From 0604f6a088c9169aa89e6db5f4bb405097c4865a Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 4 Jun 2025 14:06:07 +0800 Subject: [PATCH 01/19] Update techpass-status.md --- docs/support/techpass-status.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index 37c7224..dba58af 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -10,7 +10,10 @@ No scheduled maintenance! ## Ongoing incidents -No ongoing incident +| **Date** | 4 June 2025 | +|---|---| +| **Incident summary** | We are currently facing issues with Intune.

**Impact**
- New users onboarding to SEED may be affected.
- Some users may face issues accessing SGTS or GCC.

**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:00 PM SGT* | + ## Previous incidents From 15d0c6b591efa7cb7b34c97ecd6d5377a78dbb07 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 4 Jun 2025 14:15:47 +0800 Subject: [PATCH 02/19] Update techpass-status.md --- docs/support/techpass-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index dba58af..3bbd68a 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -12,7 +12,7 @@ No scheduled maintenance! | **Date** | 4 June 2025 | |---|---| -| **Incident summary** | We are currently facing issues with Intune.

**Impact**
- New users onboarding to SEED may be affected.
- Some users may face issues accessing SGTS or GCC.

**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:00 PM SGT* | +| **Incident summary** | We are currently facing issues with Intune.

**Impact**
- New users onboarding to SEED may be affected.

**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | From b0d841957c80f301dc82d13c6fe9616570d39ed1 Mon Sep 17 00:00:00 2001 From: eu-tee <118496033+eu-tee@users.noreply.github.com> Date: Wed, 4 Jun 2025 14:32:28 +0800 Subject: [PATCH 03/19] Update techpass-status.md --- docs/support/techpass-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index 3bbd68a..fe701ad 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -12,7 +12,7 @@ No scheduled maintenance! | **Date** | 4 June 2025 | |---|---| -| **Incident summary** | We are currently facing issues with Intune.

**Impact**
- New users onboarding to SEED may be affected.

**Action**
- We have identified the root cause and are working closely with Microsoft to resolve the issue.
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | +| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.

**Impact**
- New users onboarding to SEED may be affected.

**Action**
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | From 48f1c93af5e04f9568791b8396cdba9724b7fa73 Mon Sep 17 00:00:00 2001 From: eu-tee <118496033+eu-tee@users.noreply.github.com> Date: Wed, 4 Jun 2025 14:33:25 +0800 Subject: [PATCH 04/19] Update techpass-status.md --- docs/support/techpass-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index fe701ad..1ca8993 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -12,7 +12,7 @@ No scheduled maintenance! | **Date** | 4 June 2025 | |---|---| -| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.

**Impact**
- New users onboarding to SEED may be affected.

**Action**
- If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | +| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.

**Impact**
- New users onboarding to SEED may be affected.

If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | From 88696674383fe8d70d5c064468b6cead19c3de27 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 4 Jun 2025 16:09:00 +0800 Subject: [PATCH 05/19] Update techpass-status.md --- docs/support/techpass-status.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index 1ca8993..920bcdd 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -10,14 +10,17 @@ No scheduled maintenance! ## Ongoing incidents -| **Date** | 4 June 2025 | -|---|---| -| **Incident summary** | We are currently facing issues with Intune. We have identified the root cause and are working closely with Microsoft to resolve the issue.

**Impact**
- New users onboarding to SEED may be affected.

If you encounter access issues, please [raise a support ticket](https://go.gov.sg/seed-techpass-support).

*Posted on: 4 June 2025, 2:10 PM SGT* | +No ongoing incident! ## Previous incidents +**| Date | 4 June 2025 | +|------|--------------| +| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 4:00 PM SGT**.

**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.

The issue has been fixed, and onboarding is now functioning normally.

**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). | +** + | **Date** | 22 January 2025 | |---|---| | **Incident summary** | At **11:58 AM (SGT)** today, TechPass users reported being unable to log in to the TechPass portal.

**Impact**
- Users were unable to access the TechPass portal during the incident.
- Access to downstream services was unaffected.

**Resolution**
- The issue has been resolved, and users can now log in successfully.

*Posted on: 22 January 2025, 12:30 SGT* | From 02679de33bb4c2af5c01e09fca03c6a5de86345d Mon Sep 17 00:00:00 2001 From: eu-tee <118496033+eu-tee@users.noreply.github.com> Date: Wed, 4 Jun 2025 19:10:27 +0800 Subject: [PATCH 06/19] Update techpass-status.md --- docs/support/techpass-status.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index 920bcdd..c201347 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -18,7 +18,7 @@ No ongoing incident! **| Date | 4 June 2025 | |------|--------------| -| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 4:00 PM SGT**.

**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.

The issue has been fixed, and onboarding is now functioning normally.

**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). | +| **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 6:57 PM SGT**.

**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.

The issue has been fixed, and onboarding is now functioning normally.

**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). | ** | **Date** | 22 January 2025 | From e3d335678b75b614cfa46cbfcb0304eb937ead15 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 4 Jun 2025 19:20:53 +0800 Subject: [PATCH 07/19] Update techpass-status.md --- docs/support/techpass-status.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/support/techpass-status.md b/docs/support/techpass-status.md index c201347..1570438 100644 --- a/docs/support/techpass-status.md +++ b/docs/support/techpass-status.md @@ -16,10 +16,9 @@ No ongoing incident! ## Previous incidents -**| Date | 4 June 2025 | +| **Date** | 4 June 2025 | |------|--------------| | **Issue summary** | The Intune issue affecting new user onboarding to SEED has been **resolved as of 6:57 PM SGT**.

**Impact**: New users onboarding to SEED via TechPass may have experienced access issues earlier today.

The issue has been fixed, and onboarding is now functioning normally.

