From 9aea41f0cbf9329bb163f7697587646ead054629 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 23 Sep 2020 11:10:42 +0500 Subject: [PATCH 01/41] Updating logon event In this page, logon events were listed for Windows Xp, 7. I have updated them to Windows 10. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/7178 --- .../auditing/basic-audit-logon-events.md | 33 ++++--------------- 1 file changed, 6 insertions(+), 27 deletions(-) diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 5c7672c13a..e03cf0d1ce 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -38,33 +38,12 @@ You can configure this security setting by opening the appropriate policy under | Logon events | Description | | - | - | -| 528 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | -| 529 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | -| 530 | Logon failure. A logon attempt was made user account tried to log on outside of the allowed time. | -| 531 | Logon failure. A logon attempt was made using a disabled account. | -| 532 | Logon failure. A logon attempt was made using an expired account. | -| 533 | Logon failure. A logon attempt was made by a user who is not allowed to log on at this computer. | -| 534 | Logon failure. The user attempted to log on with a type that is not allowed. | -| 535 | Logon failure. The password for the specified account has expired. | -| 536 | Logon failure. The Net Logon service is not active. | -| 537 | Logon failure. The logon attempt failed for other reasons. | -| 538 | The logoff process was completed for a user. | -| 539 | Logon failure. The account was locked out at the time the logon attempt was made. | -| 540 | A user successfully logged on to a network. | -| 541 | Main mode Internet Key Exchange (IKE) authentication was completed between the local computer and the listed peer identity (establishing a security association), or quick mode has established a data channel. | -| 542 | A data channel was terminated. | -| 543 | Main mode was terminated. | -| 544 | Main mode authentication failed because the peer did not provide a valid certificate or the signature was not validated. | -| 545 | Main mode authentication failed because of a Kerberos failure or a password that is not valid. | -| 546 | IKE security association establishment failed because the peer sent a proposal that is not valid. A packet was received that contained data that is not valid. | -| 547 | A failure occurred during an IKE handshake. | -| 548 | Logon failure. The security ID (SID) from a trusted domain does not match the account domain SID of the client. | -| 549 | Logon failure. All SIDs corresponding to untrusted namespaces were filtered out during an authentication across forests. | -| 550 | Notification message that could indicate a possible denial-of-service attack. | -| 551 | A user initiated the logoff process. | -| 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | -| 682 | A user has reconnected to a disconnected terminal server session. | -| 683 | A user disconnected a terminal server session without logging off. | +| 4624 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | +| 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | +| 4634 | The logoff process was completed for a user. | +| 4647 | A user initiated the logoff process. | +| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | +| 4779 | A user disconnected a terminal server session without logging off. | When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. From f1eaf7601089582606509c69f35b7914b71d8ac5 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 28 Sep 2020 20:00:39 +0500 Subject: [PATCH 02/41] Update windows-editions-for-education-customers.md --- .../windows/windows-editions-for-education-customers.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 80555a4b90..7b99e740f1 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -32,8 +32,8 @@ Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and For Cortana[1](#footnote1), - If you're using version 1607, Cortana is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). @@ -51,8 +51,8 @@ Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise For Cortana1, - If you're using version 1607, Cortana1 is removed. -- If you're using new devices with version 1703, Cortana is turned on by default. -- If you're upgrading from version 1607 to version 1703, Cortana will be enabled. +- If you're using new devices with version 1703 or later, Cortana is turned on by default. +- If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. You can use the **AllowCortana** policy to turn Cortana off. For more information, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). From 5d1075ddb39180193b63d7f198a72ce80e48f655 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 5 Oct 2020 22:09:12 +0500 Subject: [PATCH 03/41] Update windows/security/threat-protection/auditing/basic-audit-logon-events.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../threat-protection/auditing/basic-audit-logon-events.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index e03cf0d1ce..66c1906086 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -42,7 +42,7 @@ You can configure this security setting by opening the appropriate policy under | 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | | 4634 | The logoff process was completed for a user. | | 4647 | A user initiated the logoff process. | -| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | +| 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | | 4779 | A user disconnected a terminal server session without logging off. | From 81f2746fc4fe49026bf94ff34fc225c75272ce1b Mon Sep 17 00:00:00 2001 From: aktsuda Date: Thu, 8 Oct 2020 15:42:37 +0900 Subject: [PATCH 04/41] Update kernel-dma-protection-for-thunderbolt.md Changed Note to "**Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-kernel-dma-protection)." --- .../kernel-dma-protection-for-thunderbolt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 2d8554f52b..859064bfc0 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -91,7 +91,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if - Reboot system into Windows 10. >[!NOTE] -> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES. +> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-kernel-dma-protection). 