%KFwE;7arANS<@mOG`*)0Ohbh|VI{>6G=B5QDel zkL9ov-TTc7SbEEvF8BSw6+t5^%G%WWS2rbiuxWADB z_$5!zIL=-RSx#>A3aq0q!u#Xk9wqI~9djN!>Wqt* zqT_aG*y4-TTRhy!$ZR^L&B5WIO&fWOl%-1+h8MP?2V#NG1F&S z%k$88X*l2(m&OWg@RGEw>*Mfe zChadH=ZOmaZvxeoC@;Z>R32dvLxZR+X+85T;LNx2r_!FpS?cc~BvQb>A3DeCmmh1x zcUY2$&O-F3NiF@Hw7-&>bf^76!nULaBxy=guHrqk$18b$0% zWswrns{0^NMPTLIXiE)CzWD=RPfRkz<^AtQ>Xt`BT;+(S1j|;(qhZlE!EA-$Wql1n zP55!4NV=M(DZ!&kICe3UI=&OwHOyq^Axl>nZ_OZQuLY8OR0 zdGh&RIXv#s_?`syOWU7CHMZJGd{vH3Q8|@qWDFnvF^i>F(=l!~^4Z0F!hQo?EIwX! zKFhxue@f1_>%&)=j(-FXt(2|a9{D~B7O*jL{p}E5t;dckt+jVTQ~lsA*h#}uolTFd zOkLU@9)r?jPFUd(tE=DzJkO|oD&Ct)OwqP*8pzQI5p1AszsjP7PgQ4Qc4-odU z6LFZ@>cejlepnY;<$a1XMT1hYPvL9@Jqij6<|)9pU8rq|^G52G#HUEK2Ze<&xm!gA zBNV#qiKzC;sPtqM`lX2p(H~4i&6teJj-%cY>V?|XbDXLs?bIu`q(#?4sTWo91;?^( z6kD=_tNV`}jatAksy^W#hL}`+D3UVFDHzbJct-}lw5Qk6;tL_2 zJ?>ik@I)JJ1}|X%?pJ`A*jPj8d|!hfx;|?Ts;(2X^8i1D-&hzYZV1CNTI5=0BAMD_ z-iw*{kLfrkqAJaL{J}M+WK13H$;@gn!vC5QA3iy8o86O|KJl#XJ<(%1#k$Wfw~Uus z$N+)+GPoXd7;*(ddhTC8dK3!CZ{-0aowuqOX{zNE0_F!v6pNO;!r8t1xStWS#kcm6f)$X>(AMtla-qR>sa|%z;g^(9buQ z@wqFq)yDmp{o_(F1UJL!&ol4e<(Wv$JjHfEOyNA-++krICI#gKedj zm$Cm_-!lKwXpFj}W&Xoa_#Z9v^L99P9c<4(D+*s@&%Zkg|Hz*IOcX9U^A2!A{!Pxj z*J+q{<7U8d-vYyhletHcd1mP6s223(k0H{U^f`+540a{`3lXRQ!9hJgW|v#?xFKG0 zwqJ;C@rBhw|Mm+I81pU#SsL@g9i*6((3)3X3z12GGf36GSl?n!M*p+w5)wx)ZN*^c zgG2e0EAKx9qbkPd@yu0+f;lE(_UgfgXn!k2v?seoN~&^k(#JUMrOlTzXfYe0M&&5G zwrEZ`Nzj56^irCPOi7u#ZojCxJeQ4^hZKV;L0N{dP`r=lDw(0X;C{~b&CN+KA5Th( zn&Q>ujCz2x8l4K}eFt&WJSGf;YHvht)%|5wGx7^mNSBw+dh%6EgMIa~{~MIeuK7`+ z@Ik*1LLDg%dMS>yQ7?5vvvZ?@pMbnoUAW=!SO-38nSUKdLhZgv*1`Me_qFsR z1BwG7440Ac-+^PK1AzZ{j`D86x5A%fo}km;OJIbIzH-O&e}yc!`^{F`Mk^tM%)%X{ zm{V9&7kJw*Ze|-L+i!%86mu%rwqMfBQzy@p!b6I|BN~h(wGTz+sTJm07bneA;FvfU zNmy8FS;c1E>FW3}=weh1KWK|lI8#}RZ?#4UjG>t^JEWYBk4@I*A_J){oe3(dyx>bF zg*y3h{6!NbMhKDU#wEUbqC~Pzl!!+%oS8YrHRcG^xrEIUgz(%)BJ(EVxjswC_5Pcp zGCPF{Okq3wCuR!bRxm|xv*NNnK8~GWj|Fz^Zw>90Yog+gKWj>f5q5$-Ao0j~k%cww zWQk=+tQ_I^g#PbPXKiJZ^6~P5Ognl5F2SljcI~c)oOG;ebV*fxB)*=)9JpmBUHxa) zK3%#_ps%Ol`!_diH+#>vgW2YXh2;KlW$PTc5Ha%lHghj}t^6{SY({asWaH#V(M3jX zvydg*cXIM7QlI^tsf&}8ASR~75{UV0Ow2eruEbsqCC2G21C=)f_W_1Zvp)34goXPIoV)mVf5Yz+m^Q(wYw6$k|qYQMx(p z$X~!?{z}G8d~r0KVsB6P5&wqRh2z}sLiAL#4vhyQ@ltfO>Yp`=#cl_+M;+C0<7I=J z$ezbX0I{CNn9Ak<$~zH_El7LTpuL5Ng))|6!Lz}?06k4?zS&wnD=D*0y=}4 zkz74o*Xb2J*^>PQU1Y}=@5}q`+J5uHiik1k+LZUZQ{ez6)7Kjx%OoopV`b*r@bv?% z&F`1xm-Oq{s<-xT_Kl+=)Dt#PVL{)I;dWgq$c%R z_nM&I)RLlhKn-Nni4fGy918ywC#}LiZ=5J`O8?v!R})V*7`8Lc#$kSalMN|sM1S9Z zO!uQ*-eHk_d>zAE;KQ=Zs5Sc!B*}z6#gX0fvFny;Y}*N{;Qy0($i`K5K5i?R7jaA~ z*tMs|^`skWx2DqY>3WFMHe_3;Lx;E1-*hu>rb5^M7c;}nKS#ITRx9+eSjtFGpDA~H z($lxPN!@I73vG{K<5xWWiN|n-0xFBA=S!(l*sm|M`i@m!KhTjIlDNz$E?#QHXKMTz z$1lKZWc$FCZI0?Ne?cwYk!DJ z(R7WAGeb-x!#iDUh~b?syq}43>{0B7xP`%*w=RVYUV$Gch->ic$1j5)w+|wS(*v%r zSB6~w1Wr)!dQ=>EHODXvn&M{T6;HjmN*bq}DBQF09hZo!cc9;kz3`iPFz*O5wJ)jk zbDAJ=&*>mQ>|Qj^1ic+I#ZJo(ZV~7N?+};^-X^fFWCM@n86d{=3{VY^$ey7);u2UN zo)wjB{}a$qvzmhV@doh~Gwd*>8>V#p?=+}WB>nDm#P3Z<{C8~6|Z$*BSt!2JN1%|L-v9LD(C?e*Y_=86h^vJ?sFY2B50@_mY5ntTGlrvUYsin|g zaletwJp+4dVDXcMT*XJF|h?apw*K`TVd>aHjmLAUJ54Z?B)O+-R2f?>T z;%BBKerh@*A7iT6sp|N%4eGWTPUv=t$n9MJa}Dy1lk8l_4yNk_7>r$ewjQ`EP2ngH zG(>3o;+ea5#oE`qq#fD8Z33O(c7blNTVNu1x4>L*tH8Rln=`b%F{bTps>0c*04;jI z-HVI%(4;gK-%lDUPDTB6gE~d&KG`5*d4-dro0!LGPJA2QEff;|MZ|-p8@Fi~q%9n4 zJ^G{D=))6C@5r7i_fxsk-GyH-epqx{u(rIx@=QSV))w}1Ej*C7R^xXFen;YWJbowR zcQ$_a;5USQ8%ynAC;ao6J>Xe{u6&-%Bt1+oU1??s|K)okoGvNlL-1b2{IUtm?pDkg zS}JK*rt6t<7y52FYs6V}!oN~Pc=B$Gg#X$}i7|<6smyeD6XM}W!XFiuty}R@72*l; zWs8I#D1J+bCv3OV3ICOnL6|4!nGx$01(l=YO%_m9^OEdhk(AIIM6lP5VO;yKMA&~N zwEv1paknmDAv)dNgk7$kbrZf`h6&aBkI27NHRZ$7hBf76Ym+Q=eV!$3&qs#MQ`csT!s#>_5gzBG7QAqw7s1PFS$L|-aaVp$PVrm=mhr(bc2rwOavbi zh7@1-QYoix!@B5 z>&j-%QmKrEQlsNC?)e=#lfZ_`qLJ}vdH z(^7vwE%krXQXid``p0RhKbw~N=V_@tuDNHAeRA5g|DKlm#I)3ZOiTUgwA4RLOC6h* z`q;G8KTS)0d|K*XrlsP;oYUC(SJS3_x{?(m}qajI#D)5v!Fq^Xx)bHE`cnbNS| zb*-PG-@Rt4xdfhyRv2=(UVwoZR~%;6eurU5zkP~bJlrS1UBfd`Ud%kqIfUVSBz$27Ui*{Kn;tf# zZWKlcm4FOxBac%G=S(%%vfhJoIz7Yda8yH{I&+4^+0k13sPiTGU60?b_H_f!}rb-G|?2@WW#i3mb+O-h^!R;kOpQWALltw*x<1@3cOM z-?#C596#H^$71kXj^8@`Fuk+3;rBZHFlVraZo(hi-F*=(lkm4n(cDVAB1Zm;xj;G1 zlLj?R@-X3fg);2EOxSf2BJ4zr+yN_q-PW%)VIHIxvEALT5O(CrRWhX$G4el^?u_NI z@b1O*==Gs=U)Zl6XD4E0jO>|CcPw`)*g0=`L&$%z@V|MSpNNrXl|M0-8zp}t;olJQ zZx;SnkMk2Tf+q!(?~Ub-BEOgLUla15FZ{J}ej-NTv*b^X#Z~~ClMp~>=pIN zjO8%5>dj(qd40&w`DbJDN%Ipi;wpdZSZ;*;tqFfe$j^CfI5XAiB4Q+~_G}x=p~3ZL z+Y?Vrcjj1b3;Aaz{3}9!?Dc?O zuR4l7iICI7uxD0}XJ_$fQ!gj#;vv3BP^I=_B2P2v9LwQ!W^cB0CqcNDu-z><@`Idq zX}mn^kY@ zN_c(}g~%q(U%EH`@Y^qQhkN%;;Uh0IhYKsxIH;FmA(Pm3XCR9gzw>iq>1)ql{-EdM z!BR%nkDm1)bm6~w*SrZuTbM6qt})n*TlmQR{0{hE(A;iYSZE+`8%OpuknbKx&T1e( zFpiwvK;Acw>}??L9!JiZ3OTod{78dyhgj}yF#is2GV-ih2jK#oL6ZOwGa`fpxCWSy zawcGRdo%;u!m8V!FDJ~CC}T#qoGS8F8rdV}IB_2M-zWUCpXsgRz8@b(a}e~xUkZ>v z()h#Jf=&l@+QI$Up3{4%O4&E7dV!w5u@ht=!?LGSA%0y;!E@c#BnjJneWI<~w@;Z<=CY4ldT|?o{+b z;3}R|sK6vo-g0AR1ZUN_70=wlTwqpi#+Eia`Q@%tSQdVp{Bfwo`+h5>T;QIs0o$J4e9PG#PO3JoYo+Gv8`{FQ&or70?hDfFL&qWNV* zI6XZsPLPFR|2LqCps9#Bc9<#S#5gk=%b_>5#oKVadt7B)i8Aj*F)Mg<_zf1fKf1CA zV--vWeHu{Vbw!|hB2;))5vW;;g4N}2AdT#E%MiCHwb7Zct6&@sc!;5m6SuznFB1(5 zuublTwsj|bT=%!Wi&++0v@}T0;L7+Nf*;>IyB-i7yY&zJ&`DSe@vGoBh~Fyw4#w|r z{N9M)5bpC~llYU&$o3x~i0z?-`&#~|_kfq;*zsL0pZkV!5#gp*cetr#>;9F`1sDd; z@%=5I%em%+97pkX>u5vE=i(TH4u|_nR`;`Hi^%_l5;$)lfl&5)d@gGnxu7j%l(ku7 zuDaqGM_O?!%jebx48x6J0IoU!KBeG61)m{^87QW*jEt|1cPRR z2qLHiaDk`5YWY1XcNeW;`ncJ99njzx8_HpPYHnEVO`YiMs177RNM3W2v*517gla!Rt z&l#WLKr{>%`ZybM|d~io|%j^HU_NQLzl&B5Bb>1+jRR?R;#f-I|BvTJd zQDdd{f8V6B(sz43<-Yp)y<0u~ZhWjv5xJ^;x(mrEZw;WM6WpohhEx!~CWO3gv3a&x zldIS(_ixdDtZzF0^ywu|$#uI{-)>Nza)}z9?#uPp*W~g#+oXQHV12iB$o^EAAKg~0 z=kt~6{(O1ecfuyM=8xT4)9D)@PMS(eQ?h?%58;ggR3Q}k4e_h5W*`&iHE;O=rW@|a zz3S0_XXi}gt^QTs*~}*(`8wiEHhW#B+{Qh-g{fl?x8r;8B&c`S*Rpk)o<|p#_B^^Q zE2s3%C7G@5$h0)ha!6K6-!Qlfb97ob4Eh#$VyUyNnCSP%rjp4Iqnaza&}GEh^x!gG zM{-t~nWY_1=1_BbF+}uDMdZid!4RT5i^#amw-D+ zD^|L;gsCox8`vME^C@>#*5v)x1HIp-KKj1Y`!xr8zgFHhUMck35A=SA zynmR6-glt)tL1GYlS04pK<`({+eS2bGhQ#`oGO=$O7ec=f!=RYXvrWgVedT9`(5(> zN$UOL1HE4&Z^_Lq^z8?FzewH^*qit35A=S6ynmK@zx+UN-SFkcaB;r(K<}5z+r~wC z>;AC?C3c6rZ6KBRod;R#ZK-6(48!{ zqNO3+OIf&!p`uXp8Jf%znVRzH!a(jGsKi+;Uc?-%$OY!sCRf?g!@o?e@E-AGedYaw zgJpB-wkG*WuR{IywfuJTdkMdL_2HAVr>`+SzpB!bm4;0JAe@u{LAzQ_F z$Z{Vfl#73#U`qt&+JVEC`yi2AED5w2xlY*DTR3dF4-&}5+N}__#BZ*ZIBdBO634~b z*%J2Sg>7Ap!}pV7G;B9g)M9`yfGFED647YucR7 zm=7z4i?tUdY|X;c*|f0bK1c``Yu8EGtC_;4lU`xVeUJz){&Rx8M%c-uS=e$PB!G+m zl3*VtY+D<+RLXsj_$~fZg00DPI+GS{xepS)#eYq(C2Dj1hNCU_L87;Ke}a7^z9xA~ zmp6()z(Wh(QY@3Z#o8(%t4!<`+nQv-R6kjR98%`?S(CYSj@@@eZuBdG-6hD`0p>r4VYY*%yJnO~zYbZ{W!u16_)csZsI&?h63u{mCTF*_d9!PpX z=^MH^F;gS!%RYgr{S?hsnU~o#tPgX9pXSu+&(7xez{C75297qc-ItT%)URRx#I6C- z_DO1S7Xz^>6vKz!JaMbB46X4~c7DW$P18(qzc%j{e-u zwioZsKF>^lc8{6C>A>Su<~R=+UDcX}J#2XLv^s?H5`YZ}xUG{n;0r8O*-O%%!up znR%l_iyq@>%H?P>PiEwlAT@fSmWe9v+ht)99Yinc*f@Hli*wj>6O6}pEz}k-el>*$ z<_cA(^G65`b6n`+dqI0lu#-JRk>@Fjxd-Zd?&6H;iZ#6vPBE?)%0kf9uvptW_c2(s zvtJ*@vOl~972b9qOY-qu^6}dJ5@qk58xTlG#CVOexIg67S+TuDuwC-;+9kfVE0SGM zJ%tdnIajPD>X8dPhI>4&TTK3F7KK=jy{r*=4JLsO@LQVr?GWEcN6NUD^UTO|%F#7| zb}8)@XH^E2^$=lk*ZIneyAsWWyZo)Xp%kptvhHQPOZwHy+~-*r<_Wi(w}ZQ zdm|X_J3+o7(A8`2lk4;FNpHzW4SdS9{FkG#=b`Dj7`4Zn^p$ZjiEH}}<>L2g^PAqa!%K0n|w zo^H^AG-$zsg15vA!pScweOc?LC*Uc2?y^gZoLV_9n>{z2-s*VZnWAMkYa%gg9QD;l z96Uz?&fS*VcFW6>h4;^R?^;O_&CvQ;qy)(Q1+yEw6y7fS@q_US4BYZE;;Bq;4VSIM z!i`Htlg6c+Wj`KY8Gc#@u9=0%D!6m?CcRTNah;MbX-NZJ@YOrPX$0K6(bcc zHZ}}pg5AjYmhUg?8k}5;k`GyH5vh=kk&(3TG4xhcM!!9Dzj+Wq(ZCj@#{5S%&SRV}IW3Zst7_)HU%827>?#*BHo;o0t+*z_^nXxI8`dIzCKeYAd zwWgqK{mMK8qnq7$@mHavV-Mc^LsDS$I>u=SW4LgL9T=^_)gR_{(xWcT6M@62+|1l& z(RkV47uUtKj%S=`6;Ac-Ch*@Q{EH5UKhoz_N8$!S`?>h;LHWX7?Oeu90K-`}cqgz_ zrZ$$c<#-*|n2h7lDm$Rj*OZ8CDd?-OMmo6xcw?Z1W~3#~2X6P}<=F#$L(U#an*=3# ztU7Eiw-2K0ur>6Kj&He3sZa}$-?6uoc`rN%&0M4)Je5TWozy8IFDad+N$CVgQKuAp z@6nJS_ZE^J4N1zWnmOWBS5As+BXPZtxGEfPQJMGEIT)=nM}i(0uN=}S=3K%5r1xM| zSaaoG$W)`0o@e(MvqqNeF`+k_(DU>0Mq@G@xNl7NEhR*M*h_S2t&pB!DP)dnru8YX zJC@WB@}k)4z~6luIfW$nSO}UuK2D^mP$J9%pCxv2@|)I&x;u=Luww@Yo#F!1-ca9P z>grmM*+kyFKS_%SR;K&vYm->}xrQQV@yDC+@^X1IEnVP+xyf(X-0}oyd;l8l&0rNh zJmM|b;uH9U@riu>i4_jk7|E66qp4FnFQKk-PA&`xW0(CbCUV#{#_>H}1Lz6tdk;PGayrB&UF`9e^*?d4Wc z!^z)h$A37_3G0`8em*)I(&Q|ilJ*3xQY87AD|)640$NeXT!tVoF)D=F(-Qi*Q(0BE_`D^RItB zbv%eKP#zV_wP$!U55mg*H#f>`Yhpj5_YjNZzaW|biM!@_>(W|s#Lt^oDLCC9?ThrN zK$1T@<;jW6=9(TfkHZ&@;U2)9T4FPjRcdFu935|_MJ`>LXKHGU`7D{N+{G7dPGFXF z231=wP;aP5CEfOVH4Qx-^BE^I9|u0SM**0AT|^QZS-*S{qJ-$Lnl>!X@7SGfHG%;#F%wcN; z5nQI`N$pD=yp_OZN>8l)a0h>U0+%_=yVz}>6I8721TItexV0~LaD*Al^_X=dUn;a8 zAz14;GRo57xjg_$z}i>fbpyEM!xzbiPmvG)yqI=1+U98eEDlJyz0q6q=as-7-vKWg z!uMKx84_>h&O+};62~>W1;<;A_IN}4O1yUqjIVTFdwd7I%z<_GhW|H?;0ay%q$szPI%k zp_$e02vBs^cD1$_J53(!y>D@LUxU$8sEf0?_G;B9!3|%Pl?mGs z!8~KYLezYF2UK?pZm6;}j`Ey(NieUFJ*4}xL+C9*+iKrNBf!{ z;=w#4NpI}^V3ga}x>N=84ClSR3LjldM(mac5gvjYFxbx)H^KZB3xk(S!B9Thsf-M> zr93DU^0L~zR%4c;WFaIbDtg1wQBfDwliyYv_|@PWtCn_@S>MN)y0^uH69JEd({RS>pB%ZStWb5x#u$yg+cpzxQ=)7p-UfP zbrFrndKKSPoP4YG(l>0q4xgmee@=}{^42FRw8mYQ;2L{NNn_HRJH>Ft z^jV96(=mvFurfR9*gQBav) zLS}923#!HSgM6lr5#svk(G9Ep{(9NV%P~+WPi70%!UlrnE8F_>xyhf7)_m43mvD4Z z7#fhulVK_AkgCP(x!X(GX;q!^l7$AOHzUkwOs8hLHhx<$Y)rpA`-?JtnzE@4G*|ZOaa=t1D%g4OTLVm)z z1~xr|fQe@zLFvmSNb9oP)r^v&=$3~EAXlGQ%(pppQe}8RYti~f`%a`$ucxx~S2wFh zRZ(-_j${4ww&B52wlugdC=Cun5f!WaS*rq+~lt6%c!>e3y@E=_GydFUU@Rd&U4Jy)p*<@%yZ^m-aRG?xr5 zv4;-pIf%awSaX8-hS!x);^&rYF+IIw+i+N4T*~zVxH1=I{(OCOs2G{*3WdnsfYLQ6 zAvYKA$EA4;5H@blj zH$4h7;=xvjPCGssHD$7-tUI6OQw>@uN$Xe2okG*a&eC>PS;IOEi=|p@v$iNkb7?9!jgZ6zsp!cQOT(t$D6#(+26T&hhldJX z;=fID?#cLwo}4m3HlO%>tAS*5b;Y*w`brk<%(-14)U#$78Oi}?NMDZt!5 z$-{|>`M<^&zgWM}3vcBXn9b|^b2QEzpXvVk(Yfl`0-Pqm@c_!X>Z1gBga8i(kR>$J znC!WE2BL6!YSoirQ#N8_g%KpmU`mL-7B zqF^imsOvL~ zX))(QElnVu1zEM6hU(x{5=duFS4~Ud!VXSa46D;wS~V?)2X}DNf>_hRNlRjD2PZ8G z^)-&ev@9;_;8YWSI_m(Qym9HezJqf_0_n`ht7{U-lR7v@CXmi_xq4Ird0q!+Jb`p( z{nfPzL<pb@=9U7?8)y-6?Ik{b(kHoXYBgDhX(` z3#uNIz?OBFz+(w$tfz@2pyl)38lQkx%=gs01h#U%TkR9js`;L3p1`Vw`JQ^60*mvK zHMne8k^=kYdunA0?C&n>t0O6JpeqQdrg=~u>p0Q54O+kKIMKKbTERq0>UDCi=r~_5 z=bDZaJ=CC8>p0&i=W!k9o8&yR<9xH659v7HBIovw^Q|~*e?UTr79|qG?6z6dbFoBE z))H!sHz&q|ZPl&O(*-Dbb7C#n7VVPLRvnUyk$(H*wXYj*2O)YY-kWa$hR9felb(*< z^XHUD+p0}R?Ro&prET7gXx;|V(?s(!LddoLA_IV1Z19+1YAo% zxz?|Ari<7SiJnQR?)S7KTSm``E%BQamvmj9f+blyW$gsfm5gnkf39~U6Aedt^RvYK zjNH}H^>cX6sYJF_x43j%D~JjOeo*^O_{Pn(!NVO6TzwnC*k;dq$iNEj4 zj$7K+vlyNcLbbR(x6M#B*g{Lox~-5`!LJL#m6IO{SFT&`u8em<=2X#FhSRrgw{RWa z5WI?_cw)d-J@_jb#jb0KN8d#5#DBMpGj49>QI_VIAq&w>9|y-D z-Ig%$0E$+1l#D?mI?0&hycs#Fk6hmfSzuH`))yQ}b42D;haps7!tnbGE(cND)7ESIXBKGp-AfolK1kGc*sH+yDa!MpY%^GSF88wXbC@ke? zmPU46QZOnP^3JlQvdu~02$URugLFuyK-?L=`mm1=`r8i3x0P8{64_7$>>=$QZIfs z-`dAKJ7c8jU&v3gka}3=&~2sGx`N)z+f6fF)Vfw3S?4~Zo-;}v0c}4a%lsxqVcd(J zLvvq}VRJcpuCuLJoIzpjIYe5Hp3Ar1*Lnj~6EzacKhNHf_!9XC=7(5L@QRENJ#i(0 zv3B9=qY0JKwy4x_?Uspr>Yt)9)Jvn{Xn3M>v!gPXL|vK6ClN`y^-R(b-K-wW$$q&1 zTK8F`d{!pLytzFPh@Qs>&CI#yr;bL4OhS%6@fJL%i{TM}JLUM_?TqfNZzy)GH6#n` zct{F;(BtSd6=igb;?-f%=gYz^(uIUno$~;@I~XT>bE*x~tCui)+HncHQqH#Bz}u3v zivJ+PK2_$+@UJ7#%$C`Kg5*~b;bDBu8DGbU=AhmzaJY3fwLs#^7Xs)DXVm-$3dsSr zESa&4-<|w6t%358u2NM=SFEHr4GI>7*0+S#n#<7(@J_IX0?QG)N6W+E>`>N1uP^5v z(*{u~_gN>#<4h`#;gBbKl$8es+^~2dq5h#o`BBHpQ{izacX(EEu5e&QCD>tQa`+%t z>L(nEj|HLDEnY~a%Ln=`5i+Rorq$%D_31$d9h=No{^>H|IuT9m4=59f)_aZ(4nT68 zUwt$0hwO-MB}w%yL!L|iRjw$ma%E9plfrvTsNQd#Mb0`4*tc>S@?0h%wA?Y-U+C1` z4TTOjo5AykCwii-334z*>6vV-2O^&ai%;gR~?OHU4|B$ML^;noY;; zgGTF*Sy*yo3rnt#;I}1(;=6KNc3`?yHrof12LL5ZE(Q(_wrEU|3#5*65rL&b1F!l}hF8V3uVT1#YS^nb4+c*x&yH^O(!pn25WRw|Y%XUUyqImexxKJ72Rs0tCv%tbLN7)S%O27Kh4R{3@lY4{fSi!;9KxU{L2=b5xq+6iVVA!K@jarop7%_4ef2wZ^KX4J!;#i zo@$!@sJ4@OcWY6eNtNb{fxUm)=Y{25^2qJtMe0vKh@X4w(`aThf5t@KQ1Xj|*~+PJ z!j-igWVu(=-l*mm>?#BiOQfRiDc_^I(mIh|uIz;?qgTUaxN=*O^r_Q}?!?V-=%Lhd z7w*{noqZc+-pCDd-u;;RWZ-6rcY)p*58N!#9HU;C8_Y&`s*Z4bOxMvm&&9dS#kq`Q z>}PoFwC)q;U{IN8KzeFDSGyfP0Ug5V;-jlytZu)5pwR;VO zJwG=Vz1l2e2m|i${N>x2K{?1u2U)ePkU|*Zs#`&-_HE;Q$ZJSk$7g`0xO@iX^V(jY zC5cZ-KCkQe;Lyx*^{(4roY`^d)tb;Wj$6r_jRSNl+J9kTeTkse;-!uMg!1sV>V#q# z*;WduBjS-=(#kg0+~Ky`4P1WfXSWHvx}H}~6?%!6{_#VzRoe| z{wYl=nT7||CWqSUcK~@kkmwD3Q1S|0;%qUR)v*=}Ml!*BV~W>D7WUxzwr&VBTZxN1 z0@J#DLboml|KNS!!&U7McdEAf-!DM_`_QKeDi@E)eB|ny<_MRdV!Qh7TfEFAsOy?# zI}4E2Z`y-be}0VJ#{MvGPJ_RjKKv3MVp%PVLD&(j^vHPNhDZ4LPh;jwjibt|J#|}1o zZYs1=c-y+)1Z+=d%~6@YZCW<~b+lWzYLa2sB>S^(B6)}QdGld?-Xb5A_6*}U-i&B8 zxQ;@m(;0Qg6Jok?R+NT^Qkj`(u8u2s`>lL$NCP7^>IRNCxL}G#3b!&*SWqZ0db>H^ zAqVB5_XEzr)L+6!*_knF$W8$@YBO<%3nRy@S!VoBK8c5sjNfGxrH}9cM=qro9mHB= zcme3$gp@Wz5<}=xmU4P`Lf5zU(ZeUAn*)+;gDNx5<&4z}JZV+MyX0|`K1@+uS{B9> z*wGVfABWA8jmnej$&QHamV@%-J<1d3;qv6Yojf^hVV)ql?BTt`UdmXf%-$ygX-?cD zM_S;Asx9k!iv7T}z28`&yuHk+3wcQ>nKHSrhbWfEt0A;DWhSL$wa*^=^y3eR+C452 z4TM5UO#DFs50$m?hb(f%edv7Xjr)k6M5Or;J;8E2skNAan#`c7j z^$;o6*N5>(!9{06J)@r9`WQ}AJI4NT*;OCfpTKsf5}q8w`OJOIaOZK%1jd{GTCNa6 zrcnIep%O-0{3KziGw!^`Nan-`+08862kIC~^M)R;lQ+Pu34O|7uBLoi_BR|5=rcWm zSf{yq5Pw!s<)uUj`b$Dx?o4JN_kywebQPpJf(AFMsC*W9sLBEOoG_IK(dV%>I2U*j zX4*Or(`w=`5YWkjFLmss{2c3uMQoMq! zN%P3TTppR7Q>|YWUfK@m6~!_ok@S_y+D2MuU5&9453HH7@pni(VW|U&(P09xi zRRj}-c{NANuCz@W?Wy4+;oUyFH1JqqNH0G=Vsk`$<98 z#-e{wr#ChjpyyjFqaImK9mTRvBpk{ofjI;hh6aOxxLDi4KFc?tAM94o5PcIXXEMK~ z7+cJK^nE^DKP8_8avu=%>wkdJ{vn@{=tsg)Tg+(>Df2_o|5sq5|6@$(|C@|p_9qx# z>uH^6hKa^7X5g&n_Cnk>dUZ zK*jwZ!uDqW6T@r0yc4O?Ca>tf_z<0Z5=fG^U*h5D|4JwcedXQ1ivF(wivE9NLjN}y zUh6{(=*uhmEg$I1C!8@zLjQMo9GG`~dTTrLW6}RT-lG2pOz8iQj9~VEF}&8-I?*Wa z3}Z$<(I5HL$eTZ58g1Ud6!HS3KN}5KmjSfL`(P(r~Jbi!Mk->{+&8p!m%)N<+17*d#|PT5Z;P=7?Ze1 zFuc}9ok&%O${tzk;{uk77c9nT%j|48v$ z8Tm(C_ap{{bqL=hMQML{6o#>p^bX3`E8*c6;$a+5@vv67-t5sbg4qbeYrUouxzcSI zGxCX!;X}0YUjR?iUBlZ&Xx+tFbc1^Qz200M51TDDu0Q_2KF%wFr*--LG5-^MKW4+aSRB2XOg?O|@k$tPP=q>^ z*7U>rlCVoZniOS6*UPMiE@NY&=dL5C(VtDy8ZDA`|9^X7GzGr(2W4>o3tUDv>pPHK z1lbVTkopZvS3WbaD3kdmINkV0qK)FXeJtO;oEM4zc^k?!SQ$6*almpxbUcQ$XQLa* zD~>A2C$#aey$Nf75O2olQjfOaY^=;%wm45C$upXGxG;m+Mqx0UH=g?|H&a*|VfIy$ zJamJo-Uu)D4x%UF&guQ}q9Z;S^u}=t@O^qUz34@!8IIzMPv-+-$8HR`yv}F7LH_-! zH~+fHaGBI+nbe;@d?q1T>||2jWl}yLpFymZ>0HMap9w(kMi%3<<&`8k_s=9bZ%HQS zt(=yVS2n58qwWh593GrV$-WkGFE)(*pP){hnt zpN~(aeS!StuCyN{tDB=dnEd!}^241w=@xi;>T&+_>9lR1A74ng=r_n8$K#8z(!RoS z^n2X%Ur4d^Kwa^AIo6%p|3PFG7a8r+%_Lo9a$5V}?`QP>25D*1 z;EVQ<9)r7@gw*)NBsB-nf*bMQ>W2U1>G~K@gwo=?>Ts6fB{%oouOBn%*|a1 z0Q+Y^fSd!VMU|aN;xCY^HO}bj!2#35H)XF6l!J0O zpCn2-klL>o$zCd{2iGj5jo=BwS)w;TDBT4~FS!EkjXo{Y(x59w-fl^1Qd*uR4wmSo zFqQX|OaA(|zqzK-7Y(Gw-bZm-tG zivCC4+pTFJ*W<{U#DmN>^IP>ft|irI`)Y7&gSim|4d&A7gQFn1#`-%721f?wS@ zVmyrKnL*}&$#pd4*0(h6d#kOK?YJ~&W;j}Fy;A79AeU0jBc-Qh>0Grz>Fm_SZok^8 zm7SCyx+jnRsFZ$bVM^tsZ}lxdf2VX-^jeH@J5AMYEN`tPV#lqEy~}cVsQ!@mqSY<< zdPA{jg&1_pEzCS6Nsq5bY>JIl?VB*h{Sm$KQk;D%pZ(#}__m+Ur`9?!)txkUQr(#$ z946I&K3u9bKKdQGvad&bip{YFef!)qf%);X_)?$ep51YQ^&A`vlV@v>%hK|?eqniy zbOyvu5*DcMAA)->TluS)|MJ2jlhesfw-T5BJjZ)KhiPpD*SO@*Jr@RD{q!8O>aG*i zL4R&H-d>V4f9~dv%kS2`|9{i+x4)AXC*N27RAAJm>NBfaF>`cb3m=3`SGx`O)YT0PkJ zkBNVgyKf*Ezl2Zq#Hkg2yce4vzm)IX$Dn3uj9!MbhUVoRGRcjX%bYNA;x1uvzfF4C z2M0ZM*~cejWM@AqgKO44B_yr+w3hn4<-seUQ4ICk2}`IwSKoXMbKZVgbX15piL#qM zO1g5T>|VQttGX$E6{y3x0^=@%9<}YLM7F)6l$+m^4xW{GpWy7o)aTGKbyqy*u_yr--O4~iIuGz)1Iotjjq;H>h2VG zAp%Dgy_wfQu^E)|byTut=Ky06ujM9>ecEr=8A;M~%CQ^(4d+*+Y?kBKf?7Zyun0A` zmI^X|Aiexb-I1htP?#oNeaceUb7P$JuG9;-dlDW@H{0j!7QphTKa7?T(LnokL~F-& zdGN^|e=22f9}aon>9SJDLDR6YipfrBmt5qc*Mn?#CER6{YY9y z`kT-?8|I?L1i3K#AWGfFV?Xl(=>MwFJ1U;lCnl7!%%FN^9cMxK2nBPlPEt5QRa^Y6;%)$r!Ms|b^{v%4+ z=F;3Au52ma-sDm&YI%J?9{GalJZcV8JJ%(7q?=?{SG>%};Q5c@*$SK;L|vp)40(BQ z7@u|gF6K9sm`wf6T}@1Mq0N0tViptg_{2OvG4F?2f3RnFh3}|&cKP;om`~FB^qr(r zju?kLABQP7x(;UQRF>S=CH{7Eif5N>*IH{P(Q>b&rh(*QIdhU@VDV2%PwO0fOrN3W z(HD374{tYa$I~#}%_S~-{BHJ)>Kj$5(!SwZ&af^uLANMq568UgA&9uc$9&0~ER zskmKlFmREST1LLUoYrhgoY6BtYlbBbxYw7s)6u28BQ^QmQm}NYuk~Uj!_Bp52(Mu% zP>VNZ&}KhJXqywdoS;7SKzC^otE(7E0=Jxupj*V$STinZ_=;?X7SCwTUwJ;agxQf>q79!HP&j|HA)r4%wZFAa=E!#$bTL}kyw%NK%A>16iu ze~{U&ha8YZ%f(XIDU-`dW1m|YxI903h)&dF7H@?`%H16^|B)&ECFAeLsqtkTINfZC z!3QMqNk~2 z-gFmyvDh}i zg+aBX4}mmXq=`^j^BlE{s$>?8Am2EW_2!4=+n+D>QK>_dYP7$~d?5Y^@KXP9AJdFd zUuVSDO0-2~OID(b-5N9(eH840`lOTDa2J^^Msv}}47}XSy47ddqE0C~w<*J`j z+nb`F&|3At^=ZFX;0|OlJy2i9wP2cCMxQXs#jaOA{v@FChMD%KFoy?B5;;7Wk3TKv z;`$au5}%P3@xjah)12m5X%H)_r~yWwCO#%ZJr1POK;jdBR<6bF^3M<6*I!!P$l)|q zlhRUk?PIyDA49h26g`@L^bKTgwsxfydm<=*}rXxg9nJZ3nfZ})as=XUq( z46xDh1$^yF?OLWg?_oq&D7_7*3rce?WBR*m>U{Kcs!~tw)AD-Yz9nm+_@$KMzudcRUas@Eg+-${ zVt3gW`+1Oxt6H^gO6o#1?-GLOQzhKrT{0iK4cii$z9O4>9DM%G+VI+qXR=(;zr6yKh=plky6?o z49|{z4b(<|^l;MT$Im2ity_jY%yr|mO9x$-b^yo9v_o**uNzl45RKz@AYZWhI~;VE zu%#gFlXQAL*V`wh>)KHIpP5CLmQH#1q@|Mv&f4~-q04x&ry{tk6D<`~PA8Q}*rSeU zsi~IUsU}+}I9E+*`dWd~mj#9B>%z;{k62h$IH{Cu;S}~o>N|$BJt@tmDb1161--9J zsap?zkhC)1(f=yr*c!B()S8T(R&ISknA|w!bKFLt%@kdRi;BMidSA9N9hm5{apC-| zI$1jQqRB0TuBhk`q7oBZ_UE0@lJ^(_J-krN<$X)3Eg}2-k#3IK9$fS-aDwRD!gQ-l z!cF4RDl=JgucmhGveC19rR3)sOj%`qL1XIq-i%CdMnGThXR%SCeVdaQhkWuOU7JQn ztDd%Qq&)NT(xDQx&OVmb zc_Q$r$p^rbI)HT!aAyaw!GeDWx3R&!gm&{|YvMQ{--EIE+3MVmRk*}!(?YM~d%R9v z=rz^j^)PvzB!Vpw+-&haPCzB!UUzJLB*mGXS0?(c&!_&gUsmpp&3#D*3c_EJ$%SIG zW&!Zk6krwrUrPaI0r2${U={%1NC9R6@XZup769K$0cHWfY{Err769K#0cHWfyGstk zEE|&!2a;Nl41Ois7;o#Cgo>FMVB^7?nnQTm`lh#g#^~V zGJgqOf@{eQ;*3-&Qt6>jUxKVifxHntI@Fy*X6<}pDE@yen%<1+L>jQ$*Gug9uj%ON zE?G_4nMWJQjjH?NOQF%{?m5lHVr=%`fG}kL1f%^^KB-Vi#Z|l8oBMZQPT=Tdb)K*`}Rudvo60G(JIM|3ylr_MAlK4xJmjK^M^JLHUovpuEA?8%ONC z`g*;{jyC_&P@l*buAb0!OnP&_!ewc2Yxhtxz)a5ir9YAfo4(e{-5HjH|^RH zOH=w!rTxjBwC_yQ&Pm1IwEwJ|cKIBb_LH+Ld{)ve==}j}E_D_tr2hb@%LA5-3p0Tn zaH^9wr+YNxlK$GiS6;Wyqd~S_r;oRZnZkW=qPNlTG2kJ6wt?BYTc4rL3&R-jkUl%W zY<)(bqqZyzW57fD+z4jt8~Pk~!on~wz}>RX9}e&_^h1Vu$ccop&pWVnQ@Tr)JjspX zN#L~f`4*op&UkCf$pG#1CTzVvhJJ`JyHtT{=XyLpYp3H7Ve73tdKs^g!~Varx4PaO zN#lZ1K~qFq&mKp46{xeTcTs3JOZK(v4-oEg{?9_^|0+3uR1tC<_)lgIBxWHoAC{Q? z&Rk`N?%3}Sb6?g|ZSE@l>gvf~g%x9dyj(r{jtDtNUGJx{$XJ}$(`dzkIWbeHye#k5 zZ$H1Um~YT2*y^ntcFlsYNVpW1Jyx;Kq%#fu?+ZdNcQMbuD!nYDH~y4Hc24P~D>x(# zjin5nUS>~b`RmTv_=%70JogNs(y7ZueWuJbq;WyETJbq!YWR-<{s3@^VxHCxNdMTHyDOEqVv?f`DLu-&`vgb&Uz1m zrm%k#lH?38VMy9GfPe!2_!e&2%tbw!LiJ(C9$i>9eO5?@3%}&U2P)THBrF3gdb*%Tds&2N$YGPYn)cM<)uc$2jjZ3Y1U+ zy3T>tlL1Lat#BE&qLWbt*?vrxwXS!_{)pB{o3#ut1qO6aVh?BY;f8DS;WXlLpKC2w zZ0k#H!^-z0g50`j5K;cQP(*bg+vvlqlv@$Ko7^9?@_7JWgNP_E^yMretqi9-<&-#8 zR$O|?t_CL-85rJ+n{%e%msi+PS-W-CH-X?O6Wn|0tfB5T+R#%kaxS?!0w(oBadO;N zCti)5J9*o!e6{7=w|Xjx?^B)hqx0dm=rx1t5?x=Sx*Po~puUlQ`l%qyj-cH2AOJbr z8yM()N~Msz&$2wTY-2iC_3Z41+6v8N^MYoQQ!`n^lj_{Y8`g5JdM(Mh>Xpw~^^%WW zhUgB>Pkm@9?JsZpFtD6ioOf?JnrmQ<67E%OPUwE( zx%1Vcb>Tw?^`S!5+@O$Qj+%Lb+IKLRi`LkFMzj{AIjo1kOr9(H(ZyZr%_BL;no^5I zi!DWkY4G4vLZ!xga#$Z?5vd=!k$C#acf`VM`xIxn=fd8^nljU$J=V-%mWvR8XJ=0^ zlU+>iv;Z)eoju-J!r4vElAGP^Ecw|jW?4GB!OR;S?dWE@ZQjk2YvDV7?1y&v;0gfa zgR|n8{%qAul#9(oyV%U7vz+h8|3-%%?Qx{#>b&EZ&uFcZB`?Xhv}2p#FfZ?@x!j7j zDLW{MFglX#vi`MAn86-?j2Yz<5{i_&xOoV`o_h?&xI+g88w(WdOW=qZHLoFfx>zX&9k{U2p(it zT|bGAL>Gw?&vxAh4s$BOk<#6Y6%Y-XI;1x2dD~C?7Hstq3OPq3zGvqqjFHf(mn`>cI5q zu@EcQc+oSpp6#uiUVdDT$HAv7&U0+;&uZOj%bu-!mr$1N-)eG?Ecj%~I-JqByXz4; zz|Lt>J$sTN=-ZH7_;;F++maB+?>ml^c1g6eWSMA(nBk1R3up`AXy*(;U!%1%W;mm7uMAu6WJL;z0bEXoO^W1IiS|)xXL$rwt6Ltc zPQ3TEmtY_FXG=0>^lf$Ik^93TA)1oXzV@&~95FM2vL-Sp=jk@>g2txS$G8y~^-DLXc*qE)ZN z9Ibh)S)XUHa`n5rX=|f5hV_-tSR^P%16QAV`eIpEV72=UHhL?uW`6YhEYMZ5-n;jN z9UJ{>fjhcuME0{MoKsO`T%{oAlDoe4Gw1A=^OddhM+@dVAm^z!Ecxwra}LV6>r;11 z5s9#i<;;9E{>?LvlyiwWpL6Mx&U)k`oF#K!`Pz5h{lfvAL+1S1vx6f){T!Ubwdx28 z3S49udb%-zNFamPPNL2IN9%Rjs7R`pSA%1mAIOY zzOx$rR{@2-jA*4wk0#;H;%*{$hN;6IcdF~8E~_hMyZUZB5-8VAYa#3oOeP2Sl!+IR15R6VCUGDeK_HGbEn zi2y}vPtY`%xCd&`U*CBY9YABFpTK>4xCZHpgRe-)ktC8~N-45NkJShUKfXPvX#Gw$ z10{PKIf#Bq#<#{#L)fKFcK6sy^dYQ8FKmAu0*raSy(`Ax%$g#!#}i=g8WwoGbK<#Y3!xF(*Md7;E=|$jtZ;j-?i*Uf`Xj26G@dzN>QwG$X_9~5)zIW=WF9;$HY727?st-m25M?p3$MA5mh$r4xfZapGob z+-5zM^G7ZWybI~iS(qF_+_;#`#Z0JpU|RjBmK=<=%ney@p33ufTBY>otB*aF&(#yd z*d|8mN9L<-*`GAAv|b4-mlx}$aFlOfSY3hP!a{EI)!lqlho%kE2#N9S)eT9;fp+s-6BZqrzyTGME9NzX;40C z?|wmCc?do0AVRh`)rwAEP#YW}`n!3RGlJy5X#A3d+bjV7ngYxMV1EiQOHa_h$pZuy zxo#v+=2| z_1I~Ak!<8akohI^rV9COLZ{*gyDXXl7aI&;CWY&(AMKT+SAvgjY_Ni zW3=ViA|M-T`*Q6UfYl$Meiv+d9%KupVDE6&Lx*J~J{p?iC`CAi67n|kgV`F0>--m;8Bja zUnSg3^UXNV7s_)FuuYPbmcr{Vr-IlihGXE!-poN1q2n7ISt#ylo{8&FJM4{iNJ6C- zgG!HkX6qc%kG??P{xGLJ*bWV2quz$l)s?Ah4<_|B>Plm4J1yvrGqBPoa+p-=XdHGx&u3^uXDtror)GFRl+3Jc2+*siapqi-bww$asQYe zXR4ZT!MxD+J*7lBQga|T4-}28#*mozoEPw+!ZSYNb=dlNS=DjKGop!4nYY*6JKp!I zff`S%p=bSd5WSrIDf*4j=hCfuA&g#uo3X3CR^5r(1yfw>Tm8n-zV)y1O>B1N!p49p z>V-D*t!G@i>m|+ey@K_ZcH2^8VmWs%U4oKV zP`z~ONTFbje*&$wJQmv=s8H8Z_mWCKg8OEn1F_dQliu_7p&M=Xc&)W!$1e17Gfa)) zzD+36_7{6=Xw8~mIzIi(@$k6}KC2^S2X`E=zMLV>Ub>xo0JYMzG0(M@-mj`T361ex z^3hZ5^sfg;$&to86+xx;mIa=Y**CZy@z>O)?i+iyz062_whPtNvq<)s7agJN^YdQ3 zkyy>gw0Jm-W*Y!*LLqX#qoO{&NP6y8J=Qwt^)8`;OQOY`g8JQgYuInq(%kah@iq3F z?JcKr>vH*Y$A0(PnCGxoy678AU0S#mD|u~zs81*`NTndzy$*{i}96f*Y3>q~VR-G@L~m^tT`l_jJ>+Upd@O!_N+x1{SVw63I^` zsTgMMraVl!vNYJ4*CiRxZTd97=9p7HKAHF}f4lkU#mA9iWTUQhyzVo~Nf9)T4lQ5N zP26&3lCPfY`@czTzk%CoAW+_0n}0Z+o9#5FuRo8}4jqIx=I*IpZe{uek+o{yeJeVR ze0?YK+YTRjpPwu5y)ejC_Fh;!=nZO{6^&e2YaNn+YwyyRTVcG+cX+WetQd~1N4Iw3 zm~d=jpngKQYNF00XkxIw-n(A26*~)2^RCx)$7VX%U(W0=-b9{Yzg%z)NwwB}P;QC5 zQ((0`IE8puDqd^v)+9#C(fcW3P0&_{xxJ?3Yny_tC!WP^rBRWQN}Z>@$%DGu78$(+b3VTaVW?en9>o zp2sEil?jhQe4@){Wxvlk?vvzfz4PyLL0qXUp=x=r9N^ZsiCmr>7^|P?sMDj8&0%~p zG-YGGVa42+i%$Wh!ZHl>y)@9eK@2R>el&3$g7yY9s;$~E7~6p*XoOCcD$AQ&3Bf}~ zdFlaCO4q0prRm@u&!lZN>1m$^>Nw-Zhe=j^dgAzK#}S_asC_1%;@o))2Z;d<5@#vI zF8M^vR_gKnaQAKc1S!hJ=V0&8M-*GVGKI!&^b%n_0O+PygJ4k)y+m^* z_K_J09|&yr0;m>@f#zaPbIizX!Rz-=Tz>Q(IOSo##8We+)-m^^S{=#Y-dIDZ{b5Ob zo)5ujFY%*)pJIy>;$m1VHlKnvBinj7m*M;#S5Yc2+>_*6HlX9#D@tcXU4-(mmw9&P zDSb|_(L+!E8_E8Z`YV;`5uN%%P0@2iUW{#?AMRx0VCt;R?cq-NvzK9;JHnkvUhFm4<_()zyJc93NJ7voppR`l0!@ z&HO_Are*W4r>-p03d!-63*zm->-ijfU4rfUzmY*?p!%Z+l7ew7>km?nsTO%-gI8u; z`UBM|`X%r_rk3X7bpzWeN}SV`Y4h)|2Oj%4`CR*9;sBcJ8_vUIqUzS*Q{6RqV`4PV zgpy9^(usV%tX&vxx~NPS>k>)ioC>=2`pLxc6GMoCp|-q09m!=R!#^6jz71T}B~usp zN$s=|VeWwo+xno|(53J-zDqvQK9vfMShuZO$6h^g#4X-Aa`kZWkGMsxF`<8Ad>O## zPL<>Bp1mpS>Wv>?jz{|uB29h$2pOeqEnO92b?qUT5qwH>s&N7PUeU*t$Mq>5pjXJb z^A|F@Sd3mFYP;kUA+mtST=ZH@-=;d_OBN-i`T;9HKSPVi9Ha7Ez}F+i*Oh#V$y{)4 zce=M!)4j03d0hPCtN3&#cRyhdD*8A)vNW!rtU3In@K(2GjoovqHPyt)y7)ujTGs3M z8i%UlM}wa(*Ki=_SCr)+|eT0L7ujJAiL`FPWsh z&ufIFfLq8~K@y~Eg~Y->BXT1P$Ss|k>m^lxTze`0%96tDMKDE=pPiA#vA7rFDn3) zGVU?!MCyxkC$rL;J@dC)GFLXt++JI5_iA%;bu`F}^1Jn|scRX>QrN9;O_y#%mBVhk zWsnoErbzX6xxMXcA~av(2#L_l!gX>UfDx`A=h30S_Uog22~;~76nXJ*kYTF7orK}6 z)_pSqxuAQlp5mRPO7uknIS4Na$-79`XhFl^4r@2r%xOw7e-2@gS9~mXX2%74V?Zg z5yojm5aR2EU}R*!*Y2R#%4N)VqUDeSxb8ywTQyy>R_nq|eqS4#qW56vO(-922t5S7 zghb-A&EZXJjXsj-*@XGrHjAJ~Yh&`q74j&09EFS^m7~$jq0r$A_C-HbK9gOe9ng3s zn}DzL{ACNk1wLe-<)6w!e}1|8usi%pb>|)a zs8{WOWOean(bXjN4u6@qs>e0vjrF*edmTJ058uw6tW%%af_?3SwlV2CugB2)?I%Sk z|KW_h0A1Zp620k8fbA#niQY&ZVlMn9jLQ04E_$|@nJe$j${a=K* z1|cAUeyV(_FYR%p1IpxU!}bke(oI=bM>9B(rO*PamqkBU)xp+uHuB%SJ+`64a|15B zQo~JOCPAK42CJ@~8pv(_0DxtEo8H}pyA8fHsq}tyQ$azc0$xGDCk=fR`3(v__JwD7=I}NI_lBXJ$Eb_z2 zpVxWVr^h3&DR$_u`vod8KKHBJ#+eOLPbPAD(_KmrJgKZTcb`;Q&&ZQ?!T958e#`AH zQ|342df)!C0P#%pr%S>H`T*WZbT^zuf*ze{G3XMkuf zdMdD3`=yK1qVg?zcZ2HZB@bHR;<6}wi`J}moiZYcguC7bNDb ziFsRMzEGy}`V#Vbqw=~~=SFO)#rui$E1Q*id3v>9GWGvnK)dKjZ^xL=WoLtCzVP_^~ej3qm6t-wtnm^|iV9MOgZg)oM-O z9Aa^AyWs;sLc%wK%D{bKnHb_L3&ae`b%Y7euVdw(=;{P1R}+Uc5g72$@bdX5x;rYW@A zDnI&(y0NEt(HeQ%QRVSUtiTuw935e~KpiE2ZXzF!Q{7BN7=0!?b_@=2wB%m$z>lt{ z8qN(fyFkRymkWoy_+{|cG-jmGIN%Vu4pgzE5E$$jw~)4iM`h54B*9v-|Z5 z%v~aNUmpUTu;5PS=0`pR*f8N38x$RtOO49#TI%sp zO0c6Ks8NVey5Q7FB0dZ^-An>mJU@_lhS`=X6Qnu9l`mzIYugMJyGy0{7~3j+HE4}u zflX5h0qYOu==a;9*8@5g&^s1_npCi1!0%iLF6Tz4h5$=2JT{e2iNcJU^p;0Uc*tpT zgo~jQF8Zyv(zBL_^45PeMho8laBZ5zZsG>!*QLDs?jYvQ!rUV)S1N1gT;8tf=B<2s z0@u$;v!;G@nlEgzTiI&=o6A+`wrN^TI4)Q=Bpf&A7qaWlMw`5IcjlFiRNnd8MH|2C z?3%M`xw%R0KCNGgE{EF^Ta_qw{F?aO_C(>FR7gt&q+;1xftk!^(P$6ls8_mvm0WSP ztPhR3i>TE(t84LJ@CaicG%l|dJdFPgD83(`=v|c0NWX(e%$@3J)m#u3X3o(4cr3s} z>}SgEIXh!;5bq~sA*P121#bQG%J$J@?sy?8P&a2EMegnoBW3rU)EMNPgKCNw5Xu4Q zik67n%tPU3GotlO!dX-Y#~qK-u55!nDm(O(HJyt%RG>KEi`>E`DV|7EvFTf6t4rGG z)Dh7zoR}U%$gFsnAnm)L7=IM>P4x9(egta+neoSDo|AIW#HHI3+`jN;&6^V@-0`b8 z-@`hq2?8ays>?%3Xf#GwM95M8<{cgKi?9fW?3 z@+XfJEUE#UTWY}xB$X??!OhJcL>}mmad5LpUST9V?dnJs^y{HDzDqvQdx(GTkqdE->b5=kL`cXa ze=lTE0?KTm9=DGHLu;bP;2qBB8@&&tzFc!rEpbbaqd(uXlZoaUptXf$pOhicY!%dN zdeEZRg48&2{=&3}NY9s*0*;-PvhHjpw*>il#EMoXE<#hGnSC^@QIVs$(XZ%9aGkdiKa-N~n7}^0SZ(A|dk&*84KiG5f z;Y7d}NvA_PI>`yyTH&7$lXDR!DmvE~5BtNqO63g{>2SfLUn^4OaxoL=uyJL(p=8qc zg|pXzJ-@?eLh?oG$RRT?eiN)k_mDnRf!rxsE-ifu`9Awt#icv071vu7SHH*gqy5B1 zBaR0#-ME|0u&B+Ppgs-xVMDW?D+${(IF5_Nq*XNeMDHiQ_|3T4^waRsSP{l=!P%EM z`&#d(X18xAK{w=T{`?hb1#mk?ry+FEJ`9&?Uxx_KQl~?=J&w^{$Fd%W9lNcKxW2dr z-zSQ1%Z3FUJ!}C-%?IX8r>Z}{r*V2-bGG_qq78;%H-0O;V=zJ#qjkzDx}ipak%m18 z6A7l0ZWNX#Kb=$bj0IjsV$PE+-$pFobenEvD&YPrL$UEfdu%5gk5cM#*EF=Jp=&A` z=a@={G0@oL(Tv1Op@$Q?9L7F}P>~=z=G>|E)arw>@g-2|ECJp@iHff^#CZyFvH?3% zL+1W4MHe;(!+0&WU+_H&Hr?JxpWbJrK;X9b7g7O-?R79E^LDtCQR zAwI!E$0uUgTY6_F{sPpsad47DI9UjKr1*Xbf&d_7<5L{MsY1}}#B6U^3<7`<#-}-i z(}j>5%0*`-2m*kRi_dTfX9^+D^ooKq3Ic$TkIxc<)-)kG&s*Lah<)p@TzmEPhH&OI z)hU}*LY`aE8fP5Z_IK)Q?O&HECr5Gs4|%oOQIiz?4A>#M) z@#o4K&m7&`8HwV11hx4>W2+y(6IaEwFS&opTu!ZPGo+kzQlvE4`#t{6;l%MOdM0TukvHjrKabx{&@G4| zGb8G&osK6{?&fh^^VC28%CslU4fRDFrbN9pIULl!n}8Pv52Am+7kK<0oTVZp2!+DD z>p%0IP}!^!E^x|bHs3FX zt>*oc8GmzQ*t)snIGX##I*zfhb^miyw1Keo&eY*lYVP%-<5YaobToNQtNMTx8ySLW ze;l7e{?9=yEhmtcGu3aupX@05eRYnJ#vj0*Gog&sP;Hek)N@giL7LwT;}3#o<3%BJ z9(hDR#hT{ZaGtJdP`9C#Fb`x>MGK>CrmK#%?FnWC1BIMhcErpHLN-*_X_}ygNBjlI zpggU`$AhqTf$4Nw%MEFeXtA;ROC%%Fd1i_9MZ6Ne8L+<8aW(t9dT{kqx;lO7r492J zq_d24rsQZbvv6eGbTgTBqQA2T?bUMpO(LkDf{T%Rxzu{fd)@H&RZVOPjA(|jvUP#V zOq2C6eg|QYQh%S$%uRCKuF%Q+>|w4>xq` z^L>yxs6GoA#^2-X`Q`4SKAD3lKOSH_ptgNLUU9xbZ4SMb*HDGfwK^RloDuQk6R{u$ zzRQ6%u=nM5vbpV<@6qzj?X0Bk6P&x6y0=*9`A?uqZrLK^T;vW2$Y0a!tJ~y*f38P<~#>j7GQ|xDe__V zgaKyg(hb~FXnorV`Nv5(`e~F)G<#)NWB($F{+vGI{qWac_b~vcqTA%amejo)^&THn z;CAAvk#1(V0FI=^xe^E? zng1b^bUscZoLcJ@7j*dhFij;<2v$$e_$S?CW{#QjRY&}IoXkRRvGrEMv`uW|#peL~ z|5$qyFgc5A|G)FTZ?Cf?Ju{h^OhOVuCcI2{2gtC@BrE|z1QZGTA_NeS{l%UHgkeHJ zaSfn|sJNq`;*RTeK|uw@Eqc9P7l?|u?|QEn^&0=5@2Psb-6%^FGB*7fj!`uh0bcdBP5FmQVaS=9BmV zV|~4D=ux>P7uvNw^hEc{J?AFJDk1WhaG$w*PHu?$K3nyTdnr2ScoWZ46>A*m9H5CU z<=O8g-0_6-d&tl!f7%|>ZF-a4w6CGrjwXJxhd#pW=92w_>Ean(@Km|&D|u6WSs^Ui z{VKP^3=z?-BC=hqvfUwf8N`dpq0yz|qh~6wqX-_vi-hEPbW(d3peuJicQ_~1 z>nJzcGukRerVYwlo-Dv7>EkX=1iqsd^mRlgfA5S;=3c7zm16W4*prkJxiYNHNi$om z_=~hT#;_B)hR)|DbRZA0R0zq8rz%Mrm-0IEONqWp3BsI0Tp~*ZV|!uD1MUl>AX)Yc zBOY^1%w)j?6n*D)G!fTPL5L(Xrs*?yxnnlKBqL!tep!>lc%s< zv^_KM$=W(DQMl6N@q)G09q29c31{WD#=r>kBHQEwpCDNKSzvTtBHOwGpCnj&ZQxS{ zpI~r8t|?zbt=Q@cQA&`T7UH5xeY}fvn&O<|VEA?3ivb?{mCD>x**^bBMj{(1?bXAc zj_vag)pv(0R8Qyj`N!(J(-o|zYy14Q`tEXt>*?M;pJS$l)oxe7%(oS?&y^vQtd%2^ zjLK51pMyHkLmGv$>oPF$L-<11kj3O-&=}t7nd?+pt8-by4QcwWu8E7umyASu=53#U zjEaM)l!1vqYh&)49gDn!?PS#t$PPxyJBlBKh8pvt`15jkaBMD3MS$ z{U^9XFS86d8ZqEbs21zyVo1j!m>+e=f`FMF(v-kLEZ?o8|FNt0T5;G^O zgN=crTcKW%?k?TVMM5gi<{|8>O+8<%+4jPyCbmZ?pX6Pk$uCb-p8F|Jw6mE{oqf;d zC^>7&t03C^3K5jySJm{3cN*+%#7=`zE}O`<&L|h6abK+4Rjek(3MtqAX}OYPMJ0JB zm9E3+Nr+Q4L3HvgyhgY?tAWeg^X9@pYS@m1x=Usr7}AsrOXToZ&BVvTGo5OD>j>BZ zv`3VC1%05uiDme0){*f7dy!(ezj+kx0ax8j%pGjLM($=EVl1gh6D%0+pE$OY2Oow9 zCQdYWaN_tbeJ_}Z?R#kA0CN{k9AxgIi6hM2ZQ^`$7f;m9T~eM%1ZX`~XiPU}S{ zbIhv$N%UE`5$Sw@KKSBrW`{d&z$7zglO!EcH~mZgSw@h;5z-a{m1{(X>GyOHd$ z52@o16!6g&uAZ+JI&0nO0~gxeuKIkMY=3inoo90Vops|~N=0XN5fh8wrZV+2i%ZT) zJ_ppls)pU-_$+GFwQXr{v3YeG9c#uahw+Qm;snyx!nJAiMY9KUd{TL&7(Yf#<_vdt z>V3J6Pvn;F&8O&>Tyv+=MqB}1a;B958&!v*bB9J?(X^R5qf)E1#$4Wtr-?zVrC_X_ zP9-k_6w!m@A%wG-{1PcoX@cWY0%AFCCG@fN&+AnL!oZ91o3Ax+PuE#!V-HqT=1**G z?XGHm8ZHn?9va=1_-tCkL@nu43f1DOH)-|VM#x0=6yb~x2qx9>Ve&)ORZ7ElZNegt zoB{q81y&QT!`!+U&~?}hJ(Hw2?=FIY58Feo6g&+0WQa;#L{$U+Eew^P6EN#qBoB7CVoU#6$tx$vgn9^tlS^xr?d8)QnH#D8{SP1 zbd{5zfNa#u)|QC*5Oq+ta-sPcNf&v5;tBk>AuZ8eB*&c2@Qi;-2oznCpW%92esA2? zSK4@hx>(06Eky&-fXVE}b3-Slyy$MZi*CyGQS@9owk~vIENuQm)K{beG|F-tRyM9+ zWpbx$%ulWW+2{}AKeBHOCKbdT01EGXIT9IG4dP0(_XIx_d`QQFK0;d>ei%+nSI;hnEDjX<6q&2x91ryod6W^Qb>^SsTg+k{iRFe0^R zUa_$kiDJ3fu)-11@P>^e8UsMcUml7kSMlVg5jga75e&csL6ikpDHm<5pVM5lx6ov3 z*jYPdZ-t-HANzt+fAlkaf=PvN{ULlXso&ZA!$SW5><8VLPEw*ltfL*f zINhiR?)=9t$fJiT)fKz*=d@xzEb`ULQ;Wp=PN~Y+Hz#`id88xZX#76!Az0uyPbtw4(A11sk1Zw9Djt8 zyYhQ^&45qEA>%bnJyYsokKW3r&dZSQRm-SJ1}bA;W*Xl`flZ5MmNL(bVtN*h0gpbq zm6fSqEdLix@9N^JynTnL52u*fdd)?3+0LvuojEY2K`{0N4396`KhxCM-AjRFoMy>! zUGPA)Q z*af@3O>6bb9cyKz+!o)rioeTIv8(o-Ry0SzHeC02O>M(9li#-)AN2)6(FPjVlx$4) zTL%qPYDfGF8ga3F1GsL*j*r@*R_;$b8cjIOOVftMXqGs7Fj5#FMYp5dU2=6RPuWD5 zrtBs*H%}o^$(?EI`2kRoyT`Zn>5$9LCz1U%;B17qyFAu-YcPq~!2bhm%*ZV6y4nIEx@a&!K8lE%Q@j)$uFVq4ah74I}^H`dOgSLbs)hS zCk63KXf>^mnhqWBtyi%1Rm;4iUTN1UQv@-Zts>l}t*BBBCiR>AN*QaW9Ql*$uEwa7 zu{D32PT}?4Lo>S`ucn!Tc-VfGb#gGE^^O*rLrHGrXDl=V+-H3mB&bh24U7M&X4XNW zLr$$#3~rg3OA4ubnDAP%48Y^?6kz~}r=2>BFH$@IsW*_R@z#$?J@)mp&XyUT0>#^x;tQdXD$f+5D6~97-iWk1s2^0U(~6 zA`H+z?&Y)7t!U*sb?#LU{a3E#^@NQ5r#a3Z09#q zTBZX(@eNmO1}RMW*0&{`Yrlo5<6R<#_=i$mCq)0$i8$~;lHnr&%$;pxP_?ZyXUa`} zO(iQe6bj&kZ;?=)ZL!?sch=r>Y2n{nd*_pPx(5G)8vGZo!MU^C zYVfqZ7wzNP`@D$*5V#EoQ(QR=9&SgNXuy_`9Nuao@h$1~=PUL(3d` z=F*LX`4G)`BEhz@jNepgi^Msn?~}rm$R37JR1Z%@W`5aR8^mp;oBAr3lMCT|jE{Q; z`LLmC@o`4=j*rt?SunfgoM#{#xr7`Vrw3{k$GoK#cZt$8E?vJByjTUA)Njh?I2v&L zR>kpK1vl1|w98;7zjYj$!EY6ESI{rE22Eb7a-6&)g}Y+N08RTnuU4UEpq*qdErT&! zN;a^>9m6H!(a3*3c)3lvTHy`2G1z)y+79toumru~O2SWsG^Yes74EQQ0(?~gHYh+| z0sf=_)JHtfWw`naHf>~%8*bP|gCEk36MrVu@Md8r{tIwwLIvD(RXfy=6zab%l&}+j zQK$_Hi7TyBW4&>?iS9qZ{F6d=UN%j z;Bt9|8xi*DsA698R5CRt&{;kUCY5smIiv)_H}}Jbz|dDhg?dzd@2rk^DKt zKd7?kB_^|)0c^q@@TC;^atb_>0;J}`uy1m}*HVDX0}k_z6rc?q=9?+-trTFEa9->f zYa-tls1ZfJ2Iy48mZ05?MC_DAEO@ZkeG}oDG=c#ju1ygJfS61X27tIOMHm2LN{Ab| zy^GsGLSx%!M~Ff>50&nPX-oq^yeLH&0Af>$FaX5$DZ&5{FBalnYA7J^)|Bc!Z9O4( zu}xh24GKz>&1o72z*7b}bhUC9(8s}bH{xlU=d0feF6cLX>nUM__@A^DcdYy4?esE- ze@+?OJZl?+ID}-9f8r%;010=-ISfh;1lc&Clt>3%O6{hT-YNSf$LQoZf@2NiKS9KU z>+J;DG~4ZabXo@6&;dVCi@@F4`@6opFboxcZ}+I&`g`2H-5b;19@ue0urB(f-S%oM zY~G|nsDb1cCbOe^2ivY|Jz@@ZQOms~Z8-yIAI&KT<2KxRo)OammtAP8U-5kE?HBA# zFI6l0H9HAN6E35Wvi78fa1+7Ih4h1_)QZ*|H_Ew&yC8{#x;SM+I);k_4wa;+&SBm? zuuxZ|sIK9%M=d99n=yK$;cB$dg=?J)qY92;;j+VCn#M*kyjmD?$fd3L#bKUzamZyY zWNEls+RY(1w4#@Xu{G?FvUcOLuMAf!9@%UmJBF(rgBEhL8cA*a%CxNw0CBSrFNV?u zz?R9eCyL@{v%Ih~ow`LK2>B|x8ubQ%xGhB(0OHjt!T=Drrw9W;ye35$0OD35u5vDS zGhk^L0pXO;?9aBymr!@4(G1}DN4G<49@M=Mg?Mcm!T=DjOA!Wuczud60K}as!hoj- z?skcc{Y<_>UWY(nF9)DF_PyPeGBt6haPn>}4JK92#vrYya>rk!;VcRX$j7I*D!A@t z^4_LlbwCidH94@6<-9(md7h%ZfpFH;27q{DiZB4gn^J@UAl{rJ3;^+#6kz~}x26aK zK)fwQ7y#m~6kz~}x2FgLK)fSG7;rdOTxoxM_~z}Z6(R0ULl^+!o)lpK2zD;6at45S zSBfyekAFsn*U48F%poE}RLxM&elVoZF{Ac?-1IE){vd`Qs>B6;vRBH(sdp2R<)Vnk z2CP~voVr)}Eq2$A;0GhwsWUw_6eg5eTq5W=57*?vq|SGJj&v%_r;JYpo5v167x`ud z%nEFmNo*Y^iwN#`=5dZqnYc3u?F?K9hc-pg#!~m;t@dX9osk7;RQo(!NEgIMb{{S> zcI=d!M-^CARPaev-{)btK8KnftXSW@x$-1GU%R@xU{3GTDKds}2bG0!(fm9>ZFHXu zYeDhZWDDDZ5vqkA9=RfjI|R}OBy!Iqel#>X*X$slrIzM#fxZ!p zv#^;_FBOw+B6MQ^NUe{d2RO2NP;wTQT##fgAy#ee!#bbm1Is6S-i(3!KJ|T=poCtS zdcV5;lfmSBaitMFkBAcoAqHqJAx86RekQ8mrWC*hv%1d7v8LuOQd#YmnCv9N|5X~R z!bS($mZp1Fl0<3_g~Skw^X&{KmHXti$Pe{y&!ZY3L^bzk!Q^{XjCtpAZ+QIZJoQa5smhPP z89xUmHWF6J} z!@BG#SlcBqPcXt?#sg!G{5E==M_8EH$Y=6e^Ouh;2J5LST?Ty?ayKx1FHxVhjQ~ex zWthgWez~50DI}A`?LeW5gc_Y;^AgG&bA7XLZD%;=Pl&q zWhzQ3GC6upraxZ|qN^O1`ugIVD8q`8u=zTrB<{!Q(_|AJSPS>gRKVF`fg5AKt_X9m zz1b**NUT zUQVhgM==_eNnd=qzVr1ZwfQcqg)1QrR2W;t5h%-_l)ARp9+#a`nnj3jrA5?R*pYz7ii(&l!3Qg?Fy`*DwA0JM8%XYZN0*}`AHG`&; zCaz}V$&-`G7g%45$ws~^+1)`@KfF*s)I~4Ykg{78je6L;^o*3~9bW27E}#hlZ834Z zVB^%uZZFHtyUy(`RM(eL*UP8Z)e6KFt4~p$ba?FR2EYb!)sO=#c%go9fFAd)v>&uk zH12?>69)Q|FA=Xcn0Dk`cGe&YRB{Z|D#Lx4u_3}FYzr+9E`TrvS98B5& z8t;lj(7(c@|7jR!V=eni;PaJ}TR*yyI9}yGUAx%KgXQ2CxYB4Qv8Jj-?d^{fWEKl? zC(Fx7lrO|r5ZbI=Vi`wM*YpHzD(X-hXZ@nBThjf8OR%sB$&bwF?z$us?=vcGo^Ynr zfd4`P*~iX&waxX0>!H=}lnvBOCuyD!a);4Y`io-O(yJfnp983`47Rp*Ty9^nC}_*_ z90uFx#n7el{nTQl`4{^g zd5+*W>(@QiVd=hrfLD@kUnQzXQKfcycVue(=>I=k&0gt_5&_usG5vn73p~akgK4pkl zcC`j3w&sj-1=^OP%Gjq=qqf(;+LwX|HzH#SFpGU&7(b24AX&rD28Rn1Xt|L5FFzO+ zM!--=5bz5Ao#5X)_&0)o>tOhkLh?rk|3dID1zQ2iocfh}=FDxqp4lT)WlgmXn`;J@ zN(rx+4Us3rghH^6jbH=pYQfwli!TEhaU)Y^I(#>3B%Vy4o#EY|;nw(G%m3K%{BT7( zZwp^@0#N|GFySRoh zi0EUcfwG=NaD(0%~1kRCG*IZ?!j*ZSUObTpAJ1Inb-ERoL`G{8A&f4Yvx(d$!f0 zkS`Xpx!XBZhrv*39(1mU;`uZP?+a)eEkd&i0c~kyqvM*Gj?o(P5BeTyPPMy?^?_2~ zI!^&>e{3{yzJ}rbWXT=%KRy?NNe*L5?I@0G3s6k1;zJtC$=3iDuiV>1ODZdu%Wie@ zZP3lX6VJ+FDHxa3C+ic~Xo<_DFAj11t(M+a!pk5>G5MBK=FUicxeV^Ogswh+X9;ze zJlWr_(TiUCb@b9Y$M@IQX0{^>R&lVTeaZrs4)IaV<1g@u(#oadZTvYF;y!%)Y{L*H z{UnQ-#O4KzndC@{)>*1wR&u2;m29$-dbgWAs^#>3*lH=>K)Z9JKaE#Ezzq@C%0pZ& zG!ER>O$+7TX5jv28ctc)9w``mZdqfmtK412@)k|EuF!ldd8?Z3^M3=Gh5kU}T_UjC};;Bnt7nsCru8)|?Bo zo{~n{D8q#q=%`)dI@rggWvuU5;$~K!u9Fv04s?C*qwMMMWH6(z(=A(fsj3U8{Vd)z zpf%c>h zO%e(7KcKsSKPJ!RU&g->pGbV!%rSoy4Qyw;0dA_c0PK4qp4vR38&D)40pk^l!=hqW zAN=lh@I%0i?pUY(5>=I2blNFZ83` zhj9erdcA&Vh8Bia?d!gVvb(P4CGGg$5QFYy`gx*ti~8{B`1b8{#|G|=VUxVu!z>S* zccsaILpI0&H7B!o;lj;2JsD_w*>&`h+t1yeTlTTsqP_W){6QQBiv%}D2Eyjx^L*8! z%tkc7QSyZ0#sSS2$lKP4>o4+1wqG&1nH1bYw*@HWCrX~3C~Z7at2`?x z+(bS(M%+ZHQac5cql8v{e%-E*^yf1@j#{&cj;h`Hjc1BZbm@hcGisfTRTCm> zr1l~N6H9mGl%i5Ii0lDbR@wQWP5{+c>W`7~6}le# z5#izY=#?!;(Ms;M+>3p%C`N&!()E}&86LHD>9iu(4{>SRa=D7faFXAUp4(Trod(yA zUQ3JD=VJ%lJYx(s7q%#wu5A}Y8}|UH4@7s%?SN*ie0ljN)rtE9s_xI$=eaGWO%Wk$ZA@&N4UNJM|uM?rM$0aBkqApwAep zx|Sw^ULt4P2UWVriJuzf2EDgZzTIK63>QJ@O>}lgfQ%Hm2AHBrr?`Z+C`eHygu9XH z*3NOveQ#dL=ZkA@p>YvIYZVe z{4onQGssTMUnNWiDPp5XCdAYRCIL(q0ELOHrm?2^#p)Vu{RbGxgDcNQeu_nqmDtFt zlcu%mG2Pgg%e3pd?#jRk@Cx;PyURg~XOK{mQo(~wvOA0#JwR^T6VP5xJ(m1%hA4!ZoTY<_kN5#^KX z>6L8@IOqFhE1pfWo~w{7$F0e^-1_yo1sbD^!)Sekr5K$(U5WoS&|<#Pg`nFvHGI8q zL>Q`_G&64*Sx3wg!Z-6g25q}xZLeTd12jP1k=`wn?2x@cx?U8nOzZBf<+XR(k*!7b zgQG;3xayVszzI=uJK%`(iT?xXh214U%Bq#6UgAhYhY^*0{|N=B=N}nK*B7-SceKJ5 zEo?`TdM<{~xY&VDP;YWPUU9(xxr(93k zQ-T3&Po0#w_LO9RwvwbGTY%^()${ecs%J6x9O|h*Kd~H^88Zu3ac5@7y-!zjmWIo4 zygUSC?EDMq#pGeNlpVHp zjl_A9`6H0%c{4zi{FRBRlgsra(&)(tc{BXx=KgPj%O`iVe58-+d|qol5|R!#sw;@3 zKz-?~)a8=fXc9QMHW}x@c8W16y30(iT5%*J99r35EiGI#pORNgOS;xb%rd4Q)EE_{ z7+_)8q~LbSu=+Q6L6}R1P9Hd+3wIIjy0Ke@bipEHQ6iIzMkXoksTlvlc4R-fUWbq6|Kjj`;O3EdL^vjxEce*WP07d9DfSzA222+hyGSTm)l{ zJQ3-%bmK^$?L*sY16a&i5j9^tp`&c0gl_D=%qmgEE+=!RPK#DQ{EvVBlh1C^ zt}FYCQcAu70G{Wt{pdUXe#F02Nq)<}&T_OC;TRr)eQqPvR`Ym`o0WWDr?tt+^mWs< zHD1DWyo5GhAa(6_Y!vWRV2k8C(-#vb7T5+yjPwvtXx63NC}X1$B@00o*3P9AQL&Wv zM*VW%4hYQ_uDk$~2;CS#jFLqJUV*!t(#)q>)Q%|C7naigD$zSCk~>hv!oqy@moQd3 z-&HWG*j-pkPpzosALI5+?y*6BdMg@U2&Ivu!@^cOCZ9>c?9I1n9a(W5c@iC2#g2pZ zCHq?XrBdI!%$xNtB9ie=d$zLLwS5kt{MXmJqvnt3YOFPw`~mYfE_4j7@(|7Tp~u*? zGvL+B<2s9MH^$(~F15&&YLS)8YKKoOR!d+|11Yjq21^{>*3i{%xb4cZ!dT=Mwqy`jDmLg=5+0WTQutCbk5{y zPnJ&;W^zoq!yMn9$y+p>XeQrb{+3cJgn$jBd=6roHgnX^^xea@dErVP!+=)v18V%4 zvq*+23vLz>W`|h>b%;WXGG9&eJtjeBZwb>PMwr+N!}jb>2(#2COl*fZx{MrM?o*8r z`?`p|9jpS(G?i)xgjtzEm?ck`kq_M>%x%mG<9`z&5Yq1`Nb{zvJY-@gZNF`8a*P^MO1@3z^wgP?Z@pmG z%!$ozP{qU(bi>3F#s@FmIoYSAB0NK0Ei7D_R0~VGRvubID@JRHt-ZZ)*czP;M22J6 z_*~fPw%KNucYjj3lyqw&1D!R_%rwLM46wmH`%o)2&?QjftDn!~CweL)jEe2~{i!f| z@CwvOLcf=%h0F50&O3dRuc$jEZ7xl!Gjp7rsjEAJM`GZX-JBl+h)1G8W$S7^ZlZnl zG0^Ar^le5%4T;<_7E;v~;-1xl8G49U5mH+ANxR3e2r% ztM{69`_P-&K5USPs#0S|uybxWt+;0n(a5oib9n>`XcGxEI<&GIuB&SeGkItqpDu?GM!q=O z1bfXSjs#f`XiucH*C>%|+;L9r`Hu8#502I1mZ%Q3!Q@FTc}48N+e+TcsSt`}dD~N) z<+TOyH8&9k^A}aIIevAmV5dS%j{^IZwSvuMtl<3w3S6=6B$m-aRL)NK)sEJDj}bFz zCfR(y;|S@*X5OreQG0}JU@CGWB+CJ*yF3SkJ^DouCx4&dKcs(jmJN9s544c?M%XM! zPmgnr_LFT(`p(Kf76Y2wTWj@ZUER` zSgYHfyE7XMZ>iKVCF&(<`v}BSs1^CDn;&%7~Ru= zp}c6~2r`r~m*qrPHl|)ot~^d6$5GdjrD}0|;YgKh83E$|q(t?7K)Nu}cbzyGU#`N%awvVsuylqZkX?+M&n8hbNczykxZzRHC< z%*><`u0O9@zD}ved*RbK9rX2lq0rFLU_tGyjaNHN?AzN_?W*tPW7&{MVH*rxrbE;S z2W5M(vlb4*j+LvO?NSqZN(p1FzHyk3S|9VB_CkE@i4oUnkWboa@<}sVO4G#OrMZ;I z_}6HBNM0j$^#j0#@z)Deo>Xmm=l1u`>zNymP^s!XR@=E&zx9o|X?5i@FnTd5_@Q3m zOm>H%UNNapZ?%W3i?*k3$=@7l*5fMYE<`lZ&j+-&y9Cp;UO@4t)S|AYplj-Z?sB!8 zqRQhgOxjOv2B3H9_^m#L@x^uL()Ru}t?SM#2PW>pY-qj?liZDM@^pOw(gM-y>5G`a z)1F56VNz+YJ`p6ax_tboHtd@30EgIB!>#UVN9v_L9F_D1Rd|LzCvD!X+G_$=xZyq% zH&=UH#m2q^?cu3ecJ(8I`^G|=R4KgwTz8ib-t#EQ z;>7FnCfr)h;iyuUoEIiX^7Gz->cIF}O1(PZB#M&pwv(`Pm~wT%>F{<{`w1q&S?_}C zg5JUEpz*J(7g-+e(577NYX|OY1x}XG+r2}z-s+HI-huqD|ET) zkh65QsJaMCXN#PEp|9h@wI6bI+(Lh(q;r`Kz7b@4chL9V)+Q(Y-n7n`&T zjg{T1i=D>G?$zCUm$U=)wFC6E0wnvW+)HbVt4osyIG5>NR$bDwEPfCW=kqwWm&Vs7 znD1@ttuD3l4>v-#ZNBurYg3xt!nSxO%|=O?majiQCCu7!DOK)K-NUG|aS*_+sIIZl zB?3w9F*ynC;%Lky@1e(h-i>$9%(zfLua)PaX`aig%iV<6;AxkTjj^~2kEUibqkgbgxyl9-H{ooVy3ZGN3#sDUq7$} ziMeI!?}U>&vJ%Et$H-Vk?CV|$wwIlx#}`uBOJgA4W>-rYc9nBtE)6;^a1rl=SzP7f zctKlQ#+Fc!a-dY@lO_(8JMPd0LKa4YINo?Cna$E^Ln%27xuY$AD!BJ`o=@VC&4l+7 z^G!Pt{D`2ny}x8h6Y9#=bKlzQbG?_mJKrc7NMI#w8Wy(@G9zN zRjIAYn{#vcb!TeeDgNomCd}?z^2ipsSnY z$*z82hN0@;w_mo7RTk&VIr_^8#KC~V#@}Pix-*#?=Mr|VQuiC9e!tXRNA(9*A{;3a zp+SWe%Fb6RHEa+IThC;o?=+J_W9?Jfk#SQXZBWNDXJ|>Lo1Kh4W*&K=?H$=Li+RX9 z=3AEQT5OI#*usv}(Rmvqn_i^x(rEG4hl@>H$w(RAET2s`P4|A9y!SS5`KZflEoqUH zXgZN3dpjr1=_(Jc>?1X1Vw*Ts1;{{FYqBKPR92`vt zt3L|Xlk(G?Yqy?;R$<3Rv(nJCneFUNsVD&<(`>YyPmGrJz}IZFT=2BK2NLkK>8n1e znFQ^`i;etaJgABD!T{FeU~4&rQBS`Rl5Fa&AJ%eHMU4RLw$*!LzD>0CkK$Fzn#acr$&~ZNLPCz z?en^@??~y>JqUq3o&*Y}Xkjl|WM*AvF|Cz>t@(hS!!~XIfzg8^(^qwNqW6rP;x7WC zN@FN86-npQ6`A^~(|KijcS@=Kob5$+ck?0Y<0obrF?RDZdK+T)xOm7pw3xGP%RBPT zzU%$a@{5Ehsp!O^Gd0kp-?o*!=^{aRqrUX{GBL zN>YTA%u081UL<(}2e-`8Yq>{6NBGe+(w(;_0i_P9d)AG4`Q)DzQRgi$FY=O0Bn1%+TpIS-`RO#3ky`6!#DfB zA&D8a*|slN+jNW6UB1nprTGhPOi%+HEwtoF67HljpDrrT##Qe>nQa%>r(y2d;BTUj zqWZD<`ZJtVtfPp^ak;ppg9Fq(YfN>jjN^?mI@lS}0uQNUqB0odh7tl0#?Z(u?s{ER zM{8T8T7zUYVRB>KSp57xzaKd+up^tP`yeK6h`8ILIwyHCWqL7X(!ImKx9=V1r#`5V z!K5N2V`PJg_zwvc#jm4;oMChGuP=TRu!Oak2?VNj0@+o?H}JJ>pAKCQWE8(cx9Qy6 zN7(-OlM36q70CU-KFjV=+EBKybGdzT!za75mjL)#Q+EF-m%S_aza){pD|kSt$33aq z>+#^#0Jn(i=+<%T?xv;YhJx)Al#4qFUlNZ#Ef`?f+MVH#6TOaINL{#t0-RdPdq9S! z2k&m+gO{Qok413&!yAi)9hruc-d8dAcKZJ%>hA`3k-n=y?Tb$moDMgRS%F@%UNk|$ zQ#YW78)GZbWHyYu1U1}Pu_A9*pN1QYR=8^U^HJS-5^tXO_nhiH>_&GM>Rc)>uo=-6 z=ns%+dKHM3ma9M|Dz3SqpMMeL`TS4t|2F% zv*B#gl6tDL`k=xH`J4>$Lmug_0r`-3wvfoHg81z&ac%!aKXx01D_31GiFQ*LhK9#V zOFr@^(rhG0c9&7S&qq_AkC@M`r00D;BA;jj^LCJ4uRf2)i+><~_2=B1P=C#_HRGl9 z7f&eKqbO0G=MPpBS8C>~wM=lSi0PH5GP1}DcHi^K8<RWmzd9(YdbRkh5 zz%s$kf|X?l42??pDvy39Z0;Mg$sX(i42~{DC(G0GRnYTb{62!k@7BD%V7k{p+lvyv zixA4u#ZBxEN|{=-;u8`DmI@;XZ-Ah{{YRzmHo~e{A%E? z$~&IV{8}n;S1VmC!*YS?NZ1^^+uDbFJpW@lEM=<0E&vDq?jDh2V`MWlV5DfJ_ak#DHxsvCD~ z^rCA#h}7{#$c5(TmZxjzO45CWXchvuH|aW}LXfPXQ@BMEY}}2Z&sCBN<}+Z{gfk-? zqW6dwz0&texZV2>8pQ8WNa`-WR$x~}^Kb3HX5zmsr{VB2Bv8K(kr3c!Y^Oe(Q0|9f#F z80E{xLir9ymE3kf)ZOJDcr05i`pu-PP2X6N zPK}i^g>=-$9c%6m z9(b+TN1Qx`2@j*p-Noar3v?mNQd}pL)AMG%d$aP>`GBxuB93phcc1kA9aSk2wY8L# zv*FazTHnB}hIz=jWRb5--|H;a%`Z&VJe`RNQ#A!MI@j9y6#dR;cyM%iIxGDm9bOc= zwK4E>`hs?_$rsMDfAGOr|9CPR+XT`K*V+gtnlm22ahB;&o3`S&4t}-FyR{rip%=MIce0^^GT%)L$Yz*h2&4F3zGtwq3|QwIi-}cPg4|-ta*O6ryDEY8A{wz^ zQepq%qKrWKHRLS9x-}#}Z4DXAOoBtJ{Bkvvt|3cbV)LA?VY|-%s$J!;yO7iKPZi{6x|BzHCgLLW$JX03lr|;Ubu$qr zblLJTqLl3^F(moKW>&Y9&wj*^w%8}q61z(PvoF0-m=EIDl4C-9?D~KqO?Tc+z9)8- z?#^Z$I!1fM{h1MNg(V>=bWF`1Uz3lIvSJarX4N>OZPzF0Fe_pIEZCCZ>o z(dBfCzMo2z>Ym%#S<6|oq&&o&Sk$vVx9)?v5jR(_&rNc-PeG`q!G+NDk=f&4yq8+CJvkZYQkXnyz|<8Ou{WQSAH&uoTLroFYh`4`|aOrK;(olsuCZS6^ksA&Jf|hIVWGlyaD1%e`8(@)TMl z<*7Srm*-6fuV_3qN{Xu}K>Z{)o=ZJpPn7c3Ymw!7-a0Cm(z0&bi?I~tooT>yX3NjY zTB9Z2fpp?g2*9z{H=&lxI+}2D#GE^Z1SZGnD)%|ysq^S*^^}sw2|T_T547=IH*oA) zia$mnVfQa#sFwPw#^+nxau)d*F<_;OVxAaUkz&vTYE0r(%dN)VHVl^?ae$H* z-Ye%ZEob)yUd3zmnT}J=yps2nIb}EZ9)X<4@yQZ!ow?7PVK)zdJonz`raW_)JB%vp z&y(o2km$f@-lR6E0A^A+Cj=S9S|8Rr9%1a5*;99)5LQatZ}^7L)=i`?C@mWUy4EqE zd9z&5vP^J}SuV&}Cdf~>OmHAFL$hwI=vX&K+-9Z?Wcrwsn)bo+28xD2C`?TkcpC;{ zaNkQAu_1?fG|?Gin4mCZ@c8W%HD4d{mxGN(cOp+SM|+LLIQ8Xlol-roFL1&9XC|Ds z-jfm-dz<;(;A+W@gGq^vN7*LZv8p7pF09jZ%DXgKdF{fuWlI75ead3)A;uSiPI!;w z=$IDoAxkz8%dUA3Hv^fr{fv21H>h?tPx?DpGh*mPfZ1Z`Zk8L@oZw2YsB26rFlDD$ zgsh#hEX5+1DhH^x`^@K)uM&|Vlh=?DObghM$rC{;NQ}nJ3R-mI5dGLGOR*i+s? z8R}mS$3iMlar@R^<*qy<9fSAg9^W#jhc>f)(&6;?9U3!EdbqZaZznuvrI65_1CxFy z#eOwW^v`a|{?Pz3k(|Vu`X7VrbJ5*PS>(gy-87M1m`8-$e}bv_Pdv`>8D@fgCw^h_ zLHoT=;ob^$*-<;>KP_-{_cBXuhZuLaVnlaugo8qdz5j%su*p%7Gcu%?&apIi_Xa%m z@;Say#`lx*?T!XcC^$<4eFeLL7WE-!>1Mh%8(-cc{(n>K5qN0LJP?#bS9N9u-k{b2 zgYLt1^o6ulUkOB*@j@Wd z_Ik!NucNbG$4v7&HtTg>_T!9c;m*u@J$IVd`B|@1rg`xkaJx*WP4nW`Q`?KD)iO0f zU90VN(loD=vtCGqGO>6{ydCSA)4ZOQ^*U#o7ec0XtmCG6Jv-}l{4}q1S+BFFd9BZS z!Nz7vh_YcjucuG*;&p(w*9FtOF3fsik2#azMOiOQ3TM1fWNasR=`^p)vR(+>GO^fI zwPQVhnpZRHh55xyEQ}_$V_^X+3tAmzgb>B4D&IAJf4p%ss#P;-%OCwEK>#s02f z&vo>J4u;a_I^t)s2}t=j9gBVp_BagUD_D`&g~!(~2%V`d79$yWZT_A5I8#@RV?63v zFKwX?^r*MAQOgTk&t(a5W@nAt=?RZ-o9j#xG7|SAIUQ?__7~NlQtK_m$5AqlHiF_v zA^y80Vcyz$;|Z+RSoq5b|2l<_|APO}Xfe=32G}Fra1&W#QAuC0P)8Ty*K18VtdOju z5}mbrsSw`}#=>>+Wcl#~tj{gGV8ybFSh8$8i;Xf*r>p3VFBLiWn`8G{UT^s#ldrJ{ zE*6rz5KxWqf(H-zis1|!yi_#LJ_e1sQ~g#^-a9ScV=mr`O`oGj3&|}+PS&~l_K?`E z`aXg04GUocF_V6_1q>`qnDLnf|0c!wevqsr4c@y?Xe%1-+pLgg?$sfJqz*bRQ9!AF zbE2f+DIFX}Ip07zCyqv+uTlu6UWPJXp)e_@KYl9>rxW{m_G+=iCbvX+rNyeqzg*qh~L{w2dEuU4<_M(;bj@d$ZV-6e7{dbtSq zP1gP$RJ?P;lkS)}Fp$yaW$ns1~vOni*o&8<4!BY9o9lTB8QX;p<2@i)kzptFbq}f6drCVbJX=YWk}vyFE?p~}B#pJbd4&E> zm#j1+eZsxGX+N_@P6o&U7Nvfqr{GIn7+D$gOE;>9qO!q1^ss9~wdGq>A3J(9+K+!k z2+kt!pxGI)#bW$pL%1AAUVi<@=p-jg>Ts{&Y!=3$b!hMUXO6us^;Xip{^P9(yT{+9 zVVHeRhJ+Zl$tk$VmF!WS%?jrNTQbMRJsNTLl2&0PKAWZ;`B>lfLIv!^sYIMOji1dL zb6`7#Jzdx{gcYUgsq+SC)M|E@6UDasyPnl=I2l89}V@ z(wsS;3Z9!HmF^Bm<=;Z;9hr@q-QzmwbWS^xeDvp}Ht{1grna!~$_8^u{jCR9pzpVl(8z`9I~$`%wV9nStD#U?mD?BEB%XdUOf;vra6FDx^DRpz=GS3Ok~@c0`qTM0M4UAYf`!SivtFDRwIlsc_T$Oy$1)0Gyx|~y!XSmV zm6$2gItFn-!TWa}#vMu%eHZDtFbiCm(0B_+10SK+pn-3YWtIlMsqabsHs`*4HX4wZ zqk*j!RKJb}f=R(>ag%cLVI}Vo5(Opi${-|1N?5&GAtZWA?#&?HFT@A{pqf28Xenb`k!b2_Tpvu%+=u zVAD`>;b&Iu*O_Prhq0V?y8oLAAeeO7Cirw=+AA*n%yb{mL^C*y<+RiNb0&ab(uKwJ z>B4wbTzH@ERj$br(NQodigciBt<+a?Mel3i46^%i%R5XA4r4j(GW{tNKrm&3b@F9m z5v#cHGwb@BOf-YTSWY|Le`Ep(Cf#?m(!E>hTKJji!ln7@go(k%CT7z8T_%8F(hXYa zGC`s;36|aO^x^lzOf-YTSWdgVf5-$7OuF~9(tW4OYvFymZvSzjCOrPajeEcX*O#U= zJ_muc>yt1sc(=G4)X2{KGh<*$*#&LQ8!*MKvsc=Rk{{_X1b=tY1A5eh0a*0_Ne}CCS8NWSWY|R?U?|A z$@qP(jNh+}E&R-k*%-7M%HU88c_!W8X95T&-4C?V{h-pd@H5l>Q6`$fVJxRz-alpn z2qxVRwbH#$=~{T7?t>{2tSWdejf5`+8OhG=} zD#%Av5DP!Ef?=j028XencE&*_fWa6&Q-E{|`b;ZdQ#A@=AzHrow|xza_1jMTvn}s1 zF*uCnw4#5m<)0WB>$e^KftGjZ&$?rwMqcilnH#X}5dI@{LDJ&eZ4)=Y8W`)hmH($( z(e0{95DUS>rJfu3LCZT#3|`VXV*r0Y6T;vymeb1MlP&+mz*xV!L?fOj`M0*OK*=Vf z+@8!iOs3U|V@)PDF!c(AU7X%;FFaG?uFK1a({6(|E=7;&HMHm3$w<*E^5WhU{wxc{Ac7y#lgDZ&8lVH?mh%RDlYiy?Ug9nHf;%$I1G zC>g(<9*DoB{qR71zsACjC1^jB7dDSfhe9~${Qr-^Q(Cw%ng$k{6e+8TOYPf82X5||K=IkACscnC8eUoiA&Wi|D$G^xJ=+* z1%^{ks#&)I{7v7J3J@lj6CjwBS8_JlrU*p|lm8&?Fu8&tBdm<=XfAS+;4yG|a;1`R zs2K5M&C*xLDuO$&Q9a;xs?Gu*3O5_?M<6lvcLGp_Uy}`{O5-;)ar`6vx+Df}zT8d@mhADSWP_@ge((LJfn=j9I;lc;$w+X%b{V#3@^{L- zn@hd7Shk0i21Yx|D0)4{{kg8%Ar3dVvh08bqjl+$#aEG9eMz;{ziOyjD#t&e<@TOe zu9i%X)5i_^csvMWqUhivqOV2>;J1{iOxfD3v&4hy*HBF(4_5)Zoi%}gy>M-59@-t> zr_!jsjD!Qp4* z1)?&oK-^ZD@<`w^E+yYl-G9mtjX*q1at|5EWY3Zd)}Up9 z4&9OsYn1Moj3H(HFJ6P*f%9J{|C{AMkd1%7^S^ivDhUdB#TpfO?0f|rYzMqz{{cMD zT~ntN7V57GbqJyOdj1;rBmySZ{Eq`(u;vT$Up%8Y7g#FiuUYC+xnRvas5s0$m}XZWB_xXv$itv0hg`w;7-w-Hk8L4WDk%(*TMTXqJg;c+mnn$(1tpV3tpwnB(P8E^MA%wiNg&Y);BV&+L zE#%XMTx!T$TgX=k*L;PnxlDqgBQxiJR)KAaqCAZ5DUUW9UJLJb6WH!II%I^~` zzgC8S1fM)8&o{_3&FfFXyey0Py)aj2F@F%|f}JG!kUXE!@=VkHEislGm>ZrxK9C4C7Kc7 zFRB8^9+l)>3ZQ9mdLh~Y?ooiJ?IOU(6o7-0ou=>+1(>r#fJ{B_RR|Okd=jl5G)nrq zJRfX%`d&y*6(wzz-#s(^;&%Ptr~o(ZBEX#ls6B6b<&8+cEsx`7@py+k_HUK(clun> z`uwdv2c}0;agxvB;Y_`*{_vBiA7^*$&gKfVVwb5-Vp%)H^(fNvW^sQoy`kJ*?Wo*dSGscD@3LG{9_8wiW+6nN zYHe*TkzCun@ir^x7yBiHJN=G! zzlr~XWnn+A<}eCMJ^|#Kj@{|X0?%%(s9ov;*yg~~iQ92ny#C~qY7iG@z&_HdE%wxx zjlUxuet+A(Z8}Uj=Fg@zpPh6(9iEmOxv^cJ$Egp(U{8k~#le-G#l>r02i9H*?aB4W z-(`MvrR%I+Rx&a}1x;kTc;%jK?TlOB?bcm(T%i{`?V1YW|Dxi&ml4JPNwVBxL8MuFN zp41d+bam6BkR5qXE_o3I(dcjfIZe#%Io!U|%O=nZ%ptd~PCVOWmci7`NF^-+M4iV= zWO);b#6M*dCkFo|d~l{6G+#l`1oh^ z35x~q;j}X!!PJx$3BzqBtLl$=<)biyN)xJ_2Btod`}`Opl#0$3q&lxE z%^B>EySzMWPHqp%jjBCzpif&7q#cUgfn~I@+jFAQst*)dsb`QIojv^WYd6|ax6)+sFK9xRj++@ew)VPGXO@m2oy?_O3In z2ELr-4X;w^9YUR^j zc3m;uDqBTtmmPREZ;XA*cx5%2FM1UB&QjAhrD+KoT8o-S&KKh!6l44qt?#XiSV>G* ze?YgyDyt>_aOG&TWj^XW)j&q~Yh%^9lL$7V>byI8tIoGtjXz5K_+XaBUN|n5(HOUC zPa>wRIu8-zyy`q+evz0+KtDAWkyqK-V|_bmqkuW!T3qc0^QSbb9qn!$`*(WZp@SVe z*_ETG6RF?(Nv+!HTl&owNfcl0G-~%3?^vkQ#HwBWZhA9Tu$JsJ5AWf!nvIZdRhm`u zLO*&3(ysM4SKQ_YrF*Z$t;9i`S8Hi`7+J~Wkq?;%MnbfW-LsbP`S~0Ra1KR2Kje(# zw4H6{af-^ASRMB$1y=0LERJefOb+4>NN)s7f`OsRz{(nr70WiIO-6qbDxOOT8ofok z64xNIuBf39PET|acm-cDmi(4vHC-z~S25X-?|QZD0PA_%cDah11h#1AWy*H;;I}wu z>4s%yi-SUv`rgkh{f_l10UjiGu}H>&lIUV>YOw7HSNbF8+3g zU67yW$572Tek`hWgVbOsuQz(CgdHg43Q^?c2p4_5-QyS<-8Ya5uBFf+yE;mtL;^1S zpi4m35)^$O$hr@ulkE(~L%>fR-5D`ET&Rk9SuCvp7+fqr}uhx;AH zBgF|Y6WIS;T&=7f-j&o;-~WGI6c8ThaSNj!UhFaI?Wp{iVB(c5PgBOy#L|iv`!o!XVf>TJVA`Ac#rw9W;AZc=G7yyDJafdJfL@h-a0D{AE7s3D#jTB)3h?ObA01$hp2m?UC zaJw`N0I_e1FaX4=6kz~}(G+0-i2YK80U-8I5e9%bAVnAe;=mMP0En>^VE~Bn6kz~} z)hWUN5NlF|0k`>c*Cp4-gN$qrUROKkAUXYUKaT1Ak3t2X63_HBFqI&A75&*!>nt-fx?hQMe`36RT60>E%qM1JUTEx&hM%|{CZ9xk<2``G zEp&!Hn-I#$wV%rR#7Y|^3(WIwJY&Sxg=EOZS!n2Y3e5>~Az9?myBYf3LbGizB#Rw- ziJ{-qLN9gb-3|S|7J8XO?}4M@egKbbahE&qVekE+8Qv?L_ntUm@?j-v1&$qhFGGJ+ zXe;oDLm!CK;1>74;h`oObLep#W|ZV%L-!}vXIKjK=+Ahx^=XH{Pvj83LtCKh zBSCVgd^-ZS9Rwi;0k;Z{(id`M4!dtB-qgY7F)2*^Ec{H~G6ubH zJ*FDg8)0%h*eH1of$d<_z6Wl8C$r9Qe{@&;8}fgFiB2FX9!Np)v4*sR-~A#x>a_vb zRqH9+0K}p*cAl&yJDfR##?S0RkGJep^fHs~Ig9IaDhy@#iYRw5?)}!L<6*+B$qG-n z6_PsvFknIt>v$H&PG^s%1YY{~Xm$C&RTU-l$JwQ2vNs%8GIFq-LjP3_Ia*K~3EPHzM zm)eQ-7&`lAmS5yC&GxRi>0fFu|syGNnvBsC&C&vhg!M&PS6OT zL#)|F_&b)0mY6slAB}18w5R*>HBVWYyE52x8}bo*ALLa4+Y6^j>cB;+%J63S=+aSb z)2pY4IbC7if#_v;vwY$_!Q%3g;Fc4^yLy~{Dah*m+rOF`_kK1^Pt zRV9no(R`S^WhPq3h}pY3Ssi5X?~8uOE+Kj zC4mXzT#?&;VmadHQ5nbjH1_ayk`BPMb{1ol{Dj7>EypAbAN55$1a%(qb1gZsOs(Xk zJuodf`L>d?^*T+i9TcN(2;+bh$G$6PlxL)dVF!^`9j4`jsY#3)S|^(64wo zGb));&FkOy1wJ=vbNJj8(0Ijx(LSbcefB$sQj}YJx{Kj!ZGp8l>#TK`j5F*)(@+8Z z85CQy_8F9qdjE|1$m_Zt6E3?ftY`@ca%-cZGa`efo38t);v4hzbuh{g5Z%2gk@rmG z?w*MZJrC)6C*>qn8qZ1oXO@#}nOJY>-ZqYK{G`shKS7?z9pMwjQa8|O)Sjp@2PwEs zYtlFJMKO=HE?|9k=lb*PURqG`GcD*7$V}Vr&5LR6syOw1d{Sy(9;+!>`%3FIQzP29 zt#qGhU(bKPG&git$|JivArY-^{gC*Jue0sVZ!z%W^q&uSa z(L(;d;_F3Bid&bM30!E8b`DT`1R4` zv(sn~rqMoc(Z0}*CZC-~`(hgHA&d5KJDPlU8trvy_r2D-?>u$imz30I`NaRFy8Sml zG6SF|<$X<;1%2^Vsxpk4-jA;V^f>?y>PaE)2%1mlbk()|#)qIQ4Er^|MQ2QW1^T)+ z{;NWrv1I$imz7^I^@toUvE$GiF;}H$ZPu?Un40x#0NV>+=hru@d|XBUuA~nk>2D}- zFtruO&Wk1Ne+W7cwj9O^(_q81eg5M>#Sw?usE_*5nUA}LschA+jf<_{OwTHu8JFEM zUI$J0l0_HGXCoC3P_Q0p&U>|&ygLswKC@Ltv9z6>@;rpI*Orn`>kI=$ZC50Y@U0}g zp5D$-2YpVayU>NtRtPVNd1dWFN%8psnmxV{oTVgI_kYz+vMq$|njDH;)xe(j*@)KZ zLS_$DVB(v!-Igg3ju#K?Ih!vL7Wo(*U77k6gu>$;Q}>%2PJP~qk8-j(Mc?|9bTiGS`vG5XsarP~qc;#RzTKxQ8Oj*x zK3D06@j>Lzr0;aGmNrLk_muBYTUxs3ZZ;@vP~*{_VeSCZ;G~uH^)swF{r2vRda988 z2R+0r|8pdP*wDsAl=W!x9nh(Wn4@ZH_XeqU|#J{UtR!V~+`5xd3Lw;XKr8y_3lbf%q?UToe zVho_@Uga`cT^uCa6k3QM39y3xSWu)v>IgmzUmO1@@P#Z8xNC_cJ-5w8Sh(RLTMVO+Amt)JHp|sq#CY&=w);@@{3lq0 ztDUneo>N#1pNjh-Xs>w#xZ@_Qi}0xpHtt1`hGPV!H%0IWUD;xL6>nE{Tmd(2qFre|m6+Frap2LPVQo9B`@|B`W>VKrMXZ?;27N#4eb!E2iA_u1KWd(7>Kjk$+}*6r3K z@^xAd%hzrFM!t#GujM<^dQiTbH94SONAlRMo$_^B_sZ98-6!8f z>lgAJY27W~&6+%Lv~2pc>~o-JI7h}9rmXZvaJIe{{pC)?{xc)a?d13hbI>n2G(vK8 zN1WHm@m1!aUvg-K?6Mad27WJq9gSP8fbsFz`Cwh$Qf&%pCXQAgZm66C& z6cz@-uhC6QInS8o`2$_cbBy1!FvFp6-E$bT79Fhf;#=(L^8pu(pKf6dLKAXBmQFhr zAYxN_OvDX{9n);=lA67g*L~eh=EXJUzJT?IgjLWAnPRS8Y_U}8P47V}yyjStfP2im zoU_v7Rub979-H}pB>9P%p8VJi-&6iW?eJ@8dbktG3cGYpChmTW@*JC%2ATj^V>-wS zOzF#C+~UU_r*SOuj|4_>!5Tl|chC*IMMz({kd!O$(f8AA*`N6dVU^+_GDyYCVMB+- zF|!+P&QNb-pvj@md>kWcgC-ccw5Oj>8~@=j03JpE$6{{1k}*7JoPu z8Ge(^9C7SAWS8&3P1Cfy@O37zL;7tvU~@rU>sk^=AZ zssJ%Tm~8jF<0M^gefS{C+TFYZ;Iy6RSc_g2wNvjfK96`8RRj2a0Z{8otAsa$%7Egz z;3uHnpF54uz1vKDdZ=M+Vo~D`263j+dk^*cNL5EjQ*dpd0hoLWZwt%hSbpv-p*=~9 zCMjlyb~eQ?c&v3dVRmH=R9&YJ-8yM`wn`@B)qn^Bc``A}WSsNmeFPj8!bu@HJcP^i zgGVq-_^34Av5{3$8(&3h(WI3_mEga9V$CM&RN?Hvm#8{!B`?R4{iXb_*5wjNqigj9 z5q>!QJ!;YAlek!>Yn_X-h1TRbXkb#7(TkkMqY-k=t(-5Ri7F;>&&ZNk6FkPzE&03^ z$Z^1Xx&#NgkusJ;=a5}k=i=NX_UGQn^I-u#CLJf`k|0Gmx#hxKGmHS60GePv(9 z08AICb)b>(kwXCbLKL)8ftNdIH#1r6&EO$GAM2JYDnyK?f~=i4 zp?MRT$-4nnS7mo0K=U@)$$2m5wX=DWZ4x#+mb>Z${2Sf|u!?JOlp|hY@X6V8RxTGI zV3sl~rv;zhO`b#Wg0~+$j<)9UE@c&O^x#?o^RW2B##^KQ*PiMuCiL!5C9T!PT~9p) z`X=p#0QFwsRX8SrLuQ{u1Ja3&Ujz~8%0p0=@yEi$5Cgh^73BmatkH?0-FPyp&W{n9 z-+VQa;yo`_B_(SqJTl78sc-^*2yrRB*M#~S^2r{aHfUsNh=QwtgtH?t`qy1NzCAt% zta)YSXJc}E0PaN!e}PJ-z6p+J&SG2ucEBaLFzeY>A&ix!qbN7pikYqmzj6okaBvb7 zz)LlzENdg`Ltc#b?nECp9|C)ajZ=6RYWKp2;e-0@%V_hAbgOiTThQoJY+j3j&n(a@^ECA?0L*!}EYXr*Q^)H(Pez^7yq zmD&X$-eXiuwE_GjGRy{G0lZvWc!7eIPx^L9v18e@ZNGE-%hc!Da6Yk^&EZ^#8$QZ` zyd0-Qs(5ltCQY0Q5oK*DU5CM-WJSnM6jednaAh`fP}gH%dehE*X9K8l9VnpjG5pa5 z49E8~P`9Nt)xG#_0Raqy`n&Z-C)4^f&zS zd8jSFh2yGM(#-1>G9T+pgZbV=oP0cNO5^N)zyO8B%q&w3Hc z`z6bBc_B0w6TwoL-Pa)36!2h1a2YUMhHecHgkOkJ>W7aZFJIEQ6A@A30h_pQCl{TY zrVk%S@|9mf;V(epx{Fd_k~K30R2Mbs9GF}y zXvEC50^lOA#^DO<;dr~LW9M}}naK|z%9rbUvNS^73fclkA0tQqJQ4&HQuucVKJnGdiAiBoM%VnAC~( z@GSf>>+QTfW+a>$>)jE1)S)pkC5YxZ`z;_S0zPO?pLuUIl=qOB$@RYA5yO z6HTW)>D$A&=q*?SShoBP97Oi){|d)0?*>{K{1xyo*~*w81Nc;7M_Gh>h*wkp(!c~7 zt!t==!G2uUY5Ovqv_xnZtpd8E)<-(?XZS`%-nV; za@*l*#&IytzU?3jtl9S(xaV;!;fVHwVF%m0A51v^?fu~6Sg66z?EAsR`ohNKHUs$X z_Jg^0k-qHg2Y;@;A1vI{%#`u{V1_I8VLw<*T7~RSAV}vcp`$yqLUIQ z@&Otsgxuz9;TNf=d`_GgbfARqW|3xqg*VbedMM1G2faN1K_pO}sbh`LOp|c=f<1P) zNn3d4bF7JLxYC<0;zjdhj`)!O#XzFOqf>#qc6wFEoi-vMl<0(Ap)JZa?@SnsY^o}n6v=0A|;1_<8cF;&<1 z;%h_Fkm|agZyop+<+WH9T!w*k9*Pz5%QQFqCkk6yq#P)F*Q*Q7?W))RC-@6?h(ts& zyDZIrA#wO5{xE`4Llm)#5l=A!gCo2Ul@JEbWw1xJe#h}4tGufrP4{6x6qek;Y_>9% zl)0?m^KtNj{nfk*;oB&s8DmE%Hao_SUeoeWw6<-;T59%<#(7(l@ z-+Wd&Q(waHsM>s`>p;hDzMmY`WeSyH&j!4|2fWd~{i8qwZFC-!uhaUYeBIXL@=dg! zkS{Kx_>(#ktv`!nr1b~+Zq@>VEI2iG73nj(imWdoeDI~ZcYG-j>V`0Rh=f<1sHWud z5}*VI4Rl^kC-T|WdcgUI7@TuN4z*i3`8usZBcBe*H_^(=7jO=XW27}8-_4pY=vVOQ zQ}D=RqqV#(oEu{z31Rt63d;mW#B3Ftn*x@=MY;J=g)0H9wtT6^ZYAaGw9@i*TPgXD zv^@E4)?~qef=$}p?h0Fs~zllCl^ybcznzvMxO6gca9E~er zM@(%$;MCjcpNE-*E@%vv>W!xA;f~W?Nw4ie{B}^~k`| zht*Q!cYCY|a28Zl254-x1HMOk3(#ib*%AFHO#y~02}2iEEZ`|UVgc-9u_tr*-XLa~ z`=LzoUM&+60BkOZdKHgVmhLtQdpVJn9>W`pvA$EI4>9dfn@LAI5EGaia4w4G)Wg_u z`1dq2+eWvJC5!U;AO)!+)-n|yVmyv3wa^9kZM zGN=$OpNKba5NNyPn;CX)_3LL9YQ`wkY-QZ;g_^i6#j6RxtR`>3+i;N7(I;2k%8zdpabUyJ41rrZ3jwOW7AA`8`O3ou?HyMEXXAy$@mO zEtiqF+^`?{Y9lT*Pq1xzCt~m-B;ap5H!Jw z6BH4&)Re*XP?ES;C~*ySZ&?{>AFdT5>Tzw1lvG`$U-SrjvNA-YF?I)b++mT=?qE|# zS^15#wy%x;xlGd>!{1GpX`wZh4Alc#5quvTC!lbgnYx4KnINKKr}4>0-ulU+z<6@Siwdfb!jB6J#cg#$+DI6v34%O)gQ?~ zLkevzQONr{&xK$_307o5=vY|6hZ)KY_MGE?R_QT1A<+?bfJ# zoz`6Wjt&)`+>Mz{Y(XOIN52j0OIOkiFc94uZC@ zq3FUK=yLru*jPv!^p-Dk3M*Zwh|TAtV2t1V1!P*<3`!i*Fz4>lNF35gd0NhBZ#fbd zJwP|snle@6HrS}xxxHB=4#jTlq?rMp#37B8r&W*lmJ`+WQkH`bX^8_IS1$E1D=5xE zL%`>sh2Dp(T_ey8^kJw{xvEm%SLxzBPMPm7N*nu6Nu^%_FZ-191vY#zHxXT!)Bc;&WJSbW39{92N8_==bPA!GENK4a|6cxf zZrYIjoJgh(nK)=e_A6a$9)iAy4cWo?$l;T(YVhL7e~gy+xrY=^cpoHFC^L(4Ffw?AXy$xH{m(zpRzX%1yBRo3W_YR--Uyz`yD1(< zYUQmxrxq~WL4)L_(cX{ng%sIobmoZ1IXujZ56`OWy;%t;3UIg_Rk zbOr^48u@24>U^@N&i{zl`HsER*`Jz%9M)G&rMB~%@l8!)MG2b&yahm^KG?q(2w*kc zTu4YL3%(I>z_tZvkQE4K63e)5L=>McA^?;iVl*`a5zU(cje#*naeD6FajFBY zOeagH>s#Q+(}pERO&8o`=KCu}B_i zkfRiY&Fl79+-rT$`?u?>_Hx1+0}P$+wZ6Ch+w~FEUG1yyr9O6Td(PQg*UrS}jQZGz zPrH3T__y1)thaqwxjp^*GB^FZ^n#mny79Rp);{tXw=-^drA7BV*2QP`My%01))_Y> zR(T|$YdC8)@o_^M)^r{Im*~LtvOUAKH=>>i7m2!w2|U7#@;|L64i{-%({|%*)v>wBifm8k!YKkOuOOIYT|H_mNi`m zE?nRn$p+Yd*%N*3jkssRMdEHkAnb-qtBJ!!n%8s+*Eyj36yb`AY!nCDd}ME83iyb~ zk#mwd^BXaxi*a#k2P28*a~L5+c$nHV9`+`n&BOx*v?eCzZaio;aXe6N({u_K=W{%; z62aBnGhENw3-gKK>dfco0;G$Z;4s~QX+3ekRvQkM-@1G-uW)q}f#; zY0%Vn73v!hywmO|#w4zY%aMII?|Cw&(UM|O4&~ulM&Az(WGx!nGhTR8vaA$t>LpdE z26f%J*Kx5o(v0xXS=*5`yU;)yjK;-Y>)RX2&8&|k*Hs^BE2?ih@Q!!uz>j+H{^~e$ zUb7dx%gU>Y-DjG#DN2b!S_VW_N2s4;M11h?gF1+i?t(S|CS#4=R|Z(g+cAo*LBbp( zldW-ZU%fYQPr$Gi;%HvfK@K2XVl)-}W-Bw=)4Z6eMHf#vZUh{7rB!%2mZ}?3X!m-T zK(*J5djm?>yIM#$4QG7;vkCbu!lo>R1==*0!U}G&7ySZmr7x)&6?f+X=AjFdMdqgWZ zDFe<7EC@K2KEL_pXiUR~#~K!xdT9QYaaj6pdD^@NibE*2YBT9&k`xY1DDJt>bY71x zZA%>YtM*c5a2YWxcs&hejr8;*%W9)?Z)E|MPzpn>2Boke9G2dMuuapH=1ttb!uP-V zU2I?0ypE2Q_EnTYWz!p>7qvqv0ct3cP&=m{6cFX3`ly|Px}mm*T9CGfng{i?i*MK7 z4nZAU(r7x=aif8a@>jbg$~^59A22Dn;%KL!nBVqLHfVb|A-D71z`UqsyZPSCZyP8? zTyG+xqks<(HO8eE8s&jI;$Lh3H%Pg4^6N@%yJatb@;aM`v87#!*2tA*tfDigCEtJ zKfv#6_&tK(z4-O@VfzqYh_n_AyR2v9w+26$%vji4wk29QH2H}68n~O)dNmBR>FeyhM-2HTO3WYnT(Sr=)s725m zx;e+dou`{T6Ye3pDN19zzeCuR4mhUxKE==q>!4*waAs`uI70q9d^m>pN6I3`j@ucy zI>OT~&i=k0<7IbmzYkfN`8sB4w0#7i(Rs$T4hKz*a&DMmKRypT!nkM^_`uGv97To^ zUkF1$Tt#0}WAX8cVW*1cvzQ2*%O=t;VyhV!k=@I|xdQ1osd*JPs{VpOpH1R1q#T-p zK`k&1;X8)kf%sjFAF$u`g8*i|z{D{=o~Cjk5PCGKCt~G(G<@YE9(>;*;c{<|FwZ5v zoa@!GNGTHI*>}}g;H}?NvG|SI=dm2%D6j2-5!_OsNyYEMP7UG|_ zJv>>e^c72H&hp3HYT6Ayj&>Ds4S{q}5iQ|GUrsm*mqS|?FF2No#RmN=*fI{*(+e^j z!R{fg(}6_JA9;Mo2%|*E7Vz|Z?k&S8YIpGqG+u1uPGqrCmLvPg}p$EcKSRkwi_#P|1at#ad zlaPI&`D_dJfbS!;x(7Tx4cV$T&vvH1gZgWZQ%M)E9>>^TQgF7l7>UC&{75{;%9uTB z;x&BRl46t)M`v6)tLI&F;j)D1Ut4?3hjRkWGA>kbrqBFLG=iNl|RGf_+lJ@C)>2Hb5K`_ zI2aCogdRk{@fE%}CaOnt*N^LM1fK8^V7Q8dL4py$P*4~~oTNrYM}pAamA@JmgNSD$ z3+~#%L*;3?`140<5U~tI3A>3pX%q0!zT;AS7j|%PUJne$D-ApvZw(q43cPv9zZO?Q zjHLt+yg|U2hJOdfD1QXXSE;0vIzQ7&>fA8wZpM?A|LTj;$5H1av?;QQgDia2oez}3-aeX>vce&`Z@n_DxFNa(Y2{EE+ zX{X%r0456SwFu&X7y(-p5SK?`OEl~S{W zrDqAt%o3KJ5f%%;H8Kk^@m1&g+xg8Vap;Wl$?LG*6X`pH7Z7~||GZd66I9C05|*;# zftR5dHFYes-!7$6Q&hE3`32E56);@|4-19g#ITNv-(68N$glRHi2TSUaHEIXWsx5A z?&J4Ty~pQ;<(fJj!Xic%u9(9) zEhfP5dmj^k2{Qri^nmNLbRBC4pTpOdW2wP3`n3Epdzy*S$(p&6)c_}ahzE_dD0~DG z;T=Z;SNsR$FsH;Aw{SkGT;uS1holisG&VteGD{~JA^L(q#JiIfqUVBL+`%wMt{Bol zv|w`#Tsg`wC!=ub!6{&K5MJfJ97&A=?qqWz!pq9V4PME-fSGdbc>+D)7g(xm^y`EV z0)pyuA`r>jwQ2Dd)T3y!c*U~aIW5*=zaRxaim+EYYW+57&kqJLYHeqJa3x^@h<)&v z*VzG&_1MFui~@;(pJ_l=15QKIpDQ|OwLY&CYDEHnkrLv`z?j-(| z22)28EBHYTrG~_Wvfmb<-(-wB!9z%Zqo*GsFZwzMl2ZzG5YB-9b!#g2VDGGY!`=!LIA z3#+5(5J@H)pzxIlGYoV31IWzFb;dUw*$-?`k~jvxKjH`C6b;}ixDUhcM)*tk-j6Q@ zk;4H97Sz@xu4S@J1?E_y%u#N59$}s}=6s1UXIXJL=RMgCS(^PZ^6+z?Y(8*m*e zPheYSW)&p;Y90m9kxw|egd1XY)ddDev!tOT?>RXf;b`@wAs>)5bmV;}hX!9U1BSf7 zAbDp+>QysxfPet?L4v2;T$lG-IASys2za@lq=YA)UInpm=pl$+e}tqc-D$QJrkIs6N>To*a~ zG`$=dGb^jZ>W4%uhwG_QSJ_<-HrZeaa?>$pGg0==)ALUBvd89kyi{2)=y*vovBd1U zSYq~)@nQ|8%q^>#=_guCF~4x`l*TW$9a9Zc3jdm;F=yHimhJ1X5U9DObOqvRr$k|Y zIrWnVK(e#;leGlT1-*$k5jeqT(0ENEvIZ5K+{bf-qhOuF6K{G4vKM@b6KR^uCz;o; zz&Aj7b1X-8?}Ebt1{eq*Zk!S#U+M^rXSQs`h6OAVV6kun*DRxWrbcE7cm`uApBoO2V=h-rHDn2vX@n5+^;%oK1sm_lY{Fs#i8%hC zLcO(xfCu)T|^aQ0Ama5 zKS4d5xa_av&fuQTOS!DV(1+SqhZ*I;cVdi{ImYysaM1I`pwsI9b~Ry_)=Vr)IQpE2 z&g0^C#VzYH-14Ghsg}{9vuYdQaH@`5OC*LFD@+9R!o7Mdw9CsE*`@6Ae!F@IzV#PR z7E!-l8mm7CarMc`q<9ZoJ_nW8=h~&i>PJle2_x1n9a%5irDN(NlMliREp%`a5G0c{ zs-ge6J^qt>{HMhHW;BnR(VRD<8I2%|TlJydMhH$hn6rk^=*9wnMsto9Sli86CEo7l zKmv_7hs-IFOa;^6rZN?=Iq;L6#{FA*;y1?6?9g+`-VZK$@&We~Ph!`AyZ*$(fPsEIqaMN~mISKdF%Gt!qT4JSE zITeJuJWGP5}YYG$&ull11I?{oP%(ZdBT}1H$E8gL%r=gc6gBdkn&7LYqrO!14kribQ(Em%=0pAb&gx<=jr4mIOw3t#D~&7-K*;Cc)LX z4;v>UwUFlXP?5@EB9a;bRmya&Utq{r0h?Pr#Jz^^+_Jvva#tN)>$Y*TZo_IpV>|0M zERtl&2IXRG$#x{*{VjgzAu;AS2<}7idl&p%`~Lvn2k=`47+~LSO&)?jv#cRP>P2Q- zv4wYwn6CGzI3d+6(Q=LNyj{i)9K<_sbYQs_Qg0GZAgi?@B%nhUK_S&8@gz-_!6bCZ z8YrahB%VZwt%xLa$ihXY0(~?wLREVJ&!|Btl2FotC1XehM!bBIuz)~EKIP<6;r%^H zNZpczj(pm|J+r@LlCIjxS2gEsIHs1VJ3U1vc^Nkj%wp0!p``=M*N{4s?tBz{Lh4(h zU|FGs)S^ToyIr7#Pj;u8eSH@0ilq`EC!~&LPpdPILvBLU+vA599-FnHTsNCm8pcWE zU_C~RcXs*fxC)@6p^nh^1TG>Xoh$h}GFF1yz`pePk|K7?&8;r7l3|_0s58Fak-Jvz zB*&9$Z#mj@6O1ms_VywzKDs-=j6_Op@@6DdSn1#!EI}?r5SQ|Ym8h$Ru{>M;sYB3T zSUbt}L%6;&Z8}xtC)wryBleD)8_;q&Gkhv>MOjQ%I9e)uwd`VeR%8Wv0ps3WP^ zNvf~nsXtvwIVL4vmSY2P_W%KZTuSXJ#Gtrci25~O4AsK7`otgxd?RWrL`h9Kb&9qV zcgnyfEiE@Uh*=m_<}?H2mnLBR(#(rrnsxC@GcJB<9h z2)KkXu1QHVDlz?|p&ufqKa5s0pe2r%;%&hE$Uh_RcegDP80gsvc7L7UV!d>3B~G0?!L5toL^A0q8(=8?zUG#sxqXqb9K zNTBJ`z7y+W35z{x@H!4tW&BdTp72X&OpIVIWgW%!EqI2*yC zDcjI2+qbbFTBg+|rGkE3;`0SmB*w-^s@@c4kz;S3yb(Cq{?*v=w|?*|3bsJCPyhJ8K_BL;ZYeD8I+mKHttCP7TG$tpbz2*%Dp)C*k6^)@553%5<3sAPXQ?g~{@N#&M zF{wO8)7-Tk@#u0|(oUK0uhyd`AX(yu&YAekHJpg>yRO*IjDkORmm3ijaST5tt) zPkG|Rp45A#E2oaJhQ1i`d&inIwv19&uf2M&?St;Juwrf0m^r;&Ihd+thTPns_RFa0 zCgWu{sWVkv-`~>!GbeR5w{i+DVR{28Y(BuN?Y0GwL`jF_CbPD%r>b6VvgU99dg>`b zpc3jsm3?N63XF(Fdnsn+T@fGn8PGVvvDn22;$uI?W_4T#_5B6-85L8^?wR^}iVgk& z`s`)UPlFzweuZw$_nJjAB(FKQ&F@?bTR`$}2G9^2h8>YcmTdVh2w0}UlV(Hf+KH4V zJgJg!s5|LtoO7bVp@eh5!9N)}IwR5-D~mEDV#IIa9Dvg&)&VGY7`K>BK97@l@OQ*z zhjG_pFRR}l>d_g2o9iPp1D8%D=H}hX96NXlg<+19Li=-WGSwVJkL0m`Jfrl95x+Xe z53`8J)o5pd!GZ-QW~p-N#B=P%H1HSfLg|>?v^jn?Bj1DPEn5dux+LD83!e)iCgXz zI&qgx4A~7_J7MC6F%Fq!nPBHh#g2?k(l-ww9Rz#|dV09dWRCRSONdw^M)?K|Rga zxLB?=2ZK%ALjha;!D$I&?J!_JYnZhO>(_C;qm7F3UnEAz(8Lp zU-?Z~?g|}2FJsFyf+%`6qFWiCMeN2iZ;L43DP_ubGka}ciIGFc~K$o4u6M$ z%b8G~b%t=AD_;F|U}Q^TiJa(a5io#W%yn5y?51i^g zPVhyj!0-U~r`VYowP{zZ4|StMnu5zC-0+>eaMGTlaW<|9IMko52>)ZdFT&Si1yuC}U!wp$%??fL*- zR%l!P*B@}JP=fFoM^}yqAQcs0JJ4S0wD^Tmj-mtaDaNbN8TJ_zSTKWAEuT1!hk;KD zF?REObWPCDL_F&SJXr@5$0B{CvG3!<%CWw-ve_2dBYd&+@d*0#0`@W9QeXu&w~*a= z76LD1N8hg<{q}Z8V=(V2chxOscP`p(?m}7LGQiPGb4T(5Yw=p87u$NiwRnrVY2GMp za$DabxhGn8vCYEcm!VzQy1|YM=@qn-i740GR!&U46`+C|(mpVzR36}Zn~KuK8*lZbm6KS_ej*rV3qpuCelSAkdEzY4 zxuG3eJH8!SJDkq&E-=W#ii0}tm6eWrS*hb*o-aa;9)XHWiw|hOyOpq@ZnxI3|HLAE z0hT@L;7#UuFbH*Qq!GuG(z5VkkZ*cP5yxO;d7Z&z7cPd%Bx`rl`N?1lOhbZ8kQQSG z@1Q{RTFdgCkh>;T&RtT&yr`=A^&t(JKe4Y?J`ejel12+wFxvYxvjYeY%fmIh}7z0%~D(4|&XNjOE=_&Mge9CS*I!Y)5e% znAq695aTS0xehTY*@4OIT-$ke+2G>@5VBmrlfep8GHcSxh)KY$XgR)-5t+do3;1+c z#P{EB9e00+7M};G`S1S`d752O$SyYB64Us9n{44N*kM?r8vp;Ks^4k7UKRhZRmJ~R zRQz{#3BD8MS*CgZOY^*4^So8_ypwsNEs}b~VQ|Q^-W&(5Z{>nKR_6EU(Vjk})7DtXR_Nk=Erm=2Z_3zb7n?$ks+_Lj8V zUX-rjHfP6DPt$yRkTj&REyoGN<>ge>aw=H}G{G;se zAkOrH4Y< zoE`7L{26PUFkg&=*8(7=(F)pdBx!V`*N6GnnZiy#<*$CMw9o3tZp}~drwn=(kL<($ z!Sq@V5669Zcd$2w&a~-5rOg+zprf1}tfvDKN2NehZ~OygHACQjli=5}utMGjm zanK&8?ncbNeTnc~6f}kVHSBcr5Kt`M_vMMH@FjpCY~W9}vNEY}8UGmRaSFJG*SMRA zfb5`-5axZJyyD|Kse~LOf?pO=m}9FfZk){5@eE`VxJQH;)S--wHTk znAaI|6gGDd(hfdrusVf}Vpsfi<=rHtuT6-|ClcX$z*(H=$Jvq< zxrA7d)dO@Brr2;ANhlyTGbx1FyWe4kmj&29O9F8rFHIQUicp<$&n%Bg|CKN=V#a2 zj%JQhcP5xhd$^Bj5JAKEaa9oiaa9oirQqj}X`*iwUzxN+3}vspgN#G?1Y~OVfmVb) z$WCWramkJiUqiU;#v!*GLi2iQ?5IwjUhcs)IS+pGpR;2j$UVmEFu|Q1ad*8kL#DyS zGg6&0BUOA7Aa6Yw<$nwK3YI`f2+R00+`dR;TZki<>5boEA@i^MJev4KaEnC)JB(jK;uaf8kgju zGe!iCiQtI|ps#j`)A)3I>`oJum|Ty#i3n5o{_)viw4QYu=}$#Ms}mf~CH-eXW!cK8 z(>RVX9|23uC1T~p3m7|i1SI9x#+}9|qQuhDSbAUj@0ttc)}Makt1iH_;xxQZn;Hbf zSf*t4q9|Wd^o;d+PUHDeYOlAAcr>lDEQ!9PjxwLrtU3SMd@7amb4eK0;%H+U@)EDu z+m?d{o)#lo^2%>SB%Ioocm3&461A=nv+`1X#qcCdQ-w6I zuc`aVYh}3fr&RvWe+CT%O{A-HQUPAlh50uA6w{UVpj`PKIVPvWI*1QzM@Rj3nyR-Y z;@gLJd27M5n{Ob0x(a``a!ew04MR6zlr~StpRF9a3cq9h9rSo2;O~rb9n`@w$P*jz z=`FCicHPFy0JSb(If-OU=oL{YL;~D<U=q2 z$rP`{?FzA>nUVq(XPv~Xkcp+@c5$g;6#y0_Q$udB&4=EI`;U?hQczM%vnv=;|JyT$ z9XV1AR6yeCOo(IDCvp83KS%87XsHz%Z(s*<4B)6fI!6~W5nbGjvTza^hr5VKL6fXu zm7{a{nsx*k!Ltx=Mm*>lMlnN&@Bfcl_s|kV^pvo%LFYE%WwNL$Q zgm00HdIb^kV%y>#%5%w!Df6W(`)E#eEvr8@R?noy>j$Sw{q<*5o)P2bSYt|2U9B}WW<4;KH+EO~ z;dqr;UVkx?%S0fGuXeH5fI|$r*C38{_Vi8!h^TozXb{hFI(nN4?pf;_ZZQ&fQcUAq zgCyb&2x&1$W(egS$NCD|2h|H62wDi{RXy4jB_&L^Swm^?tkPf|RvzM6dsb=fL=w9R zS5s9(Te_(B#+&0S2_kwcdz%_*5Bl)Gc);;(2@0Y<20Nw1-QB6BqhBx+T#n$b@t# z`rcYWJ%TTJZ%a;DnWF!HiDti$bJAB4-JQf-`O#p+XP3At71t7c5o;MxQ^8e5PDjN{tAZv43!0MgqA#ASz)MYfuSaB#FA!+OWXsS zHmNd=p96PBan-;Ht;@qZWMYwHH%|B^c)*tuLi5;x>F8meuI_X0L}@1er6yIs*YucByZD=p`L9@vt#oAZq!d7T$6q%ISxmEOhp1lnZ z0{>r92;T-IrHk^(*kJ0aD)zw8ebo~0hR;)5Ed7(PZbX^SWB;^uYg=#tDU$l%&I)1@ zf>E%En9Zq!!n;Td?ddt;crgLO$O3OeeIZ7!CmD5K_j~4b$tY7j73XHw?_>-=&)!v8 z9Jl9N>jASF$(ac}v@V)v@Z@*1dt?TJWDa{aopop6J}a$EhHPLz1jBOyTuPfFbwcBW zWmG#t;OayqDv;sHDOA3vF+H(hWbAQ>BZY8Zl!#dvlF7%YVWiFgDg~ruS)G)LPRc|l zWrhL_&S)8-K^r<&e|<{ii)i6%I$HGPoEKN4FK;K^8@;=OQbg~LV}mw;s4nn=zXQ2^ zkl>G)DyUP5E!S~sDN+ia34!v37{twY06)!l;?Gu6h2Y<%?TfXci)P%7KSxm=?R3h9 z;r<2W0=N)05nM>u0$hUQ;@w8}p<}%cWx#Y7Hiys{zY7%>(2NZ)3FXh-6~IUx}fZo<)o3r_Dy}b zg57gy_%2bT1{d>-J)6cNRG|bf^Wz4TafXZy(x>Pe&_ZaN(uEb1P;p_rr(sxCgRPuw z+GhO1iiKX$HygJe)<&{%D_gbMWb;~d4Qjc#Q;Xv1i>T-MsApIVy|0JjV)C5`>WEJR zsquqfgAhtk=T)wVjTbDFBMIuxcCpC@QEJA;fTmXHD~Bf=#G{FWl?+q}C9HgdcLTP{ z5*;X&`67V&UyQJU2iJr5Ac1LtRJr;ESgtyaPOS|`>`WSGGn=f_c(vkX#BG6lA*AY# zKC3-E4z+^@(o8k6mf#)3--9(uEU1c8NzE(>Lljn#lsp3X%9DNskA2!1mLDD z4G_m_yV#<`Y``?SyiPR}ucJE>ZD7sV&72|t*LLS@T*}t^fX~MDFUe#C=N^)|v1GUJ zzO+~}JE3)R-g+^}-~~PWVvPL4lf^O`NNl3N2Ed$ZlXkEX-dZs1gx7=VH{MEcxd!tZ zPE$?l@sOsYhQM1sb?McEK!5nd>i~|w9WdBpLdYmer&_i zOfjj6wMvq+3ugXs|Gk_@VTH_=KuBT>aBwsjLW}zEeSLdm%%6yw2ZctvVOn-f|6u~y zXg_G8as4}w*|`+Dv&R0H8Dy9wuRsN^NFG>*9xCW){4_$CLf^ZHN|D#;UF>VDtG{C{ zT?X%&GbRmrf_1&Y?AtBFZNUX@Ztz|VH5$;p58sQ@l|zg~x4%ksl;kMU zY1;Q-eG$CBJ40N!^9mO&%QW`8qb=-tda#=E|33lC3ki$tW`i}G?%kvOuc_uw7``G$ z!ZXo+a49uWQDh3g0U2Hg&}x%T<0pVX2rsTra~cc3)b0XS-iuzpaM8*mrJ-oGe@XBG zHZ)FDy>eeJx#e15r1@X?V+3`xdT87nRTYOIk_k^=_%RxzX!q1fDpTDGz$%C~ex zId|$DbS-W_j?GWy#`Eut5DQ##tXz)o*W>as78-5BUlGGi^Lo^h-gzWc5AQ@Fsu&SL zNNCrO2=JaxWE(?W+oC?e!(DnW#JwWdSC{0*ueA*z63 z%7!I;&n7?I_yi`cv^~v8SSX{qjnG&3g}0%=r8tBx5e`MsG@fV?U-)r)Vg=&@0GE;c zhMzDg#q&vePzXIvczZnRQ(aM?rY}|`t{RXc`3*l~@`>lOanI-Cp3l=W*0}h~*5x$& z*#T||0>MR%a`0Hb0FvME3nrgKaP8T68HR+9y8Ve zKtBN7SOe1KLIh72P+ULJKKsSQZQvsihj4#Ixc?WqtINFbXZ#Lg8S-;D!tWpoWLoqJ zv1HAkGQ-`7_jnO~5~YY?Xr~}b+$){tJxJ1Ii|DyG?%5glbj5T$t6_oNypIW4UwNHe zdD{F119mdtK*w$VlDS3f8y?REFVLIpjsB;uW zxcGu;e~q-H8G4-X5&8gyMEwRHg`({Z((w`>=q>S|Eb+IdM0%X?ccw&%>Xg{_c9;08 z-V$-AychnSWq`)S^9NHrJx=(ji4yXAuq!ukM1Fo5z8A{aehk!IJIfA9L2drUz{;_9 z^N%Q~MUNdMSm$H#hmYe=x-#m8Prw0I#du#JjPCmxleCVKj?M<~$`@d+L`A!!{|x zd>s>5Z~|A5PNXSL_+w-a|BMELuMt;HY!-eTezG+ALLlPTu;RZUM>#!Q9+Rmx`XGQ| z&A%dclldSZ;x&X&cuhpkMRwcYSQN;a9w+=eeMhM;{0BVYKWBveiy`O?$=>OVwzr!= ziSiDI<5*mX{=xknkfSWxW7@$2RPBW%$Osiru<5j0{3Oy|BDBb$)!4#;{RY#APXY?q zRoP(yzF;x_v?-KHE7OKT=`mS$u{}@WPo^^Jhn9~;g+0yqq;!~2s2aP~K%ssWGnh&f zQU~tbmTGWLPBIl5(~z2ksd*iaBy3j`fTWH5ae}pPQ)!y-a(x`(m$Ln`8~6P zWddW!*g{fU<4)4DP{@7=`YwZnyh(-CVJ2f3K0jb7{m6?V2JoqU0w=DVU4@&WztrJ^ zS|#F2MA-2NwtODt@zbmmZ?pygFWiS%uew9slzph@x?0xJgsQp{M=9E%2y{5A)(vkB zI|LFG&H*&o(}kvnptpIwim$0t{%kmBl-)DIi zehK`x<99HAx0xR_meyg${hC-f4=lYu=6@I5lOMt#199J1A`Ismr^0RExD%aTZfrmR zj%o!5fSg2eUv9hrLFL9Y|2~ZpqRi#S)iaCQxMoJ_Z9rHS8nt+#uf5j6!GJH66y%UT zyK@{lg=W40nz70JPX)PNIe?~4fbpr++uimdM5Vo)+m)Z!^ zRaqo>~L`cTUdAqDG{K+zXRRnEYWSMvgh z$FKsAPZV$NohSy}>VRVdyBuZGQ5dx3C&6(Ds2v(>OL1a(*BBvY=i(`{u0WZZ?!gp2 z`AXn2mbYXulvZw)lO1WD+Q1#9Gd*o0@h+q0#b_nPC5l2e zkpX0^+?78jwu^#o-IPp(D|+0tp;jK0(1q7i}%^h-R==VECXVbXjh zp62_pG>p(aU9~=NH$t0jXJ&)O55E>K<>7WI8X=|l;Wy%Go`|Jkgh})DcpB$xQLFrr z5hl$y<7x7-G>nKt+?YV5E22R@Ih34zN)$c3ZCz(I^UAk4M;;9#oB|)Pb$+7c1y!Dz zBc&g4T$EsljO7+GooVprz0+V3PrXNTVEMpEUh=HZfv#XCZ|pewQ^k5dr8d>r8w23F zt=*AnVa_p}-9edDwg_A~FIH{3J06UJ)HL)IcLx{Gx{o0DC9iXLa48oHS?=z5s5@kV z+bLShfjP<8*V|ys0}5m*p7FCg$nE1moaXMpNxhy5sFaLVi3-};+7;a0sbD@TSTY!V;~BGD**?4S&WqXPjmiI3e!26(|5{H+YC0Sv-n zuzM^*;+XgmN~#w9@D7p1t`n?7IpHS=)erFpOsF0B$=L#L zpDplHu|QYRGndmWmaJ*KIM5GENr}Q<9)L~`BvQd)gaaw}m6WUgThV^qiy~wawSQb6 z`A&xKv2!Eek?_4J9r+G|@9MU1{|cU}(n<%>U}5UAK9L!jIDm1_TCH4@!BQ%g46hOq z#vB51azLOot*v4e3gHv0P$uY<1IQ_R91i@woID3o%YX-*97CKW3=s_YqELYBy%6M? zshp3U+C^}2*Lg9%!9MuYA9;vI%8J?(gKi2D`yxU31&~E$p_>A5Zny*?ZS&eF#TStx zpP&f)Ex1t2QlzR;0Kl5!!)<|234XTi^<^aAsxJ4#bou0$?Mx05^^ z=IADOna?2r?njUV{J{_q8A#|3k6r^a2$3mzATcwwkwuqS&38up*0s(70IvXkbwa?t zH}2QM9Rs?L8$aU#G9)sgtl>b+3>ftdj>Y?mzZ^~*CI&pgpC1xoS(QtYf-@Npu5}6e z6VFGOGj5p(Pep)nB7T$^x8XN{WH@r&_4_o!pTuu6gNVpL-&s0bmh~Ktw9&dLo787? zhLdtVI}g@lRg(^G!urM}(EwZ`mJaqO7TX#31*5ADB;{iE{!~!zij*tY2b0_7#&r@= zr4y|s;uLl|sP=~PR`sCP2?c+6r}Bh8x1Bf7GGH^POHEqA7e0qU3+vg z4~eN=7LHS>QN_T-PCKX~4)>bl(xoFL)x;Sl>}0NZgm$b#sMR@aT?Q8J*45JRHabrxlTfvaeKSD8;+cVAR9k7_M^Y|7mueqisxk= z=KWpQ!g*n9Gx}i|_dHLofJYI_!v({zj{7r68`g0L^Jv-R@9;-WB!t3^(f8`_A~>mY z7O`5|w|+eSu3dW@!l_SN4m!bEBAp?Wxf;fj@SxuhS0LU_g0!9u%&)o?xxi`=&ZW)d z`&f9RGhrN*jLjG2WNf;apN!2GgUQZhu?l9cmfM*k$PQP(76@qr2dQ)9IPiB|Zv_cd z?%FM`m%CQo#`9ipU7kzwQr=w!rs*hagtOGXyN47wciXrGy^HHs@5G>25ZGK7*GQ8> zq>ZuWRsCXSl6tNlbP2J`Ih5K`r?Ck|8qS^`O7AMHK;L%2(y6@NHtn#uT*i6B7u8)- z6n3TyDhC!bm6iC_@hju^G;8u}=D5k~JD-fsZo1Z=(1;f33bQsfVKTs0eFcFucplD9 zz6s7*Km+~AGD$_P1@Lh}q`ne-T>7YQVWk$QrF7-6xEC#nd$Txz)3`~{My4FcModaI zyamU_#9*s`?HN$qxI8cOX^hGKM9N5dkg=4SjS%=*#NwU+;87((>Qo@^TX?1jJhr}D0uACV6X1cL~D<db}5`_gV8kVmXF0Z2|bdEkT_K!Gc*mnSCR!JRKSG*nUJAV@u3!?@R0FU z0!l)2^f?q=2F}CJ(?OZbvp$RQdj)W*{gO?B2SQ6@K}xg83s1r~S?b?VJp3HECeOql z6f7I}sfl4%Rt{CjxzGGIkY^5lkqTtUU?QQkr$vvh#SVd0=$C0H!OIFb?eJFRnbS_H zxONOR=}fbVx66A&E^b_JVLCG+T`e8SZxtM2WJ~kZgo!ehi&bbp*5cl1YIJo@g66VX zhdz^Y5@tpKmaZ;!&h93t6+S!%;U}}BcciJ3C7~^alNK0M)EL<_r zo-_Z)I&pDF?|3*M=08VtU}HRvkghJ*YbVDiQm%-MxHHum*9Fn)30RlT)A)IMi5FsB zUT-Y>>KC9a)tRd*U|mOD-mT`T1x8)o*_0Vlb-8e59bvq;uB|rzWUsz}YIBtXeCveM zR1Wy8)7S;X=z&BCBsk&+@&UT)-|Y%LfuXS7?yThX3#m4`c~{s`UJ zR@!-Sk1peyJvwomX6(v}!O18YJ9jBY!xV_$a02Aj_B?~0b%5*zNVyc>^@Ig@IAF&}4M|4nQ2kPRDoh z063hDDP9hwu=(L@P*HdQfbzpPz?rR_k_-=o7luv*J{8`=1Oz8M2*GwLyov62;Excd z@xL4X=sJE3z76mqDf3DL&22e1>`cck*jPa!oFqn^jcGu|+nyN+M&5?2a1rF*MEE8Y zh2i=fC@EJVLmr3NBxN!N8zdMJ?N=iKM(YJ&1idijk^&Eo@?XTW{AMrw7Tove<5HMt zH(ZKtLxz(?c0Oh5OG(qUo+O5g;11wRB3MicQ0Z7AE-S)=wT+U*63_miod)1!e_=R>Idoua{W?F9#3$pVfMkf z!R-sV&cL19&qZl`aA1y{=FHEjV0Fu|(TNnou7as?p7-JhZ^CLLKTz4n6sGHx+)z#q z-r;j6zz?pGLqk=sce{Y4X=xDA+UJq452vTF4Gj$YGlL>uWJ&OOm93BdOa_uqG;mYk&s=g<`gS^6hSlG$1?z zzf193hacacq5pFHKHBqp1nC*}TYM+6Nfz;@F(?tqjQT6jNC`8_yG1UGu{sp)BfN8c z6e3K9+!P^L&8*Lw8=tGXBgxyL{xl5{Y04{+L?t)iR z_4)_Q^}tz#g(5@XDsE+Q)9 zADKb`#+^mYVe}h@yZ2YY^;?&toOETv4nlF1?cg$TEV3KFix`&{d=)NzR>l=T8|`hv zwx(SOig4nd;Xz1U*`*!7l~kK3)M{OMrIm$Vx^D}VsnpO0*d6hzgZ4CWw4`P)Er&+| zPq3d>`<_>|+mgntbtHKNe>m1+r`OYm9ymD8xHPo;}_o0&vr7&_WyV zmTSrmUIv%O&TGd$i2C^m-B@GaC@(SDvn=7oPX+*HQ|mGQB04JlVCNMza3n{}A^kaCQ_`-~XNNJNM3(eYQ+U zG67~NW(klW5Kv^_ciF-!2ndKY^d$(H^f02LK!_}gi0p{6iHHa&DvAOMh{!G?JE)+t zh-|{}et)OB``(!(k3P@){QvKKl3R67ojP^uRMn}qtCTk<0l1fI?y9Bf_KxQ<8{FaZ zVyozum(EODE7VT*_Q&J~DJ)<*j}^?G!gH?fvsp$7iszB9V2QLb+OA@&S!S@Z^N~Bb zxWCJ<%UGJz$D}!ZK77Yz=Re@=)3z+yNtqXe<&*dG&K=Rm7jk{HG_YymOL}wME&2a3 z{ud$2T;b(s&^PA)1|NX*EqEa8?I{`SO-xN5`hn5B};l24GEB}SfrJ*~h2<5c~OGCfF(}fz{r--I2;%j;E z;ik}5{kRv|$C|%w;3{ATT7vjYRX<-K?pSa>RYH7HZUmf9V>)kUP2|n233mR*GNf{T zJZIo58Z#S=(TXVEML75C&V1rJfe8Y}~TWUg5&;L#M&v34A9RGC?>^A=YivN5vVtajh zd3h)P5A**F{%->Q0$la;T<2l`H~0;nz%3zF@^J)pq+|ZfU{=ZA5AkDcruhElY14gQ z9;j+gBdxUyS;O}&ewunrUqRSX%PUA<&}lmF^0i3gY){0ieKkaE=qy62mU7qp2@Ms_ zS~o52!SMChHSo~(l*UvT8mp`(a`;wDrJT*nYH6rd4z~k(q^M_eKFMAt$pVLA@6Ohk z89RC?z%(5;Do>fv$tO7-Tr}vuq49UQe-hIg8;Y0vS(erF&y%N=mv$pfCIv^AObY8t zm>GGuG5(~joO-9xwQv?f%>0LE)CwUZs0#aodwgRV4mrq|Dr_J&K!0GzT>gNo-n z`ssPUEgUn6eJ~A>s|KrLqhzhA_fr?BL)cHLTyNE=9qkrw-8p}f@6h#DkA-n0S@zKH zA;YimMYA(Q;Iv}i-qJ9kpGQbrsr8LLtP@QsUeMS*0{^w>Mb#}?MednaY+w8LjSUN@ z)t4C}Hm4-(mj>5$JE{#B18#f^hT4eJ9_^%3D+P=K(>7sf&b@z$`q&pVb}V!!BEq!t znCOs?VbDO&YGd@uz1TUuf$G^bL_5R3mutuBI~K0BI_HSW3p*BaR9o55xG|Nd!A0ER zvB7lK{Zff1=OU#~vv9HCyDac{JG}Z>y`np7&|J9gPC(ikh4j)#vz~!Izod4ZKQ-&B ziVe#PO_2=?*RIFkUrr%RvJHt$SZ>PQMXF-in6ptwQtp*qffsXA=ibdziVb!YFPz^$ zMooPGRiouh=X_}3mCI4XRJ$dv0}H+G#xUSW+ZYz*T(jj=v-ApRb`Ed7mufU?@ucH+ zuUR%?TFT)^r=s6fonDXYp~tz@&yX6{zbeL5aY|>o#VE14Jjg383%Q-G+%Z>6G)?`* zQu|tum&4M+`9avHv7E*~+Pu_XI6RTa9cQhrTP=qtDe<%BwRoSfonR;DSowsV4t7e8 zl~33%hWKhfAAzs69}`Ry!4WWiA}CS4at2p1rCC_C8>PbeetZ8Tk@op0bylst{}=?| zx@vK|d)yehJv?qqU$LifbSmmxdaQE{_fFKaf(&aIhS6T4v@z7dNUXn36T7El_DL6v zNK+}?-hDfP7xZ*=KP7iWipztZPJ=Y@ykJB+%Y$A`gWj+pDNd7%Rpe@pU>*=NGlY3q zd@BwUl#D*j~8^H@ZqdF}g)- z%zB{d@Lnx1iF^&YQlxo6I3ZZi?6jyPUCi1Ki(FU?;<^eI7AmP(+;C>7kINr)G4bmTpQ82WHq}WSz z>jm*IF`2E7sbpy}P}BXj(B3P9w&M*Vv9FvB7k8^zfx6XDXXGe-%=vTS!elGufLYs* z1iB0P)vQh8*sRU%DHfvtDIVyz6#aG>K6#?ggY+mWO0l9kVuaYDV&Stiv{Th58|?s! zRh&gyWagugHY~Fe52I7Xxz$VJX>7?ijFu6=0V*vqPoK*r3-WZ$T{Vc$CHpH}ZcFu* z%84V5`mt(Qn2$W4m+kh)K2{6;v5#P8t7E0K6tE?+K0RN1lGc9@Cof zyS$X4Xp7Q8e=&7E?Ps2H|(4Vn+WDJ|9J$b5Rw0JlN+9%PD9zeDb75@AE8yp7(JgC6MMxXs)FZE7tdNwDo_hQx0cnj2AlY zr(v)*sm_n+@6=EzD0$6Q+5gG&(PCyTdv0(L`{QfS$^aJ=2u&hcw$292g#sl8lUL!m zQz_BOb^7ofTFHigC5qy$977Z6(RS55!6JyqeU45G zxiXvBW zmr{?e_@@b07wlHnyl$3zU3t-`eN?2wq%vOu6lp zx;x9gE|oj%8Eol|H-C_^$qYdZ+z=jp6(p;~2)!x)w2* zJ=Z@$RBB_Lr}Bb`gMe$!Xxplg{!Xh(%0y$h+3+|`cJcL3=vC_e*H;M zeZVIu`Ye3qA*7q)8Rs>66HMG>-4xd5pQs#i(~@{P&|QTTv8xG|Mjs z|G)fi!q5CS;b*NVoIc<4cW19C*zDXkl*E9zK*<}|+F7M@J`r(}ksR`1?uw42)b4)ROz9cV4NXW_*nXY>NDJ8XObR*PeN z0d~-#Co9U_%A<5LGG1|%AU>GPyHApQsyS=A=jR%UjvZG|m>)zBfOCf{PM91a$uS7# zGT1%R(9x%aJ`CE2Gg{X@Sr#-oN+COWD5L(gaMI(RYH<9qzyiu2I!epqBjkCI&v#Y6 z(eZE{TyuG?l?ssqc9cW z9~CPt!efQ37G0diH#92SU8eoupz<-IBmyvA6=*EIzJq&`c_Lx-h(dNsg{u+=Re^VgBG8<-zOXL! z|nwo{qQzi{Poek z66=w)ESuxKRLyLlQlE7RN8~8JQL79npYHQ;Qtu>8u}wfA$BJg>z2i!XWGJ1rN>n*j25D$$UpGS6f?4X7Bc zXSrLSUzN@}3WH?agRa^t>MX zoT$_S6~Gxp@GP=SK0{De0O)IBs;?2yi2(Gqj7VxQ8%Znf%Yx9+hNh!o<4naeu(o2U z?(UD?zKq_2_;+N>ooT6`#jmfW>X#Pn!cH5b&B<~76KG^peljJV4Phx7L0^@SWPBc7 z6&sysiFZ}rX0@LiQp_Qf=U6hL%cOi1LT^9A0weOYJ&7VZfuIH2%L!anFb!b*h~;GY zzGAFa6#O}Y2L@LhRbkWF&2M;;e67ci&sY2w-Wl$G>=(wm{1ky7;U~-V%2FAm)>p$e zg|}~TljF}n1B)B^$yj_f&-rq8LZwv8r`ll5>UVYPYiG5aebRbx3hGG&P!G<9uj;{8 zRu8t}x9{%2ZE4UQGRL1+dAP4ZmOaMkgQL$8aG4*dtLj*k=wwj~RD>|H(YosBc_zM) z8RZjDYTfGV;C#*5K*cf$da%^}mPGD;I~9E2RPe76mrBd7iej@$ zoGmY<=t45H^gdP`O?$#y(yo<=IT&U4&SXeKZPhA9LdW(mvLEW4Hn{Io>{AOyZe+l)u(K%9dY@tojSw zC4|=GJ$f7E3@|=4Z7fC0+)WVQMgHS8o~yR5Tvwi+P4t|eJ?VD$F|yq2k!jE}SoxXf zgc?kLM+%%taQ2PBSq!-&)dn?$OHDrI!Bd9OlM3nTW(md`>3(TlzZ7&LfFimKat%5@ zff%8?9HFU~!1P4)37v_!P7$&ehLnRU-O^g<}4VxYqpV z3@$bjzfSQ#8WZv`*Z*Wpm_|d7-!u(gVZT08k0DdmA8bxt@Z+m*CYD#x0{3kQ zRx;i&^LeKyjLwI>x6Y+*?lmm*rTFu}50tv!5vu#$v=H}C3-KBP69E+Bl_aEMIaWpB zt^z7X$E8J8i(4cdnm$H!(YN7X2GxUCj0G<@5OrK_*}TSnJ>`Q0*_iu^To>2o!O@k3 z=3_5r4vNDim=O3jUhPA!QW7;G)oxUMVdwlE0;go7!=Y2JnFGUjvVYbyIIWjk_BD&C zT*pt(h_E_*#m98w7VPZ-<;5JAb)LJfluk$SB)wKlE+-RcpytY#Gx5 zrbYDTG3VjUBjV>68+{J+ugE5@WRzKN?e`qC=uNsA)#fs)XVLMh9Bm^_o*>e=bGh^; zmD{7u2{60b(m#R23zEo`#JLjbuAB}}{LNNf6ciJb_bre6<1|w!qO5eNukE2zkE8QO%lr z-4BUT`H|v&N)$C~l~^H-lUcX4zaY|Li;o&aw<^X#Ie(9i4g)b*c1JMg?WgOuHJwAi zMW5hDYS7w>Z<&3nbyMQ2Uu2@~-luEvBScvY<(Ui~q$0VlqjDyy?g^s%aiXty|Gn~` z>;3o1e;z*?8d@COgB6!yNMarkpU4pA0dYu%Fb@N`vthCH7Ebnc*suFBq7F2=Gg@gn zb|W1+mSi?y;_Acm(P%qDIQe4pP{!z0M+rQMA8uVn-GTXHbE%sazWAepfmI8!JEf|-yaM9 zz(B2ItU<}z-jHV#xSzo_Qsa&qH6MJ9%=a|yT8e&XQLgjNxpuuI6`)x8IWa4@EBdWt zQ~Qa5bK@>@S+VtU>gO*Y4BRj6_YV8@g8v@ktTMan$Qn(E%PI@PnesJ^m4Xh>lx!Xl zM`Q@|fH*QkmuKuY7gWS8ScsY-AYIxj}^0+tUakuB; z(Qb9mLy+gORXl2Hx&Z-wbv8YQg*mt!G@cUo{#n)C!nNwg)rRW9?~*dD`fnBQViY%4 zIjGOf;~!TIU19v=#Qtb+PHwreB%B$Y9%yucOy;I_FociUM1XO93geqzmuktVY^M_n;A`>OBZ_ zv=cv>z7G^)yBfqNgxEodnvn$q5G$T>1CTYwk*#n~^dZt8vnRSN9B2()uSVhw@qDol zj^mUU`#$3W=GBU&_8b)SEwTR6@|#MGZ1>_eYG(XLs1%7EhXO?z&C#u z(5Ac${jU6sp|8$7zMzAT$+tby}=Au_#bNs^Jvu4c)*KQff<+ka3fd5c{-!CVC%4~BhF^;V-pIDkp zUk6QB#mL&1`Rk)y#^w9=6-B7l=;b3Ys`ZtwN>p5qEAmOso=i_gcTSB0Y}0r-1*CCS z&*HeR{M#r>V=w6S7uZMR$q3y?(3zYj$2PZ;v*hha&h^gMyz_PMTqDOuTH!!_*g3b6 zv;4^gAmx5TE!$unqr~uppRkf}!xMg@!ZkQI4~WGX!aN{`GK6_R zEXfe&0g+?~^MDx65at1KQid=O2x-ESH4g}miFky0K%AT*%mduxYzYH%vLP*m@uWV$42CYsVws2bSEu`f3g=>{ z0%zMhyV>@R-XZxSCXfr8GMcYdX?RLp=O>}jW)C!QzBuD-9uSvg2=jorG((sN#AO-6 zJRmO55at2#%?x245LaXf^MLqPhAN>$K>R2}mFD3{;LSS}m@8sDn`*v;Sc(kXXCaT3q#XxbE=3L> zN7{eon6&+V-hMTpb0hp{tt%~Z6(VJsmb}E(kx$hCEo#^v?o;GOmD0)^SG0mHZ@5O> z=PQiN8x~Kg4q)-*P6yS&yOAEbN{XDzSW=<9=k7f-{ySu+WL(<4r;CTjja|oRowu-> zM{B*|>sG(dBPFijZ+n#QCK{|Ia5?@`kT@6PP|xQU`G_xUpIlcig%xWhTd~hY80T@_ z+cK^}-+e*!D)qX}Qs@+?xxG9#j=tM8{*2hiGnG!W@D5&+Q;XZw7o6 zT7-GP{|5d~=iK^8Un@Y)xizA<)gLOd_A5-0~Yf zwdrlm<9Z^*d%`e1=IiGi$08eFX403dmN%8QEP!G8_7b)#p0Ur>3>s#xV8 z-ubn6-to?x-uXa|KNN8_>3P;m=X2)RX|c~w<6x)x_z!V;8Hy1 zJwDCOlC>Ywd2MX;+V=Azv3LZeSYF1Cx#)a>=X;F01i-HWpNk%u4t`DQw9@fMq5FOs zM1O+GvLia@P50i8^J`O33+;<<`e#=BIsNpEzHo0?SSuCdKl=a*R;7?9wlqqtWn=T#s__qiD@miCQ zkSn*pD&*Lew%1uwO;_6ffwy**Vl3esRl0S*=hAAT~&5E zH$Jd1EuYN^u#NQ%PbWr-6m?B_NAx05=#NzmvVgJcLDkh5>i;W{v5)pDPD^{)+N8g! z((H&W?xfszCL!x3(n`=+k%6-{1v)FO3rH&c)rjK_b8m{-78V23Yk-cqoOgeFY#oh^ ziZO;&WC6AOWI7Pr!b~5wLXa-YMZ)xT+OmWh8R@rFIM0if$+aUyUM{}OFh<*hp|#vR zUXm*1`kpeS7rrwaKy+Wo7p>_iqGqKs5>Y0pC4e2zQ**L}eI4FOTSBz54a<4yItZT} z2QnY`Y4E1i4fBBbZH6!pi2E~yd1j>(iCG<$pD5W3&No8cZ5}=JyDXl0IO^nHqhi>$ zd|Jl)pv#M?tA=Z@yhiP={EXOvdmTzv3?ByY+MQ7HP;?h4LLMCxA}G37A&~uEz;6ub zJ79U%|A2KLE79%lm(bXmukF$@)gi6j-=PLsw-`omKswkK9|g+rF5t98wmAAv0>jGZ zRc$whQQ(9qMr+C6H&@p*w!1r(g6eazu+<9FC=PI#dkq$YN%^8YWzP!^m6OM^=MqZK z|NMLybIbTxl~eOLeO0mtmLpqQCDS-=W8}MpvZx%)rzSmN@(^2OJwy6Mw9z~^he`;q zyh&cM3(9h-a#oeoDN^CwcQX~H8Tk(=&aUN=oqs-jJfmnc(=K(*v>(kkklO2hD^1I8 zXnf$;cE1WLld)#WvaiW@o;`y-je+w2C*oadcJnPVo5I=UA>@o2OBKe&W6Tv7t z=;huf(jb!$vGvj3)gb}fKu)onl9uIckTrCp%hu2h7`ui}GI7hl&||uEZzSRnH@}yU zE-;?Lx0+fo4>{4`?05lW?j1t8r1co~EqSoV!pokRX8RD_nA1h?LR2{cX=M%`${MYC zKs=lw%md<)3}K!PS+$Udt2o3?t^8l`^R0X1EAs>8-?pZJhLNM*|$dx7>fZh#v^?<-%=3Uy!LLZO`K zd0qnd|Qq`kS6(BX|jompwC zA{D#VmPpOxZHZ*EmZmc9Mh2}Rq>DFpkck|Owo`cid*bAAwbmwEU^ef`!;i|aYaILt zp3&0b(s_xLdPWq|*X11Dkxao8ipn_leum|g=nWhRNeoB+gM#jG`WE>|VP#?`zbCTJ zZaiUbm@u>kE+&tgTc7;V+_vN~bC-B>w+8ts7lM%->sz^FJF`7d(P4gk{8SkljqGXCNG-XmS8B5cZnx+oN<#}f?SK_ zvif!^Jg=D(mvg9pOPV0g7lMKLeZbvhY-Hpllp|ny9Acr|^uHJ}os*f~03e zA&!orKO2|7O0{Y!HAbt#uYY=}GFj{d1a7{P;8N|?aZ3$7gXP|GG#7u=D@5OB!+%5( z(G*2^h1z3z5A98Zt5i2HhTj~mN?8)>GzdV-a zc+qqjjY5Y1IyU$-)nJ9#0Y=^U)^GCs40)!OqE(1K(4f0M*HXE1Z}B|2)5=e7yl5@j zvT90u|5Uw@xaeS(cX;%fRn7L%aCAy<{180i?n2!$@mKf>+)S8FNsq`(u`@E8a=$EU zE@;U~cVTV7e=Rd{omU|%SGDOS;PjWb`3;eR#o!kywP0d>@)x=F$)5}?CVw`!l)Pka zIeFRKhUBm2HYR^Fw<-C%xy{Kd=C&knm^&eP-Q0=EtL9EhUc+S!H`%_QH#ryr>nR`J z>nTrcnAkY6X=2O7=GN9$_aOvRn=BW)S@63?_2&c>-BhYi{)U!)21-HlcLAj#;p|}U zXM?)5k4l~=wa^ywI2Jx#v*ZcATwcqEaqTVL58b$PXi0~>NGk~qrl)RKQbV@j#NDVjyKu?wQP^K4o@Qt6uEDfOcP z-hfrV0|$!}8~b@OLa~o~iG_13uyEi=_7)D26jmR?=wSJ+?8E3V`K{W7(NXeSRSKhn zq|D{~z_xBNA6rKZ~!VLdw9Q}vINJ&-unMaBpxsy#Jx#htqg%f<*;dGsL-N$3J_aN>f2|9WPMjN zT$u$ss?Nvg74x%jFeRg9<0d0M%0jE-j%%?;jEiQ|qLK+y{J3b6xnVNV++s4>+_t2}+$EmO&7)&r z+#$%#A-d8G3L49N$MalOJXwaYu~ukqm=w(|CiUjFC3WU5@nnwu0Pz&$R?m5U6rR`B z@NBR+LDFO{PZ5~gmXyt1;)C6~o|mAUS6En)PL3I;lkfVp?3}MNoM=y|5a36fdnhDo=%#bl1T^~r2=+mcnxUE;~zdY-qS z8hwlR_iA{zTAUzhH#bb$%q=Dz=GG_E&23AjnY+Z3yY)S9K{dQpmN(S!{uf=7#?5?F zfXn0U<`$DtbK4S@5i~CKWR9L&Whp4-sr#S53eWGuGpzJbzAQrZ;xzY1l~Xa6Ee+*p z4b_@=h*WAAEuAI{>cBW2t?nP3SZWwjP_!nf{*BTWbvzvnw5N+!$Nz_4gT%(OuizOi zC0Rhvh(g?Y(5J5=ocd%_c>rKK{l^m;lBVx&O)LzZ>hJU3*e9X|uCs_I<8}`dXEt+U zW}tniEq9O`-YEA8E+#AVv<$R>k+;VMnO?NNH9Zm)G>kl3g?O~>1VrmLH zTD=u$!rY`$qD`Pk8inwtNlKv0`9_vkw?QiHuf4QWB@1I*1Ko!O-C5L)5N6mEJHCw^ zxPJLo3mJO6iBOBv2t{{DOsKy?W~1px|oZ_6Wq%e_p16{y>_Rt0J(qJGHx;y<9e@oM-6< z$$WFeWLT4$>x@mDdsk~50jAICF-yAt9?xct?Y=ITyc{tc5=l|uGq;H zJGo*f*Wy#J>k8A*!!76`Sj6>c>2a=uC~<#KY?|oR;hTqutr@~RAh@#EQr|B>{x-jUps|npE>$9aL1?>(&JB>czU@4E|03wn4GQJkpzbC3A+lC3 zN!#Ei=$!^7$2#Gx4GOW6Hn)yTkUFf ze_~Yyb^6g>*YG^Wn-z?h+ci8t1zyR(z^!F;Y%K7|lT@2-0sK?dZk}o&k2dLROIvrNcP(iXqUh*v?Lh%*XtTWY;!?e4 zaX+UND4v@I#P9R#i|2;?_|eX#x??Wu=?HXo>Z|6T9_ql*HS*hmp}yD`+V{Z(b}S(D zhXbtmwu&Dpi}&;Vdfr>bdo&3%u{p!szDjo3>2h#cYEPNprxvydKckqYSQT$g3-IFY zZ+;(PNPaKgR`Jg!D7|ebX6bDe|7wyjFY%kndS?t zv<;Z&w7_jlLrpFQ8^pIk?jA+KLHq}K8E)BE;#Cs&h(bdja(8WHPNyp1US_RL4(h;#i%X7j_dkxtESBBH2_ds9mBqk!cqgOsSQ6`~*~ znhn^n9MPsC3Ui`E0UMViIzvRf(`DK$#oqy>`_4s6)BByM>T{~sM8)+wS!PqJX>CxI za;lF4@)T806~+-5uO2@SDWS(7n;sS7E@S%3(Gz7E4cK~8r&mZhS{DI*Q1l_Zy`@;0 zMh6+0RML==DJUaTw$VaHCZ#l{WD3g2lyUT6WYbHr)WVB9K2?QfbjmuK$mpaPR=PZ$ z!ZJE#K3f!npH#!jn5R>irwjZdgqxzq>*roN|Mdd%xU^ER6GK>fL$~VQwS@l!odxb& zUR}C%KH8ERYQ6m$nAu*zFi}jOJo=@5axOv={`vg?V^KKp>Ha6pGQSn zduplsE4Xu4_wd|R`d2M=e@7TX-jECBTeu55KGeX256lYL{%ZH`X<0v(kK1buVl-Ez zn~6mE4pKRV@I7AODGmlf&eR8{G--g(X1!xVM>dPDNBqds70TO&41?rJX+d9^*+TPx z_*OH>e_VUBR3>5ZL^YCnj>#b0Jq_5N7_O zW8PHC1y_ zvC(ulg;&OdN+}VnybpDGS&H zkCwY9G^XaTF*S!C#vIOSOwD0qY7QGSbI5a}dJm#O+jKIE{q05WF5!AqEBt<56SWMm zHR0A*nzoLZ-erJn=?#wRxj}POj8m%mF zoOSpbvzO~r#dNSfn`oWinavbVf`<(p<@)Jo`eS<=s`%k*>G1qVihQL8IXy#8 zo1K-aiY%oZtU-2V$enAD9AO?x)2=J9Ww_iL#9op$9wLfAl&!Uj718beAJQ#c3Ej_S zuNG~euYG(DW6~FobZ6;O=`N+Us$6f8uGC+f2bs0LqrJ`B;Snx68XkOaeTCen;8;0a zRHtOy^*PIq`26+ToU$>91MEWDSWiV{#H#4Z>yhx)Uwq*lMA-?tk?)ayd}|KgAn>jn z{Jy|PbMQuiFX!M71iq7lHwm1!YR36yKwB%&LS|pr@U4Q+woeZjx}PIk%dT)MS9R(V z@pvsF`g_0oPD$5N{H;g%CQH;J!(8T$l>eHd@!wK3hyp#Rj(!qXXK+@WW_B8kIvT-%UVC7ZkRew>?sp0IyBv72&nZ-S<+)$JagWoZCwPk?x|e4QujS<6@R}Fi3X0L{W1!4~So+BL7k@ zYCKvk(iE%HQe?&*1x9Y<-Jv^t3|C3vI|cUzt?jK&+j?2w{{_nGmsVENf{vx`p{C_O zcnN(H^GKp{Gv%I$N!o|neL~ua^(!Y_rJPbvgt{0t(1_fpNhl~q6Y(cMCu+cLVCCLY zR1!j2p^PLa8MO>rpC1-hL#8_<(~u%XZ_X>h1ZesxEUXRTj|UCP(Hx zN<-r3{>k`&MI!0F+#2;DO|&6|EgRf~_#D022w*~EbRz)_3!s`2eH#@o_!_}H{H@~= zZc|3+3r+#iXj}dINGe`^^TII`F%rCM`@mO1;0M=l%Pg5FF&KjeSzyql_#@TRV-az3&_+Yf1Iqi&ehiaVu zVEN08rCoZJCjTHj2lr2bn*r>$)VbT&Vsvxr+yy>m_}n2rA0^>v6MlM^%g1Qx&T%P8 zWUuZ1_Egn80%&EyQpp??m1bq|neq9c;`?`VPbvI*=Q@2&R|pDk)UDPLnE!S^hdh=> z;5J2?rQOg6c5uVqGzsjihI##q8^qTho6c{Z$a+B-si_z3*B5vgJq>11AI9L;Rt2W7 zO{D|b#2?*%XNSC(4R$uYcW&qSn7F)`*n;ef)_d6b`?4Qs8#52|XZfky+>r}qS#3DHs5lTb) zjVG?gq%hiA%4XnEXN#=SHh|OwBRCp@hG^TB6Wk9$;|e)6S}mDY-@o3}dTWu>sPM+L zeRVCD)nqa1R%Z7h15R@*F9EUCA_jj>HL4%m9E{7l;!<3pY@oLzDo;$V$Els|PQ>=+d>$x{?8*0w7>%M;9Q`mfBR=>Bd+x#@|R~`B| zH2Mo8HP!)pb;UXqyCSZPaprVZ#5WD;i!9a7W^HV{UTF!VA4^&4niai9p!j_9X4j{6 zFcvHqZY3SP-%-CnJx#s)4tX3%CKd-yWQ|JQYc@L5fv$l=7)gE>Q#r7&Pl4sS=k&#c zKFONMsXt7vdmcaMz4NN+yF8ZrYVXg!o)Y9M5bM9ixfsn;hxAt%)Ji+NGZoOb>wUw! zGSg+xh(i2EwvFHThOzK#@)4w!+=_hgIDs<#oEBFF9&8KaN2GwYNK+q9?@o(q=qnBH zGB%y7l+KPs=owLn+lHpW2M9ZZ8GgPI#4h;UuKWyOlruKv${g(@R}sjh^6bUETe6t} z45QgKYCS{3g^`?++m>WfJEC(f_Yem=vKz@H-$o4Ck*mxNlPk?_OTK095+Cfgg8}wK zklUSTT05z?yOr*RSLHXd47F`4Vf4YOp{b_7G$d&FWBk;p{MxF@72;J6kK54T@a|)2 zzav_IQL926Q=k4M#uv~I?o;3%2<6j>@9L>Lro-(3Nw4L(-o9)9jpY2Dmoqs&jru?} zs!-Ls6~9u;M0s6|1-wr@9!z;Km?~mZFX*;m6k}bzWPPZb zpi$(NIgRnCV%So`D)H=Ib~HSrhsFO{+J{-F{l{{FbJ} zB(1-$oll4RCCI}o6D0lttW#F~U1|EcnDJi-wMt%-MZ3v;?t!%!U6ej|$6Aba{TtO_ zOfkF;gD{V*R2WWBWWrckh6SGODEwCC@Mu~NCz9Kml0)~xEO?iC?!DHBTc7Tm*q&4s z$EV&+ZZCWThmNPxD3rJEuHD4#Ey{7^Gt2Q72<0QWp{z{o3`=WYncO_4+~`bDIy#a# zeYGR^S+bstixgm^ij@o3BZj|U0mF{y(`wnq!%}^G3{h*}{q0Mte5`RlI>tuqL(Jq{1eJ~Wy18L;p1H;3Yv#5kUp04$Cv!V` zTOr8pr-aRpzJyMHr*eDB$}LEi5MCP6?;wwe(eQtzO8$3pl_Ysk^l@O{AT}=z3GadR zYWjiUy+GF(mg_T3^o%GZ9qcM0UKp2SOg*=BR6T|rt24FizE@?ZkXm*%LQqUkXM|Sn zt$n-c`p}(FMrD7r5FNk|21#~%eRT1F*RP%TI~%^z?>XkSC1;tt#G~ELUY~+$&iCn@ z+=HISfhwc#q&&WBZkSwWZZWyu+_vOebC-BBw~OZ~$Q_iHQN5jae@JEYf|XI2j1XQb zCiKh{m4GNWX#+>7<-VvqYrvWY=Y}GMYwg+JsAMU6IeWHNe;!t2&vr%1-hML?e_B~W z@#l!z;fz!g{duK?zo-(HhLj~=m5lvgRvPQAYAnVz{%qL8Uhki#Q%>%Nk;?8~bHn5w zbBoDu%xz14ZSE3J=63UX7vy;HF+IPkKKT*P)6T@+YH@<(C+3F9kIijMeq`ue?dU&>7X!pe@?mGo4+QhJ-5nDP{vr{4Ld>3b~GsYwDZ=P8rZmlsi}8WG=JnTWlaj6On*jQ?7hjJ=!|H0nl21>?bw&{5%3H+7fq zxybvJNFR(7$(U(6f=FqbcZE6IW-=8ESAc&; zGO;^idR#{Gd5sd#8m)mMk}nHCWWS@OI*2QaU>hCJPp{8|!rXqA2YI8<5ajc40=_&C zt9iAa2yQUVLrajYx+xEVnAfP)m@S69nuom$b55-0VKI4lR(S~1Je+B=>X#XI+BgJN z>vC)45Tl3Gib`z=?$Hu{dZUD2FZD3KTKa_W5A^LlD5&p!4xKU9HT(8E)FYeufVpAvpt)_y{pK$5!ES$V*96s! z$;9jV8eWfBoFIAB+%S2}+_vOlbC>vFcYx<5XdJH>YIyy@;snVb%?*<$%xy~^H+P8- zb_aT1f;=yFIp|5)uXUHw@5|Xt+CJN4DtW%9K zPcd!}2a4gc!O2Bk7_F$SQJ?S`BhhoZYCeuXP?L0)? zVz*EH_FT>v4QVSRx`|B@n~Q@!b*&YktuOf$_2EUz(ES3bg5xUet_H_pZ-b_uC|_F( z?J9?oExRqRLQj}|1gCYn>efqhIV?pFs8`aaOY~_H(aQl^8=72L9oN2nw?lB%Z$$M~ zRu3ky#K?{!(I_M6fgLc%o$KEx=s@1E|U-G@%t()q2N`s98&tn%Hf zT=QA%0|u9p2hA-f51HGTJZx@L@`$<3$)o1BB#)Wfko+DO*+RQW(`5VqKD}V#gyeBc ze`4|nb0=v>rZSOLoa6}!gzZsw;Exyrd* zVkq*gOXZ?#~2w*!5)T7o)!BsC_df8vniLTgv`=c8vt;d0S9*U+T}k zpBiCIko4G`B1pJX#O4QUm|IMoxoyen<}UGM?&H3{668)Mx?d~OH#2{MXQd|{$4n#K zUnAiTBF4ac4=`%!)u`oj#B_Z3&rXg5&48ioxi3j+o zRb5?Zc`Lg2eAdj)>3ge}YVy`;vIj|*xnZ)3xy59?DcMN$LqtepK_DMTgR(37qLkE4bx@9F&i^4j@7l~{XbY_Jt(>{*z$9x?^o zPjXPjuLa1~4S@SQa#BIwMD^QExyu>UCe3v_l=t?zU?_nuq_6wczo!rN|ZODC59{ za)+ay`9&JIkMevaqUn+pyB>vpx>RUmZT>Z-!2*NkP}cB*!3ia+chMVYhY?C(o*-Ta z)n(se^pwi+9>CTlqYB>+#RrW6qrWI}B%|e*?bZ$AFZ^FI=nd?G)=YwqQaQgMCA(ly zX$E#MJfmtUl^qKtrRZe~y0k`uGUr?WW>~$eoJA1!HL%tvtKPFQSa@Ca$#->wLB!0n zscZki)q>$kR=V~y;VCQ*R+gdpo)KZ)Vd!2DlQZUOA*jji$OZ%NcS6zpWPNYY{A8ir zr?o6@FDbO`Sg4;twdPci255cN!>8XtU>!caRc_7UQzlz@!%502f58CV^f_Rk411sCVQ;U4LZP|25K0GH)A>7eZ>U~wV0Aw% zMqeR9^i}F)?5rh7O2<@RIzKO-3p8_?R+WTt=F69uHDc*mzqBRkYe;TVjB>h zhtI>MA&WuhP>Q||w*OFHST*QPDZFM+U0!y?kQ0@*K=ILZg?>3Ubzs;#h#tTk1hgX{c~8@RZ8M79jjwpcz^LVc>1GW$tam-%>IEK z{}9s$)xbg->_m&h1s0H0CL%)eKEB$r{--bNi%B*4uoYd9e8k)^+1T7-@=sY-x7aQZPYHNZ(oNq|GJ@m_AYa2fy0+0Lwn_$ z{L%ogz$r!F;`g|RRVd%a*BlR%5G!U^0{9ZzfCcClzijTV0{cXR^yk-}=M>i7HS2GD z+j*;|?QCJ{36d?%4U=umEhgKVTc2!YF8bWsJZ;J5<}UH^+!0=%f_&RiU+@#sew#Gd zbHhBiXP6GCU(=k{#^1;K!j3N^8y;`>tybA*!8UP& zENU7{-_$mbCDz+&WyiRPx%wC`dg^T~=7x;#oDC^ci*h~}s&9r`2c}p946Hp=7@C#( zteJ-1e|A1ety5+8_5WKN<@G-RE6b-)xdu0N;PtkXp}yOh2|!lg_3imP=+0eDhN5fu zX(~I`!2NYO#y>8w?BcstVzW;k$n6#Kki!MSH7bkd$Fxl zxt9WI4p^`^>i>$iY#Hv`xHwRXTR+U?E?%bJuF7{MZC7Q1G||-R<*u`{A|^M3wbJ19 z8u3{XXm896N}oGh(KmKR#>TAMPkdr`9YUrPg+I{gr{`q3@2;uuqLl=Gw;JVobwjrH zE1l?GaCbeS!#h$hZEt7?Jfo#8WO~1+Xd?=7M^bx-cN$BxrD$$28ilw|L1Q+9)`grd<^Y?nt8s6^zEyYtSN&xZ|Hu5H zHwMZDUB$0{m8HFpQBx`>`Pz1^cNqE8QZ&xdTwH&Zo6uKJ7~L$VBf160{g9vDC)e){ zKw7>WO=-M6Tyfjk8_6+MMzE_dA z6RtkTJ)Pr9Ic_w^QIXQPe50GjZOCz3?0H}an-#xy^nUW6UI zWpfdcDo;~w7YCJ}f=o6bZqUxdx&WNR*cA?ypQ#qnbo;gU-k+>5k|F&L?~>V=o$-v8 zwvmnbIn*4}0}R;?H}Lx@>v^&;x*Iylq@<&J1nlGP#fg5y z4<9Xt?mi*g`%WhNyD9s>1+LuB5AE=Ga@wN@L}Gc-nUweQyhINY5Iw|CQ~#t=^e`TJ zCF963eme#5m$9b+{8(m6Va7lH ziSIObdVHU`Q{qR=ZR|}w1r78vJGIwdg+{HhbXB&ag5`#R#iz<+D5S&vo?pK57YB8B0vd`8#{70f{SBDpL@!I_EArOFF=x=gO}WFAYryDn@TnOn{h zSG{Q|{89;WrCS(1!<3+@*t%Q0|@@HWubH zO+8&nT96ec3X&}C?FO|6OD+ML8cr?xqCXz$=5ludA?8nR=q_whD6HMt(EaDIP}sYr z+}#b+xnK6-bH9koNM^lq*=q_mZckF*HBG#pD=VLz(7{gwA-fau#FTm)Ck2J}!sS0K zG!VV8AvdfbLKyuKb@pm4w$awH>c}rQ#t;-8f>3<&<4(ghF&WcKg#(@L7#Y^5h?%0w z?e17mt${lQ;^{1pJwu>-mLH30KQ-!bpMk8UVW8aL^AK=x3!ImBqgPAM=KUkc8JIj0 zHF^$iP5pb*dY@Oy{g1uaK){Rrdl6;rk-a;Kklpua+C@RCg_fLyz@#`P_V-aXE4^0)cIPv3usW z41vCYKlvtTY=PzlvQV3vtre2T1Nog=h)#v9bAD}0DfKPpA_qb_U(QFWBhdw56xtC1;F*mH{=;e_5PD zu;eP@x*^gqvr^>}AG~SZF)1hWJ1t~o+-fn#5$TO%U9jZpF&s@Nf$5}ZGHZc!pd23$ z`^g0gU`dvCDX5%<-=EXbIJzEseYy4}Nd0n#+F_S68P0A?&Q`v{aM=;bx#qiHA?`k; zbbq2yldl=J=ysqvBF%BIqES>R>ZJmJ@`_{P1^>wG_YG;cZ* znG+1Azer@1zHqb$DiM0nAE$i33g0JreC_rURO?vUI86e2fzO>9~%jCWB0xb<}C22o7# zF5jwuQ-!k=uTp~U84P;)%sjeMINx5@M5eOpp2cgz>V|rBr0F<5dkR{DCF0glcI@AC z19*AO5DAc~h7dgekf|)dsvvK=K2`QJRF#b%Q?5~%v6*iRr1@v1t!~;pq^tF; zRp}D-7gXLLw>{lwGRKN9!6-!kH25sR>ui?8XAAyD6+TDszpC(81dnW<(|=X)f-Q3R zT)`(*;jamPt_tfSn|RKaIsMlKCsp`-!RKw2hkrxxzFX%oH$4~P*Q@Y_f}h(a57*at z@$=i}FvVYpr){6ZKNq~`4mr%xxI+AgD*R8u=k1t>zbSbAopM+g8O4Y1oWpMmzNrdx z`mYdo?vjT$7FtH)x?OX)DEPoCJX!D^Rd|x%x2kZv;PrRQ;}=5UFW10zz^~N6Mc`dO zR;8~89@!&@o5kP8f%y<9$O~1YJCXFcJ?J_^yxY=5*4L8R1KMMIT`yY*cwC~%5t>~V-Mxk(IliQEg zWIb4L8Xx3f8I(-vi0Cbn9N1?}V0odBvhRda z_!JL?C8hdFAm%fz-wH5BW~bsvELu+cZi4diahCfEX46SilGaB7}g1&^50s< zi$4yNh{$;t1tq!48-df$gwHailDGr=(e3iq*#1OZJTDagBSI^u(%VPBz?Vu}2fN;sq^4_dH!~cx?xEKOkT5GS zi9R4^A{{Epi}mrm1y=7@rzc}$B&O^ef-Met;#;gua%VpcsmCPBaNtzTaQ#aqI)##dXd9IBsMrRK=}J5 zyq*W(235T7SNtRj9+T~&3*lsYZ}TY53FM=4CcL<+BYB1~aHXD{v#48=!i1b*k@DLkX4FG~ZH2<;hBi2DpQ?gW0C%dKuQ zcy1!IV$d{B`nE=f6qBUr!_3lg%8LLuMG0m(d4LP5jHWRg~rpV=rUasinie7F?@AtaS&J*KhE+zK9ocg4|WI!t?JkDj2 zgjQrx$<6Sh6I>@(gEaGi2r`6uK!h2>JRpi0!aN}AGlY4(9oD&m$&?Y3!i%Zo$@^$p z=L%?~xM6}#z%3?R5RF@(1m+?*?E*ww@}3ba@$uY=6c5L=1o^$@eJBr#Q=?vLIjcj_ zOR7!1978^yuaQFX<`q>v_E3_Th-u}RllvJBiuloi&nn@$E zx#yeT=mKDWvV}K0Q%mzs7BOliVn5^SDs9vzUY;^)$IrdE?MZ_ewkKsdyeFwlgsxdt zOnWjz$TdZ6`Sr9dm(fe9Jt^T#szcJ(m7uJH>wsgkzNh<#Dz>3oV8iuKorL(0KuWBX zWOsy!MN31++*u8s^Ctw;-ScW(l!K084@n$rZi}<|tt-sf+^?IQ?WV)f@p*N>8{&tK z4MDoV`BW!}$Hsws)AEuUrd7FOa|R@Rds4}KW(UIQ{dJult8$RtV)=H8+ntC_juoQP z!0NLPDb1Z73`t9a9YLvMp?gbgOWx@)^;w@>Dr`gisa1QB8`bD;6tZXl^UADs&5kp) z@6^*C+6@+$HTyNO*&ppJ+v-+yF2rsXNlF%G;ttZVX9?bp$t*+5p9szyynW-Z4& zASP!B^B|M*b{g)PT0e5#L~eI)kjfwjwB+`NT&LLTsMMwYO~OU5BOZb_l1D=ghJK-| zEwqI$7WFHCgVYC3jz=+a@w|f=r8L&r{R{eg)dKlwSo8~)NK+lLmvNVH2M4I{w+<#VHDt#M@6r(3l z=-j%#V)REm-8`mNn8y_z256?f7D2w41BXGv`dU~-Nu_H>SCj6EwB>fb$9sa|Aa4bT zyS!S=&pR*(A7!N6)Ys*WcdoXrY~?pc_dec~pb!A(LJvNJrmK@GLP4(KwX zgm%NfeJvk!#0x$_sehUu_d*Q|eR^WDM^rct`|TtnHWhExbW-v4o*OUN6xvkpc|Uu=nUy7F=b; zW>u~l!U4Jx^O>>On*2wDO6(H8Ca{aCnxeVD&HWpdqqXp~WY_HL4s>R3tDnXdNIrVD(*rqhqhG2i;WI z`hCA1B%Ic@m`N7e&6d!?mj-xgTJECt>7Qi#SYDb3w_a{Qn2+1X;rDfMF^ZuZ6JVv* zCXMDDUf))s#$r~sq5F`cdmF6rVh3psx2P&!M|vSk`0I)9ocP(pIM-n{sIg?VXIe3? zeA3P$>z0MS_zHk#BPjc>!>C$}sKE}g_06qZ57QB`CrPvW2jc3_>&Q$b@5!5?jn*e+ z_S0%gkQz8mdHD$?VHPi?+yKh4WUXV!v`$+pe90$O@a^Ep!|RS&CGG2K5?sm%w~iW+ zq87k;DKDRa>P%4^3gxM$r>KppsIC+xW1mvZNKqfoQSMkBGFo1yBaZlgFH=}}o%Y&imbzsexuER182Wh*fXNdg)x8o?CF&)fTAsP)a=&Tt(C2W+d9X^Cm+f5Wt$xC zUXP7|?ho1ze|xmO`Av!)a&)v~j?F|7MSHYUj&EqG- z`lXk%`&1KYM!dU^B;l8CJ2uiP@oF=;w9seAhQQUB(E&&}+&w0DTmV)-ef|kmEKzrb zZ`c1){#GukmuAiwX%>8zW|*pD@Py$!5Y)&17lrzFDw;i3sK={9b!_q*4=h9+mOVPH za7NozMA2@Tj|JZ$d^l$?v9!wnk|O_oMJY!T>c3N4d=acVHn%q@133=O9|+g~_qq5t zWoBc5M!PQu`3u9VC{qXKZ8)S)sNy<~ob|s{DvN1}+@w0ypWTelR>Lg%bMIAi(B)fs z{rCo+HslqwVQcv1@kKe)x9!I9&HCeHb7I3V>sEf=!2FLH7AMrQ8J0q9yg{GcsC7I0 z8=g5*H4}F^MBa;?)bQh>)-2pckixNvhk|yN^+4fNDR_S zZWP;u-g`4((@X~&@HKbAfTg<@5IUGnf(gxZ2rYC%=q(AoLqN17KLR0yG|De=-uHXX zy}NfMLGpX=_ul9I@!OAdXXebznKLtI+L@U%2LM<+kUnIX(8sR!VKIe14t)+{oP!yM z14ZbQsP{qbqS1}u1<^%-i{8Dx5j8hzkAa}t!A&wbhI>Aga6T!M- zHU(>o*{{J&pg8F=hatM+TmZVpE6(}E*(Gu8pdcpR(G)WgOc65~OcoRJ!KrFV2Gi8y z2GDjb62mpc>{m>tq{-4{4wqylFZ(0i39)qBB@*tyis=NaikS#j6Ehi15)u*DPiU$e>|h$*M!{`;!H>y)<1VB+|DG$@0* zbG=2((F|MxhW#kmYf~EH8;0-!@QO?dT-IHeo;efY(i&jw5mA7n8H#vD&%mqA(7#MP z4T;irNC{7lCraBg$>wtSGQtKtKVC@NIMoJr!s{A%Eq$wzL-ni%G}{x+X~P3_G`KTQ zN4ZG=BShpYTB^*)dGJN%LtFszj$v)q z%*6R{tc=NAH6E@nLM0F2Gxq>A<-c+fp2sT(=JCFn8_+|EnNpRMun%9KpUL-ipulWL z5^x(#mBz8gxsu-GP1oTs2aVG*DM93_ByD* zVfh%gCiLuMeRm-yD?8w$mnLz(6Q$X+o+2=P2o^9hSav15W#G$_&7ieU4sKnQYOB1^XP6BY;={m=XcR0>IP=AQk|o zMF6n?Fg*f@1%S08fLI`Ez?{YP7oj}D$08!o_bZ@ick=D>+-)YXVD2`H1{My`WAhr& z1nbhxDKP+-5HN$OAytN_$q0~P=Nyre$j5AkfOzpG51EGAIaVk529C7`%hha*0Qu>y z{)M0@<6Da$;q>R=TjxKE?`Yham~s?-uEV$1Py6&a4&TvoJ-YZZqO)Tzo`90Z)sz!y zh?jSgLcR~foQw}UXaC?WtwsKC5#Rp`AMX^vIV2YWcob4-e<#?yQx&?r3|$d}ZhdqV z`7{l-2LTc<1RNZN@K1s*#O8XZOK|TDjdkkKSeF8TdpRgWZ#gsN)R)3sXs9#%IkO0Y#U6?^rgo*8Ye%!*3KsRWa8%VNB0!wX~Ho> zie?Q0CgYQeN_s9K`}1=QJ`t3CV-@8?vyzCXUrsPe_XSBobCRwO>Ax5AtEu)2qsNWG zI&`?0J87SZag0|`8&Uw{5EPu!m1a|2(U`Px$Ed?1_Zs9zpgaCNIArM^F8lI1x; zxGKQ)60^NlmR>Z_i{pHDPSzg#BaJTBtKzt3I1UU$8@lTIli|Kdf7O(CHi`iHYnH+2 zOnc|R7(IwvDbWuHdU~q%SH{GNql7%~~{5x3mjw`8o$W z4O9Mu<%G)_$MXzzX&Ky7e&)C+=jG*2Lt+M1@`Cea!Gj(&B?6uy1thDS#-FeA-o^4__~v-cs|Tqiu_!r&m~l=Z0ZgEH@YI!C+S1u)IYn4q9V(PMOR zN7QadjkgUAtY$7GAzP7!!uK(5vpQeXCT?51Sa&$1q`60fXXR+m24qKBZ|{hLE1*sw z@3;uq0QQQRW4*iGWt z!5lH2V0SSS!5(5JgSlch1+&HM*Wl(<#Z6ZzDWHsnboVN5k+Gm53EjJh=>$88nFw|k zGZ~=dgl@DC(yhVGX^NXJm9^}vO(ti~#2&J@oFCC0wx`UkWXQI?jk)s$qS>yvcSpXS z3|eg5*Leu_r1y0aJ+90yx)M2D;yn*Tx?bXSa?@OU*?b4U=Nb5YaK#b=5_77;C0h2u zEY+Pmr#8_%r)96!J!MW;SK179HyU@|96TPpAJqMx*WlutpL1SA3T89RbUK@?$-2!4 zUT_&~`8lw+%xgU$n`%99KLIrZlxkaLUh@Ij^!O0g0$93j!+956mQA+Kp}3%B4(BYX zX_uz(!cD$+3tZqjMAEAX)5}OYHL-MRB%Mq=os6VItiYG-UR^NMO3d0=%v#1|sAhyp z=d#Hn>L!D;z0&M+C?5lM;qgZThE>Eg4QKXb7}g2zJ)m2~nt@lhTKCCd{+9FKL4n)8 zeLT95hX5|#gJ*k|GlQn~ujXx<}XK=Zvn= z@YCK(&Ab$Bm`fKQ1g$JAb}{dB3Rl2{&HNB80lCTHxty(S^eKvR`si#jn|h^r&pB<~ zyLNY#J?6zcChyvvjY35McFm^pbGZ5rQ@^DWq;37OXL{Nvji4f7>R5c3M*6}z8C~{N!gp z_faoPq&Hh!aXOP7XRPhW0g4RTPMup*q-L%a(o$Sx`w#e>y%6is+QiwjaLW`gE4!)U zHK1)}L%=G+G2Cluq?gS{(7l4|=+HHsY2ktO>jB_-NV|_V+;77-Z*C-%^NJ%t@ARs= zX={^|qAKXS2|*)A$Pgh-LI;itMx^9ZeK#ZUviT{A1ajmsgU}SKzH;5|cYxL%=WvIB zjc)uDv^ zG8xJRC%=qKw5hp?X|&@GFIx*X(lE?J>~tSUiE~mkS8lWR=~rID!ol26%0Vaj`%swc zppG5ycp%Aik9WP}U;)=^O{Anj`h@USxkmNM0tmagQ6)vJ z_4@2G=t3=xsdj$!U_DmMqa!+%xiF2#PSQ_-Dc_YQMw%m)(vD{L*>O zK3zLFp*^|J?1Zz;n8ZG_d5TJ*iicR#}1B)6cJ^Ma<7 z6Ox)uUASOQZ8XM5P;{T~rkt>pTlZQpc?}!K&sdv#YBwo%Fqx7fuy-Nsv~rloMDd#6 z%)egOok%yoUYBm!r|@NZ+&+arr6=rD_$-age7;nQBH4-Zuxg-kjG($0KFGzw>W%Uu z&IW9UvD?PGcA2U{$kCAQ9*aGvv<@3tG%9WY zWfREz$7$)u*+Yf>b%UG3itJ#`S{D6RrhA7h2YE6_HY1EwUt13e$+G#3BpivUR4x3- zRbdc9lwVe$W2&pL3FkmPw`MVTaUv9z;Iwn>e1tJJAV9tZ!l5b@h{FLS-m)ow;co!{ zz4*Ts|4ICBitdi`7yk49D(|SuL<8L+w%j>$wIf=BC_cfcK55wwYtep-k2`l*zg%-{Y zURHdzwI1*>eY1jH+{%X1c9{Pa#-i1hwufzQ`;=oaDQPr6lcFA=FZ>4R7Y2rY`$EEA zR#_f!(cnFV@VF7F=jfs0&^8YP0<|mt*GnMg8P$jNHqW>NQWZ>mBuwOO{4f}F+9bU3 zm|mMxqj{)nEe8GTp*%!_0G+=$(U8ea-Ou(OL2}-w2wmIVk@9{IOP#9+Pm@SHZKu6P z1T_Pk3_psnouM+{SK>#BUGLW@mfX~_*eIbbKR53^#=t7~L?P;&b(}SIyXrpsd!z|{ z5_ZcSQGlzo%y<~|DmiWI3mhVy$APhVBPcBp@#ea}{t>CB*2^qalIH zsxc=Z7o)NGpvf_yuExW_kr90|fQzHNBQ@zV?+F$TLtuqjBXW-d^ura#Luktzk6KQ7 zlv9l!ROb_vZVeDUiHKTIv(}M4q*MXgXhrZD_1O*9OTX5#;QTh9G~Z`!aejLq=wF|_ zE7>Wy<}5BUiie_p!NKS`v9jI{>r`2=In%q+J!{yItET39tD@V&`^ThMl^v%*_5lzL zaRFY7TTEf3wn@{mh+R1favpRfSQv(DwwvsfH|g7O$l8PZIa5I&bbw&(%DRTW5UP^v zPKq=EdpfrP==Y&eaQIs|2Db{HA~STY2sQ7vI;!ll-aiw;Y=7?K7LNK;xg}J5B6in; zFkqd35d(3dJfqzpB$vj zr^ea>@it`H>giv&rf2Y~jyxKg>iQ0ByeJ*Rrq6;ZEj*L6(a5wwK%?&+J_Evt;&KqS zfRwS63|^-X>0*919vO!`QHUtGF&Rg~{5TfZeVZ^p+JiW`1zlVK{sJKjS$9?Iys`JN z8($~sHZ7Rm==fKZ%Tx4-B6uaxTyr*9a4yzsF=R^UFM%)gWu6n(K0vzZ@N}<4_6lh? z3~D#F4%7)ttjt$vPN7*ew|LIV72J zlfm;aab5QX8cy&c3@SH%31;O+0J;%8@hL%8x-ZjfAJD2#6=DV*di61~xfyb4gZnz& zf|9sislug!W$i$@$Dc_$%0Jc>v5! zy-0siTjW99=Uz)^-C$#^GcO+vz=}`bfL`62u(6hrZ8cldw^cj&q#5ZS$TGoo6>|eJ zQb@Vb9Ek$ZUXNiw>yR+3Xc(x?!PykIvm7>I@lHxLzFk~%J@A%}0JF*+yu)Ex>25)u zeFxd<7@$w-$ZGE`E8g@m=Yynja?oN+x>iS8Usur%x*)`?1Y|GD@=2losWs8EwqaR2 z<|;u8b2NcALZpC)2LxwsS;jH_Ys+QbbpSi@#MKn&KYf5zK)>%nV19V44CSo)Yo% z;`&^eJy=NZNw?j%7Yy$sQgMp^BlejRKrZk=69!6J4$B%GWzBTmR6dMABpMQ$nezGK zuYn*SD%|!L#AlR!HHF_G08};g)6@J`94o4WINpDdiZIB>43am8vo)U*2E=_bq4sw} z!$osy-YMS}Jc8En3Bm-Q;={A7zZcU9J`*z${6WlQ@VS^cyZJ}4GzDLX*{|^oR0VO9 zhc5GHe1s2~#&(*TM7Quq8cW5}6dW&Rzs56AKg2ZX z(nr2HA7Xy6N1e6HQ^)qp^4>9=uDSXy#19Zn^>~}Vk}@IH2)z|Eq=-LHj%^?Dnp#4&$+|) zY@>W$-uAvi$V~UDsEw~-gAz7ru~~_g^1cDACy}ok9ESk^NyqD|m~YFnV!m8iW?X0W z&a%b;y#*dzgrU0N7XOYoUGXCFe#?ET``P8FMP*o|;e@M`nm(Dpbz{}6Z395I% z`+j`@!IjJuu$0R84u|HJ`@ck(R_}AveGjhZFYm%X{zC9dB;@^*sV%ePA-NEX0F^Mk zB@EFC4;{Ml7U#h)avlsh-FqbE8l(ONrBmsS)o(JDiaU_Yu#fSWz60<2ti`lPW1MOF2U%E^N zp9+qhVsxAs(s5Eq2UbhmlT@(5=|SS4YX}`X$LOe)bnT!{%%)(pnEeVi(6U7wbSWLZ zW(@2DEZ?qarG42m$u=exN|S$jP$P|W2v3S*UmK%8^ps+VSOsx&D-)d9<#2g(EKv~$ z&Qa;~^+Pl(j280v3p&+_exJouOV#ad(+8<9tJaTosh z3*mTgB2_}yuq{5}SojnRG69_m+EtL}6V`6PDQj5as6w{Y-;2>s#Yb+JV@@~&#qPC$ zu5j`)LLhfY!P({`68(wYGaR951u9#fjnQ$!+Zzd#%e+yevW!0kZL?9vwl9y|Sl&3q zENpE1UxK=NSDiV(VJS`yyW`CD=yeJy)%($fjYa?L1_Vn0_6Yu|k zQEU6FB7VKC*ixyq_h*1@zlTsKg4TGS3v?c#c#4IDqAY@Nv)U-o;LR{FVJ3*%V8Zj6kBs`O-sa40(lo`(_(0Ea~Yu>deX z0*D2G1rb0j0303x!~(z(5kM>e92o(`66<&{h{&XKVH7|th~Y&5u>i0r0*D2GqauJ< z0PrJ#SSm+qiiERI(|1mGM>%64zXFXlxG(JQ9~9FG?iVu=JRoK=_^Ftf6a7pqO~Jil z_G>%?6^ZQ3=~7)j6{S5)&#|^gz4B-4+c4}oRCfflKBzvA=>w694{QQysBJ4CFzH8V z!~Xtd5Z3R=>Qzxz#S)b#AL5h+gOqBy08Fz!K+v}$iX|4HxjF)fWl!6*Af()7!vQuN z9mPFKshw-0aAHBkYa@VI0Jts!hy{S_BY;?@+5I;FV8){rQMZ0^0xSVRn5wJSL_p+3 zi8|ZhJZm1VoW>{tmK%wsJ;Jgou@FQo;x(y^MVzY<%l_3^K-^7?LZ%lB05?Yfu>kPn z2p|>|WiM5AIBiq9+NQDsZi)QG0{^Kof6#d={LShSogJi;Akrybon<=3xd!RvHRo7v zk;-jRDq;cP_6Q&r0PctYVgcYM5kM>e+!+DH0>E7nKr8^<9Rb7wz&#N_EIZikUppAh zYV7uJV2TK73%mUfgyHncmSiqGV=nyef!Ft7KL&x*Ht;AMC{p)Yn`d{nOxK9qmQvTY z_Q`pCYkIS((!EG7n^>;r_PQqkymb1Qls_LlAHr(b@BRkN*eORB(lP;=cDp`C!$Xv8 z+uX;QBWYu=V*+H(Jk(Q{MoP(aTMeYXK#Q$<-QZ9RZ|7o@9*&JXU&~)x``L$c=R4;g z1uFP<+3{jF`zMIm;-4;NtAC!D+Wh}l--->;U8|EOAO{hzC) z&VNZQqy4wkGRFTvEvxvyQ_EQY3$*Ma{?=+4@9(UZ3I1HQO!W6xOPfERmI2ln<|mHzwHBAklm$R>2NhogHn3GIX60p_4|0c8&;LGX|}sHib~(n0RW_M})3N=x@ng z@vxi5@K)&EybP7|qcQdo{%;ETr!0PW3MFOR(6F-r5k&-AH0%r>ir|M=!yk^|M^wWf zjo?RC!yky?3#;Kjjo@B2{AUq-Q8oOr2!0gdYl6gL7wLR3g8PJb6J8+vkqBO_#`Czq zSGqe9+{56#4E_YbT>DWL$#yyy?X;M~6eKgaI$o#T6`}p3z*;G<96+9#D-VeT74TdPIOdH5-t02u>ip0?po-0Hg+E%I`R%fbV!2f^d^H4supF@ds9LO z%e(AgA(tI2*|LMhS$41t%MKP?*}>ea1GGF1hY%+g0G^2eVtFc2$lK-s5Xk3>wG5o% z?IhSX`wamHeG?N*JZ zYrQd6O3bm4JF-e&m zgTS#ja8SSF>oNsQ1aH7B{Tw-U`)KuM02wBOuhBje_MRT`^=83d`US#G%P3$y38=Bm z_uvQ^$L-^{XS)9d+ChkNeR%3cx~$otY)_gEVK+{BU1w3MehSL8c5oJMe3W35ZGo|V z%Zb>?HnI%l1}#)O39Xe>D>1Do@0Rrgt9FGoYch&r_u@uKYJjYC`7&HgPj6i>{myc*Yx$w$oDTJ0PU=Qi>POQFVm zjzZwcyqw5FdEA3*-qPks*}nj#B5$twpV5YCPv&S2_h61il-Sj3inp^F;r3bSIb>R! zb#Lie+P5J6_h?eCxd=&hnRA$+Yc3YYGIjibj^dUGjmF0H?S`OZAM)Y>sEUm0Z8UEn z{X!Qv5wI^Woxm?c2ZBa~{pWP}=E zrqOZQHwJ9#N>r?)^OzK(`S$>Y;MmnUZQkb^em1-+g z4mi|xZc6gQwlhmgt9GDpH@W<&|Kz2ICD7TZ7T6!PwVL0Dhbn%<6MNiCkuIthoRw zp?3I~AlzUYgkc}YUoK}Qca-r?#dVc_^?6ni`p<-gqdC@os3SdzuybR^G0TCH(rt4Y zEt#ZaE`??1e3xUGuiBJDRVV^GlT739r_plX@oJWQHU|R zjG-YhxXz%JPWeyb$zd%Ha}^?aop{b3n&C(mG|)j8LB{(F;HjFVSpgHL_BaX9d~IUY zY-_b23?AQsa!g#j%@}st#SS1rn{}-NkSCQ>@j^!?*;W(H$wz%(=HvIU~rm;XuXsY!z$L&5m*NQ=JcUawF({wV* zCg<$|6ue!0P%6E=>_^o-q2K5lTsF_o#UW!}I-iTfo>+JJEr<-&4a@Zy4ew!Kt(MHg zJDbc+9&}o9P*C!SQeh@@Q}pCM9uA&%G4xa@ba>WR1>P93L$i*OX5JycejlYe@B-Po zwIs$ga~(jA_b$F&k>kDpf+LcRU{>-X@p85(mdHc;(nC?E{6+Kjq3;#HhN!ASx%eO^ zNx|!M_wnmJ1UF`KrB~nxULw5oDy=W$15xT6WK6-uxwHyc(wu?x(&z^qZ($4g+wty# z;dpz?cRzg1mr(x<#oa`jD(;Ec-d^}H3=HgSZH{8~&%;N>yZ;&>={6xpc0=x z5eCqDnR~pg)8yPn74~6dlTN%em&V_D- z$=|oN-wzNr-hMx%yN_ROzccL8J8%S;ilP0!OY56r9i;UwvA##^+hTp6)?eWhHE@Yn zJPc%MyyARXC0=m>trAar0Eq`$N%tBs<9&enMw>kGjnL$W#QA{j*D?R8aY%5gcsNq? zj=%>k`bZc$SFEJ-xW-wjaY$jRxR7x?jk9QkIOk}be`*|NB~?6%aeR$aEXNtvw=lC& z-y(TV%D8?o+K^-Z4ut4`NCXbYct-4e%f6wR0{&{0e#o&3NcRv)?;n~TGr;r~Grh*T6yD!+JmwLz?PCc` zi)^dX$1xKl_i@Jp_o3|L2EepD@%9xs*6riBsw%5HGI~p=AM41NH*{ntkolz}`w)So zBl`fBmF|Mbqho+R+L1{=OBxO%4JU>)d<}oMkKZcR01d}U?xZuNw?_s74aWn_&NQUq zq$sHpw)EmO93FXe4A5r?4f9FE_d^=Kfxp|wuZgo7Xpmag4xQdw%Z|6Cnue33q)NX= zpjbH^5qWeB&}Rq@3rNE$Ar1ctf47fc6K7q}AT_Tv&|53t@%pN1I5kSD^cw_<(Qsts z(J?@uG7XM3WPA{Y)$xHX`n$&mhA92EI;Dk7Nyi8J==gw5%s4e3!|3=xpQ`bJIERf7 zA6Lg;REbZY?-(E0XSvqnkZ~T)ay|_adD!zGhy{Y!*)zjfS$vH)Y4@>1^7>JxG9)^3 zGRuGYjFG&!QpEa44s%I3(^VNe7rBb7ge}&1#*ZT50q}PW(8pYlfui(Dbr_#vN)m=X z<^~Q^TjCS^9nKV5-02L#7AM*xXMBj(R6G-~y0jbo6Ja!MC*6++>k?rL>Z3=xj}RS6 zr7G?ZP^=j9)3-`X%6+8W+nVdP zby5mi>7EfqEB(Hjl%pe$jsg0Ja(!1&=-BXM3X1m;nhxA9EAJn49rI-%Xt4L}~ufOa(ja@idOD#HWwMj|z=wq|jt;67k`Y zo2T%|u&lYJb?K2fqwAM;}t4NeKf zvvxegoFrlBV{T#5+=@?Nfok&MGKLt!hvx!DKEyi#;6tVjKD6Nod$2xwr27bo`0!8F z=`N|HOCL!$DpDpdMap@e(h=vw^Qs7n6{GMWQ|=?}-uIC!;X{J(CQ%fvgi{sqBIt`e zItJ(y@*z=hj>$2$gi{*v82yZ)b4>aSpJSpw(zDZGVJn<(N}s#++2JJ9?vsv}GtaOk zoh(+eqj!o}g*{G%HJmTZB{KZNPUo-HGzFyTG=%OLppUr?W!KZK$&|jV4qIYaoypQi zXR`UO=XEa238zdM2RPr98RGz_n=)Y>;A~Uoivyf&;yf_!o}Er2JMHGOt)*iHH6}J;%BFozA#LtkRGfnSY0AyFd)tjNA+%Ii)^r+k~%FXV@^AL1^ zk>n2J0P%xHrg*SAUI@6I4Iu%JOhJ-w{s0<#_Hp}01He~?(&^^8`E@$F zw{ZKC0JUYNH@ST&*xKKig&S}Q+|rzp8$Gxd{-+EJa^U7+kS2I%@jn{>HTZ|bkGDJZ zo&iX*1_rF;IEcwMv88byj(wP78>G8kFNdoeA9CVFW&-47ILSooI9lasooS)fG~?@d z=d(T__xKa@Ou2_x0QhqR5DNf*i2z~&4P2Y-L}Ku>OJk8onf|N-%S!h`vh@W(-Z4O* z;)SpVe+7z=J{)`?6^@xi0}s`~%ex4HOgjLi=x!zKQ^1IWfeXEarhB z_!^!N8Wtzg@eMnz1*^=kdTRwpkNlaFSe1Zvxsuk87aRv%5>r>^^{r1kOG%ls6H+wKG0L5rVba z;NZ=l6R`8XWQ7`g;nmF-hHdwb-g>p-4l8@j62&_>75*RkMC`dJKM6o zW2@Ym>EpQE82~jAoZB6u52<_o2t+!Ydsm4&^V8dgM2uZykm$&4J2E>f#oK>l(7JNa z6f!Ql0f@U^0Ac|k7Xicq zKt2M91%T!VAQk{xB7j%`XpI130bpDN5DNg~BY;={m=FQP0>H!wAQk}HB7j%`XpaD5 z0btb#AQk{7MF6n?uv!EV3)^ba!pU~rBLsi?w=_biujeLb+JM^rn&={`&qOx3jkw3{ z7RF>okas)hL+32X@n;%Gji^+CnY=0-Ki|p zYod{Po(4ITv1_Y>*x6d|Ncv`LD5Qc)F7w;bi18smTaV!J5j{2+k2L5^`+K~J^JwQ| zBSqsYK-Fw*smZ>YN3wOAtepL<^NR54(hS)C@gPehOx6e&kWM`XN~ELG-c4c`+sKwss4J&N#Tn3VIYt%vt32Ic< zu)Xss(ZNv7%aM4LNFtcoNTz$#chNg-M0#JgJyJD7DUuHC`Uv{mg2@@bBPzzOE&MHE zw@tFV8&BDH0v(($<&x57hMh(r9Tr|2nCpN1 zXY9KTMdodaYAlH9s#F%WIVHDd}Adh_2$}AKM-V>W97QD;Yq!(>C9u zi%o1r$2c5Jg-cjAlAmDD(>4W(IsqDdhkIkjv(9j6TMZs4lUQw-z-*v4oXy&1SWt5@ z#)XW(+4=uJl0T#<{;j;!LQzf1>*St9*k^4ElRsMyJp>&Xazkq;t+El13GS(gQv3m@ zzpE3BNpfAMfAEFTeW+j!LX&}k(Y3_U8$3-3HL+1nwBdD=k-V7{yw`%92ZyQpm_!sB zN5SY@{2|iDNiS^a!;;A163bnji&jDICS)6gSuSCycK05FxOV3FQA9t5E>!LzUWy>R zL-ivuo!~Mt6T#(TCW9-)#CiBD)shUZQi~g`5KB{VwV3^i$=r*Sa43o{y_pCxv*gQb zX0|v!VC`f1_RsP{(w2=FxVY=tkZu5I9j|ln2zlo!hZig&^qKan4UA6 zW{ufM*OgogY>Kvf4ARMmM?=~!LjNymihN0}qwAfOxg=Vw_HRANY^^4o(kJ3k;)j5k zy1|}Ke`jFuPa>K|GY#WN-C#4G?&Eb1r3`a~5N@S=CWZN97Xr1u=U*&peIJ04ilVzS zFGA+Sd_E5!$2%MOjO0E%iR*ZkM;XWRbmV(jW_l;W7WaX=0oPoEy7Tw=!M~5?1jd?x z9Gf1bs$`_)h4k*a$h9tf(o5vtxP{xGwOd(D?XoO@eIKitXU}-9WfAhRSn5=2h*#hW zP%?@86ym-gHI^A{!2w69atPI|>FCC0pbTpVXRd7Jkp$^id9lFt*u(nwA}9JDLXYF* zc2TJ7vC|F9uPY_;1iboejhSe*kS_8m?{$kzqj)V!L|d=i5yNBTatBQ=aq&D((z*~~ zj}^Kf!MrWJ85#2G}5;x5P!uOwXzDBaWf0q|ORXua=cyX@T2#y6_bX0Jwst0I>it zH3EnQfN2pxECAr%r$!MA0Bc16u|$%Ymn-*OJN&OevUeRywX?%_FR9pbW%~fH^_GQI zm{;nZLKJiLp6^A#yGgVj3#;Qjg>P{#I3ZXF zAo`W)&d_nFOSIVQL1M5jWFG7zXNU0&P${k&pe<# zB35OZRw9TkdchL1hOx^bV9xP!KZ_bc>k`y2NY> z))2E_gBx5%WG76QUfq^?`IjiWCBR+067n4Ib9F&^@{(%;O?hM=myNs)pSgN2MQ+W;FoYjo1 z0hioVh43)bgLg(*i(!b+OKLJ~gb!9VLZqu>%S3CdL$n=Yh$jXN@s;}D65;w|yf;Pa z)efeK=>)iS1U^UvxYz)*DVQu~zXmhVeam{MOIgjgwbk7OzUz?N?cU9>nhR0vl*=t5 z*OTucf3&c$gS-o?OX^i!*@WSBoLjt%jYEP-8+;q#0`ky}~4B&h4Y8Hwm3{JA3NhHR6!J0J7n-A;IQg88x{-3}z4!lBn~5ujerCnA}vZ=CzO% zl6??{jA1h9I^Oee>!6qQF2DwLHZ z+G3f*+5DC6kN=M=pf0ItNZ~`OdKQvO*Hnt0?y%^EX6k*>vKJpI`~QYACoalW6L5`S6t3si+p2CUja#?o$81NK^H+dLa|>V;N#LS?rqF^dPjf4q z*lqk!{gWWdcM+AdvgtUqs+uZPWnj|WjyUXd&{{HuRUFvv03<|^gWBDak4iT`0T9ZZ zXz#Kk{%HSk$R7d*e-!EceAu9icOp(l@oX0FU1B|{V!bW01`?;YbTp!RcOw|igD0$+ zD3=pZF3DqXRm1L?Vw(#Y;U4&By2rTQy|Cc97Viu|!@lp6k^84DEu?knM;_}X{VEU{IQ`9HdS^3oz*TT|f;QN*C zZRGU(kg?+Z_zbW>WbMNHjwiAW-GR+2oX7nbEQFIq(=nHW4ziTqcXQi%^(q=>7$2fL z?JNUSdI%Y07$H5x-%Sh!NYBQ8C~2*Ov`->`+UWYdE0C$enhF2!pdjflT27f1)ygSA zPuy}+=oU9ZJ6{scZMFsu{%lcC7W5-ucJTpZF$ieY-hY)*29o4V&sgbs26n99*!&bh zx<|v~F68?NaRz-X6yPFlyl?S+mdoAjTUz4-54{VDf&3Pp6$U zS0fWB*M!Bz+sTZ7uf%tPZ4o8exU-^g`{;E0al;hn_YimHa)c+!`-oEJ2pkgJJ_&IP zi)OtovY~O(lV!&_$s^2*tcRsK`dF@JCoZRUty9{nnykAjWYI?sx0IG3cx-ny!qBrNbl|$zf!NCY%FaV=D$(2K z8hFGRBp3QH()Cr5M%a_x)7tCqs9mal=Tlg(qR}xdlt)o0wcV3a-ea(EkL+=np48fC zj`&Z|8Pf#vdewz6?@4%%?rwoTw5MRB?pu~76=!Sx!Q*Lo^bBG%3XAemS!oXnT=kaK zTfO1>-nMqOI*--us9xPMW|?&@^v`9B(n@>=*ea)d;rEAc_2W1~T}N+J=2AGO03p#f zmzLKlB`IXqZLpM9+uV#o#SoG(KSxTz013D?k~xhS8#VR8sw*r*H4TNac zMt3xIknwzX(0CeX)S#Zs9kvPy-6&4ze}x7cdhG5*O46U|*m!z54X4~Oui;9;;F+EY z34dSIy`zU$lRpaA>Z#%;(k(BJ&Gv8=)4La0ZvWh|c*0 z8(1b$KGm%%!qJF`)up{_{Yj50ah3N#i&I&UT>?CGWu!ETW8q7ST>mRzzvxwe> z6E8YG^#LzsIf;s_aQY;>j|8Z6@DWzbbdCrK^C0TiJPcf2aQqAoES4)FCtb$ps3?Cr zi}Jou^3{!~{=M*W8|^-3NP`ry=*B%KR<+29ehfO!LjD|;XFY;MGJ{*=&PN6Rmq3z= z?`-H;E(sibIYb6`;{z>uOhkm9u{2yL+SHxFM}e6S7s-Ag9R&ztD~arK1+rVF+5ZC0 zknUk9L)jSi?8jJJw__OMS(>d_p3DcgG$Cgd=^WR^1=oM^%2A8DpdldU^BD694NDK9 zFlz_LLfN6_|6y@kk^HUI8o!P;mS--A`PS7}obRl!2ET#uaY z`fnfv#F4jy7r>94Q?pHQ16pj_zV z{F}f2e#?pK>M^*_MSc=JcsrJy**z+eagNy?4Fr8)gMarm(OrM^pO2!{x}0MUf@dKY zC*hw6C0q&Lv%m#-%WQ2tD4D|JW>gb^9h3^W&tJ>@J<8@Kl(t?6H>AHI@-b1M(yC5G-uU!jP~Xvrpb0{@3z8l=L2@-O=O7OmjC_R=ST? z20Hr4KxbY;t~EG1w8C@? zT!4*?vl}=i$r%GfaNIit$3{2(OB~%B#)+7X2yr6b`qv0VmXx$!1t}MxOpDKeMKZz@ zJ=6Tp5FamJor$U_&52lP4`HPzDy&2wVWnyd<5`#VxBb9gi_om}3@I}uw z-AyR-Ov;~obI3Dw!ZYbc%&wJZYLsV`I4p~P9$}XShTBK1cJXP{Jl1hZi+as2ME>kV zi*m9PoDBxS^Nq-xikPLsdr>)sg3@s$5?2a%IX2_Fw{R3~;W15eZAvLnSsVcJ3we^b zg(o|dCHF&A-6z}@!$n7oBYpS?H-x|nM~eJ&M_|1ObVu`!{g5rrI}Q-j2@Vu95$rE! zGB`-greL0!{TkfhrUd1$bm{y9bDD(Jj&^i0>-<^PIqnSY3xBtdUtGoQ#ThQn8~oEi zq4^~Wa!HKUP~y*3l{nscVZ{7$^DKg5La&jpxOL>n&sRl`;ufDr>6jPrsf|G9MYy22 zt{t0TIN!5rj0S)A+bBs7lVv!$wvmzp3cBydzVy2&DeVQCrGr$iemWwnV}L%wOTs@< zzw0Ex0Fe+{7(nO3d!wE>k5g3)6a2}yBi}E9B*(mruYVrhyvLmBo?=8PL$iM=V8gwm zl6#3Uq}UzT>w?g~3yLi9`0xW{Y3X+#M4CTf{k(Cf!<}(AI&SVwqi* z8|Z6M@=~ZNyZ8b#qGR@Y)|joW+1kIy+iGjnR+s%-ZB?j=x7F6~ZmT?pVD}Msyse&$ zJo%U5BcsQ+G~mC0cwgHpTQtt2bC44a7qEZ8VxhJR*hk%2v2Px;vlOE+`^VtNmhI6F zCC9wCP}jS%|8nwDCc67tf^sHh-@{>9>Ao42F_et6_9#g*uYgpYneGtAIC50ccCh_LRI*4Y2)fc4@O`Q zA$Ax==l^4xp6y@F=dr1r46C5x*ev!#N8cqmfO~x^B$ExhV<}9ZveA(fQ{f z9PAbCy`%-9biVsElwE{~{ofj&Xpz+qKvqbvI{YW1&;)mp=3wgOPXMf=~mvx z{ysxtfB!ymmB_aaLK>Gc4Vmnl|A0qrs(J3_F5tEJ$EKs`3$kJ2OqA7#|Lz{!I83{{ z+cu9OMy7j`ZQd6P&Wb)Sma(>ZN-P-h-=c-{aXpKjM|!eg$jDl=*1Q4#I z@0(ZgX-LS3)TskmCKLwR6S~5otufToUzgSp_PDO*t|(M%7hb!y&Bwq~uv@yuqrs4d zFOUcRLiOg;LcMTZi9$!BbbQoekCPVrVWq{=M@BVhw>lew$ijO5v#17{?dfb)F)XRZ z@KFT=eIg7p7hK0*>pozRsjf!utB(BZN@V(kkrRd5gntNQQm2}b-CrH=HaSfa@ZJg%k(%xgmP+R(g?=G)PJLBL=TAgrLF zr&$>xv@%X;m1v9YJ_eK%ZXLGa3f@3(iq1cn*!A$042T7Q8zO*M0Jt#%hy{R~B7j%` zxH$rdCCU+aBWYa+zW5Qxwcnuxp^lA0l3*!{P#Z|86qR!T%S!j-N;%UfoLe(IRH*6V zcHP(vnsY_BkKX>~_lLc4w89-G=5<44Hbhi4R_L%m#PKGmYKr8?}76HTpz~d1>EC4(a0mK5plMz5HQ4=X^elx3({XX&6MIE)4FA$6c zP%aSEiv<@58pVP^Ap^@<6QKutg&f|OwY3kvy_{o@cHOu=b1i0!?E?T$#&OxodnLV> z$$KRkyb9UU%Y(F#Hq1q*P%8=`Q=->D8~}JYH?1=4i$Gf_f98y;MxJ{zPhvWYE6lkC zW*kTo{hV`=AjHg}KD=80W<)I7m^v=8anaJNLpY(ZQ0wphAiRDFDwp_+HwLSpPc4dJ zkUAVuz)Q}KcL9JyhT`z7-3%+YgO0^Q!30vkIh-Ts6|Nka21k-Ap3S6i#~H?mXT;mA z8l$)u#%S)r+Fmk1>Y$Gl=Wn=K5k0-;^klVrx&ax(r43}dO9AWutPGfCH_1IaM{g)} z*-e;2$Yq6Db}sI7xt&X3C6MTB>`uxATf_(n#~g{X-C~b07yQpK-u5OIm)7ICb}#SMF$Cvv^dYjFCQ zcvLQvwra9gLp!EO4O21}mQV64PGtZ~O16<~vmpzO(l`($lWN?ayMcuJALFY&TlfM>o#SYzGsUsS+iVh&NCu}6OH3}jY&ixbCPf$+Ru$+o-pdlCE#3xfMGOFtx zLBsaj9sw&H4ZAm20c(^2dnsUY8L*E6)-40(Dd3fhuxlwe_E*3@){uPMt--}P!dN^wCg;CQyjrLN%tpzse9Q~z;kV+Nb24e45 z_{{JbNy7?SDgiCDN0G8g|AL`0Hj2e~ioKVMOXf}G7%moz$nlJpSTJ0w8P|}?re^*Q zInJg$9L&fxWM)vlmCbld=&H@u{+sFZ6cPfLldg{^eH4=Jo)2%7<*332+1hJqX~5%C zS_<`b^2lw&==#zAPcH@k+=j$?Mla)kG$f9g=RL@5>r zqbAX%!J0QZ8PO8QJb*O4D=_3{x({@{eNnNsDZxW!F>boKceUO7S9jvof0H!y$4VAgDB z+?nSA;Hv(S>1{T)xE`#9n=?RZ&heyiLWQ1nY2|^n(!v6@c*0d5m&X0Hks3-Bit6H2 zgi__-5h^h}fXv7K2GXHT8E<5{(ph!c-Y-CR#(j~Uo;+1+z!N-j#Ga|keR1JX_&k&@ z;KvPx-=XkhhQgi4B|L9l$MAR9*Ah~jY6nFF3#P4-YKN+mr3Oo+?VJ|>Kw zE3&kdueR$JGH$iY3(In)Fk^~`^1iScSXxo zchXNiiHQW=4Y0sH4hEi|-p#J)Y;V9rPSF6>18>xFibKt@MG2y?0CKeOwvt$jkE%I>-@&N_-h1KQ3k6OF}^AQVRU3?_tnZaD; z6>Ho3bp?)@*a@J}E z!7LAoo+4{TRzE`)K4H0gFmGkKn;a(i85hsHUh@=+a9dki1UW z;kN={PD2{v#?_X8pn`Egt}f-T1+TP#UGMLJj;A~Fk-iX*MbwQBjd}4FmFR$U>oo^;E4cR1hQXyj+jnxu9!^$HXi`*S8wxkbhDw$ z{0E}xz7E&yw=1r5(H90k3~^l&;`o8$P_X%h;-Jf%PZ>~|9&GQD9>IY(B7~j`#dHEZ zI|6r8aK4!R>TQ0hxaf-E;yLP{#PW8s#Ib`@#B_pF#Y_aJiP;o(;v;TMK+GkqeylSyiQ>m$ z`8m=b;c8JCcVlg1U1H`*NO5Q?-WN<{C^RK$k9K{gT{B|ZGRAN<6w@&=BJ5FcS)D6y zhNeSI)I;N+bo5BMNT-UwlWd?49gC|P_6@ie&$2le$J}P#DY+=Sz4Op*s|a>n!oLsn z#sZ6{7F7j9)m>I<&?>Yi{O5;6edbn6+>At^!7 zp6T#UM9}D@`ZK8aj-G61nB*hmQ^Eub<|2YX?zM}!Cztkl#XJU=fMF(=G25cP0`ne; z`4;eD3T-|Cx6Hgscw!j5rz;)j2qGDV^mJssA<@0tw}q@i`Y95V=^GDh3?ZcKC$pN< z1Z~=17kbw)Yhm$(;pILK^|O?I4{YW$dMVwaXmIP@So0c&g(qA^iH_F}dN9kH zP@giZ(wa_J&$1*cJUijp^EPgBrB>!{EiVkiLOvDcQ@YnhFSRp7t%ZEr{}JkQ=^cb@ z4~QV?-Ygcnp#}?CdM&*x3S@S}lE2WVaYqU&Skfx%w6RsvHP@CUCC}x|M?Lnj-wG86 zY#S;L;F^g=uJ6aJ>fZ#qRM0;NTj(kBe;xIs@bF=6Xt$%Y%Ued?+ele^?5pz=?xS+8 z#Gm6qZMfSrJyDo~twU%4cEjgqSM_)Kc|^h@*wj;>untM^pfKC@&-(>}t;Qm$_mA2a z4e0`W8pjv6K%p&B^exlZj#oS@)xV9=c$VA|G>!+=(~uA1l+vtUMpGM&UD#<@;sjEKPKa~bGm-y$SQpyOoDb$G#2rPProdZ! z>U%nT+5bo%MLxorsnR{*310NGSLXQjc0nDly`T%@`t@i#!8J10+QD^VI>Gf~CW33lOa?cI3B^ic_G@tSoQ}zKscwf~gxz0d zY|<{R;aOH1)vc+UR$J^+PPSD8dNyM@fuO5VV_i4lvA=6!Ibk+Bb4M?-W9vh%v6ru) zMsKS*)@F#$U-2K9L3TiA6iDhw2A9*o1nvqklfji@y1`X6aUKE2N_QnEoqu3A@;N@8 zaz=&abDy-K!|*&o`6~U|rI{E)+h1Mz&wsWTupIUNh!~J?MuA9P>Il(^Ah%_UtD?5L zcxaf}fa>Dn7YH#xB&>&|^{!A|nV$w5!poLU&C#joECL*_4kHn#lelt&QjwXuxdk?O zWyEWZPRAQx4)kMqc}-vi$6E(L$D4((*#`&bg7t{7xC2-r*qBz^+=#$vnVU<%E%7aO zGT`?rzQvuuaKZWnn2Uim*o0Qc+XI1>DoL=OUK_zHQOKA-a>H*DIFK`V=7J^@r%Bv2 ziIV09G&z$O3jiz!dJr2;l1h^aBVew0J&0xuDFxKoDC>!^Ed4dXZ6<*(YhY`H_K!Ix za&ANC;bq@#>3pT^+>XvIpNj%-Pv?qaED?f7X2B+*v|0nVz{kYzMcY@vFgJsAbG{DqzX`(7EaA>fX_<4t+ zybb3u!QKQodcC2Mb;`>*=25bYZ8&_6Nftk46+J*u7_d|7v$nIMM>yCQc#_@%;4N&T zW;m?0hrF+)mW0STK~z+;{uIb+=50Qg1Y+r?Jl zF&$TMd#W6X7up5cej$^wK*%F|(j+s91|;53Ka?)|;q?u`N-9a3~)gib6#cTfZn z3jha40I^7)HjuEa``LF2o5`WVjH~=P9mf4&5z&x45C& ztWh=R|R;H(Z^ z5grJA@FIxWd-v$W4i(Nq z?B8Icf5{{N&uaHcDIBR?&Q8Cr4F8L@{avX3zo~sUt#^sd+Tb86AcZtEi*6r-<{|8- zDl)bQbng2n%*KLSF$?6Kh}*<;g4@Mx3T_dzU%k!qI@hJk`~}gvqPgz3&uu&W>UnTA zMTe3i>bIcG@24?(ekSSK!NX!Y!9!v;1rLhZuioYbrH3x1N9OgEu{{{W^@PN+gD1sw zf~Ukx1W$|E6g)0wzXmfeDo(nF;QUz(=SvdD4qg${30@X65xgp9Q}Cjg{Tj@?q&Vq{ z;iPQxA;q~1Ws}cI96NYE#PO`+P_TJfanNOEhqB3<@|h$DgX0*~viA&XJ+zkP15jlw zegdEZ(#FQd;<|F6#VP)k_4rh{W|4Y)4~-{WqfmqsM&bVBeAl5D=de%#dLySiP;pqDQ3TV zn^&|v=qi_K!nz#vU_V^nNFK_29lqo*`BFK56h_&7q|4h5!+n@*3ZKGUR|}gUd6BR? zAgoI3a<1PEbTPQ#2;Dm&Tw$#1Z;2o(rsUFZNUK~BZv&6U%He&fH< znEmQ)Q0kO>(^W19+hQAdOmWHD_V*IU4n7yt2|g1u5&S{Srr=XC`!$$(O>xqtYudr@ zTGJj{DNkB$?{tbhnNzOsM&glWajrN5`L}g1z$uR7wEb|FNTr{8JXR)u6*}$UZ(=&Z zmtr;r*j3|RfO?zPm43RkOt!(Co9TF)vF18C3s(GWgHI^_zp)?uhv2b;l_6ei+YqmU z%^QlBF7p-Jjr2Ff@ucDq-Jo`p_N9)PO~EKJ`xR{7R2+1bb$}*BXL6ZuGj?HPY+;vW z+rl)$ySDd!BtCQf?@h&WX?si&Y;TazjbW9io2Bgap2-=YjlZhBpV)59ky7}wN3#@l z7w!lxBoqoBpdabx3e+QX4DN9O{6Yo1NWjU!r|A@r=lb_3+WUwmrq9Q_7=_=p&^F(& zkLr^!=4Nu4CD1C?a!yLfI`8zyn_=G(`dNncZu6?cSfl@yoxGhr=6dQYML z>^^2e+jVc~*cjxY)st3{z~V6jKwNJ_d<{jj-ck~-dG$oN%vnNDdn``elR{#RLjFrw zr-XU6Mc9owKKtlsrhFFcPC`fTVY_QZkQ6F9kJa4KgeHUIXkdAKyqL*g3C*x7h&4DS z2B4fUSPVd{%{?7!b5QgobAybSPEadmQ;-(3U%ky+%GY!a>4%&`0u!@-d8qB<{IO)=UNZK3c3O|qG#Ez}dhsTy+Ize8{rU0TJxck-H{7P}r z6~o1T@)t2&co<1=ttzGytR`k6m?UOX&?aWT1~cy{PP!Cl)pV;*i?mGhFJooeD|qYx zuL20olf`Tbdc^EkZ-Y}*?Az%YQl`(waIGzIpa)q@CsURs5t2w zg7di;&W$CG9c(J56Ko=8BG^pKreGs6`!$$(PjS)}!^wW}dBrL78$4SgWxGL$<9muj z!RCF%LDzrZ{03z|()d%Jqx7?iswyq0ZU-;K%4EBc{vE`0g6+j@3bqxqU%kx-nh&~S zWkH^OF^1~^iDL%`is=LgiP;qFFJ`}bn-3KiT|;oa6vMT*#Ib{Y#Dp3PF`EKtS0?|f zxA{nM(N)Hku&B3zzwhX4p==Lj;{6bvcV+bHkkKdZB|{KLst*4P3=V$F%i%0b=J!2F zgY!ga!~-&w=Rl$yO&XyP0uLT0?gtw`DH^&!}-eyEeI^Ncp zVhtmC6$Ft!JZ)`ME|&_?}y>of)2JUN%2Jr3No&O-72{6SFwioj?0XoCWI0wN1Xv zJDRuYaTQ>ZNJen9Ie~LvA3`$K3B0(4kmKjCNlD)Ec0x$CC%kpZEwf{Q znFQ<-1B@qNhZtZj0_Kzf&^SxJ_Vz4865hrPazF)Ox)@^bGC;Cr{scE3&qP1(SeJsn z*VxBsWtEq|#T-!K60KArMT=f50N7+y2zwQ84E7JaSAoo%48O=rP;kDa0{SVCvw73# zpYzs^1>>6A`;-{Ir_hNcbpzOOL1_Z)&>J!ihR~T5T_$OsMbY#rQ}v%mc|&>dcr5G- zxGyNAmOZ?+0q*R^8$$vgLe-xjr^KC>N|aBCYt#t1=<(gS{sLUJj$6pNIX%+YmN9tS zBjc@#Np1J2MsG7@%1IS+sa#5qJhnAf`)>h%u#C)kN@N)P!hTKOG2j+l4^+uYuS7`S zWq72kfa~fpn72Mc6*e0R@lHk==BJ~@lw*6n3~4u`y~Lr6FQKWbvpoNLJ=TBw(ofq# zQA{T|TFj>4C^7rh+u+t2=U;Sb|1Fy*Qqr=6@;M07H6Z7aZz%rj(Jus0wlCwuX<|CT z>0%}V=;8*vDL6&Uehp@RtLe~Ho|`7E0pNU-{2W%Ubh`hGw)X(DtE&3{Z_e#^CJB>d zX3}6nnQ)jAAfZeWI->LR>E*z^6lLxi0w^jVAVp~+U~dTM3pNz7y{L$ySV=?> z1ylr-j^Y3Lu6_2s=gv%qd7tO^&y%@ppSAa1d#|hhmnJqkgTc;J#OmfGU>5^eo07}C1ow|1m)hP7)SYDG)2P3NVf{u+rCqwT zDk-K$@`>cg6|KI8CrN}|h!FC6XeEw_KRQ5MNZvLKEXbxn$w%Pp@# zd_|J?%Us?aI(*XQU0;o{ePH(ZKRFuK4_uwlxF(@-m80R%Aup$?f6-T?-Opz7)VD{a zSBD{R>D7nv4~CV`>JW^$8!m^1jTX@?YBQC2-snC13eNW=e3xD)QCR@=mEsWbH2-T$Dz4{lTNV)94|O=HjYmT8WbyP^i5{JHQ;G`W`~3{A`FBZlwT8&c7*g zQt#@FKQedRpPyN^9t9xtvXkuu)W5Xh_=74*Ze%rJ1)A88KOhVjqXJUpd@-L^&YFw= zIaSWrTA2j#bq2HX^#(iRj~T2xZ`DnemA+EtEn1JI%KK9mCx}07FdK81zv=xa4c47^ z_;*K3UyX8iy7RcBWwz)~SezifIiYcrqv6ouKO7Bxjj~1m#nCWZG!GwGef(lV$u?*IDcf^)JliwxG`Xdg6WO%ttkKr51;Z*c zGr}iW1xT=m$-p23LX9KgSP{~1ku~2ROTSCjXvS=0^cv%xg1rKq+H^d|jLrj$sa&|; zmB!@~DaYa<+*a+sw=-NS;6as{&fR=V(4CwprPzmv%RUW3{A zy9PVsdkof{cleAe1AR60DwkOaE&WS!q)|e62=!s$tqG>lp^V%{OuJj{%Q)5+PVzOp zca?nXvYhG>k5H>F;b+$RZo{Y_BPh>*OXc|iqNx4;xxsAwpux`gX9nxeJN%c+v%VU6 zb~chHQ?%~3I6?e%gW32S20P=s4Az}@_^hL)uTiv~aQ8|KK=`Un_vw&Y`9^e%!FTHCC_;a6<;Csp+&w><@GwcTl+6R@s&br zk%h+;#}cY7LqFq>SX85*YTvGsBKoy-_A)j4WbXa4GJVQmHvYT8&X`Niz}KC3_;1Iz zzFawIUttf)X>V0DQx0Sx`syeD>F8S<^P15K;@1Fc&{>urq$f zVBG}^UvxC})u5Tra01o-We1kJq0+jh5CdH5qxpkhvuW1UDNIRiW?_RYH|E|XYb!^I zM{~-d8HC#qJ}{*(Yimqn!f5J|gqakXgg~RAsAgBw$@bHdjP_|B8oZDoHdNOtmrf2o zXb6VrI~rncb+sY9DWb`Na;GDOE&}fzkD648L!C0*ag9G^IPytG=C+%>x+}=)QT(_a z?_ADfC(3g1HPUoFlzXD|{-ahm^6|$6v+>pTS%|L%a;kP%-vdl|_aSUBEbQ8Voj-{U zz@6RH8K7*mmYNm}i%d3p1Gk$Vb3?w;(;jvqx$Baz@D!-w7V&Jv>BEZACjmu|9${$B zHA;g)XJ0UTrG}~3gBH9Yfj1`b;|aV;a8GU*fi5@h@f%Hns?8~inJQZMS-m;rC7|dm z=qYwEeTqBj5fFZGUUlG4bjmWKH{a&9kyU@*L>phHIJ8vCk#>_RN5M2+sE|i4KMlFo z_9T5hD(u$&vKgJ}dzQLH-9HeofgN*L#`nb)p21J0mL=)7Vv_G19|^fAFLxm-032_{ zsEFIO8AZFVLlw%cbHcc+Ryu}YS@kDeE`xTr9sRt;cXxcbFp%IDovZtBu54bz?c$J!Y-R=Nr^+|0SDGnUx7$5T6>M&T zg8h`@G-}1C^+hp%2H3}ABBGdW>Qp|nn{mxd-7CIArWAhw#TUt@;)|pyzAMj!q?IR{ z{W*N4;h#_77ZUiz1b#`7G-W$@cPqd7Sb;T&QeYL(v>bb|52uh~Mf<->g0X?|Zdp