**For more assistance**: Create an [incident support request](https://go.gov.sg/seed-techpass-support). | -** | **Date** | 22 January 2025 | |---|---| From d812051921f82f8396244471bd1baf5f730d4fe4 Mon Sep 17 00:00:00 2001 From: Huda Date: Thu, 5 Jun 2025 04:16:01 +0800 Subject: [PATCH 08/19] change --- docs/_sidebar.md | 6 +- docs/account-llifecycle.md | 54 ++++++++++++++++++ docs/securing-your-account.md | 100 ++++++++++++++++++++++++++++++++++ 3 files changed, 159 insertions(+), 1 deletion(-) create mode 100644 docs/account-llifecycle.md create mode 100644 docs/securing-your-account.md diff --git a/docs/_sidebar.md b/docs/_sidebar.md index fcac50c..fbc801c 100644 --- a/docs/_sidebar.md +++ b/docs/_sidebar.md @@ -12,7 +12,11 @@ - [Request for SEED provisioning](request-for-seed-provisioning) - [Register Intune Device ID](register-intune-device-id) - [Edit TechPass profile](edit-profile) - - [User life cycle](user-lifecycle) +- **Account and access lifecycle** + - [User lifecycle rules](user-lifecycle.md) + - [Account lifecycle after departure](account-lifecycle.md) + - [Securing your account](securing-your-account.md) + - **Reset MFA** - [WOG account](reset-security-verification-for-wog-account) - [TechPass account](reset-techpass-mfa-for-new-device) diff --git a/docs/account-llifecycle.md b/docs/account-llifecycle.md new file mode 100644 index 0000000..8094b4a --- /dev/null +++ b/docs/account-llifecycle.md @@ -0,0 +1,54 @@ +# Account lifecycle after leaving your organisation + +When you leave your organisation, your TechPass account may be disabled or terminated. This affects your access to connected services such as SEED, GCC, and SHIP-HATS. This guide explains what you can expect and what you might need to do. + +## Lifecycle flow overview + +The diagram below shows how account removal is triggered and processed across systems: + +![Account Lifecycle flow](/assets/images/acc-lifecycle.png) + +## How account removal is triggered + +TechPass is notified by your organisation when a user leaves. These notifications come from official systems or manual requests from project teams. + +| Source | Applies to | Description | +| --- | --- | --- | +| HR systems | Public officers | Exit events are detected by central identity systems. | +| TIVO system (temporary, intern, vendor officers) | Vendors, interns, temporary staff | Access removal is triggered when an assignment ends. | +| Service request | All user types | A manual request to remove a user can be submitted by project teams. | + +> Note: If you move to another department within the same agency, your TechPass account will not be updated automatically. There is no signal to detect internal transfers, so your access remains unless your project team updates it manually. + +## How this affects your access + +Once your account is removed from TechPass, your access to other services may be affected in the following ways: + +- **SEED** + You will be signed out and unable to log back in. + +- **GCC** + Access is usually removed by project administrators. In some cases, this may take a few days, especially if GitLab group clean-up runs on a weekly schedule. + +- **SHIP-HATS** + Access removal follows a weekly sync. If your access still works temporarily, your project team is expected to remove it during their regular reviews. + +## What you might need to do + +Most users do not need to take any action. However: + +- If you still have access to a service you should no longer use, notify your project team. +- You may be logged out from services without warning once the removal process completes. + +## For project teams and administrators + +| Role | Action | +| --- | --- | +| Tenant admin | Remove user access after receiving the email notification from TechPass. | +| Project team | Review and clean up user access in tools such as SHIP-HATS or GitLab groups. | + +## Limitations + +- Internal transfers within the same agency are not automatically detected. +- Some systems process access removal on a scheduled basis, which may cause delays. +- Manual steps are still required in many cases, especially for project-level tools. diff --git a/docs/securing-your-account.md b/docs/securing-your-account.md new file mode 100644 index 0000000..72de145 --- /dev/null +++ b/docs/securing-your-account.md @@ -0,0 +1,100 @@ +# Securing your account + +Multiple layers of security are applied across TechPass and its connected systems to protect user accounts and control access to government digital services. These controls span authentication, authorisation, monitoring, and automated risk detection. + +Account security is a shared responsibility across users, agencies, services, and the identity platform. + +## Shared responsibility + +Account security is maintained through the combined efforts of different groups: + +| Group | Responsibility | +| --- | --- | +| End user | Use multifactor authentication (MFA), avoid approving unknown sign-in requests, report suspicious behaviour | +| Agency (HR, managers) | Manage onboarding, deactivation, and internal movement of users | +| Services | Define access through roles, assign permissions, and conduct regular access reviews | +| Identity platform | Detect suspicious activity, enforce conditional access policies, and prompt reauthentication when needed | + +## Authentication and authorisation + +- **Authentication** is the process of confirming identity during sign-in (for example, using a password and MFA). +- **Authorisation** determines what access is granted to the user based on assigned roles (for example, a project admin may have more access than a viewer). + +Both are essential for secure system access. + +## Security controls in place + +### Single sign-on (SSO) + +TechPass uses single sign-on to provide access to multiple services through a single identity. + +- Managed via Microsoft Entra ID +- Requires MFA at sign-in +- Allows centralised monitoring of sign-in behaviour + +### Multifactor authentication (MFA) + +MFA is required for all users. It protects against unauthorised access even if credentials are compromised. + +- Review each prompt before approving +- Reject any unexpected MFA request +- Report suspicious activity to TechPass support +- MFA will be prompted again if a risky sign-in is detected + +### Device registration + +Access to some services, such as SEED, is restricted to registered devices. + +- Devices must meet compliance checks before registration +- Helps prevent unauthorised access from unmanaged endpoints + +### Role-based access + +Access permissions are based on user roles, aligned with the principle of least privilege. + +- Services such as GCC2 use roles to define what users can view or manage +- Roles should reflect the user’s actual responsibilities + +### Access reviews + +Regular access reviews ensure users retain only the access required for their roles. + +- Services are responsible for conducting reviews +- Users may be prompted to confirm continued access +- Unused or outdated access may be revoked + +### Identity protection and risky sign-ins + +The identity platform monitors sign-ins for risky patterns, including: + +- Sign-ins from unfamiliar locations or devices +- Unusual session activity or behavioural anomalies +- Multiple failed attempts or rapid account switching + +When risky behaviour is detected: + +- Access may be temporarily blocked +- The user may be asked to reauthenticate and complete MFA +- Conditional access policies are automatically enforced to reduce risk + +> To learn more, see [Microsoft identity protection](https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection). + +### Future enhancements: Privileged identity management + +Future updates may include tighter controls for sensitive roles, such as: + +- Just-in-time role elevation +- Time-based access expiry +- Access approvals before assignment + +These enhancements will support higher-risk functions and roles across agencies. + +## Security practices in integrated services + +- **GCC2** applies role-based access controls and conducts regular access reviews. +- **SEED** requires devices to be registered before granting access. +- Credentials used for TechPass sign-in follow security policies aligned with public sector infrastructure. + +--- + +This guide is part of the broader **account and access lifecycle**. To learn what happens when an account is deactivated or removed, see [Account lifecycle after leaving your organisation](account-lifecycle.md). From 7cbdbdee58bad9aa772159981542d1da92b246f1 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Thu, 5 Jun 2025 04:17:15 +0800 Subject: [PATCH 09/19] Add files via upload --- docs/assets/images/acc-lifecyle.png | Bin 0 -> 67479 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 docs/assets/images/acc-lifecyle.png diff --git a/docs/assets/images/acc-lifecyle.png b/docs/assets/images/acc-lifecyle.png new file mode 100644 index 0000000000000000000000000000000000000000..4db5d7ce875a2f31bf2e276014780beba06820a1 GIT binary patch literal 67479 zcmce;1zeQt);^5A4L}qDQ3it$Bm`*&FbIbb=?0}6>7jKSlrTz4BSUw07=(0p=^&xx z(9M61y3dZY_c`zP{lE9)ca9sF;hE>T?-kd&*0pZ$dv_&>k5L~ZA|fJ2-4T^1B02)! z@7MWdKm6uXQO!a4&(Vi>)NF}}j-Mj@e_zM2`!*5L1tOH_O+|F%%&?0l`3i0i|CxFJ zb4N018N~~CS#r_W*f;#{>W<_#Ntr&|STV-W8r$clH<6cP6YCVBBr~`=6-<>GrDSfN zUViO(sQi&;`REP5@^>xs+nd|rqwbE5;tw7B)zCt;F(Q5a!(pxN!ZABdGZFo2sKanS z@byR?Wn+Kn$M-~UxxFOz{rJ91z8d@Ux28-uxu4$_kmIlX`1X;y51RbPw>MbDkc7vE zuh@`Fh@Tg`Cq;%KJUVAVl1^6=a3D&HJ+T>im^7=rhdV-X4WNCOpGiR#wg8dz)I~ z;?L94^ag{N6yoCIHdklU@UN?@MNt9N+@|_&DvF9hbf{M3(u?8}$9ZilD=Sn0Qb=gJ zD1A1In|D(M;#+2?M1&3M{YLrjPk%Qp*W&w{bDtqB@}sT#`g*c=#*-~k^r%#otdXp$UDMr1 ze&=|FH@*bY2-sbt_Pgy#B7|OuUA1{7CcN6G*WTXlu{}nsgZ}(%tPbNlj+MY5kmv=* z7}radEiob<3!mP>MM{e|daHKr;fMLktvMAPx8RpAPtwwgI4yqBD6*{2-Ts!A_59g0 z?{CDrGS1GWD`xFp62ZZZxsl=F&hr&(k^x`F#xD0L%gJ4ATyz|D>`5QT-?HPDR(N38N9+{BwtjbNvfOrA>Z(g<{+~FU~8K?*C4T}zd z!885XgQm@u>6#Q@k?n;iERD7kO=MNdcDU-JY9UqYxZ~FI&xy}9#UvDJhKzgcF2&$7 z;nF_zmnHmz=$I~Chz-CepK1}_n#qIvGwBo`%3m75QcRjx;%m?0BGr6Vy7G)<@%Aoq z-E+fbX61cgA3oIK(ur?wdrAgy8Mnm_^1O1A;VMkSbAnaG%6_+eOT)hG2bZF!2MWyA z=7t6BrY=~vyymzaGA=8!qd2s^R<&ob%Th2t;W#@|p~14zsIz;i<){*_ol?hDZm2s+ zmUbGgh`J_*7)VvRx)gEOMTDr9L3(Hrzw zURnw_Hdh%lfN*dl=Et(s2VYg$-r1qoxODllf!Z#Fm>QY!