4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. From 08ec329b9d52b3d29654170721b360ccc178a21b Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 9 Oct 2020 15:28:20 +0200 Subject: [PATCH 05/41] Credential Guard: Enterprise & Education SKU Just to make it clear that Credential Guard is not supported on Windows 10 Pro or Windows 10 Home edition Ref. closed issue ticket #4025 --- .../credential-guard/credential-guard-manage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 32bf1aabaf..1e5ca4586a 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -22,7 +22,7 @@ ms.custom: **Applies to** - Windows 10 <=1903 Enterprise and Education SKUs -- Windows 10 >=1909 +- Windows 10 >=1909 Enterprise and Education SKUs - Windows Server 2016 - Windows Server 2019 From 3940dc0089abfa5ffc682f5cfbca099f3358e826 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 9 Oct 2020 15:39:49 +0200 Subject: [PATCH 06/41] Credential Guard: Enterprise & Education SKU Ref. closed issue ticket #4025 and PR #8435 Just to make it clear that Credential Guard is not supported on Windows 10 Pro or Windows 10 Home edition Thanks to @JonZeolla for raising the question by opening the ticket. Thanks to @tecxx for taking the time to create and follow up CRM:0773000358 (MSRC). --- .../credential-guard/credential-guard-requirements.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index cdf9c3ec9a..79de4b8ec8 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -19,7 +19,7 @@ ms.reviewer: # Windows Defender Credential Guard: Requirements **Applies to** -- Windows 10 +- Windows 10 Enterprise and Education SKUs - Windows Server 2016 @@ -56,11 +56,11 @@ For information about Windows Defender Remote Credential Guard hardware and soft When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatibility with the reduced functionality. ->[!WARNING] +> [!WARNING] > Enabling Windows Defender Credential Guard on domain controllers is not supported.
> The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes. ->[!NOTE] +> [!NOTE] > Windows Defender Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Windows Defender Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). Applications will break if they require: From 37266f65295520da475310c0627de02f11e01c8e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 9 Oct 2020 19:01:51 +0200 Subject: [PATCH 07/41] Merge into 1 line - Clarify that only Windows 10 Enterprise or Education SKUs are covered. --- .../credential-guard/credential-guard-manage.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 1e5ca4586a..0b0c7e3af3 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -21,8 +21,7 @@ ms.custom: # Manage Windows Defender Credential Guard **Applies to** -- Windows 10 <=1903 Enterprise and Education SKUs -- Windows 10 >=1909 Enterprise and Education SKUs +- Windows 10 Enterprise or Education SKUs - Windows Server 2016 - Windows Server 2019 From 42b0c8ff76af5a364001d968de969b4c42d9f965 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sun, 11 Oct 2020 08:39:30 +0500 Subject: [PATCH 08/41] Update how-user-account-control-works.md --- .../user-account-control/how-user-account-control-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 560f4b240c..f25477e9ad 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -278,7 +278,7 @@ The slider will never turn UAC completely off. If you set it to Never notify< > **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. > -> **Warning:** Universal Windows apps will not work when UAC is disabled. +> **Warning:** Some Universal Windows apps may not work when UAC is disabled. ### Virtualization From 9e90ea017a38107796ef99cbef5f838e76d626b6 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 12 Oct 2020 09:39:33 +0500 Subject: [PATCH 09/41] Update windows/security/identity-protection/user-account-control/how-user-account-control-works.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../user-account-control/how-user-account-control-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index f25477e9ad..042e28e960 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -278,7 +278,7 @@ The slider will never turn UAC completely off. If you set it to Never notify< > **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. > -> **Warning:** Some Universal Windows apps may not work when UAC is disabled. +> **Warning:** Some Universal Windows Platform apps may not work when UAC is disabled. ### Virtualization From e59c706d86f628478c7f566d412b2bbce00d9582 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 12 Oct 2020 21:04:39 +0500 Subject: [PATCH 10/41] Addition of information in Note Add additional information in the Note section to enable policy to work. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8241 --- windows/security/identity-protection/remote-credential-guard.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 373339ebcd..0e6a67a9e5 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -109,6 +109,8 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > [!NOTE] > Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain. +> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for Delegation of non-exportable credentials. + - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. - The remote host must be running at least Windows 10 version 1607, or Windows Server 2016. - The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard. From a8dd40616c11690ef6177528fd598215aefd4d3c Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 12 Oct 2020 23:08:53 +0500 Subject: [PATCH 11/41] Update windows/security/identity-protection/remote-credential-guard.