|_2L*JB=v$8Kws$=U>&MU z`Z>G5UwkEZ#O>zp>Ky2(o-N(8R@I#&Z(L9!51Mio1ZLZXz%sPx{CBef?z6hrcV{+| zlm_Q#BUPipwvn$W<0aMJAlnrlLN;-P?-pE?@|?LvF{3*^9;QuoXQ=9=NoO(-n_O>K z)^4LG3nO0^y)9@`$;-$c&5t=Fw>3ZJj@;h-m}l2AQ3a~6e47=VGI^nM;h6gRc{&j; z&pQKqw9~O%W{|%6Ikj1X1;PgQ3;sY`Auu3P>KdXaO8W_@?|G> zZMk8gx`JS4@^N0_3rus;Nk-gX#RZeS|*6gd(C?s9{svYCEKmg*bxZfUky-DKAcr@8WWdq4NA+3hwtQ?aaX zUOSfrUG#b@bf6&Fshm4%FvxNfTjP=pjTg_8;_`3S+Jer>r_Q!ZF-G2CJ3p(WoQcoXt#PD3iO)5yKGHe0Sa&Ays|oyC0{MzvW%FQqaf6qHO$2lHvi7p8 zDUDRHktsy8DP#u6+QPLyPVXxDBr#jhj6@gHRJp4t2O&31Y(>nXN7(p&;LWMDmHiG`dXWt6%Det%3v-o8>EOU&XJEx=ID&`2J0?j z_>!Bw=*!Kn$jI&}E5%cZ^=^YU!weU>xwHY~bL(`MGJnr=*v zY12Fpq43N=$n5AO**piGhx-cuBd|= z=Ts^5EbQ){6~2%0BnNc9L;j;HY4CLgYw~$DpQw-NsalyMeIaQGTsx2SV_FbR7KR0@ zzwk2X>YH188!4ZAWa2abuZeVKg|8s$(cb5J@2;?$yTVAw5gZ-uv;_YnA3l5)YT;`l z>EkT>+o+_%9prtS&-;R36lq&(-&XFap04e3bMzOTzD!rEI4jYYE`#jZGnk7z4R*#e z4c1+-@O6^FQlYP~Lvv& ztz6~dwTR?=x)){V_D`7?g`ns#60hO; zq!bN;OF}Iva>=d2I0~)}nv>Au9`Fj)XD~abe@eHbbdg)Ba)Tyrf82zqgY3uFB32hI zN4IoT?XdO-yz1mJQ~FOMWbzm^n2iSv=Hf*LJL5isbr&pL>*S)ZurtwrNAtB5%`GiX z5VNvlGG;vmn2Q%1?2NZCSa-p~HyllUHE8BCUnifhLvuvsI*+@~M3Wbf3{0++jpY;v~8_7+HX~b?@urSX=nA zkKemWK326X!t7a&NHDTtYmD2PG2~+df?4QDK64yA{1+Z-Unhvx&o;$Bx$k*aj+*%m zAJrmt^(FV(THVxgvD>^hxN)xfUHC2xyZAf9uj8D_vU}XH%L-WKtF!WJU0ImEzl9`a zN8in0Hh!DIT>Msp`FMAOo$;;)>n?c6g;r|k^yT#b&g%Y8VHKNAg1yxr;0#=+_B(o& z-s&06ewAO{PRJdHQ8yL>!$6S4TcGu?cv1)z7xGLOtE;GC} zs!2ikCx9&qhaYE*7jvzejdBcL8AMOuUF~^ZJ>F*#*5Gu93LgOP%x#NP7)}6H_h<&5 z8dP5-*Dfm3^FbdZvW^DWwhOFZ5Ai+7Dz%6btgG+J96fRNsDZgj1_m262Z}itOs{)e z?kslSVF|VNkwG{JqHQU^hAmL_QSU^$dGz2Sy^k6GoWuq;P6;4+#Brym(Sqm^x`%8y zC@QHS(bb^)E^w2?V+fe?vk7O|$x9(Vz@={%;5+LK@Xa|%|7NnMkE==qn%zshx4P5n zL*#Ci*tJ^$RGvQN=hsO%$@`4Ize(Pgtup}gzlP4Z*(GzOi(HqHWt;80iRpIUaz5ld z>D1yxrwnQ;8m?HMyl#UMUV?vgJwFVM9F*NmZ#!gi=ymuQOi>O}l!1V~f7!0+ub{Yi z&GH~SJ9bEOzaMuk=EoxStqG!w_>fwO2-jBXD6)HEBOA@N+CfFL5)C3n4*#rhi``%^ z)c7EEd*fEps$9Ia1KT7V=~Ht8`*v-=#>!L3JL?lR_SxI&d=T%Gv;lj$Ho&37DXtCB zS7WT>)?5Nd!{!b9Co~R7Xzb@`ICK~|8v1gxf<+@s$X7(?ZDS|bKW9_)4o>JDYLIId z40gr`8LT_+Fze{*E1_GXnW?N2@xJ>gy!(+?x&?{;hRkNS?90`T+IV>)C4*ztM@vs4 zrEy-)`p*A{b=Ag>$51BRL(Ba@D%BwRBfr+Pa*>JL)#ES5?xbPIz;^6)tbXn#wRh8{ z9@+}oZe2#Hx(dy+_3O%O1JjN7o@gmT3@NeJXaJZeu%ipM3nL0()? zOBc??LJBUv(n2nD&*cl&dua-Gq0MK ztG@GQz zsg#XOG?Z;Vvo&d?=K20Sh-XjC~yZY;NbRm6obIU@~k#B26 z_wua<|4gN-4n^NKD80Ok?Kd&(e&Y?ncGF1*_2&l zRQwCYBiYvt&aQ6qOe**C^mNSa=&G6W^8))GJns-7DbuvJ)5o!P@k|-dt>rKg;5)AV$ae ztHsG?wkOT$DwAhnQFH$r;BVvzVibnuEYxr0H(IC!WeRxCOTtV6g<<(Z%Ifm~a6Qp_ z-e~3Gk9%5Kj;)B;+QPpTe^aPMp-9qUDXnNTJ{sa!RO{n&l|1^MURTF+B)-W(#e>k? z8?N_; zw8wS^G`S{^a%!VbD=ZAB5j5&2-G1E_>;z05P!;GHvY81T>Ke>o$;*(>n>P0-SMrjaC4$JWjQNF^A3v>#9uX- zjlX6v7vE{HGrrwm-31HRb2RnUpqa~DLEbx|S$j!3!*yneV^+8ebDjZq%2+vKjaFY3 z>f8dixvM$X&I{q)xkX`E?&@Xef?IWs)+o{=+MaR?J`FST%U*-g##g*M+5NA8 zZXR-WGSLb5Bh~5;pvt8YBKSuLV!gLXPvhVt$0z@aXZQ7X2cMp*kbVT#vBgJACvDNf zZ?gD*pf(~Zwb_Ew`9G*lawq)$nT@JmZx&@%T;%m8n>m)ecd0xw8@l%3E=0l=aU@q5 zmRqW9i`|9#-F&)MRW*AG5t{FF7l!3K*i}8`DcR5!GhEA}liRT7d@(RApvB0X6m1C? zLA03Ph^aBR#&@XeBDMgGAc_vskS#g7=w$G&QXg0<7pf#-}o*$jMQGqA9!z^O6%3BHz?gM3Io-VR(}`oSKhN+k%7g3`b) z4o1wyol5MAgLkKb@GUq1U1(yc1MGGVVI3-w=)~O2z+0V8P*YFzc`yfvlRUy4AWrrO zbNK9Ao!FneZa`kMjH}M#ftM*-b50(NFD|&2S;ZDJiVLm=F51L>FPh)KL2<#Cg~5j% z)|o|>;sW*pWL9=>o$Idj2VM5gbdWh2+C5`vYlaNF5{loq%%Ic=EG4 z-oTG*j)Ul}kZ_Oxtyi7(9GR4d z9BT_Redp4qhm`aa`uk*-u_ z&jjuH&%d76xv--`p#sdT8&A z4hBJAP_4b#lFLXp)eg)|GNg}egzc=tB@vE`aCll;pdXEY4v;^z!@ z#{V=}cfrCg*YD^nWcNm;?-1Xl#OIJFnw0k_Yi#Bsm*xb@r}16ro9i~J;PGD1hB-i- z>k;MvG3*iM@QhyBNVJYWiN*r?@C&Gt_Dr3pSj3jEpu7b~1XXJ00AT^uPZctAXgyg_ z=%{rkyQ3PaM_z5%f1@ls(}fg{YX6$_GlV<6>m$^P@W z%>)Cfdu3ujISQrfFDah&ll{58w{;&mm(AqAps_cB`MzQ1B$&Bieqfk+31&W+AA_+? zuWgt4?z;!+iCq?PDfcp8S}HTzq37EiMA4p)wMxVUQu%p=7J8(-zbsl~37BJ8A< zV(l$3SdI?mcV;m?0P85KZn}4$4#-^osC!B<$jr>V(mti4c0u>kv>`*bTy@mum<(&! zSS#^=5KVRT2Z5ZkXm(J|zeEeaxpwmyg_*h4 zw~(X@Ftv*-YECXi*c2N#)HoUW3u>HS_)P@D?K6e0>vcm-M`1R9bFL40K(7*Ff2?pT z%^i~2ZT!^kRbUEM8SW_Ig+a2?k?&q1Ghuo071DyaEn1KkSHfrqwgNY9?ae&&Qe%vA zfmcIwc%?=iFZ3Sf0P#MLFb9bDdxSa84Z{B+pRRwM&JEZ8!>#@k{vsdV93;iIGh0lU z?cneSd;oJS=9X*Gkf^9IuCu?@pAOJqr8q4gK8)`)Gw$o_w~FvRMR=%DEiZ*C)$+pv z`S>ycs^v!vVlp>ah_3*uS}L@lf(t6Vpu!3IaEfp9s#z5N#u`hVbpsE$Yl6b{4EHMw zx~nH>+@%#{mjoEb1`fzt1>m}mjri*`)bTV7f7<7K0zRLrNNH- z@N*1;-B=+yU%Tv=u^Ce2-0mm)RNUl~yeLoa0_tB+#oMyGUbdl#&)aO<`OYB(?g+P( z=Oze_lDW*zPY|3PlRR`-O!p()+S^l3a%%$^&0DgWU0ial>o_}*WYYOuNui+%R|(|f zs|AvqEB9{(x<(~SNh`3RLJKOmVB+rwpDN=cThh%A97K6ZF~i^RgWJ^dch3EL;s4;= zf0X+X=l-+Yk2&|BIY4~OBg_HfT8}UXi0eGU93Zau2y=kA z!6VE8;zo}!$JxFnSyz5cQ&1mQFe~RT!v7{}Yd1;ytN+qc1;YwJ)6}b`X$4JI$kW38 zBQN4-R_7ORtSziB-2!!a!OJbsM;UDNXU=swK`j-=1W~!mxxXy;*W{j7h`s^j{o1G-WcX!1+DjY| zP+yk~O5vA4M6>Z)bL`ZdE#~IJFY=iz?3z2-ipjg%2Z)b;vYHOcGORuIA){(D=(9d( zP_DlBRid#ovarVX5v#w{zaRfNbL{2}Ib=gPf$vSFGyN1%g@v6d-Dr93NU|9RIMWQE z`~xb;qwowjP!aa<19nhY?7o!W#lXm7(#GOZYgf$%hSEze?7pmYq;{Ul z-u?@3{o-wr>1RI9NZcT66_@y#vgv@;-T9fHJ(-!QdUHV#sX$$Jn3dZ{qfGnQq2z1} zD}g%mruVj9B!adR2GQM+Uchw%nMLftvJcLCWR|QSMA&yRm+2wrgmrtD5Sd3CHJV**?hskfYwgU}2WAWj=GUr(r?E-PvD0 z(3uUQ-$Esb9_BZEnFuV%CdBlZ%_26-8f8{+o9uA(A+uz=z}*L?EoO}+5L(~nSu)6C zulDxA=ovNDFS#V_Jj|`$=wxq6Yq!D^nSjxnGdMjZw;Qh|`)~)^vpV~d4IkrJB>UnP zCp)t3yx^WebR-D`(dU)SD6dOY2PoFqGv~q2}gVr*dDNYIe*zhZKpUF~d z>L&Cr2^$Ox*omk3HubXfwjL^)jq_zQAE4f$Hg>P^R1{UVjA;ft<935}hYmMFdD%Ck zFL$r;zCjp>F-s~N{jY8iU@YPGObt4^r!xkRxjEA4ZeTDQ_ZaMq=Nqg$?{H&BUteLB zXiZv+94$=Jl{mCGLA;s4Y|Lev(C&;kHCT7v;U&`pe)X~yc7|DiYGFMqHcC>mV^NlS|5OW10`Ra@}ax@$| z3>^)9g&Q_xEgDN44cnW$B%!fYLSwO`;n3k`j)uP6KEBhcgXpGHis(MHA-an-S=&RJ zI-9s!+NVA(mpOyM+*YJlJD&ZF75itbhH7n{x&7x)G6LV143=TBOnP;<4 zbhdns!9opo2e5;GrgP;1UX1zkoROwMWTArYsh9z%-LGXf-e5{H4#{P1qs+FZ%(CGCC7+S)TD|v@cVyo32?rtFmg9Xi zrvOnOV$m{cgmpMMcqjqP2%HXHg*AzE4nKIwjyL!S zM!X_MykcU+t4e+|vI(j37*gegR5|>MNX?yyl*B(H=SXdjnegw_&vdrfNMYHkgg+9k zc@xo6@y*D4TKO@w*n4TT+QMr@YyP@vX`nD=CkmZ^<#J}0#uh>5noM|)w?jUf2}@Jj z<®2@mq__e=?IcJAf|;5Al(H75Nay0DFOp|&rH!<)R))wQjEF6RPOTUoE(l`y5~ zH2cMd&#j%V#;&HuPHC;N37tlboys%5Syy3mg=jZ%nv4GI0M`Eso>p)5jBmEJ-X^4) z^)?T!ysNj|!}>N6!CLG93kDTDt@?@@|bO5bVC`u$VNbX%+6=h0Gd z8SH+LudG?r?ygCu*o*z8V%I!7JuuZ({gbjZG$lJnS8@%2)m;;ptGibC1G_pUh|YzR zh!qLnoU_hgTdov=HeHpK<~$a^Npt@F6u&BdkrIqXM2cky->9#WlMPBns%Vv!rv7|S zibnm1DN-tZkrIrsCRZXX$G&ODW=y#xq{>!TY49-|yIj$<|2RcTg)dTq5!T{Lghkjl z@E??u`f9mqv#Lt7{~=F`2LApODV4rR2}T!-)Fq1FPG8X;V(hKVq-QizQ=|0>0~XV- z%T@c@uAinz?SnUS<-Jw2i<$CznMJPdAD`LyVy_E#W;TAm+X9$^j;PkMwoKs@CU<^b`uN0%Jy&bg#xzO~n!kYOK~&Vv!GO znDr~M2nRJR`;}NEgBr&DN-Sc{=^=+aF!fhrN80R0kJFwnL+(MiM@7cJaDSQv>#y4i z)mJWKN5I>`5A5SU!UNUj+)Slt?_XGoK7oUaf999NGr`Zy6|Eho?^Q1jP&Zz3qpFA2 zR7wN%?{05w^_+Z=P~N{_A8E>)Im%iJ99W;5dY%w*?55VS7hK0)h}5ws#2;)W{*g3s zeT+w(0UpGQ;g3a}rzEYXFS(w+6se~lpZG0l;`$hmc)6nt@pAZ45yuc{U4O-O{gp^v z|Mt3G(kC)^woYIn8vjXSek?ZcK*Q~TwO7L6IBYl*>} zZ6i8z7KAisV_d~bkcL;R|5Ty}73!_TBLwR|mBEJ@yV2D@*z5^S)r%I$X!G>4jUPTP zf+c8|!kgqQml$cW8leH#&43i`Qg{mpqfOuc%M@)Xd#Oo#Y7p9h;#Lu?K)VutQqH#W zjJEJoxB#C9q-a;d&ww!63UIdoSaiTaxxS26tuoDZC4pS{KLUAouh8Ajy_G`UCO5kYzF@Ez9wit|E9IljN<9%8= z;k%OXJ>+MU$s+E@9BUn2l|U$i?!w67yO zINy(iHp;)Tz!sn%5VO*+F<1=DN!#;C>_?JhR1B4VnA*BFv5C)@x0-VL%u-PO=TxpLP~_q%;l-j+ z?#LysO6ipF5~11(4%1QYsC2Y-((q58a z3qtYEm208Wjgs1f+CBXAU6Aml%Y;UFCOa1%f-Ag{d!@nyaJe=r$Z#Ca=6ykU z2hoC2leq9w(VDqMduD&%mWA(CxNLKS+(|6nx$AZP20HFuC|EDi*hI%g1*t7{C+Mpb zUg>Es7)9GrOZu7ew92$L7xpJXlDO|}N0b%cspi6q^-1TmN-(@iDzPelJiTRN(L7~8UHGKencGG9vM zT9YdG2KHizwQG?y2gI+gNgBFHat3k6y;N(pe33*8;sXtYWDMe$m-`SZ3lLvHlrD!GhJfIM_im1v1#6KHRq{)qj(iB;H!2UwMpRhaIZ^xh8(hk+5CMKe0n^dse z2jTeyNn^!A5MDS6D?Wno{iCpAh8s*rVZ~7pUNQ>n8fYm&IyJEpgdb|b2H}VK))g~? z;ifu(&a?IsLxS3iiHOZGbQe;p-Mcsle?=7f=_0Cx0jMO9kIMq#^>|UPh0Ni;zEpXz zg@|o0Sw=d;>70#cig=(jT>j8siv2 zn`?}vXQV3C3(uT#I`d?u*{a$LzR@<`kVgEe(Gr7#;!v<6sDX+(Xe*SPbqygtNouaX zWivzMRcDEU>XX+c8X8o0LlCB$3@488Zap=6o$~2BXp?J8IY3MNYmcM;1);j8UL)st zY^p%7rI!de)kiD2AiRlq&9FYN$2hW?1y9{R@0tah9enVo4-400(&?x~cTve#w4f!{ zanPbZ4*F*eGzn@S#6C%Sj(#>WW!RXGdSJ-0!-*JW)KI+ZDZ1In@@^>hY>8$z(yxVL zgEllpTYI=!%3u%oSDSmdKT9}*P@e6+Jk0@Osz;au#59jE$1_2;`Zf*x)CjruJliZr z*B@r9M{%>P3t{ukY^afz#^qznOvGFZ-z*1Tk~U^fm6^zLOixTUurOhDQp`;ESv3cU z^*q8HAUZt49Af4SuXf2~uc@AH4xO#Oa+hbuCX?ClD`KXV7qx?4(=;P$=C9Y{2cgDD zX{^!>!aG~A;zgq$&Y2~%P}vh)#%KqAidXG!l&|)6e&U(p0%+H{b%FO$;QyN=~iV7I!R7*w6+Dm(p;=q7&RB0;Y-*YG*A*# zL?dUfYtQn&=D=6ETUYb-W0L8+vL-3Ebeoc6qj55Uv5#Cc20u%XWSV8&+J)T8`2YnS z%q^VNpAWU=xOZ^ILXWi_cJBtM?P8`gr|ARL?ebYS2Nwt0ib(hX#QH{D1K`g2@8-fMq-7>MbdsyTXJ|sdar+j83%4ui%mD;g{sqo4ZFCwt{ zS5}?le5_{pY-SPRcOiUtB^PbUWUZ|@nCq(a&nTXCGUGMg6ew}g!8a)aJ3_*NR~h=) z?^gW?l^_;BZfOEkqW7|=ncj1orWAaOhJxp#9i-;D@HfgYO8#r0*Xm?^>dih)m+ze4|h0zjJ!3Tc4&-2i(`hM9y2#F0?zXYY#JiT zkrR*EAaU3`)UIRh-=w8}iEmfGxWubbwKxkGJ|+&RT~7j2wQH`lLVWBBAOA;Nie-3g zYObAL0zFq(|452-eSZKjf*55@S@6(Ui-_saVZ_%zCj=+g<<$ofs(-^fkyp#G-U+NR ztZxdcFP&Ly9THtV$tBa0&TcL9he@QuPwOK-7J|sY$bGcp3wvNLmcS%q2Dn_>&>{=d1>x)BfcOg(U!zrX%&iuGIOTNHn;^3cy?Kl3ef3qSgx^w++C%VQSicK2 zR*k+5(tUSD_o(@z9?%?Lh8z{wf!}m#!|FO7kA?EdOEs zM(k7K+&Vv!zA_W<0=lm<8y3HXl?$-H7=}~xXi*mVq?IL{1tG^eJZmm{0r0Kjeb_Ry z3;u&sT(`-@b_Ma1d`wY3RF&Ms(Cm~vpF9ftP9j)-nnCHQ^*C}kgP;oW{4}}Wja1!IXK(cc60lCa*D96Ejb*8~dOCjLhan%%^ZD$p zo((eF%uR3ghkw)yq{i(|q_62MBvNg0XsJH&%oPBNe;bX(90s=YBU+a<)0_LrW4wJM(Mm-j=?mizJhC#f1!t zQz5GLZ6^VBzQOH%F%mf=VfyK}!Yp!|n|iaBc!IS-Tcx+hdphMZ5(SrwK+=$&yBHQB zt?ll`r$p&fr~F-8Ja=SY)sDF%`wMIktTIS`RnJcY?v8Ga?1yKitF3@Nn76DeVGn6W zH;`ug$liDjbdKx;D1{v?(GQdiH+9X{wU=r3Rw+O;Lb!plE0gXjMM;9{N+C{mLi!OM zSaIz|DRbB{PKIxtWmIYpOH~&@pzqd=$r}F_>=b?i%kU~OQBzB|N?Emlj+06^^T;z{)OMpjJS0_C1|2GA-V^SNuv;+vSKx zPF20 z;+-C04iHCsggHPQ;}PZn@h*=r2M954M9l%>SdTCVh~qrM9DcNc$MN3794U_zyoWgm zd7?*{1H?%lVGa!v!o4IQbL}n{fll^;%+U;l*D2o193W2h2y?WMIn8^SgRqfDm;=P= z9$^j;XLy7;KvX@#93W~QVGa;ydW1PZoaGVb0CBcQm;=N)9$^j;@9_w8fOxM*m;=PQ z9$^j;!yaLdJ%d^w!i$xH(`L!B?!%bF^|z;>+k4OkWoJjdboT?tB%4F4Uq`o-2ivNp zHZ|dUK#?V@wOu>Ve7V`K8Ao@gwOPm$9Tq4ikd9~mSjyY<&T_4j`h+EJ_UsCoEX6)c z<^VC`5$3qfXKO>A&ocVwL*L%@!)A@s47d%dYN5pFd7g+lK&%o1c)s^A2Z#$i!W4B% zZJHC^?Qmn$8_uui%jUXF`&=aBw)OxcY39(1J%BtK!3L)ls>e_Bir>GX3o;1ZW)NOG z{Ba}5y7c-I&#F1#{ZfxG2Z#@QggHQ5<`L$Q-RBl$@m}r6NOb6GzO&Vhr!%TlJ<3)i zoI&_0F`4L#in&qsl2F%KsLv3J+dg?^`}BV72KsE);c7DsI@U^LYfH-2?puk~>gy}C zuX>kzF3e%=ulKsbdzk}{KjIPQ0CA;9m;=OB9$^j;S9^pxKwRSy<^b_gk1&UgQT@6^ z?PFvgd;Oi_{Ugr(HMuWw?z`l^+_}Fk_Xp+fiazX6Ul-~ce(0U{3`XuyO;I9Aoml1| z-SQ2}0$DLgnW-$_0^E~!wsySP@PhbIYR)M_6=%JB-}hV|>;@H#>Ey?fM_ zZbbm+*T*F;;eEto(te|o(imkw=~S zZGAb~+XT`246%aRUnJ8#ZM@}CKO2jBOsGbjAL{Gvi6C55?njn1ByX4JeNuTo)$+m{ z2L`#o%wR4)!(cw<9c;_f#jUc|+U^c$RU@rco!F+tH!Or+5gLM}? zT;|f!*Qhc%C`J3T7AJ^5XD}Oo-XPCa8|3+FgPrkb4Ax!naJi$cuTiuQPSO5~#R=lu z4QAsz4Cdmm8qCLc8tja3Ggx=Q!|fbxeT|}hNQ(B|7AJ_mZZI2v!(cA{mOd)hJ~FP z)CJadu3=Af(3wPm$p4B+uB&~`qGI$S>DWn#i@1nm(fQr&Yv#->1U+jVd86CG?OeoI zGpiL{3V#ANnTK=pP3EGjGjnvlYa5rHZ1_{>FMb($WmXu!50EAJeGmY@2Nb%Oe*;;- z_AkJs+0JtmQfwRl#`n&~w+L{7Mf^*_`p@~DLEp6_jIYL2!z-xrU^8G{FvYy$AxSaM zp^{UQ6vM}xf*zaV4na3!TX%|U4w+nX4XGL_%XEuWo9INU?jD_KnSZ?6kf}IL$uyUF z6>e9WOdrAvnf@ApOb-ldQyDYIzu^-u9|ol5I!2v#G_i^X>hxQI`mgwvI_)H>USm>~ z2O1@i5~^Z(jVcy-7j+8TCxc-n&5_84zf@IIyr2|6B2fQ5zcbjkjaj;X&0)c?uA@=q5J$acOVe{*mrIwrX!<&d%yJr0)kPJ(UYFu|!@xKRBoHPWb##Jy?{)(40 zt^?d;wYF0e-PKzv_2CELp*Z{?zgNxVw0qCeU2Y_+9fhU$8|W#o+)a6(&QFfNjgr4B z5DB3dtlVubz8~l7cK+0H3a0u*KM?Q!dZLtk{s9=CNji6622`^3d@ z-0~WwHFTNtJZ*U|WI>;~{2fA{0~*aXA@j=fL_$`7GJ%k1!u(`}y!6v+-*}_gHOn=m z4T0aQjBrP4l9#_*ULK~om|5W%*l*-0bF}QYI0knPW;gOuj-RFglLF_O$hWA#KL9Zf zj;g@RL0xcd=ia)zK|={E@N)P&C>4u!ni_6B;gWQBpf+qL;r7*B2-6S?3XfRUnUy&c zXN9M9CzX|kAnqnY(Tm~5iPN4taoVdUnRYRHNn6cMP=vMU`c1O zXPOOS8k)r3a8;>*SuVc&s<@yw7KXkiXA2iYw~RrN&x_EhWgn1F zBh!hB@GAJatKbg71{3CaO?@&=ftT8vWyNa8v}6Uf7(PM8xb&~sc*92+6ogxnk#lFZ zYs_O!q4hHz?cwifOx!G^i7thI0Na=DkK5^6=kk~8kJV9S!#^sd>wmY!{~gx<{v9vW z^Pd3v-wNHwP5j+U3A`1x`~`p4QNg(zGIJw;GiZMw;_rRxxvUQky5fHkx1}qNp>QN2 zJoIk=4FU7>-_L*;S}Brr#m_)(GF`DUuCDl5!TLY=Rad;5T4vrvpccqOU9n)QD^@(; z6&Gip%34B0iFZP)n4P+eEE6KarpB0An2iQx==?f|C>Xfw)|<(1RP#| zKLs*$J^nOuCZS36qZ3GI85y69gqE@?g0?B?N0F8|r{=JA#&VJBK}#IcwjNaHzf(P^ z%SADM9=Rvw#LLJiSO4m-L5x#*DyL#l7fkh_R!&9hK^Y;d?>KWmlsA4(bcUsKOFxHb zy*z$LfTRN*FDL3iC&&qRcTOrNZtUJObVtV-fz3*A>6Va4RbVD^oIE6(uGezz z_SIjaXj|K`=U$QbEuD&dD9&v{EcG)59!+xcg2Zm|+Bhkt@n`|7Ke zkwmLfgQ4-tQhneAA~@30d~>Zro4GvKdR`NJs^=XqRrOgDr23@wS#O@|&8?w)tL?|I4g38dBRzUXr;|EWHAy!@;GnjrtOKutz*`iESH+rLF?&UyN(g_ESK z9V|C88qBh~J9N1^-z3keK6h-McMN*U6J~nN*^|lftoF%tw{7ZfO+KcQ6@Z&7B ziV1Js0`-~vino2?ZS@a~f;?bPAT=#eEZCDldZ5_dzWROYn>qgjI{c&6@pUaW$z-+8 zG}j!+xrH}Nupvq#V|hlD%|)dq+Ak`3+xO$oHQHrynp*$JWlM2V`U5~|a zdh4+`MPC_oC82aFiTMKcIsB?5_ESl)07F^IgOU(f+xa)&X(<*Z!QuPLvcp*(S&e~o z)G%piSMZIDqy|2^W6CBWGV&yo5S5SRq$3}%5A7r?+@-X?vT^~`IrD%AU1MD^H3_l2 zNJRZh#l%y8u94*`LDIq_fyfTel&&@UIR19kYPr3Q7c6 z)YwR%-ovjJH4cz;Sd>CK@?cRzAXQ})D_PW7`dKBInnic7xT@!@C8tw^EC6jPS2D3Bf*rQ6v?lD7r9tgNvpBq7*4X}Z)A-e`q6Bin`qxUW7S>{rdS>O z@C^;Vm5o&UoXZ@E-nhPQF<$V!6+nDbf7MgL{?=fE;cfU0xi_16`1pO0tHh#0YrCyL zeF?v6Z4Z`yU_7Dz$b;5aAjP&~CH>xDv8#Rc-AcKOHr`Tgwj5)(S?p*Fk?T(N{7I&o zV^hUjsJN+hFtt5}LCnu79D6(ar`Y}ro55JR#%4=b*+e%ABVAuNLgrhv)>la?RWA9= ztC&zuFnt`ti*i{8z&4tLpF{b(miRK8>@m>=o(pAUALjd&Zc%IKRWcC$VMVSI`l&&Kz19U?eb8EE|?lzm<01~ zaIwAZy^xp&TZI`6ZzrUrTK!aDnIBkxoJdXtHWu?-r3PMO ztv5Rdvbnl)D#klYpia@T{;p6txqUP8ko8wE)vH@MIqUDxHUHHf8A)|u?z%FzX4_Uwgv{=0H>zjO)VV%(E=;257fl+Aw+hsEl%w$f^?vJLLy0#4wOpUzj`lAQ6B0;1yiMF zNxHF^ZztYHh!(Zf9*1SxbJSA*R|$b$Sq@Y6UwUQrU#kj9{a1Z)IV{F|HFJnw9j+XH z-s-qV|pXJ?^<(4`l?E5)OtXH0NGf`wgp@vGzO!W41oTdq}vG(?l(GOdy)? zp)$enn~SDJ`+CAfbbJlATKvZ0P;I|o6xSBnLXnj(vEWwmXBj*F^d8G*c`ahJXl;$< z+-hq}Thm03*VgC-tvqc>s;yCdPqj6<%wOR9Bx`H-#*4OQUjXCA6N`E>vOp20MosYn zc=}R(J8opZA0T|C(F$mUq6wKc_1S#P?VlBK8l3|L>ih7kMu+V@{cBF-TqobOI0C8a zuP6|)O)tUl{(J?)mj19(mOZ!NXAnl+$hOQNnrJ5-KaT$V-HmayvXYWVHuE#&ak9zd zAiR*rp#bEuf`j^p;EY%DQykgOlywE})KqJoQwWjL6yh+!`oa8a3UP$kX9^*#nm@r* zi>pYDDMT==bjxa!no|fPYvibuQ`)_)tcfm#0oaD!{fe6!d@B#xFe_gyi|pHM@_jg7 z@O>m8;rj@j@jLk`jx0C6kHS3}zC}uWA1zpa2fyN*B{kz)Sn(~G;#-kYd@J3u#$rvr zjjWMt;k$`mH{Z&`I`}>YFZezdknsI(obmDe6i2vf0`)r%_hk4MDe--RVEtYEitnQm zzJ(Rvf+@ZgDaE(aEvsK{@@-^|Tnpb#^t$<09$NT*j(+VF)AJMYg71?7$-Lw?>cC36 ziU;}AR)Ur`U}~9-487%n9m{?Xg9frcLH47KZN|+qyB3#NK& z#eW4ta5(qXl1nqsbE+h*o*3dskYCuTClc{RJT&9UO=f4z<8-@I5R=2|3&Dmz!n=t@7Ie1C7CKxAzV;RplT~ zTT48ppe~rIDkh$inb&1csc1BAgiIScDk*zP6Wy4?x9m6mA2fy+hthqdG%7WR&t(px zA3fFT%ISDfSE>N&3h2yg{vM)y&L5|qY_>I(#45{ijmp9vmrRwgaq`DXZDvT7OqIn| zn$4E8eK9liE<SReX{DvK|pN!08KvU?}g zCzIWwLzJeg*?Zw!M>XEULOsdi&H%e;UjYtQiU}ucwk}o|b|ho@^5}ss^_A*qIW;Zf zUB0Gyvx!csV|s2pn+mm%ztnhDYM82v`OGV*)M-{1&%ukj_+CI#7cW8tnp;hm+NH;> z^jRA%DwTUS-RbHvWq^@$7!q!{iwfz3yAt>fA8U+iZDcokok4w(GNDQn3)bJmuPV*4 z(jOKZC=hw5(g>#XNAajM8r%-4yDgS={HHJwV`^*3j%DQ4i8G=#sR=T2zbW#YXQZFG z%vXG|w#aXE5f{T5%IqH8gd~TXmxaG#qLw&+-E=;TGrAf5(G`hfXK-}{(ceAJ)J`50 zhw=X=Mh5kH6Y-CHCsPnDEcYza)UG%q(ef6*G2&>c)I}D~m3f=gB?=WEO@mmpIUh#n z ze1PV7L46gja5h&2wKhzR+He8>T!o=f&DyYzIi83!$9tbZ{XBj($2(3v`MbChgKy?| z0;y`CD9t&ZOYA~$;at?p&+d$_5p0>=HPL?V>*sf$yrVJCQ8rTZyIe*q5|OnZ@5c*S zd;owf_9)I}T=zkxom!??*P4*xs@i`@uznH0s`l9N``5gKODy*oZ)YN@ z??bTISPe3QMhGRyH>Pq;bSW&@WX! zmK9cXn#S2CI#C)g&nI7O$W!@m(U~4LvY%n{yaF%ec_n~8N6T`1AnV`phe=;|w`7*m zf9W_BZ%|~kPy0}ew!h$S1^fDb%HJ;R?fW`^w{tn+spYZ#)V{lDeVW1G)?1X9!Zprh ztN3S#aRYzfNd6WAHE6sEIP@j^*nI0{^mNNLU!b#FX$RnneDK6}<~|Y?)ZbTeuO)MG zpFyUEPQ_8~*<<;+Aj>`bE`JRUhE^EzxUJVO_Z+_bK%!{OdAz~nmVXirKX9DwSW#NV~3SpJcB(ceP;sBmAn) zohT(cAHv-80ZP?QFr{UR=f|g)G5TaAw!Jda(r6Ezsc~tUp_pYSwG(~3NtQZXmz_d< z4dj#TFmgOe*?Arram$FZ!^lxE)#O=r8dE!!1bu`h`mbg$KVG8hcEZ8k3frCTO?p6hk~hQ z)&%S(hf8fVZVibq?W<;1Ix0QKE~@i;)=rO8!MylWyGq6rzxJk2Ac?iq@yV3=&~>RK zpPyLx+L}H=l9x;}$^Olf#?;B6xpAe%9&LxFnZRraRZU5(m^cB(>W=LrZs+wm?IWJq z#*=ook$C4oyVzX@+v1Nki;1g(PEj#EO=}Vi%Yz4T>w>8rfL2Uxwwrh%$$o*bjb#5b zakAQcK0&fN-aFZ3mnd0nZF+O9+{JAmcL|THmRjqdlv-XS9cWd{o;{Y-8vMU75&z_) zGO+-vmXAruz5nz^lBr{xW3`_o+ZsuZ+vL4L<3Abor=;&CsD>6M@d>BsB-=i5vO3j0 z$z)|T@m2k$iRvAxPMtVa<~);4^;dL;tvyY0KnFqGJ=V{imcj3av3|)}Njyj7+0*WA zAJI5r8-|g$%hOlq2`vopJ#AvX=R#{T(jMCMrG|-NzMQ`CwOw*UWl-y|Iz02Dye?*8 zbg)wH8C;Yv_bgg+MkD_dDk%p%rcapvHAhS)^UTjSWOTk61IlxGd>d1S)p#3lbWBZ| zGMZ>VGfUet9%pR#9DgZWhK4LH^Rh3{47fd8*W$&v@&*9o^c{oY>v64XgO*!SQxt~W zHwx6R<5xrOQ)zbBtPF;QWxOqr>KPR!*`3v1EQQ@}j%CATqh@4UhRaR#=s8vtH^$3K zyk)%nGJI8Sy!>&z;Oi3r_==MGM=*Rdh!t)qxRMpoPx49Kyaf;p>mwMxmEZ7DtEaXp zcq61%0=-!+<@ChZT z^d-SB3f4cvuOt{rf*eB@RuU9UNl=lz1gYN2LU~1OV6a&1j>UlQ;e_q_c)2mxwFE68 z#8__3b(`o?SZSH-{^_3$IVyYEu&p`Q)fsiSZ~04jA;;SQi9K)+Wce-r_OmvSM(`{6 zrKb1m*i9!w*fDMwsDGJX*)dMnfaXKi0LlYXhCr%vDVEML`*Hyh5 zZP?UIV}d+g2<^$_N%q7Y8|Tu8Q~L|%^c@(5McWfACA`%6L0gWdIf>n&GR;to&2UvkcLk{h!}6dd7Dy?JVkIr{(k%#wvRHa4Wm(tZ151#-ig!aINs+yZT$sY@ zr==(l?Nt;^DT^iP4j&}SGA&USnwejWqb@ZK(kxdgbr~;LQkMyG^+8jYH_sLA?B4%J zh2d7U!UR&;r00j1i)ebU@^pd-g%}ARKAawhu-bKq0qQ!MSd~~ z4}C|pD21ProylCZqTFk=`G8>kettFDJV)){_aGGv%R^%w!Bmf_c+>@VqLNz+Rw>=# z)R5Cl{}Kx9!AK~_aX7C|z|<^qC&ucmQi`>El*&n(P1S65>09>@ zg$gPHXj8RZuc+#9a;b-=ttZG|i!xKmpTf^|nR-R{=0tVR zo6U)84m+L`)zr1iy0!MJtmxcf@(C6FQIv%XSygoIFp=xciCWQHZBDd(-TB0f84xqw zn-(1}XU$MgkTa*erF*+UxG#@o%LoDSi#N*;rO)#<|TV+iac%$D5C-#{RhcgY;X5`Fs6iHTvFO zt4C^8$RZhhFQI$-;jgfHy!T)qGl0PZn}`QN90z2&2u(` z`s37K{E}?BMVTNC>g9SpRHb7A$F?-jr{9V0s8Ft_Tz=jYF(5MwaExTN=4`riHz;XIS7tgVmwH zLO!(J1}zH@9UN#`_@TjlhMvdbwJcmUxI@dr@=80NJ4Ae4S=fPlun^rXBf4?zVaOSJ zQT~Ok?&WEFX>%{XwU>7HVo4Uxa4$C*J5AY3uN{Guvsat~2CO zyEhY0e5I_DMO*Drh>B&wM{25)#hH|n8?ynhL%J$=w390U-R<-yi?(nBp==F0TtR}0 z$`(FLed(VSEPC~Sboi~bx0nexAl0F;>}tJt)z%TaICqMgqdwULnqxeyOs+Z0bUU=) zQ8;tqLA%Tt6J{4i?DB7fh8BtJ+K5PXHY2&uVQNfPe{KRM4@!*xr%WE`k2x-;_LpLg zi&V~4i@AJt$4SA+54$w?A5<(tMHViosBY-<8ak<^iQbxm(_|`oP!Xo(Z()N=5=Zr_ zZ)u&zm9I>UMfrJr%r*U37d70hM|O{BF(JVr9!o-OP!v3Ls#@^03X8PVAbQR5jM+2X z^s}}X#0MwTk98bxuRW#$ID^PHvDq}=w@yPcu3iVgt)^AE-r&L1y508G`h^{ORV{2i zHMRx1F4Aum$!jONSDxuC=Poz-$+=-)RG9$u)f8=1oT>REBie}VnCZ=1XTjslAAOfb z?gsu|`zZ5YH}>C~bwoGz|2-hu$0u;SvHu)&@O=J@sPH%P=NlWjnHb`$`1gbRoBZc8 zUVfPWskFrn#{NeE(pX<^;!obel#cxcdj(WOhY1(8|4GQ1%Gh7jYwZ8D-0I^zHTGX4 zp&kjUpdx_A{&Kx`L+Sjn|CY+v#)^+%&_2VVeSo9U#``Hu3{1fL=fN};-Y6m-cot*9KI@Zg1lDR6)T1=4h1K1h9 zk1&Ot&n6~iHcgsvYA&9saG8#40yxJxB~@Z>E}5jTY^O3wF+sL&l4A18HN-cZk{frQ zmDe>vj3%v%Q#q85&Ukm-`#0{cH%Vay@OniJCn+W-7qxdr* z`e4uEu!gs?7=AO);kaYCtC|oyOVf84bwO_tA47?6M_F$**e&D<8Kc1GXa!9cFN?}C#EfO zv^@TpMnd-Vswwvc;7+gp0SG?+8wb6j3Cr!uU+1(I5{JvJ0k|vd$C0ci&x8PN`mdbo zKY2=K&{93GORCAp^HO}>Vlj!8Rnhq~q z9cUX2^E#2@ahZT8ce6mp`^*lvqLKe>_7zG|-salCcmY<7qP`<5zf*j6W?I ze;s7po(%vQ%kgBaRI!Y?Y#UgACC)dIwdFpktQ+U9F31#eA9_DUcX{?lMH76n@+Y)y zBH{0B!f%}SMc|x5-Y&a3c28(5H9%^dsdlSPDO1&@*HTsuei~=%>eQrCc4eKcPH8aH zFe}xmN%KkSlwmP_tgBO5@VIqq1f}^4f3HqSrM)_p&*`EESEmB>mO9mpLx1Cq+~;|@ z8JH#l8kh~&$|@msrbSLQ&r@~gMAaExAQw~wpw7tg>WorlcCo-)P$}|^-qpB{x~~W} z%ug(xG_!=IhQ-LOV`&!bSeopyUiWOeXGTS=Wg2}2Ew(ObvREO?^&sAAUfaYOj*>f-`H@Nr|Dn2+unn2iXSkdI0T z9~a4~Zpc%7JXw7Fnb|b~;G-Omk4ja?$2H5W$Gnj6aDr;!Ok2Y|#mY%DOjv1HjO032 zX2JFC!{dKV?V5_|@v%AgAa;!t?;Tt#4+uVPhJ#&W-qh@xrh1Nq*Dvtru0qb-%?c`; ztE^v{%(e+3{9P=kx+zcb_Z0D$yM?fA0>EE69)Fc8<}d4(J-ijeOUWucnP#Kr-mldA z@3aVeD&*0fRd6_+&^e4?G%PMwn3!tn>cBo3v25pR+_{!fY)q_EafWInZS zZR0$5pIV-Ax3-#br5Ii%-f&M8qO_7vpprY=5VNjb95JKuhznp5wQ}y9g)rYr$D5wZPeURhT2c=5vO}L)o_W=!Oj<5Je)uf8w zm@23ElT!76p!kjRbc#P|o{8eC_(kJNtoR&fL1tF+Nfo~_6;AP|NX6uXSf}_6vyO>{O&;cW&=;|=(rx<^F_@! z@D@(kAJHtg(4%pC$f@qiQyTXT0z4a6MF8|JEdFlm-aJuoarbX`5jf)mCjbAR4<|5Q|um-!rb*T%ejDz+&frTBDs04A%0|`1wNZ_8*ToyJA$QAe>xr_{Vp!wsT&MQ`8E@TK zsbO}~+)49FG}o}0Ce&$e794A?-xj_NRXLcy*A_~ZJRSCJ>p_6f;rHUy+17&zn9v?5 zA-Z~~oa%dcN>|U!Y^wn1svJ*Ol`7HIpz=Q6qB|Iw(4jp9|3vHc&bBtpRcxI!%Y?0l z#fYwBYZjasgmG-EiW>8BW4eL%`t*z&#>%k4z$%2fznnzz1XZ z{c^D(bCxvcG!Lv_5OTLi8`%gLG}V+QXbMIP$1KPdhG%j7Bm5Gq58pX0*SF>;-P+pH zy?D({ct#5+ZbFoAHRalR)(W!br}f~I1iri|upr@C;Hin0{M@C>n%3N0ANwOjE$iBtC-ofEx;lu5h8}~m1ppMA#>WES$btJrxnK4Fv#}gJ*PT(1q8e2M7M;hj;Ix=aN zNgXjPMs!^r$$}@SBPyzAZ}Pb>r@Z_$Ab9y19NJ8_oY+1gU0cj8BUt^D08GeJA%Lf+ z%Bh~nQ#}2uc)G125CERa@p!6K2~W8onl~dt1HsLu{^-=R(>SS2s=rggifo6OYw* zMV7bmS0Ct7{@m>hupy5%ViFQ$dZwJ}={zOVb0kv+ULX(vnac5Gs#J+gE1Vr`>Rwtc zR@(8*9UOL^`GZGNc|K3Xh|hmaEa=8WIK`Trh@kQXa*FetP_ZQ9#`!tLnmoTmvA&q* zIWPOj31& zhgg(DMF2EUj;DD_H6_h6A|}MmQ(#EPciaqFj9B5Dikit@wliY85b|&ExeX&lA;<$LseJQEI8Jk zq^zI*Vme+|{&i)2Gi_DPY|6I*QP%I^#5U#4@Im{NALh@^oB+6SlV`+*aFkh}*4B1q z9iP{y5bgB5+x8?}l=*vds+aIona`K3eXq=NSTvVQxn-+c%gthOI)zpimo=)Q; z(Wb(l|BE6m+(2b|P9K#wE?YS#C=&|k=r>_}ELFfc>)%|slkKlH+PQk+a+TW2gR2+V zRopkSAGe7Ts(TmYdP->0aF;2fctsulH9VG{8wj&YE3;sycz%CLb3Ez~c{WS>;OSsf zPB&byF&(@D5IXpMoLC3Hjt;&K25Y~4K*6s96y8OVYd^#nRIcW^>@u@R0vYS(?ef(u zK!WcXXj)wAYjzjrtzOKneIcLiYU^JeBjlD$p^Z{bHrRzP@=)vRO>@6`v)`&YZzj!4fkm@?YU8akmG->jjYoso$$ zUJr_xizwqa#l;g$YywCh<$Bh^*w}2=K^ZU4>1!5A=Ay@uAKnR{`Y|7$M9#4hNc7jT zHo?{DZx+11{%Y&Sf%W<;!Pn{UFzo%L>F*7I(BB{7aPQyKDh?$6m{+H>Kf&kTouV$? zCVrbpOJ^o1_~uHXZ^QU4))L{i1E=9_K)H62cS+E~odnG*)9FdDy`_JZixgCD5{k^E zuYU`yYsXYJE*Jc%oa&7{b-5syIQ5NuBB&^o%LV0lB2$w13Rtc=%(F1!2uuoeHzaSh zo~W#UWVu;3b^W6(IBw&7TQh_l_TcZ?8qpccYH;}TngY3*kaP;9z{E%=QyOc#G_R3N zjLccW6b`c6Bgl2k&W(2N#^+-T%-Jkp&Z!q&SZlKWIf#(;?KsF*G`{PCs$_n{DB>SYZ!RQ`fv=Wna1BT&z_)$1v@U z`x);R&LzZm14k2?Za9|RvKuB`Gb|Dj**$WqxABz7E>unX5Oi{R5AGKuC&PYoKkGR#B-XH zB6l=Tq0Fu~*|5wbSgJ`2oEFR|uen0Hr)b}KGq<>BS2$Zv#@4#4FSFoSMeEk~_yA7s z)p{M3U}7EJrt5Sm+uCkl9S`PC52BR1PhY_1fS#`W1<@mU)ODYH`IK3~(P6QGK=QS@ zO0!K6&cnUv2x9h1k2gRX$4g(s`GmL4&V}5pzz31Xhuspxg4_zyonU${ywQR<@rJmk z{X-Y*RO-SvQusd!AKq9#%O2Ziadu#G7Q)=iGQA8AFC^C5Un#ew(jCX_qDZ?)48Si^ zF5=5t3x;o1w0(knw1`CcXcL~{7sY`2!&d-0Zg6;0Ve3~=f{pS8xh*IIW8#i{#DryA zTOrySCk$ZMKv3u{+$(m5TzkWZjV8p~#NsXXZq<+$1PuY{JhlsJIAA{7-8jN!~zm zkUVD%aZ1s^m}Fes3bEWw#WQck85|R%Xs{N0wpxs>{1_|&zo`|K)(8|DQrN0 z>Y(x&)P^p7AEK=k-j7)O=a*0Hpn_nV+YD&8{0#SD-H+=&eU%0ScdAJUNIuuzd%EYH z@51tgg?9n%UMuX>r9!SuUZ0{)l#iSZ)^#izw3RW28A{zQhz<~qbL0Blb(%=IAbNuG&S`4tXljj~22E@C0W(^` zxy>~#R^Ec0G5mCrf43F1t^CDOaJ2JJw=z0^`@Q=m%H18)P`DuKBik7*<*#=JN6#Oh zvYxs3ieg7*&%9Pg>Kx|PTXKbtrU(}Ft!;uKE#<3UGnQtDrP*O=7F!<-?|{c^gt0Wg zo*zBk!38~Y^B45YTO$EEqj${7P?w|)W8+^lQsqA_%ozug$;iXuL8b^DW^Gn3Wr=PB^6pLdgdXZGYK#c z0bNOec?O67Af9(CFtN=igC%}AiK@IzdaufQ2H~D=!V~2)U_a|GqoqFOa{RO zjY+aif!Is?3ti_##BK{;((Pg!C9ly7WRO(>vj!keDA+q6J*IM1=0lf}us&!(3Zmba z&y{GiKLb5MWkUdM?vSF}9I`P1t{-H7MxX+e0Ax?wj{ z%Ag_u9}kn`b;FbjJnDu8m4&=;fW)4g@bos>t(U3m2Q|!e%iqCv(ZiN54nsT|liNs+K zB5*aIx!N$XnD?#b(lgrvk9*xP`Yl^4YKrLsmYrps3<+SXg~D-^FrvE)|F*Q4UO1b` z37UMnny6*Szm=To<~%jzzgV(+1%lZ|O%OwVIiBp4DjxE4h2Q{hL8&$<$5B;Vf`8~+ z6q|Nk!4(BW7t=UsY#UVics=8Yt!6r3N7EOUap6R+qe(YFb~J6g((VoYC}rN7|E~O{ zNr&*?m%pM7R)(%M?;>rN8?1FSEeaRqax0E^fm_Ni$k69`1m*cV=Z-c4hk|K(UzEPT zXz<19`xExwpT6H`@7tvBKeP9t^!+M(-zj~+z~0}SzJJl)-<`gnzaGlKHrNwU6uDDU0B_S8U@LF*O@?Cw?HauXu|HiyUoL4c;t5~P4PTW#W7qg?e*wMUl zJvDW~Q_)gQ{WR9n{bAcwwA5)JSNu52tb89!>Wyixt1y#pu5C=p-O{YdD@@;-BwMSl z8%~7>TDxnUvA%aRg^ZJ$YNF@s1|0?1;iT@K5?yo=b#&)FUeQ!W`W~yr^y0GbNSoK! z08iVJ3ZH2}S8+Y*cQHROnSF9QsT!7gnG-5L;W04B|hmlpE&HX$tqFkxG&l(eNg%BgO{ zQ*G(DWseUq1Om{O%JJ;6Ql)L_w!GNs!sVxvF9#HOr~78l?d`dPJ%{YM%%016hFqy1 zPq?ht=DIC|jfvA0LhRWG%Ou1(Vpb5*I|#jAc5bDzVRmZbC(SEv;th#$(r@Ck&~apa zJe>Y4|85Eu%UY6%Wu0`gwr6L&LZcn&XZ9`+Dm(F3%G)p}?QSU&;3gM|5$R66I+%f@s$iQ7Kxku5CgW$#zR&(Ft@EQxM5^PeIV+ zCu3~;`V3ZzUgra8VfK{B_!?}6jf~!CY~kBDeQwGoq2bV=vX?+f_d6b^EM^=seM9=o zdjm|V+R62S!%NU|?ZaZsqRy~fb$#W&0m{<&2j`=Gfd`ehiX?em|2N4TxY7rew+Sw< z>jK|4et3U(g3sb-__F>qdZ0f0TXFSE@azZvF`4u)$%kK6S3S&!=inwQGs4<4P+Xj3 zwXaCyX7e_$*FKuyeLFxmaOh3qze7RGK_Y4gkV4D?3)ftLhlgR+9+G6VCr@O=bAhb~ z^^OB^D@8zTk750c+g{@O@~+{%aeIQ=oAe5k-z;}1K&s=K!keqWXa(eCexSbj`nYoke_rwns#YFkf!;r7w{@q|nu_u1R~k~hugHQD?C zr>Hyf;lIGwR#-S|uuzyk7hs!7sin=Mi-c!jcEjyw=jrXSLC^iH~Uu^T(vKzBh zZ==XT<#b|5dhA|wX)B+TdwF6dmxi3I)w)DedFd&!mq{Zi2($~Y z4mK6Km$v0bxRd%|f*y7H!E$FVn4@dNrT;HYFqai070kA zuJT@B<<}(wXMC-I=o8eZ+WYVY3tzQ}eM>meAjrpov!qL?x$`8f&sMckr+f2sf&N|D{zAB|nk^32-TgEI4tBO~YU9xsW z$4#%NX`#vH9m!4KUx|6OaCGV1pdwxxSC>wwwiuJ!`ifn{?WRN{6z|KQAu^gEnA3!h;FDaHW=PY1G-v{vGB{mW z%@vBljMo0mgVyjnQj1ke(``w*+t$rhrZI-TRk8j=szuv7di_4i^}%>=^`V^b)RkU9}kXgaSk1+SkP1&cin%pL5D$vI8rsGILW$9^R?7(SUcrS?Ok z);&e}>Mpp*wlBQVUend+W-u2Vm+i--jyI)f-&g%-x7}_;D;=N6xL$cU2J?xG@4?`a z!-I-K^?eMv-VBbh*L?@v7ZDyMoQPpR7FQnim6E&)(AIUX;RDqCH+nYW>@kbSZ8-n_C_K=c6i(5Hos zR|>uv!_$x=sa|7>o+b-6dVytPiY$M(_5FaFXmJ!d>Y@jsYv=uJCz!{m0~<5SO?5RS zOMAp8rHTE2Zc~}4F+SICDocaiWLKgaGbypo=;)#(>|vrCl9M;D*_6{B>MxjX{0z_- zdvuox@>T%8J<>a$^;PJk_DD!kk~`#7Z{aB=VdqQVx(5xn0Ek46XOEQ1vq#FXeDc|u zJ@P1+)E+gafE{fp#iSHqk5UfIlRYwW9v3;z9;MLr>`|QZ-`LD!w1Z;!8ri4YDGqz@ z?5VV|eYy>AY@ae1-!Ha!#_cKCCo3)X=}x6`497lQ8QUj?%09{U>ZGwdu}{i7wNHkw zesx* z=87A!5uyTOb0yN)q-W1xDR@$I)tDk@t|q6*@=wf_XmJ!3E27RfR~d29L5&&Z%vD3O zWUeNqDKS@u#rRxjuCm}UbMvxS*CAtdQ#^YmLB;ke8!FzXlDeVd{dhUk8`vC_8h}yp)iuW5lj0hCUh~V!;P2#jf zKgTRY@1=87`>kRzQc$!Zmekd8QJ9ScY7Yy_C+Tn;zPSlLW^ZhS;WAZ()juMHA<27! z)<|PJ^0&pPsVJND6$H(Vu0lq1px8GG9x zL%b!9Xm_3c&xzRu>$@a<{S`1uf4{Hq3ZP`_&Rfy5zPbpz4H9hb@D8Gbg{rE2v!}a6eP9e@RyuSm8%^JaB zFZH&0jD7ctTXB%oIs(nS*B-~m+TRm$DtfN|2{G8pzC}xPEFGKvg)X?bw0YgbF0o=o zcL0l137NISb6PrD-Y^@9--BUYiHqXrzRzDB!MDLsyGRmup7*~5|NZ>6Znz!)fAUY@ zL+q-`S?8Hudle(K@|bdS-DMHd8a;&)u_0S8L!8RS8p|tsw;Ye&q1D2{h$b3$*qu4(q=y1wAbbcCtcH3y@GOTAuTlA2P3iWjt z`w*&)ob=80_=}M`kE?2;@0dO*xB4j0*?d9kDmB1u#ufqe1ueN=3#@ct(pIv*p7NRJ zrQNQyI%M50HzA&s=J%xZdZ=^sElWGpqiV@CK}i^iZo7}_zHEa4O_DX zY>℞$2-I{wnzQWwS+31Hu;l8HY2U$6$zN8gKtdK$%Z*#vAVWsuKaxOGvHuEI#+n zr^FOGX`f!1(4hTAPW2Bw)swnLf^^sW2mr(6cnnjjq)$(m+9>+#xv?~h;awCnTbXhb z4{Rh+w4m~gJw;u36B^lYjJ~VM)9AyZJf~ESK)MS*5P_$f@(Q4Cuv|~mjKZWFoHB@w z=0w{%A$hw*0mmnq?vD-ZjRwoR?tDcS9E-Z{e1*o%C-SFFOJptf#f?}lWl>pdw=N!Q!37=!D& z-dXT?x_34r(7k4!?ny+k?hOuKNY7{OzX?f~uvlzT$A#T7$rVN~35-6dKc21ID0Ixa z%_Zs!j<;@;&wYdRUom}CI(m68a8T+iI^UfR3{OeJg^B z-mPPMjQUwK=mf8Z*j6KX_`gc=U!~}_1j)*cVRcEZuX|k(id6csLg)Ii7mM~nZ?bN4 z_Svrcs_Et|xw@xD0qnGO8)cSsPg%Fo>uLLI2~BlOb1+}EGQUcAJO^_W1$~~sn}hiu z0MCF|^zP5e=$%g}%_4MC`>jlkTwGVy_mrF$Hdpcv1?m#wiE7H78@_oGx*8K{43`^d(vWHUa&D7C_bea#Y+7 zN;E?Uo>I*`y?o?|fIN%mdpmD`YaT8t@B*EmGU(FQIDR+Vmf|G3ri*- z!Tdmx1$Biuf1J&3`ToN2r=X0R6AZXV77#~IR?#V2Qh&~|`cnYexO12-0Q~x*_n^|M z&`IlykWydT_DFxJ* zlmqisUyPi!BFEL26uMr0iBoE*<>oL?#E#acQ=FjUo=O|npEkVlpfQ656$QuKo2uKRj@Ar|5nXq!OBS5;In-|E zax-(@owh2fH=c3dAv(`^*#(I6O0!rqpdlT8g42(+`GhfF(!tDtyu+LkEz}mcK#Y)l z9AmZTJf6|2#=R~#GptPD`-XC=-8{wjAB*p28s7zg?{Yl8D^<*QM~It<_#XV8KC)M# ziz5_9i@E}$DNJ1!a}Mgm+sSvp!0bF<)Lc#2cGcyGj#+^IL_*kp)$ z(Br!9H_opawWqT0uBk}*@Khz-Kkch+L?G68V;pb8$3lg=nbl1MDcHV}W5EA4lZW8w z_NF-KcA?NcxP4bIJs*V^L(Nrbb7oKs@0F3*jL^OTIv=v^TDzgh}5id9^iq`e?cHQ@Y&Tp2*JT_N+WMw|6UTn&$RIdQA_T&$~-4T{f|N z8a#@Nf4bPkT%X2Re}>5FxW)=aDOM_s0>ldEqx-pPX?a^&R%IJ z1H(}nAVz$cdU{#A`i8$n6+CXNaM;h~gtLVB93|q}|9*tCHJ-jVx`3dfw{w_I-;)zl zcw3_#3kb2B3DG`Y5s30Mfw;^SpGw`)#5o-K9R`ODfn0*F7$QfFVRKc-RL3EmTaVP_ zq1+OAP#NqsndiPB<&Tqt_?OAS=rTFnAJ+x3u%-tx8I)foGnqV6UoW;HJeJ9}c%4jw zoW^3#E+_&r*$yYR3oEQLD7?-t$V5cHmvPu0kQoPgYD;;*M8!8IT8?}YgLh{fzY@EBvS(3j}wg~l79b-YnIGTvBr#+yfD-l!-wJ&Yeu)bnEp!ef3c z!<+D9b;=J#fFC>J#QfO7_+bfy%5uU7S{!5grWI?i^0F1t_fz;CRDEcqB|?UWntxiDlWfBujzqqtdL(c8!w&_FRb6q zCh^=whIc1`^t-hVaTfnm=?t}D8BgZVeF*ejb|Hd4e$~6{kGoT6yYkK?b49LAmiN)-n08g@}d1>Idvb!VQsLgpql?DPpBN&v2qk>hpTl`6jY zNB3MAkW<#$Um80qenZ|I=#V#25S=V8JL{5OXQ$MK&w=KnU{bud)0 z6{rI!8IlD$6@SoZps)Huu^ zHs*g*xoRol0(rEQaG}dyA4qoDx7YT}vS%rQt6}=qy^Kn5(n{IWnUp))xnW)Q?cuj9 z`yX3OQ!S0UY&y3Gn`d=HD{|A;J^8M^Np&Z`S9B= zvd#n@LK>ZMX^Ji(@Luh)bywc#P}D$o9Go7{ardS)H|Lof&qqIkQA~$#&|KQrMGP`akZ1WW#O(X9R~%O$TBq*ZAQ4#Nc3JaMPstnFQ$3?4 z{2k@D)+}J8+rKA^@%sSv!vCcjUT7y44bC!~7hp`Vm#}slQudb6R@z<=%j288w64B^ zkb#!g)i>hWju6{yvagb{#X}MMm=w~x+YF)uLSNc>HD`0+!2IgBV92i z@7vaqEQ{3D*Bsu2a`rDOpO>8PX|=;j*+QQ?o)Wql_@ zYJI1_L8HbuQj3}%_}?tQaRd&TE~ zp~Ko1j1C)Ne3J*b)8TjHlMV|o^aVxY12KXgjQnZ`3ffY+Ld#&^p~}_{vgof^^uC>g zs@}uz0-?KSkt+uf((1IDts?yk7&X=2u2kKYh}D_>rKU!ROa48Q4_p(3Dzd{k+PRS$ z(~`^I(PR4bUfYf&rT`R~PM=;8m(Zta@%fv7{mb!2>o}H?p^%zb(M(N_OiCSR*`+LP z{zlUjqS(_Qdv)Uv>Cj~Fx)}i;}O>`(*i&KO#YjG{071bg13ZE zW4&f{VZS)Uiz;+*%nq+i*?aq^m+!>}#MPaHOC)gG^g(>$t56I*V*O49IXk4IFJ`=I zA5yf6p36R=NO5knISBj~Y1v^wTEfRgL7e9R_xvfeYsm&KVKftC)V;E=t*fsXlSn_f zC4ACPG%rb%@9Zmi>Cz;%!?T>~%Bo_!vU2~A2(|n=3J1(7#CbG`uIqu)_i8Y8Z8w8lu{C9K9E@&WVXgRULTk#63Rvy-lQp$06arvuQm@NJM`VOK07-kJCWHT!)kV@8A4=-ROM@W;6GG; z)m;1^kYBebARPh+~ z6OO*!*C(oftMc>p6!i=g7F!kb`*GPd3o*k?!GB`?IEjxO#7C##8%UmG`f=yOAN_s( zHt87urQarptRLrqB3nRXL8AOByQlp2n)Kr?PxZs;zH~FweM4%xKNA|I`%(z{1_$%5eMygfs-#~;0XjEHd!`GnHg*d^=h z2|Qt6Z=u*2gd5A5q_0=VX*%T!E4%Q*u_{j7j$eXyP$$kI3hlU&6;zG`?&`!R@u^M- zF!UBhswl|S305^!DQasKsiNmH1{k!>m21@d`#IX3SX8>rTmK<+8q=td}2SokB6u z5j5Jlh6S{~!-MrPzoWb@QnX2fa`#5Lqg~fD3m}$mLt1lN?eUU(^FA8?`WkX4LOntcuIq2`#7snT+QsZA(`J<)pr~@Hvses4b<#1;L%)Vw>3uvWC?5ha%G{#$2GVHHHgd$P3C{vG z<#wUoU2WwQZn*O$9Iu~oK77!&J#1=x4#DTvyP`p5egt>29A1M=28P55vsTj(+G0Kr8Npa$mm{u+}trTBDsRBB! zTp~u-p99(fp6c)0Ge@10Nd=8RnSN%Z3uuf;^iza+`f0C;eqNKx&FQCfCeu$tYWleq zBuYOe+L|8tzbwD_i~mgdB~Scckzc$q{oH|+o_?N7c&wja!<*9dIW=dGQ0AEYx9&~D8QviCcoyP+uQUa9d&q@-fPhwoC z7!^I;*|Rtt-BDOr#MsrcIQ^Whu(&?~lj-~RsJk}lx}4o5X;-KYXq&Oie{P)r$Wck= zeW%BSo=A4W=OWHaBJQ3<9MZSV(L|%5WJQdNY})#YHNRp#al{Fyt;;0~+0b3F3oLiq z?}IQ^e_vmX!^T3Xq_HwlNpa3oNqe>N*zRDvHkGB*N$E+ZlZMrFav6k3CnfHh9{9g5 zzhr8GkaYB)!yMrM=Y41;8eXguXZMIVoK0q_TyhqWGqmY|7e9^YWWRj|G}y zUZk|$mXxOZhy+cH7?}u4QK@&(8o@r(^o@k z`nnq=N?)Z0H9hcOBERHr`noqUybWnr5YC3QD{*?SO1G(f--TW!r@3~uoS99vYs_t~ z{Qx%|Ztaw>SnSHRgxUpP;k_Dk?VYb!^2!ehceh1mM;2}o2F-_SZs2+=+g${;6_$Nj z%2W9TFQxEy@GygUECT_zhsXhBaIrubXys`92=eFvIWZ<=^Uk4UvoC&7>T@ zp@s7`-O-IW;q^QgcZF1!zOLvM4z+2z@>N{jlRAn!;J#QSD%h0xOF7lMd1_N4-xaa1 zo+*??WI3aqf22ciEBHzRlK+8Zak4Md&{+DqeVJKs{l3g%?q_$V-`i8Jb^9_i9^C^d z<mgYED z@Af3w4d^Bxz`0y=-M?a={%p+Iz2@d?zc#n2cAvSOwR_C1x@h6gVaV*9y@gkjoHl~9 zVSnhxrbLhNj825m@Ns;-7X;A>ybNE2(dyxfLNqDr#&1Flyoiqk(N~E$Fp%%>btTPP zc?UNvk3zg36uvSGjQ{3woZ2Au#dgNM(Us>v)Q{Raqc^BQ4du$$M&fcj>dN83;cc!Q zdJ8$=%8r5r*N+^o{|VPamL{k@Y;L~xTXQ>W51Lzb;P7^bOK%|y@!9Q(gTvp4MQfj< zVyA}1td*IPJ%Y;p2t0Zao`juTn3%=^@_-;$k@~cIbRFg3@L?FZwGR@S#-iM^HQEC3 zV`#RcDBN4hnYBW6H7Td}Eh&X^pPMGpDIAyD9vkP&9?t3B{%fidKi>p^>)MeojQiC^%kLh^|-4 z=Dtmt$G$<{f;Jc3C?tjOM?$h7K|%~8!)rWb`rk8bxY|b&<0l+&whN|4r&fa8q zj}n3A7SPNnh8s~8IHF9L%iIytS{nXASFX^W93ZufECY@!+)7HfttJa@34czgokP=p z`tvSJ?Y5}OhqnnjIDC|p@G(MCCFIh|=R0zR@{QY0i|^^}Jvbk|fFgCD{t+~{r)%M+ zUyE)-E8Tqpe*VPx`2EMQ0^Y}DD;ro#^&F1U9 za77I&f(Dg8@QiMU%&zDTo@xm1#8pFh7jE1TDjSUaALUe^Z@Fdk^;pgFSN_NTDRmZm_i(&*A$<_iyD5=W7tEvDkR=Z)&w(zeJkK-w z>pUV44p)@RU;SJ-dCBOr&^y0;5Ufp8AIhDg1V>NIkb=EPiUrYM5o;RZ^76NcA5{Jh zNMG*hvyV4%a<=Y0+=wnp@2YZPBgOq^J?u80+(S8(3OLU8ak5w1KXG;aS)K@`-RHQ|~CWSP@iS5=P_7 zeiFth<@+po8mvj=nX?)Ml09t@v|Oltolgp-H% zq>*c?sbH>tN5@i^9c;945|M|04CBI~G_<0)YhK`C_wq`-qlKy>9u7l#)(R4GxT`O` zo`l0g1jeQ#`Z!36;b9c7wHO{jhm&RMQAJ-Z;V*=HUD2;mP}>-KpFA>Vzrn)}QQ0sR zNYg^xm`as;nYY<|#FS4s^{un1&x!#0h^gGsPAa|YUn(7#9uUg7;8;S*Ea8H9VI@n7 z{uz~sTddo{Ux2<5gFf4cLG8&m9*pFYp&86w@aT| z1H1gqa2XPgbdLabHY*Em2_GXgwOKQBYfejTmh#SrzjtuiaBUy_nU%8$h;p{!P|kxm zqleGz_JF=GtT(<+?QZ#K3O{0HejG%mQcvJfnV-as%Pf49dAgixi&9f&K9$%v@-9vb z@=lrMjCO9HlvznY@)St83c8dwfQHI&&;Vvd&Vth-$98&Vjw|Bk#j;i2UYVP6oyh(c zD|0&_%De#%_4#CY5e%Y`@&XX+q z2g*SuoJE=`=!No!N3-QrXYdq{?iG*tW{pDOksMDilqA**N6%>ClXW#q6~z?Ake6Ih z3_1FeRh0FhaYca#uC1GyyZhnXqL_!G&8r`U++xNsw;B)U0D^~IIPmag(sR|wd9XMb z{*+ib7XXLw?Agh)rgowjzF!uKJ1`2%&LwVaDnEfei{{Y7SawoSc7cnAy=pZ2L%PWJ;;pbpFtgmYh(n_#JJYQmqF~l}dA_ z`pN!23ZqyL%`L(o>z5c=r(YLQkA80YwILw%Yh#@Fj8{8pf69L^ZT=cwD<#_$s5O8y zf?_N6Z=v4R2-Y^k$4Nq-(W%IIZq&oGpYBQ;R6dXT%h5ujoW^%4f>0fsa4FIJNKaX$ zO@#Mms(QJ7p%U4X>mV2?vVpPUJ#j6J@BsMy(XQ-l$7LHd{x1Qm)rXUKXq;f0=4_|nU6kEOV zaqyfl4j${dw~q|YnXW2qj3`-^VJ6w?N687*#M3d|Rp>3J5I3#f>3I&-@13c;Z{a_f z)oE$LI5Sw)pi+ z0am{j{gdqD>ZQQ?>ZMv`)l0VBt6ri+wtY};HRLJV{-9K~BvVrnK(<}3SG|-DOs;xq zMqq$|@v2!$Uo=lf!Bsc~a{iO28}_pmx{sIss;hPV$2ix8wnjfUO}FdSbll3WSChSn zuUFHRDy|&G+E&8s%E4y_9#T2pY?>|rA55#t^^UPyIg0Ls>0bMM58{XwEo+~zCorg* zMCLL*;K5^W)>O}F?O;_#1su~v_kXOzZ^c~+qYJGOZcspX^LFC`s%4wJbX?G8jhW#o z)l32FYy_XWjbHd4ZbX9q|H62UDkmG4O zY~*e2Mm+Yomh`t<-PoEq)QzP$^vUNY&p$>h7EeIsw@6e#a>GUbeR?wIselmsMy0ZBUUFf^8)eq=Tal?BJM zP+9-+xX-42aAh0MLuq`)TpWschm~;%5M^9}L;vwI%1-~0`;e$_%L%hS5i>{c%}N%^N5!yq{&n~`2+Oms$yI4DbDHD&zdEV^;s$f8x0%3oqmmuGv|9{i3A|ej9n~$h zokP0x=F^?f5B;`4Kas^=%yJL_sBx7aO)?IW9ar9D1FR;r0Mhl|>Ar)r1YOTQkp zCAqO4wsllky&#mwr(8CEZL0W`K=Byk3ZzeV%5_Dw`d(=h|~d(Do` zFF#6poP8FV^D{XBKj46cO)T_M=N!5zZ#%6yycIH{|6;)CzmfEQ1(W7GF3r0(votk1 zS?D)iXvgMWDA2DdO;=v`8_h4DF5vv~=DX*zlnDmhFCaq?eFRjM+Y01&EmW4jo@eIsCXt#%G~6r}h+VQ!&qZZfMZ$-U_1yJ|XW-))gv>nwI35awTN!e<4L= z+c6NsZ2LSduzUsJz|zDQ2CgWKO`m5kfeWh9P)q=KEXVHA4~sfoOph=tM|+K=%AR4 zH5bCmpz?9>h$?%Hskk^%7ejE5P--qUo-_@|nelyh`AK8JC%_g~$lht~yUT}csj{vY ze0c9T!Aaqn&{m~nKeEcW6*HSL{j18iS~@atTJANcOe0%#H;t_HZW=j3dQzGDuOOwW zwC@94{)WBRL~)&{jQ5+s_fKf<`c{jzMyd9qUhxSoRju1KY_y7*;NPF!w?uNJTh^*! z33QA+M?{`Y03c7jupe4E)XCFA>g1WmN#&VJ%0LrI3dui8MyaTS%JJlwzQ&S2HXmJ+ zk#nsiKbuLEIKQMcCzW^V7cWl$L;2(8{glYRSL$fIM1&5{rwI>_Mj_%1E-znZ@lRBI zF*II_I7#oHW_{I()Yc*p>1Px?R-}!>FE77kKx9n?HwCrj0qJs3NvR)GP=xwfC~(yw z>W$lugbhcst#=&y)|30z=n~(a?cn=;vvZ@JJJBmD^mXS$C-_r9;j$gRlo~1RdXBzW zYM=ADM(Jf0*g@MkeL`qz{!dNg3Vnm%B-N^NZcywzO=V0)58Lv$E%S^ zoHUy=>T;(tThh-d>2c#HeLgWnpI4+*V2)k=3-Zw?jRgi(JL>={n-2FcSh7KG&uO{b z-PZT~0w}O|XX4QJ{5>)$wzovLl4?e4sTB2qDOwI0bDH`V(79eAZ*wdC-?!q64iI=A z4?sH+F!1QeY%cYh!8Cc-Ke*7-ErYj2_k(X4i($E9(bT@w-4fkLSg9rY4bJT1Xy-ei ztfM%)C7xezncX_t*+Wmd12RforQzGDEu0xEoz@TWwe(cRjtG_-5*Z+I+yN4pyk&8ZKLH^b~|>+!i< zKSk7c-Y5*K^Vv^x0-Cea#6+P0gJ1J93?WwD73Nd?!5dX%o-N zrL9ztl{#xut@Y{(nI!0|sXdM1Y17)Z^^oIi+*RV6_Kx*JGg?@e@HghHAy?w|5tft0 z=Y*`0hGZQIS=~lKJEL^FKil}kPIRR&IawRGSPOaq9*k@%rECcS{}6!}7(I%*<^w#un($-s|L>HxXRRRNV<=s=x~w^3uO_4g z(zLL>7~P(RYxHayu9-DY!^Jv{o-dMHJ)fsW&%c+3&r%^P0%-Is*VAyN1Cy;TbA&6%V<}7a&GF;R%xltC0SY7QZ6D(CMH*6M$7*O zi__9Zky^t45JzLL#Fjn@fAl^B)fsC`I|5#K2K|0G^pJH0$ zsnxCetje_|!O`sFPx}R}w#Ovgl5FGPfju3DHT#0bQ`*ZUNzIV=tQ90SG8uX;tjvwJ zV`h~~q=`=Ht5Nq^$Vy-6K4vd;F$=b+X7T6>(YF269X zR=>@2Hgl_wOQrvznpY7(bE|SkJ9kTF)RYcPqe7`=ybwY3b#Y2KZn6gBGVez`ugu@c z$}EVLnRW4xrlp~$7k`PwN49+dFl}zyo>h9`Ix#W-*y0ZgsHJY!NFkSWzn- zyUWSS6|SQ-{2wH{xt{f)En#j3YU|H|&PVTbAH*V<5wGouN%?S^VygeuoO_9xI8NWQ z5AVBx(9J7w&`s@GXYOwZa4`HhC9hp2LMoT@jBbQrGp3BVVY9-V)&&*Cigm9PEtZwk z&@4`u+1TE#)#52~B^|n1*VI$NvG8Sl+nC(aL=I_Cxl-BF#e~mBU1opTc?$JUiu&&x zU7jVisIE_uVqCM5Sf0eMlEed;)w5QR@Cj7QFN$Y&Wo^gX)FZBH9ph@b)$j4tI>wXI z(c=+KP!T}u7;-(ct90~Ll1)7#ANABotEORW9UBB3Ej%S+hp~>)F+5~|74DO(zJ^OU zT6jXSy(O-c2W}L-_1<0%;U<qm-o82`e8bL2>H9}168lx|J2{G5Tk`{HWY!9l>^#{t;$ySipDqF4X zOd#8fq*ZE|z*9Ywr&LAU7l;H<&qVHM z=N^d}S2{3F2NRtLWgLkyt4q^#a4qSy87XeM%DkFh^9bx{8pxOW)Cl~JnTG7`Vcv$T z#Elm6kiAaJ)Y0scG>019W^c+Qdpo)A?R4H+m5hzu?GQZtTkvZ+$0TPQu#zLP8Gzk3 zvMjhIoJpwlNxZ!q+aZVD`FrCyaW5Zk;36+r(vmx|C71iP$?66`$m+*9@!Ia$7@*^j zHQ!IgOg=+}sNDpV@6g)wM?7nqc}W74wDxHQxDYojlPYcPCu2d@^FE%AOYNsA8kfj4 zdPgArvx=3QHA($1T0bTR`livl$*8c{*0$6%nZ*}pQ$(YMXA{G*=6!^ER_OW!(6d&M zaG4oCVNJ9`ew!YP8!1gmxqQco5hA?WNyO-`;qtbc95>Y}cOMfyJqo-yXiVZO6O_}Dr zqlM?kNUnPuPjVJp(n(_fRk1seN-XD(SZq#tjg|8YikR&y9-d8_+Ruc^qaoTGjj7#A zDBY~V{-Li^kGX|I0pXhj`ni`tWJEQE-sTdl_zdQG$nJ0ostOC&2zom{By345dI_s) zKXs+0FL*w33v506teGpb&)PK<+h;X%PDHJ>J4h6Zh+RW}l8AaaddsJJ0ch8dT+cq6 zh+54)W9BNx0i!Km>q?1;>2Y&~nNFqsxB*hjfN06Y5;=2jUYXfAR5rGw#o6YT%*sZG z!J58qDu5Ei?D`~O%YVu#&XF!=2|HZqXx9emU@{KrR0v6prA|6;R?>aFq>|Za7q{rf zlZ;M^qn!%z+3xDw7OpI@Dtv~t)(3F)%yB7X4wOQT;lzJuBFZ02lx{-6_J5SLKl2jP z9T$JBs?2qll46deUiGSy$ix__^~dOgDw{r;;jwht%=-8B2-5;Yv>!HR*;8nxU*Z^x zQ2QN$@f1zF!X{9(n~jDkC|aT-$}`U1>6I070>zo`6lZ#-I8408N}DpMqusP=99{al zrx4~jtT!a?-Ai2DrWJOMstXH`Zyi@cf=p}S=Equd)%6H zFOc>=>j&Kl2&Vi3hjH%nq`@xV&6_s|a}TdB&`rN|gbk)*HsaIL#4UF(jpqz!2W|mr z-C<5d-W$T*vklbtgua($J*7ge$K7+t~^1LRs(U4OG)R6O6 za;tao)R6O8+3V+2+KK=ga?16ZRHciDoMw`WqXl|fh2c)93I9U!H3t*JqxFZPwaaJ~ zBz%rI+NeCRt>em?_twY1E@>Eh)(T?XpoCu|%NgFDZkDS(74>+j>|2VQ=9@!T5jQ{+z-pCKFCw${%c%rg;H)gUb&TIOt}q< zC9f-Y7Tmbp%CoNA52f;c1Q6w3heNrK;Y2FF?g%@9kT3LjpzxRnOe~u0<+=ou^FaB) zgAqB^-|-X=UWj?1PHK4W;K36( z*v7T+M)%+B{wy9ouS{rWBe4#Q47`qR(KZ|T(LRTPi>_y5PlLMPz6PN@;m6Z*s=wzc ze*6u7toyL_E(L%kay*tORm>7UOHFaDISiO*rhb~49YNgaE2un)f4yxpwWkPGp}V)= zzA$gap0q||(U-p=TW?1ainTuwoi_51a=L1Na*0>yV#&hX6{~SLPD`L$cK)2+<8^13 zKVw}3YXzF~y29cDY%QAd+FCS$8SlkZ|NWHgU0c#((Dituzp#5ZdYXqHUmS`y&tj&- z_h=D;Zgso%=adpYS}gjxGNQ2*HArYI#fxm3a|%*4Ub^hK9ink|>MAzQZu==_SF%FV z`H~)Z3<}Rfs|gmzU3YAm2embBf2i!zC&yK_$HB=le4Y{WNIT6eEwR*Nq)rt&P=)_L zXaXZ|Q^>l_4%*YKz3w^@Zd)C84)l$W#xl9U?8g*TK#a26TD!SlT3tEX+m7br!nri4 z(L5eWT`O758=1x6ZMri&(RCP_N0ZKi(NeP7?2HPX1#2PatKnP^>Wt;CZ-!2OdmtRG z^}U_iuL}#fr(3JWIn6s?Mi}?Z*>xd`tDpLy+_9uHQn^L=<36ZtS)HAIVg(iVREpY16u^;moXj5AUa)A-+f)8| z(E$t&Vc6dkRI0t`oWDEgA96U*juUN9yl@q@zxGdsR`k?48DS|mZJSs-2XOg@wD*PD zzZBgChcw%T+P__ZD08@DAk9*t_8%Xpm+&8&W_rmYTVc`>fB(vuwB1CS4Q=-HLWYO< z$QN_IE}xVSF-x>MWv3fjqsO!jkgcqR;b&zFZ!oiG@y$R!Pv9hnvLz{1;aB8VpXI5} z^oweqs;x5b0;n@B*Xv9xUABJ1&XWHU5Eo%EEz~NwCxC6DjLG*V`<*b2%N66Eleuk5 zect-YRu=6_j1y}+V)!4}8o%Gk`|vx6>a@Vgdr6xAQB%oZIS)So4i2X^%rAOOnMlXH z`P>0U&qKp-_A)O{C6;{`g`Z09S?Py=q%2H-9U+dLA^n*`?Nwop>H8stUi1Q$ zX^;u`=5iGcu8lgl$81ymZD9rX8yHy@#gsp&m?BqP-a|N z2@qc#9)F@k6KOW1rZWNFjG9xbmfHW6$|)6R0{$+g+Jf;dr}P2nSb$t_M$MF}#m%U3 zaJ8SkE26~qN6cx{a#2cHM_aT&_A)7)E07g`z|_N)R%PqpgF0FQDP~h2PEaMs)skbL znFD8sMhkZ&eJZzF7kB+kJFG)7rt4?lW3uB>`ao2CJWB1j1P; zaY6u&%2nlh-9O{RbQ=vhJGJI5l*H@wU7QfuvsRFJ%3VgZSX;$2SC}{0S(v|KR5rI% zo2LA`Y5@+A6*jYKCinki?oHq$E2{qQo=&Da$z+Dfq?62KfC?_HFdNRnx65e_I9JKA=IUvIcb96;?K&+pd6aeJe#Pz$tgrt24~$m^0YZ zF{dud&S?~7jq7-77kT9?Vj$6rbgA~y&oHte-fk6$x1QADJ5LYD+mYe`sa)MpSiE||7V5FBk((s-|4)2d0oO?Q?!9{)>`1~ z+`Xjzg~{ufzmvRP#9>|JeA3vu$d7ozW(>ZW9L~B3dsS1ci)7Iz4vx|w*5Iglm7h;( zkx+$lR+Iw=u-oZ8byoBxvD;o_w+i66sGMMAR4Ve(I^jgnM&8~?IA6;MM@%nA81$i8e+fHp6endMw-xnD#nxz|7JI1Lg$JV8EPJha_Lod$1s4 zrsyU#pH@Ux-h6L@Rx$2FHmhkq!=o!NTM?P6Jc&{(FYnKW@zs}Cs#!JRV-E3kbVN5o z(Y00pW_+k>O~{V@+BNiD>s{WKvVo) z+kosO{)7XR^{~?9Ff1XyU}qn@2#d@%UwT$)aTC^!@QvTh3IJ@{_H6!u`%B}~Jp?)1 zhx2%wVEeFFxlLjFP*JfJWY76LS8w}J#js?(j-2XTo?5bg8O}WRwtPjttXInkY#%BK z%Vl-jhxy9d_(aUVG7E^7t>wp>{z46@*1nl{F%iAefEJmjR*)&BWZWqBk5f%MeKfp+;Q1Uu>8SC6D-heneTrKt>)CZ+=xNHgBe zMG4dFIJtvM=O`|NXFXvwy$MkfZ#KhWukM}s@)oeA+E#pGkHek{s;MTa$L8`7SjC9Z z&28jPkGJ5+sEgr1mi-j>jVY3PYCC&f6Oz!j(dsZ}K=^PcyJzN;li!0FUBT(;9!}6~XX+_4HWO0R*cvHnS5^=G{3tNK!K%Lxq z8%om{TPenjJWCBd;JCIm`DjvKj2HnYw}yjpGs@|XH|J@l-?q?;hU+bP@yf%Z1RdPl zMs9Ueo;tYqnxy1ot)Ud4gL`tvyADqmC6tbw7LyZeIjU+#0Eh{T@o0^(icn~*=i+)j zw_)+3HNK9O=K5OD^Ht>^*c8%Gd%eoIBnNbZN8J zyYrJyxx&y`ay`hf$bQMz;Ku2WPYP{`wjogC@6IRE8*n9OJcj#WK2m)iymD23TjGbA zmfTx;zZaMP=KmlsI$(mu?)sl(kkn>XAMbu{riN{bmZ;E_cb%E9EWx*eAz%)G%j7>s zYVe3>vuwiM0n_bHpkEum*baY!cfgrZSOndjN*nLU7ZzCTxs+#oIZf(p7)sZUi{0^z zkTwcE@wSv~G`O8!L^<2@;%QL1iw1X*Tiu?gXz)Lx!H1|qzM=rppxp7Uqf#1FI&#{P zoMyJhPg)HGj=lOb)N@>m^;==9fu9(q^Hju&=N zkJv@{DpuZLgh~&`JxF^k9Lg_333X2*Mvjf|#cRAPvHcls9sadNXkpziLTjQeXw-iD z$gS?iQ|8Ui`@bWW9x!kB0*=lV?8KsFX4WLLZZVd)+GyJRQ@1TGMuK3W8ky9 zZD7a3k2jF{%^!+|JV%X=0db02jP@qSAaEZ(Z&%#*rj~eLJ_4F*6XY&UP=8MVq zDe^7f2}IDng1R>?MAKBMLU-+tKvyX5N7~vSc+F$(=MyRH26dsLC|8^UznRh9-aV64 z6~%0g_a{-YB|ZSBCG@-Ul%AuHYH#g1YG$kRjt?Zt=HDsy?+B6);+>WsRn`C0Y)E{n z>9mDx^Z$6OwAS&#M2ZgKG1%3d&-}ZiL-Bj68|vxpo3=E!qQASjba0P7yZd*f#guJ) z7?BR{)?FA)Iq^6BHK8FySX19@hQQi$yhcYs;)8RV7FP7tN1Ua{S%A;wa1~!lgI5sl zf(K@KzjfVrbVNf$U5Vu*26?x5zcf2?Yj&}^)2jFyP3a^}y_>c*%^jZI)H~ch(B8D5 zb$EKyg4tW-se6B$?0JZWP*}?ShPH01{6#h5;_ck1%Jza?Qz;Rd5F@(^JW2A%5n$6bK)0EwO&|qux zL8qSzxv>2!yI<4sncm>jHj7w#+`dfFrghIK6r0NQ#R7ZQ%CRNBiH}*+TjGcz^AN{# z3c0hX-!l`-u=#;2Bh9X!zX!vj%$Nlb2QnD8&nl?&LJE?F&TMHF3^1yK&T0z?bYgE7 z6r4}nCa%Gl9+BV;mZ$7GN`cdT@HAWneU;7GCW$i^}=c=Eg^;+%d z%e(T5JzurwYdoVrLMgSEcoVK9Z|#bEGFAW75dZ$>ID#U}#zqOsX+?wbQ4_Ko!e zx5kpoZN7PKwq){k(UDM5DhG?(xo4ptlwt6K!H?r0*U6MGa-B@cfdIIU!MQ*hl zlY;!m3x5S9o06)#sYs55$?GI4-8nt_KEq!810Fp~BWhBNo&~{6t_G>)lNEz4WchSV zA1}Ov@A4}|MNjTk=bVC9cl;Z+Va$HP(|VDB_Y5z7-XLtrenGRaQhl8-*)Pa5Dvq8{ zf!u3A0Q0k|-0?0>#JUZ2r6Z?j$!XCx*8xvY8R4(c*&4l*LUja0m8l3(-5Ak070oSSy8V4VFtweyAAebJUeG}%s2yWh-sbe9qof_asH(-?A);) zso-_Aaz&88vIthCRTYCJMeE;$)_4LOO;ofyK24>}LIEJr%gi}5qcSgC>!UpshoPCZ z=>Y06G&3JHlTfQ@^5qyyRqlA#3F)-T&@(eSoosY?U@c8`ETfX6Kf`p#T5iT;hBGIH z`iT#yP4^hpAcK70jk_nVZ~|TD6)k#CQ}ia^g|_>9ZPZAeH1HUACH8jPX*r;sWYHikTTknQ zFSX#A_2A+18!Bd2V=<2rtN)mh`7Nvk?zw$_c`11-&v?4zHt+p_c|TV7ey5AQ!4CAm z{q;DMM_f<}AM{oEzNE+N6NA36W18v@yfvgcWT!M}gtvyEzbMEu>|dG&4VPONP@mb2 z^|^&`EP?(+P90xK^Ugw5CsBhd;nU#f=U*W?f`R4;qS-)GBBsWe3(SKtrVEdFQ#j47 z3wx7WK8uwNY3cYJErYzFXVu_pQ9H|cF*O-voB?&Y4f^rtMhqk+FYcm{j^yDnl{TF?|OUMKb4N0D&)k{n+k5N z3H$Ed8p18XFDzCz5J1|YO>R}C2lVz2-jeoRx#z=fuL~l%9L5VXsgbQlj&zW(O^HMa zw=v4w6Y_Di7q))%B?+Zgs z(QAt7+T=pQe{XHFfFRmr5e{vF!ufi<4KBdWJTBWO_T12(3wg%7LIwkjw^?w!3tre1 z7(6LoE~!B`BA##1bFG$&+v<@;_OxzQjjFYVnqJh*BU$STBq_c|a;tqjrTE&S)@4%2 z;G_U4zRDf%dPmy2N=HsBlqH}G3}{4z+0an(A1`#J?cp>BEOte4+sBRyR!!&VnvOG0 zz^(&}r5Fiti>1k<&_Gh$4I4(qcn-!~ZQ;A4=$1R3Wd*B+LC=cE`M~6sxH9jS=mLDP zNyZu%&0#iObp~uP9}951<;kDcyJV~IaDKrWm+;aQU1(X*&k8y1?LTL2x-mht=^zem zx&eaF?WE0@JJdSE__E_+&jFq_^>M-2SdrX-$-bF&N+U#Pzs6$=C zi|?8$TU~Ptxz&E2>YA-;Je?qBdjT(XO}XP;r>2dkbmVj?In5j^brzDsGOkSBXAe;9 zSCLboHzDR=OKS{K7G%@{vMkiZzg&chUWaBU*ON5)K94E-s%kf0n3Iyg$Q-_dzB(ff zShzwVX2gM2TNRwIz-_~l*a|X_%@vWxO^I6yxJKMk!1cr}xx(S6rM9I~IsBl2+a~r5-)iQ8IJam8lLPMLvGa>QUzV4%#1 z)TEM0p&_k`Cb!~u6~AxsEAd0#rg0suc0h*<8f6cWK|rhS&hkGPt!_mSw7LzB*Kf*~ zXNgX?#fN2edv49Mropd)MwirMR9u*`Y?uvg@Sc=LFH33ky%~+FOws6ea;uAZibiLs z4RkpqR_O5(jmjPGT9(qN(m|t_i$)!2tu>9X?%fT>09;5m-;)tz4(xVtcCs7q$+Esil*o)#buVYJzxFnv&>;HcfYKEZ%EZj z(JrV^49;ze*XJu=LF{PWqOB=jmoFJ;?d~6Gh`3f5(ZYwz1H@givr0=d?@iX*%VexO zy_=Ja{(Yo6kW<-30Wt)AR=V?3fy zHnDoM{@!qG7i3E!>AN=7O{$bZjyj@}A70Pyv->vPR(JVgG~bl5En2oUmR;{9i-bN^ z7A#{B(QP0nIr4-5n@rDFdRdo_hCpP}x(^j;>6l)MHb)KOT-!S~`5b}+t$$9mUOA8tC+Z$frTv{(b#2QwtQRlMRfTL6M3Av_K&@ zAW@|wr^zI`#T?&)(JV4)AAPA#v5%^uS4pwZTD>lwV(oh}#hQ0Uk`pO*LhwY2{ckg! zK(RaRD`BZlv5v$Hk%mBM%Z3Qsc+0$}92>?M7yiO8kT=x^er(VjVn*&A(A1xerVb+r znmP&xn)(KqEpuOL+rs25Aj(&cz(0l&Vr{5>#stT|ebn4o=4qA(HGR7_AniwPbhw|Y2FF~PM& zVb@Ued_@6bf^q{2Q@W{{;O$hr)CtQlPSG8`TWe9U&_ZX+Son!`&mHaN|~v_ufpT08iwiX?$mE@`_Spu-x;qoQEZ7nut+{ zeeA^{Xxr^?P>Jo?{3iJc9*#NM{Ab+*QlX}OZ2!(S2gA+>HNxPK;Q*Oo^QMj&9c_N1 zWcJ0aA*=zgFP=@5GH)+@rt4v|X&vc#EW(v;X)1f(&-bBx7oba~RCRyNp9b;UmR~^6 zYH=@{=eT~BO#Zx7-A z#rlW*=^tMpHuJFp{ovT{{(P6k&lkr#D>o5RQQ5T*6P2CW8*v6sV|mWLEBd?&_~%FO zl~L}S6uKp$dZ`Gg+RePNm8+6^>RG!8ei{Wmb?fI6TqpV2x?Ml7! zl%1+?yzz#%RVvE8zqfo3I#lPfyQ0s_cYzDk#jI`Fd^{P1I@OW7_a({4j2v#UvOdBy z{;1Mwi@{wgy$dF_@o9>0Nrub2Gp4RMmE!6JNfUU5E>&5~%lVp+w{o3) zJ=pdKb>GZiX%9A$u+G|6`y1Q1?A6y^Ft@A5kzBs3&O4e7Bk*6*G+h)8&uhv(4vjr; zZTfNGZ7VFfgG`xUe**_=()gj(*>f=c;x>xlBJ|tw>e*y|vL1f!%POBNQJgynJeStK z6E|PcvwO2jzWNDXB366b2ABDd``~ubC-LqvlmAnkf|oLhKtk{HE;-dt@s!?YhZx#I zz{avLUZ{S`2~>zHG;hU4Ka)PVBl!Q#aLuQM{ddx_d1B<$TGKF5jq~EMI7B^-o@yvuF2~-_~@N=y=Otw6n!nFiKd*E7yfQI_&T28-~O}QuP zbnrgV0}f8gSFYd<96VJ^Z}-b*0M)J}&_#*AOE#+{24x8`TqUP^IZqKok0%ECLJV>O zVo;JPh(V=JAO_3aa%~`n%)3quDIRYBbR7=@rhyhl>$LDaY6Tun#@ZThE5*b233O3H z?z|F$P@WLP59CyT$WsI{*As+%AqY7EK`6ce$!az6~A{<%-S@_B+0pm;`4qh`w9e{*h61Mw(5Am~KHrpl42VvMYB-(i47;$D< zSRMHs-?nBf(8mi$r2z|9D8%OZ#R^8zDM3kn73|fO`&E47TWqyvTkv7S>~?xli*C=0 zU#(H?v|9Ofxz#W6)M_PXBnL*dEr5|lyfn~^R}W2gr_x&nkIj}bI=K7smh zLuNA%^O?KV8N}bObShR z+|&8RVE|eKv5)c7KFr>JZ9DaU0e>`r>hgf*7q8>T34>gp_h0M^_WSL_<+q5&e+58w zqV7$80Nni&Tz>>?_HrX5Z{y27^7*WfGcra7Msmt&yzq9B+>c4TaD_smUPz*U7a}X4 z_-s!4OQ23yLYF0{A1)d6H$;t>5g6RdI9xtO06tAnJ-!F9H(7XuEvx>}IqyDl^-w>S zR_LQ?h3us_X*tR#{z)3+_B2NQ<)>-TU1^ZL1c?nPs;A0{f5t=lUv(_KNG%LYs?K=f zybMbUSwk$nOw@^3$}o8e^*{|uah`6(WEN-1(Tek`;(T*uah|a_uPM$|D~og4G0NvZ ziZkJ+wF{C(Z&KLngjIeevFYdFBD$CehD-ye#N7nOK)<` zu|~)*$ssSTVX=Od`uEyC7QiXa@#i#LKP)qcY_htC&r_G9-ZihYFNC9sQyunQksi&?rlvu(+Z z1YiVFubMstxsUu7PuKZ*;m!@7eoH|i&dN-&vWTl}*(BqM8Ylif2d#>g?_jK{{mwj9 zLcXH+`1d?kb4o$D(FpXM-0B~AY6P0E5$JBJl&>g2BaqxcvQj!mAUmbtOZ%i?Fu+O% zO0lw09aaaot3&yZr1h(ObqseGD`>IYQ2P^kdiYuDTU+pBI2QO7 zprt;!!BU^W@Af-pZu4QQ}Pud-6)Q+9>|5mSR8l6YZwhw~U(kSB?F4p{Fk?TlAi|s{P*< zU>ghBMvTv2tGrCzr6xGuJ2n^9Kdiv0Zw+!hK(0IR#=@39d?HnAaQ)z8VZ1dvORgE? zQ=!G9;%)F~&9<_n;xR2>`7@aux8&jpeef^%27U0aeEL495bJ}jw)krT*3fSL16wZx zoox+;xDwtvxL!w_Gl7NHqHOLg=T@1acJ4C})}puLHP*CfjC<;w$2!ogc8_LAv(V_K zdm+WN!C$x(@*&re)sUh&+&J^xPwP zoKLipNa2REJ(44jYxIGC7jo=b=KgK`dn2OK>>J~-2Z6AwWw~Qur^U)Lct-Mv8>THU zR^G*HT(^4^zX|*nE3DHuyTf-oum!k8vY(Gxw@^B=0r^_Xs}kddny1e3+@$wNhWUU;9ZKUt)0C4Wil}w$o`+>hY)3#5WBv6tRYh?;%4G zYk?rU9wecKLVy&pBF4N-vl`ZGuLsA1wd*EpD6oGtAYX~5y&0ydSAM9t#st{4|Tdxof_?I?&+L9#)ewY z(pSJ?NAu}e-_L6xj@L(Rpif(gOQj;=X`upughhm*IYw?~P;^df{BNjW$ww@r(a%fJ z0DA4B5Jwu5>WnmGxLuPvt2eKr&KFQFC%9K%=dq<7&2@V+&5ibC)Fi2TnUz(l$;+V^ ziv1@@b5rn1p)JwB2t+8CE~Nf;=l2jlHbZT_T}b8AXtag5Zhn1y`?Y2@U{myOmxtEg z-_5x2lF{g5f}l}Gd1!R*;zjv@YD{dOmvkOapWBH?9ML+p9f;~>^$JDkD2e3td=+zn z{(LWrTD;eG9+=-B#rW9p4~rvyR`{%w@0XkUJ%$oK<-*pp5sTw6!@e4&j@1q)lTezYcB~ zZ$W6-UaCg&6-d#Pa7aE_Pd+;tIRQGojfY#U^PxVujbbk_iaBdXLmMR@J5eK$v50zL znj;75{aJn8$g-J}rbYOYrscX3(%sZzI5Vo`8W!utrb3c=*Sl~1%*s#HY3LG1LA@K{ zs{ituTf&daCUP51kS(=_wi$l1zrfg>_G|S7->*~A(Cw}3z7?$nB;TcySUC{H;oNN(cV(j7aXC%Y!MtEIJ z?Ja+R=3%wrJ_YUG5R^Pkeu%fbpJdJza?(0ng6^6i{uHU*GdhwrjiG#VzYD3y{7mvX z2~kZe2b?K`PVcn0>{{g_5U@lHa%uD?$U%w2$G8BOF5H_`+VD zHPz|TuTYK7>0z=>-r+ldXTwsA<}_jM`}|N{`3DJ13(~Eb+()QSZIjTmD34e#5ew&^ zIBt?2l+aTu`mYBF&Q}Ef8fi|d=3>-`%B>#AQ*y(GVjoUvNC9Hha)XrwrGrsREp6sD zUtBG~!2K@(%N9ZYPhr>izY5s3HJh)j0qk&IwH`x*P!@j~AiLw2H2i32cv&wR8eZXr zb97?3uGE&=VZ`?sV`x|i#&nKOz8V+gj(1&|idlv(j<%4E-K<^gXzMOT4^bLx{5JQs zY^?#9^u9(sw;`E%w?zNJH{8#E7nPh24WGtO{6?|^j=jt8JbnT1QR6m6uPc+`@zW)h}XI7ln5ku@z# z-tjKQI+j?rL~*&a!;FX30XZP~g~fRbae6-N(jSm)`);KR{j3jf2Y-FV`tVzcP9Hu2 z$KT1RyWDhz#h3Wy%ip6~wYL+Ruej&&yw?OsK#MMHyzoCnw&}3R=*~9-+6lp}%GUC7 zA;+`&l5|}-Z8>MT*B1BNEXX*y9{Amvt1sTnIgkyOaRhMQoTAAN^V!c?46{GCwdaa= zgO7#X3wF4vPC>Pr>mX7jqKtF=f~j$*+OoNKCl~K&>BL z%Zs0=sG0H|t+kWnR*&O3hZ_(ViQy!)SH7YE-GC@JU^q%gj}*g^!nK;Pqs29!!$Hs# z`HH}aevozM_BrjYGfRxJ&g?XP95gd(CllX8gUxgX^MTQ4=}G8-5kLp6$_@InK{Lbk z=TV#F{I7s;9A)J|h@-3l1WZy)xy3RnIU+aIBHkD)vGub_p(#fRb+7*pQNO{jkJ|gW zh}x*mH+~}K@D6tBG0_goNwiDy9h~T=G?a_m zn|$yz{I!=cJy(GqUbVg*la{`n;II~^^MLuvX?z$9k>-Bi)%XpUc+nz(y}WEM1M`#X zll=0|=7Fx{_0#R8J$-2^>4vqLt%Ikz+*+e20fe*Y?lbzTzPNKfdLBMT7nOcEp;`Y* zK6?gTlHs-vi(_Y|>MAKAQD5&UlzQg0_>SJvNj5e9~RJ5@Z7~P*= zFs2BEI&F-pna{+hP7J+C^O-c~aQSHko!uDpJ_YqAOV0|O=kzsPeopagjqy)Do1j$U z+#~rDpZUsp#BrpPh9qc%;hC?T&(ox~XgW<%z5>oxPmamdH{c}s$^}I7=2VBvFR0WD z@u|mSpKiL@LU|23{4uMS&WuldC9B#o_7mIMk_*pa{=%5sR*0wZoKcMPI79hTe=%<2 ztvhb!8BgaCaQANG?mZuN`*zcFe+94qFKj{LlWE-2mYa$=a-vxwDE4)u`^y`Ac0y$rK4{_pVD(0;msD~sP3)Dl(yfC~-CUk(e)-G3`4sd!%zW~3&7`g(~ zN#q8G4h-;CGju=~SDzM$(M=St4}n;216WCKCa+mRC0CJ>tAZ6rf0{wOvGui~v9d@l zQ9E%=mJ4iyeE`hr?jp@)Jnt3eo1&R6vUJTpPuS~5Csz;zom_>(TIGSo=w@IA=~(u{ zE4rSq?syg{O%G=+y=b|9HZMrB;wH*LyP(&|tzOAfyPyM}o5)vNpmN8%u1zIbB_f*+ zvXLz`JK}8_Sq3mmtG&&qGw-avPIqcn?wm{Ox>G8+p^iVIj^kFxYYC!`*WpmdBUVq( zlh4FE!D~Dxti9!Jc~bkW zAw?&-XWpqLxU}x?|5&~5g2dZ?bGn4ztJnR51X1@JaQ@Hgu8dUo56i87h^Oj4q`D(s z$X9ij8`NEivbuL$N48E}Z*6qpBh*iGl`F)JzdV$6-9?r znMYKiYKu?Gt=`5{ZLtZUj?OX&6rkpi8>}lT9nIlxBDjN(_zSFzMIVD0v9Wb09>~O> zkpKDy#7g%H#3LOLh1y-j_dqb`hq(-l3LEIv6QDW2++fMjfN*;SsNL!2tDyndO&y$g zGrUk%7Z~-8#^g0x(hMKBO8K@$Y|#L)+Oq+kt-od7#dP_+elD;GV9UYKS^NU|Lm2ey zX~X4wA9VC7eCmYLoBaM<=!mr9okir@Y1a046N$cc500NJo=uz=`CUu?#b_2t%&IW* zY2q0jDD&|`6Xke1P>9>ciPl?v>#JC`{(W+*pW&(2XPIzdbeXlj0@V6)gVt9%-})@` zoFpmW2v(b-F`7SLxtGvr4VvARUZ{PR_`Y-q`Fz6H$~b zuK4L~YpiYm)_57uQh9-9wZ+zGfgz`)K}Z93mtG`$bo1iZRUCLNwfi&hSXbEs@Fd&H zSL-Tr$Gbj|jz$JsOVs1}vF$2aMuuJXXyy{)_;Kdl63xRGI~Bp$`#<1cXJG=`Qu{PT zy^1Gkd;>_T@vS1f@57ji7*0W!KxAJKfW zhZ4VxMPJa!yAIplPtC$|v?J6LZ)KZ7S!R2mM`pTMmYJ6MW|hnk+#MT5O7=C1 z)SjwQq}#+2MzuEju-xibd1`HROLZ7`5vu~!VdMrxsdVHdqLl30KKf=FpcwrYXu9LI z<*Pohj$YIU*5$=Zudc+F+Be9-mq;JjN+oVV9vpm7iF5nhr#iwyIX)wf6c z=#Qr$pLk24oHyJ(5&F4?oc|RC?P%A$tsLU9lhy=WBcF72$1*Fq?rYS@>W;BDTiuxy znsT{p4|)M4bP?76xX2MV+=KoR{9%+|AO3#sA%ge(&yAlShp99hulXiHP{_A&;5Eu? zH-10hw}giHHNTB1BmEV_v2iNZ98E@)r8a!OBe(i3p0bg&SfoEpx%r9$q?#i)7#o!i zVM~&cqf=9Ss-V-=yzTD+hUN-a)7kdzDs-$2z_vC z>-A!y6$Pjd$_<7|1Ej@ms1{Ml3CBFGIvR)3wAFJMQM4oUZ&!K7L1=gvW zMOXJY2&Zh84_djaZx#>R7aCz}&0tfA!ImrZ9&IYcm(pjE?Hx`B zsQM@|bS}MCDDmz73?$&W{ZwtCtL;|N793p#!>ezLncK`2z#*rX5k}+mT7mYQetx~Q z_S*jlMn~@L`G`gz7}YWxr=kexwVH*fMn1e^t-5>m^S~bKeH#YgEsH zEqtSX5$FPf!!U6w87ss|#vCovI5e}hee6*7<+m~ljDH91E%Ld1sWF!sSuP5(T%P2* zOJ)w%NQSPCS%GYqd8b@&XY_8M&)hLQo(7@Y!9ynATX!;kXYdPTKJlFfp7$H_m~K4p z`vk%Beu%?-eD7kk79&=?7Sk|4sB6w=O)Xj7H?=sM5=!d-k=*JJcuMNuR!!~HaTOq` zUvALUN=Hr_)Df8m!+x+}Vn67K7ige;fum%gd7V;ymTrYxq0G|XXitUV%)2GZv1H-T zInK)6_SyOzU63|K(-bQHKRx#^@K`Wh{Foqc@lzbuDE|bGm_j=}v!CFXY`DTpU-|MC zEL1Lp31MCVIUR#^vIj&v5ZQFBbN_mR5CGQQmF4x;aur1 z=-^BI`oM;l6@;aResdk+MWdBp5d^I~f#c`eyOHio{1zxqC>yM7)kImS2R$jb`Z!PZ zpdHjAn~(>p0w6a$3ji3*j%w=1(y8zsIk6XAbHmH8E5 z=iCed68_}|Vt|$DXUmN(yRwO|E2*V6mX(CSf#Q%&eB~=?LvGNrR?LKnuVrNDX_)wC z-cz*YQQ+?+egO{@euK6w<_?5Mwpd#}MG$TIG!AW901s-*D@flDpM8{{_Tz8k*U+xQ zv8{$l$_OqCQFfYO{a$YMH#{}LS}GimnfRjs;aG0au1ZHvwi@R9`I$7Xf0epSseCj& ztM*$W=F9(KsHr`x*NUDYFIq%rb-qbA`tt_e6J_cbuYn7+M8$hK?5CH!`ch}9vo zrS=>}c|<}&I}4FAn#_470z^e}gH>KbWQ(nEr|QkF;7q;QYT|U9?etPG^7QnS;$0}C zJKjiaRDxBc7YVr=^8!DWkn4csK8g%Dgxp;Poc3t*6$MDhl{?<`(UhMWaBWe)vQ+o? zCD$?Snkha4^woYx(qiSES~mDJ%Lbgy!Xq9ash4l3B0PZj@Or>$k zjc4>c;CNka$$rLKB>VXph9pf_W_#_AO6ABN*>5)?kajo2n6Bx4 zu&TD!oVDDrA@kpU*pQs*%9>UCQ&!fje1woaFgC(5F%>k6V`5fNeO1j0n&pR$VXh%Z z^0JIdu1A$zZ{omPJ=c!eZV=gc4dT{iv|#=1kM#GK_zi;qKc!t!quf&d2W`*D}EnhP;?+FIMGKqJz0AJzir-7c=dT+omyX^JP381 z+ubQsvBx34{DP7_iB0T*!HE~qk@Y~avS7nh5Q&xjU2gR+JjKfPP@8Hx%suLOiIvF> zdZ5ygllGX<=FvKgY7qSmD#}+3+6}Dx+k*bermU{;mfAl^>I2Lsd!{_LFDK=@qVL0G zJ;XyB^0J;EPWcnTyZ!lU@V#X`mrO3QfEn&?y^mh=y zwLsuo`Dttn*H?6LgU+S}U{0ExnK$Geb4oQ)={Pchnz zoY*9fUbGJO5^+LdP*iFhTRqKlY>g7G(AL_kS)phZ?5je*N~3TpUWKAnAUEh>R%okN zvPU&I` z3x&2TpLtKkhqcVSb0eLKW&%E3%xTn~VRZT*f}qoJ9Oi*iuz-hS}TS$_# z(LV>lZ9~PRaAAHqcQT!TQyzsqw~rm%8t*_XY&3rZ&m_7iMRxK!ug;v|dKb%J2{ykA zcA14|cxJrS05&W#CES9J;x^7Q@0MsweEY+>;Dey~d;9{vre(PVyG+df}V%rE-Fy zR!Oq+r7F24-kr8gO+s0gmKUN`b{aABZnOT4x}z@I4`E^pAsUg30ng1y2| zgZBC-_|RQZ5`WHNBP99YB~oQ8k^+MgI^FST{Y;1Ut#1IoGYx+&L;-(oIKf<6EJ(Jm z8^(i`&83xvx=g#=D(7dd%N!)C+>$)F=L9cx8M(oDpmcsNov+T|!!CwI_OdZUkppEv6j|GpX@(cQe@Eq{a<{SzvxmnhxYY{}7cHqE6ufo4rIYUfP z2b}%u8TNX*d@mFCAu_67m2>e}I5ck&W|?>^RuqBdr8#6({s3YlH?i;<-kexfj=Bf}M{{w!Jfwq+qu}^@#;S9eH$=qES9^%y=+ZFa4#w*O z+9j_TUe5$U$?xcGZfm%duULxLS53VVqXdEE`?cj(yLn2!KTOoi4nN&S0is^H0gjXo z`Cd5E&g|ei#fkxO>!luu=;b#w&b8TqM6*?6zbcH7WT03cm1k z)M0EE7L~QxM|vmPIJ>?xTUrZ81opW*B&km|By!J zY8hdejw?4%NHh$$m_j05!fI7%~PKFik$clj4icZd9=n`D{#KvEAoMu zKSW;{JQGpPlg1mXCJoJHRzVtF2KeepqkZ%n&~k`nHPaFuv-VIwuK`=OG@Sl}tLN~Q z4bA7%OZCdX+8X&&#tE$Mmdmqzm;cNo{<30*3$Rm7*ChYCDz??u6{;NdGhI7EZR3P) z1!%e^HyAXmZQOLtH_a^>$mbZ%Y}`OIt{w6f*Cqz@3)H;)5|DaQ3b>gBu8C{65}{Yo zA{QD;SKlITK0G$;rh=AX$&pdX5l_j{jUgkQAKK!_YT|nS7s^n}U?5d~!P;a33~FysczQ0e@Dft_2y+gg*< zx9b(J~!t3yd{YW=Q$GHB568o(pf?;7Mi%G3YWM8E50MuiS*_aTze z?xAx={Og_{OK;GBNS;PN7D}1 z&(!hgeg7*0bP8N6ug2JkYf=X(J@mOT#Ih>6-f5)FsFCfvP6|!;>ipW`PeIyEphIhf z(zgoN7C%GZe~@1v{+_3)s|53nrW}@&bKL8O-uspW!AG{iVf?s=G=-j{=kEGlUN{ez zuPi2DWFsCnfQS{27d8{6IqOggaf(D$SVX?EHQ%dKB$5EFV%3$G$gOV0Q(gHOb*-9p zEd_`m9te?5fIL+beo80~WIzI?l zn3gJyg-M?FEKD8GmEKz0E-Rg-N^T?`7myN)UD5700hr9R^->|A4GsVBUm)WTWfqbiD>=CzPeIvb)^s&OC*cw}`G? zo(d3RYaB^|fHibltCfIBcOKGJccjh52p<(^>5hw{0GUPSI`e_>~z`0zP(dE8Gfi4fg zfi5+Uew5!wsE_PuaNTb1GJc;xxE^E!FJImf)>1o=*xZ+8&;5DUREyL@S=CgFph?%{ zyhOvadu4020#`JDxZLV~JVo=zi{KUuzKQ}w^Kt{4S2|Dgm=A^IxHuz_CEtfcSUW_% zrP`r5K1_=R=>d(o{(#18%%cz^IsOCmRjoR4xyxZ$k}u-Z_X;RmdINYYR%&9^H!*A2 z)*U3XwD0&}+Rq)*D#BkhBO6H7-)taNfAiA6v|3#C3$-JN@2gLL<8JbS(XH7N<+3LN z)ZgR=)Na*x=P%kvM`=tC*ewF=LN&BQMqOKY$uc}yA2M*8K9pbXEgc_8zOv6Xg|g?$ zhF=GBYwf5EW`^Il3FZrdggeCqGsCakfPWjze)w(4W7$HjmRf}s9I|62*PRBU<@ABc zBA!dG6jLoP6|o+~w;O6)SlnR>s@rH-mukooy+|=-TVB|x(rE2qo>@CuIXW`qX802Y zvyKIDgBAhoDOTlrw~ol~j6RuMw- zchl7cslF`jZau`(858l5wF(=ilZI+f=%I`{W|T_hty#jgo`Z#c(572P6lj= zYVy_KB{vwn3}!!grRSwBBda&(rL$>F=AE`|<38k8;AU5TfvhIn1#Q)w!`efx$J*+6 zf@mwQ1(0k63FNdeC0!<+jlE4Hy(({mMSshv!GUm-;IQ&gclK{2MD2$1wHHy~rHkUv=_+a#eDk#=lMc9KBi zWhX5IxU$-6@5stx$L5_XYdb4T0ot*V8<3xsm7Xlqf%u?#`(A}uwrE&7v2O90P$JXBDR=e8e9>B8eNkP9c*%`M8Uyly%Qu?7`Om*gxX>}Az) z)UYHsDKzb6;oi;DP~zYC^?@qS4@Iey=0ly#hYlx>{*XA{sUq#^Q1nBv=d9*+#P3I% z@D}uB53&%g4YRDBG9iUCizDCoN)p$%E66{!l`)roo!ZKH$=k|!+1tu^(b>vy-qESh z1-3Huh z@HLq|WM%t*CC?PvBx$)-5H1&l?rI0UI%}fKlI4wo$%#kh+@;T^r_`GJB^_g)@xs$c z1urb)utu80e-cBxm&{CZE6wy_KcyLlP7eEvDKsA*`e-|6c-PQJiqFHFc^?~mE@bfO z8RnAG(^U-(PJ=8b)juL}DpVNbKFGqS%dBn8{&?D-jL-UXvyI#CCMK&@%iZ;&QEQKk z+p5a4_;iNcYQj?%pWY>g@eSGu>tc9m)l%+w*S#sXRXTFolbjaDdnx1Qh4J2Ur^oxq zDReYr*2$6iR3fzp5hBnWyq8wYyO`5#1?&88rWnXSnov_QUc4pHL*T6z9% zqI3C9Zwqo)fowuE<}31FaxggsNtW!)cWbi2Z4;VOal`qXTF~Zmnm7CToCZ!oD_xbU z-0E38rK|F8HKh*Ta|I_}5C!5ci@$Cv8=~T`N52kV&U+0Vw>#|B!HhlD_f zW;MsT40njv2B2Z3Vcje9PRXUgKFF6r+;{i|^diIt^wOMrm~mjf(aQ)y(8~%OdS(W8<`E+QUmp_(u6ql_=G zWbUclYVWRllxpv)zmFI8RW{Fa#wq#^*{~UEYDvgn>*z&N)4FcCQ)Hw{NdCH5ZuLB# zlE2t!9vFSX$VdT_zvPa0p~>eot(A_P7Le1-A_|xHQB=MvknQy-jPCJX5sVc#s@b>T zjCyTeQ2(CD-lBQpc|L=zVp(1k_gRXIx*GFoADs!rki22vN=2hqXBy)5m<#Yei+87k zx?V@hhrUe@6`Kr?q^?E0iBKVt=@uU(Gs`k4BzU!%eAEqGSp3CUliJAv(&DZMKCKBW zfr4gI_U@9PBDXBqJ;I6@qz_&j$}rw&ZCG-YXHA&0NK=xS6j~?!y4~}W>9b;VAL6Gq zy|?>&3sV2}p!pN=7Z1hB&Ej_!ei!rWWc@|$Y(-b|0gvQ;YO}UFmw~n>Pl?2irSK~0& zY0sG^QMScsK)tVWz7~1wl1h9do&FV@o)UG8rUpmcNR>J5u4og=hj29RYJ2 zs)p^1v0JtF&8u%G6|Huc1_CB7Ro-1+8?IqX!EQ&C-YKwVAvH|sNF<-Uo|@2nX1}jMoJ1$zmpq~ zl2y&06c{UYwj?`uV`=?YP$pWMXS4l4Wh}#H}y5@>^>+XXUepbCxvr-BtOVd4ya?*z9c+&)l@W8>=M_&vujpfk05 zzzd4GVU4>+XSWapoqZGsUT`;gz{mF|xgT1MgWK7xBK-JwS%4{lZ>JSdE}?p_828Li zdS*dH9r!6$F2y^{$DQ4Jk9ftJp4}3BBH)k7t$u{32>5KZvKU&vq5u)F+~Dk%(m}xC z*)5$@bufizw}8G5kbgaf9YFuOrl+_Zn8n(y6zjocUd)k$fzfYMY`&rZ&5Pv*r??Ev z|J5n3WBnvOU0vSiIpbQ$o5+lCWenYTaD)wph~v!$ZCfX>uB z4QIM;A$&cfvyT%5o!yS(bv=GY@-L8w?0*$2mx(BhrtBbw4##-1dOjs9AIU~1yLG@F zeX*38rw+lC?C6VhEPa|rIb_MRMhQl=^${+O>(Tj6k!=hdm6G$%j1-Ff3RFS8~|H60YK~hlTHTm+zSQ>K&Brw7H`# ztcG@qR-DaF(Q20NPtl62yBfCCK0zv9LuTm})$mcHY6WPPE;l$uYc*`~r)ZI>wxTF3 zz^d$EA7?UScNZP39Is-mt4FFvX`91aM%FOQ;j>dlnfH|PF~%oz%NyxhZQC$TKSJ%- zH@f~LLD2Q5aF~~1d%Dg{>Sq`)2Gb&ymQw3w0(U< zPCAtUS5xcx+)suLdOn}S!|VC%0Le_$d|yL7pHT|WS3XZ(Q|S4$=H5f6+Q8cG3q+yq zzJ#N;tIsL7F>-wX?{FPW%V)NZra4Hkj;36svicRd)i3gt%4$uWq|exZ0;IAkH&{ng zI&!jgG#lc+j7KpF3J=!N)G=)xO`RrKM{|W2YY&pv7tXjdqQXCJJyZc2cjN}^XjXX9 z*3r;BS5>ht%d;45P37%qnSV9T>XjNS%sjO2+FD;l^ERUlm{LvoI9M8%5hjIBF^`da zydS?lVE1bRLTH2Rf{mfvhSq*xC5ZNW2*=CFn!3x5z}EENIc!em%Q2K&dsq-v-1FwvKa z%WKkfw>pJ<<9D#kZ)VMyMYsk2`axoM5+gu^+BvWqhj^|mq8&kkR~MNq9y|SJSDV(_ zqr~^MK|Efe+F(|K+9*I0vfMyIw%RxenUMt*Ct+HuGFjWyRbJ)|OI1egf~ri9z4+>$ zLv^RDOkGu`F}r+4xp-BXcDrrSRW((W5%E++Hjy~fD(bFn)m7Aee<<_6tGic~F}#~~ zUQ}foflpOs6va{Xcwsqo?^R{g{%ipN_QZq}zx{!a#@yrGr2{47yqIz&t9H|*?VQom z*^a7Ad(YCB=yV-3oVEpnQ{Nq-Bfj*A-OTbsB=cE9&(D>?i2!gME4~KDaPtU;u zT@0}s>0;3(_<0q)NWn!uX)svaWc$K_Uk##5wxv1m(|rRFON z5Gl(Y@A_Q2<)?JybO1Stb8uv^ZE!bU{))lbq3tI2{E>T!9>D*u41R^A@Xxant-|*; zCU|$2Kp~bOtZAp!)OwMK%6gHyQ_zcCO^dZBNbhTkczua#`c3Oa3Xpg$H|RxH)1vhv z`dCG6%0hvrB(80o*EqK|`Zh7(oUhGXmh_Ol#E|0x&&CeFUs0 z`?X4Ut%V?Vsp{~Cbw~wB5R)4)9;<`1O63XavqT6QWLXOQ!W9a!Dzw|(Fr71!x2?;S zb~A>WN&_4QjkJe4Ke`jcWrLd}=QRZNXF(-bPO|7;SiUsHSi;)D`(2RwjrZcqMbzT^ zR<)ArGNqbmz*R6kX>Ye{tt?VH`A_Y#$)=U;&HfqpEx6&?N!`yZ74wbo_wy2wef>Q6 z2&h=`BtG>?Z*TGoAZC8tf1f#tocfHolRG(fBQO2sE59M(!l7*!VKP-!s61oO-`exp zx{q~y7igW`Epn9y>HPJK55dSJ35E*Ek5yhW_}QS;_cq1XurO%r5<{KtBVYMF@tw84 z{%-d8nsYO#XJq{9IfCFyVmt4yul{frS zwl=}ez`|bMOto}!Y4NYoze}oHLbWow1sLk|g4tTbrePh0Z65+8SA4S0{lv9FJnum>m@kzXCd5mcu(~l zq|YF|o*(h+@6N9H&u1 z;NcZH)qnF89^R*Zp@z#>6aXsZjCXNoltYD5k(3Fi&gZkB?)YF5wU2GcnAPXzDh6Z8)!txCacvYh zDYTCAI?i8foz~~+OH~YT-emiM1BUZg38Fgx!2##T!x5hmCX1D;#c%Gg9WHyljn`aji-dZD}-F}+I&R;68hu@gr;>Yo|dg_%_U}%qGbQNy7%5;P)7g~rApW)tH^=@PM96aK) zoNt?a&ymL=^cQE-aR9wd<>u2LS`RSFlunm=zo~RNE+}y5{q1t91)l2tSBWY(5HDZ4 zzMNnKMM=m++FY>S8GI!p&$7yJ7Y{SG?mg%JZrbt|^GKH*tS~F3VQVGxPRXO*Z~ydi zomUDtPZQ4e4S$Z$H7AaJ@C4mj05Q!%;@EEFr>QpauF$V3FHJc4&p-^Co*y;%7s zKE^z?GjG8O?dY`7*_l_C&inQUQYpk2p_K8*R9aAGvGNUh--P!{m9U&i0>Lg8F<}30Qe~=qYGn5GaVCx%f6@HLnGCdp1(Q<0gv&p=@5TA}m|7n{x&+|qV zKS8JMnB=2h7D0Cqlw9{5Hc}an+xm}5+P+fvUdF5Qeq#O=m}lf7J`28eA%`)Q@YaQM zlaDmzmfyN?9yS!squ0&|+!~EykJH^B`gz)O*xIv`7_?_M4()j{$j78ozS6~ad^P== zCDGbkKD^fzcY|tS?wwn5}=YM$>N;-wyN}RjziW z=E<#=cxqSb8nJ6x@5WvnUfPwC8}taJBPY{uY;{z$HzpPF9i%54*tRTplkg-7HtBwl zLGK_Q<#n_u7e>10s~O#0L)Ed(Mn-n#qScTXJxl|{iy3GKH}?r`XJ4E6@oez}nWc-* z=PgJZeGbp|v0a=OrYr?k^m#m?udE0xlemcUn4vRUG?W-BxOVGs*ohNwGVhk?2z+6` z4f>MjfUZmV1w38oY>JLl7$ViDg8$zcgka3JRGWwR(q3qUnlkv$$2=@&LHmcKEyFQIa41~ zj!6a|53`os=Gv{KkS8HU=+C4trRc$vY@em)F+|q<)JC zu758}9=9|bts>3!$*$i}z7cWa6S(E(^6B)pm6dQwQuwA~Z>-o482KLs`h#jPHZ|q6 zp05F|9!<7(*zg#=h&8>5 z7k?MFautW;xB$J1B?{wk+D|#ju(E8CU@K<-_t(1Hm z7CiECdR|mUGKrris3sD1@r_!O4;#r?>EEJl2bVZdT$J&`=P1J#M4hF>AmzML`3?bK zQ2xvSV!@_uVRGEv2nS~GbTbvWjS5V@FW4TTfZ7tiilcjeqfYHa)*2o_juv+E2YHVfD#9GO2*08 zx8zjpa)pKum-U3<#93u2If^YAp~4hYy4m9FZ0~44LkpgrGdpGu9-h2_N^HkWw|YC% zR&S$zOn?q9)AK9_KZ(kvA{5(BsTJ`(D>=1R5T=8amELot*|Fu zm}cj;S!<-@xTWiA?8_Q^w%Pfl(3DH>ydMO@-~Ig92gz*%XSqf}^x$XG%@$O|;aod2uH|4G-lg*63Z%+`sgk$HDC#6G~FW)O(wG^Lx#XWcA zJ$5D$?l%S#700{z)EsT&Dj`s80DoYNKWLFp3QzAELaP1lf+F$+LsI`WF*yqboJOY>JUKi!omK zYC}tgQM+Tw!0leULh(n|=MfOlJ!#s7D-_~sK`|XvOnk(iVut4 z=TaKhrSJk9a>l!uKRLlssmSN&){yVgdw zpma=Q{Xe{Ydz{SG|Noiy%+Act%+6(Z?P}c>#=0azB)JzQl}mCbVP%YVsWiK;MRG|} zAtWkY6uPGpx@d(WiCiO<@~M<4Y5P52uXCCAZuIf_{_)$#W8de@^SsXMyw2-&&g-1_ zd7t-r<7aXyBR&w_wmH2sX-kp1ir!R-hL9wECfk^rJDHYL6iBz^(^c8psX)tH)RTh3 z?zpB~R&*gLXatUt!*6^ckOG^2C<~a-J=)pj8wB}kLT4@-C%6FSj0KgX&XTawnQs5< zwwm@&;*`=8J^yOLdb$}&&{J;&&{H>0loxs?p?&a-*-G?5O0*)^{uYSCEqpK{q=s7& zsz+bM2Q9oW1%i`62uj@dhoJU=W59&IIg2Mi|Qe79Tx)O@IQedkq zWzlubw%3(;F_ThtO~U_HS1Mc8Rj(e6%>V8~8Z~Y~5<37s(L%0E^~!IskM1?*V0M#$G{T4gpKBzJOOVn9z2dSIxj0XVW03wjb>HZHpMC3f~5cplj zHoFaJu-Qliu$kOp8zXui1RemLRq#2KT@(jsCFq*J_b0qylVGZeup{5?6;UBJP?B=d zQB3{Z0Z*b0*_Lf^C)t4KhnaFps1nKWG%u8-574i;ZGnZX!_z`it8H3Hbs+1EqOfoT zu4Em2VYbe`GiVYxDF_f5h(g=6kn({OO$+gTI9^_%)q?s>ZQ|r#_7OFGt}HcLdB#y4 zh?aj8Dfwx|_|RHrv?0x~Qf0pA6DTwgh^Pg%iNQSV|^aHaX%%(TQBzYX=k zl3z;1ojo(g&#?)Nyc{h`f;bx?%T!8NtTxlx3K3P*y?S z_z09#N>s9XiFyw~W?f)8lGdVl#VL}?3t@GwlAQc< zo6$or#zoeg`)(vvz9f#dC%BbAnx6~{KC803~W)#oDeL`Q-K zF4ml@atLwy?)ueeT)h$3>q&%T9a7K+x-jDU&x6PcV02ce?LM3usxulV=Gxzn%zvBf zbvKgYbe7nRM*0M{+>!ZRwoskVmPYF#)49F6> z<)RJSpCZzTRIjEYm`)z}8&s1Acq>8DM(aY(z`j?(2>pV;Wjuc?C}>k(T|EBfx^Tv~ z2(AMbXe4buu}0B;Ka(19=WqO!^hZ3^5qYm8M@>S<;Y);Fele`^HQ8jt_k_&KJ77qGhntO=}X*}KxbuXI6AYGf&lRhiK=}BAD?Pc?oNbw}P zu`ao2Nwu19Hn|P{bCxC-C8=IC54fMg!b!N&Jm6_+g?msj9Pt&QYTt*t+EraYM?4l6MQk^Xh*TN;$nN-$+^vj3b-cG?s5FS1uT zPuWWed&f2-EbIG^|C3hfiP67Eb}yRDd1*DZ-v6c%dJ6O}<))o)xuvZ+I6rl}?CZv; z=<7p1qrPsM`#C$jvL*Q#ZX%wo9mEl^D&rp{9j5p;|3C*m zG{4u@P?NmL5m^Z)w>bh@b>iDK>Q#KZCLIA)h}MZ8qOcJDh1ZF3qJ5oxEx9vM0xdjI zXmbRV51eQ`B3aT>n|}{!RJovBpS8_l4?tiZ#Jv8B6q0A^#Hs;JCHVL;6tb+66F!!}{ z5uLrS(F<7L;@>u3qZX(7TK$5fP{4$_K+N2&;ke%L9M0&&IKvS8hax*{`!^@$Tc2an zO4}o>#60ARevjD;|CZa@^aOBDezl$CxE6pW@hC1hYzo&>ujrZ*$K`*>#E&uE!gJDL zv&SMNntZ+T^S+=$76Y^$q&qJEh=Hxd23nB1@8$4 zN^QaGl~3f7)>bOo7wr+kOiWzCerqYR!f!o^0PAwsplv;cC=M#YHF_;~ol%%G^J32J zh|tnwK0>whNZBz!ET^Dw8Ll*EeFjc~cHI+-2`dF9<<{$^N6G>wqrt?iIx-v1kCnJF zNReBClCU>=2hd!-zB+o6Szo0>ozXifRj#Fx&uz(ddj?6U+X@6&mpM#*tKbCr;TM3w z?LLPrMDk9rSGB#t~dNNT$CGOu$ z=e>-(H1nW5fqf?+5;RUFN@=3kBsEU{m^99+XO&CGOtqpJ+DZxwpT(7CXwQ;krmeD8 zf)Z$kMxjmbln*mB(mT#Xj&?#x=Uus^eoEXY&siV+RFx&nlv>U#;=C*;ru|6=aV{d` zAna={bpJOR|2F?X6)!aw3#4Dkc3*`g*!^V$usf}2T8WqNgKh0e^n)qo&3uh~*R$Bn zbS?T(ych1}YvgxB)JnVp;^=iy5TmdV0g^|wGvGAbQZvJTya2!*Vx=E8Sbc)J{-WGf17wxUeRR@6s$*^?PD1L!f?N0M-vKJxx{(?_UO)kn1J8<#(c ztNI#}tiFcEAe+`E4WjJ}oCIUM(%C$852v%ltAw!DjCPfhW zKO&1PTk=x{SO1rS+3l;+N*5J|9zH~C!pyh1B(pYI@(&t12tRd5Yf!;047rR1(MOHsF%i7?2hiQQb zpK|vA!fmy0uh)-FMm%BX8f414a}6+4ABW8Q`5F2@Qa#b}NX&IqMD4^o;^Jd^$;Tu9 z5RR(q89Hgg8J$3sQs+NG8?9OA8;}H@_s1b8RKJO!sfRE7)+w+7@kv1Cix>P1miPWq zKeX*BCqC4jKcKMiJzS|fuOQXatQ*IJ0HPjEp>6LU^kAW>jQQ~%@U|yF-+@<5uW;AX_gS1Bb z8R$Hz>@08`1Aat%qEM?K1;j<$@LTi#6!G{p@Xm^VM7JU|^)IFf`RPrFsQ37(?sS{8 zgTlg%xYBkQd?BUIzCP%%R)P}fHiyEJa`p5qhVp^aW@3p#sc5tc@*Ajj{RGAg5;cw; zz`kgA5-~wll!PU2x2c<)6Hs<`I?+C${V#iArO2M5&xxTF8B5Cew5>ijo)TzDnL^v6 z8WvgZg+&EYgmUwM0ek%$O?C*+RTS-dFGSv;+e#m|diVVquKDNfJxPN1< z8BfbuKo$&(%E@M$guSYn@)|Fip`cfG*CV7eAgUvzKf=l9A4J-v_+kI<60O(KUFfy= zN5Q-%+(hca*2eu}80|IWHogMm!fK;1zrT*l$Nc-H|ek_GW8MhXT1>&7cT%^O=aK21W&w!#F}=;TO1)!&phy z+Je;sysQq090r9Y<=)o~jPilgEO4TiWp?9d{vQ~e)Cc#z!Eb75akR8Oh+B!hxT0_F z;~)F^dVsH#)k+-1HQMXHw=OBKr|4VCCFMoyT1E0!VtFZnS{H@3*2VJboz_x`IPQV8 zsK3oeB2#mr(0rSZen{%%SXz~yAU47xD_Mf!z`pThEY^aAOWa=5hc1PG*hk0F&S)4jKf@OyOBt2SyJ?-e>W1XC;p3( z?t&hy#D6zZU|(HO$~xFIZ6#zUpnAqfLXzgkOaA^_>Ft7j&?Hq*Qq|4kP15=80ZT+a z7P1mlKl&7l&49EO#0JPm#U~&_Lu@rQbQ10fV_)1`Hf-JsV; z_dv`{G$+5`ek^Tvbo++nOs63-KY@nh0xi*joFQCCoSjb_g#5he%j4V{XDn7m%@%W1* z!&ZvTW;@CE4|7jzCR7o;zMT{V_lB-Ag(RyV#YcqdU|SDf+e`rw9}uHCeF#qKWSChh znLaueKZMgxG|dM|n)(He$N+AzG3v?5_Z;M2I+Oz4j_JPI61Yzi?a^QLx5xfO#&ls7 zo#C)t(P<6~B^-SjjS=4-qhIpdV|-s(86Knq_j!COlIA!#A_jAux*aidSq=W4sGkpw zIQw>Cxkr|A;(jtjL17xMbU%qRt8l~*ti1!CHb!)tVjn0CKP?gcK3P?~d7XglPS%S+)yKFuRwX2c@n z2J&yr#-)Er!s@H++P?(Fp`VR^p_-QZE<4?$U&XqNAPKt6K%jK_$$9FMazdB*t`2IJ zjw|W%HPYo*tV>FOE-A3-l5&}Q^Gy7Z@1pqgi_vNdp2W@b-F6*Y38IOA%$jbcHOECv=W)BB74uaV4F9!n%i$hBte&z5hz{0exACdoX{n{nTLv1!j*K17kTUKllu)Q0lK8Xrc26o z7F}A2DoBWL=61>-wx%0#KE;{ZY0IQX;9{ZBYM@u;LZNRdg%U~%rOv~y z%8XcWC^QZG5~W8-!ro{QsCky~-ASWQs;x5`qExwlM835n>l0_TlRhs(@IU%i$_ahe zpr8=nM`C@xP5P9+l@g#&3T*nMTxZc|d?Ra;4*()f(g8s1TloYa+2grDXtE|)s1l(` zZ2e~6N+@ZPLfZjATwV$v0Aw`Dj96r7a;NdFN!T0x0;rk0mGZ4rQ*8H>=`=T`Ek&JJ zm$i@tUDiebUE+O~e;c6W4u8r5CE~M6s8SSHYLsiKN`tKgq0k@&HVsmiQW~@pxq#xE zph2o4pPI^inIRrL%|UCFjU@?tqYnW^71jJSD8^1T?S%w!M(0Wbsw4HkYq*Yek%T(d zNAN%PKgx-!HlU!e9wi+%Lt>zNYt8&q5)~QxQD76|2ZKqjssVRJ#rD-+Hhy_Qh*^RlRRB00SM!y7l zw*E)8#bH*IO8qY+=zY;^S)ceA4(an!1bC)Hz6>wTXSXc}h0Ad zS>HyHlPMAvcTP_;Q37tBD6koja;X_y@^x_g`lY5YbT zO)N{?m!eKAYmEt%qF#xl>JB4kl2Vzf5Y1dCi)3DF7}%u6V&1+IVeS4>=s@YQ=- z`f5r+RuN9#r>vJ(GI~|Qyhc^0xu1T`Zu0A=;)hN>M`6S#gE`(rzgF{FG^AxTgIybRML`y;);I? zv7(#UhWt%OI$)5$=}0?x)i)h!PY7EP2Mpq1S#3rfFt~xtxE0E=5|lv4@lj~|rX$5UEDI8Ek_-M<03Y8E=js`vbhH#JZ=KyvZ~r?xtkjvR|G&o0PN= z^e<9I&sR$SKc)2Bq{Jx~R8wCB`#&Q-a|F1r^bz1h8*od3=W4E_9aw{0u$pq%|Gv4HkunVCh!m;kW*ywdk7gQu#uUXjQBGNt?6 zRsO2)a%VU4iTzlg?ScaK%I7|oh~NwZKK`8V59cFaXZE3#&+n=0_hi@aljW1I%$6(S z((rCE6`Hsj*LZszTN1r96-w@p`;MYclv3p{CaiT4=Dl5I|j>oR#7{m$Yz3U z-~M`z>lPiFc@Xe@{!P;NoYFijmK7~Pt2YzUgpWu0`oSc#5l#UPQG=yd%X) z2fVt`6%;tHs0V@x*8nueLs?Efi;{ihBs z7LlDN&;fE3nMe`66mXqYNLe}6St05}tx#%TD)oAMsfGisa}bC478t60{fhRV+4a-( zPugystA1ofv30&q{3tS*atB$7uHX*}k}LW!rZLg?;NMXAEmU|nd*QiGvwoxH9x0)E z5hq^O1g%^rp}Hp5vc8uO%lF_W7B7T?DEc1GT9n7ty0Cd7dLMi1o=Az)5HO<#8bh={ z6lcWjWhHK=OVqIkc4VSpMx(c%3g`VqesWyGuCk`+ISj>roc-&2I9O+O%_9`8`O z^!#uDg@wIwrRRqq&@k~cguok*fN17KVM)0b`tc6s1E*ue5>F1TM1KJBXCMy0L4w6& zUmOoraS9zNOcUU1Gi@*sS_u+9jwJwymkGON{PUPxIjfW6d5Z>uUWtcM>_do0>nw!Q z5JsWxj9iwj%+c`7i0h|Mi{nD2I)n z8Wp|Pkj%l&tR|g5aE%Qvcm!Imq1whR)He2FE|mXq5f0E>Pqum#={4hdU}q($5S~}& zcm7H}deTkIlq0Fm(b%Ysabu$=fVRd)3ZiF;!znDh1y_2OxRDxLEmBj066jeXg|@~< z`M`-98=hbq@nro<+{4LP@!MeZBn{6Hhk-uck=i2NEtF}CD!l;D8{N^@(Npd1kS0;( zs6o>CP3jW`G@Fu=dx~xYXC*lXfRCsh!Z8p^j}$4iwL=!$qdpW_OFmm>MwzlH;LG2J zo&L-cKczVr(OKIlJ#(&#f7^2x(yXnGy7+rpH*y;tfh4rikqDB0h7J-yGmHaNeuks6 z@r?qi{mdfvGn5EFLqE>j&rrGKXYwg5jNwXtrkG6sBl{UjAU{K)&GeM7l%KgBfV3@{ zsElpN&k#YuQ5YBRd=l+>co`|2x2OR0N;r6#P0GsTGG2xmaqUWZnIx<% zXkTNbcc**d-{xaTJ?F6BXe7aYcOdwO{q6*)?8i}Qzq^2zwjU*G``vS%;{=sU_Pd+H z!ZEm#{XS0Gj}pj!6x!@Z`AXSuEP#Kt9}yJb$v^BzqMwibq;TG%1n8A;u-|57KSIfV z6x!^^l9jO^GveBnvR@KDKl_n-O4)A(>?`|UA(CLfaR`$3qh)*azwrQ-{WvP^HvwpA z`%$8{-}#R7R4&IDK zO4&FGpT)+bprUd3xAjp{VJRECa9`Dxee69*f{mvjQ18}_gNw^Uen0$l5&mK9sYq4E z=BPCGeLzban-b4uZ1R9S&eAYv8)r!X`l{)43JdSWmA-2F2^o7JO1Bb}fL*zT6xxhU z`M`-Mbt%+Z?gxOEyZAZ{*Z50h%TKs-+R)bs-BK1^Lnt;Z!N{C<6@JSPS5zp)lW=~T z8DDQ$#Chf9C!QekgFl)e^5HTxLi6D=^8I94Rd3M@l2KL_&Eiw4>K)v!DS=uBg|_7? zuBumkn!;9U7M1FC#3bnd?uDnD#} z?n3wDw&^@d#6DMEe_%$LvLUc~u?*1^BFTNO|48*lFGFIkeSBMk7WWbUtD*`QPxMZg=^Y$QVI7J)*Wk+^t$ zi*SLwMPNo;1$|S%x2j24841<0_p?i2gDdfG8>2`KHan&8eL#1%(_$pSPD>CZ?WFqI z69AQ+I4bS56sWe-<7_8Ngq`TeKkft0bqh%4(k?E8PO_O!hNMpj$u+ZFZu3 z>J|{2f0yA`d=@$xk2)HdO@JJnh#(WI4S({8LZaJENaH5o<&ihA-Q`K)+(l1;UI~YB z^9yA{LTS*X&}KrG%&qS7)Q2aS5!Vhc6_&^SqSrq`EL@H&^|M{centt@&nUFnkMfVT+;3;|m^hyHsv)#%_gi=4F&}JkqzDz%3MqGtb{VWNecRwRF zoWo8pA_;a{h2S4{S`ARyiKEg^F99uWCrbQZ?L_60onE1^a3!u}r!SLsq6D%Ng*H1; zzO&frWxxg4c!{|j$#*_>k`j1|UIo390Cw7=>_jNpi9(y5xcD-5Vn$qrQg%wh=WQoa z!#V8q8j@hAHxT^8PHzHKcH*eC(;A?q?L>+HtDUG^veVlX7QT)v*=cXmPLx1)qR?h1 z%6Aq!y#-iJE=a!fv6Ga*Q}hn#l?1TUK4m9D$xam7?8L>Fu@f`mDwMKQ5KEKYYx!$|m=$%OGuMYDdT0C!Jmbl2f(HPfVZVI59Q~q)4BPN4x4C&7H4pyxAJ3o& zEb|O%KA>|vgIbQU_9phbln;+{uEA1dKt77P1&^Yp(G;Ux5hYsQL`NjXx8pHL(Ec%ol3D;H`a+>=NNV~>4B zoEbxrqK|>0!jzP)Y3MObf)ccB`lo(^(+N**wjiB9E+S92llK!ipGw@!GHgXM&LCSv z2Euo1i5PF@t52=c*GY;#1BN6D_;}Bv9RwukTF;;FKBTuVN(iqKAtBnEkNBjhWE$-Q z;NRbQBuTI@=5q=PKf#su#q6h!{s-TaQv&wIP++@HrCe%Xj4ZlFJx@(33f^@jA^GGd zIzFPk8`R7FWb>+L5=ZW8~>MGjzYWzyD+8o?;FDLKRDitm7{(UnrK~id&Px7I~kdatN^g;*!Sb!A& zzJVZxXn3GNU_mizTBnx$VV5%{DFQbSCgg81z%=f<`4J3>Wt!FLAQBq=11=%B;#uK1 z9$wO?FYN{YQ$cZ*zN(*KWo-QP6dyI+jTuTH(;6ilK{lIAv@DZ5an>^R)C zG3#9dCnAqZI~S2B`ULqMeGlV7mAaze_QJpISqAkKXLKo1%D$ZmyY=F}y%S03+xH`* zRj`1buzd*xFUj#0P2E*Q-T^QF;F>&z+5USB`2zEiBAJq9I}MaxE}_$9=;abVTt;r^ zqmr>jY7Yg4U*JkFmmHuWvk-6a;5YV1QD8e)hO&SOohuW+g!lK8m?iGV=;4)l(oXLe z^Lr;;LZ++`m!Mxi;rEOGk*eN8(eI#a+a>fn#U!122Zi*PBIp~r_=W*G!(Jpoe^sf^ zSc(1kRmL|;e|QiH|463Z-+VRqwgX6S_OywrFFjE%j>;VY&F@VT&{1{e8-??GqBZ5u zHciS(5GU@c73v3Vzj7L->>I+_%gERojPzsuy5ao44ufCguXPiZGD|+uzU-greIYU> zy)WcX$CobL>VO*)}eMNR6hIkzn5PBa4wqcZVncazH%iIQsc8)Sz@W(38Stfn4;lCEB zUnOHMEOMzsxRbC{vOXi`_}^xqE>+X)#d?ZnWZwWW^I@9vUSAngGCeQC{vMa;2z9i^ zW-4c5XF7H)HE`t0*i1Z#aQK{wT|nJg5{oW_f3*_dfvY?IB*pQ`XeyNR_AH_}+%NCP zdJbV9w&{;Rk?Us!uxUF_Vq^v^Sd3-ebIpXL_oRH72_2`P@F!epCUl6rCss2F#WaWl zoBb$@ng(T?&Ckq-8DR5s^4+{7>@EFnUQpQ1^`~-ee$glHgkS8-_4)-#sMiSu@;uBA zc-WnZsyzkG$PFvhIB5lmoCz-=$;L@J(Kvsjpb&E^Zk&gyaaII(D?tfpoD|q@rYINq zWP@K#EPGN(V`*ISV}p_XH*Gk=avP=7cLhC(C5UIc+fvAHh188nnmogs-uT67vpBU55P$cg5k5{qd?GIBv@WEm6DkAPB|4jg z;6}%8o|QM0b5QQqTv5pjyrw{9od0zW%Hd`@Zkb3 z$&_a~8rcKlY@t3}%k@owP<0 zHv4I{AKre@_+gUCrn``M4!Y~lx;u>|=b*jW%1!&Wjp#{G?nX~$ zh|`vIkKB!JL*KBE!;eaxM4IRb}!}5VV%!l)1Gj-CiNmv_J&ta&4#9^l*{M-7+pI~il+@@=% zHmaNPUg|q8t>2)2qXvyGX@<@gHjgIHA!`v|Jb^Q18#iDS5Nssg&U$bzZ}KmO4sdEtlRw0EHjmIivIV*JLv zRT?mCpcM5Hf*t1}jPk}%&Sr#AKlu^-t=gpP?-qwAJH)L6Ea4W#n9a-B-BWdJ(*#iV zu|$SA1RDBti_39r;a4)Ji&#B}@NagAbn)Oii(^^h&GH@;-Pa+WK4?mtLYT zFtUBUtu$RaxV*z$9&CYU!DA^$=K~IL%{=1#9PAXAI0`JnR-3)QtVGL zw7D*$B4n1SPr&A~=KUa*#BOS-b(Movs%BHD++NjnJ({(1h?)xsE4e`Hz77UOX@v=@ zMsCpvI+fa}3aNsfxVXha)I;XoX!170b|Kk{E16iGFLf>V{h%!vIq6U}UyBF8QU`B$(RA0PN-jb1 zXG=>=XX{_{os%Q!x|gw+40gs~kC<5SLQVIq!8V#4lMPnM(7kD}!-g*NMa^Z;QHN-Nex4%+n%GX0 z<8p(IKno%H+~U)_bbTFfXiauCy{z#C4)M)v)N<^Pp(nUB@<_lG+H0UrcHX)JW3(`nyiOZjBJjx6sV~=Zkgf&6nudW?(Wk zXN<=F7%j0J(NB4$ldzaeA7$nt`bCG9PtQooq5>AZNpBXhi*zf9@MJJ`*`;w(%BM$4>XlRmB-6DIa98<71 zj>DCy#ionOYvuTsE>`}i$GoFMb*!MDj*WyZ$**OJ5ulUf;A+sx*l~<#GWH|*$=I+z zbZQs0D~Zt=Q!=*y9gTS~XCN$HyjVlZ;uaP(BuB{(W^_r-(c{eHpE%Tr^Yq^`78I8h zYMuT(LB?u|sqi^}hAfdQ?u9mf!jWNaF$POJu@(1;zE~Wiv-un8Bq&D#B`t z+uz2hiM(#H*7T_5u(`CyeaiYZMdg{6SUH1o?81g2nd6BM9HJ>o3yRi?4kH~}tQ?P) zJ*|7iRsAKunqv8M2XhIET<9tvRt$=I#Nq$Y$aEBKT+S%+Uc>w8%{eLHYDeXo4^$^=L#2eAf>t$JygaPt<$mEXo-Y1 z6ph+C#GL0zYX?+Mc8fGshFdsHxxb@rNC~>5P0HBS`BDPR)=laokVR^3PG#-0zry@f z>a;D|B(;)UF#@%eQr-N8)Jv|odb!44hS!p*PWUDnyV}&_vMn;TiRjqO5*sk1Z6a1- zP9tMa!CDkc7xPh??3aOxvLCs{4eO=!>EiLrb?@$k`5MvH6t7_OsBEV%Vty~@e@{U} z(xYGG&^4NGdRaF!*Bh`?x4-9KGP9NZg&;v_~*>X&XY8P;k5TDRD8k&eY6y~K8ZBx5yko|UXyO|b^v zTh{WkNxE(~LVD_#ZZQOsQn^8K&kGJUc7KdiDZ$mI*VaX8Wa;{18ps9Z*%JCjX2>N?0MfWYY_~ikums#N_RGH(nk~AomsTp@rY%*hV`-5_Xb&LJD^OiY|rs~q>saBUG z9yK%C=S=L>cW74_C3D0!6YFB;iLK0C<=X@FoV5mK*K#)ZV6L9^%{O_c8O{L{TaBJ9 z%UEML4~O*B>fEBMnfcbZQOi69?ODy6#_QN3gZ-wk98n*fX|`EeyrAZZZn5hIIok}1 zBFsx<->-zxPu|1ci+V`T{wBJ#rmZx#ADpHBy1*04*sl8|T~HLF44TPcgjF^Qib;L- zn0zIAGR>vj;x5zAFIK)dC_XT;pOoF)qCQ428ZWPMT=u&jKb}&YtBWz{M{>rKK2pb0 zK_{`Es2jy{#O77<-XL8xM2{l>mo9GEuVXtPmBjYIcgk2sB^`Se^B0Ldj9H|Ntw6al zwm3~ZD`eh#+RB()d~=i5^K7M;n&NZVjb;=7W&iUU5 zKiLj87wXl8N4Dz`wjQ)gBa>Tvi@q=0}%#L8`7v$XZS$B) zb&KWjqEau*p?exrazy*dmKwpD{zu0SY}I4lq|SQGTV*_O7ViAXGBrh|S#mz<7N_pe z!XZ9zS~z#ajoK43aH&R86>`TSjRX`jZJ|cOgy8QLcqigBLzGiA zJs#II7XTy9?;6gP74n1OTwNgv^hPO94IoP(^E`MlLWGDaWG-5wMzBr}ZB&Pz2^kEU z97d)=hlKRS9=j@H0{AqwAyvf$2~jmHe*Rn1yaSqtIagJ*7AfJC0^3U=PYBkL zNNe#pm;RR0YD~0-E{MiLYayD!K$Zf*)5cpRk|)}W7laoy&%p~3O)*Xaet~n%Q}Xl` zUBoNQ`3=mwh$bfbi=8ZCiIQ-F7%6I_Nr%OwM#9_0r4Fja=Z5BX(HLci#ff&B&uGyK z2)-~2-zGUfBrx>=&1qHE67iA16cE@bcp9R~6JH24ebCfuA#-gOhX?^p;((_4k)Mu) zMR~)=;i%x8fU*(Sn31jF*giH`wj&d&IQ*c7_$#zs?q`{LKsi2SxO)sdT zklz<;n(7K!`?yAGDC9SjtF}VkTB2#{D`ekB*?#gwLxq%>zSC48jhE?Mmn-Cj$28JX zA-5H3q#Y1yz27G+@yab^!E1>II=t>ejdXED8TkP|R?>8LG~`^j7HXQC9hbS5AXfv- zM2H6aavhyGS0UQG%yqNl8rImWQAv}BGdFH!n$O^KCCyYqpyz9Fk4i|MnC2M9WoqI+V|r^o4?2omULYHr%3Q_b5g-$Q{ATL4+A+mN68?$xDJkI^$8s)xj;Yrg$1{w~ z!=09tXRTus$_k69LUudWI(9Kl1fv1b%yYc!IL;F8Gi9xFSa7~!@lmFvS?^fqa58d0 zA=@159Vv|Dcat==tql$jBSjdkWa;lYd?{p|x~A?M9e$?iZc6{yk;OkIxb>9#h5clngfp3jLbAN2OL*1GSMI>9i4y(vBrjUW|}4j`O|@YU#MxrGm`T> z$DfXVOjF&^oN)|GA$#>udOq$r;~2@v8Pzrj$>&_lZMp79nE=lH73Y{Z;~39ny{>df z$TUXsFrSw7`r9#^W$teHIIMXoiHS@roskZh+sRy2t*(rG(?%jOoEOrak*;_` zLNw(Z)vVr(V*QG9S>zBQJS*-Bg$OK0I(_C^UWD+CAHqQ5O>9?+sG?`XI zYYHRVpO;8o>q_epETRdqe+XvLkQpPIwUm*@??~jhql-drupv(~&6lkuAEJ4Vk=t#^ zi*9O}b5vO|(Zza6mTu%3Y;9&F?Kv&s?bcpK8nu#0OpLLy4Q!rZuXGO_s1j>6VF>Xz6wY^ zjDtke&01yM%E%n zY0vLjI64l@13jglrNYB=$l6ZG?(;oQR6fswFmNtAB?$#G!Y$~eHa;!{v~NT zIQylNR_QB2gye~5vf24}mN}y{cdyP6+m}I45&iR~?l!KU@8s z_b}22EsAJ@*!s`wO(q0VZ!Q3;D(Sh<(E@|?99S&O?# ziHvZ@8EMvC(j2!&I%hD_7CI!Fkz%CtQAPrXBu!oCDChHxxJFAPCPq0|F;dPT1oNIj~^8^nSk+?x#c7D&u41>JlJjRH%3hPba922iPfAo_!HY%E! zc+;5@APIx8GSTD#NevLqPOLb}TpNLqgztPOkv`6koB>8YQ8ay=#m+DzO^wVSJF^-2 z#mKYSc>yDqq1ocBz{n{>v(;IdktGKC#95UQA3XmX^XabbQ)hKX?uKuX$Y;*lEb|(S z<{GKTG&|wvHPVQYCv3Tza;_Fw8PPOXFwJb-Giu~YMot>!3ugyLrWnq9o!2t*isC%m zx!2i^kz#`!boOPWlgV|^Ie?Kr4RY8ygpop1))D6@MvfRh-#W)Lvck}O=bX&Q^u|)= z&Cc(fQyJ-LkfY9r8Cid+rup7EpOJnB`N4^!1z_ds3WrZKYmdyQ0a&0=II{Hmm>>UxNgqxVZbRb3al z9$_RGx9CLEz*WOFpOH1oHB!s^9TS728^xI~M(Qi?%t6aO%CIa~#BauWpyAGx~Q1^qc;G3;X z)7kY^+C(6;u8_zAalPvYMtUe@F_1Hid}ojwTp~!hs=)&gp9SJZmxqy84NX^9Am~8p z6RXJ5mx^w#Fe8|vbFQaFcUMJ57AfR8(Zh8iBbO@VMRAj>4kNV`pO-{W*CmX6q-b6f zH@liM5~(IRuMxdm?HO6Ea;+7;U7Z=(t&k0(k82PkKPo;SioUK9cYXS4gSDd$sp{`|2GvCk*bFF6NCc|f>YZG$e zeb%bDAA(l%#Ovflxvr3g{yanB>c;8e#137 zM7?P_o;66B-*y#+s5fN{*JZ79Ee%oWyDMvCBM`E3V^jAn3Yo3SiixeRSGcSJ2HEC% zi;;tsWm!ALcGo&a4l9~@W0Nw^<~D@+=D-$?kSE1QuM zigOG!<-?>6YoshaCib{0G0hRIz(}p`b5&!c-oqOC%2l6{V_4gfG+(~vNBR; zhe^*3K9vaUo$??fpDE6S%w?qYe#tqBw8}{$4>Qfzwp@=e(n`rgxgKXE_ z(LBR4e~bG9s@KAljFe|(E<=-@@)B#~_O~U?aYuH_8%&edTyxG&c{@yPWBPkZWCPQz zZKrFRo$@*J`P{~54wx%VU~PhYXpeQhKaG@ZB0vWmrOcjpLcEIv_}{-(QIgftdX z8jGf^Ap{aOPiUIA-M29EKwDk+cilrd*GOg4m{{i?!SV!5>)qsyQ0@(fu{o{rPT|2wg^_ z=P9>0o%FoyRfqV5kw4w(>D=l-Lx>O#&jn2LdakB%cybt7k#C79A>!loRAOW-))NT1 z$K&)=VdS+xlQfOfC!iK{-*t$SH_Kej)5$--ve;rIPgL?;olbXum3_v*v!+FbKTlsBh5WGGqS9WP&8M12C>X*?vqHdXyX~o^3;J}9eO{N-d-Wwp0pIw z1IR>Ze&Gg56BE6N2FUO>5^3$~3+rYJkwZM6(O2D@tWsFrgXP$c zo?T2+0qdfK%y<3e*_}QCxhATzV#49w&$*@?*16o?|8TB>rYw*5C${n+j48yY*yZz{ z=3HH|?)7pB*&@T6l|g!Ld9fvi?7Jpy^@jchURkbRg831 z^29_-@Ab^N^#kze@PILKrMDX+m2F6OMlLo;dv9On(+w+uGFN-=0H&FM`*(?4;~mFH zy2*8&cRVA%;z_%txz2k(Bh^qZjXcDhzl68Z$UN5JZiV2x4BiEdjIHEg8bTgpKF^@P z>s$*n$o~ve5*CBzIYzSHlr+Vnn|BqL)pMuh6B9RkUu8ZI89sfyZ!uEOhP=bb%c}I4 z=P1LQ3{}W0>oqdc`y12Td9g+cydslY)J&&F zMthx^)K+f+58{LQp4Y|5Gtj(7+?mvRZ^ND4JHx3jkM{bQrfC$l0D|YZ3K@YFPL24v ztd5UMBnFy5CiPr=r9*6co9guh5Gvh?-c*F%B*ap0D3f|Y1BJwZq%+cV6ZWq!p zRF-)M>@I0GduK9De}ioG&S#`!O--}ai+8^9H_`C<#QPM}xGOsppHICnF!IQ?I@dPu zDn{Nl$QRxZ87am*flBY3a@f0S4S0a(` zz29=Z+F{-+kz?K;S@R>HjfEIj@RZ&AGb1jPrIFtlxf$~WjhtkpA8M+RQ;bxFo;7kt z>JX*J29b4s@n&IbNLbvRjkS$#WQ$+C*^EqjO(^6yZ)HZh#vKaz!&`%qEuTx|gy&Ch zEk@qIT_V4GLa9+kX1%33UzB7$Sg!?~|Qj%8`i{S>kRZB^zPq>vU^C6>rwAf%u2vow;I zdKV)B^b$!kB6Tbyd6g`2%ab&E##1MiTY_A@D@p|WWmBgyO^%_tJ#_{nM{DR@1*vnn zrsLoNB%d*1D|HbgPyVfG#-%>PNQDX-nV9-wIqF{-SZivGy z8B)W+NIUP;)D4VWZIJ1yA2PDjAhS}pGO}`rrTENF-NwjCLo+*dHzQLF@@VQoM(V$# zb3K;&H6v#VWa%-nIQ1wa0n9w5giBL@VI+Nwrdgi)dpVk!UtCind16JXGmC6d!<6+Z z5TaRf8{XyN+2EV0-YoKCJ6@JZOuP$(Jaz_p6Vc$QS?UFxYj#7OYg1~~EV9=nEwLKL zK648YYKO1fBaxWcl3JUQui@n_nc0>nrZ$-zmPNzUr$D657)WUfKaYldo@iM2+8~h=Ax7fZ!r6CWD}6* z@bpCTso)#WNF!5vb>9@`d=L7Uq^aeb%1Fr6s}2z2v-_Z?sq4dw@<6(**GNO(94`Gj zh2S(b-(u!--0*4aTf(^lZM8hjeao39#mLjv_X;C7Rn#;cflyh_M=cRwM)vCAdzF!H zyCvdH9pb|mNKP=@hYwuTAGA z0yGoRTVi6muW9xY@Oe@p*!Ase%`^v5ccSs8&i1uoq*ksazQdRr6LWo?7-@ypE0OuW z>#}Js+8MTx$m717ndV}XYniV%BUhVT%YFSA*=TaT;LBsA1I84|=Oy20M*44Xh>`25 z7rg14z{r05BBVv?JHC6k7E2X^8L97Hrm1dnz2n2-{ix}c23hNy&d6z%3q992i;-cl z&NX$Zrt5uk8CizbE0K-91=-Y3r|;3ocfQBC^fAamGFme!Hi)c=G+WJ!&X#!iwTvz#hj69YvX@2)~^oPnX0UxL0 zgI#O>Os45zIA7y0$H<2?7k!B4B-i+}%afHiVjPr6XMaWJ^DVsk&8NxAUHnxTnVXYD zsxea2hE!){kPWH9Wu-ue#0UFQ{58u{-x-P#RwCW~^%z-zyEa08_w@8%%6v8$KE3?S zz(3*HBm8+R^BTnmZ;JSDW2D?MNkd4C`7}^S3`m@j z>IRAX3mBOQFCoi{`|l`EBkb3cu6O&)eQ03&#BkMjkoh5U*i}JRyaQ z%mj@_CNSc(Arl#CY(plMr}4cLR>*a($&5^UQzN7OvpCld+_g!XJN*wc@~91Yglloj zO7oPR`HJ^U2;gaiIdIoIppOh^pK zWf#yY#EzdOQY^mmw`7{Z*gw{xh-i-Z+cNU@XLySN$PV8ze>X;)J0$X{?~H#eBYU<> zWUtQ?n18_pNVpz%9F%LXFA#W^X`WKZr@m0&B}PuDTswT}fwwrx!oUY?ub*KrNwX;M5!2kI zat-q@3T)=Gda7L5H4)g($iN;l7a^ZBvdf0-VPuaj*FNSv-*8?WIK)U_gFGJinrpE} zz4a3lO9Dr8oRHav@r3@c)&#_Z*3z_y`UI`TtqFXe<3tO04`cw(I6hKHwbmNh5;(>* z{bCx~9{7=w+i%p!uE5WXY-^^GeSu#X>4_aI^cNF{11A{4q>}%N#n*w8jPz)$kskuT zGjc1opU_{iI1xC_$Y%u_`6FZS!5ahRGmObatIc%-Je zEG?apzlUk0OR+*7! zhv;0R(yB7@k*URRJjha{hvxGgxQ zLJE?TJ}N(0#C&$Xpvx*!$Rh^1CpeyI{$8PJW&|fP;&@RbbAyu^nQna4W5IhFsb~7> zlHgQ{nD(3>F=N5^!Pgmy1vSmF;G2y6fSpwI7ZX1P-(n+QGT1DC@*TDD;JtCzUgytVrlfM)s=F6VG8odn=@% zUz|+UoHIlF%gB=*I>Nac7_H`njxypj8mkccfsvO7$g+w>#n68k@tSex!q88Q+-ch3 zC86VtB&~Br=vPK&n0j3qI?2c~gR~C)!N?kev<;nMB&m&dp%O;EGc@f(q9TpUe;cGj z$YNx$X=7J~T#Q^$TWjpqF^`6xY{$ zZU~iQq=nI8*HAVPJW(u^eJ4+J4_&}Cqm9hHfRMfJGgj^ss#uZw@(oio=f0sTWhCrR z2xz96mM|n#t4!%bL$w+4Hqd-Yam7#e!)VB=sXlMW< zS;lY758cAZ6$W`MG=veCX+MiXd5m;0G>?ZyFmi`Mo(RQRo}kIKER@g43FAqg4J8=K zR7kOSDKv$V3(b6NP3XQdG#f(qm!a7dn!(5zH6O#9N}*YdEHk6$p3po-e1`Lp&;r(T z08douZ;1FYw2*1OFyr!%p(R|eD|h%EM%Ee$gW-1>*?N(t$qKJ$KKK7B+iFZy3ctrRXE0J^W)6x0w+7>Z_j3h_=`y#(E@?0a$XIkV0BW=v={r<>F zM&2}hrbqr@fWMhK8=)PEbbvKjeYjg`gX%g69X~upm)-*i z&sR4{2h`3z5Qq;nEAQ1b1JkczNRi01%G*B3lNg$L6xgmY*WaWQ+2M-(ywEhPEW~PX!8nLf1#{9Rv{EJ z-OTiMr{7T7h0*-haWdCH*WUD-*vh>($y{Sy`_qT9JR=%Nb0u5d zSLw4WL3bvW%@W><)><#L4vMnC55?S$82$r9aQe zG9%Ba^w$}A5T|#^zf!4K=cf5z#$~Y-VjFNBmRi#~3-NiYgXo(tl4@RmevrXEGTX z0Y;LmJ((FnMv@X{WkeWBuJ&Azk;#Z@N1>w`rwJ11>DV=O@b$Y=uO!?gE zYFp5NDRXVj-?89WuKm$VwDv9qjhHh3Na?VC?t+5GTAG3CH;FSF1MC^(BLv5?O~H@Kh;Q;JNh|0y_|DQ{b;TMODV z9=!FhF<$FHB)6vQ%}nvpx!((JWy)_hGyYL1phyqhW2 zZ1oi_9C2X9NWL3metxgQQCTuq4Jqwx$C_U_hWVUly;E2?HmlUZh2uDnkEYfwe1s{_ znHQroW`ZR zJZBcZ#1ubH&nkR5t5lo9S2@ox^8jZT&dthmPT}iWlum_jaw+el&M$nIDc=8dEnLJD zFV6*qOPF$~>F2`2rCFSN7k8mMOj!M;0|=ir3+> zMaMJ6>##}DiA)KsrA>>PFvW9jRdfndCLbyC^mAtwHD!vgt98+7OqptZ(WR&bQ;xPC z>{fIJQ~Y_srA4in;?D~%D>{oQ{w$z>Q5&Y*c$n6Hc~Lv2Ol+q58CcYTDFaSZ%GE_3 znev-yb!btFDK%`DbZgPMO!4yEUDTN=zQ67%I-e;Y3S;!w=%Ndl@{qOkfuf5fkBz|z zMctWln%U~)q8?0HU_0NZiZ03O)2T(hIghuW8ASt_;`eAT6%Ay{5{ui+EV_~@H#OC^ z&n>!&DO;@ecZ;rJ%5@iMo+U+tnX<|HeMQlbEO|aHx`Fd}AGNM%7*o8D`m*R|ruf+4 zS4Fon#p`EN(d|sZ&mH)0q1#$?CsX>_xY$uNoGHgz)M#hXJz4VXDjJbRaq;`Pl&?K6 z{t#1kN>%8uz2grvC1rJ0j!$5UpD*&`k1%C`dA5T1l!IvHc`I%t(qBKffBf;R+H1z2 z;!?V9!EZ3*)0pB{DRtsAnBse|ZhR(FuBAy2__@d;wF|G*wEw_`6Iw zs+&?e#uqW=KQ@-ni!WhHO@fBHl`ourX%F{Q#Dl5;x z_{U6%7@sTRYnkHbrt9LLGbJ=D^TO z>&KERVqH7DIL#IjpY}g$dvmpQc7`g6Q(?2Gf|D=Q<&1m;`0X=H)YD~rdq0A@o7xy zYoq&!;ucJ)YSGjN#b;#6d}48{1jUF3;ROTwyVRXr+=fdXJykgObIpm8NZ+-!E+6nS7o$ z-LmkWcV=0_yTv0p z&%qY)SX6u;Q~aF!UhzXrS$~4I>;2+~nKIM-;YY<2m{Qa9^J(!TOlk0(mfBGKXjbiC z6;I(j-qU_v`~;7S4i>xkw)iQ|b51xeuqFv9gN*WH@iUxfzEOTIp30QKYTsG>e4?(K zIWX$Z9!g(EI372-TYXJmFru$5&V#NK?uRe&J26I;zY-LSO&;zzH5IIR8Nb~^-c&HQ zR8V^A#3!S!9j8tWQF`j-c=NiHQ|Wu7g6J!wgwpe!@9NnWE3TM_m_`#hrB=1X5}`=P^e`TsP+2x38jGhA6r|MCm2yTR}a!#G^|T zExub&dOrHz&!wD?zL82OJ(XJCPwHKW)fo`p+Zc-9{Im4uEyu5~a7q|)iO&?hwO!H5 z4fySCZAxuhK7tpH2p#t^e#s0jdG00LCBK@{6hmVl!Ak*58!;~8Zspo4;x{J3rT>Fb z=92He&5O8uk=n@R--|D9K!Qf@lmUu%Emlo?X8lUa9<$SPjw{R zp(g3^%fyE8ZAC-3?TEMsS-uk{McjBsV-`5~IHOM{;JX+=+4`FWS}LG#+X|v@iwdgI zQBaASgj@CW-e#Vo@7+>rp4;`i*g>9)B1TTF%yUP6CA!CF*(XYEd9E+e8(iW8)8B`n zEo9njp(fKcJ{4yY%Q^L{cU1a4_d>3|yy6S(->*z-<<@EMkGweIK1Ll8w*tR>e>YCj zcPzj=wp{Nn+-RV$aUvD1{EE^1%OY+wqX`eoNWt$IU&L39nARDHtS-;pK3>LPp8E@k zEH>gkd{Q)ouZz4EaX&EanCemjUpcBGD1k?S#2+NwiLg@|WeIn{w`vD_O3ibm$(`Vg zc1(`AU5u(d8gYAlLp0KTc}8R#RTxn(6fmOR+Lsaa7LDXQHxBv8Bjvd>@tgmeoVq`L zOK~uxiuhGhT}I7Min_xYy^0%U$1v)DFn;&W=z82BI}r#HofdVcGP?Ddh-<-U5aesa zh;-VK5$W%IMk|oogAr-+GDZbJgBbb#@V)TY3p)1eER6E_P1pT5mikfasJj7NN`n_e zy_5zuLcNp*+b~i{8>KQPmyTPl|;>Dp(>}4qnp=^_=Ha&v-90)U((r={e7-p2cEG&v{Puoaa=} z_$|#ln8a2XEvVaRL^3G!kUS$KqHHdxc0x`cm0eWLkY5ogiB)MOgc>l zn?iq(42oumPLsi+7X&3-E&Qf+5tp5Kmv~3`(RXFk!m97one!Y&o#INns=1E+3lG6> zt(i-$M8vIR6n_uCiP6<-om&T#?z0m!@r`!SQh~#YP0;7v747JcZ+3HPKUjpI58hPt zIo1b4I|l0mK?|EHt>Y(x(sdBMPupACBtHkJ<^CK>w5xtxq2P$zTpG4v52?eOF4p2iE9TH)bK5O{-h~}sx zm3&j2yq|m0d*+o-@qH8S znZrJo^+qaa+Er-j`DjH;vqmbY3yT#*t3yKR`G`jIQ7Ry>Oej5-R+i+8Qvu~8l%Coa zD|wp1Qo%sN-J`uTr594c;aCF`Ej`~X_z0TCQ^CiJ1f{1^i)gl& z773yj38EGWA`KBrFH3D}#FBP{zY;|2KS8wq6GZDjL7Q;jRnUa zQ$v~G5^iw=MMH6y_<=a(tNC-p-2)VHi$93+YA(IKvvA3`6}OjKDTuyHDyZ41*sF0W z`2#@*87+Fd(xOJA@0Uux$4=2y`jV;8rWlRBcq+8pj7Hy06GYM^l(P(EVv~5PCJ)+S1n=G`;5?VE*J-k$9Szu)!F163Y zz)gJOSK?kAE^CVtchW729yHqVvy^rV?iomlKZYq9W%=IvNTe!p&ls)!IB7?Tn`5+V zD@eV`U?Du_&5)&``{|mfyQ&ARj3^#KJHBKPyGzO@gSer(hRTKdO9nNeH7Z-;7UASg z+BN}kDnbbt+lj9g?@uH7>tFB&5Rdq`e~Y??p!qSKaEqXgUI!4DC9CmeK`y%xdyP9m zOE^M505x=v;P-d5r>pCdSIP>xu4_9G-ws5Hx^6@7s2jm35~5`AOt@-E2IoB~{-wmV zT^(`vAz!|${$tcV2~^^KIWXd;0wowx9SL{)QBn5-r&f4f_LBLWIvccz8=MafG1}Ba zV+BPB3BJv=2e&yc3%T+lA*%7S(#|kc{x79X#YkDiWru#QXd@y@LTiZ{NtRS_%vsWo zRB*1LgU=LNGN|54(ZrUD78v@@P~Wg@GMI3N<~z-3|1sL-#xKuk4;U?Bv_DLOQ;k+^ z{JMp-5;x`6s9W(Z%_PSgml>AtODj9lXmhOWval>H7JW|Z&W7$2L)ESjS~BQmtNQ8~ zgJjRrziUx1b`l#jelYTP)$aR18<3iC=l|(kk3*>U*T=9M1Feyp-WT&xU9#B6>*$y+ z_lJzPgwtI@!o7ni360Q%doq+D6*PE7cKNA*W-F2<6^w~VJR%jeM=C`oQo%)|1=V%S zPsJNf#bo36;kIFQpoF^~YovnugnGA&y1#H%UgB;$9`Ch+R^r}yO{}xT(Kmm8hRpeH zZsSw{`MT;WtllMg%4c%6Zt=e4MK*)S3b1sI)k7wFSoWY*Vv~q|f zh_zP(qW-|@dZpBxaI}*W}RP^#3#xJ3So6;fbo~uJ8 zzHO^z4>c}V!Rn+$>KVj$SsTp_T>)L4%e1wKV^Z{z;sn^&GKv9F%rbo*qODeJY3>%<@9@fk?!3>1=%{9z`XYQCrRKSdu>v4T^W4y;ih9AH3aw!`(N&)7 z-BtFSd2Yic!X?jj9i{mK%+pfh8Q7n+ydGwuZrsWdhIZiIuF$#|?RB8OobN5vA@S2s z*Xx*`XBs-zwARkheCU~a3*WN+Ks7!Tc6AkK3D+)+EGFEg#_xLA5cS93*+CJ;rPzV? zetMt#p7y=3eV%a3BN0d63V^RMS|^k)x^ zzU6As=VPK_J0@SKV@6kfCGI(_;TD5)p7YV)r*SeMy}ufWMsmcRYqY8e`jKEyGid)nV=u<}CHikhj!g=gkMKcVIFkk2G>WEN( zbdCV6@fe&BB%|?RAc}w^`nyTSCA>7ezNduL*4@kodY><6K9#AMx04g*r$$ z+9`d*oNFU0NgfVf87rghK($@n)1&SWMvcQ*?p|(H3w$DX3*{ToTQ&LpyE>P3e+_;F zsR{S#erjt)h!0g^T1m(+-+j4NPEqpR)l0-9rGhIuNN=TrcBP8u8SOBmz1dMy>u-|T zITZw7D_VM%q?Wi|Ct=P*y(MlC&>=wi?)Yg@cQnhgx?9v8%jocMZ5DAlry%Z7N$q7= zRMFHBCEUydWEGjf3t2Mv)ODS)#%#j;mZIen?P-LTH)Gmg*pr;Ws2pgm8SS2mSN3w8 zOq~S_6Q6woR)>Pl{K05ABM_QD!J<7=d(?qG-=XIkeQ;VJmVJkz`30zv^S!qf-{56b z?t4XFfhL?2pb1*Bm!4~EGjuM{MO?NH{DzE$;h;%$Ybub?1{flL)rU)L1(JNHLc2mM zG>uonI)YX_h#f$JtGL7f$SiGpx-w4Zu#<)*;-5&+qmq`W2wA9X!o5CCbub>jUHH8m zj#`PxQCY+`Vc9n_YTX6z)^ly6e3TC8X3(%RG@HENEb*vw)Fyv4+J7wHy+-SAXsV$F zX4zjDnrrA2LshJfdWISrm%*0rLPNh8+G!=8GpP=+vP~`ZVnf#$T5hPEm6&U^&PMa& z_Yk|GSTSLC=)1>bE|k^Rls7eMBQgY>h_1WKR9> z>|VH#-3!WP_wQi!`XtvuBjA8=5adUSxAt5kCDZPuMUTUC z&E`5jxDG31M)x8b`W{fiJV?U5y9*S zdnQEOS&SC!joTuO24h`E^5r`^o9)Q7gWkluuZ%WK#*GE`taGsc6}0UZne$5AfqfA{ zL%tH%-q87mUhku+*BUy)QWqQTM57He+K`ZzaGO5Rdgo13k52N5EFIqwlx-zFAeHP` z1d-JVqKLI1idYMxb0I-wyMoA`1(A&lB6}7@wkwEEg9Ooek03f-5=3!KK@=esMDb2R z6d@%9pRpeEFC(vex^-|V)3lX1>$ylv=$(Z0mXj4z@23K?c0%c?(I=y92dRKwbs&pK z1vCN#-P>4DdI{o3_L2%HRV?R@0-5*o-1!(E{gH|t2fo22D~deq?FBuF{WPIGx36D& z_r{tZB}&|kdnNjja9<&wAhUC)3gE>2?hB(I>9Wv1^mdkI5qzDX$%ZDtPK7oIIu&$< zrS>%11x9;4uK8Zc*Rr!Lb%deuA;Nh#_T9u8BWmx6yBnyk8-)0{L=oqND9^1yiylC# zM~ygc@i5a=8xi+)sEuSW>@3kiGMJSVl<%$!*Qd$ggK(Zs1}($cw8Y(fBH|g~SK?ZR zE81l69DE{aG8udu&dEtzp(F!cHK%j#3X70cP~BcpHx>NwzNyjXUq(9ximxpSrAh`J zTT2}!?uQVFPEgwd+;28u>Gc?K2?0%ZMY`&lp7sU+m6UxebxszLY+#z~O_8L}8yEye@ zNJS@S$)NdtvM(!f?_vfbT8TTOqoU3iD*B?AAUUbt3w-i*U4sEUk$gnR!J-CO;z0w-+Xl5pLzvh2XMPqM5=ZPzh+;d{I#j8wD}sp31wg)1oBSFEUG-=`kgc)jBSrbx0nK3fzD6{37Nd=5$6`kNnV+nU zc=k%BCE%q#W>o7}oL4aFjyd@YM#q5P*NoN{Mcj9cJ__vxH>WnMECazsG<3yx_(l}x z8*TCpM%iDO*3@V(qwL}&>A5;=@()fOSVh}gf;9+PELL8~C!DKWEB_Ng%J-DIVyULi zv())k$Eije4t~OAC}MNvQ8wXDMJtJxa0RHBP|RIf1CcT2+-8e&2QeCgbHC8StmR#y z-8!8534EAX$u)>&P_H7Y1yr9?>FiU=;tN8d1T$exM{{b8{D?c2(N@p|wFd13rrl@K zdyVT@jW}PMufx~tduEFD`4(%3*Pqu~F56g*nARyQ%NFQa+R?45^%49t(Qx+&nj{@0 z+zasI%~2xZ9>MxlQnlsjqhi-fk}nn9Ixxy5Qo)rsD6KtKk;Ekxth`TYQTTCs?2Dg@U6lrR;WUHV zQ5tmHs4eeVS&_GmD%+(*dMjIDZPAM5YaOD5`x7Hs_zl5VPeeoN;Y!@}KclWKO5o%g zUaAwLoj~0fog8|3to44-6=SE6hTE3q)ysd_DdH~S5(kHUjoPS_-M<{CveLguSD-+GLr zp^Pe3jkuc_9gWd*JEJQg{oO!lAySD8_Ex*#?|Tq(h6WmX4>FJ95+imvH;z#XKIaie zC+rn*k1@ImQjwM52CJ2Q7-Nv?NbjR&=wIT3J=l%W5Pki*(zalwAgKcp7a){yub@RV zR#U-?JEa#A?)Z()JKH*5?&x3Qs zy@>XThPs;{(%!=DzL0Zz+vs*1`C_@RC+OWNhec z`bs+vIv@#BLF4&~Zk(y99e&pmN9HN|`5sNJJwQ?NNKJKDDsAxs<@fkZMMK_EbdZ%e z?-ixZ+^l7fU8?Afw2Cnt5h|t z-VQC5Ht|eFw;Ni&OlcP^R@BVUAj`Mv3{Cwu^d;DTtW{b!)8sK$@4ibk^%Z;vNi_cE zrP|87jP}-S&3E`&iq183vej|ro2s=bhKBW4e!HGg)c!d|HOvlLLRTWe?N)Zu8_Mrg zYvrbSO54}8wms~RRIp@{a=H0Et>YalaU%S))Nz1u?ryc+)Kg15+gS6Jw|qBPdv~nT z)cY)7Rou%E&QX)}WsGT|?LeeW(1)h`^;5OBM%IoIMq7P^mgu^#<~ymTq8BZ-mP!Ab zq2*?=uUpwu5rYy5W`?`jRIso0Lc=*KX`#tnJDiDALAh78?9FCjCoR?zn@sx4jNbr5 zlT2%~t?WcYEm~X_H7^OTldY-K+;YdYUF zdA3>SQP?*M=WST$2pVkG)T*std^R&e1MVh+IP;0aMP2ox~73A4` zRLiv6!eqI2u<|>}koTRJn^ezP>Mb@xy;q(Y+I=eUUb)6%<=ogxOtyNHGcq zR>xl5HMQtEMeWQI>zQ^-ZMNTKW$RiU2juX;HU3b33F|lSPrVl%WL)kx^itR#_$8Nd z-erAs?I+rf0X7?avsP>K^VW%WBX3#*P2I1dqFnQlpL_hA;^(MYHj`XuQXOkrOPOBI zJ4WlMZc=@eV|MX#$}u*g{G774*-);r`e}|)d!3EnTx$?NU!H4gq*Z1SSDM}XRl(gh zdQP9FEvjp%nW2MibYE+;_~|w?{S?#QdSZZb@iWt5*xkvvJZ6oi?wqFMt*deVYq93@ z^UP4weMduneQ?>2%5PpuQ7xO3{R&{N%|~-5Y8}hXbNLzeDMZCZQa{%YTBwpLw-)a!Fup#8-q&>`58Oc?CfVjYu3n-Rw#Y`~ z0vqSI7;UwA+e>VPvahY0pEc|Jy^%`Lxw)d>&4&6K8hf6m`q?zke6gQb&ugsta?P+c zj?vUvC5i?Zt-rP0tyAr8ykGOZK1FFy9Imv;E~U}eyh-B`H$P0pdDmKvCsKSvQmXmV zf);Ue{?OWvjNrHG-_nWVhxcqics+!p{X;!Zr-;E6OplRPZy-m?>J83VIzSwDf!w4JC_61+-HV zMEfW~w2u-*dnQ4&j}r7dc140JV?{A z#Hkx`DGeHhDB;H8R>{#wO&FJid+rY0D`naf_)QX>Yb4yykog3rY0NDd^cXEtHFBFz zg9UVPGBHh4yDB z8JFqS^dUy~DbP?VxCJ^8bS&;t2--F@!YJlyqaDqWFXp}vbr5q;VmCo;OHXzEl}7o_ z;1ZK&Ag0gg3G5NM1i!OGG`Z8(n$gpzp=TJaF!VUBMwr&(4MoA#iteSpiV1g|8jWK+- zp!Z)?l>dUJMh$gAZ%Mw75H%1q_IE|Ye$}##%lR*L56}(R}h#0C6qI3&; z0Tyv3x3W2UUr^)Wimrzp2(8|&iYgguXC;~kntB(kPD(VnQBnP&iVnX+(dmXBvDAsi zC211OwA4J4W!}xoWxh$@-)j5)22EXJWvf_i9fnD2dQU%zc3jIkxWUjxXot{xp}m6c zwbUyipU|$i)JcX`TD~6)op+~}SOw{+Y%qvfNp!9FT6*k3K zM~Q@c;?0P=g;Bq-_pvs^Y;Y%NcrRl;e!t4-py_%>)#FpKgM_Oe?t1atKIFTX^SySv ztQ3;L(9^{WB!k`|O1RCUP?21>Xj&iCg4rT5l!Xz~rvQo+gSUqP>; zHbGaR-vo7rH3_=iP)FF1&?Z`mws$G5g>jx|`8HS`?G4qi)X&jg;TM6`g$UXZ)C0XQ zs3WXX&_b*256gF{(bmHbBwsaa$0kE{O}@jdMVA{o(WELiss1vV4>b82T5SuB->-N^R&RBas8uL4rZyQis z_dO#wq198)cwNwCe6}& zMuRc;{K2#ikRXBx2*&O^7?X_N!pej6oC;3IEF?3|07G33wQj4al?@$X=n_NUER}o> z-I<8QR74#O-Hwx^t{S6mhPJyg^XH#p+>HV6Tx38bQzWi|}OdeslRncrvKeNzpo^)e311 z-7WCmbGgK6Sn-g>CW8TS8JD<`*9doYK})#3ztvlvm(S2qJO7fXyM#+LM$b^$eE0a$ zs5=ww$amGQ6_gBqFIMZk1d)j=dJsRdHTs=8>VSsjPD0g)qKdd%LA2au_f!JEf$1yr zAjUrS3o-_2N8b)oC4Qxf%{+IAedq|KjJ?+_hv-H2tRP?2x%U_I!sU2~nLh>De z6AnRjzKVn|4HTTO=rD_J=_{70Kwq|mhOi@*w+U$NE$H?W75$3UFtr@-Q6#11si446 z>rF}_y{hbY?mmvZT|x1v`M*VLB{UD8l#`=R|(?|bkxf;L!Ge4fQS>!W`q zb&;JE&Z?_rFaB83e(x&k+e1;c_qFVWeH8sUL;5lm+(&y!Zu#(ON?Y)}(jGKg-B1Ux zHh3DjaisU4Fq7h5RX?;P{Vvl@7*R6&)eqN+xLFj&$Rh4(XzdCvQ3pLUgi$B+Yu(LX ztw9OlvVRyeinyRW-g@B@{%(}NFGYSxMj6F!$X?QAe%YckYs0%>5w|F;x5QOORGcD^ zsbB_H^`e)DLX>dL&qfRi{IFJrHUuq)uN%X(6Q9R@E=KJ!@&xtzP|@PUqHZFmo_d+m zzQGJ8`8va%!xGyg?kVKM?+Nqpo4D_(wpG94WilRRlk+1SF@!e?QHi@A_B;b6O5D29 zx<1en`EE7hKCdA)-yMXva-$N0iWt;lAl%hM41m@fwcWM9M%^;dYP%`FMBRGM zH#(%1xK~5kA!$*j`)-f&P1*Far=Y|Z=28XdPeyM8Rr#?j&Yi;&C9Y0bqQrd~me_N> zso)FrjP%yccPVOCtk(WUYo+~&HJs$@1C0y1=}DoLxNnw3+<}m<#I1cz)_Fd zcN58A8&>s#DqwvoXc%lm&@)BipOe9o5aE~nAGq*0nFp^|-+3B5I@OCCZ=Ya2h1xI^ zRFc^x;<_UGOR4x>PZ%9cxcL52*8uqv?i1WjXbgni3D#jEz4t>M)+ufFXNu~5s_0Jm zNh#5!lIozy{KjW%l-AN{l?_b_Z)>K4>&*MiU#S~6%ArXsqz46j{&M|#l}1)`qj8D6#ZMn%)9pQH4)CSG6tUU#YY8afZC z32VH^O4YO8+w`{x;iXn+YOZ^SM_XBcgYze>! z2A10T*crIC7k4jj(A0DGQ*<0w=2BvNeU-FxzM}Sq+Add`9|2zXejGgm+Y^3jr>S6Q zeWm%9&l{}#HXf&Fm7xe$s=~#$$ZNxE$mcr{5pXHt+k4_brM+q%?w~^DJb8iGK`I!5 z6{D1W?{-C7ZSH&^yy z)7glMV`tcqcd}RPNBMSOj=zBODQf7>!}>~6=k0^_A5u%)_BK)1kL&%_TJ&S+vrB_% z;ff6J4WFxP*VwBY7x(pf1ZR$7E5sMc0DtEZk^uk zUJ{~)?l#P%nKB<@`?t~{5styyuJZ+m6oGRxI5}LSCxd6hSp#qFwo?u5hxL{G0^pi( z%p`-GEZ?AKrH>NM=Tn4T(IVke;)>oAF3I4%X+lc|>y1mDD@sQU8)~A7g|{%lAbTq7}yqC|V)DZb5lP z)o?B;zi9D(obG^=g{7aNd4I3xlG*zO>W@^=vn$>UVl*H7RY9a@L8Mbb_ur?q^R2|P zDcY+eLtUl!%rV17&js#8S}j2v*%CYeS}M2!wF!EupQ1MgD4H4~yc$+0{BRnL8G=gS zU4vh=<@cMOXWCAEdl=b?IQ{iXGRTL&rxk572)e6nd@xwiS0PH5l;(Z|)(zLczK(FdczAJ2Y)?bdNf=&xHwTE$e-1_LK4w~xMf8}gXJR7ka z;e5hk$(Ib=@j{C@{dH!c~qv`P1ay2tjrK)iB@mQ#!o@3&Od-xd9ibus;34H3hQ z`g99F(%|CnM3&N^XG=wG5j`ULN`ucsl<$^ftUe6Sh3Is+55+ID zfhfY4a6N%0aq3Axj{`-V{)W>3<}Bepg4d(p_9fiC$oCAFm;u@}pj5CIR!ibll2sL* zutHH|qka9Q_S?}Rt&tnO05Kt9AU^OY_~29TnyCI>p_J`=b0SUF<(FH5Y4I-Z48^84g| z_eUN57P-XrN3T)@5;vVjM#En;e>WoPMscrpK04|?;Hcc0L1gu+VxL2ST`R(=Ak8x7Nb$o^y@q0#kD+j;# zGrf$4t_HELE)Dtlb|l>H_4+z+IuiPbg!8p|3HttsmtVQw9$16?mLUPY_c8}B4JXO2 zW`w&yM3^Cm*xH$M^;G7}cjb3&_)WCs^S7?_*PeLQG4zgj5ptVYQ~EtE-|~;c7z$o4 z4LK*=(HE-kJOw+iKUf>Sw%w)rUu4O5Rl@jHzWWU^EsA87xFn)#dD|(vRbr`Ug(!F1 zyg&8YX#b*(<4ns=Zc(Im!@oc5NX|niT zd3B3e``!B)NiFg0^NQZAt*C#f$y6}Ag|?{ixr$D<9dnIQN~>x6Uw>0}AB(!wut-et zJu34jTNHg~E6^4VRRZ5fJ|gFP%f}CVY>sBXZ0-79Ewx^ae4=$s{aBHYWnA!qa>>;n zeqGnFot7PGTH9`GxZhq^E;n1-jx*$=Bn|gfE-eksu{CR#wVL|CJEG@w@7Sj<-VeiA zNCo@9rTIR_DJbb6{XA;+-gr&&yWRI-4Y=&$orsGvqPwAj?nnGy5bY5OVc&z@F>y`? zKiG~>Pbd>^`FXO+C~;j{;5{;Um3&umqsWr)K1Ut2*2{Ny4G}KsyDU1vqPxGTVAK0@ z3m9L>ds9&aGq$9bjE{yW@`jd}zDD)jaER1~Xux%fW*FKSBD^@;Tkk|`d@{X+=1T@z zHsS903Grg+pv3jX?;)B1rJq#4jJx*os>N``cLhDTL{}NjM?2SowcEz_E=8fFhyaBv zk5rJ%A$=}cv_!fDdTO2u{Ql$k!K#-jSl7v@XnnsR+@r9S{`+5vU8V054&E!`&V<3*2aP0ENdTc2dnqT87XV%8K8?9wE*hPXb4b0M(b;0e+h&;!dp~= zm9~#RJx|V$@FGE2FLvL{oVx}kO5D`$_?{P|o6sM0za2A}A(HQQuER^^B^Wka?o1>c zedCb0q=Jdqi__jE6|}ikthkY@b*@CW4&nC{=;e`wI}QG7G)mx`4)MJmVWEmM~XDUoW5(*yW;7Q{HIZ#q(`gq zkK*zP*TGgs^yNG82R~yS)&a34XcqIdyzS7j9OQ-m63$1NH1dRcu@jb+wAPyp8er^` z%orahiiP3i8sp<}ZV{dSKf|aGXi~2~Y4`xK8=-yjji7Wd@Mhzvn})KOIp-=Gk2NsS z5_TILH|@ebJN821=t(&L9>v|ug)_d`fKy8;>+|WIa(K~DzC@bz$_0DIkPF_2w_UH_ z|JKDGQQnU@9PuX7P{jTDv(`HYJ^d2vVEINl3xwzWQc!7dN^8*?ew7@ebRGPH`&_TH z4vsT)ANI9E+l-SlLg^*QchV_xDxhD?33>^Ud_fCCKQJL}n-}jQ545k@+%+R0Vsx;xgX@e7E z9@B~tVZm6XyBZDMgiG*SB_2_SRFisfQ|AM<-O;NR9lu`hhOWSTNj?JK7{xl`J+|zN zfmSm*6X**@H&l$ct&FOJ-)}$(cV-0Nc4D8{Y_fcX1vk+;N;}g1+L+K!CS2Qs@&Z*uNh9`h8t%rLhtv1c((BdQ(mj`df6bqzdP%he-WRkO zg_gjpY35_&p{^q46LIIzW+81Getm`=Ulnd|t~#3R5RKzLzO_wzCRaP~{mXE6!OQUT z)S9#harShd&TkjPPWR<{4+&@cRB*(DX7?M^?#BlrK`M9`w`^rZJq)iWsQWNQZ{DP6 z(Vbehm3f9$SVc;SW5NhMUY|F9zuB06$T%-EGz51Nr0mGM6g9Bg>h)8ZCu3bF`Py2& z_YY9oL`23U^&R6fVz{O*f^V19N~4tD2}bMrl9WxjW{BL$i$JQ=glmIwP!pQOI-&;N z^<$)|so;B)<+lBlbGOba%l@A#x^%jxw%w_;Y2oS+@q26U%-WJK-_68&tsZL2cM~w4 z=?-p*tASM{oe|`_`r(OUzIz@Xgl;~T27BAeqo2*mNqChbSmyexWELuM6@ch9we(qS z=zPhS3TQT<61X$*ydsLX6D_^Ox7ah4aK7ga9ffrS(IV~`NJZyr`1VD0X%W_pxQ|J_ zfVYt_catXlZ4umD&evO4t<4{7#R^nPP!utIJKs(a+GBkssl7m>88+hl+NVwEStSA~ zW&Le0jiy9gV~lfp6D#8GvipDjH*r3q=~stGp*Gr`q_68HU{xv}?v)=AFX6WN^`Azz zaZeJSkamVxzreGK%pU1VE8?1Bu8`kzPN{+jG4p#3Nalt70=&z~v@@!zb~U<+d&tl; z-C4wr(lnGS&bk-8S+)dTmRy{DFRb3|TvL|7zgp)d@RE8iUY5F$nc};?mFadxzhtGh z;RWhhiU#7mf@uB(A>n?9XK2f`3peAz%ui(NE1awe@xQmI2cqK@3Xr-Hp^cnD$9M z8dX-gZ^j%9q z7oc82G0R7pulW!3DVyc*3NZtT_at&fU?0_$nO{Cv$X6nkfJex~nE356mZz?d|N?f<$& zk?w)SI&bE`*u$)%4O}|nsVvjXvl(CMj5@o=dx7W zKQBvmN^`9rp)pr|y?moN=03bre}$vglx>NAoJ%`)=U4U^{9nqJrGuEeahgAaJGg0aH@Ru+_xiJs{cQ6$+nVAkC{1AM9;a#TUlK2 zVh7@#;%&*sGx=rfr7SL(E3J=u!wzKiO8j#5k@UH?BfXCzH_C59(tE!wE~oC%U**z4 zS+<6kWzC9J2mid~TEhDr-wUAi%I(obmfd}4**2N2`|E$#^~Nd1GUB}tL$ooRiG^RT zk=HUyf1XR%cVr}|^V3#l>!oa+Qi(nL;_McwMR*-}o&LLeb6MSnrhf zW$8sc2(AAzy-&7fXKF|+C)Wy~ELmbs#|*w0Y*KkY*`%jRdS_onB?Hx;s`R2~k%eZ1 zcCZb^uCX!~&(QB0EkX92OS}KBymO!_5JSQHX_= zU6#freUDyzlW^IX%3dk_9T)2TvdYF>CEQl>e)r$WvNOE7_s_MFt3{dPt!xQ=JG4a1 zsW$#j2medG|4Z3iGSk{je)COs|L@vMWhFNJ-<6d}%%02o_WD)i?(O(HjqhGUc4Klo zf6o&5vU6~=fjnHyeYI518~-<3`vm&y#52y;dv~9$_AHgxi|n-<&Z^Xm!R#=xPfBi4vZtQ^2-**+VOmmb8iC)t#U1*tt)W&z$CS;d2PHd zQIin$*1ZQ1`sP`DQH&9#_R2~n+HG019s{FpQVr$zOqr?Vy*=l3W#*$g?qmtPR7CqB zi{oY7%qSHsPs)lh8C-UzqJ0bvF*Ghj z`R=`M<;#Kj?i)i@!d}gHH4W|evh3NVFP~!D?OzFB`~ec$B?;=^rInrQ3KZiw`YUWD zV{s$zHAYi$ibta?=6dwOJ14c(HlD>jk+`dM48GL}%jmGKt z?Sri42N)U=B9Y}SmhZD8@h%RdaYqaCtH^Ye8IP58*|5Bfji(_Z{hfeyA3GfZnXH?5RBx^ zmT*; zIN!2LQTHLECgr1ULl*L>M`Hy*-vUdw67@sU`zyH5ckB&6#At5Jxi1)PhDX}U=ugmg z0-;wc$QRRNuJt~7p#&Q*66=h)3Qe8c`)A5WEh3G_+;B}z^O$rRQ~~)?!C2fO6;$Rn+YdBrQ6SX={;NQd?jh zCg^;Ow?jDf!K0M+YISXSZ_F;oAvNaC$1e&7vL*KaCF&NzXUE(PMcVQ^K-<8y_CTWD zk&uskyXc@Pb16ZKXbi^O4;^u8nZ?=HF@K?!?fQb&b_RNN9`jQacegadw_sWNtw84! zzciiF{jfoxr2_gAp&&Y)BUIPE=Nfago}9xL@f&(j&|wE7Izjx{5794%p#!WK$@_>- zhaolY?!Y{I8>8dTQgmi{+{IzqO@})-k-7X3)*)q|<tq zPHl&Ibs3P*)-a8H@j9cO-GnS`Bu2%_K$7ofrd2MNPTTur%J)cxblMosw*`9fWgll6 z%>hJ<*m)V^81F<~^A{CWkc_(COCOOam)(OUVRtTxGe%Np2wM_LOImzX;M zy4i9e}dc{!95tDk|$|uszF{-K+AoYu~Gr?$uet z9htpFTw<<1?qrD_d=~c6Keq!v!;1*Z7{+)l zZl$hJWNaPIJ*ahv-RIJ2BhHtry{c2(i-aag(p;^~aP z85N{SL7BZpFUomOm|mh+Ta;k$I1Z~h@spWlY2NZ>vHtC&>yir%ksV0Af6q_y>G(~T zr7Y<)OW2xrOt`o_infd>ZG>Iwt;uI;Lm%#3@{2 zPc4$(dY1F;UN7#d?Xg9tz`|r!d%36D+O)okYTx?k`X$QDM2UKVxR7||R1 z*)Q60+fxpNi$5Aa27%=?Et*= zkR=Q4kLWAlcpLYzD5Gq@E32wnScAwfeaOd_eeS$_J{h6QlC&eZ4ceezoyXj*h{RN! zMCgezScgF>$yWm??r0~HAW3aUAomjwXWBRG`H{-08Xjm!SELZt|wjtIdx^ zR1Nv0<*T?vrqbmOV+X+WgId%zpEI9&w)YPv9)S($(=HoaNk#-cg~iduLn8;nu%& zw>y30`O%m;^6IhHGOa{zvuq51wIw4!_^F1{CC!wNcF{3@=Y`}e4OVRxYcCD%u@`9C zhQ9(U4Hn-k_E#F{SFK6|{i;=IpkK8r4fMDArGb9c3g1CRbiv0)O3;qDd#WPh9gON9 zCF3&gmV_fzB0%KL;*O$&%{U)L2Zc5Uu{uE%6%s^IA@ap>N0Bz6J%ZWqY%cq2q0;I$ zRCL$H*rjqRosmijIwKWyTOUpR6rQFB=X?JM=LRr3-6Z|oq_2S5uH)3ttZbcp^*#aW zy@gYU!<$JR2U~4d!b=e?<|^MHub{xMAxcNTQj58#aHo6(%EsK~<^{I&)Dko*9^%x^ zZ;7XlIXZ`!$g~QGl}=&Q;8{d}88z-Bzrc&RuJz@+MlrW*WyC$lsZTA`7@3#FqvK|% zANp{Gmhe7tQ)m1tkGXh$%ih-#^8>ty%c*^^Dxmj#)7yK~OPa4~XmyCtKcL$1tqh8V~n5Y>}5IUKPt0NJqwb)!<@_V^4>>~?!~j_I;sAExp@6O0GUNY z+9L5+>zGRw>^|j1VH&Hs=7lerpKs;v8WMg#F~7C&e>)kq17~Vc*)z^A=IkZ)@?}a@ zekb)?rXSjuX}g!jcZ0%S6{!wJKD@L5sp>H*tCdGEKb0We4%F(T9gR3&rYtfGm8F+6 zxL)5P`ofd!HAZ7ZwdT}*m@(QjQu!i|*0x=kHf@k|JsIu1%DFy_#$D&!AVxHU<&=uO z?VdH{rP6w{^_*#Sew>$WfB$U>??JQ|{;rPQHJ(0S&O)Dyo~dnefY#`$NY?GP&I~aPFnNGZ(*Xe0j;caK`1zKg0*Tc61Y(&jLZRFu1t_FHq zdXU~Ppzi?USHGxDdT=iKcQkXk0QVh5=HcjHK{zH4QU5xMj)IS+H#zW&v~!$$kjrWh z;+Jq}8@)V?Jwb0Rp;jU{Jw+Sakt#a4ufOVmA}r&%y_q_Yc|VuNhlH~@e$Crj;|Kp% z<8k*6b~aC-URg;`1ByGEIc4pA#aX)c{sn7q(hJrvIndCL5Q*mVtxV}(;uh^`N8tI1 z)m@xp&HDP^aw)s)-%F5Q_Vj&pA3$T_eXh501ANbrk*>62?jYp+<{ZOKu;wLw8iTQEtgn=Xq_8TMW%fF0Yx!-9l?EkLL*qQZK=2WUz^0j^i++p!C zx8H0uS%#evr`u#Iq$@(c=;=F&E!!6WYRem21>qMr7eqKhjjs+u zf^$e_M{ha_qSvMwRcm>AgkSWJxt53HCLrhYWpBAM>Mms3L9u99_GOGC;X+Y}9-KP$ z1w|8a9Rb0F~0eP7UBKV5sIpz7lc-Qs-jgj70t(+1CrVlzY-U84{me|T8?*$ z1XVSDzuc?&${X#(u&hLOa_Ln3+U1BD(RUeRt{2ceXjgjrGVXOI|P{S5WD+Ws`!PsZgTlk|E+cUy@EjdR>2Eob>Qo6Hpq1y*9N zp{`b9jd4CcMT<=j(sMD^fquNcjpclS#c-<2@8c)h6C3{9@H!7!zuv zT5TO4)$Hq{)uz3ssdG-%5+`;Hkt^I!{Bz6=gm$HlB}I&Mq%a*c$a#{EAnMIS$B@*_U=B@`IuJry4}yj|D>$W$+8xhfZAjZ zrQgL!Y-ut}@a!ynN0AZD@$~gX>6sTmi@TNOG|q708H(<}3@dSl?~c@!haxHaGMA+r zp_ET(bC{MmQn@t4try`kIi+0I85(+d#J#~%b;b*S3m8p$PxJL0gxj}F^C)wb;eUZl zFWrg`mZ5~`;6pB(Sz;~Irgp^8E${omJmyJ8L%KknsQi0*ePolgP3ozp}W9MR@!B^JBFGmBq^^S|eHN zx+z!*Ztg~?7S<7T4@!ljVIbb3JEzXW zK9o4)Whm@JsVt&#J@Ml91j={)=_+5-uvf9lz)O@15u=Q`@2I z_mv2WxfjMD+6`K^PA4HUDXC90+GnzQz3Ug?s|!rq3wLZ5GwSh{bMt^AZXovTBB|d& zlAX4nNc=MGK;jHuf?Rbd=a|#lME4Sj&g7TkcIfSsh&urKlUE5mhBjl4O56;T zT_TsvQpZ7936j>bOXP~?NgY&zG?`t3>qwi=*Ss8c7lAXrt=%OOqIah&t==M~oo4yI zzz#!7e1qTF5K3Pw6ThC!Zwq=*&^W9%1&tblx5hY?zQ#=`y(~%4hg08wQPHG_6pb`A z0dI~rg-8E2A1Neh5A7*wzciyMyQ!9H9q>|J#-%#}M^^#BQc>tt}JKE>T zoRVu^&9n`fO>^b*euKvOAksnFn=9mf27@M6$2;7#-XaarNfLUizM_XdQ}i>mCaKdg ze+aq_XPSZ%Ba~Kv)s4_zpR1|84^`Us_Z9t!6Gh3l<3%~a!YyT-OA76}Ws1H;BwA>L z_Rb5@BtuV>)6~~O6mxm^;JkYWwfx2hBW@_`VCgmTRV&f>O|0>&kJkBoaFKJjGi?)M zJkK(E7BL<{{VU>?NT$(k*X4}p2J9C={@g$~@8s0ZcAi3~uQHS9$|LUR7XU(AP(|yd z-vUT&XSPyAb?mZwYyU}BGUPmb36IgMmn)Y$s>3rf?Sux{jWG(&RMeml+GW~Oq>g0t z6SxRkZ(QhiG1AJKLZ1BU2 zB52J#Mime-T+E2_$r(mwzGaqg4WlKab;enNb-Tq#k|!G$*Ome*9AB%UdzK z$PV{GL;KFtxW!Su@c!)ABp*dd2uWYAL%nfF_mIB?652bD(5isqG}41~BbiXPFP0hS z(Yy7RCDbxCciq(Xyls;jHIx5qAXUH-8`GcP^2Oi!bYAZkN{6p573iw8os5kM0GD z)>hkD2Wc%+W{E^gy~S9AEM$9r>JxdjSaiDgUup*xfZ}c*yoKnr7;73q-Xf~ujjpQ5 z7jqub4RO++@GE34^lLjRo81fhaarF=YB_xeE9Pz=D_@xq-BX{7?rWoja6Xbb(_MSw zEVKqpqr34Uso&3d+n5f&A+ofcjdeBKB%LbIHw0rYXe_Tt=a$sxBS{;x^eU;hAz7_A zL2B93H)BcZ_MOPmKC~QZ#~GYTH+rNUkHVV?>H`laB{D5XG?^)1>oVmd+whuf&$VT0 z@|-LQwBEQ={l%S1B{Fx;;DTS|Vu$AUU>CA1e(t6lwcbj4aB60YE@c|&c`&1$FJY!* zr1lbV6I$!Or*|24FT3bHbN2j5FE{0o#Ye?OmctR%CF!MqX_RH#OJ)h5PjodJb;xh_ zq%SZ33GaJzy$3W$gs(k~l%|XD-5?&JQ{eAKlZ`PO2vV<-U9b3|L*TjS+bg&`gZ+%m zV6{Jqy2rEhm+4u_Gl+c8uzcP+Gxax(xlqr%`nUYV=e&-5!g(QcR$Ie7V=I(HuqqH6 zKRUE_KcZxp^*+~DR?9^y?Mq)mM&k;Um0loO#FwmQer2^yYV-WGUg6@;I!J52mEer? zyj+~+?47hmoP|rSe9{iB&9}pA181q2Nj4alP1Yi6Ted~`-rB~g+M+$TqiileXK~5L z4wB}5d|i*Cim*DopMl-k?<`fOg~@zGx69ow?gi*d^hdYLb4f4ud?KP?#Lw$M^g^;= zcMC7z-@Nd1p6{7l`#i6g3XsKf&els+mXu@`e$>CYB;Aj>Q2!D?;UaOGvf@5|4dP3X z^fFRvgG=09gSDCXh_46A$#>a3b0|yj-}SHPnWPskH@>f)CX*lOAX@?{tNEm7hznl1 zhMj(lm?a`qSUrfx>f}@P}yAha`_i&uS$?T z0%)b+JzTb~nz62yu8Ht1i|l@r+LW_smr97P&R|4$g<3OegMEP9-{=BgBDbW5!CvUb zFLp%mGUG5KX3Hmfq1!vM238G;FK*AA$-i_4$}J!DptM6Jl{&n2<{I(dgJhTWH&Un< zdawlK1%w~TC;a>zPZDI#&Uo(&`$lTH{1Ui7OHX@Aq4|Bv6nsra*0H(l)N}qQ^dQo< zEBB}kk);A69kNS!0_zCrnN!e5a-W9UCfcR8?OD5-ZIj-=o%KS!Pi>31&*3fZW<;FF z^Bz01MczvZKivU&o0PU?&H=b*`M17vl-0ZEKKBx2mMGh<9suWT`N~>7WOMOz3UQIP z?Rie|^5v@6w~c1C?ArW%aKlCeLD z>wW1nU6p3`uOCs8&s*K0|Jv$yuUD+@an__Cp=&y;&v^%)M*Pb}cpC9J>P2P6n9B>u zy+|5mB(wApjreTsX17h{lM=pX#9MeDk*Oiyzfv2;JD=g&JU`zyl71RXMI+R6rrKm~ zoP*T3)BQPKLa-k6CxAC1_CQ}nlpdrnG~(CGwombUjaToNFFB^)R=NriAlb2Gw!>?K z_({*ak<|{8-j9@Ax|d&2`1`xm3nHJ^E85NVdk873`Fz_%mIbUel3>rj9uVm%AJrjN zLccr^?JfovLCaXr%Mo#v(Nh`yCgWqD7j<{%qeq##^5gQu3=O5Z2P0x%%yMmcZ}hN#oxz?HQaZNOY?<*5h-#rSFat_`ZX* z65pWx1m}a>>BiQHL!=JT&{lAXJB{4M-Fq!mSGhb*#ZZ$mcQ9n$&JrXaQ0aX;y0+GK z&`Su?A|EAbGzeeb;x`Gd@p$-Mtdia+TG5>G$uIi&$73Wg~7c z%zh-j*r{0iWUPJUHfa@jB+)62Ux|W|XUNs7a;BcyGbFRrb^xPH&yY)ce=;xa9g5o` zBujcb4lo^%_c@3;ldX|_*|sM3LM^AS@A_6|=kqr1^U>XS8Bw|RZ&HG+j((XVKe4rKOmYLTiw(=z+=pOkp15?24PXPhGAh8o#@?zZ`Sq>W=uYw`<#H_SRSC6HET zmOX*XlI~A2E~0zVMy^rYoZIG8)k?%R+A^0EEKzKY`qKMd(TkTLQ$F9n9k`DCIpB%e zGh4g4e&--%J!jI3a8dbU?m@g1AikssD*%y?ZZAq#`_A= zX(!Ps?MW=cN1Vk=osU$RFXfj=I$y@z-t*McC_jmclYFv*@5UPP`6y;CsUG>%dw1cT zHZGfQzPL~LJ{EayQ+ zYT4QP8*luGv&fgr$4b6E%SRrQzM})(ZxIR7eJ5$-39hXbPL}1@vVP@8_V+AHFcfp> zbVgfX?H#wN@1$Gu;uCXuTaj84ULcakfogvy8j*aTkY>jIFm(LQW%Pjr2}(b^anUC|1cHq0fjfv$(n zvJBZado2-jTUTg&L)(_EKmR?OJ!^yZTiIp( z>PFtVp&*F95lJZfPMf^bp)b|on~5Lji%RsuhNOC1qc^~0meiLiMA8RXKDyoU zFeAEEA~)G8!gi;E7IUrgqmEuwk`nVcAB{4}_h3uC@pkh_8C#O?ZO%t${`@L~`}l5M z)l*+CV$Oc<@oybu&Jce0xs*%zeCk1BPIt4?NA$~V>5p9dP~qpfkSxMk`N zW`0j1c1S0l*}WxxgZ50he(mJ#pzJ#C8-ZJ9|4?Sn@3S)dsDH-IhJV^eUzEwO9&~!s zzm~6Tep}JrQU8bhRzto%|A+kc)F0v_zJ{*wzCd+(t0eB|&X}y$>CTwEs7`mrzT9J2)aw8ElbJc^%$xz~y*C9#dKFMmn)EJBSfvU}2kB*5SP>CeK$<93I#Q(z z2+LAMsvw}C0xk%MfQpLveLu;Q-MROEen0-W7hgQdWLhT4MIdK(!m+6KKL&x*hOcUoGRN2e`*hn@zDQu~PiSq~LJ+O#%$FwV39q&S40 zh+cc*8MFlTR~!Goo>BTYqiI_+HKDG3N~n@j+W)Jkq@PhHMOs;;*n)Ol+IIi1nY?Mw zw^FIwpgT_=tMV|tx^@+{zlAaD`DOLDLzsJ{T9JV#ScxfUBjI1$jGKnzuKzZg|MuU{ z)wD0YG(!q~@6&ewJ1(t!tyAOvuX;Q!PQRO=WA*fDvBl3y5_49>p8n90Yip2?*xQmGKtv%$pgtO76yd&D~nj6#a;WU5a}(F^(>nqlq!qZ z&T|^-~LNQsz5tiks#V975IK{FRLNVFIMV4*dr1%&6o?ZOF@+Ab#QOM6M zqd&03Y#iqt;sMJ%$cK=e;xWs&J#{|0goC4vYuU?sGye!QjlusT} zQc1i!tpL_GgyaNlUg5pD#p^z_>tWq)|^}H7n8v{bexsceWWVSnUFxJUM zs>0$B%QVPoND=Xs7EygA*2#br6_*2Y4N^>0FNW;IY!$N>^>1-eKOny#ri54&kQIn| zPHYIsP6yxV5T6I+5mG%bjt1ljq?Gt3AhvCZ(jp}wE~Je3BOvJ^WkvYuv=Sy_>*Yi? zC5htwBq=f@ro1Q`h{*-1Aj$`X*1oJL8Y`Kp_B20YDv1G{PmNXhel+9-u`!Tp2~xcz zjs{YdMNCa`n^VQ-k>UkNZBgLkBYiV^ii#en0lghK?8gjcvUu zh6SVnVj74EN_3fI43)X1aEqrM z=b?ycB{BzOG^CBF5|9K)JCWmAood#4OOUh|g#z*(q=P6KkQtEIMcaVPhjbPb1F{VA zrkEa(wUBONZ9uj{-V)mbvJcWnTvn1OG8~lRIAoxxj*%C-!k3|hUqgn7x&gTa87i6u z{mxAC52uKCU2VyNtJ^X&G24t?-9+29QdE#{(vljY!)X2vIeqMO}>TfgM6+-5R>7oC5DBB z*e`mke3CtTs}M2x_XDCY%e683S#UrMP?A;~9}uII+z@742U2q;X@i`T#RZNrTR)N- zL(&s5Cqy-j>j`l~nDU$zjg_Qr>zrtnz>)>3L3c)1sai^kn>6ObW=C z*!S~dZa}D2@QqmXKe93)^pyEVYzzpcx+r!8gkmm={Q*h9eq9pB12Przt@v8WOi_9m z#x_u%DX;ve#P|-i0jfeM=0_3LlKQN?CJO$K zP#U^6O#ASfD6V4Cj&q7A!#TfzG2bgFVT!22LTlh%S5k{51yA$akei|ji?tZ5-z(|J zvixHy{)F5TZ?Wuy{HtUr%b;ZRAVT<+sF=Vq0g_J13@xeqbz9622$koySQQXD7k9*_ zfMh{Fcf|!I@uK)9-SYfJ6vVGrFbh)Dh~Ntpi1|e%E14-u+`z0%$bE5^<@F8t9W>;D zSc%>%)-n>SDoF7%Ki+J1kEu`H(T_m`N& zV%mOxi|H(;?f18s$70%kkHumZ)AsvEtY*o~=i-Uj#!{Tm#S?LmCEr3R8eqTv6{lG$ zL7FPL%2I;cbwb`@d4=0`LjKJXhg7YRN=lb*MO>>3ARUxsXQ{w#KT8&2d6nCKmMm+8 z+nKg}k;Sw{ZP|#WcM;vcaAZ4{ArRbf!jU~#EWXAJi=ny&z}66#k8M2c}+{|H6N9?148AA z%DApzyl-$qq z?^47-GRVuE%3Y%+lYFKU<(w?j&lBQ3#AJ~#vb0)(d4rIwvNcP~kAzqc$tGi2X3iDj z3rKc3oMp!cLY#u+kkeTzFTk4}NKUy@NxX<%srM_le8@70C6CNonaUF<8nWb-J(Nsv zFO8Do4)Vz-`zc9qd*ip{F^JA5hq8=-WLGkdWz1n6lV46^nFpbm{4!BVvR5Sw?tbK4 zK+aQg(5nksi8g-$xr9@dUm(RFh$$#nvowM{R+7w8;v*?6^qC9E6D%)5B1&$tdBcZWe+9E z-uXABC;=%Z`?0i{g!OWePcb=^rE_Q9_beu-u>8DP*P_MbaTXUfB$cO_EMHZZuv;wZ zOqFwOmI088N*XJP7l;0qqB`VhIZR2~ljs?_K}npru^#J1;}||8V=+2J=e;@JM81Ml z#by3#TI%h^h?^4nZ+gZR+Nz(G#brqqlZ*hoyHhb`@EsSb`F~#~#j8pdDM^-n_^6hU zjcTZT3j7vH$#Esg^3;C(1`ASB9)DTKbU@4`B|Wh}w5=;` z(T0RPFSFLxF|DvI8kc!q9#@hq%Y0^urm;ellEdogm?zlNm53=NbJo?e{fr*}DJ@H| zeEN?Rn-No5R$;mHsfjtRBtaB=%E(joD4z-9?W5i)?3)H8WI57*?A+@zC$(k%Tvg@2H$wf*gh?0l&)+@^hMw%(r%w04Nhw)RH zm*v`Je3b{=sw~?m`Cfj2UmsFT71>Qml3WR)tyhtwl_bk)98*=!QW7ur@bRfCSF;?4 zTtv=QWfIGMv`&A3RFj`KKz6vsVvp#$rG`AoGALEhjm4ihaT-UA?!g-JStSXs88NFN z%dwadvl{XR7IVkdkS}XVeO}a%4FW=SLJiq6Ak;d2QNA7!YMs`UJpytI<#}07Qli_d zzd`EB83Fkh@~T`JkaTEEHIgZTeCRkgllQcw?pHJUh{fzzGbtL;(MWL3el?S>mel=f zCNl*{rr~HN`TFnw~EBS$?WF_?7A#cfBEVUr6)2F`~&x)ms)|nFyJ#q#8@g60Fw`iIuOg_)AeEDe26z0X>Cf zkUp{p%U6)qO5#~eJF~BRkHxez`^pt8rVr9j(id;&$eTV$KY5JBw0rx@Gc2av+h6{| zV%og}LX{vKJZQ6k{4~uEj4wRKynqej#2V0mV;<(d63caZI+?+wC24Q6#>=frW~=%qJN9C{+!v6%O1@+1gw*Dv`5dxZ4hhI1$T~SrNt{@RoWFvsm&=qKuOaiv-=d+;hW`FmK-lx;sRne%OoW;1<4i2XYx;u`QlYe+<|PD>0ei6c1=CDL*`~N z_1F$soW;~*J7q-{Q;+SGudtZvqfDET*p8Er+w1y6$tCz+&pU z&*dx@s(&70FZRdhQgC6N{R7AyZgP zefWj^oy9zN_RA+M=DD+9Mmp)^Y@Ry@WL6gQ+&Lf%vzYohNtR|Y^>dP}!D4FKgR%~b zsc8?&CM@Q8nk?I}nCEG-?95`?0EgsY7SjeeB-gM!pU)DWhj&+UGfP8A7A3n`%=7(- zOky$5_apKoi)l+7m66W+XqdLdQJIIuv?Y$oA}ppYaZHwExr>%eer)}?tibY!+csay znk?oib3*oFF;AHjau|!LX}^;1vY49oD>;wF)S@Tl78X;Bo|J#Fn5We#8Hv&RWu8{2 zWHuJ_v^p&dvzVvVX<3HFJgv^i7g@~H>Wpl}VxCrKWqTI$v^pz$vY02)IXQ&IJc-W9 zcoy?S`&v$CF;BFw<;N`MX?0$%VKGmu^Ku7^c@kZaM_J61=z=`MVxBVJ$g3>oDf5lI zt0e91z(pB)L*P%^Q|6+~sU%sLaioi~f|7XAZMGhPxg>8ZiBnPn*T!X8^G(VpPE7w$ zh-#4UN*6*V82_YXE#kwJ9v7B5iL>I*TBvV)} zF2Y8S6!Nni#ZrDQ>TSqvd5ERuG9jix?#M?hwOQ^-`ei)rMTQl6>ks52 zmJ1Nt)!qmp=$ zh^v=IN=sNPIL3^WK5Omcm~A-AGnnS^heX-=RXvS%+BMFEO5}H8B#!?rO6RBRZP7czkC?-FomQ`!8mioxKDC89@hUG<; zIu?BwlCCi`ept_1K17QdKdfhMVKF0b^{o9YX8f?8b&|!5AJ(&~57S%!>0K$F#n$Ut zjYewugQdQ8kEH?TfR#net5(KQdh2Giuz{6#tWNdW`}$}!usX6deNX4yz`7i#V`gQ; z7$ov(Xtf=$^D!fVjjZl0W{k0sHJHVWUN*8OD2Wr-v96{>292!SED5{x)*D$J;`O#V zXVHC`M%EM-uc#iKYh-O_dAgV$GjC+=PSB|eLNe#V8mm@?ceMP4R8>&sW>!y@PNmS} zfV8x}W$_?18sEyg$I=S4R^rYbl2#PS@ca>}gY^dd;fOk_|Dm^|sb_mUI{srmeTNisJgC zRO4}$WAL~3*0t$cUfrROVS99xv`oe5RCX0pkmY7xUFHtfB9>b`*Rg|DW~NTn1@r4# zVOt%no-7k^-a9}#S}CZ%XzNuPV7)>}XX`P<#RhX>1>C-nH>`B?b&R!FZ@r7P7j-VB z`eP5q5)jkXy2$bhW;V{vBSa7DVL(PBrl-{v^$w*P&=j*U5Yx+A#*zr3Bi7rhk9v?| zzQ>WLBNl57V7bTFSgbXRqT0ApyJH+~% z#f)$cv7(D8=VZ|bM}?l1L#!f7;ze(kx2+eHB#E+1b<9w!CC8Lz8D@3in5<}%yoVAF zx5jZyW|ooGFG`X{HJn@8)@aLJEbu2@RAm`swN#QUC?AR$YsD%_66;rJ8D~x6RO?vc zENYq2QKgtU*!p;@SY}w&mBfiD%W<@k&rE9y%Wzz?B(tr3 z0XYSkXBAzhw?#2mARk%v0&)|w&}yY5PNc*6dH`8$O;VC9uHxBEWnN}2<5b_VEVrCb z^zk8~qp{NJtVE}xeAZZ_l*9{)A^Frg&oNK0(R;ely2mj^SvFb4v4?bgNS+|oW^1I9 zWKo#U*Jsu&jw#5p)jA#!O0~@@fPbSa^B9f_?ZpnOx{`Qtgk_gCjbnCjo9%OJCC6-I z*<)Q(5+_I~=e<_tl{)8XILnmt7gh@;@#1}!16EItDUBmft?q+XJjXoGa>$w$h>7|b z8@1L4Vn~izCj&7#Azxaz15z0Bl@(b<<%t)RGs!8dgpy=ITQ37SV>RQLI=G@p&RI(X zG1MzLZ|w=>L-LLFRUoDsQeCoc1!73PwR~L1bew5huR^X^#g*vtkbG~A48*jC{AkS% z#E@LKwgqCkL4LB%24YBVTF>B`Fxwgc`Pq6|iQX2;9ji+qCJyq8H6{>4@~bs95c59d zfwd|SL-Lz-G!XL<-g$TP}Am$vz zwwDCtM@Y!t$EoO?l0@t*>(aLM3&gWaDbf2*;@eFFG5 zKn&FqS?mJ=$$^+`_IH6)BsuJVS?FjKgXFSvewtRovXDG>Y(T0(^4XIDQU_ANUaCaz z1xX?MU?8R?q=@}}KwgIwvmXaikvwDPU!S&hx+_cA)s^U+NuIMOD2Y>d3e{TA+gAdq zdLy4Q_TxY*l5%#_4QV+Kg;cP6DbYETRI=X-#JmHkVy_5DBIE^oe;^e}b^BT%hHB#% z?SBKZ5HU6F+#6}@dRrtf+trllJ8m7Mw%wCsI^ymoscSC^$PP$-`|m)i!;pq{j!kL% zbsEyxE~i9qi=?UDietj4b?6v2xBGL9!_v||z%jq!ex>JEYx`T4`KW10+Sq@vTt+=j z@|vA#v)=l0TtAd^Tf3x^c(IJ7z1>v_dPxvEUmfjz9FrX_>Z>SWXZzVLluw-70P~}M zg1lijRFdGDzTO*lOBU1Dd&BO|)5YG( z@;Tbi)Ozn~?_oI(p}90&?ei=-8|v0_H~R|9(~#`gRyR9Ei+V472Yb=oZu%MRSF(73 zxgrvO>tT0fF>SUUb}uDy;sV~5>X>C5({7`YT`XsQHgcLJb1VJJjvltVm9~{6{^HpP zJ?+6tlEuF*^bDN0?70E?z(z~h_O?-~1J)gG^T*nml*Eao0eV}pc1a~kq7i;&LnVy0 zr*q8U_w)?6SUcl($|p(8;k}5p3$Xm1hug+>DJ5~DLK6D#I6kpK*Su^9b#+S37c7VIIN3)&W4 z8-wg30cn>5--NU)1f&&Yh+R7%ogi=9tpidYGSnUxkjL1sVfMy=G|7x#XWM5362gR} z5qA2WY2~5oXQW*$AWtD?lwC0(SsiZrN)5G4m) zQ%B9UhjNUW7dOwIz+z^>&9f7g=$UDaP{Mikau%AI))F$`KC8v;*a5!|QF4u?T&gTP zAn+$n6swQAP{pK6((>w2+_jJeb~z<_1aA=JBl|Ti?mtuTZEVQLc4rp%eO!Y|#CMzI#zzp$7Qvqd(|(50)_jH)fNv$2>lt3`Hk7Bf1x$Zn=2 zPOQ1A>#;@lgrj;dBHv=Ya^0ic#rAaUGwo@Un_8CG%};3g3!@Mev()az zk{k2%NS4_XSdL)ylH?P6-&Z=-+~PW)<@SYBTJGacp?hbAz4o-01FLk*3VX;|l0;Dw zPvIxUgji|EvslRWxPx~F_FN@#;s-oaXj^OSyytX2HF4jshOD*cvh=}TY=V4huVl%F zQ7n@6_I8%xJu!C?$l~RAi^!n#GJK?6LOObhLRo%bT8N|vUDmSk6DG2;>k?KUiCWFXld91!Z`AGT*I zi5Gk4>UP~Rdk4puUjLW&1&&#a-sD#(;R(C^CB1di&OBu|R}wF7q5n-s{*2v$V@!+j ztUa8?^zpy8=dhTuf(!N*B?;o@$3lFEZGB_!4ahCXCHs6pX!Pkj`&vN$K+ILU{&!Tu z12*O3V20?A_I4%l;@1y#&M9`fD-;ta>dx14%kHcsSyC^F#sO~IqXR;H{JZvt0iizr zJ$pw$s7HU_J|7V3zdy8p3kdbrf48$-rLF62QQ!QLT{a-p6aUL@8W8GtKeqb>gnHRe z?DqmfeQM#X3JCR}E$2``sK4wu*8@WR<*;LaFYrf~hkD1ZQz#(RJB~Up1%&#->73UC zLOtK7oRI;cer`r*UO=dyo7veG5bD)tb)b zn%8L@5bB@icX|he`lkh*cLPGb(ZbG(fKczIsBLHeKh6jZDgXNq#0ioVs1?RJXP+zZ-bB4u?hE;Lyv6zvr zs?Jl_sD$w%8?I-%Q>r;-luQs~aLv=5Qp3r4onkP{6fs$Fr_^-j-qbP@wR#aqZKvoh zlC-+FwsTiWg1ZF2Wr)GQ)pmYo*#yb1CxMnfp3j+0TzM7K5C zEmY6fb!u`N;(1>zvJOjk-=J7BgF;t}}wg z%+{#qjAt>kHR?GZvzXZ$^_}G`X0}FsXFrRXLGh|{l*P=Tc-6VBaIIppoUTqWS z4VI;!>h^pSrx%Oq=QeQ$vvkH)C$Wtt&S)0X^KIh1!?K6pKs9xyvzVT5Q)ga4s6W`u zS;9j7Wy-mQvq4FMpcWdnXP{-RV}ok=YJj>hjn5Yx@M$8sC@7afi6 zPWy+HDoL90gzip97Bdde!|B9gdi_0|7#7p(@8NV+5-)OL-|6`Da4P&pIVVfg$M5O9 z$YT2VJ)Qb2rjOs#X~xnMZ|L$M{aa2C7V6QH^l}CSBn0X0j0gzz@nfC%fKZ>Yk2578 z)W`4Zd=L=oxjL2=~ih*3{`q?0iq^b4#} zPU(Pj!L>2kX%diF$QY+jK!!lZI#U8dV<6+4H36X!k2vROK*k`|c;{w7-hsqB?jLC- zoDP}bJQI+4kcm#+fGmL|INbuW2J((GAs|~Ilbodi*$a8s*&mRjkjc*X0XYYG&k>K( z%5xPm#VHUF8WnlpDIX9T&6w&m4oFvIFwGgsV#YV7JMk=Ld?V4Bq9pBiKr@^Vm8AU+ zXoj;z$xJnh^)t#d(@FOal`v6M#X0>QGTZ6QQuJTUMaL6#o-9K1-eLO5((bFxF#3K1-dv|5AD4MClS*RygBW4%Wd6c8FQyTxLmVi_Zq3 z#rUaHTIHAa+nfzfWi6?{&Dr3*6cDN90J6)O&XQpgbU&RHdKq7UY`B%((8+9_yJc@o4VmT#ObO7N?(zF6G>IbU{Mn_}X`TeYzV zkSk6rB?+nH;XgR@IHuKmxc|~)RRL!$$JCiC#Brp$?qqayK3$h#%>&3yr>K&I)ENtR zoN-!G&--0xMnJyID#Tr9c|fi}?l~7YpV-Z))ljQHbmBsKzuI7}<+2%t_}!V#ayy3< zol6Pv$XTdlwitjpW;altznl#$!z*E(0m$D@x-jK4TfFubMw>HQ;vc6gOY@d^%LjSl z%nC?0hzu2q=u}0pQdS{IC{#Kir6G|}eU@t&$$2dkesdk#!crQkY9l6n$Z>T(t3QyU z6C`7(Bg?AscrHOQhvu^UQ&5U{NVd>PmTqWoBtmk8vU-$HqWBuAK7!;7b!2IN3%_H4 zCgPGf7M$!G+4#xtL_+5 z6%MTl$Z1HC&_N~1lGY6yjExix-DPp{riQj!ER?~g|4){*rz7y!Vxh_`^ISZaAWw%n zYVl5<(EW?zq0ubqe%C#h;-QZ@RcHpj36507LzhiH&FMFz`0Z`TO^5%(4C2O+2KZZv zP)U}QZD?aEsn60LDo(p}za$tpCAE0DtE6dz7v}O<14GyJf@eZIo zF_6+BFTLLSxJ3Q-q;#mD7H`HWiPd*7OCVH><+;;RTN(@^znI_9I7 zum%NUT87punJrr5j?0x3Z&X9uS-!^B>8Q2~<;~7pM@%QAY9D&cQW??<(kXNSbrY4j z4&-gfo1s2<`jSk>Nbu<9XwQd6vHY_Gtt!Oy45cVZtNCL?v4vC#Q&;ng4Yeptk{~)G z=cz~)8=9^pPP_~Gsw3LQp;|>K2EU9(ekA=vZCT3VH{i38YCvdiQ62L><{whbz|gW{ zT6S;6`vk-c3YB?U%LbMqq46w5ad$68%+Sz$C23_I9=f0eSIZWxa)g-Sq3bM@OG>c` zG9r}o8OnL4Xp8dff{YCHSCT0HfFwgkhqkahc}>fh(C;i|hT+MHn6aUpxFYHLA^93I zE;LTbOwo*Gd}wMwDAk0}oPb<~Obl({dlWvCLw(dfDkBVmYH8H#0@ix?{5x=<3! zB*ak8>q8G&QgFWBglrB?D66;LV>xDiLbir31Y`_kSLkXv9WxW~9wR-{z= zNpuo1=R!*Zvh!KAe?p%Jhy&+DO^EavHXJ(TqYor?B?^0^*b#xk!tW+$N`ej}8=8pWhNJ#U1vv4rq^pG;c~ zwbJ5k!G2ALq=eS6G{$~W%&kxgry7BrKY-j0Rj;md9>vex+o5;0c(+lW7{uHOt!9~q zBmbe2n@Vm-Dl_%k?t}`~Q2BT{aGWXTZm6>sX`Y^ULvuLBJU#D)K4mda&wHVhN^W@O z8oL+zT}iU+)f3Nw0%(hd{xNb7cmH(Oe~*X z$5RIKIFyxTMOHi&A^(PQuyneCH`fpu&d>66HjHvXLgAt;gK-RAhq&SASOy@UUXXO* zax9aO&rnFla7C7u$R{3>HC%W1H|r(?z?U@wq!gYYgT$%3xcX$48nD4FTb!ZDnSv)mwj zQAwgGoeOWbm5BO!-`{G1cfyb+;TV?9N2J&eX&OGRBu+G#AjBa^^YDd6I@QjWSS1zG zDqOR%E>AbadGDua1xVNMN+mPJGQ_+B=^p+~N!k_OGyIQ| zv{p*bu-BaOnXQgtW2EXC&Z|VHY6p2MTtx}yz2gd}--h%G4-CY_ASO0EonvYtrZi&u zguhafBuXE^H#%{4`iJcnw5_!A3<(#kU+oI{De2YVpr0paR8M&!d;9tar{Zrf6q zIokk?)j{44w{NAT>Pji5L57C=2V@>(WcZ|#M3HF~+6a)b;l8bPs!GUt9b|lXf|5kB z;Y}evgT#khwb3!JT##ZXWI}jBTarY4)me&zkV)Z_EGx0c=OI(W+1sg@)b{Gka1|x` z%KQm2Gs88NBnxvL&J3?)G1uX&aKZMJPn=kaEAtLg%?{`6NRlkfbvQqq#A2?x55uvq z>lhNc#y$$Cu$U`qVR%a?9b>Ma#oYf6VAjjc_7b2)`oL)Of(k#a>%-HVUEcQp_os@&vDG5 zoH}NGxID*PgHX(daCMI9n@h)R4AYQg3!^#zi`6isqauKupeuP{KpJw@WrWAJ}--hogNxLt; z4|nXP^C>zIqi%@#K0J(N`6_%>F+1`KZ(->N@gdj4_50{lQy?_E=uUWffenaC5CAFgUC z9`OcJs+pqrw^~X>@@P>t0M&=jMv5v)s}G-zjAJqN;d7D8ET;B*KJwxq$~o{ zg@w-h0LU9^PjR(`%oWuoRm@YkTdJ6Atb3}MCv1=Z5W2?RN)>aB_5Kf`YphS?v?@>9 zJcoXfi@Joai@J)wdeATO14|A_1?*41$j>Y<)xy<;nxuc^0ZRi2)%*h@k6Bhi#$itf zMx5d5Xt9wT3i5MKo#xa8%qkoE+!I69{%kkFZW5|$5F(vxhy;{jjI!0uF zAKxZ`yd7!FQUJ0OGCVSnr5ftje{ijiicD0ZS7-VHF{2~X19A*9HZpl6l{xK>8y}gg zWVXnbEX4)HjE|(SEc*-VEkoiXB}eHis>3XdWI!fH`m+3j`aT7c5E;dC?^V>;kar?0 zl_Uxm{e!HS(0`H@r?Alo93Cs0hHD2ID17P2GKZ=z0BIsv22kX?~s z0T~VXJhF)8pFX%!Ap0U00x}h{Kazs<)FYhy0tV5IgtdRrOLgI)?b6j`8Twpf58 zwia?Yl4p`mRRe9UZIGjp+Dgz<=!g`MFLB;!X4<7lF_w!E8ce(t zDaA4tZ@Xe3mm^iRs5;>(lMK<~PD5L3G-i+7ii~EV z@xu<-uUnCKSSp~7qL`l}(^!_^?9jgd9GS!N$wqxNevT~EqV|;D=l&eoswAyEcOxg2 z%og-^vNXzkH{wjyNB#hw_*EhIBdu6=vOJ7zW}&yPZ{vvl9@)im0x`9a>W|2YfHZ*o z6}cXeR*)wVIZbbiQgw#dSmT}~QIPb8MBOSJb36~OaBM5RJC>ziHPqIKdCHx|(xj9W zqaYdFYb*nC2IC=_+?eTlTi5#PCu~;t7bS^eT5XKGBPN^sFUO4FnCz~Xs8e-f$>C;I zk|=sX=-VGT-F!22OkULP^>LhYyTw>avgC1}XQ89|F}9W0t<6G5l_bC0m1W}BSoacA z(7mHXx6o+ZxQL6z@o;>SMW+(_EEjXzvK&R5gx+ZubH^&VAxVD15qsL*r9|hmJts!h z+^bsDcc5sDy14sL$!xJ97go>1)=RjLS@LwlQxEd2>&()7nq@lL*QnK>bJMZZ!r37y z>1JiA`ns0q-MlP==&nReDYq!gKd42i?k(+>WGVLmH5Rs2#;w583k}>9a*k*)>6ssYGQEyDWA%2EX)1+81X=P zs<>wZauQPAz0J}d`%X`*m)xGXi>MYob_~yM#ME*JvrzrqyAnpJ+&Cp^Py9OWJSF<< ze1}wZ-1Pyu2C3)n3kYqafqPgXp5Q0LNb z43AXD>L`##?uSa!%G1c*s6>z3JW?^+l_a>w?&=ZyM($n~e-Q3t6?2HC1jNZrIiF;? zjan-PTW#!KV97j1&p>YMes5xO>ztdoH(Ao*sN&KPP2Bq|9-ga|PgD0VmJ$$(Y3kZ@ zXulHNO}wpUuFvungkqYxSy`H5>oJh#ZeEuDT%P7`F_vY&(#j2JdArZEY=h7@uv)m4 zw4}BwTe|&~BujIgTe?$}B#Onz*~ignEcfk@Z zeefQi*1e2%mnn%8c2kTUBBrmqh2N#d?yRMH>mxd&9S-U5ie*~LV!u9y40P{( zLXs%n{axRc!`#-(wbaB&4&A52-AOD5*65fK?rtSm`5*b5LOvs1X9cB7k~`L7+yXMn z?YL4)bI5hbXt(4lEi+KUJCHGMeU^nd7r#Nqx?NccA?6>*IQJ~e9~fT^<-xp4x9w`3 z&yR>n4;k+cW*GvZdobRei?Y(lK$#d_<_Ye0mSJ2+O?1<()iDw!r9Dk>8!1T?Z|ug~ zWaRvg``0=hbG4Ba#UWGNGN07-bQcSpB2}Cij4P@oWQN;pvz9jJFpC*7*G*!1G7;w!GT$A!MQ`2INFTYgSO(VC zb=1f1T9%5qoA#pJvd}%MBtgt>p<@=gXO*PYNQ>RxpQ)Tv>$=5mUnOZ{7fak>O5(&_ z)ITFoo+a)UB{$^lg1XnX)IH0xzmOCY5%Y^zQu5~KFke+YI=x4?Vc4NCO; zi^E8@&poHbZH;3XgP0`uTb39I)y7Hg4J8RKttOfo4VQ!NU6w2B_1pi0?(Zzmpuh7r zQXO=ku$bSK9CX9G)Lyu?_vvjNbf02r2BB>obaSvc8+AU(ZUL5Wui)Jl%AD*zqea!~ z7nIZp2px^XZd)a3N8^ZloW&fCV`!bzpX3nrwyq-8m;WI@Lr$cMd0w1M6?3hgN)>ah zo=FvRWu8kFbM?~fbG>zQMO{o4b46V?lHOcDSB!+rwUH*~y#J6IWA^l#TN5=AJ##C( zsYh~dxb<0v-qKIl8*Vct@$R9YjkIMMQo%?J%ZXX~`F_LgsU*(*9ztjEhC6^`#x>UC zHb1$aC`oVy#@=ZpC&gXIk`+SZHaFeRSvDb64Dz|<9%MNIp`35ICzQmyXOi^Re|GQb z7*EO$ zLT!83Eya=-LeIgwZcmoyIp!C)zmf#E?MrAmAk{DKFqU4Bj7s8I=nFygeUN+ZyDapD zAezsA&z-?SUn9znRKL3OS?Fs-1(hsip|24=2f6RAVWF=PRaCM?iN3pOzaFS7AvjL^ zkVTKv)q8!;3XQL}fjs`7eEvy|p>f*R5%X`VP(D2&mWLu>lsH+Md?GBm z9;0z%H#LUxp;|qfDwNM~n;~>m^Lpc0=*y~fPV;$_Sm&mk0RkVvCCB1!0@N0t4 zrML(w?R~@25b`6WjCWs2f}0Ox1-Bt(y}wv0Lw<*p^X$X=`0T|qm(Fr|&u2*=VV84_wul;f>51M-Yd#tYRC#+NfuN4Rq$ezq}6^Ey`C(l_N(L#U@^5{Wp6l( zsr@Q@IwrODtKzjirjH@jelj2C0DD(izWEcglOQj6?T_ny|Dy}WW0btf z(&QC=#9r`vvGjn@5v%46Qj#bpW5hlyQdRe6u{?l01F7L{*Qrv=^O9HQOI;qCF;xvQ zHNC+sH20|v(p=&nYWf@dKR=UAkDqcSkAVUVkD%6w}<5ro)Y6BExki5`)Wz? zE~FLa@aghg>WkkkL0Ws?usnKM&tPxk{lIb_vo&TS<~8qU7J>52g|zh^vNV4MUsQp# z^ZsF>cTx>1;_Z?b{z`9a3%0ccF&(@NET^!o6_AczPL>VW)>_ExULhs;rX=oVdggZW zO0cwm&@;EQS58an`HJyg{x5mMYr(0^7bM^G+M9eH>MuyX>2+aA!P9CZw%*0-%|c&2 z*rjAJ3w<3j8Pe4o#WDeMQprRX`pV=bNH_0&7W&HMbtSV|%+=f7`H9$ew~kaI8ZCd=25-<8~FX$|=Y z(%busr4Pi;Phy{>GnnA^!6+8hHnE=1G6_P@lvuA4OJ=?Y`*<(1l;L}@uUB75yn7CP z#u%jP=M_Aqa!x&i{k&RA;>Czhb^E!$*I$ckeml_L8^*G-xD-*8u)jCqzw#O2om7(6 zml^0?K26(-cQdZj_2EG88cQ(<)rSMUJ4zB<^XXNDh&sgYtF4^&no9KPcLf>;Ks3e(%zSZ&~QYCmN zSm;|V^_84wp>Ly5%lsYh3JZN3g<9tCcquF+X5oz?Qcd#iu}p<@guLth$+CoFCVTRn zKF-@Y<~=XUvJFR!@|oggW;qI>eBSr+uzU-lx9wBCA}seHlOfZ*l1kFvE=~7paE$58 zO!w-rn7+((uL+Ck%OrYjSWI6g(d*1&`YAKK9xSGxGQ;c7V){EXy7JdBtPhRpGbo>xazd<+>0 znd{Y4f^k}0z2hPCy{;Tn(6z;TkOkfjC3<$m2atu{6(#ZRDU4z*fGqMdUZ9*Oh!=4k zE?3fB339%Q_r{PV-Xe~zvVDXGRP*L&Sq%A$2jqn8`JVM-DNedFm%Ng=7u@G|4t8iDx?4K&dddP2Ht6#J% z8;SBl{`PAAs)fdFet?9d7g(~)!I6h}(W@-Gkc1g?_3~HMW;N_vJvg@ zbOrG=iVl9L<;ofnnasnoSaha#+CUsq-FFl%gmNid=F_8EtpBi%%3L2O-S45B$i&2@bx;#>(T8j z>2aTi3Skaav||>XDt}?j2Y~d9Zez)X_cG5zdPgrQ(LD~jzxqb+X;I%Jqpybbi!REl z^D%eI!02uky5lM#pMlY%EOf__42oW3X*yks8j!)!M(F3zp6+@VzX*ejh(5-gI+C|A zR?rPHF4_upGRb*dW5Xd6qPJNlqmG&kc{f@eb1f*QG*W#4nG!vYdz|E3q@u5(&4|+b zBN7^iT!olf(M3vTimWTqGKb8LUgnsbD=^*ynHSB9Rt}|Ff$Q)fWI=Qoi-qfuWMT9& z%PgG1laM9R!+6e8s_FwQaSgIE+7{P2NscqR@w7`{F60$#<75_`AuHi0t z34cEv9f!6fNjcm*tsy6(_X5%zayIG|(=oJ`&KStW=v9`V>6(XJjh1;v$Hd`ISqZrj zeOz42VeA+6J#R-FmC#bUvlM#}b0<3eSuG`TFQ0VLpOJ?YvBW3l{V3yv%-Q7W3`A%zhsh^XD#7R{iQ7CJ9OFn4J_t6blLnpEJbh)(l>3h`^Q+!cj&VF->{f(%;oTJu$=vlW@h0T z=RagItBvLKWm$bx&1z#g{R}K-wXs}&UKX?3ST6rr7PHz|Zoe{1qXqiA?YaFrEauyA zdHfbE=G$<2{1_Iqwpd=j4~tn_EU!P3#e5qspFfGkd>byGKbys@Y?j|&%3@YF%kOVw zF>90+@b|EoHOdP3$63r8Wd;3jSj-w_1^u5`%s2Q7`43qdZ;`6MT*$Y|>7#1CF<02n zz+%2JSJ=;|1Yh7n`!IsKv4~$miGEh5SJFNpSs_LJaY_zY<{O~J{N*g>d!x_z$5_mF zIZODz2J)fSdr4oGrxMN<6UOQplF$3;SPtOreI9J9v_FOACi^xg%vEUX`YhADrpA8pfY7|Arhe6cP)o6eUrR~ayrvfZt4h+|cenJL>r|=lyIcD0 z|0|zX{y3c~^?i3Mzb0A?)P_9thW_p3YkqwtX+750{1hGI+AH*E*lYehmV6Kz-+0ac zlciG+9n;pAFQ}Z|Q4or0>ql9(a7;TtGs{;T)6UPMBw5mvdJN82d%rBpd$sjkh>m`3 zmIlA-`4X@D$R2-^LS~jlC%>(ZNu3ke*3_bHhmNG4!gF@C0MROYmq`ERJ4 zgYWf>==XZ`yS6SIlPu}|*L%pPYpT%uuQ`w&elC@>KJRo+d-{a}LSs8U{c1{XNb{Eb zEx$oP=q-6Kzg-{|y?>AO2Xl;hE8WLG%wpb3_w$=oPrK^qJLv=b&Pr}b^GcQ z)=nSe=j9l)cKTSq1dCaxeXL)J#jK`2)_+Ay>esc#`puN2tx!GIAFL&Hh3c{XTo$uJ z^;mzm5`AUT_|I5>AnI-&xK7X^gYuZ#1~2ZZkT@&2QL(7W1r zzjRG?G}P*Fw3grmzga+Nt-Oi;I{~2;2owC30ihN4-tn&lgx0v5 z9~ux^5plM^As|%S%<(gz<$)_xoeNsUajst`Ahb&1JikXkXvN6+{-l7=iijWjdjpaO zIWF+82832|{K%J>&t$ems}z3hR|yEMd%4hW7Z6(4agjegAhhn~Vt->mXkEu8eo8=S zZNsI0uDWU4qBSj-`7Z>7)@=O5AHZ@fuYP~A+@HZ>)<0a~Z)P!Ty{`06v6!`9SNgxO zn6+M4`Wfr#t(&!8SNWw_%v!Ij{H6h+wO&{I16j=4vupk7EN1Q5wf?6pW_{7M{z(?I z2I)HgSC(l*bRG4np8@?_I`U@a+fV)CN@j~cG3M}b5&RC??--DkkPZGqmdG%ynh4qK zuMNln$Y*{=%oV`h>8|}0zdyiVxBEF+Hbdx2*zOl%If%Ee6tlxG!SWS^Vs`lDSm^x) z&GFdjzraH8FR0$w>A%7<KQXe9}( z9OR#2c?6+a>wtfmWgSM-DJIFk#zG_R6qDrNVflq)4*I{b{LL{3{U9 z98ZM%*dpke`DkFN9(a`2|^4jnQu&5BtSgc0y?15Bp_Vj&aNpzbeaR zjydAL%n~~qzsbgtKk7GNc^h&=NlTU+7@3YiS&#W0Se!fh?b|WGE6XoPMc)TG?#Hs& z*w#2DLs)7-D4#F=(JbvD^wj&(Phj~9`B2OWe=5rr2*sT6=djSb_4_E{SN=kla94~x zDOt%#p-T<$u9a07Chk@{h92M=C1MY5z3Kb_kW{w10_Z zcW-^Ip7DQVIRc?;^^AX;r7X^%Ulb#F{zH}*AoR_fv;IFUUtGg;2_-z|hZ^c@;{=56 zi*x={EOobG4Mn8-+Rx6?0#aN_0hV5`>vMYEe}?642%XdOei;^Tr7rUYzY0rM2$lJQ zUrR~6n-%9B#S!25ud)<^P|P=e3ziKVbUk*_Z_hHXpiXtsf0JcBgi>Afd$VN2JgXSU zC4Uf0NeCU)Oa3S&X>IZpnu5zNBKk5#bzCIM-Um>>PYO49mq*Zog)jC$ME88O%Wqe|k$jrCGpQ8#?6G3AUe z7G=;^-A{gbE$+DY^>=fA@~bO}S9{SN`TXSf;Zz54d}s!Hia(2GP7KEQ5p&b;*i7e~ z5BUs(-12KS*OIL(+K-T*{gZ9AjK^7~E8(`^s-2c0xW-8C__tZc;OZs0>*sB+W1hu5 zNb-x{h@~#>f=Q5je!31i#u=+)e)TW2?C6d@8e;DImpf9-OmU?verpDK;AccRjI4n? z^y@20>(T$_A5fCunlIS?<{x7*U$FhnKf_}B1;6>1w4}ac{muU|AasrW=HCtotpohK z|9e1a9pFd4=tL#da{@P^gn#*klq9$t=1cK8yjMD#eJta(L5j}yw8 zMZ0iqL}{Er`(DnBiO@KK_Pv~0LWIT%6jRqYb!pqjZ=M2~H%o4<~IjSq?Y%DH@Cqp20Od8WrZxhGa{UxNX>2z1p7{_ZV*tHn9S6QLG$D@#ccYEczg z%8F2nqL?OTWf5vo6w}14t%S==>MZy!@dA9? z5AwMAK8t!rs4=9O`H@PMtc~X8CrY9=_MJxW&CR(i8PU=Z8tFARzxkh3EzFH9d6B+2 zrjH@#7G}xbK|Ry>=LxeuOPbLTF|-#?nKM+3@u)~kvq?Wnm1ew;r)!=>K2Mv=L~>C- zl&Y0EroW206Ze-pAm%x<|WxSPbc5(zl8zACey- zJ>{b?33ifHvwuh)hP-8t7^KR)z9F91LU}UGF(GM=m|?FGpK$T+i)2+cuOKyu8~kgS1>H`j_3n}_);WTLqpD zFiQ=kobz~|vJW!JY^NkjwR#LP+5A9+z61OhWQw_i1>b2$%)gLn<~|XMF)HHQE9Nnl z)dl)(!*g+vPfP>#OK^L;)t1Jz9vFn^{4s89J9ZO{x0!cGgXAXOH4IC*Bq(yiK3@PK3|yGN>cP!i07F( z5<_3~rBw6Gk6Bh1h*VPFvY2nqVhLK^e6wJhI$qT3DkJBGrW2C-kZ;TmEJ3SVY<6V{ zYHYEYDxzy_iMfy^Gx|(p)gvu4mx;Upp;^f?a}7(-dY7APRZOy1UvB;yk`^e>a`R$H zo`tM13!|p=Xt`u9tcID1kkGciH(Rj;?RmBNwuo-ex#l>QppE64`;;WxSe{uWowk)1 z)opC8*`Fn-=k;bbi#iM1p@i$rNg?SB*@;d!;Tv)eRTaw9!Z zp2AKT9TGzcxemnrR|*{ZcZDCEfUAGRn&_ zQ$@aCi>p0KxX)ZCG6MJY4kKp2)avS@x^FpP8Y5KwoJDW*7h(>YYef#tRQ<+bbJ9o^ z(+x3nE*~+!7ugA+e(b2ZS!5rC`k!OwPRu>1=Kn?CNyqDi+2w5|YtWDVhnN%QSdk5q z^PlDnk*A8P-^e&+wir#RvW;>}@rHgSyxD3FVL{I5`6-_>=GQFh*GcGlan9Vpl5W&M z&qlTJkGW4IZG~EIIdA^Ml4&%+@uE~0%tG(bw$hD3tMN@IZ0lb$l?C5^T!+~+8<7kM?faEv&FdcNin&5!-m9Zh8P?j6P(L5Bwy~re zB{8qO727IkHGWr>u%bv|tHl_SEaMWM8?1tuqSi*1bio$>JUdA)95YuWXQb(>Sw$()BF}bG1td=5uq;0rXTO}zE$Q8}AI*I%Sp_UN0dP=GZ z->R!j!Wtm*k*C^5F)K}k`c7(N#jH^xw?)-ernoguNy>zC>Kwem8ZR+bvsBBx!J5K? zRlbqxDqPZ9D>3?aVMdSF(zT zEI~|rj!6;Ogql}kDv8X*==440T*-=yJX$(r`IRqG~+Su5qKYTY6- z0Qn%1afekwQmwdvcdkKqSd~QPh`HCgB(hPYfmM4v<(!`~1P7}xVj5cAM6yL1 zSyNep@%(+(!jRBf_kGsdkbGDG>j~D+A)%i30qX=yF#c(56`Md?4@PkhT9rifwdojuBA@51wIUSr1*Elgl|_x~zJav0qLV0RCEr2XS;IwWzOw<+ z-Wn5_xt(_7>vk8jnWnB`XoK3{^ zw#s58glk;N0<174AbqUcl|&9;_E#G6hV`I`@2S3}uhl|i07mgu5!2U773qc%$UTsL zR{f7v&Oe@2z25+23W0Gf>HNCs{@PbHy%OEK&v-PZsa1`A$G!e(|TJZ z7wwQ_kTrv4f20-K7`i)Sur)6v^uoTjc~7kQ&kZeyB_mFmTDqZq+cCk)fB1S5?`d?m^(#Yn2Kk6A*ojVkW_)BSr3S8 ztcforu(V*wHClXul?+I_)t)8I*o4XH^QfN;YcoqQ9~@~#u?a9O1Fgb9`-(jG#y z;|W$XB|IObeq*B5gJpFAJre%FN)^!~;Sa6dB6|G%k@cU59%E0oN=~P(2fg3NR#g$* z`%SUBi|EnvbgRFJ?)_$1b42v0`%`P9h+aAQ)VeC7`?{G{(HXS$ps$;0UB{wkThuaV zTGd!o&rkE*Syug!&^-5ZYqZKI*-Ol^R;V6VdA%ORT*j`fctd)^V2H=;?}TePfArh9$UGF0l;s zXw;tjp2U7*FP2y(STc<9r?BdXeP3pEWXU!35nN#nV#zdU1%`UR71j*NN4JFUte-{B zT~IySO6#}?y~nx=Ij^)Xu;d!lqG)8k%5pFUMVmKtzq;CL!IEoGTcuT_Tx$qRn$Z{~ zq+_wh8YeNjh38opRX%)0qiexhtNbjLv+keQS@$W4((i3iufD-*DMG)cMLqTgtFxq{ zU&f?$tqs;7k=}Smel21)THQXQoP#mak5+${9HaLKhOr4TKU%9$Y_c|ngj&L8 zYp0~D)*rKD#QbbE`kZnO#sFKaCM>}b++w|~B-&?s#5j#qTdeLPBOw2xf7$LRltby%8;l$fhV%R8->B2^*9P*Xdt zwn~yE+-1GYk{7u$MfK0StZpiX`|t*pF~YD$vE&$&v9k0imh|W@2(1wvvC2tIkDt|=%ux%wg1^;8 zb$=L$?lZOIS#&R(R<@5xsys`t2pzK?=bUp4N<}Lb$E=RBt@V4soc zYnce$J)w1^)7Bahx_hGJCzf=B#;vrnblN&3F=Hj>FYBC0zoZn#bsbj_o&nM7_g_{S z5k00oV>MC|p*th3F_<`Kb&(joVs_rj5Ya1U=dCG{itdci`1!mwlO>ba(B8yRK5wm% z7`=ve-r6lO)U%_XoLF}FY*yH7|eKwSG^NUB0Sd(fgFRb5Ej z_7?~80K~WFgrpfHVK-h9#5@NnX8#tFj*#MZ)1^U7cSs5QU`YByZmbVxpf+-zS83AK$|>~Y@(spcW3v|VUrAm2jD*nL8> z0&=Te5&f60`8-HjdtOL3LCV=3zYk)5gOsL0#ezY9Fj7SD)!8fRD@Ku7lx!32@+_pLeIg_sA+_v(L(&UU+b*(3?K|zo5XhZ&JR~C_ zciE*vG6qt|E+3Ndkh=CAA(;%h+pZUq&mi~M4}@d^q@LX(B+DW7?Y1FV3%S>RIV3+r z8rZ!<@*AX~Jv1bTA&u#F4T|ZGm}l&> zA?XWgW!GQN?a(l=hCdY2+HMk(5s)_a_zfzC)@|tMw6mv#WE|uL`-lkL-KJD8+JA+F za_(UN$AY(UQ*gHn($T(cBjv25CEhFPWZ%USyj|7BZmcBvc2yU28Ud9Z%RI2LTF^w*Uk_bgfFSk7^$ya>L*p6u@E|@{p=AT zp<~+L{zv4{Fm;D+pj~8>N=33CsRr7mMK(cBK;E<`g@oQse$%e9nNp=2`w>I;tp?d0 zS%SID5W5*hrSz3TS~va+`3$k26`@sPniHkk9a(}|Nt)eFN%R983)<5(yH6;F#*k_D zyCI>O=3Dj@mf+3A47%h|z){RE3fXve#r}*XGg&|H+4DtmepNO0p1oEH&t+()@Sc4% zBs7K`WBEhO}Q+{gBVA)&Vpr`WASLhmz9wR?qx=BLx_5h0{A)#Zj+%CA6 zwyw5C$7_Y{g@o$oJNwpI-fkKas-M+%n~+fb|*K_0tif5oD9y=>^qEo5VO@DAhPpQ{6-jLoBftZQF?|G zvfUmnaxNF&PGFh9l4YEJA!4**nRG;zXDOr;WQV zeb2r2CK38#Ee@Bl*FMIg=H2w(&0hNgOMZl6jzIR=g-%j=l;lG8+xN2scNq@YEm-zP zN*BeL4$%kg`I4#@Bm*TpWS^FpA1dO>YGj#j-~1=#ygzc+Zv6HcO9hcZaa`jdhwVE= zP7KGo1muW)mxzlxM8|F%wHt{1(8Dm+LXO!FiA;fPf*iM-i5$G&FzC{8!hS|%Ib;vy zq}@(r^-I_T$e(s6kx7u_kW+RKk$WG&SBxO1?S3M2?!!|$kiYCyk*~hTRi~g~{B4gA z8Qv;lq(IKtV?-8rj2Ir|tUZw>Gg{-2dY|#UJyoP0gx+U7Z-35`XM9y3_eN2x7wokv zCb>3v(cT=A8Hl-P@BN=tm+Z?bCi)ge8T8)hRlD#h6dm_vMnh;@S8ZElHLimcW5kMy zY=BUV5xYgCh^_L8#BLLbK`15?tIiUXxj?KLOB%mH{6#gaz{J|9RLQ-F#yWv2=;h=}ndR-Ta0&9OyS zRm}IB&>x^YH^)AvW{qv#xIm3SO2?M6q#I2JKzR_3!aUg`Jb3)V^>*%Blvvmdfda-`%Y)m^RbdF!PZ;HYJ_6wJZ%?i^gl5##9E1* zDTr?a6vBH7u~e2cV?C~rOR!%r$Npi-GRn-uCu59IJaB2}b5f zm4}#av2R%NjMz536M(^S_t+U0Rb#ZLJz|$6MsK}Gtk(6{=G-gxnuyNljaV8>kWb&( zNQu$;^o>pUpL_-++acW%JNFQtD~Rp;pPYxr{#Ft_I7H0{Q)A~?f;OKTGfY)Ny{**P zED>EB>9L0`6{E{MBK90hQ09@bjuNBu85zs4uif|2vBoiyETa#`TtA^!vtrvECI8}1 z&99Jgv0?7D+j>7Xo+a2;PHf8m#N@>OV+r%4zaD44&L9v@N|5vsYt;?_~i&} zYeKALTy0C2d15TXSEBcQQY^LDwdI)_D_Wc+D9^N5j3sE#(_)QSF!z*pI4#zs1f|L{ zx}xeohGUvqlu>`GdZfqD!u=Ouu??{Z^))%q&MD$+Fk4<1n zGtw~HX&A-)BIcB&ZKWCa?MA->Srls{((Vf-i(@~r1Y2Jc+ovSiqL#)Eumt5<8au8e zYIMfazSz^Hu`?oZ$iFO?MC!~^Z_O`@SvPX6MjwSx53np&Mnr!HZ+Wbyi2e@V@>qSA zpq^L6%uRvNcD`d;GR*b$bXHvWiJDXU`W+D*s(aBQ5&*!h?@A=QysyK>i- z`B>~tNEA62I;?uXRfCkOK_Ag#A;Vi^`piP>V$Mq<=S7M;Z-{*MXT)fUm=ew?kpsBv+7?pE znIbarUyP$5Wt@c~u@zWphLm-F2uWW^Ip0)koXWJP`6&+}pCORS zP7M}S8yPH(RZOG+_VjH?73VdP`>_`^hpp-imVET@Q{Ul?3gt5vsqSz-kQggpjfAT? zGey3epk<-RMhNw6)tv7|7Gtg3LT6Il*(9UZ$;H~{u8OQ zUFB2LDOyGC`;~0<6_J{bFESMOkZD^roiZ$W(G!p9R25m&wx(cPHJv(=>hCIQrcldi zDAK7NzODKQo{@H%s(ey(KDC@S5>w$t{8}UOspXhesXVzUcS73Z-)cFfSh8_XFJdg< zm~JfjDNlD-scJj^9h539`W=K))plC2MlGrPJelY^;r;zJ`3t3WAs^2H!1ooxH~EOEVw5r`YfoI z6nz#nOo~1W8Ye}c1rJ>#bQV0E6nz#va*fbg@R$}$p9Rg5qT6a9x~&GH+iD=Xtu{~Q zquXjAx@ERV#^{zAh;EsI=$4t3!uqTXM4y#UBy-kh<&#O#Ei(|^G6T^qGZ5YC0?}@TyDp?-g##$ytpG_^DW84nYqXW=GwtE!!BAvfk)H(POOMz;17UV_s zem(6JVaZR?NAPJUE~1a%(@tp-eFUF&?hw&O@ENC`h(3bPIFGQXt*=M>dDeMOV)QX> z<#ZC!$F!C6x`;let(;U5eN0<9@2~{DO)F;{OIoz*N<7DhZMAZyvZ$@^V3{MS^znMm zxy+Iq)ji2`PVwqgKf(3uIj5Y6K69UUYKZ7Fx3$wiM4!2BoX14;ncLQBC8E#Vc1~vz zedfO8^cT@*Zf7S`M4!2@I1@rbXYQ-cJQ027c5_yTgwEU^&TmSR*RNiVQG;88q1#w5 zrv^(}^gNave@Cj`P6HNIhX+|6R;lygZXGx3Fm#PcnpZ-p17M1h$EL9|xZcziAMJ&O!X@Ij(#LJRA)3xesau~<}8wYbp5>LjJ}ii!gx7VtwX-$w7KirH5S0kbk&N-1f5Q-V$ToLK;o{Aai6sbe|o*5kqp_q}5!xGFU zMmarM(u`so@$Gcf^E=Kw5&DYNy^wdES#?#do@t6-oPmsSO5Lr5zK=~Z)@gB%k`1`Q z@dRX?vrVKR#(u3J?>o!ttC+u#b0^3|r{=wZ41`Q}x{1Uw(xX(@>!2n>oJI#>&$AbFRT*(4q4+=e?+C4{W0!7L4I(IN0r=ydrAL5Hae|D>QFaZ3o8T8B9VbeRTQ$x zaUNHxosrw)YX@B8Me`THT~5s|LQnbtG&oz|R6opCf9J?wN~31*{* zo!3-M^aS41Ov4)FVW*!+;Scd$8f^WrlN!qBRmc%1M@jPQuScEfBKk>;qs}}Lx=Y>* zsg63iENRB%TqVbx8PBMFKlCZejF{ujP8K{}+ymcrhWzO?dsfBt&&Dsfq0ygqo)UQ+ zcNs<^<}asxDCRxL8E4^hlq%TMv(73Ob=NhgDDJE|>y+@C13eFL*7;9jN=6DA?UDYR zQ{Z{ZCo@_PLTB7L=X#N$I4>yXA15v{0YWkVIHg2%t)6$viRfBA?^IR7Ti=GK8ZJ0> zLz08N_}6(LBp*TkbKVTeEXZZ&3l^*q;k=;cYPh*9!IMRX+p{(8MPBlo-iAAdCCw<0 zb=vm$e}>zw4aKD4ccQcmYO7@L_gZ$gQ!;n2dUD2atG}S60^}={$8aAMiDK5~HZzQf z+eV}(UUgrBn20;)MU^UnyI!jx1>A!o{p6lhLAOu`6;pern%Na}Ym1zn6*0rv(+?l6&eE~>Y6int$$bU^EU6Z>A&oyQWi!>CJ@jbp*@ zGEhEI_vTJip3Eq{H?f(ef(X4gLFZ1?ttL_jPt;QhQ`|Ztk3#6#o)otcOR#2so!dmk z81#jiUy#pr?i(!XX$0E3>Go$)Z%Y2oGKwX5^3!z3s(g~GbEf-=63&@QXu3;Sf}AaP zIg85qC}J#k6HAb@)qHsm6j@wcU~|s;@hXRJL1P z36Bc;BHD55vIO}!ZX*`8Ejn`@w>e9Yv+H)2e2)Eu-WWCSy03{`fKbi5Zhw&-^VON+ zxv5Hczb>IXo|`2xx4eQov$b)j*qtbH2PDceEtDz-Nw{B0Ob^^MF99j;E)}7#J>Sfd zD{}pC6;s09C{i3kF(usXO1L~UeZ9dw&l1$ejqXKBMKeU&){Sn#E~;hHS9&O)8(mX` zMyJ$POS!%XjkTyHlyYxUl02q2x#cBB_lGyRHAQrPc$3>Gl#2Spo868fq3g~qZaND_ zJNT|FUC~OrV_1Tx@=CjlBt}0MSH{f~(a-YT>TVO!Pt%ok{}9n%K`-Z?7SYcHmUj!j zLbZ`+=w}PdyTwHG6M*I23L^SCSiyaW1;1h@=W+%284>;b;cf0KBJ|uKwcgv@{w(Q6 z-QQHLR&t}Ss;$%0eH~Gb+uesn^mBui-RDL0bAy%L?x9pPI<4%!6B25@RoodNp=ScC zx|>5nPo~}B9u5gTbym$S-Zdx>J!4kgtr`+~4y}g!KuGBPs_DKM5_%@EmfJrh^h{uF zcT7m=nYTOLl_8;L0`GEngoK_6tmFO}5_)#7u3M;EP(pgZ1=j8LqgBIHE`FlWE#Ejl|ss=p?gu}R6d?A!M-rPlr-|ENVm5X{t}Ll6 z>Cswka4&#m1WWMU<|giJmKfixNKH zJ7TW)h+CjXu&31Onz{~4wvmdf`ODbW<8Diq;K{UR?obi^WLk4~w1|E(t+_jeCCxbU zB}Nv=xw(6uCAjJ}cdxRjXD^rGD%{+SzDDKAFg|_-_0t@`@9vgi$utHJ#hZeNdBVL% zvhM5gnp6gX?IOXY9XeTdm$u!5!2c&(UWV#pnUE_Ogp!3 zNZvxsi*BosybI~*_7}-VJyQugxf?}_6)I?qM@(n8OfQx50}v`<7q_K|QJ^5Fdet4y zl5V_m3QyqlGmNh85+!`R-bQV7b2ll8_Inz?yaDO%qPp<6y6EJO4C6Ak-re27F?q%X zyyr{O!_5!nQxmCP`+uo=x<+p*VUVhq>$Bt<^cxU#1be%ES<<5;p1~U%$fviP%93gP zeH3r-VNZLz`$TR%rsQ?E;p==%lUJEO?!zqVxSv2iecTt7L@y!dOOQAIUkTrEU*VXb zgniw?p?ta_Rlon2s=qt-e^L!_r|NB?4hJFCK=(72w5Tx#b6o7jKzDv9XR5J*?s}GN zgP!`Bi-b8lx+`?VD@ znQl!MRr6G1neIa@YQJ_NX1Lo@^2tG8cLXxh?I4nwh37XRqukys!Ct)Wjuz4TKHAM@ zQCmNSRHNMwS=834J&$(3WKml`hnRQV)hfo=iP>o3JF(*7Zeao#Xm<%vVG-Dg=;d2V1yXHn(36_VpFW(l_bfxA^iZ|g(%HU_7&z-y24e76IOs^@g%GvDpXqV|INmig{b7PS{65wpO3N2M~dD&Q-!kcI9_7PVg= zK)!Z2iO_Y2V!m;IX9-I9t$RU4*Xkm-)SJO^pNdqA+;S|zabM)tRbmYP8gGOlX0iJa ziz?w4kR|SO67x1@>&qd_++HHx-$(DklEIQ`l%Qw2Aj{o}BJYpHQ}B=#?gEkOkl!KS zxf?`kZNQ2VWTm@XWW;8y;y_lpM@82EfM=E=-@6w?>@9dF`!2jq;1(UEjwwB8Z9;Ng zhXv~!^OUS{Uk$~?5tHYpg`^bZ2X~AJweYf#wQl{vlyh+0H@Jscf|}ppMuuG55;nR~ zmUM2<)sfFe*HOaP9cs@T-Eu6dp6^1;k8a(NG=Xe(pA1QB$TqhVOPX=M0KUuw+2Ot+ za`GhZ(m-~)*(|EJc@whBohd?R3dwGFkqGtSZ$W-_FNB2h+2d9ls`g7?9e#J4vIMoU z*ZojpbgSFz{>Y-vf>Fq4ue+T^wL0o)_qs<})V_~F%s%&WNTxv!xNa(KJ2iFj26D#zhb1WUS=ULw zwuI;0;w-^loOA25q(`H8ci>lytj@WOS%NX`Irmu=!>x|SwCCJjk}7u`&Kt--GD^uS ztVd{CRu|RB^t?NOQ)Tif&Z&d*(9IN?Iv?M~V);~rM#Afm^9A=umfVOQv;FICW=S`m zoTtX&|GGD4(4M9n`CZk0kbm6=Sk!!{EOP$OeUc^H_-+K=VuxIGhp3onwOtXT7UYtf zDWZSd>yrDfi2iM_OYV4)ufK>G?XlI%?#Ci)AvDvx?9LJyJ*@!8Tyf`#%z;qM6?ZX9 zx>5Cc6?4_yqhgYy%B$`%mTcoV%6vCUc-8$&^3f%{>i#RDOL)~SFpO#=Gx~TLHIp*D z>qL4%Xij8!ah7zWPd1*$zeF&)v zc+FHk$sVbI_mbp8qspd;Dd_cN$utfw#@9a}g}tF7bPkdf@!l1o^YkT1QST!W>an{* zqTU>l%QxZs^NFp)M`dZKn%!kZydy{nc@BGY?nIW5w+kCq!pa@$BA z!4h6YmTaTlx45f@y(r;TQ!!C}c9-z#i0HGsgx5%Ke&(0a?g-r11QdP^g()O#u)y_Ryn*Fr?Er8M?Zm2m65f-*no9bm~%sUpt)c znAcfis^O|vxGug2;=LwvALM$L{vt=mq344 zbYS^WQvFZ?Pj5k<^tMaP4oFXy-zBCR&eML7r@VZLxeqd!<&?y9Lv3V0T6*V2QX!*Q zj4W=yc;B@HH7y48Shq!8HTf)VxIMG zmzeh<6!WZCOJXWaR3oBRUOkDa2ccuy%4;k!)z(Ig$=LdHUQ>yw51GO8w8RWquG+@) zUR#No2BCbO_c}>Tk;|BuBUNj!hs2bE%xCGxk{La@Oy$$Y8!F;RK5e`al2696h_MK% z+InLop9zo^EE6SFjm%#t4c5i9K!)6FZAO~)cLx*yl>qR6?sXNwf3=kQsIi?qR$=QLvM;oTyV z4x!Ot53i!gjis^nj#RIC)kSJUO0wK7vf^eu)d1<~-6yggavRH|BI6*mU%k91MW#Zi z%)PwUB1h1-w1@QeI*43>&=KtIbrb2i9q&3I=hwYHA|FC(vkVq_A0v=@kUripk#8aQ zvAio%Q)1rmazvhzm^ZwSMd*txO^~XuH&dj<4qOLV=83G3mf6o+#F8G}BQ3L^w@PAk z582;aC!%}E{@xZ5eM|>9L0&Nt-D3~-ZWhr!_F(Te5j}Dk;#CvTBZnbgT@gKU80s|=(IbbU-XkKq zw@LM$(5a-iN%fu=(LG6;_mYV2Nz%NoBKj))miM}dz6!tP4HD5;;dC!UL|=u|y?0oG zwTldIro?RjJ!0fwCXnHMDRLZg)w@5RruhN+^-1|f1IS9oJ_l_$`&Ot_aXF~EcTILAPe4mdp$FzgI?H$VrRWE-cKMvS+(Jk=)9 zeq|YZQRY#Q_r3dAvWYbWw_p@LkVnO+wW7hC@YF`s$8Mdi_rmvJ<=-1Fask`2A>VovMG8&9 zvp{ry^`od7}L^BYKga=CDV8mqpus0YKixINXkN%dRJ5`<1j|KRUpef z|0614rcn~(!=jiat?<@|q&8x{_l}9o!Jgg=$@OlZOsUi?@?ppiUTc<2!vKYOi} zME|Z6G1^16cpXFv*HvTDEnYX4plxjR2C?KAGqJ6wv8`?1A0o68*bcJY`%mR#JlhXX zVnBZJ3QgnsVd(+c;XN-xznIq_vdildl97<#yd@&fVLbLBWS_TRqy^3ZlKozEy2_bk z8srb}$&k#29Ps*tWEJF~mm@;=^(dc1-Xf8bcx!b#B;Wf%rz%j8V-9WpljK8=dC?hELVU{$^+T=hxOb5ylYi;;6k?8h1wWyfbfei2e3^m8 zVabf@vFLHHgh&(A23=*2du2rQSoDNfNkorDPk1#&R-KI)?UCxFcaO+E2(^Th-UCXK zt>sS-jK4ffkB9=%tv3)oM+-!s1%c@H9Ecvb1foY)f#_LVAbM^Uh+c&VM2~g?(PNuH z^!z;#J=+RIk9GplW1B$q(FsJ)6avxfElDZdV;SyC;3!`!k$NGqYPG|6;~}S#$D-1F zHEs!{E!wJcO^kl?E{GY{6RqW%m}#%!%fZ*k9lh{f-fN@}Qr#Vv!rSB-=~Ld5+**P@ z;gr{&Mg6+*14wn+>&=p7P~Y1W@|QPNwK1b4&XlJie|s}jK76LU06F7*B{8%T*adRd z`%#2`6S)uMoVQ(4(U~%kRWTR6ogz>n;-zQNwp5RF05OH)6 z`uNU}+y$}XRX(RZ%`u*N2Xk166JN!WZBQ@q1jLPR6Y2OMo}y%_GMnosS@ZFDZI@G;KyHMNskU1uU4@V@qUu(T?nmWCE}?p zIYuFrxdX~mEM92twdE-uH$&15F~#HKLXrci5MRln&dRSLHRC6~q&Fu!{dVEmX559UAHPW?J1ONw z^p&W7ysAi(%^1a?g!SWhihTR4Do_3Ry&|Tx)%x)VMeak7-QYvo*5e{OUec+a7J0pr zmbN0*(GIEatsj3`WaJwBCJt}CJ4<@>_&T&_mNz8k5v(H}VHvE%m|I-U_3FoGE8*7i zC&w(2RAte=nkEzW2u0i|Co}z45Igi&|mahc{Ll#D5j}2|`bCH;5k;86hzZ z<0nL>NKC`{IguI9seBs6FN-XNP(F>~Mdqtx`UH+n^KOQ5U)&aX0kYo4I#Im1Nb|zD zo?9lQ{&g$1-XuOsq|-h4x-!dHmh|Z6)e&ApYZCuJV(4A~<=iB`N@50@Sc~ISJC!8+ z%qHDkMJT2VJYkNU8AEsc9HRL!OEE z6v_MCFm^+pi|2|Qn~E_4q;3Mo>S^bqJj3GSSaOUxI2PZqpm_Mpv-JB8nQ<-peTP8w+YL!6 z{DIVJAoHc>MT(Pw2K`W#G3VSRoDqR)#!D2C3j(K_eCx~;x*jZj;CFDd$L z%F<%#mM~UJVcmKI(XDq}GDf%F_miUA;rOIbd1&hslA`zPgQVy-ABb-AA0=Zp7RD;y zofr+rzmj8m6+Je!mMQV2B1Ma+{%}e>S7eLKfTqSbiX4PcpE)(YT|{5Ir^WY(==J$& z@q7_`lWJqr<9~|W0-=1S$ImO_Ht#@Y=rUV(H&COCPqh>-GX}qUiMK8!-!#(gjkuA>N5i%AJsB zO5sdk!C6o^J_+vyBIetqOcYs^ly#U%QOx3`Z2tsr??IL%r7~J3$5y+r=gF-pR%ZX3rGG*qkG^#tDRO$xQTZP@y*r07=nd%VD6 zx;o?-MPFB|-+SY}NR3^XzZSp>Uc9nMp>Oa-P2{sb-iRfbn;(dOrX+c_IvAhNk{{9i z#=-a&$)^gQgg=RV4#jt~1YeOo6#qlTL@#IJyVo3ZlqEY_a=2lfXZcHFu3*iRV)Ek` zB<7~Oadxv9OL)Jc^gBNkb2wgCZ!M#}P{)F5)%0%*3Dv6QKOYjR)tLXTlITA&j`I8*mb7T0%IZqw z`3oh6W|4GdjQh((o|3Cx++QOy`#rpSiaDe2|0wbU#6!*d{!W(Qt;~eqb2*iHb-{eB znbR+NC;UY#l$0-|q?o_)JKirtulp7EPq5?|Yp@b{6LK!@&sZ7kdpSr6e_lwcLT>a| zgrpAS7Jq9<8biwY`AVYKm&f->AQk=7EV;%S)I8O5MgQSd!M3PYEBdd7H@kYH1r#< zrt+*Vpj$#Ce-cZ!@knpXL6Gx({_0$c$ugeKHH>#45BmF9vW=6783%dDU%Q54vW>=l zRH`QaZzAm@_+}4cn)?0oR6etD+~-4{@Mp7R8~^meI12KVzgA)npgre7TKdKhDpkoJ z@cT}c@bsE*i^P{=wH0q+KkHWz`4%xG&-s-^Dx(f5RcrqN7Io%Q8*Ae~reaFm`K0Q5 z+xUG#F`KdVHvSPM(Oy>~#tukZ|8yv356i1-sf3vva}d(b@2w;`s%+;E4hgl@_WsC_ zP>qBP&>>^Bm*S)_~KMaN)tN-?kaV?c6YT#$EljEb4knt*)!TjU{-Wx|@GRM88kn-M@Z4moVDZz_Y~I zR(HR&NI#L+{3z|bv zJ;Lwr7uZPK%8%#~{s6yJNN9vV$gjeZ$um|e&rp9XOHdm_{aGqTwHEB@P=Ae*Xyo~b zaRcNn|3{IkYt_}^Eq}X?!J7hfy?D#t!=h^S7EX0SVt)NerAqe;{mAtb)$^uwzm$kx zbxikbi#)dk?G$BB_g`a4kLvM!y5CQvO;fDwVq58cs)&B)D8nBi^3<(rUXbCB5oz|7 zDo=(#jb(pI8RSDVg$)05k;}J#_$u{hZ$OAIfpTv@8Jlh6yQ^<6GGt2(S z>oRYe;g|Y_QsH-RU&U{iBjyu7SL89QaFWdQqdQd0ER5wzKJ&-yR9nx$ww6O?`^$Ez zn1R3HZ8*qW|13+IQDPR>>mXnHO?Io8dU&ey9Av)V;8&H;4zz^G{g~DIEm_iy1DGMc zP{c46`V(08NB*6x=5Y)C6D(PHY6xu}slM@@J(SP>$g@+`JZ`byQRE}c+GrNJ)St(a zWqfo!e$y4HmicvmSLHbgsSR1_pJmw}xkYA?xqhL&s)YH|@q{~K*7&Vh_D6n_S>zA? z9Fd0D7R_PT`Nlp~o|-bx-QYhZa;U#Ln|}1$v*10=+=%f4a{kdj&5~~1gO&fzkWK!S z{c7v!srX(K6(Pdx*RsD-3)5ejSAITQ^!|yLLU1sYC{M9V^5xsJ9(BC4WS56N3`$hE1NxpwtM6aA2 z_OFWQm6IdBoljfOkLZt+Tw|zT%3&{f)C*CZ6YHi6(DXRag<}CH=v(y0V$ohNkm^kN+-&T=zDgh6IDgNUThfcv5nG+ zJ6Z7TH-u((r4tP#Mz7M8NjxO7=A^owmPs@dIfwI$@+p&eMnpe%S|-s>gl27Y@2^av zlSp~=t8_2BOrnQK8M*3}N%R#t_aE+);BHr$#1IkvRzjIXrbsQk-JrJquE^*y7zLv? z$|Q1Fa*V>rxed!Q5evO>CrH_Ze~jud$9Q2OzIy;Em*^_;Y8!k(1aezq5{o((H1?~M zm=hA3f8CyNk5fK)|FnRrpDKwPSkj`cA(X00;#P^N-cgMzt0r!jnEN3VQ#DbGB|UmO z-Z!TvN3`SinT55-hVG!@B!P)xPN(<1slZ1qH2k>a>g(>oE>6P-l# z`h1N<4-tA_hVrSA=qIA*dNmV6Mf6;+W@3cMpIE7&^3+O<5xD@Nd}<{oiVS*ImAQ6e zDoa}QeF(+WPJAvgPhh2#^0_myKw?@$DCW+@Qi;*`==sq{ViI*HvX z6}JS+xo+YtOODY1ExABF1 zNTb9tk&DP@E#$t$rI74|G)}ZSskYTi@@bMdD?+J`Bj(XWp+8j&$yG?xL@N(JCl&- z5>b)uke66okv99VmyqWZH;B9ep?scC+^U2}r}XZ2>qKpq{79AYc!LBnZ4wh$Fp`-O zF@{6hCvsWRj97_?@h;@W#L6>V9?oY9q(h?gS(5z7$|<=%*LS24y4ya`Ba)NdwcNX$6w z`;fAjwIvpc^pH8oki=4!Tw}l`oLo5Pha|oixf@R!&>1%*u~ww%b}j#j6z!(vx(ih1 zT%$}gEw_ohby!OakqTd`Yc6sY+0tCcY!+#hucg#~D(A0m!<+Y9!b&3ZE8&fKmg*uC zdt>a!QkNyq@TcPqY?gT{AjMHYZ|K;B7s0F*v4ll+zO}Sc3U-I=8V@Bd7Fp7`@+#RDqPj zvwV#pnaP;P)}hRhkx4mr1Mb>G#v~1iK>oo9ZEr}jO1HTV_kSSk6FXITj2O<-n=$v?kj$sRA&is}6G-Gw z{5An(Q!?hGJ5)>9l9W>iu!@D1$E`_O@&5(SuU;E-J8~|XOodu0I^-{$r;weAR#(+g zuJ;4h-C15>3Em6Xndr=-j{Ex7_|4x$UzWURVv`y}?n;bc!7u9Gug<|;iMK*8RU!JN{p)qyH~eQ3D5C#{6nq2_@02&vkijVo8fmhtODkSE2$-uot@% zby29W$@%sY@LAg7YY%h``BIplOw z7T`%9I^X|FO8shh+6OUzCnW>-$a+G~CFK^x^oRVDlojPvK9`fS?h!nRS`uH6NlH7E z=WV3Anv_AfzKwx!l^E3fy_KWde5BZ5-gkU;vkBfaYm2k4SQbk#wkc3-Qb@)lp8~~> zDvADv)=Sr~BE|k|~8>>6a`~mI!6v z*O*2Vg-oM~l7uWFdzO@uF$hJ;5<)Qu8M2k_|32q@&iBrD{_{LNPtVKeoO|xM=icwR z=bn46K2u0=wJD%i%q{W}y_B`cr-0sGigxuh-s!{LW+6RMNV>R2@s?0XUmzsNr?9?W zh#d3WjC=~~ee>{~Q?=b|FoOV6RG%#bD>!{0(so0N>D6Oo3Hj0a2~u32EF{>LuFsdE z-J2z^kcNIhNU(K7KP@DNKCqMlEP zR6mjw7=!2L5K})ZBq{s?V*Y|yx|>hbVYoMmt+yxn1HXgU5aa06NN$q2`gSRz=K0a_ zc-3mz=L0B_^8xN4AD?0}LVP}e)*Sbq5mEC2O8>un%0y!LY?eYuRW2etA01L5A}XKC z`o3%>j7Q89x*L{zT4E|ji6K?>cp>T9aXjOwE@URftn7i`6v&hMY?3XI=0X-piR^nd z{pSKAXCZuB)%2nTxdcb~DLqa|dZZ;hrMDA;FD;%#?;WY0(vOo=`5I53AT{(nu{@uk zgf;YDQX=iSroK@~0=^j|&y-sFUXrHwWoxOWpCBpn1V)mPb1gkrA)a%B))2o`z3_i^ z^dcln@a&5p)4KX0A@T|^aUz#LrG$$i=VCA7S)_hRrV2j};W72}8`)Cvoa^hQ3-fIy zg~xZ1Yn3<9E0KHz;k}CndMzP|;oImH^g#)q)(4YlU8FSBzmTc4B;1$t5;oGm5|W^; z8LlKlNV>+br@XZ^(zPOd>&e>fs`%;=q>0{8NP<=gIrB0%(`w2Iti z&!?rHC`8utBy7E?@Z^xY)mG?JVSBwaiORXXUWr6KC2y}k zC1i5AGu~R|?;W?->kCN;_l5A)3EJz=P)x!m8S|pvmSU12Jmy8cqmZPqa~4l#QHLG$ zZX}OGdI{-E`8;_FZ!=>rI_iT-+Cb(A8AGX7;tqN~q?4XNk_K5UWSWrR&bPCkB_vV1 zhU>;k#Jnu7KRC)U>PpgG&-W;=vCNRVJMN(u6%zEddg_)CdEB=mpPqU-nJWL`Mp)~< z9Y$vLD%oPTBj#28Dv+3iBc2Q( zW~lxo$t}oPA$5f$guowR#W|ST_ zxul0a!JhJ8v@!Z*AqiUkA5lN}1s$i?v1F<@=o&R4(l%5*2cqhEg5FM~O4KglK83fa zH}(0p+!k+9{Fo-_i-b(p>Y_IIXwO^v5t16Wq$KKDLK3t(+vW9evYy8g`9!WilXX+b zWbOU!=x3qKZ|f6;1U-->eVUL2?QIO(^5dSQ-ywOVsvJ*1j4SuF#Is7`JSiD;WlPeT z&n4(XCh66MWQMNd%3l;)Ptx5|JSH=A0<)M)LuTj=57q@o{$B4d|933C(t z)Wnm=sgRWs;W2X{t0OWEPZgI#*6FiEKC(Q#-}|-xn-uNqy?B0zn2q|MB=P%|To#g` zHHT~$F>X0to&@c|CEQa&HtEAjTJ%H@_espT)mv1MF^h*u*`iObC}n7WDc|TzD{)EI z24Fn%7v!^5uU=Wk+(6FfAlvlaLQ=I(kgJgGda);XOj1~V`SE+*Cb2L^#P{oay%foF zedTY;4*hYGZV(=`L$6MAQa`o?T>8+Eux|C>^^-za~-_UpGuc&+BcecFEgffQ{%W_t5?==STy zs)(A`I$|6t7BN5SaY7Qb9#3JmA>^QLR+C5YWfLp;L4MU+ROgbcHC>Fkju?kLs&^5R z6iz)Z_w<b3J9uZ~6owsao1#toDO#9oMIkw8u={ zs*sabi>H#$t@!E|m-Ht{rl9x5=VxBlTL?+kxU@ofuINi@%T!#n zCU`ojZxWKCJ%T#qsjlfiQOtmWcmj^T)^+`akYw#}CA|9&`9~jDSLTxi;i+!u(}e`r zsGIs?E}>Md?QzUX!`5%=D@k63ydq>h<@3+Km~|!O8<|g7$I}5mu60vS7m}I(z>l(D zcT=xek8d4c+{>F=w9K3OEGdzCzNvqaP1>W^bW>lGO+vV`-`2m$CijbDOvdKu4@UC8v7mKdyQy~v@Q;3}R^-d4$w6Rvkh%YgXMODWbyM<(i!jH<|ro2YG z20Wk4(6YBM?v9weM!JwBE!PKlQyY@cIP^4+3BJt~HckkU-*2jdn6Pn)VqV8{08AZ( z+?0~P+f6yPoZq-ZF}LzzG#WAajkyhF&i633%(qp*SSlnzGj8M89Q9MssMv_dBxn0yo|r*vbP|%Fm8y@{0x^u)O=UjYN25H* z$27K*EP?DqjAayTCS%q^`0;X$dL&oglx1edG$ASBl%M37XPohi6s_!1>;l?zoN+}+ zsy3d^f|5q@XL!!3+Mm=`A2aHbfj93<5wXm+I0L5p2R;sWjr962;t{WO~ZXw z=DfHQ-g7~!T1I=4m-dFV^N`xcQj)2Kuxd_g+_4&$Nd`dp{Q0^@d`p>68_0E}s%wlV zdF>U<^Muql=8~*J43`E*xRp$m4=WEmggkB3&L)Lg=F%D(&kIS>hTx1#dQ@@ zZDe_P%n(RB;{b_+vC}b-=ZzaA50*)J!H8=sQ@w_(Rsv#PG^UZvK(G6KNJnEU$)$q0 z+k$j9&XfF&w(&Wni*b`=(Q34x@_0IF+$Z@6vJ^2d8!^wxZ9O_2Gkzhj7==l6$hVLl zhABkWSnm1g+Zny3i2H);sH|Sb0Ft-R68M|Qy^Ikg?Yk+NKyq-DlDCBfSM^@TTp1&- zwEX?tUd9nhrE>0VoFY*<_cqRxsGNHnSA_&Q_crpj<9nJE{ugI=NBnPZ<1r~(+>`Rx zytmO*ir6~uhW0iFQB0me@*eFq;{%d`OYlUo7w!j*Z%EkJ^4iD<0rvJ$Ebck`9WD%~|Rx8|X8TI}rQ~l5{msTD!+-OVE1Hzw!j4-;B zY=+cA%m`yQ$#-jU-atkg|B$SLw1$i_io76mUR?&`KhJC0Xk#$RxLvY5V~klsQo`Th znDQ&YSYy5vtuV$#yC9#j#%U7$QyeSEI3vD2&pAcoG7>W0=u1)(vj~zQ6O0wvd z##JG~@tSDd6@v9ZF3NtwL?is7EOQrJCHR$Xl2L+Wo+JAS3C3e2{8x{^RrZ!qM@W$K z+r~3OWP5(AJKmW!UJ{ZK=3ij{8s$kcdJ4%5sVhK|(Jxyn{2Cx;h>%pR^GhM^)81Uh zy;jIAn(Ldp7wK@_`ZJ zjTkK|zNUPVKFbJ`6pfK9$<;ksGL_QxHT`AQGjQ`w&%rm|v z={Xal&aLr_W!w>h`Lu&^2LzdKWOb59x$h#hRmcM4xz4gYTpoigG~N(`x1J%DAd8J* zLhyZRNHrnjDdtvLc@8cyCX+mb@E-LNV>*eN+q2a8kc23gq#T_)40tgqhXG%-!NKa6aLl08%9Sd z;YKvq@uty@gukK2V{RIKNgAxim9HJXAz}Udr9hH z^nl0wXB;9K7$4I5qs(`WGbGa>Lxo%=$)vrwXV_ikQC4ql+%w9OJc?`h7^J#qJVi1N zJx_j>xNmePsdiRLUm=O%mJnW^`^FH8iH(uhjR(dUlFASs^T2qEBxAoE@px#wOL7Ln z>*t}7Lb4NO{s$>Fa{$1 z=Q9VA^hXQldm1)Jl1zl~n6NpKB=)?ljr`_2B#%LOOn!5wkW{TC>To(r_=vfPtTE;|XHWo6McH^lqw~(${h0K-R z#nFjee+rwMgvh5Je12VF^F$9Glc2Tu2k-r%ghkA9J-JK{_n{eOMa(KBlOP|9nA#-8 z%H!P>NKvzqkj&6D%%)o+SF>^A- zly9qIl1bjBnlEO~BdJXD>w z-)1Uq?kAZ8;qOTmHxH9MMKLAJ-$^=9ObPS6kc`j-)Xi%Ar<>NR;&|mxC@W|8nPwT1 zfv8nJyU#SMk(hLJOsb#s7&U7#5H$lZ5H*i65H*i65H*i65H*i65H*i65H*i65H*i6 z5H)Kt5H)MjG#iTjN)I)pnm5hnLNY=-sMVQfXSwg8U#QiYW>1PyGaD_lKgpenm^X)7 zb<71M_6GUP*E7G6l3&ei^vtCcqvk_;<|-03AJQ|wCi&pL{C?#@Ko2^O448+}f8;m2F zGlgV?UceKm4D4x1b6RhnD!5OHHx~#=(aPf=enw2Zd0I$jXu=or%2wLEKyny8cYcj3 zV`h=;UL>ztWz9Pztwu;GXKJs>5_bPvN_jIZB)B3~FpCID)tX>ieCA#S(gr%)JWcOiHz2iITY_eZEyWFD2n`iOPJAQa+_3<%#bj zYD`-m*?LQojgb<*A|-NNtzb?QlB%7=%+C|3)e2_ozC0i7Y0Z#!5%Rb>o}}bpyq^oH zXl}?Rw;`3x6C_WeW%3eMHqCxKpP&van{nABR~uY$%ql`ML-#PAkRS4dnI$Ay8-c;q z5|Ag&Jg>|B%5CJ*;vi3%!%3>3wN!!BHr+R5%;8rt>ISJ}{wF1}r}fOd{dr7EcxQY_ zYlE12W~`8){nRsU64id{n`KE<`)OcSCsFO^X|oZDYCjFlwnBn^Z)A3$m;Ho%-SR& zyi>#9t9{07Niy(&e7~}}*_GsvWV|_zR4vR2B=Jba*QI&ZoIz6SAVyyh)6$$zk_W5# zjf1o@(@E-4d0Lx22g>rSr}DHhhmrh)r$W3uZOzFf-Kjj!nX`ptgc>K{Jy+!1&Kx_4 z=aUioXcFdBK>lYYkko}NfV4NKkd#<}cQhd#%=d+4hOT43(jcA8G$Bda`$gn6p_93b zQt_t){5sazyhySfId{iaUouM!=35W0KQEb8gvevckHt&o1tFOsbu7A??vUtX@v_;D zL>-G)%*iC`SadTtk*H(Q-8?~}jztf%^-!6!Iut_E^Qq-~NZ^n<7qK?Ht^Pe$N)UgR1dl&j<;Q#Za@vIG#_Urq02krca{I!C_{35_RSd zH>;7TvwMVDUr2DCjx?JI39d*Z%^o>o#+dymMxD!J%>E?mTpnW%%#muWIr9I>n?jPc znp@>cs$jtUi7v2XxKIMGY?@~b(b| zdhda#-g_Xb_a2Dqy$4d6dhda#-g_Xb_dY#R9@TpfMD^Yy607=b5s6X#@QB2!e)#(; z=UCMb4@C9DBNC(TcLGtp%9$#k7}ci@MD=L{QGMFvNGjE*O^Jx=oqiY*)ys`Ytm@@P zBu4dMKQzM=c$-hvUdW$YJAwB6p=k+`XE*N+rkZV~gg-(bscUJ>_Axt^mxJ(_Ip$;;BhJAhkdMvNl=G)a*%eo!nW4<&elgvlV1JvPia~jE4kp6gDyxjbdr1J(jO0&ZJ zl;kxCFV6~dF^O8Gd8PRkNn&|f=9T6~61A%2SLQYnwW{P-=57+T%E~J90Et?ia+P_E zM6HCm+B`#|R>E9u{zalz!dzosCs8Y5t}*YD?8f`u{Ftsab0^5QaSX!uYpq$3M6Lh4 z&MZ!n2fcT`M)W$m4|FJ_fgCQq#isW6)%;L|# zzA@8;q-gt*Ph-SvH4h|-J=LCG5z<;hzB4CH5hBjh_K-C5h!pK%ZH!l8t2@kFB!83a zG)qk7sS+_`M#k(i<4Nv*B+tP;W>q0c+P#nP)js6B$817UC>38qgX}e5q*O1@M{bb) zW?vHhOHG>(IcWY)!neL1a>TqWBtc7_F6S*DHLJhN%Y$csxI^5Bm}BN#A<0^ThM8iJ z<7Rjok4e_*A?6RrNpqHv1g*>jd_|`zW^kEl6f+;|Yh6LiX>;)Opnmu@>JM|Yl(2gK z^@ll$L_Pod!<KRbOroBVoi!JbsAptn&E+I&9kX-hIuf;x**SA7 z34hAK+jFLwPNLSq%QW|ssCV|yo4=B%clOVlze|bq*)EuwLV`Zq1=E=kT^kq7_-w*g z;JIKgi*=oFjvj&Mbc}cjL9%M6&6_Och@&IRwh?(&L&p9)6rmmc6aL1fWa-&H|djT_ymWFC;0PGz0x~#DuM`LW0#q!`4h8 zsah`|@7jx)xk7>xhOHYUsyqd(hN;nIj>Lce^EB+&%DpgyE z611_B))W~NxdN25RtpJ^U`ea#Twb2wyok5jlc-}FZ*3BiptTL*3W_q9 zvF-~A&XjVN`>CiOaZE2Dro44rN~G0Qw6cWA=P9=lQ_%{~^V za__o~x3nNttnNb6L$6?divy`@AqoD{W1huRp(h~KtqUS%vep;B1vMZ~S*t(eIVWms zG2{1XNDZs_d@c#vImk1RnpPIcbjUXRV=XJ~a~V_oA;$C&Q`?%kfJ?Gg1N+_yQqNi~ zM1K9J7o?$;f1yYv>UjX9krgi_S^MW*ypsiKYRwXY_adpx&8-WIc&Z?u7S`@Bf_x?; z)w5Q)#ax0^t*l8Tsy13%Cxj$u{V)>9SHgVG3NID;Xnf_#8OW!dRgT179nxl_OY}c$ zCJA5tp4aLN)?6V$c{*6bmqnMSqjg9~P@c|K#V>hGYIy5@Ib-T2s}{*nJXzy&s9v&~ zl4M0<+L7dmNLP}E`&6pFBs#wTCG#0hG78rXDU*Z*SJ9WODMIA?u>2jUm#o3dqwBDX zmA*oXs>7~U+)6I^ZcY`9rlK~wS@(nl=X(z;_A4HfpdF)kMtWF}lc+lEVbu~6)L}0x zS;j=#MsI6{kf3e!wcJ(FC49r0yqb&LFTNN3t)oH`wc;z}nKHn-AS78Uf;ncq9S*WO zt&w}d*NC168El;plB^BchH+ZR5bM}lk#ktBG&0;eL$c`!*~1@h{Y9dBAS0~nB&r88 z!n#YMdQBs(-0Nh{s@F8qDoCPwM5C6;k?^+# z+f>IHWj#f*4!u(;^+~48R?lBj#w3D)lo7TIWe-L3qr&Ru;)qt!2!6 z)*X_z5FYcM71}8GOMN?Unw6hKeJOaFRZL2xo~K)OHsSe9x5^6%Rv4aP^%9b*nI}Tp z0qpw>>kpFM=y@K2yl-93Cci^wTD>;$@}z3>5yRin_`n*RO)?RaVx^IEz%Tw4$cNSm zAt_oT?E6hfD*ZBM#HuyZW=BMQkuVUo?}4cA1_q*5V~a>k=C_!SgKY)E?>+N8k0-Bc zTQRq?Q1g(v5jhAkAoHvuo8_MJG1$i-pIbi3zOOOQ9J0`=K*C35dCX#~Hp$5InAr$f zYV{!5NU4@v{j*5}#C&BXknpiwp3iD)CP^1cwbuG1oA6W{tkonvXj>btqa;TQ%JOWn z&S#SrNVV0ACp#*+c${Ij)B#%PaJl;`p<)>$c$GvycSGNr1ID=nW({EPK~ zr1UpZ4p~LE${PFmN4eJhuU07`!Ef#ntCo=9`#VRhh9sve$aDFK^(=|{BF|Cld6EX@ zWXw_PB@*?Go?})|l111$uZ?5Y8zg5@W`1q?%^F5>2f|~1v&NIC@w(&IWD+%Acifsz zqQ3QW!upV;VTK&9J7LWuQNO|`t;HnjSNNp0T8g$ABSLSX=6|<}eamYs=v4)%wniSWGgdW<*#O}&XRLY@qsHt0u$oeg8n64qYC|!d zI>`F@(|VC&210l~e_F3ljQTF;S?e{5>DE-noV5l~%(Hk$jF)h%;&r{hhi2$cs}Q?1r+1_PsUuZzNDB65FT^ES|?+)Sj<)9 z<+*6>q*Q7}=!@2VO7-c^koG=~#YO9=kYw%cQ|K{5{<3C&C);zkks)mnnlm-1sb%+teJchk~$atV(6Eh|n)iuPH4 zP5Tk~+)`KCSoIC-I}tffv(5t9RR(LK*TRTLBqmf2BWlPekSFleV^mbkb7k?qV^oZR zd|F@>FG%$Zo_L&(ifMzKuVj~)14rS=)v2C>@f=uC-g%;VRrI_>g?|3Ly#Fl*>2^Ao=Z+LV{W? zXkQSLs#ThaH^vZC(0+9f&nH!DfoGchjw99{BqX>-#oF%)Ns7!0j5c9K~4f%$gWWvGeSewYm|~4>7vkPDp|_9&ehAhM4vu z5(jsh??Y@`+s9KSXw^649Sw+U?{aYs+b@%-bFjAEn?#*)we0~U>a477j}Vd& zZiMrcpG~#xHz`J40qWREBMAz}XgxJ&Ict+D+DiJBYV*j`Jb*4AijZy|XN*Ns8Q zr?LG#$vDUeA$v*qsE6ZZ-{rWuSHpvWJwZ^EFJv97+G_}hKNeI_~@L!pxc2$bu z_tgAN$!2x~5_K*&vs;m#X(U9JDQz1bKU$b8lBFpnOV*1#VC`Og%b$f4)RBza)g(PSn z;hEG2NY&qt|5MiL?b-6{3H|N9LXx!%)X%3PCQXRk)|Ze0c89Y(Rc5HjB2C)}8EOv~ z672gh`z*=*Z)9s3W_LfwQ^|aGBGoYahLE5(M%xWDWqHcrH}@!F#@Mq+&Y^zzw#M0~ zNxq&dW5(On&IdW4N6edc3n4+y3HB@@L5q6JzCgmq26>B`Y}dOWx2{@Ll0At;wWuUJ zT}W^&-m!lZ610{n_5~qwPj8?+Q|x<`N*$f|>=qa0wrbCpXUa5t7D-c*>Go+7)mCTN zE&k%Eg00W66NDs&AEM_FdJ$JQdn(EI=vDG7_WO1!iRwqaZ_gJZpDE-Msd8TuIfvAl z@&WZ6(qmMaQ|z#aNz!go31`{ug_%4n)jidpyPPC%lP}rFQtb+*VUuN#;P7+na=>ht#!Yg}wD39y3`x zYT%7k#H_UQ+>oi(?!lYWjW7aZyEmmY!f4nk#H_O8ZgEM}IxWOHLy*<>Fd@lW^>OG8 zLe|>TWK4J&Mi>r2*4eX!$aZ*G$Ymj!A$3eQ*;Q`KZFR*NcM&n0?cqWawT~*{xv`Kb zcX*7<=PqQ6eMm@fetm1l{VVfP=jnHLe-d@I*=DaMQCFL7_6-t#wF!5?3Ptwe|9Cz@ z3s18z3Q35x@a^_B64k=D+Yf|H4yzWv-OhVAD02zqyxp!SB-rYiDWxgui{_O{@Gqc zG8ghZw)KmBM@YJ+TKKQ_81crNJf__dbJ$)fBr~-9JIv=AhW8NceI$IWay#UtT|N|p z@+4~=aOMs~s^9HuLNfEKvC~s_T@p2RddhA>qQ*{7*{w*_*y$Uq0GE?z>}51)dVzw8Y{GDB*7^@_cXM2)Xrwf6~;wecZR zUALXwJfC1a&zp8TA#&^U5p&aCPcf>-{>sQSt0j3rU^ zli!&l1YdP5AXjuL=$t3Bw1)q)gv zPUaJ-G`{s8Atjs(Bz)_~A*RE^GA0SF?jpo>%9A{XmU$iGIdz4|BgoI?IH#$Q;CDIB z`AJA-epSzL&Jhw-&vDKvnNMU~BF;HaF{*{fIaevB3EouV{rNcOHpQr88s|JDQO7IJ z$(LUq3sv)R&Lbr1=#+E{lBi=5?-V9c$D)i=Oh~Y&<(=oHM84!+-svn;UT}Qa$Oc6{!-#+Io3^ zQPbHXBr~%0n$EY`b4HFeoqaMUvh`Zd*&M0rJLhwxs_)#&k*a~i3h*)~hWm}i(+ZTi ziBpDT9;BL(%0hzjG;yj5k$c)y#5Bw%9Ux7eb~06@gw31{LJ}jtuq~amY^nMpRZGV# zD37x08@F}33JHEspK~q?N!8Y1cIZf?YUdP*<*AajKHKCt|NorcLV~0GLZs%m)DLMB zkSdVfpP)wpX&;G6!>`qckPZ=fAHVNhIz{Apj9D#)ycCgs=>PDU!(AiNp2qnD;a_s! zh*U2}V)(bYe}?o_65Htqc~9NT86fr|Gk+k1v+Wmu)1;R(MMy?S?N@K-6PYTc_Ukog z0g2kLzRngBRl?Vu?Ifx^Z#c(D)V>dJu92v{805qjlE+Kc#&D-JiK>l}YQJLCF%6^~ z=5YRweIMmi6shF#x(XTNw4i)c%s6MRkYsH$dcwC6Gr>7TG95Dw9zrHYw)Mt*yuH{7 z&oG=bg?R~+A~P)$or@%D&OoAbo#c_XF$RfLlb!!aJjjM8xa2M(@`*fedfO?GO?;$! z+o>faGo-dY#Yq&BtkvEpzoR7e-gQb9m93X;M*jyg-Dx2tK^uqr$~ur4 z&Rmj~=)rQC>10u=yMJP(KF9~o`eHJlqh~{6-bIR2?olpSjSaQY9x(nMWhV!C3qUSo#2*D^QgugXE*Xczu-))gGpE^S*h6|7R)R|5(x4+f236J1j##u`; zpHj_twoxiBJk@;XsE{4G7UjwJ@8DwRTOqQo^4eJJWKb%V^AhJgiOPAY6V~O{RnE(t@+7K+UpjTAL~3<~(?E#4 z)8yM);dB?06jq~-E1kYVQniM-lNyV?Sm_KUDU&<5HUqNSnUqaZA#0r}LQ=HXQDdJ$ z);R}Amf~#UvVqQ~9fj3V-lzo2|HxVmMD6?LNQ~O|EfG=s{*4nhcx~Vt#Ml;pR=d?H zAw<^dGHm@@=SeByJ=hCA;=0YLL-H85E~TjyEeUs;>yT=jGlgW%eA&a_=Ij-cs+Ge$ z2mWT+Hs`321noRheJ4_tGI@D|qnzeEAtY$?X-;<`L7U(1^pz56W80mvIa2L#Cg+Gr zca924(W>OhEx!7c;XGsUtp_b?m(y2B(0X?}X(Xzie{jx_sCwS(sIf*suLg^&BxjI<+VtwXGkW$s}r9KRG{D`M%gdU9U++^ zUh}(9^M{-!PO$Gh=2xe^kRax;^I5hS-a9?wERhnPji=kZ4|&8{MKT}48{83R6G?