-avh|O6Qf-0UNat$GIV< zxy`}RU53WodVL>X-#|JhW@gEd@r8wlsDQ&Ks4g_xpirm}&xx?x^jSLEk*JNLrE1Rbf!N<4TQE<2SS<(xf1Y6tuVQY6OSk>ur zOO(=-X?BLw)$*ETT@>AGu5fTzH@)T%$I5M2z9igHnf)|_d#FjZ7uj%`BPFRuIXZ`> zQC4^(zIbEd1L>&S+Az*D0*r?Z0v(caL4*+BeY&;UM}rIA#4J(dnd zOwC0F(GnaX#%;A<+>g3BT1aE7W)4=oK8W#dq_Otd0wc99QN1#_%ZKdW_igUW<0FWZ zlgMys27}KvzLYhXL-dS{jk%iY>fu2_U#6$822_F_x-K>IQa9GLULiiu*Vfo5HPoFf zhjkork{GgIo@#fP9q=B%{rm)MmdE&5yN>(DxHn^TvQAYc+WGEX|COuqI5}IeX;TAS zyHqF}F|Dv>xdYyIiGza!{I%CTCzr+XYlj$8SVUyBoYS;5H`)6~#L@n~t)_`O9y=?a z-aX;x=clNm%p%xzV<`LlVA1@-=MUrK;}eZnnVJ0&Le7g{>P=J7!SF?cL|^0OU26!w zO5vDN(Fd_oDInex;rwyp7Vmo*rk?HmSKhtZ&EBq8Zw^7sUr~ppA#V;o0 z(*XgT7L6gSB<2r~l)7##rmLAOM_oxtxo+4RZM(5(pyDVc6Bu1-&_Et)KOMx>DX)-Z z)t}ql-F$zLaG{njLaM{`^v`(9Lez83?#M*F3aPzDl-k{sp`oCVBpb##JbwKKakP*o zdMFq^aiWQ9xUeaNRd>C_{TB|qeK$nTpT*pb5#DNh16fzzM_sLO#upq=AiJ5ypeLPw zIm(IOF8K}50mz170SIskQ zo{Z^z`Ppc)ElMzyhL&jC!~ccEsIysWBct<9C7uSKqHFhRV=NK`{=i~uZr>s`?aqAgt?O*2rB!U<9Vsb6Yg}&Q=!!pc zN{Vx&P@;_Oj&*N5NMt}mJ%!8Aoq`=8>7nt_GO%jbA zIEhg{06$h^CEF+44iTwbL}bj}LVja=hVIJok|-d)A83qD;mB_W~1HG7o(8BeWthK3RU5-)`Sq zB`=AzvXhunsf!4E7MvU)CN`F8tSPMZV_EMT1@O^_;YUC$ajkET6J^TN;EfF@cAFy{ z!`bWW`8Q^ZA}|OcEb`N!6|cwE?8JQ4p2_?Oa@J{ks{Q&^W!Ie+!M*kMv0yc|BU+U@ zDW=w;==|7E0aN7Dm%_Ea_7I=THFv14+6}HWYL&yUeg2RX%Bmq`HL@iYn%U4Sl+Z3b z@#OQ{$NP;O>*7(Jlg%!p6I$?C_Je3H_W2=5Q)`6lFL$!)*q>dN#GVJWk`&tPm zr#^7}zW#kLB(yjywx@NzitOa`itPPr(@Qf$vBK{%#Di#V6{&JwSzDU)$Tn`D6xl5v z#%cRua|cJ#$Q@rubd!|ki?pf_Y1HrZT8Lcs)wQP540DvEC#6~WzSyak5pFndMnU^; zx|RCfsq^%xf%1*fh6Cjl73a8&RkKF40_bXL>~mXgimK%qy5$+Z^P}eW_MPr3wLd2- z+j{i$Nad3QiQuvGf-Z48HCnj#p&^CcswF%=m=0C4F_Wj)RJH<9{)JCzEADHY@7_w* zGPqOKo}2ZP!^9Ch#Jgj(^Hx19#qK+YO(oJMo?N_^9ZiSQD%%YeTOaS+oo&bVUT=Mo z>qLo9)-$QY`ck-!q^mu=fB(KGi8UG7nzPH+^4xG$cDCryR=<%M9qQO|Gb&5@>9G*;l`BxIaT6LhNfVa4eOtD+lZ$GUYa1uufJmORnAtprJD zIL5^?ay2&B$noCBdxGizSbD%Skk8Vr#}dJwQi`WZ9DFw;h4RPRYkXC>tPr^Qd8=#H z;u4MvOH009#g5J4D>&_0Ea$9CvoCBj^%1Rs7$erXj4!*>g)y(ha`;YE&I%?hdiwux zK4))<;3MY!xn*L$AxDpT^Qd$u$_$QFY)wwaQ1TX8iR4=j_XzUc-)!BSpSjbxi(|tl zJB4u?gk)LK6j<)yeCO#vP4ke>(E9p{a&liMW3pBj7N`Urw((<>H6lnIXOmw& zJ?j?7b%q`Cx7Wv36J?$NM3^t%rAK7&P~)dW_BPnr*|YX`=O=^rLiV;s`FFNR6tU0bME~@8E9Pw@M$kcj@!DMYXH2{YH{P`6(1H!&5esV^B!=!w((Sq?H#0kf2 zvt-lu7WSD@8pX=*K3=qA<7R)CT>=w*R$w_yz+ zA`Mc)&dW_->aQC$Zw^{u8Z2F!47G>Y5Z!!JsisKvupJfpF}Z>d_X`{)$A2?nJ4y`2 znPB0yp+3N~YFU%u=K*xhF?)|!v}irHTjS$JBG|(?^mcXjHlMG5bKKiKfQ^gO(-S12 z<}&Zi{GgE3VgmLj6H(~4B|K6zKPKonv0E7s3>zUQx3)4jyjM2QS^Zu`+iA(lW9tex zH!Dvel$cQ=ENXJ9s+=Yr%de^QdNcP5bZdAUC^C5U^SDj5k()7zX2Yd^PMa?yT$rz2 zTbL~}B0m#MeImzW{mDCA35`JYu%nK&fq3IoJ3E(2hxB$-$m-hG{5%w39_VfSMUBE4 zWyDg$RVy~tg$Jgl;q6o+=!J*VyIKX`wiu()oD8+bT(x@}t$Vf$_unjPLO92gVH~DT zQl2?uu~hzK?}Yc0Bgdz^@LLdy${anW>KS7SsaS{0M7k2B*1S*e=@jxoP?M8u#|ZHx z8&+ef1EXux4e*ImJ+tq~E{jKqKvu1)SnfE8UyHCxOib9(+TN*W)Y<+jD|GoXR>0By z{xSh^gVeRGYPq+Z`d~||ZDtFU z+~4y8qBNajK`2erL>!R*LJ4ov=QFb(zf#Ykd=feQ)GkG;UP(LFlBt*2fi`}gl>kVbDUwf0u76xsOF=}Vb~{+9A;cX!ui^*n&pf|837>~F+tv03GdhFEdG z;63@4sI6!WW`3l?$z^Q<3RtJb6TXuGuVe%0#$Sl|9e8&0$@2osVezMz;o|}sWcI)S zXx-Oefp5%?dT1gOr9$W4y=!(^o`R}GN_clYre|lXN27DZ_4-O)Yme)4`(knNU0@k@ z8aBNp()`qsrB*tXo}Qk+bSjYycZBm03%hUQMt4``?%)3e>9JXY5M3*lT0|~gnmZ#k zS5-9)du=L>Oy&4$(xgsd<#YD>gj7JjyIW#$TI?tJrHPAhS4HUKO_3#U2L~rTb|=Tj z8>^t$5|(c%Zto*llrD9zYW>rrfd>v8NV*%fgs;0gUsYum$k6=!gi~sA^74qw-a_p; zrUvTGRX0tRUR8~8Mps`zHxncd#HJNkp0`k~Zj>w*C#_HS+ z3&|pWBIYW`3584dEWixyJC<`@)?V%I92s$QylQ8& zbSN+Ghd|;md#Py;lY!S#x4xJBLWmHBC@`5CMcoq@1Xr)i$ zr(Rt)+J9ggXaX>k zh)$LJf$1gP{32a^i&8`_w{k#?hwznTcgcpmt=NDlElt2EP~FxJF!O)b0GP?GG|Zj6 z;y*xiT5knhGAL)DV(WH8q`9qQEJwoNd7|J^!6gFhbOfmD>ddisrz77ayI8Zb`SJ%? z#7Z|>j8`$QU|HYKEq8<(ncAQpS97)6X)Y8gaX#KT`O{+9Qq{Da{yJ7GG922-B6Y6uh zY}}lPGe@Gp4DP^Z6k2Q{kx1cPv;q7;Dq7j zaet0pQhlJ&mr0$IF;=|hALS9i06rW);sn073-Pd7MYp{QqL$QM_Y~VnOMqsDR^+hivs_W^;DY?i@&hg2?70&3YW!SoaLSCjuzU2B-s;> zR81B#&tK`#j!;R?H{lc8ZH zBG+yAO6@gboK5v1;MS13YS5l#V65uOH(6Mn^&B!=z2_@YV;yQkm;UAB&6_KyPo4Ua zdDtu|F{Z8^UAss#8jSjURc)sTtZcELIva+%fdrylHtYTsbgbYT9nve+(S_W#mj7h?t zB6Or^O6SQ%o{Mklat+dYvs#DpO+3LzZQ`!tjSJ*pMJ_l&lra z8GVhE6qBK`b_FX|9h;`?Hk$na+tyY_$+}rSQG?}S6!KGR+?27Nx+fPU;7;pN&Iw-E z+A4c?uR-Gzcmygy-yJnN*y2Y$ujy-|sYj2?u-FX)51~Xepue z{FZq$!?Ek|>lIbEi7+`yS1WLLq3`ZK^t-#;J2SDcn6$;d;j3!JeZ0mxJ8wVTQ?T)j zF{%||iZ^yxJqi$bJZ@IK?ty^)ca$&0#JvB6Aa!b0qsLp6Jj8Cp%^XA+z?J2Ry z3YWpwj{~0Xg15=8FR6T{AQatVj`(D-MtB?^j~gH22r2Hvhs%tU@x}ZP-hW9>-imgy z)U>lZ65+C(oxQ48yDfHp^Yxx`{q9bkkdTnYE_?nWKDn8=Kh?JRg#?C1P@~HI3Gb*h zF>wX3Av%g7BI}<%ym{jo5tAJlInMQY& zdpOPtu%P6fH(POr@J|388Ae&eFUC;v&Ycs)7S=O;YD>=m$nMNudhd6H6d`QXQYLBA z9yhMDyXeEI9z?Yq?eZR4BbP{aO&=mtrJbqsLYjHSARIfdINMD$9hwL|sywp)2njjb z*%=xQr+in8t;EKn%!K{S(&=C?KYSSLl&w+>$v5d#u8xfou;66b|?o`Xf0Y`zF>fUpt_iOLEJh;3cU8d3g-Wv?-Gy7q z-6e1lK8UgQ@^agY7vJ>67%nZg2(9+Ta+~$g3OOeNu&ARgDzc&_J2xoj^cD~nWTQGW^-g0*M)3TE z`9Qwj#$pyTEhg3CV-H)ZVJ#N-qUG&d=LuR(G2TN54Vt&hPHqw-2iJ ziU6!w5F~UQfSU{M*67`BQrOZU9bE3+Uz@goqYNr4YRxyX6{A>!2nQ_`piN{iBV=Uv zO0+A=PMvaw550YGD#oplfth);Voi8;c{#t>_!GE1bWMEL!kv)eF&^6dZCM=n=S8x?svwoHmEH$7z^d$wpJQeXS7uHCl%sXkRHWyx zoUD2~@%1Z{ZW~mL9s~I%WmY=wfc~4pj+d902c=1+Wn?U#t`r0I$M#6s;ervlbN7|} zBuHt6GkE@#epfrC{iC#l*tz$B*0}A-;Ncs-;c!$5o; zpNKxi3lYv7(hde=b>~iUmQ_@B^$2cl*L~B(N>h_D=aifukQ_i?EUm6)>Qp_hs`A*` zB!##V_*EpPj8gdbeM_oNZXEgfY;luE6bv0Gh78`c)$g#MYe%pM7 zB(~`2Xvg6*iba-MMF@Ezf5(f#pG)0Sp>%{upR>s7VP^0x5}Qd_om5wurB}Vn9(=6Ly_ab^E@*`lp0eLIHQCPHVVSXzJ_Nui)5&gLQRvyc{`2r-TNP z%$>r9c_nAod?X4;OH)M<6|)br2QaUPSC?{I2(Bz?55ya*lhY*Z%RENJvdC$?0rHj5 z&a#IF%TUf`mz~X~oh{6$!+3u`V^3CVQ-i<-wkWl3`7q)VJ><8S1lUjO-p6ovuYBy1 zy6WtQ3~?Z$jXykRDTp~=paz&gN)T~o{O#jkSEjFf>~5@5_GBj&%ORP4R^yE((+%WS zXB&$)gzY~ncPY!Os^&T^wLlxs+gQW<=5e6?HcheyvK}OV_Xc?{338KO&EK>D-9z{v z=}J|}w>HSqmPpZ1@dr)fC!xhxF?6#Xco7;*cxyrg@7~}<(HKAsX4|F-F!U<}N3`bT znKzh!aHT`+2&JoGVOvH`XjnXrZSq)4sSH1f;Y)q#kD6VPw`j`K*>Km?m|8LCz{u1vFSRXBFW4N zzf=Fr_ewTW%Lw}if4Em-yfOC$gwkzfD!Chp7SY2q z@KkKo*g05J8eg>HIehYQLLyNwF#AL(>3}`nhfk))$t6tLPVIk`2Gq49Fv+3t9IDmW z0WS$HRUlfsQnd~clFV(SIx+ls62tueiZzE8!UkF=jMFRxfeotyfZDo_S2&Y`X*=`{6bV$h{^s&m#=Dvh8)cP-tq6t0 z;@x814mzP)EVuc3cR8Voz(Mg=`y&6gr;ny^`*aD5&hB_Px7qo=34cyN+nX)rKUyKZ z-NW+Obk!VOr|jO>#b~V@-2&m!C)bTQJxUYL3n&JK)J6;!_UBFZ1Uv`}R6sh;AytZa z?`foOS1Ffm`|0Evk%rPb(g-MW*(M_PE>_r#H=Ma@`f(xc6#>@N{A?*TOG-iaCxA0b zSLBxpc1&njy7t2@bpoqN&)r=hB&av7yi<83 zOhk)=&M+~d`Ezq-V#o}2;@v2IBNAKTdl`k6!vglHgY%1a!Y=SfHA<|3;R1R+>CjA) zZl-eQM#E-G@o^%$-&hP5mXsb#rY=2UN_DPOtoQ9>s=Gwzf32^+%N4uSR!9_kn;VJf zo)kO$<}uq7>e}a)?c5J9JU>n3d7m@qH1QNNpOt9pB>u|sv;UP>?-64pO6Cd%-!#TP z&v~O^M||Gv^TD?lUrW!39uOe4I8G#>_+jifwavZT|4mn8ibgirXAP5R9p-*PJRE2C z>Bb30B9eFdx{TCqPR1HUZEvU%n8bvH|FR<0*fz?4Ua$X~S7EKkOM5Ln|8X%13j%#n z!q*KMRzC?am*{{1d3E(v7PWk1Ic4RL)x5g^4p+V@jT`Rm?x>`zUTm~cQ|tfu>hk4F zmz`{}^kmh#+6E6Tm)K6K7ns_A?Vxu_b<_w>7x{7J*wY1E2pMVVAiA$By*er( zRDQMnc}8X;jmBJTYPq5%{1yZGKsz+#mfwH(YjJTg000nQ^eJ5RT}k5@)uiWj+gvt5 z1%QUeN_NFEEnwxykL%jSt=3}KMm;=k+;|JxmFiQz=;d0!b1thh{bi2x%@Mpc0lt*% z;t~?AQG!Lq#p^>Qwz!}sP%aUq9Uz?`CI7B^X4LZXg-_uW~%jmhUbfb zKwIHb)c15{(?E^w%9T5^vLbd<_r%1Wsp?jifW#-lYQXt4NQWYLty)@Ji@YQn8yg*G z2cUCp;GR1Pk66>#U+!dk^XB84)O52;2zDOpxgq}P%@|>~P0)TcQ26@#f_!S_GFQRm;WBz-f`aT?h1Tfk=%B43z{YkrK64^M>du{Oqxm&v z(z3Fo$BuDQ`vG$R;wDhf3=Iu|Za_>_)NXd502RmppzSn-c0RaKGZr#$=(^JXPw$R#ZYik3Ym=`xWC8bn=qP)EBj;Jqlcb1M$%BlPQ zjeXM;S_h8k^6h*03&Ux__D3zZ2lqcB>0Ur{LD-(KA;ZiKm2~#@@`B(1iC|@C$GmuP zUc|i|{pB@>9(;t@kO_X=nhXOvkH|=*^RjWy0xUWRxRiC@fhNtpE%qjb#%Ph1&W#&4 z)YQU?QzF+*a&~bzUA%;tSj`v^ix1u(wC;4Zo$!cAOHTIk^16dUy)x+6=OjMMDO!zX z2!y`$-P4SB$w@WJ94w%REh=;3@NHGq*TupnAZEj0WVN-U#Rm|_~ zV=R{d9R3xh{Y@zqQJ-!8E(WEI$*F}LIYD*Jb^YNInv0iL1^8pBQ70#-06N$k9z~DF{^z_hKbNBZ4 z)^!5p5gB=nxa^7L=ddj|Y%a4!%-G&eV|tgH-Ic~qUkBqk-fxVT)!lsn9Z z)1d@GmFJ2K4-HiT;uxp`pxBGG${ZRfXPb9GCnMyty1ce#)tT4~ijSIGzAI}W5Ce^! zRn^YwuZNC5C!wLHrDYFMVSu_ymh{94MN0~DaxXO3<;x#BJFnwC8k?HPQ^ui6i$^BN z#t2(gZX^;`|3gQDR5P#o2D)q8n?ea>fGVj6Uyt3BFPfs}JNe=0qubZQ`n(U@AqFUj z?2-%Xu(>Q4&@x($R!SnBXZko$0e7R3Omk-jT3m!GrUukOpxRMQK!d~v8$idTbHDZD$CLQvk0{wl zz6U$xPu|74e$WaT-vSj9=+AnSz3q{v?ZWWndz;f)HKSz?v%t%-rdEI6-*t`0&NuV% z0ggx_zJr0@QN}kW-&pLs;R#tNb*EDrHxITeLTERC^S;ul&w19bwjC=0766?Rkm)&2 z_sAd@+hKXWCWHpXSb{Brdkz*`kAXDkiU@^OW^C*ykm5)ZSCp4m7kz5()lpTwg6epD z;D~5XKWLwrYhY>WYHR(^@!ox!jX^GYEp|#DJ$m%O5t8lkP@QVu;d~PXC#RA-thaC9 z7LzV9Y^Da;Alb3B?rH%Y;Kch4>JVhGsyb8!XJIs@jVa^KBZeD`n_mN)p=v zlkJ7SfBEv|r%#_CKA1u~P3ab^^+Z#cL1T#b=O4NDUX-Z`QvED=fdHhoD514)-D!@) z_9_rH1`aedHezT++}9UALnbmwpMFpn4U`0|;oD60^_yGS4 z3KSZCwt|YfVGsT3d3bWNQ>Qu#%z8nH_9zhb{Z4NHxVJAS?A(`+uj(+gj`m`y6VE8M z`^ug2(##&K%h1IG9|}E-EuiQ5!hR@{`8588vP}73y*#|fz{AsX|JoJCK+bF7S+n>z;o7_9~c^y`BZD6*|;NFM6HrCR^B-Ic1e>y46 z;1IVj%Cqng5l!l6yz!3(OZ{hfD~dek_P_Hg0XS#6%sNbQCO@;;d2VA#VcWO64 z8M|U0ZVH*7%huy1@fmUI^l5sO^Ug|dFugd|8o=K`D_|6<5EePhyMW;Uf#Bv39jBD7wJX7|)6-d&I+K~704Bga|!{pPEJm0 z91QPazo~{n`=HNIboC_4r2%3!A1N=1jeYAXbm-6_AY?pAXrSAAZ?M!pF#6AUve|Sn zo%B1Ld}Kz3c`roAz(9}%du(>b1Ox`woLWNL!M%gua#5X-laqV!;KA0~e5k<&VDmM| zzr&>k?Z(oQk^u(%!os^BNJWASoW8@!%X7z$A3yyjnx%1Tbrv*4{4T5M8$Fb)>Rpv? zF5?p*Ee4Jen%%68HkOu_khm^gx>O4AFdh{M0M)yW>cn$7tT$7mO>39Y6tJDfPqjn|y1BV6 zEiE;VwL_MKe1IRT^Of*FdmTcSa&;8N=s^`6K(WBUK+y8DHZHDA_X5S2uJ76^vbP<3 z^9f6#JJjMH9v$&5|Q4?cN!l8o$u^;~LfAac*8?Lh_uehX6(g9TKxW3B)d9$Xef8Ql~n zofyKZk*Qf?^YP`yh80<{OHMF6FkLqYy(xqcGb&(FYvsj@6W{I1514O@fdcu;FKmsA zP!X;{z6W6kfz+QS`k0Hf#)*RNGY&OaWVHuTz_$vjScB_`?teC|ONeKciVO%=Hn!EJ zr8JeSXfIBvWZR9;3pwZ4>oc>n(<0Fi0b*5Orgd9x57l-?Z7@0bp$TOo6eO7nN&btC z^F1TzF+a=U((VimM~Fxb@1H(>3UG6Gv5`HF0U|eCM#UHKpTD0U4XrRRl@52p_LTUQE1WoRn^9O%u`5n*7MfZPF6 zzJJ4+N4dJSe|12n5`rAa_KQrrQvuR~$_Ub<{6HS8&#PCj;5URN5Qo|z9-^-qKplWF z4<9acr6_dcM&7#~uFXrxVMtf%}5gH`;HTrCs6NtL12*uRnzEw6(FR zW`9501L-F(FHcHJDr3I%NoZ^i&$POC*CIe)SOlPkcsv$>;vu0Gc0IyqKT>Kx4J=86 z;}W-VzPzC!1S)+So7`d?^Y`3yV+EA?Um$9qIL9N+Z;*SqQ<$>5pa%jX0A|3)M-XUe z8VMKA*2jN;Khf%C#G&2!LtGO6=bg6KtyNU2ziPuM72Hx;DFt-()X#u`i;N7PB(jqN zSs+sS2L_1rLz6%9_j=03$F~kOl>5{hPaF>SFDxqi6N?@_yjuh%JfL#ONRWEkx<8yQ z2-J~d#~s7 z=d0hk%|O`SQ1KrTsTn}VLep+Z*9dJujd-H}2uPy{c=y8xn3K|TFHJu5_wW6k!ybHu~`xyb^?{vicObGx8S8!iQmXs{23-6D!=Ua_xvs3}K ze}EL(29SwT8~p&h9RAFrBi{R$2hBRSbamq}m{w2|C8s~E@i`+bEDYUgQ;qXTbT%l# zKtZdr^b9`f@RN)D{2L%rg1dGHEg}Twz;MC<9T5>PjEcUU4V!c`YK>;Sdi5$0X&*mc zVPPRZ4(Jr<7~|cbKt@^ZG6$J$w?Bd2h66xB0`vi<4lb%S#KO)#T41K4tlZO`rjl`0 zL0K8v&L!4k;sz+7C)f45lI4KZ<+q)9VWR@%Dn#}4F#`7hYJ)^b3#X)<0jF1acod+Q zfu4ap9VYDN3=~>Wl4`mwz~TTpi~ihaKSx|`p*R|fb{a9dMg;>=XDBErXldssCyRid zQVRk686Wwcsd4cS_;V3}9n@_m*QlWE2ld_R{AgCXL^T!w`qWU#63h*XF20V47zEFT zm;nFsm~`j^Ur7;MV)r$G4h5r11vQI+(`tHq9r3uDBDbTku2$vv=k3OX`LR1T)7@!B zz#A8!?LNPM2GgL$_S4F6`_&5Ry=vOpbK~PHFt>L4#{}+ue~3_nFvbWZE9C1-jf;e# zLx{gVK0Yw{xW2VTpyBFX(27(7EqaLym^cEDsVZ#P^t!K46;EtOhM5>2FR&VQ$5ngd z_Wi(@4b4!h^MDXIJ-sPTSXO8yC@Tv{D>ujkC03)tIS=dnX#j-b(`uza+xPz2aaxxd z4z&=NJi>P=$hyHSm?