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/security/identity-protection/remote-credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 0e6a67a9e5..a2dffe193f 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -109,7 +109,7 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > [!NOTE] > Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain. -> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for Delegation of non-exportable credentials. +> GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials. - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. - The remote host must be running at least Windows 10 version 1607, or Windows Server 2016. From 3ef680b8308b50de54d3dbe2593d1c8998f95df3 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 14 Oct 2020 10:13:26 -0700 Subject: [PATCH 12/41] Update kernel-dma-protection-for-thunderbolt.md removed en-us from URL line 94 --- .../kernel-dma-protection-for-thunderbolt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 859064bfc0..dac9d8ce02 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -91,7 +91,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if - Reboot system into Windows 10. >[!NOTE] -> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-kernel-dma-protection). +> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection). 4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. From 99f3ecea1a7857559ba831601601ba6bebc0045a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 15 Oct 2020 17:41:33 -0700 Subject: [PATCH 13/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index a71f13399e..831c1204f8 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -12,7 +12,7 @@ ms.author: deniseb ms.reviewer: manager: dansimp ms.custom: nextgen -ms.date: 08/26/2020 +ms.date: 10/15/2020 --- # Turn on block at first sight From d09202414096f80cbd1364fccc5d8c1626912c66 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 19 Oct 2020 23:59:59 +0200 Subject: [PATCH 14/41] Update windows/security/identity-protection/credential-guard/credential-guard-requirements.md Unneeded blank line added during resolve of file conflict, line removed. --- .../credential-guard/credential-guard-requirements.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index dd65abcdca..315c4bad46 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -18,7 +18,6 @@ ms.reviewer: # Windows Defender Credential Guard: Requirements - ## Applies to - Windows 10 From 8f2c0fe56cd6f668ccd5ea9bbb1b06e3a263b412 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 20 Oct 2020 00:02:06 +0200 Subject: [PATCH 15/41] Update windows/security/identity-protection/credential-guard/credential-guard-requirements.md Another unneeded blank line added during merge of branch 'public' into PR branch. Line removed. --- .../credential-guard/credential-guard-requirements.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 315c4bad46..2e56e0803c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -58,7 +58,6 @@ For information about Windows Defender Remote Credential Guard hardware and soft When Windows Defender Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatibility with the reduced functionality. - > [!WARNING] > Enabling Windows Defender Credential Guard on domain controllers is not supported. > The domain controller hosts authentication services which integrate with processes isolated when Windows Defender Credential Guard is enabled, causing crashes. From bde764ac498bd7e5b159aa42f7adbd8fccdcb139 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 13:39:50 -0700 Subject: [PATCH 16/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...irst-sight-microsoft-defender-antivirus.md | 117 ++++++------------ 1 file changed, 39 insertions(+), 78 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 831c1204f8..054bb0b89e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Enable Block at First Sight to detect malware in seconds +title: Enable block at first sight to detect malware in seconds description: Turn on the block at first sight feature to detect and block malware within seconds, and validate that it is configured correctly. keywords: scan, BAFS, malware, first seen, first sight, cloud, defender search.product: eADQiWindows 10XVcnh @@ -12,7 +12,7 @@ ms.author: deniseb ms.reviewer: manager: dansimp ms.custom: nextgen -ms.date: 10/15/2020 +ms.date: 10/22/2020 --- # Turn on block at first sight @@ -24,9 +24,9 @@ ms.date: 10/15/2020 - Microsoft Defender Antivirus -Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are also enabled. In most cases, these prerequisite settings are also enabled by default, so the feature is running without any intervention. +Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (usually set to 50), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. -You can [specify how long the file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. +You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. >[!TIP] >Visit the Microsoft Defender ATP demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. @@ -46,103 +46,64 @@ If the cloud backend is unable to make a determination, Microsoft Defender Antiv In many cases, this process can reduce the response time for new malware from hours to seconds. -## Confirm and validate that block at first sight is turned on +## Turn on block at first sight with Microsoft Intune -Block at first sight requires a number of settings to be configured