+q z8FSQ0BWVudF-M&}QX*INW6nW}QBSUqImbxUlj~#7A0!pVV5|Up@tgA(Np;9^A^%8; zNktFW0{5JO)=Y1i;d2uGP7Zq{0ehaAr8H{5Z z+Zk(!M`9}A4Qn5AJ|e%(6%e?^4H)P!7)h?+XjwHXV^ z>+Tei6kd#eCU155-2EiqKzMQUxra&0){-${_ji&y5FQhD&y!T|FTX6G-@QuG5W?rv z=6CN%i5#y-T+J74BRqM(Jj#!_VUqa}p7SGaQIZv?=R}mbfNPO#hP*4}F)5Lp3%W>( zzl@mEXYu?HF$LXd{qL@D^rkJZeCQ}_i z{qVl}qizL~Z;qhPf^C&>s|t}<3Et*Qxb=jjXm<;0+B^|6o@7%cDZ0B_h}=3av*F$& zQEkj}tC!+i4_451+=fDeZ8>fWA;F$HZu@L8Um$14ok{tqcF5ebLK3t^XuYwu@qF2x z63@4lpw-6N#NSjZ>7F3zhTml_rQ9l|WlR>%%C*S3w7XA8vUVO%#Q2)bW!=9>&f#~N zOF1`B8Jfhww`y4)ld3r>A?-WlT+!_(B-pP??wdkzH-UfW@BLMB zlY}IMheP;#f0f+#g~)B~gjROf%T%El?8Q%zDsH=SaxeJX+;<>#+}T1fn)(!G<-LUG zux|14GKP=f6^Ar%=L(snC81|k7xIjIT1bjE6wfA}g*12LE6BaLji;p@AuZgwLW1Mf z%3UNS%;)7MV||2H?h2A$AVYEPv~o9*B>pR(2DWy~J*5`v?H_d)t$ zThF;^B*W)n6>G@z>Ku$!N9P44F{q zGN-whDV3UwKFz&BqUNGcbMKQpj#kI78`IsGD!j&$!VMw(x-s1?L=uAVcY$ZPI*AV9 z?*h+oeJPQxzwee6l8WPv^AEN9zT1N2gSmK<9g^&Rk}XvcY;~5qMo4D+7uTsK@*)N`c9K6Q&^lh2UPr|wfy!s@Mr&)xbY>dl4E-DV`}D?*>UZAjEtgg$pW zkf`>v!0j$1RhvC4q;15u7PyO^lxNBX$PbW3?!IcWC7i~6IbZ2=v3p2JV)zQ=Pa!8| zOk^*XxaTMp{|3!ph*{!ZA>rSk$r5slq(nh^OqaS3NXkO^m3FC{ue#j2db56+TbM+> zS-;FRg(QYY;$8dhNcE*#lcY1=&*d%QOZRD#!4RJFmu?FosT$wY+bGX+x1EqAQ5!tf z3b&J#a9hmjlG2@|7lh}t!tEy{QCrsq=OFS~>5h~!k=j`4zA0mb&K=9h=;HBr_wD=P6l-;XWbF!?rfL1%+g2 zKa9mns@RK7Zbc!PAugp5v)P?RF|S|@wj&<0ZE^F};Q1tIwGhMK_S)j=B=IEQxaFjT zt6h}GbgMgCi2N<6fSk9wnNq@PFVftvtNPjQz9j^s@vG%b=I!o#6r*bFdpCt*7N8FKQU2bYOEGFz@D6v8ilJG- zJKU8NqhDc0>~VLK`~vwOri207xM6_TtCYZcPwKu)-6^>|FO z_85-oO2}zpcgWu^YbaAqx{7rOaHeFr%}IJ7<{!lT#kz_sk^EUE%==LYMhnQ** z&D%sW3^N28K|)@h#$sEc`iOZBlFMsHQkJK}v$ovcERx2bYg!k?*H?S zi*Lg7Nzh8-c^rSTpU3M%@^~@X`^w`X0Dl>=YQF+e`xTKGwO@g#{R%|wMU2WhMwK~l zMAUu-qV^(RBu4E;I3lXX0#WO9<&VUub-DskYq&iUiBaq66^Mvh!>wRM)EaKF5m9Tn z6^e*j!>w>c)EaI@BBIuCD;g2ChFh_Ss5RUkjfh&qt$0MbqxCL9n=cU&wVs|H5w)J4 z840V+gf+br3_1L^9? zK1m=8G2fW~QdjU=x8gaY*NrPu6855kSF5#@+qfd}>rYj$KgonE7^Oi>HLqM78Pf>D zuVb~mQ9|Ti@Vmdd-XtNxm_uFfp%8qbp2}R;%hy)ySAJFIx?W)tRpz>$L88iB*YkzQ zQR}%VPhGEp5PW$p0sTA46<6tb0pm+;duh2q1TaQ2xO0t?j*$^haru;z9c^6 z4ixOZ>|*at5-?L z9U&>&&LttO4y2h^?s;Bg$=YP3Y6N-4n=d3$JA@eC5}JGE+KZUTGrQ*A%R*8#t1!NO zid4`gfEuLg;q>aO+;ufC9ku)3># z!+VBeN+V~!r~SRQBu_zjPo}@ukwo3=4e+{=sJEU6czs9~ti>~7%<3HA4I)WdEbDN9 zH;RP6bKR?jhM0*$62knQYZIFv;7w7fC}yBHlVX-p%s_7r#XJvruD_-Y@;;}SZV=v! z8{~bdVwT_;KDIU3TT3yoK=`%>d*2923Qxs6#_rhDA>Iy>FCcu5{Sa>-<+J>Xte>IY zA{{YTysQoTzg%^};)-u~GE+j!Kj{A3hbY^?wg(Pa~ny}EjKr!kH zu+V$)71^Trwa!MWgpFHo&fC3HLW1*jyLVnl&};n%S~fQ(r{k_h3)BHddqWJhk* zT6TJyNmOge@Qw*d(I)Q2H~@0a@bdJLWnO}-%_ztouey+Atx8Xf)(Bt<5I<2>$A2Nr@c6k4tb&Pk1dzex#oH32(KK zB=mb^jh*nyyv|c4h1Ip?gjbnFt&MrYt0^QgtolDEy{Ac3|L3IFf>JGcSI!&!-Rnf6 zu2H{x-Gu~g<9Dwg#i+J%${Q&}wvErQ@29-!B>Wn+7;@U%AtY!UXS~}&g0^wS%kze; zje~f4%li^%yn;efwg0ZjXUAu}Cxis&*B_C488xaOh#J+8NQ@evk4UWQ`$Z&1jp|1v zR*n4s>DA1(b^c7@Pj8rz;F-cXZzPG@`Z@0%5|z(6Zw86l`Z+IEO5~ZsId3+JDs!fn zCM4MROz%g^XHJ@I8=2l=AqnC25Pqg)dZ#F6^sh4JymvvyXl-#H$FE4|y~_Q0&1Z)A zTk1n!=1p&hkkoK5 z%&Izs{krM>AS5N6gzMOELJpFoLQV@gAya9U9nAfK-17Pk;roTJW8+tt&%wLpjTI7% z72NU`3JLb~mbaKh?ddIVC5hUvTi$vSwePpQjZz|eddu5PqW1K*mnJ0G)7#!|AsG3m zCnLAL140tQkJ32*ZSNSxG=CW@yJElYcxOnar^{>a9q*z{CEDRXA|}^RvG3uri1`ol zua{qn)^{B$r8}3hB<-**F8_JWNLsCxa@TuRNKj+Kb`P(%91^ z4In&5V=YM1UCfbbhU*k-NAeq_5K0(gok`S6;JH{2615U|F7`Ufq+{})F*h4ZG7G}* zg>$oUBn_xfl7}Udw1V*RGxwpED5QK|!IQGDMEv2r9QA$-3Iv8p7hRtvM*B&t>mv&KS# zZ53fnWlUsSMOkY~rB-+-%G#5tuOAj=FOxJ{BUeHw#(ILolwhBesP!Clwv1#0ewX>3xX#v+ zsF@)K+d`sdh8S!IiCS^OWP3?=l*Onup46D^5Q&;Xx6tf)`|=d#1{jgaj}&5m$cVIhfOH9Nv(CdH^VC_ENNF`tY=+dyB! zW92D^&yL`4WH45hgwKxPZ)7l5M@pn6_^b`ZB;olxKRP~pk>n!?KRQ0^E+lACaqMW0 zd`hy@Ir1sVF679kB)dkUp1(iF{v}bXFFwX{jpVfvY^xNjEF`#M$Fmwz!gmhh%{@54+Iq^^kLU_6bQJ2>+^VdA5jT zAzkY#uoWch=~`ETZ4wgH*yC)-DAA%KN4X;VSV~x}+EI}$AW^G!RAkFZ)T$ko*g6um zYDXoumE?F>p39Y4I>`eFZ!MMCeiGH9o?yR{s224EJ1rzAa}~CFbaa`kvQ1LLDxaz> zjYQ>BmF*!>$KpwLkVGAeC)sZ#>R41`e~_qSQH@<9QP>m}KTTqJ~BH`=X@ZW-3 z>?DcWuiES!iQ2E)>~9j)=IgLqB&yBVVGl`E9oA*}#)|z4t2(U9ijb&wSdW<`svXv2 zB}vqZF7;V?61AdBefA`YI&&MaIwb1MZNQpJ(F);r`E#5FPqR5ff*O08eIjEbExaK^ zmEbQUM*W&MWM7FG*(ceGm0=pOZ)HCD)jRu**=`x5B|n0L$Fv)cS2I>l zh`lP zVg*yL<6 zeCyNM>1@KcK9kj(7#tnG^%OQcoA9ltvVVlgk+*jsb6Al{Jk^=diIZ~dVlK-f`4V4k zu7iJ@%d~{(m`_>Lx1^|;Pg#2smCroZKQTIH9ve@hVm@OnCP&A7#yXLxnEC9$+tD%e z+3!Mv-|o*@rjSH!S{!Du=ffG!vM80x=X2J5dUQUYv%w@PW&t}eD>`NYJ58cu7P1u| zM#n5AHV7)$yj`@NOCs8qrS;N`UF^gF{5*4$AxpSgpmavK> zDrPCWlOtv+3x6zAshDM~=_k?oEMx6SRLqww{?q7~FIjaG6|Q(A+BY(l zirK;%ZjH`o3u{NBV!mOsGooX@VM|F=%vLsdS9Hu)Hi<;Ve9LC-j*j`3Eh14d-?0;W zqGP^emq}F2HWuC&9kY#@Bq}D2)%!6zCXKZwQ8C-uqyy10+u2MK74totd@wrZdp3(i z#q40|KS#&xV24OlOgfu?JUS+wttL@1J6YNv(J?#O0TLCH!J1x%x{NmR@(R_{u5 z%r4fNM8)i8v#v(R>}HEdRLmaM{aSR)9yXXn#r(k5--wR+fu)nEn7!=I&FGlDEPP9f zirL2+-j0sh$J&vonEh@Nocwt3sk;erBWdM92KhrjV$ZU)brG=$Kzv7Kw^E#2SX9 zV-B%)Br4`tmX$v`=2xaYB1Od%5M8zCstqVuT9A#Ze zRLn6pyGV4*F}7GpQh54{@_y$x_7%w&5PrY&8{0_I>?ipq*KxLuq!WZ6mE&wT$q~$! z?+!V^4v-X`h&Ma&Z2bf~O0ujj`eNu=onWU)wn0*bTqMcW1-)t9fSqL5NdDIgZ;&A7 zB>R_y&zSnKESEe*`F_dX&Jq!mE(G6vL8`AIr&zUOJSG^CKFyvM67-Qyv*tn)wW8Rm zwb=S;_CJ!*<)oZpFOd{#Cgl&-n`AtminPT2%%AKHlExJ<;~rZ-%SMqjeMZyvL(Z{D zLV{jpCfoXG^wG&=`$*IgJkO?;h>khW=8~wG3+${B9dm)*AW<im^;Fw-zjfDiq^eSs9BvJdWFun_ea$IGt|6i(3|1VW{O0}pco@nht< zI=Vbp*>6IE@?^2|LW1&Sv8zH7wV`oXSsFQKv3zBCJ~D={x^#^>LNfC=dWd^itT1<- zl_SY}1y7|BeVsKW=`aOvD+}pP5{FSWDNCe?JD2VvW<3diw#94XI@>NJDD!o;Ur12q z>+Dw{cy3+-&!0tkkW|Y}WuE?sru`%C<8tFmRio;Ku&M{%3y4Tx$WgTUTM>B*at`t@ zyCHKH;|aU)2HSruT$a~HhE}`;-o(X|#k;Jqkf4P3nIj}9;e8e_BvC6+94q=_JNH?~ z95D}AH;U+8HHyjOKb<2c#&1qB859%a zcgYcx*MF5_?v#?-%IlBH5tGlKNHMD@pM3rtB{gNLu>Vz#RQdg{DP{m_o!5MR|3HqI zNBpA{vyfsQ@vrBIDd7J{F}+a2k#SfH*w0g**I2Tc%g3M9#`?oaVlLs07PPTg{|3pC z@$z|YA%AZLo+?!UP@K2il$w{`DOU0bHteb1&V2p`4&&2b((&ziqS38_6rKZ_mbi; zuNg76-z8fNpV{d6qoss5JS%$_%%4Q^0|WY3s{+&^s;duO?Byab^5P)uUs|`0Ghj zOj&vqLx|3w}k{Htl~dLG3s2d;@8L#^Q7M(N6eG{ z^EqOw`<*FfIBNbX%3R$akRzssKO#p=4gcL7F}3^;D5gAqg?Rnc@;}QFQ`=ucF(XkM z{I|Qdza>XZUH^NE>DCTwm>{OEe_Tk=GVA;2bEK;8U!_zJ(DU@re(L)VNp_(s;~@?F ze6?h)-o&r)U1n48LZMn8yCo6yxLCQV01o z_B)caK`Jgy{HZxoHT7pvOvUGAOjG}Aj+kctZHh@ki{fWoGrwkSz866WpYfj-lBoGO z*~j8y_l)0}q!#L#OLKo%wp5LfPYZv#kj&7W=P`c@75%I~SIC)A8wf5xkVQg*nt#?` zoh=_^jF?SA5;eX=IIo{){ohF1qR-EzrJqIeTCAqMfUURki`S9IVnJmY)7rm8a=Dm1 zf^B@Qu8bLqo@aNYYU{f~f_;C^kEfVlac$X#5W={g-mYbn<&r%q^6e$8_>X_nLGQREFs0!&^&F z|A7#EH5L8L0Sr%S{Jiz$QErST$K_SO5Xq4ISmz(dy_a8}+s&5^2)--J>%LC%wqs*m3}M@(P87sY%RC$DUM{iY3~TS7m- zwGdpfQ56%gqD?>l#T+qj_%G*(dBY!^BW8d-fb zLa91EigyB#&j|n79H~b7FXl)!(tnv!l|uh;6H<-zd*?_s${&&=)hK@qrCN$#kdE~< zZIqvsBh_gCgB+)LQ*hlrgivF5sPcZVzq23;k;UEV$Hs0fdmIuNIO7#+%T zt~XILSqJDIHg(97n)7E-J*M)}J!~#W@Q}`qdxXa-C(t={kFbq$>bIgdTyLinb>V%A zpx@~cKH?CsVUKWza-d<)u=QcAkBkpH(Es%e_i7&3uxHp(kp|RYaxLf?UZ_a_vw-w= zh)+e&@D4$;spu6BR1Q+nD;%yIq@q{&ogzp@ukcqzF!Jmbb~sXW#`e<9iHNlB{esiO{bV>t+IF6UXZK}dxssB0~_`ZFIG-#DhXTCZ!h%@rzrv( z_6}z%f^_u`o1GF*SMRWuBH-KTf z4ByG&aINeYRyf4h%Dck)Z6z+`&RyYrhxpvND_kv{n)lA6xA{r(UE!}93bnF-m_EbF zsfoPkAJ!2hyGP$Yys>>eUH!xU4v`Tf=huMnA>|;y285%P)2Q5-ov9=Y2*)demmUX( z(-awf1HCgu>(2wj*^1mlXR%62@}O{mB1QcJ#~B>16r|=`bbg-iwhsw^Qlz%NLOdk= zRYN^CC@?ih&XBOynVgEH!BcZnq!67(2)9sV(MVZ)zb`Bmq~_eW1M?H+k&EfI z4GwjG*uo(`2Zx2N9O6sDuyAIFxW$Hr^AthJd@!tYPMq^#7%2kILt*E0xK4M=1yO z^wIEkMUd~0h65ZT8nQl*hEFI5`iuz2DFS^)gio9&`aDcM2(Q452qy`W)n`OFT{+Na zL^ww|6(`UOg_J=f!i~=ti$R|e;g$~Z`iuzoRu1$T88%V``iu+@zCiRjpW3mjNuQBn z3qi8_j0{^U2l|W*TPx>DYR7)38aFb0L=osSGJM=2UZ0WSEagC-QQ^yqK%Y_Jsh#5a zH7Yz)kgPtV!t;~^eMW_ym4o~m6;4nD`iu&vImGKTDtuQt&}VcwUlHgtIz0WtxIUx9 zvjxfOGdk>~9OyGT?5rHzu1hBC&B|db0|p{%Xun1BnRP=`Bd1>A--K5AC@bEl#UPEUCwfRyE;DX zst9_$@!=qc_+D>(c)uW7Ym5(vD+ksXAC6HDtT8?;xk6G3Ym5&!c8JfN@!{^uLGDZl zZ&U<2PY55pGOqK4aJnMUc|!QUL%hxt!jA>X>O3J_svPJ%AzY;#=sY1j_Nutf6T*`n z;&q-7c2*8_o*0f&1UgR)n|F)rJTdIx5U=6Hu#+HJ4JU?|DhC=)47(}^8cq!7Dgvuc z3>P}YYdA4nqa0{BDQta>qzf8O3L9J(*KktUOc7XhQrO-hUgt^Sd4gnho)liJ9OyhL zyiz&Pc~bbMBG7qK_`XB@SYlH6sY84TpA>%SkTSC$%?o%HVp8~94u{M9(_y{tk}jll za@biBq;zuFx@SD4#8Ct(ogCio5TDY?;Q&FhDV-eNs~n_sayVQ$Na^Hots+S2%flP5kLz3>KBx$EE)Sn^h}XG1oFzzB=kjola-eg0I8Qmy zxja1R2C*S@E)NfPh}XG1?4TUjc}h545$HT6Y;a>-=P6+`MWFMPu)RaP&Qrqk1j*_= zCA?TU(0NLDrE;M2lyIRU(0NMusYATZQ$o{Q(gmHThD{ZL&QrsAH^p_H8m@AP*KlgM zMv$zAQ^U2&freAV8aGQ^&~R#anj+9}YIv4IyoOW5>y!fxr-kzrfrit?opg(bI1DxmYUaASvv&Jp!Q)50BckUa@` zCOjzz;lAmGu&qPNOeyUK9zvWK!iy4|7sJbyvzc;U414ErrtV9(@56x(@ng|h;i%h1 zL-d}r!g58}VjTPIa892%XLh*AA@uvy$I;6}q|Zy?UUx9Z|K7waVVOhZw3dc!|_Gr?IHzOS5J8_?b; z#lA3H?hxPhE)2iV3uW%)bd{MNv_f?QrD9=taX+yt?7S%KaF-y+i$&oj4)Kyd46kvB zPy2`A4Gy96#ig#^ZDk=;Ls@Lwrdfq<=j2kHc3T z;$vSNzUL4h`{M8;htSP&3fzxkUmSj;$Pcut{~#et!t?-^Od7VJ*a`V0tgXnoZ3Ou= z+}t5vaz(hUa^8$&1*Rh0%OPH$im+*3sOB1K?XJ|DQCt;aOGO$UDYrX63r|jj`Yb#{ zIfv4ji)Sd*XW^9z&eHHY<&3E(a+Zdp6lt~}kePX*<|wD*Rw8+6_*sJUdALeBgDG}e zrZu03TMrbA1+=Kn`g|TXQe<*_;VcW!bcnauvhaN6^rIaF4z(=op~yxDN~q=GaEJJO zUmo6acRb&hheH%W$^0VhJUGtzBJ8CIIA4Yxhr~HwhF2;A&WdonQ@x%5d4RIA>+JMiFqn4i`Th=X@Qmbcnaus_+Mglo>8#Z247T-A5!8}^JVlZBw9J1Owo_yP?Wb@`zYEV*q%O6GuaTVZ!oMq0Lc5&ISsh-k z$go|2bW`MH+H(<3FGcR4oe_THcXilLk(t!~Fz5Slup*Cjq?c4FuJ6NPilnGTV$KiY z2u1eV7swNe3_6!uSqk+-I7yN3Ri7Wj>5BYFZ41l!F?>;xyDpMYKZdUg0pROR=DPbbf=8RP=-*zffz;NIH5yAtw`ktegonDq#C$ zq8}9LtZi>5+VC;aXDOviI1L=)^~prLD`ye)DI8ZOY60W~2~`xGtw?|B3z$eEj-)fkRUAE%#~GuX*R)3~juzx`mMCWiZi!)YozzwD0Nwh{ezttBFH;EcQA*r};f63ELqpKX^W8W<5 zuAFVQl~9{S0~MK~q3TADCqiu=O;FB@+DdF5y_v^(UpXIUIp5`Reo@Yo#Nl*p9&P%h z=sZW;mMx-&4)Ho~5$&&>;iY2vEut$O;zuA`M!$|_IsUxXmQn3-f}j_!7u_;G&Z!p- zQ3RZ=qN66oIa@_-6ai=JsA6)Qvvssu5pcGN>P?SxwuyFD1f2TO%xB`9`q4Z^z}YsM zGds@NHd>?zINL?5UygIOi!!eW0!|pMPy{28F#0vYiK2>E<8q>CwIYyXqh+tfIW}6O z2souttGDBv(x`(X;A|h6596HeqdJO!(;%w%Nu1Ll+R-6?Y_mhOk3)QE*&%A;kTTPX z`bwTD><}HU$aTjEvSZXT5o)KXwQ@G4GFF>P=1x(k1ZU@{vvT%P&d$+|3C=E2ALZ;% zwUTEpyF|khoL!@l%4tJ#cy6_8RPGR8o_C9;e;QBwZqXb?V4vNiITdlv?$IJez}X{O z{8^l{N3_x*-eL`-9~@F$bU|JN|uRgoW$m$t59)Krlzsa5B8 zwPAF=Lvkf|R!%eOJ%#h2LwrgbMnk`dYuGS)%pqRRp3!)Rl$mza%WOuuvuE^{hC)jB zidwCR%h@aHpa?j7N4u|#bM}s!IK-EzeWD{A;$z<@I^H2==A~N3)Th|@iB4Cf4UPS_ zCuHB~;)I+=QP+f=Mo}*fwLOJ8>By966y4&G7gIgHq4UT`(Ayc&U5QZpMfW)5?i%|% zO)qLwT>C}ia*(|V*+2S7Le;1{L3Yv)hXfHv`C_RaB zVAM8;!=Vn0I^`f7s!4RUL#}rxbsJOc2Svjj;(wF9X=GM$T-Td_G@z4@#AzC}amY>P z+)L>85X}t^j+P7Ji;&^vkmp>Tgk_Z&=RKV9x#Y7GrZdXBHi#Ncu_I znI+Dl(V>bwM`=HYki(-R6*-rF&EX$}w20a$atZyy%N2wi5v^6EJ-sM(4IxKH#otO? zHScxFTQEZ*5E@q;2$=B7Ie#_R&)gksO>(oc7TSN zluqYpoFXeJ?c64Gj>ao;)zdWhqEMZqiHh7nv9p}ZqNf$v>J(#sCFF{zT#;gWag?Tw z=Bj9_A{Cp+>nK-8(-ql&vaBC=iJn#D4drx+W+?K&?joma^nxPOmD4SnsYshcg>y|b zTakWW(OcXU`?b-_io9D)r~e4KE_zjwzGNTPuzNH|k?Dl+o_LSw4Mi3aLXDg06}_cM zPqG--o$I4_6nRZKH$?Lkxj~V#=siVt8cyT%^XT`Wqxp*b?J+uIPsq*D2a3EtNlp>m z8ZA=f?~2?OeWb`in$p{&#fr4wSVHxQK2fAMm3h|ij)?vfyBXA15xE(37PV3RvIyS{ zs!RIx&mw#?=u|q@d3RLdB>Pr$aJ0%Hz7-uDt#L@1xsd8sDajce9le^%s^<)ePIO2a z)kb4pq1cB+XC^rJM(5`soEP^-*X1BwGKV@1d(k^5ACpygp}0Kq(*R@kC*+~%#zd%* z(Qt>%Hcdy#?S_$2-S6WXj*RN(Ak9e5$f!*YawH+6qV5i%8!J?EPatHB(}z~Ui>|7m zce7~rGA^s(uJp#+->8szuQ?m%SbyriUX<3BZXXZQ`^~tdY=f!hb z4$>|N=MK{D5u|;F3&k9y{rN0{w7-x=IPKSyJ}+jG>5tGarV%nLi#$TD@m++xltso7 zX9yv$W|2W3(Hr&0(MnbpLBBI6i?GG+r%~H*5*v^*?F{NawbPQSK2kH;dH2 zQ+^}ky)1Ik#uCaS=r2CVa?o3SoJG)sEXgA1tv=5p=r5LK5u{>y7D12pWfnn?_Ei=^ zkM?yIL2vb47D4a%V-`U#{BssTFZ^2;K_9m^i=a18TjTy_Z@9+{ITcf!MJ7HYy+a9* zBDAYDvIyGenpp&W+y+?$J=%s@1U;HZ&^~(v?fgdBQ0QSd&LZgJw#Xvr2kT`K^srlJ z5%h8Ovj}=CkDy1}Hp@X@xm^}P&&c;e_-}R*de|t7ps%!91pP&67D1n~eHK9v(jbeV z2iYNupl{kSi=hA7DT`nPvWrKwuiPz*U@WnF7QxtNk1T?|d!H=e~UO#YOP-fcFn#@PkHyvmjJH*dr4zwMA zVvb*hIM8115Z}i&vDY}H%yft(t|m^yUS>e__cy6crFNr<9pX5?KRw6}PslmQj!`)u z(P?m=TODL4D01NuK&C447|l3@^L(D1SCljR0B{!Pah54(N77m3taV7Ph8z6MY4<5T z$ZqD4GV{e|2(`5$J!uT^0;TjIySE~ZXdPRSqZC=)oLXYXIaiUR+W_gI$hGGJxkr&M z7Xg{5$bim3-gHQ=&I=uqtMjKCYS%rW^B0O7vlozW@zao7zTe_|n%JSnMYX2&Wrfe;>bH?!r6+;nze7E-7~?F>Z*5VFJ}uPD-t=2m;P zHRdq;wjxIn!fzKJWeW; z7WNQ__%hbQ9;u;f(Ru>sP78ayA}<{QqwGUD$Q|dJT6MiMF|h z`g{|b`BK?9(H^JBM|%r$l0734>SWtdIn!y^{#OchvK{3RpQk6=nRViMak8DK2=c47 zowrGx)7n-j0?sLR{-$xxDR!A6;GAj~Z5HR8YF8)%&S|!yZk%(PU9AW>ZS1PexJkao77 zB3)^3y%BNRTdT~uvQCHrvN&$hD^ zIr%6-&arPOGL=$#E^*Ga?<;Z$rL>HYj&`vky-ye9JiA%d7&=QPzPx(=xi@hwK9VqX=5;%Wbor6+; zM4u~d*E~+IJkAJ*cpF}6$LEEbs-d2u<*D=q^zyBJJ}=bkd7<9bP_Iyn&Gxy{E>a|- zk)R--DpH~Oex>~)PtLc>xsOi9)^xGg-Gi;+(|)zB?~pR{J@w`+`D%NVB8RsE($*n9 zrB~bY^W=2aP;)m%sNoLrd3v=SxK}(cuC@<5#7pjCpLB@Vu#0`#A!Vj6wd$;47yC?J zs8{kry{)0T)JCZJid?R7i#;HZbBJ<13hVT z)vk0%nb}cGOIQ1S9_KgZ@Y^G-PglF~ejHb>UzTDOBs>qAfTZx>5 z6uFstG(nm>#HXvPUABKbU0v-D4)L*fv#A5(cJ5|tImDNZZgvxgX6*Hj&q2&Pd9sthC=D>X4~a)Iw}X2?`E&g zU%dk*&$xTYwU}OP}kTw8tNgfDc9J&8cSZF z6}`qD)g+!f*Vs0SfODFQ;_QlyEF z`Fq*bitIsST8_P!{Y8<+T2_16)L|TZuH@PdDKkgY=%da7^isO*8@hR zezu}>oYT*)Rs@{8?260doV)DL4)JO4Z!=dgr_6jzImmUezisD`Tuw*jaJsl8^tXK+ z;&ZvbU2#o3uKxB{MWD|BJLI}JXMi202si`nuRY_OfwopJM!Y_QY+Z+xnNzlsy?{aX zsyt3Fg&&keyf-PuCzjQxT;7Zd=hi&biyJRs@{Ew$80_&R`oU0?rV7%WZMa5PP>n zd@Am-4>+WZPB4qk_tnW=4-Dv%zmIq_m1E!aY$}lE0lv)Vwi0{n03zOv~&oqnd>RR zVfIRg_!2eDHn=CA(qXodBCy7T_PPh+oCj?mMZkH;-Z(7IdB_e_1e}NMyochPhi!!- z;5=fdKN{yeVqbNLxBPJXo}hue=FQf5Z$tZlgcOpz&S)!}x9BA2Po^tO(W0Yw&e)cCpWIv4kto?IojT= z$QC*(7;XFJg}PfgZ&MpCp(Z-S+j+EIGd7;~(YD4oL13T9Y`dr8oX6}%4)Gd3ZZCHT zl`&n@d)(ftNa=wR`{VXOMP}*B+v9e=L%cqZ+wuwVxE{B&9U^f>RO-gqPX(#5>Qgxl zHP(KqNUH|)d)Z|9vGzNMc&m=JYjfn#b_#JyCURV5X0onpjkOyo@;>eGvc<;QP?0?} zm&e-u6nR-|%2?Y}k zbgXUsbUaVT+M^Uf85?KoO^7Gi z6YQ!4XQC~CF)nAKeOVF6nPeBwjB_U0Rf>S~w4F06&UxA{QUsjIwtRM+Guh5|h_`dO zeZwI%^VJo+a{GlM+vrM8xy`&Jav-_fc6~W6x!m655HER(?duScybIN@DYjfgLC#b= z^VPVVsrDU*csbMT2M#GSEp#<(nq8sDL)u17v%f1+alDkwX|~R5ah<2xPH)8Hnr5$d zh>vT!?ctCzv$>YK>GobluGjJNbX%@+kc#Pc=v#5g)9n~VzkIc?R3Gi;YU zPEX|&X`eg84$tF^QO@sMh~;P4IeDCU%2`32y{IJ2u!|C$7i@)c8fq@TV1H5MHr4P2 zyUhZ&k5Bsxc6*1EnOC)Uc)_++#J3wS*k&KZ?fimmr3mukMca5$ob#eR zN)d2o+KwN_IWz6$4)Ge!ve!7I%p6N6D7bx|W$(@73|9{3XtV6jAF*Va*-5Bd9Fi-! zpK^{o0g}h$aV9FKm)7oCc9}!GHD=kCi{q)7W!ou&l+L!Dmc%);ZC6FWdC9h{h;v@D z?Gyp$Wm|uFob$5X)giuwzhd`yh)?M&_HPa;GkeyMl)hqHDDu{>Kw3J)r|T74|BHBB zuh?B3;w8Uo_i;#>Ik&#ZdDR}D$2nCwS7bStJH+e!s_l^%>Lv}9p}n>yROVl`eHHoi z2>Q)QLSD0XEAmVm`ehbE=GX@m`SM)4kwM7oc7!6=)4l_Tdc!`c$Z@ozaXuk$+GiCx zmDcn)uD9%K4)G~{+s;+anY5e3q29I|e#!RnoOkTz4k@EIOoj7~J;5P9rE~2WiBNNG zM-BD(>GZ-dNuFz;NpR-bS;{$pX6rqOGtaJ3%Z=>l7!p*GYN`vvw(MOy2M{Q~=KUZ`J{ z(||@+ye_f8Hv3A-7)tm8d)>--sas(CC<4w0cGcH$&Ii`4ipyDOn|>4LEVL~Zft*FQ z&$n^TB0E$Oa6Yv2zl(D|w96C$=Oa6Pb)55&ouddiAKThL#5o_^`ig+F*v|hs&RJ}i zI>hJ268o(~d|oWEKRcw%TtxdRLn#NB*z_+fr_5YIxif~4Pi$?6NGLvM^{L(2A^!EM z3fn;u)~5q;Dr~)9SXl7I!!PZm1ZRbPMmaZ9-_5C5 zVHYGgU)d$f*@s#r?gziJ^?&EI`*eL}8#qLEB81b_A-*s8%C1_=q5K(!ujuRmbtZ(M z^scl6Q-WZneWe|)2smHc)|oixYuix~a8}v6#c|Fm+dvU;zOidc;+$`6jT(Z0^Q~>P zL7elgZLSD7-`Ul*XL(ezemS0cVYEy?LCo#-8I4U!s1pmpH`d@=x|^hm@HCo5~I1pKLcp4yRUv z%g@jDIz?`yy2HPZ_KUqyk*0O&RTHXBzuNwaETB-!2>H$4=MagD+m_$$7>D?_Wv#7H zgj3OhIBV@Fev&+=ZCPt)I%G-BU1rfsEhKrZog+xLZCPvQDhF-LTD#aGKJ9Dm3WxZ# zueGZkQf5x4{r9y_@~=4@*4dP9u%%cP=T3vtI*LH&ptOS^+4pIK(oV|3+r>fYrOJVZ zL1`Co(?H9ZD_2{mJdn?svP8UsQa!8q(LTwb^>Mbt4Gr=h-9ip7R)Lt;B zq;!=-e7jMjwA{vHuTlE4BG9mA>9_`QPR-I8ihxtAbj1#FPOZ{k6#-|1(zkYsb2cdD zU6l0gyzWH5v(|@Q{Lw96x?^n&-PNAUZrY5VAUweX^VMnc{UZ7u3J(9vAsjYkzHH5I z+H`$~zh}(7bbFG&-#T90PwBU-*uSu^`0wo@{wLlfI0wh~xXT>=^Wo*Yp!s-`m+zN& zs|ru6ccWR)w3#?m^p5L=@A>lMyg&P$M!yep{AqK_W@6vohve!*zo|zz_xQW;GRiA5 zaUS%juDn3yB3xB&O5;uP)*pX{PMr9BrMDWLKW*yXpPTOdcy4|?_j}50b8lRZd`~M* zQMfU~hg-Kku(#*K9um&uuhaVkx%n=B=o6TJ4JCiYrF-9+-*JE19P?CV>GSbC z(kfm~#Gf`l-n1?}WA3|C^!sEJuSpe_Up23R)2Aq*j}KRIp5%wPDKlx1*dP7IW%Nb>mltvAt{kP6 z{Y&W$3)br<*DeNTaZT}G;`*hu@=+e(`gjZVgH^Tbx2zU@pr4fUzziI~vQuj3v>CaB z=!x&a&7$ADUnKmx_4Rtj^(llSeSf`M=hVQ|sS}v9KK3r#KkgU3z=M`a9=;cH5f0xG zzA`s%mp`8FdnZbMK;E$J92en=M#g#M-4@|q#ylI5(gjOEBDh2k*52_0sS{^&ZF@- zy#-@Vq46NUs_}|*i_N7}Uun)|hSTdL+%7<04#(qT4#(x2!_l2B7mnU+bm2@+xC3JS zA@!5=d+ywROZiA=`^`Ad<8eOpC?tnOyFYqu$Bi?+e;YS`^>(R6zoWzH`u8lSUhjW} zewFnDSIl7h&|N|5kJwI)9+Z58AMW3_jPu}c{}QJmoed9u(6e$rzDvB)?{U1>x%QJ@ zt#R>qd4+Ju>A5%_4{*fatv!GD^2E+Qy@mYJ&!o+}I{t&)s$7ZB%U@rARq`wU&UwIp zfr-Z_XcEsa2g38X50@LC|DGJL{4qab@p6Iqav|+ee*LXmSNhL$Zxc73-}IK4mOrsa zU~V46vT09_e%Fu7!_n`un=!5Ftt)QVI=wA&r2GY14(Xn)E8qG4c)3iLU*v;#-*xeO zKlBnk19O~92dzuEdXP33>A1F`Tfd+?rixEi{H)tW-{1ASgh&1L_QH3Oi*zLQpf_%v zJ<}S$%n$0+p_07jGdZHijc;)t>+qKguc(xov z&voOz{P=Q{TW(pNj0b(a%=IV3C;c2A@|MzTDqN1He-Lk1AWzy8-`=2oP2!LT_va#d zkC*J7>qom>nLZ!5`78atJ-q>y+rAaTp@)1=Yq(4{zGOQHInW2+rM&v|Rk-<#*PH#& zo9%{p1&@bgUhQ@~52_qTx++UQ&yRV>+}DEd|BW1<*l-OtIY0yG~B;3|0~lwH~y;fFBv}RU*GUm@pHeUK1;n>cmCvt zt1SPj`u^{lu660f`xUw0W&c9jU9?|Gm)pH{^((pUGxN~iGA{dADf3_r8D~ho`2M?) zU*>nx-m)C5!$|uNT-ts9E^<;?9^{HX_zsueZFS>1`2X`<$+y5r|B=)m{Wk2iArf0Tb;?&3Vg(H_FhtslAJ@mYuB3 z`95qf-wr10KlIDhpTpF zzMVz?^+(-!KbhZOO8vq5sMO!wb_4NBdXl_kJn>%Vl5&9m?zZ^t*giUU}Ug_5dILczF+u^fxGP7`M?I-mV{l z-;Y}`UavuK`*Xbzc^PvY&Br;v*Y`WZiM&)+&L7?X!af<&Epq(6o9vU(Zwc%#`eU67 z_K|jhlH&gI#|>yVAYa1ew;NUAa&9c6>yP>UrtF)h&GMx@9?0j3opJ6U(0%fh^3&OM zO_B5G@dw?yV|C^DcCzwt{yXeBe1A@7%AD%lz{LG&(`H}JuZ)?qkCd~Hi-cdJp7(S4 zho4>c3okHT)(G$P=h;nV{mFf#56_kFXP?6^{sI%n)22knr9Bsl9w3Mrc zk&AKx9Q;!*V>zBL`lifRZhS@St+9AK5BS=7EFZkUh&;L*+D#|M_r`A5CXIz0!MuglpsWhp;Z5UMJ4`uaHw&IR70Q1g0_` zzH+{ayp(z8Y}Uue&*|WQKTMJQMZBnox#v}Vyn*?%-}zhz|NCZ)*azzri0@FE59Y>) z?=QRj_vdGYALzN-%3Y49yXGVFlYY*p@lT2#pKmShEH@wZcDwNm!C@b`E87SzF1@bm z_K5;hx!>cHb)V*n3P9Cn8o2v)sALOFlUlU3_6qnjv`jr^256h{2;q;?@%l*#wsSM|E=U&aJtvnom z@96s9fPRUW<3)T)zwipl`7`lXPe0#}#P#&!{aid(pU;;|x+K5T=Czt>N@rjuZzXmX z`vz)fpHFeze`kF;ynLs(nXB+~zInb62fIU#_B|VK1%*`J9^Bs zyv|Z&PH!su6yi-P=k!(0V|kpeLUQn3=JzS{WJl(w&BcFb`59AlU$LX)13~W3=ZoOf zpP$IQwAo+BS2E7QeB6I8J&WbzFEDSp^SyAv^WU4g^S*%*cm2OtE}!~Ecb+;hua-*s zIg}c9e&-S#^oD7g%3O zesA}!v6uo2Gv=Ak_*!213fT5kouZ7zhBP!;SYAA7T&cVejf0y zoA0H}jvXYuQXgr4>CPbrT0iO6Gj%+Rc~BueS5cQxuXTdKal4#YV!HsNOZQ;j!K&a?(0}r+VI`^7QBGL2rK-lq2V){5nZe zPtgx{DpLK5Rlky~++;X8Pe$#E%a^Lt$LqoTkLN#J4zFl29&;U65$ep;7t^A_|YeqQmn zBgO9EA2*O~4IW%t53dx*ckhb*>E0BTBbKu+KiAidUH{^FPbb2$KbI%_@bvqiF`RYg zKgbD8rwch8y*WeuC5K0U344oPfq~rwr`LEUi2dUJWPW*jfG75$dy_v%c%=IqcmEpY zme!@5U$kX?CvU@i{K20xJ5Lrl@;%>wq8neQmFL4FKjF$cA=$yzBbx8HbwlV8nAh8J zJX9VWo>u+xd7^j996VU^we-Bo!y$kAbYNau+bypj?2d5~`uqEIT!4F8z>_@eN62~| z_9FuA&*9Q94(fe&S;wRIG-mtc@KlJm`@1@=P4v+H@9^Yks$gh*Z4}E3b zhwQo?+bL}>+<|Qn=(}48+Kn`7va&K%6(c0!8MEjaPG6BZ#PuJ({7ATz!F_1tEBZI!(qGbe)b(3wwQt4*t{*RQ z;pv?fbN_vD`$8VVi$ASA8gsgQqIGT^AD;1z*bg|$Ey|I&DO0yp@(X^HWBBE}@4tbA z_u9(1o-2-Fd2}yb*9+u(U_LuhaQRN_SZ*FnuXz#9+v0u;@%(Guq<&a`^zOR#Nrq4Q3#BWc2m2$wq#yXdx0_7Y`uYpm%j2@H=f@G) zpOt>z$A^BL+ZX;PyyW+k>DN*EO?lTKFv}j7{txqX^lydwLwuL><|!F{Po_xw z&*JR8QpAIE;plhK@4>})8K=>D!Yk6h0>^k!{JtK7FW)m-AB!|y#pVZh@3q9pJ3koL z`udA`6y%GWG8;GJ_|qzf&KJ0G?H`X9=~y3q>6Dwfn(UjR^<%uB^M57h6kW%vJpQWf zBK9xNrUUkdJgMh$ZiUwaU|o zq4#9y*0foD2jd%`kBeL7ZMNk+phkn)vlTBdnd3@=@==O(%!`F&GR+n^DR1m zNZMV}0sVYBq#V&XP@S(JzWK*Xd4zrv-s>mdi*%gm(_1+|FopDz`vOI}j$3T@ar40v zb1&5k9>+i*=-G>2_{_yObMvUQ!My|Y2l4k{{5vry$8fQ)CH`c2@a;U>=Oq8e$5@~I zegS;g1N!%L{UP!X{cuXtpEi&uyrOKsaQN+P4|);Wg{Sifx?hmgM{wW13BNciC(if# zuCRx=Qa`wzK>rmF2Rr%jl1|?afnNwOWN%4#A$<|Aw>PJk%m0gH7j9?8PF}C-#uLvc zA6~`}`RT&A0`|hXdR2bdMcM_(_4!pO{W!NGdiwPLv-wi5iVeDB=U*ZH ztDA4g@89p1`hoI>c3brE^{6WS3+aP(NS4p*g?t~A+abt9`vX7fJKEJkxTF*9z<-bX z;a1X)Z{gnk^6k9zkKPaaCEN4P?i>x~m6R3k5BqO2pW&RUc?idYKg@HyAM0xpZ^|5f zJ?AU_yga;ziT#$^v_Hx1vG_gz_}=mG(oXpA>+6SpvJXZ3dTu|;%L5+YFG%hupCyiJ8%vc{^Wj6avckH6gQ>oUsz}I=N@F8I>_#)Cf7G%A1Nm| z_vY<`@^h)4AFS^B<@(z5EiKQmS4}O~@c+-1_OdEF;9Udk$D%yNUH|?A?uEj|{v+N2 z$o2Dh=DV|{-O0td9gq9dCcU@ts?ztr{kx3MeS3XUbFmxpL)?@BF8!eIH-W>2Js}tS z706GV2m6BhVa_-B*Vo1P4KB`0iCg$xBmACl?)xe@M>9#+x#6OGp?%E_&vr<*+jyrqxi2Wco8a?*n|nE5@#oL&NO~|X z!#!QN9!I$qJ^g#gz;VAf?)UeDf#d!c&dme=v-X6Xq<$#xu(ym;=zNLVy>h?*T?Ob> zUHcWvH{|24x5di=@MQUb-qm%HKGfT!EAKq`{C~*J$AhdL#C|C=SnoN(p7DH5XTRhA zUYzI44e;aK?@`eGWp^&$mxp9I;B|LycX+>p%Q^O)CA`-Y`G)!lKlBv8*Aw64t}nlZ zaO4Z;7wglojkJrXZ*hNG_rEg6z99VaM12##Pe1g9onX(nn_vIHPufp#pTAX=8^oXF z#pCz+2_E7F59^%b(#_?cB>&(?dkG%;W8@R;`P(594t$hn%u`Vh|7d#){R_E>FJ2ye zI{>@GZsPaltn%{e%Nfe+!McwquFo%Nhm!u3-UstI>=SRd{dei-ao)?9pF-`@pX*N$ z4_xRQ_w&3CcE>m+?gw97UKf(@K3%XsT$ICjKjQguI|QcoCGr06M?LqM#GloBvdx-E zJ;uEsIoC|*@8A@fja@zW{cN&)BD|DeydRS>+f)&b^Q$`J2-p$j7xgk;PLu6U z(vR~3zC6RuQXhOd#`q*T-$%Vk_NS<~NN=HX2zhe9Ffb22AI~rG1BZ)p0zbwzNDtCU z?_ATl2yVwwe~>=7Nqd0@d&d1UvvzeY7$9K3WCvasP!eRK&=a1MG`72-jckhSXWIE+{ zu<(0l`Fym;Xt)1y5$8j?!0*HT=ggO3kN>$cp7?jM1KJ6cH_Xq(@5j4>qrAe!xh3z9 z^YEQ|+7|KlB)8sj{VCMnCwb!czY~UWnyjPI??s#nY|JCV4 zfA^8z$9>-28w>OvB%RN2_j&1Fn%?V8-t+Cgipxiw$NScW&TU`ul9XGdQ~bVPO7?%r z`&+OR%Ddca3rwGFrM8-W?;?h&QTQ!4-DpGCf$lSrA(Kalq5 z;>{$z@Nee)fe}}D^oqJ!NbQ$%bv*^=gmQV@A7Ebv`bm4|?FhZ(JKZN*!twjxYel%E z{e_2l1Kzg`%qDJq1n-Xed0~Bb?~%?UYks2Ljr+Y`$hXSFd7gYvnQrcVH@Z*d++;jy zU2n?A(OTh;Jfa;DeewIL zzMYYL@%0kzILkeOieIN&J<@!`#9`3#WSvg3*ygTRZ4*MY< z=#BaT_s_-;xs}WD`^U1bQhobCF5JrHS65z=2fe(Dc+fs1-9Hzw?*r9dVcHDA-QU!{Bi7NO#g`zALdDj=h;>=-jH`?=zX-w z;)fjMXZ*YG&;RkP$bIr=m80RGTPc2ohx@a8AH%P=V|P3ky{C` zAxUla-lJq|gR(_5_Zl$fnuf9VpLlg@lSC45HHf%pR>b{PUNb4!RF@U+(vOyvWUGW!;eH%Prlw z1HX^v-z6WU{c$HZKc)At)J^Jz{t@eVaIsz`eB5vI?Lu4*{r-Z!uav~0UmOo~{+Tj3 zuaNu>KkS8kgMMgdF@KD&6Z_u{L3=Cmd^#Wp@%*Q_GH>^G>pYR`CcSs)-b+cFA{vj? zsgp6U((gL(d&1Y!dtPv-uH)TJ=)EQ0r>mQmb?S6E^HWYP@4qGS+S6DskFVISaz5}v z{Bt6X*UJ&V*8}Nd{WyI|J%QKyTE0JXilj^SCH?QLj6bz<{J3u=9Ng{IZprXbf$)$k zZpw&#)8?*SMJ`;(dsx?Ji!`5}bZ*N0r2eM#9u)u1R6Pxkc*TW$+9z@4h1$WpB;O$) z=@%D#diU%j(FZR0&7jjWg5Dw`a zJW1pw^QF%q$&WohmGXx65$;v5366UFsat2K@zy(n<2)DK{uP45Eo3+7SGk?irl!7+ zoycG~X3#rLE;PTSE1dcFkia7_o?QTqD;s1IMh zDE0Lt>chCal(_!TryuQqja$TC=&#`RKUeUZbpN8}5Xq0q`iXzX{;e`S*$%I}{ij0X zwg2JC^7r53w-<5wPMOCuTwnaS3Al`hJdS7R8~>ZMKjNm$0-ev6>?HUs9aoQdS;o1oXuXuj_h*yK zat@(>fb|lb=97*Gf7-NrhG@j&_K*9W_x>(&+qRPM`_npXZhy21wWnM@s;Uq58cTTa zkRG(lXouhIB0O>FcSdyl3jck2?qr6}CvtJNE90DAgu6)Bf49`}$W2{E{=qper)Lh0 z<2c=GSBne#!)-TA?7;m8^N^0Dd$yjFK>Erj5uNyOlXB3XfSW4epy^~J+*87OOt%gW?ejLbtnwKwTmwr#;pmnEnhjK0l z{`aZb&*86|&idgTaA5YiL*luG-XG%cZBC2J#kn!q5&Sb33;+2=?553Dx}Lv*J1020R)HWCOXa9!gsafpb$UM3WyBnJm z`-`4`WxR&oRg(B>yZE^rygOIYRm-{byJ*fH8S_FZK!<{$xbcnZJ*7?T42q^GKRs=sE`c80Vti0muAV{G`8Izo2&< zwEckp;g6+UR(#ERcpm)h=B76(FFEgpT+EjX)yG2kS8o2EGS}}cdX>MyZpNU#+%}v2 z#d;p5M8~}~G<|`2ZsT}5pa=9y>MQF(bZ$w@19*k(oW!eVXKz>J7vibP{+M4^Rqki) z#&$_%e-A|D`*<;5OX5j;K(8d8ynkBVcPF+VD)})=-T6IOPr7ej02lkF%teDG+_i3g z?ft+v?9SimJnB^geTw`JOINjQ4{-?dlrox|gMBkGS>uXwt=|Kn@9{h)rl zvBWo*{LCMzZqh!<_dsSmE&R&y!tcxCedGBTihjpVVL7SnJQwx8y5*$b=^`gtUgG|= z!S6O#j%Q5IFC;zkJuq=z((mPcP%iO5=h6|F$0kd9o_GCjV7}1v1hw6G9lzri7+&9H zdw)5cT{_qN3WuZj%I+kG@Fs5Fmonec?=G<)>rXY@J`s(_Pm1e%oZ_fg>zfXQOS;dF z6+Pi%eLilVw7!#(ZznnboH4uYo~tkFHSCzt@I}?+CF4o@(^beR#LpBgC!&8w^Pwoq zOWLa{KkNuMX~(vgbG`I>G{02r_TFXe!fyHcC&MM>O8L*27H)mh+j(dpx#*ACG;R%uMyY-Z5e?8F%{eqO3d8d+klQJkamA zyemAk>oPB+d#|n?NoU)A^dl`VW5+CHD zU&1&Unwf(|rEt%HPnfYZmjnP5}4$A3$L?qxf0yZcX|DU$J;;ZI?Elmik?`XVLW$zCKu;+T-I;=?={MLjF*?x z1K|s;`&6!vmk0giJx`B+GJ4(i&9>vNzoOscb>~Uw_eHm0yLkN%&~+}s{qG3L??$6P zNSm>@vfVOfXlo8nze^RHFVOvt#c{dVFN2%pZ|(YBugBgxP8U9Y&xQJ-D)fI<=k=HE zFZMvXcONBsay!EL{ix0h_Ii_fDI@XI{_^w8OBvZ8Mmhp>D9uB7XYT-7ALI5|-U$fI zaqc_=z324-f2B3-yCvT9-0$(E%pMC_URr<8ETiWzi_8!1J*8r^7tK%k9o&`rzEZ7E zM4ulue-3iLM@zpKJ)ZF*)8<5Wi_OdKdx?3gFY8ky8@}{Q(SKdx`TboE&+#V1iykSn zw6^Fi>Bwk0ip)3{Z*lfKDfpGAlYS3c(Fie-*4i7xbL=z!m%IW5s&DTcKY!B zIR2eD8f}@b+J51@)$LcX{(<@SFtO)o_j|bc{#)A#Pu^t+4Bls$F^7Uv_-FfwTYpQI z6Buz*W`?e_zwX9MDf9bhB8R`T-rKu#KY{67i|~kL@Lyo09HtDPBjIv!;sB9*OLIy8 zp_Knzj%5BBm|^;RaJ#vEUc^K9t{hJ5pjs~8DHr(<%n}#v>e=pGMatCwnDtAW&D_33 z#+>WcA&Shi?!IENS>wh(C1%iv%&TFVx^?-QX3b*u*D@~<&hOsWX~X{7<{H<(QhlLy zVJ?AZ>?!HV{Da+$8K>*B=el`wvAKCZ<0WR!43RH-)y&F~e4=w}OZYqeZtJ1Uhnq4t zQ$1k2w4iu+e?9q~aZX=%waeFJ7cLj?G+@1p%_8S7F{itEy|-(H`k&VM^cy;lKsg-s z0?VcGH_7LIz`FJEjJZV17winaCHr!W@94Po_Io8AyA?}6BjITrlylwpQVw`snDa;G=iW{jFJnCg z`k;Tg)U{7()1xoPn=#Tp6`Ai``(A9W*-r8ke8I6^lF5Eg>RHI2>|c}pv7G0kch6iu z>&HW|C;DmBOR*RIP73w=Tn@p5o3z)~x~|l0n(&j~lm28nlKGS5udko&%Joa~fzIcs zepT6Fs>}Dlz(u|y{Qd7sxsd&tv>ER9X)@-3&lxW=4QRjE_1A6L4kc!P+E3&572}es z!ef7{dy#|}c?e%KyIue}vYwMRqEANkDN=ok4dn3t9_OQ!3wjsjaPiBz1DtoIcXVE7 zoW_0BesTNy#M$hp-}iCn28;BZA^rZM^9TCf^S6G3!zKA%F2~R9D$X6YeVzGqZ@{&m ze*6W!&~J*~fq7vC^AWFipPnIjDCySlL@4w@G1oHpS=F=u_{6ghzjOaJ|3(4m*C$Wq1F`ct_cwlfoI_V<( zK5ku}-s7dPoSrUgMDFYROM1jlzb~zR@CB#ePf6e+r!ZdZ^vYzz;hm^LZsqThc|Ebd zW%NGH@@GYV@u$oOZ%R7Y&*O2-^rL+BiLW0?F{vsZhV`*%qn`v39n z+zibqACdO_IyX+rn2s;UaxAV@6 zBplA&$+}EN*Es@%e#EVNL}Uv0N9ESd2U2F{7zU`_a&E>v<>qtrJ873jU4cseo8`o9|Q-K^s_=&`=zJ%szS`v2AOR(G6> zbN>IV^7dED6*~ty9?xI@KKubGU+9+*|AT|2-Ab-k;yc_y?%b*DM{+%`xLo969$CY! ztJ3d$J9)HH_yX7OAUpp+yP0&Q-%lAiFPb(zhloBH4^-DZg4WkrucV88%ei_ESH7pr zanqz9s<)+tTmA;en=*25B(3@c=IToYUq$Pm-2UCZgu_w0so?|^M&{ExcxnKSIMXK@w0w7@5GJu{+KgZ@E(Z$?^_=p>kg+o~rc2_hdaDo2a*_@5%a$eTm%q>+_Y) zgJ}BD9wgnXB2F*rPk#FYew>%CQZB;%U%ACUN%`LOD#_1qfw&i3F77F3%J)7~#9gTS zdRx2iDLwz{>j$6f_jaXmtZSFjdOjBK(E4-xGL9?kmvs+6u21@(aQ6)Hoqk8lwUZh1 z+TNlszE9qY^^$cEUO#xCOvcm9=X=Ko>%PZPdae-T7tHso@;`e_ZhV2RPeQN4<)u)* z<9x>_bgq)yu}^m7bq{*?a3@*+zZZso?? zR9~c|E|tY?=mP}J^RqPFx40GC0wBS z;?sA;hLS&09%;YmOo^Z88(a=hE>K>9ZsW;xC(IhoGAwVuPC2*19roUiofYQA>s9Dxy+?!oDOX1RYv>!K~We0Usu;JBZJeoS0y zU!Uf1v~Q~W!yg>W^?~k-P=Ckv7MDiOZr?F&?i?rOP}1+q1N=#Oz%kB&|0<0a@5cZy z6khngKTgW4Zn#46Cgn|Z=U#k#h2+2Mcxf{$8E^795A7oQ;hhFZ{J`PLI|IJ|{CN`F(fjw+ z{tE9Au%GL{y-vy#zVmrjZVy&bf63+SJ~zJh_hF83qj!( zm$-43mm}e-wl~t3ly_Fb4$uQ`p>U^Z`9MB0pX(>W1zI2F-fP-?;LaD&yWe9ZeZXbE zKQO|F>(ldrnDAuQm;yRkozuy>E1lIeED*L`I@B5&+E2w=Wl&^ zS+=Ewm-^s;KU&V|qzuY2;+1v<=M;SVGS$_OB6CT@czK1M$^00YDA%wj$|dq+-SPQ+ zKzQg2Kip*etS`6kcWb%rnJBlIzaV_}9_QPfzLbGKYk#+|j`fVRk#`3&hTk3FeOG?B zfX|;Cqw5dL$^FoV^PaijD@bib$-hfAxRj2kEB%9~B+#(7_f-%sFrS7^KmdD1@9 zeFYaTFzY)G6@FUdk#`x`9_TkKPdBZHC(_IBIaDWHuHNfPAM94$^oX7*wX45}jebhT zsdT>YS+;Ll)0Z)Ab=@*PpQm#IZanYp!u^6D-=}q4pUIBvp|6a0X@2bH1vKy1e8KlZ z`B~j`Vw{BcCorxW>du2(34-<0uNJ|FXQ@a29^Vfh!O zq`jyv|B|j!&f!)!oami0EBbSM^!wAUoywT=UH|0U5wusY?jqx&+EXMx_H+5eyC`va zf%fM#kI-=fz9;<`X}fo|?uTRCFZ-rxGs(>}sGjf0dKQ`Ob{6|!-5K|YFz%?XK8Pg18yD6G;gBA*lkzT%U$>O?+mvbN*3s}@jQ{@O5>6lao$J5<>fSZ+=gzPm zkR1Q9e6D9-(EdG-N8Z-;8}LsYEcqt=SIUS#ZA$gs6!dFi&y+br$HkTV10#B+^gb@e z$A11Q`xErL!zw5Bxx^2@*I|9xwr?2@`DF;Yb(uLe44!_9r za^n1yd63E-+YjXn?*QT5Bk;wQ_b$0Uz>oXd$#@Wd(#88hg46Gg==(~*5nnR>h432g zohRrc_Wftr4e5X$Nq@3@CjAHpH~BqTe?D~WLCU;!AeRqcAAocGoNq%`NI8>y@O-or zz%kx{AK#PlqTcd6j^+2IbzL4WmFYTb^813VnJ3@f{N4HKog3$tnCqNd!+f%>lw(Q1 z*E4QMX&-XaCEuxj=r{-ZBRwcLNqZLZBRtYCe!M&2^{VVU&zE0%PSSz+;Z`n}Y(sg+ z^#yhlyU;yZwP(`)6LlRuiC52$^GYLkhp&)yVci_<*>ZAbhteCN*Zml)aKtznLG^9#A}S*K1dv)x-FPxgK3-jU8f;_?Gs-%shj7nSowd?KIj zJGt;BF8(@oYGlVLcf2C;VBC)MEdPyhnokvr{R@=`;8=ghy@I4au6MqkQeM1W9Nrek&k*N_aOXw9l}Ze z&^u9UBtG~L>n`>KuPXP#CnY?1XisGQI<4!p8MEyLEVsy%Y#{uqc=FC!v3bdrr@&xc z81E|HqvM*1`W@q5kxT1HuAifK7BxPEgP!Z_KI7^Ojq5KK{oy9%z>e}>U0UCH$e3r{ zIiVtb->_KUaVs(X+KIiB;UqnN90+-WXVfl5<^|nPLU{R}*6$g!TF*PdKEkJS6JFru^QUzwl#HQeJy{4$EfBbtWyPd-Fe7TW) zF4l7(C1$R>FF^NZ-MS;f(S0o!&hO_)IGRVhb?zc_n6`(N^8$0Q>)+_!JKe+Ke&_9h zW(XOQ;1#FcLzSKO%m zkht_aAX;yd@+93}o~(Zqo4=1_`C-3G3Y7@tmYO!>KUP`&;`~kWq@H9npZ&W_l27^hkxWNY5BZM%%irs$9M6~qcW^mL-seHMj5+*Z zX>XHyBYo)alHZf*lKx8eF{@J#lj%e~#`u!k3+{hEoFV!HhdmbRee9jS68-UeV~5QZ zKloVJmEQxvevTi<%6qc(JH#4~$ff&lG>>PyK@Q?g`afJjjE5e1{y_xA$^@%Q=C3T=t*y z@onAyay~w=AJ?;dyimFZ6p-_OrKjxQ=j$)$XY%oR1=1_$7xMW@`yii?f7$$S=Lmdw z@R0A|71B%2U-;K&U4m%WT@1%dH^Hyg_xp?vp z?%(t8zv3QjtxtsavYXcg2JT;7j#}wCalF@ZZ$rtaML4`8fO!77F58y>g6!|g%lmEk9XZkGV6y+Xdm9o zfjy+WqzwF$ULQ{ELBH2Cf$c>5JMMfGof~xbrD=Sq={#l=vE%r=p^)$`yuCc={-$n4yjUEfZiJmH)<(gzp&%GgiFzHw#e z8@QZcT?pqZ5MI`AX#VTg>*Ra{>%nqd`?Xl~%9YRGlkffG-9osSpZ`Dh-aRm@;_Cn1 z&y$2C5bgr z_I~!`{!Tn3vE%2N%l$gr$J2}KeJ7qr@%K7X(X%!$eKq&@`MSOT-F%l<6Ft&UGM*^{HuO={QUb7p8t3K`QMH6f498%2hY8~d^JD%>SWyb zuk1f<^U+uJeiQH0bN|P3{~c(5AEM{}KEx-_P5Q-GKR<8lzz2(xzbD_H;r&P4U($%3 zY4gc--%0#E{)$9C*WNqx0P6?+yFbo3ALHkyQudxyp8w%Kj7scbc20}u748FC{^iQ# z?`PTjT3-5(#E*XSC`P%em-RU#`oRnOoEaSz=ll-#JbmWm5A$LkoL%dz(&oquUEFTKb*N8|79wqEq#FI{8znUnWLWSCw5U5Kn`k7ts2 zd{yt7pUIz0dw*e;y+5X(Jx7tfqukTiB>w-pUOCS(?v(g*qs7_n=B<#u)Q)mrl|N&C zx56d|i?eef-h42zH^=g$&5xBzc2wlm7Md zzkd&B^1Jf>zRUEE_tyT)`fiktf&NQH^M}a4baXWHUIzav;+*#kYoB10bo8HoKV5m+ z`V;+=ewrGU8Ql`Eo3o;utUrD0q_DmG?seSGjHoMae`a*->q(sc#UJWT;=p_DEKUz| z{Pcd;8#!Ou?TxOvFvv&o{?q$Ze>!@R=brVK{E>-WmD9hi@p;g9-s$|)zsqBLeD5(n zPP|7X&Qp<}@Bf{8W$!nuJ1EoHVZJ@4Np}weUV0##hBz z?}1gE_1;pBVm!X`v`jqCWQ)6YBaU;n52k6+h#o~+MP@%*K6!R7x|{-X7FAAkIPKmPfv`TsO-Ue2%M zJ@;|S>-}o(^}GI8^G&Ohe&@N@^Z!=v{&?>D2L9P|Z`W5p_nz|qtY1F5XQJo%f7YIT zq7BivqLZTiNe94_qjOS|qYFrLQs3pbc)lAABZ>1#=a4Q)9Ua|3Qa&ejOf(`oCfbFx z8%dwXlWrhgkUBToBf22!O5HSx^qeRseMyv;o=dtedNke0=f%;s)Dk}bj=wkI z!z$`qg`G#D!=p#2`H|>I(wtN)pIiCd%IDVj^VW20w4HPgf4hK`mGLNVUVfDFkMj3N zqZ6XXqEkqxl1?YhNj(;g%XlmrO*$~+>FB4?)7W|%`P0<5O(BUVlBSW$vX15RambG&Kb~|Vd?NWNsVY)+)@i82m#5mZ=ci7}zB;ubx`lKrsgZOCX&HaNC-rQ`^3?g+ z52afB{W0}c^vBdN(wx*EQ-h+_sm$#5R8ICQ=)H-~#?*}LO{tFTw^D7{|B+go{Z494 z_PgYpQ#beDl4|V#9;qAIRz822`Y7{5+MJu-CuaaDk2Hj|f4V*A!1Rio!_sHw9+BQT zcQR>8dR@lU^p!bBrZ+_2hs)ukNyntia*rh)N2(wlPnna`Gjc1_)wwg$HMwV{TXWAQ zolm+b-JW}CdTnlPx+8aPdVTI?>CL(G(nI=RkArMJ{|C~aMStXPt?8crtI3}r{fYDxsXaYozzd`oNiUJskzOXfLh2yBN_vg-I_Zt{ z#RJ|<*A93qJ#WB&r0WK}oBlM~Oxi+vkMuriE9nE$hop~4ACo>I{f*Q^`jqq;>2uOH z(st4pq`#ATNneuwLHZ{tqGzT^X;KC$laxj3N6IGUka9`=NdriEq=BSCq`{;iq@ko? zq~WA|QUPfMX(!Uoq>-duNM9orl6EESM%tY;iZq(E2Wd}I5os^d7}7UL-y{{2_9cCb zv>$0KX&kA9G(O|D)cB0KsT1H6Nhguc%GjGUCv|bg{?WA=hmq!_uFW`vd;@82>N;fC zA-fLQb;zzm_G`*5AT1>QhID<#k)%1P>oblf-$0t1YCwJi=_b;mjI&4^NOM!S@cGt^ z!%5#I9Z8y#YD9J$>2}g$WQ&n4#@1rWET+tojA79dWJ@wGB;P=qoBCbGWzp}D{VwAY z@(rZ9sXHip2eLaTdk3;RkToG|Le_+=30V`eJE`Yx1BvSwt>$eNKgBWp&s9NBVY%aJWdwj9~L$nHgU zFS2`)-HYr#WcMMv57~Xl?nAZ$*$QMUkgY(r0@*73euT7|^e58uq;}E^q!&pqk=Byd zkzOHnkUk`RMEaQY3F&X79@3|z&q$w>wvo1zz99Xb)Jw|9q<@pLNI9hbqyeO&%ni|A znH@v+%KTC0-kF_4CLo(k`Y!2vq$#AMNJo>7Asw4}A!!3?Zt6rnpF}#DbPDMQq)O81 zq@R&4Bwa+hm^6=c1?g(iZ%EgZ8b~*gZYJGAx{Y)@>9?fCq$Q-^k?tThk?thjMOsF> zhxB_=GwD9k3erl_{iFv;e;_?XY9&2NdW`fq=?T)GNKca5NKcWTCOt=bp43iyf%GEj z6;cQ3RnlvuKa<`dy-9k9^e$;LX$$E+()*-t(pJ(3q>o6Ska|d;kv=DFBSl$^JESxz zo0LP!CG{r_B<)NZN!o?MwA*3r>qcryGw{x*d)m2@QOXwosHX{70-T&|S& zJ68JzQ8d&zi+p4tA8p*9e4OzR@(IQx$R`Cn)%a`V(*r&^;F$r>3V3$Fa{`_p@KpgX z40wt0DDq{-De{#8KWn@<`KCawtzwUZ9@B8vmhsXHwA&Fy>r7q(Z-G1COyVZKhkMh9 zAkSrK>Sd=JD-IvSix3rily|c`A(Dcx2WD6zJp=>2kyPhFn(-ZI=T=Z$M(B?mY-u_`F6Fj zY%VaCO_!@JH<;Z0S6TN>d@tWCxz%(IIzQn>nSFJQrg5rQ@!XD|isuZtf;8%xbo7bI zSGOc_mX74|`6?@`DwX#Dw)csCDR zhmPW}vSP*jC&qp(Bv(w%HMwFU9o=eC-1HS(anA6>XR+dQiOF>=<{9UGmb6zoI*!uO zvGcNG*ZCNqFJOP~N_50i-b&&i{@ouEJK{Hy&%mDelZ8n?5kJ?#b4XV9O7=w;84rIh z=?~I*Kd|43J}R-DP22d557X~p@APit5BYsYuWRNleLUg!2{%&SYofIDS7)bLGXjWc&}~FVA8BpSVi?6z_M{R;4&i ze{gJPuv3`p-|L zlgSvscQh}9=VS8$_Epuly950q*yGj{$a@3%Rg^t|Mrqu@mFSIqxQ9e8KJw4(D;qDM zPd;F*j`WD}UhosfZ!l1-F>ZlhGTwH06uoA=4(3#i?Z19{6zOZ>s%r(TpTZPR=iO(Y z7_Vk<)wwJAGk@YhFgA!gPD-&JPk4P*igh<}$WF$DX)vd2JU-k2FETl$xr&dX-iBmM zUX{}~hHNqJL4QJSBG;HU)%fqSX-s#IW*VnC4!QmN^b7f$_d~JwF|qeOvG=!yR#v_( zF_!%&0(mEY+|dVMKc=hD+c94Zh@yQ7_@Vf7GW;;#WB)!p6ZY|0@;g`ZPGZw3xrX=p z8fy%k0rz0P_Mv3_6sxSpC2c#qTpR8<`1@BxF}puH zmldn@Qr_QUI&M>Pjq~e~yUv^NROGI+GT_mHKTIteCgqQ4-;NzcBC&m(nmEaq>jI3@Y@CG zh~I?Iw6eL}|Gn5)zFh|A1!d=0U9#gW`_5OO?|dCxgnjQPV(%v!?_4f+c}XA_yL<`l z7ppGC|4rt>N3p*MM-FCgdJ^_HJZEz6^RBZl&|eRiV&CUw@!A*D@i|fkKU1H~M`HI= zIywgjFm{&1er}3=9Wou?&OL?qYoH@PA9(;f_%8nCYsvB50B>QDwFf#(2|MhIy}gxz zT0y538?H9}MaHf#x%8JIuL*R- zt|N9G`4Gm+{ZXvM>L+3!8^yjZ8p$6IV;%B+#_27@MDxY5@NBs9LcZG!Z$ihJmToUOM`N>1dv6H68b%-t;xTxetFfea$R-KkfuSVLJQ34gU+9N1MLpuM=U732N85u=>N#nE2+xLy>=*dF@uXF|d;|{d-ME z@q8U_3UpLfHs41sn>uH|Fn-ed-ge|Y4Ja~q`FX^rXgmG#*YwqIB2RIWzkg6FIvAE* z^OWR1k7z8)MMpm99Bjr1KQF|7+*<;<*yXJzKL?v)m$wCSvCG>{uJydw*w1~9Z@zBtLGI%~ChTQ<1J?#X%#I7TDo$^3O>^frCsR(q$t|NAx%0Nf#I%3zU3UtJ-BX*tYKu7F4V%Mn& zbi}SBcAeTlN9;Oc*QpD1#I7TD9gTrJk*ub&=88_ka9j(1>(0bbL=Z@I> zWJ4eqyS$OIt}k|ZQy>?+ydjW_U0xr^#V&6Q>J_`ZDUgd@-WQ`c|&3v7&zHvS_HP8AQLwqgk$@$1Nx4K+B#pY=7(=9yfi;mjsW6`)k zzYF<0_^CC9cskExY2Fe0{38Ay&mG0{5iC0?Cfc4rr`zR}?S=gsFq7lt>(4xRIPWVM zXJvhzlaJi>3j_TkxZl>qpLL9n$1UeQ2aN5KpTK(QbnFzvK0o@JL2Cf{9Qz5EpyPd8 z>~RqLu`4yX#_-V`m-@3((O)nm{@NS-ehw^~v7bYus0@8?mvp*5teMgA zc-Fw~r_M*kO~+Av?;jVXqB8Ww7xTSM@iOdao}DT=eL}H1+W5{p($R6Sk7=h#PT6}V zCuJp9KfDmR+Op=OWN%Qcy~N9q=LK@H@0C4EUAwkN(F}Z(9qpgIjDCY1NA=H^fOTH` zanw2JTpzH`WtTSxtaI7rjR7|WT#Ik6QwRIGAohMM_BFiXued!uoEQ>kl~rHbU@_d4 z1xW+?7jmrjGydKsToW2MA^(K7H=^TZn~aY^M`Oa)TUbK}d`7@$!I}$xawFG6uHJ2vJP1Zw*=g3^}c}I`LA%B$-gxDn~Xm>1B32Re~EORm_epGfZ91$+FvVei{Lu=j20_;J~SoxRxf z{t-Ti-?)V_5Kf^p=tiE!g?nMQnaRZKW5_yUc>Rx(eT-*eU8mfGejYj=t9)3;I)@k+ z!dhp3icV2rXEbG{lQ|-hdtK7;ef45kal=e}FT-_8kb7IiF4wqG&N!_7G4bwX)F)3gdGYSV0WQUk#+-}bGI-a|c$V7uGRC)?VD0<)zO>l)rN!=p?CBc09Qg!voHeg$U9=T>CHgP(+r@)+O1PmSiiW}J4~rStM!;;b#m9FPT!p@$cRub- zLGFB1z^Lw!R|N8t13oq2GvG=1Df{ufkDuC4INx-{7X^G7tn>7mQ~5qI?ANo}vr^mD z#udoLPp;sd!?5-oWM6eTtF8$qe;m2mu06VE;OY3IdjT)P+NVB^J$CJ?o9v0AFX@OGFI8y z#)t3@O|5&S)3v>iPiG(F64TN7=sf$g^bY;YA4^AdrjyCS>00BE|`euMSZ^QN=zqIA?@tg`Ek zzqIw3?Bt%D?4O7)Cx-8tj@tF1@kYMmCb{~v+Z4;@u#t&etiCtYr6+->n@WkR`;1)bv+EL?ATk=QM>WC_|BZO zj^isPKZxsGtwl9g>U{4-z7Y2Hy!_YoyT@TSz5}GOPV)9&CF7p>Wqgxd_3ll*Vqe1y z+9i?igb$L}avb}8k&eEFT)dg}x#leKQ{1>Y0Qqc=quPSGs1CWWTcqS zj@B&|CigYW82Y)!v?_F^@8g^FwXQqE^!=WodGJ2-&12Gt&V97|Ddb|Uh1MH)ApZ}z3AudJ`B*C7rYHBfbzH>58Q_{t zXMb37pF1|-r{=q3kgtSgrvh$8=egXB=qGTymDO<<>$~<>n|#rQ+*3CF?TkM+!?M$_ zARXOi@^@-DFHHZ<-J@tZ++jB5v+BBxeeB1OcLsHdRo6!*_qrt4_eDNMuDTAOt}kHO z`Ix%;F%e7WW2;N@66WFpI~SNd zw6mFg`%6r|ZO^3bJwaKq$~K}S_OfEVvtbEx`SX4Jx!ZK^3;fy6dbI_4ui1PC?tnF? zD9*BT-@!?}io+b@{31G;Tqk-Q#PXrno6W`kHi{V1{x2@ zkD?K98FJO7^K=z<@*YY@-$owW+?F9LhgAPeYKZncB zrpA*B*vD%r5d!|~OY3|c~OzHgK3SwpURrU|CuU#KC`PZN0 zKCTf}Dqv`*n)s8cW9` zmv26Ih<#s0e6-#FRb6}I&td3`2g6h0HvBp3O!g39wIwP`MW@2s(NRpQ0{$tylDM2X zBZ-f69%anG61mpxr?8f|0nSBd>C>sG6JEwV_%7$sTPEMey5(JykD*2tw~w=eD!f$Y>i6lmHk{;Ww&+pm2JVF;mCEpc`^DkqJ%peqL}6L z!B6m80akW(eV-2qcTHzxOd#n)NP*WuPOuDfR-lRuxEzUq>ndyGot zW34SNFE+UzepB03_H8Sx_@BTrVp$l+T>VqmO46x&BWbUAtLcj~+ml#{$8o-d@jQ^a zbnL=D|4MmcU&ps@PMU9|B=!&8tIwb1n-e=~ui`%$J7e(ewvjxaX1pK!bvlp6kzRZ% ziBBDU*vAveM{vEo02`9O1M3=7T(u|rGT5m#eT@my_v59uTs`7n`%f+Uk}oj1^xt96 zK|V-+=plXn-)=gR-()QR?=k;%?&!SuH8$tN9&_;(Jd8IZO5|#bo)^-%F_|^+?dVU( z&RE8--@{9gds(rU6?@r}(ckI3zVYqHTw}ISR`R1*OK98^zt1|v$3TrOk62y%J;}RT zobg9vT?29RYi(VV-bq_NL`TPKKJEPsUWv^c&!HoYX1y20S!>s7{NEk9_A&JAN-->( ze$B43oo!Jx9(fUCh#%8cDeP7!&+Rm!{}R_{KSW2YG5^QL2XUX|Jh(ZiSN3H`>)saF zuUq9q)^e`V&|j45t4pkVuPw-RZLa(EPr_B``<|*_k8eUg6Q5@9@mz?~sc%U)&dPtFh*bb}Q@iLPt7OOzp11J<(_hKB z;q&!at|gx{`2faekJ}scy;qTE^8AF>mT$xJv8jEMFJblJQ9K)&Q3P`=rXQM)1{)tr zS?zsEC*D&+E;~Ao8beYUtYJo`qA|!d7s&qpaGvStIEtTSF4NjYymS=j16*w}lpT#5 zlY{Y4?eeku(p&rZA^MohUm+%9)%zaz5NA-AcqnZb%clB+>(9TxZ;ZX>i)0)t3fiLc zw1f8QUWVGckl%B;2|tSiof2cUOYHry6#gb_n3vHP-_|c3ZGg)HeX;A82dsKWvoDmQ z{T0Z)A6CNN5369sT=i<7-_J+M-KN<4w%FG^DGI6V71*y1?1=RnLCZ|8_jTQCd>-q~ z2jH6E7)k$=gG?USse!%!i@pDgrw-sfb+Q9{|F4C;E#kF#^iOoeK2OyJI^xn?jvYE; z*QpP5#I7T**)xhhM87`pzah{Ud%a@U*B*=RmH&gXqlufY>j&?hJO`y`bhZCHmGMnH z0=dSzl6$z<8SrShF{rBv_I;0LSm%hww0tCZFG*hJrMgnj+sthrb${U>eBqy2xad9?rE64;jynzQ^|xRkMC z2IW-t3(kv|%+531XL0#`ixc_Blr6FQ3-V#{P09TTvDPOVA65~!xKCy!b;V?-YkU*AiQF#Jbn1<06}W-gO3LyMnUaupckQ?VJfotYk;yjO_TDq37$w1Rbp( z{uyx2K7I1x0q+{{n1Bxm_&Whlh1U@`*;if8I#)Au5!;N9@t~6nCE|`te)ZjJ356XmyXzvk=Vy5v0sac{n!=39>ZeTV_pJ#S+SRupBlHP zjNzJ#IP2a}6|6Ono?FoKFgj;vbFFtFa`Dn->F83p)ap`S5|=V&-fr?^SS#utpX9r< z;JE~)LOPWDCi!^AM#*PkGpnTUIhlpWB&@ome;+ob^Xsy7^q_I!oa8wi$%~Esc|ZA6 zhJ9auihbRvy+?gtM*F~$YrJ|Fo8|DC)cX&(0#?1UBYExFT)TZEk?+G^_inJBGaPB- zgZg9+=kK?WZ=uZK1%2oEp*$}%1DWIpaxLI|9%GL4d#5IIt8_X);rl^m=Zy7zI_EK` zyMAqJa$ZaS_~m`_(7mGdLm5&L*sZ#p_h8jNK}>~-n9@IC6rK))$q#aUzT%y0Hx7u-6U`5hha z=PiN0#*NLadFs#?KOKzEy8rt+@>cXcCT+0CMAy!K-6Z}xdy=z@sR#D`jTHTPDwCd$ zOS{?8^VJ=J9nDAHA3BkHtiuAMRZIo}_=zAN*ZodbXeH|mkY6#=}E&H;RrHvj3ap^Nj-xHtBUYyP&@srF!io;Op z+kJ%Iz@~iD*f`-^$r!GCTRM)Jx#%-T==mRUH`lPIp`+)h{T`6y)ej`sWn+lH#~}~7 z`kr2pA5sc04Q zag2!`lP$DM*9DIw*Rk+tKje@1?Mbq4t|h50V;RKjU~lhKVt&cJ>?@98t&7~pF|o%}>|@t- z^grWTX)E?CiKBG%OpEMS&*fgT$$jjSj;~#%|DP&D62VC-wA3PmyDU3-w)cKwgj=N2)M=UYwi>K zbAV#EFZO2w#r_;%A?z`nj{)(}131^S&< zd)yR5_d#;+tDUePUzPRoS?tg9sjT)}hG0|r-k)X1eeN=rZ`}dQx0AQ?ow5@4E0C++ z`{7<#^*#q@QpWFfiZur6Sw!i0T^bM7x3%Vx9q(g>u(wO>eW@2c@6X(xjK(eFUFiq1 zjzTAliT9auj+yuQyucr^`_pJX=>D?o`1e_~-rH;EV&Ez`1s&^~;%lNFA{0&|S`&25ZB9?DDcBO%i#`e$dNY+T=Guo5+t1Qr$O_kMnRUXJ?$K@5qG&M@`f5-d> z_bd)(O^Do&ow%6euJKk}0;>;;6`xt?SHj*`7xA~FPoY1U++(8e=J*;_^Ib<3*LvuP zFFKk%J-7-xek`hC_kpEtwCE-F2&E5e4t<>X)dc#r0oTFam+FmmT_d^MY=FI=_&Q40 zViT}`@SVILb$oJNa3gEok;c6*^E`?1M(#D71p9ZRPKRaF`>oioM;c+pN^6xS*kjcU z`}rmI{w$yUJd(c0P;wtvTVO9M_Oh+8$58tIEJqvcW!p{1*G1ZA&^3Msa<|!OI)oz< zE1rsBmvQ_YHSF>1hP~}#kL?`Jue(xQb8(z|kjppK+iNWQne>ev=Q!-~Dd8CVSdow1 z+f@krcv4OIkmW=Cj3PST2Z~|0Ujn=RQrKf6_L!H!-Y&7XOYAnqethMd+Y!5+a#;0h zT&;jrug29%*xOPCd(6dt9QDkw+fiBX1FF~iQZ?*t5xb7!Bl~l|&AD%^IIFDJ>vCP! z?2t3I*O-p?4Xv3MVMlTHvbBLu9mmn*zYZPUzsM`)TnlvSVUK?U>^?Wb3mLx-MPICY z8Als0MSddOgk1H?pJsR_xm zfta}M@pGv0JMd`Z9=IM~ zL;G@f3fb@5BW|a_qHnzps^Z*L*`9z(Im zQ0y`Ewm*Q)BI#RST@G-pJVxODDK7NX2Q`aLZ+tZP}n?>xg68m*Z%;?~5 zY(Lc5Xk}&7=Y>@kPxnX9G_IVOl=bhVNZd#eb zJB%o*Hda5>IFQBl%afGd!r#hh`|;#8rlVsj)-zG>qEl;ftv$qkO(gbfBGs#Pwcg>N znCKqOPs?C*^gSRwJMGWV`g7FMnS;(U#trd2SkLQe9KRb#F85^S;>69oh80A$I+iKws?oI!E*!v|oHTIWBk6fAkKJb=0Bn z%`HK`1lBrA?n~fuEwk5}n(*Pci6wJjccOARmrINAFzt?c`)H zLOSl}I&?Iij6z?m_I@3f{wGa5_Xw|ouje}MNR!|HbM7&jTxCyypFn3A*FIVstE}4> zFQ;DlDZY&BvRd@FSiL{DveLiG0c(Q)5oKHsFWd|q^B zqTg=uk&f7pV<+s_r(LF_^;mbn(vd&9-t2+B?8nsQ?dnDDbA-+peMg{bN^eV?o4IQ1Q_i~@B5|+=B&w#!EUj$2kAv*rO1KGb!`ZgEqIMUQ;@Z)?p4Y~M{efcd6 z<0r7W$oT%kRJ7RmbNFuKWgn!XdyOAwZ}uVMMcaArlks4_8}e+xYmN8(Ip;{ge>MIt z`tQOUh)EiM{svFSx5KGd*VmF?&U$GE{%?W@zLWG-@#8o5aXYLwO1_HsU#UNf*T9m? zrmr8iAb)-Zw$Kqja&I4B-jZA=N?*@w^_oB3{AP*tB|mUxvhN|@8y>`oI%ZJce68=U zDE^u|B=>V!a_^HWd;B@+Xg|tM2+E3GUu}OJof+o;uZT|>`rDBoXmOJrjWh1s4A|S- zG=g&<{n+PUByCJ(_r*}`F%)|Y#U4Yk$1oT67>YfHVvnKNV>k=n=Fn$O#Rs+B*E3>2 zcf|gljggd9+~ohzfF}_Xm&+e<6*g6u_-uHzF_#6=RP^;dnx7$`VDd{~$#tI2hbNi* zDp-D=yN+iAjIYAy+hFI+r>0`>as|-^v2tq~mpoy{=epb#2N`j?2N=kzD8aVa9%r zPsaz3$y9X2N28-y`TaPt;-fjeJn%vKRh7v-JMmuFSAUR>&)t$g@GjqxWNev9UB}X1 z?X!us*44fE3iRCvvEr<2C9z*4hPA`a;LI8arNZ4ea&S26d@jKeRSV?*7EFB0ljRCi2jq8szG? z(%Ii)C_CEoT!;_OHwJuLz`qOl?tq&EegKyL-bS&D+-=ozC78Yc26xze=%(p70rr6_>(|fuCYOXT^Tpn*$xO>xf-P$HL>LYXm(f z^Ly-<1m}oztI69M($SN!^jp|J*Lf|S7jI^LVmdioW4-~GB7f(8p4~M0J3N=7I7qH~ zWwRB34*Un#B&KsL>j(ZE%WuCeioQhNhRzM>3_m7em#f}v*7?$JN2eW~QRs+Wrvt7+ zzAtjI%NaUjANEJyiTt;-`28$ca<|!q+}k4gl_&5XKXfGbIBsS@{7>F6?x{MKKo+#N9_JonjQI{hur;_-2KcC>`3l*BzHSiW=H-P z26l=99kI7p`ra-cTi+4G;-G8^?8jQ{b&1`M%DSHu;2%GnjE$1JpEYK`8{bNUvXb|5 zEP74u_G?XFZ7D)(eV{6^Bf0m1>cEcJ?TFn@4XpD>*F=(g%p1(U;!um+;~@EtwjlTR z*1>MS1fBF>*!w0v;`KS)?}ML(XRzkK+~nJCNzTpb^x>9sljjYpVfmx|J(V5O!h0Ce z*S&+`H}SiLa6NUo&yDDa70-si&qmnWSZg-5PH3{SHI$Q%j}@}x@t54&IZ|@sl!!?oKHQJ1w`41#xm$+*c-)BEMk^7jYvPVu!p2`u-YsCrN0Z4M)vf?rpC`vu;d42=vUzqxgQtVxg2@1>5C5tcoN(i z*w;DryA?@$#e1YP;ZQ7T0Donf{)P``|(}Im{9m(ay{6NeeVw) zu=iEz`>{|QikWu~IF|JQZLHyYD_T>j>>oc)`cexzUa#0~ie0BQ&=I?DV)v~x@Mn(s zqd8P^Ki|cnP4~0Q^ff+oi}868YkRTpQHy<#x+l;PyN=j(HV~`#F5)`{w7nO(ucc8XxF!Qyua1Ue+t0l?D3c0c$T& z&%pc!ecAWx3)#^+=XtZ^{#UB3#YgOI7kk^Q0v)mIh+U^zI6#74Bzv7?9vXjLo`yA@qC*nOD#(LiG zpNwge`xsb(eUC{I?AKgkzt5t&^j=e)r`7Z!zZcwKzUls5qp^;)*w>j&u(wzGf4!RT z|Kg8yyuH%#>!W7a&o$}PG2uLiehR}U+OsPyfljN~j+fYvh1idU;yJc76-_!Jsn?J7 zB5dk87QM%~4Sko3-T!vj{TI8R9kBZ;`}!`)wb&nOel{Cx&;Neo*<3q326w8g`7Cyy z#qM)gU|(&Qoq;DN_Vo@K*%^oYc;1Dg_mecD@7FKgD(mMs?Di#h`#sX3f2!~4dx#$A z-k_}5%Zj~hCVkrba~|yR$%p+Kyb$(#f0Fz8EBTH-2D=Z6;lcN(<33-E-0hdZZeRBu zyziB&thG_>eu~}CvOq`dI%3x;myX3j$KB&l5y&fHmy5k`RKYuZgS~G^$NN$>?DlJ5 zwpjmX^x+3`6& zkC^N@Ptox{rsK8OAimp3KWs+sKIpo*hxJwJ6y|Zs?HGyO2eJDwlDaxrd(f4m(eUQi z*@vO*RrogXg;X>aZbjdpmy^z{^Z1QO14 z7QSguL;DGS?_P7LaScP15X@5q~ zcz@$>>8Kf@u01|^U7GyQue~@ ztS+@h{51PriktXh_9aHZ8{oLTKj_n^npmfkaa%g_|AcCu2}frZb;%#u>@Q}V~ z@tsz5x&lAD1MY$U#zO2^bi{tH$xh|X$v%MOetz}B-nVB{uih=Gx+M2=O=bP}gT&tF z#r|x(%AWcM_Hw9K{7@}>GS-%g)vS}@Efy<{tI|;$>r6jmWD+aMpQY?I$Yp;$bG_cb zlsUBTe9VJ)_>4`x&uW$Iz`FO{YApND!Sk)IwZ@+u&NKg}qwfnyKOdVObFtcZ34zdY z$>SdDHgv?BY0H5v&4)57MHHocwC@g%TtL_Clf?rZkvuSx94W;w^s^*cCs#3$3P z-QM80*w7dMoUvu1@r(6b+rwih`=_GWS}iyxy8ABFxbi&X_I`DoSy zr@*tnBERc;#vIc*tt^?#q`wRIeOx}7^}Oa*wd=IU`Cb7moh`NeZVP4SU{mA6xv+dI zz|IBmRaRFmybykjXF`5%`~&*QRbuoj8j`xidr@|Q$-DlZif%Gq%-EuOrL%l~N9Sl92hfn4>vyiRQEK(WS|>Fhs^cq7p)U2+S^S@#6`6P% zYhC32TwkN<$hRig&x>Z*&x=j8Mf1)blpVv`uZ8`n<;HK{p6~?ZO{{IUnti{P(YdMT zyFN3y?^nnNpD*0zo->FWF`s!O-?24TU6bGx{p!w@$upK3m-hP>;~R4Eqv!J6u<;1w znnRzpexzGRZHgblX znE&}`5@(Iudvd=?&%H>ea#>P#9PxQ%XV#Y3-;Vre&$16cHR0XblkrnJTHkh~qdj3? zr-?nDVt+nU?D1^TakM@o_WmID{;+{#QT}V5$7cOIlyzf&)(>Sfxn59N>nCmS6BjdY zA{V#u4A_t1cKB1qjY~}4f{w-w>5O1vkxjAe{K|C1+Usz+_P515ea_rL5M@(3%S}Iv zcNafud_HscYUB2UxOWD3qVKu@|TabP67aghiJBhOI&*)0Nk-qUY^i|iF%wLmX+0ix8G?V-J(uI!NqA^gc z=QB??9rbgq8)awfWjsr1oM!x#Ty?4JwWhx(`=YlR-%XsKf_05^J@-HrXTN5A7x@Ir z?|o;ok6MIp{yx%0$aiPIx)&X>_NH>qU=NeJykF_u)bBm%`9}36-)E4%?#Y&-ul_9G zj)JvU^8pj!1tu5k{kMy-qkZq|kS~Na&fEZNzvb~CCi^Wt)<#5;cp}d{=)D2r%h^AF z7Jczn%D!y;%Rv-wfrxZJWyd>YTPlepCeRh}@FzbShxQ@M!FdM{(_=7>Ye6(sw&zw^IpwS@F+S z^L#aS#9mgu{qil|onrp$`>JY-KbxUrIw6a;vG%(S`E2Hkk}r~dD)C{k<{hzOtNBPg zl>1gLKZ4_eiCA9oP_i%N`qI(3;Wjm%=y_~Co1t;Q*RECg?Dvwys;h=_V!z)c_VrSA zpf7fPvFnRnzb4QZyS~`<#jam#I$Ar`8Ef5AAIKX5d1D}N3gpd!yam?U{u5#%`(Br9 zI?Il;$~w=aZuP5Ef6ST%)^j)-LuQ%08u=#r_HOs_T|#&nao+RA2 z2iZc|9`>59v$7-EYq|;k82KA7@-8iSJN(J?Wc{GBilO?C&bMpM<9tBpWc)ej*VGS7 z$H%=~bi9uZg`c6n{Q;debi9poxCVEd?PgywmyYB*79%NJG&>!AKv~T}zOIv8=e4fO zW-C4uY1>a2ACMO;U~Nr2<||g%*#)`yh)uj}-FTOC_>K}Rn?8nLg^qsbcO3Gm*zveY zuC-99mG$dcjTO3=It_V;`KY@DV^|h&dB7C`%Lgx88OW;wt_k{&>hk!j zUCy%OTpg5M#IfAS8h-9s%xSQE({Wk#6~2pgsje|sWhXknK)(h%9#66RDfYU=Zd3OV zbxvvQtu?v&Qk`);9>RXks?Y0Q?SQj6R*dJeqwloVo4)ue{Q3UwV4KD4%U@BlbC0>~n6DbZFzJ*b%Sb-mAtx-E%+k5Pr|7nswa(#(CD3$H06Y zWk;;Erqy@+b^lR1CtS~%h)!EZpN`hC+KW2_d9&4pC}uw{Eyz9ot+204+hAYkv|Cvn zJL$`39lH)=*;HL0u!hk+%FaMvIzx!VOZXu6^GNLHi`e^*SU%`I`CYL4&<)E^Jp(NE zb+YaiN?*?~_XPT4UysSA_f^GBZ9n`R?h7FIV&hj~Zw$=5AbJ;7fbMQ}a zzLizXpT(AJ9(-OR_hVX!jvvP&*kkDW+7l=?JMu?z`JihS#ix;LAGJ$!-yyu$OLL#r z0P_|kbD!qHOIRCd9xRa^U&F&5L&-gcrB;{r*vpJ3pHF|Ly}n)&dmP5#gT4b>kB(UT z&kNylD=VKjAlKgb!^k)BS=YR4jTICA992l)d=tBGV)xC@L7jK{ohsKCyS~`3F-uHRwNL^5d|h{wevx`z32>+4)X0-zP$+4j(+Wx-QmUjh zjc=?;IKPN@UBcr69gV$9xdvC;o3P_!h}dJ*EH*#IUa#2eZGpY4*vqyC+y?vDCHA#M zHSA-4d!W++%Z~bhr+Z4OaJn2~6R8}!*$LD_B6hp~% zu4$f{h5Ustk~u>BXIRIj3>`o2dglKk_QB-yY~rRpD1BGA93Agt6{fGgR2gtpz}mYw zYY6Ag#gq%=H38QetBrMmyguLt*zdVF2Kr*}8)C&Ieg_WhF_F*yELjum^KUck$FxOk z{aNgNK)%4}3*yGS<^7xzzxC8d%C4E0nJ7F)|6>xXJJpuQ^-Y)$Hp0_Ixb~}=L zyJX+*N8}?{*$*$J?^#*(0kP}L2iGqO^os+1vFpoE*Dne5O9Oqe>#HrUUl!<>2l`^y z&x2jRBG9i4^u?}U1$)00`?mjBN3%~|z2m(p*Yt4*%sTNAMCE4KPxSS@lL z7rlF@4)$|U?B|_y+-LdYW$S~o4MAD4mz9o}mH%G0F(}&3CVS*UL5sWm|%> zVlOKlFPjH@*;d%w+Xj1k#a>oAUbc;MMrHL3YCCepR`KjGj@Rv0_7ilgV80im_xSmJ ziq4>HS5Q{0dR4ZDHJip>J;$rP8lBe@FJlcuzdwUHNb|Vl&)>)%9r8(xZ@+(n{Ym4c zteM4HPnK*=$LqPbTw?$0rYV zn_`biKJ5C1fqqe-Um5r;xtEpP{SmuAV)v&iC@Xe-vFnRnzdFztyS~`<#jaly=!;!n z?D}HYuMPCYt}k|dvFq0b`eN4?yS~`|_V%IMV{4Wpu*V@JVkJ$aMgngW;3b;Dp8ra7xv5#Z5rlYdeiP&>;s+PNhrx5;qu${iBk&^lBKQ<|7JLiOmPkGy&M#m; z3SI(Ff@Nnm{G0qlelpy{^AggL50%JOR(vF5tav6oZ1;q(3gj)c(SI9gHrI7(uhx^T z$lZUjV*BIKtczj)eTViyM=YIY>gq7Lt|=tnZEO_1j9k1A{65@iI+|a)VE;`Jwin}h zLGSqOM()2uA@<*==z-k_vHz|_FYLeLkjWlIX>Rg65qSaU!>%)q_D<)1-wcjvp>#OD zddGVa>~oXk{=WBOSbb>?ouC9(d^AsqwP*Mia_MLe-3nLH7TrtIJ9{@UA8CH=WRdc-`K~yVt}YeTO{=+9f`M^Gm-wEWUwf!(88ECAq)v zPFy&R`INFXu=^nPdc{S@C-sWm2k~!C>yx`bl3((1@-9BH`zChZ#IIEF4g#y!{gmAO z6uX~df4`sDeb&49d@dII*eLd~QS4)5ChJw#7rVaL^~J7VYyPO8v=etf9}CfOJ7TvZ zb~|FXvy3&8mn{j(ioLAZ%Zj~hMW8QseX;9{UB3>W{WyyKIEwxKUE-e{#c$Wquf(^W zlJqgLj*;G#E%sv}?m8w}msSS;)Fbz`M+59@l}6a-8nMqcO@V%Mpx+Yci(S7p&~FR$ z+XH>E>vshDoq>K=pf7fPwZ-Ep_IQdto*LWzHyJgL^nQ^1epw+WmLF5Sn@eMkuBp4R z?{k^h*Y-WIUptHa+F9(^&icNj+w4W|`^lN?%lmaf9_;q>19@Q}FM@pz75n&B9O#z> z`lW%s*!A^1z~ft!=K;ie2Zf$zE2oTyl@O*kdmCm}~EA z{N1dn7c!OxbyWp*RR?wHJC9zM}W4*A$FwW^@_b-vDaG@)KweQRTtD%$^Mns zCArrnx!V`JeX-lG59~Jt_8SBHRe^oU-M-{*U+nh9Zoet8-yGO)3G9pAW^16|7U;JJ z`eN7b2=qGx{jNY??D{>NBkD`K-t0!MzOAuT-*NL8ioIQ8Z9|d?+Z4Oa%w78Wa31V^I3M;t+!^>OxwlJlw=Z`4Vz*z2zPGnGup{=eVlON9 zvPG2j^Q#zk-%4Qjtt^Ox~)o)?|zmCTw$!(7NYMqD+8UX zfU5(pfqnh9lCm#U^X`;k&{}H>s*!9J(-w^1FU0>|_V%HzZ{SqI;#nrR9A9@SVx1ysxH|;Yw z;J@Ody$k7RE>KLwf4GP79sNdhJPu8;$DtYaIJ98X+akHgL~{32?0$;f&z8V`Yhb@E zu-_Kgm)z}3?)JrQU+nhV(f58O_Wsa{j?4AkwE5OM`SS{%TSl($8a&8%C3Fod{`9eA&uS=r?4X~dM zbXH%JypKqHRec{nY~Ra}{Clq_WxI&Ulk7*y2k~9(r~MK;-4?g_deB(DN$#-t5 zJ|FfzFZO=85c|(?pR|gyPryGtlxscX4KJmlOX0%6W>H|XIIt;pn^7?c{pvu!CeW`7{E^(tO78xM-5;_0QybW? z3+&ei_FDq`lDmD$-M-lEi`{;TW32P*%G>F0$o<+xyqar}_h%+@zXp+f*^k(3HhsSy zX`o(zep~F%Z#TkzE=%suayP*~<}|}zuh^eY7W?zbOE|COXZpA7p&*}qbaG83_UD$> zxA)z`Z*ZH=L5HxXW9-i_wV>~PqZO79TK}}cKAyM3-nTno@7t>D)nobI6gDOII7{x& zNO!_MhDh$uQFpe+-I?u6?<8+m+hgf$5ZUj8;ifj zG1W8YV#P;o5&QGWy|C9+giZO7v6%H6a<5nH^@_dTa`qNIo|%PxK8XE!X|ektb|1v< zLmuqcIQg*0p)ima1za3((eS?hmIwQH9|{95F`IOkNc_D^7^i4sDeQ3*`*Ut$e{N0e z&$fyE`8RP!IrHV&i5-6yPIB#~^jnfVQ>Qsg_g^GGbV2g`n|v5o%)58d5q}%j9;0+# z=2#6wUIzR5BDwc%vG?umHg}IjUvl-;iN^j6p6u)Q7rd@}VAWNQ-1~n8?ESwI_Ws{U z483ni?)_hK?;B$88)EMpy+PTkpswnmu9~1OvD;T!w=Z`4Vz)n&wx9TyJibEQ22 zwaedQOgD|WZaMExzk_`-#<7;hMafG6??s9fqr?QUlHhwUB5EWuL|_5 z1AVdU*97{tfqq?}FLwQU*xM!cc8UF5Xn;Mojj+eI3HI2E-DWLu^L>eC#KRaOevoWwQx%(`+*CqD4#9mjE zbnN;)OWt`FGHlor4>B2Or!U z_%C)lVz(o9J9>7aXk;q7ma^i^HR-4U9?g8Q$4y)o!&l+kNq^)%3!G0(Jcflq42yyo zial<{uVf^(iQP}J`zdxmb^WgQmb{D|?Fo2$ zHFxN|);yaN6-I}xRz4~^BF^`*&&Bq+#6FL=&!y3nSg*|FQ%qiN@@dgg@!!w1zgOGe z&$qwV*xzgI@AK^Mb@umqlP@s&&Gxy`KJT1L{4Go+{*Fo|{uHH>ddt(v-=|q#Vfjgx zS6V*9@+!;Ew7lB#8p|)Xyf&TKpO;SRtuy(Rme*UpAkO(FR{B`tFeqwFSH$sHoL)kn z5fx?J6@T6*V_BRRXWSd-Gcpptt1=S%XJ#brs?JF2JwM}tSg$7I;W)oIFtx1^rPaeq#u=LZI6%B#H@eBd5zh**zDAroq1-b z&g@)icIwT}f~=%JHe@CJ@#d_gKQ?A1{bq4i(r=owlK#0gE9p1QSxLWHk(KnDmaL@T zJe;L|lM}UOWjvvLbyiNCw`C2C^EFw+;=Da;r#N4mRT$?TS)=28eb(M_-kJ5yINz8x zHqN`U4vh27S%<`Vch+~}{G+V0IPb}t8t2=xj*j!*tmEQ5>UUC{XZHJHoagjAJ0JeCK`_#`!+|lH*d`FFAf=`z6P(q+fFUrr6)h?eEjUYzqD`LO7m9JPN~G{^F*EMI8(BFmRpzRdCm<2)zYIX5|ug}KRb9F?0K$D-Wi zIPR01oQK7^$@w)lH#xsba+C97eC{)G{qtix!=hI$|J3p?EuYXo@pH1}H(36lHum2dx4)}@Pn>V=|7G0XE%x{B{yEPnP9OCzi1VKQMdZVxPwns9`X3R?d;6ad z%X0@L^^dfCjO7z7pJe%T%V%0X+w%FAFSLA#84kacW*2|DesT5{A80?=C#N28F_ES zc~#!VI6pJ*^Ej{0OTQpLX2<&UbIa#jzR>bTmM^pXDa&8A{B6s(TK=WwSp$=PQ4r^> z8!ayyn4Ay$3{1|4;(^I|Fm_9YJHRwO&mBd_J69$ zr&(SR+aDGkZ=X+!>lqfE9Dg1b{m|r9_W4Kl`AqZceEVEupD%Vl2dO1TP;x$(4NA`EDT9*pxqOh?mlI7J)E?&*gOYjfq(R9%S2-w|=VlB_ z=DDgt$vk)Fp!Z_^>Oo07&L5P_a|_I$2J@%UJ} z&qD^Q{hV+1Ie)O?Ff1yt&pQuRJcdQP#-E2pV=O-~&Id&k2M^=;4~ohLPfGfM$;$^% zi{;Y>pB&4NH+kjYAIG16XrE^czAgSd(>_-XZi>sDIe2+2pJnp%2WwqEEV>~6JS>`P z@_BLjK~bIQUuE+8!4JoF77TtSw)3Esd(`r$EPuiDI|jcN>%D59*ALzlm+u_>Ni2WU z}syl}`LWBIPJd|0%X<@?5YPE<1F(fIEN zn*319CtH4$<;Pq8L(6|;`8k$fVEJ6je`)!(mfv9cZI<6@`Etu2jPp$1ysLH&iypPl ztK;@&Ms0CBhec1Bd`;ZmOx`l9b`FbPF!|acf8ujy)G?$jmcMH9^+TSH<()&;#PT;y zzH!KN@#jtUxob#!thaf{i?Mu*$-9TFjpZK=c{$E|hIGXFwjr;@dGC<*aUKo*bDU=m z?TquBp?@LIiPj8F&a3vJ$#}GO=oF4?4sWhX#-sH^lkq5Xc%qjxJkiS=p6Cr3p6KNd zPxN*ko{U?gOuxwV_c8rq(;pk_4~nJ?--sWBqVnMxFR9)cR<0^8Hz=weJ{CFW$M9do zf6vLcaUehOV@Q7DM}B_d$IkikgY{?rJ&C>ir{cWI%AINDs;%7lak)WJP5yInJs0PX zT&wc6`Rn3*UjF!XasByiaeig~*I(A>`uuruz94^7oHyi`ydwF{`FF>8V}4VF8}p~dc~|~TBzoaYs6kMkh~!#Y(izu>4i-?`xYI4>-?EzU<3yd3961>56%pMv~1rC(fdXq=BN zI5W;m3a*dy@deMtd1=9yaXzu&8-J00S;6EupHfg0=j8=2#QC&>{(sfqD+<0H=O-1M z6z7!%cf|ROg048PD)`z)>77|HEzYY8ejVrM7rYkdH3b7U>F*a892w`e1-Hieyn@H# zysqH&IKQ$WdP{os1(V}^K|xiVHxw+1^P3CS#Cc=E_BdZ$Fzi31-&Al>oG&f7CC-}* zUXAk=1;e`Z_m+Y~PKopOf<2Qg625iSnzI~cbT7?EpFWf>33D`qk_?K-cwK&=i3Tyiu2xrKgD@8Vtbrt zj@W0j^m9fe@y;9ZgZT515m(1~{)pvqzVnE-I4>NrDb7cY7_vp>ibfn7=lhH}KhBFs z+#2U&N34(Yk`Wp2NpJj!z2m%e#4qD~;)v*d$;(E}jq@oZZjAHt5v$^S+K89qykf+c zaemT>-MXb;IbvL#&-lN%x*s?<>N0=elWx#mC|GLQ%`V&SWRvY~*`-~eKr0m|Bq-aK zwrJ6+MJ6U-D-{cZpn^~^E4^p_fgj(}yH?e0z3)(Ud+#Sy-O>Aisyln1Q}v$SSN@Uv z{oYlo)_cpU?&|%fs(X50Q1$-abB}P}gT1$?`f%?qRrmJ(r>a43_n-LjR`1!WKH0lo z)u(#zQuXQHr&QhF`=Y7`dYAk!_dnPB9#zBMovL_qJ8F`Yt}oeeu3)RPFBDrRvPSzo|N_Z|u+f_?*70RZaByst)%3PF1__ zg1_+N>Av@=I@b5FsuO)L|10N{eQQ)*-1l)+m-IcY>axC*j`8D8-`iBp^*y8NWqtGh z#`(&=lB#R^cB#6y?`Nv6>zn<5{P_C56{@;@pHsEi_o^2;-_SRBoa?5(yHwrWciv09 zd{f^;s@~f7y1(=CZGClBy}r5s;N?o+8dbOSJ+A7uzDbLI7ofGh@29Hn=zAsoLI}FA z_pMj;p1#La_4|&fTJKvrgCF13_kLCP^!<;j_xF9Fi}MHjeyQrieGB5eytnUqRfE3A zRBiQLa1!TF_C2KPQ+*e`jF+G8yYl5+_xGLB&GkUvW2!#am+j%@ul0Uui#}X(V4|Ho)|ivYj@&tRc9v7n$63z z5?84@CvnOvc{!2zld6M>&(GmyJ8{|>T+@kys$+@Yt2&W*q?hx_#K-A(d7VbzQTSql z>ypI1^u3nT=wAgLR@F&-=1gABB|b;LJA>W_Bqr$JZPEEpyg$ixO`-NMGi@5Gc{94tWi7O^~`JTk%=W+EDa~5;0Ckm?W zO8ipQJ&9MJ&-wj{+f;opv0K%L6Y&c;-3b%0{uA3S=6WCzX1G3=*puZNCbnP7wUc;J)q{!hYkB!_;{4ZfJ(76qW%RoTtv@9$ z4){7hn%G6lbR8uArt0y;Azzg*IfU9t9n`gZ{EVoEBn{3=enkU@+z)t`@f^=y8h9(@$&lquB*Aa{Y6!a{ZG5R zyrKX4Jl9SAN8ZkLbN{;vTyN_CwW_!Fzplv3xAkYQ;p+9zy_RdGKl=`@Tlz2Gz;#>y z$UC`i?|fa|1PdO`>(m4>plI4-p$qTfBR;x_5R@-xbEt=Z{)hCzoY8?{q>u9 znf^t&N3{#$S5<)Htj_j7Iaw{GM5WdDBpw|aCP^e67%`gH$aJg)ou&-xJ8 z1O4?1*XR2G@L{fD|Iv?f?eu?j3)h4Fm)yzqaR2^~b3M|3_9wU=?cb*AvHm%qea?pZGj4PY!(W9%41BfDH8)WIGS|xn zc728G%7N>5aa}X8a5vYr12^5vb=|;!?cut9;IFE>19R@<<>J7Fs%{u~qpF(*ZdSE2 z;H$c2;67Ei4Lqsp_JQZA&amzpc)falbOw&8{NTX9+)uwxmwvqM+f?bgIdiXCzU@qY z9(7yZnbFrBl`}6>%iDCmUFSP=zVpn>)#LY^`GBhanGdU4Kl3qFcb)k?s&t;td{J%Z z$eDM1Q$1hRcy#;+KlLEbW94A<^~;*UX!~mi|E}_NgIy2tht+!B z))BQ{w{=wS*D+P;x*WVq^;>hJdB$~3%#HScP%qnaqvM~R8y(-VxxC$O`fW|oeofAe z_G|Inud4Bu%>BBm%jP~vb++|tJ)Sf75tZlWepl7Y<~CJbIrm9b*UbHqs%z)|m#XXa zdaj;FQO{$O&Nu7)CY|4^=XaZ)pQqiONH=jG4k z&qcbex}NVYJ`uqxl2_I=U%L8XKq&2gL5xa_3+%wRXsBI^{O77`zBS7&0VkR@ws_bt$Ej~ z8lQKas@?N8t2%Su&8p6t_kLC9%)3L?#Jq~CgY&kkYR~(Gs_A*3R&{LNPO9|z>AdKA zSUfMfPL|Azu7_pwqUW76FS;&r^P=b5W%GWju8)=Teyr-6dGpnEzjofZs_W)Ws=9vO zI#pdgPEl`X!@TIcY?}84+CIGw%=?n6_sn}h&F6mI_n@B7!}Gqc^5^FLP}OkW)2epn z{Y2G+^Zr}a!}ETn>XCUJRgca)r0TJGe^B-KycblphK{KkA9_jE?x7jq=HoDP=;f-; z8k(uAVFB^Kjsw;=yr0SZX^{TEN%B#9==vr0R4_&9KJG5EV;?T{iZWwyMs+)%H zP<8WAMb(>zwyJvT&?i*AZRpdgdP6%^tqgrZ)h$C`Qgz$Vzp1)?XpgEphQ6Wd&Y^Fq zde6|Ks@8`BRd)?NuIhyS1FG~oWB;eBYwX0syu8+4r0P2RwW_YS->s@^?^3mBKdb5n zJN^hC|DASp9o}O{*I`{R?^4V3KETdUAH9CtcdB~8epc1P_8s4e(f13F+doj%O8!XI zc=BmgyOYnTIy3oGs@>L{WKLa|iR80tc_R5sRhJ~A>w1l<^nNEft#U8<7ge_;qxo%1 zM)TXAjGiYulF{>IXEJ)8?ALt){PHoQjl%^H5Us&j_#R5daDWmN}<_o`|S z|4P;L@c*hhHr%t9w=*%kP}RxdH>kRJ_*zw$4Bw&Zvf-VoI>WnF%?*D~)ysx|qUy@w zqpGeMKK(HsZ|(4WRo4w)sOtLR<*K^FSF2hae!r?4hCin2rs18cZXVvP>P^GnQT5j0 z$5p*;__wNh!?Ex3_~G!ds-5ApRo#|aqU!b(|NS(2f0=rVsykC3Q1zbFHdX!9=T)tz zzDo5Z>;6>qdHaJY{=EGp>)}-NIs4uezmK7xS4h1;ece_obxf^yIQ5dMM^Z2Qcizs? z)S0RtOD$IQcxtt(R@zlHp1w}i?(~OLotgfus8|5J4^eQLnt+UZ_Z z)9Ggb~J5^nl-mR*W{=Ta9bo730SNeIiyeEA`)%(-2 z25;xVbXwJi)6x65{ppL;@`3alRedgfovLB_gQ|AYcdL3Z{T)>gr=$Hol73z-A5H&V z)nn=CI2}*F;(NRuYeXN9k@;%5dt|AqGe@HRm^I?6=!PdHtOuvsJxkWRa@%k&9K`H8Q2@o{biaIZe)N9+srk|Si>K#D@8|c=->b$ssK+_1$2p?c zKRW-YdY&Ge-xb}@M|pd+pQCLx4}0`4s-{Qp{1MM*LOo9JcSdi6z$JsDCtm>xG z)v9hD-J|MFqkmTQ*3s^#x$m~ol&aq7q^gzCjH+8kU8>#Iw$WSE@{Uoy@6&ZLdYf9l zXLPHo{^)j9>!Vdwcj@IlqtSJK|L882KREi3st=Dw&*#0PEwvns{!G=@=xi?H(Ieb>`Rt zRcDP&syb)vLRAxE7pporR#4R*ec2Ur=>&>_Jr*k3FjDlChSm z%f_Bn)fqcXwcFY>#$SJ&Y;7Jph`f=RdAN#DT2gbgy>T_dD_w)GS*k`EH`^E*)^*w7rbbZfR5MAGi1=00A zxFEWI>;-&%)8`Ef+G_nJXGQ0Aa6G#I+vCysNsmYO%dzpltGsNjJ+iH2&_%Bu6GakKO-9H{Xz~eqRZmat6 z_zG3`j&D{q7{5!^mOh?Ojz`b$r}S}sdOW(%?;np|rw@!r&yVNyaS8Qt?~H#}jdO7P zhpHYP4^=%f9=)y{9e+tJAJfP0xITW?MD+R`pNNiQ_rz(>@_c7bME8?f6QgQ*&cwy4 zCMH&>Iye!%KG_q|_aW00>r_5A5q)29V&Z*jd2%B9KFzX;ht;w(@hhryf0~Hyvuh`! z>u}vfbRDjrh^|9-g0DmRTxVkDf2;F4aR=3IYl~iQn_h3bUT=q9Z>L(X+q!3huV4Cn zZeoX8zdrGVs=Fo*s=8<5^q=#%_fOq#Ra+B}s@j?8sCsbXcd8zl7<`V` zJF3Syrq@5N$D4Wf3ibG`v)`iXoU^Y{HF5SPswZ1p&c2x{-6zlfpsLnF-e0;8Ei9|$ z^up-4j4h0g%fv!HF7!F&!aM14`kZp%*e}%jx^KJg+oAgC>k&0xx8>`{>-zCs`tdz_ zd%?o!dDL1Mo!=)H-cRGweRN^;yn1?JbUo}}_^8ScEIgpczEHUT0XMy9954ljP4J|7DlhP#}}?qxwYsjRpX1I>$Q8)X0<$X(T7!?wJ5r7 z=PcTzmJ^HqUDd%w(f!a~6kUJmML$*f*rGqHIuXsL_i=yj)@uH<_dC8(nR9&`c zN>yjkT2*t4qUY0Pi>_A7D;M3W>Y7ELRCVp5@2k3Q(N9!euh(-Ib<}ck(Tl2XSkxQx zb~i0LPu0zfUQ4yhx@{4E9Y^`(n`oJSE_{+dhobX18Qtf%Om0y9+a}+w>h{SSRoyXp zi>f;(Z&UT2$vaf_CqJZWeezSP?wX8_$DYa0spb18tExUYSy%Pp$$M4ZJNY$LgUN5G z+M0Y&)h8#vt?E;gdsTgUGJ1X4KN-E=9GGmX{JF{fs)mz4SG6>ygRd zsO6)RzgKnUIY(8UbZopa7{RTJmL+I$=a&xz(|pA*e5eNJ5EW9OWr>cly-Rn48l z?<45*&U2#YhkH)+{3xCi-8VLz6Wup9>&I`>kKd{ur+)`iwtoDuu19p=QPtON9XmJL-tlvz*GucX==CywUi5yj`#gR>NUyW!J)!EX z^Ph=aJ_{^PAH3`Nh%lpLD(Af@t|FU6)=ME#I!|R$V`( z>lak*ww_wbee}L)X|$jFmqy3yz|v^`&n=DSA1;mN-&q>X|KQSS{)d-F^FOjQnt$%1 zXuQiVipE=cQ8eC~i=zA3(TnD)^L6Z^$5lOk(WAfS^K32KH_bJ^tli=BxbD@_IO|^> zjpM#L8mIW`XkMXyyrUmKs2-=knD-j~`nTIUcuBPW;Y*_Rk6aS1fAo@Q{bQFz`*r-1 zXuqs%v|sUTv|ruXXus@iG)_9p(Uv&;pI7(o==s2 zzVK3BkG>yr>D$zDzg`}^^bWN=S1;R_M(+pGmwrX9KX&O8ROzpNUdsD1!@5e>jk?~f zYf0CS>w1^2U)J@E*GB6%qA)NfTiI`tPij`Td7dQnwtc{H#1 z@@PKY%cJ?sTpnEqvzABK!JOsMJQB;Jc?>Ss*TM2=9_i)LJjRws^O#s3&0}&o&!flM zskYN&-LstczsK^`_Ij+k+Fp;fOKp$7kD|6m-$zl~qwk}r?a}v9)b{B6C~AB3eH695 z*;Yf3+fv)5&*{~6>2rFuUHUmf{rJ<%`8f1g`TTh$}W`&2!;d{EV6%af`eUp}AeZ0jYx9cu-DEEL@ zW5riYs^ydPa`%e!)p|2myoxIQMS&Ik`BRTIYsG75x!XE@1)ql=YtD+Cdi)Iicw)tr zTJG1&gDY0ia*t)Nc!SE5EBJcrvC=En(ei25*()siAN~Bc+HSYCY(;e4IcofFYx4^0 zfB5^N;KLDP8Z< zeUIzDk;|j?&(U?Mu2Z@;RHggcs^~ggzbcxiyDGXKi>spRal@+Udfc=sx*j*Limu07 z^?JAI^*p^^MX$F-ueV+I?a+NYSMl+r_q(gAw14!zZuMeZg)kzB<~k?$xhQ`OMXGRGqcD zU)4FQ=c$@lole%WFRh?M9Ox4NN8C4greyyrYR!OIgI^Jyud{XSe|@xk``V}; z()G`(o@TwYHo6{8y)t@yuC8b6x>VKEtV^$q`tDZC^p~lwDtis!*ApDx~)A| zNA>=zqwD#>tND7SzY6B^e$(rhs`PX1ZnT|DKB|}MI;HF7x?Z8{mAbxJ*Q<2BM%SvY zU)FWEuJ`Hs4P777^$}ek)AeyxXISUFJ(}lIU9Tua%U2en$AH4Lf0$a89jdfbx~ca>I~}}*YWt>)+5(N^LR{EdOgv7kE_~k{a8Pq+!XbV zs7n7HVpBBU*{XJ1SLw&E(T{J`kH1SlewTjyZvFTd^y5|ic>nd=)%7>``sg@sRh52j z{(9aHy?@hr&%2|?&(L*5*Sl4nZS8w^G_N1&`mC*Mkpx&JilN|n>U|G6oe z*Hyaab-hN{jk>-|*Bf-bS=aaJy7cB~oLB3b(e-9s->2$n*6lY(_nVSho?-32IXZ6d zx+U7b)87}3bM_rvM=ka1{M5f)XP-;|Et=6~okew+{u}(;3~M3PQ|Lc_KC@p*|Mk-E zPh_7-{|#xU$QNsmlV7KO9{GJUqW+7>SLr-UE`Sf*81-F;5SQ}j2n#Qq12`))V>&BkpO>|;Ua=Tp8Fa-S^Y(3hVl`cpIL_oM6ar^s@w_JOC#JpUCmCjDB~6FpsBQGN~O zak8wNBA-S5eEiwGFZ_IA%Q*bEC#1g!uIZjTXv}?(PwSlLK>vv7#J=>9WgHvw6q&bm zH}yM^XCcp#WnC9~ijaGdm&rWl12m=&c>vx|mU9|-AC61Ym1ePq{YTiJjrS?0r*`2^6@0Egi0%jkD>(>P1$caN6HGX7Sw?0Xe* zwruwh^qlnaXkC}CjUKYBYm<3ye9esLo=s$jEaPO!a@}4EJudV#bk6sDwye94EZb^B zK24S}WAp=%(w`!qqL14GvaCA=-bhx*gkEdP(C?G^HG=nLH}nUP?}NOjCmQEQ8pkHf zx>d4lw?>xvOq2OJ|37s7#7{Oo4q4VMkfoo0Pn3*P0e@JV=h=chO)E-2|7|8YCOOFS zWVr^|(o=+<669qv{a;;&Rf4R`mUZi7*=|67RQETar$uh+JcOPOS=N1CoA=9_X~v0> zrN@RmO_nho@>w)K-^bW8ha8#L7O zEc3LDoJAz98#2YRemnA`^E$TEjI zIDno8*pR2la({Lp&qD4(UVxncj+@MOhmhsd5#tXFHk1XR9N5XvTQdG zE`h6H{@thC&&Tr+S&m`PJY$C}*MJKy{F7yzI^{Bl5PGa3Gfo#cO_uHEz-8!R%lH-O z*{XBC_G-}2mi{{Q?}q*+^s}YE%Z7Q9B~L-lmV6^w=I=p|58kbNE~M)@fV@GLbKNBK zwa3@eG}uX+`DDnvUEbd*vTS!F*n|E6+#t)g+TaeE$C;wfa}H_qJUNu}-b3ad^?cOk zeg}FAWSM`7Ec2{_Yh<~%@76hAdkyGe%RKi%&ml7XU(LZvnYqQuob!Bow0WL3^la5R z@0XW0>-ylHk!b!leL!TBYcwX`6CAKhmSe(}9)G@Z0NzKIIfrCfmo4iaf}WmH)4xEQ z@1-^Jd+76*{%=OUj-2{BeU1k?Tk>hh*^(b3%XzWJ%p7{ilG~6kfZQR={9SN?EOTSa zwwh#l4Qi2Pd~1Oj#|As#OUZoP__Guj@*-KrsereV`P$>J4Qph%#yZe*NcSwEo;>Y{ zjFTKUPJ=UKId^%;Ti^~jH(|ypl4acrxJl+?wS%7HY&ljvXPb2wfXn1l^mSMx-%FnT z_Ze1sp~llW$HK?w&)WIEa>%3?j?r|1JR5l3#yPbl)qJ-+m{(Rif*y4m|-`_Ps@x>pXQ&}EvgJHx z$a3!TWIq19Ew# z8E~G=`@&zduw@*N{0!ws=)Lz=@_?R?uk(ffLZ5X*9_aig$`6rwOnzTsEsMt4OS!Fm zoa|^{{Av1Hi7dz2)A^m0``QP{q4wMzH0GFx5-<{Cyt5E&;KlqqrH_pO_qBCTlUdG9i6+ByV_qP7sxUuTgKc-mN7lu{{r=w$a3DdLXWR| zF1VYXUt~U~{GN&}{kx$*(ET5v{s#23rN2p*xv^z#A(^kYCav2h^S1bT&6agzj&YnU z`(l%M-BUhC#|Ls(=Wn3g)4rP=X#b9EWukQ#f1cJQ%b1SN%anWCKO_g*v+tpGFNxM& zM~;z)t>}5=kmdE1E%SFFXG@+Z57W9EX@578Wey%$#__>*@-X%D^J_Qx1@fEez4tz{ ztQ*goo*uH~NwRD=MV52HmUEGTo;^mVIYSe+F{42 z`|}s+KG}x+5LwPe&*jDoz!|d4%_Z|Vzoc>UkZ*+k5?SWv>;B;{(AWNCKAwN0d9vkr zHpnu5Q}<*8dL4qEHuS_+nemh06j{y}TgG2N=KJ%{>HeG{^S1aHvSpqnoqw3}fXw^& zE}CvoZ4yKLER5_(e5!5^yI-Fndk6rnnMZlDp{^!w#*^W{ayb` zulta6~Bd*^+N1%b0AQ z+rpE&tSa<0z-@5sN;6KLEZ34peuj?26?7a*WVsJ)CCj!N(BB5f-e|_jlKEWxijGwt z@)EeLdrq;stdLA!j;Z%K)|-r{$S+X-5!x@d%poN6JU>J8jIE32`58JsHktFEQ=Zg0 zf6bU7pV&vTY|95%$#QHP;1GJ+kXvsyJ{;Mm(>{@^4y z1Daakjvyd0SWpEAL1n(pB>kEH>iY@oyY3S)HnE9l@S+EN(fQ#e-E4tTtke9(# za1Go5H^FW2G&oi?^Xvkrz*%qsTn1OcHE;vm22X=y*O)mZ!6|T>EXO1Rc@~@p7r;fb ztXqP-46cG};0Cw}ZjoioHssUb*tKTAy1+?r3cP^K*VV61>ay5!U1gvr3(kWJ;1akD z-b$7+*|M!F^fbV2@H9B~4%jd9Y`Rvn0sVba$W!19I1es^Yv3lh4W0(aHozRfNpK3B z0cXK^Z~e?l*=`s4#J+Hz5yoKC?#ehsndVE`O#m4Lx1go9(8+S#SYd2G_t1a1-1n%f3%T9(%XR zli&{pla1%TY?%HhDO@RyGGPnkAg4^U1`vSRjgL(fGBTG*gS>|j*PZD}k z(31rhz-4d^+ysYYdCxWtxpkw-yT~Wz19=K^2l6cB1+WJ_WypQVYmiTayWV5wkOF7H z1+x5HO&M|@TmuK-CO8CJH<|5rfm7fNSgS&1qKckW& z%N(-cGPpvPZPg%ef~UbUO|%6;-hdLOG~*%n*o zRs%P{P4G0>y4{S~MV4_=;4HWRE|GZ->hlN4t7Lxvz@PcoAa6k4gghk6ezhT=26uhX z%*`fCf08WQNWyovbCU_d$RWkEQfwSN|xBxDJ%itQ={!sK@`bv6l%$9w3bbcS@ zY{^}nch%`^NYlAF3KKT^gQ-wSr%b0BG3Bgvy zIyZ6y{*)=l%40#p$YtSE(pP_yEI-R?&k3{SKjMin#x~YFM zj~|P5Svkt(_!OXr%{}APQ`WvxTgI$WE^}sM&ghJofIsQFl9%mWlHd(Hv6!a|6J(p5X7V;^bucCaT_M6CM z=-EpCUz$%guq>Y}*s*PY6BJ&~r%lRH(<=Vz$*qmTRwv z%-i}b_1Mspf}RDs=S$S%Ku;EWrgYB()Z;==0eUv-o(A=J&{Kw`M=s^HH8ZJ{;Mm8^K6ZhV;1oCm&Vuvc0=NV&gR9^MxDAeNgSml|;1oCm&Vuvc z61WWZ!Bub#yqnC|!0mMW1IQcTCU~FjzmxjgkWYgT=^k~xeH``|+(YK=@->!(JO$2x zv*0|q04{;c;3~KV-c9B?@cpm>c@w-(_k4l(7xHQFA>DHy^~645_P2-3s$ftDv1Ii1KZ`Ap-l$Rmjs`KAaUW0tM&iVK^A>XI-zfnF7`5~Rhd+2rTlQ4fW z&wnQ6Nyt;+3^)tUgA3pixD2j>Yv2aB3EoHMxy_-uwIQDdAJRQ@sVBDG>{l1Khs@)Q z@;*YI0x!@#7f??I@+^2t_q>jJ@{kw68+FfB)Kh}I4Bo1H`1P&|c@4Z<_q>P3X+Yit z@6$c}ybj5y==Z2?=$Qt`J_W}IoCK%98E_Vy2N%F4a2Z?$*T4;M6Wj(*gJb^!^9Luv zDR2gy1?Ry9a0y%nSHU%K1Kb3+!PDT_r(yo!Bsc}mfV1E{xBxDJ%itQg0d9iZ;AwDd z2h16q1gF3ma2A{g7r-TO8C(U|zzuK{+y+mBV|T&)!AWomoB?OSd2j(-0++#6a1Go5 zH^FW2G&uGdm_IlPPJuJvEI1D?fJ@*qxC*X;8{j6m4W0&f$ntex?6a^h;3PN&&VaMv z99hQ9LtX%vz-4e1Tm#q1GG+tvCb$ir26yc=`xPe-(|wpf_e(*Z1sA|&a1Go9PlLPe zhHa5$&MC;V-~zY|u7Yde2Dk}sgQvl<&zbpjfs^1AI14U-OW-oN3a)`0;3jw)-1T`g zw-h)7&Vmcz61WVmfg9j9cp4nL$IPJ%oC0USS#Ta)0GGj4a1Go5H^FW2G&uGJm?t<1 zPJuJvEO?5{@3r`SX&&+dc%$wq@p~l5%it=w25x|x;5K*~9Q#+;FR%?xf>YoOI1A2$ z3*ZvC46cG};N4_CR-fVbc#t>2`*hD2sizJ3H29G2*-bsMFT(zUd&s=4Z&6PY@)UT1 z?rBg@2J$R;O85MPdh(DLz#DbXpQxtWTSqtiUO7nk?fxWOYv2aB32uX@!LcuyId_4R;1oCm&Vuvc0=NV&gR9^gxB+g0r@>wH zA*X!KnF43Q1#lT$1Meow_pO?c?}L0A@uj+BDezf$D;m9oZ8a1Gx+Kz&FGdj zKW(;KC(HE^kYx@b*!r=_ZLkA&!6DfCFSD*g=KbaSp$qoF6|(HF4|)6H*vTV!RZ{`*Q+hp1IG+FvP+Wh;hVm~qK#>q|nJW4{I z0T;BSRm%vqU8ytJqY%2-Qfb(Dv zTmt*x0NenF;5OL$Z!?D&*aj!T4mbnOkq7Adz{pz6%Wj2|bM&t8&tV2%#J=P!0_;E6i&%ZOrhCB_q19=W|7xE(H9^@6B^J{S(96(Qt zEXO>A-1?)LrvomMrQe6VMV4zge#G>o$&wc_|C8w{f`k7x+vN`i<$Sqd4_qP3eAt)p z@uc@8KJ*0O5S%`0*3FRR+*Kg2gFD*lHTo~GE?L&igFUj`^Q({tWZAC}T>PsUvknf) z(r+Czw!seA1sBP3d_2hOWWM(JYmM}arYC*eIQEj+ujJp2tKbH>Mdstr$EOW>>>p;` zBsfi$xn&^FgG=BF^!sEvCROOELr(+p5c=DY$E?_ia~CJee3Fo-Amjya9P8X69BQ%kzlM=Z;?^VlzySLze3;gL#+faluyHFOgT0et zC(cEKEYF2DIQBA=C&3wT9$W$^UvAdTfL*d&14Xi&JGR^hO3+^gr@Ku*`&D#2)$1?h z9$Cis!7=)Sqq2`SS$dL?JCJ7}&x0G_HaK>Q8NW`J{c1zrf!v;H=8z*xe+%3u%ba7U z8YjUSaE>hFNRtYf#YP^mJN9loF>b*9LO_Z7n}zd z$-FMVetD3Wz&^MN4!{j?2)6pne%W9LoFmKpUC2GK53WOh0C@}Y5OOPF<`5^#wrt4L zkUNmOU=QqrtKb0K0Jq4p-4OCN*y=a)jDc;i1J03UOc(MzxClKS}#^)NR!I^nxK6!8n+yIB* zHrN_68~WszI4FJVbhZV=fNeg53YjiWIhfrn?e6p3-Sgy1h>KbN7m&v zD+ac~Nw5RXfOBM-g9~{c?14*QA6x|o;08DZx4~8#_5~a#%XMNyo&=|%$ALTpcENeD z2ll}MI0RcGW}Y_K0lQ!i?1KYv2yTO|`DR-&unkUv(_}tY{5z~1$TQ#^^th1c!5+8- zu8`$i_>k8j4_WSLvS!|#&413yo8WpBI?s=Yil8|S>IWo_a->bM}ISzT~DMF7AJpnjd2k6_1-HmDPJO9yNS6I=lVuLpt4tmvOYV~& zpy$FjdH>BFp&JMP^+a?1Fu8hkRn)WoBIu?1SrM=?@{dUTxM*lcgtqv9Uvz{mnt% z(&q0+binb~MC)>%AdgNwRHeZ~lR72E)~!5y;9Gv=7_<7CN;8RO(7rY8f=gG=Bl zxB+g1V_7q15}W~hWI1kiGS7{VNei6InY;*Yf!#}^>;KPm{S?VEPKhkXwgS0NmhG~o zrwR_Bhb=t~a0oqY>1l&IWSNikTC-iY^vA$)vh*h*PeWb@2V~io5FCG<87B?SkY&4h za0y(2{wm}Ra0`0ckar-DU1qkG1ZTiSvg~gioSQOv5nKTW=D^7nWw20qTds!=nfHtDIo7JEC!iiz`yXVV{3!MCXXydBLzZI_Uu~QQJ7n3H zoX*wjBji3f0Egf_yDV;m>T{5`VFvkE==D@=cpEd3?OE0D+EVD^PA?^`ltnL{32 z0$0HeaDA;Avjy&eV^^B-li&>4CG&Z_=&STIT96mXaxO}c`(!!(b?9NsezhRaywS`d zN0u@3kQX5@L0*Bp3V9v!2IOsU>`i97C2$oSfJ1N_99w6`NrF8xAGe$6xV6Z#UmdXZ zW^=6AaxK}A7s;}21zZP*&~LrPjA?_@WEsbSJO{Z8c@gpe@(|pC9_OvmJ?a~@zpnNl z$e#Atz4Y?~WSK(?+yPtbVgBGES=Oz9>)`ZNrY8q3f?L{rPYB6!t=exhcEB#!1N-1Q zS?1OPcfi)wu@k>r(gwR=k1X@?!NEWIBD${B{2{kovo2eD9LQa8g)H}KA9A*=TZf(i zdf3uq=goE;$I+@RldabzzdcbM2^f-{a z;JWVN_l*s*%q@f->sm8@nk?5thAjO>$UETNJIuMrlcm1`d7Ug{c62^Wp9{q{nEo_b zdWzsWxDEXs$YUGLI5t_X!zAPxa2{MF%XUkUTkkaERLQbm4RDJr>$V|}U1$1}V3+&= zy%#Fb{lwG$61lj^{A>f8uWj}7Z)Dk*3gm6F%qR9P<0Lo(&VvK8jM;#^MLw}Fkar-D zT@Tv=XTUkKjN_7dTYL@Yp{E3{=zi|0LLQK1-3H{zcbhq6z%E((^N^RoRd4|P4anPI zYqJ?MLzZKn2baKAa0A>1J2#l;ng=eCW&A3*0d9k1H=2H%EcdP?_LAC@+!Ci zZi8d*G22aoGvGYfBg=UyK_2K_-IpM5gWa3Ve%Uui<8Z$V_Q4IZ9K$x)elM&Gwr?@H z2lm1Ct)|EQfEnKd`{W1cdHpMTE?c+huXpy$uxzr-Ckb}I8L$h^gFSEw?1KYv100fh zZXc!jv>}h(4s!!LWIkVfoHLNSWFF@LjgyDm*Lmtb`dSI{2DlB5eGs+_&Vcja61WO( zfZO2M9WXvP19r)>k0r>f;0Cx2j(IRXI0MduOW-OvAj=#=a2tAJCD;}?1NOirun(?+ z8{jrL_9567I0G($8{jtBDo5AJd+B(Kr<|j!ow4 z@GX?LKWg&K7URZNADW(vt^!;1ak(mTmcvSHTT% zi!AdG$uH2oYY$%=&=dQlnM0f`{Yl6(;2c@zkcYeku8?J%D&!4ti!9@`A&+f``H-b2 z33&#bBg?k(ke9$!a0A>1$3A7Yn*^uHO*(G;nNb*Jqt9b7(fzi4dtm!Brl&}j?RLmAXX~?OTQ;~zmYxvu4q3*j?=)_ar9XYQaRnTZdB1qh zEyzR2)1Nczx@74O$Z`x@pEuWY{2ueUS(+?!aLIBE^E&74`d=`40M7lZSvOCX=Zi;{ zaVpRg=$yw4!LcuzbzQQ|-vd|3GS4dXcObWXv#t%!kY#Q;vW!y!x4>=a@93Q8Y*)>G z<;Xk^=Owa?U(q?gPqV%R^8qKx((gkaf~}faH%FE^dv!Ah9~^)~u=8cp&z9@Kg`6$9 z2ll}MI0Rc?G3&<3GEW=w4q2}M;=h@m+%A*ncALBcj(^qU4q4`zgWQF@4te}uvu+w( z0f%H6vjcfOUFuMXJzrWvP2mTkEYnA`*V;1Fy*X!;$n3--W1 zxK5VsS`V3VY;c+^=f#2C1sBOOP96H=-!gdx>^*G0whh3!M@&Ck&Z$e5uki!0{ivC< z19rhhvdrIu+y~d8CxG1AYktPYCd+wGlVyJ$$X##?dmf8fblI!lp=5nGcH(y>vH3mQ z1pN&Z8*;YfY4V9}L5~AHF63-k*Mpobd4()v`q0Cco;vgd(8HFV4q2XSxqmmuxdQgd za@^`<*{&Cu+$YQLk7D!qO+F?K(-VTN@0r|d8oMp<_$a2m5;5zijpMrJCvfUiy4anQz z*pEzqoGkm5gggVzK~G(qUze@_Fyj=-GEN5^|4)$Vp*aQ3E033p? zXUsSr*arvT5bW$X>$+g)r;vj^un(@2n{+*^?}SB|cEKLl2U`cC?_KtN zgRWui>&OmSj=2l=z&f1Y2#G8`uH6;38S(=|S#; z18@lLkY!!#*RWl1k}TJT19?X0{BN~f$USfgTp`Q0e8{Wd0NenFU~3xY33k9PxJc&t z^S^)eAosxmI0RcA*cR9UyWk>O_R)jf2M6E~+#$=l*7LAkumjGKrQe0TsB?Zz@gVoX z0k{SIA>`I?U=Cmh?1DY84-UXBvdlSz-1;Bb7T5v1;38SZ@gWbuE$Fcin(@_WSL$LK*GY1>&fOF&% z+k)H!```fFBFnlV$;HVq2Ght2M6E~Z2bY|08Wxm%mH!_?1KYv zgUsuGnC`0~ES>A8B;3D*Rko({k^yL0z z#;kxFWEsB=?m$oO1y~o{0lP=dI7PA?lM=WC&ivW*5VCzNGZ-dih8Q+0CciiN4aQYu6&yeN0S%lmt z^FH#vuw`Fb(37)foY-y!Tm^T)c5KFpaU5`tEc16EXY(9>M|1GBfA%2#J0s}#p}zyU zMX!JI^|%c#l4V;Ja2?zNcfj$kXkC8KUEA{50eaz%JMW``|iR_BVh$1Y13@EpU!3>w1v;;5zgK zkcVLFWEdapfL*W$_Q3%-1Y4)T_~0~I=I=nBgWQF@2)PG&1#%zqI^+T5EuHgu3?a8> z!aTtaI7gOiz=u43s@WHh%+JABeT(j6+8-s?p(oJ!Gn8AWMg2qHrhi{amSbY;{2i1# z+Iz{a_A4Kz?|G5=UdrE(2woA5b3NtmEVC~j*eCPcenLF~vXfO4R*jT zxJZ^cdyxC!033p?*)vZ3+f{GQ4E4G01&`3Zmn`=LU*}sWXG<5TPq33!JU57W1ks~IZb1-WlRTh zw&X>!9P`}Z|L;q9yEo7^K)D=~z%~xSK@xJXHEePl?50farHy^CGh%WV?16o-JqGwGh&4R*jT*aHV-zDHdf(EPOzkgW@%d_{xy z@j^3x2)34(+y*;j`8V>`Qs@CYU>EFxeQ*E{!Pcu_e6Ry{!5-KL2jCDKTx7-%!PYX9 z+h7Omf<3Sg4!|MUdNqs>cEB#!1N-0r9D=QjVSKO)_P_!8#Pf*E&#%Ym+6W$170M7a$)oAXnf^fLhD570fIzenRh51V_gqaKg^47o}UwO`(%ZDnA; zzz*02dte_Nl6m}h(U|TfkzXJO+Sff!dDd*p1KZ0@?tne8y$X83!5Wi?;NT6AgRQkD zx53_(CJ(?N*nN}f@xTE%1l#LOzXNu`9=P~sa~|o3xKF%BIA9m-fqifQ4#Cb_&6qCO z1N-0r9D=R&W*i&rfL*W$_Q3%-1Y1`{*UurkX42#)U03S+k7Rk>%)QOz&ebM&!5-KL zhhX|(_{5mb+l^hY2ll~UA)4nKzfZ4^+7FTg?K7UB=bHBIWd9m-pAX2gFCo~v*5o$W z0lQ!i?1KYv2)5n<{>t|RG(9fm(f%DDg*t$0wdte_NfJ3l*vw5G!mUHAm&X(MVoGp0(Ia_l3y=Hv2 z5A1^ja0s?O2;+ktunP{rA=tVD#sNEE z7wmz3Z~zX$wilhp^bhI$mdv(%aQGpUTV-P#?0`M64-UW~*s8#oU5A1^ja0s@x!1!PX?1DY84-UZgon}l2?1HUrrpE?5 zU>6*G()0)0!8?q-&(r58^#1UDbS?SXGoGT?DeaGuL+v>~qI*cqtZRcEunYFUJ~#wh zbr=)ufL*W$w!duFb-*6j2M6E~Y<)&8}umg6%9@qy5;1F!> zg7Lu)*aiPT?%q9art1IuUwhB#I?v2?kyA242uTu>j8l?RNF`yMk|a@*k76WAk`R() zB7n~5R7Kro(hXqFjM+L_O#|0+@hu*gPv>DW~@M3+eh~TK;nBchJgkbfKPA4Qd zEI1-KDmW%M%=?U6pZ4z1U7t+3#T;Hco3;JDy~V6{P~84?^891$E991|QD zoDi%wiu47?VCNde1t$cn&vhKNNpnbWSa3veRB%jiTyR3LVovPjCnPv5I3hSII3`#z z?xxcb92OiA92FcB92cArtQf!3=?e}EjtGtljtPznP6$@?iRttOM+8SD(`PyH!`n1R z1V;tO1jhv@1gq^L9XQ!n2fwDTPVs->Sc;Fp@f5cr4fTy3|HCBj)air-hXqFjM+L_O z#|0+@t6d^}!D_b%7aSHG7n~5Rz7_il4hxP5jtUO%(fdXO#|0+@tM7FDnBchJgkZH- z#}5e(3y#6b>lNUdsPAol2o9xq0~}6qkrcP1%;K=qF4Pa2qj0i(J|Irwkj(~V7CvnAf8fv&o4LS{IP{|(|2!N{aR_#wez!Rj|1Cm}d~N`wmz{jS&iBXF|Jn^G^Luu~@SRQNZ9NB*?q z+(Laxz)l=>R&z*jSa1wZrvEDYhR)f16b`4j4)rdU;t_E8yiPN5L38|~z3(pKBvM?9 zIvBcShrbR-VJC0#%bG*VW#!>Cal$FSojMp#@myFLcARYLR~UBEi3pAgjtNc(R;J!J zBseTMAy~OYe8FMCQ8-zK1Ie56*t`i2rMLlgJe=Zra13_x9~Ybuth_o-NN`wiRB%ji zTyR2gC_|?i797g7^L!=kERy1<;b@9~NphCnHzqg%C(peL?Jt~d^ISNR;$v_$#W&Fw z6R>mcDo1lza71uaa7=Jqa6)pfPE+M+4*6Z_^~|u~h~TK;nBchJgkTlWX(riuP8Sm4 z;s0VMPK0o$9HN3_g5!b{f>luO8xkBA91$E992cArtnx*gg2RF%f@83=J{*UWbzlV7 zH_1+TqClsqif9fA4hxP5jtWi)Rz*cRg2RF%g5!b{fXf@6Z?f)j$( zl_Gt?VZjN(s4XG_1xEx&1;+$Ou60?@*S00g0e12ht)e+5I4(FLSXI^WLxRJCBZ8xXV}j#?6M|JW zk-p%t;E3R;;F#dJ;Dlgxok(ABthx@53r+}D*XuYT!C}D>!BN36!EwO}!K#KxUvOA( zL~vAaOmJLqLa@3)rys4UIVLzRI3f5j?7WwvZq)m_;nS)2RYJ9Ncvx^ma8z(ia9nWs zCY?@1a8z(ia9nUgu&Sfe2?>q}jtY*{)$yZ(V}hggbex#rxZs4~&@DQCSg@+E!(+E< z4mHpm7Muv{@I*t+@y41Hf>je89%-sMDmW%ME?C{B zkl?W3h~TK;nBchJgkaT5q%SxuI3hSII3_qQI3ZZI7U>HP3yuhm3XTbm3r+}DZAAKl z!-6A%V}j#?LwD+Q!h$1$qkS91$E9922bC zi*y8s1xEx&1;+%(1t$cD@6zc<1V;tO1jhv@1gj1@osi(D;Fw@_w}>w|EI1-KDmW%M zE;u1r-6PT$92OiA92FcB9JyDg6Ni)Y*!rv|B~m;Kj&-!dJ*+3iQ~Us&NbyEk-Dk(C z#M)9Q#be;e{dV}za4f~Qvz`=B@oYGe;!CjVY{&0-ntfsCxnWFjLa@7w9_vG}6Tdv{ zjP(%_o)8@Bs^dol#{?$?haw`r;F#cq;7~UmzX|NjNg^V=C+y@iCc+bfL)~>c5y3IR z3BjQrI(`#4eOwXV6HXsjgeL@tdg^o{f@6Xcf)B&avE03M`XSi4E)l^o!3n{k2Sj|q zF~JGJq240C;F#cq;Lw92zTlYPgy2vg5npgja6)kCArW72OmISQsIQ1GI3_qDIP|cH zFE}PRAz1ZuDd!$4BseTMA~-5ICO9rQAvoS&=SMxNIV?CTI4)QX5b*^^1;-^1)bT@) zxzgWqObpfMsGias5*!vB5gZj9e_E%nhG`B9j*YbMPd}iK3ca9@6_)&x-ZvsRE;u1r zjo0x*g2RF%f}?^%FYA57f+K>Xf@6XcfBf2;JDy~;Ls$! zZ$xnD6&)TE92Xp#tmA|QM+C z!BN36!3n|YHIb&^u;7T`sNk63gkUvYq$xNoI3hSII3_qDSiLUN6dV>D5gZj96PysN zW{5NehXqFj#{`Go(EEl3#|0+@tC>1}NN`wiL~vBFiiv#%hXqFjM+L_O#|4LG=`_QF zBZ8xXV}j#?6M`de>NKN*V}j#?6M`eN#lC{o9337K92OiA92FcB92Xp(tJ91KjtY(m zjtfo*R`YZ^Zg?$o+T`yzq9QydI4(FL_%Q73tLE!8LxRJCV}j#?6N1%SA|1hD!4bg; z!D@lnS8!NxL~wMWjvp7S7TI&`!SsRA6z_v$DZcp(Ytf7KzM*$C$KKPN5FC16herg* z1SbTCmg@L1!3n|P6?Q(Sk)L>6$5(4KhXqFk#|5j;M0~+f!EwQAt%xr;DmX4!t<&-2 z>ouzln!|!48+CX>aOiU#9^T_pi&(3y%ro{#if@3UDXs^{QrrZNr??fINb%jU`p!!C{{u%;JQ9wj_(eFL;>mC##c#lBubuvUIF#ad;c$vqz>ySx21ir8 z8IGm+8#tcgeQ+YhKf>yJJN=VzD8=XCaEcAyDTt&v3y!9^0FI^jN;sb43UDID*THI^ zoqlaNl;Y$&3*i(uha)L&myEMtU!ys&^Lz7kk`L(c!-Cxj9bR5=6Tv+NKPz~S;B|rz z3w9qA=?iWmxToMbu+zUKe$eOTKBUtL!Op!~dH8Dj(&XQnY9cry;=}~UVduUhAy^&O z;UU3c!4bhx!7;(^BRW6j1vi16>+-A!pCiH#i*WakI(`Ut&bNsOkBIP?;5j1BVZrLC zPR9*9_ix=+|~lHXUHb5f^sSaA7MI=uYvcKqab@WQ8cI?+Eg#|5i1I{aDK$!C%q zk+eoH(3Z6Wc^NE9KVZEI484@Q|rF zA~+^EAvoj`@dd{OCj^JwI==E~4hxP7jtfqBb^MS|b3|}Va3n*=i3v^!j%2#6^0|fg zwjx;~zTkx5P_~F8I3YNcqvJ#b#{?$?NAq<2xM1bi;bFm1!J(jz6A>H}oDdu<(D4(3 zV?{(b?DTu8sOCg59Vb*=b3|}Va6)jXgorOVCO9EDT2jYXr8LI{N3PW2F~JGJkuoBV z;Dq3CSsf=TI4)RSt>eT6C$6#U&n)UssG^P&5gZeo5FDx`;tP%mP6&=x*70M4)wMc2 zBseTMA~-6!n%*}qSY4;X!-AuNW#EZ<@I&W6cc?Y4N2 z#d|H@XYm1xk6M1h@{^XIvT}afI^r2C-U6vb>k&y)Ex!d4}?;$$WL!;9sR`dkmGuzjgRGz`u3* zw+R2<%)iC?w;umq$-lSoZ+ZT$&%c%U_g4O`%D)Zx_eTB=^KX=Y8+saY_tP3Zh#p1H zqBqb|bO@bCZjVw~D1d6B`sg;)9leV_LDn06ko3gQismU* z3ROfkQC-v&wM89JH`EUeL8H(FG#f2LYtRmK0$oPgex<6Q`lvbTfcl^(&^R;!y^3a{ zkI|!4#V62H=p{5A1%i|pD$ZxIZbH4$b7%sZf@Y#cXc=0AzDGZyKaeWmFPx*fXc1b5 zwxV5VKRSX=p!3K>^$(&Ms8Ug-nxF{khdx2u(0-J41@X{zs4;4RoqN{0MRnbl8b(BCqqVuRk3CbJ|MlYi&D2_Iu1LzmzVTxUVN}vho$x`GC zT}N~6fkvXAQC?~40qTGTp=szVbmLXz8TCa2kh_dh*P`KQ9%>Nc8l&x~L0Ree9cU%BUUcjuxWz zXbUQGGwl+!MLp1SXcpRlE}=X=nHxfJv;+NyE}@e3NfR|jZBS425PAZ=fTo~D=smOw zZ9)n3EBYG+Zsq(?MbsSiMx)VW^gddRK1XF6P`}Xas59!1MxfE?WwZt*(2wYM6bw^G zP;c}YdKoQ5tI#==+mQYRl|eV6n^AZ45PBSqL=(|`^dZ`a_Mo59dDNs4*A8_@15gx= zN7K+-Xf@i0{y^Twv=wv}s)6dEmZ$^jj{2h~&~P*XO+_=%DzpWCi+(|Wpz|oN3D*)` zgQ}yu&;w``ay4a)MpvSS=uUJW>VqCdPoekFM`#^7j4mM8ZKR8?MKw_i)DewG)6qh- z0)2|sq0Q(3`U(AwiZr7yL!D6%^afgij-jmEId@bURY#4{edr;y2*uGi=r?p3d73ju zqZ?2i)EGUCP9XCRrAni6s1~Y++M}sx4%&(SM1P}7Eg08P2h;^Uk0ziP`W^XOQuj~| z6h?#4(`Xg?8vTYYqKsDbgJ>o?jDA69&?Qu~HT@3ij^?5d(N1&_-QR}xh4!J~ol4z< zR-%pQJ5;YN<&4^*uBab+4vj;T&w`Uwi z!Mms<=mvBvx&z&fx}(`>0a}7qq69jRayn4AP8p=Z$x=m_%M z&35!T+K!H*v*;pn-$PqNHBm#<3Ux;hqQ_AbZ9(pPX^-ee6hD0Z6^~G#P-ip%O-8fOBJ?RbjWW8?E>Q^8KqJs(^gTL*Dt4#5 z&|owVZ9(6llPJ)Gwu+jdPN**$hF(B3(0ueBT8_R)m3mUoP%ktZ?MJE?;{&RW9zX-p zo9I)t4sAob(FNprfVPV6Mm^CG^cngB?MCNNUT^vWG#b5z-g=OJ41JFFqF<5GhjT{5 z(a-3Whd3Vk4*iYXeQ8Ii4;p|*qnFVeXenBazC=GD-@}a4s5H734M%g(+vpQ?2%SSM z`q9Ur`%y2{AH9Gkp%|KnK16HLR`e}8f__DRA>$F|yQmDRhZ>?gP)GDA8iB^33FtMn z0KJPgq5bH-{#+mQBpQZZLCeu9v=Qw>r_e=|`6zuBx)!xT)6pEX9_>O$(cdUz0Og26 zs4BV{-GV$fs zC(#%*8BIs?(NeS;ZAQD%A#@U5K)&IWKPrQ&py$v+^fkJK?uc>@=yz0V1lI@kMHA67 z^erm$4E-V+h~7lMpqoZguhCev3uQjbyd1SfkE6pVV-(j2J%whXwJ7);?Hc8drk)}7 zJoO$$&_uKfT|(|L^!aE6T7zo8K$)Yv(BCL~EMv8ngxN zK)I7CbM!H)HihatK?$cK+CQ3!wxB)eshRY_Xf>)DV_u5BM)%L6U8A$8?VD^z#b$FX z)CX-xP3LfKXe3&PZk|iMN88Yy^XMbcd34u&uHjpZTPU!AyrO5&K9s!>M(-l`BF-7T zjEt1enXX(QBTk?G!-2~#Xe-bL9d}r=p3rLoU%qS^bM-`5n~P7ff}t~ z8ybc_LYW_vKQsX?MkmqDD~X40N3GGD=rkJs32gXA$aFD^{$Q$H z{_Vj3gZx{BT-4>?{nL!(Ps!9%x0~uoFST}vp`PO3PMr+(dLV;iW^>FdIA$^BQ6-d@ zr@#5C6pL=9RZ&%z(DH;<T{VR9&y0CEqWonraHG$+J~c zHAmg1=BnG(+p4vCN3~H)R9nudom!Ou9DdPse(`tm$;klL+= zsDv7-4yvcrQT2>EM#?{{QGC~WtU9k=R32lT$}`5RfH6S@jfv_iW0ERkOjftj+!`3K zsm{jhDq_q~-HbV^r!ikWY`mo=7z@=zW09I{yscg}-cd`8ch!f+2Wq*oLVav}tX3K; zRowVQtut1sJ;tZ%J7cvvXvEbKV~sjytX01l>-ZB}>(%eZ26fu_Tp8vU%42R;K69(e zGPkL0^Bewb#<$9E9#jGIs0x}t@uwtyQAN#@s<`=^Dq)^dCC%SeY4bFH%HR)G)jXrB znSZM5&9mx8^PH+>o>%qFzf>dhf@)^|ty-8DRcrH-YHMCje!kkc*EEcXX&Svum(kbs z82wGJ@u=xD2ACPf<7TEY*vvAXG_#E%W{&Y6GtYR+^c%y>fHB+*8qb&o#jA>?h<2AE_ zG2Ohzc-^dM%rGk%GtJ7zZ1Y-Uu35#HXI3@dHme&;%oZCx#m zyIie}`(5pfuCDe*ch}uU57#|LZ`XasgRZW|!>)+Y&(+Hq;CjFq=6b{!?t0XSx&|1}xCR=dT#p%JT!V~PT|=MHaGy19a-TEmx-S^F zxGx!P+?i$vceZ)AJIB0-KgM#e+i!Ms2h7g=v5_wB5@s)VNwbf;l-bW+#vJIr+8pAp zU=DLvGNbM)=4f|SbAr2u`I@_y8FSY$7q}al>)nmb&)rSUP44FAm+qG4Hg_v?m%FvO z+ug?8?`~@*-0jSR?)K&(_g&^;cL(#R`(E=WcSrM>yNmg=ySw>|yN7wg-P8Ql-OK#V z{ebzq`$6-xyN~&YyPtW+{fK$iJ-|Hge$u?)9%5c{M@{8<#xy+7nqJQ+)8~24%>dC$DV^S*hnXQ|o4^MU!GXPMd8^P%~OXSq4h^O5%2s*X9DxHgmaWyZMo4hxxJR8}l>IPIH52m-&Tfx4GH#ow?n!-`wFjV1DCCm^(cO z&0U^rT)RDWTn9YuT!%c*xPJ7EbN%Fb$@Q~mlIs`GG}o`5>8{^AG1qC&EY}&&o368- z*{<`RIj#$y`L2tew_KM!3tWbGq08lc+vV{tcKN*TxH7#g_#gv<>iwcaEw5m#u)^-Vz!O4?UKnPk z;%#Rv%(KFNZEU3I2GdN@wq88JwYJWfY^q`woqNy;>+q@*wz&+?7Okxd$~wn=B~8O) z{AD$3>(J>ubF^sE;@!)tR_6N{eTz}(QHe|sM1()->$(@=L>`>ssq{!_v_SYeCP=b_JcNI9pR_ic2J zYu@dYX<=ocOX&Bf4Asd>c^F^kvd?YC=MLRbV5)A`)-kUes+UDi%rMkL79EHBTeR*i z=V+rpFx2B#*ytXN@D^=($xzQ&R4U?J!B>c9*N8svIs1O{u%Vu_;uThNbi9AwdZLl3 zUbIrFK)Fn`=)S9&&sbEuo~hojXu(aq#b%K%(=iK7wa^NyHQP|{T6Bi%`=LepdgyCj z*mcuaYc%_QV(okV97ClpfK6?QF?b5WyDvd_`wr_WrU@4qcmU6Q(H>oV0Psmt%TTMU(BvVg&wuRFp>DE(No6-B~_NH4|q!VveS;xI8P4l>)tzw1w zOPZ>NMW>27J;-VP)}`GpKTP)rBL+EndBE?)>r1~;+uFBHy8Y@F`p+e<%T$-RzHYjl zb$Yx1bb63-UpqMn{OQ!<$0j=YTkth^8CI_PeC71igSVNf-bbf$-$PD6w7-&}8d-ZZ z;jLD?m)gbqp0`_Jx6e1#T^6{q>EZ9<->iylf-~{jII9rgN1s&s2|FVNdmU zsIdI$9Q@1}^&e}GUm4#=_Ik1mgDm^y7+R#kxYtY*+wo-|-G1YR5=D)~0_ZD4FkNYFN zuGHupSslKj;N-kg~n?@pQaa{MOu_GyHgqseZ6h>B*h89WU9d{A7h4TH@4*L9`FMZs?O3o8qgg z@*O4A+uCCQ)X$<9yE-L#V>$~a!+$r%${d9c^JCr-hq0Qr*o>k8sXR~Hw*EL-ul5+vO zgp%{q;Z_ckvj@9gCFcy!TVct$fL+5TQlBSUVV|VwD^j+@{($U$qp%vQ>#450J8ALL zt@QLvLC+8LJVMW}^h{dMHwv4%=^2ln5B;CaZVH>L=o!jCkBxeEt;fc~W+R1-mwLvd zXDG=YbFNiteZJ&5hecigHd8&i?xo5y(%IKM+S{QWY5KP_4?S1WbCAO37KPpWCF`Hv z`;=v5x9PxlPLI@il@q4#5tF0%0_%*1d7b;lq3=8QAB)rU_fP!ICM(|2-A0Nkf9ueG z!tA4k2(#%^?o#bGnEd-YHid?pYNeG*#tEnO^kAz!m+F$fuRZj%Q+~<5WP`QGnqE%4 za_O*72(wFkOJ67VPmzP|)*jmro2hf#yWCX!tgtbR$#xFjTHx$)`!7x(@d0bqc5ksX z&q&wK-prb_tdx_- zEoxEnxHctoRn`hi=Addi2R4;wU;AoJG)#4awN;mMpPQU(l$-_Cv9|7Fxyru!$6x$Iqj>s$zp#CEylm#Nc8Pc4E8TXzYO>RzF3eu-W3>Cji6>^)=`cOd z)^p&(X0+`-bW(Zg2Zv%4oNK;rlT(|k`r>ne5H%64GT_E;Eyoa!l`y#6g!>t^68AC@|^d}?dSc^Vq>jaAiGwM#YXo<&EGc2mH*eQeLm^a%B zEAbhSzq(SK4qLws*j=L6+P(e zq4THntVfbVKRP{dwH*!>FXr^}$-fDnnk`K;)e@@=hK@4T#}?^zJx#?J)z({Ed%orL zqWYe*-hQV>=(~h9k2+y@d}^xA*1r0Fro~TAOE!7NW%s~ec5+D9rU5&hu+Gee?RXKOltfT3zExVa&w-r_wvg>a0ZxY&JYx_B2W2><$WW`ICqoQ#t=dR5vW~0s zqSMp$MdzR=Eg;|8Lm%Ux_tkad`8%EZcj!5%539$$vt5fvj&~@Np0Id2S65loz;MD$}$rf*KO{Q$;MW4~`^f-NfwbS-bmUqgfJMRqCvr_(nSw=&P`rU7;mKN2j z>g@3r?;hA~`WD_guxVxoQ{8RFd+}~l-EWb)$5h>IBJ4qno~ECCBu$T}=|5?T7DCUZ z!(L3BE{rZ>_w$D*9ZhFWORkylLhu0=KXu%d2}e)6;L9jBb%ebc$Vdh4LF&Y353 z|B1El-q)S5>CGG}Im1++SzCX(!=VP-o%CF@d4ti~s*lzxeY9b;U%Mn*r|W6Obl*N; zGH>5l^G;9Di8r0MChWQ~hxaCI>hip)c3H=8vB&oo-Nib{Zx+3n?&V*l#s6i6ou5k2 zK)=mfIMC1^MUF)?NiW}`S#FmqZqdc`HP2n?)SL#4J$4RW|J+blS@Gua#)lm? z^CExM*a|C>4qNt#p{}*Us$XlW>n)nP#yPj`JYlnI-TfasDep<2@9-X`y2(Dq)6Ox< z#~tdOj(1zSTxRgxz|PA&p8GYh_C4uw+VoE=ovn-0^w?*HYHG#noE|0n4mNlPG+9>h z!_JxO7LYlKw~MT;qZ#S!dQgXZp?j>bJy)@UVNr5D(Z15A%gMnP%z=AYTleiURUeC< zOw*OSP2M$49`|7SjPzB|InYPb$I!>sSF5lZrpr{9WMTEC)d52dvhwoBaHs7*`=xW; z4suUopIb@h_cl%7EbY=Lpr0IS?K|$MvsIVDq0P<}{5(ya({uDjUpQOKr)dav(!Q$s zud+^UrL60pu9LbZ)*Q{+gB35cj#IDn_0?DP@E^`rUCuf^U7z*Q^f7cf>no#cyRO-~ z{T6mTbh|99-s@|mbFXWs?k!p|hZ|>|Z#CW>v#&?DGX`%gCu@_Q9gbm+`GyrXkGqq% zEV_aFh4(FblC7Uu^v~%vWxdyKm%875cOt70*1pwP(cEUy^W~ft@P3+-v;W=J)`?S{ zw%?9fy`AR;-#gbMkX~mnSe^Oa+G8<2x=p&oyKpD+gSE9H``W2=r3bb1HzL zM<=WYInA=RKExeW5sOODW0th&=Ao=JSTu}W*|Udv_c{C4zU;J_DfHRb*s0viZGcEM zK9Z$d$J$!hEJM#N3d_CDv(D)?%yaDX_$gg?_4O^c)yZG|Tb;Vmt*^m5^~vi|y_}Ki zPZKRo)yxVr>pAiCnTJR72Di1fXls>yY;w{8xn_pRa_H(7`5{B7n94ZFTn zzlIeIE4?z@N7+|U_lY0;;+)Z-mrQk!6|e4XPT1~gDx4Wdzv1!sQ=G~dc>mQ z%kDYN)mzr+LYCjvk5AJPdVc%LT*164YUS_CVMdBxPlxf6oqEpN`h1!`BAy-g z2i-?ztKq6wfkJoG5Yp&uFS(r9QueFVVAh>eROTtbz>JLX~&D-q@s{gWc1+PlCtxNP$ zc748)InpvKv5-*JAFLYATTf0OtId?!+ z)9w5LO5DC1OST@nTt@L!#?IBDrcTO{tDHM39i~&!TXhS4n0c%{Ls{^VL(N$Mx9`iQ z95DF>PBK?}DBZ0V9dBf)o&OcqhduUKVZW|0)d7q8*D=)*i}b2Nj|ZKcZvN7tv0EIv zCEf3~O!t4j*3QE~)A)3v=MGif{b$zvS1j+R{AvP(#hZzZWO_I1;%ruy!#8C9wBrO{BrUh+uHZ%^uD^M9zM@WuXXyq;s)ji_E{cDKSkNZ zzV`cY-||+yeMZlv!=A`=W)#iea?;Z?4?P=6)(HE0B>Sr(R<88<-f_t}?#T2^>l(hb zV&~=AfxJm%?a}O7<|-D=;O@j8Ved=Rrxke$Z*BdgGS4O~YJZwH`z_LaPAomo*6D4c ztm;_tbbqDe{o9mhb2nx`y-BW(*txIDU4l)Q<~wz_FL!8mnC@+7FrMFP5k6ayIz`p zUhmXSoyyrQrW$1J`$Tbv{z!*qq^Zf5&eoFLciVdm{mLOdmg(H<^VMhhZV5vTv5uA; zE9{koOX>THa?_kJeN~gQT)Ry5h^?=_o^PD^&1oN7=*Nd!$2iS96ZXCj)O1o=wacMb z(yK1|K2Ogh^nIh=s@Hw=%wuX5=NLbv>7VEAe>0ZZxzaVUuo=8w&0E20sJ(}-e*@Di zhWc*t9!3&7p01tqS~+3YwR1?%EcN~Q0r~^G-_Yw#o=T<~WtF5}d1_A&GS&)f&bpMn z`tf@OQ%$hK+Oo$~i**02dk{Tm)pu>4^t#2&^c~PY=SAm0=SrW4&XvxK&R_B#$6k-n zqlTV63@7(9tlaBWHGQvkxFY?eH6l*r%x7Eil0D4=i;}Ag_GqtH61uV;W?v6o8u~1C z>rT!r-?vifJHfdVo|j%hduX$hik?#^@7nB?C)F_3N7lY)#yPF$<8PfYuiEd1+F)(H zz=-{&MLmCY(mVGBPnNAP7i}gg|5UJ7fM zx}0^&&3<+2y>8RG{p$N}J?d(DRIf3n$7H>=-;;*=-O9_Gkc-tAej}TXr%Ubr^vakf z-8+^Y#r(k9SGR6Wy8h{~Ev($xYreXk>aB&*999VI`qE;GL%LU~GsIM-tsLli(|7du z_8v!8JA2&9C}f9qf7rPvp2G-XhuzG`Udc-3$&St_uJ5NupLc3!a(-{$0X@VWi@opR zUmVi=mSRS0&xZ;leb=T(9NnUH8R)x8J*G5azH83_N<#LyuUB@me{%BDGCdb4!Q9Nw zscvsSpLAO7zI3bAW0@Y`^j(b3OLn%Ys#|51oXgj;s7j7=Ts@Qd&pzi~?ePIl4jxS3 z!|MB0JvQnQQLo6YSmN{+IlT>4&pKM|W6sg^9y&ceZ_+s}EWN@;m*dQ;?ECY5+&$TS z;tf|hN831*=MdB$egpcHL%Ik4cCE8oR#;g5ubou3rJt2QQran(`SithefhWXZXdzZ zG^;c|WEG;7MGc{j7Mv+L<;?saV{Udibvb>I0-NhhA(SI_$NOks5TnM04-P7d_w zqGxk@bkQ?GJqGC6m!5O!u|m)Kl4FHE+P_UdZm$(+(*1ZV)()3iC3JZWD{>Znwb7X! zUU`VMIV-HN+2ISz48A9m>=~{~-;)$J|1&e4^VK=fR9MQoBp0qS)Mo1#`nj5(pX!|I zRCHeSyi=d0o^AeHTF}9{zV~l+W(s>5)$B4YI^20{a&0}<|E!!Q-`lj`7k#)VD}h#6 zvZuD+sm$Ul1IMhe0jHcbM*S8@J<8r*cl@fkbKK$09BP>kORj3zzfje`sJd@0Z>(A= zKeoTr*0(Q?6S{%^C~AyuhHuFeB=BYMh!@|qvSfZJ(H470%lyeAmNJHE^Dnsxoj*+~hkR zW#L*l{ULeeH;1^XZYE#MZ*kTw$P3S`II_uSdaB^#IfAKPBW=b!+*GfVwxMR=rh1dK z`IQ^a?|(^~-$&p)zaecy&BuBEuIj=Ia8rH2aagy@gV*4^nWUP-YjIPpQ!U{2IM3--D|jPr@&leW@Fv{k zDlrz*xoOhS_Mv9?M;imds^?^_0^j3T?#ZYH(Q~jy> z;b&EU{G1wqpI49JfAKvPQ(aJliTO9q+j+(i{90ouUd4DCuVoC!Z!$*UwT+Q@BV!ct z8{_=78Dliu6gSmv#u&I6&M!2Lv2b&oJ3GF}!ka-jb7sEG!joj&RIT|!i=o=!rn-}_ zw9s?nrfSF6S`5`5=l7k)RJa4q`*X%L_#WI;_ZrjTj<~7rGiJb@aNevlX2P9uR%MM@ za95nafMLvryWy;uO*NQr$r$QMoZpJ^JsF-y z_SGjX128k^u*I4#K749~`C zLBn2wsWP`ivv+DxB759EDfov_9h)yauQB8OPzZ zIIYh(0k6ktea1<6BTnlxPQjaSTAy(m-i*`wj5F{SoYrTYg}36gKI1&R4X5=P7vLQ@ z-$*hp!aH%^3p6gnyK&y>GY!K~1vs-rzNusIr5+dDg>UPasw-dCVJ^dWbxidgU)3?x zUYxr{GZ)^6n`%E_*fG=roE1I3vSX-&IPcu>wH=Rn1iqZ|SOxw{lg%XSk}d^$pxqGhNl;7;dUr zt{V88uA2C4S1o*wt2REDFYp*@9&W1nu6poWIQPn~`tU;Bysf(h-p<_$@8oWScXqcWW*3}R>28mAb9cady6?ez zxjW(yxI5wV-JS78?ymSd?r!*d?jHF2?q11b;nXyDZ+wNj5B{mUFX5|kYLUAizSi9z zU+*4(Z*)I~f9@WHZ*mXDe{>JQPq~NUS9qSrD|m+E*LX&dPDPw?(=!sTjMFQ6M!{8Z z#!Am_b#i}O7Z?*V+A_aGrJ;mk3-hv1iSO38Z! zpW;1A$W)x()q4z|<~>fxYdF7L^`3xV$7w;{lkgijEy#Ncj^Wfg?`eFg_Y5H);JgLk zJqv$`^E+_wdH5ro+UUIie~j}RGw((G6YphwmDgbP|5L9EU+wkaaj(y$-@~b~-b{Ec zPCw?&hPUAKW8UO*yRBY7{n*@{c#GoSc#9Ff6Q>{ZmVkHTrux=f3jf|) z8sFzFL->B2nSi$}d=6*y_m+eI#!Yq6TLHd=^LtKjMOgVN!iKLhY~rSJ`KsV%I~WS2XIpbef97nzWRg|#i@b5 z25-|N zuMJ!or(OHn!c}nEwXZ!~4X0iEI>6O&+O_Wfxrk#n%I_kDKaNUoW@;ZmO`aH{1|sX65SxH^!M+`TD|5ab{M&esD9K znU$|U+#IKm^$mbq;EV#k$KY1DsoMAk!FS^Hz`nt7JKR+5eM8{8a8q^g4TbN<>4$w! zbG`bNU*aQaf;D13u&G$9*t`W)XFcoWW8>>CSj#;L=;aqt$L zI_w({Z^fy@z6tO)oI32A1n6P94rz50}HK!x8~G*8-S7>=hWxTz**?1iV`JR{E72fvEbA7&hYU&HASGY-P9yH_y;dgL;A((Lneivt~&o~RekJIaBoQFTa>2)(Mz#roDx)~SYk8pb3jLY!HIK6I$ z;o{p)IK6I$3;qx& z_nVn*;hS)J)Xes99h@FDvjcoHZmN2j_rSN{rmCOW5xx~SRfEh=3|-t;I6o-9?I;G_stxDKb-j( zJ~DF7<^0SSbS^dIQ;9(@%Z`73B>se=jvxp!hKnj@rxsqs#(kMTeFtq zjk8v8lqR^Tnr5wpZ^J3WtX25kS*!6*S!?jev)1B+vex5IWNjqoVBA#CW^KYJWo^b^ z$=ZTX&f1Dk$=Zg`$=ZR>%i4+0&)SW@m$ip|-^b|zvi8Cs;Pe1l``{08N-ygGyaMM= zGwUF{5@*JhbqHRCGvmrS0is0N8=B~zz<*va?Rn-Obi2I6X}69=ICLd^>k9Tpee=ox2aNfm4Tb z55Vnl)?RWC;@xr&5z-xJ9WVC?+!JT@AonQz08am$dklXz_c$S=aPB2@Pr##b?jLhc z;^T8q;jiSL#;4|c?!8Xi{IaO!ie z3x6xuL&yT0`kd>77va?B+)Vf#oSKuHjenP$i|@_#?$0ZS2l6W5SLRj3%jH$ZtK?O|YvfhKZ_cZZH_fYox5}%D zch9SZKblt?e>$%&{%l@7d~{xYd}3Y$d{SORa{CHSFP+yIo`O?Kc}?M0aaJSqn!z)0 zRwMJ8!!vPOdR`0s{k&F$EX7$T%xeQL!&xWHYYQ*O>AmyX!z*xl@4OE1N}QfB?;dy+ zPCL!(2yek@r+J;=tvKy8uQR+2XC9u{6+VsAj`F&}XK-3mUJv*zPMgZ>1)s-hQ+d7N z3pj7r=kDE+;EFhR#Qw=}WtYol*$7!Md8E_4pJ7WJ#xF*gWv40j^3umRvKO3%%v(n|C3)jV| zlm7X5J^upy7XKo=zJD=WZ^fC#`Iq2f|9f~t|5Cym;mkn%%itzB_1V81z76N?djAUe zcHHD|Pp*XTz)jV{zY1=NQ}g|+;np~_LH`=~PMq1Ge=Xb&XC~uc58s7z_vGIQ-;MK2 zH2)^}UYvK5{F~wXaArIHE%5y~tD63;a2K3D%D)Yc;Ph1f9dLJ?p31)y?upY=`FFz) z;5>2g?|~o0dE(&T3qOQ2+w|{)AI4cd^B;g8!C5`?AA}#pnOFD^!2@wdYX1><5YD{I ze-s{!^F@FEF?a~hcPstJ;i0&xM)*(Q&-hQ`BmJlFXZ@$~QT{XdbN;jVX#aWqdH)4` zjQ=A3g8wo;&2RAgo7sLB{(;})rFG-9Zody+j?=pRneYmn8IC_2|J0vL$ZDMN)bEFP z;oJxLgYdUFeWSks{tl;C^cThV`HSKE{Uz`N{!)0tUm8E?FN6Q!FN+`Ym%|VHE8s`` z74aYamGPtgD)>+SYWOjKb^K?44g9#jCjN`R7JkBC8~@c`7eD2%hyU)ckDvB8!2j?! z#LxH}mqO$9pRH3D4;xdG>{C(sSP8K=Djdf>MNdg1j0z42QEeeec>zIZs$ z4{sRgk2eYoz#9i1!Dyj5T%$7+q!MgpVY zJ8{}bU^Ltgr;P;0z<1%ak-%8^Zk#p}7zf{r(?$a0;rnpfNMHhdKTaD7OoF@Mw2{DM zID*qg0#o7cIBg^_4euG4j`s@8z#j z_}IV_{Kdd~__)AQ{H4G$e0*RzJ|VCIpBPw)PYSHUrvz5xQv+-8R|9MDnSu5Ag1|;{ zwGd~$BCrX58)qC3Y=+;#nU@B(!0+OWcY&?=XMt__+Q1HcU0^4^J+K=;6xf3w4eTZU zPdK$Pun+zjr#1!-z`x+s#=t@NSDf)BcnJ34j3dD#a4ya`5gJ<9>IK6%FEL;tzE(Ooyje{5PX2FYi ztKen4L(uSX#e*)qXV8Q93i|K|f|>Y(!EC%wFc*I)=*Rm8gZRV20-vG!;XDNh7RCDq zi{Xz3OW*^7rSO5l()eS+GWg@cviP82Ieb>I0{gy+)8_;$!gFxenu3+#c{sDLU={c+ zoNE`X1~0_9cERfK+c@+8U=4gzuqOURuok{KSevb1;@k@a>*8Mp>)~62_3^KR4e)Kj zhWPeiV|+)jDgI5c8NM^v9N!gef$t8s!uJQ;klF#9J}TH2K8Vvt1>3`iaQdiV2lxn1 z9~Ha@K8n*v1v|pWaQdiVC-^u{9~JBjpTOy(f?eU0IO~wXZty9b{wml5KOO8v$R9Yf zk^J6pCeCamzYm;^Q;YKZ!nruLCBGkjWqyCWbp8N5l>ZohWBwq#R{mi8ru-pz?fjv5 z%lxPDyYh$Q59W`+`{s|tAITqu56B-)$^&t(VE!2Vx%{z&jK;aA%O8iolRuu2B{*Y2 z{see6&K+F-B=|F&a?YQO@5rBuf0I8A-}b|1N(PzBhk1{(b&jd|&>2 ze1HA|(m8-r{`rgGgE-}%zZgD*Q~vo&;3GKYpZ^|w6sK(Sm*RirFC*jv&de}>IeZc4 zZYzHUtO{1ZM!`z_x`I`NRLAMJ3s%E5aOOep4{7F>W&;FMm$MffC6%`CVKpTen`1x5xlbDYt$zy+Vh89fU; z@OhjvFYv(^aLT+O6TXNu8!yO)FXP$2@A{Fq8MJf_f z3FjWRNM-!mB2@^fg41UfsRmcWsTD=4!_{$WMUfhKjUqJ(xdCULvq&xc#v-)|sfAN3 ziqyqx|39p~2YeJoRvj+(Y5+GL-Y9c{|7?J=9J%kpK4x)l$2nR$$5>jZ=MMR_s zhzKeYdIwQJx>!I!<^P`9yGZtq4uRH;3HuLzD3>AvGkl4ZanmuMTa8ZwCcks}T@X655grq`hPH0zr8l)!=?G6Wo_JjjNd%=;RkHRsbz2Vr<$KmqO zzVLczDlBVHgMoH0EN34GgY4-r)IJ!x>_f=e4H+ZZv+!Y%D`FptuL7BGwCCchL&i(? ze0)vFc*#B-9|2&r)7j_aJ3x9-`>XhlkT*E?*YTYp_e%R4_`#5SrM&<@1k$_Om*BG? z_e%RR{7^_sx39qGLhhCJRrq|!7|Ff{PP4CrFWEQ1#r8MhYWrJojeRp*Yu^gj*|)*< z_8su3eHZ-Hz6Tz&?}f+h@52-J58-F_{qS@90eIeih<*JG8MoLE<9~sSTkJ>hzd}~o z+K=KdLwW%FF?iK}0$#I!4u7|Q0dLw*k>(bp2e6;U--h%6_HXciL3#lDclbMy=W)jw zyamz^IL_h&A+^r&BR&YyCpgaI%R|OUjtlq-kTH_uBEBNzS=(_5Ul~$M9lzo2klw&? z71nV44r@AYzzD}J80okTn>qd>WphaDbKJqVgj{8ZC6KEOxylZK?*O^V4jaBB2>;;Eo#j49Hl^5dnue?uEl0QE-Ig zJ~+~GKOE(#2cLF407pCO!!eFHIMvYrzTjvCr#TYgbVn2NoBo{7`2aFY>=+F9IflUfjx6|*V<=X4n2oC)uD&Vr4cb6|pVE=+XJgPol7VQ1&7u#59`*wy(4 z?B*Rbi;IoH6!&UG-)xdG-o--N@QZ^7Zt&2WTsD;(+E21hw} z!12yqaDsCWeAc-aKIeQNPH}z+UvTb+Gn@zDOy?o^qVq6($$11WbsmMwoX6l+=LydA z9mrL4evaP`DO=|k@U-(3{Kk12o^^f$e{p^XFFMb_YtFOqZ|9FtbDf9fTo=e82-4nN z7xCpGrRTbY4}r{PyMDu0f{YDZSMe^$*ueEW-UE3r>AHcBhP;<_-NMH}?$@r{_*lrj z!}S-w0p#A{x`S^7X{|0xIa({Ev|R%KB&4)mHrUTqmXI_^8*~NYy^uEO3c?SBTnkru zIK))}X1gj9o&^~>yDGzHTy{bxK}z1`#7~BlzsrrE0(s_jh2f_{u7#@#ej4P8xT@i2 zLavCb27VUgnb#G8p96W$b=?c+yQ1I%*M0C+*ZuGfS3S}!f;@A%9>6b#Jaf6~ zkZq7w>}rSK1!=9W6!^ZY1N^|%5q{|E4EMRZ!u_u9@UW{VJmTsF|KoZT9(DDGpSm80 zCtQ8W?K4R0bEV=>LRz0I4gV$NIl|?|e+8+Hu7UWkA$8J~j{g=i*W?o5bdQ0J+~Z(#_XOC&{S0jBeikOV zpM%Nn=gG4*WEAIq0pAw#6yTnYZx4A2aL>d)2$|<}&%!?hc|v#3fqmR_33(jSC%EU~ z`$GBz_k5V@eiim}zYf#fZ@~WU0@8RPwbZ=?KM-=Ka4*BBL&hiW75KrB@ripCeh6fI z;$DN#g4AU9I{Z+`_{6;dj&Z+9$XICA#<}0ZkB9Us?#=j#klOCvik}3j?e1;($&lLa z-hrP2sqOAv_^FWE?%so+2D#U`_u^+jdLj4w_!lAbJnj$SYwrEMPyOR49ekgdB!Ex4M7CpN2fQy3gakfjqamFTn5I7YX?uGI!*@ z1TVOMgTJ`1!e8CL!^`d)@QV8uyz0IUuetw%zq{|iTW(7bYX%^158VQ49vifH%0k@} z2yGtux#BXO^02I@0u1(4gylVz;XNKZtl)7%r^gLlo-pY4RDm8(HCWYC16K1yu&?Tn z@sj6Wc&{f4*7Dp3qdfP+`#tqYQy0?rdLDq$p87Dx69*GK4Tw#IjK)2U@J%42aZe(? z8Kk{lc!#g`f{ejDo$N6Q2fYO`cwOFQhej z9>ouYv?fn)d^)5xc^=0PhO{P6U;GeAYx1PxvmmX>lZGD(X-yt4J{NKa_YB16L+;?7 zbo_A09o#b*KN4~W_YA>54QYd(Ec{qVyYmdiPlU8PPcD8Eq^)`K@lzme%`+TM^^7Fs z1<1J0^E7@s-0<9QDMDx__C zp2xoqX`7xG@NYn#Ry@=3OCX~N&rJL>$Wy0h7Jdcf?&Fz*Uj-RGdgkKSK}L+8dH6RW zZPqg%{}!apdS1nEhO}AF>-epZ`;O-g{5Ht@M^6EM2jm{)S%TjMX~mvp@KetUc*3&^ zp7N}Lr#Gt3OzN_ZCJnucwIL&J8!oUmQ+)v!JA zwXnVL^|1Hh!mtnFH(~qP>RU)}5Ox6nJ)}1XJB0rMGWH8U47-INfy2U&!V%%e;DqoK z@R{(>;hgX<;N0+2a8>wexF-A?xH#R;dW%t5k*!tJq<)Do)sN zUNr(=wc5S-YLJ|(Md52e@~?IuJ_6D^Rl6U5FJyM5T0PjT+5>P!_4;sS^*Gq2Mg!Qb zMk6?*Mk0K%MiV%%Ml(3SMvLIuT1#sjpM`t5Of-C@OblF5CYDdF1q8%tZCT~m04I5jXGP7CY~X9V_yF9!DF({w9CqT%Y07`Qeh zme0cdRCxmYx$-mcm&(t=Un@TcFIRpZUa9;7yjFQSyk2=Gyjgh`{G;+5_-Ez0@bAj= zpcXnG>Y+)nOz5jHAT$}43vB~~LsQ^Ap&ejI=p&!DHq5I*c&;#)8&_i%b=wbLy=n?o{ z=u!AV=rOo2^aT7U^mBMH^b7cL=qdO~=xO+$&~M#6EVWy)6 z%y#U7d5#P4Wk)o8#SsG+IAY;y$3?i-afweGeogF0+PB1hqI#{eVYS+lNY_D0nMy}=inp5BpH7CQLYA%I8*PI0Z ztob4=7cm=Fjd&T>j9368BWA!l5ih~$h*w}t#55QiF%`x~EQgOptb~0c7Q!bY7QrVY z7Q^g_^)M%5Bg~7~1cybu4M#+*hNB|Z)_BcQ_ud+oC6)njhvn;9E%?;g_qFQdf2b7) z&(&%Gf2!5Ua@tb6cJ0zG@xNLxkKDui@QdA>Jbv;XPt8K1?jdhl%C* zaIq2}E>`2Kh_(1CVm-d9*odzxHsPy@xAE1)7JPN_4!*kBj;|qh;%kWA_?qHfd`VqKq&SGbSA2}WSA2rMPyB(uPyC6mBmTzM5n7`}K1pb8)ClVMx}pre zt_Z-_6Xo#rL@+*D+=Gu6A@~PGCHw;-6dxlT_!!~B*B2gqeG!h27j^LQqAvbn@g@FY z@fE(8_!{3!e2afXe2;%b{D6N-G)-usjSzVWBjK=wr?u(gTtXcDDIp8~k}wATnve@G zC*;E`3FF{3wwfVsl5&RlgOoFbHE|5o6LVpi#C#Z#I1ZLeY@y8*!HJFFJ&B3hiy{R7 zqNs$QB|`DDgabcYxbU-u2R}ztO^k!p6SH8g#9gp9InNPw$a#*ao45x?lk-a=hOJ%_ zv1~P0#N+3RhWL4+C4Qc0g`Y1TBDeXX6S>V7-4f5k9^^J(JWOs2#3Q6!ARZ&-tKtdr zd`*lZT(KrA3-fq0FS1!7_1Z*UPQ3&dhl7Ko*ZSK)F}E*7gvxmc_v5g)MkC1M{bmx_a=Tq-^$kaDT`l$1-waZ)Z7pOJEzILX;96JK(6E5r|MwL+X@s} zSJ-NWxW-m1#Z6MK6n~I%rO+Dhg4V{lP;ZqI9~t`j{-xlTMx%5~xqQmzw^k#e2rL(28y zNm8yC{Ybf93?k)v@f0c7iwsh(7n!77FS1FwLFAEggBV824Pq22H;B=s+#tr1a)TI8 z$_-*7DL0DAq}(W`kaDA#LCTHdMN)1Qvq`y8yhO^4;$>296U!Snf-4&*YTLzX{C2Sx z|E~BH|E@TWe@}die@}dmKO|gD8bME!MD1e{j{jIx#UB>c@rOlC{3jw3|B0xDKO$=5 zkBB<>|A@Ny|A=V(Q4xbbDq``+L<0VpXpBEDn&OX(=J-pZTvP6?BDg8{R&fvhvIxQd zCMw~76QTGk!hydcT==WPgTE@m@z+FE{54S>|GTJ(|6N4luZvpv>!LRPhNy$TA?o69 zifH^z5re-aV)3^`JpK>S5dVirz~2^)@wY`&{GXyZ{!h^oFZ9RoLhpmu^(XMU{v_U} z_ru%t{`der4y7ap^(XNi^?vwHdVhQ;eE`0*J_z4ge+u7C&uJb9^O|SD zVa&V@Q>=R;UCo(;vdr&;UCi%<9q8%@xArs z_&)kdd>?%^zMsAY-%o!BpR32VXawV1Bx=L-w)kOsd;DT_?Prw@pJXd___KO z{44t3_*ZnTWumq~4`@l>tCz#Su7~4a*Q??e>ecZJ^_uuM^ho?0dM*4Sy*7T4UI$;G z*Tom;(fGxB41Td5i(jJ0rFV|b)SLvPbtMo4T z)p|GlYP|=3js7rxjs6IJt^OE(t=bia->YxOzo+lSzo+lUzpuZGe_wwO|AGDi{sVm<{zLsE{D=BM{676-{675? z{6YO3{-FL7{*eAN{*e9){$u@D{Kxub{9*kH{;+-x|A~Gb|A~GRe@qWaqL0|52Za|4E;O|4E;WKd(>0pVz12f7Ykrf7WNGxEBZ$KHGMn&n!Xc%UH<@oUEhblp?`$Gp&!KG z)IY}G)IY&%wrhCJb{%iA-NajLf8edQKk-)E-}th&O05`m+d^B>^Vl5t0GkURX!GC$ zZQ=NGwyOAYw(9uuwmSIowz_ziEgSE$<>1}6JiOaB4DYdxzdrRUCY+RTf;-s)ePdZE>qy{L)tW zaCxgFLRPkF!8b2_##Z;+PO?>9+n4ydwy*H@Y+vK+*}la`+rGy~+kU`5U^|C@!1fb9 z#`ZHl#`X)ozU^0hecNSxtnCUu)^-gaXSFm1VAGNl`R)d5 zawDkYlWmUVIOs~wg5k+SVb$bZSUovkYh$ZJY#Uo$V%ylFlXt-wV%ykaiEU>~AfI-& z#^lr9))e2~)*PQ=Yl%;>wZcDWYmI-<))wE%)(zju)&t+!_AtJ)?Gbzz+hh1Hwm$f- zwkPmiZBODq zC>~8gGtkSZwvFRQozW|35n74$(NCy$5Z~yCng{c9bZ9bq z1HFTepmXT;dpHhs7=43&L|4%*P9fc?Y0*fyG~Q2BXFQY(8iE#~9q0;*4AZpMs4vP! z6VVp*6G{jtJ$ec4LD!J03de=|qH$;mI*D$gYE?Du1@scKSJSj-(G2uDdZao(bA=|O zAJ9EDG_5DfLsQTn^8cEeHXoft-=Uw;RTLG$zR+pZK2p=Vp`PeDv=F_IK1Ns3AE@fR zTthSt6`&8%Ve}>X5nV@(YSE5S2eb(_i=tklk!T89g4UwV=oIQ%o8RU}Oh=n${Z)MtSHL^gH^YE*@P&f1&5Ll>L#3ob1*trI$g zTD7Ds(0sH6{fhoZ_a<>)Nai@vH>gZ&O?v{JLG9XbeCQOa(Uv^W=jb9@(~fP>C+G`Q zxjpR-bwlr<1L!P@OyPyXgOmZ!zp_8Uf zMRU+==rRiGO#4RnqD0gY<)VpbHYz}?(OYOII)sj+Gw3R^cG0wObT5iW%}`s^8Kt2N zGz-l`i_j|c8@hvfb)_AnTc}Dm?rW$&%0*Mq+h`X$j6Op@pzA2AJAE;F0u4r!&?WR2 za`w=)5oiLMisqm%khdrIL$nU4W8iW?1 zRp>KRw-0Rr?M4ZYbIs8&=oVV~1nmZWh>oI@=nUfP5;Z$&h#p3>&;oSpN$PVd?GNRk zW$0t{SU>JxX_OJVj%@v@bEqn6hn_;S(0ml+r9VW8s4W_e&Y%nEDhe8)X_b%%MWFjp zJZg$Mp-E^5I*J|}NZu$9Ek{3~ph4Ud(PQW-Gzv{cFQJ8~dOCFgy?_p&>nQ#y+Af-k zmZ3GM(qPUXEk(bgAsL!B3{6FI&}(QDdJokc!Y}5cCMX~E&E)!`=q#=a>WC(xuTb@D z?*C{bx`?uevY#BvJD1}^1JFn48}vXP?Go)rA^FrX)DPvOY3McdHTn@_pv`D6`UYJ>w@`x-n$`xrj+Uc+=yOzeBynga`V{pa#r+GNMnO+g z&Zs}iL?h5d^a6Sbokh2iZ8RSMMs5^=>Y+v`33Wi3Xc^jzo*KjTL}SquG#kB!mZObm zJNf_}M_(b=SjrT28AqEzGsn|!pf}J_bP|1oexJbo1c`~Hn@l@FS!l#_94p$04x`Oe z*am%zLY}A0(S4{c8iHn{1!ytainOVm4;qffq36&{G!MOj)}hU4H#&)2FVGjE2T&uF zgi=sf^gOyajq{sM{h2}CKqJwMXg*quwxRdXA@n`EfUcotGb!H}sc+~Nv1LPOCg^d35dj-yJmDOVJYvd{=L0maN=oPZueonE3pMo*&HxwLV# z5nV=qqu`ghE@%bXf<8n)p@-*DhtW8+ADu%tP{mg$pZVPDP#xr6K>J7Ws2R#bW6)%D z2$g@8azta%F%HR^~8&`PucokN$Izzk zK3c*UWhr@}nyBJ3`a%?eUPVjMI`jd0b2--x9YV*^{uP?`AM^#fj1H|N9GynP*J|2$ z^gLRGR-sL(_d41y8iFpMJE-z{&JVTT#61~3h8n#^7+Q;(zD@a|PH59+`eXC~O4)+8 zG6q4tQP4K-1E>n>huZ9>T&=?+A7w2I-?L;L85z!R%t-fiWQPMr*qF$l`IdbdHZC%N zZ@ZUnLgX51xOC4%PV%{DBj=1UVxNnw^^vjd^O1dhu`fgpUtq*ek33Sta5E$4`}Q#_ zvi*1DMt*Z5C!CbdBGyF8UPa*6MQ-uA4UtEuvbvAw^EV?$J;iqxa1d`rR-iO&T1(63 z$m?%1UL$O4WFOWD+O*b|9g)_vtp3C8inQ<>Jpsh-iF`fUaC;*!oneI_Ved!o#*vHo zFmgA)XH*8aKe7&6l;M+~7b9zZCv&M)@lxcHR(xiaEq;rf?sHcoLsYD0`8{$IkNPt9 zMr6|mjC8jmCwIsxFuX1JP0lc z9uJoWuY}8jKZ47HPr?fbGoV}*-Sg61JGya~#cK?YejPu9z zQRQ*g8ls)E)@D^mZB~QSW)(L* zG0d&Su=0R!az|BBHB=qdKs8YWibVIKS|XP38jjU!i#S#d#Iaf+j#UD2tPY4{ZZ3}1 z0CB7Wh~w>l9B=(u2PcxWI212hX$?ec=I$QU8leQySxZEXMOUo}YKoen=BNc~iIPw& zl#E)VHmEIXhuWhQ(M@|$bk{nFNBExONBEZGN3~9^0d z6l<8zT%%1A>$PXaMs2d#q&+9z(Wap1(Ny#TnueyM8EB^1&Kid8tX|rIr9##;%$9F^TV|~Cr-u&<5o&G-gww`&^ zeY}6)$G1Tr;_dno-kbl2H{wTm*ZnEq0ey@&*~ge?{gSuOr+BY?nm5K@^X<=P`R?bl zeDm{J?QOJKl(lR@TgAPWcSLQ=Hold5JK7;)Ej#(%>0KhhvRfos_K0N5yP~yauV`a= z54|tiT0Ri%EFX#oE&I@Z^btCM4x&ToV{{mOf{vj7prhzh(ZO;I9Y-fbU(090Yx!K{ zT27)b(3j{G`U;&!U!!l(x9B_cJvxJaKxff8^dtHSoku^T3+NYg5&eoTq08tubOl{S z*U<0iI=X>wqFd+>bQ}GN{t}}sf1^7{(??k>$chBgkqwpM8>!2p02HW?w(x$~5`?&A zSjy{DE%)ftEEQ0QKFd;3pJ%CrDx*+jM-JpfF62fY6o$f46;u^fL)B3YR1-y@NOZ6M zx}_G1(wA9kqx(=DeTC(IR2S7l(dYpbgX*JL6o=wb1Jn>TLJ9gROCoBludy`I*IJsQ zW~e!8p|7*F)Yn^*P%D&-TBA0oEoz6_qZECUUy-^?ZxPHX)1nP^P)Q?$GQ9qQXe{Jcne{b>X=Pd)! zK>cUSAe4@tLW5BT8iF!W7RuHyTZZa4Ejjw1mRyvl2UzpbFf<&EKqK`)>nJ_Q`m`Qw z9j)JE9fQWAae9b#yk5~dL9b+;s8_Z=gC?P8(PZ?T9%`L}p4T1LsptjWX`QCKtkd-> z)){CfdQrdMI!lkS&emhCbI?m@E_zvyx6VVap!s^Dbpd)+Z)|-Hy^a>5H_#$fpf|BD z)|*oT+)tw2^SZA5RPP3SE>$@(_hjJBYy=pDV4 zbsO4_cA%YT7ut>Xpm+6T>t6I8dS7pC{Q!N4_M!cH8|z2t06K^cp^wpF^a(nmx3m5S z9Yvp_W9T?Kfj&c@>m98p_0HBW(3g4->nXjb^((!P^)&igf71F5`WAhMzDH-!59lm9 zhkisqq4Vfx-D|yoenA)YbnCC^lKzzSGWty)Y`uc6>N(bH=y!d%^*XwNZlYWI)7C%G zZS_(u&uY&v~9FTph$GD z?M-Vf6lL3Lt&Q%peQB*@J7v8e)kXDer>)WG0ThGkqgdPb);QZ4YdmUz8lpzFAFK%| z5j93lP*c1tm)!S*U)sGOxMSBPnoW=@aH$o zbW?=C3@xl`%`PL$RF+nDndO)HZc61|oo1ACj+rh;rIV$RXXY}@bR$eR z%5)pXNLH^X!t<0F0||%U#oDK zu`bhj%yb?zUAP$*?hDhkR^}EXOxGg7zu#oj4K-b^>7F*-7}Jdl@So8HGwd1DJ!`t> zO!vI$=9q4g=@y%Asp(dlZoTQ=4)E9AcTD$#8GFuj=L7xccF}adneKPf@vY3h(*4Wl zT$;O_Kdip#8knw;=@L!X#B|L}H?Ew&9gQpJ@0%uH{F3C|202U-rQS=--Vg3is>Ru zcczj*-C5K9Xu9*J`>m3{wqG^f@20z<(#i6>VTRo@!)}>jx6S-O5!h51LE19Y?XmmMW54MRm~NcIAN!2Y>DpVS+iJQUX1cHl{}y9Rx1*Ln zY?tZw)biJ+J+=I`DJsgJuAb>0i1Mdu$Q?rkfMxZ+Y`f z_kJD!5gahxjTnE}Ez{jL-Cw4=quf_o1o!^qip>L(nB=)?c~o&QY#uNa-mpkE516dH zwgr#f`_b^l)nwHTFM4VhQp)Q2cX5;M6sO;@2=Qaaj*&>uK0`!nW^|H z{M@=;al7I^75*u-Sie^OXT|F(#2PI3c#on7er~O$7za1;u%as}y%A?pORm(N;m` zSy8dRVzOdq*wwlQZWT8}c&ntiM{%#nsK|S3<;Mm{zhB6!ut&&Ru~i%)gm0IxBy(P- zxI^)K#a|WwfZN2($}-JW#XE{Yp)$k?TLsAa)+%5E{)WYw<+ii*5Aj=tWRA*nVnChy>Mb|uxH>>e6K*c-|V2H z__^x5whDQ6){t>^%s zu)HkigXJ?~By$u;D2`T?b>?9C@ybt9oT4a?@L>6A%D<>6ukwB&ufj30KaRBu?XVe4%#6ZAVXZ`DmRr^M6zdK zp5nVuuY3UBtaL>2B)ncpQmgze{Iilw`FADh^~&<7sGrSvBOCMtoUHbK)$$_#t)OM_ zs%5L<`|xj-&&^8i7Q8_ZlJ((yP%nH}Yr5joaF#CjeoTChr>|=%IRusuo(S6nmrbIM z1xLdv0ezrWSsq*GU|C|F1IG}u$?-xmZzqFgX;084_X~M_XRBj75p0yC!K<>?NeSVqJLEk^qxJS}S%@>;w0R z*P+F_8CDG03w!b{wDS5&?ye>G)h$Z;rcn>}ls%aAd&D>R=R@wm=^;HHmgyy@hsf}4 zD)#k|C4@vr$sAUMe23qv@~j&rQ*I5Z*Na{>LYDAVOFR7DkUp?(l+59@H4~o{G726O z7bMkDoept7LM;u6h8AmMc-7JtdLrajo(P$!n8x8N*2_Hmh;WI=#rQpIktb8s#^p=c4;o?y*XB|h%Yx1d&4tOL)M zeG(P~?0|C>PXtSUtCA5SkH21JYpUGp9(bgZ2kuvWX79=s`%zmI_p7ULLe=eB>dNj> zA=^~S=27yBq?YT|UtV|VuT_#fTlqL4S1mul^OfbkE-ID{z0XT?3GD;RhGr-~9VS&g z4SNP27${5WI^0=HUY(t_=$4}#T$wuTZUACUG1ykkM`?|)}hkhqv(MvLTV}BQt=_!)&7X`{oy71 zNO;xqtO}V2yV{p1ZcyBz!uKm4Q~U<52)UsA4MmY7_gFzOOtA~>YVV``n~J+s$N}X~ zDgPt9WWNfpTJEUunz=HcXhl9;NDgh`-jHr8Bp+V2On~h|rYp`@A(lLuvOK(Dk>$U= zmh6RYSgI0I!;t_jqAR@5F+ed#g-nGt9Gf9Mr{ZxH{;lFKD&(f3p3h1gha1*#JfPS_ zu^s#-NY>sOjt$D6gpWJ!Cb&}16bfZr+5Xfa@HO%nFQxMM=4HLTmknx&%vY43KLlA z<4l0xIs3x%&dKmM=PEeU`7tbTmYXQ)P;8>uPH_O7>71(gvI;q*__^X4Mf)>y+Zu{> z6x%|JYoKDT;y5_dxmj_q;z7l0irOR@8wLxUkucEJM)^T1e2wB(#dj4yh6T=(%Kr%~ zx~e}bL+UCfz?se`6rWNdxysK`ek-)NE-U`2XqzmzO;PNrI81ROw76bSoTs=*h3{1S zQ1KJR&lSH_Jg;~~@wTG=oXo$fVw7TxVxnRz#SV%+6dzX{pqK@F20jN<%gumW#Zq`o zybBAQXBB@{yrEceiVXKCMksbr?4>wHakAnn#UqfXo2hcE4vJpIOn4%A1w1Bdyr6M| z8LYSlUT~dN{0$a3gQn3&TrrAGVS)2u#TAMh6;CSu0FQ|q%2$}q3Nlv<#SSpgovk<; z7C7g^ithFBK6mdKk`oo>>aP3T#})sA1i;5F$V zh8I0@^mR$`H|G{Y?s)idc=)7ZCUk~vg;8Na3#D%j8%K46cRaJ8#d-`r8dmKM$w%R^ zsH8IT>=xjMhi!q+hh0&=+#>12;M1PYaE}-R9}SBrkbDq+R7XCE6gcPL3!HDjGhycy zqZdoxSTPx144b0(rs8eIz$G%gB`hDlN^!el{iU*G`YH~FS1n`UnXq+=TVPc9ABtj` z^mP@dD{fJ&vRsDOQjAw@1#i2vl|QX`LGghVGG&5dTgA1Co8fzP_A39q;-8A;R>~uJ zQ1M~KY#0^(p5i&hYl_xYd}bj$S+OfDa1Mh};qNH!RXhUEg#D%1Yqj)V#gU4OVO01} ziq{pJt&t&Z6??$j?up9pQ#_)0TCv+&nXdJ`6G%a70*F$c+^J82JlSSNX6%1fpaa43csLu zOR?RXGNdOg>lv^7CyHMw{tPLfO_KSF&%mhg9f}{oZSG5ok#EVdgly3T&XM>6=W~iX z;F+)=;i~YEw@DM;OR+$4wcC+3xT}_%n*r;HvN)ia#q>-O6YrygytOK3n;B;qT$)-=PGmbW&WaxLvW< zHW?ldXF4B-a|1HqRm%u?+g+fz8kY5(Qv5;jisEf(_tf1k*#NF`=PQnd5mlB-@BB>h z8(83s*dbXL?p4oCbJWv!RQO~qj{uz11!y6D5n7Cvpk-(UT7}l4xA;BIx6w!1IdVRy z9YlxF$B2J@`*zPu%}Y;9%E?I`nUa~F*JEV1w|n|1Z?pO_TGK&UL%d08X<7N1c`5yy zH|X0}2DTaDP0P>oCgqOIOl#iX2usP#^X8;^v-6Vj^9E(*q>m!ctjwM{>BUmD_2#7w z>g3HEo|QAWqc<+`u9)H${dj1-#*dgP?0XQXEi?C#B`B=WKf%T;FP--9|>>P=4JnG@Y6 zxpiz(e8aYJamn!saj}gWwoZ;~7#H8DP3xG%xVZS_`U$wWxTIDw@o@>sNsSsN#wNCD zkl3J2tAym(HgV*y@>LhkJVb*3xr)ZKP3x>~-qij{xvjFYDDA?UBIDYO$d>1xk-^3D z=H~k9Ocs|UxA4dtkg%0^Kvs^oyEkKitk5!~V|rRnR&LgSym~3Bg5-^?XVj2-DJq-f z)U-ife|gmFo|l#VP*&!^Zuyy+lwRk4SzU6nTa7n4ALts5l8#3v=i#MV!4+qO~t)(vCh5)vCUXv9G^ zPn4~#FRrxa(a#_GUuvM4j`~|z-5@9oEB9rDMyI7w z$qN52xo;zt%q33cLiX7lz(`eLbLDnMc**U2p==lLFR$+29GW>jQ@;#vNAHk+v~jt; z5ij@9K&33KgEH0#Gb=;1zcNG{l_9#6$`JiuDg(JTRC_9U%n3#)N1{x$zhu;3Ntsk9 zib@@Gshg`n-_aY@j?0rYJT*PfS7_5)Ffo0Xp@i_b_?@#$Ixbb!%$+t+j!K-)Ezrx!ckcI;H%%3p5mmCt zjL`q>D7$%wWDWD*zRhE7XdFa|@<=cbO&PPcQJkt*l-E*L82=%sWaS#S)NbDXbg^l9 z-0IZ@mx;`pTk5U~_Y^A=(`6bt$<8H(O2}xy95=|_s#NM`(=(;VAZlcPwIdZ=vY3p- zs?$;Ny}bR%e0Z)m$LQfZr4CCUNQt*k&Fr7yHTs=WGm14rX((~Z(R&#eymL-B?|>X{ z?jYl4qH36#HeR{5=@|?ljQCa~yQk4(89j}P?UI$9pTQv%UU6fqlBZ&X(gCLr;l`zM zlZ``GJry{*^vxO=2UFtmHZ%`WnPMY2%2)+*OX=tx(K;(Fe+UC1v%aV}qa%+-FrHVntw)Wp-};i2+_qV1>Bf~bi@rgrhug5!&_p9to`k%Zg%wKu zS)@7?>2Xw4;Rr$fS$L+#5P;-n%`y|HYu&*+Qk8++UCAOSnzOv)^yhJ*LuS@+qn3c5dT4`EciFIT zm-0A$y;P}pDH$*8UukzR8CQ65RG!7}r~dP4n~^#&w{RHd4^HZzn$eT~woT@+^qj0r z*_9ZbUulJB9&-H#GMd3?u6j~oBRRmNu!@d1RGN}SWNfM0m5TSZtHM(=`WF><*LXL! z)GUoqIqG>ZH!HJyUJfIA+4ahcC?DlA^G27xVSK6CH8eu03yqXBO1F5S8Zq)LR1)@7 zv|CVNCHrg@C=W6@m7!sVSM_%)u$wn6E2n>(5%O`IB9zrjg_kTkBanU8ZzxN@N6tw0 zt8O$sb2(+%;LWCPBq3fkt^USSxy;#!C~Tz0-z9hD3uRxiYF}hzbkN41a>QKN{mN{O zaN0~xDr1Yx!Ln_3%IfdCgZT5H2fgcVY;5^&_iH0X$wMqXG*0bGT^QwhX3GJa9ID8Q zP79J#Bf0W#M!d!|K}zO;ELG;lrX}yhW`@ep^R&w9Khl^{pfB^)ceC78qLNox1ZIJ(>1ncdq~@qzQY9)` zBu1dDAdO@N@fEeI0d!sRvAZ)5W2&9{9&}}eP-%@yP8Y0>rb}wN8fzJGC3oWsm6bzn zTR4tTe^OVt&MC%(j?tP`xV$Lw$`v1Q73q1*Vl>jpobqVS{g}Nf@w{UsD0yV1hc+;F zU-H752c?YhAm;1cRS5Su-xH|1Xew-=H%~ok%Q=`Nbv@)2Q&DCqsJ|#i^{Alc#FBE- zikzgmMaiRA8_H6upCB(^N@iM)>b<(>tKKnLR$XHZY$TAylQU42un|x)Ltm)8P%1|@ zkfSli|0SNe%xF2p@wE|om_~TXY<;0*8>h1Eo;u9iBkLjWz|^#nvXz-5HzV4pTE_5M zbyO-KD@QiM;?o&M`jWfzh05Bac2~UiFg&N$8l967Uvm4>LmQ~PN~UdCYN!z?FHEAm zFhx2~^|!nZ#iy)f*%@i&<%}(ws>A@&AJrz4QM{VKQ{}FL<+gGD1jYzN_EoZX@ef0c z=;YLlH1&+qJ%8XpW*xl7)Q*}>GsaX#ekEFfv2pR@^mU2q<`iG*R=!Y*JtENXICo`y1>PMR*e)TLb~RAb4JPm z4BcDC5H+)<<|T|A$kCtP>|2a%I;ZzfD;kuN>zi`T8<~`mo|^0R&2Jd_JjC$bo7p3) zJ7<`|9JiXKru#RhS&Aj?;>}@ha!9Y-9y$5B?0p0`_Ccwc1AUXkMt;WgtbdZG=yCjS z!+fLZF|%G;R-C-=C`yYhIXDjY|ICUuzhL`M(udk+Udz zfd3q9RBqoDW5A%Me+yri7{?&zs{Qr9NQoG|NU>+@+*TvG>lNL#ugb|Tqg&w%79(Ht zhH1Qyq7@d&-5Bc1sT?^&X1pa(U6ib}@}VZ({}+cnFnyTnhjMv8zyn-f`Y@*SGW`jB zE!Nk=a6#m(zj{NJlG%!vS_5;q&H59!l9M-TPE}2GF>d#5=Rex+*%|41$%E+gytHs% zq}(bca~N;Ad;!I~ST$nzci@~r$JFd1e^D3mQqwbeTh%|EcS9)yGkMXGOn>Cd%U6}v zJ+|=fDXXc!k^2%F$6f3XnX1?D;j*JE`NYNv<@)oRiZ(ep%tsfwZIG;;mvJuxcYn9x%ip;Eysa@N>q?FF)!!0vvet8t z_C4$}Ig-;cH&qR{&4X&&eNbvncH8{SGBnRQct}SDMD% zTwbT{xf#BMz9&o)$$HvTK2VrX1->k01S%z_lt)!EGO9z-W2Wu5FZwFFGyNeQrT_8P z+{U<$#S$Am<=q>|voOx5WLEOQMm{6?j$V!Ai~Ma=IbWY8o0oS)9=C3;itkS0e*iSf zO?K$&0kQbgVTs7Qo*s#3xI(^a@-jcWNKqPnfiZw95^P-1yMnp;cZKn+SS+mYnj3F< z3hz?>GBD@S{WIwOi%g+&tiE$!J_lW2|C~LTH3f`BOk(4e-zH_3!`<_8a zo6FM>SKZ6BY8r#0+^h_u{b!iZd@Ws@+S+(y$QGPj@c{Fw$vh^rQ)5koeBod8Eti?7 z^p{}19Ta(&Q+(Ej_`6z>y40$($mOjFH;%&jf09%1#pVI!=JI`ndgvlvR=rju3;(7H z7;gZ4rC@YeMW2P$M)EFJthp3RUZjot_ai3@a=T}H(|D81$W%Rf`s0l2Q}hl{WD<_u z6~>p=@%wY(%24uh*vs8P-3@$mXZ{4V7j@H7Eyy=XNbViIISg%!JTsanSR&9k4BsmT znTeb!DptjeN5m3Q-1=L|s+2NhNPeDt6-?Ky*1nWT=gZ!lBqg|5FJ5+-TvG1zvc3#U&l}m9XYS1YS;GsD(Eo76 zOJMnuq{zOEV@S#D?;TMjl#?nMBnzWRD&9WQj=E%Jq^GGzPfn-!@Tc&pRF;7nTp2?> z7IF|$;$^&VfR>WUbR%Q?qA6wDQ}+*9^@~Ond#7&X+B{Qc{!ssntTgq1YR*9ZFMK!A zofT3n=ou+10=Ea^NWszM`X8v-y{i54C52p8RbTaGYWMzemw5=jNMHTuZpFkbeMWzI zL5j5PV(ES7nViaSf&~}Gc%fJd^BG01;9~d58N4=9H+gx?{uhA0NOhffHA}zje;{En zo>z2DlW_+AMp}3WF?SkE3bojXn;I9nSh#QfldpRnDc|Ur@o{YDy97L#c4v`*yi)Y6 z#Zsuw#=m{B81pIT|Fn{))K~kILOe&|Uux7kE1!xOShUc>rYqxiVQr1<1S7FH!C$H%r}aZ!V$*7cKOTQ#iTs0}Nx8r6?YY}K%J>!jpH ziOC5G4HM(zTh(urP(LxYVQg}8eXR$lRdPOyMLmQTPQkD|N2X%Bg=I82>WRPWxOYi9F<yP@%wZml{~@Muf}x^hIG zO^JC}Bel#`W%{p^RVoE1@DEQZD%u=VtG`r9$H}Ap=LH!=`Wp&)mspTN{-xQK8b8d{1CxQlbkpb7tWH zS#vTJf$A4aU7A1=;?;nf$z=I~0olBaZ3_o0#^0(`RjzDeE>#x{x7fnPR_w7cR67#>s^H6{JhZO(#wp(Ub zqRQ}c+P4$lC*wGbe|$M@L>o;?c5=owGcqWVt&y2LS>F4yUGay{5^sx%FC1C^x0!Jx zKbbS{j*TPwhqpRLe905`g|fZc+-M`EywfmFOJ3td-)>6jON=;qFe;IpclxiNjiDy0 z#LW}P+Zg+sZ(EJO{nG)eHEK=&<=txW^k$c91Q&a^O3?rH?I}r1_BI6l*9FJwRQ!jo zo^mPMQr}4$hv&ah_=h|tj{dHXG0Cn;?c<-{F%ti;!#3kIitfn&SY9-&cwH@WBPyDR zc2e51U-n?O!n4DEg}oYKr$<}URus(a4(bZ{C(BsU*68JRk5c5 zf6@E4G`b-F9k}S*8FSyp`xgHz7=qdNU2jzgR^3S9f^XjriZ9DHE~s%D#cl<~UPPqy zFYywB+>2kKBCj|~eQUu6a@wxs{6E2kW8;5Z=T0i4)XmXCDHGymqS7bCiKaaM;e!@N zWYJGP_@-m{+=;K)%#o#ku=6joeqUfE6K;xwUFUy5U zeAnzVVX6kmF-55puW}EiPrMRSa`KX(;#a(I@{%ZK%Cmf*qbZzRB3#~v)kI=uUa_f3 zqDoFp64ZTgdbZKN<=mbB{N*e>AIr=esc!4WaufAJ+(=aVn{*?N^DnZR$OvnmFY|t= zznu4EA0=;1@-sV6mJ-go>e7Pc%Iea>{~?%ltEHu8wPI<(tb!{om^E0X1+#p}AFRwj z7L1v!zCV4e-_(zj&bMW;wGFcHRHQ60Ws)*8v*hP*c`v0tN}CYx&qbMz-qhTD-q*A8 zwH0&Cg&&b^;7`_28ecN=vNs}7zIf)p9;vziA8Bve+*You3+uZ!55+Mq%ugVheF zbOEMwC^d9=>=BK_o|dw2ZK>bWB)kY_79Xg89nM@bJ7rn^x)EsU zxIUn-$N%$=pYdVi6*vG9{IKzDyf|z;!>~>Z zBU$qKX!M5eK5XFa6m$1=vO#YQ{=a`vk_Vd^FOc3MFX><8%o!%^J5q2YN{v8HOco>7 zksaZ9Sk5QlSe_jn0-?(=8Z5_16I3FjlSP7juaIsu_>i{N%NOPgCgq|G=Vs-k<9FDe zOsvIMNT_8gRRw+m=Z8VA8<^OKSe`4kF*MbhuM4{{@goce^zc!mb=Wy9THQ8!5me32pUu18@loTC?)`1|8V`eR`{7;ztx@~_@4I1t z^hft^Kvdj7AGnDD_t@~2Nx;s!-SKQSB=S{j_XKAS-zE|$Pp}sfv0B`EXp`_vGsQuw8d4f0rjYlj@XD9F<hFHSBmjxVp8$ERmUX9p*(*2&rB@x@X5 zymN-J*=(J_GI(*^J!%Z`9h|{)pM}oZ0%z+F{*iuifBt&@NNHpxz&lsGyJtGWQKpNJ zfG6;V;=cP}1Y}SN!hUJlV1dL_W|cH7tde;8sdvU$nys-{_)zgYsK$h#9?#bfff?n8 zA?5~ER<0DwSrr^cm9JqG2u?o5DJv&c(OLmq$y&i0Dq2^Zq_lcn ziC)m)s3S6w8XS;~fSMoZADIk564-!dkvEXcMN@#(S!W6WQtCcu-9N2Hw_MPV<0*_o zNop^~$_yoAHA3KKU9MnDi%W=WHR|pKF4z>*y+=1GBy0vwQh`{x*3T$dl%6@E`}R4x zr2d4i+%@ph8dw-&P+}XEJp8;88@aHfJ)sbb$FcoR?03Go*)BHSB{#AX1Pe6tjqX`o z8b@;08)t8@e6#Oxu*9ywl3R&br8+7HTkFZ68|-Kq7Dwyn2~&H7wC$hgJOShoTe#Sw zC~T#uFV%c_W)Of5j{SZK`PZ<&2f#FXo*U83yalnK8f5IWMFI4JW!nZL1#MTQ8R@kF z6AG(wU=*X0H+MO-k#{Seq=21HbMkdy{0?W96}&PuB2vM1AIEB~9-1bey-F*>yt?vc zFYfW*yA@7*;`12lX}*T%aY#Rkkm@Re0vayIS`9jXy&cXcUpKB)enG6J;#*05wHP#H zFYid^+97^J;^5;*&torvCZHFrXzYJQD8>d;!Y6qJfg`YylEEK$ldm%vu(VKqINb>t z;6)WkJ_cF30X3qv>>VsIkvM3U;5qQcjNOktI8VMCd=^gkyKK7SwG_^8A?$|+cyk?Q zs4;fmPzP9QzUgizt*Wv20r_ik1lJ04nf8k^3aRLt!#B%`YIliPS+kO2 zt0$1PmPg=paiIF&mr^nG0A4b^0F1YattnOrpfbB6L%%ONCjY^a5uZn7bX#lW7tJb>dK`r+5-|I(EK0ggHY}15pjePcz7hYeIS-ankP<{1VS# zeRjSJ2~$!-!!mp42^6nkMxN`{>g(+zypcjCJGW% z1wbzlBGsB}q%N$w5EA^s24L{krm#%FUMHDAcQ^<6WqcHAA5pVuACDS;ogQ395dx1I z->ZPsKzY<~&U|L1m>sDG^N1SEeQJU}N61lQenb`Lkyml@bDD}19S}C1N7Q%XRTC{I zx-w9R&U$my*rG%?(=Oh zrZFlxzPLEJY+YWSpB!FZoSh#Yo*qCGqQ&oy84NBHyC^GBMm|FDEq_x8VP zf#}|j8&%yKdNk~&p;SX!w!?>f`jJ`-B>NRuexpM*mKA-(2Ykg^&5qGQErTaN9`|W0 zT_Zl^=F$B){l!sd3PO!37MuFI}x<}bH1H`Qe?bhUzNWNO&Rvzs!5JCV_ z@|VeJARc?y%`39VZWO<=ebgP5=~j)Jd(!A5_)V9gWs4ARN8QF1Wn#}8Z$VjGzA*(< zww(B_>@VDwlNfG#2Wpa5BdP2kfm!&?q!cin{fSd`IB)6j|AL)T*pmZHC2}D<&4fYi zx-TLz$rcX<$@U1pl`R+`uW~rgUS2va-g<#RH&1xrw-Ij;BNk~*cWWF1p!nJS5lDY+ zZtc-ERs>CL$X-3(FV|kH$VN$=gw=@S+6J3-GQR5FVt=_YtgyOkLm@xjwRxg_yEYJ& z_EkP_%u3SjPv)qGJT*?x!2HUl$5-w)U18J1k}Q(9Z9D+6;KD-fOd?*+03JP9j7Wp^ z9N6l%1t3a2i4T<)lAr6)5>UR>?dDNjH}@FFx-B@iZNYJ{&L4Z3_?Uw1v6oM=`fi?~ z<=L(#s|6SWJz3BQC$sV~NSnuvvxC#-@zv#VvwPmWJntSHv=2|ut}f5dyO$?N2S?}K z=IQZK_vq}ndD=QTIcOrJ_~qrr$<@UH#G}r^342v|jOlOu8$g(9{Nru>Vk59O75+lt zPfdOF4{4oU9a}k>9iez2gXrZ})&y+>@P5l10Omn{WVz*eYL)8yKz&vz4qkEqnxDGS ziXhCL0(4htNXaB~V%_Hefl!NG(H6N9I={F&1{!1QZM#Q!CC?^*N+hmflN^>Pi^G^Q zH{aK{fC&58aHc|Ne)`+Q*!uRJ{Brv;-i4N(o;2?6`|a*v(7zuw@7tex!)|-{aNiyE znrF4R=1m944Lnq=!>>gK0Ic4;52Wp1YRNFa2Ovy@ZYZ;QXxHJnpuxuC9(Qx+l#pwi2xq%#-t@_SNO(FLzOY*?htVP6ZVI z9Z=5obTaCpxF8QgVn&)W7YwR#ML#93mM06AE-j439vs!7{Re$p9)n`M2HA^`q zIoK+K1dOM>i@TDDzC@O+pkYg@~Gf%{A(m z<)eHVFO$OJoDd0WT#m36W)zE(fWLm7h|6Xy?*SadJFI1JW3gH&jHLh0% z@#R%~;oK`y3Z+!)HT{MF2SbEUeM{*}FbTL(!*3@Ta`$*)quKnv1zn`aI2neLBY<^> zJis6{i?a*(DFJYzaYVYhbOR)u938!t{X(3%)=5_Dw(9z+=!Qo-|9PVkY*5xTQEeGx6 zqvqMgX{UL3&^m3OAK~5>sAoEtP25h>X&tt~KTkRr$A_n0N2cz^9DM{LB;xC9HH@ymZGrmIR4-XkAST0b|TTZRD(pI zy0<0juw#IoWJ`ZJ21oL>oB$crBU#H+Ur7?Xl2lXZ%Q-!5bjI(vC*TG`%a`LbP-dRx zfc=^b(qF2sRtLDR>+-a5d3gZ!+u_m0S-X9Fd314pbb4}m-a0zRf{Ht9TJ7`pB_z<+ z35Lkg`Qh2&;pxdi3odI{XJ@A;Ewm(A`;fM^FK*-idhK(?o{WCE*lgtKnuc;pYZ|~y zQ)}QcvXmza22g5S6*j#xwuvLPoF71{Iz&V_vkL<_P8J6M;Pm`TFV*jsYf@zVAan{B zqvIPDxHt$EW6hD1Ism$j5@d_{hDLoiFD*mNv7ij3${O~2^0=7t2c}cXjB@P7N#{xC z>KXu2yFaYRa)GYS*Wn5bNBE{QtH+Jgd3UcK7~li=f{DHz1v+tm0Nf`mJ#lvB?=A|R zII(Dm)|iOhC~`PN&=s9QQ=z=jX6P5HuJ%#ald)r}&o=GH$;}km9WOiG<5_xmwolR` zPX&RE&7L7|yM&4z|vx$H!L(-6nU*r^g4_G#_3aogW-xt9{9sIR_oA zc^Bu$M`)(BU)`E-$G5(zK-F)lj*(9$QFQ_lf%nEY^cSF@n*e>r7HIIPd31UPE82Fz z--M^1HJY;xpzZDE)5~}QBi!Moz`%!7*ni09WeE7UL)mUSnMzzh)W7yw;{@Gza&_9i zIN^Q$a(K-k-yl}o$1U3%^+4agJKlc&f^W2W z9Y?Ft;d!oAsw$p9V)DJTp+?n9rUuIJ`F#5bM!W>MCa*hvreivYosE+=`%h0$ulQD+poAanrSXcSvU<`6oS!$Y z&bpoU;ra1#>)`C->f{uMR*t(6_i(Y}VGF7h$a&4qX}fcNc7EIe<^uNHvy0C0Rjb`P z#BqZ1lm>W=!;oKQ>reCNF9Z0Kt$5g%@(WP1L&xu0LM1w2a6bg1VkEy* z2R2~;`%#NRYFIfiofQH*;<&04A_0;#7?n}&}(0zMi=zHGn`&Mq&GjxJhP z7nhgqX1596b$Z-A?Vh#IArN*iPR`mV5M|EbPI7R1(7`ROozB(4akF!Nespzs94eMg zTS<$cG{%k*ZTBU*o%aO!MMLbaoh6_+q)vhG!{n#T2l3+cqi~@py?JqVeAYRDy88&y z@J06u*VCRK9Ctd$=PjH%ySQq1PtOjIFK}KFkt8n=9}>I&b`y|x>$r7+=KXfrI7R1N z9G*7Y2PbFU^Ulc`Oi<0!i!&U7?C`4F!;5C;`WBlY(a7y9IfIG_>YAv6jCF_08^Dk0HR(UBRf+A0>v+?{8Bb{={ZMcrEXB9qF{~! z7@y?_mm*+-DP1xb{h$TzW;NX{X1`%j>-C~NUc5@zY&lrmfz$PTvH7jhIpLS-wwm~! zm-wF0(VR37I>(3j$Y+N*+;;#q%_&qjCnuPY-Od^Q;gbMy-tD#zn~keB4y?9Mag#H? z|M>y*Hn4+Sv@g0)^1dY;{g9Pp>dmns9U6@W@3I zk1)qEBDmf)1i1_z$o=JAyV<}@ygWERJ-C1~81{MH&dI?^8{_rj08$8$FpYN3&T*s> zS5afw9v!h27w3luXXovsi%zrgX*j$a4TjC(!(jAqJ9xOe>)#K%ozYFV(`z<*x832W zJG$+U{%l_N9Q0<;Y~16YVcX5y+x~EL-EVeAo#wE~6SS>|tE=w4CRdODYBunv)%ZMy zVX<}8Zj7hXzfRk_<-?lJXIj9xzVn$p)jhvO&l|(vLxYc_o}G5%3;tnL;cpiY?Z(ac z>+A}a!9lN$?XmQiOGes7^l68!9Q8)+{_U`L`+#@sc01jUd#C&E;Nf~W>huP8&0+f! z5G3#7B|r9WN1g6%51_d33ZT3DE=uo=uA05;xa3X`h+zfX?svMQPXF_*c4N1Fjox*& z-oU2V{Ma2euZP`x4`tK4f8qQ5b%zq;7mA^ABd@!+ABUet_uYR!NDlje&4=NqF1n%J z9QN>bRkSp%cZ)%CeLdm`LFWv7EB@KP!}u5qLWWM#Eh$F((9Tp3{vHgwH>2LI3@sT8 zA0K+1#x?&e+b>i6OysX~PXOR9`ik%zAjt}$25@^}gbFNME%e|(I+yc;cMgF7kEvUjM>pN!r@kw@|1cc&uSNrWw(f1a+Zgu$=-!UBA&p~bbPldyl^}2F z9%6Ezz|h-1y8!DuJ7{-KPrBeh+<=@O9kouoP%#`K%<<{*dGqk9+wEHWd$;ZW&E0i( z*hSqk+LG_cG0`0iN5g)9bltrF*mVKrI?%hyup9fc? zKYN27>9phQ`;R^~Z#xQnxbF@BcIlMI+;{J;o9O+))!pa{vnr_zGqcNM{H+np@WXz) zf9+mnH2nKc>eHfi5(`YoH9dG}-SqH=B(+-oeB=~{A-^%eti2w1ylZ>Adq3=5asKFA z^)QESyC3_*9w8@SEXSuOXIEG$pznbsb#>A?X&#*)U$(lJ2dyqvs>5?gAIGiBs}qDu zKtzOt^K&TTj$mrKx@rs%sp`tL>0!{tj30KvSU50yw;vnVgC&ZiBCkT73Yh;Qj0G&z~Cq?8%IxAz3sG zD0Yua@Iz0W(D}n{Adcl@2LqpT00y|ZX}Q(sPxI*vAQR((!>t)e>j^@Mkg(}5VVmp! zVWWl*BmDXOvx9uT$9v(+V<7kLn%8(k{HgQD0OPz)UVYHL|FegI^>8cW7;B1Nn4{7+ zRu~ET)w`}B26YICFLnYV%aex|%Sce4ljSoUs*G?thitXwy_PZ$Sx1N-6r+JR7$&K{J3*?WWG^N#;UH#c>?+`PX@8gkvc>S8&) zO*;Onf8XkLuzK2ubu|l*Bh0@Wc%IJg9=_gvvpwwnY3s3q2PY4@JV&|y?A{Nsq`7y1 z95VoOBLtYy?QrzDfBy%iAA+aK)%)kHmt>1X< z^c$Ui`%`}~eCYLVulg*S(@DNZ2g57_-Zk5QaD`WdTNx`k9ZNxrjL-srpt?KOp&tk` z8((YG0k=&0+ImCSHP&&N$3ukQik*lzoanvjovf6#NPm}REyZYCSFqp7Wg8i;?HbbJ z!``Zvwq ztw?|O{p;(1AR|CZuJ7>2aUpSkx_5&JEKvnG#D&3=4V&)$ecwIH0KIKqj}#a)VJ+Se z@u;|MV%bf`30Qcyc{3XH{=1402-X2iM2Znt*UgWE#zVh1(xkn35R0C@rwx8t8Bz=;S4`d?RHmi04&SER{zK>KCrDC*2I{x%$KU~S z!e9W-Js1ue*YoA>dw)PX5swBzyu()@;$}SQZ*s75>fb*jC$A+LkL&@zgDvkV88lk! zCxmvI$rH|s=>t-!j3JUP-x;Eic5sCNa`!E|y#axVf_yR(fx7~?9VTBAvOGuU;I7+- zlz3a<3LcFPhV8Uddf-Up@u&-8Wq5Ud9cWm<%Yv`Rthos*(AJ~#h8vlqpG&S+D@Q!qXba5%A=*{?b)(HZxPY_COFXLOZ~M*`-)zPW9>=^v zu)Nmn-cmS(f{2APC}s&+ z_aNaY>f{UJRP=D{|7ty(`8a$VIK`ESpx~N6z5kG`y?QMWy^c4Vx7At;76ApOTD?tE z>OxcE6x1l|?stUX!-x@^pAfCh$|(u_u`@#IE8b7Of~Qnl8!q;hlbiy6fpUz?>sHmeSYg5*xH@4Sf@%ZOxP%Qf7wBtIfT z!sEXXt;D77$8Q`rl5~DxX5|$RL_w^~L5yCRW(^QHTS}NDC{OvstAo;sgoBNwsLMZl z_f>(w69uYGIIw!WQ;SN6`9wboH^KSq5qcSbH>Fdrrg0;k70pv3s4@@EJwS7k;pT7; zo@S<($}2ktvF2>gN0G=C6r&K;a5qAMP7>=136~&Vu4N?%ARdh!$%5F z!|@{=aKX|UdYLX}U`}7J=Z_HY9+l}b@q!ku7kEH)+Q-J`QCj`i=|o03e-WYp`>RNW z;13)U4vDYb;t0OG(9_-#I!U5y{tOzAE!L{8XzkX02Z z)`Ritk{@T=D5Z^nZ4M(+D0NtipuAc$po8>p4&{i#+JVt3L|oeJkwq$oQ61tt5Pflb z(4pL7Zmp+?dV?uy^(J*ZvE9xM7$X8s*|hCecH;`;$I>UaRBNinN1qlKnR_um)g0(q zH{lep-%W`&2^ONXuC;8Y_w;YDNr`)@Lat+GVqr*8UAxQ8746fs!{}@L%)vNB`w*jxtd*^IE+=%Zx-+rF^@mhRH{RuT z;N6s5)fMlhM()tW?ln124-J?LuJ`b&BZz%;{nu_XP^xlQZC}YdMNTn)}b4*HQD-Lc4*VMoH?xtz>j#|!FSwF=>g?h`t-U_jUT1vo{k zeH|^!jZ(-O!AZXnyTa)lyW$>Nv*@0i5)Kx--0P%KFgF|f1ATC$+sCwJAlVA2encP2 zX9HneoNpm}o0Jw8kNzt_L*qG=lBGFn8uFGr`0$;AUr9rTbL9WPF4P{1icb1Wu>%w? z+a`v&^BK}h5Pq?9oUkh8`daiLLj;S>{rXu&j@JyysEXj3bB1uNs+S%VG%)^0*~sXs zPDk2htSE`!qD`T=9ObuaAtpya;ff3hXx$dE9cjK=8Wb6M)o8sk8U|p;Y#KMqGIgbU z%<(&N2Gcgh05?-&Se&`)HLk^XR#%JN=8Gn3PyRt!wR*i?EuRs+o3RaTubVjAHTFdZ zSGLZ*PL)Gy&9ZRa&bAc9+>%B|(8b~rHxMXI@kANfkjv1m^NVV3ijj!wn$t9iGz;KsP*FxIJPv)+q1M zxYwNZTKJySk+NL60>xbzI<_Xx6JJJ($UKOCk)M^Ekla_RIw$>N(P6+K4BMVNrTH#d zRq?>7IS9#o(wEv>ETs}(gA`>4Q%-RwlsKuh5WL@sTgg<{>Wpy|Zop>QN+Saor-X$4 zQK96X{Utg&Zs_i>M9RyfllRzuVJ}@d)%c4aB8xZVW*h_QYrT|0r7ul}tvT8hEl6Mv zaR7e7=qgmjs3@QEA$N3HYmeO7IL&m&q$nL55{$5l%G+GY==@qJ+-YgC^sM%A+iM0A z=U`v<8*Vss)uC86fJCAV-YH-9e;E)vMh4A&8biO)-z4<01mF)rY17>()s#wp_Qfjq z97F;FcZ9<=Jod2C4X8uqW?M_p1r@S!<#4KwjSOlnleT9_PDJrU#-wcPs>&)-JNBnT@7dyAPoJNM(<~T4|H)yx zU*sK5-c<&zeF(8SJGuMI#a4q?Kq<4$V86DCRz$nXjR@9j^XK{2M$)g99&w^{2B~J- z4QII(q$cd4&aId}o>noOmC33h!afEudq)6H`f%IG==6Ugq}+1tTz^`<%~uOOl`_? z3Jo8WD~n9yO@EEkfb-?2c|^3|rJ8Nk8^|eULkO4X-M$9-1{pMwCsORM4NBX3sVBQu zsw#S0$GHHQ)b5*F3&u>ZytreeC zM#^`4MIEgsU06u9);lgdRdO5P*g$JqR{*H>)-FPlj!h;-I7$v`yJ@GLAF|lyj9(Cz zG~5s?)1Pn5k&J=Pt3=StX2S9QMfVmP80UGvp_E?%x!%O5)};hwBMs+-Cy2=E1cGOB zgE+I(3jH-FC7 zgX!0htpXYgtp_6C#O1Lv+}A)7-&2+1hEh`@5*x7@;$iycc9}>FCM$%w#wHNYX7KmC z&%n0tgOq{O6{uig4{W>{T>;);_F`eele|=P1VcYqJAsgfg96i@mwR9X6OL>seLa>v zp3;wCEA}TorZoI=_uXH!3~P`{5C-80N+BPicZWu6^``T{*by=VVY4T|7O&_-JMygW ztAem}!*=8o)uHbZyw=($WbO5-796E~Vuu&-iOOv8@Rhi!XjAQN?WBwLq))*0$v?Ac zKH>cvJOpp;pRGH6n%~apT#rfos%GZ;uc1gIpkmDmPzhY zmEN#H>e1NKV;Z#HJs=g|J-AYghmR(%TFg5?WhEfK^>K7HxxHEn@tvB2(X%Pw3&w(t zMU>NIvzM^XLk7`dY}Lu?A3z+z6%Ygo=(m$hI9(S2%#r}co)(QVy4E}D!@lPg!mho>&HoMb+^n;DTP~Q;1(j_0 zZu~9~-BVD=au8~a*0_90U9%PoMC2c?9J1#{Y#Fc)JbJa_>fJ|pbEvzG;~#s-@V&*} z!s|C2o!Y+skC%l$I9cd}c$mU_``;gamk;pUZy(V9#-8%yW(Fx32Mt6PKK)9nmSannX?_1!-|EFYuP;&rJJWQ}sL!x3)DbBp-WqKcKz zf=Mllaf6q;MOT) zn*LHpt=f1+MGZO5mCEYEd~ne9>;>L<1wG^XJEut#Kmt9%Zc^B`U>*o-uxby+OOd^ z3kMvLi}7{j0v?>nmrVG!a0USM#ePw^n&$oGFhG*`I;SV`OGL0%xB zBLGvfw+SE)fC`AYQCgL%0t!OMXN(tL1xKk*JS;c<8EYrzduO&}L*V3Rov7+=f+&(> zdH#xLYy#G+xiN3JVJ%nCOhfWUf9gx1Z7}yDF@*+@{?U?P!@GLlB5JsX&SL_u18qN7 zCx;-BLna9JL=mAm#H$)JS-#Kp{0TmTh(BYsY2LjgEah%K#|{CC$Y+;v^qPU*FzHQF zb9<0VCT-Au8g0>jnmIm)n5$~)L2sn3?Lm?HJYLS#dkkETVQR>vAT`rhZHu5hyXPFAZVE6jET6-ib+l%aN!W~nl zwY-@vcX8oD@@+nQ8*Em0D`+yHyOi5TW&NzjYS$H1hjHdwG;{0RlFvgq7^3(ijFH=< z{vXk>9JP1qdhed`!4Si1?UEEi)f1D9Az23d;L;ILaI*ad zBAa}M9TncF0jQ#{KidKMJME~4x#fnOfzyG|WDMctVlb{EctyA)U(rhv>8>jj+z3AdVl@6_R+T# z!f7jrF!Az&-cYl&Ws7wxC<23Ji-kI5#=?brNN;D@4Y`UUCpz^$FoX>+H@KWo=Cg4@ zM1R)cvCYyuPmO-C^~2OO3jrZtEQPv_1==fD!=_m8oGG?$E2y$xOmnbbFjN*V&SL>v zQJF*)253+)uRp<=j=&FvlR%Dx5R4fCn+zo&-|aeIiG|pVbzlpLm7J`d6z0;a{3Lk2tkgm1_ZH#ypd^$(Kxw86~oxyMyepkhGr&f?}C z5YnQP3Q4>O