=KF-8hoh3IIKO<+?7g`xco?5R!rH_}J3I@FN(!)%;g6A1khB z4qZ9|)bj`p3c3^UV_Ff&3Aj@#GH*~axZ-Olafyd20gEwz$W!p%d~ zM<7Ucw>JQxLn2P8!9vBdwz?_|6$ncsDCJl1crp*)m4k;40RrH*7~q29Ey{5uXC&nI zLgBN&W6Z)~Naq`KtSOYM?NsMrs>Y_d?K^t3Tb=^M&uclPTIIe2STReZDD%OG=kSY{ z2K+)o!_dfu!fe~0MzGp>4umyuO8^;}Na4Q=%gfT+qY$FGQ!5^PI1I{Rm_VK(INRN}m9}fCtbsLIQ+VFEod;qT%B0=LDYT$az5r>411}VxI^=;SDlR-YtN-oQ|Hp zrn)*(#6ueiWbqAtnu0}e3wZ?v12xOR!da-Yt+q}Dp_j|%D+B3FI^t2eEPx|{Q0a$A z1kUTfqXmIvZ^2VUHA}(bzugscjt0i3{F# zT?bRI?>tvB2~Ju)&sU!t`SRtpho9bp--#jJfW;~Ft>ET7IH)o1vM%Izi9!4oR^d7P*5aKv^M`c_n6+h1W>gI%%-?l zHDnx!;FYhPjMuJRLn6zeo`K0oUaJu?Qd{@;QM@2@ed^b61l;UIj8ls4k8jI|eY)z-`|9G^35JEevAz3T9+g{)21$z*R6A z`F(JckT(9|Gy=sxg@&NuV88SHoR==ef$^?dL7=q-l2qQ^A;n{F_o{Mw@;6C@)0bDE z=Tc?Q+8zKQs||QOESgq@b3v*`R=l8#$*)c|=)wPt$5RAwR2^$Q9Dj%EX%n_`-* z5m*IQTss_z055n~5n2k6`d~abBC9Yq_JWYm4uk>d@=mZ97j91Y1X0SQ>**`+=~C%TJEZ?g*HI=HcYKRKr72-nI9_2 z1G*Z31kBpAu$V(?z`cT>{z%JATt)qvyWzn|h{dYO$#DS30HNNK)}4=mL41S4Ltef^ zXl*F)<;yk*2hiSyl9qW8#7(Ne%mGWJ4!!}?YhhV3+fjd$lO^4vohHKa^Yj1O>l|b1 zVQ;>F?FALbB^H)+z)8^h0*5-wp(|=aw)T3SlvHcOdo=&YFNeUX5cPceL(K z2lNp&HHV-q1ponuWDvBEj&qu7Az3o%k<2FRG$i>KPfGKFBJ&M9cCeZ(n4at(L#6V9yO>%PT1Jk(4pijPens(n+8Kc zNx8MT3EZkoe8{oD`g}-Y8%vW(@$t*kz3dzuaxBmRPDx2=`0zp;%SWq#q61%`M>Tx> z*tb*$=?4I`FW(AuVw9qj<6lw}Z29n$2k(A8gqvSpwgX0RTyW)sCn-#ZsDOGOuIyU{ z=#&n1N~d1M%t zxA$)y#|r3<&$hk!Flbd(0YU`8leKkqzT=0Ve8ysg<$L;}6$B?2bh=sqbOBwU_nwBK zVIp8B=!iB4a(&;UrciwY1JDItafDE41BC{hyRnFFH-?DVjeZ=QPDO~OL;@1uQFt8| zAX*^ZSKuvhiG0@;hZKE(qi&j)fx3ynCqD!b4zUghK;U`k+1Xn=I~80nLc0)*B^=H) z2yHe{tAukzMm+Z1mI}O2DsQyY*#cLfbhiRN9J_w0d{rTm9AjGkR#N%I_s@=kD*MxF z)0kXfJsjHsp9eSuI!>T49?H<*wGLHBGB?_oo6kT%5Z&DPco_qW1%U}b9)%QG8Q@UR zf^@%se+v~ra-Q!3XAc|(5>|(O^XAPZ4$VA6znGX9FXQIZ^*^W_pT;L}=mbEv;LuQD zgs$=NscNz)g%Fyw%L$>{^6s1?6AF=_&HtMlR0{zr0(f>HUIvooE@Ru#(2dQ}yo?yG zaB(y?HU@emoY!i%N5e|34*PeFK5rMoAqEh0#Kpzo)*XPvp1>P}DMM@+D72WKpRY1* zzXZ!x_4kcFTi{Bd&nV9ffBZY)lPpw|qLT@R_^;hm`MvXz@~w{#iWwjWukNjbEX2^r zC^RG_RS59xHWZA6J|1+!Hx?l+&_vgm#e|-QU>$AB0Ax^?iK>W}$;oj%re+haDQ4 znxLqd>CGC2!)W60*Zz~x3(z0HC&+x}fZ$j3{wm}8qbw8Z7(1&+Rj)Xk|%osJH7jv)Pqpu9ier-7dBe(T`J@WMo&c4Eviqj)0~_fC{0m! z?~df?d8S>37l>k&f4t%1_3MPZck$xI$nTB08zKY<^r#ak8o07e>3622BIPsww;TN4 z5PWA5^fjH4X_3YS)Z!TB~_UyA)?^6&0qQDn!r_LeBZLKi`C3 zCQ4cwT2F-RD((kE0!Q3jU8CJMze2S3c1eO!U#O+GuHOF%(#mFxWOrDZCz2D}j=F?L zISTw+0{b)J)G-wf4Lnc=F!Peq2#}vYzddBz>Ky_6GVmRzJ>Ysn;~A&^InZMu$Y4=QuwCu|Zw2V}gN8+e=)^#}gWpaKaUk zE56?dSk~z=q<;|eFa)Apgn$q22igR9V=)VE=Xg$Z(t*FjE6{XR9w+FAU_!_ZxM|=p zAkhAhgWV%!WT-;Gu)+Gl@miXjEdXPRii*O&P?h9@*bAQxNf#sz`EWwVyCbwGNJw_! zz#MIl9eWRtJvdI}oL?;*u(D*KHkweV?wjFD4|8F^96vq{c_u4s9%QfLFQ~|9Xogdj z(x#@2$qdxHJb(p)?jrO<+}+)wgGt^P7!UyUUNj^JxL{pPjaE6j-4NEM00JU(GpJ8I zhfWkAHR$S?S-p>3IWFf?553NtH*bQz4T*Gx3NnB$3d-1!@t@kUy5F>8afQ*qr|dg$ z7%q<7Uibh=2&%X2jc@0Xt*>GZ3Hm8rk?AIJ4-UwHfZotd;swRj&{ zLs$bS6v)WP2uE>o0K#ndhvr8fkUftc5sjDk!ZA97uJ%gr1!?}IWg_&Kenyp4a?Hf! zq*MT1W~l)gdrLTX<2J`1_?J}x&!_-9I6})eLy;4qq>)k66THcyntfwCDmr@Z>(><5 zaaYiz0C}2fzcbky!@kQ#X!W67=|}ZBEg-J~H3K&XPb?)Zov&tOp!5Srj-tNfNYr+G z@Bjl#s>SZDE^Qk)ObGfaj$iU}bMxW2fEC!lA82wGn3CX`SA)1HlD|rF+xI?<4A)60 z0q7Dr6&P@Y^3nyTUk{$TbxV?gvpRdfg^UV<#p~H6#n{7S?{dZ5-%_fO5BSt-p*BL2 zeUo1mWRojPnwlkCc`j{n>Wb7!>`~M&2M?d}dU``Q{0M`sdznkss%z49Tav)0v$mYB zBUxJ*Xtd4Qj;`5{ztD{4|KOIjb^g|2?k~?DnCx){DmdlC0a5|+Q1z9DP!dj~LTIpr zK*2AwqXAA!;X4k!Ku00)YPkZ-DE~PDP}BxM2Vpz`PDJxUrTA54WXJ@>fBR+%bX-fM z)7r4(-i(n*V{^0Hmsb*;oSZ}cYF|^cv)iowY$81XYGMJ1vWVA?!2ffiuyTqUM`GF0q}fU~8MV9=8Ju0Oc(0S?9}ldqcZQ zSLB?Qq3{l%BUIZyU!b-QUQF(M8TZGTA$^-GaM0b<%nb5I&0~lyKps?6u5w@ct`!l# z?L*Fgb(*ekanA2`TbeBEFe!7gkH%l##fsc<5SiFlDAHYpY zI(3=c_tyd>os^h30;kV`j*c^;8LE;V;im)H1uD4!Gz0_$U@tg1ZJ=+X;SW`tMC8o85ZF6;o zd4z+HKynQxuSXQhrUmZ{P0lAQ;iEU}PEJ8v+H3qzPndor{&0!QElR2_gkmEOBon&m&op2eYF%z?0j}1 z(fu1i5)W8@+?o&3@-^_yUw_@d+p%xz*Ff)3)f=M^EcU&9v|WyD_&utSQQJvbTjSw4 zHlRX*O?VEJI!Nn5+%oCMJ94thO!hA~v*85RM?~c*e~w1T*$!xdT!Th9J8fX_31MX) zN?{3;3za0W5|Hn~0{laL2`}83k0ZR`N_b#?{;){JzdM zqtn8kFK-f;JWzdlSm06=(O(|{XvWUL+c(yJTbCOW@u&Y3eol_dQ60bdgxcmq_AkVC zqJMdcKQ8J2!#{-u_><|hk$pXQgECUOyn6p8iP>?Y!(S!|Pxbxl9>G<=f4yb(0ShO( zCg58W0B(eY7T6$&R^8kxat$Cffa;7|NIFJX2o&W@v%?80A|uIZX=WxSUxzsefA2;@ zxaNI3Xg-h<6VJ}fkjnymItNS-xipLzFroq+oVxTmXF-gS*PLohCx zw~x8~G4}b;HI`ckXi^ds^z_CoiiSZj#u5!`X@Z2LJx&bwRdBxiI(p%L*)Uu5fO#Qk zi=gAer!C3U5DNSbKj^|OEHXM*0WzzxgaCNrN91F%W6({EaomiUJEReyP0b)W3 zJkMkP8vPZN7ZKNu{L!vZNQ3eVf*j04nt)v82+8@AgE9=Apy~$f1f!G$m=3JY)j=>q z5P8SEdevU#u}3)Y&s@Y|rVnJvG7Jh3u3TNWjbhvqE3}v}+R*g?7X$=}2Us1M_{qT> zTD8!oYY^6P#fyQcAGWntbch5EumtW3^kIg1{8z80!H$A#8-gHVaztHy0JyYr5|Xyi zh5j%93Nn8T4^ww8M=8Ua+kaD3Bg}X|0q&(C_dLk(6%;NvE&^!LaT-6P7BcIw1z3*9 zyzj!uBHS1;jX-`ufs*2xv9U4e^)b)sQ&Ul088PDw>*(kRkBBf(8!56HrEwf;@9s9p z>j!0CZ-xfrrW!P@fqQ|pHQVeY-ds=U^3QH?(}u|RB~Ah1;g>9GLPtsn{_AiXJwbdcV`XcPs3NL6VnO+Y}( zqAiMwfPjEB>7ews=)J8w7HFc;>~qe2?sJ~&AN$Ex%D3h>=Uc`*#+d4^(5#@k7^PW; z0uv;hu8ZERVEJL(IwnEamkKl<6*hu2Wx9Zf8K`TIIWzt!#wlcu_M-A(mP}UWWL>Je zzIqKR-o3HzJlP{Rs)8DfY3ejk9b>NJ?kO!T?Zd2*aqSb*1BFN?n-~)V@)xq3Vbf_b z3}irqalnwV#Y;=a7`4B8u2bd=pYz3wHJCBQQ68SdSFR*nF^(6Fl8_KFHukLd+f~k+ z!lX5|S3A2A)~;HESf#V)%7v4rJ87Q$?scR}ve|_~qTj|Mbri0cDB`>$z@Ut@U?N>AsC%WK@)CbH+g+UkevyRa6?Vmm$_L?gL=3+o4M=JAs# zHm%^#?ch*sw%Tjh1>kc6$WfC488mrlb6&nYHtOv3k>-`2@7I|JDPW-x8VfK{+An2)OVw}v0V&UETXpa2u=f2?6BooH-*SWVNjitxqeqV@G_~$`yNbs2q3bX*ic6Nk zr@?DAFfh>5i%w3$&U^7<1Za_ zkt-jMCZPFFPfK%WLv4H~8W0#4CujDxPdDnLQOQL_yfH8FO4(+X3DCDdTflZGxWi7J zwRiRlHj z8;n|{H85mv-ncO~K8|1&{OA!KJ$=xlN3njV7>o!kz6OBEfcyYvK+vGfa(G$r!LO*e zz|b<(X-raU-8P(s-+nED&;4U+L>-8GXuOG8S!k94KQkxTfUb~hwA{mBW1PJ_3NBas z@3n>sf)7E)KU^WaFBHiLV6*ued5?mvJ9jF}%ZFR(r#G=mJ;36wOB#0^&f$k(vof>n zDm^$-8KcjtF-vRJJ@gR2W4A{Nswy%dE<6(e&6_uGrW-fxEwzAP?Zk=K7y@zGSe_{- zU-`lXV5cZ~dHMNEld}Q62n}VNROg80J5IeGArACiu&i2FQySe(%Qa^28vKq{hXJn9 zjHgdepi}1fg!(6;OE#{S4#ibSNc?v0wZs+|@P(02A!+IZ=7tG=Y`y8Bhu}S~)#XoV z;7lmm&JZeKDelAUQDD*T3TDhlq@Je%f*{-!@v|$O@w9y?#nSbY!YD-~C=7@IAb;3c z$Q*{8qDb%UN%Hnq6aj=e3JGS(cC}fCa$&;6W*1GyuG~6js;|pW@LA!t=*rEw9LFP^4!3A0WpH_KK<)+% z1tUz9rM$enC?@7?>_G@WBj5E2p*w% z<*zfwV_%@4Z+kJ6?Fjgr0VoaeBfisNv9@j7wrdxK!&f(^|2;;KWL}-9(j*~sw_lknoy@H zA8KP`6A&1v1+t=vYfzaDkadKqv^2gV5)>fF1tkSOUX4vn5M}#^W!lzORe_4O$K|7D z4F@3d#USa@S&iJNgU4AD)-=H^AG2KV^*>KEgH(ZvvbLrsB8UE8i_z5Tn5d|34E4!$ zZkCo1#?jJh%z1)p6n517X}ZK}eKu}xeEbQBolvO6rcr3rChv?LxOeMoaH07kAQ05|A>6dqufO`qf5Rzw|CBbrY2_7JR}(!f{zf{# z-QNF%8onzR{!j1%EYzy&YTN$;6w(ji*#F-JM-2O}Bq`&B`9&jKU?Luyn5dLSQG`8z zE*0K`c{5aFj=4F+iT)ybYinyRF0LG*bua((@5evj{QnyiW8K#k-#;;|-ZNYwr~%A~ zq%?|({)mW(Ge{j6({Gh&Ln{Tix`|{nT5~mp0qj=PMx%0PWplH^U4$aZ$jB%p4M(|5 zI|mv<6e1Rq@_ z3jt>4PGF|6FWANd^D!ODtsLH92k?SG1hpB8C}{sXp^(xh7GF_)ap^cpE&T0`n>Q(< zF5P*AIMhYp_RLKWQ%VbW5^7m`QKyXJD`zDo?|OTa2U99i(>b~-(IGdZKEZ%7*SzC) z_4Z~j2$w13nT8&eq(A@s^RvXnx(9cfR)gLn3N0Krceybic*1zO@YZK#XYYrGN9NqQ zphLRuX0IvW-h{m$p#Eb_FR-Gh?@E#vP*K33N;aSiLp7|IN&rTQvn3pfZT1QRaVxT}DnwvRG$8w$LhcY_65)!zB$^wFevoSEN ztU!1x@}$>GZ>mkhN5VV7g+02fylM(rVslXKXwQRu0hz~Y(%lRy<-zWmt~n4>Z{NP{ zp8l3HAF~cSP08xLP0RhB=q1q1FfK%qX*bsw4Ppdnp3qWb*FRT`v*@S_~Dbo%t0)@2nR1-LjWEFTswP_wMKyr5N z*fH51WR}H{S6EMjD>=a99yOW68sRz}CC9x9YZO@`{UqWQjh1i6u~AU)uh6C}@XVT( zTJ_g-7}8Dj0_>r}?67pqC^08Zzw#*<%xwIO1Z7SX8bNdEZy3&@P*yX`iJahDDTm7Y zLZ6@s^kG&|Qlh1yX?2+=m6U7Gqp+tu7%YIXuAJN#tRoMm!Sw)_biByPS;SsL^RI`^ zKXpodJ!h!k;*siq4u1L>C|8!el=&x~PRW-4KZGB?M~xf%Qn6{lI|t$|Axvl@p%g&h zP0P=?1H=+c>E~;ewC*y1#%jzL^o$*jE*>{@FjK~c@lTF2B2=2D2bFbG1orcu;cVH*9O8ozhT_SsT!*4tl@trGyX*|rkwlb zKN+WGmphP?z}itdYozlZIfCVKZ{xvD0dA=5s&AHK&=nd6_raEYD%-(&Sp|jtE(FR) zS-)oFl($~b>`Rx4a3<%4(IOEcN*nf`cI8Lr+vd%;fOktYO-xJ-WbOli=BFzF#{_JQ zzT-V;RI$Gjnh>*FoyMg}(|`pi5o$GBZrFWHTv`>{J31)LRFBKdiU2o-GEg45*W>%- zw=V?c=j;6Zrlux;F2JJ{T?F(mI`*k(Ux5TSM1RRdsVOP)4a(>Sl$B?osI{`TW}`oC zKLJDz-;)p@uaG7bAYsDS1TiuSxnS=6W`N;HOCakT8%s$`wF~*8haFs^kObfm_AT?TN+N~UukLifja;YqzGY*l>~*snZtfZ zH;7rlkt=Wi1p0d5ru{^vM8R9+0VeRjXleEMf;j0xZnPal z7l5Bg^e~SC6&52>6arCEQSAF=i&W#0tZ{D_2)CedA!ukhPbzr+;vo8)N{0F53R3o;@fg4V)##rpN@aq-XTfG(iZ2qM6F)dssSGD56qWNM1$ z8rmP*W^=a;#fv5@Ju7&&K~gL{uYaBp{pt;$vfp0#O}7eqHnP-yMi7wB_(VAEr<7&{ zVMBr{u$|8?e6Y&FT%z{l9bPt&qJDqnYOC14ZAlK3JSuehKA5zIdN!F zKEq(11AMiZ4qZ9Je{%iKjsF^hj#RPj->(buZo4_^2N*Do$zeKXM43fH%Lkq^7c=t} zXbr&E-$DOF#>E=|Wf6W_x+Bq$7V-W2GYe2;>}Zv}92nl4MYUA)v#ha3~OaRT;Uyhvw}% z0DGVo2YmpL1Qf$v%8c+@{B|;sV5O|2#E*&$Lok$H)Vq)V26#CoWgL-MJ@`;6)InR`G$xHM6 z44KtLCuyA<=hfGz0jPQRPKt^8*JFvm70#bOzclLYO5wt_GD6lVew>00Ol-!JfKO&; z=G|@v`JlSGRUbbHGR}|;wj#GO0fA!_b+W?%u8q9dmIp%+bttH>e>al8zszPhrG{o4 zP$T}}oI^0F&cmYnc`k%xVXZp435CqDQ380nkFW@OmmrvXiqHw?!P$I#ov*!aq7XZP=? zge&F9Q|TIUgr0pH!V$GGY`)g~`&T3E=IN}8zvqgdzvBsh3EZj92YLuz{`+$-Q)7=E zSYC7&Fjav~tX=g{QGA6^u+X-GMC^A7VqCTAz(1=QY-G%OzCZ7Pd$^DO4TSt~s{T*> z;@foe{~gPMGF|$XlCbh3|7NqSbjg&@vWl0|V6Ix#ycJ*-hHGP~&z~DZZ-x0zNdRQ} zf&Tsm6TiXGYGJ{tB7OS0m&T+NCayTTJfIg{Pu#TvprrqSfdJ(3fbZO+@h&(2{PTqk zQ4}gJvm}wCXtWt>?wg%re4i8-dT@n5QGj1N!n;gr!R4;+>+9{BOwtjUJ)%Jlh3T4d zs{VbuxpJZ5O^m|zrs*EhIB=MNAc=Yf%DFdo{WaMcNL>U02@E}O#m*OjAaT^Z{S6XO z?8U3Rl%h*WQ1H2;k)tC~-Yr4L$k5Qx*x0JM2S_aXHag2pbcz@xRX@OJ1#}9G3$zKU zIL&VgQQ0A00AY+CU9;*V(|5(;^1RN|SJKe1{~S*ab16i4mKYAY1QV|@X z_A!PDS_5g2MRLJ4EOdviyoL6XlAFF8;*?Bb>p`BPcjd|iuwoPm3SQ7hBvH&=q@vIZ zpdJEsU&@gv$4K#u&6#c`qDsQl|LFNwq zFZ8cWiHSQET%Iz5KjvYrkZ|Z&eX-u4(1LypE3r!mK*^l2R0O07s}azlfTf=f&?UCO zU-1u${bPDI>L7HySmPc03-I75W8H-wQn-WDnDC(J?(V*-5&%(^Z4rYls^z<-dSil$(;_sFJ!L_xQ@CsQ3X*p{3^c)i7@&<* z+a6~14RPyB^ucGLY}Q-1TENMGq8?^zIh>`S3ISA3QH?M0l&A<6*eB_O;ofK-ZXUhX z`F4w}oYSXUw0^DcuBK%4R)HUjy2jX;QrGlBN!VT@4d+F(n7W!82&mydh4FqI)=T{K z>73c_poEUPolW>Mm~C(yCZmR@ToNqZ({A(5>+jK#hJr$*mXoQ0Q`PEkd1)&oD*a%o zHxzb*h#(di1rU%RT*wTI5`D0h@W@;==OAs4TH-P*5p;P*D%>Kc!;~2P(Rw*Dg6a&SRGjWsjGGbP!ZtKzhJX z3VjvD00tsg>?b&RH4|+U>t1Enj!LdyweH&rloD^AI3JQkTLV=kbg(laPf_1vBZC~> zfyV_j=zoqa0zY#P1Y2>LCK2~7O@i(RGzq&ywCOtM zWn?hm{d+#tUOLlzP_%E=_q4o~K|9H}`2T<{5kX-~#Cm>aOBg;fJ?CjdY%%7eOmCab ztiZJa2=<{q!Adv1Da>iC7}Jo^@v{`r>>pGKd&;whq9_8Xroj0O)&Ud{e+9%#@FXU7 zE^pZ{(OCk&&W9N)dc}sZ_a~_VMD6JB?}vfF78)8pv}$-mm|j{VJiL?6Uiin*K*GfYtIlJgoLd|fIj zqe8^Z2ivxR8o&PKN`>m3&EZg2AF6qH6`&*OIz%VkIuTUjKT!@;cg61j#Xzd{|_Q7}^*R~RzzW@`0RQHxc z=Ql9Ya%#X1`wUY!)+=CqNVzkd5s(%Thyy&(9>Dz9fxjy6iKE;34%<=#xppoHs(Twg zVWf!GlQPv0&C!tH56R#x1&WQiwiu9WM3tJUS#Yf%1O!BNyqt+x^G{9{rS^G$^dXen zx0ZPmAUIT2J>5Qr9~-Y2XV(m78bK8!`70`>5ZsxV`0HjSB^~7DwT7*YVjSVgljAX0 zVHUE2Eu1Ia0l@+^W|Xp+=4qb;18C=U&QiXhGDAWm38O(^-n)T?r==+pw;e1;&V-Cm zw-cex6rtbHP|#`S#mfvv{9I_22{Bl;}tB*%=)Nlc1f%7yv;&ZgW0JPOy*zbDt}> zrGS-Tg&Y5U?eoO^Py^@#C=d!dzz`GzK}J|J-86)mtUi7D3l~5Vuo)zzuxEy;=%3HJ z;G&d`=$*{@548TSVfQ~r0)h3NIsy?YQ8*x3ys!oWbsc6VM=xd!Y0)-f6KgbaePkc}~f8!WzP zkoQ9f4=UC+A$_R@Sg|OSxB_j$UFMZllmUdK6*Y4sc?gf@a#j!