correctly or it will not work. These settings are enabled by default in most enterprise Microsoft Defender Antivirus deployments. +> [!TIP] +> Microsoft Intune is now part of Microsoft Endpoint Manager. -### Confirm block at first sight is turned on with Intune +1. In the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), navigate to **Devices** > **Configuration profiles**. -1. In Intune, navigate to **Device configuration - Profiles** > *Profile name* > **Device restrictions** > **Microsoft Defender Antivirus**. +2. Select or create a profile using the **Device restrictions** profile type. - > [!NOTE] - > The profile you select must be a Device Restriction profile type, not an Endpoint Protection profile type. +3. In the **Configuration settings** for the Device restrictions profile, set or confirm the following settings under **Microsoft Defender Antivirus**: -2. Verify these settings are configured as follows: - - - **Cloud-delivered protection**: **Enable** - - **File Blocking Level**: **High** - - **Time extension for file scanning by the cloud**: **50** - - **Prompt users before sample submission**: **Send all data without prompting** + - **Cloud-delivered protection**: Enabled + - **File Blocking Level**: High + - **Time extension for file scanning by the cloud**: 50 + - **Prompt users before sample submission**: Send all data without prompting ![Intune config](images/defender/intune-block-at-first-sight.png) - > [!WARNING] - > Setting the file blocking level to **High** will apply a strong level of detection. In the unlikely event that it causes a false positive detection of legitimate files, use the option to [restore the quarantined files](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus). +4. Save your settings. -For more information about configuring Microsoft Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). +> [!TIP] +> - Setting the file blocking level to **High** applies a strong level of detection. In the unlikely event that file blocking causes a false positive detection of legitimate files, you can [restore quarantined files](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus). +> - For more information about configuring Microsoft Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). +> - For a list of Microsoft Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus). -For a list of Microsoft Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](https://docs.microsoft.com/intune/device-restrictions-windows-10#microsoft-defender-antivirus). +## Turn on block at first sight with Microsoft Endpoint Manager -### Turn on block at first sight with Microsoft Endpoint Configuration Manager +1. In Microsoft Endpoint Manager ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), go to **Endpoint security** > **Antivirus**. -1. In Microsoft Endpoint Configuration Manager, click **Assets and Compliance** > **Endpoint Protection** > **AntiMalware Policies**. +2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. -2. Click **Home** > **Create Antimalware Policy**. +3. Set or confirm the following configuration settings: -3. Enter a name and a description, and add these settings: - - **Real time protection** - - **Advanced** - - **Cloud Protection Service** + - **Turn on cloud-delivered protection**: Yes + - **Cloud-delivered protection level**: High + - **Defender Cloud Extended Timeout in Seconds**: 50 -4. In the left column, click **Real time protection**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. - ![Enable real-time protection](images/defender/sccm-real-time-protection.png) +4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. -5. Click **Advanced**, set **Enable real-time protection** to **Yes**, and set **Scan system files** to **Scan incoming and outgoing files**. - ![Enable Advanced settings](images/defender/sccm-advanced-settings.png) +## Turn on block at first sight Group Policy -6. Click **Cloud Protection Service**, set **Cloud Protection Service membership type** to **Advanced membership**, set **Level for blocking suspicious files** to **High**, and set **Allow extended cloud check to block and scan suspicious files for up to (seconds)** to **50** seconds. - ![Enable Cloud Protection Service](images/defender/sccm-cloud-protection-service.png) - -7. Click **OK** to create the policy. - -### Confirm block at first sight is turned on with Group Policy +> [!NOTE] +> We recommend using Intune or Microsoft Endpoint Manager to turn on block at first sight. 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. -3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **MAPS**, configure the following Group Policies, and then click **OK**: - - 1. Double-click **Join Microsoft MAPS** and ensure the option is set to **Enabled**. Click **OK**. - - 2. Double-click **Send file samples when further analysis is required** and ensure the option is set to **Enabled** and the additional options are either **Send safe samples (1)** or **Send all samples (3)**. +3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then click **OK**. > [!WARNING] > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. -4. In the **Group Policy Management Editor**, expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Real-time Protection**: +4. In the MAPS section, double-click **Send file samples when further analysis is required**, and set it to **Enabled**. Under **Send file samples when further analysis is required**, select **Send all samples**, and then click **OK**. - 1. Double-click **Scan all downloaded files and attachments** and ensure the option is set to **Enabled**, and then click **OK**. +5. If you had to changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. - 2. Double-click **Turn off real-time protection** and ensure the