EYERXS;*O1>ZbX3cRuIQ|I_ww&6DIVU0gV}cX`mp?$0>DiESULVz8WY)M8E9C^#)jOxD=eXY;G`!J-zE4*ItY&k2A)LDQ`SWr2>x^ zr?XnDQw4eQ(b{#NwE20t;=qx9x96U=25rR6+Tiii#@xiO2*k|FB+zM^KT57=yn$9Q zBYAUq6fbcn>(gifB^r$j)k@_%Mx zYvo3GhiN2pLatn|8e6*Gk#q6h#~yi%W7Vyhn=35IY|nXy9g-an@M7e)f=N ztKEtapz>a09FSDm8u`>{hX>_p(GYHpH)s+~?mTG)k4TH?23m5VSJpaq510=8t}um) zE)FQKS$curK1LW0(9RYgdM#-9u_$p1jT;RI5LthYR^QL)ErAPP0}nO<7^PWPsPY(G zvWkIHG=M6L66c*`^LXh%hdz8HTNQ%WSCLH<0zZ${a-HD7hud@LfpvT!rmoB>bk;T2 z`9(rnX^&&a35^%Cnw!CHx=L_RpVH8e>8>h(1lgQEVfB$iY>U-figImBpmBFpT9(kM zHh^DWw;}#3m>_V4>Z+)02M`FjF2D7jZ0(jc&PJCnxQvstRx2+;q?s6U?p?%YUrGWR zJ;emqn=zQol3Em48L^xr6AXJBIdki4080$=pV`-^jqP~z6>1BtK;P!8-DdIr&)sZ? z{8<;e*$qA34CV$-M=WM@_`P@qjz@7=dqpI^uQ*9KerLAc0LHO03}qJiO0E`C2;PR# zXSg^2R9KGih2fvGdP5oZjy#-?SBK?Opni%wE!yUTC};2n;DI&|MRwGkwmVd5OkNdO zRg~&spcD+$2wM;m4iA5f0L1z6IEg@2yTz35(g|37KznLzmnIh8AX0miL3!-~Ug!tZ z#+Bk6udCNT=2K^y<0Fas_?_b)XP3#(I*K5pN>3*k8xq!?E@i5fXrNFukipY<{S(@) zn$4`O;odOADMBF&auVcG@M*PaIx;BMF$=I6*?!!iOx!;$zYk12^Us2RnCvg0|3;{X z^*f(Lw*BW0f&x^CGXNxbG@?lU_H{I(YYEl>L+HZO>*N>>Hj%@*rGz8nILC<0Tt+2f z3-X-Jatwo~oGY`ED)8xp|N{C(%*qghxa)5f_0nEmaRF(tFb9r6K5bHUQ&Au7n52 zd-a|#h3w{&l4Hc1BnNvhk{Y~s=qO~3oh)*6%uo{djGPoA933>6qx89zJm*X{x->Gw8zZS3{BFOo5yeSJdh`0rx*On)RHx zPV=2p)@rd!q?yE8`#L{RPUnT2Iyy(F%;B~qIli}v*;kHt>wAugl^X@DZozXz*jtxy zRXH@Lff|lVpo-X+)4>}w2Vx0C0M8uGEl(ZJX{qvDJ$XkbTZ(5Rt%OhT5y*+LjDeDS zryR%I^JiL63ij*Q2))G4^>V=HB=5ol#en(l>}uR z)!StZieppCNNZ#;lI6|Ovo@uMlE>8)`#P7cYZ)7KaCvQa*oDA9C`a6=<4}%}ifXZF zqbkUSwdJ{~kCu5;gEwOYrf?mB=bL%qqIwOCwT8f1;A$$sUKES0-c*7RQMk{cFcZep zGKO2PGKO;Bj_fjl#9W-M z>j|()2H%~CV|%#>T5{HlcYNM5-d;EfCzHR*AG0-1U$5YwB1_Q^s6Rrd1lx6~Pt;UY z#z97f$31P`8@RUyj4v5J=r4)^c>~12CDLyhuZv56x1GQOnP(T%Kn~_m%%Koc$_T`^ zC}s!_l~6qGW;H~!$zqH!N6%$+b-3UF)jskt5z57}&&!yg?61LlcRtFtWg6j;H7Iu| zZVwFvaXtN4F5+g!;0R?L+hn@5IuaE^c5;}YT!@JhWh6GbWkmSOwIrB-k?>e9M%8;| zoGtGf;58qZPI&3TP^m5}ISrTpdMqmNA(&wJ;`L#95s}Aij;y%U<^&_P`1@~+SPDGY zSg5B;NhdXO%K9916#Vm;@<^e$8ZekJ{VHp)QS_+%RpeyeUW$D4K4bc9&vghFG#pd4%VQrHArXx!N0LFtHX=SObyZ>9hvgJj=W|w6*yBu9YM69 z?ggMn?n~Dnfek%Vo;y@{4>Igk1h3z$D4}dfWDERA@kg>#78_YAoaz~ z@t%8vXMD-gl(l|90#g*PRg*&zc>#ChZJ}7M9c2tI#aQg7Gd+Eg7k7iRw=cVwTJ-q) zK6K=9mKP20`yBWK<4ZXY46Y0VS475sk41vWM3^@RpMz&ecnLb3&vT<;zEb9dLrD#mzOEqesMX;arksK zm@a$@3xzRIhYA=&ghr$v3qNLFa4>GtGi-$;H#rSX&gH<6(HTCAWKO-?{=#EOMUqgG z>RBnP775e2RA`fza*Nr;e>Hy*V=*}b9@U6Fi9LEP#f`F`eOYTMmb;fcpRv{6GDpci zbp|Jb5(*kv@P~aQdNiP4$Zd6&P*z|WmDE`xai4xqDY(K6KDzlE$sEnW76P(>fS;0xDZGrBXHG=O934D)#KCC8lg~Mo4u9{*$72O> zFa`%NQcK_4)UKm}6LwyWoXv6uw}*9s0#Ylswgm)^Ag(9SDoEXsiKFnth*6hU#crVv zBFBW$pW}F?iuaVw(SE@zmps_cUh_=7)doU}9PM$pOnk)2y#l2U|GWf_Vht^o;~*K* zp&9B0;YHXsd~6~#oXx^^L0|cQ`%RqR*Pa!Bn*Zw*ro33uZv)3axlY}9(m8(6wFs@&n&!HIFD6J zqD+nlmsZPKBC+<%>GVP+=5dTJvYkq8G0sBnnLsTiEA$$dS}H$RYALusD)oHibzeu~ z21Om7_D`&#R2UXIg;y}_r_l1txiQb++V5P#xDM{48_sxacVBtx^_LGJ7d2F*8vA;p z<|w_=aE`Ow5^xVko=OC&*%Lj@?DKm33cW{OW%u7Zcq?z=kCBFOdW}Avoyj>Ubwd{HxUV+^)>EMq#8g{Pk(f*B$wY|BTQS%@)?hwuUlzti zYbd}%Oh8AM*3j7Ka%!C#D%~Hf3ZG17Lxg|11hgXc#i6-&!(#ZV)&79 z;_Od22wk72V;csO{(8%sP2L_yB)9#RNv;v9(io|uE)xbU*Sh^Q^0A;jb~|EW*FBuE z%bTdSf&zjOmtfgK;Eb1X0UgfU^Zu9{9R7zOS)hv@e+%fUiA6UAc{BA*3I&+R-@^fv z$!a+*Pn(8odQsifdjW-ty3OlyFR6KR`bELMX+EL$& z6iA)doexY?Lnn5bLVlZ|`_MR{Q^*((?*h8Hn8Sgmh(J$LCUCd>6lks%bd?ifo48`=G&T>ZgP3N=#BD}b>>EP-uXkGl`&i$X3@6y+aV1>72B7;<$4 z>A*g>D1lc_SdykQE7}QP)lcgsPH~EH3}b0 zeA1&MAhncE2or4xnAqA~>WqtKX&^4tYCa!&I?}m3)Kc3G7kL}O6xUbNdSZ{Pq^g(L{czh^x8fmvW%Z1OzXB~XQ|Jw> zli>O8z{0+gaDIBNSF_XX(mU5~B z$rJjh7Rey~(KRP|_GoJ8vNKg|n; zo2Zw!2b>cQ9y$EK5oifadxG6?j-+C(`CLTx5K5)G|IQ15hHbfFu<9Izi#O(o1IXZf zIg58<;a0e13oE!>3*%*hc|tOuur<#bVALVL2g$30Kr zp}ct}$3s`Fm(t`Yk?nBAPOhEF(Od}_$wrKf^<=t<^7`|7Lf+-oCQ~U?CHI@i5>>`4 zH_9`@*WFl2j>9xX6tx_VJW$ahG}QbXf_K(Yfe)<EI^%%^Vuy z)_Y!nIFi7qBzxKtTG-;0p;Wn5M2J1Ii4tKAg0g2$E>i{ze2y9HV4Cy$h$0EB?)CXo z>wG<(F1p3?Q*k(N;uVh<;xe)|Zdcx5i?=Ae25sDo4rZDk*PoY3vLOYxb~Mho|m&XeUNj4j4v(Gdaxc!I6MAQKl@o_ zG>P>Fkb7C89oHAj9|1!IJK!%r=y1g+sL1&93$96xv9yfA zc%qO+^-vAG#k1U!Ex8x>GehC=#JN`E^JYif~;zgn}AmA9| zL}7!-(aZY@q}k3{QyT6Q=uz-OaTS7o#u{A0awt~OUy&P%&&{Ta=(XOtLZLrq=y+e8 z%uX2}w%nTi!_j)e`b#0oC4Y!7ybN{w@_0PVCtlHDT=R}7ah$)>H~CpC;Rg&vp#z~l zPzAbLE{zWv_#rJ!s1$%t6p%iOV+7J838Fj+P>q!ar^xvW9PAft$^8srknqcsG`*+K zU*_8xPW%J#kAvSvsFHBRXUgCa1Y@OzSD&plqkV=LBn+?zsbh&i|1A73EQ^@`eB_&j z6vj(PXqefM#!IVQ(tirTzg`w0fulBGcdsGM!fi7ffZxL-HhUX!{Kbg+Z)_FuBQK^+ z({4$$J;2Sg-}u!?t|F(>`Scx`N{~k8_Z_%614KAf}SsneAuqHw^4d;M-H^qBd8ha+Gg+7rtP?vunT18;s+vY`4#lF>I*w1cz zqLb3qVqy0@l9YM87RgfpkLhonY<^_r*0JEryaJ=u zGinLN(E%143sn?*96r2%#-bk*EJ008t{A=$CPJjE^*K2vYEW8v4HC8cQQ!;n;WhQc zSpXXCIG2#lErh92suCiu%6Z~8#;V|eJBBNGGN#V@)Z(X zd%os1Y1o-LQnoh=wIeN!(^h#5k}ME%Vi>o(l4rn>%~ELkI5-!B1@7~Nnjp@8%0=~FrtZ=)w{Q2ax`552 zoa-aDAI0ikiqH|a%JjptqW|&R@o2P>z*_Qk$PsrOyZYTN!I$zFh<3Z>>}HJ101WMP z{T{G(82gw;Co<#!Eof}y&Q~nSyz&t7fql4V=SyxI??crx3$yX;Xi-kb3|)}UJN5n?Jq(xq_zQN@j~i;)W?Aw0?@ zU{rwZ4q6kBws_HqC@sPlb)g?HTs?m4vhqE-)8LVLDHv3p*$hzwEG>Frm}EV`iVk<$ zZBQ~ayz|M2Ue%}FT@Gm`MK-~g^TpM`CZK!yRs5^PX+47$LpBk$3*X6s#%R*Mn6WF5 z<=ZC@A>iao=TLqntH~Roq)}_GX9zN{HK(}fD87Diu&i>?IW!(3Er^7X@k{EJiIi5? zhawh3m9Hf_QzlHEfMMxD)SGxh>KP=#apMy^2W44iORz~0rOc^ZvLj5RIoRMxE(10Q z)UVMHj^g_{;Bx6cOCXld5rxjvFA)QLanjIekqw2YND$J{kA}o(=3Bzve zE{_wvKG##x&s-8JrO}=yN&S4g#|fLGmzGdqU}C+nr=5QyR}v(-l03+Q3GYWq{5JyM zU9D$ey+hou0NsE?V1I!(;8c--32sS zvc(oigbFv9X9nB z&hq<_akCoqu|so^xM%V;_sml9g?TKJXMgEi1fK zem7tKG4+s26fbDf!SCeGT$e}3pvgRXUzkHt9_RI_x=MK{?%KuXMYU1-0l@4bf?bEF(x*b2r#Ql;JY2-Q_@_6@hjWOxKQ~rbx6q>eYPy)KHT8s;Rt>A z{XMHwibbE7vC^U@C`ns$f;ljuqfWtfi-16Wr98PqwC8*JKrxzbW zQ#yeWD?vtM6bvjuvF*bB5-3+bL<`xVJ0@QejO;YI;<`pgi?aiTwp`H!m*k(tc{$7< zmap?AhCem(G}rq8w0} z@Z%2J!+%q9cJMk&SVL!MLQ4_0lAXmyysZ1(l}kjGC#6{VA`w?gv4yXm5yZT(i&geL zrLd8qSJTDqLfKhXhkvoL3z~a!_lCq5R!)yg)Wus2rZX()7LL(S^yePK3zpN;Q?H&m zoGq!cDg~l|7u97bfpV4G;w zZhI2B;6hHYP6}RCkmVdyRv9JeNeAdNzj&0KZ(wC~LCqsL$$+UqDlyWfpSih>$hJPj zI(942>uRlgER7+rGx*}tu&7c0Ndatqp^)TdwOpA{Hivy{dF`2^Kfs9J{l;I|I@G%@8+F~$n$IQ7=}NFj5jV+#(=!nHQ1%QQ2zD?)0ZOMM zy@0^*!5&HK#nOv7LWomt>CI>&@L-8mB+T{m8Lunlm3(;FJ6vjuZI(cXaCT`xjR|gv z4=DCidvtbFOFn_a(TwT{p}fZ#8_5Jysy)pWuo*qV7wYUpBH`<#WQY~IL5&s0oins{ zny}@Va$5kRqe6n;6>_3*{{ZE5&Y`2FFL*P8h5;@UB1UkBE3H64oi}~*N7kaFXqZVh z2-#v*Orxe`WPLu-gHC=q(*o&U<~`*9M7(bSiy=oPWS~9xo5R!7WCPPPBs5m#6oCSy z-vJn{bZdfbe#7xhfk0U2D#iACnAYaK$`c%4rMIcL!iKDh_B}$wVL)cL0^y!jUnvZa z?7tZFfGK@^L<68SmC3V{Bzbt|lWUyWFnx~8z?j^o2dcY{yqK%J|MY~x;VG8xJ)qSR zI>dG1CsxlOSsUewYym>Y%>XL;+(qa?++0lJ=H~Y(^-&Zfn;l&VB5-pPCE(KNbN4U^ za5b-#WS8^GGq`|V2uxLv+=wf1etxdslHfr13BM^sRyslmMYJJ|!E(~X6HTHFJ(c%0 zw~jTg?{c+;tjn~AyR>d@Vu&uJN%RaT`b;`W!O^1UD5S~wY~eOcgCqpXYzMNbh9Z;S z0Me*E^_PFDOSZ5CTsCPbbJWJ{jcpZ3TDQ=00iRQE#egdqZeWxV?QFYo#t*}lAxYQV zSb`m<;d~lUQrXjJ;UCR&SR8Ky9W`hnCF^YpQcYY0a~{Z8zAPi6p(3!GOUZ!%!{C$H zzR>^}q8!>>&bsupL0#t9yk`<_0$T%`s<7u^4`#* z?~nsTUkBTFJaImor=U-BKE^PcpBiGC9`c%1d>BQi+@XKN({RA+y9^k$1b65fX~Zlc_VUFN+VbxM8W} z8x&mu1!Lnwsl<{kkE&~zM^#72m}zSfO7{wu^zN+7s~IMD`GJewUECLBLfk zY_6L*m?QyB(f~kt*8JF0hC6w1WpbMCy}ay%&q86abDqqcnNotsVmCSYYL?FeR<0KZ zGpwbc$zdO!Cthnaiq$PMhp-Cc`e++K{uO1zUW1cstn(~>c=t_f= zh^U8H03M}hfo{gH9>R}Vxu!~4<_;%Ru*r2(=dqHePAo#_bxPnCpIz~qDaFWWvTdR# zCv(8+AbUp-gd~vy&@mnvI@wL$9A&fCBeXX#k3Gbf!tvsvN|%5;~UOSSz}4XM$;dE2%i#@=$w zOxVuyR29?&J4K_nyQ&Z0v|xaf`^X^Cy{xeQ;ln^jPhFK<{{T5%N@T_1-X>pr1teJn zd576Rg^?s+a)j%NJdR!j3NPZ{(wNFv9vz4nQEmJ$hycGq(z`;FJwx3kntLy=4R?e zh=VfCG_0R6q@iQZ(W-1s(V_)(MWiSP?a9I16vr8cD`aTF`=ZU@3;6rwgtLScj*jU) zb2381)p9}>CD|?55-eU|t%|^~-ywkH3ik|%>Vy_{%;nu{1Y+%QcG|rtg|Ks+u3$$( zrGsG_>D;8(phYUeAqc@kTD(Pt&O-FaGr8JOZo8BBK;fnY4A>&ji`>zG4T7aSD zXW#{)Gu{5a*6<@vxkB>$@mGk&p@;7SASqh!0_LH-9*-+n+E&e#tffMMbwGYitgsD{ zfW~oxU-1e{4>re|AzJzpxDetjijnbihYKVdPXTj1e_Ue;m#UZv!_I47<>MxR-ZV+l z-bp{k1c-MxE}g<<|C&&;ixL1&)g}OEcuRn8l86Z^!MuSFrv>P<n$Ev=&xiPf6NB z(dnH>DMrK46)<8oOK7zP*W<_8B7wt{ncQkpgVdT*Bs6~sK*K2~Aje>60f@h78uHN% z&)H&%OLn3UFMIh43`Sr0?J~%KkwOAWGNol#u{KuHEHVS+>!ffjDF5EgcnT(khc@Im z`&09`m+I;KFIu4={ndU=kIe4+fFI!5@+| z6^4vokN~+#gt;rGk;W7BcDjr^a}`w$OY$f-n9HFg*h-%u#v6=1lq5M6CyL+@0v_P$ zxR&??j>2xApndWHbg+MR6IncL#LU%&caT4m+}OF+_4*4O-IL?Bay@b5iLvA44aAtR z&+1P3+K8}WH!UVPPh{6+lOwuu$ij($9$Ls*dey4JxNLPZ3sx=jEVN44O+^GN84Nx} zcW)NS#ECj9^@i3`SA(`-@HU5c({S~$ozSq+z|FYw3+<%*VmoCvKzA2U1N#6yoT~z; zSyOZ*Y$wjZVWtb8gvwDedVnfEe9{)|s%qPnj=B7u4TAaW1-53N4eg`#;CC381|kg6 zBnmUWCorwJD`)B++>6VOM_v`3u!L;AhTEc~WiC=119l|S< ze1y~Tkjlh^O90Shtf7)cFW=+%z?(f$5{FF9?%fgx?WI1b&xDU<%>l2P3+Ogibb1xD z4AmITt*POu@AO2K{Iz-bCTa$>dy!?uP9b*m$`MeR-e1ldJZvl*(Q6*ZAOr&pas{sx zQRfbM8ckp#+sGp;L%;%g?l0Zb0Me)dA;dj0cTeK@q08Wd2OBj(pi0sh3jrzL(NVIN z-UiD01@mF(Y4mSck2f$!3vfK0LMaX`95}EU*Jlovhox-pz1V@1_)w1Yo`jgX;PFBp zWneK-j_vQkhgLKs%4(#UgihX=6~Vh@2F?VV(oE;jnj?V6+Z+7w@*q=0p8R}pM&l1+ zKE_^VhM+Ob#DdWuOZc)dNtO{O17@^=mqN_syBnUBZHQwct(S;-q7ZB-h@fMdk12CE z2ZS$6pC>(>V>}bkT%fh2GW z5IR7gr2C1$`&>_tAlZvow1B4AWb$fiNkr$$B@NN#oA+B2h}Q^8ij|6N>Qjk{E1>vM zYfz(EYy%5fK9V7>v3MjP@jDCBcjG*VeMtN%X8=N)#6fQw;G=Ioe@`y?g2F8v zz@shO;urLvT!?#5UJgJ!5HTLuokIdVF`%9^-5{4LYp|;qM|#%cCA6xC;Qjct~-Ggw)#2 zZh9a}_7?o~%sElg%pHmL0yD8YE(Y66M%QwsU{?e|U((d}d$_bkG*$3d31Ded4u-?1 zE0AMGmI2Y)N-HKJ@X~B9Nr<3$8=o9UE}C2|L*EPa=vh~+@ReklksY}f2ZvT1B66iG zGsK!m+lbXDU6Vlg9x2U79NS7rOktbAu*gKkwy;v$3(~o1?vktyD%#yzvCzu8M=v1- zUl};VNExbJmPa$&HAXLLzk?|AWaC!P=-%OrIl)5bt|a+VQ4)f#`o4Ht(fz4Mi55Uv z15!C|Lx5BuWUjmIMl6BhU>=T0h`Eh3+hB5Wh)?sKAqir4%HiZ1XIq^J!a0;e+3Flh zk5cZEEGs1tXf32*d?|6!kx>}|la)yOA;QuQK-W&F1HP=Ln;1jc;S=sf<24lT4lzYY z5sAHKwL+K+yoRf%v;}<(6$SPRI1A%opd`QZr<;Z=kFp{qYouFlE?3L<7dQY3!hIB; z4|FfA-(6BG3GghB>~!e`i~1};nTj!hFG3}{D@&=wpTd_Sn;}W*{P_q~k7nS(A)N}I z7{Z=yAOwW(5htCL9K-(dzC0Wm=tqbq35aJ>6M)iGp`+<)BF1j17(--Zw>>!{xNjr9 zkg&zDmoUNIH8=PadwNrYOInzNs>LNeqVuLaF<7fS*yT!Ff7wO z^Roqs#X-LsC9%*-W0iHG6np^%FtuG(QkGzF<91ySx_TCB#@I8-nMi8mx ztaWui>Gmd~E1-c9HvTFN*00NuTvT=!)HWr)P)f)~>n8vWTyxIw37wZu{^eL=H=%9w%1B!TuZ8haF z!gaahp3#%&Hc>#zW#QWnTi_d(_5r$15OyX5i{Z-#XntevFZ3umVlypP&q6243g@DX z>xE5e%<5#}@M65oZ7%bYO>jKM;UPU};oM0bA;HlD#_6wu%|crRyPByN36i3|ihnyv zfq8RgifS;a+ zf=8;CiigZtCWjvPdmj2_h48W}M)al$Myp9c&R?990$fn#Xlb7>53NDt#VRAS34%jX z1n_Pepal3FV*692v2l(CW{rylNzsFa-dFJq=7og#1xH}AzXJGnWrt~n+eGxLqDd-I zzm$lEEI{)4%3m^wh_W8fmvtU65(Oi0Bv11%EFwO^w~0dv2pdlTEHVLni6Rgnzz3Kp zRu;LS%9k2G9+*&urThbi2~8zj`U`n{*qj2csWGb6FT>;6#tO)8ZIm&r8_gNMVueWk zc!nzsiwcHsOa(4C*1j6D z6dxLt(d0qOl_&AZF;TF$5nHYu6%U(KArw~~K4IziyVs4NTvPl8LZFa0u@7Ul6v87b zy0j-wKSE+TJF##QF@koJIE_7@#FC*dOXJwfi4hv=V=|5amBKL4OdVUrSHkTGi><;& zF9?_tXT(&Blar_&ea6akvZi)<<^DX_Mt4i;54S;J4Bq})o!%PI$fy=nCkHL5_H-*2 zk;X*jN~g&an=NkHRiu*oBzs__a*tOIdSs;_4=-h6*HR(uiFie|PsqvB3C5d;(A2AU z#<@sm&gff#_Lmhv52~!^F9TQ?S2O@&$BJ7JLXxk+gHQC3wz&ffFGK<7avFUY?BnIa zf}x{unKOj(DSo=3_HwzR5+RNZFrA016(X}hP47tT8qy}XF|4@O9{r5M7g7W@{Fr$v zBYARb1Gg+=gi)%ZJ1))+&Tz;SuVm*`#-d$W1+`tZ7+AqBO%> zIGp4&I!>mLBb0@W5RbwIR06>CVTgFNQVF_hIprpo&L;{?c6Om;;pC2Do2Kp%ofuqa zXC+{)BR~MuCHxu0XHb^}+q4tv}+zPOos4gIai7Q$K z8Y#lLrzayrN#iJl2ppUg2*VJ1?OB|^;qiiA6562s5?g*ibZ|En@051pNdu~UC{NJR zYb?(Tcusi?hoVn7eXT^>W9N|L>$ zTvy7IH7`yRFUv{{lmX9sI%D7fvia-@T01T1F?wbpn39SZsJ)Db#b0oWry=e>jlXDD zm_P0SkScwOQWm$0ayJ%)h;blvEF5|v3E~kj6xMpvkjA1K5-y@bfPBOn&dq8>#A?mk zHG;DH;d&Xa9}Z>6t*I*EMHyhK_JUso<_#5)lrwUMQ3yrqsB*3!5qyO)`Na5GvPY)l zNI>G$JXQlaJ{y3ra)7HrCp8xz_X<`_X#?3Phb-=70(lIT76Id*9waca|5BY9f^R*m zL!A4T&Q9<1G%D;XAo$spA-f(+i{hZ$hlfT7gRh(y-_6edhx**;5tsG==A1!XQ-69T zU^0)mfC8I`+IWza+cyI23`-u=J6O&=@Miq}C_zI42rtIr7645Kv`j%T!Ua60 zJqCgLn>ilBufgqfpmMLO4*CIZ)xl;W=2GQd(b5qpJ^KnEH~82|wpq)O6tXD*%ByEo zuG3&Zf0>I5LS6#8PQ6rFMvjgS7zCu#ySa!NYVy_B(~;Q$7uE?9a-lCvUl5(Ph zAyvVg-vzJ@?J70r3Eobv{h=9?9AuQ({9=*@%KlPh+yF2-zmN4p4T?by%Bno8S{krk^=Jiy%efG&pS?ttK!^(}K$ZQL>f@$E~5 zYF`i7pam^AA%k%GkaXOcZJK?L=-k-K5NLs9&wvc8MSIKcT;OYk?I@~P0u zMyCS9%FX_%Kq)-v;fYXF=nR-Qmr>K0Kj>jX26NhGH{n}7&JhQ&k_)|$tw0PN`@ZLk zLE9yFJeYg4NG>?RLLr7u#P-Oh4rqOKmeq=rz2Zo35?(MPO1 zkbqM4vsp)aOC`aV;H5Z&$v6O{L`83@0M$oK0)60?QlB_DRRqyA_9}2H(`RfG*eS~H z6@P)< zEB)CNBwsruF$>Vkp+QPC|tqEX+N#nFP(*z@LD!e0uCv>PRNwY+_ zZpbbwL9j7hxML^4(Nwo++TIBjOX1Y4PH9L>6*avZ{KbjE&U*ZOJwp^(*e#x6 z=Ucyj!XYu79ptGAJABLA3*13mIMT4AMPDXYLc!3p^QNrkdUgXx6m0QuB+2C-;wU9T z&M+U?s32?L1ytW4vNnXl08yn#437`I$8e51TrG|r zUJUhXl0P936k>W}z)2y&wIsSvCji||Isp>MpnsDueK(%39i1*<|Hs>VKJ>)OvVH$R z`Rl{=eEIJW>M;J>Zyz)Q%g?rC_^TOyrV)GE(36+|)i$PKAmDXKvy)KDKJ(|v`QhR$ zV0V_ei!dIr1Wv#iFhnpBN3<|BCXez%PkpROQ%SH8uRBx_=_{ZhC->J^^Y50|tef$d z)mQFq_7eqGfXKi5Nu^_Si0&th%B+%O+0f9J=INm;-iDfRcFUaee>#(AcsP%r^%2sO zL|01O^OxO=q~Xr~UF01} zz08;LJALa9Pzp`2T=X?3Ntq9x@B+{_SR_Z5-NPvZ_|oAZU<8y3$KSyxFx0%dvN)=bCapn+&jh?FNB_)ml*bg|Ah@_Ix3j>*hn`CTjF%jEKZNbONnJ@&` zl17x^>a(LZMUW}Cqxz(=#Y)K?pd91?KNTS4NcrvYx(!uLNSa2}*97t;WuP1xcfu|j zV_q_>$ETHn>~Ug-*OSrEXVV^8R!EIKoUTT;?rTlGVCGQ(b5>#eFjW{VkT~nf0c3jz zu(`&zlAeSz5uHlBibu>~ z$CB#wAQv}4W?z%<+m)Dsck{UeYIU>{L_i30C4kB12tOgAEL;)j1s^R3JakE8p7TzC z1TNYi4;MKL94kZgeSDTc3-vIscdC|Q6G_JrTq!jqJ!|!=a=oBo2M{&`9GByn{GZCi zFI31ln~*0_b13Qq7PgflJMYk2Kn8)C5*OZ}3Yb@;B#ZOs;`D5HZ|bJ6jM926^K$n{ zpQAq@Kqc9Vh|#n}&T=SY$DBi|&VZ!kdu9lZogzZ+dd|pg_+)UoOe1NAyrc8aaGyV+ zVAbA(qeu}hFDjzrZls>E*o_Io`T4s(PLTF)MV#;dB!`Qa;45Z}biQjO1CQXl77HC|yF&;!RJYI8#HoeE%AX8~oE7BHiy zynI$m&Af;a$&2Pt-A5xLNk-37`X<33v%>poo>E1$27vX?I-5v!)uNHztxxzR68wYf?2 z%NVPtj2wy8Gb@etK#<#PdG=|wPHHK^t&S3k$HTI6SpFS0FEp(C4$y%3ZpiFGTWxzN zaGR7+5QCAYX&%Bexxt2;-9 zEHi4W$ywM6tNi&v4TvAiBEj(s)#&Q&GcIapP%Jte<6xv6upq#MR5P7^Fl7fZpT}#- zV%{&%*=m~FzYqclN)TMN$SvR)N?ACxs{qiTl|^+m1{kiAq{;#q%45Uhh?WFPia^+T z-+g_?M5Zkp2SF!B$}Yz(wmq}4=_xZdAi~457@FCMUJt4p4TqK;jMnc!%p9BTY)dW* z3sLNP<%!F|Ht3!d`zz?0?9ys=y0Ui2KFF^2l@8LoL=4-6YKM1TSdx6yC-jO#2-SvU z`#9|>XB$Y~q5=zzvcO_SOSqVCEG^yuuAohH0kL+aQDK3WBd(TI>zO5__W0Rb;SGo# zs#7W(#CM^kaf{rFr^wyt(YT!kfH&l9u^>A^48!$2BD0eb2H~6ay`!s?C9)ldUzEx2 z95Tqq+18Gb+Hf~G4Vw1I{4&tBeZy6hpv79w;iU$-on}qc(!ZJ97)BW18d5-l(W zc@j@1OQ1*XDITeMxr-r^@tRpn1-l@hIE10 za*XOfl?!Cq@CCUbQPH-B{vKO;{hn5;-Q(^*0QkV{yWwDIlM|eFmtue2W$;WxqMMxA zKSe+fy3uc_1CxiDIJ)GE$~h&brv529eZYqPKi=MM$E_sU_ge>sad2?1jQs+0=bPi2 znVy*q+ZYT``e-$KODc^@nr`nKf<>}aY*mpQk|n9yFmU`3ei*-W&AmJ=eYaX45~@t93A{2gKCu|ZXF)!U89eUzF$qV& zzeciwXBOr36-iXjBG-syX%}HF;p5t}GbYAHphc5+sgS9U&$etdkDpZ)h8fljJp;*( zi67RxR#_LAYoV(-lIS8-qT{f;|VNnUP%Ep@q1rZl$Z$zxdD8T7ar zSJ-T4$z)LsA0#KPws*01sWnbre{Wt|W%BfH#v_x*)od<+mPudN=@;lbCdlUqViTl0 z^_{6-&lj&AE_NS~m*b?RyWQUHKXl~s9CK?uJNf1Lc0pJ452tw3^00LkoSW>^sd~eGfrIY(p+%>5 z6*lm&nQv}OIw^!p#M!(O9cd7+$aB1)-m(XC^gzjSeZBfp(rmY~^|LP)EBLu|4p$fT z!27|if30fgcJFt$G4^@+<(ohKvl=GGVGD4*gCRBH#n7`t=!_1zrga}8 z8nr+lD!OAR^GbFTC2xkM>2PQS&$Tv(154sMkZD;K)skOUqwx9qqz^si-!_dqyx`b@=!eTg4(14=1EGic5U)EfJ zxxh#5gex$OZL$%JoKwUvh3x<#qf&LGim`|qt3-q$SGNf^G+pej+gT|MuvJsPpK!p5 zCijrH&ZQVVAwJt*w%Bi+%e2mk;DR$q1Ubu~ABl)OG+@=9QPsr^R2JOqS$`nYP*+Ec zF=~&2qWj9+>f;3gaZPbVioQDHpX};ZG6F*)X;Mvp;$^Egp}r1EHC!Kp5?gBOz*~ye zL%vV&9t6F!b#^3qDK}iMp$>>^HG3df7tBz4AnkN;)~0)pgygKch|_YON~#y^*-)>D zU0Uvfj{c1h1SLe%aE&IOk_sq$4ay~yZeNm)2IZp1<>KRn=dr&8Spf#CUoq2LZ%Q)S ztktw^-3!}8q#@ZIJjjy4ifZU*vxog;{fhB;)7{x$wdpf7n5=Vo>&w_&YeXqK**6^@ zbLu3qDb5`m9pw@0)!7%1xV_pO6&vpyCooz00!Xn!63AS^(=V*5ezuf7XINnbFA@ui zb&UCx(Hhjbb(IC(G7ZCD+Qg5(vs>M!He_qm^n}NV>0Qetay1&*YTrA9%X3a7Q5TnJ z#aV;z^8KZ5(rlSFW81h|rj4tM+BkE+jdCp!CHkFhzi80yvem_&>d3Q@Lq}GtkgBAT zaeo%xo%UyZmxe}289al}+S}3hui|>1K{Wv33!{DXv0Th_Wvu22icUlWnBeUXy3UK< z*4Uxw6JZ&+a)O{>h-4JxMwl*Z>8ll8e#ubt(Z5ji>y1+CfT>?AR)M)MxO;`qZ$C5W z4Q(eZxTy2}97J<%S_NOOk3gJ51f7ThM!Fy$oved|*8Rgb zF=LfPbAny683bv}2QM?n-T038>s(kSvN|>%B}<<`O42l&FLH8PV(U(pE0v$!vlBqu zSP!snvGdkMQRD_lU(N!sjoS4*g=dTj4F!dLxp~g?*=_OJX=V>>TPSQ1GoX}S-T@S$ zTI4*oZN)~UMrV^ayE;1;_X^};>zeo#MbtbEmu+p( z#<3|wuwcSq7Sk59@?LL2etV*YXw0|q%J&z>zLNu@8p{*MWTQogR&9|syn8i@6{;mt zH^TEa)gB>I#YVs{isf^g<7@hb`xa(b*1{tLPJK^STf}ZN#46p5{%ASe@XLb@`VsRh z3k`huu_j=2a`BOe$hn%G(-pHht7(ZFw_)Og0@8pAisL~z`uwUx?T;c&-E^Mn`@6k91C!`U`f z2=txRdBxl1o-5P^sSiGh^e-33u4W#jT$uN^5d^nd%}ruf{*v)|v6D@HDRp24cCo8~ zOvM0U3B%E^D#4cOj1`{mY{~BC8Mw}XK2xqzT)5Eb9c{m9&On)eByK-=7r0px<=D>< zzSJ8PGpnsZ?ahiNE<>qzxB=-FpIt4%IzY@Cjpr>pi9B@n5_@igi#ZLNrwO@NZ{eB0 zB5q-Oeh>c5BKBrmMqc@&nQBaXHxvFMLwiONc}};pg$1k_-V3qFo8|JOFXOZIM~Tc# zSpHU#o&JQN6}vtTy&pS{ZuT2m3W1)%5zKE;vV4@^9VXrZmvn5?x~gnBvz?;YW?ACF zLj&sLkAR5fDc#Pw@V+ZXFygZ#s=@85_v_t~!ezOZnd9eXrRP=lYVvctA`ooPhPzon z)ysNN#RA&T<#}RZ5bDspxYGSqmj(?1b5DYU{sae5)~WA5e`F}dqNRxP2OAI{bR46F z(ubcwZS6iv&`p05@j-Wv;0@`g?_S()u83&SFX0%rcz1JTj^hHLJp-jWz0_twZ(#|% z^PK~Z7|835Gi9$Z*1=+!McWQk-S&n~j(zD7Q&8VVX1BcaB43?Nn(*G)K&)woWY#D{ zV8i$x@m4~2E;~-UKJ7M_*1`FgY(uTu9(6|lw#nr~ziKAS=%Xh%*Ao4D7 zu>u2-XMt`@Z+;d+`jp|p5wC*yYL~);m^1xwVtoGF(iF{RG80c&6x^g-RZ@7 zt+gWc>1@5M+&i+QV3xge+(BtX$WK24@mqGq#l4@=?8Rax0AG)JzNsZ*n*43G)3FL# zZEw0zsoR;W<)^5reXk;_VvXQZ*d9Eqqbw7!B){Frls7s`@SV)hOX8LKK;R$t3!kC* zF$lg{3oiYt%lDXU`pQH}N_IEC7WonsyuN6@%5UG8A7 z50FwvaPIV`Qiqwio4tZeW`Og`^M{J7=gK~AJ|w=iob5BE$FjCGjh1Ut z#n=JG9p9}yCEdb{poB?|N%2@o2>ELJEgGoZR>ugb6D zzi9IgBP!L>P-^}YD4r~d%kD-A>)uA^stq2-{_xG&g3yb_Dnc-gvu#FZi%&Iz=zzf* zWH@oS&9Ej|fbVP2ta}1HdH(I&^HIW>(|;|iqvjo`7+qt zBT>hyNM}am?%xe*Ic3yPJ;K&SgED$o1A zXQzpFi?c73b@_02wP9BIkH&R)jbtk!A5%ZuoEriAEyXt*rJvrE3seSBPIgLjbT2lY z>1jtpXm^~k^~kE`up=Y4X33axVMtg7^xLl=lhjbM9Hf>Q=LbF7*m$@%!B}R@n@{Gv5zqG~KZEOC&hBg= zZDlK_h{g?Oklb<%09NW7nZFu#?>|phP^KK&-b^tjw{sV+ywM?+x7*rZU(vqf{^thW z)?N23c)m$>XNYLgs3$FjRtm2OB ziGn6|={(aKJ9bq2w|t;_%<>&!>;8d{d@MWv&_^knk9~~pAE=nvg;U?@6?>GTsaT;y z{FRHD<*ZY%dgukaq1&QyT+orrn9zbd2Cf_zyp`o)hVUL@i{p@-C0Skt5#?0i^bYbP z=*XmS@x|H5Y5lC$zvjF052^s2!NM-5Ii&0JRfBO1qCa$SJk(uI@HU|Jfz>T+EkYTM zB4%UMsu0vV#vWzS2a>!G@I_{F8K-{<5Uqv%M75lkdxi#eKG%YAncc#*)hs$}1q04? z1X(oSlqoePIM=H=VyE6G%6@~v(qgNs8;liH=X0f5>CbO{2LBc(nLJ$g@Y^DH-3R9E zIwi3Iu;toQVa0S6q2@@4jgdBO9v*w(1&2HBfPH`_=~F$nsMUFUvzl|c8qw3?hJ686 z=T4{X1|}=9N|7%Vx!Il!+Dvlbj{ngPxX%U&3J|Z4Jfh*$IoO@985sufVJ>~UQ%m|U z7a+^sW-m#+7!Vae?~Q@o?x}hH>hc!iJtvBI4$I=moOf7kz2iA5Yf|{lTc~Io4>7RV z=sg@fr$@YY9)9`rci&C#?mDFHi;c>F$5DW;j}vn+YyZ0GK`lxa_Mi+>Iz*wmjm{X> z(qp`@O}G+MHXKVW4s%VE%6U}X`2@F0q`UGTu_5+NX^v4eb_L+vkns)iCgjEX-OXxW z2skm?b#V+-Kj2l&vJ0yzYorXT^x{w`fojDgpeWpA!V*mADK0qp0{QexY0$;A}- zk;+0GsW1&e&}+s9=u`}Cy#D>$my>n3{WRmR z633cI%twZ;g~Xokxd{v}+u%vOyNzTx%ffH~*`8Om#FV83a`@K3Az`0p2*v0k@?bz` zzBWb{7i;vr8Z8R>La0zvVPZ{%iN!J=R8e+N)!0b=3QezmK(Qxlzaw%^zQ5+FdK^PF zrz_3Uzg1-+^D4tNZljn__6+-~b~X^fCsuRne4nw+cKTu`A@c6s4cQWXiSdku^G2)- z(8N~rVwT++!iA=fs}eI|q4@@}L$wI-B8C=C28YCLz9Yi%DvOtMXddBKF; ztrln!nD0&Gf(PR8RX#^AL|!$h+>ox`u`2{pM_#=N2dlkbPM+BU5xwv3rKHeI(UBHN ztrityYo@(L6)+o!vQd?moyWC3LzU|xb)1L9t733e31a=W@6538lNn=FhSEg((S*A1 z_>5iR+$_T{Fk@hAl-N|&ZonCQ!t3>7LiCj$Kq!(XNDf#9LQ_71IY!KnYN2a;ULQ?p5BaJ9 zA7mrzr_V@jXZawx+_Abg&p47i%~T1RC(>s$?6EBhZ5;LVkcCE++j7*MUotbYHf4Vx zwiq9WEkwhxjn67q2|FgOhu8L!8EN0j%=UmAo3pCIVAU^r>Y8B(L6#- zJQ;qwWFYO45XpE%lv<+wZNS-Qhq9}9z+YnTemYo9UoNn~mVlXM|5{fFVEnnh@Z;ix zMX(7G>@zGpE{IpR3qFJgUNdBQJXx~dslx2p;+vCGN9_sYDJx53+#`xEO?8WyGpEQf zVqbiPOj1@}NO--$O2%NS^^JNj6{*u9=Xp*>`eO9yUe0{#SBli79v}|>VgzoRw;?YePDocuw zllev*(;TznCdxHCE_WGD2aU@=z9(Y{6=}>1dhnM#WKpSjAPHlF8J8o*5>}v{-!LG; z%&-DWVz>0Eh^Fiz>IZCg5c``Qso4kBRDN_CCV0K!nkW)X_<$j4jWgxH=)xV}-oHVH zU50cJBp#D-g}lOT;DbH=AX*K7TN47cpU&))X zg<~u2rfj;T6fB(gW4kMwxK|bqrf24~CFaTMM%U_=m5yQY$rZPs|Lf(mzsaRvd~b0Y zXF`y*F=p=CYRv9+bvvK4X`DGwIve z6#|e~`&ENtVG3*?{)$m-=K%Nl&_~L~y2&G0^9C}jWouwc@oD#RvO;QzBcN2FJt|sU zaiFKo`21$+~<0({(i|saP7oT6ve%kDs=!&Ol zGWzy#OIH3ixFRUCB zs;Y1pWf!zGFK2gGi&+D}vc?Ww4M<9Kv{eWE)t7W;w%Np~MjC51P(Kc;B0ZoSw>JQ8 zlvOjL1`a<#ZOim)FfqIu2<5XCtT6#9Rdim5=crpC2GtD-G1E;pp!aJ|p-o&z8o#*Q z0OQb&$z_jrx~!$EI~k1|e41hkypQG<)E3E6jGOss83+dII0GL^s3D75uG7`wzu&Jo zgd$qDOXL#o65`D&>TO(;D8NS!cs3E{ z%d^;A>6pNH6!}S+esIXi!FQ@3(eqQ8R#sAESVYuz76{s_H{z%XfGe zPhGmISJ%&kim7J=@URhn5?G(#k9ak=Zt?c9d8o=B8~X+7W&EggBApp z23A@@)*{uo-taAX>=7;KN4J{xnk!Ws*S^!nCzzbHaUTE!AOb{I5I2u7?j^m4Vlx+} ztZJp{BAkl$!Kwm>w@5yt18Z!e-l{BHMJUlJoW9`{PJ{9kF1XWEXc$*NiJc;Falt9< z<>hxetDHh>akVj6zcDX&48ZKb1BlZ49(0^|2q*Orv?-0hpWZi{1v2-TnYg3#H{;pk z5_lwK(G(QFY%_ubl5g&5@PI-{P9hEmUULW=2$@J4pHKiCNlo79u6`u^ET}~$vPU6y zZs}o<`A*Q*Ecx)EH-TaxvP9}>7s9?KkqI4sO#k-UHl^UJtySB|8|27$gu zDrQW#EUwD8alA%UZVcXV@nh)eW~2;c=;spP#K7eUqt&tj znRv&s!AWt=jzbmurF~Yc?0!2Xu4$*uO`OKgI5FAnD^D@9JDUwmpURpM<5P6*TDEj{ zl7@*8m%8<-iA(}NE8`o1AM_trMUSo?Q7hdo{La3H*if!>I4(U#B1QsWfjlGn&RiJ zO=hEyJi!MRN7Y}rjiYg%_zX)s#{Ps z(l-hkh|knxnRQb7p5l-n!OCd_BeDgncHrA zgC4jZ^X%Z7r#jutFX2;r;6!6p1_j!M<@HI=m)V*;CRVp?v!6tr*-M5nujWBr52mdu zx$bzURmz3}c!h6}60s)ZwTG;O&7_Q&o(U_2jMH`{oNw9}fc8MP^j#&cv@{v3?W`JVfz@Iv3S2;!X7hk!ujo+4bmNy$O8$LeGLoqdhfTbYi-qxqX^aL z^Mse>MiM#8BPIaFVU>f4aVS%$g{SQo_;O{mR>2nqoDYB5vI3HB-DGLiIDs>5z~*4b zmYUtO+gr*R0H3oLa`i#oeuQJyKL*Oj$F8YIuajWbbRVvksY#Ms@DWl;kANH;?bD7B z-WqxB1?%~X>$egL*22W|e;GrlAY_r~SBqMrrgAA$jc2Rxc{hsf2lF2mu8KbY@BvK{ zoJ9q3nynEeM$DrblIC`l)>wXkW?6-@#@7h_d~tngmjEg-^txrbRE$l*mhbPQ`Y~B+ zN$Q=IYq$LhRkztqpbEmwqfM8slw*^Ib!TZch3aKXU{hS_+BPq(Pcx+BSto|TrEbw? z+`CVA(JL&Qu|nSU#q>`l3a!{^J{QAh#*K)(Qp!+_hcb}QCs~X+ESz}Wf*EaqJc!KyA?lx3ICj8hx!B6U)3`k69jjxiL+^I*%-f@J} ziJ_9}t0k$d5Y?m)(c!KSx$md2%7z}GeBayUy%;#8KDNwCt~(^LQ=@AMO0roAS$kgI z^X4q3tMsFWj|5XFJn+%iJ?9LJaUwfg08X(gG9vP8_!c@rW(Gr=a~*=4d)@l7h|NF? z`QS7QMNw(=Zs^`vIm`yIm)tkALeGNiXC!wxuJjrol;ejc6RGGG49i5_l5FVg_S@C+ zcCj~vjgxZvZ4mR>c4qIQb5F3TuQ&PA1{soZqrq*m{jNgWz}D+7*9>a6LwwK1{#wXIr?gH5)$?G6B4?6`Jn(bI(8fMqNIvF5)}` zyOG!e=R+#{x*7IQJ5PaAR0|^^v0pwOoEFnlqP)YFZXtSQAyXp0a{W<`V0GGia<8ilm};WH`uKX&-TKd!fr-Zn z6RC*WPy&fF4&3YTjFM9OJ3kL~qI+eYe=FWT1AawX%_ zP1^AfzkI8@eSJ-M`S#Z(II$4vFjb!4eI(1K6_RT16?S<{&kG~YJ9i>TkekbFut?qvQ8<_sZyJ;t7BWnWGQHespAUS4-ENzRE`S)+*HjDoo)jxOatghs zV$<_O*q0bpZapT|Hi(OyEf~UN3#;w5(OX1KUn1!j#W38`HYX_-5i4K;6c#MOtV|Zu z{I4;pCXIo%H^U-G>BYmWg*Gs>jRE5eENX+GMxj!@%!#kBxJKo!9AC}MZcX(K)@Vpa z@+MWA8OCl6#`6=4GR&+`r^@nHdy`W2?L*jS8+@bf?MzB(^^fJ;Bn<|jYI4G8VHF~U zlPS~A+q^kA+X6vl0(b#xLN(ar59pE>rxq!lS2{!h1Tsu{AP|GMoix83uN zzJ&z|{8Tbnw_jm9;caBPI$YV|GlnpSKrsOe^C3fA1!|%SmnVx1NlRnaf0E?-#xJsY z8D;M_F?_5PI~$qMce(YY@<2fSe5rtogFf->4iS0hb2mX>4mc5%py<=`yXEb+TSRNo z#dllnr>Qm-2N=Gd)S7$4%W}B1@4Dw8qf7X^O&@;Wy3rVxFgQBZlEmjAW8n%w3V2xj z;ex}Yc>r{lhXWy&-hL7aYG0Qc>d@48=g87BvuB&7U;a1gfZ!V1xLk?1FD_-{zU?m1 zKf|Tz6J8<;)P*A*kuj;+j;--Nxz17^v_D%f4~ymgqsYBak!Hz}ApVl*E_){7k$j5z z=2I+q&UDO8b_4?ukB@BLQ3)f@o}H{MTD?dGz|NG0@{wtVvl^^;g8X>TxaM^c3vdWv zLDzFRYrxwN*lIt$TbOP{_Ta0F%iMEP1?D)lDh_GKks7!sky`OiA}R7D?qh6z{fg|v zaxtnUrB3(p6T@NockJM04$p{@je!TQV;2+9o92?xbaSnr;0c-N#w2B&{rm4@y{Ti0 z6JG4_-@%hDw@+rf?hwB`6N5JSelHkPEufWJ%{F~+O z|A1M}I*c)(4Ttt0%cn9rzPchK1Glu(nct{`kv)~8`!I0ygG!Zcz!&sxy6T}B>K73$ zWMX#*Ew;IXyYPa`%Zg6G-*JV%^ z8Tc++(VWAo7blnNP}c-P#z4M?1|ZFddO-HnUR9xAPsk#(@xhBw)1s_WhoQ)l>*|85fNpI5J;jKo(Xc+W5&f~ z%Tw#(N#voBInNwv)RbxE%kkec60l5Vj(w6@>CUW`!WJGOGQy=(rZJgyL`JF^n2|aL zMiSl#`X{4joSP&!pe#1`*yUR#So2ZJWP~H73uqIGt+!dSWwM32PUrxR=+UaQlGdu#ZP*2hfhl2>YJvWIY7 zT!0*6Y?2hf1ann487LrH9z%~AvZ-U7zLjIwAcem77%Cgp0U>VC%-7lgjPM!%%-78E zQVA7AJNO&u%%#mOn!$oqfv2%rX`MMQ2`0Ytl=!u2Jxg>F{i9LrnwNq?a^MSbflLN! ziGsl3N0%;(LZcu&0Vgq?X^+wR)?B7b8hzpsaGPV!mPf>#cQa!+SQ*as6oif#d;>2C zBslixjQYZxF`lo;pe~i%W~AnBw}KLU;>J#*;jM=^DC_l{BpQej*tYWGPg1nkE}uMT z#nA-DO@qohwBdVBjX(%TLsvrx>29;?E|`pJ^pm%8!w7}<%J zuzn#;HU=Xp+oNstqtwjg-d6@Mf#04Z(tfKmw^*6n3EHEiOe+^$JWA#FpdKY5qruQP zBLDMW4%6w?Js18N?wT`brT&JJ>YGqa`9la|?7qd_0yLUJzf7YejAiGi8A}yGUvSe( zF@PbvvZIgPue{_|WZ?RDHUh{G+kLSe$!wClF}ZpG^;KhVeaRR+*6A@+c?+b?zda5{ zk?mP8Knxq-WFme!h&$(#>HWS>T{#0DC+(!dBgFwl2gm(@P)Hl4j5hl1?S^`BMsGF|*N6qAKi~7T&@I_ZxE&lT#Gb#dJ8Hh39q3v$|1mh`SY$u!-B67K) zN=0bur1L9(z_8WFTJIsg=tp zq5*Cr6+S^`T-dkjXI0x*DH#asc%Tv&Xqo8B6NEm%9(MDU$yW*I%k93X11js4WS4XU z!yTUAZBB?LYEqA)2~s~CLw)HvhD*YA3=NhfvkXQgqZ6xhC`%HkV#nZfX-@~V6LC~+ z!Zxn8sf}wBZsRZfzGx;l-_RM!`62sDw{gbk)Q+D?F^MZotmCnJB}N}`5;<`W(;PlN zv?<2m9Az;H8pGuL;2Xx!Je5-1N|sV4xnC4UuPy&1^2mrLQ(5B|okBwO^=jo&L~Qy< zzha!KkB)$Mfn=`ghApeJy}XL{N%j|PX&(|I4O0_k##Y<}uYaCy6~7}=tWa)YIjk05WaqrTPCFVA!lUVJrvGtS-Gj zz)ZK8cF18Cg6`RI?M^{9@3CK4P{PPapd3AP!1 zy;A0F9aN+@hSkwKumK=~LPXX8W;kMPqDt>Heza>)`n(gU`+d29Z7o{b$LZY`ax|+W z6v|@kCL7wK9&TVc*i5%)3$wj*&`_*uJ-%X!xpK9e#P9owSY^h!ZeQUNWU|+CDwg2g z#<@b2fkCSVi=fR!X6+i;l?=qVUC&y;`9tpZg63GI8{Rq-k7Nt>#r)BmlU(fDi^07{ zNz%=@7hmzs@zsI2*+H|EcniD?mR|>?=zl4JyF8U4RqT=(^X*GK7PQuHAmi2w=4ey+lieo^~Qx! zTv;pcy2&%%X~Rb3{Un?{GhW8=yAc3gQMXuSCAr3eI7eOn$6EeQG}zI-EjmE0ybY3M`rLAuWP= z>3<5{yo9VtKdbQ2r)!!shu7&n$mg2)jJ&$A*~wLZj;0Gsj6E<}XyKlq7`$aN7>{B% z+052S1z?Su;okBd3DQIcZYUv)As&4~V;6u>+&0|P&IKHrJsh;yh@bx*w@mQ%1)^>{0%{VE z0GXeQBe2`z9D$3{#4!6Kyji9kL8r@M{j}po-9OJ-evYlx51k7Mt2=Gh9KzucVm7M% z9;4sWm3ZgmVvdsgGZq>Y7FDYdz^=~k^TG@mKWa#|&PgN}K(YDd;c3~mb8fsfs!|%NR1E`aVWp_!M-dd!RyCE8jLsczTTG zVRL_`*Xfpvvq)(Sx-Ma)^cz;sqJ_mtfGi#B&e=6D8oFEEq@yBxU&<2_P3+Fx6Btd~ z2mY%1+bVf>p(pOG#(DjUN^0ki4@|6hvkbdn_svZ2ZTTg~4p}p8;3g)tt?PrVP5QBN z&Ax(t)2VTDgxy4qX|8ch{cYLAptY3a>uBz1IxVnOB6~Ia^hyR(@?^7+QFGJ}z+dGn zuz{G(#swAwh!f_^0ruTy0N9qS)JYt3LTB3X%0v^RHkfwb>tqKX!qZi#Cw4N0&7c;? z8DjqxKGwlhd2NN+`4j8U3Rx8TsvNYGFgUW_bLlAu!vIcVW3wVu-!^XCh)gSj_!&2l z*055mIsS?&*mcD%WO``O!M8|WnKiKuvlsD|Hb7SOVyKZP?m)7QL`c<@{WSA|5SsnJ_&eH(=2xZQ6k@qtnH?{l@TcA&xVRNDN}!z6YO1g z)86Iu`Q-}$wG>2Y{&weGZO&sAWiM}T1XN78f9Yc+lc{-r$L3|ky zD_yB1pXb35=9AbB`JS#gM4Ph9sQ_xJiCF3CVT_uT9SL&on)R6QF3izLYe^gLl^zyGV*OR~crTnnB zxL8Zj`Mq8(kYL|zFnTcei^$tfdpHTW@_oyL-# zTxKygpeo0K0@7z5L#gQq)GOXM(dvSgJI({8}G*iV8iARYj8tJ4$vE z!J1d{*JS{k90j60kASMi5%4J$<%#FLi~>!Vrz)7oK+U$2VKl~3a``GgF1o(o$OJEW zsQhsZE$Vi0ojo0&`bNFS%tm=D*7W7_`hYxc*Ig4~?@^Eggno2M=rg~I&;AQv%6l8K z&;V!=+oKcGJi?fJ7<3GQT#y^69ej<4v_V%muI?v|!5Xb}^#dDp!yECg^!`RFBD~J< z3VLN~&$7L`8lSApe#d}vYUT&oOM98u4B+jxofy7f#da6Ef&8D@hiXZkp{cehIR(bUCt z11vyHkDJKT^HTfELthx`I8fbl1PmF5Yu^rdV&e3P+Dsmgd?Z}?BR`BZq#1GP-BDq` z4fy;M?5G5Hj>ya~66+&eBJD(PXRCeC_rKiHnol-2J*u(SlZ&%!nEbsDyjb_+USJF{ z4H_xsjic~vx&C6a+FR0Lwx6lzKIi2Ln$}I;od5$NLr<J*1HeQ=GDznM0966(T0 zyI6aSFMZA1(Yo{ZZo~56&|!^y2FdLlDv~n&kq>SBHJ1XO9fQJah9|RD)n32cIe_kY zBN=@}gV=|QQ%KvEIs=EKy{M$o()#x0bWT&AknIZ|9J%K;ms>sSbG~lYAy72Neb-%@vmfYzKdgP%~*H%jqn?=yvw=10G@| z(0z*chR$5QTTigs$mj?d8$#)a3ibMqAT&iszZ%Btnfh zicks|k5Qa$8z*qn?N~9&O)NUEVlLaFhp?#_ww6cmNbGvarsD)Rn}w;!6~*Qa~`52hPgki<#Y_4aaY`yZ-N$PHYa@E=mUug*IA z2=3ySTX#~&*?_pgG#y0aOkReq8e_oDHFp1|!u)9BX37=%K@O*F46%&t^@f4RY>zE5 z9U_hBTvtpibf&@Hoz3m%lf*s#tYefeks3U%u4W6u5i@lVA@=OAS`C^{If)yrTumyI zIK!K@1*uW0d!t$b`_chn(Kom74@_ZiwZH9=cR$D zcS~@7i^oavruOhqE>O+4+lnKn$hs8Qret#%fs*|Qba9;A+SDvV+Dzw7$-h!8_Z+8C zjD}Y@<=1aq$#3o%@}8a$6S!*QKXgJQKE3b9TmG@7iyM?0d)2^$mzQ8D;mkMuPNoryjHFRpP|;xk7W|-K&CUj12DA$sGXkWQoX4tmXC~=m?{Jlz^1a3a@ZM`1cYr!>l>xz^Vg>u?=P$qDnnrU6)dH$t zv`#3Z4ot1}K|icDc3TOCLn~i-A=Y1lHPAM_)mTiu@*TG6ojk``K(lPJ=b0)yi-g)L z#2Pj!*%V&waV)Ywpo4ZFKMg#Wpd*AzO7p3ZTyO~3n^b)a-qM>P>k)MWoi5^moXNV# zZjD~K7+ozQ$~=Y^ZQ3!)tz~<8C}#=k!qBRR(++Y9x8o?xjr1OU`>pP5>F8q{@N~tC zmr^6d$(0Y9>|5U<7yC!fg4N99TliH5&>lmNFef9QIM17>3d~hElkI00+^vS744KvwgSSeX!qH?6}JysEY8>?G2XUSV}WWO&I}L z&+WVF3NInb!5iJIVFUM?n7o z-PlAC&{Fy}&IY)&dz}s7Mc*;tYo1FeIVfAk{VgJ9|7=>I7q@b6XImWB9KmBEJ|98z zxW-WuHP=xd*b~k0N!5d^0mk6mXGJ8{BgF`5_Rxd)7tME@{Gu>3bYoT~9K0@ncg|FLPNnWf83M3kbG3c6HaU3!Y zLuo7yL`t_k4~6)z4G_sXJ*vJl;iyNSEw6C6&eoz!dwaJmGtYhQR+HL==w#W0evn(g zBvA>r-pCT#r!uFk24dHunmD(7aS7nm=tE-dsi{M3>j0*{6tq3q^xlmlV=y}JN< zj+)v~Sc>j4VmnSFj}HANaz+koRpRf{D@n{mMdG^DBm z^E1o4;0X(pl9<@Fp_|@(1yL{+O)_QAH^-!I5E>Sv2!Nw-(n`%TinCHA1RBL!Q75q{ zBs5w&VFC6BNf#%uMoryST)5+Jpep7V>Q-V6S$szWIZ=aOxQnB)m~R>6FtvvQ_jqrX zi5Pme6|Xyr75y8}B1mbgwa$O_39jU)A{d*1;yVWru8m^7PzaPJO#?3v4@#qN9)PBd zcr&OE5~adV1IkZL;=ir-+>{8Ei&`7HXdC12WWGn%GuvaWpwrl`kByOZDn0cxeh&b? zxMq0*l?t3eir8r*J-nSP^deSuk2Z6(7)86~l;bsRLtV`|^w5%4W2d9{>Web%!ErkrB zxDa9M97wh6rLK7S7>JO8*8#%XW>e)=0_&<7|N)-+9j`fO~H%WJ4<(8%#{RK5LZhyPRqs z(-^Q#)5ey=__C@PNi!-(A?Kp8JdF4_fUfV-L_53uyEz?zf5fGnHsc;ia7j4#jMH>nc8gAAwwT0*w~wptESa#jS}QsBhBODC2d`2Ec=i-M`NES zCP9f}GrX*ea|6oYOwtxoT%zeQC!uLm!~Vtx7|J`2vn8Vc!^2r)QTA{)c(e8~Zc@|R zC-qr)JH>H?j4mEaG^A8}G(415ytf!@66>Bh82rUyl6SZ7j8iXU_M_qH6LM zh{cJ<&}_G>^bG~A?mJ}z`$)66rC9@1C0Pj?$gkXZo0Qe5q<_IH-kH|d(LWjV^Rt5) zMDZf~E4)FixB{P4ra^jtxc*<|AxM1wz zD?^o*98sIs^(ft-`%3iRPVwe^SbYJ<_sx{tRR!VxtkLtH1(mv(_35Agcsi9Sc31N@ z^*>TAm2|q0wrUNfh6LL+!kI`q%Ym_Zc6>Osa4L&!e2XVo&> zfKNYZ!b^B6yJdvW@vA~mEc1{uz&wrFIxj;Z7Dkpmsn31-Sq-}B!jCR_mT{=;jl}bM z%%649e)N1lpKSyBY=h>Q`+MPvzD2n&uu+tZPKPABbj`VVMr5~@C-hI@u0WpA=HJV2tV%iXpvz(b6rFatlsk7&C6m&} z1;m*9@=#*a_!1vFQO_bh!=h@dT}G>22~Y15D(*vC4;s!kBQqp1`9*=0dx!<1L`8Cj zC@+#qfr|V4^gCVPPAgagAaWy;{*qHB-0ut#MW;Svb-z6~>Y@baXN(H$Tawsx_em z6V=6ur8)nZCG32W+P@1m{!D*xv(5#{R~!dT%KF1$ZoV4EFIIs^NZ0Yqe4bBu5EfIy)kaX_5whgT*o!&{Wrj3=E; z``Ud^YC0(va?YI&xL@lcSBb)<5iNHxc^S0a%XE6q7Y+R}{-*)`!M|m0VnV$gq1BKx z*&d$>_LYud+4OkW9GJNJH5Y6|Q%6W%ci=e~y&inlSS5>LFh79s0e*bVn$b($PFznhgyQixY*|d4;sldrgfv?Iid48f=jo=IP3AE}v*4B$%z+N)4dI0B|0xQ07e&|J5sUxl%=n=Hbn-ONuVKa<~ zsY=X0Pw zbc%!-9_wi*9pv1(htcrdct|2Y4{0~IIpWc}t9Ts7BVOn6cs=2G{9CyY*?QQIZXRyz zHp`jIF)&2fJ>SmO+{M^Cs4grXkCi7PHt?K{(~9gYfR2z@GT2nK>W5H^^ULgx=@?S2 zh+d_q3|mS~EN1qxfkprpels3hU~C;aldRpV;31pw2IDvYH{(vt-7?0&2VEg+;xo5K zY#?)4*?4Yt-mXQk!cwZ$peenE z0c;^rDg+FxJDv=+CQ=*r07fzUGN5PyPwg>TPi{(055|{yM7em2`At(R3-%sMXqIwc zP0JErB~_;9Gd|N*ezvGbkS2=|U2Wp^h)QG>L8PJ9<(>};alKsVcdc<|FC}6(gZxOW;l5rdDN_ z?{0Fxx9)3&^45txK&;%2;9h4cn2#RSti`*5e3UFPuH6nzuC^|X^_A!U-yYdxIh^6* z`D^PkvfXGS=wH~-8ha|!cxvx4iYi!x$H$Bdj2g!+e~^N2S`zBchOdF!*)m|(wQYulV|r9GbF;^f;RO^wXT^ut02B+T ziF1*FOA=utPO00tMrIq2bmCyo;2aSfQu&%Z&}Bb)v)tX`P{Xn=Hnp(}X@J`(&G!`> zc&tzBHRiB7w_`yGV1#Al?nWz z6*|o`s zFwE(b`yHZYwzJmc-Y(KXM2VTNueqj}OAtdXn52Z13-@sjNVxSfHVO+2!I8enNqM65 zagCqA7B!Xcq>&`b&1cIXFE!mLLWPVX7*Bu;DaMy{0O94CA{|pZdmjs6K2r$PpfgWxQu(lr^d=);L~=MKkKo1hXMPZ4BSC zo2hn5rH?)WlGhQ;7O-JzxRQQ$zHqk%D6B1&k(y-+6f0+fRJT}U2N-%{@H{Ld|AzUa zF{fnmC~`Qka(v)CZV!ucjm)J(IlVF#Zz-8&h0SBO32}2S-Q_L@S^DK#@$Q~|dLGf_ zcIlTp#AXtclA}XLa+ger;$GGJQxIIJG z?>)giO4#QWX|X)p2zb!O=y(3C@_p6jEY4fGCQr{7zQV$-?Zj!2zPGf@w?mxHPq;9J|c8u+h zz;OyaJHxyj9Dr?$9s{>Uj+}!@hily7%bWX-vujgt|1MX#yx&XZC)xGJEQ=emwya-z zs52^jdcBOrRlOd^!A8T6-F{5q z<%~_Irlg*7Nn$l;OWw{tH$)m_eaH(xD|~5)ROg--ck8#h)(>!XK^`E;dH|VTrOL}I z2!+cQI9m-WfN`JHA+U`Y>aF|@JF>EZZBpTGV4qHSqrsfG>_&!ej z7_{%W)?#C4gy}O`d|667Srb*GHBpIGR63B(-oT(d|j?`K1uK&ien1WkF;NygjA+EeQtOq<^F=3b(|kPq!IgOzwhq3 zn~oJTCZ&qK{Q0}@rgwK!f->0V@JVQ;HQqu>#L2|MYVWy)E?tU@N($Gi+nd$gzYGTj ztq-68+Leln>ubqa0;F8sHY@<@>mEQ9W&qHGitHFlSM{i_?6s=M*#xcmG8_`$k8!eZ zYI1(fSZFHJ#!Ed~V5vq6q!w*-)?}(o!i#~O92-Ze309UPU>jRWW3ATr6`3d{=Lp=o zkxUfJJg1F=3>n>tzFG3t?ZMs3;_2XdycrWCGR=C7N0?x5x&FX(TKjQV)>d{i!!1t3 z0Sar$2pNt(pP{;P2jsAlxQOyGj||F0F;q|Yqq@l(_5>I#-_~!im1A}$2+KQHrn3m9 z;J3lK)_erV7S4T``|U)fez4q^df=>yZxdnOSuYQq5uJ}bn62}xy+F?If=X-gcbEw- zK{OJcOGIG;J-PSatN4xSQj$JdL4@)F6D-p-JmaDikcI!eFstD?ODY$~_KlM?TO15l z{E}PeNV!*WZ`k`({|eDMizL@*E41WMK?nNbPD`7wEPgGQVWAs2dy^fOPbg4o%dUXM zlFD?es$K%ALJD!12|tHtL?w$XC-j+VZBy`B z#3{Ug(>k7jEy=FTjd_XcinU6px&uqfK!m*Xj zpwBuS0-qXd=?pSa&A4vK{W`k_D?OH7iGXW(F3f4R!;UE$jB&mYtATo&X5V+4?Gz2{ z{q4P04H?V4!fIOgOPC%w8cPO#U(HMZo?x+LgQUm-^9HXA51O8R)H_!3A;1qKGN@Nb>FhJKhhUwLwFX$9Z7O? zgp9o>ao&&_V*`~Y$(Te7a3qa8a_=_SBCmP8+~B6srbBLV72PZn#psdy`6%E1?Kip@ zmXCd>Et@FW#_P~t_&P=N?^I7URj-WD0JxY^m z018de09u?WM8f2-o;++hEb;Cfhqf#yo_Y$((k{v|U{Ck^yJuI0kqT&GVZtvRc2a>! zM|D+{hqgyrsDkJ8!a8hsvI@*N7xe*0H*7Hj?n+Tp}SI-Gu?O(uLvr<<*q>IM-XpkKZg}E6+QrMu6}}< zDHJczsAuhb{P)bWVr2DU%C!%{2E*+7iZvJGyHBCEX7ZG>)ERBut6vx3La4$;ruuTR`c5dGpMTL5OlUurGzfSo)p6U! z=jXgLQKs$p-b1*w*xL1D_m(6MD=}QF3Yy9O#|Z6NjqYX%rko7BXt4nlH!X!EcC0{f z&)hGT$QP7nNRye$UXFz-)XunBe43Oj0stj;_GP*zI9Idh>x7s&O^r&iuf=S|N)%a1 z6Z?b7#auXMBi0IsbKCgi0p@Ka=x50YYtapu^-zSf4w=18!la8vkLbV#{K2t)LCY7f5c#V&OSX;RJFNG=tbWpnc|OO4;3;uj7V@y2eUE0&Bjj9mhu;d~K} zV*-?ZWFk8Ka+k#Sy9{Y81>Wa48o9X9lgSWl%oYqHHDTF(kI3qBe1wuVub*dq5t6&S zbtUq5ztocr?5DC&L7P?m(!3%lyL<+UvF`GW$O02&QWDVHhzbIrMhZug0pTM40Dpn= zLA?|j1X>XWpiQ5`MlJoa%OolVW8%obm#-RM7tC9@5jW5C0k!cTC1?BATI@%(2>bN{ zad9%d)m^=L1QAe3evGqDn2Qx^b_x-4q&*N~&L!W_MoJ(cOz~24Uois%jnC{B| z2f1?l#lz-Vv;dg+3$%#c!Z}D9J$3+v_V!3M$LL&91*`(TZo7SUfs9`kIWuO2ECu(P z)>?SAeJupE57!Lw?m4T7F38LRD|w<$MQl zuMy@!a)E7>D`Fv-s6|iT5V%w`07~2gXqNQ=bGtDbLZdX(6ond`r10iJcL zd(hc)R%_GH*=@C#@-5r38XFI)O-oj}{Joy6Z(v+BD*YEq^h;EU zHTLal*GAtlM|dK{CP@UDGrF1~=;U1Yf+ONir%Y&8HqJm*OS=G6Te<*P*F;#I=6*Q> zpb~okWB;{y!Y<+uS<6L`vakX}`sH4+IH(8Weiec1SXUz|O+f_3xJ2+Hhld+>k%(eB zFQEVfGVFT-J{tqR!oL9K-04p~NVylZx;AA{vx{0IDw83se%tF!W)S)h6AvWI95^H` zV_*|)28r)p5n=E|h}DbX5fLpb5wvL^;n*l62J2CxIy^CE?_45S z(qpw7QRDV;aec9)3bS=EFX8;rjC|z)yNA2j@wJvmlF?R?-M}^@=3O8U{yF`3PPP0Y zIi@ji`011AUpKhCLg1+Q&rR6&3%BgI$tLa9IRbWHVQZ|c;%5VQ6!Dg;Z<`nos^h$egH%;p*+5BNl+ zuLx2?jifgng6L%9o>jIC3-2ZtO;*tk@Bu3R>5v*+l*~Q*ohWkd3DiUHcD&Q3YuC07 z)EF;ttk%E(-39!m-Z{os1rKV;e(e!0MDj&NBXs6QaL%Zi^;^%VAh5e7&N}9%4eovn zRk01n42y-yaGtF*?!A_=32vVq{>_>w1v0mzI6HHcD7M03~F)4Dx4U{-nG$ zW@4QYWs45qw9?ufb=)iQJg*?hWh9${dci>pU&)0*t|FxxTN&6!*us7kpRICXRx)VY zR!02$GnPGIpOQe@B!jAOqn@^oY2yr7d%dfLv4Q)Q1zTEo^A<;yIr%ZHO@P^I$y2Q6 z6aDa@!P%xn$H#qUI9ilzazfMMCi{OG=-1UYEyc1r?(`-9{r&}7#+~_D?taXk?R9ha z!~WflNl#1K%ee3)_Tn*aAVV@xl6j-X)@;)Kf?_}E12p6cR%5P2UM;_r@Ldxw&#rXa zPka|L!ZZzF8Qf#zY8|ewqT8G$wT`MWEwd6KaoNqBfK|-Yb;mXiTtriGRkYE-GOJMH zR*Wkun~aVq+{WMtJTH}o(>8{h9cj0GKXDO8H*X{Q%7BaEiXh8(gj^965fQ&%MdUsM zDIN;A-rm!M899a(-Ctah=Qx%QgvL}`bc`{tZ+QAV>HH-ARZcViauy<*|DdY4T;{*U zcY5qEzq(M~(EOFvqCx+R@k}h0VZ*WT{($ z_3^Xr&wu%5I-SQbF=v$-85x`KE{XNUIF2Bf_t*G^onXI=K#TQO<(f3WWSTgnBcUO* zu8$&&CD1+2VG53S$3Xio7iPw8XoAg7XG|^u`F%xrB!|LXF`3vMar2BA;#;f-6ZOK( zso=)#^y*q?JHgvSG)ZN~XVsNTf>nz&RYMrDLR^_Bedh_3?;1%s*_*e?jM|5d3T^#6 z$5GJ>yOccQ`q+MfMx1ay?04vcon00x`f;e_AR#4@KAxL??37mGD5B zqERKr8)=mjai60I4>pnzhKmN-wqt?=q(96aZt0-t4u z7wh0`VPCxn7bamT3-2RKYKJ0+>BTuxVQlx7QGalPGHLqqL(fgxCe&f^2&=S>(Q}^G zI)A=@izpxY#CI#&NFT}}w*_gY3_#O)pF|lkidXBBM~x|Yjisy8v?*i)RU|%V-NLX3 zo!*w5`2cG2e(U9U%ukiNerAPF-oRqN!C>xyTmJ|^80@!>$g<0MgQ1A-$|gJBO|Mv` zO3b8fVooKcs$ks1;wc7`hQ+%ZQxBB{VOp$g(QPVaLCxBT8VXH8LEbfC;moIH!3yH* zM4TF|d-{-rj3!Hp3+#_3T8B&o?WVPvR=MRj^)WWO<7@jEapdTEH0w$k%12N16~Nx! z&@9mxrM1J*&(8I_Y&JqtK%e{PBP7TYBcW%LhK|G4L!q=*G1=2GPG92Usbieg+ax-N znpuc`29kQGUFyXL^mhXk?_C}Vx?mrj4VJeXviBYIeoI-J7fISHo#9#?J%x*89> z_9jv<-h0r%lP!w-Gmrai2@l6=?y|{R%2Q`r9KgjaChNx@4DBDXFK^Dd{cz#e1FGe! zJd^EB5Gech2$z>`EVUdUWd_dvWK4@{hLtt*zV*16sLB2Wf<}Zxk&GcplPIL{nY{Lr9J^7NIZ)F&;o(>G8+Sbs?EG zjV3FCv13`|_3!LbDw(gKQ%e=vsVQ-nyE1XT}G<2b1M4izL41!>K7-<3iSyKl@o!bXmV zG;TcPu9H2C(#}2gd9<Iw9yzKAr7Z1 zios}@MNR``uQ_y5zw(t9PQP&(H;JaBUt96lG9qE#6>@5yT$o<3|DJg!a`v zB3cb3cP}-&eIs13X@)mIX{|n+*Q$wqg}7Amub|dtwFe_U$C134CA$r$W5v_k&HW+{ z6L!tcPYgY%@79-_*|zNN8Ww6W6iVnV+@+a{y`IVT z<_4*T(QFdWW<1YJ-Vd5Tm>ynB2TETV;;0LiiKfF>lB&7Cl2mUNoi0<=v-)Huj4|&) zM3Tx%L*&fLB)0sAHglA~*80Z?dW|%iMXzl}DSAyZN}*C*t1Twd875hQm&QMdJZb{A z0+!rOFLketh6Kl7IHWlK!Xd>AwxC;1>hLa0S)^ONFS$Q>J3Cx+jAxntBD?W2?t-aG z?O;YVaM~k8!u|8L-X?_kP@F%g&3d?*wNBA* zkj4sZvDOl)+p2T}izPIUPYk<3u!hhFULl!V?kqTiWwZeH_aFBb^6FtZWHE-CwU2h< zi}me84``9^8D6lq2S?#3krF0&{oyCO)-__xHDDSZ-)#tJOjsZ`Qq#RH7X}iMZE^4h zcEl_xj-i$zqo$B(2wCL(i~TI}cxo|`qisKQH~RC=6slG!520D|fb99uzrNde6n^1_ zj!+)EmOauVitZ3)bX$0^_itZb++zv)X=XoyV3iC+HG%slw6ec&7mDCT(1sV|&>n5b z+Q&6~_C-B(uu(Ej_}aNM9*^1}uDW28ZxAwiV`l59$rC-o?=nqHiHvf2)yu*3RF|Sv zpL>j6*Nd042gTSuQ9njRUqFZKF%L%sVLjSL?Fi~9Zr6*#p4GGuH#$DImoDPl_*M3= zk@Z@}7LcIP0>M4W(5L&+{)*TF8dnzB!mV4tU-epGn?Gj`7V4)6nYePdcZibpA@d&I z7*pEXO1$%5l^JFvS2cvEQM_+x^cl-rOm*n445uaLO7YA*lXZ<4QhC z*eVy{DeL^*US}jGlwmn&yDLaK$8^t$xHM_5OnQTIt4sfu=FL6aeuPz$^5b}!=17TB z!6#55IbvLSZAMayV~Nx1iA-1kv#56EPndp@(EF{QY!ovfD-<|y*!3X3==4A@Sj6OH zB@^Y@xCdOe6t?tNv1}$(ONsgL&6aEvp>`TY#Nw88S#rjeVNAgUDXRg^r*DB(ojUM|dIp*;&mnYygr04~<-7|bw{ zPN9vUovQ`=nq!{%#Q8c}jhFMJR|Hn~dEZI1Efyo-I6e%i?~gOk#=|!CAivDE487j? zFUIEzGVUXUmG_LB=W#kzh;P=-}n+?*8$=J(R(4V8Sl0wwBkm>>K1cZgOfLd zi5rm109<1eb(ay%jo?oa?Zcnp_VupIg(;1VY3#xVuSDqiNm!ic-aL6t|iXA&XRnnVuHDi?tBfsPa_U#FB}cVnKg@RKjgu z$_rsO`%Q8oS6#v6E=FRkB8upS{}hw zx`0v-n!>D?8T}dAh6QI9-ZzI0=+-|d_Hs9D=$@`{^x_2^9yHqnUd+aI%1|?Fl`+>; z=qaCUA})7S5r4nF0y^fCgG1T9F#c<*iwneQ7wbQL@oD>P^@-aX+%J3b5GzHEn{RmF z7dynN{IU)_bkgojj%sjy3jfQ^Uqv`@lXlU^=PNsE(6;^NtmZSYC|x{2|9q z(!4SAK)s zrma^*0%{Mv<7rp5=#*@q+S_tz0xB(f;22n^aK1^NNcb@fUoQNDx;b}ozu;2YWd(+i z)W>7!QK-~3wwF|p+Clv(MU7cUp6@+JO@mPcjO+-xx2GqyF=uO|$7j|yTvH15jV^Th zW5TeOx`7)J3~VDbL9Wf6^$i!h9y;A#sWB!OD@zNZLKVIBG-gNhcF8)8Jv@2rr^vlN zVm5@(OL0|KzDI2uTEM&D`_JKA9;JqXy?y+gRubgF%>WeNpgkKy_{m1+B#U0DxC#0y zL_0w{hVcPlYW?q$g0f)dgakV$&3)MXQuL&zir0 zd7;W$W%Mh~P4zxB;qq>Y2!vG6YK|&QdO5-0aRuXG0IBcNu~!4uXTkC`5D}^oH}^i7 zJh?Mg%DFDGk_W*R3y9FQgejUK8uIF>%TSChFe?O)RY(+R*|LrzsaEi9Ba&9!l>!CL z&M7F2M3@*T)-*InP-!X}WNE2f*KOn~nM-8Q-@#eg^=AWKncuS#-?m5_z9|P_{3`)p zOz$eB?Y|1ZwK7*ci|cl)sLxu3n1`01!tbhyxuV-E4qOVjHy#VQ>|?L+WMe<-K5ttA zZNiwsKrw2?)QSU!01?zWtmu0ASw9>A^wTal5tq}M>OMq3vg`wNd0t2E-Gis`W1_;Q zk^e{lkrPU1E*09y@!McT)T!Hi&B7->gPh?6Jwx_`f6V~&FUzahl>~GH_~jZWtt0Rv zz8lcv!#5;-0|Xx^$;C_(rU5E=y#aLHuXA|+F5h4i+w~I#=G{L4PCTyh6H=W*AIF}Q zz??nZJ!}v7CB=)bw_BcOZ1wbaXLWs|fHf>ez}NWD*dc6dDEa*7>}L-p=`0RP&NI43 z==^qjGrMANaT>U#SIt+6J@k&ZSSH>z*LJ;P+T5iguz^`3~WfMNu{>ce`xD{U_AZ$8in!x zuTS_@t@z7z@|GOX&1dUNS>nZDc*XFYec(8yac!a>5AJ*ZKn;d!&wK({#BG@~MPpwPqdEFNYkaj|xp08C+ zga8-U3Oc8YhLhD*H}78Xz@j4My{(Q{r#3Qk*=oJ#B!*M39qIml8zIRHBG|Yjv~{Jf z``vseHTZKmVblFoiToNYZE*_4LUann)|fJ^Ca=BT10I2^y<^lj)Etdiwpa58GzrH@ zEyx)STbUa$_ORoKmK!-vgd70oym{NY$x>Tf+!;7dI6I9zh!Gm5ATtRHhhSQ09N|8V zn%d+Uq5>Gce|33=0Qp!$IRdCBgrz)z+OZxq`y(=LnDxq3x6ybiOE1?>x#zwdo?}5fU11$KN4)0%+ zDnGn=OSGTVT1qF+nwy_EYTOnwXXa_63jfh-_SDr66|SLU=K=&}lHccYl{>TJ5?WTK zJ{ozD)6FI0i16k%0@79a%ZOHgr}SasVJ;kb0FQhqc-5^E;;1@&gF426OdvBwwIjZR z>b~IdrKL`truFz_|Kxs;7~@KR|K%WF%H}qrk$1#WXU{v^xP*G><{2>VEkqqc$XV3i z#cWHD|G{ENerrU07ovrNR1-Y;=BdusW`yVB?G~VR zsAzq3jVblTYBBFag8QsMN$N&{=a{dTlH7t`l&GWA55C};CQ~}kr^#{y?K2$`k8b#(eK&t^Ou`0>g z2fHG~2NldgYzQ*%WX$DCq_h{|>9a!L$sf%%Mn_zPX*FKjuWawIk5rP#ElKMtoyL6Ksn>%i=Uu30;arqpB>Gbk5Frn@23F9HKJ+*46 zJ|MQggJDEW%rne=oodg+55!v2zmjyAlehX1y4nvR>9=?YcVTO31l5Fj5et0bcO`JQ z<3%SIb(3ok>+tNM$=+SpdCcqN;TPc!kE6!MPbl%Kwm*B*mIGwDYF=3J#X; zGecXy0u3YTw}^PWHW51Jmxz>NiLj;l{rd0s8}um!s)ZMMLIau06sO?#_gDJ(61U3q zAeL{z`=U~!ZeL)D3XCQ()6czMMk{bNXNhPJDv>)~T4U|=H?#|Qo`Tx~VRzogm8Swj zQB7FKyaJ*IC0xXT{VO}aa5K9kS96!kN(Fi%Q#RZMpP>`znJ)GG8hQ91HKKJ47bfM*mGWk2YLlf?z+r zgIVlDu*d2HHhZIO4kD3u|MA{JjndL7uj~b$6xti?<;XPg3Q4OYE%BE3|d*7?k)QkTgdv6nB=auGpoAcr8_%sIBAMvD3T;8 zYEcwTQWQne6hqMz%}|S>X=*hzv#3Q;i(brX7PF{DuZE_Xd4A`ApZlEie%!cM3TL{T zLMS5cd*An*=RDtE=e*Darn-^;`p9@94gPd<5P0lL#=Q>>SaA0bY*1&0F5sXaQ$u*s zC%~Nuyn|O;2wESqcG@xe>xoOoelt%TOCO|}ZMLXwhf~^j&R`aV$A)OId**-FAVxZG z+nO9bTtj@2NM}*Ln>VpZbMM$VH!~l!<+ywbBHG-S*N4L8ScBIj94j``=L!Ar=@7Cz zMo5R^usw&kNk8P$YAiV;uu2#QvAtWVf^=!guH3be zkQ0a0X;eQ4olrBtBKBiUDVaM7U3j}5duEVp)8N0O;l&);msH>*CKQ_&POH^TFv0G+0mwdObW<_>>!$y@0mkzGk zU+B1N#w*9uYeSuM$*f)4^^Fu3HQjKBZoSYCwF}@DLr>kvx(M$IJAlI{D=1qXqX`nX ziMS2_@uDfP8(H}9OF%*xd3On1wOz}@vjnjMChm$&_lZp^)qmAY8U_g@;q{cR7)~9E z@-zF{HbQM6ZBLIugz>y>bI5T7d5r#1L8`QH*1lyn-0>12jtE?Y7~fTH5Ie0bj37fi zqkCVD`sQrzpQoksc?>}c?930;c8RMNDxlt=s=M?cXsY{V|iETf@HyY>ubbtAB5$nOz_pZx?K&U9jxk zVc?VY{V-SQsn9t;C{{+G>yoo>GE4{gM64mOA*5OQULSQFzR0sO3h z+2c=*Tn<=!xFBW#S4)R9GMU{(`APXO$)!gbD=hu46tk z1hf@=7pSgdx>>LS4+v0 z+JM0Kw+s|qr8b{SfuS5fGf>IKV7*G9W^Qy-dlJq9`H^sf568imZZ%i`eS;ktSu?pn zITGS_jqymx-VS3tNPXeZBKkgEQ_{jk*rPxvo7q()|8(E+{`Cy}( zbLzRl`nyPg2ueIc@>paaWqLh5de5YTWDLnccUs*&L403KFF?^PfghC+;hDj|C73P) zT^n=tad0Bf*|kbeJ}uU+pIdhlMWLrlD~#$@epfEOVehSOE}c}yaImCIZLBJ7yFQ)7u~E!s8Y_~PUl`Xj>7qOw}m)X`h^mY<;vTWcNx7}4Tn*M<(obQrv9C* z)TD~X-;JoE6!Do*>i~zTe%ipB*$3FvORDI^>J^wy%ZNWQXTp@8_?pRcg|PhaJW&WZgtPb!z|q~ zOcS=){coJjn3**^6D%me5cTjW<#$4{TLuYpGM*I4=k~V;3p0!24*AKt>N7h{n#zZ9 zl>R{J8!T7P+dM$vg`cKlMlq@6ErKxOV@5(%f1LRPNXx`b(8=a_0=lGY3z@5$>w`DI z1FQ5kz^h){U~XtawTN0NGnLPHorH>v&2?w;S>#fXBlbe3i?jmGiRQbwW{^jXv2?69 zTLm+NLsg>cbRXC|ZziqB^L?lAwlsg7A&LdgiT@GqT?Vl&C79 zSpKB@RL2d@B@;dTE2VJp8=cYXlu{wJKM7AR?uMZFQc=#4l;crFZvtK_tw}fSKKV8x zvHmV$j3Bu5E=-7eYUsWud2sSZy-fz#@L0I2Vo%x`K4xF8KJK6(H424qEZ9h%lyk3( zb=AI9)bg8!u$oHf!x$~_XDdC_q+5K8mz8#SO|uUtT5pLF;6(8`Mq-UN--~CBQutV^ z_+bX)`$(=hE;0;9^-Osmf0v`!$Vc(>Ke7M#!thB1XyM(bi>vmXY=@F+SR8l?Uqgkj zcC3V~(aRM)hQv`A1n=4F-sOCNuab7b*Hmfqr=4Iz1}NhV0`hz!lhJo^L*5aPDButR!6_W~3m3en2xU zr$u{;m`3_SV|>S|Y2USP+vc`zLgabJHFa|1i>q5b!+C@3mcfVVQ1mVzUpx~*XF7wb7dt@9MYT&{#*3Dl|_XJ@a{HJ7r5l(0+m6V@UlWsLAsvxA{= z;|aH6!mIh|HX9i0>?hd2Y-GMQ5*-*m4X?}8NTl-hMrIQ6!%#6#85ByPP>{Z!StuM) zL(ZziB@AwJln7J1M(|z(89mr#v+*Ju=!O!42}T!6zvs%x@pYGX=Ha?w-iya!SV}`$ zx(|_+S5OpGReJ{C`>f1{;CgvVN*E=8H%lrgW?pyYv#{BE1Ao3=t<_hQUg=Kalyq=) z5@(r~Yhr>}y^jl9<`wb#>iZP-!$s+xhvjHSy>-IqtM8{AOkojO|=u?EPXBwQLNs;A-pjCAUDL6}y?hfZw=f?!Jd81$Ux1<#npneAF1 zZOh0s>A`TMOY1n^S%c=07%i=(&9NL~hvs!XDBI{(7YK0+!UBJ6+;+vF&bfq^3yeh- z)IPFF=N`X0($A;-FHg^sQi0A`@%9!H*5WYRc=uLp4r$D?6(5(i)B$j!oK~g#BymB> zW-X2T^zzFupVX|$?`&*d#B^rv{#KJwCRuL zd4y5LWiAJ4WySDFe+6xt_8B7`~Q+3_M6WTCNqa;5l8-YaxV13#8}9Kf$_3_nsJkue85- zHMCh;d(<_yF*c(4j0em)McT#6?HvDH)Jun6vsvk7`N&}4 zp0GIhwCPga+T1r6Q3m=C2~~RexJgy}s;~E7SkgJY_c&uW=c`7(@KubQK6so_+qih! z@O3T!&)9e@OgFL77~9HYWrO;3RO}ynt1+^c`G>Cat;a}X>@CGejQw~#-R2RrzbIDO_Ng+b;bBw%769v>FQR(zGk}1_t6&cZz+D-b3C3VY|7Artw4#v%;{UojWKq* z{y2DVbK_~V6wMeg+mvgMGfxvYy|Y~Ts%J?*+R7P99_n4wtzYMi>52DEoAC2?{%Q8z z{{A@s{4oEtUiw{h!ar~SzMW1CKfPd|Ua-&lPM==N_p_<@eQRz?+n%ywkmn8hqfxwI z&!{Oqe%)rn`yxuovDp{+YNYV%LYU$+a--y$lvP#aP(DAdyb`&UtMURsxGddFF!taNyBEgf-e2`N6LeJ%arGkjE88^Fa|?OlYSpL%IS<}O zDT8fB;K9%F8t_oTgvWJ6I-Z}Xa{>{s`Y?y{#yFw?wp8=neH%{=D-lP+9njUwDn#&g z>0($&T6kP|(gY*i%TOx1Yp;lGN0U#LdAMO1@`EGbZqJLsLu6RXZTVe!63cdc(9JIO zX!p&pLr&`G+e=>cy;W1tOxk9e-~?Hms3kbN+%*cR$VVg;eW=4I^u02l)65#Q>l5HY z81zvoPqoLjHP6=YEE>0=FYe_n`7Jo!o(>L0bZRo|ng11!^Tt&G&>qcL&N3}ec4bI? zyfo3sT_f1YIbY%&lm>siV#xE4kPLFS(@)L9Q-rMk4Ems%Mk&8r%IQ9c=T}j@s9zxP z1de}~Zq%miya_kY-pK0x_$ZN}jT3jX>v`8^z@;F8LBM#gP!R-l=tU}rN?EA~!UE(y zpBfb94x#i`H%>|hanp0dpo09~H-{UBpom59r5Q`pb>X)ht7iJmG3|Kk!}iQ)o6p%y zFK)rCJC^gRt@v?-WOt2a!RiT4a}{<;ttcs(wpq&QV5n^zaZhRG#KBIIHz;ybGrRZ( zg$U22-C;EHosBeroQNyN5380+@WX515C10Ag7{`>$Y&_S@|kAX;m<$X$TD2GAFKtQ z&8~aiGUQ1QFJNLenmq#Wop9nCheg5QD^q|!B1NqJ0QwzJ?A^`^X0mNcypsdd*miK* zl4Qzd!mvpr)|xFOb$PrQLl@(4UNVaO~nsiPCj;T81PB0 zJNsrTxmzhiq)z-SoS{nyBaUkI0gh4I^WbM#CTS>j+O>7uaU1G2 z15OTExeRY+jUl5Eqjb4m7#2@ru{`mj_g<@YxCDZXJxt{1D*yt@-_5B!ISsJ+l&Asr zQcbb|Q!j&GzGJ9EC%fO@p4!VnP5V+};;Jp8*|36LxSK7uLM3-|dCsxaMS+=z@L;Je zxyy@QO>_x8B62r+9R9GE%~0cxjh+ipgTEU$^^yVQ``5Mtj9`)brn<*T1o2Vr*#`m@ ziPlW^SL2qkwV+QXs9n6HB^VR#_JB~rny#MBHjjR}tA>`QhV@|oUW-e-j~x}@{xAYj z(t8*z9-;u};cF9H=27ll8>Sn4f4LPVkJUPP*?bFp5I7aJHu8IqcHM`!jr|_oHP>|) z_5f%-1)=7IT=KlPZV+St6@qcv2Y$hMyQXeQ_d>Wrsj+$d2zc`j&aRd+`MU(4VEm!2 zEuBKqH$!~-Pf2wUmJ>V)*Xj&~4JB_z*Y~=fR?x=NHAB0U;uZCcJW}O5!6Z1hGyM*o zwcihHG8%Ee)DTSFel!xJj7wi68tV>udwT`Xy?Q%3i*1plA1!|KK zU#hu-*oV#j$E|$;LkI58W&Mg~bnTd}`GL}!S4FTViNA<+?q>Qj;&tl|9rn2%`pEuL z>VXKXkgjV>zjqRB%hK!TvQ(gF028AuoSLn@qlr|`mof4P@*=N46&kHK>~(a_&BpRYDRtx{tPzp z9~bOW$u(V`byt!G;Kp?xgTI<{`VaVQMurOpTpf=&Z#G*;K#&{&kQ!|_wzPdsoyi^P zBI_m9;C<7PWpQq=aYpE?k>bN$@fLKh@s0SZ+|Ho8o$uhEcm`*p4$C~T0cTOU_f7%j zwwj19T^eR)Z9v7U1tT)@`Eb?kz^hj$jp&NhJE914}BR2NRHdLOJm>^ zY)$T>Zh(QaxsR1kqZpf167AEG^1hyX>?mQ|^f7xjuR6BJ1n#8i;9sd>o4>K~nWIVR ztAQ@8u{{3>T&O-M10?K*b}MCIX8Sjccg$fi0}MxbZhqYOHQ!6oL%*IG2LJYg4GS6S zqD-xlrJ=l*5g?X@lNu-&wh|nXxj9pyxV#tSz%+p_WA0BTCyLa-IPV1Uc7!@Bd4z3q z4Ss=p*5ncKeSqABRf3mta5x83FHPaDZD@iv^6ODY&Qi~Tq-a`8;dNa=L zsf)ptPHt@yQp#%5k@KddHv&)PtcTMxhS}q03t)&Ztj6dj_-X6hetH<#qiLSDVEb9y zFcsqjJJh3Gvh2X`S}^*%7NCE?Gxy?|PmPhtD#*i7-lDWRB{a%}hGo&Rb~7S{;{bxFnwZap@GkJ%;CNW-w+$1Kw_V9 zvqb;|NKP>v&2Lfj8pjPrc+L2gNFRHvSSAG|8DcjMLSYnfS(3+>=GxUu!{S1P!xqZ5 z&r}a(bldLux-acNj9Xf1z`$PDa&V!+-fxULpVceqVq=VAn-Joq(qSTqARLfi+vKp4 zC(_1~lTGW6Zk^mNZS**8wVA#`V<~;rZ`tJ;!n5*25jr{Fq4_~h9pxZ0O02k$_8}IF zgO{Q7gHix9U;evwyNu(FJE|#VsIKLkh5Kvvt$@M$)+e|)kfG+Z#1b%#(*0aFxV4QY z-yzsAmmpFkjH3{sG+4sT8Jh{|)P7Ew1-xptumm!#z@Z;swH^(6l#GjU_1wv7Ve}Vl zzGnRC^MX}TKoDR7fI>8K%7CR1b~>03eC@r}&J*2wfl z+yi4bt(GiHYyj^1$2{K z3l%Chdx9lI>Qm8#Of~Ez1J6SHP-6>QJ#VOt6eDCVVUmh&qPledMPz9ubDDRTM`BwU zxpkPj&*c_5*r-f?kWT^@?kaH@GuvDrtdE3lx@Yl}qgM^}0;U}@X138!wlNd11{??i zVll$NXO9lmbWsB^j3NWuP1{cI)~hN-whh085FFed7Cj?9XxP|zVyjGRsSis{eW~HV zyB?O#aqU_Hj)wYmo6wE*Ozp3?2^B~7nI9+}oE)a7yY9-}-6jv&#I28xvN|H`KEwcX zx;)w&gYgT4SsO;6+$yseOjjDk1%q9gn6I}zpo_`uV&JiE(Y?bjc4m94|3G8 zgJ1cYMst09{&iW}f2!$)#)?3-9nF2smvf_DO`mtyM!x*3?#RwLtcvEWVhJwX_pY;x zc$xlGsm?qp`kpf;)n6XNRxwSU}Vn_)i8-i*en?Z zN=AOsTO~o9J)9KN_?!lty+)^GjWWp;Y2PUshJ;evg=!BizXS~l2#R-_JrT}@l(5`$ zk#i^M?lPT{4~V6>M3q@|t~W}@($FCx8H&^x)1iXLi6`aCrmI~Hg(NC%>?Xe5Rp`v; zNeVC7g?#u*)4k2-fQ2{D@=Y=4i))z*zG1ApJm)MXNYjbe^SYr12^ZMAOSBqKZP;lI zUCe<vW!^dOcq6)?s8C^tu5t?~h?kvCaoziZzL~rRF)2{!?2UgyI@WK#?wz2&~>K z#CVOcHU@&m2#a$cZWY8)Ery!379cjN&MGGmPF7yg+ubuySF?#RZ7mx=bq1*IOSc2x z_3j`qLHWspUHYU;Dui^jK`@S3X51{?3&F}jp)Yo8ret+08iWK!?~XwSmjyO&|Bx7A zNnvk6D^?)rSj#Y!?_hE~X#EtZsZDac1B}N{!NVtQ1EY6+=F7L%?Ixt^aTBR<0d4qj z?(HErg;OBK-oH3vsqRE;AKE16?oxG=7#$*_x<+CiB?2c;DApRqNAj?v8){EhHVGxo z206-RENQ>UQk=K%BZm{Z(2W`s^M~+Z;_4CyTA|rGK3?v}dp@3gz|+I5p>ft4gbJMm(eaPMOT#;n zqf6--L*$I6rkB39`8ug9B@j_Qy42AB$+T<}o~%60VCi-{{=MN_07x$y^VsnLzTan3 zkE!glgHla5#lwR1!K3(N6OaA|7^kWXN4eUQd%=~uGqB`TATE-+*B@`3(#=5ywwu6} z$Tgwb+>I7Gn=8T6Yan{^bODrz#QXIWecg=JU8@hH)?+vJD@#L1eXE_#7r3=G#VYlP3nhSTq$C zIUWZb)geb#t*<5HO~y75?VJHy=P6;+5bL%`*`f!3_H_Vh6Un!%wM8Rue6c>tT?X@a`PgvF zxLClIv7&4@2=Z&2!2WZFA!itD&u}z$tTmL&7P}8um(3CBs%oGUw#Y?!s!iv+^#PNe zcevQW^y%$-9~F)r(ViSlqM~xwbo*O5f~6QuHzICBX~=baW*yfwcidmh!b#Noz%a={ zpg3uI>5UviZHS5U57z7se?vhB#1E#yfuD)6FtQ^Ntpd%8tq3#bnJt(11-nY*%G-o= zG-x`~yf@Bi@TbxnelYd)Zvy9CR>usx{F~W!-L`XdyUn*TL4)4ZR-MC`w-2-=gZgy;h0lR`}Ew8Zl z@@<0}2MAdMt#@g+o+1;Kv235qH|wR{;59<%w7Z5s?N)9`s_IEF|1I*A+Z1?=5NIilgCF^)(ie)-H{qZ@AeTZxm`o8&j8|80^ok}YFu|ke#!BIu z8(m#6h+W9rSu$r*b}qmys1}R^&OL2S2u+;y#&;gF#ySOWS<~>W9r%=j)CxZ`$23eT z&%J5$l(pS<{>cpM*f*uX5Z+wjFcmCw0T`~e471;3ruzu*F6 z><|!}d+_H=`F1595d*$-Mw@Oh+8oN0rh-Y!Nr^sXpZN=Y?9n7lL1x6kF9>?QWb=0F zOWNAegw{B2Bh}EeCeX?(>iB6g2n>nII5q9sNndj{x{0cZG9!Fm5h+#kyU zxMjQlzU^~-p<1%?yHJPCJzW6)5#BP)QLiqh`Hg^O@5mk=(r>S+!jF>9j`Af`)*T2R zG;pd*Ebv%$js{ft_gz%z8+fah4wcIq23mlwB`f6Drn`vhp){(4aSh8x}@!)P{eY%9#yV~2!>ZkqnzZ8PgduRif`ZyR% zqTxCQ4HJDGxHg1qyx{_Su5zTjhBH~Q=8>N(N0z!JOw=i>SZpcX=Yitw_Pt6dt0zk8 zRfgia$qJ?dMXoLl9|@)bt~~p`Q06gqI?;92jX^JT55_$;J)G{XFrNohj>nkEu(Gjp zJ!c-!U_^uRE&WzXE$A+}1CXL76B!B51);NRJ0^nkBh!IoBiI!i8CTT%o!Bmg3xpFB z5*eTe!o95QqX8?1t!5h753LRSatG1lr9C!eY_pgB4BeH|ZWC|zx+_cLlz|ITtf0qH z>1kK2*K*a?1nY?!m}jD4C`6~Z&dFkZL`jiVu}I;D)3|GP{Ef)u#=0e*j-@j03fy|< z@MyNd&)Wg2OL$0k7|Vz!AVnRx;vc|5I$g15yk-+#1YBhRWq$UH3oX0Xbjx7e%47XN zQeL-Yz(CRmN=txr@6`$$?aZi@kbjC*8bm)mYa`L&6^^2Gj}WdWOP3F_xAkpPk8;b?}$t)N|8dZ8qHFduW)PJ4M2<@XT)1 zOG8S_dVQ%8T$Z~`?gU}ra_#rIz(tVkuT2ge1t$k~eEzhcznVc0-V$kG$9qA<35F+#>DAxM7#;RyYYHvJTp%tKz#Wjcu7HC7#(&WF-v2&oXpU~ zPrur<6Y_?<@sa_(}MZ2+c>)4Ji>ecRVgn8zyWcQ{l+x+?f$o%{ra3v? z3NGZ;+ssq0yz3SAHp-JfG%bbZ#s8}v2#W+wb0EugXw$@Sge$I1M@?dzBE>^#89L`xmcK2RUiY&j6mQK}fV>2xDEQm+yE-#nt z2tph2rRkn7=8Cq8pEKC!8!C6r6CaOB%WYeGg-6=RL-Z zzE+>b{Si1u;Tf?^95|hN4$4#-)yse4mom>IZ!LOk_zW+zs0kMgV1UDb?`qVgZrplqY7*!S3$KLK=}F03MC$7H#bX4PfWe-%x5atYto*jKgp_xZ zHv?jMnRp?1uGkCYa1zMN`9>HyIr&=X>EXG2!u{oLOm@*`GT37DO#df-JN>p5ZU1HZ zmq{Aw6T>9b1*>r1Ra-y0qzfO6U@u^Nb+fg}ItR5>3lskstqSehP3PwG$OYy2&(TNQ zPbL1PC;X@NwrziEc#YrbiSMNE=AZWWw(rUk+(mzI@u!2$e*AEMklx#@X#()PkpNV*-$9O$HT!onJAUpwqX%{;)DDhEcO>YZz zpBWLnA0V6=Tm`-nF%aen-XXexEc#e}z9I3u3F|UnyLD+nh5o=6UqYnONeQ1HYs%6jz(^qtCqyKa&&xN*=q+}TNPkhtQau=} z!H6ry60tpS!A4NlVATJ=T^Y}`^BucW?}7M8#BY=`vUAj<+jKr$j)8_Ru;o50ef7A_WiIS$J9}ih+j!jSz;6n;@9S<;FP-e=A1SEE zI!ad?ywL)HPz($Ieask=RRW9O!2$`(<%`m5j_?qk0iw=3x@HT%W8}uXDFybtZIyc2 z{`*hvUN^}Yybpk48nYRDV?+@4BSS|v?)3eKyWJXs$s4}lnJy!6K{@; z?(n2Z-3U-TuimN727f(X9n@?1P2e5Zq{3Z?L4PN+G$Fd^*r$inVkwYK1S>3wQ3zrj zd7)U-;14&Kf@w5)JuTFoN}umOZGOU{J@cOJDqFJMai5!P-85D-E&I|t#>W1>yk=Hd zuJ*g;Rh_XpOOzR_zw!fH{CyLkm(!g6dyxMfx1TSXAh5dYcJ+lUO3&M0F{kZF-1f5V zL#&_wp}|1~72T?aDTsR8td_LaaT8PG#W|Z1eHriEp0mGI%ShY4VPk*KsvAe_Zb`!x zdn*f?Jl?l4vxjdPi}}!aY1^x|pYYWojA`zOJ)!-qdebKPFz%ZjMwsZx=scX+dBnaW zOtg{qAL+a&^@R8D8VonHHb?inCN8Zyx;WafREt%X$s2oMytH${u%dt{t$3GAz)0Pz z=?j;(FIq8Z-3^g8I`8?Oea0R*+o!$Xv(H$`JBDLXC++{9eXo55;2rx371Pe|*>6!c z?f#z8P8DMOd_LbZ1}{n^EB3B&BX1jp)srwiHhraaaf~>5Phuh2{C#9`{rQ8^z3UV z;z8on0y)l$c-Ib$!{DjG4xUEmziV27im=Oru4(yY6-n3eJ;Z_1VedAhkioCM$^{@W z-HYIxdLbw+9GMy(!|_{v3fc=`;hfa;b=Hwm%%ZpFDTAj{u!CRJ6ZSJwpIZ}5)MOT@ zq&*_-ZXr0@yB1{<1*R={<7y0v`lP?VR_W^4gg?iHyd_ryno_Mw#MPLR^DHpL=WP{) zDO<4reGp0797&~;V%uW3Qmdg?DuQ`L1e6%e3s;nlR1dRslIuhPp0+!hO5>Wj;KEzY zW3Fs1f$>T0DM@uR;%yt#&1mT}l&ZEYg@ZMPYv9{?vPwMcbEEfiky%drKF==x~x%-w@uc8f}lW{45I=hopfyC%gcWau{Fl)$MDZdChRdo#8x(`;xd{ZLjC?7jScoa{NZamiDNgR7Mf73_8T@bW7^EJQ zDuaW@B*vFHz_L0eDQ76tgOz2XR9Y z7znKX@fa0oG!n;!rhR-yQ1J~^)w15j{WUBo?5qX`zgiyZ6Avz_I|Q>olLw7 zmVM-}^psN4pV?TfLgJ+@{KGr;z}4jp>Ey-CI6pA|koFW+I6)O&wYyU!-SLLwN;>FJ zbbR-dMUy~0Cf0G;d}{P)U;(MUXV731Z$8st{0(!P7Umyo0u~v*yI4$8ax=u#n^`Vt-0#7JA@Tasz9sG#lsjJem z!bw2Lq4Il#5@h%|JDfB9I8|#d|AgGL8A@_vB~AF$rU@$YaGH6}8B>_RwV;f5&afgJ z7X6Q>$ZUK%mW5;W99&Sb@`}&2X4t$w#OIsCbvcuw^6wAN+ZqeYWfvrg=Z_1a0S2fR z2_iSZ(wI>*bIVF3gvdsYE*;r?{B-DZ!!&Ayq6K47p(m!I*X;8&v!|(f(;hit_l%3U z-_8u1`_O(Xz`Se1+LVsVMhot|YC2V%EGqIH)l3M=B4ZGQoV7A+aQ{`ZO2j9)nQi8$t!|IH=KC__C3@tQC;h`ht-X z23WSW$DO4Bc5Aic_Qbsj*pF0bB>KP{-B#uJzCN@wo(t=re3ieMF$+FewL80bz_KJKOIlvGk>zz=HmJ!;UCyw_N=Ixs_=U4!IY3v}O4Dr% zu*S2e2rat+i9sPq#MprnoX`6sq}Wn+0u!ynHEVC<$z#+J7xRkes3dTe{v}>LNwAw&P^gD)r zS9b8BTlS`+i0K#1lAg|sY)%3xlxX})m%Dq;*i8X35T_IM9#WPXZY*l23nA&tr9gw@ zOJZ7kjC~y6oCK;j5ds>}>CPR;D!`9r2k@9Jg+eEsb0d`w!98meqg=xGibz?gqF2S2 zx6Mj!4u`UnPGol~aJ;l30~7)2W^#Dj?rE>F4$grSz0W34B>k#AQ$mPsgL$5@dydMlbJtXjR$f=wKi3EgnF>VbV}H= zGrK^Mx(^>%P1buFb=oTO`oLiMFvm9>U=kKgq(~W%&lNT(k zFFCtgI@msh&c)NqiMo4mzli4~biA=M0BJ$WiTN(1H!{!D5arL*n?+zAb#Ul3SD1|T zVCAs*u#G9TJK!$VkfKRfLX)fl271$=2IJ>4HT>}jhX+iIDoe*mLQv#{sYrKR zF>}Cs_&6*Qmg1VRArKxW@mozm5y$9PabKmUOh}r9SPw;ueM;EpXUBN z!*k=Gs9>I*^xi!30#+crY0^+=N7TkG({6mrCnZp>*%e}2K6|s+%;3LD`5qpX&z)`M zw&Un2{o5Q2QLP8lljsA))SWkJFYF*aRbs$LSKHGrFw_OCsx>JTF;)L;b4{mhwbI2B zqESNn0IO*#de}dmJZs<7nMd3?Tuqgmx;>oqYPpijEnHr15$|$l>&r&qtfx0Fxu+0W zqi$;~tBpkXrq|}OyGSW3>-*t!J|?>Lwv8iGp-(K8s2V;4FrGj=tlD1+(A>yLyVc2x z-yAz|niDcEUE5%c4??EU_t%W{ZdiHB<5d2JDMIGD$kr5-wDAvzC;vwn$1LuZ?Zkfrk$XCgn4#Fb~rH2haPjW6cA z38>&Kyc29E%n?D5!VdcUpRsR_57G4lyO$PbFL8V)&xz!I*Ge3u`aZSa-?6_K7g^Ug z-?8f)ih%p~FyDLJ#ymcZSJR&6xM}d8ed(vofUevBty=sGHWJj|>c!)4gUH`AQgxxA zTJX_2t21Y0114op;ZORu(_#}X(2IMs)?XY?G965E`puodzYl|kdv8li%dU_UXvT`~__g33VcMGs5QAeKs-Zs=} z@F%Vf+FwdRfqVk{XyC#^VPk3pfgD;Cf&lU^rTlP1$i|Q?oE?UV@CYu7t64AcpjJWi z%+8RJWUq(UtX*)%oRW3|pmqCqE^9ZuMxJH9OuoT?95n7$qHc>5b-_1!?59tY2X(6Qc#5h44)#M+S zy+xV-`qeM0X+mJ!uYRd+#G11csC-v!xdT1Ok&S7W-;K#j+hzUJlb8;2Rz&NO*Oq!t zD`)aGWxIJTI{J@dJSK>23VsXT2-k5AnT^~XOyc?(*HVP|)q1`tM?+B)eKi%kJjvNWjAem(sR^`yvYO%_+1M&hTI{~ z@}@b)@Bf}`6atUQN8zWJ#^28j53|K?J-I*Jjq`cLVJ%~}sY+l3)Qm!WZAv5C19zqm z_|^*+B<-7Nfxzq|#D9bTMg~=lVcr-*nogw{NUB1f1Ayz$1i&4LGLo4jLPYQuO$Vcq z@wmF4>6#6@Rwj;^UpW#O3SSYiFVWTobr$>C(|I-C(6VArqAp&y5qbHR^2)w;-e9Sc z$7Q=?)qE9V2}CVBHiDhD!+fBqRA#`~0CT&0CN_Imq$^8R!OaWE+(+>3a2pTpTyB zEA~uXXQZ#DUJ!?dgw&DgmX;QpAjNN`U0K?_ffdN4IGIfjx^_JIyl0Jd-Y{5+N$c@g zk2YhWzNd%pc%!GuwJZgU8U~yMxrJyT1j!R2xEjnJT@uQsqUG*dBwT)~v)nk9afY_9 z1fL$9LD9!u5x5qMi#sCYB!kuE?rc`WBE^UZ&m8ftkX6ITM+R}*!%6$fLgwp6N1X0- z%&$@-!O4~v!Cgc-L>e615h-MN73ff#zzDsf4&%;f6YEw5+4z54x41}_3-at& zEGW_|c(D=*X_*pfI6(ojbYgv)YA~9M72;3B0J&YU8z}oIBZB40VOqD5r8<}owwLcs z+@ldxi$gcl6vcIP*3C>pdM6bNZ3Z7RHtmr^deMr*7cIK#W*Z3Rfvpr__k9xEU@uh; z5Ob+PeJ@AyYE^74#nfR^3C}x>Q2=f1&Dfi3`)RgjSO;D(l=g<>ONk5YCp&^nE)7_1 zx;MdMtEOUBZGNaxHjdU|o-2M)&wFLlF~yanl-qOAR{(Wy8hm~qj+(Yjrk8-3)cbk6 z3vmGM>%(Fk90klcH?nEm`<8t&*KgO7K|3m$o$BIO@k4FG#BU*}n3MDXENNy>2%y{u z9!SbSPmlCat5HOktZ6N9H6a5tASpbj^SFGqP5h?8AGwwA$x9bURoV*%7}=e2T4zoL zw`D&Q4jP&Xa*J(L^LS>sR}OmtXr=9rJJ3(h7O$&zv9`A`EZBoJCRsJ>^?DILjMSN& zVffkO7|e6r>3oF$gfGUODB;jkqVb~PPiG@TrRFs#gfT)#K_RHc(sOZoY1v?j3WCn% zsTZyEwL=e5;5UK{LG+9rq6fNkijO-EG7)Y()_eC2k{{$yv)<4$f@>de!4h7*ARCpos|_n{JPEO!{$&D0>b05s3c^T0 zAqQv;a`bh5y06n7SC+0G1r(Rc1*HkHd5J-@Gft2M1o6V3u64zVP)+x9G7V;o=ec$# z&y)6Gj*yTAQ!~r2~Zq`jg0(^yO?rN(5Np*Wstu3V`p(=NMoV6g&=(JhT z%OYLyB_VwB)(&3Prv@ps9w=JQL;*(R4juslIX=w#tNL zylZ0;-;^PPBocj$7liH5x{)y8$D)9>W^lck#{yGyRbj*`W!RtLX)9PE`b z|7_;aa%t@*kHF#B>g6jJO_X0VM2Np++rc_A>~aD4wY^{iU^+s11Q*;riIQ5{B$$qJ zPdT<6{2)Lc=|!)N!*AF|W_Pave&pJ1yB5kSJz3VhnISBY!M3povf>&zvs+3Nb-& z2ClMGuNgz5Pg#;Xmk9YYh9=s|nN*cs{^AOUcY+2C57p5wo~kP=F*9I?R@bt-mdjd} zGt8yh^Vxw!T#FKd2tZ7OJTIJt+g(vgw0+&$>VaB8>D6kC8SS)2r%RNkHBr4u0-=x= z@pPgR1x&6Sl0af&nKco`eHn>LY}pp&(XsdCk!<`#7$81WrLVNGJU)Fa*e%Hcgol8R zyI^#27A_Z77{z|u{thuK&6Hdia;!}U_Fm>C6+K{kR4PBaRI6NRG#j0Kto6RBbjJl- z70Wy52t$W)A4X80;k8+dqA%xD{7~Lx`;X*&k(2FQUQJ0f);jYPas*t6SUdM@oMItF zTayOUz#erL`fwI$8N@XBFFrv#s_UDw<{-DZevHg{6Uv2bt?Eq!?iz_-yB9NVtWqtY zqq?CxW~4c6ih(RCdg~)YG+xJ9Lof1xKAjo-)$8_={Ss&;r+#@1nvlU1GQx0&bQtam z14^EmBAjXz`igyriwhqR8X_&{Y%c0G5=Due5(>)0dwqaqHD@*ldGIrN$gkUws2BQ! z7+gK>^4_S$xVV(IK&;-!+?)9gp764bM7Nwz&=ADMG`IPTrQ)pl2zWs;YM2gu?~kIt z$-P%biI^uF?1LBVTK(P#w{__tXpQeKXSB)=rURiWR`RUg`kMAG863K6(O?Hh>ABxB z)gB5APY{wvG7DIShqWAf*%FGsm39=H`hA=X@e_Q@TULA)3Khe7j+9rKnHU`ojhWKX zGFe)~3KQYMSzhGXGL|h@uGxw^pX?rQ-PrZIW#{|H!Tqv3j&wi2W>Cm0wvy(t{!vPw zB^~M>%kh_v^p7*bVKv6O;R6F83zy##(O3}}YuxeNib0OJc2_Odj9R0_fo?`_u} z*hX61|01RyWA7z6;tc51^8x{9e2+8 zog`+?+dYvD`l##vBktnYDQ5Zsb;g#}cm{v4U<+3209Fn!O1?X42Q~*8>|aCVrS}|| zHlUGw!DZoza6CQfQ7ZuKWIBYB34f04xONjjBomxDhY}Tv-@qc+`^Z@B`cJxnsF%#{ z%o-|zdd`lF$})rgS{C|;Rpy-g-Zc0;`|f%5e9VZoVnr=D9h9<+L?2t0P$QN)d=g%}J^LTnpjZ%XlfVoqC+Pb*iRncO zWxI4(j${O5SR>yz8F4SDy<>nfCIrQIkkd>?QUq3;mn@sd8(8s2wOY&*>yeEz3-;xo zdONKEu8RbrqTQqSI22IYPPWn*N}(&60Ux@F?otPeiZP!g?eSYldvIcsd33H#M)Dc2pVHu|hZjn@p?$wUcJ-`DE<|VbCKrl)juKlxs3{IP2tBEI;^#+`A7+~WD#t7&z zM2OY3me+vMnb|LGtp4s37D{q3{I|>}tj(eCaaFic`iSXBt*0@PrKZGur@Ti8V+o!j zkK5jcnGV)#zHDpY8F(!nDw&r~4segXP>mp+P?W$tB@r1H))>Q1Wt>P$D0Yrkfs7TPr_-Kd3ax(3$*Kp8O*fK^h4f1%lUD$ys~VtoUvKyK1IR(4%L!j+_j&MSA1yqv+?AgU@~roU)>>I zv%jy~KW>3ZJ}MR%Z1T_;!QX7thd78KRolO8?m;1o_nYidj?757t7kLw)jq2*XNqOv>wQ1YW>gRQwqC(H-6`~P z9a>*|USpnDH$x}!CmsQCmx|s|yL};FZmUJ_E_29l+IKM8&ZJH5_){ZkQ&ec*J6_c0Z4+7F+WCH}F z8mQ%PYfkly3Qd@I#h`LSSZazlI|g=zdAtJLQXJVb@!;qPEyMT3hG>g>rYU1nU`g-D zKDtZlStGslit&UDmHA4e+@yWCHj@#09BtM$!W7!9Q~b&?Hxa*1ZCE~!M@eKQuFcwT z(`QQd8jAVbSWVH3xGE@LZn{7wWQ7!^;zi0PVU6p<$!U&?8FP=Ce% z!po|AbU8emlMV4nJjJ+R!)k*QJ|ga?Q0WX4z_ihdV*k{DlYN2Ai}tr-IaA9IF69yd znJt_YSycc2E1dV$6=NhkH(x_LOINN+HaN--Y4EE>TUb!lZ3S)Z3@MuS`49M3irhep z6iuzdbse4orKk|RDw$;Mfq*Y19lA^P4SzA4xr-NxHg8*8!?WzCeAx(r^r9Atckb9< z^2c5_Ht^&W=OW4t<{dT<>=Wmb$;_bAW^7M&)8*yV^5(U5ccyQhx2MY*Q1>nh-fA8# zeBcl)f*q7AtQcCUKV_J{oDKCU?*(4-a7jq^9v~?+SDTIuA-b6pLA<;`RmUn)+HL+3 z&%n$7yo(~Tn5a_JRd_f=JZRIv?9VXzqfh0s}rB!qPnc zplr?`oq@D-&UDxd<`F+{_Y=A}M{$OS|BYa)*c(Uv`?ZJ_(oR?(9c-JCcDbyYrBm~IR0=vs3u8E`l*{g45@-aNLX*1O2 zYeB$>v%RklZ9d6M0=iC_?9-()JACxC8f5otL0o(>l%pc$iAa6KN9m_Z`sB2Yi3{(I zQLDCUKWX021}wcYw-8dt%2Zq!GGKVWx*o!nlQm!N;amu{9ey|WF|j{{Yts4O&4&=- zl;XC1*Sr*&&2CHax&ckp0U+NovfxVllYEX*>50-z-oy~IbA9|gAjju{DI%!QB9UG% z;=A1oTi2EOXB7JSah;`;<(x*e2?HU1j3ZL3Hz^20tn{JjK-R`;`5yd@`^)jbnwRW; z={+^cD6Zy=El3rFi!^UsQ^*cOqIbew;7M)M^qB;Y8b^e4QO0>7ZTxI2SppU9H6~nV zCi|+`f<#a`*VmIZ#P%@77$WROr{Gtrl%Af&d{KV!d=KRtHLh|RYKTL!KtDb?^Xus{ zTjWoJqx8_Vl510$OdN#CPtq3l31@B_jcXTx*`PXsPU+L97qK?Ar~be^^4dd}W5G47 zK|0`W?s1DHz>@FoPuF<^?(3HFqu-W;3EuD6E&jfx-IsD5;&q!_IE+(hu`j5OPwm;W zHvT#L{d@L0toLnP^zlvmEA2jSccJF6*_774X?Xg!VN#aY%MZ94d~?$Nzfk-=Z?254 z>-%pN-}ASBZzcTv{E6aw{`T)r*bAh8JEbT7=VU*(Up3yhOx<4c$;8^I4_SBK0~q06 zdAI_WAC==u%uQvmz8oe5W3Q~2ly6&?wox`9S-AwrXyw@-aqg62b^!@J9q-un;w6p-CGCJ5r3j<75F5^bshIC z=b3M1tOG@?!q<4lW+JAw?aPOJ4*#xBLA1YzO3_N14*2u$*qG$LbYO_#XN0@>=5(gU z6{|G*QzZpP-ySM!u=HcCo4LJfBNKocRknX_jV<4_-^lk${`_rPU3OnEoJ8w)`eHrf zm5et2Eg1{1YogVZ#6fT3JGq-4d8($n9-d;De|cr3x#2Tq^Vuky_MWvdubWh%@%YYY zwdXDSc{gJod9#)5=Uesu-?xJK!+f7zAN-sp0~E`S##NFbMAY49`ZB2JtmFoIVM}A7 zrXU?Z<>bqkA;|(lqRSrDLBt!8b7rI5_CX)!1^Z#i`*BE7Pqr9M?bG9kaLbM zWndVB;oYST0=5~YWMddDa>ddgSS*%J$FUp*8AU*MRmpXb#)26`aJY;KX&?_~MMA&TS<5^~8_k;ihsxbn zCr}5yUA`X;bwU-0l=CN9$R>GX;WvSU8<+Z9Zgk^~$X5-|_%k48i#p-!O;V6x?*_Wznos?h}S zf7%Uvdkc3>=8#h+WTB1`bSglV`>^DdmztM|BAismcniFZxi0W9o+xZ3V}l?fpB!5F z)z1^fr~;1knDiEI8sjh}iYE>%l70kpWq87UrR!MY+`%V)!&q=H86JEcTtyFnL@T$z zs^5x+a0E1l4+uCwrZc0Qg9#BfdUvhQ>}plA?Bjz8>;f1RW&|THjSOj)uPcuInlNBr zSO(5X-P1Nj;J?vJ5*%OjNf;iHk@apo@v6gB!aFXf&|tue z{(OyJ;fHHwxUku{N_%9+zFaqxFp^R#T7`_As~7MjE)bQRZ%V~2gSTdh#&Z~^k>G%N z1X_Nr9A$Lt1H+iFHN*+ZE7pV(@IY-yJqWTHzMO57Z7DZxGb{^2jJ{?6-L78DIz^M? z+P-U`QrSFbSz@%0f)VAFc>1_qb@aEH7YmG06*8o=VlK3o7=u8ZPiijLo=&s|qV}#m zFV;k7N(5cdLhP~jpsU{xrppF5P1;-6H=lWOOlh*?60&k=c;)t!EeJ z2(q_PJRY@d%aK{3chntKMROqw)Ea4*LWik|if%W^4g0ywN`w6%AHt-+#XgLRbpg?J zmdIrd(TS!5j3en>ej~+7bZ}Tr8kyQQW@~-xM0PmZM$<+c{Bj|KHtAq4C#XOaFo&83L_H!4}1Js>Yq1{=GqFjDwwhRAu>SrD>J5|ndSPrT$$5ISnc{**UzimQ_G zv#hjYn`YdB`FGO$+}+eNs7J@y)P_>}z;z*ORT6^r*P6iH1Oy`@^%c`ND^_>J5m1jI z`YXNYE3RjAD1AOO70!KL>)>x?Kv=B21V|BV1iH&^BsU*g0whGmqvT)>84pr+*NtTf zVU&x(TPYb*g<3{-`NTGpQiSal^0++?KMv*uYzm1OvSb_Xx3TQ+Dm&BDVgqNKgxeN41 zMaGcw@R^Rr19&_vKg80}gy(H6U}vGs#@MyGgg7MfNmGDUP^0;4_OzKVt=U)*SspGf zs7?@2#NsR~>47y}#WdMg>W!xqSlZYp7Kbe6{gM|l3*k{sTq7@5?-63ZjAris>6(g``ozi)*qx%eQi~XdPGJ{jI zp=(`!BgR0j4HbwS9Dqi`a0R1kH1+j>owRe=sD92$pX+9C87X`YwzK2igF9_%g5S8t zj=15L*ulSBt{#F-{UON1ka`Fp^bixvt1n|y{}wjJeF0g^)~v(`FB&n+z>rx`@yvbS zz$Y+6d3q38&x;lU3M4-}Z@cTpp0uz2toBp$buXEpRrdH?v`_KIc{aVAw=1QojaRt2 zB(e~ARvs@)Uo&t?*0N_wcC#KAwS#iS>42Za5qhdL%2`U@0c^qXKF)}129k`N z`XRO9g5w5iu;%Rwc$FD-hgx9Gyr@xmU52{P{T1{javGZLXZOx_fa2aQcq<=vCy0sQ z?>coR83Uh^1eaK_c+J2D@94a?n+J113*h&;&thjP78 zT3Qc8iNP5+beVd;BXpEYiT)!yp!cLUSMNFm&5xuNfM6`q0=^NI zwue}8b9ThdbtY@krYuCx$=#1%gr9gKjH!wnI(mRH945y%@e>ko)4pp$!WwEkBieF8 z0-C=5ah`Uo<+C!Edt>4_ln-8Ob8cdi6@v|lEF}}M3EqOv%C#tG-Opd#=^6lVh&Lsq&isSJ0OE(&B@#TSOv^;c# z%8RyWC|fLh@ZUDqVa@)+c_4aD`v`&L>EJgJ9vW;%<0>pk z4H$dygCT=TA*B5tJ^{y?&GL!n+V;CCEu(d@n)HSe1>MizxpKmBq<1*B=pk?Zn&!)< zv(bu-n|2cYJfHukU2K^1L}}WGL#o&UUAdYuOD8Q>Jk1dq)m^LOaGYKx(DYaGE!kL+ z4n|Pc3}^TpXmr#oUSQzV`dnwr=Qq9Ej(wJL@O=w0RyumozPmTvZBJ5NzJJ^?&$dK! zh=Bsd4lLFsJ?Nqg~Q`37E*o0;}OBYdg_yLWVTFIFFZl~Q5dY1zF8 z+3VObh8{g`^x(XAAMJR?)^+QL_bY6flCzn1YyEh88NMBk+jIo%m)k=-R_}jJ;R(?c>G0ls-2y1>#LtHs5Y|)oha)p+N9Nb z{s%@CV&(^ycnPYBE-xC*BvG!1XS3Xw0d1FtO0GsM}T?&}Z4i>o(l?HfCi5!d1?U|3#%&s>x zc@@s3U6m<(k|T0ZK^Ke+x`R(BJyUnvYy;cg6?>Z5r35(^g!d_GGvH_TG%COjCd^yy z2;m=Q_aS{yqZQ0x0sNeknbY( zZ`Lw<=5Kb_L1WsD->f4T86oXy`l7@V*n(pJ-uy!&2>)iyYgw_M$osk_B;Pcq#&3T) z-;Y3j%XW_bPibc7>o$fef@v2-^hi7HSRbw{t<=PA5+j(A`^p|kqJ_xS4ZYZx9(A-d zTR$m(zgIBq?Zgu6P(&{q!^ul$$1yd|myI!bN6s1hON!>@Ax^O#BOiM=x^ls;;A!*H zRJ?(YZLP#V=_rgGMZNpBYWzhYi|j;th5RDfI(mJ0k{yM>c+;-Q|JU7kop1~}QM_OC zIQKD93zJWAmAHXX?heOzm^16c2yqWJAAD|(S;3=88+SZQ#oz$>xlM;V0T5^$r3bYL z)dJ|UfiV>7DVd2Di?k-`SU@E-CW%?5JTb*W8<`P}s1TaOW&7yc+T{f>7 z(##VXL9e1$v_v2Q;5a}{sWno6M2m~IBv7uG(FvvL1VRKmDI2VV+=*E+xbg%2P)?g(Ouhfzor;-AEjaw4Xl%hc-)3tTdYT zku%@24+fwGSg$2O@>m)_*d-lgB=tS9Dz+&)rZ^{^kyy1Q!gfk>V2(6T4={}Ok>P@Q z^quad5=gp^eg-#ZX@9vxRnNc`X~$@`y_~A$s~*;2=j2j^Zhbw&dds9Atf-`e$U<35 z^3D14E_^kn%k_XM9qPc7=&x9-W3iuV8F%~DX2e}D8{SBpQW!}4erSK8d*E5%q_-n& zhfd}unZ7+~62Wg06#C846@0eiF!Jvghrho${B1{C$B#cxAp6@=AVam^7A(TPiu8sauKp23BhLb#t)?taQLv~s9xL;6stc+a);|kSV$Li z!cB#Tp@LjIRAxHHHMvk_+osO{hj(RH(!=)iXeBR-%F3xUCv8Xag9I>;0lg>YR6~~s zLeZ~#ejt`TOz%y0Y)hHe$L^jrjr_hDf^fR-r+4yNfed|`_N(~^>x{ZTYZwD}Y4>T< z@HE_?F=z5UOXgj)#N|aZcnfxCTZ3IoGv?yUL-0G&a`TFe5_Cbg-%qE~)58@$ZMCQx zGJQvt>S=>!F+=OmrQP+tX)oz<-&T!AFfH{Gn!uC6oY*&>#^@k5dDhi&Zgm*Q($zIq<~q zcw4c$u)*T3tiPV}aim|Hvzphn?G=;P!|6F2D;)QL0tR4+EugRUi+>8=_$jxl^7U-^jDWK=A~3 z&@JkM2^cb=m{J@K83^tc6UgP~rz5%zJ_vT>#r*OkA-5|b8JQSWCP;`W8=4RrMx#Ol z%rJ#I88kwmvt0A}jDDVY)}CdZ;0Ps%KZ}B7-HsL3;!c{#G#&#btmJ$j{rtgL|8%Do z|Mex)RMIIbZQV2=0u}C;Vhi}DD~^l1yU61xk#_Lb3#^Yf>p)0pc=-9MeS>dUdcHcL zZm7+#Zw@h~Or?fnWU*tQsaz#QikTs@dB3!YZH5{YYqK*mDoXA?dK4tC4-Szbs3$L% zT^c%`#Z0HcAOGgTau!GE;R_nM)8HRA2W&m-hhGOP0b10_ORSd6gv6b*CCGhojq=tI z*Tbl9@Q?qaEzHksOoRX9>$Efpp~v0R)9F9`kFb~#ZEkG7nzo+nGP9d%y473e>7Frv z)pKqA=2&?I#K{{$sYGA~r4#Z2WqVZjpxjTQ#A3CblptTQ=!dxH`{oI++d*x(10FFe z5{brubcooOtIc0IeDCvkcBEP2Lp@9qY}SX;S!$y!W^y)axvZr~<8r92NxyN4FL0%Hcb(Us`L6JdT% zo8vAlFjyZ}mA>4?@v)@Il!6TO;eVA2`yd~GyEI~*$l5VNT*uKb(*_Z+#&NZ4BSO2b zp>Znupdsz6YvcsQ8}7J-+W|1*MM46q81!op0PzUS!kV-|B=RFxEHA$>DRP z9yh=H+rzt2G2Ru%IuUch@zU@P(huyyqJ+xW`j(W4R&_CdFO0Zu=RTz<<%>K1NuXGw z@5@7=yl;8JXU|fvIZd%#79y!SR(awlVwJGle1#3QhlZQH*Id-EwE-kv71i4H}=^-&b%(iQu9 z%A6d4?*$+p$I)oVL)xzAz%zrqZiQ&X(w=<8z4F>YaKu!g z5yYa86j7&R&MYM61L=`8Q7eL8af;zW#|@KNgWo@8dA3tFL8&rPW>ip7UXh3(*`OGe zQ~@;;rAknVzm;~3IEeU?r@Y%7mB;rbUxgyYBv~|ic`M*Jp67YfmIoq&$87vjZAH-4 zZ{bkZc+}cD_@na~%OpmXo)YEZHWJH`Hioij`Y2P9e`)S!p`4|C$U%Ad0w-jWkwKu< z_zyQ~lxYH;W(-n(RCQoh(*Y7ixf!`qZ(6cGgg`~Ob7it(JtdQH z&vX`Fmz4!w@V%cpM`F=7#g={x*hJq842d%$!=s@TYKwwccL{UblR)&s4XES2umI^* zlyGz?NT5rI;@$KpEt$!%aOu`$YvR=k%Le-oZ46@FE|is)6CR^0BHRa@hh!OxNuVt~ zFQR5|L5W@gOqfN;yhD5vk~sK0Bo_rD=z0f(IMtf|s^`rx(-YE4- zI#hnMVsk_W35}ADmES8mivEpA#H7W|L{7EgF1M0??mXA^C=WtXaXirWJr#V7(k6s( z$pAyYmsbOKm)nzJgMTv_+SZ5ij<7*4M6OL-FEH1l=_i6hI6Vp1PNE|Wz^6*2m*kSC zVq`g5-q9x8(4!grm#_CiYkSs4?IdzTaN$90=Az|VlDe!P63p0g8C`-2A~6O2f}b?7 zBE)8Fjd6ceb>aL4D5Y~CGbv`)VL@TcCs7P274>4GHQ~CfEG+dg$!cED{0b6@*xHV0 zMsjWm3=5#Qga?#eNN=jIbZRnqdLW=gImvPy$xKgRgdpD@If|Sfizh+0N0}J!G?GzA z&!Xqmy^Eis1V=0#oyGHB>(TdoBHEvXe0Wc2FD!%!{}J@zQtnt!nuB z-=dR=`h;rWR2ty^;YQDm*~yTyG$Ar@Ibx~dD#(e$RJfg$j`KbV7fOM(ITA3Qz*L$y z5PRMh48KXAaaZiOfGEU|-Kdyk&UEBm3w@gC<|vpY8xj(+#^1bE4g=Fwo3C zyu^8n#AogIxAV_=J5Sg9Rc z1w{g8E^82UgLg7^ZA6Wnt~QN&)sKB&Kh82wII)mrKW$hu$Rr9)9aQ)tZDwKdC_41N zoJKiO?m4%6vdH@4qc}6Uhp`zX$l`it!*2hcg>gI*)q{``t+e^JiS~B>qf51u ze=b8hxf>+#g3w*z9A-xM+8&v~-%N)V&)}Ag4_clwyRvHHSaFo2WO{^RIYa6Q|CF8p z>Ich!%{*_L6zGWs9m*Gk}YQ5LNIRrF%ZM|=+LD@iikbceX=$pr|s`HM$$gV)tb$)nCG!4PPAv>`}4LhfS;H1To-KA*9<0H z$RPV~*=5ahlL0K3d(L_+DQ zT3PB1ZiKL2)k+%+lL5VCk4zE~Pa6cHfkT_O0o)uVs7j!FlyGn>W>3}yhsnkhx^H{e z6zZMKGNFLaoU)zA?GEgV^{NbhHD_YUSxkiSbM_y#BqKIwg4(QF9XI}{J#{?K`kAsQ z(!857$9-Rp1(;TQzTPy>Zouz7hIz(h^CoFr3ET%Ozsz%pNWVeWHW<#T@+T)QI&>LN zs2yo1g#$vn2S7Oc&GV+Q0JOj1$jdELqKqIy8&m2&Sd6q>LBcNnV$2E6^OH^8NRu5$ zHNq73946ioV6eNT~Y!DOohtJzgrDD~0wfolOgUA7bKCBqtkS9}Z!AHxakMsdS z8Vw@aVaMURv?=&`la!?8A>&I^7Nc;eEBMS@xoUIhik~*AO$+Yn=sVg~52p`I8*vaE z`>ny2k}GyZ$>1;7Gbi9I1Nx$U?fnqgB;2RF#w}ch1T`XR&r>-)aRAJ&dvRw_%*%Ov zUF(0Y>A5l*UaleWZI)NQ-8}tj78s^}2tHOU_DZ;1i#=8Ie=^$_~e;hayHVw!T-w=qcrWvFUIjU0G1n+=9{Rc#k$K*)d!k9cFtxuaYn}4gP|&8aUzl$ z#qn?)hl0 zV@*eFW^I^-gVNgLkEaaywXDQ5Ww(7{yQHn#d56QF_W56zZJp=sU*1Xo_T$eD2VmMH z3uy~RWZN@pK#hW1fp0_{`C!a+VXN27fmF7U)NKvvliDz0w8U_J9mhk)OoHpzaX)nZ zc2+We9oIwGm6G-A?2ys*9~u#E*xwk;FDww}I;PMz-hTZ6`&~Ow7+FO75row~gG@AU zp&=WUWn||$lSAL}_PH(3bj%+8J`&&9IZ;oWeBCr&6e7|gA%{ZDr^9Q~F}j|%5AWNn z&y0B0pM3%ZVpM6}C7klCs=qg{+9fdfe-})J^xxdwecwE=17&y4CQ^;V%i%;1Qrd7(-K6Vt$3_(|pd08c`yC-Y_=O%)T2LGJ0A zZRTiWFF@NnO|$3hIc&fCHEPIj&I&E*zN4n{q1M) zoV%`{wkUq)NoPYmFR+Kv2Xm;j^xU{_{S0QdSDM+~F=Envu&!R^#KA*Sl4);w6>sQA zW^hqXm<8_fw$OBI!T5mI&UWF!y;-Q#_Q)`HqCa7@n|uXGyd?v3C|@qN8P4R6`Lds~ z*i3i;I4KtK8?OsT0*@~3!pQ)3AW1KBYzv$a(eUMAPYnX(4Wn`>6bq$$r(4e)E}rp5 z)$*Cc)$RvyCcc$d__mD)4?HyNk&!E(RIz2|NsKT2$G!nvntK`h+A)zf4xP6z>Sok< zpx%+9#e;6`8X^znZSSy8ojYTqC`h>wv;PQ-?L_nI=sm6?u-I2-#%NFuMNlNXZpqyJ zy<(o~6}yALfxN4>f6m%(UvhK7@()$Na#81eRfrAq)uL`20G@2KFy&h@NgDitcVam* z!pry0J)#ge*MWjZ^<9m2=UsT5WDlB2k|`b+(uE%9ImM}p3fy_fT2T zbA9{>S{V{JU#0>)zC|2J;y7%hx3lQQ|3|CJgerD zbH*#B+JDu=fxRX(2NpAJBmn9d7=B~tS7GvK<3=#^-B~M^Mj(3b^7rp8*~+AX52sMV zejErojp!aUjU?H4GB$6K02#r3 zpbIA%;ypB@==CAPnd~f2?HyHKI*J201U0tu2>aG-Cg6G3yv9X`_rMv$oeck*Ha=21 z9RE4S*K1LTMDN-&X!&LiJdgbpy9&_`3x*-6p)BaK%{CnEDV}b3WfylGa|O6y^MYZe ztC>@FMSB+0OF)dXb3V`FMXXiBDQ~TZMsTobS3P+Qo@A{W6F8ge!C_6EIDr$>(bBcU z{gNGVwG8GhN=znoq1FKbPp1;x|#&z>TBM>}OJi8xidk<%E{W(#P zF~9>M7Gs~YPfh0{9qES>S}{X<>Ql4O@VsA<%UVEs3`j%HF;`{E(z7_}0Jy%KoqV~h zAKNGTLei@ahhq`*=_y<&7Nd8rW0sY2kF5H-jjGH^=iS?-QPaks>yQDl|B6kc6bGvP zbwd{H?7|2TL!d-7Jj#rp?2q_DXog zKQ{jR-%0w1h->pO|^%;3-54#reu?3`2kcaF==ME4;}lkFW3 z3n)f_ME!fpK`h^^kDL%Tg4>TSK zIA;3)*?SilJF6?-^E*{8pK{rCa2?|Sohm3gAfUlK8n}T3Zm8HMxUs{-b_fF&aR(BZ z*o24O36r3E&MDi$7nc(>L4(yG1>KG&k-Bw>ZlX&xL`rmNDXj^bL_>6g6f|U-NJJu< zMCz7kU0O5$-&)_Qy}$FQI%S|AGXv%Gz4o{F+H0@(UVDG}=H~dj0Y_@VxgH*g;lgnC z*)CTFBwhD<#28sTr>1aX@P0j1k89ee#T<`nKVTy5Q1RgT&S=_c;HKvI(qBQZmAD(F+sgcIeOXaN^*00UW z#L5O-KTnnRJ7Ma%`IK5N+G|(dF=zBti3l#3uz#qal+g-iGj*x73Vn#xfS6Wmo1^qc~$@; zY>23<*mS+so9mKTXXBE`!>feeSWwMr?L*M2a&wCqVwmwO!fEU zOF(lKg>>pw%-l`UCa$`tgW#|04Y9~7J`+WjqoWq%!of%8`mzEHEH@9Gbg2(R&yCe; zYiX$5*zq^Wo4`>F70dL$b+w6Oi~MU&Q&q@-`!eN7Rdh1|`^W$q%IHlMoQ-rA>;g-BXU%XLNOw zz0F4KVE>;6>P>2knAu>RTWkH*E-Mfy3=6jZ+-p^3(+LJ9rARVExJ`H6qxYaA-@RJ7 z(Gb?XtLmt!rn%3QQ5I|OV4@)TYyx7x=ZSqt1P7OYM(U0rn}^BpF49uW4~fuHy%0io zfD->Awq^Y9HGp^?%x6;{?bpuEYv>0Vv4+$JA-^o0{Ik85`*LPsKXHN1f+d59A<6KH z7=>cWJx>xDAXk z7wZ}`xwznB^&%z(mMl5dU2pOJU8<9v<1iaPFRjbC`aHarJltV}ks|Q!-qWmy%^tDv zYP`&64MAr999f0bg%B_dAeJOqVPKFCF@IdOG7PBPN30w&n3+p=Z7Jghlb;bht+l>7 z9Ei|V>PGUp!vc#*RurrIz_=dZ1dtCXCjc4%_~gTS=ngO(AcAJqf8H(TdBKE*ZQ)k30>cxP0k1&~Gv60#R~ZoYn8042tvmJ@3x8;{HLc6y}> zt+_VA>v1@W59IIk&uT8t%gglEyI9v*4i)Lo@DuJS)BBMfUCib6xQ0KVa%km#vaK6l zr5JC@Yrw>&9kd_!$)0q60V0*YEHB*)ceQ?_pcTD=?^Ilpx51sy3X(tT1CiTF#nq`i z%UZ$Ca*+8*)hDqbyN1~@(1^Qk%Quz{wtGySo$3bdMf0E&Q6$+bhR3&6_;UL*kr3Kf)P-X4v`^kdNbT310MNb3d_e~Aq&8gmFWtg0>#u0Hd*K;94F8Be#r|A_@S!Cb zWzZQziecplN*B}pT3^8ga7!yMu-lM99LH@|D5N_L07RuIN^i)^=ShOn+$qKSgP$=_ z+y(ZTi{f+V8F0NYoToR^G6Ss7UAhB3B3qCwpoN(sEDTJSaCJcogXeK%rzv2roz{&G z?`?5y_x(Uqd@6zvU$Ozx7MUQoX#Z`*D5~3mcUKx4Fok6Wtq@O$$)M$_H_-rjHy9{T zsKre)cCG-zRICUo4@j1wtFn7PZx`j-Yj}V;H20MCyhU`zP9c;SB2N5uif2m1o#KKVbL@bG@#@AFc^zpYr1)%5OMZ7LY&Zs-@FNHaFEi4} zwQf3c=~tW^D>uETIL)YMXofzPnI5hG;NBew_S_5}!n-~RKRkLP>cCfkv4Ih)_p7cz zZxyLZ%_^P5JA_WRZ_>Sw>fBpk!Aw}Ux9V>4f9XRC)IpwXN{Glu zKNoA6`SkB|6qny-D80ATmiT@IpKeyov`S>d!-F@bcUphmA3VAT1-k%5x6oNez-Kt1 z7{(6)dy{Ap&PhVX-@=On^x->uL#3<5hoeJtqH2U}I5NZof!k@KZ#Gb=z7tw|Oo$8J zeD^@QhtWNV?jdwvy5iyULb*l!U$jrTL#RNW<^c2};9+xjgIU}K4(vyC+0lu30C_xh zvFKAloP$s(nvqPR3)FkZhn)fGp5RK%w6_dMA{rl-m}JTi57C7mRPTbh-z++!r8qCJ zkr15*#_7!F3iKU&EGZ`+BLBsd3;2hUhjUuo*=j@v57NH2uuJNG(A07NJ$QHabm6bf={a;NQfhRT1@4ZnWNe|y8}32-tJniSM(zk{Lrj0rH9 zjd^@3b_qZzns59-3xJJefVQ9mg7Ut|(sAq&+CS4X&nbZov8O4ScYRQYORUq|e&B`f za2MMHWZghv-Yf+e4B+x1SfO8Mi}nR`f*3H;lnHT-MAZlydg;NV-r-619ok?c$%q>V%O6Rc)eZsrm8|sb+q>NdkWb~faPSB%UFdJi!p1Ii_;ro8O-C>7jwDeLMF8fbepdKRL6dN zolI=r>TNj)+A~#xgs_YW7`UN_2xj>N1|jMItx0Vu8WUKA#~~6(wKuWIamaL`MEV)G zszfqb6YRw)?hJ%9Do&Xb+{t!}ec`)9>BR@V9CYe} z21Rg<%zz4eznBXP7w6F@D2GWKFYP{r$8t#_wsLEo8Q4>%I4|^mzZ41gY2XB^#cXG?&MCCm0DUoG;=9^-51~RATL?tAKe9fIeMuBje6Y8b zK~W4(0sN9CbM@XCgWe;3-E9Ksv(WdL!8?MA>jOotP8y67NUruL*h>B+R)jfqFv{WT zaOQr7)!BX~3Am+V^)4Q|Gb&K0JGIyZf#D5%!Y$+p(IFyW7LcYnFYWj5k8+FoB<#KbCW?9-F{`!tkT#5hIg5JP>KHaaF=k?B zRQGL56=(jk?Q?^?ZZ&v)@38|mcL-_vQugAe$n8Yz^;=AMz2IR9Y>H3y3n(rwZdOjO z3pQVDYtgM4uLF7nmL#t2Y3rNAfw04d+QGitLOnrZpk^tc&^k+j;Ji*Lz{_P>(ltf< z#sD*!vrq@32MX>Fz!m`wO$B~vWVUCN=U=HG&4)C(`hcJWPnhM`zG+gqFWS^SvaN zMsVqIt|ICou`R3+Vv-K~EN^rx&_s*CgfL+EH|xrEy|>4ZB6#|(%&wwtsgkKy4-Hpg z0ma2#wC<697w7%!^8te4=pXMm5#YJqr#>Q-BS8`PcByX&h~kbxVt_h^X={nP7a3?! z8#@IX0VMQ!z9T^|6%-c$%P>q-oJ(uTR_V_|#mrV=z=MU9V62I!xH2hDiCKGaq-mwr zpR;DljW&-a_#*KVTQKiB)xurKKe_`fV^Zb5B^mmV}qxo?+~N9aU|c( zOjS3C7w_o{8ZNG}J8spWqX8sPH}2ATI0on`o@*~j7$#*hd$@u}NcHe}!sSJBu-^m0 zpjZh`$OEGzeJLJEl!NKdFkGrxQwVaO-9#P%Bz3#^uC;#lPYqZSswuGx&Em12kS`vf zhboaxbRDcdQd}c+Iby&!4D=^i?B(Ag_FAuE9wl!SvkiUc*heutE?ugkn+J~r;KY!3 z<9?S^By}xa1De|nsMM7Rz@-%mz>CI!T--29@Vhtdy-@e|R(ppDg6ZbkCe`SsNp2d4 z-U$zOkWEqS_cQ@~THix2%$wdiJu4i@``6}C;>hnuVc?tOG+evOTkEYG1J8RlsBVl9 z=7-R~z|gn;3v+|bLqYT_`c#4Ca+rZyzo^>&NdN8^#EEtYCj}q6BOw#-f}JYCW>@{k zjT~6aMU~ux62*kUW_Vas0eL$$l9%E&#wf+QRD?{d`|(}^Q$#%6OhVfibAxL4VDAt; z+3C)JM^|9ee544$eqOLZX;Bw=qINLk(&1h2&<5%o&XQYf;|a_)^0o5|xUh2^m3;fFGZ^<&*G4D!pB5poKO+pm8JQ)m`y zM)L5RyFSHUoYmmkpi5jqcV)ZFyYz7h7Ia%pY^>I=c+{p_)qc=*@M5&oQ~D96Rbm!6 zN-y0)ni1|7C`NY@OmK<8xaafC-U9A!@qsx#acw!U%%|rn*n^^$!}?ON=k`6b)CR{+ zkETAP@YFty4ZG7Ul{lRAfJY*P*K*6tQaWQi&>MTCyp_6M>yPHAPo-xjebDVxi zVTf^yw`=EB-$Sptd`_ciz1lQfIj_Iix!I%)BZZ7k!Tg*ze9GBntIPS2Cq9{$Gyw1y zJC+U>uCTTT?~vo{)>d*yq4X4+W`$*}soW#n;jKG;IX!jDN>eUGtwt1$fPpEM>561ZPb}Xb~{tmTbV}d5HJy3`3K|6j#%Z80ZqFY3#B+XmxrJ9_Rg&qyV zw!QOq?*a(tBF-IDOw2S4Ib{?d@K{kV*(d5LKA(miR!Nf(OVcJfm)%2NrNcB?mnc$n z_NA4!x7p}A-v}!)U0(BGf&*3~mEFNt{P$&1CJ^v)mMp*qi_PapqX4iI0rdbxkT+1Sg82> zjqkc;F6ImqqbM>j@FK-LS9OM487(m?pwFmGcB(*~wFLxo6l z%>gW!Gqu|=3aYMe_d9!+Gz&x8C1Gv#{=1bc>%<3vheSTZ7zmh5;EBE!m*<+cDkD=S zX%)}K<(P{;_XV!f)2ca4idUF{#iN7UsXC)Lkgym`;+s|WlQ5yjlPs$CJjRCHB=xdA zwp{bQ%@S^U*yd6oK92$1E#XB*MEVF1gAseR+^uPeT@r}9^;XiwTNk5ASg3cGvon#d zbCceO1wbU)ltBR&WCo=J3H=4_3ejK_bV(ZJWJ5#{7^--{hlk1YHCen>EoUgc57RCD zF`y8wxs+R;@mNZ9a(_p&I&@nzgwe{tv7*BSH=nf!JHxu&TU6FnJ~K#A9kM>Ca4?Mo zgXh3t48_=bv>z!Il4{oIi+z8opIIy=Pb6Rmu}KwoOM|-<(<}$DtAGqRvA|NYF{#Js za>zzkk-2jZOR$amJE?B~NlOr{tX3b=uo;omv9P9}-(GB6Y5iVXwH51sEKcp`T0ri& zr6AR3)}gEWHID?xd4$Y2Cm=r7&yj`rA)#)oqt|(@b;)OE*+58@+^DhY+f_S;4(RLM zePQK}fXmG!Ws?Qz))wxROCSg?=7-1)_1rvT|Fgj)0tCA-eH4SeEIg{LiRzVu<{{6Z za~InVM9%(U6TpR4q{ZH5q)z0^rl|>a!~aEV{+$BmR!xq<0I530{X{_tgg!#O()ex_ zIS7H?`peq4;cpOMXCwoiSch(v=L#WTJO>BFKCXWqQP%V5fBCiqojs8OSf@YWH z-H|`%Ea-z->pX%Uwlo8nY)ER+@NDgFkvUn~qcpX7?kn1ZEClo`PNgU5#_VCSx4RZF zK|T0Y)RHe^!5$tAZ7-DA(6xteR&6Ot6Icc&-pJ$hy-n!-E)`4NiA|UAk>5o1c>KZf{LZqDU)JE{zFTTwd+}kl;bAPB zmT;3qeY8KP8hpAn@J8t0r%ByR^u%aQa$oC~+5^(IsF2TzFuKVxZAV0%l}{X=vRyr3 znv&dSvHx0kaZ!ZD1{5C{rf22zjZA(Let@9&$K5`kj6_bOGFVpwt+3Jul>$)}n(U(8 zw97*^eH z<)E+D<@D31rh|8sJGa~~;qLAl;*AKS@775SF6SA9AdvY~BxOqye5j-?=P{H8 z^1wHI3Fmc~emY*fRsRHxD`a*uDXtF4y5ZTTG2AYgHX9~U5Zu`<=z#R2f)r(-ImLe} zP=o0Z77&{6U4*580K%|OdFKG`L+!S7Fe4zB`u(z{JO0O6$IGF4mj@*`CEYH8ZER33 zTne_(rX^JS-(CE>>PVT{U65V76lCagC#}c;g=Bc6BpKN%?s8vPOZ=^*33xO%nYW6evcYV9LL! zMy(z*p=B&?@cLPudv8z($$W4;0S|TYrswq5&O#i97!A>uRw&dyM(s(EV?b1EULI0L zr*;zxt9xw(5iK`eVpokYAKmclPcb&yXH>oHSl+6{>el!BHRbUw*NLC8Fn(B6jxGkd zw^7&3QIc=Z(D+Uv0TKzjE_Uqe|5asY=S}J=&Q7wBefT2)VMzLjhp-}~b(h{?@Pi2Y z*>AZ{EIM<$1QZktc;Q>YIndAGB}UP~-m&a97;~D6w~(1RWzv-i(Jm9TP(R9(d6VQ< zpbOHjX%1~oo{&z~p;~=Bm7Rn3mhdu{uzETL2B`OM-xg z7%rwm@LA9*2Ces@dq^iFoscN8F-{Oz)ZpZWjA6V6*K_iHskX?-Y|ZFkhhaH9W}Kwj zjXvKKBsi<3dtlm)&pe3($&Y4-y5LhNBke0fOU0Gl|&p7&8Fs}{T! zt#77J0Q4p^S1X9QDHo_T>()2Q`Q(Qkx^=~{La29ClXw6cCqqPQ_*F*MH=?TXQxKvqW?YLvupmFNFkzx9 z3wLcld=s$4S|P3waw$j`(UQ=gJjJWR_wQy{69;F1M9<00*kp|7Yg}<1u9Y!D0Z^$>&9`nPz`#@)j1=Z2R@fqOto!0jTX9TKc{1qS27u@ZFo7GP&<3M znu4#C)8{^G|IZaoE&T@l8_a^iOpy8nE)s@{XDiGK?8)FO%BDwy5v#@Ht z4=a(~e*b@`Sy;PkXE}z41q6ltWJR7%`Am zn}*=P5yz8siHx9d6M5EjT(JfXOu9#LJ5fENprKvap8$&lW7MPGY+G`%=@zuEC;ZLn zj5;w%tNUHz^&$z2&+b+|OV=8@yXx3Gw7_4TFz-JxSZu~93y85Y*uf1r`+Zy&c+zsV zn0F{zN4F`;m#Rq}cez?s0`AFHt4f>u2Wds5F@^c@J@FhPN0GsrEln8$>Sj8%9=}yR zz}i7hdKR%SflD&e?JW;zdTwd|6o9IAh{1|I2VM2=> zqt^WqI;UQ(gpyLfv18yPpNY^Cr#s%gHo7ewxm0&ppc__8TigPIBc4ehm?y1fhU`I| zo94L*?1Ucit?qeg1X1c_u<&5rpI{();6MIr0CTq7$wV@^^*_HefME*=8PUeHCZg)S z!R#~d4AAa$K-Vn{9(;j(duIcG;+=u#^cl|oy9r#OMKasO7fW%@rRsj9jk(Z4HO00= zI5FYKz-Pmkh9i_XyIk{2G44MVfxU}7@!pbJ4(Pig6yFP?LwVjPuEO54^vdN(Ad&|$ zer~PEl;rbZT%9jUMo;(VbzY#mxs(nAaWDZ{&dj^Y9dz4cr8&q`5#F8FwQOKiyNo!Fl$*7n7$Y&)!%O0DT=wE{M5{+0&c42~?&&rVY>#&1I9LOBgmsnKT z{d7LsnjpwaG4Vw9&X0EL#Mjyba_*6MQeJZAlN*Ux!H@;%VS|ItoREBF2^ti$HwX~G znfGF5@Btn1i+g8u(vnOF#C2M<>FxL~K}Mw6XBT?+or#u<_J7+|0^JR0?jJ`ZdB?hE z6Z*~2fI?^q+D8HR){{UBlOo^9ijDxEPgxTv@N{Mp-9bQ_uI8#b`rQZwrROVd!$dWM z@KMtMoW;~N=L|L921OqebzllJTu}M|6~@OXqc^T;80O&H7<{OZ;p`r)9FN_2r_Y}- z5}<$BZ_$oplk^PsXRJ=^MUsdU;PSXI5;-ryk;b7<>|!tS^j@{-nWXR`auZi1ZSsvx zgARnO^Le|_MbJw!Js@$PLm)s@yP7_B*YA3raf>=!uS8;-^+Bs?2Elf#jV7U_O&a60 zxequ(*EpMTMA8vk0wSoOc5d22&SRH8i&$-+1%6Al&D%`5m>T~5A+?cpaI1@ zl`}l3y{)Rn;mR#HMsu@K1ytm-b2;v}F5;#8xm(J`ZG&5MN`Pn5a*O_$N;C%#oA>nD z!S#mSKunl60*lZQ@OCd`Sds@=_p-xK92=VZ*Xx{cT&2Nsp+aM*V5Fo#UHf?GoGcfz zKs*nlTRc*4o*`tGytXJA28KBk#BS*26NZFhmu}UGoRn~%vW+|(c@b?bc^<0899}{MB&>_!a30u zMO}upVqzZffMSq%8_kw6s&T_p0$Eh*5gOw6*#PGEu~1d38PyqQ?y%U zBr|6@yb;}dX*f_2Qp4y+wDx~z0&J^1{F~*MZ_$yU{Z_3O+oiKz+IXLDYVFq94SJ5K z^Lt$F)OqSa>Lg|uHM)Oq+>ZskB=^bzb~uXOtmK?*7J)NNNcr#)-= z`m*P#47K{3Fnst|;0OW)I&@U5omejWswy;CMF9*>CmwmLwf@t4OJ=)lNV|Rb_1qo~0OAI@uMVfM^xy5TlSddJXfKgraM0@z zbpv(%ihv6FoQE+guF;%FQju@??AI1|6n9Ei?a{2v#pU^hm8<*-=f#z`3Tt|BZP!HSj7BqTt3rwI|}D8QtoP+9pKNWp-Cj#Nt~^&A|{`&EOA zw~%@6q=WwACZ-L2I|xTh3W8O8?Hd9OhAB{YB9BKR3zvJbR|%kntLyMVPVR~MJA;rD z1BAxJ(($aqqV-iiQk|xuoSc*D!{24x6DILkwyFX!mV&D|4KeXds2rSBYw7J0CJ8*6 z?+RYD6o_~y0J)NU*T9hrw{mC*6d+N1ccw*Mr<4tBzQJ5~l4HYYxvB-fH1Vz>qrELm zlV`BHMXRFm^QRwkjK|JM`wZ zHbfXL_gK#k3hilP*40K?c@LSx% zQv~K`b>*=(mUxmM1T_;G=S#`KMbK)uf7-QXuKlHLeX3+U@+uQ!=2hYtIm5Ym9i~`y z5vfyH+Giv8&2LjHbd&j|EztYKiDJfdl7rkiO84eoKg?#bWiZh8x$fgp(KYiN#Z zh8A4`ytuM1270Y-p6pbKlVR=dW%J3=bQ3u_qqRGH+U-Mv2b%wkBD|g)$3#DlCd=(w?bSXw(u_ohb^#eb# zy<&_JgqjTE(5J5FlN=mWN8k@S!0YJWCQm&OK`1;$cMxdg%MeYV%;#*(iya>oV%-q{ z!IX!@ef5?1v1&Vm-hAgN-&M+ETSe=CsaEGw(#1WFv!|*gQ)1YzBb(_i1~{Rq_XHL4 zUEVEJK$As#!<-J)(eyE31bpTwG^Zn~n?8~~Fi#jJEK2SMe4)x5{qICdFkSgTQTt$y5A-%P*^LihotAS-F+W<}G(4>= zf|&nImE+3}Vu}c{(v3mPI4rUwd;l_TlNjEiJs{k<-6Cdg<1HV}&*ci3|GR(v|Fz{Nu{G>o(VSkVvt7 zSntqpNb)BA%ZW1Zv{M9C-J#>7!c1O&SUXr+2p8{Ls<|J@N9~9x@4aK#^Cey35wpdM z<4H0;`&nbDtwFsYeKcHCL@2vuF+xeTVv8{*RrQBRMQxwFR&vH+q-w3-=VaC^t-Es+ zoumB=t4MVu1jZTq!Sw)42?FMzoptJt#jpl5R%Y&i6ai)ieRW zO`wDuMT58MYPqmjx2@Vet2As-tY_wYCBXPdzFVO5u;xII1h{z(ZDKw{xAE#f}tnhCh{tdm#{Y0ptuQ8P2v3{|f2TU*_(wvujlkt`x zbOJiS6$xl5P7geTLuEHH~L>A5T>pp_f*Ns(yO9H5$&|RKidIfOt$jWkExu%E^YAK<+Xv3nQXA@^A_OfdICe7C}I&T>c+GCbA= zw_#ABP@_l4v|QiE3=;L{VSUhfzwWtpoKV({cD|{Biak$dlWfE1s4lDVWgEm3-K(H% zv<*ZdtLXVo!3^vxohrb2_1KbgFl~ zVDLlgd@hH!T87$AM6yzIqiiqlY!?h5FA&QyAL0=02?;*1gQR8A`q@&=4X?`q0|^sI z@J;6X&m1S_b&BKKJ=%9ZJ0ccu{a>j|uyM$e&*=`bW2*O0R zL1qzvL@M|qn;3GaBdxMhNr8jkO3I`i2_tZ#R`hdyJPyKwWUF!+?Yh$ZL4+QX)>ifG&;L_6{P2tTy5sEn{pH$s2Yel=wnKZ7>aHvTr z!h>?LVR^1VL;f!{ASg4>+=S_FEbB%VaMuS1G&o~z8!*Vec@_b+-hIPPhDdO6=pS>n zQ1|ANSg@S>lUWr4$T6Ax_Y8QaN}9Zr*8*M>6p)y^T8?>_#V3zprVW^(V*H%I8DmfL zAFhw@oD~Q4FEsEzLFnck^yUf=COz3+Gm-Vq~b$1uDYYXq{E7vuyS^(Bx%;3y5L^0 z8xUB>kU?7egig)Z;QJHud>Ovtv^@Phy;XcRK^zi2x2+QNIW}N$X8~XQObc7pr#zjf ztNo9>vv!KRdL7!Tt&gx9WaOlAL^$CCAR;5FgWSGiZl}hA(TUlK(2#C*ft>jSuxbl0h+?c?vjaW75J08C9EqSPbHFBWaUB^Q9hXSDy5)cZt#{;QJR_ z0tT0PJW0Uj8px#~5~A7yWK(PX`K<u>w7<>A!KBc1T6h-8nsN{aY6S13O>J0e%XYvFCCDbj)v zn%pda(p)CE56VY@INdYXh5hHgKV_2RBTjnM>u`@g&4l{&3PunKUCdQdi#sm)1WmL8 zRYequ0m_k`2By2#qI3B!V{yPriovm-j6lYkIUBkX4DW&=?=nIn7kmB29W>-(&&99@ z8mN1i)iTv7I*{`TLsOn+<#duhY2h=~!CL+1o8b9;c$rtD?rmZxmjOWtNFeCncOBuJ z2~v83vH=H72f4KwOU|J8aHYMTe82*$)S3@mcr`nOcXBSNm5>fX;$ym|<$JB=JZMxU z``(lsdUdk)36sGJ(y%M`E&)K7dL>qGla3lkF?xqsm2(989jeZ?QzSGIP64%n9wr+R z@zH9aCq57%ZrU0qy?@<_WW(S%-*&e8g$W2f_Ekt}O~vi~33H~Ag;L)v2NZmEAG2)(YEuWTK!zL z)j1=kkO6^dmu&R28Z5=~AW%x5T}pM6W58|$tKAdgnjTi$8m0}}CxQXiBSGqZYZ;#) zk1Yn-U$2?iU9R4*t+wt@dILa=oSUmq)S_{4ZvVGwCyUS@yj5>RG%Q$hkTK)&IDgw! zTW(Wt7@-}~F<1zLX|!~)5NThd!4L?hUe_+*U64-)TL` z;w`sZk|je^X~+Tq56&f)q`_nph0^P_gB{rORcCl?KEBQdp7R_Ahkxp&*!gjdXE*6o zBia#nOT-)G*NYHPS=_jMokQ29y)JSgFo+Fvg7B?GbL~e!1}4DU^>7z(*0dGn$<^I| z$+Xw$eRn2K0zY)9kB3{aD1~HSCcfHPQVFWU@cFS`1($5%yvAkh;yrV!F{!}BS`j%- z&{T~kC@xAPI-y6mFz9DFzkWyRK`xlwLWxUV1FlMaVfsnd zxWT!IFHgs(c9n45fAE}r=y)vT^OeYGxL}Tc103uz%s@NJa7S#&TVJX67)&`P-PTKa z!%0dYlS8<pQFfz+E#PGRT@HRp63Y#k^hL3Rl)FR+ysa%w zTmSd%dg-95i>x%4yg@=v{#2P0T(_m3lZ0DIIT=zqHO`c(HxBmtk7A6}V9^6y*jM+f zj$FpO@0_5IS+zm!7jxtc?=u4TT*GbzvO)(qAiq>ghQju<|GX&N(bWNlGN%BjahREt zcMGM}^$f@y3^;d>-Abv#=TjSSwui=%FjCae zwN!OoOu(dVhlz>oQ0?0Vp?{M8W*s-HPicy_-vUH8cVSX@reLmQJ4PRdX#KMvRUP0k z!Q2aF9_Szx>G0#(!i>nVJRp|0N(LFx-eLyKFsd+d9u%>s?aTTJRZyJd5Xg;SpbOnl zFmxBu=meD;R#BqYGYoGkG(mSF4$=XDT^8&&**~Xt=mu_jtky@qfw1Jw;<>t{dcXuY zf#c+Vq@@86m-M&km!VD;G&>n? z?OQhz4$N8`n=ZEAxdC&r*~8WF*TotuLJeS)bicf{VIb;P29C~sp1VaIo;E@*_5O-P zdca%0I>+47ktQ|}LXrAC%CBW5|#wY{mmY!mp4m1eA+3j|X711@!dfWTTLd z#8ju_D_f|l^ynPF{e~NM!1e;e-L_henS5+e=Ke8%!l+FUZ>k#E?r`2Bo>xCO1+a$J_x8zBxMjhz%elyfm)`gd_n{X=@Dz6 z-7Rh$4kcSue=av&I#zpG3`tx-Ofs??YSV?s~2KnAeb z`)sG`#jt~7HmhTFqA#+vDNGd+{Rb?qesbsn>Xk$3YRRbOv|E)k@i7hfO%mI8=^tx1 zw-&`^{qMU9`ZM*CH1?eKij9A)t$_KrN&o(h{a#ko-k)&g#FebCqV>dZG*~qtlDp)V zxFgsDBcM1@kBcIgvbl(QNTqTymQmA9!$A~@FGyFS91v0ZmS;d9+xeD$-5=DSelhDF z&bkEX!>kbx;&i$C1nIJSfdU23^b7$!Oni=!pp~&!iy!>cfN?lz0z) zlBbvYAh|<>f#i}fsd`{So%!k;x6XaQ^D>_hH3RR-nnXFWF(9kD1$`G@50hn-#wbFn zB(q6T=8w5)kQ+MrLJ*`xco;~Okmq-2AHbp)#qQzj;iD0*o%8sFYm#aLPi^P$wR(+= zB;$bv?^B+R1tuv=&uLGrZ}^ZtBy)+V$z#NfK3bhve1G5L62sy?y_4posg=|{;vjse zz1I4V!-JfYZtrwekbFNI5uVN$ym|_Yqk!(Gl{^eiFGNY$7aypWCl=UUbMfKc8U_(b z-X|lBFIDUB54mSE5X8c-fJh;`YUYW5T<3lx9;922mtOzF+Ln=XlN87nDLHoS?`9D^ zg7kb43&F~?hX;k|aB|@eB@3c{!yhLT;5|WCc;~b^$V|z^guISZBEM(30Dar9C$Hj*)N%i@xs`n$jLspow+pj}P1VAjjc4 zo|J6p3D{zA(v*>X>xtel=r+AnRh)z99S0)t*eeTqj(>u&ikbe@eX3Bz@-Os-9JP^yCaN_ zgC5?gI3hj73{H9=%NsOUC{5wrgdywgcBs5I_(qE1|j@f`j@Q;WidWVIe^3 zi0%}lfdGahHdGkfkUk{kh7m?8D{t@A|2OG~P0Rjz9p6bSK! zf=F3GMxLk5^%$Gx`>%u!PL?>sJpyqoV2&L2-fjSDjm50P(!u7+=%tV|Vn6qJda0ut zxnn%Lc?k7EaseI(0>CHns2L*fox^e2oV?j&!UiXX(oT@s*tBQ(}; zc}mjk0#PBxVcBX|8SL+dr{W7 zgt^{@+RyhcxVle7UNsx~!90v_83FOM)~z^=!G?{hPFZ0e7rv}0HdRGyzDpO|7FXXZ z-W}R?MuQ%Q5wxAk*{alKS|UPrk1PhP ze*(S5M?yBGZ|YWuJLO^`Jw14h5-)?2<*Kawo4noc_e9pp{Cxi^t$PpPlqnn2x%uFcw?8%X&N}#9uedBN%jYANxw|Hn{m%9)UIyA}W>JWg)80P8|_!SNB zt>tL-=s)QTaO&dJ;4PmJG+4%TG}-7d3VA+QbF{#4a`d#2Xv3rUes__8DmAjJ_?-Bf zNz#+9@zFa}2l2*z3ZF*U(*tmMWboldS?6BGJDHpm6f@3PoJr4_F z4Bz|~z3Nor%ga*oQE&Az=m|;vfn>OgyV&7Bfemr_IzJ!SURjC2r6WFkdBm8(po8Sj z`E-lohI?09|E;PcjDHUe=hj%C7N+1y95_-#w`o9&2NS^sb|Tt<9H4)|$x241k-8^w z*~%L^exA9AxH`T>Hs8IPcFtEh)X)X;o&NL3RSX0md~mYivZ}QMCxrS1;VFH|2P~*) zr5}`G7wBoh_Ku^f#Jb{%i zk?#p>Lv2aJcmN|D$aptxgVqlf3C08wtvk$!zPZZq?-EjC@M)b%3KSy-Ot_t^r$2w%}COE7)4xYr!tfJ0COaG-0K+V$b84q877P6QJ0psM@D z7MKhJ8Yb=F>Et;KA{jRUs{IQdWjF&zyHq1O8*z#_86HD@`1q230~&O%>M_*8uoQ*M+n&@mw0R8M?)aQZCT3ho8!i$(q9 zGF?(0Ne{T+IBKGpl#NZC+KKHUBerODy}Q1FR6YBB4Q;zh;7H;V|n z_YBSrW8Ox(Bj@>6d+zGx_WTY#M=ybed}LkSxY9Pml)((By3oa*mDV)~ z{$9)pQms(B{{Q^1zrW;H+vh)g@Y(-z=|7xTjEWXl&DLt;WBQreI5s;{Yc#kq!cW8Q z?y%pz^^MKe_iN34Ts04_=C}3t;~Sgp$y&4hyRq4#*?v?njZf=mWSW}Br&YaG#J%b9 zy6!dG502~Zv}$Ybt!*ecZqt$S(^gEcs;Xz~_uv{mzI|jvv7y$m7dB3{uU)*{R?9Ct z2f2LSp02Z6?dkM17gu{xS|~OYsJd zH-wGWO*2g|v`LUo3l>JBL_hTb+I0f`E$)}NF7HD# zRzM)@WbJItpx5a%RkvShwqGsLTre6}*QPma6TRrLhj#?dROd%(d8FBSP=`@Jtn$N{ zA6EOJ?gt@{l56}h;fJ+;Sm%dH9R$Ht>xnpN+sTMJ&50qmIe(E(<{4K`=%k;b z;bc}FIP|m-t|n_!^FQG7PF?Exp}Y0`0Z#Vm z=a8RCX^~d*-|y22MAvzX6ZO?j?9op~i(-6DeQaF+H6Q=_$m+&;eU+b!lE%gHqj3C4 zW2$pyy*^5r@eTF*3`hIX3Fo7ANuP~VkJLu${7$vrERS!msgF*z+RfHslSrduMbT`% zy1G7McZynLRBbdGYNH`mesEP$8<|{Pj5hS29*nEJ9yC_f^{ZY|WKA)mm!Hw!SiLsY zMi?{?>a^MVuKhkYZk0D%KQvBky+pMWwKI#6GmCm5sW)}_*8-~9dal`eUh+(p>FgW4 zduW~5S%mw5khpesR8{_DgTQ@mtd3+kWp<3KZ!`~XD0oS%HPSp-2b_aCitQWC)(^bV zA5FFXy2QXQ%j0Y1@ppjT`npii&;emJGpepNTQAW=j(%0%9RGv5hDN<;9iAB-pK3j| zajNxmRq&MlG@PxUab8ya6taTHP;FUE1KbeGkl9m*f4|yBXG>ZBbsMtr(TUm!Kt2AK z8l9>3n);=+T5bKA#n^=16MkF2wddcmJKw5LNDynN*R8Kf4zzwH+@4to#WQ18>MvA# zyQZr(g`m-y1SK{7g-J3MmrU~-L>P-_M;FhYDC?grkHFWkn!h3NRo{qJ$B0d}UbF{K z+nuL1m;g3DzTQs^TTtUu^}2yPK2aYjZ$id;eOf48XxLjCywydGYmMo+1muINPk2;? z>xxwxt;7GId+Wz1>tnpA!T!C7a6?^hyg1c*a%QYCqX$n;&x{G+F_ES4Q3wrzq{MG&pGkBSxrkM};O!a3<|(4$h>%s&3hvBhwJ1 zE+#mZZy8obR_jJ%{mA?3s{vmkvwQ{N*^;drXH(X3o!A(tmU#Cl%n&ah^_P!U zUp^|~Ah{r!QJXemctLVvTnsZRF=qx%_i?QlxAUm~iF!xREJWt~KOurF-$5d@B{?5+ zUb)#1SNP!?L4}RsS6BH#1_<4~q3reFN&Y^HI1)=V_vr!~!;UgBbTribqCCD;9^ddf zE-f!5JgB2n%+~9Ym-fyz_Is86Zs&Jg;_z$dP~iCi1*}xF{jy29=XD}9>79?&jgF>n zw%4x6UcSN3TYslERr%NLYH%sZ#qs98)slSE;&D~|xP+oEPPb+rTjNY;q7a&I?pteY z@T=O$)ZR7wD#rjdQMF&M&p|OYQu8VMxsHkI%PT)ArcL{@4~f-!iT? z7wbJXYd2@D@Tva(sNFi%Zk=Q2=h*owJ72~5<8N}VU(SDF=fAKr>#fXsyZ^e~f8EaC zu=6+U{53m&&CY*k=O*wUf6JRUkRN}G$Hz=8>X&BTwxVy_`QO?3-&vV;oF7|f=hxWz zHFkcworCD9V^`VvRh&QmOV0Jn{fq4WMRtCJo!?;R*V*}XR{pyahE)dI#p-wM_VZTF z^H%%{D}IIDe_`EXaq*@Vdchw2Fn@5=9{kWAyqG_D!XCKH{&8w~(r*9Q%Ks$YwxNFf zCwBX%j=qMK{ONjR7!r5tDr89O=y)+YGba5gNj+xn2`-8oHo7~586m5tKFj&|_?Rpi zeub&0*3?%)jd~s1V^l^CR}D8?kVj1k_{XJng`iOc>qui-x|>34>uXfa_~_{9$f#b% zQW~vMKVoQ9Cef%G8Xd)Y8691XT_tNr=i{5|r%C?4DB&f+JIT*f`y6qzj;$y1dlR~z z6zmg?aeB}gmqyU7QOPkK{LgPq2!P26li3ScNorXz(8Xih!I^$JKV;{JbYAN8W5?{y zF?;%$oj)eXjV+Juvg=*;?2~r>Njv|Poqx*C@3r%L?fh;#zuV6D+4(+GWM&r}`MS?u2mHu%TYN)(&gdtd*_VdD;I|w@$FaudFqXJ#}q;&D8ukt{^(k>4=g3 zod4OCnC)6z+~?AXX%j2t)}J0uNK>jf9ynD?%XFUO1WVsetlID`b!!%LcD=jfiw

Oqf+u4YSbu2)_G1+zxhcFGIb?HeCI_+cjrY@_HGDtUc9O<2kpD@VjM9P zDt%R@U4H<(L%RC8ku%oUWICxYXX3S&haIxz5mzcO3Sppy1+5xT@LH|S}}8GaSEEQy>+DF zRWvXIxLQl_;qVFJ-vbgmMn*;^^=yZ1G{$;l#Oz=@t=wCuMR>9s7p~_*o$^<8syjucK*WW>KmHvTjOtzQe^V?PlI*F^`9Li{@FhB>^Ca^LKxGmCW^P%ojE z%oY8uyQ05steKVD{99AAv$C;ezL`3eyCb1kOdZ)MU8Dlz6UEs0jA9BZX|Vj%VEL(9 zIC6#>#4q%-@=gtQ$M@b)o3hpwGTH!t=}_A+y9$EO?lc;d-)iMc*~ilf2;Ae0<@4;O zPK8+2R_KSvDyRzqAbELaVTP%=1YdxA$Qh2@ft=;u>u08U@C=#T2b=ACX7q1d|5Qdo zv3+0jpdy9boa$^{EuToY;1C>`HL^Ed=;#3towrZG=8HQWnh>{o>nJs3v&k*8)x<*xS zeB9AsZ$3CF!74$fw?KwKM++XD85fktUIs0z<-bDERO^^LUB|MW4SKFB{W+S6>dLyB z?MLJqxyPVWnO)PPs%vDmeAm(G_0!YSqIN}gng=KJ##V(_bOC88%wnS91QyP^`l{x! zUvjV6ZlkN7w>Zq`>J5edDatE=+lt}x3a9!Lp<2v(hj2AjmvObwSSJVjiSdawYi0jQ z@~uOP>kj7={H)<;?U;V#x!2`TTaZ9tvb*(XVDjC zJT;G8X`$Q`!kU7Q6Ch>+!%8M!`w4YyQ!R{D7;rdta@+T1?IqLf7gld&iI5AO1OHPbS zIGPL|udnu=h@Eh4M)b}^U7KQRO829H!zxr zryb(@Z!Q)D$nt4J6An?kicIyCZA?^NU2ou*a~P19RQ$2mR&nM^#wahIk8Bv7m|3hJ z1pQVFCpLUlXC^SV=rt2;*XaZ?&Cz7r!nohDBd`9*%JG6E$4DclM}D-rKq{! ztM&TUm-TU^s_zF}-#>NnMZm29accPzM_&4?cB3L|K$tnon2DwZ^l*wk?acn z>XM5I1x8CqLByMS6UnQm@9)8fidVpxF2UeP{oje2zeCO5KcaNNz>zY49cBJ{vCJ_h z+-RI5WxgHg{B~4x?5(m0M~eJBdi-;1=GfcibB;X!K{WG&#by=?FJni_ymX4JC=l@y zW%M^$jOffpEgD`}RldZLm%bMje~*{MJbD4xf2Zf`oOP_SSD`+;YmmOGn`@0(%BK@P z2AY5|{GTG7bL3i6BXSnouSyj0tB8O5Re2K4BXc^@^r24MzmguZ=dY~CTKJ8s#i*eP zd;S|~FPSGYHFPsZoby?Br!M(ggQLY?Y4CMRwB%6d}} z-#69Kbf%o*$*Ini{#3w>N4v2`5B-lK?Y7R5pq(|+H=QZeg$_2&tfMJ2>R4kVErV1R zsFjd;2`}l10Wp~#bSB5kBB^ZK#`K;hY>)BUJaW6LnwdJX2hg!Kr>#WWM+zf#;T*F# z3HnBpoikLrGeha|Qgslj6SjkJUs3O038I9=rsj7vH0s$1mrpyJrm&r68v1{&f?mze z84ZGhX4`ZQh;U{!6l$3Vf>?-|5p8-r;A*K9LEY?J-B>MR*MV88MKgBo`r4{-S+$xR z#Q>HCHL|fjjuE-G*}hY+o~yFsYt8syxRi5eF2SJ_-4Q!VtgjUo)XLfsS(Izdc)oM( zcvJV15!N}N3fD+SdUK8XINf0;Z)B~_cj|0hp&|_35h?Alk<;t+ScTl|8kJop^HBPG zwHb;sLKV>)Ut6qJ9IzqZuyZ9XTHv5Wjarl&jzRnz5j5C6vX?7l%WsU3AC)^%KBvg_ z^(lx_|0L<*iiIn5D$;YR6g%j`|AMpP$P0=q>4k+W80m#8L;*1W!WDH`TjBr$k^{7G z#X1-lw}*!8Lag5A;*^ZyVs7&!GX@p5mV{5iCl#mC5sHg9XhJwW3rdTxY#Z;(+wKX zdu>&!|K*uT?!ud$jRcyfaVu)m>qp=Z30Cokb%{5Ozl3(>{isH<hia5RwK*oKs$m zoN2ix3Jo?p+w3tx1H_t|(~GCd30}Ba%`eq6ZKUyq#?|V+U)XzMYZ)Sb9}*~-TLL+BEk!Io+hG_KV-2Z`K4;# zPaT$tiCLvU_=CEl*IYQ%TzCv;Or6r- zgru;_KyYwX=XS*hAWw0OG783!d*y^gXKT>JJx&w%tkZLXD<+8bicX1laf?26_DD=B zc}d=@`mjfF!M)71K*APWKSLeT{VSjoBv9vebx6j2vvUu@b6qW-WRLZrxj-6@-z#BK z56+H2tG#!oaGat15IdQEHg* zzR};;;BSp_+&EPi-E}rvfrYP+Hy54?RBv<(VIyN8wWKmSIhPY-*r%;B=zA+k32n{L z$xByQ`boU=LK$-hH8{%EF@JnqDtknUHKT+H8Z*=G0sTcH7TA@`H3+F4@^Pi>apXrd zbgHFZXiiYUopsU&zM2}+Op^D%+tYrp0(jmpyix>3i1uJ5%JoQ^xv-8N} z&GPgVR~#h}3bbHRS{`6$PLo{DcMYrp6_G+09a6pdAb$Ug8t)$t@x*>pI zW#`srryZwy#Qc^RLsVwRGY~+nr|p;Uc(Zeu5$zr@8P$fa#oXFdTCId5>5^b*P61CjemL+{208RID^kbsNddKeOMI8EbCd zJ(wV!o3r~$nl+4Uze1LFXS+rFrdq#)vCH$mHU!$fPkm(IMTw-fnQ3W+Kz^y6 z%zA1GWt5*se=iku!r8)$ye}IGF{@yxp~&<~vvY$X;X1|3o1JU)XrtLU7-XF*^!CD! z?fKneM%Bu+wj#5q%l5fW*mOXg>^j?<*AX`bv?SWMkNcF}ktdQ=&`@P6WINL%&CWU+ z&?s!FH}$%xRm9scfQvj8T=n~qDf?dtdr=X>En%J{^H9J!TOS8qb^%7tPe5nb9P+gYpj(F+dsr7L} zrgNso=EP@n9xB%f`G;z0PJj5^omY*tbs^*6$O(y7Rrdb+T8*meDF@ojw6d*@LV4%e zsm=){r#Cy_)St|@SIm8X23K4UrDjejyQ0vnurR8m3T1Ub2|l837ci>;q21%-i8OEC zJ%NO^aT6((C+Xg7+?zECnQ8=2TV*Io4s`wsOXEADneQo0ohY2{$ZGAJyFMO%U!>cqLC zo*PEdBpVEkO4=5R<}XqTgyu^+KVm*sVO!7pQ5MQXZBqYM>)(X_tyz@Qh8^4Dabn85&AaQ(|X|#>gzytzyEF2zwJ5k=L*fi|J%`s z7_pu0GFzxu|1|EJaBQ6BcFa_(WT7}f2kkc-cq9i+Nl85HR}GgcLXJr)y|qu1I;|hT z9`mO+=g+6=`SVGNmnEdxS`t5PF1m9%mF;Wp+f+YQM643CdQ(!QbInxebP@j+UEQF< zs(o73tKqA3p!1j_v-LvN>A$nY2A#K>owuz$HOU|CNn3qGfAzZ3NgIvnKO)Bg{JuTl zAWaNc3i$Wc$z`Q$YE;hUsXEi&xIAYj^v0*)E`hetm{y0{dSjx#n#|FQ$R8zp`$ccV z#lL0PnQo9rp|0$oKBs<)j#nuYkU6`~4VwP4{8Cv@M^&5tbbV=ky+%X`r7pUy1Q>%u znYN&XLY8EuphtVZ?ktu$tG-UvpQ`HZRjWNOK4tNn){jP}V?adisDaK8$kb`bM-cm| zWub5SOzGdw+2f>MYbdtsrj7hQMp?HWte-0p;UZ|^jhX3bx9KUlAnk~pSa^fK&i3i4 zh1V7D1QQFd>(9=%l+S3dvmWf&-=nJjm2%{p?PoObn#Ay$!Z_XT;i~O6wJoD};SH1I z3vc*1FT7q7`obHfNLqN~?7Ch?`KfHf8>Ux=rm5C1bv{=Ielb;NyC58wA@w2*VxYEu z2}bC&%;%TNA`-aQmZ$zs89X-jT|8G^=dK@Rj(Mvh1!rQPWEPKEK&IqI)=t2QsiuI0 znI;-F6E|z#?w6BDih?b|GEI`OStnhGE$V@olMxWbhy#W9)(=qs`yhGaWbvO6UM7Ic z+cNh>3lu~GZ;EM2w?i>7=Zd4OK||lR~k+GR86`{joEwf#w$wnu<7{njs;k7bTzjo+8WV>U$gZijoQzr zIwGNq%=Y@Z8S$^o)Yqvp5S*ZsYychsdk#60gT#Z04i$8u#Jg?g>l()PdiNBU3FZS$ zuEYPs0U+35p$DN$Y|{o!KbG`rmoBUf7u`0uira@>?QhgAQ_5dcYFP7t-r1pe?KEcN z0nBI&{kTbu_LLVE-f}NTl^!HkBUe|R>_JIp;(GXjI@aqJ*(vET2x z#_!y2Bk*cwv|A%3@2Pq$qhApuS%nCk9+8&O@s#@NX;~UCi9&y^ye6f;K(@aY3Y1yI zEe50YlIfd`(1$`ZlKrH~NdByEthXe&g|}(_IO|Hptd@SY*VZ#MTiBOOlGECgkgsHX z=V^+!epvE*$D%XDX*y4X9kj(_z{YRk!kV+AOVuHj(Ro_lsk|3Oe;SQHt}7)=xAcHG zj^aTsL5yIjw)aFt*q9lWd8lag=+u$#E2OAIg7KK+uUy>c?Pd}aTt$F58TXEguuk-YxFJw1L49%bZKFfD8 z<)2>YysbGQ&#sjHVK1CtD$UM|)%(V+y4jH^6k~K;qrV7ws8U@kP})4c%7N9T)6wFk z#9Y~PJu7=|XUIohFURe;S^LL@e(RhrMXCOK#6-~DQ=OlDP|0k^#c|?Ib-08lJB&2% z6pg7;xWYu+o#SiOy^@xXk6Tda&ND4$8ip6cZ*`Ow(3Y9fJj*++I?HyDsCv>4=jyoD z(@3gCg6h+%jXvOz+X>A)O)wdORn~#BK-@o1wxEm_o$-zp_18MTDc?6c@cA=JKX;La z7EjP&DN7Z~OC;pn(s{ldD_YT5(JIZEXZZYuc!ST0V_$-cv{XWZyX(Xp0A8XVV>X?| z3yb$sMyx7#U*Y*O{|r;K90H-j;)72UNR*Q7>;CEXk7{SuR!xXQf%y2TLds$VTEru2 zGg5S%EvB%7`$aAgPp2zJtn(tAs!1cvbZ8N2suTI9pipN%20D>MKRzpozFuNUg)G}n z1FA)yx}hhURxam2bx&*GtW+7!&>h7yBzJXGVP*sEt#kAiH!g}B7nL_+BJDWyXYz{F zpoD_KBvW^sdAhfB0zderu`4l?`O`IV<43agj$dW*SDTb0IfYy2+bzOiIxWLs$FH!P zjrwZYC%7>BIq1=Ltzfmepz=7Sb+^(PlEcTZ18e%_{2C3g7MnCXZ`jRikjb4lh&Cgl zW&gclPNH5Gh$`zR_UaAx#tnA9C8~MTZf>z^-n2)%?2hHuAGiGT<2R=aTkpTDS1I#< z24&}w&j*m=;kd0!{ZZr8k-r`vm%5rd z@;B335m(Axd+deQD8Yz_GJ}jkqbZZAnrh%7X7)78;@q;4sjGFt3M_rH+4&u=4EWOc zzNvB0r7Sfmg{jUj#e;hGwlVBK>Xmcq5*qU}hS8~cO+-El2v!>vQkktm_9A7XC{&HO&knLR9wuq#V6JMt@I z)=TR&?xoU+i{1=o)nS->dnDwt;brRh7fT@K(WbgIG%0}g!=~1-O8l92031J;I216`^(Ch}91X7#8`A_l5O3%K!W&8w@I_3GtV^>US@tf-mJ zS07ANFW0e7RgQgE(`)F(8V77m&(pQMw3gfW^z#>yTe~nVr$j4n{f@3@#?0gQr%x(^ z0a`5!*YWz~B7`RvF<9As%=;>%ay$*f9_Y8i}#S;?42 zKca@_@h?MM{yTrFl(pzelx+eNTEET&oKD1X5V4%0aq>iJ>owUY(izkBG#M()7wHs@ zdPq_VPF3)EmF{VK4h8n7S!$!@Lq@6P`kU5^ChVZy7g?t~e~zLnipsQ}fh*@{RRvQJ z`^G28T^3FGk_#0pk>iIGQOo=}9)FlWXRT$PlIuG;DY>sK)CE7-O!MSb^^ID)qP7gv za%a?}{yc@%nxZu_rR}dR`tU#b+~X6rxXl*)k9ehI8>tBv0qgLjDTfT4r2TZa? zdvRFOpq`&#jb2%^LpWgz#pciP&Z=b^Q!lOClk2LTWxQIpGY3O*kqDTgI^#k67MBst z`CTl9qtjfhEe&%_*mK7ksOT^1O`h!M6cd8ymPB2mD zcTFou*POqzIsYjITIWC6oWEPA`irLT)C{^r&r6NTiG1z15`4Kks#FH)c2(7AjJldO zQ_gMF`CWnq16L=a0hIBZQXp!kynSa(UCiGZ)ap=O5K~J=z+R$dAT`%%&djovKDMo;Wq}v?cAT=t)lw%%@yW%GnvqS*^2M6 z-@W1vf9vzF&*MKvL2uNQN%OcSW?ojM$6wTAN-fTP9xv^8-M3KS z@gL9DCz{89s%s764EZ}60$I{}F6g8mH!6OCG+CUJr&rUpd3-*$*o9mer#Zs-==|n+s7^K(i9ZqeQ^!vRi>zO1k-#bAgbf} zyR$UsUw1B0gb?w74m_d1i84i0rvj8ff}hxP>*opWdeUrtuQ~rrbN>xWB>tzWdczEexr=-q9UDc8;YzGhlpti zK28X|djAQ|*YU#=Q`S6j_o%F59kf_x!D2)6zg$G3AkiFH37$>Upk|X=RZB{lDdAK5 znyU(E&!|t>43IRAha>e^)#;5J>hGI6bVKvdIjUEraA=GEtjgx0^J$BFv-Wps^N{~t zr4txk;_ztm&^6jzV61uQI*7_DkkwLK#m`vWnq4zHMp~}cJ=!(^T4gt;?545CCH3{* zc$B2|akV^NZTc!1u{41}G?_{+M%$>UGyPuY=Na-qqe zngWC4nW!p!RYwD&JXu^Y*&3@#eBakl_KkGpI_)?J@5^ zW(_QsKE@ax`kvXBe{;G9==6Be_8q%ZZ+s0GZvI8l#u_}bBw@sHhb}F0W$T(G0}rGs|4nwnoKF*`BuF1ElX@K1&l0y zNgnlX>bQs4-mvr6QP9U-YaDukOq`>y%g$@H0Q>0cbobB;jOFthF}0>uqwb&_KA;s( zDtY(;v+WNb;NTJIAS;!XD3nn$nkdJp|X z&i_nf>d;TdB)Vp_s9qNLGrF{94*f*a=$abAMG-@`p0rG2dq<^a8q$oCVOrZMNua5e zRZ4Ab2x*62D5K?5C7kNfahCGv+2IE)mdcd{<_;fFvNFjA(o#P*cwej2@8+Q&f>><} zcj&dnEdv_sE%v9NZ|m2_7M7!$T|yeIXBx^1HMrL6qO9fcDy#e({2qTR{6BSD*H&m= zOm^sPT~2+q5L*)+ee5-c>#K#`lo+s^hflSe$}3paJbY^N@aa-_^S=>;zG2$=D|4!5 zjT-e6k5TKP*|>+HG-QdL%>P5_%lVy#@5m5JQrj-XX}(p1 zyu$UP*wf3*j;n-Ld)G8c?(J%bSF`gS>z~J)UtKR{_LWmjO$oE5TPbZs$Dc(YF%nlz z8q#%3M%3Y}4D(mnlS^Yb{N|;0la(4%U%kT4x7ax$>8Y<;=v%*>U-SR4_ddW@)@PpQ z;d-N2g2+Ao39-?>ZHS@+2#5x0G$3e0f=CNSJDUk27scd)G++WfX8Qv7axXVVF5FA6 z$(k86M6Ub~m=a%z|@d)J;ayLMG()^wT9em~FiKIiv) z-*fIC{+RUE4u9VBzVG?{d4A9T=lT6P_I{b&&$auxR~6x*xr>wS*N_kL4iaHPkDhi(y~p)*a-Mdv`~w`WwU-n4&$WNHTWnSlDtmB9%^C&Y@T0~Ig{ zwTjLBl@`KQ*T7z<3{Ua384HiFJpc1;773^+{c~Fjjcl+d3kDuKVfo?PZN5~m>9yx8rPTT!kcK?>2H`hq^56Se{4CBzA*dfq(Hu-3LUCb5NhxRZk4P4Z; z2_1oo7Lq6p?J2$$e*2f$#G*b5fg9RW2;9&fgXaX=$aXfmNNfSs{Kjg)DE_UDbI2 zO8>S(WCsj8!&esA={GFs5pMcWW(rvPE-iSj?^1ZKb9fpZ3{PWa&alkzr9$<)QaAS9 zjNmr6cvf=8uSE#i|E^QD?^0FsS{jW-6ql;H-jH@4#&#eE%7)c((9{;oM(hLV-<5zU zU4~JV++Duv2e^)UQ9gYf+U98L*RtV79ca{F37YFV!?fBh7XqBby|G?g_;d=0o zteH7QGXrKMhHc$r-?a(?zAF!9;64xZ@8i&y`oM2n4YL%(a}mdZRVKiFpT-*<_#GAM z?EAF7AlTrQFZ|tq*mlJCEez}~G)5YjDD}0K@n;+`v$M zcSsM*%g{?5D#P3%+{M?$4TDf+jcb4tc$qvj$A7?5e|p)-cJ%&)iAC$bxRFe&^d;?= zT{g3$?c$jnhM@H>O2-Z_yI6K>%9P8sL!)iV%r-YTnxVK@4&);pox{VOht_r;T8_0k zw0frAwQB~GZ74H!-szN!7`WCgss79vtnTQ$M;oM+?&%!vwZo)&VGEb|LbayMl!Mxb40slwB>I)hj| z!Hz6axcXwR{{z2=Y)bCX({=l2Z=R;iz^eM8m-P=OzDId+S=y-t+?={1b#AGo{j-3p z?+&f&p5hojO4Z@#{U41DKTnb27yawwHjZKBx9?l^KF(y*jjcoDnHh`vz_&e?I~t64 zl#NlUaFhxNxM_;vcdV;-JNrJ_+4m!5#&lEP|Df?S!X?n@Q{OQ=IQ+`BhEx-YzCU$n zzGtleW1x|k4gb_0e?;DCV7qw|!yjnrl52W53gJ$A{eRXeRj0Mt14>=IE`2L+18+3e z!c6BO%+B2eigbj=wdlul|H`)BMn!fggFfAN$Au>>qy)Mu(n} zwvjh4nf&W1tkmG+GF8hO#YYFf`wuMP6-}ph$x=qU-&0Ol zy?)O!zu!|;`NK+dX%qO&Sn5>(_C4*6w_9HaVqK-Y=y&VvP;dYmpW*+hp1sr39#60; zOUkA-EeevFsrTuW9_cKtBq7B%y*@Cv-uE+tUgL>_|J?NR&+7YsqdxFga-u!ur0 zYw_d7zuvF!jxN_5ePf>&^X}RXX1O}rSks{o0n1_(9lob2nvQE#a+MxAHOp>TVG%DW z&~|ZKn@;YLOjtFvp{-@aG2S{>n_+WHd9-0KJ;>0?$z4>xuMZ3YvP=L|UUc z4g#{~goTT!P&~RJwLZ1-zGG^Krl(>AoIw`lEUPH&&CnT}OnSFz-$9g%GBPkyZX_d_ z^E952i=<;K?1Xoc;$4zsWhp;_yJa~$FC^6?2TH-UZho$8bm5KZC{Gz38H8SPoMdkZ z8!qeWz*XRn(xl4v=v@)!=uVuhtIU)RUYeq-q83>Ry|RBC{`qkQqDlyTT$!J#gsG~b z;tFpXQ|cV`BsHULDo|;?>^6Ah6Ew>KDfU^iD6g%wDiWqNb;*sVDN2upE#O-ZE&L8= z((W$NdDjx{-d^%*{hjsxtHdi9+Jk?j%x}J`Rnv)@YA*5;JlF~RQjK@-BY}1`hsA zbAp!9vdSjOkC-GsG9Av;DhXdbSre+KE6u~?H{Ol%d1{gyaY6^G(dzcNnousq8tHL3 z*<(+>M~)t2a$tFRnFCvl)ZyU0wbgA+bbAxNwZHQypGG?TMX$gsjBEe3cv{-rR!q+u zLmJJPqOh43n4#|n%CJkHu0pL^_^W&CaL_tbqzbAIE2V9peg4@$Tgw8p)c?m?Jx$`H zgToGFW{Ygu09gleXah{>Dt$JfD9~SU6eBNo#*3XeDFZv}{WlfgJWSg2WA*-pHjIV% zIQ_SApuGllo3tKLVe(8cKx}kbq-FMroG>) zrn`Fo9i&0$IlOIhCgspBxm0dR=b>r(AqfH3c6H22TNJH>MFqR$SQ$WJagC@=0Cw=t z^+2pdG8fovd0zjDdjCE84(9G0ysC5Xlje*JUJEq+_h_4&uAPIwp~EsH{|EnEIz@@s zd$c_MTFs&Px_5cqKafZ;s$y(IOvu|PhfX!_PIUPG>MN#5BiD~UmkKN3W&3tf zG^HQC8Rcm-5@!Szzb1}xZB%M}B~P$X+aqb6c-Ht6`sdFC_J+V08bwH-*{c^DuPj*w znqO+Xq9H5wa^n?k;kzGw1)urotF17v%vgr`GfkM+gskUq&XiFK1Q|+s%!qutRad7= zU7c>~>U4Bh)G#oh)^AvZ}z*yE5kF8kbOf!p|u|UBc zz`>h>)(3T{O?&6jH}vmgxX*kd(`b4rq^WS>0C}4Fz!}qxZmn&GS=Oe2^5D!*T%yC# z2i`-vO$jg$#~*WWtWL45YbtpM<$B#B%#sc}WGQlKgo8h#pTi~~1Mj)!wqtN*ocJW6 z@xCsW+BolM=h^)^lhQA|0y}a zQf)?UCN2;Ci7XH5@aQ{Y4w=;H^+8-V{WZ7+m-=h3PFnnRYyGyPPo0hZ}cA zl2+~x>ov%c3@Srprett|hZ%C(?H!SY-`E?sCW8w|7syUo)Z5QS2h%VP7F}Kwmbt+UWkK;=C6Lej^Ol>w3WgHW=vZ?D{V)3wHZUIqJthy=2s+pUL66novB4fn4{BFsuhs6h zJi}l&gy{XTSu4#${g|a%@~A|Z&OsSm?e|}(OrQ4GEEKspZ2Lx3WGaUnT%P)<)U`?XNc`wB;;;kl}T@}eQliE%RSanfn}&_5VpV71Sc zbsjS>{@5eVP`y9VSqW0F#$8I&O7U4Za9Alc1?NgKND~hVh11)#ut06uNVgSo*FVdK zxy@egv3r{XIkwmC_uBhjyYIF8r|tgf%Sh)oMq=Oe**AT5Z|?T7LA!s(-alja!*)Mx z_gX1oqOX}us4;3UpR@btbYCCzH!s?o7wy}Z?EWRYf7$L|w)Ur`>;o(FfgR1EI6(`tf9wI0++0yX zTv2G`E>*1$IM&{`N;WHW>_fZ%P#ZEOmt7g=3Le%b1_@C1Uh5k2Mc_Ut;$Q?0$jn>m$pZTMsj#fciT;(~7LMB5UpbVY`3W z?l;=~M!R2c_v>XBHb4 z;mzO*4CzRB+jO4%SJ_6kSwGvX&mOz)ku;%l&?I(Jp#mpOA6f~`85;W@K4V4q=w-HvG>OEBd~nEe;>o{{VP&}{rhyI zfAn#9*!y_Nns~{oy=?a{%dt_8$-jQZUYTHwyk_^WSNJq9F8hY2@F_|A-JXfn~MweK!>-%7} zXj8wBSs&`Q0s5`3*M5v$s+-;7`CDETUP5|NYN9x?!kX*Sa*WYs*4H1>*Y9Zk1KlXW zpsVhge%1bHd&zwi5b9JwVCyTcqpRRFR#)uwl^~535Id(+&%V(b0Y8vqQ0H!pcOb{5 zI*?;%r$Dfi7nF|h!wR)hp@==>nG(wX#UnKgn$@dl4CET*ILr^%GPLkJ&d1l1Krl?(vAo>3%g3<#0mW%v=3lShn4 zO>vJx^3Ksv(L<(_M!|gNXtx!HGdf4N+5I-VH^n@<*Y0=P`<-_GwB0{_?^4_Y&2Ag9BN_LH*yg)(qo*?+fbcn8q_PRY9B9cep%C$Nimr^undt#O|REFWn*eU(6|wLynUg&D9T;YXX70t@OL2I zo8->lfp~w%oxcO|Mc2Y|ee^l^I)`2rXWq_)#*UenOq1;ZyRCy=aIwf?EhYyrWqB$D^agJKfi+L z2sam=J!T&e+$pK1f6DRcP|x1|^`ZCiG7kQTECvyV7GB%xywMj;6PbTEO7ESc=Gf`V zy*YEba&JzauH3(Fn(KADHz#lO4ZA;K?@!phIeeoh?f#U#KV|oC+Wnh$|CZgqW%sU0 z^`kuOWOzZLX7A5g9p3vh&PqNZ;nYl}JuSAOS0VQPd0IK9UoKoIn@*{3zIuyh%GH*pXetePBi6P7 z|1-`1lv{i)8hH(y{2%na=BR{T|NOZ=rxiG(_19+U=V}V5$GE3!c!r$ACvG_{M7QWL6ASp97tBdrCjCOl!Cd zV-$I_C^8PWyros(v?5KYR_N|$+6!&eY~YAFR9-udbU>50r`Ztv_fLc!F>=732z^!`)6u5X=RBT)v-TK zG#jI}j?QP=i>{w(&zfpyxyBexWy4eTj;PK_j$WlYsAr}{nHk0Cv=efy(LHlz!JDN) zl>3}{yY@7W0bSm(H<2Ve1}Ly+1xO9a*6&3&?)3|5jeEWC3XXHBD}O;_SDHL*T-61V8vb6ToeT^ zQh|UXuSKLt%g?Nik^*hDOWhldE~C)exLF@J8{_8TxcO4tJQ6qEakDLMdXzTS*ozK8 zb9}QiZuZ2@-ne->ZhGUUFK!0o=9#z|j+;?p4u#)#E}GUO*r8vqXwFBDT3gB8)vws5 zd8-4jRKA;ThS9t~{RFS9CbyjXDCkc$A?n5G{-wBi*@s*d&4>I-6nQmnUc1h0iX7df ziRJ$^dI?gA>aRx~SzGK-(SAutGW5QYRei&y;#9S4R)iHP_T!_bv-Y#t3O6N(o;51^ zp-KI6Wcuwk{ZiZI;>L*eb*QoVu>1d+AC!M5#~kMiYI$_mnmc{V*INByzq{qvk89Of zJZf>C-|NWm|BZkAC=xgEyq}+K)6XAWp&ty@aTWTjpM_?Pw%yzF{`&s?6ym5eK9}fI z0oJ$t*Y}tKFK+cx33#G7-?XP(LcFl^l8QjMmE?guXN-qIr zmG$ap!#|-Zt>je{H2>DaTH+Zr(b~pD=Wm4&ev4_GZ?V0WPj=SwxwH7(Q+)0%KA+a7 zym3FsT|bLpD+DDx+Jp%}FBw2a*&?F?%=+fI|0t|s%?nM>6NIxk%BS;y4h7ZOty+!7 zl&Q`E)e+ygk&1iNg_fj$Y${j5XXo1S2?f=BabO&8(ouE(&Ef(_`aMiv|0tf*80{!J z|6PW<4w*AB3y2J09Z<(R>3r&Gu22!4oe`%XR{yO2T$OYt)*D+rQq(d}?ZCSw;cWKQ zbT*x9)@PTQ^86P;Y1a}s64yV^tDa|3*duBd+dvYO(OOz zJJ&e2#Sq#H3-*b@F2jZ6z{Oeo$Ofxb{JoYR@Lto`R({Z~&)9YNix5NX^>7JV&UF@2 zHGX~mtoY;^{^HsBOq460omqse;`u|-EF+bsJ#C-;fe-L1tU+$9hs%n%13En0DEMv^ zv>WR>6?``<_+AvW8w$Rc3ci;W{4fgI4Fx|;1wT|lsRPb!(of52bu#Ex3VtS`u_35H z_Vd!+e7BsJcr$;lUrK_lUyw24i&a*GZ~gs?iraa=8Z3*SvK2~J?ET_Hrq_z1dt9Qd$=3@Q_v)QZEj|0j6=DI8C>;xE<)BZ8_RMGZ@2ZW? z<1sg*V-z$+blm1G1QKgR~5$yX)vG#{<$JMYLoft4wP zqGjgz99Fvl)-#Qk51;8gGWQ0QUH=@K1KdX2)QShSr`_lRJ6@2`NMCz;BfhH_k{i#R zM;16@8-1uRjosnWw(kb8{Ywg9{YJp{FKGa)I!6}k+}#oa#)G&SjwKHhODFtk^HTs> zjNK=-i@_BSHdi`H?0A*HPI>~b{*<8dXKjv8uf(6==E$$6QQD1mSDf+t$bTj4|uoiHat9|`Lk*&Cm=k*N)v z;qO1G8)kvH8AFB(5ShTyNTd1F-u&ru^Gwwg?cGLROv4le0dQykY@5(9>Gm-cEK&?8 zNw>cU{!LHtZ&A1*-TvHpx6P|p>KTyLE5*jIYPl{ zDv4zg!d0Pk{7KC+L{m!s22*BQDLrPjuV_GC(4g}O3pt91Eo7hiA&|+Slf?%u71gX_ z8x_X`u~CT8BrKeCESxN3;jN(YNgYV*SjAA02NxH%Iy@92m%u;?;Wh}A4f zm7@1aXR;W*FFo?uPcIig!EQb_NSZN)h!5^KYYJ&HN>sjQcYyTHN?vib)EfoNgT29YtHgT z-n=!c-giIZU8iixkBHvnN9f#u>*Q|~24=#-GfGvj#B1xj>UyKwd*HsW)4Q`zF;ZWr zP^5ph>SwcpOf9L<&R{M6!HwzDS*48|GfKQcYV}p4r@l^|8{kgB`|Q&0{jL|WPxZkv z!thu)7|0s(8#UDX-9|$?CTV!iJVV|4v|@o9wSN*UN6)2Z3(mDd1s#XymKvPPl+~bq z|5D4EI1I6KxSL)7`Y90X$M7?tRzx3uMhoSX!5DriaP{1vckP+Z=j9$3=G7vgbq3SsCq~*0Bqk zrKj~?S?o#Ig1^D1I@#~|6E#eTJ-Dyl$6hSi!@n{j^OFij8^6&=zd?gnERY$7 z@a&x9r;t^iY|Ox_f*-gkIxqNPU{wR_1FO_KE9Cn$>HDXbEtsNZLE4jjozBmiUOfG^ zKUt>x&}+8fMjI`yNeqfcqt3Pel0NK1-$uAHUAwtI1(O_lt$yhAbp2N`@r8W~ABV80 zJ}P+l(CGqHzp;W1P!FBfChyy@-qu+C(8;1LK56S@z3(Tjdnhn*NNYKYqTJB@$<+MG z&ZD!^lRBGaazbZs>R(ZTPda-ugPKK&{xX_6|xd zpK5YQn*oG?IQ2NNsz z>ivLFt*!TcKQXvCBUBqnli>o2Wm**=mK7zXV7`HS z#8yodfq#0Vsvv?}w$E>D)t0>~YO4l6!1I($Z?R!j%VZoO$k z2y;_O5FPElR$)@H+tkJf2x*uMku2*p8%>c-$w^8_i$SS-iOyw`t2J%W)mBHXQ6qN)po(sv$hMCo=>7id%q1UoD^tm zp|zWN#8U(Bi^}33LsymM1f^7%c2gBRa7xv+aqIA$i`B+Arf|gG(8IAh@?j}VO|hsY zA%&8cOJjs@%3c^qCJQ@@6 zM^As++XC#qACR0uy$q0clMw4=|MQu24_GeDzG#$e2}dJS?GRva66y0{2RbB0jiot#!2KRS-)>=GiGcb}MmNLio8N4F1;0?Ry(3Y%v;)-Ld z+q-I4Xa%h62UYDnwi>PC+kCX$S|~{!)dx0ObBzK9ed9@Eh~TPd!1;@jjk z7caD@$d)Dzp42$JaKTAxI)l0qwNLLnwh`$)zRWbWw&KZvil3Z}-kl^WYtuwK8(m_*2LBy9c3dh58@W7|0H zzJH%HYQKJ}LnZcIE6uXhSn^#uIXuYKR>)cdhIzemXzV>E_=HYf*FM2a20f`^` zXXOe896HeeS;yub+cT|UG}QLzN$3w+_tv-L1N>Gbx{8u2P#KE$Hu@8OkEJKTOi#eF z*L)gvZwI!uXtL1~rJr7eMuPV31Q zGYtN89JTnIGvbHm$cQgC`eQKZiNU<+!uX-EO9H$i|GB=Q?n|FHl2f{&>~RjN_3XJ( z!U)xPYA{0ys+U{XjF*EEUe17Q?yL&rE1v<#!#apVY;(@4_4NjLXrb4aV4AZwa}$zG zhT|bA?My$u(P$5}rzcu}!^Wr9C#4Zj7&ka9B1&cmlk4JuB)~F2Qn-mblAZwT0RN0u%-N))zwUHxlZ;^^Jmk>s9a;ya*p%GaI!)S)(?*pE?Cor|&T)Gfdf@ z7IkNz4E+q!G&t%lT2Fc#J!Y5`A_@z2rT~4&Zmg|F=R;>YkGt} z<#%B%4;!WjM~$C2!q*^iXEIWbdPR1;oNQ%pk(}!CYn=()RFro(e0lYmjqG&(w)5Eg zg&P|^JNr6_gO=H!kacnqhvYwPpaZ)8)E4d9pcMccWd3OxUTt%g*Ps@%Mu?M-ePB+d zswu#+N@G|r)ys_OhmEeG#D~sO)8OnN@VEreYmc-yohoP*666Z)94dciKx&z%tEj++nqTZZ>XYMx$}%%tmH7&1Wz) zwWztn<^dLvHq3f;z*ja}lz|@cHN=N!lqgrC)W}R9gHDK-k2M(umG>wv8=2GSQCv1M z=d*athpoA069-rHkxB(YaQKcU`c@>K9LXBAEcs7 zI!D&qiU|7hqL$b32b)~9`9W1`nn)knDBZ5(09BS7CC>YoxU!%vO=wqp_UF|0a1J!!*{ zJ>F<6($}GdQ2WmW;>Y-s!EOY}5mk7i_kGvX;&EL8UBFeS`yN8a3$YMFOnDd-Y2> z>SI(WD~6DC?Ms#yweJc#pV6m~l$C8Xsdppc`;NS9>-!FmHZ}Q*?G-w#!^_MmI((vN zkj-X=TXFbAfpxzT)(@XZy+{kaT6%iTiTP4}WsYE#Z2Ylw_8jR z7s<|4To9j5#aq-MH(DzG_NUEVq;>z-gb`a?RjPBwHOo)+Q!+*A!k!&|hf$bN>boF| z-9VOiQY-K1umvZCT2arf8Y-18{090=WXroPm1gmnvX!^k9B+TU|69&jQX6+j5tC*% z6(>5Rdq7u)QuBiP#VDu5sQn1r;J2n~VxXvDvvbPlR%Mi_)c*dCVv;yhNuyn6p@+!B z*GFg6ZBAR*NORjQ_=@RBZ3VTD{{9(h1)UC*Q0|~HR!xPE&Tc%32}ftALn@A2i0B>n z_j@n)i4Ev)#nAmn^QkcnN0qE_!TbIFjlTN(J4ci2K+khnT3O80SUr|2g?4J|99>Li zb}Q2#dk_@=wT0uW%%fjrnqz2KzI;I`m$efPfSl@vbc{aIfI)>vA8FJq^pTG6EZ)!-|o29-hq$UWx=WU?**nVuNHYo-3u6W_gF`tJ4LgdT!L z))<7HY=N_kpIik>G*!HUv^RpSQ}#tukfZ5|&Xa)z=o6-)zBxD!BAT+#4d`jElwTP= zX&&G=pYi6J2{nFOry4B-+9?OEXsZQMy!o+tDA`h)OHY9PR;jD>#CNAl-<{S0E&6@m z*kfa6gB>cRZB%;3NE8-^uh~&712b!u?NWHQ=aXh@hwFXCqAi`|G^igzOQLmrmX6&n zl&D*8^PX}V%PTqFmDK9-+2%TF^;bnn9G}BaP0VDij&1HZ`f%E?T(HRTCFTSk`%)7U znMCdXw7SiE76OkiGt+;JDW;}M86#43x$Srx{Su4L8k(gE%2gfz^7p>e*J|y(wc2Q{R=c=O7d=0) zVa38)yMEL{f9L(d=EraPqx-i{x$}1){LYl$U;p2&-n@F(4L|zS@$X)>?+2g#?7#or zH@^AY<^RhSwMSpM^UnWp)rr^E{oaYM{NG>x<0}J)x8Cu6fgu2=Z~?k@{nmz{TD!02e{ZbKtKC?;Pk;TcyVk9{ zjrzY@e{ZZU)&K4K>vy|ryKD1n_m=*CzSh26ZMOaV7wu20oAzJ);uoK7r`L8ZY0|Vk zmrJ;GaM4eE*V?CXnabtkTrT4>oy+B1W^n1`vX;voTm+a(WKqS_ZXh@6z!Dv;*aR@R=Z_2}=` z+7`WgLQgvk#5D%+Q+l_#_NaY7zqUqyA#naS@9|3)w&~wiM_cVb ze2~+utyf9ICq0iT*=I)Kk@M-M%I~c@>HerYz_j&T$WC%bZ8f5uzs$}UUE6Qq{^&RC zF4OPH)bvAT7tawUN^z`v&P^$fcIT>Y?seH=#AQFy^m1_!fX|K#U&p^@xL}g4I2`-CDc4TbJE} zA12wUm+m1>drXCQsV-QZPMODa3rp>()%WO|&1#C_Iv1!FMvia#MBz=|t$wC$(<5}G z)C|h(Rz&UCXLYPp+1+Yw+Px}7qkwYzSZ&^;79Dr{YM)o} zeIhk(Ht_7KUF@$qHWorU^$Tje5YhDp7o&wgr{AC9T8#fG!volu@hQ>bNj14$Md@r7 zFS@PvX2oZ~niTxipAsHHG7axmo169J*4q3}>EQ`+2Dn7Xx9AHRo7b{<$7e-|?Sk}y zZ7Q=z%`C0mqQ75JEx;h6*`d#`>pNKJt7;Lxo3C~O^%m7Yn!lnlz_#1!?zXa1rs!v! zE}GIlo1j0&<6%da`!SMzy?8 zW1;YqwN)w(k-!gO@h{fhttW@1%gC10S(nxLs&&w%VeV6K=oWx0u1Q{Ez95}n>-`t& z)JvDX1zJqRZaq0&5KLsSTW?&h&#y;^26*WO8_-pIP)J21D;1f-BHKpb#PeGUdC( z)~J9k^-0YwMp;1X(qC%rQTqsO3~#rdx9Bf}r`}`w7KppVtgYb3=|jb#Zg;8OM_U)` z60dB@j9Rc+^RQN`I|h|Nclib+I_a)Gj9Np_2F$IyoPX9`KC;ppb=C)BP{6Pf$}uy} zeLHjqqS5o7w&>EEU3!Cjp^yE$o%$A80p$;Xaj+PWyQFpL9hLTqrNicfZ$>yaFfJOq zXc7tUF%yO6sxl3339vw>ohnJ^=rM1AarOv8=h=|PXc2sWR<-Bp|3)#)gVI%detBKq zE8x~jY2E{0ArPcI0(qevH)>3-PaH7Di2a6#7+0`(=!jtGNA<1OgmJrSUwBZ}zN-J& z?;Uyp=_vv!n;QZQ6j*A+OJS)30GjO`x?Ai3IH)MTNd!tV>~&#s_p)4_1*jW@{0%ko zXyyKZ;cIFW5lKu6J9>Lb?YhkOesFgQ-qs~^MLM=MU=*-aGfeaz;sJzcJ(t)V2f_OY zJ4&3fgRd286J6%4oWr}O)D{}9N9A3AmhpnGuutDUsn25M$9^?b2t2?)RcbtqB7+@* zjBs%oogm~PeUG{W;T{ES7mJ~L#xflt59mc=4GKZ_kN_JG1EWVmu*y1x_b3a*8H&2Ca%(j{W(|_>OdgUj z=fPHq4%n*41Yu7Jqqz!mZx`qCal>|aO9@+uA|r+0un%3ey$|VTp0v*{8$3)Gob2w= z*u*@)uCH;KfZlN4Cc*4+*`C@QzVcv$h#>UdrUqnTL$3o%n^Yj=VYi+bHRiUvRu8gm z(j$oLsojuXp|YK-se>pscZyU?yq04a&(%|7-}%+$o+0T9AfI3$9U z>&hGf!pSCVH4N;jUElomHX)DJJWB7b&3sDZ+@Z#!Xi#t|Q4DkdFORDLirt?{MF5Q( zs7-n*`#0BD87PXPB2bF^YI7$p!eBfpwYUlj9JoUOI4{DY%{_>pC{lLe(RxrNxp&u4 zEO{ObCOnTh)vt2Rnisqo)v#R+=Tvm&-((0RV1_66)NT%lTIu?71Gh)fgtbk^04|ov z>nK-SRK={jR19mA*(7MiyM*7l0E5(^gg{Wv!rUXu2n&oLggJk1(vabh6yD5lHGcSt zNCus?t`ffo@;$WFS6fxDYlRs+lEEsx1I3HNZ`Wbn5j(B7Itqz20f zp9R8QC&F+&`a1E@=Un$N_#{bR*FD&CjUPD}s*&(xrWQmaV>yPFKc-hu2xUxvP^zjb z7D#HlaArW_CXHcX=I*MBY#Dg> z1zO<%LMiEjve~7Uz%9z>+)%cdYGf4|IT{q2=8;$$QnF2Vwdy->#CbVI8fA2?4|Z^? z8R)?q49SD~<8xU~_v@=_D3LJ~q?CABiA9k)un_}~7Yx{wZ)K=gg?9hC5f#>Am`M_O zlSmAQx-Y}~X#6^c=owXa9HI&LSC&P&O@<3^&9z7HLoO|40Hw}Zh~Or5hx&1oND>mX z0t9w!0bgLwf{0-$H|c%gJQs?Yq4!+;QWl{5?C6*{sg-ar%2pV=o&jUCG4@ci8SP8U zR;QWy&=;;+tNM7^L{({QENyXfxw7LG@48v<&vDl~XyRPpj$c_Z&!Y?9pE zf>L)p$U<6L*};0yI;qVYB7(#yrI;`+zgzR5D^(=umb;D2+qwm;Vr2f=6<^eCiWV0Xp=V&5%u0mk z;Ck0h4Bslh7d^CMq|oOcwu7bXzamJ>I=t!$U0o&fSHwq}(F(q6rK9Ep48r4TU?Qhy zF2Nt;3oDgS->l!8T<#dLlOUft2v788+-YS0QT0M*wG}5gyDw{9G|zQLtIeue{eY~e zGEMj8n3MFmSIn*pa1=;b!mJY9g2R}) zb&;S?53$1%;HAMSznACTH;I{DID&87w_c&jp6Y^6q}rrxCiORIDwP`e z59ArJvG>`jATB{IsiiLq~NYe zw^h$+vD+V5C{GdLF#E_`xjEP6L3uMDF9EM%+>?$A)^J@EOptSRS5;T=?25vZh0DtY z<_YFxpyr7v<>K?i)u?sw0dH@veJOdop%BaR?|z+|>%4JyO>$V81EQHOlx5_=Wotn% z!LWnlVVlztHpCivkFCqOEQIp05H<~?oFQ34=t|^{jwap zsJ`X_7j9SWhMa36dTFNi?D2{rD45$h&crnCIWKtEg^pkoTA)C;)^0C*T!azLGT6fL z&e_OWpH!&FQ{^VWa+v6GPl zBxEox$YK~oqLA{gGA~xyx)paiN4Z&Am9GeB#$K6+cmhdf?YO(PAn{a8mw28Gr3GDK zN(Qw_CX!__H$;Wp?dI!nj7S=6u2s~fS##9Z=oSgcZ9o3b`J9R6g#OS|i^IvEUBEr--9rhNN(o zME$Xf67b`HQ6;ZRM@mq{$H;w~AlNtG4FZMB%b#NPq{StGXhK{jl)vJ`%c=ae6l`!A1G9QP=_F zfQ({kJf{f+$iHjBM9=k(L3jLenamj!!{BUzR3W?WU#4yoUMg|HlSNcd-_XIyhl{t_ zDAO`2-&`q2HV`a-QihP!M^Yl8(aH=`E|JFlIZ&7AntNh_K)j=19s17=QY5}vS@k(r zHonR&>{_JD7;&&vYv(Gr@J7%as%oAq_lKR7RmhYmE~my?S3!Y!7O@<(teaf*GA{DL zhLLwyVfDn#fjtI+#v%0_BPlRT~COK9vZs~IX3w4EG}UoDTCW7{_>bGvBv!ED!>YX zWK%a=Pq7Qs~0H);7yvZgGuxKDWYr9W^jgJjW2wZ9u{ z|46CJZ)k(6L+mEbmud8#Su2WRwPUR4vsSHCQ8*c>Lp{O2lZV&cE*2@Ft$n4NubIG0 zV)<@4xz(kSjXlD>8;fS#uZ(OB>zY6nppC!M#@8@m2Vw0piDM;|3oC%ZBEB50_j#`Y zV&|I!ijrgQI#!M|7@z+D8dfradaNMqjAlb719=Y`v|R-p-YWUfiPvhUbyV)4LW<%7P0p%)OI`QQ{O8tT(()<$;Y6 zyU&T0t*+1Z^{^;#=FjPwtP=Qv(dqpu^-9`cubwCu%a!>yn5e2Cs_lT2FWne_hZ!v<@G%)1r1)4hqhhPT9K_e?w!&mgV zG9oih_b9ET-!|$kY5~6Msx4~OG3ZO{8uE^*vL|>0<>0IFAJmY*zT=U|oMZ~rf)ksm zxL)7mS%y~^E8N_MIQmd)zI=*KzcP7t7>mfEquh8oq8(r;31xkeTknerMM)ofEyqRk zfMV$RkgED^rKuVMvM!tH!*cH`^0f$cgfmHZj<<&UE`W; zEc6n1gQZCS#q?Upk+%`+NYgS6hTZ!rv~ZJ%=7@Wg5XnPEOWW1SzFfTdo*Wab$hyyc zRtvk9_ndSIG^cgf*}i)xM1*W0tb?*^jX0oQJ`u4%Rji3PfI$Z@enIF0Jss} zRCr6SaD7Fl?_k*@rra%)foBM4kkOq8-?s2yZ_vwKrlauzoage@1^Gq>Aic2at+($% zfdp77c<>?R8Ng;q2LKnu)zWLh2caN4!1Jn9Kt|*JNp4%FCGG{EoURb+T*D_9nX~r`@ zy|3P6c(CHRoo>u4A4 z-TqM-=Nwq%Z;b3%eJ zC*;Ir1R1McXR_fhWxhPr@JP!eu-r2&$4dZ2L%oBv)XGN-6T!Ycce$z_+lA3jgh~d< zALG@y?^s5t#}~~yw+yxOR_kCUceKkJBSO=|uf9Rr@e;N@#U?~)@DCBM6ExK^_>U!w zQCT9$#)#kau^?X?tOj#(~=t@0RTiFl}t*L*o^AZYXU`O(bsRg^{&F z*gW_=@TL3JEyCB-a@J87h$lYA8w1JHm3fy^#i>7gij?jIF{A$G$TL z%FAO`$E0JQJ_1Y0xQyQ#_{ZPO6*d@#H-HQrIK0l54mCK1&loYdeM%JcE&9IR!CUj- z798!r?g49y@xx_68oF|;%$%o?FmuUl1l-AJdT;q$Le+nc(Gvs_+=O_?dpLo&a2GhE zXT26c|IJz$MOgo}9qg!TInYiWTXK5Y{BIRWi(%#pFVcX{VZD@8x@S2fQegB=GkY zBS;-Ss1yqC!)f@#Q43%JXhHJ(i*iu`Fx+sL~5}r7r#^B2z%?kAd^_Mvcs-yq=f2l z19Xqf_jsz;+0gT{P;=KRkpVqPqMl~Z9v(t@XCSbeM}kLUreMmkve z#EA188eaMfAqaoh6?QF;|iH+fsv^b<(RPO@HkBS5`QN#Y1B4t*cQi4#NX@cM- zhR8uN50MJv_3Pv>Xn z;N*40_}8dr!qxr4R4Y7fFrS6VCmaXNHs==R?ZerqU3$X^Ip3z1$D=~Xtw-4y1SH%k ziTeaykt=`0IFX*(JM_tjK_0i z1hCpMmABJ)ELL+k->s;W8H@7*s>w=<`vT*QVSa7@AD6klc`Q{8u|j*s`4t4$!i)r| z+0n>%I465LAlIOigBrIyWb6Mgb|%8ibFnqO|3jI6XxFMspHC{#2ey?feo1btuy5|8 zmO~7tzILiC)}KR=98Mf=4@P1ILGFSlPmj`JWm6)HzI*>JQXym%=$XuUzBD94|Kxqq zr+Wbr=whQIWcQV>IoDCzZ7^`8Gy(m$PAx?G0GP|UzQ7L_AbL-MwOg`sQ0|gER{#57 z_|=Y|J-+#=UEsEyeD%z~)8?bc$9kh9(_ZibAt&3t{mEmJGJGBvk)ZQ5O-iDr06zS9 zXz!MLGO3?f_}Kf}O5=j^)N(o5l;tMP+ zX%aZAF)8q`#%n7E&dy_Wmve3Me*qG0NV?lmirsedlG3IZN51RI(051^_e8Hx2pc{@ z5gZ$bUoNv=Y4+oCobhocvgBHGJjcfX&Z; zBphe4(?*mtXpAv!&u<#%+cC~nl5)<&y-*`v^bw7e)Am_%`8CZPL&55J%T%1aKujcG zA*yKTSdx*Zo`^+TVQ#Y8GYKil(=w+KeZeKJDu|D(Y2{@PssM?CNFT6f5fLKjjOJWy zLSIJGLrKFI&!_hN5=Q#qxzk+YaG4Y0(CZ=kt}&V1N66j$QIaRJ;hv&!1f%N_ zS@uex({S@Z4z0WPM*;Yn6vBO2g~@o@rIwcrL`E<9!6;~OLWS51(~5whOvakn4g;9C z8>WESrXSo`g_O50$V|8*Z%q8H0~C&($Kl2l>-h1QACLqV@(e! z8&X-WQV;IJCEX#57K+!^T^+qkpz}22gLf(I zvf!p}BE;@ad+*D z<)t*PI^3+I4t*N}jis=rnLJ5FdicZYEMe*Fo6fnR-00ncx!X9}7k_otuCLmr2aSzT z5*t+zC4Ha^QKKQ~AK4360;zddkm+>T#2L-&pJ=HZI;OR6p^{M5`5GxmI#n=*L5Ug5 zq$bNM)uD~N4=jd~aBnO&XU7CRqfJbfb1wP+GFxp>8{i=n-((#MkErK~2XIk*b_-}c z2N5~1#PrFrsQQdkwV@)-EJXInw=??8DR}_64>-qer#Uw;*|B)ODSA|n_vST%$W?ln zk(@K;3655oH)sTWu>fg@%B8v0WWE!;KFz3iX=tHV_}uY{ZCJEs0#<7?Uq@mB6LyJ;)y zkI+hRRN3hH;`Goe_czu@EK-|JDR-=MN5yk`=z$1yB6s6XPg1a+yD8@tv8b`Q5RD&w z;{aj_64#+K(FQ(K3@^HV3d2{G{I1%8#Z;-|{=5U0=1TK4u^~M`j%iqVhXe-7WE{a>_ zm_J22f$(v)fL7y)Q&76>lwnWZv2LGMc-tCoccgQ-JFS*(9?^WYQ-#y@PvCECOW{t9 zTO8V%oNn<`+VdZDVKjk*c}?^p-;k1~iF#w{{FqfwtvXIyaYEiQBRKc~xB&O9aocL{ zKY6#!oR+tbSLs%9r}1fm&-uZ5Gq~#>;RIR1#rDi4&x8uB3V@&7Q)X9)yZP>Kz<(Z) zcuVdfgy!&Yz!R&n?!$vWUkb^{{W;(WE~t(z_=XzQ?|>(#SQ>Y}87W-i&^i|i9|XNm zT1e)$HED!ceX>U1?=F7qGU)}l*H>VG^?mwr#-NsS!xIhMpiy(3H~H~@lv0wg3`c}^ zz0gupr&(^Z$Yof59@aSZ;0wes&jT%;&oDb^F6Lthu zO6shWQ?gOTF4p>KLqM5Ng}FF*o;HbT?;)}c&FJy|QW#!!L4XcWQyA5p4J|?Q<5Gp}etknZ43KYeBs2yt@;~s$+O@hRAxxpig>qlvkfa>n z&HbnHkD;QM=+vVp_q5jI@CVgB&_BNhZ+GU;8Np+T@YZsY5jFXsx>FJ-!V1sWl_}|q zcra=>=*dXY4AM}Z!gG#DhxGKmz-V#H!MuYNrhbLqb~i#yIMU7e3bhG+sTavWXb0_q z5HsqolPhi@2!*{*+QrMFVF+%WRKVpSWqxEnwC(*4MjtmAxS~IIMpo!2lij@qxwsSE z<|0%}w}uXQ&kwd$D+C~oBRZb{a*Kke2v;RF8nHIMCVmm>$?3d*s;_Ip#<&LeNhSC- z@h51dZu(h0z6EV7^mmm$s}q;328uO5lmkLi(!iOH3Ze|#dHCUA7>0geH%N!&j69R8 z8(>5^`S^ekLPPqq%^;S?<8nK{_Bj`o2h?Pa(v6KS-Qf+lk!rzNIk?6*&!IF_^^RH)W|`uB3fG~?C^!LN-?2vwh*+m zQa9v~bf#lw+IHk_>3}; zp9?c@QOm9m*+<>#SO@n%_MZR>ddO?=1m~400bj>{;^50Tt^i%>0SlO7f+fe{<`imTN3|C`0)7hKh@tJ%k7e z(Fq*Fkn@5r01Syi<6{CTgLCH!<9HexJRCr4e2{u#qB1l3Nh^? zM^OE7v&qR& z(KzYaCK~gh^E_TIdC0Za>rr`;3i=5YD|WcVt=50wf2n$F6qi zew|>Tm6cX&tKo#vFbZ-Nk(k5=BN0egcwo4@kthr}=#BQ8V=MZl7h)6la4@}JyRG3$ot<{`4;Y(WX?y*!_YXWmPL*~JZhat|wT-}wtSM9St1?F_q z9_&rukk=QgwrY=Bz=t#7t8+MczN>bb)}*waJqNK{t!#?^$}l2C7zJF`st|c?qDz<; zwZk&FvI&`Q$%ha{T;KVHLYbero+M%-A`J%y5oqo?@LXPKTQ+mB1!G1eeLfczhyrmM zB`ks~j2n#WX^MR2J73|nzbEm+7ql|GOUm+>!x3wY>d@QMMI`9bx)E3S2pn!9$AsgS zGM;c5;B@xBA$(u~dWCz?Y7ARNMP?IwYG2UdrJq%4X3Ysc;N!DZZMVt+L8S$KeVOvu zE^M(o;xEhl`F!Lk%G>c;5ixHYHkhe|L)zkjEL07H8g2 zc4;95s)%ecsDY>`pN)E+D8Cyb)SRx{XdVN|r!^vTkAEkV%Y5W)xdmw?r7)S04&?3s zii6jsvmp4XUO;RPBM2hga)2;LU7|iiL-xlD+5^$$G)C*tu0!wgxe)1Bf!YHV%&cQF0p6}`F!5t z;SCKMPGfQwTZ?shCb!xe6Hwu6xL4%d4<6|2?1b}NIR#m&ZmNL-Pgh+@fWpDa7Xqib z&(Lxhgx2|OpX%o4?GVo@!Vu%Mmr6elk~r^|)oJ${p~9Dm;aG%9xv(Sa{aYupCa~3) z8*|4+oT~*xvvinG)ErFb^F}UY`SFv~jC@MK>2{{NEb?6016v3bi1WNAn3{j<%qiUXT7m;NuMYs@eiu%?ESEvasB3IUltOhbD1xH^|i0 zY^dt6GY-@rJOor^tx$L8Otm|lbEPW3b)mW=@Yk$o{?f| zm6w|G4eBP8T&pmFajvs=;H51xP4Fgu13v%}*@2K6TFWyihNX`4!4fUP`xgRBzj93c zMVL2u!I#{-7DyRrcVlw-n~YA#XZT{2DP!eaSk~;m#El$`AAs##j1j^O2+rX*TYZ)Z z8hS{0Zbr&mbxu4x$Q%|zV{(G$JLh$-dTp$wipJr8u|hbjQWC7YZF6VRZH(Xhj34ny zBoAEshf^7EU4uj`)nmT ztBNQQY{#x*-j0_khI7!XKn89-TE-QR#fctyGA7TAGXnsv$sEU~p5Pv*9Nz`aLSF~< zC&oqS9Or4M&isJuBl7!jKCQyvK-_zBjX~r5;mZ<(bKI8Z_8&T@BqsGYnnq)V1$Nu5 zI#_Epx7j>f3?%NSxfcT+d<4!RZr6QR{&v+yYEw=wqe_sC{X4(uD3IF0 zlpI(%SLudB19$UGLyd*I@pSm!iP4oKxVm!5*(L-P^uQLmGW3Ci2vjru+2(gGD4MBu2QSsnnSAC+z*yueb_l?tX5Fd zd+)zmA*L_qTiIRW;V|X}VPdIbZ2b4{%BM|%J6eHWh!DyyZv&dZOWs=i2&tO+C5$tcSSBVw%d;VEmf=VW z4tsKZ_&yj6yywVnQfsTqcA?5xKXmE57YBe*Dwj9<+yBLIRTHj}p5}zR)5JN>Cvp=_!i+ZS2J{Q%NYA9j z!Y-+?8Gt93I#L&DrV{w>*LQASfeFe+uvMMsnLPHI_bKMO^XyVK7YUJhBSQ5a7* z5{3>%xZdD81r1=3H|V`c3ISg^S=+q*q>KaCTIF`wTOSKKJ*nt>`(2*^;l>8_kUE@Z z*Mx9)zQ5P)DSFNQ4-b9QdUB+ZSxYcM_~Uax+=UmzJviJVO@t=Hq9bczX`mw^9ZSW0 z6pj_QqEIQgGH{f}M%`B9uZBFHcKCwYhw_sTfy)+iVqAdP1M40XRI%sSsf)gK48zTY zqyB4M&<4+>%G33`bntIw3MiXp)TZjhHU zZ&YorTQ-*+>}uJ&4%|4N{a`Mra-Z6Ue|%Y$_YyYVTbP(ezV`u)dD5CYv_g_-pMPVV z_(E_&kF8*-QnWb<@^#UOBfnT5K&$gLE}xCtKmG4JKe^xTm_=KmlRdQz=GO}c_!xwr z$R++!l3DkBiMU+OUDw0w9I}RI<}D_@y#H==7i~>6_qRx8+{=xF=c?S|R?az$6pvdt z-X>mlPI9;-{&PEocjtD){p~U*dfOyqJRJ9(H}~opS@S8Bu}`rn%NrU1{4wgYO`o~0 z2|WN#wAc3S__d1_8Y!FxRj{w?#ebwHT_aR=HF6W)Ja~bUNjfC$NN0rZo4L(!8HtoBHU_&!P4vzAuRC~9 zZJ!Qzz0bfERCM12Zo7N(hJs*y6?+;5& zbjtcNq8{SXh$_bBg5FnSga1b3p=7^8>T|v4UYh$R;3Ta;q#jW$aV+?Dzoc0f^Q|@5 zPg*JK{;?*d&^P30nI7H$2jknH7}JUtaFlyPdQ#5Db3fjT>&?h?AywGm)N)MxJfIdL z-wzd$s>sYBiJ=L~Ibt7q!e8(vT#NUKHBY}m11+E}{z7D8C;`Wfg)ex^Bl|Qy;0tRO zBWb4lWHID2kz{p#?O@|~x)NtQAB7Jvaek({D)Z~Y2H0Vw@YwzGmhRVQ?pff06WvnI zp(jHha|ci%@JoaN79TLV4v*D0%tl;=W_JIKvY#*7Ci}o!ryTO^7+#~iT&p(S7g%BT zo-JYdR`-pn0n9s0+qJG=hKVSVXaWzx?Z-;N!@L_Bvvmt)2+*rw68{VB+PY4;SL)=g zl%YWWgEm0sT;J0Y8|8LeV;C?S97O$9Q3}oR80W4~(NRuuSk<(uC(aY9#Vp zJ%Q+x9|p%t1vjJp$=%~GJ$#?O@`NuULlu$)nA1EV&root3DY<)KPBW6iSsG2`L!?K zsh_95Qw=3vM*jzwy9XR|Y31LY&zB}ltzD{R9QeO`ik(iJLp;CMd+0*6zf^mNE)`T& zYn1i_@%>5-IP!r+c>e7ogJb`HOtFmfw<9VRg}4sztTDPFX_~Ns;hDk95tHEcITv{Z z2~S0)!1YVYl7;4?3^oW~4NcYThnB4m{h=@2W}{WT1!srwRCtfB#A`t2&@!;cMDU^i zfWYP7M-h-dB%Se)e2~C<83RD>(jDbnmy5YDbP%w?zWI^+5#3=Ig6kL|&^Kdmr^c4@ z@RR|neC|Lz_iz6z%X}gT*jY;D5kHyqf2eok!8?{9L7R0p3a3Io$H5yY>Zj!P> zSxrDp-}{}(jSl%`<0`O~Wz1)K@hCoTvoY13SIwgV*2yeJ?>#d)*d7$-o5$H|W+9zB z4pi_+@*P9_Ad_T2f>u@d;lZ#qQHDC_GNaM^FD5ratV2~ofiV1^JVqIx!{I_OgS7k4 z9e8AdKJi6RK0BK>*1P7*{WfvU^OJ?!v!-Y^GzYoaDn6lsXI9F3F!lo?mEp%sl5hUv zY@ur%Eg;RFX$w0Qr$3gZ4bRxE1bmR|fSBu#gZufOUlYJ8y2Th@8|9WtSpVC}jcb*3 zAiNzh6Btk0!|7kv2@~6zvL*9z1ot;nG+BRrX&wxv_6F zn@fZ_k@fu5j;MJ~I>lN^_cUv@@GtO!#1XHa9ae}9$N;#^r+(6V3QOEYm9;zAAV%@S;#u_ zwbtH0C2dMBWpZQkya9U9<6u7#-C=I_M#@>xGGzHULlQ$j-Dmn}Z2t=^giUER_XUTf zkR@6#?^2u${GPMR=OoIRJJ(aLP0BD=bpjax_#hU;yWe`ZcnXfji(~!FO5-q(%;(st z^}YYsh3gCVUGYJP zFsVU_d}W)@V`2pvgGcl}6B|AXk~0xM!xs9VW z{A6H;lJ1#$3wft{()vf@QHR6%Dq)2YMQ+&hhwcZAg@HWVR$dWvwzC&${AV-k zb3g~WVfCDP;dQy^l6z=A+Qda6|I|xcI^ck0=c7!5tT~o~i@+u|;l^|En7gzs6j<{W zRW1o>rDo8=xveTeL4UZI5rrQNx2(~K+$wrqzak0goB=qUkzg?x2{EYWIm1hYw_E~( zkrQ9gYL2bor28~B=A&qp`3L0mxAe@Ywpq{lOp8M}wk2d#5v`mpmyz1qe;2h| z{dU+&VQYmVeMVBv46!~B--X_SYLva2S)^#-Y>}JNnhmii1(Xb ziB-wJ9H>+NIy4Jjl5?1^r|kV;h42QJ{WL3NF!YT3J(J0yAmih$%k=e@*d6+U=aCIO z3-lzK!TAslC)WUF!*087h5vFr2F532JJ?F*b34_M?{C{K|97o4Be0`ueWus1F&gJe z=V8xVpnd#s+K^DBB<3w$pGU5^d5+dGg{l~`z(y7JplNxfW;ws?Hgc@i&vwM_l~$#d)7L!vzEYTP z=1rmq*P>~L7F~*;fS=@+KWqZj@^{e|S}*6_$!aP1n-h_c09FW&DZ_u9Q}Ic0bJ#+9 zZWYnGHjnnkTWb(&-aktC53EY?hacg(J@mu)@|SxSKC);9y98x@{~}RE(Edhg9%3Ta zbL`OC6ZG+ox*uz;l9zBhM=PvD!7^fX@i@@;6T?B)9j#IJ*syANKdfwXEjN)wIFB`Z zTq$11vn*?$Eqaqfh^MAfW#!WpsAF@$Me6y{Gb58tcPWdo_$%tqX0`2p+Fp-}=i9s)riK zjk>ON5juf>rLQ;Y1!ff2kkEc#?dI{bM;p{i%=k{r-P~)yd>+$ovaAN{5@x~B9wNFM z?22fU#Gt!YCl~jqeoquV@8~%298_Iz@7?nHnwL9mC*&gA1IeC9{w~(;%eY^leVB{0 zC*I$#|30r4rSkf>>ATx>R^DRmth`nKy-eOlyz|dR0{9NKdArKqUi*w{-yzsg{d%cC)?vjK053cboMWh^fyfEiBU07Ja)&HSe%G-B$ZE*7hBG`m4@o$J85;->SEac9FhWpeNo!?S zjC@9|+@ZgpF?fKPmbdC#U|vx4Km-N`mKY3MbbqV0xmjhQ^JaYm6pMAYP-SU!U0#~HNqoIqtP4Wn zaZez&-#xunyNl#Q?$V5(;He7F{sWxGzDIJ|qw~Q1$XP$3-IrcK}i7vLf93w4?nM|z5k z(MAA|;>Nih-{GbeehD0H<;gM+RlP2H2uh&(X~!LdM@^li%|mF&M`d0UHgC~$K0?Ps zVEw?13rPdg;GP2R{z&m(HOhbga1WND4Lm&FUC;@hOSY1L7VdFu@{`>d^)Maj2j`dED5v5yO{NvAipKa(Kq(h@M*%=k61uAw>LO!CE!QQ1D>)>G@u}$C!RyjI~So z|J{1KLC>x@!iz>3cR-mO4S9(5nmvrJH2~)R3ucy{tn<5x$9b9_3=vkLGE*)HI?ObMX>1wYn zuhp(bS{*5QLo-o9%=@z|rSt_;DZ9);?kRmilfCV=i!SYLpTgxLE^S=exqOUE2bZZ_ zrg6E9%XBW6bD6=VlglT#%;fSLT(0Nx87}pUF0Juxt-XtjzOA)iyG8@TG1(;+;ED#S zuhT8R7>RoIoJ@NgxEbbhl*=(LBV0zg9Ov=}T>cv_&vE%Sm+x@-Z@E0r<-1(|F_(YB zVOSp7!xs=OPE+6MIjmu?RrgOQR z%M318a=D7j)m%QoWhR$Ta;Z(>(#GW?E+6C4uFKzwHtjQR)aCZJT5UBZu^jhQ=O$N* zmty7PCd+h2Y`IDKaW`JOYFEc`)f;4qQqr^WI#jLClFy0K8;vZ40jpFGE{~+od>Q=} zwIxxo`t=&I-C7k{sVY7{#v9^bD&AdNFn&djRgQ|@lYDG;lr;lFyQ>A(9`U~yT{d3P zdn{fcq#>9lh@=5(IAE(I3SBBKbcs=hc_m5KwQP1A{DWch=heL9OkUTHCx@+oqbNLo%`8samami@L+0 zVYYofp#6W8@V4DnYkRu3*iX1mGC?*SsBoZgzC2q}4&bKJ6lC36>ma1#7__#9wYCMd z>+k^KdQVwxm*+|f6uPj4@fw&kX3Cg;NaXXA(Q_&OD697pW||2S)PQ{TWpSF|+ytDA5n~q@hSk@&CG3Wz+a( zwfcIsAVeixxk3~IeXOn^ABX;&!T1na7=!SvULOAag5}E8!CIAYS-fV2jVb5Tpu>!N zR4GrBOxvKQT_AVYX5?zxKp@kWGuG4}QjHSqa#+%5@J zx7dPqyP98@xlBK!LZkPq&eXN)aEFkvw{{I;vt8YicJkCg#4H!PjCM`52x~^Q;&iwI zk@FnQ^fDZ)tHooQF3R6&lehe6%JoVRmMi;r_@USTzwEsYY*km5?|JUUHWvdI-xEkV z)pq(;UMfR(0c9Hlb`7Z)5=cWeBy@19NWaueuI=mKim@GkB+#82+4lo~KvIwby<|j2 zw3M1jN$F8)lt}4ON=lC?iI!+7nMpJ}iAXNJltjHDGwGRRh90Fg^ZT!TKJGQfKozBV zBPB8W?9a8=UVH7e)?Ry`bG@4X`8!C4o*kG?qPJLPb-WDY55r(5#fqG1yws;6|}hRmR{R%8M249u@mz>!Ge<^G)63x zm8+%nwFX5EH4-J893kcRxw;GAxf}&5bUmkpk50K)&mW<1`ntH-d5@l;cX^aT`r)Mt zksI)Qp%9**I|o!lXwZh}W~HXoXaH0lox`nt&_Zsm9ED*Qj3w?}qD}O00y5{_sZl6% zVPN%f+XjbtoN-qiz1Ak?_R1oEtu0E&v)9Y1;du|j+ogwQf`5^V8NpEmNh~?VtS`Fd7vY7bribS*M5ZZJ1 zsA+t^!7*LsGICSi5FR_ZO<1qDS~Kr%Pl%7jSYzH@m1EJXO_iY6Q>oWuA!)|NTa4T- zTOsIPf0cT6mkgdTK9Gk(b<8cQF)dWpG_EU@v=%{}t{(CHN-P~Zt7Soj+V+V6#})1j zP|lb!FYPL-D=qCil?+`lS~1lOeRuWxtNb)VOn97Ol?>t*xlk6>+*cJwy?+}TQ4%h) zJicRHxjm+gC>dAIpY$C_uY5I^VdL2KJ0RySwzNVh*>u`%xoZO>-e2B2@NM%zfB*Lf z{Uhv8jinOfftvwaN#XSjdOo99l4+sN8nyi8h>x#ONc!R|t(<>%Mj{*q0>GVoB}8%HM?Zbw#)h&_Zhx?z;S; zO0h(B##!3&yOxQTTz!m*aeJjwl(-Nr-KGg;D*GyYO+t!Gbjy49#D;{r?1lu=3tB6> z1*$x;>0OSPasi1(x@e{qt3!+fIGW{@PHymO=6;HEOsLJ-22%0$|*Ck<$!V>0zFEv74(lF7O>f6t8# zX0`TYtx#b-&khS)y}R}k(b?$^?y+?d>%vXEp55;b_EXAz#H(nh!v?i(_5ApTM|cw* z>rr#<-Xq;-6p$_X-ERltHrB=8W)Rgwb(=>gfZEtf##$oi-Qg?Ypx(P~Y{dH@ROKD$ z`O{JDq%HK`7}VdDDRvm2iZR?h;)PhmP3(N?#P^A`B*aJ(C1REEc1Go`d(p1a0k2V4 zZcMZwwDJ`?cfaDo%2{qY#g+OD-)K``?u&(j;}}#-zJvZ{Dha;pPtU7ycgFyN=yuGq zF5Ep1CrK-D*MbmhI}b_qC;laDBn}+5SN}qq+fM8JTRjOE@mTDlc83>k$EArp{VY%#DqNkGA z-Q7<&YvL8%uh3U*BrtW0+KHZ!A2x&%V2iCjCqG)f72*YFZD3G*GuT`@+ue^2 z`=<9eq9lB6FV zTjEm;DoObRU^XDN!K4thH~(T*MbuPYh40I(k0t%rZ& z{dQuTAfzl|X>w`Pjg;jGRll3Kj^L%J*@?P6>o`y)bJ@&FbT0hyD>nDq_(-Y_dJQtj zM8gpAJ7vE~E^3(zh*qt{gN}Uk^)~qS9usb9Vb3R5*ZlQMiwJz8EO{T%U6v_@cC1?armr>)luRLYNZ= zQULmFtO%`rW2Ja^aKhzn7TfhIG>InHdPU&A4G1I6@Bs9Rf63FyJawa`B->Y1mVkZA zv~R4nzV|G1swE?L_U{L(q52(%AA75-Gla^Iy*g>gQLoPZ&}yA?oYc8BU*~orcRN`t zkF!(%qT_sDPb%EX;D!mAqak+KIPiE(9A9ZK6*jnCvQ#sv#TI8HfQG4)`W`IxFw1Xs z7o(%lH&ZDe*~3O`JJXBemUbAYD*>a^UR@))YN z$8}HJ)YKh7r@)h*;wT_AfqT64qIl0sg*LCEaB zhoN;Vz3A9aucwa!=)=k)Lb+R$rvyer0vFaIB$VnCBJ?i>rybwsLYq zjTh3ra*FS%rjj$jv_*0>3_Jb0+ewJI+_>Te#d)AqpNj6T1{QOlB){{!4tTd~osY=Vn9zF5`p64;`ZLY&rK8*RxwX(hKaV4I>ga%+uVeUKtedd(vcGiDB=1}d)= zHdc4+d{mlMjsO<=>c)!oX4B{bw@w*+NX$#mA<0PUyu}Xk^8QM!MT& z>3+Ws{l4w3br~_U%Mle@RIy8{ZSjg)GU541$gVAmHwj6v<*5(LvgQ_Q5TkI*1=$*18wNxN7H zN;|KZj)J5D-1~Ua(-KTh;yZWivy{c(P|{W?^o55oWHx9U)Pp9Jr%Ex2xrrl-VOKpl z&b>PyC;4I2+qLkLw@%|)e5~~vklPM6UEOPZudz_{gM8Q>E z#{==9xT^Wp+X2Jess8z*=uR1UGC$_)a`VZWAEM zlo~N&@*o#_X`dYTz)f53I-Tx4?bXLxf8xL1LpSpsHv06wxL^c)Kc*L0h%)hHIr^8rm+)0#vX*#idS>KAe1*}NC;hF-AHYb1I-r4N;+*D>77E*pU{ z@%i=e+`ul^*|YA1>3+uL7MngqQ<)OJ*Ms(-#;7M(To2F1M_oCO+n5VET(p=Z)^-_3 z4B6aVub2NssKF({#d-Djr^bVDs|;`V@q_F2_n!z|5X`rVE|u%#|Btlbs#$pM6JIfD z3(cTV$4MqR1uW$d`+T&ul;q5Li|o&26KerEjh?OEPgQm=I8S+t>|>qJMnaP_%W60R zFH^;-eK{@gm&tZ=yFzIv>8Q{`ks7Ji@iqHoe0C{F+^1I?@ch*v_`I4+O9+0e;6Ez( zUld$c@Tr3TRl)zJ;4=mPq~L#7@P8=yT)`I#{!az}mx3z_{#n8Qt>A;D1plLg|4G4z z3jS`nUf>A+t9hTSiT`RtVxqL~@aS0n;D&wqp7D|XvBMko=0^_pkB;^a4UR^cao)DE zv624n@v;26?7`8Vp^<_9?seJk=SNik-u4YG`hQ*af$@Q{@sa$!gZc5Xk=($#?B4P2 zf&QL9&mZm@dOAONZ}*lhxlKKrHn(nvelBDtS0?<)&jjrAF#k#zxfDiz6*O%LGcFME zC%>8S2NZ!~1y7hY184Ge1#dtGzbnD;{fT3O{;tZup&$j>lFC10{clS6$3&aLX$5Z* zxa5acN*9GU>*|`DGsn&V#)1iv&6TeOvs85yCq~Px5!fZ#^>5bqaus<5Q|LNodG0{d7p?N6R&PVe)T+!15t7uMB)?ttO{t`Jp5rm#a$=2lhU zlurBODmkToA0wFfrRrQ3$$y++T(qPIaLW`Lg$)en7Yr|pWdl^xX;s}DkS7hAf14oq z#S*{pc2m>WT#r%q-_=;Qf#0u&TNUh9aJPcBG2v~p3oFQ-yrNkuypV`{7yJ2>E0SqJ zn$Ua~p0ug_z@h$lgX=h$r{;igMiGYXPo6Q5zfK7I$u$D zM&Wcs{=(@nv)D+Rf?5}@gvB%!-Oh(~US!FUr#|8LbXd)CYT?}#%7@zu?*uvTsA1u^ z5Zv{+g9$HKrqTW#b*2?kxS-&oYOBCdDK4Y5xKe@Ec#$>k7dsW)OYq`=A@Rci2?18C zOtD2lyMhkE+@uCJO`pO4nIf}efnQt~&^Z-6(^2nTs6fx$X=!^D%c_7;`=yR#ohVgWt-uB`xhvt9&l#h!;KV3LA(DSo)sI3X|L9f)+ZAY) z9u*rO-K(HW!G3iw)Q>)H6TBzsPrT|+d@9u5BD-`(tGB?CnA+)=-u0)a{h24#9g=WL zji*bhb%kJ7qn-Lt$%_Ot$0;q3DS4To_<_yoE@S4SjTt~7oBY|WCffYj`_x2e&U~W2 z-zPTvGC}zO!PGhOCVr!W^9oF!7k`rgw5U{s3CovMxlzrCWhQ2n>@dRojU!C)3qd-h zd?=bJN4k!xneyEPv&U3;mZ12Nur2KnG`m?GsC49wO-tkFMm!>NxhU<{Fx&wl65Sb z%n@OKBoZ^FPLZH=FS=Z_c7*xP9D$mdBfAwmsi4=OHk;TvvYnjc6M#N)KtY#LusM+_ z?IC&mW%c=}3JxiFUI8fhrPl<=WIR$JB~CkXQu#k7m;$C>67!eD{Kqx+(%S?_G^ism zL8kPN#ESo*f)5n@T0~(ALH#$0`Z)31M7=tCPr+HEm6rdByJ<6(QczP{_s8XBik9zC zfF}0KsN2jGgZ5|lD)udh>xbu8Wj|KKZ*^j`@&(m zFRu?8NCi)wRq%#{w+e$QvxcnIo;^RmY;JzWh4~rhqP~hB2Yo>Yf9j%wIVa+kF`F`$ zh9>D?PBjzLa|$|yxdg)W+HefhEk>k%=5%b=QPwKmu>0I%n6N)W* zZofdfxmJ{i*tJxhT!unaE!$DhY~mfQC#pBsLd38nGcg%JX{ySdsY;!wfVHwBE`=>f z;%z0QrLX%e%RgO7>1ocvQQ(GTtnq)HVB7lc+=O?v_j-6wa z$HX=-th4zOfKHW6vP}HR->PJHSTZ@O{$4m1rSrDRq|^$JrOkFAI@#}!hcya!Sc{YN z^1_)Y^D$)>m~H=sHzgGWK!!W(xbRq1Yj;W&-Z2Yyj|rWtEZBqrK;c-o+ zUw{q$;tGPor6>OBfs0##S6r>&K4ZF%5~6i+yMmo2m^uS#XI7~H;u|X29n=*uiU$-7 zC>T?4h+xuWhvd|Y=Olv)YeE9PcrN70H2X1GQjOGqQ6ut;zs9DC#%5x@+z=uzi^~5= zO$euaDH#sEZ0KvtZ6hp7WdCG^?e6wy-vz_lq@=?|kan5rsx@KeV_BT|lhsit9i}7A z%Xy~q8RDjs_e_~U7 zEX*tI6+lPI7~soPoIPX|P-bbbs!x0*JXIoOT~gi8o?GpD#?Y!o%bmqWr3ocdT7ss3 z0to+-$V{yc#N`q#>Yqf5u6!vPZES3-eQ6~@IjT4DD#_!G;Z(7eC|^O`mF_T{SbU|7 z>VFmva7vbl@vLjv63%O>HJY|ktJc`@c51ry!9Fo_9G1x(->-nNWR5dynd4o_x}|zP zu7H)8IetjNu!858)U8SYr?gAJBJo=~p@ANGO_`2xASrV;Q~H(iK2z`|!3mV7f8>1y zVv{2mlvfjIDKV4HuFH;AtV^y4$9P2C-Dl(oM;aq?f$6tV7LMaHYG)c`&`Qd!4% zW`5Rr-&wg4Bx)rC?KBUx2z=u7g5Azlbvrk&+c|i7!Dbh#nq8RJ>;fFVV6$^o&Cbnh zc8;a8-~i?{fT`ETna;e|Dm(FJoYriect?SJG0ck$^%L)hvpE%M9$RrIv}{g%Mqsx1 ziCEeXgzPXqKGxmS9?77>t|Y9i#WO7w zr@A6x5|_NRU-s{hk<~aDeG~pO>hq=E5Pi#={v^cBk}nCt=}W3N92S@yo!uHG?^Bh_ z3N+SoOIR>{MtQO>Y~7a)vLs{q6AE5BtcJsU!? zf}e^EGZ$6xp#sL_|MXH+Mah|n%5tjsKfOXw{HL%=SzC1%WWu~z&Hb$CeNv<-&nVWY zQjyv!pKMXVUK8<;p>+rR*6kdKIuU*nuI$U^R26=H?(fZ_W zW-by^t_!Evoaz;IPwtO!zM!P${y6mC|{EyieZMc z{7#-!?b8HD4=5N=QuA|kOu@8*V+5yC)d1Or%+JuOJQds2Uq%|ljJ#8g6#qnhoRU(I z+RGf5KSSeh)@JNfJB26q6TI|zZ9=DN%M%{wUi?RVg?+FrNKnjwOS4PT%}Y|L+AO>F zREiI3S+XYUH8<5}+3FE`Ixr&6g9N8EO7O76moD+;GS73m=dF5=y`ZU~x9Yq^nvGw* zw?vOjduD6OOA?*QwAWJP_w!k;bV@;;f~5+UxkfK2z8r+oD>%DKF7s;BE7OW8Yo#K! zfLfVWwOR#y_Dh|eT53IqE^PCW?^<+8_$rga#QRPW)U%<&oJd1T2zd^mwL)f*xsF*b_R| zxQJ>{_ZP11FT%D&T-&!@+qZ+ZJY8EwlJ(gofIklkZ?4GJ@Hpd-E3q`2On`9{c=!_& z{{D2@c;rLJBOhAgqDx$~#GFgaS>iL72p%U_S||V5z{y5Kv*r)K&`F=68oP6VX#3ZR zmzQeLbOq05w%3X^31QPu9Jo)GXPp|8TWM7gH(v$m6+ybWmPDqaQ0zKCXXdJ$6XaBa zTsbeDA{}-QZ~jJj9esI8)>|TEw;Hlr745KShoZYJx_fEX6OySE1G0#X=`10Ks2Z7j zKnB(>qdiGQtCwDuO(cy(wE>KkLD9-|kdX{BlGL?cG7~52U2|e_=46yPnU10}np1z` zHAmgEnsN?$n^Me{o`MZFM2#5=>ykY2eXN6NY7>$%_|uk&EnkCe(ksL%79)FwnDaHw zWmxBpsE);3+Y=#uAfjtfa=3)L0_r5~3WZ$*x+4L}v01 zC3q+?am5l7S1fVKB`#@>T5OI8sdT~RUm)KSS}1JtxjIQD4h1mBk@5+3b&}S|nt`9Iea$ zEW4DpXIMrbH;6$pTiv6>J$Bn8)sX&%t4B3g%fb!|cPmW6Jzz2UjizPc>L0flIsUlA z=R9nHnmA5>Am$JF<13lz0jB7imeS}rY!}zLEVxP&s8Y*h^HT6!W)M|Po8L@UT+MN} z3t3Go!W^yaFp*LM(P6bxNv*(TS-9;}#C#A_4LFB92P#~lsu8wK8k`kbxKl0Pr6}w{ z3XFQN>ZiocHjzpPm=IUZ<<_B#yCFA=F(!^#V&a&Vq3#AiEJja6)Kf3@UTp$x94KV` zt*B+jK*)o}g3p6RvZRhlKyTM%@pY%W=L^^;XN|bzGpC3$dRhzA6IcLxY7+UtfT^0WkpnFMRgSwggu-hUfH|SuDQq@kES{$+Jz8ah*~gVLEDHk`BPqDga8=Ws{Db5sXgkPJTn| zuBBuA&wQ^4BP(IwM4f`Aj)!O50 z3#h`_Ob12;J3~>pbk2xFqD7^NOlND2j%PTIAh}9vkVSEx3p^_3LYiIw0Y}~XkrbXd zlU$aqu_vM-y9ACrgZns}K)a$0q=`X5X=fRjX|OCLbA1?D9!8|KtxjDSSsF&1lwy`@ z!<-ru(BwF?!P?2n4?xHb8%0mW(O1|8fU%7VwT~kBiv~v6fVBwv@5`QqrUB}!Ouj+} z2Eb4v;wk+b2{yA4%z98u$u__PCa@g>laJj3U7B>k`ZjTYCu;UL*6>r5nIuP)kR)5> z*<4J1LtIPR_iCLgLA?f9GDU?MSTxtB8Zgn8BrSq1Og>RH3=$3sw!ReCWKPN%3*RZd zJEh!qkyR^*Rqv%m89gavP0Pan>Go z9?1q*n=PXNV*jWIDg_xrRg_Zk3eWYG@+S|bK#Dm#=ubY=%tlf6#=&M~lA-MJV09m~ z8P`y6lNrVgW1O%nAhOiMw8B_mp!RIA>6y&J3D7h%@k-kFL>XNo!)@X&t69kl?0KZ5 zUQpvDO_)3%i%KtQ$u@CKF`B|uSv=u7}*vZcYRbrs<2k5ws6Mmn=KPS&VANX}q4vzv8QXBtQdUOnwz zVS$}sij2V2xKNYlE~?daqDF(+-J)TsGS>NKzu6%X%f#9syw+FCcWU z(KkRU(M%@ZDK=J`$-hb7=G~UCgnTAJ!g-mMz;H@5n`2n1)beZ%b^OVnBNghI3dR4n zp^2qr(O)!Ig?;ao2qb-un%bU~9 z=~alt$;ZR>RTx{rf@dU7zGx}1mrpjNwYs#cFN`(F6~L{{$CtB!d2sUUC6+hUd+huf z+ZdLdhbvH91i?r86*j>mmeZ^qA88}!%MA#~$&W>+an8;8TaFPy27lu+KNC$x(k5+d z80$7`<#q;8nv0N*s}yy62uX?{Q&HBJn!)j0N`>TH9(5v2El5)pGHC+G&6;;nWJ*gC zQLGeV1_(?SB1Dl?%2Br#fDU?X#t4JZ;mXQgsnfO{*sa;5fGlV9A12hyMXXLh=Y+aSvqtP8?0hsF7YoMB0GZ593^ZSJ;I zb1mAJnM*hDKfPxPkEW~F*JCajuByk3k4S}lWYLstN3p|lGa_}II(d4TF`sfVK%1Jd z1DD|BGwWrNeRi|?G8BWqn{DW{N;{s(RZ`z5auRe} z*a0i6fSB_|HZ4W-BV15&2nR*rux9^k`s6pQxIN@a*a7+!Cs~q4~b~piC$uf+{DQ=>yw5k z!C)?bOe9nIAtTjP6t*GeO(dj~HanWMw7k=Bhc+xpwkPbilQ_bty$fM_dw;f2TL=lPB?83YKUvJKh~3b?G5ruAlJFZqpZSS zNn73O*$dwxZ7ohw|1yb1F3#hl1`}{hfwrOAmaP-t1zgm01Cgxrrhq>4X=t_tPZ38H z*cm+U3!YnpXM6DMrKJSwB>pVjlOjS>)(=>-ZHFZUDz#` zIjIH|3&YbDeCnA(77ZT5A4#^|!`FgNH?i13I$(Mzz$`MkGGPmD|5-RicbUQ~qy>ft z*3T~;$&e#834{U}+DcAd);10Kb=md8B>XUGDo6A2L)I6~{K?hyOyz?L3+u!e1GSm~ zQ+Y^54p~gQxoEg8o%k}&{L=b?Bb?9_Z%9NMQj=c@O_z1Kfj#Er7ePW*R=5n#5lEO5 z8~!&_tVyyE4f=%@nO8h6B0Jt$Q%?&g==>v53#z zG;OE-$qq+|Q$~orwhO3w7bATeGRSvX;Vm|Vh2-2f(hcMaKB&J3Io((h#}PK zB(23;JTis9$GcG5M6g6eLTS0j31zKRP^X|?L5+eH3YIEZreJwfGz%BwS-2Qweimn% zo6}})F3!|R2k(p6{1ooC#9EiI2iqdcTjBCnC^2bnXdco^g14RZY7$woz<>Wq+{GtO zd+C)Eqp~>Pz)hUz0Z;FC!1W-JhSihl24aX@rLoprb@PL`6~gk$Ow9QOB+YJ2XZYIj zdOBMtCA6*yhdiv$jK~`ed)p|U)T%5tDn~L!FL@AOlU?d6Ny2C;t|pXlma;3X6GMRH zI(YyFRE0n_{wTW)U|B=~xK=c5Xlh7XnS9&}lzlDqe^-~KS4tS-6*q;wt|41jiIlXv z1TR?BDxZItt;lYl0SoB>DHZ*3cDb?|D)SnWphW|oa?i+7lg5%kV{OlDXK@*f!uBR1 z!QNQ}YG_DW>XfBg8iGSMk*qH7UzTmMn#-7XpBMUy+O1ZB^#Tu?(Ny7 z0XX%;pRoqZQ|6emST_O%!AOk5mB_pXrQK+&+zM+dOg)wUdaSI@#@Qv6)EwY5HGo6#@au7fOA+!uxdi>GiJo7H3) zG1GWyicFvtPO}3FV)&pVIb1j!E63BA7D7XclDKrH_7pUA`7ROFFE+;Yi;WVc#YPZP zCq{wOtRU=Z+S?j?uTEq+EsXTwg+5ru7^U!@H7mSlc9Lobk;3U95&$k-Nt-p~5TPF# zq0%*lv+7&+E*DfW!Fbv^F2Wv*7}PQaX%))t;lHRnLbLQvJ988?5kBBx7;B@C#2#8qkVnGK{>_z*>$Hnqw0V zg?A8ar)^%WZ3yrkn{@ZOq{B@wiWFS7ZQb56%-(Sm`Hr^t+&^;5RoPC2gV~Y8G|^e8A0I_@tbwQQZe(3oWhqur&n&% z=CYy^m7Ah!K|}K7fewJUma1kQgxf8KP;A5p?KWSQTG5b9+$kz*N9H$}|C?x-)0Cmy zm4;bMtp&dQ5ckNp9-dR3$2-DZng-hw|C*6pVmXj^o9E7oU4~!OiJiEp7#L}nAgfls ztvt1{m8S@GZRK5ZEAJ9laD$8{I0tyBG#wLZDblm1hrv6V+qx4}B~wHw)gvfvaI&D& zmOM3@RW(Na@_f{l;ZO$-W4p|XN~H0Sil0?zNC&k-id42JF0+QkmG0s0L=@~Qj$il} zm$}A0bVY*EVd-Lf7Csk>^(_f4E6tWe+-A}CUEaCV2~=`DnjlLrk74^U0%(3i1>?-AL|b`qZ(d z3SUO37rrEip5%_u!&$^sOlx{{)7t1Ns7BWSyfMQS#|&2@X1L;*;Yz>^f&x5bAP)V) zrUn5snUv!u96BFM9C`*hL`_JA_YFw|H?##td|?|l!>Ga9RJ@adZk8X9gDS0kWByDw zIGc}hVxozzRm&kDGWED@Qk)a^PO0hmR8|{ za(UP~Yq3PpZqpPlx{`}l((X#QE5mZ^aET5BU^^5eBZifZN-I~k?J_EdVi|7!<#s7L z>Gzp&tvL8j56Y+Qs-K2hT&M9MUwJHdYF}@W>#&ML8ZzsVhGtG$wR&=7Wk_94OjagT zH!3+1H(VJw1b&sH|)}?BA1Rbk(5LJsHs#ZZ%O@gSJ8REh$$P>mv zbVXQPf!?yXcsWrJ62d%GnTN`GsBEdn5hzdV;S`Z*xJp>=E0wuQkjo8%u=s__VkLk~ zC}Q(~-Y#7WzNAIuT9?C5x`sIw(Li)?#1@<` zFbHvA7v|N+(G?-S6(H;4;-ztPSsY#NdI`EV-Ju0#@O2HA0o##Fu~A-aB_Ukc(JPe$ zc_qv}RhfHAYDoHa;>}tlG;H2tb}u)}aE4$}xhrP2JhZgKb>f;yf>AGlq%E#swNuO; zQ1|4`xaC-gW`B_FJXEVH0D|>oqRlOuvxst2e4G`Sv@fnB z=5hix%%>YXUFOn3Fz1!UyPKNuu%_he<+!uBr-?H?qu9E%E%9|&h}1IpRE8>Xis69) zi+mj-MKK;MsdbIIHRkjcV~wM$mzkl6HI_2{l!6MfkjP*Yh~kr-R_tQ;F4<@C6yAIw zccr!0;mP}`S=GUr&B1b53sJ^3S%t;NF@*6Mn55f(TNNUjmg4F^^4N(x6fAJXS)p^%CIR3k$#+6bRz);8HZHGOE$lM=%?l)8O;UKVccBHERc|6 z7dbF-#uT!2?W6G4QdoAJOg&%3JclH#{4;hZxR`f{{Ye)HzB z87}q%&3s8j&Iq#DvM}acD{S^eT|oaW55G8v9)$#RoLu0PbrC6Ui&>3}E_u!%wFf9W zk25ih07-}VMXDOQ6K9-b-=L`TpE>j$8gs}OZE1p(HY>%80D50t;3kZUeg;AqzSvOg z^X#Ii7NboJ_Zl1p#Us3LnANT(y)K@d4uhI_oZQT;g^O@ z)RD6L;YZuk2*A>qf3)Q4GCq>7ti#|O@{b;>gmcKjIb^=$qg!pOdi42pT2_DQ`M6V; zF%dxy(3lXH_@xP$;#VLp+8o_(NR*|TR+Eb7`O;20XtFCDWJH0$6PWK@n{dLxXy<_eHZR#5JMKdlWCJ;>y9F|JZm zP^tJ2F3lDIM2}UDYi~vqaXcCqFUk3$QdJHYJ*q0XevVVu;2w7aJnp9Lcra~U2Ki(( zH878XiE|v7lj16k;iLm|(v6vFcN@AVE79G5hcJ0LA{(>Li`nHCO!o%Cc)23O3EE%l zr98_=jgOxH@w1Kfpt`Rm9udcN93*Po2B-~|MU|~`+TlKk}18H!^fFiHSN6kNRuUIj+4lg$CTh<)h@egdil#Q z4_l%+7-1o(z!rlx(XyJ^AVaRLa6jsvJQTr9gj5C=z+&u2xV~( zA6a0hSUL|B6{-OCaahtoRWPc!I2CZqWydY0%Yjgym6CvciXUKyN{pAs>}~;Br3=P? z7sZaHIluIY;UR;_(#4O^yDBJtl*CKuVsNphDkfZ+lxM?c$iW4)pPGRw56%{`QC6au?%T`?Qy$f4$e5MOP z(w)TWqgX16iF$rn>}A7#mxwwpdtt|vl@Dm~mjxwY#&VY-@w_#z@pT!53N=Qmat%yo z#Wfm9xyDEl7na@>P0ASL9CKsQ2T{NH4{<&?AmVD$EJlNbfe#w*nQ1TaGCk)Xz0aRM z3u7Qg*CD@;_spgOGP;@v;LYz)2>leRJhQ5n-XLiN4YEm(s%`Vd?EA-8XS&pbq z@zpec>X2XB8@4yxI}{ebP&jqSa?GxxGKny}TT3=mzFS$d$1E{>%qpK%!Y`jyqIAi! zdM$o#mDm9y+H5imKakmB8gigls;a=Ij(}kuQPFm)nhYpG650DePd=h1D57JnP!q;R zJ4#~jkQjDlGI+6Of`kf=hmAfF$S{d%Y|VmFI|VO==A0`EjWR!*lF#0Ny;)R*p;9+o#$5I)bw1(ZSj35ym1)@y5aC0a4BYMGLwMocmGYCZ zhPChGY38RI70%irj7<)!h|$=bu>E04&6{tW?-+sKKb&qi!9 zJ4ZI>DZ$b!?Nzhcvtfqhcv3Ya!h{d{RMxu=!x;{8In6Dmf0qB3O^`GTYm?6g@;-Jw zx62as(nai(CVt8H0#ykeAiV%hpqG}R$)uCOXRm@J8P+8ui=?={6EvM3PQ`GhrHZMj z8)q0bu0EdFUj{EBfZ4YqX^W^LUz=o6*ynsPbu-c*7D38K;^QKl01FX_Ca=;!hIG_9y`EFx5R% za&HdLlnlb`1@~}AY141=d4ZShn0b0GU@X|PnE{)^WrmQw`tT2*?pTgOwL1Dx06kKO zTNj6-A<9*iP5Q9n3pDOzjZ7vEJ<-^X-Pnr+tX%K(DlS&Ae>EFL$htINhqT@q;z7 zZ?!UPIHob=xn-<~jk#=6y!>Qj{@QBP)hcdDQiBh^ zq}}ZIVna4cF_Z@+s^~W)A#&`Gvh@oWAnEQx*(}(IvS5Ctxvo=1_7I=UG+wiCY5=?# z$Q#fB##Rg~j)#^$2~Ba}xUei(#Uu%8n0w5@nkNqSvAVs4wp9+GsfSK=YxI&fTXAbD zupf)lG$PAROig__1#h||Xcj7cwoR&P+jm!sK4d?tD_N>SZkaHZ%w_p1$1#T6!A(AD z(>D32lhu4ObeYK$Ose$Pxds#LZBl`}Ml6-D&>;juf2_??B`NpQ(gYlPQG|ZhnUWKqo;w7pDrcZ*x0~9%~GDr8WmsZrBaQ{ z()^ES2Gc1>H7skOuz^=zsI_WU=E&+*%T}#Qq_|Q{%jQ}+lp8sJAZ*}#q*m3`hI~G) zq|i>gBR>m%#kOlG{LFik=+c0K_8#s-*E=NyV3WS zQI4c(~DIqtN#uH05t6RPsZ4a5)QA~5QB@kan^gd)(ABe%qJ#vA{ zN6w-qaR-N4%HZ2&=`?B}$UBFO}9#We)gO~w(sf_>yez-U%Z+)c!!r4~n# zQ@&GtDHag~X2n-2TguKBgD~OTw&c9W_j~pAUW|hy@4;GNM|Jj1hN!Fozx2-%d2r#s z1Pgj4aBSO86e(U0`KDP`7}im~irou>Gxe<9K7p}-|D_r6H z$WFw`x0?$9=YmeLalOOs*M?j0*)Wb9-H>0woz*O{_e;q0&zuR}ja8|SFW|7^cEU9( zp`Jxfb{)a^rSxRwxeyYmm^3jLF=7T)L@`j#Os!_IXHmY7fYcf*})kvG_ zb(O*H_NyvV#0$Hu>*CKL5#0HABB7oE8I52h-vniD66yNN#Q}19}SU153dFn;v zVDB`W(h#RE2UBM-FjohNn24wka%S&?qI7#7T&S&@6SC9OY&#{&=oL3F)CqU1{>&%P z7BLlPoOKyZp~;3>Y&9ehFac-xvjDO!38y|-=M-|bGJV!WQdq$>uU$||^XfRlM_WlY z99k0=Lxj1lAs5`q45p4Mu_>v+O2nd{~0IX1z-WAQ+4_JE$*r z8V$5%rYpXBQITPMH$5jo3VZ1#Xb4EiUu4BiuNCJ^w`hM5z)7ch0alv^_Ds{57rH_@ zz18NDn_D~^=*i~QzWzA9)wr&F8n8xw#pGs_npgF71!zoN$D?Q2Lr2pwJ-}}`+ZXmvndmy)5D;TP!n;XzUtZun{X)qkSwNwkHu?s>EVId^U@l6nuMHw z9=#@+P|w2Pnt)|9)pksQ4`57MUfvS1us^dlO&m;#S*C+A4KBvj(#ej!xq@t52B%N_ z5<`Fvr_D{R_Y1?gWypF!W$}+q9wBp#elS!|rdMdpEdfhu6!o}~nmC$-pKbe{M_6$Y22menh&^Xaeja((Saq$!sVB{-nZgdUV{t_QXFhmJ zB=h*{0Ni2`n+S58D3!QmV1}fmJV)QtZ$`dC$5Z%~cjKoAi(eB2pY*I;MNB?PTzAz~ z*k6&&+HsAj#eYi4Z)PdpPr-WryAWF(-;NA$*{d1IAB-Y+i1E=|ZiCl_C&Rka)*HXW z3?gEV?qn7P`VJz?DZ8qSB1YiWW-PY0nuyr7{PK7x@xl#HI?ah- zMYjRXD?4ndOze+3gZ||fI;&u)a#hv#2n~MIA(|e>EtjK>Yd4IslJ0F&F?Cs^iHi8K z2Y==Of0aU8-BplcXJulqC@eQ_OsXeMOqH9M;(A48(Xi>UvBS^UQrU!dKxKJWnUN;Q zr+W3&BgN#3IU)=N=(5fD^vTdiMovI7a9b1ZbkHwxu4}!#O0WwpUE62RGVl|aNv6WrXymBo3v_!-wIJ`9{Q74W3 zu0}+7ynUQ&tkeraWo~6~!iS_q^_9mm`yJ1yrALA^Wv=-K%HlEDCMb ziyv6sq;^|kRaG*LIc+vBQ^M+%vJsS-wbW5l`Iap~oJmvHKPGB#Q|p=_GagxT$>6r~ z)MsKbWFqroGav&-TeON_1qm~v<3?Ull^Ch066Hj7>_U-NQN7-6sx!D7Wcmfp2Ix{c2ac#?vLl~^Ws@Q2wCEJpm=^uypEpav%yXMq zDC(Pidk5YV=tb(12tM<^Kl35K`NA*0MC1atnLt{yHZ660?3UP4(A9IfCw`NseMWv` zRkD?eH4UtZS8aaf>I96H7e6-Il+bLe*JkUTT-15Ws}2q}Y1s_tY3)|9?I1p9HY9ZH zO}GjomuKSo_hj)ypuREe;>-YuHE{DC?o?G$E=MUE75_;)C=lk-fVuHAr8UeXiWPvI z1+mkzSPFuh(nF*^?QZXRsWcWK|#$r!dHLWpfpL353wv@2g zrso<1c?i!`{6d9aacs+h?CjY{H`>{4C`7?3vH)Z!(W6AMEo)t;$Ci!U3g*;WDsz|r zn%PtE^$?3Whj5y;Dv5v?r91Sr7{Vng3XlVPeFfMI!j0<56oORmr*dabd(}>&*HHL%;(!pq;N;b{x@}Jwe5~>Zv zv)I?nFKv5T(oweb31lG)Z+LKA!xyiWCza0wG{pKYoV{TFZ2+^s3Rp?T>~hz$dJkV#3`n%Dyg& zLkqr1!F?m01c+(|LcGgJ<{T23Hh;r_2r1Mq%~wk>u@}42GWqXyfTcB}*cV*v zYqGB=`h{=Wd(VQ}*81{|Jzm)9Qh6R!vyT9c^GO`bEd;M&t_e)t;M*<1 z7xoM}n%Eb8^hpI_P|&9bi0~l=BCd-|wG@o&5?e3^dr25eZ=6?&t;&lj*S$-*Oe&e! zm6j>+_WzaTGAWQalYDf~%nQXoXsRF+cV02~8>udV7QWDEs)_sY)O0VHgrED#??T}(-AGMNdOtZepmArt5LIsQ~ZM!714 zwy4f<$N>bEzBEYXOSsMhO1KGTO2eIgJiFQk>W+hJ;~ujzh7p5EJSz6roU{YpE z{S9o-IKJj>2ETL=3y|+|5 zN?hE@L_Pe?v9I29;ym0HQALZ-+NhK-rbMT|$F+Fq1uC523ld;J@BZ;OxLnEUd@9x4 z)M#`losz2N3tcHb0>)qzbEACMHeAQgVren-#-$1whOIa^Xewx=X+0bLpR0yGXW)WN zwA}pa7pkjYu=>4?k=74?O~!H|VBRcaYdnjuU25DAbOtTRInqT*x7uA2 zSrAN?lLhj*nbZ%5C=Fm6UcKUj;s?CmQ4M~Mt6~xg9La~UP#MxIs%0O#M6`doWUZIv zUy6U}nzekPgn*x3A;xd6ti_tRY~h#7QYa)Ho4#e~4=ucC;hcq^(U9N2P?Jv-@@o@o z`LzjRTNQLD*u8Wu-E)=Cs-2~R^)&G@X+FQNaB_{sYb;bfJ`+r+A4VYL7ZDU*60jDF zULeY^AE@4!mhmf;LAyRqvg~*^^eIb&OHbZMZ`DuWR5``VYuW(90 z`8FKkq~_A+b8mzL!Biv#*(~kLQS8fj=uL4nYvkeHxx-IiP&06Qqjndg*k@5p%;EFB zF@9~Sa? z7~--m4CXiaX&;MdClgHUo7OJ)5{eaSkHwcz6qggJ@Qxww!q=CtWi7hTk7z!5yO$ZJ zvnKa2t|%s~#Xq^MwCkJiEI15vs%}_aFaXBMg^Lz%x3I%XH)%5YW`Jn-S%gioD~>*H zwezY`bnOqvg+}_K3nx`&;%%!qW8n)Hp0Ln(r1&=$f0d9|4aHHlit=J1O-oseH&|TQ z@m8N342Br5|AjO)mN@H3pG%F3f@8ka&)W3w_9i(9o=p5y%u&^xL@J) zn-;&1P_JMKjs}mdveNp->mq;3r^@3^Cgsh4X-RqRO(kIPa)fGLQOHY4guIQU9FY+d zju4Nr<=Cp>RU`6?AGoPR`YOo_MXGG*^BRfbpAhQZA%*WNhxa)MdH;lP>YVcV%8N?H zm-1$(f==}cickz*L9tPBu59dYC(QMZ%H*Y@nBypSUsLe-!TGgpAgvplXKvA|OE<$` zs0t?qs%R5hzK9GqxNftpy1WrV$g2>lbygwoKq%g8@pDE2UBy?Di}8fBr&*`<#5n&| zy7;Ns$10RhE2I2|3d?gEtix!gWcg1hh zgxm)poO;soPb%b?&`6+TLM1On6m!Rf%shX2Nt6}yN>NYfz zlzqfzmY-)1@|&7c2`{Cer{k)gm+-ohxBp-yH~i4h;EqE*`Qfqtp~0>LBSX)PCaA~n z+VS6-gtvTOe&pHyo_wx*AYaopGM@KvXVTi698GwW2lw>%j0}wq^^I-V)tet2>mNJ3 z;emmEVjH&SN1q-W8eW&(JKjCe-}C4B!}qqdw6(YBzxED$bh=ba%jT9g%LvLhwQbti z-ny|>H7#E;{u@2H*M+c?%de7v9GspOKVR{M|WpOOJDEC){S)A*4?tPcVln9wRKZZ zdv`~BeoL;WeRD3~w<+J+*_LZ>$!}@jw54}b-^N@^N8jenBEy!}*7l7ZEnE89dN%fS zxAf*V<=ZxPZ|vx60g)}6J3F^@w6|>T+nnFjyRn4^y}esHJ2v(8Y}uIGl-u0Wnd|7@ z(w=MW?Q6-kb#CnJY$4UsvN0!|JKHz*LYuyPPv_>|?tIUd)|Sn=jx8OXn>TIj%=JR_ z5r{r;ZKB^lGW2wQ=i*Ysf!-gXDkk&{w>FOL>1B;tySm_n>TL;@TQGDJ#C#^@>_b_ z^1XfemhN0nYfo=aUnjfPEp6@Wa$E8(xh>tTovp2%o4U7b-n^x|n@w7bAdk=)~+tS{nEpooEZ*yC&yKgh7v~{-Tds}iF z+3dEqZtNz=Z_aIDgWS3?PqPjX-_p{)si$WP+s|w1%wW&IZj|=s6p&^e{c09&=`8GL79QFEAhzLG zl)bfvp-~pGv2D2jE1tcjJez}O{|!6%2M;}fUK|?8ZyWx~DSm62w-*xs+rUZkgZ@F2 z4?ozp=PO3OrHuR}RQ}80R7c9~D?Yx(hdX-`Uekt$c62>Bk~^4xZfNA`b>GjA$eOaH?(nNmtGweZtou*9>^Vjh`OuQDjSt#t@hXXTt{TEWbq#k4>@_~o;qriOc2G1+}dBQ8~SXrO7|GEzJ zk7kE+Jx}MJ%4d6q2FG&!gQMB81Nm%s|6p#UKR=os>a%p*$+mIIIWO!n4`+6FfA>gk z{?~!M+OdOxBb=lNItu5d-mD34K06?9qoT=uz&EW z^?)B|_@mk9`o|7rH96UPvZFl*hK2^Rxt^Y(@j)4T@%RLFXfRhcZPjt=$olNsP6 z$~@bji~GF4?ST#1t^*J{9L(^@(6iK5ANf&;I#kie0|P_jz1eMhcVz`SH+VQZ1W`vU zXEfi#IC`_)5QvG05xa^M>X7++*0EZ4bbJ^_VY)fEWZ>Cc^+ffJ5BA6>og3h&SLhrb z8V{zd8+Pi=_Sos~Xm-8L<2pB+5o-qNJ=-4Lm38y#c`G@UhGVyEXx-4_dF=`B+b;F3 zmW_Sw-J5%Rb8YRp&hDPhTx)kr$L1|tHn(l+V>+VdVucq<>t4-bv@j}46+espBu!2@Gs!=vB%_P3v6&d0kq^b8&Rwz0>y?cY8a zo_nvaCeZo;$I0tqsP(-=V}toI&)bsl+7{^edvM4G1&<&|@+05cy6@@!;ccUb2YbHT z`@|Eip7&tF+jb-ETziGv27BfD7#WMew0YjHgtz@h!E75D$sOkGVd(zDV|hzNkT!YV z&V={C4MQ62-81xTzH11x2d_YkQ7b4tobbMPBY>(PJjlZ4w!&5L+CA^ygx9ecysrGA zv5?B!hm2Aooi}>kj)ZsLjkeyK8yU^-9U2|`er{kq9}x!}{w(3$f1^-@frj&7|6u>< zfjpBI%sNE=*9q@CHv?yTZY&qI$4Rp-;cdOq_BNX8k#u+-(*403g`kn_8yi7X7}t#V z_2ow*Y&ty;rMB}%Vd1@#lzSjIGSZJOc_cqJK7uPRTo9~??FsK+-!L@I6#mwpq273& z#C$hHAPw(<13-$=V5%QTc;CG#G#>8$QNE{Q2{6q!JrwzptJcxxo8#Oaxv?J{=pW0E zqN*zh0>|9+aNLB)B!Oq{Pk8s$4g%KQ#s91Bf!#IDD@OIw}7mELMOLI8i+jV$2 zKTnUe!#p=5nL@lU8S-8I2V*VJ&g?&w@OIrOYV!d-+}Af+Au-!;a{eN4`JVoRxtJ;2 zS^YO7Fe5la+&PU$w~6KdyG$R%-`EzdkWCQ#cR^;JvfKozznkznuSe=1jG(L86l@=2 zpEnv0<_3jo*xa7G2DJf>Mj|8VdkJsHjiO*MY-K@_{0N)B7!;D{dix8hw0Y=ow<$kT zy;j>G?~NFqA*AiB3n&x{RQW+7tlHq4TLnwH<7P$};I(fo$1Y5}sR%1c>6;;YC8T)^ zUjp)ad#FmXSAtr|GT8{hZbXpGBmSfC6^2B`{zWqGW~gNVjS<+{RVgGbw;NH6^H8d0 zs!fdR_Xe{0R$#J)8T-94=|sQ&{y>l*H^YXNQ#4jJMXfE6_eS*Vyg9mRC)3Kx_#N2q zk=%3D)7>g_|9bo95E{K{S!L{lVn{czb*X|>Asl2R#DG}W*V~_kfVNgqW`|r-+QL8e#1q?| z%k__i68rhq)+buN%S#Q9CcM3isiGT%>y(_JwhHPa32)CWfC~Bo*(Q)2lJ2_&ARoye z#9hra3GhY%UTh6LI>y#^3|H}n`*E;tZr?E|hX#g$i$pWjij+E-@D_Se!5ob-obTnH z&F$+M=^q|b-srcs8i99=_T;cK<3eY*XnVaqKhS?r)<|s2s<*{f5D+z;EF2B7+zjA6sY~NYwg-SG#@3{g3{c!{U4U9)2jhkIRt%Uv+G=8N)ZE0aPqH)@^M78| zm^F^Kf6Q99tMz}L@HQ{n_4mw>2^ghoDB?NfR7b+wctdS>58$ex za?m`DfQ);-#i@krBNS?pt2qN=UZ0`k=2f&n5M7_4F+0As^?{LmrGA7HuDgK0XAI1uG- zgLHja7fz`l-3Zm5O?b~ZTT7BPP|o?0wcR)&|0K)N{7|>9jg93uWS!8-=5)(KDxAZ9 zyN|F?a~vW%5g9{L=bt*fE*pU3R036oy^*rFxOvHY;#9($_=#Nt&|QMa&gsn$kL09=d2yfSe0EssI-l8 zPvnosE-EG*AeQ=(QX16Rb`|u2p3}$oP z7?i<A8hU2r#2an{R z5()SdJlLhrUFpaTxO?DS%R-D8==;a}2iPjWKstToo&9T^@B|mg_Z@~e4sr?f`~CUn z9<~nxusL{mI6o-j?&y6g&+FySal0V0f7)h>qhX=DD$98E<*<)Sx;_&D?r?t3GW&$&bRD193YmHH}N0f*Nc_-0v*lA zs=)YXx_h;dG?l__0BhK--3Pf*v(;VNU|s{p4XD2^+m#!Adh4j2uYdQu;W*YAD~{Ol zIKp6XXmEZ0&~U%*`{eBQ2Y}XPpF7asbHG+@H}{9K59VP7t!7CPyAPEcSbTWyD$n`| zB!k2_YO5S#BrHZ)=m*`lNX+tZe{YYj;n=Dcb^btfho>k0BXs`{U95#(_r-~9w|xXb zlPmJ~LYJN~rj=c9|A0PY5sE8YqQSkj4O!zJZo6q!Jv5G)74GZen?>{Q3~g|qTd>&> z>sVWy-R>QjY{0e~L=abVt$PHs`zKDu1Y1BSBf{2$#I;}Yt>xi-3DIo5L^{&u41@*{St%nr_;3stCaYGD3f!>JLV>>gJkE~7lS z1Q^N2R#E{+#&DK%{Tl{~0=)`(Xq9e}!oyd#*b_CQI0^yy{k}8ga>jB724W zI!dl5x87i{H`wb#*k(YXxhDP{BRKx3S+x7?Qmr$#L-lf%cCRGR{f8Mk=cNbpd(ooY z8tz@YD{!BnheEy1Jz_^dr{^_bYlB8G#g8I#jVmcDe(u`mF6$ZxCe(jHkM~PogGbh3w;J9kc%<6o9&g0GQB7W*0sTi7Iiyv=^DO_1^RTt z$RLcG5b7Tp8mzh!sCyUJ*w-%rZ-?28-0-hJZIoS)z1$IcYUS!->#)$b8WsQ!`(xHmW+De43|EW@D}+pS|vRr9B+tA1G~p*|F}n3^bghJ!-M9ib!3iu z?1X1V65b-8-22_f`0$`}@XqfN8}<)3$p5#!?|^G6`4+yR3W6Y55L?8C0^uff6_lz- zm13cYkOYW8f(b~m0d`$`!7kW)?_II%+ScB?uDz|j`<-)35+Fo)@4w%^uY_O7y>sWD zIWu$Sw3#_W7fDS%swxSZu8>3YrEHwUObIP!bCf*ef#a;)B# z$K$mlhy)H1qa=e$+@)7ej+&(a!kaZkSUn000kE+5MF`8(D@qa^l;dDfj`*+CqP#6v zy*kk@FB%Qn>H*z}Rvw_P@f@P}e+84O%4SMnTGE9>kXoTDQf1lc;JpD`9P|%RZqWNE z<`DhTLDg7U7tlYnn|IZMPED&IT$rv-&wvFys*OQFAt@Xp>A#77 zIBixj$b^V}_XGcoxpaaRx!+Fj0U0n9ISE;DdK5~Z-Ki0%YH z-H-9YEBgQ#M)i7FE99#1h90hB0TrWRRts-s=PI#=j;&%h0t1&?brp@Y> zs7QtFE&ccuHI|>v7eM!E$C8EyTeIYOFf#xSW#GNt#OZLUoU%j}k;L1yuM$foazOf3OtIDwkQ?Hp-FX)s$nynmCd2ulXo-@4X_W>rfC@&_(~97nh?dh6 zN<2T<%qN8%lMvfReL+q_ zKY2>U*)Wl*9#D$Xbv={Z+!9@c5Mj&1$yrRgd+1Xj;S4Ye5e#DeuOgzyAfo$kBZ3HE z*C0awYKvf(X!m%8p}ZIH=pUM{m7ImufLP}Q-w6p>JNskc(Y6t_IURhiFdIiDR0Iga zU;D7o1kGC{@{x)1C@Vn$+8LuCs}Ec4JXI4=L=p8ufai-d&dNzkC0JB{`f`XqRdYXD z;E7nj7|%NiYywb7Dx`zvqq3LENpkIu?FwLc^xk;6utItyWhL2lqIrlWd7i`};;Uba zzzmV1W<`K&B9%i3t1g0d5Av`fP$)2Tfy={XQs7i}odU!lKiJ36DdA~CF|aEMda#vU z0_4-5Lx}%d1)P;Hozj4MS-B!uFqAYPE{0Dt{jj#|47@h=qW1%ri6CA zj(vkiPdhMO#OfZ5A5oKQ3VNlQkQtb;)H+YyFUce;*^m-v5O}d1qGvVwTM3!wXkc11 zQ}9*727OWcxKOsouVG_HYjQsm1TH@MkDy`(+omp!=>Vc)&iRyHPhIw#Q8MM0@s#gl|6U~Ih z2X(BPVyRp&RBRoX45ugEQS>n@bIQ4XVCZSreJWR^g3jQzIu-oKuCMOym%8HEAvlg=s4RIz;=*qsrA`ng(};!JdL_)%HOggt;6- zQ4@5_0i*h|`~U|lgx>G~-46ONv%(6Lc`(qGtWf}?vZk6=xq>TFunID?PfZzDImoo} z!PJSGarT$X)#AipP>0H6>seN6b6UN)qoBVafpPP&{UPMs}vs~TdUZ@SY;q$bp@t+0va z_H_uAxpS4JvE_gbLA&h2G!%%uv|s|v;g7CHTUNB`!9#%?QDD&w?9qYw5!iQ(F|x!J z^MT_{B&xh_Q?=Yc+1iLsH3vE^6c`yoHA^|mqoPZTwiT2GK|^a7A@ueW9{mG;u#l{D zg>u6MYwA-oOYH6oC2U|KRcz~GxO+L+w7yBt)~RiLQ9{EesbYVfR&Xq`=vc)yi7J4A zpZ0kg&G;z+vdT5GF6~}q&46Gepl=iHoJZ( zAGEhPiysdThXJpxYI6!js?;Fxmx?lF>P!brj5rR_OB(}VaMcKuL6crFQ3*I;{3{ES z0j_FBo;Pfvr+vd&c}y}c6REmkpt-BrtLmkQk}2;FMMKpsrkcHq8-sZG4`+HMF#jh< z;X(~WsweP~l3D=!Y_02nmA$GYJ06>)Oi>>MEK8zjA2b5*fij5*0>@)KXJx4{(5l&H z$}(zDsxzc{q8D$x(411U=c-7P?KTxLe>;H(|Bq)SP82v-A`Dq>?+ z38s?v51pyqX;2vzh$SZ#V=|~6u-;6i&!N*m`{Du(z$lkMr5Qcks6LcK|~~ zo%7ersIeQgn+Dno3Z&en^#G;*eTjIJ1u~*RRR(-B>PXcJd_Hg>?Op^e0GWDIIl%6LReK`kqAIl_ zfaPfS*3v~_e=AtBrgunD%d>E(ql4Y9Qzx7gz>rGdu7XuK7?KO>J-ivM^SK$6-8oyK}p;zU|2@y{0U zkJkXk*FReW7;FD*0WkKouh`Vo$uzH5u8Psx!`e5EYJwgPk!K}BT8#ZGpn+`uDXf8D z{wdHvDp{I$nNbnoVBsdU{MGT{Ur1$CGtEvc(S~oK+|g1 zD%Xxth0=jxK;4DKtyy_?-PtQ#m9GIBNN(*GozirJ=<71Oa(C=17L{X^GQKF8Kri}N zIv0Lrl$L|5xfIr3jD&gZZm=*@DRQ9~wEGyU0URVRYodCmOF#~&wkg1HEtm*CwJ}vo z7s?W+#Fw!k_$C%~HJ|ICKZBnX*?kr!)mh!e0Rk-BJ$ixV*= z8GrF2oxPB-7ya3bRQ6&3dy&ard|@xXvKQaj3tb4}KtcY_ru<+pezF$?n}@?*=&%=h z?1ce)0Z76J{u{9u#_UCH_QH_8FkvrD*^4^tg&BKsmqp_qdvTw=FsJfp_xfsE9$v9O zA^azFC(R_q=mt<*G!Fek#RjeBtV22PH9MFpmgi2D2csA_;!>t%pwtJf;}kgt!ti2? ztm!ltW7*O3uocV1Xrxd{<@78RLPaOd*BtJWvHi5DjFk#-qiR(RO_C*fAP^*U{6eoA zQoReeI*!{&_x6BjuYaP5{a#3$6?-&R`FSRHDED)eJ13H1qk4yKd zonsKqhYsvR#n)6tc49ZF`(Q*)MJ5D?Pi7{b=|DO@c)S=y@ll2wz?H@SEr`+C65JY3 zMGJymYBn6ADFqLrUcuIN47|$j`-hkX*?4?f!A)Rjm#K~SQiu%&fgB(dK^DX{%E2Sh zV23>Ysso-^M(x1|my9fjiWEbc;na#`t~eLBe8E%!b;MUDh@3>6Fo5&dGBY8rjq;qb z4A_L9gJI7RfCM5tLHN;hm@N^qkyjwp4Jh_%$Aw{70En?gomeJOC?GzUJ(X9Sn~0&0 zRU7zwCuYD|ZBm{;%v!(%eq-hEu(|Uva z#7WsHz?v9+%3eAEG8b$I^4LIC5*bx4a9E5F1~KlEuzhK&!1z$iS&ZC)PSpNuZ$J8M zM(#it9=DfTm=Gow2&=7&u~T|FIYO*jMt^5gcwBUKP!W);4u9vA%Y1qhscNe4e?Cw~V%-#5U)-NVTTUc?&t`1$(ty=grCoJe23 zt1I8Z*Uviua{7@D?%wbYN&1q`0lpso0#|=Jr<1d{8{fs7bZ~WXccXK92%Nnkr-1Yh z@OAU{b@rng)|_fs(075OQaTGksFV*Xfq6zh1m;kidcy-kD1%mkK@(v_r~+>SiE&w~ zrfg6)lTuZ{=|?=F2Zu3E{AVPk=YjbKQ3WeQ(wvVX3}nkH{i9$t4A7;Z+lgW0CKYLb zGIY79AfQcJ88nLfO8G(MrB>jp-h&|y=k-u5DX>!Z4)_cOgaW4dD-^8+<;k^e$My6A zHbEQTz)e;GvP&4-oMEkzuyaY68jzlt0tdFLH)xa$M!!gsOdn60K}BQ1V2n&)CuH@M z5<#ElT7|(+F(Ztos0>L8-b`gTL4+j+3pNs;s$tzRYB^OXI1vB<#*Zq8A9lFfBV{)i zfb*fw$5<0DFiU31PNi&nLzJ6<|Fu zZbKp)I?-Mw3nq1?BIuu!x7PXyZpy^=n)HksbmuhL{x z3IvR2n9uTyf&n3voC>M%+tcn*L zF#2my%sbE+3>fxxU@*GS_5@LvLzpDe3!M_s>>&s%4q=&0$L0k6KLLhzmP{xE&qEUq z(NOI{1{2IQAzKa)n{xvOXFX9CMj~1{=lsjj&}Xml|CO$|z&UF~cz=p1c zY!rjZ(AcsK1DQc=8PT^v;yfC5nm7+72o0Ml$cH+3m98A9OX*+|fZIn$0pRgh2){^! zVBXU0l%0iF2s|5@F4IsHaZnqSm;|sY%z6Vu33Dl6T_G7&#>=6 zGp7~81jgW{(NHA|alIE^CM-@*;&aB?lzshOpQCWaB!f{xTZ904BVwU9UUA(S#SU! z*AHSTQX7LXV2`?o0}kM(B1|KbP|&Ar1OH+pJ2M8pSV0$n{)X(7RNy+v=?D%CFf^a& zbf z(=VWC$pG^J8ViHRU@ve%MyvHFm|--+cxXI`Qs^R)sp zT+nI{VL++ncWNn70II^RY92@VfG&XxAJojCCh(t*>$z_9QrUA`lz} z(1GP^199~$W+-1S7$oTTWQLe}GlOeSEUHv}6?nRzfLwuxK?rqpuz)ZEP)w+3C>j_7 zjhhl4?g^v8ap^31646cF0fpw!qbKUL!Y9gr~nJNesZp(faE(ll6*&& zYuf-ME*C;+CCSkh1A4XC)27M^C^|RfXKlD&zQFaP`KzZ5P6WUp5plt_WW#l&%XMT5 z#`-v_Dg?J^aL)C2PwkR3dc~qJt0zyw&W%nwtT-^EYlEOaFO{UWI$QV3>{lJvgf~uk zDj#FMfpfi$MO>{v#_w3a;juWm_P62}GX^Z4VZGT%+L^y$hpSiM{V?-!vp?RNGGKd$ z!85+iw3N5f?;T#SY0Sty_XqC(zGdx%?Y;WkO=+;x=!^Wx-~K&E9X*L&S0Z2M*-?TM z5{@@GnPu|CiZD50g^#EYXupIdeA~iz2s|62_6#%7wl-eTpNL4m$k-kIUoBgFq1(Rp z&yQNon3{?(91|QBa-k!w%s5ur1CDT7fnx;i+;fC3b#@h0otc*@N+Ke=c?(=z38qY2 zFQ!ba7unt7!QN^2_8ihX^Vdnho&7w-Yc6|N{`ZPnKG?qFE0gel?W=$&{NzkI94i@LK)LzW)oP^Pk;tUeGpY_U!3v6w!%Kc z{=+YuUmX|hJN0{PF}6PVtNskj#t)W(u<)0?W?`%UdJ{f`FX0E+1rS|{ZbTr_od_a= zi4Y=`2qVIY9z+BYNkkFRL{Fj@(VOT4y^%;H5klxmG0az|5UGTO=uf1bcn}Umg0jBqIBB|uYEbmh34UYY z3l<463%=XndlA0x;0qQH!G~`ce5F`v=7a6b!o;@L)ZT2~|FeI=YJv&?hbbsu4>~j! zsUaQnb%Sqjq7ktV35ogatK|$=J)!Rt;J-gb1%W^jp>Q7v{{!F}KYR6F!9oHK&=69x z>bEoXl%{W_b@h)Q+(7UWpd&fJkpSh00j3nFNk(OBMZt=Kr-_iNfai%oO%ix2Wx#CE zYX-Q2lLyk}@I(r9SQ*k67*G%+RQcx&bPH`jEYS;qg$=#{F9ZI>@OBoIf_&4M;Hv#a zQM9dqluW=t2sEAu<%r>4Na2zN_gFUO$b!81B#BDFnn~aupU9wIs^=k)E`+Btc!p21 z;F&j!6#9L{1fQ$w%Z0Hh0jSs(a-e!H)k<>s!OQ{5yKpP=iNMM2JF z`V)Iw4mhZ4gdAlceAD4cCj257!P>DoF(sXX;SC%m8}6{hy@7ji;XMJ=nFKz~g|{To zPg3}gbm2h#av{G$2{Q-M5Nj^*C&VHRuG&y<3L#Ynf9Y_CeU3ey%}|Ivq-m-ni!0J+ zVwG-=?gXGLeC?`VVx@WOeWMw1}#FvX6u1@ zX-dVO)l?5(s^zmOEWLsE2SPp;Yy3s(lQF%G6v*a59E41NU=5QP3Zh4Zrjp9n8sS!? z3buw43TLDWqz0M?U=L@*8<~KO9Pq(fB?8tWc#b`eciKi&GS#C(c$0>QeTMXac+hm8 zNA-I7QI-Tyv8Gr^QKa_!lOi)v+Vs1IpDk=^F%k~IsfW`7hKfpx+H9!uPscZwyFnNF(j!M<| zlVi3M0!Ll*tW+zqyjY9eC*Jz@m( zRmCzY_O5#0+ChFN;M6E%T>&c*)Kma>iJ<49w&(#@e7GV(^Fw-YgZ~211wG)u6Qt96 zA!>=3;tp@X8KD$yc|#jxD`!A1n)_?RgQYR7!~YYXJ76tbNkepI(nA5A%iIweK6Z6L`;hr{8Uk){Sl{YG`;h;{XJIQj$`XJBk+z|rFr zx#@89N4I^;Rr>HuaR~^|KYvC#qfX$;o|7icCk6MFzTLk?yk+T^){&j-?Zr0lIrH&WJbbXtfr*NKY5RGRSgj z14={rwMiob-Do`nOP%OQz9m@~Z)#Z@_kx(wFueimy!hs19ZWQ|G>j07z*jBeHzS*1 zim_#VrBesy&gGftXatuu-jJlY=9bL*NAP3t*R2A7vWR1&-cZnYx)IB&Txp>{&$nO=&~!n_m~`i zXx`CUrT6Oy?hBG`q+L6(&2VO!-w_k1FW*}hPP&#)MqKgfUD_=uDs1{GtI}S_ZI6zA zu_ zXSeZ^n@(L1mi?VY2vX9IAygwbgE@1x4xD{nXB1XS5zaC%4Y14M#)wPE_cNbmN z30kZJgvwc5#3_On8A>*XzHZuD&x&lIq~_pS9D`aw>-zeJy1Haj%uq+KfnL3*()K#t z75CSc5 zU2JnKmJBTETH-&-m+>{{b+qKGWg1l!A!!}+PF12%T~0j*o414}znf0nvC z49&JFm6oi&u*uQc*Dj#tWDDOL&%GwcocH=R>RD3jTN^GfFq(3R|NX}^bBi6W=ATRo zLxxz*$eMUqa?t+y9g8QNBhRl7&5a82=-996{xHjW@;g4ACo0HOI?=9UEswsKS&;v8 zaN`D>OZRdParfk2a=!W0zx~}!oTe*soHNWX3_DWG-q25UpR;Gtp>-)gCQm!O=W~3) zy1VsWo%j$qFZ$(f1NnmA1QTCn&3RN})WNc&ao2*-P5y^p1vuo}m#ltvpz)i9=G@Ci z_AOmuspHdkn8&T1qGbzOylg> zn1=TZKKVVqyD|U7qaueDD|hSi8XW&J)6TzJ-6hwvPQ>z)kDOjxI;G(s!B>y0-x65= zFP|SFx-QG+e%_UNY>Lb%=t0}T9}fO~DY|Q`WPTlM;nx9=nho7JbWMKJux~x@$)kQd zV&ipkxb%{1v$Yq=9k%;AuNu@{)W*2CuhYxPpLhFRiIr>&Y4By=lJZm2AGapG{49R>XPJT1i^0d`LuZUSH!FIcj@LP%d%+M-`<6!GetiVB_hxJu6*Z#n zi^HFj8U<~CCh6AE=gFWhr`MUa-ZcAg?oJta!C+}<4V8qtd_fM?YO%@sElSTSTv=}f>tTXu>C7>&D|H3i<2zwQfBo0Yk z%XX>}93g{MMZQ4a^wI(`SGk5&DF{FuxRLGx(#3=HKtbS2-SSDi{nrImkxpfipo1bo z2Sfslxz(?~$jzJZ)?SgWDl!jo-t}f%?-mPv8n;h-5)-~^hk?7bUf`}_WhTvTx}_bp zxKjJI`=Qwe8-Dk=$f?KoIX~7kPc(Yy^nR_<*Dna1_awFNx!ZFiHyPWPt-rd`Ze707 z`pYx>9PekX|0H?fV?jh43&%&RYlZ*0*>8LNmBT#U?A57nPh`C95LepZUBIq8?xHnP zkxTBf5}}#H`7YBw-M?jMdND30p4r+)Ek~Sqw@Y`_gpUcY&qVD1ZTjdv2U=vcPO!4w zcCxLld+S*q-Ch42ym9KfCM}n*On#o&y#HO>!1)Pd?zN6T-y+B>;_%j9om=U?KARuw zc(LXE%y_dN0XdsL5qI~j(J4x}exUy5y^SwK2R-sAHG9%BaF5jvzrp?w4wlLD@5mpu zy1hSO_K{bIn)JFpe8TgPKyvx&iMOA}E?ocZ=7!{Z2a5{_y}0xu=uu$1<(9U~mJdlO zcsMR8H(`_Gh|9g^#qH0rwf*}=Mw#s-`$=8g!VcaY={NSUQSgxqOMM-)W_*->%H{U9 zw~X&MV~$st(}-&u#x%UOAoShL4SNDg(r2B!b7{x%a`ybYa_ci(?c+$NHZnx*C%yB1e6nVa)%B&{K>vM z>*#&SVU}(OeHC5gAqzQW7*OkdZ ziKj~z4ktUa#p!SwIB6>mg*P0*u5iqhOJL7So-k9vOU=q4yC?zZkj~8n+@@*{j0DP| zgDw{#xG@sI6h?