^xP($YG&wqu3&r zYvd-=9p~L~#tB*p7+!n>Ts(Wm4qSE@9bK$?{sC^;8gASLSfrKXpb((@h2GJTwvE^V z!9wnp;;rVV5G_cJyp<=Ry#}^)XkF3RGov2UJawK{;Fq8Ilzf;AIbm%|6cS8XO;Z}y zQ8RLyE*m<6uaEhe$~_yeM93!SBufCK~rB>ayX?mkTv z?ziDKWlcDEDH0d{-6K0VuCP9?V352_1V<|a1HxoDuypld{=n!m^Qmp2oB#0DcR21l zVWR=^-B0kqQ;o0z;IKau!*xlY*tob5DqC21z|R2QCHF9hfj5YDxVU{yl9kZsQHKfZ zXBkXL$bh#H9;n48L6H&UC@bMV9(+XK&C7!8-1{jYnQ^)@C#A`6f}_HKGNVFkg86pR z*t4e0jF61N>yU92{`O{VG+M=kxXr6Z=s))$?6}c|a{SeoAxXQDj{ri+V}W_wty4h< zrh?~K!>go{fY8t-h;cZ0?By7DKpTO&d(E0P1=B=u9bBi0ZFd8q>IYSt;ukrV0MTGB z3^PoHV&dcdnTsct?xvQ8n+n-J@*ATu|GgjBMnR#w`-ZNV#y7whDAd?Ak1gzV>5Rg5 z?}65I959Tts=j5hxmmh2oQ`r-V9|}D%CT9T=D#%sU+5wjd7@gvQeec}K37Cx;7GU! z#~Nc8pbCo&i<^}}0hDTpQU&aR$Q-fYZSulr$x3@Kymema*h2xL>NG3_p965#z{|Qg z&?(e5TMi(lAiXXqDCqPaIc$r@%z+5Mu&c>UB+%`kDMo>EH3co4%&eqC`ZhAqMwt8i z&09mp1_yaudzkO(=?T6nBC(Yk?t67_WH)$MKzbv>=54qMXXLa8O}t8qI9GU<$Cu`S zT`cHM?v1Yp{JkeSu2=xe#|M+Wygf?l;USP-MrWvT=_<2i-dt^>pAtiy@z?ari3rND zUlG;Q~O;P)ssWMuVnyryM zL6}D>%gz=Cc#}XJqQr2JoAWM5@{Qt>XmcPtUTz7AiR9MlTvl<45q~p|7ycyNyeRa| zM-TrC6EfUYtMPC3c$ic-Mp&r9okjK~H5dcVp$wV)j~8I4A`8B;C55DZL4p!1@6J4V z0)Uk*&nWS@-_IICwx#B)2T;rn445^#f*k^kJ#nhPHOG;`Oyy$zOySmU^4^?+D%gokNaml5<2yU|r|*>Vv5FK~3Crqo#rsBZoX zZ^PlF`bi3H36WvP4qg;mMIMqWpA|yOW2F)6tvjkP8M{N?vTIk2%|W(RFMnRaXh!(A zT)!U?9W4QKY!()p?b|1&nAWd)`5B;CW#t3>LVDF1$4&F^1Prt=#!1bS5HJjKH+=PrO& zbQ(&5k%gNTKT?`}!Ndf(K6VG|kt{Y-zDwUZ(xiE&20_HRf+ONPt`J2Mbjsdu`3tj5 z%I&8bCw)Ve&aiz$R{pYrV+WR>!)jZY`v3B4N{SSl1NSCK;Ep@B$Clk%g#Q-7s>cZ{VOs*=Duc@gPNF8m*@K z_~e4)ytam<B24AHX+13l*ggoFLIi|LkhGRkO$ zyS4;v8H>;>GgooSI(4Mz`BZLt>Er!$zzUxW`*v~QhGGN8fbINZ{@`w zQ?M-!uL}~JpGrTxj+%;Ggc~SuGkG(JxetSbM?T&pKhB2boQ8cQrb$3eRd~1Kd_Zgp> zkuKM7K0uQUx98u>Jrp1j$Q>eP(fQ(BAo;0rUvk*eNVt|juBvO_v$6i#sBK~X4DVfv z2_W2<6#KY^@U^~BSnL^X+YvZunZ2sNsw>Z_cFw+>z1DQ(~Z@c&DRFwK2#L6s~ao?y)L=sQQ&IAQFqkc?O@e@DZ0|uR`b}2 zH^VYcbGga-2}W^Jfh&v{xTsix$5%6=Yu$=>L`h3AVV7j={|22mmXjjrDO zAu$8)2Hu@f0*QRO1kSMq896SdBR+4~;s}S|8z?XY*~N5AJ(2gUA{`AW2~U{Mkk%lu z#W6JcHd_)8(KWQE{?w?a5gFrb5u-pk1|`xBUli3_=>Cc=W8KjYRdd-lZrE^7X2^2q#}_LF+r zj*1_Gx9q#Edv(cKUH#q6sE&V$N8{2!9r-9T^HFZ@LgS^YiXV2XDNP0oR6l)s8_qds z`45`r?J+vEUr)E}t~;Hesd|aol$kvJrUIWzMK!h75u zG(WDTl|8c_9Yj)6CI0v9{&b=wbe|Vv9KzCRpxY<({UI)v&{e5LS~%^ra4qu1WM8q^ z|Ey~rQdYJN`uy^mcF3Qz^VAXGBd`(6_EwOYTe|b5eewEu4^duU6ZYJibD%wxT*@oqHKgRI(1Dj5BiyJfCUW_83q9XLxZPaSbQ)&O z%6_U+QJr`%2rwz7yu(9|Brl;81q7Xv)0fi{`WsTBMaSRymWaJ=85*7_tCo>j+H>T{ zsTj4p=U%ECiAze3KK(VE?=|;)-^4`C{&S2p5}B9d46~+U3a$L;iYB`&PMo;mac=6a z^M`oH_TSg%hL4I<>qIC$Xy)$NtfpXL@jA;|=8kg!kL#7@jP0@xmUD`UI&69c?x(Rb z?+u7e*4019sgmhVS_rL`X&aWK&XXWLjE#TL^hcd&fR3e*E+J2J z`7PaKm3(@IV6#pzAyy~FT7h+cfmoga;X%Q|?BP?MRlf3Wg`!?DacMz~PeR0d`KFr_ z?%AXrO}Ngwap1D$;_&}`4>dtGlx1L_iWC2-l)Swx=DocBEXYMYsEMYhv2uHi(!`+r}~kr_%rz%6*WNmfWvHIQ~egm^?NnX5jr| zZsM|}5BCTEqq(v=f?jK%-`dEen!B(?_A-v)9Mf=a>|ZZNry$0g!scUk%!<0u7fkHnyMEau(I~et&S7q zg|JA=9?}1}NbA46E=1*=eNL#>Y;O9Qh`i?xOKCfjPRo&l%~xg9mvBVBUVM(knG29{ zIQACopZ{O2JSJ7)`~Ffcu1px)BhkGvY&2~55s6e#pas=pp|?yaJ`87=v^1%RMHK0P z@N&Vxdq7N)SJR>?xFq~mfYvlc)L3ICkoL6Qxt*y#uW@!`Qj=Cw$$rV$Sne04yodF0 z$1SmFVM0&Fq-?QopSSRX`}d=^J2Vdst7^}8ymAfVBdP7#^J@?uX)*mc+YL4tm#W&kYxiHc4`AGo`aF(lMAwOjF0A_{kA85>%2qKcRN13JqzzP+Jmi zxCkLeXad_pA^#0-jiqy~P2@v{7lQ{P6VI<1Ss1P)N%1PaT37fT4K?kD zd<LW3I%T$U*S#sCR&rN)>O51K=vSq7;>7dnxUL@~68g(m$zpNt=>M zpl>-}lytoovCGM>CNw7#?vu(%+V`jEMZE8GQ7z-y&HMzWP+yRU6%r*S*0@OyUK=m zu3E9{*w0M&+C(o7|Yc$;zR*3kIHY9w0i`7n=G z%r>qq78^&qHpO|42(=YI5OFjd(8~KYg{G}vp{b#-Cpyg8rl7O9@71eCvc+I}qr|AN zc-9}qq(k_1L1k^~X@hPWQ`PvTu4n;Poe|} z84FFF5>ql|*{y=8Lz(aT)G}UuY(&q`ty>#gus5SR+Ep!vvR5xO74=n|GT|qj6yi(I zj7~cgdc~tr#kMHVq>V8Lk!<(B%xqDtG{=S<38fiHMlN4KjDPmAP^|@C!Q~lae}hw&dB!$ZB$yNwu_* zxZyrw+og)>7XCe)oXiK!Pua~}zsZyvo|FPvmU^+j&!PS(i9W@9+0-a=Tx4B-RE#Y|2BmceB#*gMqxo@29`CxX z6U|PYsj1#~nRq!)(DH*t?AUw6-yEh-Xb^Tpi(1STkW8hc*PGRN-5-8!m6Q;Xuym#( zU@>aoL&^&W(TLCjjYKwETbmI6SoSzkn?)*%^f?1lws~USMvl~lEMhpx{HN(l1*Q(1 zo@~U$f$1qkW{eqWw?*2=0_jeoqpOrRtR{n?iZhuMm z5p=oZ9X}4vei8=w=k6jrNaVar&MGbx>`1||UU!s~Ahn4x{ z6xi?S%3pwoRW+aIjTG|D3d)Ta{tYrw0(9ZWpZhD5nJn1YZTkMfz8JXt3kLJQgRT76 zZ>6w-ene1OHo#G@v#~5+M}ZEk(?#ZbDYvBdT3bwgfnshGfTa-CPvXU;n&O_7uty?} zw>5XbW`VNjS4~hYzmX3&(*$}NjOt|i74}4~020TB9}AzwcZuk?cg84v>F`(OKqN+i zDIT-2%4o1hVAk9f+Wv!A0gIfDq3DOp?@Tp4sH3=genZUvLbhIHZNf%*$Ewtis*9^j zDNXs0onkti?I+r7$z!w9abaz#bF^xq&SYwPGy#cu?4$2bPLmyE61X*hkdUWxNHQY+ zlfB_7lq50l`gR~W%to-JAj_va;867Gqcfj`7#X$aCSc1>8I?rlw$?lyr1MI=+z>() ztFx|Z&eT%G-a($SC|~(be6HRo)*#tD-Y~D?@@2C}E1;rcd3#f)qh8h@b*+UGPD@25>|=+Xeh(4Jfd;A0GUkW$e3?Ymo@Ge143 zf0Eqa;k|Kb(XMY;NRR`?5F(%!!NoMtD1k2|qsp#%^cXES4Ve(H?)ckTwJfWpxA*f= z+Ib{Lmb%R4d%Nss^axis5Qg=_ga=neXgUpBhb)ITCCQ`540APqKl)TvHhO-nWE7}J z#fK$Hlgo+xu2aQf|n^$LXvGx2(3>U zHSEJr`mnJ;TgSe@jZ%1q6B(Y^L^LM^HDPRYO`nr^D0KY8-h(Fy&##pnB;91+)jRvh z&gak6+}fJ+p(1h1sGXzx4^TUp2YF44m31ob8qAj6@$0W6!$eoMP{rUm{hDVPNS>0u zg_I6{{d$`_BxHriNKg3m!GHG`B2`ROM>SNfa84Y;)Y(KH#V zyB+XKc3Jd3dE!P#yEgXDRoyakjsJ<%)h&b7wer>OHuxyw?g+)0b?B=$(!2v!{P2hY zE*BxY+Ruimdn;VCvqd6DCmaz$4$C2Wd&HKL$*w1k9hZ8$@mJZ4r}p^lsiZbF2pVFo zOwK;bK~!GI#D(8+21ZSfRPANyH1vmT2pYy&n#P(oy4`DU-qKH~W247vT>os+l5>fZpzAr%ujjZK03AZrIyhS zrhDGrckc~CpSEx7NjH(2oos|GfqN1px0B(6dl^N@)vZE9y(0KNrG#!lVQx1|DaYuN zTmkuQdMwOk1C2&8hie-l9}&jH$)lisp*Zty(MnL^iUU{OIHjNIE`<7S3;|q`G|6v z+3CbZ$q9&EB-lG-b$Js$bQc!dgdOZiZ?C|InH*wZP1sudEPASyH2qXo#Fs5iCQQ>m zaLIYJ;~bCJwqM`3Px3E`xN+pQS3 zdwvY%vMz(FqgxnoZ`RUyN+cG_=4EiMoKM6y);wC*1a(3LR<_c3s{M+vs$OwhvUP)+ zhhCnrZQ~m11zY@j?M!SS+twrY&^tG^YR)|!yXEG(&>aPu|5)txEya$HPM#9n;%9#3!Yq>I=?w->I#7#{s!W=dicfRQ;Wv(4c3PC*Af% z%JQ>z$a*G|KT+p_IpNR$)JC1E=fTu@lXh9sqoV?Q45XiLS%MLSXf$FOv|pE*Xrx&@C|kfOx7J#*TMfAXnH3q^#0Dc@zAsJvThmV6^`G2 zd#sjzK2DJ*>6hpjA|D>nHa2{C+9E^cr+GtMALwd~_>%qx-W8up-bu%w#Zz4>p9@A<*c<%H>z*+ag zg~tm$NgaJ9b{ADVkBo27J?NV2bkQe5gIH%!C+~L| z2w~bZkJhtagMUL!@00xdRnLM{g=2S9k&<1h+uF3LYGs zc4xZ$Jf+jDX~{c|K+b(JF+}tg_dH9Z#h9mTex~y}&>BXurQ`P{JsBLsRD~U~uSwXH zD~`_0->U$@L{Zkhp52x6)N-G&2X;+w?t0g#j3s{P7M*zSyk_0R z4jF@*@hr!5?}*x1+m-_t!riDOVn^QC8d}SHNciVJ8MUaa6+E{jFC#)nOUq@trfVc) zclklj5I)>4Y;mIMk=#DU9C7E;)!sV5aNst$X|vUv6^A44r`LycwA5%jD&0%+O`2}s z*|=4PRuA+JiZzv9h3TtT{H)B)s+RkUw7HI&kAaCgkEA)(Tgl5DG1+ZK<{rwdd2(`o zWaRye7dBWI+$WevkICH+MWqOQWobccVLVoWe#`q@?^1v_foIN>2ZoVBI?s)mQC`n7WrQ4GJUN zXyT>RZRN`<#<;5?$#MGa%a_;loM&R4`Q0l9vxakje|l;-M~sYkG&egY>-MVaet1wv zhfZTUEfPvI(UC1NuN z(yNje5e5Bh2XZZV`B`m)7HJ=vG}bmY>l9U|Sf;tZxe$mmCLe9fxHJkMKU<>RV9(j9 zD?P^6b_yR6jP^jX4{*|^;<^0`fJ{}eLrXm)Hec=+;~{%)_p zCZ<3R%jcD6&yFXE3p;EUt;?Z0xsLbU=6r29&h$KI z<=lK9ZW6fL^`U96JJz2GZ_)R(o1j~W%J}h5=$MOth}P57rbT?EIl6B9AI3}Z9V*bxTIrny&SClB66K1@>Gc%KTs)WS9bgjnL z+w-?`wOLjPS7feSk)R!}J7U$#Qy1@=e&0x6>qyQz)mE?R-1~Qz)fKBos5W~@Fgf&! zYPDSjg+Jmj2P;eKRArGzGlO{jpzhKQJzJ;r#*Qs_@2knly`E>{)DK?%CDXlhmjhyV zJehgNy;5xXdlEYs)$15|=b!fRz8@R0AEtl!`9`(j_t)(vPW0t=mo3s}j}^UtpN6`r zq|^gDR6S%rqgH&Gh>D-AUNO1vb?eN`gSxf{_Q?l2)QcHMjS-o17qte(Ms&;kch7d| zRV-eM=`Y$CIggC#ex9^_qxV&3B1)ZXl}az#p)-dQXGY(4H)aVZy>a2e_EC?WlNAO% zHqe*IRhHe3{GY$iqTX^;@B9#qXvs;oZL}o`n(<|eb*&Y)R}*A41zG2`RMT7?8#m0J zsST~Fzj1iS3!X~`4NGC%g9-_j{S)P3JWL9455%wcUem2i9~UFFgr>FIeWIEVPjNk) z>D+bgsIUz|&WMSSJ)JzZrhCHw7He)w8_`C$rrW!5C|KYcfsWndKZ0o@CZ}H=Ou-GC zTH6Sj?Cr8{A?C`;^Zd6KIsJtON6s+NNZa3=q~i%Fh;eQ5C;El5+S&V&qxd-+y1Nkp)&tYk<$8Ms2Q{%N4hg`J|)jGctOS?$%Q~b7^WH zD)3?=U%Gg)2N`d1aq&aEtL?(fdPI@E`-DK6e7i;RY)Nl|hR|lZ2@h_Kz3_BH#+%Q1 zJ9^fp{KFrAsO{S)M76t~hx2*M+~(m1ru+G!bsxIm*TXC0)!e8qC%iegOrB2dTGUTe8)wp~wMdoWaoI&o z-o~cT)Q>*YFx-I*P^-xIP@Bow$}W(53x3isKkFx5s|@p#=ow+_n(8W|^45s2DTz90 z0$Z?8_>8dH<5E51>e%PO=eU4U6jg9n_Wa9Ni4V= zUj36%Hdj@*dJD$oc3m$zc;!MqOj&QQ6VzU@sil=YHl37cg7$z?NZO6B^&otFsJE22 zW#3RG)h?6V-yI2j{CsKi_jcv&a6SL%NP_L~(b=(du*4NK=cXgocybn`jve!;Yn!oc z`@7KY;wqi3d?s5A8z;YJj;?8^)3I`T#lubfF0cPcYTuh1N66IeS|5B5!o-yx!jCi0 z?!7kGv%mY1jr_(=JV@EfMOWP6+moDmLH4|1XLM@%wU!Ofc8q8jJVDAqx%Osk*I^fU zjMy3}y}OM2Ws{4y)9v&oYDwXGJ z!{TSp#VK+XD3?0ssfX02ncNZ1&6{u0(J5-}xuz&|_?*e@+E2f0rGF$?+hcd|RD`f} z=jT&Xr+7=$8b00P-DoRrLM7xRUoUe>SGa%V3<;!M&8q98S*F7MFPa*MS>_pP2c(@_ z3?zkBshtx3<=B+J2@i}*LECul$o!e!k53YvorCUr3{Nr5$l31+Jv^$fIEC?dXJUId z?SuW2g63n6Tl7%vN^r^?P8=B>y`Oh#po8d$0cO~$f#wOo$zmv(H-CfKDZYpSMc z`7nVxp?*p*-t}N^E{t%KUiY@oRn1QWO;W9m6@lJoeNv641%n(*2j8hz zC+j}WZv5jHooFe^E#5zDHwHVn1QZTNCte&nA0IQh5L6bnX_tl4rAx;^rdN#D+{+z; zJLDzL=bmdgWRp;t%kMSD#+v?Eakb}9rVUw~M`yZAYgM$&=4JxaZp0ZS6F9nm!_5Q@ zSKJprnkBxCgA%Ft7A=dBm@X3x@`=td{$<4m`vQ8pP0|}2U4GBBwR(C z7(D6vIb>i#h0C({9_S^nn?{as%M7wXb&7PO6W{AvMoi4fBvD*-bUx?&Do?h#`Xp@)20gx z&Z9G0j$(l~gAlm85(_=fy*wYXls8XR>?*j83fmYrp}e8J%Jty}x)vTinUb8hG44Ny z8V_C6X{&MI{-!J1N^fPC6XZMk%vbF~+;#EQ1DvzyFcMXBIzPF&Nrx_E1aFE}cqhtO ztBf`C&vQ0TqM7Kg9S^bXG5CAUN<)JA&;+4Dx$;&ck=qG3#x~LBbkA(iVnv9xYhcPa zytbmO2?fOhuZ`v0Sx=$5rkYbG35J{g%oi{wN4@uwU@&d&me#YZwaFRtBwdih6;n5IgNjEC9 zt-Iv)_0J#y%mvIOR_(9TiLNW)c1O zJcai%l@?CuhwOK4nsQZ-FS8a!f3ndK2mLXY$g;b0^_sbL|C5TOye{cfxHfi2VF`=8 zF%tRS6RNPxjp5nq;mpdHMyBskaN(?w5C_ssxOD{t> z?T|uo>}cgpd*5p{7KIz~$~p!L4Bl%L-<`{bt1;Y88jnZGFTFK(E*i)}T1yYH=PwqD ztqYpVs`gna7DUgb)%K7>QB)&X01yLajiDmM zwd>o0|GZ{Y<{#`(5MFM4Jp3oawSGM3;0mHRq!F)8m8YIaNlmZ_?zn%SfoSW!Y15{e zCbvX(@A6ObR9J?h1Vuw#%d3t0Z^D&~EcfkwjcX)b2$`f#PQorlxAj9(ucn9QpXwB0 zr1%1#yCQTk)mb=JaT~$*Vg5=La6*XD+Af0cw0v$vZbz3CB?*;h2X#`C5b0eiGsSua zrUL`KAIm4{NF}w+!ObS+PHQKv%&($^+1yl`=_Ar0pjN=EeLiiaXX*^PAk;99TwUZ9 zt=D6$p!pkz>Plnf?r6{dJTv2#!;Tl4J1jGje-1+KXAsD0=%#6D5ik!>0r z?GCyLRL`0-x$t)(`H@E)0(d8BWc#*(52rdbuD0#+e62Yx{i)>!c>GFwwc*YqRX-;?E?v8S$6j@BjM?--I90Ypj+L zOG1t79Cqjoy@16CVz)Pgj9KcVBS|(LyJNimdsEcD(iC-58qELNskc*@t<^acOr*j( zF&~3H%lsER!SP%1=T|?qy2Z_o!pEh1^54EjB9MYLTzu(ikK9PzGk3nc@|$&Un}3hjjWQeRs4#Q=Y%-=Y&KAuwMgcCumCREYCdzK(guNEX9|01;MO z-11AVCk}56ayGCP52vCMic#zwpiwv7;qP`16_#-B#mVsO(Z;N7-_yIs&ehm-Udueh z7@tr~X-?`q#f?(`>V}^w39H)oy#N9t!Nen{_UekewB#-ZM#e^>ZF8gbFu{Pe z76GrIMY-vgOA}{3xRaeV79W&ZlAWuGM{}t+JfCQFx3?`%1|{+>kEPCQJUC(7wwik0 z8-%7f4`|H*f41H>@2k3IcfE!nRIM7>p66M-(X0$6RUI?VG5`l@THAkfw0 z-rxboiU*@=l0II$TaY^=hLvlhq+i^TsI`emQ}>dnAg4}y2|2)^=c9jICL?vJKELYn zC2|NPLNy$WEsOaMC{B-*k9)Bs`ve+<3CyumCfJQrK_MkE>QjRft^~SrbuA6 z2r#w>C=jVdk6zR{!YlZn_R58yERheocIc;yo8ppo${)M+^L7&!){4ddPj7D?Pj%jg zk85wHw2GoADauwt$<|alDUzk^l*pd!J1x^5r>r4Vr>r4#>`R4&kbU2iosNC?y*@27 z%}hP7@9+D^&+B<+WOUB?yq9~q?)$#33D;ZaEsM7yYLNCg@o-veI@zMa!-sc))Y{`R zAu1EKdCz-!0ap(=0GORvbbf-$OzW(-FZ11Z=bdGcWK7m+*Fk&Vn)YIe5I^Pd zNnuazsiAg?2S;CR`Uz3iFYzotWC%ViL!q;ikoG+Z5sg50sQk|*-Wp*HU&DxDlmZ)Tb zdVlpmMBh=$0$k*8@P3cIp&(h1u&@EGzd{%j&)>e?ErvWie;crk^0Q()qrvXw5IR1D zG-fauVl@rp6H_`9nWHYzcS+t&*ZV6XJ46SH;=5kK?s;(3G|iKCC*}Mu6>3xa{GRri zQ3$&?ZDb06Xd`AcWI>e>Ei=R?8E-3H6G?QM7%z%mCudSnln{CiK7dt7q-%wkZ zb6K>B;iq+oxn%qW`wJ7#-;#JAG-E}8l(tVx=AjJYnHd`L^zMnHNvARf*1A=`BfQ@T z?