option is set to **Disabled**, and then click **OK**. - -5. In the **Group Policy Management Editor**, expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **MpEngine**: - - 1. Double-click **Select cloud protection level** and ensure the option is set to **Enabled**. - - 2. Ensure that **Select cloud blocking level** section on the same page is set to **High blocking level**, and then click **OK**. - -If you had to change any of the settings, you should redeploy the Group Policy Object across your network to ensure all endpoints are covered. - -### Confirm block at first sight is turned on with Registry editor - -1. Start Registry Editor. - -2. Go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet`, and make sure that - - 1. **SpynetReporting** key is set to **1** - - 2. **SubmitSamplesConsent** key is set to either **1** (Send safe samples) or **3** (Send all samples) - -3. Go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection`, and make sure that - - 1. **DisableIOAVProtection** key is set to **0** - - 2. **DisableRealtimeMonitoring** key is set to **0** - -4. Go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\MpEngine`, and make sure that the **MpCloudBlockLevel** key is set to **2** - -### Confirm Block at First Sight is enabled on individual clients +## Confirm Block at First Sight is enabled on individual clients You can confirm that block at first sight is enabled on individual clients using Windows security settings. @@ -159,16 +120,16 @@ Block at first sight is automatically enabled as long as **Cloud-delivered prote > [!NOTE] > If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. -### Validate block at first sight is working +## Validate block at first sight is working You can validate that the feature is working by following the steps outlined in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). ## Turn off block at first sight -> [!WARNING] -> Turning off block at first sight will lower the protection state of the endpoint and your network. +> [!CAUTION] +> Turning off block at first sight will lower the protection state of your device(s) and your network. -You may choose to disable block at first sight if you want to retain the prerequisite settings without using block at first sight protection. You might wish to do this if you are experiencing latency issues or you want to test the feature's impact on your network. +You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do this if you are experiencing latency issues or you want to test the feature's impact on your network. We do not recommend disabling block at first sight protection. ### Turn off block at first sight with Group Policy From af285dc47b60a228daec97b1d3b53b853f39a9b1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 13:44:48 -0700 Subject: [PATCH 17/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...gure-block-at-first-sight-microsoft-defender-antivirus.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 054bb0b89e..0d81f2a70d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -96,7 +96,7 @@ In many cases, this process can reduce the response time for new malware from ho 3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then click **OK**. - > [!WARNING] + > [!IMPORTANT] > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. 4. In the MAPS section, double-click **Send file samples when further analysis is required**, and set it to **Enabled**. Under **Send file samples when further analysis is required**, select **Send all samples**, and then click **OK**. @@ -118,7 +118,8 @@ Block at first sight is automatically enabled as long as **Cloud-delivered prote 3. Confirm that **Cloud-delivered protection** and **Automatic sample submission** are both turned on. > [!NOTE] -> If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. +> - If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. +> - Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. ## Validate block at first sight is working From f430f19ec793687265604b3b1c1245a57177cc12 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 13:58:04 -0700 Subject: [PATCH 18/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...igure-block-at-first-sight-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 0d81f2a70d..13f926b10b 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -85,7 +85,7 @@ In many cases, this process can reduce the response time for new malware from ho 4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. -## Turn on block at first sight Group Policy +## Turn on block at first sight with Group Policy > [!NOTE] > We recommend using Intune or Microsoft Endpoint Manager to turn on block at first sight. @@ -103,7 +103,7 @@ In many cases, this process can reduce the response time for new malware from ho 5. If you had to changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. -## Confirm Block at First Sight is enabled on individual clients +## Confirm block at first sight is enabled on individual clients You can confirm that block at first sight is enabled on individual clients using Windows security settings. From 91af155ea75e17a3ad7267e73947077d165e6ce0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 13:58:43 -0700 Subject: [PATCH 19/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 13f926b10b..6c2e17f67f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -101,7 +101,7 @@ In many cases, this process can reduce the response time for new malware from ho 4. In the MAPS section, double-click **Send file samples when further analysis is required**, and set it to **Enabled**. Under **Send file samples when further analysis is required**, select **Send all samples**, and then click **OK**. -5. If you had to changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. +5. If you changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. ## Confirm block at first sight is enabled on individual clients From 69893e42a88a78a462a4e94eafdfc073f3e3a026 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 14:02:18 -0700 Subject: [PATCH 20/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...ure-block-at-first-sight-microsoft-defender-antivirus.