<^7G)6AP8c4ysV3>0@@CZ1S$CrHta<0JWTn{5tv$2uUE$Q(J~M}$ z%QKmLP@KTC_xe;OKbtZ9$G*;wjgNQS-*x5Ux036^{WdO3i{r&3CJz}O5FUNSWa{8^ z)wz*QTr2 z>yPQ--`iayoHf{(-Mrqu#Kf(yZyar`x9_(1u{yRdZ;2hB7k?;?n|Xz}R2s0i&)edqMnT=o zXBRX-L$o`xaqiO2{yEKDj-FezXkmW7&6jR7ny>!awPnHk1)uh(Z4WBG_bfZt`uS70 z*?Cq$KQC==nVS7@{g-d!pVcmSD(SfX8~H*nc;fBb*%`tqo@eLx3=P{~(95PYx2~W? z{wr_ejh(-)IJqSLVCk5-y$19Q?dE^L=a0DqV~q>CrG3v^cyMn;ivdT z)-A~*>*inrl7%z=ZNXKg6{u#ImK3fdfdMggp^+}%M5)Mwp$fL1%51I8uLJt0>b^ed zsCrS4Z==VxNI5d~%c_&R!bkQ~jFlbZ^x!2Ar;|Qvubc3lNkK`y z0*lIi!BXo2tE$Gd`mh7zOs|MTbU1P*yZ-T0hCOv!h{oL6xqE2tlx2ZGYS;0em+Sc4 z+P;b2%Vww69t__(@JV}1>!b7D6<(cl``g+FP2SG9u!qe0Io4u1tWV!=a`t9FZu@if zmuzhKKmHyfMmHl=xKQNy)lQNxwW#?{s3@QWJG zhO`;V9zy>_!%>g~8jEga|3ncd#-KJ!1?J$QDB=V{+xmk@^9E{WK#%BStjp2hpqQ7~ zI5szE@Q=KZ;FHOtmalxY_MLSX>y%?QQJtS8#}yyYF-S?;;^rS_Who%R$OpZS?}5fX z&(+B}hSV$2;k+v;yt<_D5?OfuA5lwdXjrx-TZ8lgJG7ZJGF2jm0}Z1hBf0*Op&guD zN!X0z;txArJe=M5t;v>{QP;AGO5KfurJfFvS+L_0cah);03}6rzk*_J3yQh9%0I*T z*qfWJcl_(2ci{CUI3Lw18~rnb|B;qxL$;zZZmJPu#ydkY-WfN63*X&|Pr6dx89pfx zFt`7Ab`+@e+Ex8CkGck1rp{geGH%%j+n;HjMmz{x!fzO#F^SA_4T=4|L)e*?apR%QE@$lG3KBWdL$4&mdzVEE%`KG(pH2m3cC5PWi z*!Scg0|q?Z(%{PF2H`Wd`%Ea^1XpE=NJQt-6_ zMxLu*JIY&LHaq8V_4$uErA`G=JvK}kzxCMnW`h4jE(8Gr%uwko=abrCQde7kT+-9qJ>^NZuCj0>(eFU?5)$1c$sGdZs~`e#cN|G z)~?kgF2bmbUaOfAYg+zgw4(psb)qhM^FB|PPpdz6VIxCtDJtmaC!ZBqHj|C@OOWm6EANZ>C)(loJ>F!x4B+# zvL_i;5>XO9Dzqx8=UCniMX#xBEg)6A25w;N!hcZKNn3t9N=Z*=m0VEL`;mRY3(a`u zKuHh(Wm&AAUcJ&PI;R?7ozFwo^>%JNJI*KYK;P19AF`Up%N;WUGTfB*Nh|l4sS6WvwU<9|Fx@aP8P3=j9pXLY3pANw|RMb z9QynEgqWc`Uapt>?W?!XPJCJ-d|ue-=(rt=2d=kh9-B7dLgbP=r+UU1$m*w>l0o{- ze#}`J{7}F5t!;68?-alBxi;@M_gmPrrMLYy@g<)QM(6Em7yjsKS?zb@&)S8o`8c8X zqX#|i=@oRaxaVD`;CyySz|*0drdgj0D-M2b^ELUm=JR4M&bt0>J@5U`;PW$_zi%~Z zE%)vGYSYI4ff-T0V+QQr>^d*)>BnZR%_iu`ec~sKd1MtV9%g#znLW4rb^gxt0|I2B zrVp0CKbuP&=vh2-be`emaiedA&6jVyve~;}kHOoS%V$~z95WApn3!dd8h)$5E? zO50~2S8Y5!XW)`yzO9N|+H#)>k`-eIZeF@BI_l<^S}#PVp@f0otPsU-e>WQ2_d%PN zV*Q(2mrZ&sBxZhE?o}E#17zg@kd=K@vXZEOkMU;Ff)f-R zCz9_j5C~jAaDs1|x^=?ae_5>mO29q1yDa$87I}->d5cb5Zk4yU&c&kh-(Su%G(5L5 zJv96G<1W2EaE7IKzjJTzPOpajoPNfI9ZUW=BXU5@y`kM>e(Z2f85z*hWa|XWKXU{J z%&i{x8`3{wxZn0=69du=>%BcP@cpRp8wdS<9}w4r?^a^$E}ih=ve}h3k%K)Fb@C6d z`YxBOZ@PNT2iJWrZA8~*b=+k=$Z2gs?9kuLo6L{+vF&kE>l^*e{)~V3V`Ai=m!6O8 z8S?7po(W6tPnopI!@kG7Cz%q{w6ZyZp*zUc*Wpt~uJAX_Xx;1LjjW7DqvocaU z&I#E2V#&Jvc5Z7GA_*iUecyhJMT>x^I+y0PWRpW2CQrto6_&r zr>Rq#HTC??{Zlc-drm<1sly4*H!a3q`o5GqWazi63;b_ylRI7?l2EYg`l_L>&s~E* z*hyDd^mx2qUw83Y#j+5$tm#dhi_Bh|zuDf^>c#TMvj=w$zP`Tip|=;WC_H^b4?1}S zPt@7tlgcxHI-*Cwy|a7!Tg4=D6vtB*^}TF6Q0JbLmHhH@?(0KeEQ~J;WhQ^PipIy5 zEF0b;K7q`dGJX1$o#CHrk4=2*YT#luqU-e=jn97HbfL+Sv=4C+J>o5{x8AirTt7ek zNZqFLR}(%*93I(l+JR2>uUoqvt5x5sbM9*YZSR|n?t5+0f(CNQ(RG8iZ};kdkGGZ; za5q7~T_r7)UKj9X=~K@@;Z^##bZ}m${ql$(qQi6c6;0_B;L`3-^Pi4-FV!TYM!^?{ zvVqG?l9({=vf$xEz-;!enQI4j+AClId8Q0DAIRi+lxxS5k~|f}&VR(qcJV{c6O$e< zic3m8>p6XL?B&yQtPYbsX(=8?!gNvzOeZPldTQup!|5d0~FNq!lG`xXWKhnX1cHW__^KKvONtqM2+;> z{LN&+_(o$Ny{_HA@K9kRpGFbc<6I9lElX7J?9&EGJKG!O)_XE#)5_S}fs3p;_|R&v3{J1F^#6AnJ!#ndn2Wh zZL3}GL35;ETSTSx_pjS^<=@-a{r-4t->~`T&IAwK+AGRvqlDu(bZ{vI-1%X=`?+_r zr{w#IgWiEdhfdpf;#0>5+w1S&a@uPtzsHC@`*jW$EgICYY5lPiGJibUddAjzZ0$*| z*LDSep8M1IiSwscE-7|*Om{r|ZT6+RHcwx-_3>;y{b5#CZ2z+hyj~0~;X4i4bK=RM z{qC85XD9#t`|1wkI@C%Ub~RHN88YEzQN~hz^MeBn`kQZQ8tv43b7^Mso6;iPo?!oY zq3;SNx=a5rw#OH>G=@qV8tB{A(bcimtxw2g#wN1A<2QRx6n6ZPzv1Q%JM)Jn;AJi> zSTgiq7TD$Icy;uNXYB>+NgFFOr6+~&?pbXu?%^$O^xb|W0|sjJ$%I=HGs>H9+`kWPs)SqtCSH7w)6edac3cn7*xkzBQk9qB!f`nGM(07D?q}EF90Tc_nl$n|s~eBR#EitM`|^ z_g)XPof4z?_V&;HYh+<}e|r(RWsO6y^-C5d9Pna%AUPzJk;)ZZ0$`Kw#GiZSQMpuF38HlT9Q8Y*3{kp zVasnVm~7kI$=P)TzevxNEYdTgyu#D|U3#K?!kRo!>OSEjPIuB;={W?auxUBpU?snA zTH~p?DcL`VxRJ%jOcyv!d-*C`I@vpM+tZXIp0DmTX+ai#Q3Igk$S-_K7Cs^iACQH6 z^|&pr&AOJBV}16K)vm_7&OJ2j{Kk0Rhg;cO!`n_@!5!M?9$7f+f51T0+;HIZ-jbBw zdCAnF$J*^%ZvCp4=hJ?+PLsB;ys^9Af`VnQZ@(K2Z-c{^ct1~d$ku(PE{HoYW_rg*lX4na(j}*E9=iJYcK$uv$awpm^OhdG=k#+z`~|zI7tc-(^Si|BBWrrh zdC64oq~P20!*8DXJ$KQUQrlUXHpXWzK400;KPupA_g>@uFKl!5Ii%yiNlqOn z-^j_&zxh*OW8%Zxxn*FpwZk^%I5(}gvd59AM?*&L?7MH1t9_SJp7{JgkJ&$0evMvu U^i}BnPjA|vO5?lX+EM)cF9GtCjsO4v literal 0 HcmV?d00001 diff --git a/Microsoft.Identity.Client.xml b/Microsoft.Identity.Client.xml new file mode 100644 index 0000000..e25b9aa --- /dev/null +++ b/Microsoft.Identity.Client.xml @@ -0,0 +1,21295 @@ + + + + Microsoft.Identity.Client + + + + + Contains information about a single account. A user can be present in multiple directories and thus have multiple accounts. + This information is used for token cache lookup and enforcing the user session on the STS authorize endpoint. + + + + + Constructor for the account instance. + + Home account ID in "uid.utid" format; can be null, for example when migrating the ADAL v3 cache. + UPN-style, can be null + Identity provider for the account, e.g., login.microsoftonline.com. + The initial flow that established the account. e.g., device code flow. + Map of (client_id, wam_account_id) + Map of (tenant_id, tenant_profile) + + + + Gets the username associated with the account. For example, account@example.com. + + + + + Gets the environment associated with the account. For example, login.microsoftonline.com. + + + + + Gets the source of the account. For example, device code flow, broker etc. + + + + + Gets additional account identifiers, such as object ID, tenant ID, and the unique identifier. + + + + + Gets the list of tenant profiles. + + + The same account can exist in its home tenant and also as a guest in multiple other tenants. + A is derived from the ID token for that tenant. + + + + + Gets a dictionary representing the mapping between the requesting client ID and the unique account ID. + + + + + Extension methods for + + + + + The same account can exist in its home tenant and also as a guest in multiple other tenants. + is derived from the ID token for that tenant. + + Only tenants for which a token was acquired will be available in property. + + + + An identifier for an account in a specific tenant. Returned by + + + + + Unique identifier for the account + + + For the Microsoft identity platform (formerly named Azure AD v2.0), the identifier is the concatenation of + and separated by a period. + Unlike in ADAL.NET, these two segments are no longer base64-encoded. + Note that there are some legitimate cases (for instance domain takeover) where the same ObjectId may show up in multiple tenants. + + + + + For Microsoft Entra ID, a string representation for a GUID which is the object ID of the user owning the account in the tenant + + + + + For Microsoft Entra ID, a string representation for a GUID which is the ID of the tenant where the account resides. + + + + + Constructor for an account ID. + + Unique identifier for the account. + A string representation for a GUID which is the ID of the user owning the account in the tenant. + A string representation for a GUID which is the ID of the tenant where the account resides. + + + + Constructor of an AccountId meant for Active Directory Federation Services (ADFS) scenarios since ADFS instances lack tenant IDs. + + Unique identifier for the account if authority is ADFS. + + + + Two accounts are equal when their properties match. + + + + + GetHashCode implementation to match . + + + + + Textual description of an . + + + + + + + + + Default constructor for AbstractAcquireTokenParameterBuilder. + + + + + Specifies which scopes to request. This method is used when your application needs + to specify the scopes needed to call a protected API. See + https://docs.microsoft.com/azure/active-directory/develop/v2-permissions-and-consent to learn + more about scopes, permissions and consent, and + https://docs.microsoft.com/azure/active-directory/develop/msal-v1-app-scopes to learn how + to create scopes for legacy applications which used to expose OAuth2 permissions. + + Scopes requested to access a protected API + The builder to chain the .With methods. + + + + Sets claims in the query. Use when the AAD admin has enabled conditional access. Acquiring the token normally will result in a + with the property set. Retry the + token acquisition, and use this value in the method. See https://aka.ms/msal-exceptions for details + as well as https://aka.ms/msal-net-claim-challenge. + + A string with one or multiple claims. + The builder to chain .With methods. + + + + Sets Extra Query Parameters for the query string in the HTTP authentication request. + + This parameter will be appended as is to the query string in the HTTP authentication request to the authority. + The string needs to be properly URL-encoded and ready to send as a string of segments of the form key=value separated by an ampersand character. + + The builder to chain .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Specific authority for which the token is requested. Passing a different value than configured + at the application constructor narrows down the selection to a specific tenant. + This does not change the configured value in the application. This is specific + to applications managing several accounts (like a mail client with several mailboxes). + See https://aka.ms/msal-net-application-configuration. + + Uri for the authority. In the case when the authority URI is + a known Azure AD URI, this setting needs to be consistent with what is declared in + the application registration portal. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single tenant application) specified by its tenant ID. See https://aka.ms/msal-net-application-configuration. + + Azure Cloud instance. + GUID of the tenant from which to sign-in users. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single tenant application) described by its domain name. See https://aka.ms/msal-net-application-configuration. + + Uri to the Azure Cloud instance (for instance + https://login.microsoftonline.com). + Tenant Id associated with the tenant from which to sign-in users. + Whether the authority should be validated against the server metadata. + + can also contain the string representation of a GUID (tenantId), + or even common, organizations or consumers but in this case + it's recommended to use another override ( + and + + The builder to chain the .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single tenant application) described by its cloud instance and its tenant ID. + See https://aka.ms/msal-net-application-configuration. + + Instance of Azure Cloud (for instance Azure + worldwide cloud, Azure German Cloud, US government ...). + Tenant Id of the tenant from which to sign-in users. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single tenant application) described by its cloud instance and its domain + name or tenant ID. See https://aka.ms/msal-net-application-configuration. + + Instance of Azure Cloud (for instance Azure + worldwide cloud, Azure German Cloud, US government ...). + Tenant Id of the tenant from which to sign-in users. This can also be a GUID. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Adds a known Azure AD authority to the application to sign-in users specifying + the cloud instance and the sign-in audience. See https://aka.ms/msal-net-application-configuration. + + Instance of Azure Cloud (for instance Azure + worldwide cloud, Azure German Cloud, US government ...). + Sign-in audience (one AAD organization, + any work and school accounts, or any work and school accounts and Microsoft personal + accounts. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Important: Use WithTenantId or WithTenantIdFromAuthority instead, or WithB2CAuthority for B2C authorities. + + Adds a known Azure AD authority to the application to sign-in users specifying + the sign-in audience (the cloud being the Azure public cloud). See https://aka.ms/msal-net-application-configuration. + + Sign-in audience (one AAD organization, + any work and school accounts, or any work and school accounts and Microsoft personal + accounts. + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods. + + + + Overrides the tenant ID specified in the authority at the application level. This operation preserves the authority host (environment). + + If an authority was not specified at the application level, the default used is `https://login.microsoftonline.com/common`. + + Tenant ID of the Microsoft Entra ID tenant + or a domain associated with this Microsoft Entra ID tenant, in order to sign-in a user of a specific organization only. + The builder to chain the .With methods. + Thrown if is null or an empty string. + Thrown if is not well-formatted (for example, has spaces). + Thrown in more general exception scenarios (for ex. if the application was configured with an authority that does not allow tenants). + + The tenant should be more restrictive than the one configured at the application level, e.g. don't use "common". + Does not affect authority validation, which is specified at the application level. + + + + + Extracts the tenant ID from the provided authority URI and overrides the tenant ID specified in the authority at the application level. This operation preserves the authority host (environment) provided to the application builder. + If an authority was not provided to the application builder, this method will replace the tenant ID in the default authority - `https://login.microsoftonline.com/common`. + + URI from which to extract the tenant ID + The builder to chain the .With methods. + Thrown if is null or an empty string. + Thrown if is not well-formatted (for example, has spaces). + Thrown in general exception scenarios (for example if the application was configured with an authority that does not allow tenants). + + The tenant should be more restrictive than the one configured at the application level, e.g. don't use "common". + Does not affect authority validation, which is specified at the application level. + + + + + Adds a known Authority corresponding to an ADFS server. See https://aka.ms/msal-net-adfs. + + Authority URL for an ADFS server. + Whether the authority should be validated against the server metadata. + MSAL.NET supports ADFS 2019 or later. + The builder to chain the .With methods. + + + + Adds a known authority corresponding to an Azure AD B2C policy. + See https://aka.ms/msal-net-b2c-specificities + + Azure AD B2C authority, including the B2C policy (for instance + "https://fabrikamb2c.b2clogin.com/tfp/{Tenant}/{policy}). + The builder to chain the .With methods. + + + + Base class for parameter builders common to public client application and confidential + client application token acquisition operations + + + + + + + + + Base class for confidential client application token request builders + + + + + + + + + Validates the parameters of the AcquireToken operation. + + + + + + Modifies the token acquisition request so that the acquired token is a Proof-of-Possession token (PoP), rather than a Bearer token. + PoP tokens are similar to Bearer tokens, but are bound to the HTTP request and to a cryptographic key, which MSAL can manage on Windows. + See https://aka.ms/msal-net-pop + + Configuration properties used to construct a Proof-of-Possession request. + The builder. + + + The PoP token is bound to the HTTP request, more specifically to the HTTP method (GET, POST, etc.) and to the Uri (path and query, but not query parameters). + MSAL creates, reads and stores a key in memory that will be cycled every 8 hours. + This is an experimental API. The method signature may change in the future without involving a major version upgrade. + + + + + + Modifies the request to acquire a Signed HTTP Request (SHR) Proof-of-Possession (PoP) token, rather than a Bearer. + SHR PoP tokens are bound to the HTTP request and to a cryptographic key, which MSAL manages on Windows. + SHR PoP tokens are different from mTLS PoP tokens, which are used for Mutual TLS (mTLS) authentication. See for details. + + Configuration properties used to construct a Proof-of-Possession request. + The builder. + + + The SHR PoP token is bound to the HTTP request, specifically to the HTTP method (for example, `GET` or `POST`) and to the URI path and query, excluding query parameters. + MSAL creates, reads, and stores a key in memory that will be cycled every 8 hours. + This is an experimental API. The method signature may change in the future without involving a major version upgrade. + + + + + + Abstract base class for managed identity application token request builders. + + + + + + Default constructor for AbstractManagedIdentityParameterBuilder. + + + + + + + + Base class for public client application token request builders + + + + + + + + + + + + + Builder for AcquireTokenByAuthorizationCode + + + + + + + + + + + + + + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + true if the x5c should be sent. Otherwise false. + The default is false + The builder to chain the .With methods + + + + Used to secure authorization code grant via Proof of Key for Code Exchange (PKCE). + See (https://tools.ietf.org/html/rfc7636) for more details. + + A dynamically created cryptographically random key used to provide proof of possession for the authorization code. + + The builder to chain the .With methods + + + + To help with resiliency, the AAD backup authentication system operates as an AAD backup. + This will provide backup authentication system with a routing hint to help improve performance during authentication. + + GUID which is unique to the user, parsed from the client_info. + GUID format of the tenant ID, parsed from the client_info. + The builder to chain the .With methods + + + + To help with resiliency, the AAD backup authentication system operates as an AAD backup. + This will provide backup authentication system with a routing hint to help improve performance during authentication. + + Identifier of the user. Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + The builder to chain the .With methods + + + + Requests an auth code for the frontend (SPA using MSAL.js for instance). + See https://aka.ms/msal-net/spa-auth-code for details. + + true if a SPA Authorization Code should be returned, + false otherwise. + The builder to chain the .With methods + + + + Builder for AcquireTokenByIntegratedWindowsAuth + + + + + + + + Specifies the username. + + + Specifying the username explicitly is normally not needed, but some Windows administrators + set policies preventing applications from looking up the signed-in user and in that case the username needs to be passed. + + Identifier of the user account for which to acquire a token with + Integrated Windows Authentication. Generally in UserPrincipalName (UPN) format, + e.g. john.doe@contoso.com + The builder to chain the .With methods. + + + + Enables MSAL to read the federation metadata for a WS-Trust exchange from the provided input instead of acquiring it from an endpoint. + This is only applicable for managed ADFS accounts. See https://aka.ms/MsalFederationMetadata. + + Federation metadata in the form of XML. + The builder to chain the .With methods + + + + + + + Parameter builder for the + method. See https://aka.ms/msal-net-migration-adal2-msal2 + + + + + + + + + + + + + + + + + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + true if the x5c should be sent. Otherwise false. + The default is false + The builder to chain the .With methods + + + + Parameter builder for the + operation. See https://aka.ms/msal-net-up + + + + + + + + + + + + + + Parameter builder for the + operation. See https://aka.ms/msal-net-up + + + + + Enables MSAL to read the federation metadata for a WS-Trust exchange from the provided input instead of acquiring it from an endpoint. + This is only applicable for managed ADFS accounts. See https://aka.ms/MsalFederationMetadata. + + Federation metadata in the form of XML. + The builder to chain the .With methods + + + + Modifies the token acquisition request so that the acquired token is a Proof-of-Possession token (PoP), rather than a Bearer token. + PoP tokens are similar to Bearer tokens, but are bound to the HTTP request and to a cryptographic key, which MSAL can manage on Windows. + Note that only the host and path parts of the request URI will be bound. + See https://aka.ms/msal-net-pop + + Nonce of the protected resource (RP) which will be published as part of the WWWAuthenticate header associated with a 401 HTTP response + or as part of the AuthorityInfo header associated with 200 response. Set it here to make it part of the Signed HTTP Request part of the POP token. + The HTTP method ("GET", "POST" etc.) method that will be bound to the token. If set to null, the PoP token will not be bound to the method. + Corresponds to the "m" part of the a signed HTTP request. + The URI to bind the signed HTTP request to. + The builder. + + + An Authentication header is automatically added to the request. + The PoP token is bound to the HTTP request, more specifically to the HTTP method (GET, POST, etc.) and to the Uri (path and query, but not query parameters). + Broker is required to use Proof-of-Possession on public clients. + + + + + + + + + + + + Builder for AcquireTokenForClient (used in client credential flows, in daemon applications). + See https://aka.ms/msal-net-client-credentials + + + + + + + + Specifies if the client application should ignore access tokens when reading the token cache. + New tokens will still be written to the application token cache. + By default the token is taken from the application token cache (forceRefresh=false) + + + If true, the request will ignore cached access tokens on read, but will still write them to the cache once obtained from the identity provider. The default is false + + + Do not use this flag except in well understood cases. Identity providers will throttle clients that make too many similar token requests. + + The builder to chain the .With methods + + + + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + true if the x5c should be sent. Otherwise false. + The default is false + The builder to chain the .With methods + + + + Specifies that the certificate provided will be used for PoP tokens with mTLS (Mutual TLS) authentication. + For more information, refer to the Proof-of-Possession documentation. + + The current instance of to enable method chaining. + + + + Please use WithAzureRegion on the ConfidentialClientApplicationBuilder object + + + + + Please use WithAzureRegion on the ConfidentialClientApplicationBuilder object + + + + + + + + + + + + + + Builder for AcquireTokenForManagedIdentity (used to get token for managed identities). + See https://aka.ms/msal-net-managed-identity + + + + + + + + Specifies if the client application should ignore access tokens when reading the token cache. + New tokens will still be written to the application token cache. + By default the token is taken from the application token cache (forceRefresh=false) + + If true, the request will ignore cached access tokens on read, but will still write them to the cache once obtained from the Identity Provider. The default is false + + + Do not use this flag except in well understood cases. Identity Providers will throttle clients that issue too many similar token requests. + + The builder to chain the .With methods + + + + Adds a claims challenge to the token request. The SDK will bypass the token cache when a claims challenge is specified. Retry the + token acquisition, and use this value in the method. A claims challenge typically arises when + calling the protected downstream API, for example when the tenant administrator revokes credentials. Apps are required + to look for a 401 Unauthorized response from the protected api and to parse the WWW-Authenticate response header in order to + extract the claims. See https://aka.ms/msal-net-claim-challenge for details. + + A string with one or multiple claims. + The builder to chain .With methods. + + + + + + + + + + Builder for an Interactive token request. See https://aka.ms/msal-net-acquire-token-interactively + + + + + Specifies if the public client application should used an embedded web browser + or the system default browser. If the broker (WAM, Authenticator, Company Portal) is configured, + this setting is only used when the broker is not installed. + + On .NET, including net8-windows, app developers must reference Microsoft.Identity.Client.Desktop + and call PublicClientApplicationBuilder.WithDesktopFeatures() to enable the embedded web browser. + + + If true, will use an embedded web browser, + otherwise will attempt to use a system web browser. The default depends on the platform: + false for iOS and Android, and true for .NET Framework + The builder to chain the .With methods + + + + Specifies options for using the system OS browser handle interactive authentication. + + Data object with options + The builder to chain the .With methods + + + + Specifies options for using the embedded web view for interactive authentication. + + Data object with options + The builder to chain the .With methods + + + + Sets the , in order to avoid select account + dialogs in the case the user is signed-in with several identities. This method is mutually exclusive + with . If both are used, an exception will be thrown + + Identifier of the user. Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + The builder to chain the .With methods + + + + Sets the account for which the token will be retrieved. This method is mutually exclusive + with . If both are used, an exception will be thrown + + Account to use for the interactive token acquisition. See for ways to get an account + The builder to chain the .With methods + + + + + Scopes that you can request the end user to consent upfront, + in addition to the scopes for the protected Web API for which you want to acquire a security token. + The builder to chain the .With methods + + + + Specifies the what the interactive experience is for the user. + + Requested interactive experience. The default is + + The builder to chain the .With methods + + + + Sets a reference to the ViewController (if using iOS), Activity (if using Android) + IWin32Window or IntPtr (if using .Net Framework). Used for invoking the browser. + + Mandatory only on Android. Can also be set via the PublicClientApplication builder. + The parent as an object, so that it can be used from shared NetStandard assemblies + The builder to chain the .With methods + + + + Sets a reference to the current IWin32Window that triggers the browser to be shown. + Used to center the browser (embedded web view and Windows broker) that pop-up onto this window. + + The current window as a IWin32Window + The builder to chain the .With methods + + + + Sets a reference to the IntPtr to a window that triggers the browser to be shown. + Used to center the browser that pop-up onto this window. + The center of the screen or the foreground app if a value is configured. + + The current window as IntPtr + The builder to chain the .With methods + + + + + Modifies the token acquisition request so that the acquired token is a Proof-of-Possession token (PoP), rather than a Bearer token. + PoP tokens are similar to Bearer tokens, but are bound to the HTTP request and to a cryptographic key, which MSAL can manage on Windows. + Note that only the host and path parts of the request URI will be bound. + See https://aka.ms/msal-net-pop + + Nonce of the protected resource which will be published as part of the WWW-Authenticate header associated with a 401 HTTP response + or as part of the AuthorityInfo header associated with 200 response. Set it here to make it part of the Signed HTTP Request part of the PoP token. + The HTTP method ("GET", "POST" etc.) method that will be bound to the token. If set to null, the PoP token will not be bound to the method. + Corresponds to the "m" part of the a signed HTTP request. + The URI to bind the signed HTTP request to. + The builder. + + + An Authentication header is automatically added to the request. + The PoP token is bound to the HTTP request, more specifically to the HTTP method (GET, POST, etc.) and to the Uri (path and query, but not query parameters). + Broker is required to use Proof-of-Possession on public clients. + + + + + + + + + + + + Builder for AcquireTokenOnBehalfOf (OBO flow) + See https://aka.ms/msal-net-on-behalf-of + + + + + + + + Specifies a key by which to look up the token in the cache instead of searching by an assertion. + + Key by which to look up the token in the cache + A builder enabling you to add optional parameters before executing the token request + + + + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + true if the x5c should be sent. Otherwise false. + The default is false + The builder to chain the .With methods + + + + Specifies if the client application should ignore access tokens when reading the token cache. + New tokens will still be written to the token cache. + By default the token is taken from the the user token cache (forceRefresh=false) + + If true, ignore any access token in the user token cache + and attempt to acquire new access token using the refresh token for the account + if one is available. The default is false + The builder to chain the .With methods + + Do not use this flag except in well understood cases. Identity Providers will throttle clients that issue too many similar token requests. + + + + + To help with resiliency, the AAD backup authentication system operates as an AAD backup. + This will provide the AAD backup authentication system with a routing hint to help improve performance during authentication. + + GUID which is unique to the user, parsed from the client_info. + GUID format of the tenant ID, parsed from the client_info. + The builder to chain the .With methods + + + + To help with resiliency, the AAD backup authentication system operates as an AAD backup. + This will provide the AAD backup authentication system with a routing hint to help improve performance during authentication. + + Identifier of the user. Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + The builder to chain the .With methods + + + + + + + + + + + + + + Parameter builder for the + operation. See https://aka.ms/msal-net-acquiretokensilent + + + + + Sets the account for which the token will be retrieved. This method is mutually exclusive + with . If both are used, an exception will be thrown + + Account to use for the silent token acquisition. See for ways to get an account + The builder to chain the .With methods + An exception will be thrown If AAD returns a different account than the one that is being requested for. + + + + Specifies if the client application should ignore access tokens when reading the token cache. + Refresh tokens will still be used. Any new tokens from the Identity Provider will still be written to the token cache. + By default the token is taken from the the user token cache (forceRefresh=false) + + If true, ignore any access token in the user token cache + and attempt to acquire new access token using the refresh token for the account + if one is available. This can be useful in the case when the application developer wants to make + sure that conditional access policies are applied immediately, rather than after the expiration of the access token. + The default is false + The builder to chain the .With methods + Avoid unnecessarily setting to true true in order to + avoid negatively affecting the performance of your application + + + + + + + + + + + + + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + true if the x5c should be sent. Otherwise false. + The default is false + The builder to chain the .With methods + + + + Modifies the token acquisition request so that the acquired token is a Proof-of-Possession token (PoP), rather than a Bearer token. + PoP tokens are similar to Bearer tokens, but are bound to the HTTP request and to a cryptographic key, which MSAL can manage on Windows. + See https://aka.ms/msal-net-pop + + Configuration properties used to construct a Proof-of-Possession request. + + + An Authentication header is automatically added to the request. + The PoP token is bound to the HTTP request, more specifically to the HTTP method (GET, POST, etc.) and to the Uri (path and query, but not query parameters). + MSAL creates, reads and stores a key in memory that will be cycled every 8 hours. + This is an experimental API. The method signature may change in the future without involving a major version upgrade. + + + + + + Modifies the token acquisition request so that the acquired token is a Proof-of-Possession token (PoP), rather than a Bearer token. + PoP tokens are similar to Bearer tokens, but are bound to the HTTP request and to a cryptographic key, which MSAL can manage on Windows. + Note that only the host and path parts of the request URI will be bound. + See https://aka.ms/msal-net-pop + + Nonce of the protected resource (RP) which will be published as part of the WWWAuthenticate header associated with a 401 HTTP response + or as part of the AuthorityInfo header associated with 200 response. Set it here to make it part of the Signed HTTP Request part of the POP token. + The HTTP method ("GET", "POST" etc.) method that will be bound to the token. If set to null, the PoP token will not be bound to the method. + Corresponds to the "m" part of the a signed HTTP request. + The URI to bind the signed HTTP request to. + The builder. + + + An Authentication header is automatically added to the request. + The PoP token is bound to the HTTP request, more specifically to the HTTP method (GET, POST, etc.) and to the Uri (path and query, but not query parameters). + MSAL creates, reads and stores a key in memory that will be cycled every 8 hours. + On confidential clients, this is an experimental API. The method signature may change in the future without involving a major version upgrade. + Broker is required to use Proof-of-Possession on public clients. + + + + + + Parameters builder for the + operation. See https://aka.ms/msal-net-device-code-flow + + + + + + + + Sets the Callback delegate so your application can + interact with the user to direct them to authenticate (to a specific URL, with a code) + + callback containing information to show the user about how to authenticate + and enter the device code. + The builder to chain the .With methods + + + + + + + + + + + + + + + Base class for builders of token requests, which attempt to acquire a token + based on the provided parameters. + + + + + + Default constructor for AbstractAcquireTokenParameterBuilder. + + + + + Executes the Token request asynchronously, with a possibility of cancelling the + asynchronous method. + + Cancellation token. See + Authentication result containing a token for the requested scopes and parameters + set in the builder. + + + Cancellation is not guaranteed, it is best effort. If the operation reaches a point of no return, e.g. + tokens are acquired and written to the cache, the task will complete even if cancellation was requested. + Do not rely on cancellation tokens for strong consistency. + + + To learn more about potential exceptions thrown by the function, refer to Exceptions in MSAL.NET. + + + + + + Executes the Token request asynchronously. + + Authentication result containing a token for the requested scopes and parameters + set in the builder. + + + + Sets the correlation id to be used in the authentication request. Used to track a request in the logs of both the SDK and the Identity Provider service. + If not set, a random one will be generated. + + Correlation id of the authentication request. + The builder to chain the .With methods. + + + + Sets Extra Query Parameters for the query string in the HTTP authentication request. + + This parameter will be appended as is to the query string in the HTTP authentication request to the authority + as a string of segments of the form key=value separated by an ampersand character. + The parameter can be null. + The builder to chain the .With methods. + + + + Validates the parameters of the AcquireToken operation. + + + + + The class specifies the options for broker across OperatingSystems + The common properties are direct members + Platform specific properties (if they exist) are part of the corresponding options + + + + + Supported OperatingSystems + + + + + No OS specified - Invalid options + + + + + Use broker on Windows OS + + + + + Constructor + + Choices of OperatingSystems + + + + Creates BrokerOptions from WindowsBrokerOptions + + + + + Operating systems on which broker is enabled. + + + + + Title of the broker window + + + + + A legacy option available only to Microsoft First-Party applications. Should be avoided where possible. + + This is a convenience API, the same can be achieved by using WithExtraQueryParameters and passing the extra query parameter "msal_request_type": "consumer_passthrough" + + + + Currently only supported on Windows + Allows the Windows broker to list Work and School accounts as part of the + + + + + Options for using the embedded webview. + + + + + + + + + Forces a static title to be set on the window hosting the browser. If not configured, the widow's title is set to the web page title. + + Currently only affects the windows desktop apps (WebView1 / Vulcan and WebView2 browser). + + + + It is possible for applications to bundle a fixed version of the runtime, and ship it side-by-side. + For this you need to tell MSAL (so it can tell WebView2) where to find the runtime bits by setting this property. If you don't set it, MSAL will attempt to use a system-wide "evergreen" installation of the runtime." + For more details see CoreWebView2Environment.CreateAsync Method. + + + + + Abstract class for confidential clients + Supports common property(ies) + + + + + Parameter sent to request to send X5C or not. + This overrides application config settings. + + + + + if true then Spa code param will be sent via AcquireTokenByAuthorizeCode + + + + + + + + + + + + + + + + + + + + + + These need to be asked for to the /authorize endpoint (for consent) + but not to the /token endpoint + + + + + User assertion is null when is called. + + + + + User-provided cache key for long-running OBO flow. + + + + + Only affects . + When enabled, mimics MSAL 4.50.0 and below behavior - checks in cache for cached tokens first, + and if not found, then uses user assertion to request new tokens from AAD. + When disabled (default behavior), doesn't search in cache, but uses the user assertion to retrieve tokens from AAD. + + + + + + + + + + + + + + + + + NOTE: a few of the methods in AbstractAcquireTokenParameterBuilder (e.g. account) don't make sense here. + Do we want to create a further base that contains ALL of the common methods, and then have another one including + account, etc + that are only used for AcquireToken? + + + + + Sets the redirect URI to add to the Authorization request URL + + Address to return to upon receiving a response from the authority. + + + + + + + + + + + + + + + + + + + + + + + Used to secure authorization code grant via Proof of Key for Code Exchange (PKCE). + For more information, see the PKCE RCF: + https://tools.ietf.org/html/rfc7636 + + MSAL.NET will generate it. + + + + + To help with resiliency, the AAD backup authentication system operates as an AAD backup. + This will provide the AAD backup authentication system with a routing hint to help improve performance during authentication. + The hint created with this api will take precedence over the one created with + + GUID which is unique to the user, parsed from the client_info. + GUID format of the tenant ID, parsed from the client_info. + The builder to chain the .With methods + + + + Specifies the interactive experience for the user. + + Requested interactive experience. The default is + + The builder to chain the .With methods + + + + + + + + + + + + + + + + + + + + + + + Options for using the default OS browser as a separate process to handle interactive auth. + MSAL will be listening for the OS browser to finish authenticating, but it cannot close the browser. + It can however respond with a 200 OK message or a 302 Redirect, which can be configured here. + For more details see https://aka.ms/msal-net-os-browser + + + + + Constructor + + + + + When the user finishes authenticating, MSAL will respond with a 200 OK message, + which the browser will show to the user. + + + + + When the user finishes authenticating, but an error occurred, + MSAL will respond with a 200 OK message, which the browser will show to the user. + You can use a string format e.g. "An error has occurred: {0} details: {1}" + + + + + When the user finishes authenticating, MSAL will redirect the browser to the given Uri + + Takes precedence over + + + + When the user finishes authenticating, but an error occurred, MSAL will redirect the browser to the given Uri + + Takes precedence over + + + + This hides the privacy prompt displayed on iOS Devices (ver 13.0+) when set to true. + By default, it is false and displays the prompt. + + + + + Allows developers to implement their own logic for starting a browser and navigating to a specific Uri. MSAL + will use this when opening the browser. Leave it null and the user configured browser will be used. + Consider using the static helpers OpenWithEdgeBrowserAsync and OpenWithChromeEdgeBrowserAsync + + + + + Use Microsoft Edge to navigate to the given URI. On non-windows platforms it uses + whatever browser is the default. + + + + + Use Microsoft Edge Chromium to navigate to the given URI. Requires the browser to be installed. + On Linux, uses the default system browser instead, as Edge is not available. + + + + + Advanced options for using the Windows 10 broker. + For more details see https://aka.ms/msal-net-wam + + + + + + + + + + A legacy option available only to Microsoft applications. Should be avoided where possible. + Support is experimental. + + + + + Allow the Windows broker to list Work and School accounts as part of the + + + + + Display a custom text in the broker UI controls which support it. + + + Currently only the WAM account picker allows for this customization, see WAM documentation. + + + + + Specifies which Microsoft accounts can be used for sign-in with a given application. + See https://aka.ms/msal-net-application-configuration + + + + + The sign-in audience was not specified + + + + + Users with a Microsoft work or school account in my organization’s Azure AD tenant (i.e. single tenant). + Maps to https://[instance]/[tenantId] + + + + + Users with a personal Microsoft account, or a work or school account in any organization’s Azure AD tenant + Maps to https://[instance]/common/ + + + + + Users with a Microsoft work or school account in any organization’s Azure AD tenant (i.e. multi-tenant). + Maps to https://[instance]/organizations/ + + + + + Users with a personal Microsoft account. Maps to https://[instance]/consumers/ + + + + + + + + + + Allows developers to configure their own valid authorities. A json string similar to https://aka.ms/aad-instance-discovery should be provided. + MSAL uses this information to: + + Call REST APIs on the environment specified in the preferred_network + Identify an environment under which to save tokens and accounts in the cache + Use the environment aliases to match tokens issued to other authorities + + For more details see https://aka.ms/msal-net-custom-instance-metadata + + + Developers take responsibility for authority validation if they use this method. Should not be used when the authority is not know in advance. + Has no effect on ADFS or B2C authorities, only for AAD authorities + + + + + + Allows developers to configure their own valid authorities. A json string similar to https://aka.ms/aad-instance-discovery should be provided. + MSAL uses this information to: + + Call REST APIs on the environment specified in the preferred_network + Identify an environment under which to save tokens and accounts in the cache + Use the environment aliases to match tokens issued to other authorities + + For more details see https://aka.ms/msal-net-custom-instance-metadata + + + Developers take responsibility for authority validation if they use this method. Should not be used when the authority is not known in advance. + Has no effect on ADFS or B2C authorities, only for AAD authorities + + + + + + Lets an organization setup their own service to handle instance discovery, which enables better caching for microservice/service environments. + A Uri that returns a response similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to: + + Call REST APIs on the environment specified in the preferred_network + Identify an environment under which to save tokens and accounts in the cache + Use the environment aliases to match tokens issued to other authorities + + For more details see https://aka.ms/msal-net-custom-instance-metadata + + + Developers take responsibility for authority validation if they use this method. Should not be used when the authority is not know in advance. + Has no effect on ADFS or B2C authorities, only for AAD authorities + + + + + + Lets an organization setup their own service to handle instance discovery, which enables better caching for microservice/service environments. + A Uri that returns a response similar to https://aka.ms/aad-instance-discovery should be provided. MSAL uses this information to: + + Call REST APIs on the environment specified in the preferred_network + Identify an environment under which to save tokens and accounts in the cache + Use the environment aliases to match tokens issued to other authorities + + For more details see https://aka.ms/msal-net-custom-instance-metadata + + + Developers take responsibility for authority validation if they use this method. Should not be used when the authority is not known in advance. + Has no effect on ADFS or B2C authorities, only for AAD authorities + + + + + + Options for MSAL token caches. + + MSAL maintains a token cache internally in memory. By default, this cache object is part of each instance of or . + This method allows customization of the in-memory token cache of MSAL. + + MSAL's memory cache is different than token cache serialization. Cache serialization pulls the tokens from a cache (e.g. Redis, Cosmos, or a file on disk), + where they are stored in JSON format, into MSAL's internal memory cache. Memory cache operations do not involve JSON operations. + + External cache serialization remains the recommended way to handle desktop apps, web site and web APIs, as it provides persistence. These options + do not currently control external cache serialization. + + Detailed guidance for each application type and platform: + https://aka.ms/msal-net-token-cache-serialization + + Options for the internal MSAL token caches. + + + + Enables legacy ADAL cache serialization and deserialization. + + Enable legacy ADAL cache compatibility. + The builder to chain the .With methods. + + ADAL is a previous legacy generation of MSAL.NET authentication library. + If you don't use .WithLegacyCacheCompatibility(false), then by default, the ADAL cache is used + (along with MSAL cache). true flag is only needed for specific migration scenarios + from ADAL.NET to MSAL.NET when both library versions are running side-by-side. + To improve performance add .WithLegacyCacheCompatibility(false) unless you care about migration scenarios. + + + + + Sets the Client ID of the application + + Client ID (also known as Application ID) of the application as registered in the + application registration portal (https://aka.ms/msal-net-register-app) + The builder to chain the .With methods + + + + Sets the redirect URI of the application. The URI must also be registered in the application portal. + See https://aka.ms/msal-net-application-configuration + + URL where the STS will call back the application with the security token. + Public Client Applications - desktop, mobile, console apps - use different browsers (system browser, embedded browses) and brokers + and each has its own rules. + + The builder to chain the .With methods + + + + Sets the tenant ID of the organization from which the application will let + users sign-in. This is classically a GUID or a domain name. See https://aka.ms/msal-net-application-configuration. + Although it is also possible to set to common, + organizations, and consumers, it's recommended to use one of the + overrides of . + + tenant ID of the Azure AD tenant + or a domain associated with this Azure AD tenant, in order to sign-in a user of a specific organization only + The builder to chain the .With methods + + + + Sets application options, which can, for instance have been read from configuration files. + See https://aka.ms/msal-net-application-configuration. + + Application options + The builder to chain the .With methods + + + + Sets Extra Query Parameters for the query string in the HTTP authentication request + + This parameter will be appended as is to the query string in the HTTP authentication request to the authority + as a string of segments of the form key=value separated by an ampersand character. + The parameter can be null. + The builder to chain the .With methods + + + + Sets Extra Query Parameters for the query string in the HTTP authentication request + + This parameter will be appended as is to the query string in the HTTP authentication request to the authority. + The string needs to be properly URL-encoded and ready to send as a string of segments of the form key=value separated by an ampersand character. + + + + + + Microsoft Identity specific OIDC extension that allows resource challenges to be resolved without interaction. + Allows configuration of one or more client capabilities, e.g. "llt" + + + MSAL will transform these into special claims request. See https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter for + details on claim requests. + For more details see https://aka.ms/msal-net-claims-request + + + + + Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to false will completely disable + instance discovery and authority validation. This will not affect the behavior of application configured with regional endpoints however. + + If instance discovery is disabled and no user metadata is provided, MSAL will use the provided authority without any checks. + takes priority over + so instance metadata can be provided regardless of this configuration. + + Determines if instance discovery/Authority validation is performed + + + + + Generate telemetry aggregation events. + + + + + + + Adds a known authority to the application. See Application configuration options. + This constructor is mainly used for scenarios where the authority is not a standard Azure AD authority, + nor an ADFS authority, nor an Azure AD B2C authority. For Azure AD, even in sovereign clouds, prefer + using other overrides such as + + URI of the authority + Whether the authority should be validated against the server metadata. + Thrown if is null. + Thrown if is not well-formatted (for example, has spaces). + Thrown in general exception scenarios (for example if the application was configured with multiple different authority hosts). + The builder to chain the .With methods + + + + Adds a known Azure AD authority to the application to sign-in users specifying + the full authority URI. See Application configuration options. + + URI of the authority from which MSAL.NET will acquire the tokens. + Authority endpoints for the Azure public Cloud are: + + https://login.microsoftonline.com/tenant/ where tenant is the tenant ID of the Azure AD tenant + or a domain associated with this Azure AD tenant, in order to sign-in users of a specific organization only + https://login.microsoftonline.com/common/ to sign-in users with any work and school accounts or personal Microsoft accounts + https://login.microsoftonline.com/organizations/ to sign-in users with any work and school accounts + https://login.microsoftonline.com/consumers/ to sign-in users with only personal Microsoft accounts (live) + + Note that this setting needs to be consistent with what is declared in the application registration portal + Whether the authority should be validated against the server metadata. + Thrown if is null or empty. + Thrown if is not well-formatted (for example, has spaces). + Thrown in general exception scenarios (for example if the application was configured with multiple different authority hosts). + The builder to chain the .With methods + + + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single-tenant application) specified by its tenant ID. See Application configuration options. + + Azure cloud instance. + GUID of the tenant from which to sign-in users. + Whether the authority should be validated against the server metadata. + Thrown if is null or empty. + Thrown if is not well-formatted (for example, has spaces). + Thrown in more general exception scenarios (for example if the application was configured with multiple different authority hosts). + The builder to chain the .With methods. + + + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single-tenant application) described by its domain name. See https://aka.ms/msal-net-application-configuration. + + Uri to the Azure cloud instance (for instance + https://login.microsoftonline.com) + Domain name associated with the tenant from which to sign-in users + Whether the authority should be validated against the server metadata. + + can also contain the string representation of a GUID (tenantId), + or even common, organizations or consumers but in this case + it's recommended to use another override ( + and + + Thrown if or is null or empty. + Thrown if or is not well-formatted (for example, has spaces). + Thrown in more general exception scenarios (for example if the application was configured with multiple different authority hosts). + The builder to chain the .With methods + + + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single tenant application) described by its cloud instance and its tenant ID. + See https://aka.ms/msal-net-application-configuration. + + Instance of Azure cloud (for example, Azure + public cloud, Azure China, or Azure Government). + Tenant Id of the tenant from which to sign-in users + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods + + + + Adds a known Azure AD authority to the application to sign-in users from a single + organization (single-tenant application) described by its cloud instance and its domain + name or tenant ID. See https://aka.ms/msal-net-application-configuration. + + Instance of Azure cloud (for example, Azure + public cloud, Azure China, or Azure Government). + Domain name associated with the Azure AD tenant from which + to sign-in users. This can also be a GUID. + Whether the authority should be validated against the server metadata. + Thrown if or is null or empty. + The builder to chain the .With methods. + + + + Adds a known Azure AD authority to the application to sign-in users specifying + the cloud instance and the sign-in audience. See https://aka.ms/msal-net-application-configuration. + + Instance of Azure Cloud (for instance Azure + worldwide cloud, Azure German Cloud, US government ...) + Sign-in audience (one AAD organization, + any work and school accounts, or any work and school accounts and Microsoft personal + accounts + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods + + + + Adds a known Azure AD authority to the application to sign-in users specifying + the sign-in audience (the cloud being the Azure public cloud). See https://aka.ms/msal-net-application-configuration. + + Sign-in audience (one AAD organization, + any work and school accounts, or any work and school accounts and Microsoft personal + accounts + Whether the authority should be validated against the server metadata. + The builder to chain the .With methods + + + + Adds a known Authority corresponding to an ADFS server. See https://aka.ms/msal-net-adfs + + Authority URL for an ADFS server + Whether the authority should be validated against the server metadata. + MSAL.NET will only support ADFS 2019 or later. + The builder to chain the .With methods + + + + Adds a known authority corresponding to an Azure AD B2C policy. + See https://aka.ms/msal-net-b2c-specificities + + Azure AD B2C authority, including the B2C policy (for instance + "https://fabrikamb2c.b2clogin.com/tfp/{Tenant}/{policy}) + The builder to chain the .With methods + + + + Applicable to only public client applications to enforce SSO policy with embedded webview. + + + + + Service principal name for Kerberos Service Ticket. + + + + + Kerberos Service Ticket container to be used. + + + + + This is here just to support the public IAppConfig. Should not be used internally, instead use the abstraction. + + + + + This is here just to support the public IAppConfig. Should not be used internally, instead use the abstraction. + + + + + Should _not_ go in the interface, only for builder usage while determining authorities with ApplicationOptions + + + + + Should _not_ go in the interface, only for builder usage while determining authorities with ApplicationOptions + + + + + Should _not_ go in the interface, only for builder usage while determining authorities with ApplicationOptions + + + + + Should _not_ go in the interface, only for builder usage while determining authorities with ApplicationOptions + + + + + Base class for options objects with string values loadable from a configuration file + (for instance a JSON file, as in an asp.net configuration scenario) + See https://aka.ms/msal-net-application-configuration + See also derived classes + and + + + + + Client ID (also known as App ID) of the application as registered in the + application registration portal (https://aka.ms/msal-net-register-app) + + + + + Tenant from which the application will allow users to sign it. This can be: + a domain associated with a tenant, a GUID (tenant id), or a meta-tenant (e.g. consumers). + This property is mutually exclusive with . If both + are provided, an exception will be thrown. + + The name of the property was chosen to ensure compatibility with AzureAdOptions + in ASP.NET Core configuration files (even the semantics would be tenant) + + + + Sign-in audience. This property is mutually exclusive with TenantId. If both + are provided, an exception will be thrown. + + + + + STS instance (for instance https://login.microsoftonline.com for the Azure public cloud). + The name was chosen to ensure compatibility with AzureAdOptions in ASP.NET Core. + This property is mutually exclusive with . If both + are provided, an exception will be thrown. + + + + + Specific instance in the case of Azure Active Directory. + It allows users to use the enum instead of the explicit URL. + This property is mutually exclusive with . If both + are provided, an exception will be thrown. + + + + + This redirect URI needs to be registered in the app registration. See https://aka.ms/msal-net-register-app for + details on which redirect URIs are defined by default by MSAL.NET and how to register them. + Also use: which provides + a good default for public client applications for all platforms. + + For web apps and web APIs, the redirect URI is computed from the URL where the application is running + (for instance, baseUrl//signin-oidc for ASP.NET Core web apps). + + For daemon applications (confidential client applications using only the Client Credential flow + that is calling AcquireTokenForClient), no reply URI is needed. + + This is especially important when you deploy an application that you have initially tested locally; + you then need to add the reply URL of the deployed application in the application registration portal + + + + + The name of the calling application for telemetry purposes. + + + + + The version of the calling application for telemetry purposes. + + + + + Microsoft Identity specific OIDC extension that allows resource challenges to be resolved without interaction. + Allows configuration of one or more client capabilities, e.g. "llt" + + + MSAL will transform these into special claims request. See https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter for + details on claim requests. + For more details see https://aka.ms/msal-net-claims-request + + + + + Enables legacy ADAL cache serialization and deserialization. + + + + + Service principal name for Kerberos Service Ticket. + + + + + Kerberos Service Ticket container to be used. + + + + + Information about the client assertion that need to be generated See https://aka.ms/msal-net-client-assertion + + Use the provided information to generate the client assertion payload + + + + + + + + Client ID for which a signed assertion is requested + + + + + The intended token endpoint + + + + + Claims to be included in the client assertion + + + + + This class must be kept immutable + + + + + For IWA + + + + + Authority supports multi-tenancy. ADFS and Generic authorities are not tenanted. + B2C doesn't allow multi-tenancy scenarios, but the authority itself is tenanted. + For CIAM, we allow multi-tenancy scenarios, and expect the STS to fail. + + + + + True if SHA2 and PSS can be used for creating the client credential from a certificate + + + + + Validates the authority string and creates a Uri object out of it. + Authority must not be null or whitespace, must be a well-formed URI (e.g. not include spaces), and must have an HTTPS schema. + Non-generic authorities must have at least one segment in the path. + + + + + This is extension for AuthorityInfo + + + + + Figures out the authority based on the authority from the config and the authority from the request, + and optionally the homeAccountTenantId, which has an impact on AcquireTokenSilent + If the request authority is consumers, organizations, or common, it should just be set an the app level. + The algorithm is: + + 1. If there is no request authority (i.e. no authority override), use the config authority. + 1.1. For AAD, if the config authority is "common" etc, try to use the tenanted version with the home account tenant ID + 2. If there is a request authority, try to use it. + 2.1. If the request authority is not "common", then use it + 2.2 If the request authority is "common", ignore it, and use 1.1 + + Special cases: + + - if the authority is not defined at the application level and the request level is not AAD, use the request authority + - if the authority is defined at app level, and the request level authority is of different type, throw an exception + + - if the intended authority is consumers, please define it at the app level and not at the request level. + known issue: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/2929 + + + + + Enumeration for the AuthorityTypes + + + + + + + + + Value communicating that the AzureCloudInstance is not specified. + + + + + Microsoft Azure public cloud. Maps to https://login.microsoftonline.com + + + + + Microsoft Azure China cloud. Maps to https://login.chinacloudapi.cn + + + + + Microsoft Azure German cloud ("Black Forest"). Maps to https://login.microsoftonline.de + + + + + US Government cloud. Maps to https://login.microsoftonline.us + + + + + + + + + + Uses a specific to communicate + with the IdP. This enables advanced scenarios such as setting a proxy, + or setting the Agent. + + HTTP client factory + MSAL does not guarantee that it will not modify the HttpClient, for example by adding new headers. + Prior to the changes needed in order to make MSAL's httpClients thread safe (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/pull/2046/files), + the httpClient had the possibility of throwing an exception stating "Properties can only be modified before sending the first request". + MSAL's httpClient will no longer throw this exception after 4.19.0 (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/releases/tag/4.19.0) + see (https://aka.ms/msal-httpclient-info) for more information. + + The builder to chain the .With methods + + + + Uses a specific to communicate + with the IdP. This enables advanced scenarios such as setting a proxy, + or setting the Agent. + + HTTP client factory + Configures MSAL to retry on 5xx server errors. When enabled (on by default), MSAL will wait 1 second after receiving + a 5xx error and then retry the http request again. + MSAL does not guarantee that it will not modify the HttpClient, for example by adding new headers. + Prior to the changes needed in order to make MSAL's httpClients thread safe (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/pull/2046/files), + the httpClient had the possibility of throwing an exception stating "Properties can only be modified before sending the first request". + MSAL's httpClient will no longer throw this exception after 4.19.0 (https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/releases/tag/4.19.0) + see (https://aka.ms/msal-httpclient-info) for more information. + If you only want to configure the retryOnceOn5xx parameter, set httpClientFactory to null and MSAL will use the default http client. + + The builder to chain the .With methods + + + + Sets the logging callback. For details see https://aka.ms/msal-net-logging + + + Desired level of logging. The default is LogLevel.Info + Boolean used to enable/disable logging of + Personally Identifiable Information (PII). + PII logs are never written to default outputs like Console, Logcat or NSLog + Default is set to false, which ensures that your application is compliant with GDPR. + You can set it to true for advanced debugging requiring PII + If both WithLogging apis are set, the other one will override the this one + + Flag to enable/disable logging to platform defaults. + In Desktop, Event Tracing is used. In iOS, NSLog is used. + In android, Logcat is used. The default value is false + + The builder to chain the .With methods + is thrown if the loggingCallback + was already set on the application builder + + + + Sets the Identity Logger. For details see https://aka.ms/msal-net-logging + + IdentityLogger + Boolean used to enable/disable logging of + Personally Identifiable Information (PII). + PII logs are never written to default outputs like Console, Logcat or NSLog + Default is set to false, which ensures that your application is compliant with GDPR. + You can set it to true for advanced debugging requiring PII + If both WithLogging apis are set, this one will override the other + + The builder to chain the .With methods + + + + Sets the Debug logging callback to a default debug method which displays + the level of the message and the message itself. For details see https://aka.ms/msal-net-logging + + Desired level of logging. The default is LogLevel.Info + Boolean used to enable/disable logging of + Personally Identifiable Information (PII). + PII logs are never written to default outputs like Console, Logcat or NSLog + Default is set to false, which ensures that your application is compliant with GDPR. + You can set it to true for advanced debugging requiring PII + + Flag to enable/disable logging to platform defaults. + In Desktop, Event Tracing is used. In iOS, NSLog is used. + In android, logcat is used. The default value is false + + The builder to chain the .With methods + is thrown if the loggingCallback + was already set on the application builder by calling + + + + + Sets application options, which can, for instance have been read from configuration files. + See https://aka.ms/msal-net-application-configuration. + + Application options + The builder to chain the .With methods + + + + Allows usage of experimental features and APIs. If this flag is not set, experimental features + will throw an exception. For details see https://aka.ms/msal-net-experimental-features + + + Changes in the public API of experimental features will not result in an increment of the major version of this library. + For these reason we advise against using these features in production. + + + + + Sets the name of the calling SDK API for telemetry purposes. + + The name of the SDK API for telemetry purposes. + + + + + Sets the version of the calling SDK for telemetry purposes. + + The version of the calling SDK for telemetry purposes. + + + + + Base class for options objects with string values loadable from a configuration file + (for instance a JSON file, as in an asp.net configuration scenario) + See https://aka.ms/msal-net-application-configuration + See also derived classes + + + + + Enables you to configure the level of logging you want. The default value is . Setting it to will only get errors + Setting it to will get errors and warning, etc.. + See https://aka.ms/msal-net-logging + + + + + Flag to enable/disable logging of Personally Identifiable Information (PII). + PII logs are never written to default outputs like Console, Logcat or NSLog + Default is set to false, which ensures that your application is compliant with GDPR. You can set + it to true for advanced debugging requiring PII. See https://aka.ms/msal-net-logging + + + + + + Flag to enable/disable logging to platform defaults. In Desktop, Event Tracing is used. In iOS, NSLog is used. + In Android, logcat is used. The default value is false. See https://aka.ms/msal-net-logging + + + + + + Options for MSAL token caches. + + + Detailed cache guidance for each application type and platform, including L2 options: + https://aka.ms/msal-net-token-cache-serialization + + + + + Recommended options for using a static cache. + + + + + Constructor for the options with default values. + + + + + Constructor + + Set to true to share the cache between all ClientApplication objects. The cache becomes static. for a detailed description. + + + + Share the cache between all ClientApplication objects. The cache becomes static. Defaults to false. + + + Recommended only for client credentials flow (service to service communication). + Web apps and Web APIs should use external token caching (Redis, Cosmos etc.) for scaling purposes. + Desktop apps should encrypt and persist their token cache to disk, to avoid losing tokens when app restarts. + ADAL used a static cache by default. + + + + + + + + + + + + Constructor of a ConfidentialClientApplicationBuilder from application configuration options. + See https://aka.ms/msal-net-application-configuration + + Confidential client applications configuration options + A from which to set more + parameters, and to create a confidential client application instance + + + + Creates a ConfidentialClientApplicationBuilder from a clientID. + See https://aka.ms/msal-net-application-configuration + + Client ID (also known as App ID) of the application as registered in the + application registration portal (https://aka.ms/msal-net-register-app)/. + A from which to set more + parameters, and to create a confidential client application instance + + + + Sets the certificate associated with the application. + + The X509 certificate used as credentials to prove the identity of the application to Azure AD. + + You should use certificates with a private key size of at least 2048 bytes. Future versions of this library might reject certificates with smaller keys. + Does not send the certificate (as x5c parameter) with the request by default. + + + + + Sets the certificate associated with the application. + Applicable to first-party applications only, this method also allows to specify + if the x5c claim should be sent to Azure AD. + Sending the x5c enables application developers to achieve easy certificate roll-over in Azure AD: + this method will send the certificate chain to Azure AD along with the token request, + so that Azure AD can use it to validate the subject name based on a trusted issuer policy. + This saves the application admin from the need to explicitly manage the certificate rollover + (either via portal or PowerShell/CLI operation). For details see https://aka.ms/msal-net-sni + + The X509 certificate used as credentials to prove the identity of the application to Azure AD. + To send X5C with every request or not. The default is false + You should use certificates with a private key size of at least 2048 bytes. Future versions of this library might reject certificates with smaller keys. + + + + Sets the certificate associated with the application along with the specific claims to sign. + By default, this will merge the with the default required set of claims needed for authentication. + If is set to false, you will need to provide the required default claims. See https://aka.ms/msal-net-client-assertion + + The X509 certificate used as credentials to prove the identity of the application to Azure AD. + The claims to be signed by the provided certificate. + Determines whether or not to merge with the default claims required for authentication. + + You should use certificates with a private key size of at least 2048 bytes. Future versions of this library might reject certificates with smaller keys. + Does not send the certificate (as x5c parameter) with the request by default. + + + + + Sets the certificate associated with the application along with the specific claims to sign. + By default, this will merge the with the default required set of claims needed for authentication. + If is set to false, you will need to provide the required default claims. See https://aka.ms/msal-net-client-assertion + + The X509 certificate used as credentials to prove the identity of the application to Azure AD. + The claims to be signed by the provided certificate. + Determines whether or not to merge with the default claims required for authentication. + To send X5C with every request or not. + You should use certificates with a private key size of at least 2048 bytes. Future versions of this library might reject certificates with smaller keys. + + + + Sets the application secret + + Secret string previously shared with AAD at application registration to prove the identity + of the application (the client) requesting the tokens + + + + + Sets the application client assertion. See https://aka.ms/msal-net-client-assertion. + This will create an assertion that will be held within the client application's memory for the duration of the client. + You can use to set a delegate that will be executed for each authentication request. + This will allow you to update the client assertion used by the client application once the assertion expires. + + The client assertion used to prove the identity of the application to Azure AD. This is a Base-64 encoded JWT. + + + + + Configures a delegate that creates a client assertion. See https://aka.ms/msal-net-client-assertion + + delegate computing the client assertion used to prove the identity of the application to Azure AD. + This is a delegate that computes a Base-64 encoded JWT for each authentication call. + The ConfidentialClientApplicationBuilder to chain more .With methods + Callers can use this mechanism to cache their assertions + + + + Configures an async delegate that creates a client assertion. See https://aka.ms/msal-net-client-assertion + + An async delegate computing the client assertion used to prove the identity of the application to Azure AD. + This is a delegate that computes a Base-64 encoded JWT for each authentication call. + The ConfidentialClientApplicationBuilder to chain more .With methods + Callers can use this mechanism to cache their assertions + + + + Configures an async delegate that creates a client assertion. The delegate is invoked only when a token cannot be retrieved from the cache. + See https://aka.ms/msal-net-client-assertion + + An async delegate that returns the client assertion. Assertion lifetime is the responsibility of the caller. + The ConfidentialClientApplicationBuilder to chain more .With methods + Callers can use this mechanism to cache their assertions + + + + Instructs MSAL to use an Azure regional token service. This feature is currently available to + first-party applications only. + + Either the string with the region (preferred) or + use and MSAL will attempt to auto-detect the region. + + + The region value should be a short region name for the region where the service is deployed. + For example, "centralus" is short name for region Central US. + Currently only tokens for the client credential flow can be obtained from the regional service. + Requires configuration at the tenant level. + Auto-detection works on a limited number of Azure artifacts (VMs, Azure functions). + If auto-detection fails, the non-regional endpoint will be used. + If a specific region was provided and the token web request failed, verify that the region name is valid. + See https://aka.ms/msal-net-region-discovery for more details. + + The builder to chain the .With methods + + + + When set to true, MSAL will lock cache access at the level, i.e. + the block of code between BeforeAccessAsync and AfterAccessAsync callbacks will be synchronized. + Apps can set this flag to false to enable an optimistic cache locking strategy, which may result in better performance + at the cost of cache consistency. + Setting this flag to false is only recommended for apps which create a new per request. + + + This flag is true by default. The default behavior is recommended. + + + + + Call instead. + + + + + + + Adds a known authority corresponding to a generic OpenIdConnect Identity Provider. + MSAL will append ".well-known/openid-configuration" to the authority and retrieve the OIDC + metadata from there, to figure out the endpoints. + See https://openid.net/specs/openid-connect-core-1_0.html#Terminology + + + Do not use this method with Entra ID authorities (e.g. https://login.microsfoftonline.com/common). + Use WithAuthority(string) instead. + + + + + This method is obsolete. See https://aka.ms/msal-net-telemetry + + + + + + + + Builds an instance of + from the parameters set in the . + + Thrown when errors occur locally in the library itself (for example, because of incorrect configuration). + An instance of + + + + Configuration options for a confidential client application + (web app / web API / daemon app). See https://aka.ms/msal-net/application-configuration + + + + + Client secret for the confidential client application. This secret (application password) + is provided by the application registration portal, or provided to Azure AD during the + application registration with PowerShell AzureAD, PowerShell AzureRM, or Azure CLI. + + + + + Instructs MSAL.NET to use an Azure regional token service. + This setting should be set to either the string with the region (preferred) or to + "TryAutoDetect" and MSAL.NET will attempt to auto-detect the region. + + + Region names as per Region class documentation. + Not all auth flows can use the regional token service. + Service To Service (client credential flow) tokens can be obtained from the regional service. + Requires configuration at the tenant level. + Auto-detection works on a limited number of Azure artifacts (VMs, Azure functions). + If auto-detection fails, the non-regional endpoint will be used. + If an invalid region name is provided, the non-regional endpoint MIGHT be used or the token request MIGHT fail. + See https://aka.ms/msal-net-region-discovery for more details. + + + + + When set to true, MSAL will lock cache access at the level, i.e. + the block of code between BeforeAccessAsync and AfterAccessAsync callbacks will be synchronized. + Apps can set this flag to false to enable an optimistic cache locking strategy, which may result in better performance + at the cost of cache consistency. + Setting this flag to false is only recommended for apps which create a new per request. + + + This flag is true by default. The default behavior is recommended. + + + + + Configuration properties used to build a public or confidential client application. + + + + + Client ID (also known as App ID) of the application as registered in the + application registration portal (https://aka.ms/msal-net-register-app). + + + + + Flag telling if logging of Personally Identifiable Information (PII) is enabled/disabled for + the application. See https://aka.ms/msal-net-logging. + + + + + + used to get HttpClient instances to communicate + with the identity provider. + + + + + Level of logging requested for the app. + See https://aka.ms/msal-net-logging. + + + + + Flag telling if logging to platform defaults is enabled/disabled for the app. + In Desktop, Event Tracing is used. In iOS, NSLog is used. + In Android, logcat is used. See https://aka.ms/msal-net-logging. + + + + + Redirect URI for the application. See + + + + + Audience for the application. See + + + + + Callback used for logging. It was set with + See https://aka.ms/msal-net-logging + + + + + Extra query parameters that will be applied to every acquire token operation. + See + + + + + Indicates whether or not the current application object is configured to use brokered authentication. + + + + + The name of the calling application for telemetry purposes. + + + + + The version of the calling application for telemetry purposes. + + + + + + + + + Allows usage of features that are experimental and would otherwise throw a specific exception. + Use of experimental features in production is not recommended and are subject to be removed between builds. + For details see https://aka.ms/msal-net-experimental-features. + + + + + Microsoft Identity specific OIDC extension that allows resource challenges to be resolved without interaction. + Allows configuration of one or more client capabilities, e.g. "llt" + + + MSAL will transform these into a "access_token" claims request. See https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter for + details on claim requests. + For more details see https://aka.ms/msal-net-claims-request + + + + + Enables legacy ADAL cache serialization and deserialization. + + + + + + + + + + + + + + + + + Factory responsible for creating HttpClient. + See https://learn.microsoft.com/dotnet/api/system.net.http.httpclient?view=net-7.0#instancing for more details. + + + Implementations must be thread safe. + Do not create a new HttpClient for each call to - this leads to socket exhaustion. + If your app uses Integrated Windows Authentication, ensure is set to true. + + + + + Method returning an HTTP client that will be used to + communicate with Azure AD. This enables advanced scenarios. + See https://aka.ms/msal-net-application-configuration. + + An HTTP client. + + + + Internal factory responsible for creating HttpClient instances configured for mutual TLS (MTLS). + This factory is specifically intended for use within the MSAL library for secure communication with Azure AD using MTLS. + For more details on HttpClient instancing, see https://learn.microsoft.com/dotnet/api/system.net.http.httpclient?view=net-7.0#instancing. + + + Implementations of this interface must be thread-safe. + It is important to reuse HttpClient instances to avoid socket exhaustion. + Do not create a new HttpClient for each call to . + If your application requires Integrated Windows Authentication, set to true. + This interface is intended for internal use by MSAL only and is designed to support MTLS scenarios. + + + + + Returns an HttpClient configured with a certificate for mutual TLS authentication. + This method enables advanced MTLS scenarios within Azure AD communications in MSAL. + + The certificate to be used for MTLS authentication. + An HttpClient instance configured with the specified certificate. + + + + Describes the types of audiences for telemetry. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + Indicates a PreProduction environment. PreProd environments are not sampled. + + + + + Indicates a Production environment. These environments are sampled based on the platforms' device info to reduce data load. + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + Communicates which audience the telemetry is for (e.g. Production or Pre-Production) so that MSAL.NET can change sampling + and filtering behavior. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + ID for the telemetry session. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + Implementers of the interface will receive this callback when telemetry data is available. The implementation should transfer + the data in ITelemetryEventPayload to a specific telemetry uploader instance. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + Data that represents a single snapshot in the series of events that are collected + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + Used for debugging and testing. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + Builder for managed identity applications. + + + + + + + + Creates a ManagedIdentityApplicationBuilder from a user assigned managed identity clientID / resourceId / objectId. + For example, for a system assigned managed identity use ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.SystemAssigned) + and for a user assigned managed identity use ManagedIdentityApplicationBuilder.Create(ManagedIdentityId.WithUserAssignedClientId(clientId)) or + ManagedIdentityId.WithUserAssignedResourceId("resourceId") or + ManagedIdentityId.WithUserAssignedObjectId("objectid"). + For more details see https://aka.ms/msal-net-managed-identity + + Configuration of the Managed Identity assigned to the resource. + A from which to set more + parameters, and to create a managed identity application instance + + + + This method is obsolete. See https://aka.ms/msal-net-telemetry + + + + + Microsoft Identity specific OIDC extension that allows resource challenges to be resolved without interaction. + Allows configuration of one or more client capabilities, e.g. "llt" + + + MSAL will transform these into special claims request. See https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter for + details on claim requests. + For more details see https://aka.ms/msal-net-claims-request + + + + + Builds an instance of + from the parameters set in the . + + Thrown when errors occur locally in the library itself (for example, because of incorrect configuration). + An instance of + + + + Class to store configuration for a managed identity enabled on a resource. + For a system assigned managed identity use ManagedIdentityId.SystemAssigned. + For user assigned managed identity use ManagedIdentityId.WithUserAssignedClientId("clientId") or + ManagedIdentityId.WithUserAssignedResourceId("resourceId") or + ManagedIdentityId.WithUserAssignedObjectId("objectid"). + For more details see https://aka.ms/msal-net-managed-identity + + + + + Gets the identifier for a user-assigned managed identity. + + + This property holds the unique identifier of the user-assigned managed identity. + It can be a client ID, a resource ID, or an object ID, depending on how the managed identity is configured. + + + The identifier string of the user-assigned managed identity. + + + + + Gets the type of identifier used for the managed identity. + + + This property indicates the type of the managed identity identifier, + which can be either a client ID, a resource ID, or an object ID. + + + The enumeration value representing the managed identity identifier type. + + + + + Gets a value indicating whether the managed identity is user-assigned. + + + This property is true if the managed identity is user-assigned, and false if it is system-assigned. + + + True if the managed identity is user-assigned; otherwise, false. + + + + + Create an instance of ManagedIdentityId for a system assigned managed identity. + + + + + Create an instance of ManagedIdentityId for a user assigned managed identity from a client id. + + Client id of the user assigned managed identity assigned to the azure resource. + Instance of ManagedIdentityId. + + + + + Create an instance of ManagedIdentityId for a user assigned managed identity from a resource id. + + Resource id of the user assigned managed identity assigned to the azure resource. + Instance of ManagedIdentityId. + + + + + Create an instance of ManagedIdentityId for a user assigned managed identity from an object id. + + Object id of the user assigned managed identity assigned to the azure resource. + Instance of ManagedIdentityId. + + + + + Enum to represent the type of MSAL application. + + + + + Details about the HTTP request and configuration properties used to construct a proof of possession request. + + + POP tokens are signed by the process making the request. By default, MSAL will generate a key in memory. + To use a hardware key or an external key, implement . + + + + + Creates a configuration using the default key management - an RSA key will be created in memory and rotated every 8h. + Uses , etc. to control which elements of the request should be included in the POP token. + + + See https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03#page-3 for details about signed HTTP requests. + + + + + Creates a configuration using the default key management, and which binds all the details of the HttpRequestMessage. + + + Currently only the HttpMethod (m), UrlHost (u) and UrlPath (p) are used to create the signed HTTP request - see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03#page-3 + + + + + Creates a configuration using the default key management, and which binds only the Uri part of the HTTP request. + + + The UrlHost (u) and UrlPath (p) are used to create the signed HTTP request - see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03#page-3 + + + + + The HTTP method ("GET", "POST" etc.) method that will be bound to the token. Leave null and the POP token will not be bound to the method. + Corresponds to the "m" part of the a signed HTTP request. Optional. + + + See https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + The URL host of the protected API. The "u" part of a signed HTTP request. This MAY include the port separated from the host by a colon in host:port format. Optional. + + + + + The "p" part of the signed HTTP request. + + + + + An extensibility point that allows developers to define their own key management. + Leave null and MSAL will use a default implementation, which generates an RSA key pair in memory and refreshes it every 8 hours. + Important note: if you want to change the key (e.g. rotate the key), you should create a new instance of this object, + as MSAL.NET will keep a thumbprint of keys in memory. + + + + + If the protected resource (RP) requires use of a special nonce, they will publish it as part of the WWWAuthenticate header associated with a 401 HTTP response + or as part of the AuthorityInfo header associated with 200 response. Set it here to make it part of the Signed HTTP Request part of the POP token. + + + + + Allows app developers to bypass the creation of the SignedHttpRequest envelope by setting this property to false. + App developers can use a package like Microsoft.IdentityModel.Protocols.SignedHttpRequest to later create and sign the envelope. + + + If set to false, you do not need to implement the method when using custom keys. + + + + + + + + + + + + Creates a PublicClientApplicationBuilder from public client application + configuration options. See https://aka.ms/msal-net-application-configuration + + Public client applications configuration options + A from which to set more + parameters, and to create a public client application instance + + + + Creates a PublicClientApplicationBuilder from a clientID. + See https://aka.ms/msal-net-application-configuration + + Client ID (also known as App ID) of the application as registered in the + application registration portal (https://aka.ms/msal-net-register-app)/. + A from which to set more + parameters, and to create a public client application instance + + + + Configures the public client application to use the recommended reply URI for the platform. + See https://aka.ms/msal-net-default-reply-uri. + + + Platform + Default Reply URI + + + .NET desktop + `https://login.microsoftonline.com/common/oauth2/nativeclient` + + + For system browser on .NET Core + http://localhost + + + NOTE:There will be an update to the default redirect URI in the future to accommodate for system browsers on the + .NET desktop and .NET Core platforms. + + A from which to set more + parameters, and to create a public client application instance + + + + Enables multi cloud support for this instance of public client application. + It enables applications to use in a global public cloud authority to the library and can still get tokens for resources from sovereign clouds. + + Enable or disable multi cloud support. + A from which to set more + parameters, and to create a public client application instance + This feature is available to Microsoft applications, which have the same client id across all clouds + + + + You can specify a Keychain Access Group to use for persisting the token cache across multiple applications. + This enables you to share the token cache between several applications having the same Keychain access group. + Sharing the token cache allows single sign-on between all of the applications that use the same Keychain access Group. + See https://aka.ms/msal-net-ios-keychain-security-group for more information. + + + A from which to set more + parameters, and to create a public client application instance + + + + + + + + + + + + Allows customization of the Windows 10 Broker experience. + + + + + Sets a reference to the ViewController (if using iOS), Activity (if using Android) + IWin32Window or IntPtr (if using .Net Framework). Used for invoking the browser. + + + Mandatory only on Android to be set either from here or from AcquireTokenInteractive builder. + See https://aka.ms/msal-net-android-activity for further documentation and details. + + The parent as an object, so that it can be used from shared NetStandard assemblies + The builder to chain the .With methods + + + + + Adds a known authority corresponding to a generic OpenIdConnect Identity Provider. + MSAL will append ".well-known/openid-configuration" to the authority and retrieve the OIDC + metadata from there, to figure out the endpoints. + See https://openid.net/specs/openid-connect-core-1_0.html#Terminology + + + Experimental on public clients. + Do not use this method with Entra ID authorities (e.g. https://login.microsfoftonline.com/common). + Use WithAuthority(string) instead. + + + + + Sets a reference to the current IWin32Window that triggers the browser to be shown. + Used to center the browser that pop-up onto this window. + + A function to return the current window + The builder to chain the .With methods + + + + Sets a reference to the IntPtr to a window that triggers the browser to be shown. + Used to center the browser that pop-up onto this window. + + A function to return the current window + The builder to chain the .With methods + + + + Sets the parameters required to get a Kerberos Ticket from Azure AD service. + + Service principal name to get Kerberos Service Ticket. + Specify where the Kerberos ticket will be returned - as a claim in the ID token or as a claim in the access token. + If the ticket is for the client application, use the ID token. If the ticket is for the downstream API, use the access token. + + The expiry of the Kerberos ticket is tied to the expiry of the token that contains it. + MSAL provides several helper APIs to read and write Kerberos tickets from the Windows Ticket Cache - see . + + + + + Returns true if a broker can be used. + This method is only needed to be used in mobile scenarios which support Mobile Application Management. In other supported scenarios, use WithBroker by itself, which will fall back to use a browser if broker is unavailable. + + + + On Windows, the broker (WAM) can be used on Windows 10 and is always installed. See https://aka.ms/msal-net-wam + On Mac, Linux, and older versions of Windows a broker is not available. + In .NET classic or .NET, install Microsoft.Identity.Client.Desktop first and call WithDesktopFeatures(). + In mobile apps, the device must be Intune joined and Authenticator or Company Portal must be installed. See https://aka.ms/msal-brokers + + + + + + Builds an instance of + from the parameters set in the . + + Thrown when errors occur locally in the library itself (for example, because of incorrect configuration). + An instance of + + + + + + + Configuration options for a public client application (desktop/mobile app). + See https://aka.ms/msal-net/application-configuration + + + + + A simple implementation that writes data using System.Diagnostics.Trace. + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + This API is experimental and it may change in future versions of the library without an major version increment + + + + + + + Default authority used for interactive calls. + + + + + Parsed authentication headers to retrieve header values from . + + + + + Parameters returned by the WWW-Authenticate header. This allows for dynamic + scenarios such as Claims challenge, Continuous Access Evaluation (CAE), and Conditional Access auth context. + See our documentation for additional details. + + + + + Parameters returned by the Authentication-Info header. + This allows for more complex authentication scenarios, such as Proof-Of-Possession. + + + + + Nonce parsed from . This is acquired from the Proof-of-Possession WWW-Authenticate header or the Authentication-Info header + + + + + Creates the authentication parameters by attempting to call the resource unauthenticated and analyzing the response. + + Resource URI. + Cancellation token to cancel the operation. + An instance of containing authentication header data. + + + + + Resource URI. + Instance of to make the request with. + Cancellation token to cancel the operation. + Thrown if the resourceUri or httpClient is null. + + + + Creates a parsed set of parameters from the provided . + + HTTP response headers. + For known values, such as the nonce used for Proof-of-Possession, the parser will first check for it in the WWW-Authenticate headers + If it cannot find it, it will then check the Authentication-Info parameters for the value. + An instance of . + + + + Creates a new instance. + + + + + Creates a key-value pair from an expression of the form a=b if possible. + Otherwise, the key value pair will be returned as (key:, value:). + + assignment + authScheme + An instance of . + + + + Parameters returned by the Authentication-Info header. This allows for + scenarios such as proof-of-possession, etc. + See https://www.rfc-editor.org/rfc/rfc7615 + + + + + The next nonce to be used in the preceding authentication request. + + + + + Return the of key . + + Name of the raw parameter to retrieve. + The raw parameter if it exists, + or throws a otherwise. + + + + + Dictionary of raw parameters in the Authentication-Info header (extracted from the Authentication-Info header + string value, without any processing). This allows support for APIs which are not mappable easily to the standard + or framework specific (Microsoft.Identity.Model, Microsoft.Identity.Web). + + + + + Create Authentication-Info parameters from the HttpResponseHeaders for each auth scheme. + + HttpResponseHeaders. + Authentication-Info provided by the endpoint + + + + Contains the results of one token acquisition operation in + or ConfidentialClientApplication. For details see https://aka.ms/msal-net-authenticationresult + + + + + Constructor meant to help application developers test their apps. Allows mocking of authentication flows. + App developers should never new-up in product code. + + Access Token that can be used as a bearer token to access protected web APIs + Account information + Expiry date-time for the access token + See + ID token + See + Granted scope values as returned by the service + Identifier for the Azure AD tenant from which the token was acquired. Can be null + Unique Id of the account. It can be null. When the is not null, this is its ID, that is its ObjectId claim, or if that claim is null, the Subject claim. + The correlation id of the authentication request + The token type, defaults to Bearer. Note: this property is experimental and may change in future versions of the library. + Contains metadata related to the Authentication Result. + Claims from the ID token + Auth Code returned by the Microsoft identity platform when you use AcquireTokenByAuthorizationCode.WithSpaAuthorizationCode(). This auth code is meant to be redeemed by the frontend code. See https://aka.ms/msal-net/spa-auth-code + Other properties from the token response. + + + + Constructor meant to help application developers test their apps. Allows mocking of authentication flows. + App developers should never new-up in product code. + + Access Token that can be used as a bearer token to access protected web APIs + Account information + Expiry date-time for the access token + See + ID token + See + Granted scope values as returned by the service + Identifier for the Azure AD tenant from which the token was acquired. Can be null + Unique Id of the account. It can be null. When the is not null, this is its ID, that is its ObjectId claim, or if that claim is null, the Subject claim. + The correlation id of the authentication request + Contains metadata related to the Authentication Result. + The token type, defaults to Bearer. Note: this property is experimental and may change in future versions of the library. + For backwards compatibility with MSAL 4.17-4.20 + + + + Access Token that can be used as a bearer token to access protected web APIs + + + + + In case when Azure AD has an outage, to be more resilient, it can return tokens with + an expiration time, and also with an extended expiration time. + The tokens are then automatically refreshed by MSAL when the time is more than the + expiration time, except when ExtendedLifeTimeEnabled is true and the time is less + than the extended expiration time. This goes in pair with Web APIs middleware which, + when this extended life time is enabled, can accept slightly expired tokens. + Client applications accept extended life time tokens only if + the ExtendedLifeTimeEnabled Boolean is set to true on ClientApplicationBase. + + This feature is not in use + + + + Gets the Unique Id of the account in this + It is set as the oid (ObjectId) claim, or if that claim is null, as the sub (Subject) claim which is guaranteed not-null. + + + The oid claim identifies a user in all apps - Microsoft Identity Providers issue ID tokens with this claim, although it can be null in rare cases. + The sub claim is "a locally unique and never reassigned identifier within the Issuer for the End-User" as per https://openid.net/specs/openid-connect-core-1_0.html and it is a + mandatory claim with OIDC compliant issuers. + Guest AAD accounts have different oid claim values in each tenant. Use to uniquely identify users across tenants. + See https://docs.microsoft.com/azure/active-directory/develop/id-tokens#payload-claims + + + + + Gets the point in time in which the Access Token returned in the property ceases to be valid. + This value is calculated based on current UTC time measured locally and the value expiresIn received from the + service. + + + + + Gets the point in time in which the Access Token returned in the AccessToken property ceases to be valid in MSAL's extended LifeTime. + This value is calculated based on current UTC time measured locally and the value ext_expiresIn received from the service. + + + + + Gets an identifier for the Azure AD tenant from which the token was acquired. This property will be null if tenant information is + not returned by the service. + + + + + Gets the account information. Some elements in might be null if not returned by the + service. The account can be passed back in some API overloads to identify which account should be used such + as or + for instance + + + + + Gets the Id Token if returned by the service or null if no Id Token is returned. + + + + + Gets the granted scope values returned by the service. + + + + + Gets the correlation id used for the request. + + + + + Identifies the type of access token. By default tokens returned by Azure Active Directory are Bearer tokens. + for getting an HTTP authorization header from an AuthenticationResult. + + + + + Gets the SPA Authorization Code, if it was requested using WithSpaAuthorizationCode method on the + AcquireTokenByAuthorizationCode builder. See https://aka.ms/msal-net/spa-auth-code for details. + + + + + Exposes additional response parameters returned by the token issuer (AAD). + + + Not all parameters are added here, only the ones that MSAL doesn't interpret itself and only scalars. + Not supported on mobile frameworks (e.g. net8-android or net8-ios) + + + + + All the claims present in the ID token. + + + + + Contains metadata for the Authentication result. + + + + + Creates the content for an HTTP authorization header from this authentication result, so + that you can call a protected API + + Created authorization header of the form "Bearer {AccessToken}" + + Here is how you can call a protected API from this authentication result (in the result + variable): + + HttpClient client = new HttpClient(); + client.DefaultRequestHeaders.Add("Authorization", result.CreateAuthorizationHeader()); + HttpResponseMessage r = await client.GetAsync(urlOfTheProtectedApi); + + + + + + Contains metadata of the authentication result. for additional MSAL-wide metrics. + + + + + Constructor for the class AuthenticationResultMetadata + The token source. + + + + + The source of the token in the result. + + + + + The token endpoint used to contact the Identity Provider (e.g. Azure Active Directory). + Can be null, for example when the token comes from the cache. + + + This may be different from the endpoint you'd infer from the authority configured in the application object: + - if regional auth is used. + - if AAD instructs MSAL to use a different environment. + - if the authority or tenant is overridden at the request level. + - during a refresh_token operation, when MSAL must resolve "common" and "organizations" to a tenant ID. + + + + + Time, in milliseconds, spent to service this request. Includes time spent making HTTP requests , time spent + in token cache callbacks , time spent in MSAL and context switching. + + + + + Time, in milliseconds, MSAL spent during this request reading and writing to the token cache, i.e. in the OnBeforeAccess, OnAfterAccess, etc. callbacks. + Does not include internal MSAL logic for searching through the cache once loaded. + + + + + Time, in milliseconds, MSAL spent for HTTP communication during this request. + + + + + Specifies the time when the cached token should be proactively refreshed. + This value may be null if proactive refresh is not enabled. + + + + + Specifies the reason for fetching the access token from the identity provider. + + + + + Indicates the type of cache that the token was read from. + + + + + Contains the outcome of the region discovery if region was used. + + + + + Represents the token type used for client telemetry only. + It is separate from the other token types as it is set locally rather than coming from the server. + + + + + Time, in microseconds, spent in the token creation of the extended token. + + + + + May contain telemetry data. + + + Currently it is emitted only for desktop public client flows when the broker is used and it is + also included in the verbose logs. May contain Personal Identifiable Information (PII), as per the logging settings. + See https://aka.ms/msal-net-logging for more details about logging. + + + + + For backwards compatibility reasons, keep the cache key unchanged for Bearer and SSH tokens. + For PoP and future tokens, the cache should support both several types of tokens for the same scope (e.g. PoP and Bearer) + + + + + + + Used to modify the experience depending on the type of token asked. + + + + + Value to log to telemetry + Values available: + + Bearer token type. + Bearer = 1 + + Pop token type. + Pop = 2, + + Ssh-cert token type. + SshCert = 3, + + External token type. + External = 4, + + Extension token type. + Extension = 5 + + + + + Prefix for the HTTP header that has the token. E.g. "Bearer" or "POP" + + + + + Extra parameters that are added to the request to the /token endpoint. + + Name and values of params + + + + Key ID of the public / private key pair used by the encryption algorithm, if any. + Tokens obtained by authentication schemes that use this are bound to the KeyId, i.e. + if a different kid is presented, the access token cannot be used. + + + + + Creates the access token that goes into an Authorization HTTP header. + + + + + Expected to match the token_type parameter returned by ESTS. Used to disambiguate + between ATs of different types (e.g. Bearer and PoP) when loading from cache etc. + + + + + The default implementation will store a key in memory + + + + + Creates the canonical representation of the JWK. See https://tools.ietf.org/html/rfc7638#section-3. + The number of parameters as well as the lexicographic order is important, as this string will be hashed to get a thumbprint. + + + + + For internal testing only + + + + + An abstraction over an the asymmetric key operations needed by POP, that encapsulates a pair of + public and private keys and some typical crypto operations. + All symmetric operations are SHA256. + + + Important: The 2 methods on this interface will be called at different times but MUST return details of + the same private / public key pair, i.e. do not change to a different key pair mid way. Best to have this class immutable. + + Ideally there should be a single public / private key pair associated with a machine, so implementers of this interface + should consider exposing a singleton. + + + + + The canonical representation of the JWK. + See https://tools.ietf.org/html/rfc7638#section-3 + + + + + Algorithm used to sign proof of possession request. + See EC algorithms for ECD. + See RSA algorithms for RSA. + + + + + Signs the byte array using the private key + + + + + Names for Json Web Key Values + + + + + Constants for JsonWebAlgorithms "kty" Key Type (sec 6.1) + http://tools.ietf.org/html/rfc7518#section-6.1 + + + + + Creates POP tokens, i.e. tokens that are bound to an HTTP request and are digitally signed. + + + Currently the signing credential algorithm is hard-coded to RSA with SHA256. Extensibility should be done + by integrating Wilson's SigningCredentials + + + + + For PoP, we chose to use the base64(jwk_thumbprint) + + + + + A key ID that uniquely describes a public / private key pair. While KeyID is not normally + strict, AAD support for PoP requires that we use the base64 encoded JWK thumbprint, as described by + https://tools.ietf.org/html/rfc7638 + + + + + Creates a JWS (json web signature) as per: https://tools.ietf.org/html/rfc7515 + Format: header.payload.signed_payload + + + + + Access token with response cnf + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Http method (GET or POST) + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Timestamp + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Uri host + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Uri path + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Uri path + https://tools.ietf.org/html/draft-ietf-oauth-signed-http-request-03#section-3 + + + + + Confirmation claim. By including this in a JWT, the issuer states that the presenter + possesses a particular key (i.e. the private key) and that the recipient can confirm this + cryptographically. + https://tools.ietf.org/html/rfc7800 + + + + + Also part of the confirmation claim. + + + + + Non-standard claim representing a nonce that protects against replay attacks. + + + + + This factory ensures key rotation every 8h + + + + + Contains the results of an ADAL token acquisition. Access Tokens from ADAL are not compatible + with MSAL, only Refresh Tokens are. + + + + + Gets user information including user Id. Some elements in UserInfo might be null if not returned by the service. + + + + + Gets the Refresh Token associated with the requested Access Token. Note: not all operations will return a Refresh Token. + + + + + Gets a value indicating whether the refresh token can be used for requesting access token for other resources. + + + + + Serializes the object to a JSON string + + Deserialized authentication result + + + + Serializes the object to a JSON string + + Serialized authentication result + + + + Determines what type of subject the token was issued for. + + + + + User + + + + + Client + + + + + UserPlusClient: This is for confidential clients used in middle tier. + + + + + can be used with Linq to access items from the TokenCache dictionary. + + + + + For the purposes of MSAL, the resource is irrelevant, since only RTs can be migrated. + + + + + Determines whether the specified object is equal to the current object. + + + true if the specified object is equal to the current object; otherwise, false. + + The object to compare with the current object. 2 + + + + Determines whether the specified TokenCacheKey is equal to the current object. + + + true if the specified TokenCacheKey is equal to the current object; otherwise, false. + + The TokenCacheKey to compare with the current object. 2 + + + + Returns the hash code for this TokenCacheKey. + + + A 32-bit signed integer hash code. + + + + + Contains information of a single user. This information is used for token cache lookup. Also if created with userId, userId is sent to the service when login_hint is accepted. + + + + + Create user information for token cache lookup + + + + + Create user information copied from another UserInfo object + + + + + Gets identifier of the user authenticated during token acquisition. + + + + + Gets a displayable value in UserPrincipalName (UPN) format. The value can be null. + + + + + Gets given name of the user if provided by the service. If not, the value is null. + + + + + Gets family name of the user if provided by the service. If not, the value is null. + + + + + Gets the time when the password expires. Default value is 0. + + + + + Gets the URL where the user can change the expiring password. The value can be null. + + + + + Gets identity provider if returned by the service. If not, the value is null. + + + + + Data class, common to ADAL.NET and MSAL.NET V2 used for the token cache serialization + in a dual format: the ADAL V3 cache format, and the new unified cache format, common + to ADAL.NET 4.x, MSAL.NET 2.x and other libraries in the same Operating System + (for instance ADAL and MSAL for objective C in iOS) + + + + + Array of bytes containing the serialized cache in ADAL.NET V3 format + + + + + Array of bytes containing the serialized MSAL.NET V2 cache + + + + + Returns a tuple where + + Item1 is a map of ClientInfo -> AdalUserInfo for those users that have ClientInfo + Item2 is a list of AdalUserInfo for those users that do not have ClientInfo + + + + + Algorithm to delete: + + DisplayableId cannot be null + Removal is scoped by environment and clientId; + + If accountId != null then delete everything with the same clientInfo + otherwise, delete everything with the same displayableId + + Notes: + - displayableId can change rarely + - ClientCredential Grant uses the app token cache, not the user token cache, so this algorithm does not apply + (nor will GetAccounts / RemoveAccount work) + + + + + + Responsible for computing: + - external distributed cache key (from request and responses) + - internal cache partition keys (as above, but also from cache items) + + These are the same string, but MSAL cannot control if the app developer actually uses distributed caching. + However, MSAL's in-memory cache needs to be partitioned, and this class computes the partition key. + + + + + Identifies the type of cache that the token was read from. + + + Token cache serialization implementations must provide this value. + + + + + Indicates that the token was retrieved from the identity provider. + + + + + Indicates that the cache level used is unknown. + Token was retrieved from cache but the token cache implementation didn't specify which cache level was used. + + + + + Indicates that the token was read from the L1 cache. + + + + + Indicates that the token was read from the L2 cache. + + + + + MSAL should only interact with the cache though this object. It is responsible for firing cache notifications. + Flows should only perform (at most) 2 cache accesses: one to read data and one to write tokens. Reading data multiple times + (e.g. read all ATs, read all RTs) should not refresh the cache from disk because of performance impact. + Write operations are still the responsibility of TokenCache. + + + + + Possibly refreshes the internal cache by calling OnBeforeAccessAsync and OnAfterAccessAsync delegates. + + + + + Creates a new object with a different expires on + + + + + Used to find the token in the cache. + Can be a token assertion hash (normal OBO flow) or a user provided key (long-running OBO flow). + + + + + Used when the token is bound to a public / private key pair which is identified by a key id (kid). + Currently used by PoP tokens + + + + + Additional parameters that were requested in the token request and are stored in the cache. + These are acquired from the response and are stored in the cache for later use. + + + + + Example account json: + + "authority_type":"MSSTS", + "client_info":"", + "environment":"login.windows.net", + "family_name":"", + "given_name":"Some Name", + "home_account_id":"69c374a4-1df6-46f8-b83a-a2fcd8823ee2.49f548d0-12b7-4169-a390-bb5304d24462", + "local_account_id":"69c374a4-1df6-46f8-b83a-a2fcd8823ee2", + "middle_name":"", + "name":"Some Name", + "realm":"49f548d0-12b7-4169-a390-bb5304d24462", + "username":"subzero@bogavrilltd.onmicrosoft.com", + "wam_account_ids":"{\"00000000480FA373\":\"ob7b8h79td9gs6hfqoh2r37m\",\"4b0db8c2-9f26-4417-8bde-3f0e3656f8e0\":\"ob7b8h79td9gs6hfqoh2r37m\"}" + + + + + + WAM special implementation: MSA accounts (and also AAD accounts) cannot be discovered through WAM + however the broker offers an interactive experience for the user to login, even with an MSA account. + After an interactive login, MSAL must be able to silently login the MSA user. To do this, MSAL must save the + account ID in its token cache. Accounts with associated WAM account ID can be used in silent WAM flows. + + + + + Apps shouldn't rely on its presence, unless the app itself wrote it. It means that SDK should translate absence of app metadata to the default values of its required fields. + Other apps that don't support app metadata should never remove existing app metadata. + App metadata is a non-removable entity.It means there's no need for a public API to remove app metadata, and it shouldn't be removed when removeAccount is called. + App metadata is a non-secret entity. It means that it cannot store any secret information, like tokens, nor PII, like username etc. + App metadata can be extended by adding additional fields when required.Absence of any non-required field should translate to default values for those field. + + + + mandatory + + + mandatory + + + + The family id of which this application is part of. This is an internal feature and there is currently a single app, + with id 1. If familyId is empty, it means an app is not part of a family. A missing entry means unknown status. + + + + + Important: order matters. This MUST be the last one called since it will extract the + remaining fields out. + + + + + Optional. A value here means the token in an FRT. + + + + + Used to find the token in the cache. + Can be a token assertion hash (normal OBO flow) or a user provided key (long-running OBO flow). + + + + + Family Refresh Tokens, can be used for all clients part of the family + + + + + Returns all access tokens from the underlying cache collection. + If is specified, returns access tokens from that partition only. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + Not all classes that implement this method are required to filter by partition (e.g. mobile) + + + + + Returns all refresh tokens from the underlying cache collection. + If is specified, returns refresh tokens from that partition only. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + Not all classes that implement this method are required to filter by partition (e.g. mobile) + + + + + Returns all ID tokens from the underlying cache collection. + If is specified, returns ID tokens from that partition only. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + Not all classes that implement this method are required to filter by partition (e.g. mobile) + + + + + Returns all accounts from the underlying cache collection. + If is specified, returns accounts from that partition only. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + Not all classes that implement this method are required to filter by partition (e.g. mobile) + + + + + WARNING: this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + + + The dictionary serializer does not handle unknown nodes. + + + + + Specifies the reason for fetching the access token from the identity provider when using AcquireTokenSilent, AcquireTokenForClient or AcquireTokenOnBehalfOf. + + + + + When a token is found in the cache or the cache is not supposed to be hit when making the request (interactive call, username password call, device code flow, etc.) + + + + + When the token request goes to the identity provider because force_refresh was set to true. Also occurs if WithClaims() is used. + + + + + When the token request goes to the identity provider because no cached access token exists + + + + + When the token request goes to the identity provider because cached access token expired + + + + + When the token request goes to the identity provider because refresh_in was used and the existing token needs to be refreshed + + + + + + + + Details on the configuration of the ClientApplication for debugging purposes. + + + + + + + + + + + + + + Returns all the available accounts in the user token cache for the application. + + + + + + + + Get the collection by its identifier among the accounts available in the token cache, + based on the user flow. This is for Azure AD B2C scenarios. + + The identifier is the user flow being targeted by the specific B2C authority/>. + + Cancellation token + + + + Get the by its identifier among the accounts available in the token cache. + + Account identifier. The identifier is typically the + value of the property of . + You typically get the account ID from an by using the property> + + Cancellation token + + + + + + + Removes all tokens in the cache for the specified account. + + Instance of the account that needs to be removed + + + + Removes all tokens in the cache for the specified account. + + Instance of the account that needs to be removed + Cancellation token + + + + + + + + + + + + + Instructs MSAL to try to auto discover the Azure region. + + + + + + + + + + + + + + + + + + + + Stops an in-progress long-running on-behalf-of session by removing the tokens associated with the provided cache key. + See Long-running OBO in MSAL.NET. + + OBO cache key used to remove the tokens. + Cancellation token. + True if tokens are removed from the cache; false, otherwise. + is not set. + + + + + + + + + + + + + The certificate used to create this , if any. + + + + + This object is returned as part of the device code flow + and has information intended to be shown to the user about + where to navigate to login and what the device code needs + to be entered on that device. + See https://aka.ms/msal-device-code-flow. + + and + the other overrides + + + + + User code returned by the service + + + + + Device code returned by the service + + + + + Verification URL where the user must navigate to authenticate using the device code and credentials. + + + + + Time when the device code will expire. + + + + + Polling interval time to check for completion of authentication flow. + + + + + User friendly text response that can be used for display purpose. + + + + + Identifier of the client requesting device code. + + + + + List of the scopes that would be held by token. + + + + + Extensions for all AcquireToken methods + + + + + Intervenes in the request pipeline, by executing a user provided delegate before MSAL makes the token request. + The delegate can modify the request payload by adding or removing body parameters and headers. + + + The builder to chain options to + An async delegate which gets invoked just before MSAL makes a token request + The builder to chain other options to. + + + + Binds the token to a key in the cache.No cryptographic operations is performed on the token. + + + The builder to chain options to + A key id to which the access token is associated. The token will not be retrieved from the cache unless the same key id is presented. Can be null. + AAD issues several types of bound tokens. MSAL checks the token type, which needs to match the value set by ESTS. Normal POP tokens have this as "pop" + the builder + + + + Enables client applications to provide a custom authentication operation to be used in the token acquisition request. + + The builder to chain options to + The implementation of the authentication operation. + + + + + Specifies additional parameters acquired from authentication responses to be cached with the access token that are normally not included in the cache object. + these values can be read from the parameter. + + + The builder to chain options to + Additional parameters to cache + + + + + + + + + + Binds the token to a key in the cache. L2 cache keys contain the key id. + No cryptographic operations is performed on the token. + + + A key id to which the access token is associated. The token will not be retrieved from the cache unless the same key id is presented. Can be null. + AAD issues several types of bound tokens. MSAL checks the token type, which needs to match the value set by ESTS. Normal POP tokens have this as "pop" + the builder + + + + + + + + Extension method enabling MSAL.NET extenders for public client applications to set a custom web UI + that will let the user sign-in with Azure AD, present consent if needed, and get back the authorization + code + + Builder for an AcquireTokenInteractive + Customer implementation for the Web UI + the builder to be able to chain .With methods + + + + Extension methods for the + + + + + Only affects . + When enabled, mimics MSAL 4.50.0 and below behavior - checks in cache for cached tokens first, + and if not found, then uses user assertion to request new tokens from AAD. + When disabled (default behavior), doesn't search in cache, but uses the user assertion to retrieve tokens from AAD. + + + This method should only be used in specific cases for backwards compatibility. For most cases, rely on the default behavior + of and + described in https://aka.ms/msal-net-long-running-obo . + + + Whether to search in cache. + The builder to chain the .With methods + + + + The authentication parameters provided to the app token provider callback. + + + + + Specifies which scopes to request. + + + + + Correlation id of the authentication request. + + + + + A string with one or multiple claims. + + + + + Tenant id of the + + + + + Used to cancel the authentication attempt made by the token provider + + + + + Token result from external app token provider + + + This is part of an extensibility mechanism designed to be used by Azure SDK in order to + enhance managed identity support. + + + + + The actual token, usually in JWT format + + + + + Expiration of token + + Mandatory + + + + When the token should be refreshed. + + If not set, MSAL will set it to half of the expiry time if that time is longer than 2 hours. + + + + Extensibility methods for + + + + + Allows setting a callback which returns an access token, based on the passed-in parameters. + MSAL will pass in its authentication parameters to the callback and it is expected that the callback + will construct a and return it to MSAL. + MSAL will cache the token response the same way it does for other authentication results. + + This is part of an extensibility mechanism designed to be used only by Azure SDK in order to + enhance managed identity support. Only client_credential flow is supported. + + + + Extensibility methods for . + + + + + Stops an in-progress long-running on-behalf-of session by removing the tokens associated with the provided cache key. + See Long-running OBO in MSAL.NET. + + Client application to remove tokens from. + OBO cache key used to remove the tokens. + Cancellation token. + True if tokens are removed from the cache; false, otherwise. + is not set. + + + + Interface that an MSAL.NET extender can implement to provide their own web UI in public client applications + to sign-in user and have them consented part of the Authorization code flow. + MSAL.NET provides an embedded web view for Windows and Mac, but there are other scenarios not yet supported. + This extensibility point enables them to provide such UI in a secure way + + + + + Method called by MSAL.NET to delegate the authentication code web with the Secure Token Service (STS) + + URI computed by MSAL.NET that will let the UI extension + navigate to the STS authorization endpoint in order to sign-in the user and have them consent + + The redirect URI that was configured. The auth code will be appended to this redirect URI and the browser + will redirect to it. + + The cancellation token to which you should respond to. + See Task cancellation for details. + + The URI returned back from the STS authorization endpoint. This URI contains a code=CODE + parameters that MSAL.NET will extract and redeem. + + + The authorizationUri is crafted to + leverage PKCE in order to protect the token from a man in the middle attack. + Only MSAL.NET can redeem the code. + + + + + Enables the extension of the MSAL authentication process by providing a custom authentication operation. + These operations are provided through the implementation of the interface. + + + + + A delegate which gets invoked just before MSAL makes a token request. + + + + + Enables the developer to provide a custom authentication extension. + + + + + Specifies additional parameters acquired from authentication responses to be cached. + + + + + Authentication request details + + + + + Constructor. + + Apps should not have to use this constructor. It is provided for testability purposes. + + + + Parameters which will be sent in the request body, as POST parameters. + + + + + Headers which will be sent with the request. + + + + + The token endpoint, including any query parameters, where the request is being sent to. + + + + + The cancellation token associated with the request + + + + + + + + + Adds additional Http Headers to the token request. + + Parameter builder for a acquiring tokens. + additional Http Headers to add to the token request. + + + + + Extensibility methods for + + + + + Used to determine if the currently available broker is able to perform Proof-of-Possession. + + Boolean indicating if Proof-of-Possession is supported + + + + Extensions that add support for SSH certificates + + + + + Instructs AAD to return an SSH certificate instead of a Bearer token. The SSH certificate + (not the same as public / private key pair used by SSH), can be used to securely deploy + a public SSH key to a machine. See https://aka.ms/msal-net-ssh for details. + + Interactive authentication builder + The public SSH key in JWK format (https://tools.ietf.org/html/rfc7517). + Currently only RSA is supported, and the JWK should contain only the RSA modulus and exponent + A key identifier, it can be in any format. Used to distinguish between + different keys when fetching an SSH certificate from the token cache. + + + + Instructs AAD to return an SSH certificate instead of a Bearer token. Attempts to retrieve + the certificate from the token cache, and if one is not found, attempts to acquire one silently, + using the refresh token. See https://aka.ms/msal-net-ssh for details. + + + The same keyID must be used to distinguish between various + + Silent authentication builder + The public SSH key in JWK format (https://tools.ietf.org/html/rfc7517). + Currently only RSA is supported, and the JWK should contain only the RSA modulus and exponent + + + + + + We invoke this class from different threads and they all use the same HttpClient. + To prevent race conditions, make sure you do not get / set anything on HttpClient itself, + instead rely on HttpRequest objects which are thread specific. + + In particular, do not change any properties on HttpClient such as BaseAddress, buffer sizes and Timeout. You should + also not access DefaultRequestHeaders because the getters are not thread safe (use HttpRequestMessage.Headers instead). + + + + + A new instance of the HTTP manager with a retry *condition*. The retry policy hardcodes: + - the number of retries (1) + - the delay between retries (1 second) + + + + + Factory to return the instance of HttpManager based on retry configuration and type of MSAL application. + + + + + Retry policy specific to managed identity flow. + Avoid changing this, as it's breaking change. + + + + + Retry condition for /token and /authorize endpoints + + + + + + + + Method to send a request to the server using the HttpClient configured in the implementation. + + The endpoint to send the request to. + Headers to send in the http request. + Body of the request. + Http method. + Logger from the request context. + Flag to decide if MsalServiceException is thrown or the response is returned in case of 5xx errors. + Certificate used for MTLS authentication. + Custom http client which bypasses the HttpClientFactory. + This is needed for service fabric managed identity where a cert validation callback is added to the handler. + + Number of retries to be attempted in case of retriable status codes. + + + + + Check common redirect URI problems. + Optionally check that the redirect URI is not the OAuth2 standard redirect URI https://login.microsoftonline.com/common/oauth2/nativeclientb + when using a system browser, because the browser cannot redirect back to the app. + + + + + The IAccount interface represents information about a single account. + The same user can be present in different tenants, that is, a user can have multiple accounts. + An IAccount is returned in the . property, and can be used as parameters + of PublicClientApplication and ConfidentialClientApplication methods acquiring tokens such as + + + + + Gets a string containing the displayable value in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com. + This can be null. + + This property replaces the DisplayableId property of IUser in previous versions of MSAL.NET + + + + Gets a string containing the identity provider for this account, e.g. login.microsoftonline.com. + + This property replaces the IdentityProvider property of IUser in previous versions of MSAL.NET + except that IdentityProvider was a URL with information about the tenant (in addition to the cloud environment), whereas Environment is only the + + + + AccountId of the home account for the user. This uniquely identifies the user across AAD tenants. + + Can be null, for example if this account was migrated to MSAL.NET from ADAL.NET v3's token cache + + + + Interface used for creation of client applications. For details see https://aka.ms/msal-net-client-applications. + + + + + + + + + + Acquires an access token from an existing refresh token and stores it, and the refresh token, in + the user token cache, where it will be available for further AcquireTokenSilent calls. + This method can be used in migration to MSAL from ADAL v2, and in various integration + scenarios where you have a RefreshToken available. + See https://aka.ms/msal-net-migration-adal2-msal2. + + Scope to request from the token endpoint. + Setting this to null or empty will request an access token, refresh token and ID token with default scopes + The refresh token from ADAL 2.x + A builder enabling you to add optional parameters before executing the token request + + + + Provides an explicit interface for using Resource Owner Password Grant on Confidential Client. + + + + + Acquires a token without user interaction using username and password authentication. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + + Scopes requested to access a protected API. + Identifier of the user, application requests token on behalf of. + Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + User password as a string. + A builder enabling you to add optional parameters before executing the token request. + + Available only for .NET Framework and .NET Core applications. See our documentation for details. + + + + + + + + Details on the configuration of the ClientApplication for debugging purposes. + + + + + User token cache which holds ID tokens, access tokens, and refresh tokens for accounts. It's used + and updated silently if needed when calling + It is updated by each acquire token method, with the exception of which only uses the application + cache (see ). + + On .NET Framework and .NET Core you can also customize the token cache serialization. + See https://aka.ms/msal-net-token-cache-serialization. This is taken care of by MSAL.NET on mobile platforms. + It is recommended to use token cache serialization for web site and web api scenarios. + + + + + Gets the URL of the authority, or the security token service (STS) from which MSAL.NET will acquire security tokens. + The return value of this property is either the value provided by the developer in the constructor of the application, or otherwise + the value of the static member (that is https://login.microsoftonline.com/common/) + + + + + Returns all the available accounts in the user token cache for the application. + + + + + Get the by its identifier among the accounts available in the token cache and of the same + environment (authority host) as . + + Account identifier. The value of the identifier will probably have been stored value from the + value of the property of . + You typically get the account ID from an by using the property. + + + + Only for Azure AD B2C scenarios, get the collection by its identifier + among the accounts available in the token cache based on the user flow. + + The identifier is the user flow being targeted by the specific B2C authority. + + + + Attempts to acquire an access token for the from the user token cache, + with advanced parameters controlling the network call. See Acquire tokens silently. + + Scopes requested to access a protected API. + Account for which the token is requested. + An used to build the token request, adding optional + parameters. + When an interaction is required with the end user of the application, + for instance, if no refresh token was in the cache; the user needs to consent or to re-sign-in (for instance if the password expired); + or the user needs to perform two factor authentication. + + The access token is considered a match if it contains at least all the requested scopes. This means that an access token with more scopes than + requested could be returned as well. If the access token is expired or close to expiration (within a 5 minute window), + then the cached refresh token (if available) is used to acquire a new access token by making a silent network call. + + + + + Attempts to acquire an access token for the from the user token cache, + with advanced parameters controlling the network call. See Acquire tokens silently. + + Scopes requested to access a protected API. + Typically the username, in UPN format, e.g. johnd@contoso.com. + An used to build the token request, adding optional + parameters. + When an interaction is required with the end user of the application, + for instance, if no refresh token was in the cache; the user needs to consent or to re-sign-in (for instance if the password expired); + or the user needs to perform two factor authentication. + + The access token is considered a match if it contains at least all the requested scopes. This means that an access token with more scopes than + requested could be returned as well. If the access token is expired or close to expiration (within a 5 minute window), + then the cached refresh token (if available) is used to acquire a new access token by making a silent network call. + + + + + Removes all tokens in the cache for the specified account. + + Instance of the account that needs to be removed. + + + + Represents confidential client applications - web apps, web APIs, daemon applications. + + + Confidential client applications are typically applications which run on servers (web apps, web API, or even service/daemon applications). + They are considered difficult to access, and therefore capable of keeping an application secret (hold configuration + time secrets as these values would be difficult for end users to extract). + A web app is the most common confidential client. The client ID is exposed through the web browser, but the secret is passed only in the back channel + and never directly exposed. For details, see Client Applications. + + + + + Application token cache which holds access tokens for this application. It's maintained + and updated silently when calling + + On .NET Framework and .NET Core you can also customize the token cache serialization. + See Token Cache Serialization. This is taken care of by MSAL.NET on other platforms. + + + + + Acquires a token from the authority configured in the app using the authorization code + previously received from the identity provider using the OAuth 2.0 authorization code flow. + See Authorization Code Flow. + This flow is usually used in web apps (for instance, ASP.NET and ASP.NET Core web apps) + which sign-in users and can request an authorization code. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + + Scopes requested to access a protected API. + The authorization code received from the service authorization endpoint. + A builder enabling you to add optional parameters before executing the token request. + + + + Acquires a token from the authority configured in the app for the confidential client itself (not for a user) + using the client credentials flow. See Client Credentials Flow. + During this operation MSAL will first search in the cache for an unexpired token before acquiring a new one from Microsoft Entra ID. + + Scopes requested to access a protected API. For this flow (client credentials), the scopes + should be in the form of "{ResourceIdUri/.default}" for instance https://management.azure.net/.default or, for Microsoft + Graph, https://graph.microsoft.com/.default as the requested scopes are defined statically in the application registration + in the portal, and cannot be overridden in the application. + A builder enabling you to add optional parameters before executing the token request. + + + + Acquires an access token for this application (usually a web API) from the authority configured in the application, + in order to access another downstream protected web API on behalf of a user using the OAuth 2.0 On-Behalf-Of flow. + During this operation MSAL will first search in the cache for an unexpired token before acquiring a new one from Microsoft Entra ID. + See On-Behalf-Of Flow. + + Scopes requested to access a protected API. + Instance of containing credential information about + the user on behalf of whom to get a token. + A builder enabling you to add optional parameters before executing the token request. + + Pass an access token (not an ID token) which was used to access this application in the + userAssertion parameter. + For long-running or background processes in web API, see Long-running OBO in MSAL.NET. + + + + + Computes the URL of the authorization request letting the user sign-in and consent to the application accessing specific scopes in + the user's name. The URL targets the /authorize endpoint of the authority configured in the application. + + Scopes requested to access a protected API. + A builder enabling you to add optional parameters before executing the token request to get the + URL of the authorization endpoint with the specified parameters. + + + + In confidential client apps use instead. + + + + + Use in web apps and web APIs, and use a token cache serializer for better security and performance. See https://aka.ms/msal-net-cca-token-cache-serialization. + + + + + Methods for long-running or background processes in web APIs. + + + + + Acquires an access token for this web API from the authority configured in the application, + in order to access another downstream protected web API on behalf of a user using the OAuth 2.0 On-Behalf-Of flow. + See Long-running OBO in MSAL.NET. + Pass an access token (not an ID token) which was used to call this confidential client application in the + userToken parameter. + Use to stop the long running process + and remove the associated tokens from the cache. + + + This method should be called once when the long-running session is started. + + Scopes requested to access a protected API. + A JSON Web Token which was used to call this web API and contains the credential information + about the user on behalf of whom to get a token. + Key by which to look up the token in the cache. + If null, it will be set to the assertion hash of the userToken by default. + A builder enabling you to add other parameters before executing the token request. + + + + Retrieves an access token from the cache using the provided cache key that can be used to + access another downstream protected web API on behalf of a user using the OAuth 2.0 On-Behalf-Of flow. + See Long-running OBO in MSAL.NET. + Use to stop the long running process + and remove the associated tokens from the cache. + + + This method should be called during the long-running session to retrieve the token from the cache. + + Scopes requested to access a protected API. + Key by which to look up the token in the cache. + A builder enabling you to add other parameters before executing the token request. + The token cache does not contain a token + with an OBO cache key that matches the . + + + + Component to be used with managed identity applications for Azure resources. + + + + + Acquires token for a managed identity configured on Azure resource. See https://aka.ms/msal-net-managed-identity. + + resource requested to access the protected API. For this flow (managed identity), the resource + should be of the form "{ResourceIdUri}" or {ResourceIdUri/.default} for instance https://management.azure.net or, for Microsoft + Graph, https://graph.microsoft.com/.default. + A builder enabling you to add optional parameters before executing the token request + You can also chain the following optional parameters: + + + + + + ADFS seems to support tenanted authorities, but the tenant ID is fixed so for all intents and purposes + it remains constant + + + + + + + + + Must be kept immutable + + + + + Figures out the authority based on the authority from the config and the authority from the request, + and optionally the homeAccountTenantId, which has an impact on AcquireTokenSilent + + The algorithm is: + + 1. If there is no request authority (i.e. no authority override), use the config authority. + 1.1. For AAD, if the config authority is "common" etc, try to use the tenanted version with the home account tenant ID + 2. If there is a request authority, try to use it. + 2.1. If the request authority is not "common", then use it + 2.2 If the request authority is "common", ignore it, and use 1.1 + + Special cases: + + - if the authority is not defined at the application level and the request level is not AAD, use the request authority + - if the authority is defined at app level, and the request level authority of is of different type, throw an exception + + + + + + Changes the tenant ID of the authority, if the authority supports tenants. If not, throws exception. + + The new tenant ID + Forces the change, even if the current tenant is not "common" or "organizations" or "consumers" + + + + This object is at REQUEST level. + + + + + Translates CIAM authorities into a usable form. This is needed only until ESTS is updated to support the north star format + North star format: https://idgciamdemo.ciamlogin.com + Transformed format: https://idgciamdemo.ciamlogin.com/idgciamdemo.onmicrosoft.com + + + + + Provides instance metadata across all authority types. Deals with metadata caching. + + + + + Priority order of metadata providers: + + If user provided metadata via use it exclusively. Otherwise: + + 1. Static cache (this is populated from the network) + 2. Well-known cache if all environments present in the token cache are known (this is hard-coded into MSAL) + 3. Cache stored in token cache (Not currently implemented) + 5. AAD discovery endpoint + 6. If going to the network fails with an error different than "invalid_instance" (i.e.authority validation failed), use the well-known instance metadata entry for the given authority + 7. On failure, use the authority itself(i.e.preferred cache = preferred network = aliases = configured_authority) + + Spec: https://identitydivision.visualstudio.com/DevEx/_git/AuthLibrariesApiReview?path=%2FInstance%20Discovery%20Caching%2Fdesktop_web_caching.md + + + + + AAD performs authority validation by calling the instance metadata endpoint. This is a bit unfortunate, + because instance metadata is used for aliasing, and authority validation is orthogonal to that. + MSAL must figure out aliasing even if ValidateAuthority is set to false. + + + + + Validates the authority. This is specific to each authority type. + + + + + + + + Gets the azure region and adds telemetry to the ApiEvents + + Returns null if region should not be used or cannot be discovered. + + + + Indicates where the region information came from. + + + + + Indicates that the API .WithAzureRegion() was not used + + + + + Auto-detection failed, fallback to global + + + + + Auto-detected from MSAL's static cache + + + + + Auto-detected from Env Variable + + + + + Auto-detected from IMDS + + + + + Indicates where the region information came from. + + + + + Indicates that the API .WithAzureRegion() was not used + + + + + Region provided by the user, matches auto detected region + + + + + Region provided by the user, auto detection cannot be done + + + + + Region provided by the user, does not match auto detected region + + + + + Region autodetect requested and was successful + + + + + Region autodetect requested but failed. Fallback to global + + + + + For Android there are from: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/blob/dev/common/src/main/java/com/microsoft/identity/common/internal/broker/BrokerResult.java + + + + + If device auth is required but the broker is not enabled, AAD will + signal this by returning an URL pointing to the broker app that needs to be installed. + + + + + For platforms that do not support a broker + + + + + The OID claim is a unique identifier (GUID) for the user object in Azure AD. + Guest Users have different OID. + This is a stable ID across all apps. + + IMPORTANT: There are rare cases where this is missing! + + + Avoid using as it is not guaranteed non-null. Use instead. + + + + + The sub claim is a unique identifier for user + app. + + + + + When outside of a request, the normal logger (requestContext.Logger) is not available. + This logger is at the app level - it is just not tied to a correlation ID. + + + + + Encryption algorithm used, e.g. ES256 + https://tools.ietf.org/html/rfc7515#section-4.1.1 + + + + + The type of token e.g. JWT + https://tools.ietf.org/html/rfc7519#section-5.1 + + + + + Key ID, can be an X509 cert thumbprint. When used with a JWK, the "kid" value is used to match a JWK "kid" + parameter value + https://tools.ietf.org/html/rfc7515#section-4.1.4 + + + + + MSAL Flavor: .NET or WinRT + + + + + MSAL assembly version + + + + + Version of the operating system. This will not be sent on WinRT + + + + + Device model. This will not be sent on .NET + + + + + This class adds additional query parameters or headers to the requests sent to STS. This can help us in + collecting statistics and potentially on diagnostics. + + + + + One and only one ApiEvent is associated with each request. + + + + + This class is responsible for merging app level and request level parameters. + Not all parameters need to be merged - app level parameters can be accessed via AppConfig property + + + + + Authority is the URI used by MSAL for communication and storage + During a request it can be updated: + - with the preferred environment + - with actual tenant + + + + + Indicates if the user configured claims via .WithClaims. Not affected by Client Capabilities + + If user configured claims, request should bypass cache + + + + If set, MSAL should add the key / value pairs from the provider to the token endpoint instead of generating a client assertion + + + + + User assertion is null when is called. + + + + + User-provided cache key for long-running OBO flow. + + + + + Handles requests that are non-interactive. Currently MSAL supports Integrated Windows Auth (IWA). + + + + + This class decides the workflow of an interactive request. The business rules are: + + 1. If WithBroker is set to true + 1.1. Attempt to invoke the broker and get the token + 1.2. If this fails, e.g. if broker is not installed, the use a web view (goto 2) + + 2. Use a webview and get an auth code and look at the auth code + 2.1. If the auth code has a special format, showing that a broker is needed then. Invoke the broker flow (step 1) with a broker installation URL + 2.2. Otherwise exchange the auth code for tokens (normal authorize_code grant) + + + + + Base class for all flows. Use by implementing + and optionally calling protected helper methods such as SendTokenRequestAsync, which know + how to use all params when making the request. + + + + + Return a custom set of scopes to override the default MSAL logic of merging + input scopes with reserved scopes (openid, profile etc.) + Leave as is / return null otherwise + + + + + Creates the region Details + + + + + + + Handles requests that are non-interactive. Currently MSAL supports Integrated Windows Auth. + + + + + Responsible for getting an auth code + + + + + Fire and forget the fetch action on a background thread. + Do not change to Task and do not await it. + + + + + This logger does not contain a correlation ID and should be used only when the correlation ID is not available + i.e. before a request exists + + + + + + + + + + + + + + + + Bearer token type for telemetry. + + + Pop token type for telemetry. + + + Ssh-cert token type for telemetry. + + + Token type for legacy AT POP + + + Extension token type for telemetry. This is used for custom token types added to MSAL as extensions through IAuthenticationOperation. + + + + For expensive logging messages (e.g. when the log message evaluates a variable), + it is better to check the log level ahead of time so as not to evaluate the expensive message and then discard it. + + + + + Extension methods for ILoggerAdapter + + + + + This method is used to avoid string concatenation when the log level is not enabled. + + + + + This method is used to avoid string concatenation when the log level is not enabled. + + + + + This exception is thrown when Intune requires app protection policy. + The information in this exception can be used by app to obtain the required + enrollment ID from Mobile App Management (MAM) SDK. + See https://aka.ms/msal-net-trueMAM + + + + + UPN of the user + + + + + Local account id + + + + + Tenant ID of the App + + + + + Authority URL + + + + + Initializes a new instance of the exception class with a specified + error code and error message. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + Represents public client applications - desktop and mobile applications. + + + Public client applications are not trusted to safely keep application secrets and therefore they can only access web APIs in the name of the authenticating user. + See Client Applications. + + Unlike , public clients are unable to securely store secrets on a client device and as a result do not require the use of a client secret. + + + The redirect URI needed for interactive authentication is automatically determined by the library. It does not need to be passed explicitly in the constructor. Depending + on the authentication strategy (e.g., through the Web Account Manager, the Authenticator app, web browser, etc.), different redirect URIs will be used by MSAL. Redirect URIs must always be configured for the application in the Azure Portal. + + + + + + Tells if the application can use the system web browser, therefore enabling single-sign-on with web applications. + By default, MSAL will try to use a system browser on the mobile platforms, if it is available. + See our documentation for more details. + + + On Windows, macOS, and Linux a system browser can always be used, except in cases where there is no UI (e.g., a SSH session). + On Android, the browser must support tabs. + + Returns true if MSAL can use the system web browser. + + + + Acquires a token interactively for the specified scopes. Either a system browser, an embedded browser, or a broker will + handle this request, depending on the version of .NET framework used and on configuration. + For Microsoft Entra applications, a broker is recommended. See Windows Broker. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + See Interactive Authentication. + + Scopes requested to access a protected API. + A builder enabling you to add optional parameters before executing the token request. + The user will be signed-in interactively and will consent to scopes, as well as perform a multi-factor authentication step if such a policy was enabled in the Azure AD tenant. + + + + + Acquires a token on a device without a web browser by letting the user authenticate on + another device. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + + + The token acquisition is done in two steps: + + The method first acquires a device code from the authority and returns it to the caller via + the . This callback takes care of interacting with the user + to direct them to authenticate (i.e., to a specific URL, with a code). + The method then proceeds to poll for the security + token which is granted upon successful login by the user based on the device code information. + + See Device Code Flow. + + Scopes requested to access a protected API. + Callback containing information to show the user about how to authenticate and enter the device code. + A builder enabling you to add optional parameters before executing the token request. + + + + + This API is no longer recommended and will be deprecated in future versions in favor of + similar functionality via the Windows broker (WAM). + WAM does not require any setup for desktop apps to login with the Windows account. + + + Acquires a token non-interactively for the signed-in user in Windows + via Integrated Windows Authentication. + The account used in this overrides is pulled from the operating system as the current user principal name. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + + + Scopes requested to access a protected API. + A builder enabling you to add optional parameters before executing the token request. + + See our documentation for more details. + + + + + Non-interactive request to acquire a token via username and password authentication. + + Scopes requested to access a protected API + Identifier of the user application requests token on behalf. + Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + User password as a secure string. + A builder enabling you to add optional parameters before executing the token request + + Available only for .NET Framework and .NET Core applications. See our documentation for details. + .NET no longer recommends using SecureString and MSAL puts the plaintext value of the password on the wire, as required by the OAuth protocol. See SecureString documentation for details. + + + + + Acquires a token without user interaction using username and password authentication. + This method does not look in the token cache, but stores the result in it. Before calling this method, use other methods + such as to check the token cache. + + Scopes requested to access a protected API. + Identifier of the user application requests token on behalf. + Generally in UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + User password as a string. + A builder enabling you to add optional parameters before executing the token request. + + Available only for .NET Framework and .NET Core applications. See our documentation for details. + + + + + Notification for certain token cache interactions during token acquisition. This delegate is + used in particular to provide a custom token cache serialization. + See https://aka.ms/aka.ms/msal-net-token-cache-serialization + + Arguments related to the cache item impacted + + + + This is the interface that implements the public access to cache operations. + With CacheV2, this should only be necessary if the caller is persisting + the cache in their own store, since this will provide the serialize/deserialize + and before/after notifications used in that scenario. + See https://aka.ms/aka.ms/msal-net-token-cache-serialization + + + + + Sets a delegate to be notified before any library method accesses the cache. This gives an option to the + delegate to deserialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization. + If you need async/task-based callbacks, please use SetBeforeAccessAsync instead. + + Delegate set in order to handle the cache deserialization + When the delegate is used to deserialize the cache, it might + want to call + + + + Sets a delegate to be notified after any library method accesses the cache. This gives an option to the + delegate to serialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization. + If you need async/task-based callbacks, please use SetAfterAccessAsync instead. + + Delegate set in order to handle the cache serialization + In the case where the delegate is used to serialize the cache entirely (not just a row), it might + want to call + + + + Sets a delegate called before any library method writes to the cache. This gives an option to the delegate + to reload the cache state from a row in database and lock that row. That database row can then be unlocked in the delegate + registered with + If you need async/task-based callbacks, please use SetBeforeWriteAsync instead. + + Delegate set in order to prepare the cache serialization + + + + Sets a delegate to be notified before any library method accesses the cache. This gives an option to the + delegate to deserialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization. + This provides the same functionality as SetBeforeAccess but it provides for an async/task-based callback. + + Delegate set in order to handle the cache deserialization + In the case where the delegate is used to deserialize the cache, it might + want to call + + + + Sets a delegate to be notified after any library method accesses the cache. This gives an option to the + delegate to serialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization. + This provides the same functionality as SetAfterAccess but it provides for an async/task-based callback. + + Delegate set in order to handle the cache serialization + In the case where the delegate is used to serialize the cache entirely (not just a row), it might + want to call + + + + Sets a delegate called before any library method writes to the cache. This gives an option to the delegate + to reload the cache state from a row in database and lock that row. That database row can then be unlocked in the delegate + registered with + This provides the same functionality as SetBeforeWrite but it provides for an async/task-based callback. + + Delegate set in order to prepare the cache serialization + + + + Returns a RT for the request. If familyId is specified, it tries to return the FRT. + + + + + FOCI - check in the app metadata to see if the app is part of the family + + null if unknown, true or false if app metadata has details + + + + Shows if MSAL's in-memory token cache has any kind of RT or non-expired AT. Does not trigger a cache notification. + Ignores ADAL's cache. + + + + + True when MSAL has been configured to fire the serialization events i.e. external token caching is enabled. + + + + + This interface will be available in TokenCacheNotificationArgs callback to enable serialization/deserialization of the cache. + + + The methods in this class are not thread safe. It is expected that they will be called from the token cache callbacks, + registered via SetBeforeAccess, SetAfterAccess. These callbacks thread safe because they are triggered sequentially. + + + + + Serializes the token cache to the MSAL.NET 3.x cache format, which is compatible with other MSAL desktop libraries, including MSAL.NET 4.x, MSAL for Python and MSAL for Java. + If you need to maintain SSO between an application using ADAL 3.x and this application using MSAL 3.x or later, + you might also want to serialize and deserialize with /, + otherwise just use /. + + Byte stream representation of the cache + + This is the recommended format for maintaining SSO state between applications. + / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + + + + + Deserializes the token cache to the MSAL.NET 3.x cache format, which is compatible with other MSAL desktop libraries, including MSAL.NET 4.x, MSAL for Python and MSAL for Java. + If you need to maintain SSO between an application using ADAL 3.x and this application using MSAL 3.x or later, + you might also want to serialize and deserialize with /, + otherwise just use /. + + Byte stream representation of the cache + + Set to true to clear MSAL cache contents. Defaults to false. + You would want to set this to true if you want the cache contents in memory to be exactly what's on disk. + You would want to set this to false if you want to merge the contents of what's on disk with your current in memory state. + + + This is the recommended format for maintaining SSO state between applications. + / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + + + + + Serializes a part of the token cache - the refresh tokens - to the ADAL.NET 3.x cache format. + If you need to maintain SSO between an application using ADAL 3.x and this application using MSAL 3.x or later, + use / in addition to /. + + See https://aka.ms/adal-to-msal-net/cache for details on how to use this advanced API correctly. + + Byte stream representation of the cache + + Do not use / without also using /, + because only refresh tokens are exported in this format. Your applications will not cache access token and id tokens, + and will instead need to get them from the identity provider (AAD), which will eventually throttle you. + Later versions of ADAL (4.x and 5.x) use the same cache format as MSAL. + Only / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + ADAL to MSAL cache interop is only available for public client scenarios and for web site scenario. + + + + + Deserializes a part of the token cache - the refresh tokens - to the ADAL.NET 3.x cache format. + This API should only be used to maintain SSO between an application using ADAL 3.x and this application using MSAL 3.x or later. + Use / in addition to /. + + See https://aka.ms/adal-to-msal-net/cache for details on how to use this advanced API correctly. + + Byte stream representation of the cache + + Do not use / without also using /, + because only refresh tokens are exported in this format. Your applications will not cache access token and id tokens, + and will instead need to get them from the identity provider (AAD), which will eventually throttle you. + Later versions of ADAL (4.x and 5.x) use the same cache format as MSAL. + Only / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + ADAL to MSAL cache interop is only available for public client scenarios and for web site scenario. + + + + + Serializes the token cache to the MSAL.NET 2.x unified cache format, which is compatible with ADAL.NET v4 and other MSAL.NET v2 applications. + If you need to maintain SSO between an application using ADAL 3.x or MSAL 2.x and this application using MSAL 3.x, + you might also want to serialize and deserialize with / or /, + otherwise just use /. + + Byte stream representation of the cache + + / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + + + + + Deserializes the token cache to the MSAL.NET 2.x cache format, which is compatible with ADAL.NET v4 and other MSAL.NET v2 applications. + If you need to maintain SSO between an application using ADAL 3.x or MSAL 2.x and this application using MSAL 3.x, + you might also want to serialize and deserialize with / or /, + otherwise just use /. + + Byte stream representation of the cache + + / is compatible with other MSAL libraries such as MSAL for Python and MSAL for Java. + + + + + The Kerberos key types used in this assembly. + + + + + None. + + + + + dec-cbc-crc ([RFC3961] section 6.2.3) + + + + + des-cbc-md5 ([RFC3961] section 6.2.1) + + + + + aes128-cts-hmac-sha1-96 ([RFC3962] section 6) + + + + + aes256-cts-hmac-sha1-96 ([RFC3962] section 6) + + + + + Class for Kerberos tickets that are included as claims and used as a supplemental token in an OAuth/OIDC + protocol response. + + + + + Get or Sets the client key used to encrypt the client portion of the ticket. + This is optional. This will be null if KeyType is null. + This MUST be protected in the protocol response. + + + + + Get or Sets the client key type.This is optional.This will be null if ClientKey is null. + + + + + Get or Sets the Base64 encoded KERB_MESSAGE_BUFFER + + + + + Get or Sets the error message that server encountered when creating a ticket granting ticket. + + + + + Get or Sets the Kerberos realm/domain name. + + + + + Get or Sets the target service principal name (SPN). + + + + + Get or Sets the client name. Depending on the ticket, this can be either a UserPrincipalName or SamAccountName. + + + + + Creates a new instance of class. + + + + + Creates a new instance of class with error message. + + Error message to be set. + + + + Creates a string representation of the data captured in the Kerberos supplemental ticket. + + A string containing the realm, service principal name, client name, and key type. + + + + Helper class to manage Kerberos Ticket Claims. + + + + + Creates a object from given ID token string.. + + ID token string. + A object if a Kerberos Ticket Claim exists in the given + idToken parameter and is parsed correctly. Null, otherwise. + + + + Save current Kerberos Ticket to current user's Ticket Cache. + + Kerberos ticket object to save. + Throws when given ticket parameter is not a valid Kerberos supplemental ticket. + Throws if error occurs while saving ticket information into Ticket Cache. + + + + + Save current Kerberos Ticket to current user's Ticket Cache. Windows only. + + Kerberos ticket object to save. + The Logon Id of the user owning the ticket cache. + The default of 0 represents the currently logged on user. + Throws when given ticket parameter is not a valid Kerberos supplemental ticket. + Throws if error occurs while saving ticket information into Ticket Cache. + + + + + Reads a Kerberos Service Ticket associated with given service principal name from + current user's Ticket Cache. Windows only. + + Service principal name to find associated Kerberos Ticket. + Byte stream of searched Kerberos Ticket information if exists. Null, otherwise. + + Throws if error occurs while searching ticket information from Ticket Cache. + + + + + Reads a Kerberos Service Ticket associated with given service principal name from + current user's Ticket Cache. + + Service principal name to find associated Kerberos Ticket. + The Logon Id of the user owning the ticket cache. + The default of 0 represents the currently logged on user. + Byte stream of searched Kerberos Ticket information if exists. Null, otherwise. + + Throws if error occurs while searching ticket information from Ticket Cache. + + + + + Gets the KRB-CRED Kerberos Ticket information as byte stream. + + Kerberos ticket object to save. + Byte stream representation of KRB-CRED Kerberos Ticket if it contains valid ticket information. + Null, otherwise. + + + + Generate a Kerberos Ticket Claim string. + + Service principal name to use. + Ticket container to use. + A Kerberos Ticket Claim string if valid service principal name was given. Empty string, otherwise. + + + + Declares the type of container to use for Kerberos Ticket Claim. + + + + + Use the Id token as the Kerberos Ticket container. + (NOTE) MSAL will read out Kerberos Service Ticket from received id token, cache into current user's + ticket cache, and return it as KerberosSupplementalTicket object in AuthenticationResult. + + + + + Use the Access Token as the Kerberos Ticket container. + (NOTE) MSAL will not read out Kerberos Service Ticket from received access token. Caller should handle + received access token directly to use for next service request. + + + + + Callback delegate that allows application developers to consume logs, and handle them in a custom manner. This + callback is set using . + If PiiLoggingEnabled is set to true, when registering the callback this method will receive the messages twice: + once with the containsPii parameter equals false and the message without PII, + and a second time with the containsPii parameter equals to true and the message might contain PII. + In some cases (when the message does not contain PII), the message will be the same. + For details see https://aka.ms/msal-net-logging + + Log level of the log message to process + Pre-formatted log message + Indicates if the log message contains Organizational Identifiable Information (OII) + or Personally Identifiable Information (PII) nor not. + + + + Represents log level in MSAL. + For details, see MSAL logging. + + + + + Includes logs of important health metrics to help with diagnostics of MSAL operations. + + + + + Includes logs when something has gone wrong and an error was generated. Used for debugging and identifying problems. + + + + + Includes logs in scenarios when there hasn't necessarily been an error or failure, but are intended for diagnostics and pinpointing problems. + + + + + Default. Includes logs of general events intended for informational purposes, not necessarily intended for debugging. + + + + + Includes logs of the full details of library behavior. + + + + + Class to be used for managed identity applications (on Azure resources like App Services, Virtual Machines, Azure Arc, Service Fabric and Cloud Shell). + + + Managed identity can be enabled on Azure resources as a system assigned managed identity or a user assigned managed identity. + + + + + + + + Detects and returns the managed identity source available on the environment. + + Managed identity source detected on the environment if any. + + + + Class to initialize a managed identity and identify the service. + + + + + The requested access token. + + When you call a secured REST API, the token is embedded in the Authorization + request header field as a "bearer" token, + allowing the API to authenticate the caller. + + + + The timespan when the access token expires. + + The date is represented as the number of seconds from "1970-01-01T0:0:0Z UTC" + (corresponds to the token's exp claim). + + + + The resource the access token was requested for. + + Which matches the resource query string parameter of the request. + + + + The type of token returned by the Managed Identity endpoint. + + which is a "Bearer" access token, which means the resource + can give access to the bearer of this token. + + + + A unique identifier generated by Azure AD for the Azure Resource. + + The Client ID is a GUID value that uniquely identifies the application + and its configuration within the identity platform + + + + Managed identity sources supported. The library will handle these internally. + + + + + Default. + + + + + The source to acquire token for managed identity is IMDS. + + + + + The source to acquire token for managed identity is App Service. + + + + + The source to acquire token for managed identity is Azure Arc. + + + + + The source to acquire token for managed identity is Cloud Shell. + + + + + The source to acquire token for managed identity is Service Fabric. + + + + + Indicates that the source is defaulted to IMDS since no environment variables are set. + This is used to detect the managed identity source. + + + + + The source to acquire token for managed identity is Machine Learning Service. + + + + + MSAL-wide metrics. + + + + + Total tokens obtained by MSAL from the identity provider. + + + + + Total tokens obtained by MSAL from cache. + + + + + Total tokens obtained by MSAL from broker. + + + + + Total time, in milliseconds, spent in MSAL for all requests. Aggregate of . + + + + + This exception indicates that claims have been returned from the endpoint that need to be resolved. This can be achieved by using them in the next authentication request. + See Conditional Access and claims challenges. + See Handling multifactor auth (MFA), Conditional Access, and incremental consent. + + + + + Initializes a new instance of the exception class with a specified + error code and error message. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + A higher level description for this exception, that allows handling code to + understand what type of action it needs to take to resolve the issue. + + + + This exception class represents errors that are local to the library or the device. Contrary to + which represent errors happening from the Azure AD service or + the network. For more details, see https://aka.ms/msal-net-exceptions + + + + + Initializes a new instance of the exception class with a specified + error code. + + + The error code returned by the service or generated by client. This is the code you can rely on + for exception handling. + + + + Initializes a new instance of the exception class with a specified + error code and error message. + + + The error code returned by the service or generated by client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception. + + + The error code returned by the service or generated by client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + + Error code returned as a property in MsalException + + + + + Standard OAuth2 protocol error code. It indicates that the application needs to expose the UI to the user + so that the user does an interactive action in order to get a new token. + Mitigation: If your application is a call AcquireTokenInteractive + perform an interactive authentication. If your application is a chances are that the Claims member + of the exception is not empty. See for the right mitigation + + + + + Standard OAuth2 protocol error code. It indicates that the application needs to expose the UI to the user + so the user can do an interactive log-in to get a token with updated claims. + Mitigation: If your application is a call AcquireTokenInteractive + perform an interactive authentication. If your application is a chances are that the Claims member + of the exception is not empty. See for the right mitigation + + + + + No token was found in the token cache. + Mitigation: If your application is a call AcquireTokenInteractive so + that the user of your application signs-in and accepts consent. + + + If it's a web app you should have previously called IConfidentialClientApplication.AcquireTokenByAuthorizationCode + as described in https://aka.ms/msal-net-authorization-code. You need to make sure that you have requested the right scopes. For details + See https://github.com/Azure-Samples/ms-identity-aspnetcore-webapp-tutorial + + This error should not happen in web APIs + + + + + + This error code comes back from calls when a null user is + passed as the account parameter. This can be because you have called AcquireTokenSilent with an account parameter + set to accounts.FirstOrDefault() but accounts is empty. + Mitigation + Pass a different account, or otherwise call + + + + + This error code comes back from + calls when a null user assertion is passed as the UserAssertion parameter. + Mitigation + Pass a valid value for user assertion + + + + + This error code comes back from calls when the + user is passed as the account parameter. Only some brokers (WAM) can login the current user. + Mitigation + On Windows, use the broker via .WithBroker(true), use a different account, or otherwise call + + + + + This error code denotes that no account was found having the given login hint. + What happens? + + or + was called with a loginHint parameter which does not match any account in + Mitigation + If you are certain about the loginHint, call + + + + + This error code denotes that multiple accounts were found having the same login hint and MSAL + cannot choose one. Please use to specify the account + + + + + This error code comes back from calls when + the user cache had not been set in the application constructor. This should never happen in MSAL.NET 3.x as the cache is created by the application + + + + + One of two conditions was encountered: + + The Prompt.NoPrompt was passed in an interactive token call, but the constraint could not be honored because user interaction is required, + for instance because the user needs to re-sign-in, give consent for more scopes, or perform multiple factor authentication. + + + An error occurred during a silent web authentication that prevented the authentication flow from completing in a short enough time frame. + + + Remediation:call AcquireTokenInteractive so that the user of your application signs-in and accepts consent. + + + + + Service is unavailable and returned HTTP error code within the range of 500-599 + Mitigation you can retry after a delay. + + + + + The HTTP Request to the STS timed out. + Mitigation you can retry after a delay. + + + + + Service returned HTTP error code 429 which indicates the request has been throttled. + For more details see https://aka.ms/msal-net-throttling + + + + + loginHint should be a UPN + What happens? An override of a token acquisition operation was called in which + takes a loginHint as a parameters, but this login hint was not using the UserPrincipalName (UPN) format, e.g. john.doe@contoso.com + expected by the service + Remediation Make sure in your code that you enforce loginHint to be a UPN + + + + + No passive auth endpoint was found in the OIDC configuration of the authority + What happens? When the libraries go to the authority and get its open id connect configuration + it expects to find a Passive Auth Endpoint entry, and could not find it. + remediation Check that the authority configured for the application, or passed on some overrides of token acquisition tokens + supporting authority override is correct + + + + + Invalid authority + What happens When the library attempts to discover the authority and get the endpoints it needs to + acquire a token, it got an un-authorize HTTP code or an unexpected response + remediation Check that the authority configured for the application, or passed on some overrides of token acquisition tokens + supporting authority override is correct + + + + + Invalid authority type. + MSAL.NET does not know how to interact with the authority specified when the application was built. + Mitigation + Use a different authority + + + + + Missing Tenanted Authority. + MSAL.NET requires a tenanted authority (i.e., an authority with a tenant ID) for mTLS to be specified when the application is built, but none was provided. + Mitigation + Ensure that a tenanted authority, which includes a specific tenant ID, is specified during the application configuration. + For example, use "https://login.microsoftonline.com/{tenantId}" or a similar URL structure. + + + + + The client is unauthorized to access resource. + This commonly happens when Mobile App Management (MAM) policies are enabled. MSAL will throw an exception in that case with protection_policy_required sub-error. + Mitigation + Catch the exception and use the properties in it to obtain the right parameters from Intune SDK. + IntuneAppProtectionPolicyRequiredException + + + + + Unknown Error occurred. + Mitigation None. You might want to inform the end user. + + + + + Unknown broker error occurred. + Mitigation None. You might want to inform the end user. + + + + + WAM Signout failed. + + + + + Authentication failed. + What happens? + The authentication failed. For instance the user did not enter the right password + Mitigation + Inform the user to retry. + + + + + Authority validation failed. + What happens? + The validation of the authority failed. This might be because the authority is not + compliant with the OIDC standard, or there might be a security issue + Mitigation + Use a different authority. If you are absolutely sure that you can trust the authority + you can use the passing + the validateAuthority parameter to false (not recommended) + + + + + Invalid owner window type. + What happens? + You used "AcquireTokenInteractiveParameterBuilder.WithParentActivityOrWindow(object) + but the parameter you passed is invalid. + Remediation + On .NET Standard, the expected object is an Activity on Android, a UIViewController on iOS, + a NSWindow on MAC, and a IWin32Window or IntPr on Windows. + If you are in a WPF application, you can use WindowInteropHelper(wpfControl).Handle to get the window + handle associated with a WPF control + + + + + Encoded token too long. + What happens + In a confidential client application call, the client assertion built by MSAL is longer than + the max possible length for a JWT token. + + + + + User Mismatch. + + + + + Failed to refresh token. + What happens? + The token could not be refreshed. This can be because the user has not used the application for a long time. + and therefore the refresh token maintained in the token cache has expired + Mitigation + If you are in a public client application, that supports interactivity, send an interactive request + . Otherwise, + use a different method to acquire tokens. + + + + + Failed to acquire token silently. Used in broker scenarios. + What happens + you called + or and your + mobile (Xamarin) application leverages the broker (Microsoft Authenticator or Microsoft Company Portal), but the broker + was not able to acquire the token silently. + Mitigation + Call + + + + + RedirectUri validation failed. + What happens? + The redirect URI / reply URI is invalid + How to fix + Pass a valid redirect URI. + + + + + The request could not be preformed because of an unknown failure in the UI flow.* + Mitigation + Inform the user. + + + + + Internal error + + + + + Accessing WS Metadata Exchange Failed. + What happens? + You tried to use + and the account is a federated account. + Mitigation + None. The WS metadata was not found or does not correspond to what was expected. + + + + + Federated service returned error. + Mitigation + None. The federated service returned an error. You can try to look at the + Body of the exception for a better understanding of the error and choose + the mitigation + + + + + User Realm Discovery Failed. + + + + + Resource Owner Password Credential (ROPC) grant attempted with an MSA (Microsoft personal) account. + ROPC does not support MSA accounts. + See https://aka.ms/msal-net-ropc for details. + + + + + Federation Metadata URL is missing for federated user. + + + + + Parsing WS Metadata Exchange Failed. + + + + + WS-Trust Endpoint Not Found in Metadata Document. + + + + + You can get this error when using + In the case of a Federated user (that is owned by a federated IdP, as opposed to a managed user owned in an Azure AD tenant) + ID3242: The security token could not be authenticated or authorized. + The user does not exist or has entered the wrong password + + + + + This can occur if there is an configuration issue in the ADFS environment where this is authenticating. See https://aka.ms/msal-net-iwa-troubleshooting for more details + + + + + What happens + You can get this error when using + The user is not recognized as a managed user, or a federated user. Azure AD was not + able to identify the IdP that needs to process the user + Mitigation + Inform the user. the login that the user provided might be incorrect. + + + + + What happens + You can get this error when using + The user is not known by the IdP + Mitigation + Inform the user. The login that the user provided might be incorrect (for instance empty) + + + + + Failed to get user name. + + + + + Password is required for managed user. + What happens? + If can got this error when using + and you (or the user) did not provide a password. + + + + + Request is invalid. + What happens? + This can happen because you are using a token acquisition method which is not compatible with the authority. For instance: + you called + but you used an authority ending with '/common' or '/consumers' as this requires a tenanted authority or '/organizations'. + Mitigation + Adjust the authority to the AcquireTokenXX method you use (don't use 'common' or 'consumers' with + + + + + + Cannot access the user from the OS (UWP) + What happens + You called , but the domain user + name could not be found. + Mitigation + This might be because you need to add more capabilities to your UWP application in the Package.appxmanifest. + See https://aka.ms/msal-net-uwp + + + + + Cannot get the user from the OS (UWP) + What happens + You called , but the domain user + name could not be found. + Mitigation + This might be because you need to add more capabilities to your UWP application in the Package.appxmanifest. + See https://aka.ms/msal-net-uwp + + + + + An error response was returned by the OAuth2 server and it could not be parsed + + + + + What happens? + In the context of Device code flow (See https://aka.ms/msal-net-device-code-flow), + this error happens when the device code expired before the user signed-in on another device (this is usually after 15 mins). + Mitigation + None. Inform the user that they took too long to sign-in at the provided URL and enter the provided code. + + + + + Integrated Windows Auth is only supported for "federated" users + + + + + On Android, you need to call AcquireTokenInteractiveParameterBuilder.WithParentActivityOrWindow(object) passing + the activity. See https://aka.ms/msal-interactive-android + + + + + Broker response hash did not match + + + + + Broker response returned an error + + + + + Broker response nonce does not match the request nonce sent by MSAL.NET for iOS broker >= v6.3.19 + + + + + MSAL is not able to invoke the broker. Possible reasons are the broker is not installed on the user's device, + or there were issues with the UiParent or CallerViewController being null. See https://aka.ms/msal-brokers + + + + + MSAL is not able to find a suitable account to use with broker + + + + + MSAL cannot find the broker application to authenticate accounts. + + + + + Null intent was returned so broker activity cannot be launched + + + + + Failed to validate android broker signature + + + + + Failed To Complete Android Broker Operation + + + + + Unable to query the Android account manager because no username or home account ID is provided in the silent authentication request. + + + + + Error code used when the HTTP response returns HttpStatusCode.NotFound + + + + + ErrorCode used when the HTTP response returns something different from 200 (OK) + + + HttpStatusCode.NotFound have a specific error code. + + + + + Error code used when the has returned a URI, but it is invalid - it is either null or has no code. + Consider throwing an exception if you are unable to intercept the URI containing the code. + + + + + Error code used when the CustomWebUI has returned a URI, but it does not match the Authority and AbsolutePath of + the configured redirect URI. + + + + + Access denied. + + + + + Cannot Access User Information or the user is not a user domain. + What happens? + You tried to use + but the user is not a domain user (the machine is not domain or AAD joined) + + + + + RedirectUri validation failed. + + + + + No Redirect URI. + What happens? + You need to provide a Reply URI / Redirect URI, but have not called + + + + + Multiple Tokens were matched. + What happens?This exception happens in the case of applications managing several identities, + when calling + or one of its overrides and the user token cache contains multiple tokens for this client application and the specified Account, but from different authorities. + Mitigation [App Development]specify the authority to use in the acquire token operation + + + + + Non HTTPS redirects are not supported + What happens?This error happens when the authorization flow, which collects user credentials, gets redirected + to an page that is not supported, for example if the redirect occurs over http. + This error does not trigger for the final redirect, which can be http://localhost, but for intermediary redirects. + MitigationThis usually happens when using a federated directory which is not setup correctly. + + + + + The request could not be preformed because the network is down. + Mitigation [App development] In the application you could either inform the user that there are network issues + or retry later + + + + + The B2C authority host is not the same as the one used when creating the client application. + + + + + The cloud (authority URL host) defined at the application level cannot be different than the cloud at the request level. + What happens?You did not define an authority at the application level, so it defaults to the public cloud (login.microsoft.com), but the authority at the request level is for a different cloud. Only the tenant can be changed at the request level. + MitigationAdd .WithAuthority("https://login.windows-ppe.net/common) at the application level and specify the tenant at the request level: .WithAuthority("https://login.windows-ppe.net/1234-567-890-12345678). + + + + + Duplicate query parameter was found in extraQueryParameters. + What happens? You have used extraQueryParameter of overrides + of token acquisition operations in public client and confidential client application and are passing a parameter which is already present in the + URL (either because you had it in another way, or the library added it). + Mitigation [App Development] RemoveAccount the duplicate parameter from the token acquisition override. + + + + + The request could not be performed because of a failure in the UI flow. + What happens?The library failed to invoke the Web View required to perform interactive authentication. + The exception might include the reason + MitigationIf the exception includes the reason, you could inform the user. This might be, for instance, a browser + implementing chrome tabs is missing on the Android phone (that's only an example: this exception can apply to other + platforms as well) + + + + + Authentication canceled. + What happens?The user had canceled the authentication, for instance by closing the authentication dialog + MitigationNone, you cannot get a token to call the protected API. You might want to inform the user + + + + + JSON parsing failed. + What happens?A JSON blob read from the token cache or received from the STS was not parseable. + This can happen when reading the token cache, or receiving an IDToken from the STS. + MitigationMake sure that the token cache was not tampered + + + + + JWT was invalid. + What happens?The library expected a JWT (for instance a token from the cache, or received from the STS), but + the format is invalid + MitigationMake sure that the token cache was not tampered + + + + + State returned from the STS was different from the one sent by the library + What happens?The library sends to the STS a state associated to a request, and expects the reply to be consistent. + This errors indicates that the reply is not associated with the request. This could indicate an attempt to replay a response + Mitigation None + + + + + Tenant discovery failed. + What happens?While reading the OpenId configuration associated with the authority, the Authorize endpoint, + or Token endpoint, or the Issuer was not found + MitigationThis indicates and authority which is not Open ID Connect compliant. Specify a different authority + in the constructor of the application, or the token acquisition override + /// + + + + The library is loaded on a platform which is not supported. + + + + + An authorization Uri has been intercepted, but it cannot be parsed. See the log for more details. + + + + + What happens?The current redirect URL is not a loopback URL. + Mitigation To use the OS browser, a loopback URL, with or without a port, must be configured both during app registration and when initializing the IPublicClientApplication object. See https://aka.ms/msal-net-os-browser for details. + + + + + What happens?MSAL has intercepted a Uri possibly containing an authorization code, but it does not match + the configured redirect URL. + MitigationIf you are using an ICustomWebUi implementation, make sure the + redirect URL matches the URL containing the auth code. If you are not using an ICustomWebUI, + this could be a man-in-the middle attack. + + + + + What happens?MSAL tried to open the browser on Linux using the xdg-open, gnome-open, or kfmclient tools, but failed. + MitigationMake sure you can open a page using xdg-open tool. See https://aka.ms/msal-net-os-browser for details. + + + + + The selected WebView is not available on this platform. You can switch to a different WebView using . See https://aka.ms/msal-net-os-browser for details + + + + + What happens?You configured MSAL interactive authentication to use an embedded WebView and you also configured . + These are mutually exclusive. + MitigationEither set to true or do not use + + + + + + What happens?You configured MSAL confidential client authentication with more than one authentication type (Certificate, Secret, Client Assertion) + + + + + What happens?You configured MSAL confidential client authentication without an authentication type (Certificate, Secret, Client Assertion) + MitigationEither call ConfidentialClientApplicationBuilder.WithClientSecret, ConfidentialClientApplicationBuilder.WithCertificate, ConfidentialClientApplicationBuilder.WithClientAssertion + + + + + Issue can be resolved by user interaction during the interactive authentication flow. + See https://aka.ms/msal-net-UiRequiredException for details + + + + + Issue can be resolved by additional remedial interaction with the system, outside of the interactive authentication flow. + Interactive authentication is still required to inform the user of what is needed. Calling application may choose to hide flows that require additional_action if the user is unlikely to complete the remedial action. + Example: + + + + + Issue cannot be resolved at this time. Launching interactive authentication flow will show a message explaining the condition. + + + + + User's password has expired. + + + + + User consent is missing, or has been revoked. + + + + + Internal to MSALs. Indicates that no further silent calls should be made with this refresh token. + + + + + Internal to MSALs. Indicates that no further silent calls should be made with this refresh token. + + + + + Internal to MSALs. Needed in ios/android to complete the end-to-end true MAM flow. This sub-error code is re-mapped to a different top level error code (IntuneAppProtectionPoliciesRequired), and not InteractionRequired + + + + + Internal to MSALs. Used in scenarios where an application is using family refresh token even though it is not part of FOCI (or vice versa). Needed to handle cases where app changes FOCI membership after being shipped. This is handled internally and doesn't need to be exposed to the calling app. Please see FOCI design document for more details. + + + + + Internal to MSALs. Indicates that device should be re-registered. + + + + + AAD service error indicating that the configured authority does not exist + + + + + What happens?You have configured your own instance metadata, but the json provided seems to be invalid. + MitigationSee https://aka.ms/msal-net-custom-instance-metadata for an example of a valid json that can be used. + + + + + What happens?You have configured your own instance metadata, and have also set validate authority to true. These are mutually exclusive. + MitigationSet the validate authority flag to false. See https://aka.ms/msal-net-custom-instance-metadata for more details. + + + + + What happens?You haven't set a client ID. + MitigationUse the application ID (a GUID) from the application portal as client ID in this SDK + + + + + What happens?You have configured both a telemetry callback and a telemetry config. + MitigationOnly one telemetry mechanism can be configured. + + + + + Azure AD service error indicating a configuration issue. + MitigationSee error message for details, then take corrective action in the app registration portal + See https://aka.ms/msal-net-invalid-client for details. + + + + + What happens?You have configured MSAL to request SSH certificates from AAD, and you are trying to format an HTTP authentication header. + MitigationSSH certificates should not used as Bearer tokens. Developers are responsible for sending the certificates to the target machines. + + + + + What happens?Windows Authentication Broker, which handles the interaction between the user and AAD, has failed. + MitigationSee the error message for more details. + + + + + What happens?You asked for one type of token, but did not receive it. + MitigationThis happens if the Identity Provider (AAD, B2C, ADFS etc.) does not support / implement the requested token type. In case of ADFS, consider upgrading to the latest version. + + + + + What happens?The response from the token endpoint does not contain the token_type parameter. + MitigationThis happens if the identity provider (AAD, B2C, ADFS, etc.) did not include the access token type in the token response. Verify the configuration of the identity provider. + + + + + What happens?You are trying to use a feature which was marked as experimental + MitigationWhen creating the PublicClientApplication or ConfidentialClientApplication, use .WithExperimentalFeatures() option. See https://aka.ms/msal-net-experimental-features for details. + + + + + What happens?A broker application is required, but one could not be found or communicated with. + MitigationInstall a broker application, such as Authenticator, from the application store + + + + + What happens?You are trying to authenticate with the broker but MSAL is unable to read the response from the broker. + MitigationThe currently installed broker may not support MSAL.Xamarin, you need to ensure that you have installed either Intune Company Portal (5.0.4689.0 or greater) or Microsoft Authenticator (6.2001.0140 or greater). see https://aka.ms/Brokered-Authentication-for-Android" + + + + + What happens?You have configured a claims request, but the claims string is not in JSON format + MitigationEnsure that the claims parameter is valid JSON. Inspect the inner exception for details about JSON parsing. + + + + + What happens?The authority configured at the application level is different than the authority configured at the request level + MitigationEnsure the same authority type is used + + + + + What happens?You specified a tenant twice - once in WithAuthority() and once using WithTenant() + MitigationSpecify the tenant once. + + + + + What happens?You have configured your own instance metadata using both an Uri and a string. Only one is supported. + MitigationCall WithInstanceDiscoveryMetadata only once. See https://aka.ms/msal-net-custom-instance-metadata for more details. + + + + + What happens?No scopes have been requested + MitigationAt least one scope must be specified for this authentication flow + + + + + What happens?The certificate provided does not have a private key. + MitigationEnsure the certificate has a private key. + + + + + What happens?The certificate provided is not of type RSA. + MitigationPlease use an RSA certificate. + + + + + Device certificate not found. + + + + + What happens?The ADAL cache is invalid as it contains multiple refresh token entries for one user. + MitigationDelete the ADAL cache. If you do not maintain an ADAL cache, this may be a bug in MSAL. + + + + + Region discovery failed. + + + + + What happens?WithAzureRegion is set to true + MitigationRegion discovery cannot be performed for ADFS authority. + + + + + What happens?The request has broker enabled and Proof-of-Possession configured but the broker does not support Proof-of-Possession + Mitigationonly configure Proof-of-Possession for public clients on windows. + + + + + What happens?The request has Proof-of-Possession configured but does not have broker enabled. Broker is required to use Proof-of-Possession on public clients + MitigationEnable the broker when Proof-of-Possession is configured. + + + + + What happens?Broker is configured with an ADFS authority, however, it does not support ADFS environments. + MitigationBroker does not support ADFS environments. + + + + + What happens?The request has Proof-of-Possession configured but does not have a nonce configured. A nonce is required for Proof-of-Possession on public clients + MitigationProvide a nonce when Proof-of-Possession is configured for public clients. + + + + + When calling AcquireTokenInteractive with the WAM broker, the call must be made from the UI thread. + + + + + The Windows broker (WAM) is only supported in conjunction with "work and school" accounts + and with Microsoft accounts. + + + + + WAM service exception that can occur when calling AcquireTokenInteractive + + + + + WAM service exception that can occur when calling AcquireTokenInteractive and the account picker + pops up + + + + + What happens?No scopes have been requested + MitigationAt least one scope must be specified for MSAL Runtime WAM + + + + + What happens?The embedded browser cannot be started because a runtime component is missing. + MitigationThe embedded browser needs WebView2 runtime to be installed. An end user of the app can download and install the WebView2 runtime from https://go.microsoft.com/fwlink/p/?LinkId=2124703 and restart the app. + The app developer can get the distributable version of the WebView2 runtime. + + + + + What happens?The embedded WebView2 browser cannot be started because a runtime component cannot be loaded. + Mitigation For troubleshooting details, see https://aka.ms/msal-net-webview2 . + + + + + What happens?You configured both Regional Authority and Authority Validation. Authority validation is not currently supported for regional authorities. + MitigationSet the validateAuthority flag to false to use Azure Regional authority. Do not disable authority validation if you read the authority from an untrusted source, + for example from the WWWAuthenticate header of an HTTP request that resulted in a 401 response. + + + + + What happens?You have configured both Region Discovery and Custom Instance Metadata. Custom metadata supersedes region discovery. + MitigationConfigure either Region Discovery or Custom Instance Discovery Metadata. + + + + + An HttpListenerException occurred while listening for the system browser to complete the login. + + + + + What happens?Failure setting process security to enable WAM Account Picker in an elevated process. + MitigationFor troubleshooting details, see https://aka.ms/msal-net-wam . + + + + + What happens?You configured MSAL cache serialization at the same time with a static internal cache via + These are mutually exclusive. + Mitigation Use only one option. Web site and web API scenarios should rely on external cache serialization, as internal cache serialization cannot scale. See https://aka.ms/msal-net-cca-token-cache-serialization + + + + + What happens?You configured WithTenant at the request level, but the application is using a non-AAD authority + These are mutually exclusive. + Mitigation WithTenantId can only be used in conjunction with AAD authorities. + + + + + What happens?You configured WithAuthority at the request level, and also WithAzureRegion. This is not supported when the environment changes from application to request. + Mitigation Use WithTenantId at the request level instead. + + + + + What happens?The token cache does not contain a token with an OBO cache key that + matches the longRunningProcessSessionKey passed into . + Mitigation Call with this longRunningProcessSessionKey + first or call with an already used longRunningProcessSessionKey. + + + + + A required value is missing from the token provider response + + + + + MSAL is unable to parse the authentication header returned from the endpoint. This can be a result of a malformed header returned in either the WWW-Authenticate or the Authentication-Info collections. + + + + + A required value is missing from the managed identity response. + + + + + Managed Identity error response was received. + + + + + Managed Identity error response was received. + + + + + Managed Identity endpoint is not reachable. + + + + + Unknown error response received. + + + + + Invalid managed identity endpoint. + + + + + Exactly one scope is expected. + + + + + User assigned managed identity is not supported for this source. + + + + + User assigned managed identity is not configurable at runtime for service fabric. + + + + + Using combined flat storage, like a file, to store both app and user tokens is not supported. Use a partitioned token cache (for ex. distributed cache like Redis) or separate files for app and user token caches. See https://aka.ms/msal-net-token-cache-serialization . + + + + + Setting the CIAM authority (ex. "{tenantName}.ciamlogin.com") at the request level is not supported. The CIAM authority must be set during application creation. + + + + + A cryptographic exception occurred when trying to use the provided certificate + + + + + What happened?mTLS Proof of Possession (mTLS PoP) is configured but a region was not specified. + MitigationEnsure that the AzureRegion configuration is set when using mTLS PoP as it requires a regional endpoint. + + + + + What happened? mTLS Proof of Possession (mTLS PoP) is configured but a certificate was not provided. + Mitigation Ensure that a valid certificate is provided in the configuration when using mTLS PoP as it is required for secure authentication. + + + + + What happened? mTLS Proof of Possession (mTLS PoP) requires a specific Azure region to be specified. + Mitigation: Ensure that the AzureRegion configuration is set when using mTLS PoP as it requires a regional endpoint. + + + + + The active directory authentication error message. + + + + + Base exception type thrown when an error occurs during token acquisition. + For more details, see https://aka.ms/msal-net-exceptions + + Avoid throwing this exception. Instead throw the more specialized + or + + + + + An property key, available when using desktop brokers. + + + + + An property key, available when using desktop brokers. + + + + + An property key, available when using desktop brokers. + + + + + An property key, available when using desktop brokers. + + + + + An property key, available when using desktop brokers. + + + + + An property key, available when using managed identity. + + + + + Indicates if the previous operation that resulted in this exception should be retried. + + + + + Initializes a new instance of the exception class. + + + + + Initializes a new instance of the exception class with a specified + error code. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + + + + Initializes a new instance of the exception class with a specified + error code and error message. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the exception class with a specified + error code and a reference to the inner exception that is the cause of + this exception. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + The exception that is the cause of the current exception, or a null reference if no inner + exception is specified. + + + + + Gets the protocol error code returned by the service or generated by the client. This is the code you can rely on for + exception handling. Values for this code are typically provided in constant strings in the derived exceptions types + with explanations of mitigation. + + + + + An ID that can used to piece up a single authentication flow. + + + + + A property bag with extra details for this exception. + + + + + Creates and returns a string representation of the current exception. + + A string representation of the current exception. + + + + Allows serialization of most values of the exception into JSON. + + + + + + Allows re-hydration of the MsalException (or one of its derived types) from JSON generated by ToJsonString(). + + + + + + + This exception class is for exceptions generated from Managed Identity sources. + This class is deprecated and will be removed in a future release. + Catch MsalServiceException instead. + For more details, see https://aka.ms/msal-net-managed-identity + + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Specifies the managed identity source from which the exception initiates. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Specifies the managed identity source from which the exception initiates. + The status code of the response. + + + + Initializes a new instance of the exception class with a specified + error code, error message and managed identity source. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + Specifies the managed identity source from which the exception initiates. + The status code of the response. + + + + Initializes a new instance of the exception class with a specified + error code, error message and managed identity source. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + Specifies the managed identity source from which the exception initiates. + + + + Specifies the managed identity source from which the exception initiates. + + + + + Retry error codes specific to managed identity + + + + + Exception type thrown when service returns an error response or other networking errors occur. + For more details, see https://aka.ms/msal-net-exceptions + + + + + Initializes a new instance of the exception class with a specified + error code, error message and a reference to the inner exception that is the cause of + this exception. + + + The protocol error code returned by the service or generated by client. This is the code you + can rely on for exception handling. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and a reference to the inner exception that is the cause of + this exception. + + + The protocol error code returned by the service or generated by the client. This is the code you + can rely on for exception handling. + + The error message that explains the reason for the exception. + Status code of the response received from the service. + + + + Initializes a new instance of the exception class with a specified + error code, error message and a reference to the inner exception that is the cause of + this exception. + + + The protocol error code returned by the service or generated by the client. This is the code you + can rely on for exception handling. + + The error message that explains the reason for the exception. + + The exception that is the cause of the current exception, or a null reference if no inner + exception is specified. + + + + + Initializes a new instance of the exception class with a specified + error code, error message and a reference to the inner exception that is the cause of + this exception. + + + The protocol error code returned by the service or generated by the client. This is the code you + can rely on for exception handling. + + The error message that explains the reason for the exception. + HTTP status code of the response received from the service. + + The exception that is the cause of the current exception, or a null reference if no inner + exception is specified. + + + + + Initializes a new instance of the exception class with a specified + error code, error message and a reference to the inner exception that is the cause of + this exception. + + + The protocol error code returned by the service or generated by the client. This is the code you + can rely on for exception handling. + + The error message that explains the reason for the exception. + The status code of the request. + The claims challenge returned back from the service. + + The exception that is the cause of the current exception, or a null reference if no inner + exception is specified. + + + + + Gets the status code returned from HTTP layer. This status code is either the HttpStatusCode in the inner + response or the NavigateError Event Status Code in a browser based flow (see NavigateError Event Status Codes). + You can use this code for purposes such as implementing retry logic or error investigation. + + + + + Additional claims requested by the service. When this property is not null or empty, this means that the service requires the user to + provide additional claims, such as doing two factor authentication. The are two cases: + + + If your application is a , you should just call + and add the modifier. + + >If your application is a , (therefore doing the On-Behalf-Of flow), you should throw an HTTP unauthorize + exception with a message containing the claims + + For more details see https://aka.ms/msal-net-claim-challenge + + + + + Raw response body received from the server. + + + + + Contains the HTTP headers from the server response that indicated an error. + + + When the server returns a 429 Too Many Requests error, a Retry-After should be set. It is important to read and respect the + time specified in the Retry-After header to avoid a retry storm. + + + + + The suberror should not be exposed for public consumption yet, as STS needs to do some work first. + + + + + A list of STS-specific error codes that can help in diagnostics. + + + + + As per discussion with Evo, AAD + + + + + Creates and returns a string representation of the current exception. + + A string representation of the current exception. + + + + Exception type thrown when MSAL detects that an application is trying to acquire a token too often, as a result of: + - A previous request resulted in an HTTP response containing a Retry-After header which was not followed. + - A previous request resulted in an HTTP 429 or 5xx, which indicates a problem with the server. + + The properties of this exception are identical to the original exception + + For more details see https://aka.ms/msal-net-throttling + + + + + Constructor + + + + + The original service exception that triggered the throttling. + + + + + Exception type thrown when MSAL detects that an application is trying to acquire a token even + though an was recently thrown. + To mitigate this, when a is encountered, + the application should switch to acquiring a token interactively. To better understand + why the was thrown, inspect the + property. + + The properties of this exception are identical to the original exception + + For more details see https://aka.ms/msal-net-throttling + + + + + Constructor + + + + + The original exception that triggered the throttling. + + + + + This exception class is to inform developers that UI interaction is required for authentication to + succeed. It's thrown when calling or one + of its overrides, and when the token does not exists in the cache, or the user needs to provide more content, or perform multiple factor authentication based + on Azure AD policies, etc.. + For more details, see https://aka.ms/msal-net-exceptions + + + + + Initializes a new instance of the exception class with a specified + error code and error message. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + + + + Initializes a new instance of the exception class with a specified + error code, error message and inner exception indicating the root cause. + + + The error code returned by the service or generated by the client. This is the code you can rely on + for exception handling. + + The error message that explains the reason for the exception. + Represents the root cause of the exception. + A higher level description for this exception, that allows handling code to + understand what type of action it needs to take to resolve the issue. + + + + Classification of the conditional access error, enabling you to do more actions or inform the user depending on your scenario. + See https://aka.ms/msal-net-UiRequiredException for more details. + + + + + Optional field, FOCI support. + + + + + This method does not belong here - it is more tied to the Android code. However, that code is + not unit testable, and this one is. + The values of the JSON response are based on + https://github.com/AzureAD/microsoft-authentication-library-common-for-android/blob/dev/common/src/main/java/com/microsoft/identity/common/internal/broker/BrokerResult.java + + + + + Responsible for talking to all the Identity provider endpoints: + - instance discovery + - endpoint metadata + - mex + - /token endpoint via TokenClient + - device code endpoint + + + + + Do not expose these in the MsalException because Evo does not guarantee that the error + codes remain the same. + + + + + OAuth2 errors that are only used internally. All error codes used when propagating exceptions should + be made public. + + + + + Default timespan that blocks an application, if HTTP 429 and HTTP 5xx was received and Retry-After HTTP header was NOT returned by AAD. + + + + + Exposed only for testing purposes + + + + + For test purposes, so that the static state can be reset + + + + + The Retry-After provider observes all service exceptions from all flows and looks for a header like: RetryAfter X seconds. + It then enforces this header, by throttling for X seconds. + + + + + Throttling is the action through which MSAL blocks applications from making repeated + bad requests to the server. This works by MSAL detecting certain conditions when the server + returns an error. If a similar request is then issued under the same condition, the same + server error is returned by MSAL, without contacting the server. + + Throttling occurs in the following conditions: + + After receiving an RetryAfter header + After receiving 429, 5xx HTTP status. + + This class manages the throttling providers and is itself a provider + + + Client Throttling spec https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/1624 + + + + + + The strict thumbprint is based on: + ClientId + Authority + Resource + Scope + Account + + + + + To prevent the cache from becoming too large, purge expired entries every X seconds + + + + + Default number of seconds that application returns the cached response, in case of UI required requests. + + + + + Exposed only for testing purposes + + + + + MsalUiRequiredException is thrown from AcquireTokenSilent, based on certain error codes from the server + when contacting the token endpoint. + Currently, throttling will only apply to public client applications at first. + + + + + The strict thumbprint is based on: + ClientId + Authority (env + tenant) + Scopes + hash(RT) or UPN for IWA (not supported) + + + + + Responsible for talking to the /token endpoint + + + + + A client side library needs to communicate to the server side that + it has implemented enforcement of HTTP 429 and Retry-After header. + Because if the server-side detects loops, then it can break the loop by sending + either HTTP 429 or Retry-After header with a different HTTP status. + Right now, the server side breaks the loops by invalid_grant response, + which breaks protocol under some condition and also causes unexplained prompt. + + + + + Add Claims, including ClientCapabilities, to body parameter for POST request. + + + + + Extension methods + + + + + Returns true if MSAL can use a system browser. + + + On Windows, Mac and Linux a system browser can always be used, except in cases where there is no UI, e.g. SSH connection. + On Android, the browser must support tabs. + + + + + Returns true if MSAL can use an embedded webview (browser). + + + Currently there are no embedded webviews on Mac and Linux. On Windows, app developers or users should install + the WebView2 runtime and this property will inform if the runtime is available, see https://aka.ms/msal-net-webview2 + + + + + Returns false when the program runs in headless OS, for example when SSH-ed into a Linux machine. + Browsers (webviews) and brokers cannot be used if there is no UI support. + Instead, please use + or + + + + + Returns the certificate used to create this , if any. + + + + + Returns the platform / os specific implementation of a PlatformProxy. + + + + + Gets the platform proxy, which can be used to perform platform specific operations + + + + + Common operations for extracting platform / operating system specifics. + Scope: per app + + + + + Gets the device model. On some TFMs this is not returned for security reasons. + + device model or null + + + + Gets the UPN of the user currently logged into the OS + + + + + + Returns the name of the calling assembly + + + + + + Returns the version of the calling assembly + + + + + + Returns a device identifier. Varies by platform. + + + + + + Gets the default redirect URI for the platform, which sometimes includes the clientId + + + + + Returns the MSAL platform, e.g. MSAL.NetCore, MSAL.Desktop. + + + + + + Returns the framework runtime version on which the app is running, e.g. .NET Core 3.1.3, .NET Framework 4.8. + + Runtime version + + + + Go to a URL using the OS default browser. + + + + + Most brokers take care of both silent auth and interactive auth, however some (iOS) + does not support silent auth and gives the RT back to MSAL. + + + + + + WAM broker has a deeper integration into MSAL because MSAL needs to store + WAM account IDs in the token cache. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + On Android and iOS, MSAL will save the legacy ADAL cache in a known location. + On other platforms, the app developer must use the serialization callbacks + + + + AAD only supports RSA certs for client credentials + + + + Checks if the OS supports WAM (Web Account Manager) + WAM Supported OS's are Windows 10 and above for Client, Windows 2019 and above for Server + + Returns true if the Windows Version has WAM support + + + + Constructs a bypass response to the PKeyAuth challenge on platforms where the challenge cannot be completed. + + + + + Constructs a bypass response to the PKeyAuth challenge on platforms where the challenge cannot be completed. + + + + + Stores tokens for an application. + Partitions the access token collection by a key of client ID with tenant ID. + App metadata collection is not partitioned. + Refresh token, ID token, and account related methods are no-op. + + + + + This method is not supported for the app token cache because + there are no refresh tokens in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no ID tokens in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no user accounts in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no ID tokens in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no user accounts in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no refresh tokens in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no ID tokens in a client credential flow. + + + + + This method is not supported for the app token cache because + there are no user accounts in a client credential flow. + + + + + WARNING: if partitionKey = null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + + + Stores tokens for users. + Partitions the access and refresh token collections by a user assertion hash in case of OBO and by home account ID otherwise. + Partitions the ID token and account collections by home account ID. + App metadata collection is not partitioned. + + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + WARNING: if partitionKey is null, this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + WARNING: this API is slow as it loads all tokens, not just from 1 partition. + It should only support external token caching, in the hope that the external token cache is partitioned. + + + + Used for platforms that do not implement PKeyAuth. + + + + + A simple implementation of the HttpClient factory that uses a managed HttpClientHandler + + + .NET should use the IHttpClientFactory, but MSAL cannot take a dependency on it. + .NET should use SocketHandler, but UseDefaultCredentials doesn't work with it + + + + + Windows OS Version checks + + + + + The operating system is Windows 10, Windows 8, Windows 7,... + + VER_NT_WORKSTATION + + + + The system is a domain controller and the operating system is Windows Server. + + VER_NT_DOMAIN_CONTROLLER + + + + The operating system is Windows Server. Note that a server that is also a domain controller + is reported as VER_NT_DOMAIN_CONTROLLER, not VER_NT_SERVER. + + VER_NT_SERVER + + + + RtlGetVersion returns STATUS_SUCCESS. + + NT_STATUS + + + + Microsoft 365 apps (for example, Office client apps) use Azure Active Directory Authentication Library (ADAL) + framework-based Modern Authentication by default. Starting with build 16.0.7967, Microsoft 365 apps use + Web Account Manager (WAM) for sign-in workflows on Windows builds that are later than 15000 + (Windows 10, version 1703, build 15063.138). + https://learn.microsoft.com/microsoft-365/troubleshoot/administration/disabling-adal-wam-not-recommended + + + + + Windows Server 2019 (version 1809, Build Number 17763) + Editions : Datacenter, Essentials, Standard + https://learn.microsoft.com/windows-server/get-started/windows-server-release-info + For MultiSession Window 10 Build Number is same as Windows 2019 Server Build Number + MultiSession Windows 10 is supported from Windows 10 multi-session, version 1903 + https://learn.microsoft.com/mem/intune/fundamentals/azure-virtual-desktop-multi-session + + + + + RtlGetVersion is the kernel-mode equivalent of the user-mode GetVersionEx function in the Windows SDK + The RtlGetVersion routine returns version information about the currently running operating system. + https://learn.microsoft.com/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlgetversion + When using RtlGetVersion to determine whether a particular version of the operating system is running, + a caller should check for version numbers that are greater than or equal to the required version number. + This ensures that a version test succeeds for later versions of Windows. + + Pointer to either a RTL_OSVERSIONINFOW structure or a RTL_OSVERSIONINFOEXW + structure that contains the version information about the currently running operating system. A caller specifies + which input structure is used by setting the dwOSVersionInfoSize member of the structure to the size in bytes of + the structure that is used. + RtlGetVersion returns Status_Success. + + + + Contains operating system version information. The information includes major and minor version numbers, + a build number, a platform identifier, and information about product suites and the latest Service Pack + installed on the system. + + + + + The size, in bytes, of an RTL_OSVERSIONINFOEXW structure. + + + + + he major version number of the operating system. + For example, for Windows 2000, the major version number is five. + + + + + The minor version number of the operating system. + For example, for Windows 2000, the minor version number is zero. + + + + + The build number of the operating system. + + + + + The operating system platform. This member can be VER_PLATFORM_WIN32_NT (2). + + + + + A null-terminated string, such as "Service Pack 3", that indicates the latest Service Pack + installed on the system. If no Service Pack has been installed, the string is empty. + + + + + The major version number of the latest Service Pack installed on the system. + For example, for Service Pack 3, the major version number is 3. + If no Service Pack has been installed, the value is zero. + + + + + The minor version number of the latest Service Pack installed on the system. + For example, for Service Pack 3, the minor version number is 0. + + + + + A bit mask that identifies the product suites available on the system. + This member can be a combination of the following values. + + + + + The product type. This member contains additional information about the system. + This member can be one of the following values: VER_NT_WORKSTATION, VER_NT_DOMAIN_CONTROLLER, VER_NT_SERVER + + + + + Reserved for future use. + + + + + Checks if the OS supports WAM (Web Account Manager) + WAM Supported OS's are Windows 10 and above for Client, Windows 2019 and above for Server + + Returns true if the OS Version has WAM support + + + + Attribute that will be picked up by the Xamarin Linker, as a hint for the linker to not remove the type. + Needs to be added to types that get created by reflection, e.g. JSON serialization types + + It's important to not change the name and the 2 fields of this class. The linker looks for these. + + + + Structure containing static members that you can use to specify how the interactive overrides + of AcquireTokenAsync in should prompt the user. + + + + + AcquireToken will send prompt=select_account to the authorization server's authorize endpoint. + which would present to the user a list of accounts from which one can be selected for + authentication. + + + This is the default prompt for backwards compatibility reasons. Please use for the best user experience. + + + + + The user will be prompted for credentials by the service. It is achieved + by sending prompt=login to the authorize endpoint. + + + + + The user will be prompted to consent, even if consent was granted before. It is achieved + by sending prompt=consent to the authorization server's authorize endpoint. + + + + + Let the identity service decide on the best user experience, based on browser cookies and + on the login hint, which can be specified using WithAccount() or WithLoginHint() + + This is the recommended prompt + + + + AcquireToken will send prompt=create to the authorization server's authorize endpoint + which would trigger a sign-up experience, used for External Identities. + + More details at https://aka.ms/msal-net-prompt-create. + + + + Only available on .NET platform. AcquireToken will send prompt=attempt_none to + the authorization server's authorize endpoint and the library will use a hidden WebView (and its cookies) to authenticate the user. + This can fail, and in that case a will be thrown. + + + + + Equals method override to compare Prompt structs + + object to compare against + true if object are equal. + + + + Override to compute hash code + + hash code of the PromptValue + + + + Operator overload to check equality + + first value + second value + true if the objects are equal + + + + Operator overload to check inequality + + first value + second value + true if the objects are not equal + + + Public Key Tokens for InternalsVisibleTo + + + + + + + A special account value that indicates that the current operating system account should be used + to log the user in. Not all operating systems and authentication flows support this concept, in which + case calling will throw an . + + + Currently only the Windows broker is able to login with the current operating system user. For additional details, see the documentation on the Windows broker. + + + + + + + + Returns true if MSAL can use an embedded web view (web browser). + + + All .NET Framework applications will use the legacy web view. .NET 6 and .NET Core applications must use the Microsoft.Identity.Client.Desktop package with WebView2. .NET 6 for Windows comes with WebView2 by default. + WebView2 UI is only shown for non-AAD authorities. + Refer to our documentation for additional details. + + + + + Returns false when the application runs in headless mode (e.g., when SSH-d into a Linux machine). + Browsers (web views) and brokers cannot be used if there is no UI support. For those scenarios, use . + + + + + Returns true if an authentication broker can be used. + This method is only needed for mobile scenarios which support Mobile Application Management (MAM). In other cases, use WithBroker, which will fall back to use a browser if an authentication broker is unavailable. + + + + On Windows, the broker (WAM) can be used on Windows 10 and is always installed. See https://aka.ms/msal-net-wam + On Mac, Linux, and older versions of Windows a broker is not available. + In .NET 8 apps, target net8.0-windows10.0.17763.0 for all Windows versions and target net8.0 for Linux and Mac. + In .NET classic or .NET Core 3.1 apps, install Microsoft.Identity.Client.Desktop first and call WithDesktopFeatures(). + In mobile apps, the device must be Intune joined and Authenticator or Company Portal must be installed. See https://aka.ms/msal-brokers + + + + + + + + + + + + + + + + + + + + + + + + Used to determine if the currently available broker is able to perform Proof-of-Possession. + + Boolean indicating if Proof-of-Possession is supported + + + + Contains the result of region when MSAL region discovery is used, + published as part of AuthenticationResultMetadata. + for additional metadata + information of the authentication result. + + + + + Constructor for RegionDetails + + + + + + + + Region Outcome based on MSAL region detection + + + + + Region used to construct /token endpoint to contact ESTS. + + + + + Error details when region auto detect fails + + + + + Responsible for recording API events and formatting CSV + with telemetry. + + + Not fully thread safe - it is possible that multiple threads request + the "previous requests" data at the same time. It is the responsibility of + the caller to protect against this. + + + + + Expected format: 5|api_id,cache_info,region_used,region_autodetection,region_outcome|platform_config + platform_config: is_token_cache_serialized,is_legacy_cache_enabled, token_type, caller_sdk_id, caller_sdk_version + + + + + Controls the HTTP telemetry that MSAL sends to AAD + via HTTP headers when contacting the /token endpoint. + + + - It is assumed that one manager is created for each application and shared between requests + - Implementer must be thread safe, since one app can fire multiple requests + + + + + Csv string with details about the current header (api used, force refresh flag) + + + + + Stores details to log to the . + + + + + Type of cache used. This data is captured from MSAL or Microsoft.Identity.Web to log to telemetry. + + + + + Represents an account in a specific tenant. The same account can exist in its home tenant and also as a guest in multiple other tenants. + Access tokens and Id Tokens are tenant specific and this object provides high level information about all the ID tokens associated with the account. + + + + + The immutable identifier for an user account, in a specific tenant. + This ID uniquely identifies the user across applications - two different applications signing in the same user will receive the same value in the oid claim. + The user will have a different object ID in each tenant - they're considered different accounts, even though the user logs into each account with the same credentials. + + This claim is issued by Microsoft Identity Providers and can be null. Fallback to the sub claim, which is scoped to a user and an app. + + + + Represents the tenant that the user is signing in to. + For work and school accounts, the GUID is the immutable tenant ID of the organization that the user is signing in to. + For sign-ins to the personal Microsoft account tenant (services like Xbox, Teams for Life, or Outlook), the value is 9188040d-6c67-4c5b-b112-36a304b66dad. + + + + + All the claims present in the ID Token associated with this profile. + + + + + Returns true if this profile is associated with the user's home tenant. + + + + + Token cache storing access and refresh tokens for accounts + This class is used in the constructors of and . + In the case of ConfidentialClientApplication, two instances are used, one for the user token cache, and one for the application + token cache (in the case of applications using the client credential flows). + + + IMPORTANT: this class is performance critical; any changes must be benchmarked using Microsoft.Identity.Test.Performance. + More information about how to test and what data to look for is in https://aka.ms/msal-net-performance-testing. + + + + + Constructor of a token cache. This constructor is left for compatibility with MSAL 2.x. + The recommended way to get a cache is by using + and IConfidentialClientApplication.AppTokenCache once the app is created. + + + + + Sets the security group to be used with the iOS Keychain. This function should not be used by external customers. It will be removed in a future version of MSAL. + + + + + delete all cache entries with intersecting scopes. + this should not happen but we have this as a safe guard + against multiple matches. + + + + + Important note: we should not be suggesting expiration dates that are in the past, as it breaks some cache implementations. + + + + + IMPORTANT: this class is performance critical; any changes must be benchmarked using Microsoft.Identity.Test.Performance. + More information about how to test and what data to look for is in https://aka.ms/msal-net-performance-testing. + + Scenario: client_creds with default in-memory cache can get to ~500k tokens + + + + + For testing purposes only. Expires ALL access tokens in memory and fires OnAfterAccessAsync event with no cache key + + + + + Get accounts should not make a network call, if possible. This can be achieved if + all the environments in the token cache are known to MSAL, as MSAL keeps a list of + known environments in + + + + + Removes OBO tokens stored in the cache. Note that the cache is internally and externally partitioned by the oboKey. + + + + + Notification method called before any library method accesses the cache. + + + + + Notification method called before any library method writes to the cache. This notification can be used to reload + the cache state from a row in database and lock that row. That database row can then be unlocked in the + notification. + + + + + Notification method called after any library method accesses the cache. + + + + + Sets a delegate to be notified before any library method accesses the cache. This gives an option to the + delegate to deserialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization + + Delegate set in order to handle the cache deserialization + + + + Sets a delegate to be notified after any library method accesses the cache. This gives an option to the + delegate to serialize a cache entry for the application and accounts specified in the . + See https://aka.ms/msal-net-token-cache-serialization + + Delegate set in order to handle the cache serialization + + + + Sets a delegate called before any library method writes to the cache. This gives an option to the delegate + to reload the cache state from a row in database and lock that row. That database row can then be unlocked in the delegate + registered with + + Delegate set in order to prepare the cache serialization + + + + + + + + + + + + + + + + + + + + + + Extension methods for ITokenCache + + + + + Options for MSAL token caches. + + MSAL maintains a token cache internally in memory. By default, this cache object is part of each instance of or . + This method allows customization of the in-memory token cache of MSAL. + + MSAL's memory cache is different than token cache serialization. Cache serialization pulls the tokens from a cache (e.g. Redis, Cosmos, or a file on disk), + where they are stored in JSON format, into MSAL's internal memory cache. Memory cache operations do not involve JSON operations. + + External cache serialization remains the recommended way to handle desktop apps, web site and web APIs, as it provides persistence. These options + do not currently control external cache serialization. + + Detailed guidance for each application type and platform: + https://aka.ms/msal-net-token-cache-serialization + + Either the UserTokenCache or the AppTokenCache, for which these options apply. + Options for the internal MSAL token caches. + + + + Contains parameters used by the MSAL call accessing the cache. + See also which contains methods + to customize the cache serialization. + For more details about the token cache see https://aka.ms/msal-net-web-token-cache + + + + + This constructor is for test purposes only. It allows apps to unit test their MSAL token cache implementation code. + + + + + This constructor is for test purposes only. It allows apps to unit test their MSAL token cache implementation code. + + + + + This constructor is for test purposes only. It allows apps to unit test their MSAL token cache implementation code. + + + + + This constructor is for test purposes only. It allows apps to unit test their MSAL token cache implementation code. + + + + + Gets the involved in the transaction + + objects implement this interface. + + + + Gets the ClientId (application ID) of the application involved in the cache transaction + + + + + Gets the account involved in the cache transaction. + + + + + Indicates whether the state of the cache has changed, for example when tokens are being added or removed. + Not all cache operations modify the state of the cache. + + + + + Indicates whether the cache change occurred in the UserTokenCache or in the AppTokenCache. + + + The Application Cache is used in Client Credential grant, which is not available on all platforms. + See https://aka.ms/msal-net-app-cache-serialization for details. + + + + + A suggested token cache key, which can be used with general purpose storage mechanisms that allow + storing key-value pairs and key based retrieval. Useful in applications that store one token cache per user, + the recommended pattern for web apps. + + The value is: + + + homeAccountId for AcquireTokenSilent, GetAccount(homeAccountId), RemoveAccount and when writing tokens on confidential client calls + "{clientId}__AppTokenCache" for AcquireTokenForClient + "{clientId}_{tenantId}_AppTokenCache" for AcquireTokenForClient when using a tenant specific authority + the hash of the original token for AcquireTokenOnBehalfOf + + + + + + Is true when at least one non-expired access token exists in the cache. + + + If this flag is false in the OnAfterAccessAsync notification - the node can be deleted from the underlying storage (e.g. IDistributedCache). + MSAL takes into consideration access tokens expiration when computing this flag. Use in conjunction with SuggestedCacheExpiry. + If a refresh token exists in the cache, this property will always be true. + + + + + The cancellation token that was passed to AcquireToken* flow via ExecuteAsync(CancellationToken). Can be passed + along to the custom token cache implementation. + + + + + The correlation id associated with the request. See + + + + + Scopes specified in the AcquireToken* method. + + + Note that Azure Active Directory may return more scopes than requested, however this property will only contain the scopes requested. + + + + + Tenant Id specified in the AcquireToken* method, if any. + + + Note that if "common" or "organizations" is specified, Azure Active Directory discovers the host tenant for the user, and the tokens + are associated with it. This property is not impacted. + + + + Suggested value of the expiry, to help determining the cache eviction time. + This value is only set on the OnAfterAccess delegate, on a cache write + operation (that is when args.HasStateChanged is true) and when the cache node contains only access tokens. + In all other cases it's null. + + + + + Identity Logger provided at the time of application creation Via WithLogging(IIdentityLogger, bool)/> + Calling the log function will automatically add MSAL formatting to the message. For details see https://aka.ms/msal-net-logging + + + + + Boolean used to determine if Personally Identifiable Information (PII) logging is enabled. + + + + + Cache Details contains the details of L1/ L2 cache for telemetry logging. + + + + + Specifies the source of the access and Id tokens in the authentication result. + + + + + The source of the access and Id token is Identity Provider - Microsoft Entra ID, ADFS or AAD B2C. + + + + + The source of access and Id token is MSAL's cache. + + + + + The source of the access and Id token is a broker application - Authenticator or Company Portal. Brokers are supported only on Android and iOS. + + + + + Details about the cause of an , giving a hint about what the user can expect when + they go through interactive authentication. See Understanding MsalUiRequiredException for details. + + + + + No details are provided. It is possible that the user will be able to resolve the issue by launching interactive authentication. + This is also the classification when no account or valid login hint is passed to . + See Understanding MsalUiRequiredException for details. + + + + + Issue cannot be resolved. Launching interactive authentication flow will show a message explaining the condition. + See Understanding MsalUiRequiredException for details. + + + + + Issue can be resolved by user interaction during the interactive authentication flow. + See Understanding MsalUiRequiredException for details. + + + + + Issue can be resolved by additional remedial interaction within the system, outside of the interactive authentication flow. + Starting an interactive authentication flow will show the user what they need to do but it is possible that the user will be unable to complete the action. + See Understanding MsalUiRequiredException for details. + + + + + User consent is missing or has been revoked. Issue can be resolved by user consenting during the interactive authentication flow. + See Understanding MsalUiRequiredException for details. + + + + + User's password has expired. Issue can be resolved by user during the interactive authentication flow. + See Understanding MsalUiRequiredException for details. + + + + + was used with a Prompt.Never value, + however this could not be honored by the server. Please use a different prompt behavior, such as . + See Understanding MsalUiRequiredException for details. + + + + + An call failed. This is usually part of the pattern + of calling for getting a token from the cache, followed by an a different + AcquireToken call for getting a token from Microsoft Entra ID. See the error message for details. + See Understanding MsalUiRequiredException for details. + + + + + A string that is added to each Authorization Request and is expected to be sent back along with the + authorization code. MSAL is responsible for validating that the state sent is identical to the state received. + + + This is in addition to PKCE, which is validated by the server to ensure that the system redeeming the auth code + is the same as the system who asked for it. It protects against XSRF https://openid.net/specs/openid-connect-core-1_0.html + + + + + + + + + + + Validates that the authorization redirects do not happen over http or other insecure protocol. + This does not include the final redirect, denoted by the redirect URI. + + + + + + + Extra validations on the redirect URI, for example system web views cannot work with the urn:oob... URI because + there is no way of knowing which app to get back to. + WebUIs can update the URI, for example use http://localhost:1234 instead of http://localhost. + Throws, if URI is invalid. + + + + + + + + Constructor from a JWT assertion. For other assertion types (SAML), use the other constructor + + JWT bearer token used to access the Web application itself + + + + Constructor of a UserAssertion specifying the assertionType in addition to the assertion + + Assertion representing the user. + Type of the assertion representing the user. Accepted types are currently: + + urn:ietf:params:oauth:grant-type:jwt-bearerJWT bearer token. Passing this is equivalent to using + the other (simpler) constructor + urn:ietf:params:oauth:grant-type:saml1_1-bearerSAML 1.1 bearer token + urn:ietf:params:oauth:grant-type:saml2-bearerSAML 2 bearer token + + + + + Gets the assertion. + + + + + Gets the assertion type. + + + + + Retrieve the TenantId for an Authority URL. + + The Authority URL to parse. + The Tenant Id + + The Tenant Id can be NULL if the Authority Type is ADFS + + + + + Encoding table + + + + + The following functions perform base64url encoding which differs from regular base64 encoding as follows + * padding is skipped so the pad character '=' doesn't have to be percent encoded + * the 62nd and 63rd regular base64 encoding characters ('+' and '/') are replace with ('-' and '_') + The changes make the encoding alphabet file and URL safe. + + string to encode. + Base64Url encoding of the UTF8 bytes. + + + + Converts a subset of an array of 8-bit unsigned integers to its equivalent string representation that is encoded with base-64-url digits. Parameters specify + the subset as an offset in the input array, and the number of elements in the array to convert. + + An array of 8-bit unsigned integers. + An offset in inArray. + The number of elements of inArray to convert. + The string representation in base 64 url encoding of length elements of inArray, starting at position offset. + 'inArray' is null. + offset or length is negative OR offset plus length is greater than the length of inArray. + + + + Converts a subset of an array of 8-bit unsigned integers to its equivalent string representation that is encoded with base-64-url digits. Parameters specify + the subset as an offset in the input array, and the number of elements in the array to convert. + + An array of 8-bit unsigned integers. + The string representation in base 64 url encoding of length elements of inArray, starting at position offset. + 'inArray' is null. + offset or length is negative OR offset plus length is greater than the length of inArray. + + + + Converts the specified string, which encodes binary data as base-64-url digits, to an equivalent 8-bit unsigned integer array. + base64Url encoded string. + UTF8 bytes. + + + + Decodes the string from Base64UrlEncoded to UTF8. + + string to decode. + UTF8 string. + + + + Represents a thread-safe hash-based unique collection. + + The type of the items in the collection. + + All public members of are thread-safe and may be used + concurrently from multiple threads. + + Based on the implementation from: https://github.com/i3arnon/ConcurrentHashSet/blob/main/src/ConcurrentHashSet/ConcurrentHashSet.cs + + + + + Gets the number of items contained in the . + + The number of items contained in the . + Count has snapshot semantics and represents the number of items in the + at the moment when Count was accessed. + + + + Gets a value that indicates whether the is empty. + + true if the is empty; otherwise, + false. + + + + Initializes a new instance of the + class that is empty, has the default concurrency level, has the default initial capacity, and + uses the default comparer for the item type. + + + + + Initializes a new instance of the + class that is empty, has the specified concurrency level and capacity, and uses the default + comparer for the item type. + + The estimated number of threads that will update the + concurrently. + The initial number of elements that the + can contain. + is + less than 1. + is less than + 0. + + + + Initializes a new instance of the + class that contains elements copied from the specified , has the default concurrency + level, has the default initial capacity, and uses the default comparer for the item type. + + The whose elements are copied to + the new + . + is a null reference. + + + + Initializes a new instance of the + class that is empty, has the specified concurrency level and capacity, and uses the specified + . + + The + implementation to use when comparing items. + + + + Initializes a new instance of the + class that contains elements copied from the specified , has the default concurrency level, has the default + initial capacity, and uses the specified + . + + The whose elements are copied to + the new + . + The + implementation to use when comparing items. + is a null reference + (Nothing in Visual Basic). + + + + + Initializes a new instance of the + class that contains elements copied from the specified , + has the specified concurrency level, has the specified initial capacity, and uses the specified + . + + The estimated number of threads that will update the + concurrently. + The whose elements are copied to the new + . + The implementation to use + when comparing items. + + is a null reference. + + + is less than 1. + + + + + Initializes a new instance of the + class that is empty, has the specified concurrency level, has the specified initial capacity, and + uses the specified . + + The estimated number of threads that will update the + concurrently. + The initial number of elements that the + can contain. + The + implementation to use when comparing items. + + is less than 1. -or- + is less than 0. + + + + + Adds the specified item to the . + + The item to add. + true if the items was added to the + successfully; false if it already exists. + The + contains too many items. + + + + Removes all items from the . + + + + + Determines whether the contains the specified + item. + + The item to locate in the . + true if the contains the item; otherwise, false. + + + + Attempts to remove the item from the . + + The item to remove. + true if an item was removed successfully; otherwise, false. + + + Returns an enumerator that iterates through the . + An enumerator for the . + + The enumerator returned from the collection is safe to use concurrently with + reads and writes to the collection, however it does not represent a moment-in-time snapshot + of the collection. The contents exposed through the enumerator may contain modifications + made to the collection after was called. + + + + + Structure that holds a result and duration of the in milliseconds + + + + + Measured milliseconds + + + + + Measured microseconds + + + + + Measured ticks + + + + + Structure that holds a duration of the in milliseconds. + + + + + Measured milliseconds + + + + + Measured microseconds + + + + + Measured ticks + + + + + An object that either wraps a SemaphoreSlim for synchronization or ignores synchronization completely and just keeps track of Wait / Release operations. + + + + + Provides functionality to automatically try the given piece of logic some number of times before re-throwing the exception. + This is useful for any piece of code which may experience transient failures. Be cautious of passing code with two distinct + actions given that if the second or subsequent piece of logic fails, the first will also be retried upon each retry. + + + Copied from https://github.com/microsoft/RetryOperationHelper/blob/master/RetryOperationHelper/RetryOperationHelper.cs + + + + Executes asynchronous function with retry logic. + The asynchronous function to be executed. + The maximum number of attempts. + Timespan to wait between attempts of the operation + The callback executed when an attempt is failed. + Allowed exceptions + The result type. + The producing the result. + + + Executes asynchronous function with retry logic. + The asynchronous function to be executed. + The maximum number of attempts. + Timespan to wait between attempts of the operation + The retry handler. + + The producing the result. + + + + Singleton timer used to measure the duration tasks. + + + + + Singleton stopwatch. + + + + + Current elapsed milliseconds of the stopwatch + + + + + Measures the duration of a code block + + + + + + + Measures the duration of an asyncronous code block + + + + + + + Measures the duration of an asyncronous code block + + + + + + + Measures duration of in ticks and milliseconds. + + + + + Measures duration of in ticks and milliseconds. + + + + + Create an array of bytes representing the UTF-8 encoding of the given string. + + String to get UTF-8 bytes for + Array of UTF-8 character bytes + + + + Culture aware Contains + + + + + Public Windows native methods + + + + + Tests whether the current user is a member of the Administrator's group. + + True if the current user is an Admin; false, otherwise. + + + + Registers security and sets the security values for the process. + + + Workaround to enable WAM Account Picker in an elevated process. + + + + + Gets the currently logged in user. Works for Windows when user is AD or AAD joined. Throws otherwise if cannot be found. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Parameters returned by the WWW-Authenticate header. This allows for dynamic + scenarios such as Claims challenge, Continuous Access Evaluation (CAE), and Conditional Access (CA). + See https://aka.ms/msal-net/wwwAuthenticate. + + + + + Resource for which to request scopes. + This is the App ID URI of the API that returned the WWW-Authenticate header. + + + Clients that perform resource validation (e.g. by comparing the host part of the resource against a list of known good hosts), + can still use the indexer to retrieve the raw value of the resource / scope. + + If a resource is used, add "/.default" to it to transform it into a scope, e.g. "https://graph.microsoft.com/.default" is the OAuth2 scope for "https://graph.microsoft.com" resource. + MSAL only works with scopes. + + + + + Scopes to request. + If it's not provided by the web API, it's computed from the Resource. + + + Clients that perform resource validation (e.g. by comparing the host part of the resource against a list of known good hosts), + can still use the indexer to retrieve the raw value of the resource / scope. + + If a resource is used, add "/.default" to it to transform it into a scope, e.g. "https://graph.microsoft.com/.default" is the OAuth2 scope for "https://graph.microsoft.com" resource. + MSAL only works with scopes. + + + + + Authority from which to request an access token. + + + + + Claims demanded by the web API. + + + + + Error. + + + + + AuthScheme. + See the documentation on WWW-Authenticate for more details + + + + + The nonce acquired from the WWW-Authenticate header. + + + + + Return the RawParameters of key . + + Name of the raw parameter to retrieve. + The raw parameter if it exists, + or throws a otherwise. + + + + + Dictionary of raw parameters in the WWW-Authenticate header (extracted from the WWW-Authenticate header + string value, without any processing). This allows support for APIs which are not mappable easily to the standard + or framework specific (Microsoft.Identity.Model, Microsoft.Identity.Web). + + + + + Gets Azure AD tenant ID. + + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + URI of the resource. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + URI of the resource. + The cancellation token to cancel operation. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + Instance of to make the request with. + URI of the resource. + The cancellation token to cancel operation. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create WWW-Authenticate parameters from the HttpResponseHeaders. + + HttpResponseHeaders. + Authentication scheme. Default is "Bearer". + The parameters requested by the web API. + Currently it only supports the Bearer scheme + + + + Creates parameters from the WWW-Authenticate string. + + String contained in a WWW-Authenticate header. + The parameters requested by the web API. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + URI of the resource. + Authentication scheme. + The cancellation token to cancel operation. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + Instance of to make the request with. + URI of the resource. + The cancellation token to cancel operation. + Authentication scheme. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create WWW-Authenticate parameters from the HttpResponseHeaders. + + HttpResponseHeaders. + Authentication scheme. + The parameters requested by the web API. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + URI of the resource. + The cancellation token to cancel operation. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create the authenticate parameters by attempting to call the resource unauthenticated, and analyzing the response. + + Instance of to make the request with. + URI of the resource. + The cancellation token to cancel operation. + WWW-Authenticate Parameters extracted from response to the unauthenticated call. + + + + Create WWW-Authenticate parameters from the HttpResponseHeaders for each auth scheme. + + HttpResponseHeaders. + The parameters requested by the web API. + Currently it only supports the Bearer scheme + + + + Gets the claim challenge from HTTP header. + Used, for example, for Conditional Access (CA). + + The HTTP response headers. + Authentication scheme. Default is Bearer. + The claims challenge + + + + Creates parameters from the WWW-Authenticate string. + + String contained in a WWW-Authenticate header. + Auth scheme of the result. + The parameters requested by the web API. + + + + Checks if input is a base-64 encoded string. + If it is one, decodes it to get a JSON fragment. + + Input string + a json fragment (original input string or decoded from base64 encoded). + + + + Class to hold the OpenTelemetry objects used by MSAL. + + + + + Constant to hold the name of the Meter. + + + + + Meter to hold the MSAL metrics. + + + + + Counter to hold the number of successful token acquisition calls. + + + + + Counter to hold the number of failed token acquisition calls. + + + + + Histogram to record total duration in milliseconds of token acquisition calls. + + + + + Histogram to record total duration of token acquisition calls in microseconds(us) when token is fetched from L1 cache. + + + + + Histogram to record duration in L2 cache for token acquisition calls. + + + + + Histogram to record duration in milliseconds in http when the token is fetched from identity provider. + + + + + Histogram to record total duration of extension modifications in microseconds(us). + + + + + + + + + + + + + This is how long we allow between completed navigations. + + + + + This is how long all redirect navigations are allowed to run for before a graceful + termination of the entire browser based authentication process is attempted. + + + + + Waits on the UI Thread to complete normally for NavigationOverallTimeout. + After it attempts shutdown the UI thread graceful followed by aborting + the thread if a graceful shutdown is not successful. + + + Returns true if the UI thread completed on its own before the timeout. Otherwise false. + + + + Callers expect the call to show the authentication dialog to be synchronous. This is easy in the + interactive case as ShowDialog is a synchronous call. However, ShowDialog will always show + the dialog. It can not be hidden. So it can not be used in the silent case. Instead we need + to do the equivalent of creating our own modal dialog. We start a new thread, launch an + invisible window on that thread. The original calling thread blocks until the secondary + UI thread completes. + + + + + + + + + + + + + + + + + + + + + + Make sure that the browser control does not surface any of it's own dialogs. + For instance bad certificate or javascript error dialogs. + + + + + + + + + This method must only be called from the UI thread. Since this is the + callers opportunity to call dispose on this object. Calling + Dispose must be done on the same thread on which this object + was constructed. + + + + + + + + + + + + + + + + + + Event arguments for BeforeNavigate event. + + + + + Initializes a new instance of WebBrowserBeforeNavigateEventArgs. + + + + + The URL to be navigated to. + + + + + The data to send to the server, if the HTTP POST transaction is used. + + + + + Additional HTTP headers to send to the server + + + + + The following flag, or zero. + beforeNavigateExternalFrameTarget (H0001) + Internet Explorer 7 or later. This navigation is the result of + an external window or tab that targets this browser. + + + + + The name of the frame in which to display the resource, + or null if no named frame is targeted for the resource. + + + + + A pointer to the IDispatch interface for the WebBrowserControl object that represents the window or frame. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The browser dialog used for user authentication + + + + + Default constructor + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Gets Web Browser control used by the dialog. + + + + + + + + + + + + + + + + + + + + + + + + + Some calls need to be made on the UI thread and this is the central place to check if we have an owner + window and if so, ensure we invoke on that proper thread. + + + + + + Some calls need to be made on the UI thread and this is the central place to do so and if so, ensure we invoke on that proper thread. + + + + + + + + + + + + + + + + + + Flags that specify the attributes required by the AcceptSecurityContext (CredSSP) function + for a server to establish the context. + https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-acceptsecuritycontext + + + + + Result of AcceptSecurityContext (CredSSP) function call which lets the server component of a transport application + establish a security context between the server and a remote client. + https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-acceptsecuritycontext + + + + + Previously authenticated logon data used by a security principal to establish its own identity, + such as a password, or a Kerberos protocol ticket. + + + + + Create a new object. + + Newly created object. + + + + Extension of a wrapper class for operating system handles. + + + + + Constructor. + + Credential handle to initialize. + + + + Checks the current contained handle is valid or not. + + + + + Release contained internal resource object. + + True always. + + + + Bit flags that indicate requests for the context for InitializeSecurityContext API call. + https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-initializesecuritycontexta + + + + + Status code returned from SSPI functions. + https://learn.microsoft.com/windows/win32/api/sspi/nf-sspi-initializesecuritycontexta + + + + + Helper class to check Kerberos Ticket in user's Ticket Cache. + + + + + Creates a object to read a Kerberos Ticket from Ticket Cache. + + Service principal name of ticket to read out from Ticket Cache. + The Logon ID of the user owning the ticket cache. + The default of 0 represents the currently logged in user. + The name of the Local Security Authority (LSA) authentication package that will be interacted with. + + + + Read out a Kerberos Ticket. + + Byte stream of Kerberos Ticket, if exists. Null otherwise. + + Throws if any error occurs while interfacing with Ticket Cache. + + + + + Clean up all data members used for interaction with Ticket Cache. + + + + + Clean up all data members used for interaction with Ticket Cache. + + + + + Provides a layer to interact with the LSA functions used to create logon sessions and manipulate the ticket caches. + + + + + Create a new instance of the interop as a standard unprivileged caller. + + The name of the LSA authentication package that will be interacted with. + Returns an instance of the class. + + + + Import a kerberos ticket containing one or more tickets into the current user ticket cache. + + The ticket to import into the cache. + The Logon Id of the user owning the ticket cache. The default of 0 represents the currently logged on user. + + + + Call Auth package to cache given Kerberos ticket. + + Pointer to Kerberos Ticket to cache. + Length of Kerberos Ticket data. + + + + Dispose all interment members. + + True if Dispose() called by the user. False, otherwise. + + + + Deletes current object. + + + + + + + Provides a scheduler that uses STA threads. + + + The STA threads used by the scheduler. + + + Stores the queued tasks to be executed by our pool of STA threads. + + + Initializes a new instance of the StaTaskScheduler class with the specified concurrency level. + The number of threads that should be created and used by this scheduler. + + + Gets the maximum concurrency level supported by this scheduler. + + + + Cleans up the scheduler by indicating that no more tasks will be queued. + This method blocks until all threads successfully shutdown. + + + + Queues a Task to be executed by this scheduler. + The task to be executed. + + + Provides a list of the scheduled tasks for the debugger to consume. + An enumerable of all tasks currently scheduled. + + + Determines whether a Task may be inlined. + The task to be executed. + Whether the task was previously queued. + true if the task was successfully inlined; otherwise, false. + + + + + + + + Platform / OS specific logic. + + + + + + + + Get the user logged in to Windows or throws + + Upn or throws + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + An abstraction over objects that are able to listen to localhost url (e.g. http://localhost:1234) + and to retrieve the whole url, including query params (e.g. http://localhost:1234?code=auth_code_from_aad) + + + + + Listens to http://localhost:{port} and retrieve the entire url, including query params. Then + push back a response such as a display message or a redirect. + + Cancellation is very important as this is typically a long running unmonitored operation + the port to listen to + the path to listen in + The message to be displayed, or url to be redirected to will be created by this callback + Cancellation token + Full redirect uri + + + + Represents a BSON Oid (object id). + + + + + Gets or sets the value of the Oid. + + The value of the Oid. + + + + Initializes a new instance of the class. + + The Oid value. + + + + Represents a reader that provides fast, non-cached, forward-only access to serialized BSON data. + + + + + Gets or sets a value indicating whether binary data reading should be compatible with incorrect Json.NET 3.5 written binary. + + + true if binary data reading will be compatible with incorrect Json.NET 3.5 written binary; otherwise, false. + + + + + Gets or sets a value indicating whether the root object will be read as a JSON array. + + + true if the root object will be read as a JSON array; otherwise, false. + + + + + Gets or sets the used when reading values from BSON. + + The used when reading values from BSON. + + + + Initializes a new instance of the class. + + The containing the BSON data to read. + + + + Initializes a new instance of the class. + + The containing the BSON data to read. + + + + Initializes a new instance of the class. + + The containing the BSON data to read. + if set to true the root object will be read as a JSON array. + The used when reading values from BSON. + + + + Initializes a new instance of the class. + + The containing the BSON data to read. + if set to true the root object will be read as a JSON array. + The used when reading values from BSON. + + + + Reads the next JSON token from the underlying . + + + true if the next token was read successfully; false if there are no more tokens to read. + + + + + Changes the reader's state to . + If is set to true, the underlying is also closed. + + + + + Represents a writer that provides a fast, non-cached, forward-only way of generating BSON data. + + + + + Gets or sets the used when writing values to BSON. + When set to no conversion will occur. + + The used when writing values to BSON. + + + + Initializes a new instance of the class. + + The to write to. + + + + Initializes a new instance of the class. + + The to write to. + + + + Flushes whatever is in the buffer to the underlying and also flushes the underlying stream. + + + + + Writes the end. + + The token. + + + + Writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + + + + Writes the start of a constructor with the given name. + + The name of the constructor. + + + + Writes raw JSON. + + The raw JSON to write. + + + + Writes raw JSON where a value is expected and updates the writer's state. + + The raw JSON to write. + + + + Writes the beginning of a JSON array. + + + + + Writes the beginning of a JSON object. + + + + + Writes the property name of a name/value pair on a JSON object. + + The name of the property. + + + + Closes this writer. + If is set to true, the underlying is also closed. + If is set to true, the JSON is auto-completed. + + + + + Writes a value. + An error will raised if the value cannot be written as a single JSON token. + + The value to write. + + + + Writes a null value. + + + + + Writes an undefined value. + + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a [] value. + + The [] value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a [] value that represents a BSON object id. + + The Object ID value to write. + + + + Writes a BSON regex. + + The regex pattern. + The regex options. + + + + Specifies how constructors are used when initializing objects during deserialization by the . + + + + + First attempt to use the public default constructor, then fall back to a single parameterized constructor, then to the non-public default constructor. + + + + + Json.NET will use a non-public default constructor before falling back to a parameterized constructor. + + + + + Converts a binary value to and from a base 64 string value. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts a to and from JSON and BSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Creates a custom object. + + The object type to convert. + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Creates an object which will then be populated by the serializer. + + Type of the object. + The created object. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Gets a value indicating whether this can write JSON. + + + true if this can write JSON; otherwise, false. + + + + + Converts a to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified value type. + + Type of the value. + + true if this instance can convert the specified value type; otherwise, false. + + + + + Converts a to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified value type. + + Type of the value. + + true if this instance can convert the specified value type; otherwise, false. + + + + + Provides a base class for converting a to and from JSON. + + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts a F# discriminated union type to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts an Entity Framework to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts an to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Gets a value indicating whether this can write JSON. + + + true if this can write JSON; otherwise, false. + + + + + Converts a to and from the ISO 8601 date format (e.g. "2008-04-12T12:53Z"). + + + + + Gets or sets the date time styles used when converting a date to and from JSON. + + The date time styles used when converting a date to and from JSON. + + + + Gets or sets the date time format used when converting a date to and from JSON. + + The date time format used when converting a date to and from JSON. + + + + Gets or sets the culture used when converting a date to and from JSON. + + The culture used when converting a date to and from JSON. + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Converts a to and from a JavaScript Date constructor (e.g. new Date(52231943)). + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing property value of the JSON that is being converted. + The calling serializer. + The object value. + + + + Converts a to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts a to and from JSON and BSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts an to and from its name string value. + + + + + Gets or sets a value indicating whether the written enum text should be camel case. + The default value is false. + + true if the written enum text will be camel case; otherwise, false. + + + + Gets or sets the naming strategy used to resolve how enum text is written. + + The naming strategy used to resolve how enum text is written. + + + + Gets or sets a value indicating whether integer values are allowed when serializing and deserializing. + The default value is true. + + true if integers are allowed when serializing and deserializing; otherwise, false. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class. + + true if the written enum text will be camel case; otherwise, false. + + + + Initializes a new instance of the class. + + The naming strategy used to resolve how enum text is written. + true if integers are allowed when serializing and deserializing; otherwise, false. + + + + Initializes a new instance of the class. + + The of the used to write enum text. + + + + Initializes a new instance of the class. + + The of the used to write enum text. + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + + + + Initializes a new instance of the class. + + The of the used to write enum text. + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + true if integers are allowed when serializing and deserializing; otherwise, false. + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts a to and from Unix epoch time + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing property value of the JSON that is being converted. + The calling serializer. + The object value. + + + + Converts a to and from a string (e.g. "1.2.3.4"). + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing property value of the JSON that is being converted. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Converts XML to and from JSON. + + + + + Gets or sets the name of the root element to insert when deserializing to XML if the JSON structure has produced multiple root elements. + + The name of the deserialized root element. + + + + Gets or sets a value to indicate whether to write the Json.NET array attribute. + This attribute helps preserve arrays when converting the written XML back to JSON. + + true if the array attribute is written to the XML; otherwise, false. + + + + Gets or sets a value indicating whether to write the root JSON object. + + true if the JSON root object is omitted; otherwise, false. + + + + Gets or sets a value indicating whether to encode special characters when converting JSON to XML. + If true, special characters like ':', '@', '?', '#' and '$' in JSON property names aren't used to specify + XML namespaces, attributes or processing directives. Instead special characters are encoded and written + as part of the XML element name. + + true if special characters are encoded; otherwise, false. + + + + Writes the JSON representation of the object. + + The to write to. + The calling serializer. + The value. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Checks if the is a namespace attribute. + + Attribute name to test. + The attribute name prefix if it has one, otherwise an empty string. + true if attribute name is for a namespace attribute, otherwise false. + + + + Determines whether this instance can convert the specified value type. + + Type of the value. + + true if this instance can convert the specified value type; otherwise, false. + + + + + Specifies how dates are formatted when writing JSON text. + + + + + Dates are written in the ISO 8601 format, e.g. "2012-03-21T05:40Z". + + + + + Dates are written in the Microsoft JSON format, e.g. "\/Date(1198908717056)\/". + + + + + Specifies how date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed when reading JSON text. + + + + + Date formatted strings are not parsed to a date type and are read as strings. + + + + + Date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed to . + + + + + Date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed to . + + + + + Specifies how to treat the time value when converting between string and . + + + + + Treat as local time. If the object represents a Coordinated Universal Time (UTC), it is converted to the local time. + + + + + Treat as a UTC. If the object represents a local time, it is converted to a UTC. + + + + + Treat as a local time if a is being converted to a string. + If a string is being converted to , convert to a local time if a time zone is specified. + + + + + Time zone information should be preserved when converting. + + + + + The default JSON name table implementation. + + + + + Initializes a new instance of the class. + + + + + Gets a string containing the same characters as the specified range of characters in the given array. + + The character array containing the name to find. + The zero-based index into the array specifying the first character of the name. + The number of characters in the name. + A string containing the same characters as the specified range of characters in the given array. + + + + Adds the specified string into name table. + + The string to add. + This method is not thread-safe. + The resolved string. + + + + Specifies default value handling options for the . + + + + + + + + + Include members where the member value is the same as the member's default value when serializing objects. + Included members are written to JSON. Has no effect when deserializing. + + + + + Ignore members where the member value is the same as the member's default value when serializing objects + so that it is not written to JSON. + This option will ignore all default values (e.g. null for objects and nullable types; 0 for integers, + decimals and floating point numbers; and false for booleans). The default value ignored can be changed by + placing the on the property. + + + + + Members with a default value but no JSON will be set to their default value when deserializing. + + + + + Ignore members where the member value is the same as the member's default value when serializing objects + and set members to their default value when deserializing. + + + + + Specifies float format handling options when writing special floating point numbers, e.g. , + and with . + + + + + Write special floating point values as strings in JSON, e.g. "NaN", "Infinity", "-Infinity". + + + + + Write special floating point values as symbols in JSON, e.g. NaN, Infinity, -Infinity. + Note that this will produce non-valid JSON. + + + + + Write special floating point values as the property's default value in JSON, e.g. 0.0 for a property, null for a of property. + + + + + Specifies how floating point numbers, e.g. 1.0 and 9.9, are parsed when reading JSON text. + + + + + Floating point numbers are parsed to . + + + + + Floating point numbers are parsed to . + + + + + Specifies formatting options for the . + + + + + No special formatting is applied. This is the default. + + + + + Causes child objects to be indented according to the and settings. + + + + + Provides an interface for using pooled arrays. + + The array type content. + + + + Rent an array from the pool. This array must be returned when it is no longer needed. + + The minimum required length of the array. The returned array may be longer. + The rented array from the pool. This array must be returned when it is no longer needed. + + + + Return an array to the pool. + + The array that is being returned. + + + + Provides an interface to enable a class to return line and position information. + + + + + Gets a value indicating whether the class can return line information. + + + true if and can be provided; otherwise, false. + + + + + Gets the current line number. + + The current line number or 0 if no line information is available (for example, when returns false). + + + + Gets the current line position. + + The current line position or 0 if no line information is available (for example, when returns false). + + + + Instructs the how to serialize the collection. + + + + + Gets or sets a value indicating whether null items are allowed in the collection. + + true if null items are allowed in the collection; otherwise, false. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class with a flag indicating whether the array can contain null items. + + A flag indicating whether the array can contain null items. + + + + Initializes a new instance of the class with the specified container Id. + + The container Id. + + + + Instructs the to use the specified constructor when deserializing that object. + + + + + Instructs the how to serialize the object. + + + + + Gets or sets the id. + + The id. + + + + Gets or sets the title. + + The title. + + + + Gets or sets the description. + + The description. + + + + Gets or sets the collection's items converter. + + The collection's items converter. + + + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + + + [JsonContainer(ItemConverterType = typeof(MyContainerConverter), ItemConverterParameters = new object[] { 123, "Four" })] + + + + + + Gets or sets the of the . + + The of the . + + + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + + + [JsonContainer(NamingStrategyType = typeof(MyNamingStrategy), NamingStrategyParameters = new object[] { 123, "Four" })] + + + + + + Gets or sets a value that indicates whether to preserve object references. + + + true to keep object reference; otherwise, false. The default is false. + + + + + Gets or sets a value that indicates whether to preserve collection's items references. + + + true to keep collection's items object references; otherwise, false. The default is false. + + + + + Gets or sets the reference loop handling used when serializing the collection's items. + + The reference loop handling. + + + + Gets or sets the type name handling used when serializing the collection's items. + + The type name handling. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class with the specified container Id. + + The container Id. + + + + Provides methods for converting between .NET types and JSON types. + + + + + + + + Gets or sets a function that creates default . + Default settings are automatically used by serialization methods on , + and and on . + To serialize without using any default settings create a with + . + + + + + Represents JavaScript's boolean value true as a string. This field is read-only. + + + + + Represents JavaScript's boolean value false as a string. This field is read-only. + + + + + Represents JavaScript's null as a string. This field is read-only. + + + + + Represents JavaScript's undefined as a string. This field is read-only. + + + + + Represents JavaScript's positive infinity as a string. This field is read-only. + + + + + Represents JavaScript's negative infinity as a string. This field is read-only. + + + + + Represents JavaScript's NaN as a string. This field is read-only. + + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation using the specified. + + The value to convert. + The format the date will be converted to. + The time zone handling when the date is converted to a string. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation using the specified. + + The value to convert. + The format the date will be converted to. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + The string delimiter character. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + The string delimiter character. + The string escape handling. + A JSON string representation of the . + + + + Converts the to its JSON string representation. + + The value to convert. + A JSON string representation of the . + + + + Serializes the specified object to a JSON string. + + The object to serialize. + A JSON string representation of the object. + + + + Serializes the specified object to a JSON string using formatting. + + The object to serialize. + Indicates how the output should be formatted. + + A JSON string representation of the object. + + + + + Serializes the specified object to a JSON string using a collection of . + + The object to serialize. + A collection of converters used while serializing. + A JSON string representation of the object. + + + + Serializes the specified object to a JSON string using formatting and a collection of . + + The object to serialize. + Indicates how the output should be formatted. + A collection of converters used while serializing. + A JSON string representation of the object. + + + + Serializes the specified object to a JSON string using . + + The object to serialize. + The used to serialize the object. + If this is null, default serialization settings will be used. + + A JSON string representation of the object. + + + + + Serializes the specified object to a JSON string using a type, formatting and . + + The object to serialize. + The used to serialize the object. + If this is null, default serialization settings will be used. + + The type of the value being serialized. + This parameter is used when is to write out the type name if the type of the value does not match. + Specifying the type is optional. + + + A JSON string representation of the object. + + + + + Serializes the specified object to a JSON string using formatting and . + + The object to serialize. + Indicates how the output should be formatted. + The used to serialize the object. + If this is null, default serialization settings will be used. + + A JSON string representation of the object. + + + + + Serializes the specified object to a JSON string using a type, formatting and . + + The object to serialize. + Indicates how the output should be formatted. + The used to serialize the object. + If this is null, default serialization settings will be used. + + The type of the value being serialized. + This parameter is used when is to write out the type name if the type of the value does not match. + Specifying the type is optional. + + + A JSON string representation of the object. + + + + + Deserializes the JSON to a .NET object. + + The JSON to deserialize. + The deserialized object from the JSON string. + + + + Deserializes the JSON to a .NET object using . + + The JSON to deserialize. + + The used to deserialize the object. + If this is null, default serialization settings will be used. + + The deserialized object from the JSON string. + + + + Deserializes the JSON to the specified .NET type. + + The JSON to deserialize. + The of object being deserialized. + The deserialized object from the JSON string. + + + + Deserializes the JSON to the specified .NET type. + + The type of the object to deserialize to. + The JSON to deserialize. + The deserialized object from the JSON string. + + + + Deserializes the JSON to the given anonymous type. + + + The anonymous type to deserialize to. This can't be specified + traditionally and must be inferred from the anonymous type passed + as a parameter. + + The JSON to deserialize. + The anonymous type object. + The deserialized anonymous type from the JSON string. + + + + Deserializes the JSON to the given anonymous type using . + + + The anonymous type to deserialize to. This can't be specified + traditionally and must be inferred from the anonymous type passed + as a parameter. + + The JSON to deserialize. + The anonymous type object. + + The used to deserialize the object. + If this is null, default serialization settings will be used. + + The deserialized anonymous type from the JSON string. + + + + Deserializes the JSON to the specified .NET type using a collection of . + + The type of the object to deserialize to. + The JSON to deserialize. + Converters to use while deserializing. + The deserialized object from the JSON string. + + + + Deserializes the JSON to the specified .NET type using . + + The type of the object to deserialize to. + The object to deserialize. + + The used to deserialize the object. + If this is null, default serialization settings will be used. + + The deserialized object from the JSON string. + + + + Deserializes the JSON to the specified .NET type using a collection of . + + The JSON to deserialize. + The type of the object to deserialize. + Converters to use while deserializing. + The deserialized object from the JSON string. + + + + Deserializes the JSON to the specified .NET type using . + + The JSON to deserialize. + The type of the object to deserialize to. + + The used to deserialize the object. + If this is null, default serialization settings will be used. + + The deserialized object from the JSON string. + + + + Populates the object with values from the JSON string. + + The JSON to populate values from. + The target object to populate values onto. + + + + Populates the object with values from the JSON string using . + + The JSON to populate values from. + The target object to populate values onto. + + The used to deserialize the object. + If this is null, default serialization settings will be used. + + + + + Serializes the to a JSON string. + + The node to serialize. + A JSON string of the . + + + + Serializes the to a JSON string using formatting. + + The node to serialize. + Indicates how the output should be formatted. + A JSON string of the . + + + + Serializes the to a JSON string using formatting and omits the root object if is true. + + The node to serialize. + Indicates how the output should be formatted. + Omits writing the root object. + A JSON string of the . + + + + Deserializes the from a JSON string. + + The JSON string. + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by . + + The JSON string. + The name of the root element to append when deserializing. + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by + and writes a Json.NET array attribute for collections. + + The JSON string. + The name of the root element to append when deserializing. + + A value to indicate whether to write the Json.NET array attribute. + This attribute helps preserve arrays when converting the written XML back to JSON. + + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by , + writes a Json.NET array attribute for collections, and encodes special characters. + + The JSON string. + The name of the root element to append when deserializing. + + A value to indicate whether to write the Json.NET array attribute. + This attribute helps preserve arrays when converting the written XML back to JSON. + + + A value to indicate whether to encode special characters when converting JSON to XML. + If true, special characters like ':', '@', '?', '#' and '$' in JSON property names aren't used to specify + XML namespaces, attributes or processing directives. Instead special characters are encoded and written + as part of the XML element name. + + The deserialized . + + + + Serializes the to a JSON string. + + The node to convert to JSON. + A JSON string of the . + + + + Serializes the to a JSON string using formatting. + + The node to convert to JSON. + Indicates how the output should be formatted. + A JSON string of the . + + + + Serializes the to a JSON string using formatting and omits the root object if is true. + + The node to serialize. + Indicates how the output should be formatted. + Omits writing the root object. + A JSON string of the . + + + + Deserializes the from a JSON string. + + The JSON string. + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by . + + The JSON string. + The name of the root element to append when deserializing. + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by + and writes a Json.NET array attribute for collections. + + The JSON string. + The name of the root element to append when deserializing. + + A value to indicate whether to write the Json.NET array attribute. + This attribute helps preserve arrays when converting the written XML back to JSON. + + The deserialized . + + + + Deserializes the from a JSON string nested in a root element specified by , + writes a Json.NET array attribute for collections, and encodes special characters. + + The JSON string. + The name of the root element to append when deserializing. + + A value to indicate whether to write the Json.NET array attribute. + This attribute helps preserve arrays when converting the written XML back to JSON. + + + A value to indicate whether to encode special characters when converting JSON to XML. + If true, special characters like ':', '@', '?', '#' and '$' in JSON property names aren't used to specify + XML namespaces, attributes or processing directives. Instead special characters are encoded and written + as part of the XML element name. + + The deserialized . + + + + Converts an object to and from JSON. + + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Gets a value indicating whether this can read JSON. + + true if this can read JSON; otherwise, false. + + + + Gets a value indicating whether this can write JSON. + + true if this can write JSON; otherwise, false. + + + + Converts an object to and from JSON. + + The object type to convert. + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Writes the JSON representation of the object. + + The to write to. + The value. + The calling serializer. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. + The calling serializer. + The object value. + + + + Reads the JSON representation of the object. + + The to read from. + Type of the object. + The existing value of object being read. If there is no existing value then null will be used. + The existing value has a value. + The calling serializer. + The object value. + + + + Determines whether this instance can convert the specified object type. + + Type of the object. + + true if this instance can convert the specified object type; otherwise, false. + + + + + Instructs the to use the specified when serializing the member or class. + + + + + Gets the of the . + + The of the . + + + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + + + + + Initializes a new instance of the class. + + Type of the . + + + + Initializes a new instance of the class. + + Type of the . + Parameter list to use when constructing the . Can be null. + + + + Represents a collection of . + + + + + Instructs the how to serialize the collection. + + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class with the specified container Id. + + The container Id. + + + + The exception thrown when an error occurs during JSON serialization or deserialization. + + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class + with a specified error message. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the class + with a specified error message and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Initializes a new instance of the class. + + The that holds the serialized object data about the exception being thrown. + The that contains contextual information about the source or destination. + The parameter is null. + The class name is null or is zero (0). + + + + Instructs the to deserialize properties with no matching class member into the specified collection + and write values during serialization. + + + + + Gets or sets a value that indicates whether to write extension data when serializing the object. + + + true to write extension data when serializing the object; otherwise, false. The default is true. + + + + + Gets or sets a value that indicates whether to read extension data when deserializing the object. + + + true to read extension data when deserializing the object; otherwise, false. The default is true. + + + + + Initializes a new instance of the class. + + + + + Instructs the not to serialize the public field or public read/write property value. + + + + + Base class for a table of atomized string objects. + + + + + Gets a string containing the same characters as the specified range of characters in the given array. + + The character array containing the name to find. + The zero-based index into the array specifying the first character of the name. + The number of characters in the name. + A string containing the same characters as the specified range of characters in the given array. + + + + Instructs the how to serialize the object. + + + + + Gets or sets the member serialization. + + The member serialization. + + + + Gets or sets the missing member handling used when deserializing this object. + + The missing member handling. + + + + Gets or sets how the object's properties with null values are handled during serialization and deserialization. + + How the object's properties with null values are handled during serialization and deserialization. + + + + Gets or sets a value that indicates whether the object's properties are required. + + + A value indicating whether the object's properties are required. + + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class with the specified member serialization. + + The member serialization. + + + + Initializes a new instance of the class with the specified container Id. + + The container Id. + + + + Instructs the to always serialize the member with the specified name. + + + + + Gets or sets the type used when serializing the property's collection items. + + The collection's items type. + + + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + + + [JsonProperty(ItemConverterType = typeof(MyContainerConverter), ItemConverterParameters = new object[] { 123, "Four" })] + + + + + + Gets or sets the of the . + + The of the . + + + + The parameter list to use when constructing the described by . + If null, the default constructor is used. + When non-null, there must be a constructor defined in the that exactly matches the number, + order, and type of these parameters. + + + + [JsonProperty(NamingStrategyType = typeof(MyNamingStrategy), NamingStrategyParameters = new object[] { 123, "Four" })] + + + + + + Gets or sets the null value handling used when serializing this property. + + The null value handling. + + + + Gets or sets the default value handling used when serializing this property. + + The default value handling. + + + + Gets or sets the reference loop handling used when serializing this property. + + The reference loop handling. + + + + Gets or sets the object creation handling used when deserializing this property. + + The object creation handling. + + + + Gets or sets the type name handling used when serializing this property. + + The type name handling. + + + + Gets or sets whether this property's value is serialized as a reference. + + Whether this property's value is serialized as a reference. + + + + Gets or sets the order of serialization of a member. + + The numeric order of serialization. + + + + Gets or sets a value indicating whether this property is required. + + + A value indicating whether this property is required. + + + + + Gets or sets the name of the property. + + The name of the property. + + + + Gets or sets the reference loop handling used when serializing the property's collection items. + + The collection's items reference loop handling. + + + + Gets or sets the type name handling used when serializing the property's collection items. + + The collection's items type name handling. + + + + Gets or sets whether this property's collection items are serialized as a reference. + + Whether this property's collection items are serialized as a reference. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class with the specified name. + + Name of the property. + + + + Represents a reader that provides fast, non-cached, forward-only access to serialized JSON data. + + + + + Asynchronously reads the next JSON token from the source. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns true if the next token was read successfully; false if there are no more tokens to read. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously skips the children of the current token. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a []. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the []. This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously reads the next JSON token from the source as a . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the . This result will be null at the end of an array. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Specifies the state of the reader. + + + + + A read method has not been called. + + + + + The end of the file has been reached successfully. + + + + + Reader is at a property. + + + + + Reader is at the start of an object. + + + + + Reader is in an object. + + + + + Reader is at the start of an array. + + + + + Reader is in an array. + + + + + The method has been called. + + + + + Reader has just read a value. + + + + + Reader is at the start of a constructor. + + + + + Reader is in a constructor. + + + + + An error occurred that prevents the read operation from continuing. + + + + + The end of the file has been reached successfully. + + + + + Gets the current reader state. + + The current reader state. + + + + Gets or sets a value indicating whether the source should be closed when this reader is closed. + + + true to close the source when this reader is closed; otherwise false. The default is true. + + + + + Gets or sets a value indicating whether multiple pieces of JSON content can + be read from a continuous stream without erroring. + + + true to support reading multiple pieces of JSON content; otherwise false. + The default is false. + + + + + Gets the quotation mark character used to enclose the value of a string. + + + + + Gets or sets how time zones are handled when reading JSON. + + + + + Gets or sets how date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed when reading JSON. + + + + + Gets or sets how floating point numbers, e.g. 1.0 and 9.9, are parsed when reading JSON text. + + + + + Gets or sets how custom date formatted strings are parsed when reading JSON. + + + + + Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . + A null value means there is no maximum. + The default value is 128. + + + + + Gets the type of the current JSON token. + + + + + Gets the text value of the current JSON token. + + + + + Gets the .NET type for the current JSON token. + + + + + Gets the depth of the current token in the JSON document. + + The depth of the current token in the JSON document. + + + + Gets the path of the current JSON token. + + + + + Gets or sets the culture used when reading JSON. Defaults to . + + + + + Initializes a new instance of the class. + + + + + Reads the next JSON token from the source. + + true if the next token was read successfully; false if there are no more tokens to read. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a . + + A . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a []. + + A [] or null if the next JSON token is null. This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the source as a of . + + A of . This method will return null at the end of an array. + + + + Skips the children of the current token. + + + + + Sets the current token. + + The new token. + + + + Sets the current token and value. + + The new token. + The value. + + + + Sets the current token and value. + + The new token. + The value. + A flag indicating whether the position index inside an array should be updated. + + + + Sets the state based on current token type. + + + + + Releases unmanaged and - optionally - managed resources. + + true to release both managed and unmanaged resources; false to release only unmanaged resources. + + + + Changes the reader's state to . + If is set to true, the source is also closed. + + + + + The exception thrown when an error occurs while reading JSON text. + + + + + Gets the line number indicating where the error occurred. + + The line number indicating where the error occurred. + + + + Gets the line position indicating where the error occurred. + + The line position indicating where the error occurred. + + + + Gets the path to the JSON where the error occurred. + + The path to the JSON where the error occurred. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class + with a specified error message. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the class + with a specified error message and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Initializes a new instance of the class. + + The that holds the serialized object data about the exception being thrown. + The that contains contextual information about the source or destination. + The parameter is null. + The class name is null or is zero (0). + + + + Initializes a new instance of the class + with a specified error message, JSON path, line number, line position, and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The path to the JSON where the error occurred. + The line number indicating where the error occurred. + The line position indicating where the error occurred. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Instructs the to always serialize the member, and to require that the member has a value. + + + + + The exception thrown when an error occurs during JSON serialization or deserialization. + + + + + Gets the line number indicating where the error occurred. + + The line number indicating where the error occurred. + + + + Gets the line position indicating where the error occurred. + + The line position indicating where the error occurred. + + + + Gets the path to the JSON where the error occurred. + + The path to the JSON where the error occurred. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class + with a specified error message. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the class + with a specified error message and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Initializes a new instance of the class. + + The that holds the serialized object data about the exception being thrown. + The that contains contextual information about the source or destination. + The parameter is null. + The class name is null or is zero (0). + + + + Initializes a new instance of the class + with a specified error message, JSON path, line number, line position, and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The path to the JSON where the error occurred. + The line number indicating where the error occurred. + The line position indicating where the error occurred. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Serializes and deserializes objects into and from the JSON format. + The enables you to control how objects are encoded into JSON. + + + + + Occurs when the errors during serialization and deserialization. + + + + + Gets or sets the used by the serializer when resolving references. + + + + + Gets or sets the used by the serializer when resolving type names. + + + + + Gets or sets the used by the serializer when resolving type names. + + + + + Gets or sets the used by the serializer when writing trace messages. + + The trace writer. + + + + Gets or sets the equality comparer used by the serializer when comparing references. + + The equality comparer. + + + + Gets or sets how type name writing and reading is handled by the serializer. + The default value is . + + + should be used with caution when your application deserializes JSON from an external source. + Incoming types should be validated with a custom + when deserializing with a value other than . + + + + + Gets or sets how a type name assembly is written and resolved by the serializer. + The default value is . + + The type name assembly format. + + + + Gets or sets how a type name assembly is written and resolved by the serializer. + The default value is . + + The type name assembly format. + + + + Gets or sets how object references are preserved by the serializer. + The default value is . + + + + + Gets or sets how reference loops (e.g. a class referencing itself) is handled. + The default value is . + + + + + Gets or sets how missing members (e.g. JSON contains a property that isn't a member on the object) are handled during deserialization. + The default value is . + + + + + Gets or sets how null values are handled during serialization and deserialization. + The default value is . + + + + + Gets or sets how default values are handled during serialization and deserialization. + The default value is . + + + + + Gets or sets how objects are created during deserialization. + The default value is . + + The object creation handling. + + + + Gets or sets how constructors are used during deserialization. + The default value is . + + The constructor handling. + + + + Gets or sets how metadata properties are used during deserialization. + The default value is . + + The metadata properties handling. + + + + Gets a collection that will be used during serialization. + + Collection that will be used during serialization. + + + + Gets or sets the contract resolver used by the serializer when + serializing .NET objects to JSON and vice versa. + + + + + Gets or sets the used by the serializer when invoking serialization callback methods. + + The context. + + + + Indicates how JSON text output is formatted. + The default value is . + + + + + Gets or sets how dates are written to JSON text. + The default value is . + + + + + Gets or sets how time zones are handled during serialization and deserialization. + The default value is . + + + + + Gets or sets how date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed when reading JSON. + The default value is . + + + + + Gets or sets how floating point numbers, e.g. 1.0 and 9.9, are parsed when reading JSON text. + The default value is . + + + + + Gets or sets how special floating point numbers, e.g. , + and , + are written as JSON text. + The default value is . + + + + + Gets or sets how strings are escaped when writing JSON text. + The default value is . + + + + + Gets or sets how and values are formatted when writing JSON text, + and the expected date format when reading JSON text. + The default value is "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK". + + + + + Gets or sets the culture used when reading JSON. + The default value is . + + + + + Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . + A null value means there is no maximum. + The default value is 128. + + + + + Gets a value indicating whether there will be a check for additional JSON content after deserializing an object. + The default value is false. + + + true if there will be a check for additional JSON content after deserializing an object; otherwise, false. + + + + + Initializes a new instance of the class. + + + + + Creates a new instance. + The will not use default settings + from . + + + A new instance. + The will not use default settings + from . + + + + + Creates a new instance using the specified . + The will not use default settings + from . + + The settings to be applied to the . + + A new instance using the specified . + The will not use default settings + from . + + + + + Creates a new instance. + The will use default settings + from . + + + A new instance. + The will use default settings + from . + + + + + Creates a new instance using the specified . + The will use default settings + from as well as the specified . + + The settings to be applied to the . + + A new instance using the specified . + The will use default settings + from as well as the specified . + + + + + Populates the JSON values onto the target object. + + The that contains the JSON structure to read values from. + The target object to populate values onto. + + + + Populates the JSON values onto the target object. + + The that contains the JSON structure to read values from. + The target object to populate values onto. + + + + Deserializes the JSON structure contained by the specified . + + The that contains the JSON structure to deserialize. + The being deserialized. + + + + Deserializes the JSON structure contained by the specified + into an instance of the specified type. + + The containing the object. + The of object being deserialized. + The instance of being deserialized. + + + + Deserializes the JSON structure contained by the specified + into an instance of the specified type. + + The containing the object. + The type of the object to deserialize. + The instance of being deserialized. + + + + Deserializes the JSON structure contained by the specified + into an instance of the specified type. + + The containing the object. + The of object being deserialized. + The instance of being deserialized. + + + + Serializes the specified and writes the JSON structure + using the specified . + + The used to write the JSON structure. + The to serialize. + + + + Serializes the specified and writes the JSON structure + using the specified . + + The used to write the JSON structure. + The to serialize. + + The type of the value being serialized. + This parameter is used when is to write out the type name if the type of the value does not match. + Specifying the type is optional. + + + + + Serializes the specified and writes the JSON structure + using the specified . + + The used to write the JSON structure. + The to serialize. + + The type of the value being serialized. + This parameter is used when is Auto to write out the type name if the type of the value does not match. + Specifying the type is optional. + + + + + Serializes the specified and writes the JSON structure + using the specified . + + The used to write the JSON structure. + The to serialize. + + + + Specifies the settings on a object. + + + + + Gets or sets how reference loops (e.g. a class referencing itself) are handled. + The default value is . + + Reference loop handling. + + + + Gets or sets how missing members (e.g. JSON contains a property that isn't a member on the object) are handled during deserialization. + The default value is . + + Missing member handling. + + + + Gets or sets how objects are created during deserialization. + The default value is . + + The object creation handling. + + + + Gets or sets how null values are handled during serialization and deserialization. + The default value is . + + Null value handling. + + + + Gets or sets how default values are handled during serialization and deserialization. + The default value is . + + The default value handling. + + + + Gets or sets a collection that will be used during serialization. + + The converters. + + + + Gets or sets how object references are preserved by the serializer. + The default value is . + + The preserve references handling. + + + + Gets or sets how type name writing and reading is handled by the serializer. + The default value is . + + + should be used with caution when your application deserializes JSON from an external source. + Incoming types should be validated with a custom + when deserializing with a value other than . + + The type name handling. + + + + Gets or sets how metadata properties are used during deserialization. + The default value is . + + The metadata properties handling. + + + + Gets or sets how a type name assembly is written and resolved by the serializer. + The default value is . + + The type name assembly format. + + + + Gets or sets how a type name assembly is written and resolved by the serializer. + The default value is . + + The type name assembly format. + + + + Gets or sets how constructors are used during deserialization. + The default value is . + + The constructor handling. + + + + Gets or sets the contract resolver used by the serializer when + serializing .NET objects to JSON and vice versa. + + The contract resolver. + + + + Gets or sets the equality comparer used by the serializer when comparing references. + + The equality comparer. + + + + Gets or sets the used by the serializer when resolving references. + + The reference resolver. + + + + Gets or sets a function that creates the used by the serializer when resolving references. + + A function that creates the used by the serializer when resolving references. + + + + Gets or sets the used by the serializer when writing trace messages. + + The trace writer. + + + + Gets or sets the used by the serializer when resolving type names. + + The binder. + + + + Gets or sets the used by the serializer when resolving type names. + + The binder. + + + + Gets or sets the error handler called during serialization and deserialization. + + The error handler called during serialization and deserialization. + + + + Gets or sets the used by the serializer when invoking serialization callback methods. + + The context. + + + + Gets or sets how and values are formatted when writing JSON text, + and the expected date format when reading JSON text. + The default value is "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK". + + + + + Gets or sets the maximum depth allowed when reading JSON. Reading past this depth will throw a . + A null value means there is no maximum. + The default value is 128. + + + + + Indicates how JSON text output is formatted. + The default value is . + + + + + Gets or sets how dates are written to JSON text. + The default value is . + + + + + Gets or sets how time zones are handled during serialization and deserialization. + The default value is . + + + + + Gets or sets how date formatted strings, e.g. "\/Date(1198908717056)\/" and "2012-03-21T05:40Z", are parsed when reading JSON. + The default value is . + + + + + Gets or sets how special floating point numbers, e.g. , + and , + are written as JSON. + The default value is . + + + + + Gets or sets how floating point numbers, e.g. 1.0 and 9.9, are parsed when reading JSON text. + The default value is . + + + + + Gets or sets how strings are escaped when writing JSON text. + The default value is . + + + + + Gets or sets the culture used when reading JSON. + The default value is . + + + + + Gets a value indicating whether there will be a check for additional content after deserializing an object. + The default value is false. + + + true if there will be a check for additional content after deserializing an object; otherwise, false. + + + + + Initializes a new instance of the class. + + + + + Represents a reader that provides fast, non-cached, forward-only access to JSON text data. + + + + + Asynchronously reads the next JSON token from the source. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns true if the next token was read successfully; false if there are no more tokens to read. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a []. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the []. This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a of . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the of . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously reads the next JSON token from the source as a . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous read. The + property returns the . This result will be null at the end of an array. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Initializes a new instance of the class with the specified . + + The containing the JSON data to read. + + + + Gets or sets the reader's property name table. + + + + + Gets or sets the reader's character buffer pool. + + + + + Reads the next JSON token from the underlying . + + + true if the next token was read successfully; false if there are no more tokens to read. + + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a . + + A . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a []. + + A [] or null if the next JSON token is null. This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Changes the reader's state to . + If is set to true, the underlying is also closed. + + + + + Gets a value indicating whether the class can return line information. + + + true if and can be provided; otherwise, false. + + + + + Gets the current line number. + + + The current line number or 0 if no line information is available (for example, returns false). + + + + + Gets the current line position. + + + The current line position or 0 if no line information is available (for example, returns false). + + + + + Represents a writer that provides a fast, non-cached, forward-only way of generating JSON data. + + + + + Asynchronously flushes whatever is in the buffer to the destination and also flushes the destination. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the JSON value delimiter. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the specified end token. + + The end token to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously closes this writer. + If is set to true, the destination is also closed. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the end of the current JSON object or array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes indent characters. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes an indent space. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes raw JSON without changing the writer's state. + + The raw JSON to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a null value. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the property name of a name/value pair of a JSON object. + + The name of the property. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the property name of a name/value pair of a JSON object. + + The name of the property. + A flag to indicate whether the text should be escaped when it is written as a JSON property name. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the beginning of a JSON array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the beginning of a JSON object. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the start of a constructor with the given name. + + The name of the constructor. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes an undefined value. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the given white space. + + The string of white space characters. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a [] value. + + The [] value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the end of an array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the end of a constructor. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes the end of a JSON object. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Asynchronously writes raw JSON where a value is expected and updates the writer's state. + + The raw JSON to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + Derived classes must override this method to get asynchronous behaviour. Otherwise it will + execute synchronously, returning an already-completed task. + + + + Gets or sets the writer's character array pool. + + + + + Gets or sets how many s to write for each level in the hierarchy when is set to . + + + + + Gets or sets which character to use to quote attribute values. + + + + + Gets or sets which character to use for indenting when is set to . + + + + + Gets or sets a value indicating whether object names will be surrounded with quotes. + + + + + Initializes a new instance of the class using the specified . + + The to write to. + + + + Flushes whatever is in the buffer to the underlying and also flushes the underlying . + + + + + Closes this writer. + If is set to true, the underlying is also closed. + If is set to true, the JSON is auto-completed. + + + + + Writes the beginning of a JSON object. + + + + + Writes the beginning of a JSON array. + + + + + Writes the start of a constructor with the given name. + + The name of the constructor. + + + + Writes the specified end token. + + The end token to write. + + + + Writes the property name of a name/value pair on a JSON object. + + The name of the property. + + + + Writes the property name of a name/value pair on a JSON object. + + The name of the property. + A flag to indicate whether the text should be escaped when it is written as a JSON property name. + + + + Writes indent characters. + + + + + Writes the JSON value delimiter. + + + + + Writes an indent space. + + + + + Writes a value. + An error will raised if the value cannot be written as a single JSON token. + + The value to write. + + + + Writes a null value. + + + + + Writes an undefined value. + + + + + Writes raw JSON. + + The raw JSON to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a value. + + The value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a [] value. + + The [] value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + + + + Writes the given white space. + + The string of white space characters. + + + + Specifies the type of JSON token. + + + + + This is returned by the if a read method has not been called. + + + + + An object start token. + + + + + An array start token. + + + + + A constructor start token. + + + + + An object property name. + + + + + A comment. + + + + + Raw JSON. + + + + + An integer. + + + + + A float. + + + + + A string. + + + + + A boolean. + + + + + A null token. + + + + + An undefined token. + + + + + An object end token. + + + + + An array end token. + + + + + A constructor end token. + + + + + A Date. + + + + + Byte data. + + + + + + Represents a reader that provides validation. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Sets an event handler for receiving schema validation errors. + + + + + Gets the text value of the current JSON token. + + + + + + Gets the depth of the current token in the JSON document. + + The depth of the current token in the JSON document. + + + + Gets the path of the current JSON token. + + + + + Gets the quotation mark character used to enclose the value of a string. + + + + + + Gets the type of the current JSON token. + + + + + + Gets the .NET type for the current JSON token. + + + + + + Initializes a new instance of the class that + validates the content returned from the given . + + The to read from while validating. + + + + Gets or sets the schema. + + The schema. + + + + Gets the used to construct this . + + The specified in the constructor. + + + + Changes the reader's state to . + If is set to true, the underlying is also closed. + + + + + Reads the next JSON token from the underlying as a of . + + A of . + + + + Reads the next JSON token from the underlying as a []. + + + A [] or null if the next JSON token is null. + + + + + Reads the next JSON token from the underlying as a of . + + A of . + + + + Reads the next JSON token from the underlying as a of . + + A of . + + + + Reads the next JSON token from the underlying as a of . + + A of . + + + + Reads the next JSON token from the underlying as a . + + A . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . This method will return null at the end of an array. + + + + Reads the next JSON token from the underlying as a of . + + A of . + + + + Reads the next JSON token from the underlying . + + + true if the next token was read successfully; false if there are no more tokens to read. + + + + + Represents a writer that provides a fast, non-cached, forward-only way of generating JSON data. + + + + + Asynchronously closes this writer. + If is set to true, the destination is also closed. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously flushes whatever is in the buffer to the destination and also flushes the destination. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the specified end token. + + The end token to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes indent characters. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the JSON value delimiter. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes an indent space. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes raw JSON without changing the writer's state. + + The raw JSON to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the end of the current JSON object or array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the end of an array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the end of a constructor. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the end of a JSON object. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a null value. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the property name of a name/value pair of a JSON object. + + The name of the property. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the property name of a name/value pair of a JSON object. + + The name of the property. + A flag to indicate whether the text should be escaped when it is written as a JSON property name. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the beginning of a JSON array. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes raw JSON where a value is expected and updates the writer's state. + + The raw JSON to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the start of a constructor with the given name. + + The name of the constructor. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the beginning of a JSON object. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the current token. + + The to read the token from. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the current token. + + The to read the token from. + A flag indicating whether the current token's children should be written. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the token and its value. + + The to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the token and its value. + + The to write. + + The value to write. + A value is only required for tokens that have an associated value, e.g. the property name for . + null can be passed to the method for tokens that don't have a value, e.g. . + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a [] value. + + The [] value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a value. + + The value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes a of value. + + The of value to write. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes an undefined value. + + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously writes the given white space. + + The string of white space characters. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Asynchronously ets the state of the . + + The being written. + The value being written. + The token to monitor for cancellation requests. The default value is . + A that represents the asynchronous operation. + The default behaviour is to execute synchronously, returning an already-completed task. Derived + classes can override this behaviour for true asynchronicity. + + + + Gets or sets a value indicating whether the destination should be closed when this writer is closed. + + + true to close the destination when this writer is closed; otherwise false. The default is true. + + + + + Gets or sets a value indicating whether the JSON should be auto-completed when this writer is closed. + + + true to auto-complete the JSON when this writer is closed; otherwise false. The default is true. + + + + + Gets the top. + + The top. + + + + Gets the state of the writer. + + + + + Gets the path of the writer. + + + + + Gets or sets a value indicating how JSON text output should be formatted. + + + + + Gets or sets how dates are written to JSON text. + + + + + Gets or sets how time zones are handled when writing JSON text. + + + + + Gets or sets how strings are escaped when writing JSON text. + + + + + Gets or sets how special floating point numbers, e.g. , + and , + are written to JSON text. + + + + + Gets or sets how and values are formatted when writing JSON text. + + + + + Gets or sets the culture used when writing JSON. Defaults to . + + + + + Initializes a new instance of the class. + + + + + Flushes whatever is in the buffer to the destination and also flushes the destination. + + + + + Closes this writer. + If is set to true, the destination is also closed. + If is set to true, the JSON is auto-completed. + + + + + Writes the beginning of a JSON object. + + + + + Writes the end of a JSON object. + + + + + Writes the beginning of a JSON array. + + + + + Writes the end of an array. + + + + + Writes the start of a constructor with the given name. + + The name of the constructor. + + + + Writes the end constructor. + + + + + Writes the property name of a name/value pair of a JSON object. + + The name of the property. + + + + Writes the property name of a name/value pair of a JSON object. + + The name of the property. + A flag to indicate whether the text should be escaped when it is written as a JSON property name. + + + + Writes the end of the current JSON object or array. + + + + + Writes the current token and its children. + + The to read the token from. + + + + Writes the current token. + + The to read the token from. + A flag indicating whether the current token's children should be written. + + + + Writes the token and its value. + + The to write. + + The value to write. + A value is only required for tokens that have an associated value, e.g. the property name for . + null can be passed to the method for tokens that don't have a value, e.g. . + + + + + Writes the token. + + The to write. + + + + Writes the specified end token. + + The end token to write. + + + + Writes indent characters. + + + + + Writes the JSON value delimiter. + + + + + Writes an indent space. + + + + + Writes a null value. + + + + + Writes an undefined value. + + + + + Writes raw JSON without changing the writer's state. + + The raw JSON to write. + + + + Writes raw JSON where a value is expected and updates the writer's state. + + The raw JSON to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a of value. + + The of value to write. + + + + Writes a [] value. + + The [] value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + An error will raised if the value cannot be written as a single JSON token. + + The value to write. + + + + Writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + + + + Writes the given white space. + + The string of white space characters. + + + + Releases unmanaged and - optionally - managed resources. + + true to release both managed and unmanaged resources; false to release only unmanaged resources. + + + + Sets the state of the . + + The being written. + The value being written. + + + + The exception thrown when an error occurs while writing JSON text. + + + + + Gets the path to the JSON where the error occurred. + + The path to the JSON where the error occurred. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class + with a specified error message. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the class + with a specified error message and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Initializes a new instance of the class. + + The that holds the serialized object data about the exception being thrown. + The that contains contextual information about the source or destination. + The parameter is null. + The class name is null or is zero (0). + + + + Initializes a new instance of the class + with a specified error message, JSON path and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The path to the JSON where the error occurred. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Specifies how JSON comments are handled when loading JSON. + + + + + Ignore comments. + + + + + Load comments as a with type . + + + + + Specifies how duplicate property names are handled when loading JSON. + + + + + Replace the existing value when there is a duplicate property. The value of the last property in the JSON object will be used. + + + + + Ignore the new value when there is a duplicate property. The value of the first property in the JSON object will be used. + + + + + Throw a when a duplicate property is encountered. + + + + + Contains the LINQ to JSON extension methods. + + + + + Returns a collection of tokens that contains the ancestors of every token in the source collection. + + The type of the objects in source, constrained to . + An of that contains the source collection. + An of that contains the ancestors of every token in the source collection. + + + + Returns a collection of tokens that contains every token in the source collection, and the ancestors of every token in the source collection. + + The type of the objects in source, constrained to . + An of that contains the source collection. + An of that contains every token in the source collection, the ancestors of every token in the source collection. + + + + Returns a collection of tokens that contains the descendants of every token in the source collection. + + The type of the objects in source, constrained to . + An of that contains the source collection. + An of that contains the descendants of every token in the source collection. + + + + Returns a collection of tokens that contains every token in the source collection, and the descendants of every token in the source collection. + + The type of the objects in source, constrained to . + An of that contains the source collection. + An of that contains every token in the source collection, and the descendants of every token in the source collection. + + + + Returns a collection of child properties of every object in the source collection. + + An of that contains the source collection. + An of that contains the properties of every object in the source collection. + + + + Returns a collection of child values of every object in the source collection with the given key. + + An of that contains the source collection. + The token key. + An of that contains the values of every token in the source collection with the given key. + + + + Returns a collection of child values of every object in the source collection. + + An of that contains the source collection. + An of that contains the values of every token in the source collection. + + + + Returns a collection of converted child values of every object in the source collection with the given key. + + The type to convert the values to. + An of that contains the source collection. + The token key. + An that contains the converted values of every token in the source collection with the given key. + + + + Returns a collection of converted child values of every object in the source collection. + + The type to convert the values to. + An of that contains the source collection. + An that contains the converted values of every token in the source collection. + + + + Converts the value. + + The type to convert the value to. + A cast as a of . + A converted value. + + + + Converts the value. + + The source collection type. + The type to convert the value to. + A cast as a of . + A converted value. + + + + Returns a collection of child tokens of every array in the source collection. + + The source collection type. + An of that contains the source collection. + An of that contains the values of every token in the source collection. + + + + Returns a collection of converted child tokens of every array in the source collection. + + An of that contains the source collection. + The type to convert the values to. + The source collection type. + An that contains the converted values of every token in the source collection. + + + + Returns the input typed as . + + An of that contains the source collection. + The input typed as . + + + + Returns the input typed as . + + The source collection type. + An of that contains the source collection. + The input typed as . + + + + Represents a collection of objects. + + The type of token. + + + + Gets the of with the specified key. + + + + + + Represents a JSON array. + + + + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + A representing the asynchronous load. The property contains the JSON that was read from the specified . + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + A representing the asynchronous load. The property contains the JSON that was read from the specified . + + + + Gets the container's children tokens. + + The container's children tokens. + + + + Gets the node type for this . + + The type. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Initializes a new instance of the class with the specified content. + + The contents of the array. + + + + Initializes a new instance of the class with the specified content. + + The contents of the array. + + + + Loads an from a . + + A that will be read for the content of the . + A that contains the JSON that was read from the specified . + + + + Loads an from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + A that contains the JSON that was read from the specified . + + + + Load a from a string that contains JSON. + + A that contains JSON. + A populated from the string that contains JSON. + + + + + + + Load a from a string that contains JSON. + + A that contains JSON. + The used to load the JSON. + If this is null, default load settings will be used. + A populated from the string that contains JSON. + + + + + + + Creates a from an object. + + The object that will be used to create . + A with the values of the specified object. + + + + Creates a from an object. + + The object that will be used to create . + The that will be used to read the object. + A with the values of the specified object. + + + + Writes this token to a . + + A into which this method will write. + A collection of which will be used when writing the token. + + + + Gets the with the specified key. + + The with the specified key. + + + + Gets or sets the at the specified index. + + + + + + Determines the index of a specific item in the . + + The object to locate in the . + + The index of if found in the list; otherwise, -1. + + + + + Inserts an item to the at the specified index. + + The zero-based index at which should be inserted. + The object to insert into the . + + is not a valid index in the . + + + + + Removes the item at the specified index. + + The zero-based index of the item to remove. + + is not a valid index in the . + + + + + Returns an enumerator that iterates through the collection. + + + A of that can be used to iterate through the collection. + + + + + Adds an item to the . + + The object to add to the . + + + + Removes all items from the . + + + + + Determines whether the contains a specific value. + + The object to locate in the . + + true if is found in the ; otherwise, false. + + + + + Copies the elements of the to an array, starting at a particular array index. + + The array. + Index of the array. + + + + Gets a value indicating whether the is read-only. + + true if the is read-only; otherwise, false. + + + + Removes the first occurrence of a specific object from the . + + The object to remove from the . + + true if was successfully removed from the ; otherwise, false. This method also returns false if is not found in the original . + + + + + Represents a JSON constructor. + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous load. The + property returns a that contains the JSON that was read from the specified . + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous load. The + property returns a that contains the JSON that was read from the specified . + + + + Gets the container's children tokens. + + The container's children tokens. + + + + Gets or sets the name of this constructor. + + The constructor name. + + + + Gets the node type for this . + + The type. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Initializes a new instance of the class with the specified name and content. + + The constructor name. + The contents of the constructor. + + + + Initializes a new instance of the class with the specified name and content. + + The constructor name. + The contents of the constructor. + + + + Initializes a new instance of the class with the specified name. + + The constructor name. + + + + Writes this token to a . + + A into which this method will write. + A collection of which will be used when writing the token. + + + + Gets the with the specified key. + + The with the specified key. + + + + Loads a from a . + + A that will be read for the content of the . + A that contains the JSON that was read from the specified . + + + + Loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + A that contains the JSON that was read from the specified . + + + + Represents a token that can contain other tokens. + + + + + Occurs when the list changes or an item in the list changes. + + + + + Occurs before an item is added to the collection. + + + + + Occurs when the items list of the collection has changed, or the collection is reset. + + + + + Gets the container's children tokens. + + The container's children tokens. + + + + Raises the event. + + The instance containing the event data. + + + + Raises the event. + + The instance containing the event data. + + + + Raises the event. + + The instance containing the event data. + + + + Gets a value indicating whether this token has child tokens. + + + true if this token has child values; otherwise, false. + + + + + Get the first child token of this token. + + + A containing the first child token of the . + + + + + Get the last child token of this token. + + + A containing the last child token of the . + + + + + Returns a collection of the child tokens of this token, in document order. + + + An of containing the child tokens of this , in document order. + + + + + Returns a collection of the child values of this token, in document order. + + The type to convert the values to. + + A containing the child values of this , in document order. + + + + + Returns a collection of the descendant tokens for this token in document order. + + An of containing the descendant tokens of the . + + + + Returns a collection of the tokens that contain this token, and all descendant tokens of this token, in document order. + + An of containing this token, and all the descendant tokens of the . + + + + Adds the specified content as children of this . + + The content to be added. + + + + Adds the specified content as the first children of this . + + The content to be added. + + + + Creates a that can be used to add tokens to the . + + A that is ready to have content written to it. + + + + Replaces the child nodes of this token with the specified content. + + The content. + + + + Removes the child nodes from this token. + + + + + Merge the specified content into this . + + The content to be merged. + + + + Merge the specified content into this using . + + The content to be merged. + The used to merge the content. + + + + Gets the count of child JSON tokens. + + The count of child JSON tokens. + + + + Represents a collection of objects. + + The type of token. + + + + An empty collection of objects. + + + + + Initializes a new instance of the struct. + + The enumerable. + + + + Returns an enumerator that can be used to iterate through the collection. + + + A that can be used to iterate through the collection. + + + + + Gets the of with the specified key. + + + + + + Determines whether the specified is equal to this instance. + + The to compare with this instance. + + true if the specified is equal to this instance; otherwise, false. + + + + + Determines whether the specified is equal to this instance. + + The to compare with this instance. + + true if the specified is equal to this instance; otherwise, false. + + + + + Returns a hash code for this instance. + + + A hash code for this instance, suitable for use in hashing algorithms and data structures like a hash table. + + + + + Represents a JSON object. + + + + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous load. The + property returns a that contains the JSON that was read from the specified . + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous load. The + property returns a that contains the JSON that was read from the specified . + + + + Gets the container's children tokens. + + The container's children tokens. + + + + Occurs when a property value changes. + + + + + Occurs when a property value is changing. + + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Initializes a new instance of the class with the specified content. + + The contents of the object. + + + + Initializes a new instance of the class with the specified content. + + The contents of the object. + + + + Gets the node type for this . + + The type. + + + + Gets an of of this object's properties. + + An of of this object's properties. + + + + Gets a with the specified name. + + The property name. + A with the specified name or null. + + + + Gets the with the specified name. + The exact name will be searched for first and if no matching property is found then + the will be used to match a property. + + The property name. + One of the enumeration values that specifies how the strings will be compared. + A matched with the specified name or null. + + + + Gets a of of this object's property values. + + A of of this object's property values. + + + + Gets the with the specified key. + + The with the specified key. + + + + Gets or sets the with the specified property name. + + + + + + Loads a from a . + + A that will be read for the content of the . + A that contains the JSON that was read from the specified . + + is not valid JSON. + + + + + Loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + A that contains the JSON that was read from the specified . + + is not valid JSON. + + + + + Load a from a string that contains JSON. + + A that contains JSON. + A populated from the string that contains JSON. + + is not valid JSON. + + + + + + + + Load a from a string that contains JSON. + + A that contains JSON. + The used to load the JSON. + If this is null, default load settings will be used. + A populated from the string that contains JSON. + + is not valid JSON. + + + + + + + + Creates a from an object. + + The object that will be used to create . + A with the values of the specified object. + + + + Creates a from an object. + + The object that will be used to create . + The that will be used to read the object. + A with the values of the specified object. + + + + Writes this token to a . + + A into which this method will write. + A collection of which will be used when writing the token. + + + + Gets the with the specified property name. + + Name of the property. + The with the specified property name. + + + + Gets the with the specified property name. + The exact property name will be searched for first and if no matching property is found then + the will be used to match a property. + + Name of the property. + One of the enumeration values that specifies how the strings will be compared. + The with the specified property name. + + + + Tries to get the with the specified property name. + The exact property name will be searched for first and if no matching property is found then + the will be used to match a property. + + Name of the property. + The value. + One of the enumeration values that specifies how the strings will be compared. + true if a value was successfully retrieved; otherwise, false. + + + + Adds the specified property name. + + Name of the property. + The value. + + + + Determines whether the JSON object has the specified property name. + + Name of the property. + true if the JSON object has the specified property name; otherwise, false. + + + + Removes the property with the specified name. + + Name of the property. + true if item was successfully removed; otherwise, false. + + + + Tries to get the with the specified property name. + + Name of the property. + The value. + true if a value was successfully retrieved; otherwise, false. + + + + Returns an enumerator that can be used to iterate through the collection. + + + A that can be used to iterate through the collection. + + + + + Raises the event with the provided arguments. + + Name of the property. + + + + Raises the event with the provided arguments. + + Name of the property. + + + + Returns the responsible for binding operations performed on this object. + + The expression tree representation of the runtime value. + + The to bind this object. + + + + + Represents a JSON property. + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The token to monitor for cancellation requests. The default value is . + A representing the asynchronous creation. The + property returns a that contains the JSON that was read from the specified . + + + + Asynchronously loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + A representing the asynchronous creation. The + property returns a that contains the JSON that was read from the specified . + + + + Gets the container's children tokens. + + The container's children tokens. + + + + Gets the property name. + + The property name. + + + + Gets or sets the property value. + + The property value. + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Gets the node type for this . + + The type. + + + + Initializes a new instance of the class. + + The property name. + The property content. + + + + Initializes a new instance of the class. + + The property name. + The property content. + + + + Writes this token to a . + + A into which this method will write. + A collection of which will be used when writing the token. + + + + Loads a from a . + + A that will be read for the content of the . + A that contains the JSON that was read from the specified . + + + + Loads a from a . + + A that will be read for the content of the . + The used to load the JSON. + If this is null, default load settings will be used. + A that contains the JSON that was read from the specified . + + + + Represents a view of a . + + + + + Initializes a new instance of the class. + + The name. + + + + When overridden in a derived class, returns whether resetting an object changes its value. + + + true if resetting the component changes its value; otherwise, false. + + The component to test for reset capability. + + + + When overridden in a derived class, gets the current value of the property on a component. + + + The value of a property for a given component. + + The component with the property for which to retrieve the value. + + + + When overridden in a derived class, resets the value for this property of the component to the default value. + + The component with the property value that is to be reset to the default value. + + + + When overridden in a derived class, sets the value of the component to a different value. + + The component with the property value that is to be set. + The new value. + + + + When overridden in a derived class, determines a value indicating whether the value of this property needs to be persisted. + + + true if the property should be persisted; otherwise, false. + + The component with the property to be examined for persistence. + + + + When overridden in a derived class, gets the type of the component this property is bound to. + + + A that represents the type of component this property is bound to. + When the or + + methods are invoked, the object specified might be an instance of this type. + + + + + When overridden in a derived class, gets a value indicating whether this property is read-only. + + + true if the property is read-only; otherwise, false. + + + + + When overridden in a derived class, gets the type of the property. + + + A that represents the type of the property. + + + + + Gets the hash code for the name of the member. + + + + The hash code for the name of the member. + + + + + Represents a raw JSON string. + + + + + Asynchronously creates an instance of with the content of the reader's current token. + + The reader. + The token to monitor for cancellation requests. The default value is . + A representing the asynchronous creation. The + property returns an instance of with the content of the reader's current token. + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Initializes a new instance of the class. + + The raw json. + + + + Creates an instance of with the content of the reader's current token. + + The reader. + An instance of with the content of the reader's current token. + + + + Specifies the settings used when loading JSON. + + + + + Initializes a new instance of the class. + + + + + Gets or sets how JSON comments are handled when loading JSON. + The default value is . + + The JSON comment handling. + + + + Gets or sets how JSON line info is handled when loading JSON. + The default value is . + + The JSON line info handling. + + + + Gets or sets how duplicate property names in JSON objects are handled when loading JSON. + The default value is . + + The JSON duplicate property name handling. + + + + Specifies the settings used when merging JSON. + + + + + Initializes a new instance of the class. + + + + + Gets or sets the method used when merging JSON arrays. + + The method used when merging JSON arrays. + + + + Gets or sets how null value properties are merged. + + How null value properties are merged. + + + + Gets or sets the comparison used to match property names while merging. + The exact property name will be searched for first and if no matching property is found then + the will be used to match a property. + + The comparison used to match property names while merging. + + + + Specifies the settings used when selecting JSON. + + + + + Gets or sets a flag that indicates whether an error should be thrown if + no tokens are found when evaluating part of the expression. + + + A flag that indicates whether an error should be thrown if + no tokens are found when evaluating part of the expression. + + + + + Represents an abstract JSON token. + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Writes this token to a asynchronously. + + A into which this method will write. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Asynchronously creates a from a . + + An positioned at the token to read into this . + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous creation. The + property returns a that contains + the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Asynchronously creates a from a . + + An positioned at the token to read into this . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous creation. The + property returns a that contains + the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Asynchronously creates a from a . + + A positioned at the token to read into this . + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous creation. The + property returns a that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Asynchronously creates a from a . + + A positioned at the token to read into this . + The used to load the JSON. + If this is null, default load settings will be used. + The token to monitor for cancellation requests. The default value is . + + A that represents the asynchronous creation. The + property returns a that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Gets a comparer that can compare two tokens for value equality. + + A that can compare two nodes for value equality. + + + + Gets or sets the parent. + + The parent. + + + + Gets the root of this . + + The root of this . + + + + Gets the node type for this . + + The type. + + + + Gets a value indicating whether this token has child tokens. + + + true if this token has child values; otherwise, false. + + + + + Compares the values of two tokens, including the values of all descendant tokens. + + The first to compare. + The second to compare. + true if the tokens are equal; otherwise false. + + + + Gets the next sibling token of this node. + + The that contains the next sibling token. + + + + Gets the previous sibling token of this node. + + The that contains the previous sibling token. + + + + Gets the path of the JSON token. + + + + + Adds the specified content immediately after this token. + + A content object that contains simple content or a collection of content objects to be added after this token. + + + + Adds the specified content immediately before this token. + + A content object that contains simple content or a collection of content objects to be added before this token. + + + + Returns a collection of the ancestor tokens of this token. + + A collection of the ancestor tokens of this token. + + + + Returns a collection of tokens that contain this token, and the ancestors of this token. + + A collection of tokens that contain this token, and the ancestors of this token. + + + + Returns a collection of the sibling tokens after this token, in document order. + + A collection of the sibling tokens after this tokens, in document order. + + + + Returns a collection of the sibling tokens before this token, in document order. + + A collection of the sibling tokens before this token, in document order. + + + + Gets the with the specified key. + + The with the specified key. + + + + Gets the with the specified key converted to the specified type. + + The type to convert the token to. + The token key. + The converted token value. + + + + Get the first child token of this token. + + A containing the first child token of the . + + + + Get the last child token of this token. + + A containing the last child token of the . + + + + Returns a collection of the child tokens of this token, in document order. + + An of containing the child tokens of this , in document order. + + + + Returns a collection of the child tokens of this token, in document order, filtered by the specified type. + + The type to filter the child tokens on. + A containing the child tokens of this , in document order. + + + + Returns a collection of the child values of this token, in document order. + + The type to convert the values to. + A containing the child values of this , in document order. + + + + Removes this token from its parent. + + + + + Replaces this token with the specified token. + + The value. + + + + Writes this token to a . + + A into which this method will write. + A collection of which will be used when writing the token. + + + + Returns the indented JSON for this token. + + + ToString() returns a non-JSON string value for tokens with a type of . + If you want the JSON for all token types then you should use . + + + The indented JSON for this token. + + + + + Returns the JSON for this token using the given formatting and converters. + + Indicates how the output should be formatted. + A collection of s which will be used when writing the token. + The JSON for this token using the given formatting and converters. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to []. + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to of . + + The value. + The result of the conversion. + + + + Performs an explicit conversion from to . + + The value. + The result of the conversion. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from [] to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from to . + + The value to create a from. + The initialized with the specified value. + + + + Performs an implicit conversion from of to . + + The value to create a from. + The initialized with the specified value. + + + + Creates a for this token. + + A that can be used to read this token and its descendants. + + + + Creates a from an object. + + The object that will be used to create . + A with the value of the specified object. + + + + Creates a from an object using the specified . + + The object that will be used to create . + The that will be used when reading the object. + A with the value of the specified object. + + + + Creates an instance of the specified .NET type from the . + + The object type that the token will be deserialized to. + The new object created from the JSON value. + + + + Creates an instance of the specified .NET type from the . + + The object type that the token will be deserialized to. + The new object created from the JSON value. + + + + Creates an instance of the specified .NET type from the using the specified . + + The object type that the token will be deserialized to. + The that will be used when creating the object. + The new object created from the JSON value. + + + + Creates an instance of the specified .NET type from the using the specified . + + The object type that the token will be deserialized to. + The that will be used when creating the object. + The new object created from the JSON value. + + + + Creates a from a . + + A positioned at the token to read into this . + + A that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Creates a from a . + + An positioned at the token to read into this . + The used to load the JSON. + If this is null, default load settings will be used. + + A that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Load a from a string that contains JSON. + + A that contains JSON. + A populated from the string that contains JSON. + + + + Load a from a string that contains JSON. + + A that contains JSON. + The used to load the JSON. + If this is null, default load settings will be used. + A populated from the string that contains JSON. + + + + Creates a from a . + + A positioned at the token to read into this . + The used to load the JSON. + If this is null, default load settings will be used. + + A that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Creates a from a . + + A positioned at the token to read into this . + + A that contains the token and its descendant tokens + that were read from the reader. The runtime type of the token is determined + by the token type of the first token encountered in the reader. + + + + + Selects a using a JSONPath expression. Selects the token that matches the object path. + + + A that contains a JSONPath expression. + + A , or null. + + + + Selects a using a JSONPath expression. Selects the token that matches the object path. + + + A that contains a JSONPath expression. + + A flag to indicate whether an error should be thrown if no tokens are found when evaluating part of the expression. + A . + + + + Selects a using a JSONPath expression. Selects the token that matches the object path. + + + A that contains a JSONPath expression. + + The used to select tokens. + A . + + + + Selects a collection of elements using a JSONPath expression. + + + A that contains a JSONPath expression. + + An of that contains the selected elements. + + + + Selects a collection of elements using a JSONPath expression. + + + A that contains a JSONPath expression. + + A flag to indicate whether an error should be thrown if no tokens are found when evaluating part of the expression. + An of that contains the selected elements. + + + + Selects a collection of elements using a JSONPath expression. + + + A that contains a JSONPath expression. + + The used to select tokens. + An of that contains the selected elements. + + + + Returns the responsible for binding operations performed on this object. + + The expression tree representation of the runtime value. + + The to bind this object. + + + + + Returns the responsible for binding operations performed on this object. + + The expression tree representation of the runtime value. + + The to bind this object. + + + + + Creates a new instance of the . All child tokens are recursively cloned. + + A new instance of the . + + + + Adds an object to the annotation list of this . + + The annotation to add. + + + + Get the first annotation object of the specified type from this . + + The type of the annotation to retrieve. + The first annotation object that matches the specified type, or null if no annotation is of the specified type. + + + + Gets the first annotation object of the specified type from this . + + The of the annotation to retrieve. + The first annotation object that matches the specified type, or null if no annotation is of the specified type. + + + + Gets a collection of annotations of the specified type for this . + + The type of the annotations to retrieve. + An that contains the annotations for this . + + + + Gets a collection of annotations of the specified type for this . + + The of the annotations to retrieve. + An of that contains the annotations that match the specified type for this . + + + + Removes the annotations of the specified type from this . + + The type of annotations to remove. + + + + Removes the annotations of the specified type from this . + + The of annotations to remove. + + + + Compares tokens to determine whether they are equal. + + + + + Determines whether the specified objects are equal. + + The first object of type to compare. + The second object of type to compare. + + true if the specified objects are equal; otherwise, false. + + + + + Returns a hash code for the specified object. + + The for which a hash code is to be returned. + A hash code for the specified object. + The type of is a reference type and is null. + + + + Represents a reader that provides fast, non-cached, forward-only access to serialized JSON data. + + + + + Gets the at the reader's current position. + + + + + Initializes a new instance of the class. + + The token to read from. + + + + Initializes a new instance of the class. + + The token to read from. + The initial path of the token. It is prepended to the returned . + + + + Reads the next JSON token from the underlying . + + + true if the next token was read successfully; false if there are no more tokens to read. + + + + + Gets the path of the current JSON token. + + + + + Specifies the type of token. + + + + + No token type has been set. + + + + + A JSON object. + + + + + A JSON array. + + + + + A JSON constructor. + + + + + A JSON object property. + + + + + A comment. + + + + + An integer value. + + + + + A float value. + + + + + A string value. + + + + + A boolean value. + + + + + A null value. + + + + + An undefined value. + + + + + A date value. + + + + + A raw JSON value. + + + + + A collection of bytes value. + + + + + A Guid value. + + + + + A Uri value. + + + + + A TimeSpan value. + + + + + Represents a writer that provides a fast, non-cached, forward-only way of generating JSON data. + + + + + Gets the at the writer's current position. + + + + + Gets the token being written. + + The token being written. + + + + Initializes a new instance of the class writing to the given . + + The container being written to. + + + + Initializes a new instance of the class. + + + + + Flushes whatever is in the buffer to the underlying . + + + + + Closes this writer. + If is set to true, the JSON is auto-completed. + + + Setting to true has no additional effect, since the underlying is a type that cannot be closed. + + + + + Writes the beginning of a JSON object. + + + + + Writes the beginning of a JSON array. + + + + + Writes the start of a constructor with the given name. + + The name of the constructor. + + + + Writes the end. + + The token. + + + + Writes the property name of a name/value pair on a JSON object. + + The name of the property. + + + + Writes a value. + An error will be raised if the value cannot be written as a single JSON token. + + The value to write. + + + + Writes a null value. + + + + + Writes an undefined value. + + + + + Writes raw JSON. + + The raw JSON to write. + + + + Writes a comment /*...*/ containing the specified text. + + Text to place inside the comment. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a [] value. + + The [] value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Writes a value. + + The value to write. + + + + Represents a value in JSON (string, integer, date, etc). + + + + + Writes this token to a asynchronously. + + A into which this method will write. + The token to monitor for cancellation requests. + A collection of which will be used when writing the token. + A that represents the asynchronous write operation. + + + + Initializes a new instance of the class from another object. + + A object to copy from. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Initializes a new instance of the class with the given value. + + The value. + + + + Gets a value indicating whether this token has child tokens. + + + true if this token has child values; otherwise, false. + + + + + Creates a comment with the given value. + + The value. + A comment with the given value. + + + + Creates a string with the given value. + + The value. + A string with the given value. + + + + Creates a null value. + + A null value. + + + + Creates a undefined value. + + A undefined value. + + + + Gets the node type for this . + + The type. + + + + Gets or sets the underlying token value. + + The underlying token value. + + + + Writes this token to a . + + A into which this method will write. + A collection of s which will be used when writing the token. + + + + Indicates whether the current object is equal to another object of the same type. + + + true if the current object is equal to the parameter; otherwise, false. + + An object to compare with this object. + + + + Determines whether the specified is equal to the current . + + The to compare with the current . + + true if the specified is equal to the current ; otherwise, false. + + + + + Serves as a hash function for a particular type. + + + A hash code for the current . + + + + + Returns a that represents this instance. + + + ToString() returns a non-JSON string value for tokens with a type of . + If you want the JSON for all token types then you should use . + + + A that represents this instance. + + + + + Returns a that represents this instance. + + The format. + + A that represents this instance. + + + + + Returns a that represents this instance. + + The format provider. + + A that represents this instance. + + + + + Returns a that represents this instance. + + The format. + The format provider. + + A that represents this instance. + + + + + Returns the responsible for binding operations performed on this object. + + The expression tree representation of the runtime value. + + The to bind this object. + + + + + Compares the current instance with another object of the same type and returns an integer that indicates whether the current instance precedes, follows, or occurs in the same position in the sort order as the other object. + + An object to compare with this instance. + + A 32-bit signed integer that indicates the relative order of the objects being compared. The return value has these meanings: + Value + Meaning + Less than zero + This instance is less than . + Zero + This instance is equal to . + Greater than zero + This instance is greater than . + + + is not of the same type as this instance. + + + + + Specifies how line information is handled when loading JSON. + + + + + Ignore line information. + + + + + Load line information. + + + + + Specifies how JSON arrays are merged together. + + + + Concatenate arrays. + + + Union arrays, skipping items that already exist. + + + Replace all array items. + + + Merge array items together, matched by index. + + + + Specifies how null value properties are merged. + + + + + The content's null value properties will be ignored during merging. + + + + + The content's null value properties will be merged. + + + + + Specifies the member serialization options for the . + + + + + All public members are serialized by default. Members can be excluded using or . + This is the default member serialization mode. + + + + + Only members marked with or are serialized. + This member serialization mode can also be set by marking the class with . + + + + + All public and private fields are serialized. Members can be excluded using or . + This member serialization mode can also be set by marking the class with + and setting IgnoreSerializableAttribute on to false. + + + + + Specifies metadata property handling options for the . + + + + + Read metadata properties located at the start of a JSON object. + + + + + Read metadata properties located anywhere in a JSON object. Note that this setting will impact performance. + + + + + Do not try to read metadata properties. + + + + + Specifies missing member handling options for the . + + + + + Ignore a missing member and do not attempt to deserialize it. + + + + + Throw a when a missing member is encountered during deserialization. + + + + + Specifies null value handling options for the . + + + + + + + + + Include null values when serializing and deserializing objects. + + + + + Ignore null values when serializing and deserializing objects. + + + + + Specifies how object creation is handled by the . + + + + + Reuse existing objects, create new objects when needed. + + + + + Only reuse existing objects. + + + + + Always create new objects. + + + + + Specifies reference handling options for the . + Note that references cannot be preserved when a value is set via a non-default constructor such as types that implement . + + + + + + + + Do not preserve references when serializing types. + + + + + Preserve references when serializing into a JSON object structure. + + + + + Preserve references when serializing into a JSON array structure. + + + + + Preserve references when serializing. + + + + + Specifies reference loop handling options for the . + + + + + Throw a when a loop is encountered. + + + + + Ignore loop references and do not serialize. + + + + + Serialize loop references. + + + + + Indicating whether a property is required. + + + + + The property is not required. The default state. + + + + + The property must be defined in JSON but can be a null value. + + + + + The property must be defined in JSON and cannot be a null value. + + + + + The property is not required but it cannot be a null value. + + + + + + Contains the JSON schema extension methods. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + + Determines whether the is valid. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + The source to test. + The schema to test with. + + true if the specified is valid; otherwise, false. + + + + + + Determines whether the is valid. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + The source to test. + The schema to test with. + When this method returns, contains any error messages generated while validating. + + true if the specified is valid; otherwise, false. + + + + + + Validates the specified . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + The source to test. + The schema to test with. + + + + + Validates the specified . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + The source to test. + The schema to test with. + The validation event handler. + + + + + An in-memory representation of a JSON Schema. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Gets or sets the id. + + + + + Gets or sets the title. + + + + + Gets or sets whether the object is required. + + + + + Gets or sets whether the object is read-only. + + + + + Gets or sets whether the object is visible to users. + + + + + Gets or sets whether the object is transient. + + + + + Gets or sets the description of the object. + + + + + Gets or sets the types of values allowed by the object. + + The type. + + + + Gets or sets the pattern. + + The pattern. + + + + Gets or sets the minimum length. + + The minimum length. + + + + Gets or sets the maximum length. + + The maximum length. + + + + Gets or sets a number that the value should be divisible by. + + A number that the value should be divisible by. + + + + Gets or sets the minimum. + + The minimum. + + + + Gets or sets the maximum. + + The maximum. + + + + Gets or sets a flag indicating whether the value can not equal the number defined by the minimum attribute (). + + A flag indicating whether the value can not equal the number defined by the minimum attribute (). + + + + Gets or sets a flag indicating whether the value can not equal the number defined by the maximum attribute (). + + A flag indicating whether the value can not equal the number defined by the maximum attribute (). + + + + Gets or sets the minimum number of items. + + The minimum number of items. + + + + Gets or sets the maximum number of items. + + The maximum number of items. + + + + Gets or sets the of items. + + The of items. + + + + Gets or sets a value indicating whether items in an array are validated using the instance at their array position from . + + + true if items are validated using their array position; otherwise, false. + + + + + Gets or sets the of additional items. + + The of additional items. + + + + Gets or sets a value indicating whether additional items are allowed. + + + true if additional items are allowed; otherwise, false. + + + + + Gets or sets whether the array items must be unique. + + + + + Gets or sets the of properties. + + The of properties. + + + + Gets or sets the of additional properties. + + The of additional properties. + + + + Gets or sets the pattern properties. + + The pattern properties. + + + + Gets or sets a value indicating whether additional properties are allowed. + + + true if additional properties are allowed; otherwise, false. + + + + + Gets or sets the required property if this property is present. + + The required property if this property is present. + + + + Gets or sets the a collection of valid enum values allowed. + + A collection of valid enum values allowed. + + + + Gets or sets disallowed types. + + The disallowed types. + + + + Gets or sets the default value. + + The default value. + + + + Gets or sets the collection of that this schema extends. + + The collection of that this schema extends. + + + + Gets or sets the format. + + The format. + + + + Initializes a new instance of the class. + + + + + Reads a from the specified . + + The containing the JSON Schema to read. + The object representing the JSON Schema. + + + + Reads a from the specified . + + The containing the JSON Schema to read. + The to use when resolving schema references. + The object representing the JSON Schema. + + + + Load a from a string that contains JSON Schema. + + A that contains JSON Schema. + A populated from the string that contains JSON Schema. + + + + Load a from a string that contains JSON Schema using the specified . + + A that contains JSON Schema. + The resolver. + A populated from the string that contains JSON Schema. + + + + Writes this schema to a . + + A into which this method will write. + + + + Writes this schema to a using the specified . + + A into which this method will write. + The resolver used. + + + + Returns a that represents the current . + + + A that represents the current . + + + + + + Returns detailed information about the schema exception. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Gets the line number indicating where the error occurred. + + The line number indicating where the error occurred. + + + + Gets the line position indicating where the error occurred. + + The line position indicating where the error occurred. + + + + Gets the path to the JSON where the error occurred. + + The path to the JSON where the error occurred. + + + + Initializes a new instance of the class. + + + + + Initializes a new instance of the class + with a specified error message. + + The error message that explains the reason for the exception. + + + + Initializes a new instance of the class + with a specified error message and a reference to the inner exception that is the cause of this exception. + + The error message that explains the reason for the exception. + The exception that is the cause of the current exception, or null if no inner exception is specified. + + + + Initializes a new instance of the class. + + The that holds the serialized object data about the exception being thrown. + The that contains contextual information about the source or destination. + The parameter is null. + The class name is null or is zero (0). + + + + + Generates a from a specified . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Gets or sets how undefined schemas are handled by the serializer. + + + + + Gets or sets the contract resolver. + + The contract resolver. + + + + Generate a from the specified type. + + The type to generate a from. + A generated from the specified type. + + + + Generate a from the specified type. + + The type to generate a from. + The used to resolve schema references. + A generated from the specified type. + + + + Generate a from the specified type. + + The type to generate a from. + Specify whether the generated root will be nullable. + A generated from the specified type. + + + + Generate a from the specified type. + + The type to generate a from. + The used to resolve schema references. + Specify whether the generated root will be nullable. + A generated from the specified type. + + + + + Resolves from an id. + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Gets or sets the loaded schemas. + + The loaded schemas. + + + + Initializes a new instance of the class. + + + + + Gets a for the specified reference. + + The id. + A for the specified reference. + + + + + The value types allowed by the . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + No type specified. + + + + + String type. + + + + + Float type. + + + + + Integer type. + + + + + Boolean type. + + + + + Object type. + + + + + Array type. + + + + + Null type. + + + + + Any type. + + + + + + Specifies undefined schema Id handling options for the . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Do not infer a schema Id. + + + + + Use the .NET type name as the schema Id. + + + + + Use the assembly qualified .NET type name as the schema Id. + + + + + + Returns detailed information related to the . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + Gets the associated with the validation error. + + The JsonSchemaException associated with the validation error. + + + + Gets the path of the JSON location where the validation error occurred. + + The path of the JSON location where the validation error occurred. + + + + Gets the text description corresponding to the validation error. + + The text description. + + + + + Represents the callback method that will handle JSON schema validation events and the . + + + JSON Schema validation has been moved to its own package. See https://www.newtonsoft.com/jsonschema for more details. + + + + + + A camel case naming strategy. + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + A flag indicating whether extension data names should be processed. + + + + + Initializes a new instance of the class. + + + + + Resolves the specified property name. + + The property name to resolve. + The resolved property name. + + + + Resolves member mappings for a type, camel casing property names. + + + + + Initializes a new instance of the class. + + + + + Resolves the contract for a given type. + + The type to resolve a contract for. + The contract for a given type. + + + + Used by to resolve a for a given . + + + + + Gets a value indicating whether members are being get and set using dynamic code generation. + This value is determined by the runtime permissions available. + + + true if using dynamic code generation; otherwise, false. + + + + + Gets or sets the default members search flags. + + The default members search flags. + + + + Gets or sets a value indicating whether compiler generated members should be serialized. + + + true if serialized compiler generated members; otherwise, false. + + + + + Gets or sets a value indicating whether to ignore the interface when serializing and deserializing types. + + + true if the interface will be ignored when serializing and deserializing types; otherwise, false. + + + + + Gets or sets a value indicating whether to ignore the attribute when serializing and deserializing types. + + + true if the attribute will be ignored when serializing and deserializing types; otherwise, false. + + + + + Gets or sets a value indicating whether to ignore IsSpecified members when serializing and deserializing types. + + + true if the IsSpecified members will be ignored when serializing and deserializing types; otherwise, false. + + + + + Gets or sets a value indicating whether to ignore ShouldSerialize members when serializing and deserializing types. + + + true if the ShouldSerialize members will be ignored when serializing and deserializing types; otherwise, false. + + + + + Gets or sets the naming strategy used to resolve how property names and dictionary keys are serialized. + + The naming strategy used to resolve how property names and dictionary keys are serialized. + + + + Initializes a new instance of the class. + + + + + Resolves the contract for a given type. + + The type to resolve a contract for. + The contract for a given type. + + + + Gets the serializable members for the type. + + The type to get serializable members for. + The serializable members for the type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates the constructor parameters. + + The constructor to create properties for. + The type's member properties. + Properties for the given . + + + + Creates a for the given . + + The matching member property. + The constructor parameter. + A created for the given . + + + + Resolves the default for the contract. + + Type of the object. + The contract's default . + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Creates a for the given type. + + Type of the object. + A for the given type. + + + + Determines which contract type is created for the given type. + + Type of the object. + A for the given type. + + + + Creates properties for the given . + + The type to create properties for. + /// The member serialization mode for the type. + Properties for the given . + + + + Creates the used by the serializer to get and set values from a member. + + The member. + The used by the serializer to get and set values from a member. + + + + Creates a for the given . + + The member's parent . + The member to create a for. + A created for the given . + + + + Resolves the name of the property. + + Name of the property. + Resolved name of the property. + + + + Resolves the name of the extension data. By default no changes are made to extension data names. + + Name of the extension data. + Resolved name of the extension data. + + + + Resolves the key of the dictionary. By default is used to resolve dictionary keys. + + Key of the dictionary. + Resolved key of the dictionary. + + + + Gets the resolved name of the property. + + Name of the property. + Name of the property. + + + + The default naming strategy. Property names and dictionary keys are unchanged. + + + + + Resolves the specified property name. + + The property name to resolve. + The resolved property name. + + + + The default serialization binder used when resolving and loading classes from type names. + + + + + Initializes a new instance of the class. + + + + + When overridden in a derived class, controls the binding of a serialized object to a type. + + Specifies the name of the serialized object. + Specifies the name of the serialized object. + + The type of the object the formatter creates a new instance of. + + + + + When overridden in a derived class, controls the binding of a serialized object to a type. + + The type of the object the formatter creates a new instance of. + Specifies the name of the serialized object. + Specifies the name of the serialized object. + + + + Represents a trace writer that writes to the application's instances. + + + + + Gets the that will be used to filter the trace messages passed to the writer. + For example a filter level of will exclude messages and include , + and messages. + + + The that will be used to filter the trace messages passed to the writer. + + + + + Writes the specified trace level, message and optional exception. + + The at which to write this trace. + The trace message. + The trace exception. This parameter is optional. + + + + Get and set values for a using dynamic methods. + + + + + Initializes a new instance of the class. + + The member info. + + + + Sets the value. + + The target to set the value on. + The value to set on the target. + + + + Gets the value. + + The target to get the value from. + The value. + + + + Provides information surrounding an error. + + + + + Gets the error. + + The error. + + + + Gets the original object that caused the error. + + The original object that caused the error. + + + + Gets the member that caused the error. + + The member that caused the error. + + + + Gets the path of the JSON location where the error occurred. + + The path of the JSON location where the error occurred. + + + + Gets or sets a value indicating whether this is handled. + + true if handled; otherwise, false. + + + + Provides data for the Error event. + + + + + Gets the current object the error event is being raised against. + + The current object the error event is being raised against. + + + + Gets the error context. + + The error context. + + + + Initializes a new instance of the class. + + The current object. + The error context. + + + + Get and set values for a using dynamic methods. + + + + + Initializes a new instance of the class. + + The member info. + + + + Sets the value. + + The target to set the value on. + The value to set on the target. + + + + Gets the value. + + The target to get the value from. + The value. + + + + Provides methods to get attributes. + + + + + Returns a collection of all of the attributes, or an empty collection if there are no attributes. + + When true, look up the hierarchy chain for the inherited custom attribute. + A collection of s, or an empty collection. + + + + Returns a collection of attributes, identified by type, or an empty collection if there are no attributes. + + The type of the attributes. + When true, look up the hierarchy chain for the inherited custom attribute. + A collection of s, or an empty collection. + + + + Used by to resolve a for a given . + + + + + + + + + Resolves the contract for a given type. + + The type to resolve a contract for. + The contract for a given type. + + + + Used to resolve references when serializing and deserializing JSON by the . + + + + + Resolves a reference to its object. + + The serialization context. + The reference to resolve. + The object that was resolved from the reference. + + + + Gets the reference for the specified object. + + The serialization context. + The object to get a reference for. + The reference to the object. + + + + Determines whether the specified object is referenced. + + The serialization context. + The object to test for a reference. + + true if the specified object is referenced; otherwise, false. + + + + + Adds a reference to the specified object. + + The serialization context. + The reference. + The object to reference. + + + + Allows users to control class loading and mandate what class to load. + + + + + When implemented, controls the binding of a serialized object to a type. + + Specifies the name of the serialized object. + Specifies the name of the serialized object + The type of the object the formatter creates a new instance of. + + + + When implemented, controls the binding of a serialized object to a type. + + The type of the object the formatter creates a new instance of. + Specifies the name of the serialized object. + Specifies the name of the serialized object. + + + + Represents a trace writer. + + + + + Gets the that will be used to filter the trace messages passed to the writer. + For example a filter level of will exclude messages and include , + and messages. + + The that will be used to filter the trace messages passed to the writer. + + + + Writes the specified trace level, message and optional exception. + + The at which to write this trace. + The trace message. + The trace exception. This parameter is optional. + + + + Provides methods to get and set values. + + + + + Sets the value. + + The target to set the value on. + The value to set on the target. + + + + Gets the value. + + The target to get the value from. + The value. + + + + Contract details for a used by the . + + + + + Gets the of the collection items. + + The of the collection items. + + + + Gets a value indicating whether the collection type is a multidimensional array. + + true if the collection type is a multidimensional array; otherwise, false. + + + + Gets or sets the function used to create the object. When set this function will override . + + The function used to create the object. + + + + Gets a value indicating whether the creator has a parameter with the collection values. + + true if the creator has a parameter with the collection values; otherwise, false. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Gets or sets the default collection items . + + The converter. + + + + Gets or sets a value indicating whether the collection items preserve object references. + + true if collection items preserve object references; otherwise, false. + + + + Gets or sets the collection item reference loop handling. + + The reference loop handling. + + + + Gets or sets the collection item type name handling. + + The type name handling. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Handles serialization callback events. + + The object that raised the callback event. + The streaming context. + + + + Handles serialization error callback events. + + The object that raised the callback event. + The streaming context. + The error context. + + + + Sets extension data for an object during deserialization. + + The object to set extension data on. + The extension data key. + The extension data value. + + + + Gets extension data for an object during serialization. + + The object to set extension data on. + + + + Contract details for a used by the . + + + + + Gets the underlying type for the contract. + + The underlying type for the contract. + + + + Gets or sets the type created during deserialization. + + The type created during deserialization. + + + + Gets or sets whether this type contract is serialized as a reference. + + Whether this type contract is serialized as a reference. + + + + Gets or sets the default for this contract. + + The converter. + + + + Gets the internally resolved for the contract's type. + This converter is used as a fallback converter when no other converter is resolved. + Setting will always override this converter. + + + + + Gets or sets all methods called immediately after deserialization of the object. + + The methods called immediately after deserialization of the object. + + + + Gets or sets all methods called during deserialization of the object. + + The methods called during deserialization of the object. + + + + Gets or sets all methods called after serialization of the object graph. + + The methods called after serialization of the object graph. + + + + Gets or sets all methods called before serialization of the object. + + The methods called before serialization of the object. + + + + Gets or sets all method called when an error is thrown during the serialization of the object. + + The methods called when an error is thrown during the serialization of the object. + + + + Gets or sets the default creator method used to create the object. + + The default creator method used to create the object. + + + + Gets or sets a value indicating whether the default creator is non-public. + + true if the default object creator is non-public; otherwise, false. + + + + Contract details for a used by the . + + + + + Gets or sets the dictionary key resolver. + + The dictionary key resolver. + + + + Gets the of the dictionary keys. + + The of the dictionary keys. + + + + Gets the of the dictionary values. + + The of the dictionary values. + + + + Gets or sets the function used to create the object. When set this function will override . + + The function used to create the object. + + + + Gets a value indicating whether the creator has a parameter with the dictionary values. + + true if the creator has a parameter with the dictionary values; otherwise, false. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Gets the object's properties. + + The object's properties. + + + + Gets or sets the property name resolver. + + The property name resolver. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Gets or sets the object constructor. + + The object constructor. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Gets or sets the object member serialization. + + The member object serialization. + + + + Gets or sets the missing member handling used when deserializing this object. + + The missing member handling. + + + + Gets or sets a value that indicates whether the object's properties are required. + + + A value indicating whether the object's properties are required. + + + + + Gets or sets how the object's properties with null values are handled during serialization and deserialization. + + How the object's properties with null values are handled during serialization and deserialization. + + + + Gets the object's properties. + + The object's properties. + + + + Gets a collection of instances that define the parameters used with . + + + + + Gets or sets the function used to create the object. When set this function will override . + This function is called with a collection of arguments which are defined by the collection. + + The function used to create the object. + + + + Gets or sets the extension data setter. + + + + + Gets or sets the extension data getter. + + + + + Gets or sets the extension data value type. + + + + + Gets or sets the extension data name resolver. + + The extension data name resolver. + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Contract details for a used by the . + + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Maps a JSON property to a .NET member or constructor parameter. + + + + + Gets or sets the name of the property. + + The name of the property. + + + + Gets or sets the type that declared this property. + + The type that declared this property. + + + + Gets or sets the order of serialization of a member. + + The numeric order of serialization. + + + + Gets or sets the name of the underlying member or parameter. + + The name of the underlying member or parameter. + + + + Gets the that will get and set the during serialization. + + The that will get and set the during serialization. + + + + Gets or sets the for this property. + + The for this property. + + + + Gets or sets the type of the property. + + The type of the property. + + + + Gets or sets the for the property. + If set this converter takes precedence over the contract converter for the property type. + + The converter. + + + + Gets or sets the member converter. + + The member converter. + + + + Gets or sets a value indicating whether this is ignored. + + true if ignored; otherwise, false. + + + + Gets or sets a value indicating whether this is readable. + + true if readable; otherwise, false. + + + + Gets or sets a value indicating whether this is writable. + + true if writable; otherwise, false. + + + + Gets or sets a value indicating whether this has a member attribute. + + true if has a member attribute; otherwise, false. + + + + Gets the default value. + + The default value. + + + + Gets or sets a value indicating whether this is required. + + A value indicating whether this is required. + + + + Gets a value indicating whether has a value specified. + + + + + Gets or sets a value indicating whether this property preserves object references. + + + true if this instance is reference; otherwise, false. + + + + + Gets or sets the property null value handling. + + The null value handling. + + + + Gets or sets the property default value handling. + + The default value handling. + + + + Gets or sets the property reference loop handling. + + The reference loop handling. + + + + Gets or sets the property object creation handling. + + The object creation handling. + + + + Gets or sets or sets the type name handling. + + The type name handling. + + + + Gets or sets a predicate used to determine whether the property should be serialized. + + A predicate used to determine whether the property should be serialized. + + + + Gets or sets a predicate used to determine whether the property should be deserialized. + + A predicate used to determine whether the property should be deserialized. + + + + Gets or sets a predicate used to determine whether the property should be serialized. + + A predicate used to determine whether the property should be serialized. + + + + Gets or sets an action used to set whether the property has been deserialized. + + An action used to set whether the property has been deserialized. + + + + Returns a that represents this instance. + + + A that represents this instance. + + + + + Gets or sets the converter used when serializing the property's collection items. + + The collection's items converter. + + + + Gets or sets whether this property's collection items are serialized as a reference. + + Whether this property's collection items are serialized as a reference. + + + + Gets or sets the type name handling used when serializing the property's collection items. + + The collection's items type name handling. + + + + Gets or sets the reference loop handling used when serializing the property's collection items. + + The collection's items reference loop handling. + + + + A collection of objects. + + + + + Initializes a new instance of the class. + + The type. + + + + When implemented in a derived class, extracts the key from the specified element. + + The element from which to extract the key. + The key for the specified element. + + + + Adds a object. + + The property to add to the collection. + + + + Gets the closest matching object. + First attempts to get an exact case match of and then + a case insensitive match. + + Name of the property. + A matching property if found. + + + + Gets a property by property name. + + The name of the property to get. + Type property name string comparison. + A matching property if found. + + + + Contract details for a used by the . + + + + + Initializes a new instance of the class. + + The underlying type for the contract. + + + + Lookup and create an instance of the type described by the argument. + + The type to create. + Optional arguments to pass to an initializing constructor of the JsonConverter. + If null, the default constructor is used. + + + + A kebab case naming strategy. + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + A flag indicating whether extension data names should be processed. + + + + + Initializes a new instance of the class. + + + + + Resolves the specified property name. + + The property name to resolve. + The resolved property name. + + + + Represents a trace writer that writes to memory. When the trace message limit is + reached then old trace messages will be removed as new messages are added. + + + + + Gets the that will be used to filter the trace messages passed to the writer. + For example a filter level of will exclude messages and include , + and messages. + + + The that will be used to filter the trace messages passed to the writer. + + + + + Initializes a new instance of the class. + + + + + Writes the specified trace level, message and optional exception. + + The at which to write this trace. + The trace message. + The trace exception. This parameter is optional. + + + + Returns an enumeration of the most recent trace messages. + + An enumeration of the most recent trace messages. + + + + Returns a of the most recent trace messages. + + + A of the most recent trace messages. + + + + + A base class for resolving how property names and dictionary keys are serialized. + + + + + A flag indicating whether dictionary keys should be processed. + Defaults to false. + + + + + A flag indicating whether extension data names should be processed. + Defaults to false. + + + + + A flag indicating whether explicitly specified property names, + e.g. a property name customized with a , should be processed. + Defaults to false. + + + + + Gets the serialized name for a given property name. + + The initial property name. + A flag indicating whether the property has had a name explicitly specified. + The serialized property name. + + + + Gets the serialized name for a given extension data name. + + The initial extension data name. + The serialized extension data name. + + + + Gets the serialized key for a given dictionary key. + + The initial dictionary key. + The serialized dictionary key. + + + + Resolves the specified property name. + + The property name to resolve. + The resolved property name. + + + + Hash code calculation + + + + + + Object equality implementation + + + + + + + Compare to another NamingStrategy + + + + + + + Represents a method that constructs an object. + + The object type to create. + + + + When applied to a method, specifies that the method is called when an error occurs serializing an object. + + + + + Provides methods to get attributes from a , , or . + + + + + Initializes a new instance of the class. + + The instance to get attributes for. This parameter should be a , , or . + + + + Returns a collection of all of the attributes, or an empty collection if there are no attributes. + + When true, look up the hierarchy chain for the inherited custom attribute. + A collection of s, or an empty collection. + + + + Returns a collection of attributes, identified by type, or an empty collection if there are no attributes. + + The type of the attributes. + When true, look up the hierarchy chain for the inherited custom attribute. + A collection of s, or an empty collection. + + + + Get and set values for a using reflection. + + + + + Initializes a new instance of the class. + + The member info. + + + + Sets the value. + + The target to set the value on. + The value to set on the target. + + + + Gets the value. + + The target to get the value from. + The value. + + + + A snake case naming strategy. + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + + + Initializes a new instance of the class. + + + A flag indicating whether dictionary keys should be processed. + + + A flag indicating whether explicitly specified property names should be processed, + e.g. a property name customized with a . + + + A flag indicating whether extension data names should be processed. + + + + + Initializes a new instance of the class. + + + + + Resolves the specified property name. + + The property name to resolve. + The resolved property name. + + + + Specifies how strings are escaped when writing JSON text. + + + + + Only control characters (e.g. newline) are escaped. + + + + + All non-ASCII and control characters (e.g. newline) are escaped. + + + + + HTML (<, >, &, ', ") and control characters (e.g. newline) are escaped. + + + + + Indicates the method that will be used during deserialization for locating and loading assemblies. + + + + + In simple mode, the assembly used during deserialization need not match exactly the assembly used during serialization. Specifically, the version numbers need not match as the LoadWithPartialName method of the class is used to load the assembly. + + + + + In full mode, the assembly used during deserialization must match exactly the assembly used during serialization. The Load method of the class is used to load the assembly. + + + + + Specifies type name handling options for the . + + + should be used with caution when your application deserializes JSON from an external source. + Incoming types should be validated with a custom + when deserializing with a value other than . + + + + + Do not include the .NET type name when serializing types. + + + + + Include the .NET type name when serializing into a JSON object structure. + + + + + Include the .NET type name when serializing into a JSON array structure. + + + + + Always include the .NET type name when serializing. + + + + + Include the .NET type name when the type of the object being serialized is not the same as its declared type. + Note that this doesn't include the root serialized object by default. To include the root object's type name in JSON + you must specify a root type object with + or . + + + + + Determines whether the collection is null or empty. + + The collection. + + true if the collection is null or empty; otherwise, false. + + + + + Adds the elements of the specified collection to the specified generic . + + The list to add to. + The collection of elements to add. + + + + Converts the value to the specified type. If the value is unable to be converted, the + value is checked whether it assignable to the specified type. + + The value to convert. + The culture to use when converting. + The type to convert or cast the value to. + + The converted type. If conversion was unsuccessful, the initial value + is returned if assignable to the target type. + + + + + Helper method for generating a MetaObject which calls a + specific method on Dynamic that returns a result + + + + + Helper method for generating a MetaObject which calls a + specific method on Dynamic, but uses one of the arguments for + the result. + + + + + Helper method for generating a MetaObject which calls a + specific method on Dynamic, but uses one of the arguments for + the result. + + + + + Returns a Restrictions object which includes our current restrictions merged + with a restriction limiting our type + + + + + Helper class for serializing immutable collections. + Note that this is used by all builds, even those that don't support immutable collections, in case the DLL is GACed + https://github.com/JamesNK/Newtonsoft.Json/issues/652 + + + + + Gets the type of the typed collection's items. + + The type. + The type of the typed collection's items. + + + + Gets the member's underlying type. + + The member. + The underlying type of the member. + + + + Determines whether the property is an indexed property. + + The property. + + true if the property is an indexed property; otherwise, false. + + + + + Gets the member's value on the object. + + The member. + The target object. + The member's value on the object. + + + + Sets the member's value on the target object. + + The member. + The target. + The value. + + + + Determines whether the specified MemberInfo can be read. + + The MemberInfo to determine whether can be read. + /// if set to true then allow the member to be gotten non-publicly. + + true if the specified MemberInfo can be read; otherwise, false. + + + + + Determines whether the specified MemberInfo can be set. + + The MemberInfo to determine whether can be set. + if set to true then allow the member to be set non-publicly. + if set to true then allow the member to be set if read-only. + + true if the specified MemberInfo can be set; otherwise, false. + + + + + Builds a string. Unlike this class lets you reuse its internal buffer. + + + + + Determines whether the string is all white space. Empty string will return false. + + The string to test whether it is all white space. + + true if the string is all white space; otherwise, false. + + + + + Specifies the state of the . + + + + + An exception has been thrown, which has left the in an invalid state. + You may call the method to put the in the Closed state. + Any other method calls result in an being thrown. + + + + + The method has been called. + + + + + An object is being written. + + + + + An array is being written. + + + + + A constructor is being written. + + + + + A property is being written. + + + + + A write method has not been called. + + + + Specifies that an output will not be null even if the corresponding type allows it. + + + Specifies that when a method returns , the parameter will not be null even if the corresponding type allows it. + + + Initializes the attribute with the specified return value condition. + + The return value condition. If the method returns this value, the associated parameter will not be null. + + + + Gets the return value condition. + + + Specifies that an output may be null even if the corresponding type disallows it. + + + Specifies that null is allowed as an input even if the corresponding type disallows it. + + + + Specifies that the method will not return if the associated Boolean parameter is passed the specified value. + + + + + Initializes a new instance of the class. + + + The condition parameter value. Code after the method will be considered unreachable by diagnostics if the argument to + the associated parameter matches this value. + + + + Gets the condition parameter value. + + + diff --git a/Microsoft.IdentityModel.Abstractions.dll b/Microsoft.IdentityModel.Abstractions.dll new file mode 100644 index 0000000000000000000000000000000000000000..b847079f7decbaafc88c9fb5d062c3ffe8124410 GIT binary patch literal 18976 zcmeHt2Ut_f^7x)4gx&-c5HJEt5yA-_QIIZ5FQOu1fB=DzKoUSu5l~U=4Z8yN-mohw zVlP**gIC3hsMxTe*Yck|35a^{eed^u?|tumzu$l1%-NaUot>SX-PxU!;Ni0o9U;Vk z=i4`g_Q4yc0TlduPzc2uJq~D~UCI}F?jwRO^o&a7OIVp=QHq$G!Aj%`g(4{{fyWYO z3t4<2%QrNVl_5&vvDMX8%;l`Z{16Hv=t!les8LQrjmVUxN{|TY14T(j{pt*F7CZys zK}d_r(`0gE0uuwA3gH2I`ZfgP8Z`-5#sA;maukywZ34cbI5PmDOa+{gCsXLo67r)E zQiIoaCxoKpMgP=`)gd}nT?z1kof@*GywOs?8QlOt88udryK`be?`*L|oCripwgHgA z12u%FQyKu$v&B4t2r6P(vCLQp6km9?rvV6gx98j6cd=d}VcBR%0nP4-P=yXc$`tiG zAYuH4-_gI!nb5|-j4`ZDY4mYa1_;1QMxZi4P-!Pn855eNHbN@ah6Spa-j1qtwPsqg zC0$_1h4O+iFgh70Dq~on{!;_04U=kTfZNH-#{d(|cnl0o)}G4P(=1s~OG+Tr-MTl8 z&akuw)VeR^ri1AbolxM`8HMJZQJ9a;sBQ-;rrWBDfqf<(hDyGyKRQDM?NzJ?(Iik) zWgHext^$~#$U)u&f+mpgT;@2kNwx#&z;VMA1tb7y1d25)KxhiQGr=CrBBf%!FhzoE zv}wrNnMFq;hNjHc%>tqWeW6Sj@aYVw?=27|;L4D|Oo*5s70T3neGU6CNd&AO1l2FZ3%4eiT*-<6F0xr`)EK~&Two_Oaz?e)&6h;gw z)MQ2iyhO)v9|ObVRKA{q4~a++%$I_CL=5DQp%{XL{y@Vae@~tt39U9jen??F1H%bxrit?9m>49}L=$9~{$ZGPEi{e77AQ?1jzG(~6jmfJTS8%v2|RW!v|Nti zv1_Ap3Y(*UoN=7!f;P#@l(8ndpei|rHPHnfqA=XUX+j6pQkbj<9du4s6MD#pvfnze z0>J9z7}lUJx+2H0mUPjz4y=^WLpLZ)CW{ezKw*=VmMdH!jLZnP>wA>nVyZ@@BAM)-hcP{+__2 zhFSn>p*H|^(FcI~=rceg*rB?B6+8j^?McC26ttqCEd@CMHIOS}!s_dX3;+&5)&PBx zC$t?#)rq4Zmx4SB@+p`BkPUmEHH{5^!vSD-6aml-#RBYumH~7?TLHSG;{bioS%8Dl zC5moBXQN2u2rw3f0Zc@30MpSNfD+UIa18nY&;j*i5X1x+V^0bWpr988M^TVV!9ofa zQLuu7l@vTm!A1(QXqb-|1-TSFO2I}7B04Tb3=CNm96&(^Sg`_F4ilgvKxNP^LS;yS zhW&;zzzPEAb12GWLId)$(#eDlHujlE6R}91V{thQU%x*N(j^qAPr_%6CevpXfU@rKsN>O@$o1_k|+`j_z5U7Pa@@Iuzf@V0gqxPVF&PpJTX5JrSPQjJ|Z!kTDiEFz$7I3 zg+kR4@OeUMdvQDB1>AD@(mbF?W+x`{cuBk@6e#f%auWoQ3&`dtp?*KG_ehVA_vR+1 z!#T;H&lBKcIkR6&0)-MOSD48AwIrA)k#JM~q#%Tw@h4Qj9FRRoloG_t;R$}_7A6*D z^2E}-Ay{vcU&`_D+eM-DCGVZmRD0f6lnq0sim?n-8I^%9g;FZ#%a!t?_)r$fleTvW zy5XTAJaK|Z!b4sX2`?i-kQdC8a+A1Hu9pTFE1fG zB?asII}NH2;Y;{G(At?t@ui)sMsdY3K7Y6;@^VGu^zS^{>-$5$AfN<{`Ci^G9w;&?J5l;; zfsZINPs~qA?NsCw6p7gi_*`KpYC9)f#1-a!=M<4Gl)`jTbSXc9F91XTUP>)86e#3N z`CI`%A7)jy$mFfqa&3T}qZqDOh~Hp=$VUtf61f6s*-3Sj-TYvslmY!np)9H0icv5> zQ7n>(lBMjxB(N}$4VFJo!1hXzNX1{N(~7KVfzT@)n5%JgyM=%4elR zdS0@8i$GrDl@r|Ri}Lf%B&6+5Z(!;5^O?Vf?RH%1S+J#UXB7gI+X3B)CB!Zivoj4rvyUjygbar zPY5C+m|cLKwj=O5is^`l@+kK+di^dg8TdJ5@0u6K3^nf^LJSr`DA8GnP=JiKHbylR zSTsUI17~SWy)JPy4I_93!b=efbdU}KXcnMKd-F#OF>q`wEv!K1;O`0%nh(7&!2@GF zBGQY4oglvV?fyKwi8elEvPo{=S$9fZPa9vQ9pLR}8IKy~vEcYzp2?JDHJ-Y9&vtum z*5+(gz2b1<#i*VswhQ&2a@KFHRveP70nr)FFT-YDZE$)Rzutc%-1tK&YwZ15pD$G!Oy_ z6KG5&I#XMT#?+uQyXeDXq$t-N=$EFggtgp77xb+G4-HgI18oDz+?u6GXi!>~K@}=b zqo8&$^-`B1;S4y6P>i&dUdfBV9HPeb{H5bS+=vn8O%zFppIe)nc(@1qIHcCb2CFk!j63;Dpf4Xl@L%5YZ##c z1afy~J2*j*#gSuAa!5zgjbqPFbaPB}NlvtPaB?C!NscbA_Vyf}n~NLiY@d+i>gwRa zb#iiYaY{f)n?P!v86czwhd237fxROmN}SDuSP2#gLrB2{GGd4LMRj;T8~LW)AEG_Z zY{th1oH7>Wy0cy!w@S`B!t}t zdm5HB6~esSPM&}T&gMJspIin+nc(>Pz329=oN_1#SrN#*qwuGuoxKf0DR4%P;AM&= zeAxE$qQ!!!RH-ym($~%|g)dFbPGBdBGVHwav&B3wUpp>-+hR`zgW-!|GlMp^e7Q5r zz|PDTVzWFUK6*%OVF0#CBB_uk#Z!ms^^Tg2DHwj@wOyp&{2d$q*t$53JK5)30;_nV zBRPB865hz!J(LH{oZn|<-^SdFG}Tv+!X;~Lzly|>E^aMHGpi<7oe$sh#OjuD*p9H# zYkX1NypSycPu))2zNv}MkSv_mbY!mxO%m<Qj!K`?1#+cW8JeF8o>^r=4 z0hWQAqA(K?!C}~h3*lin!-Hex@`Q~H$L%cOnFwVQJC)%oR5%=Gb6_V*NVAjMlpW~G(b@i=YRAq@f@{J+FMB6vBp0FN zrCbCUrbc?%1m7{-HSDVzUTRlhDD9~Q=UMI8kMH)7wv38z8NLERFj%PUV#4FG@$rO8 z-+BR)pVjdrxBpWZj%QMzA_{*THnn*nQf6+Qim;W)z8wr50Gm5@Q}WbB!4Yyp;6@)0 z&<{mGE)c%7ga950&|mh|1ywU%e#PF`4DP0{E81HlQf_gAc^XoVwLUQJzr(OT4@p%(+ZkeDOn^*MsKtl2DSyH#gsMZrxMhEi zC;{sLRX{WZc0lMY1O8-wRRVM`Fs4lCD-og=T;Rw9JdyItQowO9vYuGbYbupz0X+dE z#8TjP?S5PWE%9i?@D7HWiI5XPJrPi)5M#k!T-LA5%?CpXrU;-6fp)uf$cN<-!a*Pe z-dI+ge&xubMk5C4ai8DM6POzUN-yBou4!N3BB3PWL;ZG%alK#p{=KALe=&BfF_6a)%_{!*ykuytgD-m!J1z-(jhvEff=^RIQ!0*k`@S)I6G%MepDfHjf>xg_Wr zp?qr0q4Jv8&hVJq^@lOp?EgE)9tP1T0);`}*b4C>RoY40e`Xh~zp-G1mO&iqXMR6h zz+cTj3AR8YH_9Gx4ABknMC1bNCJ`(ITZ|KBCrLnefjFl<{Bb~wZh*N#i8J5{FbY@r za{wBbYT*PqC!k}y#8Egeutm6Cfld=Z%Xu&-e=i^2HU3Kzh=#v2!T|q&`ah@v>NgG$ zfhLPBHJQrRB?C)7s1u5`iegJ3S$w7u1V@upXDW{>8A$Nx3>tjQBS$b*`Y;IwQS3q^ z7!@I85ZSF0MUzyf6R3i*l2(Y|LiJ-?28*jde@Ih&aG=?m=US82s5WI>ypnj+^Y+N1 zL3ZH_j-DP~QLLUr7Aw3Zi|M~t&}jsXrsDuVCi@wCG5V4ylb1B^{L*t_1ERDN>P;qeW_9qM{C5ev&do!X%CfX@n^%I(i*v z+|E}ejwRU}m(z86bS_Wgu_E~?)O{z+$BPBGMhpd2h5TeOVcJJV$hEZBROk~hcKZIz%R^0$lh0l# zEgLWRjS;=E;9JwcLk{MVp^q|L)Z*V=FUfA$HEBIRx$Q;YEd48LVSJ9(;-r+giCNsbEQ6&?q!)b29>qaz)*=*#e@VjA|iXhTpRad z=#yPLtT{-DU@C#FD<~+^>7+5PpuyrTQ0>!|6)uV&hWK!IndE?E5&8q!Y(kCWaXnqfmFCFzHd4!j!-*(}$o12@<&gclw;yZ6~1Ne*~`3GG{Ni{6E4ncfl z(BMG*;|iu1(+Jdm_mPHxioIR~>-}hMtCyN|JN|fp$BC>HIkjh0-+l6$Fy>lwp~02w z(M_jz`mByrQAGA;iUU`q-|N%hudwA^sKvB9E9x39sJ>EgnyEw*O-{7LkoJ62A+9#EeB`q<{rzT509 zmo0jupZ;akM%5z~8tzq<=7CGSM|?XuSigJX_+DnEA5|8uPCCB7XlQiu%JLm|p1O8_ z5D~lj-cNyGh>;D7nIW?$>}(r5@ObK`_!_6&J}=CVMvm7jKH^du8=Ao7 zCOrzO^KSm?J#WaAO{VkSTiQf6Hm!C$m+?mB=87)a&2+Ox=RU4les6kRjJtlt9EC*} zd=5X;kWTO#FnY+L$4_WVCTm6nI$sUZ__;A?Qx4gRiL$ZzeA(du8fhh zT!I%c_BU9bDL*=-rQgop^}nBCy3U(p;~RW*!=CO3tfkM|ygdyrEjd|u{=tJ)ewJ!U zw${Fni!P1&60qxY_WTdEFU%qYOEsVDn{S-;jx1KphrK^Rw(qNOHD+I?Tr&M9VRUlCER*eZP+o!EYFSz`ps(@cl%}V|isuQ$_GKC9h-WhyCA$bhRg)+(>HY zccxGdiP8VKXDX)s>H}!l2hhL=z?$3i>XTT@h`r^eaAUDnu;YO@dxrKb_wH_;-aI^P z<36UVAtUg>_*ylS+b-!RyWCWL<$7!}bNgwxYlJSx`%0;LUee@(`J>DQ+g1cFYfc?` z`R>xlohml9+v+#;*_yAs?Z$#(XGa+-G$-dgv5)B8#ja_SQrN{R-@S1+kF)97n^IfP zWwiDkQQ7sa|A9u=q|L%4r_pOG5;bkF44BvU;EtmDwGnx10X6Kla?)4r!rpG-g4V`HCrqXWM!`be(TOEd; z*z57t{z?_S|Bjv8=DHSKUS4SPE@a4@o=&}L-GoWwBM&Uo++tuh@!Z=3^pY7L;$K~g zI5K_yb$N_)lYTkbh;Vd>gyk=r2Wi(_}p-D+gEZbR~OZjZEkmVwLTr`+!qcctfG zkBH;DV?532uj=w+?XHC*QAGSTv^PdduLZ zK&y2+mTT9IODTLjHDPr8PP>UWVwR0Kl51)Cx+SC5a+b}k0WP66_a^z49#;-JadnN4 zowV$Oux&JJsEtnCsInyaF5m|@ zC${ZNQ{*9@isIleK8bKMjfZfai zsxHvJmpFH^_kwYk^VDY7@Z#Av9&NSax{L{54|_gQIqQBTV8g0b{;k9#rcP@X#_=Z3 z9yiTDEc&L}+_9Gp2OG8a^PU!QY5SM-2Of%StEG?ocVBaLw{h-#xBJaWXMFpQ&Npk- z8Mk(}bi$0c=X%rpt&dIBI=Fg+g4)uS)K97GvI=WY>-3?4i9MA0!r_Y+Je=_M=&V-% zK6gI5U#fO`DeSfN(Kd^gOSfA!wk@_?xF}eozv>&M((65H?e*`!I$`@;?2281ZYn2L zj-A}H_0i7yTY6K%{f4^QXIU7I-|^O>?T$@f7Jt#sVWp`;(Yn3T+5rm8wS={$N3o|) zaI)&rs^E9`W{o!z>5cPSm-A?VHE&gITtq@it#P9B!jiiUt!;0*RxYu)cVW%KOE2OQ zy&l9WE}QJZ%w^UwcVzd_JS3)5 z*C-DjsI|DT$0cNSV#m@oo_@I|PA4y~Tv?utdeP(G+tV-d)^e=hkHPsmzX=frNI_mjh z7dXX+YGkpY65RR7qO$+Ao~c?%@i(o-|wla91S>s ze#iAlyYCGd98(7C-NVUw_ge1vFpRzGW>Di)tE#%Fc6@5xrAFb0-l9?-gY@pyT#e&M z+E?fncKJ2vS!r0P|5t0e^Rk267^9d#7sAf0DKKkOp0#+vbnaUnmmW)_e%H%RJ{Ghk zVRpLd>)rk4G+95c?zy=kAxoQ8&2}oMm+)4to`3fCy#=4v+bkKK=5BSUye?{gBTT36qwOR?-{&jgChjJvbweXw?+2H41Spu}_=sIG50F{h;l%@|*khykS*I&8?)? zZgNUlwEnS>r1So}T(&3f^YIr9 z{VP`&dDJ@JA?%k)w#Ga2uYUHZ-@h&DV)hlc-w@!`HWQGVQUP6KJKJ3d8xPFslC(Ju_x^vWM7G$oE+@gZjMgF zNk$=!cw13ax4P&zvgq8u&=5C*m?g3#?MAUb-XdH+c`)|=eZ_*qOjjm(-T?3sYmWN?Tc^JkS zZnmxt_D-&{FbqBb$k6{?69h;2zdzbvYi3=zzEA(wIJeV#y|aBpMm-t#ma{WGiml&# zoUd`p;X;JH-`-|D_ZI&myDOK)Z5zjpINngb!Eaa4E;8t7PlM+U!b;l3jN5eB%Q3=q;luKrvc^76Vaco-bBDaTQH5#^&qT8f?ydM{{kbaD zgDHBvc(mnuMQ+7)VQ%h=4dLX7+ll*+=OlbRaQaJbN=eVYUk+N$EOSe1IyS%Xbsc(o zjgfh!WclXxBh&>YcG4xx@_WH#{fVwapHE-PPY}UiJl@ z>!COD4rR?B#QU)HaGiBw`CLY6=^ImT_9ThVA}e-9QltCwJGP&O7H&O~GId??mjLy? zkJ7Wk_9^ct$1Y!C;=f>WyiLUItD46ZN9`iZ?}WDH9qKtYUZiU-Z}ohlY=*pC=ivRad|f?J-P>P zA6zx+{Q2Iivx^roCuQHMJw4ajVC&MXC3P)GH77`EQWSlH^MHN7ryXk>-E*sfSy}2? zkM1v>3QN*Aty2kFYuWnAVnwXtCtm%|9r|_Odgq7dm87>H?E_&S^y_qxH|kqs6`8VL zVPu?J?H?`%TjHBWSp0AvFJGq@hejsEO?dn0GH+e?NGF44F&U4Kv^^L@$suG^MMOnd zNyuM$xu3#LvY!j~vM0Z+Pz#6hQRGMnGs{D7a3~M^hkdo5 z%m2CFehx-;#e?gGLsM#`N_)R_B`RWUtcmGxjZrN8X}6<}&DPG>hT6Q?9dvF=TINA< ztaRF=I=>yS%IT?B=DSo)<#)X?dYM(x7yD4P6;dkr%t@{Zc(QB;+viqnjN%{ov5@) zVw;xD_|~*AEw>~l$mW}P&i=H#326sYhNs$BS*q{6`YIzK(BIRoXkyYV{UhaF3a5Bw zEvzh`bLK{j9o;v|?Aq<4Q#YA-OrCPF`|hcY$^q!vxEJcnDxX%mcHQ~)j&efEaHj?S zcj|o8nvd9DTJ&MQ^w5mN`wsE!g zdC^w=@Zp=)iz@X(P4(_O7`<`0bt;kjfpplD^Tp|7t?oUKuf*7_CG*nXetN{2;W=jd zlrN3j&YX@@pAtaVizt3<*s`%8)u-~g&Fvd@^ENr9YOEbG)`O(`vh1hMQonywSh{;L zBR_q&+Ze%I%@)JlH#MtRn`STB9~#@-d}WvBe4Tq!SESC4U8`%<=4Iynet_^(uvYq* zdCgAY_s?8>du`uUt+OLjdrVnIv@Pp5G~Re@%}(EsFHZ~3y}dE>xbERE^>wP<{9bKb zr&|X;G7Eg78gwUqM?MxR{Dw>HTCi|2@$wnZtxYl>^CvpSamOfy0DYG=(}~ z^gry*|B-`xcyDb`(=KsO)x4GGZkXp)Yg{Y7^5w-cMa9b-1R>d{&pO4tC&mi~HQuk@ z@6m0P!?zKkr;7TBs z+j=7BT}jyQHNK~_Muc-*DpXvBGg@wF-s~MY){RTcKfdvcn7_?<)8_Zihn;#SH7s&J zU^vEMOJQumbSSvv8GiP#6J6Tpg*frU_w(-oYg56QGe*dHpy(lBqeTjc{%j&K9RxX>*J)7Xy~Ne!|WR`|r<~@^HasV$i|ESsS{=ri{ANHg}GRasMx@i;{6(OZ>Ah9FKRr z-KF&Umo=<$1)u9z_}$$jw!1YhzVN`UjRnrnorB)@5w7nN{^W=PeN~-gZLo`UzL8_G z<}0l?djs@a);(D~)-&kVwvoqLuicdN_X(+Sa0{AAJLH|p)_OWI-2Z-Eb(;QgE+ILa zvU21N%N*K$2YvC4b*xv%K6O#Kktk9-lFK2v=I6kS{yrcc}ZW+3qQqt4+ z9KFeJ&pVUJBO7L|=ql!)+&X6OUXQf<>@DpM?lw5Mda_GLlm%i}3RD>!oIB!KH2mSl zdR@fVq~l8t7tiVE?__mR>zf_pMJLbrr;cv~_6;ogM-er7cr0kbIJhQz{m()8oh%#Z()Cq!)~`5$FiI~8@&c}>vxe~Tb z`WT_7jq+&S<~chz#NG{DB~?50d`{uz{*MQFB)f+mEcs+_Sij)ytoL(>_rIN#et91x z7HMtDCQmqS&%YV=Rb}Yy0sT%zWh_sW4z$@35@1`S%g8#C^wIpVB;)K%3b&_e`I@vheQTYyM-Y zG&Zeng-1(41;=6Bp>xe+j<{y}*3Eu>dQ;!2eU%c%*Jmb12G4j=oUukht0s$?rnSpB z+F@u_WoGi5%3^vb+<)K)2oS6KSoy#3`n}Rj1;(bxROq8Yry0`q(0wDn1Ik;P9_ky! z{1Nu$)toC=?|!I&U~*C6>Vp5UpZ@VvE=>V7>kQ8&P4zXYfC&dq7jAF|=M0w<@P%AP zAalrm-=i}Og2N_lNEJB){PjT@0FB6@!3P6HoTYUU$;x#%eZb|;om$iI?=?Dtd^p-e zt56{!oQY_3#Y$FXd!8t%_+?9hA4B9T@=G-B3wp;n`(Jx-uy5doh~=Y~PxE-!?}>5Q zs|&MD&RrGoo*GY4vQ_H-d4ImW!?Rw_2QQzPbvw=Q(1M7s+6=XE`wF~n*N-G+^c`Kq%=Y6ed|YxVhkbOTYle+lre;b(jcWw%B@>=&e{G`;MKp;Z`dam&}2f8?sVh3T>i z$)Zo47|`rEMNi41CbH-uSyatnl~?HPwCyXpN|F}Z{ciPYVPA4ue)F_dQFWKBT`a}C zRDcAM}TtTc2S@AERb&u2KGJMKFqK zXxJX76WSK`ZL6XiKAMaS@eDY*g)q;&8J=}*@X{9-e=9ky^EN(J(L8CS#mg(3x~(*y zb7T0;YghN?-dUK<@AIj`apb8MWwVBnueU8+ZSurD^W?IIO?!4n8}T-sdsVPLZN!2b zD14#!e4W-Tqpr6&+jcS?oWoq%4UhYvl?z2mK9cw4K3cPjk!Gj}|j;4*zI$6A+@ zx?)svL@(>!WfK?9IJ3Wa(~f@jQya7ceOIyXk5Mh&GG*{{i+w@n)?#I!!ZX(nXDd(M zT4${qvty^m=f>1m<)4o^-3~vre2U3#jd6XBd-nc)UhTe$nsYbLWQtM`?=JApukX@K ze>vQB&sO6JBOf)Xo3*=o$aOwCD72W@pEbbp&9}Ty`&TTySeo-n*{Y>1^>y{P z=!nR=ccCk7jdaT{=KF6CvQX79JEAl&dgy>cR`iZzn!AprbRVvKwdM1?3ucO)aCX60S + + + Microsoft.IdentityModel.Abstractions + + + + + Defines Event Log Levels. + + + + + No level filtering is done on this log level. Log messages of all levels will be logged. + + + + + Logs that describe an unrecoverable application or system crash, or a catastrophic failure that requires + immediate attention. + + + + + Logs that highlight when the current flow of execution is stopped due to a failure. These should indicate a + failure in the current activity, not an application-wide failure. + + + + + Logs that highlight an abnormal or unexpected event in the application flow, but do not otherwise cause the + application execution to stop. + + + + + Logs that track the general flow of the application. These logs should have long-term value. + + + + + Logs that are used for interactive investigation during development. These logs should primarily contain + information useful for debugging and have no long-term value. + + + + + Interface that needs to be implemented by classes providing logging in Microsoft identity libraries. + + + + + Checks to see if logging is enabled at given . + + Log level of a message. + + + + Writes a log entry. + + Defines a structured message to be logged at the provided . + + + + Interface for Telemetry tracking. + + + + + Gets or sets the application or client ID that telemetry is being sent for. + + + + + Perform any necessary bootstrapping for the telemetry client. + + + The expectation is that this should only be called once for the lifetime of the object however the + implementation should be idempotent. + + + + + Checks to see if telemetry is enabled all up. + + + Returns if telemetry should be sent; otherwise. + + + This check should be used to gate any resource intensive operations to generate telemetry as well. + + + + + Checks to see if telemetry is enabled for the named event. + + Name of the event to check. + + Returns if telemetry should be sent for ; + otherwise. + + + This check should be used to gate any resource intensive operations to generate telemetry as well. + + + + + Tracks an instance of a named event. + + Details of the event to track. + + + + Tracks an instance of a named event. + + Name of the event to track. Should be unique per scenario. + Key value pair of strings to long with the event. + Key value pair of longs to long with the event. + Key value pair of bools to long with the event. + Key value pair of DateTimes to long with the event. + Key value pair of doubles to long with the event. + Key value pair of Guids to long with the event. + + + + Defines the structure of a log entry. + + + + + Defines the . + + + + + Message to be logged. + + + + + A unique identifier for a request that can help with diagnostics across components. + + + Also referred to as ActivityId in Microsoft.IdentityModel.Tokens.CallContext. + + + + + A minimalistic implementation that is disabled by default and doesn't log. + + + + + Default instance of . + + + + + + + + + + + The default implementation of the interface which swallows all telemetry signals. + + + + + + + + Singleton instance of . + + + + + Initializes an instance of . + + + Private constructor to prevent the default constructor being exposed. + + + + + + + + + + + + + + + + + + + + Common class containing observability constants to be used as well known metric keys. + + + + + String used for the name of the property indicating if the call was successful. + + + + + String used for the name of the property indicating the call in Duration (ms). + + + + + String used for the name of the property indicating the call's Activity Id/Correlation Id. + + + + + String used for the name of the property indicating the caller's ClientId. + + + + + Details of the telemetry event. + + + This implementation is not meant to be thread-safe. This implementation would either need to be overridden or + usage should not be concurrently operated on. + + + + + The underlying properties making up the . + + + + + Name of the telemetry event, should be unique between events. + + + + + Properties which describe the event. + + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + + Sets a property on the event details. + + Property key. + Property value. + 'key' is null. + + + diff --git a/PRT.ps1 b/PRT.ps1 index 29a85bd..6961ce1 100644 --- a/PRT.ps1 +++ b/PRT.ps1 @@ -12,22 +12,19 @@ function New-UserPRTToken Creates a new Primary Refresh Token (PRT) as JWT to be used to sign-in as the user. .Parameter RefreshToken - Primary Refresh Token (PRT) or the user. + Primary Refresh Token (PRT) of the user. .Parameter SessionKey - The session key of the user + The session key binded to given PRT .Parameter Context - The context used = B64 encoded byte array (size 24) + Optional. The context used in the request header. .Parameter Settings PSObject containing refresh_token and session_key attributes. .Parameter Nonce - Nonce to be added to the token. - - .Parameter GetNonce - Get nonce automatically by connecting to Azure AD. + Optional. Nonce used in the request. .EXAMPLE Get-AADIntAccessTokenForAADJoin -SaveToCache @@ -49,7 +46,7 @@ function New-UserPRTToken PS C:\>$prtKeys = Get-UserAADIntPRTKeys -PfxFileName .\d03994c9-24f8-41ba-a156-1805998d6dc7.pfx -Credentials $cred - PS C:\>$prtToken = New-AADIntUserPRTToken -RefreshToken $prtKeys.refresh_token -SessionKey $prtKeys.session_key -GetNonce + PS C:\>$prtToken = New-AADIntUserPRTToken -RefreshToken $prtKeys.refresh_token -SessionKey $prtKeys.session_key PS C:\>$at = Get-AADIntAccessTokenForAADGraph -PRTToken $prtToken @@ -59,7 +56,7 @@ function New-UserPRTToken eyJhbGciOiJIUzI1NiIsICJjdHgiOiJBQUFBQUFBQUFBQUF... .EXAMPLE - PS C:\>New-AADIntUserPRTToken -Settings $prtKeys -GetNonce + PS C:\>New-AADIntUserPRTToken -Settings $prtKeys eyJhbGciOiJIUzI1NiIsICJjdHgiOiJBQUFBQUFBQUFBQUF... @@ -71,13 +68,13 @@ function New-UserPRTToken [Parameter(ParameterSetName='TokenAndKey',Mandatory=$True)] [String]$SessionKey, [Parameter(Mandatory=$False)] - [String]$Context, - [Parameter(Mandatory=$False)] - [String]$Nonce, + [String]$Context="8J+YiEFBREludGVybmFscyBGVFfwn5Kp", [Parameter(ParameterSetName='Settings',Mandatory=$True)] $Settings, - [switch]$GetNonce, - [bool]$KdfV2 = $true + [Parameter(Mandatory=$False)] + [bool]$KdfV2 = $true, + [Parameter(Mandatory=$False)] + [String]$SubScope ) Process { @@ -88,69 +85,75 @@ function New-UserPRTToken throw "refresh_token and/or session_key missing!" } $RefreshToken = $Settings.refresh_token - $SessionKey = $Settings.session_key + $SessionKey = $Settings.session_key } - if(!$Context) + return New-PRTSignedJWE -RefreshToken $RefreshToken -SessionKey $SessionKey -Context $Context -KdfV2 $KdfV2 -PRTToken + } +} + +# Creates a new PRT signed request +# Feb 4th 2025 +function New-SignedPRTRequest +{ +<# + .SYNOPSIS + Creates a new signed PRT request. + + .DESCRIPTION + Creates a new signed Primary Refresh Token (PRT) request used to get access tokens. + + .Parameter RefreshToken + Primary Refresh Token (PRT) of the user. + + .Parameter SessionKey + The session key binded to given PRT + + .Parameter Context + Optional. The context used in the request header. + + .Parameter Settings + PSObject containing refresh_token and session_key attributes. + + .Parameter Nonce + Optional. Nonce used in the request. + + .EXAMPLE + TBA + +#> + [cmdletbinding()] + Param( + [Parameter(ParameterSetName='TokenAndKey',Mandatory=$True)] + [String]$RefreshToken, + [Parameter(ParameterSetName='TokenAndKey',Mandatory=$True)] + [String]$SessionKey, + [Parameter(Mandatory=$False)] + [String]$Context="8J+YiEFBREludGVybmFscyBGVFfwn5Kp", + [Parameter(ParameterSetName='Settings',Mandatory=$True)] + $Settings, + [Parameter(Mandatory=$False)] + [bool]$KdfV2 = $true, + [Parameter(Mandatory=$True)] + $ClientId, + [Parameter(Mandatory=$True)] + $Resource, + [Parameter(Mandatory=$False)] + [String]$SubScope + ) + Process + { + if($Settings) { - # Create a random context - $ctx = New-Object byte[] 24 - ([System.Security.Cryptography.RandomNumberGenerator]::Create()).GetBytes($ctx) - } - else - { - $ctx = Convert-B64ToByteArray -B64 $Context - } - - $sKey = Convert-B64ToByteArray -B64 $SessionKey - $iat = [int]((Get-Date).ToUniversalTime() - $epoch).TotalSeconds - - # Create the header and body - $hdr = [ordered]@{ - "alg" = "HS256" - "typ" = "JWT" - "ctx" = (Convert-ByteArrayToB64 -Bytes $ctx) + if([string]::IsNullOrEmpty($Settings.refresh_token) -or [string]::IsNullOrEmpty($Settings.session_key)) + { + throw "refresh_token and/or session_key missing!" + } + $RefreshToken = $Settings.refresh_token + $SessionKey = $Settings.session_key } - $pld = [ordered]@{ - "refresh_token" = $RefreshToken - "is_primary" = "true" - "iat" = $iat - } - - # Derive the key from session key and context - if($KdfV2) - { - $hdr["kdf_ver"] = 2 - $derivedContext = Get-KDFv2Context -Context $ctx -Payload $pld - } - else - { - $derivedContext = $ctx - } - - $key = Get-PRTDerivedKey -Context $derivedContext -SessionKey $sKey - - # Fetch the nonce if not provided - if([string]::IsNullOrEmpty($Nonce)) - { - $Nonce = (Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/Common/oauth2/token" -Body "grant_type=srv_challenge").Nonce - } - $pld["request_nonce"] = $Nonce - - - # As the payload may have changed due to nonce, derive the key again if needed - if($KdfV2) - { - $derivedContext = Get-KDFv2Context -Context $ctx -Payload $pld - $key = Get-PRTDerivedKey -Context $derivedContext -SessionKey $sKey - } - - # Create the JWT - $jwt = New-JWT -Key $key -Header $hdr -Payload $pld - - # Return - return $jwt + return New-PRTSignedJWE -RefreshToken $RefreshToken -SessionKey $SessionKey -Context $Context -KdfV2 $KdfV2 -ClientId $ClientId -Resource $Resource -Request } } @@ -1575,3 +1578,324 @@ function Set-DeviceWHfBKey } } } + +# Generates a new P2P certificate +# Aug 21st 2020 +function New-P2PDeviceCertificate +{ +<# + .SYNOPSIS + Creates a new P2P device or user certificate using the device certificate or PRT information. + + .DESCRIPTION + Creates a new peer-to-peer (P2P) device or user certificate and exports it and the corresponding CA certificate. + It can be used to enable RDP trust between devices of the same AAD tenant. + + .EXAMPLE + Get-AADIntAccessTokenForAADJoin -SaveToCache + PS\:>Join-AADIntAzureAD -DeviceName "My computer" -DeviceType "Commodore" -OSVersion "C64" + + .Parameter Certificate + x509 certificate used to sign the certificate request. + + .Parameter PfxFileName + File name of the .pfx certificate used to sign the certificate request. + + .Parameter PfxPassword + The password of the .pfx certificate used to sign the certificate request. + + .Parameter TenantId + The tenant id or name of users' tenant. + + .Parameter DeviceName + The name of the device. Will be added to DNS Names attribute of the certificate. + + .Parameter OSVersion + The operating system version of the device. Defaults to "10.0.18363.0" + + .Parameter RefreshToken + Primary Refresh Token (PRT) or the user. + + .Parameter SessionKey + The session key of the user + + .Parameter Context + The context used = B64 encoded byte array (size 24) + + .Parameter Settings + PSObject containing refresh_token and session_key attributes. + + .EXAMPLE + PS C\:>New-AADIntP2PDeviceCertificate -PfxFileName .\d03994c9-24f8-41ba-a156-1805998d6dc7.pfx -DeviceName "mypc1.company.com" + + Device P2P certificate successfully created: + Subject: "CN=d03994c9-24f8-41ba-a156-1805998d6dc7, DC=4169fee0-df47-4e31-b1d7-5d248222b872" + DnsName: "mypc1.company.com" + Issuer: "CN=MS-Organization-P2P-Access [2020]" + Cert thumbprint: 84D7641F9BFA90767EA3456E443E21948FC425E5 + Cert file name : "d03994c9-24f8-41ba-a156-1805998d6dc7-P2P.pfx" + CA file name : "d03994c9-24f8-41ba-a156-1805998d6dc7-P2P-CA.der" + + .EXAMPLE + Get-AADIntAccessTokenForAADJoin -SaveToCache + PS C:\>Join-AADIntAzureAD -DeviceName "My computer" -DeviceType "Commodore" -OSVersion "C64" + + Device successfully registered to Azure AD: + DisplayName: "My computer" + DeviceId: d03994c9-24f8-41ba-a156-1805998d6dc7 + Cert thumbprint: 78CC77315A100089CF794EE49670552485DE3689 + Cert file name : "d03994c9-24f8-41ba-a156-1805998d6dc7.pfx" + Local SID: + S-1-5-32-544 + Additional SIDs: + S-1-12-1-797902961-1250002609-2090226073-616445738 + S-1-12-1-3408697635-1121971140-3092833713-2344201430 + S-1-12-1-2007802275-1256657308-2098244751-2635987013 + + PS C:\>$creds = Get-Credential + + PS C:\>$prtKeys = Get-UserAADIntPRTKeys -PfxFileName .\d03994c9-24f8-41ba-a156-1805998d6dc7.pfx -Credentials $cred + + PS C:\>New-AADIntP2PDeviceCertificate -RefreshToken $prtKeys.refresh_token -SessionKey $prtKeys.session_key + + User certificate successfully created: + Subject: "CN=TestU@contoso.com, CN=S-1-12-1-xx-xx-xx-xx, DC=0f73eaa6-7fd6-48b8-8897-e382ba96daf4" + Issuer: "CN=MS-Organization-P2P-Access [2020]" + Cert thumbprint: A7F1D1F134569E0234E6AA722354D99C3AA68D0F + Cert file name : "TestU@contoso.com-P2P.pfx" + CA file name : "TestU@contoso.com-P2P-CA.der" + +#> + [cmdletbinding()] + Param( + [Parameter(ParameterSetName='Certificate',Mandatory=$True)] + [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate, + + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$True)] + [string]$PfxFileName, + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$False)] + [string]$PfxPassword, + + [Parameter(ParameterSetName='TokenAndKey',Mandatory=$True)] + [String]$RefreshToken, + [Parameter(ParameterSetName='TokenAndKey',Mandatory=$True)] + [String]$SessionKey, + [Parameter(Mandatory=$False)] + [String]$Context, + [Parameter(ParameterSetName='Settings',Mandatory=$True)] + $Settings, + + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$True)] + [Parameter(ParameterSetName='Certificate',Mandatory=$True)] + [String]$TenantId, + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$True)] + [Parameter(ParameterSetName='Certificate',Mandatory=$True)] + [String]$DeviceName, + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$False)] + [Parameter(ParameterSetName='Certificate',Mandatory=$False)] + [String]$OSVersion="10.0.18363.0", + [Parameter(ParameterSetName='FileAndPassword',Mandatory=$False)] + [Parameter(ParameterSetName='Certificate',Mandatory=$False)] + [String[]]$DNSNames + ) + Process + { + if($Settings) + { + if([string]::IsNullOrEmpty($Settings.refresh_token) -or [string]::IsNullOrEmpty($Settings.session_key)) + { + throw "refresh_token and/or session_key missing!" + } + $RefreshToken = $Settings.refresh_token + $SessionKey = $Settings.session_key + } + + if($SessionKey -ne $null -and [string]::IsNullOrEmpty($Context)) + { + # Create a random context + $ctx = New-Object byte[] 24 + ([System.Security.Cryptography.RandomNumberGenerator]::Create()).GetBytes($ctx) + } + elseif($Context) + { + $ctx = Convert-B64ToByteArray -B64 $Context + } + + if($Certificate -eq $null -and [string]::IsNullOrEmpty($PfxFileName) -eq $false) + { + $Certificate = Load-Certificate -FileName $PfxFileName -Password $PfxPassword -Exportable + } + + if(!$DNSNames) + { + $DNSNames = @($DeviceName) + } + + if($Certificate) + { + $TenantId = (Parse-CertificateOIDs -Certificate $Certificate).TenantId + } + + if(!$TenantId) + { + $TenantId = (Read-Accesstoken $prtKeys.id_token).tid + } + + # Get the nonce + $nonce = (Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$TenantId/oauth2/token" -Body "grant_type=srv_challenge").Nonce + + # We are doing this with the existing device certificate + if($Certificate) + { + # Get the private key + $privateKey = Load-PrivateKey -Certificate $Certificate + + # Initialize the Certificate Signing Request object + $CN = $Certificate.Subject + $req = [System.Security.Cryptography.X509Certificates.CertificateRequest]::new($CN, $privateKey, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1) + + # Create the signing request + $csr = [convert]::ToBase64String($req.CreateSigningRequest()) + + # B64 encode the public key + $x5c = [convert]::ToBase64String(($certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert))) + + # Create the header and body + $hdr = [ordered]@{ + "alg" = "RS256" + "typ" = "JWT" + "x5c" = "$x5c" + } + + $pld = [ordered]@{ + "client_id" = "38aa3b87-a06d-4817-b275-7a316988d93b" + "request_nonce" = $nonce + "win_ver" = $OSVersion + "grant_type" = "device_auth" + "cert_token_use" = "device_cert" + "csr_type" = "http://schemas.microsoft.com/windows/pki/2009/01/enrollment#PKCS10" + "csr" = $csr + "netbios_name" = $DeviceName + "dns_names" = $DNSNames + } + + # Create the JWT + $jwt = New-JWT -PrivateKey $privateKey -Header $hdr -Payload $pld + + # Construct the body + $body = @{ + "windows_api_version" = "2.0" + "grant_type" = "urn:ietf:params:oauth:grant-type:jwt-bearer" + "request" = "$jwt" + } + } + else # We are doing this with the PRT keys information + { + # Create a private key and do something with it to get it stored + $rsa=[System.Security.Cryptography.RSA]::Create(2048) + + # Store the private key to so that it can be exported + $cspParameters = [System.Security.Cryptography.CspParameters]::new() + $cspParameters.ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider" + $cspParameters.ProviderType = 24 + $cspParameters.KeyContainerName ="AADInternals" + + # Set the private key + $privateKey = [System.Security.Cryptography.RSACryptoServiceProvider]::new(2048,$cspParameters) + $privateKey.ImportParameters($rsa.ExportParameters($true)) + + # Initialize the Certificate Signing Request object + $req = [System.Security.Cryptography.X509Certificates.CertificateRequest]::new("CN=", $rsa, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1) + + # Create the signing request + $csr = [convert]::ToBase64String($req.CreateSigningRequest()) + + # Create the header and body + $hdr = [ordered]@{ + "alg" = "HS256" + "typ" = "JWT" + "ctx" = (Convert-ByteArrayToB64 -Bytes $ctx) + } + + $pld = [ordered]@{ + "iss" = "aad:brokerplugin" + "grant_type" = "refresh_token" + "aud" = "login.microsoftonline.com" + "request_nonce" = $nonce + "scope" = "openid aza ugs" + "refresh_token" = $RefreshToken + "client_id" = "38aa3b87-a06d-4817-b275-7a316988d93b" + "cert_token_use" = "user_cert" + "csr_type" = "http://schemas.microsoft.com/windows/pki/2009/01/enrollment#PKCS10" + "csr" = $csr + } + + # Create the JWT + $jwt = New-JWT -Key (Get-PRTDerivedKey -Context $ctx -SessionKey (Convert-B64ToByteArray $SessionKey)) -Header $hdr -Payload $pld + + # Construct the body + $body = @{ + "grant_type" = "urn:ietf:params:oauth:grant-type:jwt-bearer" + "request" = "$jwt" + "windows_api_version" = "1.0" + } + } + + try + { + # Make the request to get the P2P certificate + $response = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/token" -ContentType "application/x-www-form-urlencoded" -Body $body + } + catch + { + $errorMessage = $_.ErrorDetails.Message | ConvertFrom-Json + Write-Error $errorMessage.error_description + return + } + + # Get the certificate + $binCert = [byte[]](Convert-B64ToByteArray -B64 $response.x5c) + + # Create a new x509certificate + $P2PCert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($binCert,"",[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable) + $P2PCert.PrivateKey = $privateKey + + # Write the device P2P certificate to disk + $certName = $P2PCert.Subject.Split(",")[0].Split("=")[1] + Set-BinaryContent -Path "$certName-P2P.pfx" -Value $P2PCert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx) + + # Write the P2P certificate CA to disk + $CA = @" +-----BEGIN PUBLIC KEY----- +$($response.x5c_ca) +-----END PUBLIC KEY----- +"@ + $CA | Set-Content "$certName-P2P-CA.der" + + if($Certificate) + { + # Unload the private key + Unload-PrivateKey -PrivateKey $privateKey + } + + # Print out information + if($Certificate) + { + Write-Host "Device P2P certificate successfully created:" + } + else + { + Write-Host "User certificate successfully created:" + } + Write-Host " Subject: ""$($P2PCert.Subject)""" + if($Certificate) + { + Write-Host " DnsNames: ""$($P2PCert.DnsNameList.Unicode)""" + } + Write-Host " Issuer: ""$($P2PCert.Issuer)""" + Write-Host " Cert thumbprint: $($P2PCert.Thumbprint)" + Write-host " Cert file name : ""$certName-P2P.pfx""" + Write-host " CA file name : ""$certName-P2P-CA.der""" + + } +} \ No newline at end of file diff --git a/PRT_Utils.ps1 b/PRT_Utils.ps1 index 34336f5..31e2e60 100644 --- a/PRT_Utils.ps1 +++ b/PRT_Utils.ps1 @@ -279,9 +279,9 @@ function Get-PRTDerivedKey } } -# Get the access token with PRT +# Get the access token with PRTToken # Aug 20th 2020 -function Get-AccessTokenWithPRT +function Get-AccessTokenWithPRTToken { [cmdletbinding()] Param( @@ -295,7 +295,8 @@ function Get-AccessTokenWithPRT [String]$RedirectUri, [switch]$GetNonce, [Parameter(Mandatory=$False)] - [String]$Tenant + [String]$Tenant,[Parameter(Mandatory=$False)] + [String]$SubScope ) Process { @@ -318,7 +319,7 @@ function Get-AccessTokenWithPRT $requestId = $mscrid # Create url and headers - $url = "https://login.microsoftonline.com/$Tenant/oauth2/authorize?resource=$Resource&client_id=$ClientId&response_type=code&redirect_uri=$RedirectUri&client-request-id=$requestId&mscrid=$mscrid" + $url = "$(Get-TenantLoginUrl -SubScope $SubScope)/$Tenant/oauth2/authorize?resource=$Resource&client_id=$ClientId&response_type=code&redirect_uri=$RedirectUri&client-request-id=$requestId&mscrid=$mscrid" # Add sso_nonce if exist if($parsedCookie.request_nonce) @@ -327,13 +328,19 @@ function Get-AccessTokenWithPRT } $headers = @{ - "User-Agent" = "" + "User-Agent" = Get-UserAgent "x-ms-RefreshTokenCredential" = $Cookie } # First, make the request to get the authorisation code (tries to redirect so throws an error) $response = Invoke-WebRequest -UseBasicParsing -Uri $url -Headers $headers -MaximumRedirection 0 -ErrorAction SilentlyContinue + $config = Parse-LoginMicrosoftOnlineComConfig -Body $response + if($config.sErrorCode) + { + Throw (Get-Error -ErrorCode $config.sErrorCode) + } + $code = Parse-CodeFromResponse -Response $response if(!$code) @@ -349,8 +356,13 @@ function Get-AccessTokenWithPRT redirect_uri = $RedirectUri } + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + # Make the second request to get the access token - $response = Invoke-RestMethod -UseBasicParsing -Uri "https://login.microsoftonline.com/common/oauth2/token" -Body $body -ContentType "application/x-www-form-urlencoded" -Method Post + $response = Invoke-RestMethod -UseBasicParsing -Uri "$(Get-TenantLoginUrl -SubScope $SubScope)/common/oauth2/token" -Body $body -ContentType "application/x-www-form-urlencoded" -Method Post Write-Debug "ACCESS TOKEN: $($response.access_token)" Write-Debug "REFRESH TOKEN: $($response.refresh_token)" @@ -372,11 +384,68 @@ function Get-AccessTokenWithBPRT [Parameter(Mandatory=$True)] [String]$Resource, [Parameter(Mandatory=$True)] - [String]$ClientId + [String]$ClientId, + [Parameter(Mandatory=$False)] + [String]$SubScope ) Process { - Get-AccessTokenWithRefreshToken -Resource "urn:ms-drs:enterpriseregistration.windows.net" -ClientId "b90d5b8f-5503-4153-b545-b31cecfaece2" -TenantId "Common" -RefreshToken $BPRT + Get-AccessTokenWithRefreshToken -Resource "urn:ms-drs:enterpriseregistration.windows.net" -ClientId "b90d5b8f-5503-4153-b545-b31cecfaece2" -TenantId "Common" -RefreshToken $BPRT -SubScope $SubScope + } +} + +# Gets the access token using a signed PRT request +# Feb 4th 2025 +function Get-AccessTokenWithSignedPRTRequest +{ + [cmdletbinding()] + Param( + [Parameter(Mandatory=$True)] + [String]$RefreshToken, + [Parameter(Mandatory=$True)] + [String]$SessionKey, + [Parameter(Mandatory=$False)] + [String]$Context="8J+YiEFBREludGVybmFscyBGVFfwn5Kp", + [Parameter(Mandatory=$True)] + $ClientId, + [Parameter(Mandatory=$True)] + $Resource, + [Parameter(Mandatory=$False)] + [String]$SubScope, + [Parameter(Mandatory=$False)] + [bool]$CAE + ) + Process + { + # Create a signed PRT request + $jwt = New-PRTSignedJWE -RefreshToken $RefreshToken -SessionKey $SessionKey -Context $Context -KdfV2 $true -ClientId $ClientId -Resource $Resource -Request + + # Set the body for API call + $body = @{ + "windows_api_version" = "2.0" + "grant_type" = "urn:ietf:params:oauth:grant-type:jwt-bearer" + "request" = $jwt + "client_info" = "1" + "tgt" = "true" + } + + # Set Continuous Access Evaluation (CAE) token claims + if($CAE) + { + $body["claims"] = Get-CAEClaims + } + + # Get the encrypted response + $jwe = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "$(Get-TenantLoginUrl -SubScope $SubScope)/Common/oauth2/token" -Body $body #-Headers $headers -WebSession $session + + # Convert session key to byte array and decrypt JWE + $sKey = Convert-B64ToByteArray -B64 $SessionKey + $response = [text.encoding]::UTF8.GetString((Decrypt-JWE -JWE $jwe -SessionKey $sKey)) | ConvertFrom-Json + + # Debug + Write-Debug "ACCESS TOKEN RESPONSE: $response" + + return $response } } @@ -688,7 +757,7 @@ Function Decrypt-JWE { $alg = "RSA-OAEP" } - elseif($parsedJWE.enc -ne "A256GCM") + elseif($parsedJWE.enc -notin "A256GCM","A128CBC-HS256") { Throw "Unsupported enc: $enc" } @@ -787,7 +856,7 @@ Function Decrypt-JWE else { # De-deflate - if($parsedJWE.zip -eq "Deflate") + if($parsedJWE.zip -in "Deflate","DEF") { $retVal = Get-DeDeflatedByteArray -byteArray $decData } @@ -938,4 +1007,103 @@ Function New-JWE Throw "Unsupported alg: $alg" } } -} \ No newline at end of file +} + +# Creates a PRT signed JWE +# Feb 4th 2025 +function New-PRTSignedJWE +{ + + [cmdletbinding()] + Param( + [Parameter(Mandatory=$True)] + [String]$RefreshToken, + + [Parameter(Mandatory=$True)] + [String]$SessionKey, + + [Parameter(Mandatory=$False)] + [String]$Context="8J+YiEFBREludGVybmFscyBGVFfwn5Kp", + + [Parameter(Mandatory=$False)] + [bool]$KdfV2 = $true, + + [Parameter(Mandatory=$False)] + [String]$SubScope, + + [Parameter(ParameterSetName='PRTToken',Mandatory=$True)] + [switch]$PRTToken, + + [Parameter(ParameterSetName='Request',Mandatory=$True)] + [switch]$Request, + + [Parameter(ParameterSetName='PRTToken',Mandatory=$False)] + [Parameter(ParameterSetName='Request',Mandatory=$True)] + [string]$ClientId, + + [Parameter(ParameterSetName='PRTToken',Mandatory=$False)] + [Parameter(ParameterSetName='Request',Mandatory=$True)] + [string]$Resource + + ) + Process + { + # Define variables + $ctx = Convert-B64ToByteArray -B64 $Context + $sKey = Convert-B64ToByteArray -B64 $SessionKey + $iat = [int]((Get-Date).ToUniversalTime() - $epoch).TotalSeconds + $nonce = (Invoke-RestMethod -UseBasicParsing -Method Post -Uri "$(Get-TenantLoginUrl -SubScope $SubScope)/Common/oauth2/token" -Body "grant_type=srv_challenge").Nonce + + # Create the header and body + $hdr = [ordered]@{ + "alg" = "HS256" + "typ" = "JWT" + "ctx" = $Context + } + + if($PRTToken) + { + $pld = [ordered]@{ + "refresh_token" = $RefreshToken + "is_primary" = "true" + "iat" = $iat + "request_nonce" = $nonce + } + } + else + { + $pld=[ordered]@{ + #"win_ver"= "10.0.19041.1620" + "scope"= "openid aza" + "resource" = $resource + "request_nonce" = $nonce + "refresh_token" = $RefreshToken + #"redirect_uri" = "ms-appx-web://Microsoft.AAD.BrokerPlugin/$clientId" + "redirect_uri" = Get-AuthRedirectUrl -ClientId $ClientId -Resource $Resource + "iss" = "aad:brokerplugin" + "grant_type" = "refresh_token" + "client_id" = $clientId + "aud" = "login.microsoftonline.com" + } + } + + # Derive the key from session key and context + if($KdfV2) + { + $hdr["kdf_ver"] = 2 + $derivedContext = Get-KDFv2Context -Context $ctx -Payload $pld + } + else + { + $derivedContext = $ctx + } + + $key = Get-PRTDerivedKey -Context $derivedContext -SessionKey $sKey + + # Create the JWT + $jwt = New-JWT -Key $key -Header $hdr -Payload $pld + + # Return + return $jwt + } +} diff --git a/SPO.ps1 b/SPO.ps1 index 3c855c0..79eb612 100644 --- a/SPO.ps1 +++ b/SPO.ps1 @@ -18,42 +18,29 @@ function Get-SPOSiteGroups SharePoint Online authentication header .Example - PS C:\>$auth=Get-AADIntSPOAuthenticationHeader -Site https://company.sharepoint.com - PS C:\>Get-AADIntSPOSiteGroups -Site https://company.sharepoint.com/sales -AuthHeader $auth + PS C:\>Get-AADIntAccessTokenForSPO -SaveToCache + PS C:\>Get-AADIntSPOSiteGroups -Site https://company.sharepoint.com/sales #> [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$Site, [Parameter(Mandatory=$False)] - [String]$AuthHeader, - [Parameter(Mandatory=$False)] [String]$AccessToken ) Process { # Check the site url - if($Site.EndsWith("/")) - { - $Site=$Site.Substring(0,$Site.Length-1) - } + $Site=$Site.Trim("/") $siteDomain=$Site.Split("/")[2] - if(![string]::IsNullOrEmpty($AuthHeader)) - { - # Create a WebSession object - $siteSession = Create-WebSession -SetCookieHeader $AuthHeader -Domain $siteDomain - } - else - { - # Get from cache if not provided - $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource $site -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" - $headers=@{ - "Authorization" = "Bearer $AccessToken" - } - } - + # Get from cache if not provided + $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource $site -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" + $headers=@{ + "Authorization" = "Bearer $AccessToken" + } + # Invoke the request $response=Invoke-WebRequest -UseBasicParsing -Uri "$Site/_api/web/sitegroups" -Method Get -WebSession $siteSession -ErrorAction SilentlyContinue -Headers $headers @@ -107,16 +94,14 @@ function Get-SPOSiteUsers SharePoint Online authentication header .Example - PS C:\>$auth=Get-AADIntSPOAuthenticationHeader -Site https://company.sharepoint.com - PS C:\>Get-AADIntSPOSiteUsers -Site https://company.sharepoint.com/sales -AuthHeader $auth + PS C:\>Get-AADIntAccessTokenForSPO -SaveToCache + PS C:\>Get-AADIntSPOSiteUsers -Site https://company.sharepoint.com/sales #> [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$Site, [Parameter(Mandatory=$False)] - [String]$AuthHeader, - [Parameter(Mandatory=$False)] [String]$AccessToken ) Process @@ -125,19 +110,11 @@ function Get-SPOSiteUsers $tenant=$Site.Split("/")[2] - if(![string]::IsNullOrEmpty($AuthHeader)) - { - # Create a WebSession object - $siteSession = Create-WebSession -SetCookieHeader $AuthHeader -Domain $siteDomain - } - else - { - # Get from cache if not provided - $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" - $headers=@{ - "Authorization" = "Bearer $AccessToken" - } - } + # Get from cache if not provided + $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" + $headers=@{ + "Authorization" = "Bearer $AccessToken" + } # Invoke the request $response=Invoke-WebRequest -UseBasicParsing -Uri "$Site/_api/web/siteusers" -Method Get -WebSession $siteSession -Headers $headers -ErrorAction SilentlyContinue @@ -204,8 +181,8 @@ function Get-SPOUserProperties LoginName of the user in format "i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint" .Example - PS C:\>$auth=Get-AADIntSPOAuthenticationHeader -Site https://company.sharepoint.com - PS C:\>Get-AADIntSPOUserProperties -Site https://company.sharepoint.com/sales -AuthHeader $auth -User "i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint" + PS C:\>Get-AADIntAccessTokenForSPO -SaveToCache + PS C:\>Get-AADIntSPOUserProperties -Site https://company.sharepoint.com/sales -User "i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint" #> [cmdletbinding()] Param( @@ -214,8 +191,6 @@ function Get-SPOUserProperties [Parameter(Mandatory=$True)] [String]$UserName, [Parameter(Mandatory=$False)] - [String]$AuthHeader, - [Parameter(Mandatory=$False)] [String]$AccessToken ) Process @@ -235,19 +210,11 @@ function Get-SPOUserProperties $UserName="i:0%23.f|membership|$UserName" } - if(![string]::IsNullOrEmpty($AuthHeader)) - { - # Create a WebSession object - $siteSession = Create-WebSession -SetCookieHeader $AuthHeader -Domain $siteDomain - } - else - { - # Get from cache if not provided - $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" - $headers=@{ - "Authorization" = "Bearer $AccessToken" - } - } + # Get from cache if not provided + $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" + $headers=@{ + "Authorization" = "Bearer $AccessToken" + } # Invoke the request $response=Invoke-WebRequest2 -Uri "$Site/_api/sp.userprofiles.peoplemanager/getpropertiesfor(@v)?@v='$UserName'" -Method Get -WebSession $siteSession -Headers $headers -ErrorAction SilentlyContinue @@ -312,12 +279,8 @@ function Get-SPOSiteUserProperties SharePoint Online Access Token .Example - PS C:\>$auth=Get-AADIntSPOAuthenticationHeader -Site https://company.sharepoint.com - PS C:\>Get-AADIntSPOSiteGroups -Site https://company.sharepoint.com/sales -AuthHeader $auth - - .Example - PS C:\>$at=Get-AADIntAccessTokenForSPO - PS C:\>Get-AADIntSPOSiteGroups -Site https://company.sharepoint.com/sales -AccessToken $at + PS C:\>Get-AADIntAccessTokenForSPO -SaveToCache + PS C:\>Get-AADIntSPOSiteGroups -Site https://company.sharepoint.com/sales #> [cmdletbinding()] Param( @@ -326,17 +289,12 @@ function Get-SPOSiteUserProperties [Parameter(Mandatory=$True)] [String]$UserName, [Parameter(Mandatory=$False)] - [String]$AuthHeader, - [Parameter(Mandatory=$False)] [String]$AccessToken ) Process { # Check the site url - if($Site.EndsWith("/")) - { - $Site=$Site.Substring(0,$Site.Length-1) - } + $Site=$Site.Trim("/") $siteDomain=$Site.Split("/")[2] @@ -346,19 +304,11 @@ function Get-SPOSiteUserProperties $UserName="i:0%23.f|membership|$UserName" } - if(![string]::IsNullOrEmpty($AuthHeader)) - { - # Create a WebSession object - $siteSession = Create-WebSession -SetCookieHeader $AuthHeader -Domain $siteDomain - } - else - { - # Get from cache if not provided - $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" - $headers=@{ - "Authorization" = "Bearer $AccessToken" - } - } + # Get from cache if not provided + $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" + $headers=@{ + "Authorization" = "Bearer $AccessToken" + } # Invoke the request $response=Invoke-WebRequest -UseBasicParsing -Uri "$Site/_api/SP.UserProfiles.PeopleManager/GetPropertiesFor(accountName=@v)?@v='$UserName'" -Method Get -WebSession $siteSession -ErrorAction SilentlyContinue -Headers $headers @@ -420,12 +370,8 @@ function Set-SPOSiteUserProperty Property value .Example - PS C:\>$auth=Get-AADIntSPOAuthenticationHeader -Site https://company.sharepoint.com - PS C:\>Set-AADIntSPOUserProperty -Site https://company.sharepoint.com/sales -AuthHeader $auth -UserName user@company.com -Property "AboutMe" -Value "I'm a happy SPO user!" - - .Example - PS C:\>$at=Get-AADIntAccessTokenForSPO - PS C:\>Set-AADIntSPOUserProperty -Site https://company.sharepoint.com/sales -AccessToken $at -UserName user@company.com -Property "AboutMe" -Value "I'm a happy SPO user!" + PS C:\>Get-AADIntAccessTokenForSPO -SaveToCache + PS C:\>Set-AADIntSPOUserProperty -Site https://company.sharepoint.com/sales -UserName user@company.com -Property "AboutMe" -Value "I'm a happy SPO user!" #> [cmdletbinding()] Param( @@ -434,8 +380,6 @@ function Set-SPOSiteUserProperty [Parameter(Mandatory=$True)] [String]$UserName, [Parameter(Mandatory=$False)] - [String]$AuthHeader, - [Parameter(Mandatory=$False)] [String]$AccessToken, [Parameter(Mandatory=$True)] [String]$Property, @@ -452,10 +396,7 @@ function Set-SPOSiteUserProperty } # Check the site url - if($Site.EndsWith("/")) - { - $Site=$Site.Substring(0,$Site.Length-1) - } + $Site=$Site.Trim("/") $siteDomain=$Site.Split("/")[2] @@ -465,17 +406,9 @@ function Set-SPOSiteUserProperty $UserName="i:0#.f|membership|$UserName" } - if(![string]::IsNullOrEmpty($AuthHeader)) - { - # Create a WebSession object - $siteSession = Create-WebSession -SetCookieHeader $AuthHeader -Domain $siteDomain - } - else - { - # Get from cache if not provided - $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" - $headers["Authorization"] = "Bearer $AccessToken" - } + # Get from cache if not provided + $AccessToken = Get-AccessTokenFromCache -AccessToken $AccessToken -Resource "https://$Tenant.sharepoint.com/" -ClientId "d3590ed6-52b3-4102-aeff-aad2292ab01c" + $headers["Authorization"] = "Bearer $AccessToken" # Create the body $body=@{ @@ -618,10 +551,8 @@ function Set-SPOSiteMembers Process { # Check the site url - if($Site.EndsWith("/")) - { - $Site=$Site.Substring(0,$Site.Length-1) - } + $Site=$Site.Trim("/") + $siteDomain=$Site.Split("/")[2] # Create a WebSession object diff --git a/SPO_utils.ps1 b/SPO_utils.ps1 index 1fa3f6a..f530573 100644 --- a/SPO_utils.ps1 +++ b/SPO_utils.ps1 @@ -1,151 +1,5 @@ # Utility functions for SharePoint Online -# Gets the authentication cookie for SPO web interface -# Supports MFA, federation, etc. -# Jul 17th 2019 -function Get-SPOAuthenticationHeader -{ -<# - .SYNOPSIS - Gets authentication header for SharePoint Online - - .DESCRIPTION - Gets authentication header for SharePoint Online, which is used for example to retrieve site users. - - .Parameter Site - Url for the SharePoint Online - - .Example - Get-AADIntSPOAuthenticationHeader -#> - [cmdletbinding()] - Param( - [Parameter(Mandatory=$True)] - [String]$Site - ) - Process - { - # Check the site url - $Site = $Site.Trim("/") - - $siteDomain=$Site.Split("/")[2] - - $headers=@{ - "User-Agent"="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" - "Upgrade-Insecure-Requests" = "1" - "Accept-Encoding" = "gzip, deflate, br" - "Accept-Language" = "en-US,en;q=0.9" - "Accept" = "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" - - } - - # Step 1: Go to the requested site - $response = Invoke-WebRequest2 -uri $Site -MaximumRedirection 0 -ErrorAction SilentlyContinue - - # Step 2: Go to "/_layouts/15/Authenticate.aspx?Source=%2F" - $url = $response.Headers.'Location' - $response = Invoke-WebRequest2 -uri $url -MaximumRedirection 0 -ErrorAction SilentlyContinue - $siteWebSession = Create-WebSession -SetCookieHeader $response.Headers.'Set-Cookie' -Domain $siteDomain - - # Step 3: Go to "/_forms/default.aspx?ReturnUrl=%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F&Source=cookie" - $html=$response.Content - $s=$html.IndexOf('href="')+6 - $e=$html.IndexOf('"',$s) - $url=$html.Substring($s,$e-$s) - $url="https://$siteDomain$url" - $response = Invoke-WebRequest2 -uri $url -MaximumRedirection 0 -WebSession $siteWebSession -ErrorAction SilentlyContinue - - # Create the cookie header for the login form - $cookieHeaderValue="" - $cookies = $response.Headers.'Set-Cookie'.Split(";,") - foreach($cookie in $cookies) - { - - $name = $cookie.Split("=")[0].trim() - $value = $cookie.Substring($name.Length+1) - - if($name.StartsWith("nSGt") -or $name -eq "RpsContextCookie") - { - # If not empty, append the separator - if(![String]::IsNullOrEmpty($cookieHeaderValue)) - { - $cookieHeaderValue+="; " - } - - $cookieHeaderValue+="$name=$value" - - } - } - - # Set variables - $auth_redirect="foobar"#"https://login.microsoftonline.com/common/federation/oauth2"#"https://login.microsoftonline.com/kmsi" - $url=$response.Headers.Location - - # Create the form - $form = Create-LoginForm -Url $url -auth_redirect $auth_redirect -Headers "Cookie: $cookieHeaderValue" - - # Show the form and wait for the return value - if($form.ShowDialog() -ne "OK") { - # Dispose the control - $form.Controls[0].Dispose() - Write-Verbose "Login cancelled" - return $null - } - - # Extract the needed parameters - $forminputs=$form.Controls[0].Document.getElementsByTagName("input") - - $code = $forminputs.GetElementsByName("code")[0].GetAttribute("value") - $session_state = $forminputs.GetElementsByName("session_state")[0].GetAttribute("value") - $id_token = $forminputs.GetElementsByName("id_token")[0].GetAttribute("value") - $correlation_id = $forminputs.GetElementsByName("correlation_id")[0].GetAttribute("value") - $url=$form.Controls[0].Document.Forms[0].DomElement.action - - # Dispose the control - $form.Controls[0].Dispose() - - # Create the body and get the cookie - $body=@{ - "code" = $code - "session_state" = $session_state - "id_token" = $id_token - "correlation_id" = $correlation_id - } - $response = Invoke-WebRequest2 -Uri $url -Method Post -Body $body -MaximumRedirection 0 -WebSession $siteWebSession - - - - # Extract the cookies - $cookieHeader = $response.Headers.'Set-Cookie' - $cookieHeaderValue="" - - # Clean up the Set-Cookie header - $cookies = $cookieHeader.Split(";,") - foreach($cookie in $cookies) - { - - $name = $cookie.Split("=")[0].trim() - $value = $cookie.Substring($name.Length+1) - - if($name -eq "rtFA" -or $name -eq "FedAuth" -or $name -eq "RpsContextCookie") - { - # If not empty, append the separator - if(![String]::IsNullOrEmpty($cookieHeaderValue)) - { - $cookieHeaderValue+="|" - } - - $cookieHeaderValue+="$name=$value" - - } - } - - # Return - return $cookieHeaderValue - - } -} - # Creates a list from xml collection function Create-ListFromCollection {