-DWhp8}`Oradg=X!W^h@Xw`9l;xzqL9~6mF{o`9YgGJ4z;guh0OJp1zEa$(38;LI z;x`C?bqfLE3$XS9UDwt6j;`k@CZrCWU>4e$+}*LYHJ3YQEWh@i8 zBNx9$puB&@w7#za97QRMMO5nRr$ou)K(}6eY_sI!EE|9Q{lNHBVzUx$m=yG{sqfRI ze6?pcq)zuAr8MWC*7V%8e*G#22ChozR~$qTcP!t)ei3z3I4=_kD4%P0IH|4m3DCbm zJB1^u^H^w|LgO00C}?PqNytw|SQ>k3;_GDhHZU;P3h&yr89+#GaN72uxa7OEcO`{1 z+HQ=+8kTL}x0@zxzJ%3$>d`+!QUTULu?gC{ckT_TBoKW}_hl(>vT4rF8(6ZUm*Bak zkgD$8s|?7TNtG3INZDsu{Q}JWm&F}zmaWJT+0s&pcnOu{;jT=8Nvm1vpnmoakZ%%R^D+`r&{W7@Ky6E;VpRsbJ7t*fWVog@ox_yfonXyXMj5?&l#1HmEr#W?z=$%9-W za&xj)R!kEsi#MbyBb$qQJ5x42DiJIFUx_K@oLIN}r_Xx@-I~%~)}gP; z`F}@yfWYf(A<22G&yZWJ(T(Nlx4#3PDSQo_3HuVk`5*bq;jJQCdHnm`zQfB0zO)mi z?EO|IPFp}D8i~3Z|0hg3N|lw>JWO<*rL)k&4*s$pbcmRNy9tr4pBCK0pnA8825#w} z-Q<-7V-!1-ymtKz?R!k9cgc#ew*NBVGlH^Id3M{^;x`@L$wMd+ke_7?ZU<+I&?Yo!*elLNK_OwD}U267IN)2KsF zK5O(81~fr8KPO_<`2iD^q8gUqw}SMsQMFcDgPT+DXCo)!WR!(|vL>YuPC%U%1gq#< zx|^m8@i}}CN@bJk3`An!WjQw?2T~%F8i5Xe6BWvJ{aII8>Y@dwleqzGrFLY zAk^+cL&2(kkdW0l2>mCJqsuEPDJdwh=Td|te`7~cnL8DV8x|8F9N^c^Fli#xspD&$ zK=_xEvcG*WB_*Z4UL(E+40cb`UnC^hU|JotVEH}ZxBvk`KNJr@Efgwt;Knl36`9YU z^YHS@ZVaD!E3_gCl+Vy5qMQSnJSOg$$dM5dA1ROo1K~nkINb+>aT5zvt=PVwihpkI z*F^*?B6!v7lguga2GpoVAQt#tgtY;D^B}x}rWN)GjBJn^M{zz6xr7{efI!tiH7L=+ z6!PiF5rP)*%$YOL#lp%fDkzknUVB(9#iS-KER5?;4m%?;dk*S7901`N8ENURT51o- zWK*oVN<-z?L~P#YDGaVts4HjaK+HtsZOD0x#E2v>a!EjpW9lt_*s@+!` zN13n;IP6JeW?*OW3oFE z}Ao&3QY!P`AlENMnn1LsjwhBK5wHYccpokdG4I^l(O zrVAYA8kQRH4uS9B)Ts(QH4ga>?RWOHR;kq`wfw{iK&J8VvB(4(1W;bRdIciBSf{sl zH-NG#X0V#7-P6+(5FE^ZjF7V?ST9^FA7IO`u9WC3y|)17!0ifQ6Yb`$Cj0pKBtTjh zWIh;GuS+!ZZ7b>RH9=tLn~Q@8@5UhwUK56iX3&l0493L?AZ!lY-@c30I>}#veHuJ2 z`=I(k;~fM@Y*v?0m=Vl)M-R9(D3F3cI=En^*u94jO{i)^1Sv7t{!T}CU2FlR0f+Q4 zIk~1eHpq-LQjL`%=AD^22jw+zA+&pM;v*iBkyq_$I&H4&{W-F@uwg03{Ze$_xQ^E7 z3+G1DY9V#f2AT_QUS9eYE3`nk1>q@tV(_REwC)Zo1n`*6^N8^O)v}v*8q+2qn+pho0y@cw zJEO@k=mD4YS#Qqaued;sWbuqfaKwaS-g0>iQ!$aOF+4I)1ao4t)0EM&;xRWwxCyk{&Ft2`&s@86&q;boBa@a7|;`C{s=}@))8fdr? z#4U{(d(cb5Ru1Z}sga&B%=*{Z#sUAz%_TV<(*AfIW{QW$iz6KLGs$sp4^F%}<%o}R z+=quYG~_wKJA5A6)32KYqa|Yn~NPttOqS7s)e+Sg##dOFAB!o#72kXz2=}$ z2;6V2@P+00)k%LlvHSt8A4@1zXgL{|Erw3S9nsJNpu0Mdc6bP3iX0sfTR4MI8BArH zwZeQH35g_J(7}~=_irFWr7RZo(FBp7Syi-EYc>YE@C(F=8XP=$=#Uh_2}{tCLCS9i z3=tpzg0hWMXk*J8Fh;p;*h5g=v?e8(HEH37frZu6bE|SV78=%b1yik+w7rHA3zJ+S zdIMiw!qDVA4A$STQf5u9H3rijXhy&{n|&FLD!fq6uK)b|X9kIYFK`htATLC-6BH7v zDAPPJ^SAqig|!fi;K+rF92$ryVA_ROA=)T(be<%s-aFFocmMwCwQJi323$KJ9L`1t zoAr^yhs6fpZ8ak3O&uT-2-Pq^onTklnM-K55@r&#@8})CY+i_XVX-XhRnkpkYJ0s=R0yJMj-57f*d{RHI{Z{PCDN>)i1F;317F!R?g3l#Z1z-@1l z@#P~~zx2je&IXI z?>YRT0$vXF$guA%m(Y8knErl7 z8;>566z+UgC~2;$ZvworV2hFfXCtVwGeNinrj+PmMeTffA2v*lT7kcizA+?62Nt~z zvW_n3@&-TOP-IL71Puq{p`8GG=?E$*5GzYUxEcHxC4QmhgxD4+tMLV)!#9v4+sdyU zt8=Z;X?(nmoYVKlOHM?@RWM<@C}?H~UZ~<@Sm+{aU8r8yHblo*?Rdx#lmKIsYL>8yygaQy zdo~U?7o$uAO-@6F9l@>=!os7Mm$2RoPR9#?@p2408pL`*C=ARXfj4!8f)s{Qn`R&w zWr9LI?2tWHg>dYW-VYy&flMP{YapaM3l&ckvAIR%5&C=3l!x}_>4mLpXDJ|>fCd)> z*>$R}$;dV}gLyO>R?~ovi1(Wp5sF2K-C!bpd`=@!i`J=w4~M|c;F>+LYKDg4H6{|) z-CimWU>W@UR5dkuWAJMVU^R4-#u_*{OhRJQOLSc-G!Y-jriH~C>#c;K6<>C4F2P$1 zhM4?zSWoa>NkRhA)sA%Ar(Ak&^OL+2PexK7KT)=ojbvGR2H4)xvr?N zumK7f_}|9LlN-qSTLE6cXdxu?B5iSN%FH(jZuF<2sFt-2Iq>rI3qG`fHH?pV;( zfcD3$P0CG^+mUN*`ri?0_8S}ptN!{LT>+R%Yz{8syV-l*$)~`Wg8&PP8-|(Kk?@gB za8p@40na!ZZ^w@~VZ;rVQ&*SJQ^|Vs22H8WFFN9Iv?iveT*3XGe+|#$!2vEp{>*87 zTm_zoyU$(ckOs9SRV@k|ZBQ2CcC@g3=YY&L(A|h)-M&glaDqh%{8Xchl-%Q{RoqFg zINJzf&P|Wg*asEs!V75;n#G+jn5&$R$>KC}NC&&lCTHoRp)-FdR7-uW51*z3a5j*7 z2?+{Xfp<7xh-mP=5NWPrKb5R6DM{U1@V7yIw4Id9R^=1K$JZ=Xwk>NkBI4kylKz3hh8gTC2%V;GBUs@sk0Rw zv&2%&b#y^+Pz==X%-*(fZ=eT<4CL8ETkSNvl8hT@qyRcY^xLHy^p=0J+qAgmbfh)T zq*1Yv*s~TGKJ@Wtg4G)2E-;~gv@602;+6fwK4dsM_Sq=~Nsfw^R{P(Bm4qfmTY8Ox5X`=yCbM}y8PAO%l_Z2lF&`2{U_k{RRMR$HXWh(n%=gyt*+LS zP$edWwX@F!*jYjAz13V*70h>t0N_(Wu{Ik)SgM;$R9oJ$57%Yiaq-1^WeRAVJh@rA z6nwp=S}>6HAa#S<0WwE$01v`W$2Hxl4Jn_DVI)Jm?YM`MhQ{*-%V+S}HyZlO!#$IZ z7enZmhQ@zyAD_ibmLL*#LJo`w3M5?vX+!Qu+5?|o{4p}$WFxng6)5xUDppoL$!Fq} za(7##;k2d~i8d2lWG_GaryiN_#*JRa0G^+lP~rbFP&s^JF9A4oJkE6*H1_ zg#{~~yK(fRP{Mht8hqr(o*r%&IdIi2KuVwA#Q1_t5=!a2cck6hQqI)HsQK?a?VljZ zeH*czbGo_?4k>>H-tlV0LPbLdXZyRn`?6v?Ge08iz>Iu*JMQeGN1G?8Ao^$5va+ZW zHaU0%8-Vwo+hLOeRnP$CZJeBB&=DhxfXRn7A5E{Q_EMWeD+?jNXH)JF?G+G!aH()p zbhJitDH;PHESqgaEkXk{h>k%Vy$Q;_@Q4V>?Cq0-gM&93?0=p%v}nP5`W+S4;d zcAY*n-8Jpo)7L>3s948z#>h3<1tQihEiIO_6c7UvvVmzKS$0ZMbt?>&v_!_rKZP#- zAzWPzexbiR9z-^fZ@-Ys81kq!iq596FZ0aI;)~uW<~p0^nVL`n!`v<>cl&q?!TmSO zpzM(En%`^5jpkp|V^MQBBd~XaF^BpaQkAnQtw|6Kr8-`qKBf&IF{>Hrdld808F7&stK4+#OP z%d}mr6HdrrlwbdUvX%QaAsxaJQ@wlO3*{tdl$>Nm_w3n&Ctwf*?QHj;uVSP%5h(K|# zzy-iGg^<%Mb0%RU`9k%J*MMli(Y;PGP!+e_-#-OWZ(k@uHi%%Y@jOWqTAkc6Y3xm1 zvjkpI`Md^LLZtBSdIoZ|W@^Hz$kT{>eS-HpjuLEuplMt}3zZd%XfVA&ijcPtNbb1k z;sO_*AF1m7FH8zTID*yLSAL$v47-s4eO19`LNyTD*Y6?vHu}ILN zSL8uRVt{EF>{8uJL#X+2T{x?oa|G#h_FES=_TV!T(@Rk|c7d*S+T+p-mzhaWsuDlu;d$TG&&H?7&DM|UPx~D2{6mBhg===+ALY3qb4iJuJyNo5qLT= z03x(%9I*a`tgRJcX@&Kc`y^p{KSyfMbf@GlMLP2Z_qL0K0|9*4PCnY*gIj`YYi&n1 z(X`Rj(BRQd?_|FbpwKgi6b9VyeVJ~2YoY=F1Oy})$E)ywCAFZa$j7x=fvGC$qN!;g z@*9Xgd-?87aSVL}VAFM)Mw$?iW+B`ZbaJaiw8p~m_R6gS3XYO<)0P)5TsV8S1ux!X zzcJ`(rK#Ii>x@DA2f;{8s=lJpc1MhiB5KW;1b3r11pIh01a|%9t9kMNBQgyM;dP9R z+qa(rQT|p*Rv{y=&}9&y`z5SA*lPvrHPqZVuk+?Fli#4g6Ef!?bvOMJ^cPqadt6TvhKd>j7d9r^W7Yri%2<3BJE z-+pFBUI}4mNypLWqQXTLL}B|CJ@FdT{nQ_(2A=K?1eh!iZF9htplD7p9GD*E`p+9{ zEN=aw{jEkW6!hiHRLnI(h%ETzjp1`#HWy45P=U`&75sd!;Q)eM)tdocM4cO4*FG=?3K$9!tRgj0jTUPuPSpdEk6yySg(tZNCKxB7im+0(72Qb%`T0sfh*F8gr5J;%U9zRVXC4C+6W#}6 zN?T&6!2qp9xmb2OhIi&a`WahNQ&}9|53!DuHfcBU06h@HMrlp)zy^git9-z zuKRR+{0ODd!$*#+fG84TBEX)bHz-~n9;M)c2F7cRk`(yfEZ!MsZlYdW;iv#1rGF>g zM$6{e3H`I+_rrWw&szdI+9YD}w8F?4n(zSNXpn|Jm`%a*qb!1`auv6nzhF3mK=xcH zdVmFXt@MvxM5y;!xKE=!JUC>YllN+e{Wwo9D8UD5;@1h@`&4 zNLEe`c)q7Ae+7Vv?ChHc3Y4tDen{7V<_Sslw#vWiKHfPxUD!(`GKa^EjE$j$K*hj< z_Chs0ALwWiqG_2lxriDq+cf$S@e1%#uNdoeJKB?@ZhhE#qhD@)l^Y4_H_!mL22=1n-Q_!Iq0VC67iHVqAG)IK10ka! z$(6vQ)DkbGLsTKa1+_5yp-*|PAf3%ue(W!^eL_dUZAHNsxQs)(tE+2jjsm0;+nQfo z?8_0JlvI7b3Qg_+Mv=IpyhJE!LKKCAlM^-28+GPMC!;u#0?f|NLQDsWW8TU(Nvkd? z8@JN9e%ZTi(ByB3stC5`t2R?l>9adII``Y;zvg){P7{NA(jM@Srj}XTV#SbfO^2Hs zZ*TX{w|j}sU_1cvDLN_SClpFMe=YakLD1RD&Z5)fEKt}hGowQLc?S5z#T#;SIVaRm z;DR`{a>nV9)nrgM&Jd+G=;S8p=6RU6y~Q2A)mLXmGJTvC1ipWiFjj65;J}qZmPBYG z_K0dMedUNu25Rb1LipItB))+T3KL2f#yA95GbTXTbAv;MVhykn;d1kTDEul{3!&eB^r%-Ghzf z%8H6j5>6`hVw&y*Y@?$C9i6rK2EpN>mEwXBVWb^&`%+3rrsC;(yFAa1fU0mMOi@dN z+HD_U4EEdfa(QF}^-DA;IaqYSyRNG9g@rBTRhe-h z$I*q7A8Kz9h{%BC3M$b2{}hhPptYIX>)IbteVRkiElW8lX z3<~Q1ta|_QX=P4JL`0;uRZ%~o z?c!r+IanA#utA=lmbf8(cqe7T1IwEK+ym#1Qz7?RfWx>`+u5-A)0z?oq%Kn^OhD&0 zC@`?^AltkH`Ut}QXXD6S?YjG0NhcocYJn`45w{r9O+!ON`nqxalwkdLogE71vsy(r zOak}KPkr=H!pncfEB_26f1Ep>G7{CvzKJ9@*|04-(rgUK17!UA%qkbs^?yK9Oxs+) zkjdX=y&r-sb8S=TU=a0`Z-2FjkXs_OoEvI((2cty#`}`QT%sZTj)sl=(!PPdjl(?8 zqX-ZKSl)R(y=N*4r%&6oyjj$~4F1b`Vz3>-N<_p?`^PiOP;F{|Nr;4pg&ifdUeMct z5GwV8Yj5I?nA2)%s9r+=d>bQPM(_N2Y8R?I8gE0HYA;bcNB(_oj;OznUs!pvt*~&1o~^ey0`y z#2_Qzar(i3(QjulqcXM|bqtYi0QK>~k=nwDBh+Jq;3~d!b#N2jrJ`)2vfkPRIPEK!;~oiNA;II_UkF@y@ev4HK@Y6z>)ke2F!C z@`N2Z_ntk9Ji!poM3X?|dp04h&M!R?=(<4A<2cei0tJS-VrD4P*rQR1Iz>s4ja9=o zAV|@rszErt{nDjNdmHVtjHp;%c>Woj_BH(SZwax#AHDyYJQGxLWMtkGMYw*P+q0|5 zMgwZ9So2-q2}!W#h?|bi4nf@6gX39f=)fEqWtV|kDug#AAn6Wijy2jMm~|th*u5qw zZCA?D%4{3n$}ts@Fqgmo@zi3dzM z$hckR!7fzuXqalt?*Zzp>hTn^2dkqXL6R4PmIMaOkEJfAQx^PLef@`vSP~W`Tg^H6 z$HaNkF`NX%n((VI95+xi=V8nzma*`>C43JWb_ivZTjJjk$f`c_Tj7!0B=isvbSpc8 zgM#>47qCPst?axf`A~uI;p$kswmJwqGYtTR*hB;L%d}9`c(aqs-p!Q2eZruqQx8_Wk;O53&n*7fx#akw|NmEhxA_g3#_XMch>gp2ZNlh?QT zUyp2fz!ZiE`o_nOA7|;i=9VV=3=VChxWmh|v^1J6ee;n@qI*!W{(pB5ei>xKwH5jn zNFbFy`QL8^J#dr&XquBl-nxnzm2=54(a|jr{SUtJ0|!SNtrj4FeZqpT9g^$je3xte z`Lhm7a;|X?Z3W#WG(7zXf&Vb{_mh^uzcU0ja#dy9Cc6L8q)D?go#>ONdr^h;Aj5HV z-}&XoaQa!-0ak~?#m%jbJ|^^YG{l-mqtnOnd*IcG^m8C}Amclr!vsKwuKIhQ>p2|i zDNqg)i4Zmxt#j7e!ui05nu(@1@!8a>F#f+wfIsAb!c++H;iUN%o^Pt_5N=2 z={6c6!k*KA|MN{&c@2q84m=-#L{3-0Ox#o z_m@9cUd7}I0dI>r2RZ|pZ=16ooO?fjJg>gC)?q&Z&fWeN+T+^@;vD~q-Q!CbgLeVa z-`&Oc$mQ=M&HwcYCAvKUI{m+fNyJI{CEjx58>0C&PobkLU-gwuijFSnk8i|M#J61= z$k-@;l^2~kOiVC|!RMQ_oXj(7(hlWb>FGp*7n3$v3!%|g+RhD+(}zpBV>0|5(9$Tk z^0;EWb81c5R#8duhDQT`6a};TuZc;U>^4rTsi@z~M$exDczm&sxRlvc4!=h1kOU%dliD5th#pEW*-XPix63SyGbT+%4poXWZPW6j(# z7iWiML@hpkd?J-rvnkbFf*A!JKmW<=p*{5VT$MOiIyubbOj^Kb&ACE<>tLt2S`-mp zGz-c3zP^ksXReJ+R(Db;FMJtY&=Y+z)JvSm!JTeRpNh2~ohuv}EIqzVOlt#$nrx{} z8-5|UBPK2GL)$rrL0x-!`3dfr_2#-Ft`0BKr{h+K{<*sTBpdzEr}XYFhXs3Y!(u*R zFV5^C-udAmVz`M&TS-_IXtC4gx*T1Jdhso@b z>jKf5qcX#Kf6mD;^--(t+VL)+g)ON&&cA^+r?%lW{Yc5H%r%#fK#-@KmgwXu>G(c) zU}COc;Jnx*+6e8_1Qr{>Bbm>}aOiMpEX@M1MNBKffd^SCnm2ZNg=mU*-==2rRS4VK;W zFNLlm3uCl<#0M`4P}Ve?!fJw7yAVcRJnOwwkh!(w$N{m4>vl>P{$D=&v2)oJQCrqy z$LlB>9^TfI1^i`$gGKq=P7`{yzS<$qLxp2YRxlU@=MD`PMXQZWK)!w~k27-59@pXV zj$_UNiP@BE*PiK|>b6??9ppu2zL&6o^+i){c)4RWqC#Q0+-Isj2Pl)p48T z;>>Evy4KI?E@G*L76{u-5{TSl097qov@O_qbcA^Mu25r_@h!(E%5SaJn-it25Pit& zIQEH)3GLUt_;{sdV-bDtdRpZZgN6kg=Z_eT>~~{{!U7t;A{}zB3!WA1;CG$qO!16Z zEwSRuf^K|EVHHVt8u6Z(8d$kebkuWNX@LZzoBe1KTle6=ogBJ`dy3b2{px&t;eD!96%S__q$7fAzU-p!RYWwmv zAZZA4oy}Q1y`*fd+;qrUeyeo*<6{1Snj6R2pdRNjJeO!2a#mKulr1>#Eu*fd)JY{1 z-Zg&+>s4?mojiHCM=M+{vZD6%OR4sqd|YwkDM}1aPp^(;f5fP6t8w7=&2_7(Pr?>@ z@{vtVTiUj2PmXrm2ibq}fB*2$_4*zc=c4D92zWl+;x|>_Au%UYw5mMIwn_7tWK>yb zu{_uG27Xc~QgJo6kjO`ms`K({3JcGbhb^_WT}dKwMjLsvF1JV)|6^52$+-=me9eo^ zG&J5!Pux+py)15|@p%*)sHBDl@sAevCr^gO!~`E^mz9w@9VuGUxRn&K^vZex-7uS% zs}`vO5YJ3aojC;z(}Z!%2kVUu#Z*cE+ZevVC)=~%$52;Qm2?<>|6+mP`O#O^ly&Pub987P+t?J$CTMN? zet!1qiT#zT-d)dYIt4@>85FHX%2_M)r%TIN+jm|~cDOzJjAD454;7M=4<3p~lvn|< zeN$5-l^U2!4qm+wts@eBn%lN{!-G9G%PVXc0Xf*?U>8o#;*(tSuUsV+J)9T?4-1fG zTidbEG<(y*kA}dNQtgLYTv@_z-nymCH4T;9;-K`~!XeM}dK=RvxsBB?en#@11$jy3 zNYT9}?|xgp{FXbbx|YlB{ZB?Ot4Pup#FOS`I~UUrK2BY^l5LjVw_xvu_Z0>yNA50V zm2g_vM*ZWD$FsASCl41)4Y+>n?slJTOo-ad&R$z=hUSO(o^Jo}j;GJ`K6beJc~f~g zIMBCgU)wR3eQOAp1Mh}hSv~F}=2A~8#w>F5+PiDi0O$PR>Q@d8ubZ~evQ`?Qt+uqZ z?U-KgLy>`9Po%={y4_ZYRv%+CGwzs7#1yWG#`ELq2cb-VHI{W+Z_ZH#b5az-tMz#eW*={qMLE<{16KiY?sLcb^(j`KD>3-tc%Jlsb%|=w;EaNA30Kab2Zc^ zt`F3!zO)~jYyadjE4M6s$x0tZxq|oarRr!=UBREb<~w>V%j%Vnj?ZE~^DgsU;fxrE zu9Auh$2zwMEp(oxs!MdlN%{}A&8IV4Z$i#^GOQqP?!S5IOP-ZNJeB43hZii_X4ENo zr}uI!X~BX+NVAehTO$RgwXVM}V9jCDTwF)F+jV!=l>Kb}naZFi@m7K}ACMZY`aP(( zgwyo_V1sqPIt`I;4?Fx zViH&L%C81z)tjoSm8Q3D-Yk0mp1R(V!E<<*>Yb7u7M8ZF7s_ikT(S{&p488D31Sic zxGUv=mR81Lc7R)Q`S~aM8`FbRS{GX~$Q0{6HJ91i)#YcA>{Q^>w{06y`i+k6kJk@{ zIdXBylAJQxQ}O0wUfBm58RJP#r|VxW?d6`{i;Gm0yh_W;xM6S>EOC!kjo0E>vq^lC z-eq6&v99Oy9?f+wk3US;OrO((aB$$9~PM+R-HmX3HkM=$0~hw@LZlsoauKXvbTV0)JF z@iIXB3}Q8ug)CN%<#mo9^n*>IetbwrCr)W+U25W=)NoHue!