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 6c2e17f67f..acddc75b8a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -24,7 +24,7 @@ ms.date: 10/22/2020 - Microsoft Defender Antivirus -Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (usually set to 50), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. +Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. @@ -40,7 +40,7 @@ Microsoft Defender Antivirus uses multiple detection and prevention technologies In Windows 10, version 1803 or later, block at first sight can block non-portable executable files (such as JS, VBS, or macros) as well as executable files. -Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if this is a previously undetected file. +Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if the file is a previously undetected file. If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs additional analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or safe. @@ -90,7 +90,7 @@ In many cases, this process can reduce the response time for new malware from ho > [!NOTE] > We recommend using Intune or Microsoft Endpoint Manager to turn on block at first sight. -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. 2. In the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. From 8e366c8f8c2b210f12e74c31eb86ac527a1bd6e6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 14:15:26 -0700 Subject: [PATCH 21/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index acddc75b8a..9ed0b239da 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -94,7 +94,7 @@ In many cases, this process can reduce the response time for new malware from ho 2. In the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. -3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then click **OK**. +3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then select **OK**. > [!IMPORTANT] > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. From 813ca87003e52717b4132b486d03959dbe3430da Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:04:34 -0700 Subject: [PATCH 22/41] Applied note styles and corrected table header cells --- .../how-user-account-control-works.md | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 042e28e960..254e57e0e9 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -109,9 +109,7 @@ To better understand each component, review the table below: Description - -

User

- +User @@ -138,9 +136,7 @@ To better understand each component, review the table below: - -

System

- +System @@ -248,8 +244,7 @@ To better understand each component, review the table below: - -

Kernel

+Kernel @@ -276,9 +271,11 @@ The slider will never turn UAC completely off. If you set it to Never notify< - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - Automatically deny all elevation requests for standard users. -> **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. -> -> **Warning:** Some Universal Windows Platform apps may not work when UAC is disabled. +> [!IMPORTANT] +> In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. + +> [!WARNING] +> Some Universal Windows Platform apps may not work when UAC is disabled. ### Virtualization @@ -291,7 +288,9 @@ Most app tasks operate properly by using virtualization features. Although virtu Virtualization is not an option in the following scenarios: - Virtualization does not apply to apps that are elevated and run with a full administrative access token. + - Virtualization supports only 32-bit apps. Non-elevated 64-bit apps simply receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations. + - Virtualization is disabled if the app includes an app manifest with a requested execution level attribute. ### Request execution levels @@ -319,6 +318,8 @@ Before a 32-bit process is created, the following attributes are checked to dete - Key attributes in the resource script data are linked in the executable file. - There are targeted sequences of bytes within the executable file. -> **Note:** The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -> -> **Note:** The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). +> [!NOTE] +> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. + +> [!NOTE] +> The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). From 4389f5e61fd099aa986f5192fdade8b610e420f3 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:09:52 -0700 Subject: [PATCH 23/41] Removed unnecessary bold from table headings Table headings are automatically bold. Adding bold ( or **) to table headings results in bold text that is lighter than normal. --- .../remote-credential-guard.md | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index a2dffe193f..1f3c3a4fa9 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -53,7 +53,7 @@ Use the following table to compare different Remote Desktop connection security
-| **Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** | +| Feature | Remote Desktop | Windows Defender Remote Credential Guard | Restricted Admin mode | |--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server | | **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | @@ -67,7 +67,7 @@ Use the following table to compare different Remote Desktop connection security
For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx) -and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)) +and [How Kerberos works](https://technet.microsoft.com/library/cc961963.aspx(d=robot)).