$P`qhg;Zz5UeTD&5B{ z>B25#-J_wE^T)yuxS!7^0F&;3~Bt5>UD z%18D0Ru!WuX^nVq=Xh30i6K6AXYSMIOGYta)edzGcQIEQz+cKe+@~#Xj&Ty}HMcl~tlf@{)W3dxfAE-6M2D8vg454c z+*prD?a+2@@SPPG{*?GKjO(e+%3k@#<~UMu;FP=2Q7)*AA{``kPF-}Ik{D*$zS(iO zgraYeJdb(m$H9X~I+E++9!%t=KnlrKG2 z85vvoROeLq-Deg8Jr^%Y|G2*kdgUphOp{*Og@p@veT&sLL{tRAL=TOO7@N+N+>Kk} zD}K8>8h$;D7x$}^B|9clf*g}?RcW%E@UMP`tsU{TqhUp~7BG1u1>aOdZgCvw)gtTz(BfHSFWBOXZZOI@$Gk*V%9F)ZPu6y zyMS5Oc-WBL=X5@l`pL^5o7{8g;E@vF-Gd_|>X{NOmYYpgpNikUT|{f+G!oRrVsDX- zd;0Vsr7H#2?Ua{Wvu&b=&=re(pWS5yKNAkuEL4JOb3gV=pI=r8v zT!4@_c*|;~Hn++AZ;xLK(^!puc^50xLuBccAI8mC?702P|#ocu_&c`P7U0zL1VhoEK z6OV}f5e<#`)MeI}ySo?Tkn=CgVY^mhnOwRroFS1J`P8NU&XT?RrfI>GcvMz9py+glRP1-+1B5G*`<)y{JK~t z)($uIZq<2R-CKv*EBRZf6e&vAe%Fkk%}XaqDQ8}Lyn9!obShWHA=uo7bayFYzp3uX zn8-*L^v78lV=4;k=dOk;nMS1>0J*s1TYA18_@=tVwZD?%23NdvTBb+C7u0 zyY75-@1F6b5@znxrz@ZD{cwhhpFfx*Z^=rRBP+|w_N@DTPOm^=!Tc*Kq~R@xuJdV5 z?%wI#Ikq#|G4T+`nphX6h)nT(hs_CdH3EGloN_MKR#y4%-VF{iqh!Gy-iONS*dX(P z%rm5C4iXoen`1%9wny#cHj>B3*%`fZA4C;K_7-~3t`@0}=4pBtuUJ3ib9?3gP#{z|n8%O)Dc}f zY&`yqqZeURb82^Zcr+e6`oP22S5ABTgYNlb{o?Cx9lmyL$%ejW@|CXSVQk7%>Ilh$ zd$rLJ6cagQNc;8Q^eTM7`lgJ*A#8aPgw1qEr<#@CFFHieuBR6TWSW}LRiEu?3# z{q5sJ&R4IJ6yyvH4Sn;TV+wC@aInOur)mHoers2mq`amOmU(#Ct<(7By?ZY{eInt) z-L2&C7dA~u9NXNTD54x)&&4eoj%~BvoUkQdpikaPDpccwTyWBpGF^TBz2>dDx?c4u z6+RChnCR=m6V@J<%p@Z6`$yyBZ8!5{fO)+K z2d)y^U2!$_I$g6S&h6X#^SxQ#9gwtmdhGGi>eR%;9BXzn(#zobc6D8wWNu(R748!H zyYrn`5>1-SZ5(TJyR=k?p+tv{ZgH3N;Xjnx1pK@YwiGA1dvwpw%iFVf#YU$tg{}J+ zp}1aU|2-tSbt~`kBK%z)AWxNnprDx z=xY}B%GxGr{`1gL1NFMhBn50~r{w-Dp4D`ASufQ0Y}lKAQqoAmG6Ykyi`efkO}_{A z1>=CpVeDGr|Ryv3%tASF=UD^o}(Obv9Vj0>I`?9)6?5_ z6-%E8+TvR$=`_B~K}ECSLt;#T($1mbVUN7$t!-;dW@fv4)DIrYlHc0dWHoh*Y1MAMFq&HZC~<+T|PD9w(1;%?`dlkJBdA8g^je{|Evjg%)|<>a1# z0JezG9~44 zxb)Z?X8x^v;z;*DOAl;|XFO!vAEq)DF7N)P;-*@Is-opkEmibgZHUQ9YD#=Y#otfBaR-8fYp)M2sH$oC{YB94NC_7l2oAfX%1-zB`Uyv+SHn7&WcD~BlyKmS3ZDoX zse-SN3HC2c>y_tlD$(OB9nyU84KJCfp=cNxBn1RaB_C%0BXPc<>WG?SdGEr}F!PdJ z)^^f)ee&qel0Nyyg$O^>jSRlL$=iZz%62X+@g#hf8XkLer{A~NYp_`z>3k~&u7RA0)=09pdgl1D0PPH zf9Dme5Fae^JV&JiL_`$B%zVaYDP7vUQLdGj#Pb(bQ@mvMpzD_IPq>ndf4i<8yMRGFU4`7zKJj{O`i{u(@TjoPWm{c7z13-Z%X_iEQvpzl z+2Y*n2MmmiLPFHvT+ZVbp@&GWbLG`V?}86XNA)js^t$u@eWQRNq6$^j&))0lK4)W0 z^Fosghh1)BZ?F8x7s}Ns$D{f+G9`|8k}oeh{=4LzwHy?Hs^B~HB7eV>H43>kvd=3d%>>oN^nZ!aZ{ z6s4`hxv#ElyVg|D`T6Wx`tKiR5-roGPO}yl6)lL3cyz|h);7^x^5RyD-fG&zjV+Sf z6i=f61fxzLIJ4(>_4o5}RdYA{@$v|ENi3c4bp1oWO4@8av#{xvU37FA#D7NunKq?v zGuqkT-xyDNkixyk(o)q=+EsvYl?&rW!b@K{qwDy+)Pz40U#~Ri{`I3vTEAC+rFQ%J o8~Eq2!mF>GnScG{k?-K#f!)imHk}=|BYr3?b>eXJ!82F>4^4ec Date: Wed, 16 Jul 2025 11:11:28 +0800 Subject: [PATCH 10/19] Update _sidebar.md --- docs/_sidebar.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/_sidebar.md b/docs/_sidebar.md index fbc801c..3fe8fe1 100644 --- a/docs/_sidebar.md +++ b/docs/_sidebar.md @@ -13,10 +13,13 @@ - [Register Intune Device ID](register-intune-device-id) - [Edit TechPass profile](edit-profile) - **Account and access lifecycle** - - [User lifecycle rules](user-lifecycle.md) - - [Account lifecycle after departure](account-lifecycle.md) - - [Securing your account](securing-your-account.md) - + - [Overview](account-access-lifecycle/overview.md) + - [Securing your account](account-access-lifecycle/securing-your-account.md) + - [Account types and classification](account-access-lifecycle/account-types-and-classification.md) + - [Device registration and access](account-access-lifecycle/device-registration-and-access.md) + - [Access removal scenarios](account-access-lifecycle/access-removal-scenarios.md) + - [Account lifecycle after departure](account-access-lifecycle/account-lifecycle-after-departure.md) + - [FAQs](account-access-lifecycle/faqs.md) - **Reset MFA** - [WOG account](reset-security-verification-for-wog-account) - [TechPass account](reset-techpass-mfa-for-new-device) From b48e6efb1f666a84ed9061d596907c7570b99f7b Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 11:21:45 +0800 Subject: [PATCH 11/19] Create account-access-lifecycle-overview --- docs/account-access-lifecycle-overview | 37 ++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 docs/account-access-lifecycle-overview diff --git a/docs/account-access-lifecycle-overview b/docs/account-access-lifecycle-overview new file mode 100644 index 0000000..3a39b28 --- /dev/null +++ b/docs/account-access-lifecycle-overview @@ -0,0 +1,37 @@ +# Account and access lifecycle: Overview + +Understanding how user accounts are created, used, and removed is key to managing access securely across Whole-of-Government systems. TechPass acts as a central identity provider, but different stakeholders play important roles at each stage of the account lifecycle. + +This section explains how accounts are provisioned, secured, updated, and eventually offboarded — and what actions may be required from users, agency admins, service teams, and TechPass. + +--- + +## Lifecycle stages + +| Stage | Description | +| --- | --- | +| **Provisioning** | Accounts are created either through self-sign-up or by invitation, based on the user's role. Access is granted to necessary services and systems. | +| **Usage** | Users authenticate via TechPass to access connected platforms (e.g. SEED, SHIP-HATS, GCC). Identity and device checks may apply. | +| **Change of status** | If a user moves departments or roles, account access may need to be reviewed or adjusted. Internal transfers are not automatically detected. | +| **Deprovisioning** | When a user leaves, their account may be disabled or removed. This affects downstream services like SEED and GCC. | + +--- + +## Stakeholders involved + +| Role | Responsibilities | +| --- | --- | +| **End user** | Protect your login credentials, approve MFA prompts carefully, and report any anomalies. | +| **Agency (HR, project teams)** | Create or invite users, keep assignments updated, and ensure timely removal upon staff departure. | +| **Service teams** | Define access policies, integrate with TechPass for identity checks, and support access reviews. | +| **IAM provider (TechPass)** | Enforce authentication, device compliance, and lifecycle signals through Entra ID and backend integrations. | + +--- + +## Related topics + +- [Securing your account](securing-your-account.md) +- [Account lifecycle after departure](account-lifecycle.md) +- [User lifecycle rules](user-lifecycle.md) +- [Device registration and access](device-registration.md) +- [Access removal scenarios](access-removal.md) From 777ebd6785827ac37a57371d5ca1d5a30b84eb35 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 11:22:09 +0800 Subject: [PATCH 12/19] Update _sidebar.md --- docs/_sidebar.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/_sidebar.md b/docs/_sidebar.md index 3fe8fe1..433b9e3 100644 --- a/docs/_sidebar.md +++ b/docs/_sidebar.md @@ -13,7 +13,7 @@ - [Register Intune Device ID](register-intune-device-id) - [Edit TechPass profile](edit-profile) - **Account and access lifecycle** - - [Overview](account-access-lifecycle/overview.md) + - [Overview](account-access-lifecycle-overview) - [Securing your account](account-access-lifecycle/securing-your-account.md) - [Account types and classification](account-access-lifecycle/account-types-and-classification.md) - [Device registration and access](account-access-lifecycle/device-registration-and-access.md) From 2717e4d21140bc6c7f8f72f86eebc7a710223d73 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:46:58 +0800 Subject: [PATCH 13/19] Create securing-account.md --- docs/securing-account.md | 88 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 docs/securing-account.md diff --git a/docs/securing-account.md b/docs/securing-account.md new file mode 100644 index 0000000..f627edf --- /dev/null +++ b/docs/securing-account.md @@ -0,0 +1,88 @@ +# Securing your account + +TechPass is built with multiple layers of security to help protect your identity and access to Whole-of-Government (WOG) services. However, security is a shared responsibility between you, your agency, connected services, and the identity provider. + +This page outlines key security measures in place and your role in keeping your account secure. + +--- + +## Shared responsibility model + +| Party | Responsibilities | +| --- | --- | +| **You (end user)** | Use secure devices, approve sign-ins carefully, and report suspicious activity. | +| **Your agency** | Provision and deprovision accounts appropriately, manage staff movements, and ensure user access is up to date. | +| **Services** | Enforce access reviews and role-based access control. | +| **Identity provider (Microsoft Entra ID)** | Provide SSO, MFA, identity protection, and enforce conditional access policies. | + +--- + +## Security controls in place + +### 1. Single sign-on (SSO) +TechPass provides SSO across supported services, so you only need to authenticate once. This reduces password fatigue and lowers the risk of password reuse. + +### 2. Multifactor authentication (MFA) +You must approve sign-ins using MFA via Microsoft Authenticator. + +**What you should do:** +- Only approve sign-ins you initiated. +- Always check the location and app name in the MFA prompt. +- If unsure, reject the request and inform your TechPass administrator. + +### 3. Conditional Access Policies (CAP) +Microsoft Entra monitors for risky sign-ins. If detected, CAPs are triggered to prompt reauthentication and reapproval of MFA. + +**What happens:** +- You may be forced to log in again or verify identity. +- Risky sign-ins are automatically blocked or challenged. + +### 4. Device registration +Some services like SEED require device registration. This ensures that only authorised and compliant devices can access sensitive data. + +- Devices may need to be registered with Intune or MDM. +- Users may be blocked from signing in on unregistered devices. + +### 5. Role-based access control (RBAC) +Services such as GCC and StackOps use role-based access to limit what users can see or do. This is enforced via Azure RBAC. + +- Roles are tied to least privilege principles. +- Admins must assign access deliberately. + +### 6. Access reviews +Access reviews help ensure only the right users retain access. + +- Services may regularly prompt you to confirm whether you still require access. +- Project administrators are expected to review user access lists periodically. + +### 7. Identity protection +Microsoft Entra's Identity Protection uses machine learning to detect: + +- Atypical sign-in locations +- Impossible travel scenarios +- Use of anonymising tools + +If detected, actions include: + +- Blocking access +- Prompting for MFA +- Notifying admins + +--- + +## Coming soon + +### Privileged Identity Management (PIM) +This feature will help agencies control elevated privileges by: + +- Granting time-bound access to sensitive roles +- Requiring approval before activation +- Enforcing just-in-time access + +--- + +## Summary + +Security is a shared effort. While TechPass and connected services enforce robust protections, you also play an essential role. Stay vigilant, review your access, and flag any suspicious activity. + +> **Need help?** [Raise a service request](raise-a-service-request). From 8e91ad1aa81830459b2cc9c8d8a82b49ca3cbc52 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:47:48 +0800 Subject: [PATCH 14/19] Create account-types-classification.md --- docs/account-types-classification.md | 32 ++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 docs/account-types-classification.md diff --git a/docs/account-types-classification.md b/docs/account-types-classification.md new file mode 100644 index 0000000..c966208 --- /dev/null +++ b/docs/account-types-classification.md @@ -0,0 +1,32 @@ +# Account types and classification + +Each user in TechPass is assigned an account type. This classification determines how access is provisioned and managed across systems, including SEED, GCC, and SHIP-HATS. + +Account type is automatically assigned when the user is onboarded or invited. + +--- + +## Account types + +| Account type | Description | +| --- | --- | +| `account:public_officer` | User is a public officer. These users can either sign up or be invited. | +| `account:vendor` | User is a vendor (e.g. working in an ODC or on a contract). Must be invited by a project team. | +| `account:temp` | User is a temporary staff member (e.g. interns, short-term hires). Must be invited by a project team. | + +--- + +## How account type is determined + +| Scenario | Assigned type | +| --- | --- | +| User signs up with a valid gov.sg email domain | `public_officer` | +| User is invited by a project team as a vendor or temporary staff | `vendor` or `temp` based on the invitation details | +| User account is provisioned via onboarding service with metadata | Automatically assigned based on metadata rules | + +--- + +## Why this matters + +- Account type affects approval flows and access provisioning. +- Certain From 0bc3dd5211e15377ff3bbb3947eca9c9312d04a0 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:48:18 +0800 Subject: [PATCH 15/19] Create device-registration-access.md --- docs/device-registration-access.md | 45 ++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 docs/device-registration-access.md diff --git a/docs/device-registration-access.md b/docs/device-registration-access.md new file mode 100644 index 0000000..c5a22e2 --- /dev/null +++ b/docs/device-registration-access.md @@ -0,0 +1,45 @@ +# Device registration and access + +To enhance security, some services require users to register their device before access is granted. This ensures that only compliant and managed devices can access sensitive government systems. + +--- + +## What is device registration? + +Device registration links a user’s identity to a specific device that meets organisational policies (e.g. antivirus, encryption, OS version). This is commonly managed through Intune or other mobile device management (MDM) solutions. + +--- + +## When is it required? + +| Service | Device registration required? | Notes | +| --- | --- | --- | +| SEED | ✅ Yes | Users must register their device via Intune before accessing SEED. | +| GCC | ❌ No | Access is based on identity and role, not device. | +| SHIP-HATS | ❌ No | No device requirement as of now. | + +> **Note:** Other services may impose their own device registration requirements in future. + +--- + +## How to register your device + +Follow the instructions provided by your agency. If you are accessing SEED, refer to the [Register Intune Device ID](../register-intune-device-id.md) guide. + +--- + +## Common issues + +| Issue | Explanation | Suggested fix | +| --- | --- | --- | +| "Blocked device" error | Device not recognised as compliant | Register via MDM and wait for sync | +| Unable to access SEED after new phone setup | New device not registered | Submit new Device ID | +| Device shows as compliant but access still blocked | Sync issue or delay | Contact your agency's IT support or [raise a service request](../raise-a-service-request.md) | + +--- + +## Shared responsibility + +- **User**: Must ensure their device is compliant and registered. +- **Agency**: Provides device management and ensures onboarding instructions are followed. +- **TechPass**: Enforces access policies bas From 2ddcad810f1237532635550aa9f3cf3b50d18c64 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:49:00 +0800 Subject: [PATCH 16/19] Create access-removal.md --- access-removal.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 access-removal.md diff --git a/access-removal.md b/access-removal.md new file mode 100644 index 0000000..bbacde6 --- /dev/null +++ b/access-removal.md @@ -0,0 +1,40 @@ +# Access removal scenarios + +Access to services through TechPass may be removed due to various reasons. This page outlines common scenarios and what happens in each case. + +--- + +## Common scenarios + +| Scenario | Trigger | What happens | User action | +| --- | --- | --- | --- | +| **User leaves the organisation** | Notified via HR system, TIVO, or manual request | TechPass account may be disabled or deleted. Access to SEED, GCC, and SHIP-HATS will be revoked. | No action needed unless access persists. | +| **Internal department transfer** | Not automatically detected | TechPass account remains unchanged. Access to previous projects may remain. | Notify project teams to update access. | +| **Device no longer compliant** | MDM reports non-compliance | Access to SEED and other device-bound services blocked. | Re-register device or contact IT support. | +| **Temporary project assignment ends** | TIVO system triggers expiry | TechPass access is revoked. | Inform project team if assignment continues. | +| **Manual removal by admin** | Tenant admin removes user | Access removed immediately from linked services. | No action needed unless removal is incorrect. | + +--- + +## What users should do + +- If you notice you still have access after departure, notify your former team. +- If you are unable to access a service unexpectedly, contact your project team or [raise a service request](../raise-a-service-request.md). + +--- + +## System limitations + +- **Delayed sync**: Some systems, such as SHIP-HATS and GitLab, only remove access weekly. +- **Lack of signals**: Internal transfers are not automatically flagged to TechPass. +- **Manual clean-up required**: Project teams must regularly review user access in tools like GitLab, SHIP-HATS, and CMP. + +> **Note:** Access reviews and user removal are part of each team’s ongoing responsibilities. TechPass helps enforce access policies but does not control project-specific tools. + +--- + +## Recommendations for project teams + +- Perform periodic access reviews, especially for SHIP-HATS and GitLab. +- Remove users manually when they depart or change roles. +- Use service request webhooks where available (e.g. CMP) to automate workflows. From 72b4e517ec101935026e50581ebc67eda66f467e Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:50:53 +0800 Subject: [PATCH 17/19] Rename access-removal.md to docs/access-removal.md --- access-removal.md => docs/access-removal.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename access-removal.md => docs/access-removal.md (100%) diff --git a/access-removal.md b/docs/access-removal.md similarity index 100% rename from access-removal.md rename to docs/access-removal.md From 9ccaedbe62580d55494f83d1cda3822f842ea730 Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 12:52:03 +0800 Subject: [PATCH 18/19] Update _sidebar.md --- docs/_sidebar.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/_sidebar.md b/docs/_sidebar.md index 433b9e3..708d3e3 100644 --- a/docs/_sidebar.md +++ b/docs/_sidebar.md @@ -14,10 +14,10 @@ - [Edit TechPass profile](edit-profile) - **Account and access lifecycle** - [Overview](account-access-lifecycle-overview) - - [Securing your account](account-access-lifecycle/securing-your-account.md) - - [Account types and classification](account-access-lifecycle/account-types-and-classification.md) - - [Device registration and access](account-access-lifecycle/device-registration-and-access.md) - - [Access removal scenarios](account-access-lifecycle/access-removal-scenarios.md) + - [Securing your account](securing-account.md) + - [Account types and classification](account-types-classification.md) + - [Device registration and access](device-registration-access.md) + - [Access removal scenarios](access-removal.md) - [Account lifecycle after departure](account-access-lifecycle/account-lifecycle-after-departure.md) - [FAQs](account-access-lifecycle/faqs.md) - **Reset MFA** From b96986d66202497d27a496b361d074a9c40b79fa Mon Sep 17 00:00:00 2001 From: kpslp <112363511+kpslp@users.noreply.github.com> Date: Wed, 16 Jul 2025 15:59:48 +0800 Subject: [PATCH 19/19] Update account-llifecycle.md --- docs/account-llifecycle.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/docs/account-llifecycle.md b/docs/account-llifecycle.md index 8094b4a..9e8d240 100644 --- a/docs/account-llifecycle.md +++ b/docs/account-llifecycle.md @@ -47,8 +47,3 @@ Most users do not need to take any action. However: | Tenant admin | Remove user access after receiving the email notification from TechPass. | | Project team | Review and clean up user access in tools such as SHIP-HATS or GitLab groups. | -## Limitations - -- Internal transfers within the same agency are not automatically detected. -- Some systems process access removal on a scheduled basis, which may cause delays. -- Manual steps are still required in many cases, especially for project-level tools.