@@ -92,9 +92,12 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. +- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. + - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. + - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. + - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. The Remote Desktop remote host: @@ -112,7 +115,9 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials. - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. + - The remote host must be running at least Windows 10 version 1607, or Windows Server 2016. + - The Remote Desktop classic Windows app is required. The Remote Desktop Universal Windows Platform app doesn't support Windows Defender Remote Credential Guard. ## Enable Windows Defender Remote Credential Guard @@ -120,15 +125,20 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. You must enable Restricted Admin or Windows Defender Remote Credential Guard on the remote host by using the Registry. 1. Open Registry Editor on the remote host. + 2. Enable Restricted Admin and Windows Defender Remote Credential Guard: + - Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa. + - Add a new DWORD value named **DisableRestrictedAdmin**. + - To turn on Restricted Admin and Windows Defender Remote Credential Guard, set the value of this registry setting to 0 to turn on Windows Defender Remote Credential Guard. + 3. Close Registry Editor. You can add this by running the following command from an elevated command prompt: -``` +```console reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD ``` @@ -145,6 +155,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: + - If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used. > [!NOTE] @@ -165,7 +176,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C If you don't use Group Policy in your organization, or if not all your remote hosts support Remote Credential Guard, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Windows Defender Remote Credential Guard for that connection. -``` +```console mstsc.exe /remoteGuard ``` From 474fd1f2dca54ddfd5221ea56a48e7353cff11a9 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:16:10 -0700 Subject: [PATCH 24/41] Added space for reliability, corrected indentation --- .../credential-guard-manage.md | 39 +++++++++++++------ 1 file changed, 28 insertions(+), 11 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 0b0c7e3af3..6175ac1e5e 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -178,15 +178,25 @@ DG_Readiness_Tool_v3.6.ps1 -Ready - We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0** - - The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run. - - The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**. - - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. - - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**. + + - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. + + - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: \[**0x0** \| **0x1** \| **0x2**\], **0** + + - The first variable: **0x1** or **0x2** means that Windows Defender Credential Guard is configured to run. **0x0** means that it's not configured to run. + + - The second variable: **0** means that it's configured to run in protect mode. **1** means that it's configured to run in test mode. This variable should always be **0**. + + - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. + + - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] + + - **Event ID 17** Error reading Windows Defender Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] + + You can also verify that TPM is being used for key protection by checking Event ID 51 in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. + + - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: **0x0**. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: **0x1**. TPM PCR mask: **0x0**. + - You can use Windows PowerShell to determine whether credential guard is running on a client computer. On the computer in question, open an elevated PowerShell window and run the following command: ```powershell @@ -194,10 +204,13 @@ DG_Readiness_Tool_v3.6.ps1 -Ready ``` This command generates the following output: + - **0**: Windows Defender Credential Guard is disabled (not running) + - **1**: Windows Defender Credential Guard is enabled (running) - > [!NOTE] - > Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running. + + > [!NOTE] + > Checking the task list or Task Manager to see if LSAISO.exe is running is not a recommended method for determining whether Windows Defender Credential Guard is running. ## Disable Windows Defender Credential Guard @@ -206,12 +219,15 @@ To disable Windows Defender Credential Guard, you can use the following set of p 1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). 2. Delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags 3. If you also wish to disable virtualization-based security delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures + > [!IMPORTANT] > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. @@ -260,6 +276,7 @@ DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot > [!IMPORTANT] > When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. #### Disable Windows Defender Credential Guard for a virtual machine From 7b1f9fc967cc87c7fa9148e8d0c0d7a69da276e8 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:18:16 -0700 Subject: [PATCH 25/41] Spacing --- .../credential-guard/credential-guard-manage.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 6175ac1e5e..742dd80951 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -118,12 +118,15 @@ You can do this by using either the Control Panel or the Deployment Image Servic 2. Enable virtualization-based security: - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. + - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. + - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. 3. Enable Windows Defender Credential Guard: - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. + - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it. 4. Close Registry Editor. @@ -144,6 +147,7 @@ DG_Readiness_Tool.ps1 -Enable -AutoReboot > [!IMPORTANT] > When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. ### Review Windows Defender Credential Guard performance @@ -170,6 +174,7 @@ DG_Readiness_Tool_v3.6.ps1 -Ready > [!IMPORTANT] > When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> > This is a known issue. > [!NOTE] From 5b6cdbdd9bbd22633634d3d227958cb2b1e43501 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:19:13 -0700 Subject: [PATCH 26/41] Corrected end punctuation --- education/windows/windows-editions-for-education-customers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 7b99e740f1..4197cf6869 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -30,7 +30,7 @@ Windows 10, version 1607 introduces two editions designed for the unique needs o Windows 10 Pro Education builds on the commercial version of Windows 10 Pro and provides important management controls needed in schools. Windows 10 Pro Education is effectively a variant of Windows 10 Pro that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana[1](#footnote1), +For Cortana[1](#footnote1): - If you're using version 1607, Cortana is removed. - If you're using new devices with version 1703 or later, Cortana is turned on by default. - If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. @@ -49,7 +49,7 @@ Customers who deploy Windows 10 Pro are able to configure the product to have si Windows 10 Education builds on Windows 10 Enterprise and provides the enterprise-grade manageability and security desired by many schools. Windows 10 Education is effectively a variant of Windows 10 Enterprise that provides education-specific default settings. These default settings disable tips, tricks and suggestions & Microsoft Store suggestions. More detailed information on these default settings is available in [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](https://go.microsoft.com/fwlink/?LinkId=822627). -For Cortana1, +For Cortana1: - If you're using version 1607, Cortana1 is removed. - If you're using new devices with version 1703 or later, Cortana is turned on by default. - If you're upgrading from version 1607 to version 1703 or later, Cortana will be enabled. From 11a57840a4337162b4544b7aa46551cf94a708dc Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:21:10 -0700 Subject: [PATCH 27/41] Corrected indentation --- .../kernel-dma-protection-for-thunderbolt.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index dac9d8ce02..836d7916f5 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -82,20 +82,24 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if ### Using System information 1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar. + 2. Check the value of **Kernel DMA Protection**. + ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) + 3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: + - Reboot into BIOS settings - Turn on Intel Virtualization Technology. - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). - Reboot system into Windows 10. ->[!NOTE] -> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection). + >[!NOTE] + > **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES and the **Hyper-V** Windows feature is enabled. Enabling both is needed to enable **Kernel DMA Protection** even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection). 4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature. -For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. + For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection. ## Frequently asked questions From da7e9d44d8637b3c83141dfd43ad8ced82421bf9 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 22 Oct 2020 15:26:57 -0700 Subject: [PATCH 28/41] Fixed a broken note --- windows/security/identity-protection/remote-credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 1f3c3a4fa9..60dc685e1e 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -111,7 +111,7 @@ There are no hardware requirements for Windows Defender Remote Credential Guard. > [!NOTE] > Remote Desktop client devices running earlier versions, at minimum Windows 10 version 1607, only support signed-in credentials, so the client device must also be joined to an Active Directory domain. Both Remote Desktop client and server must either be joined to the same domain, or the Remote Desktop server can be joined to a domain that has a trust relationship to the client device's domain. - +> > GPO [Remote host allows delegation of non-exportable credentials](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialsdelegation) should be enabled for delegation of non-exportable credentials. - For Windows Defender Remote Credential Guard to be supported, the user must authenticate to the remote host using Kerberos authentication. From fc68e8d917065cc9a2e92a0645152fe660d571ed Mon Sep 17 00:00:00 2001 From: "H. Poulsen" Date: Thu, 22 Oct 2020 15:28:24 -0700 Subject: [PATCH 29/41] Update safeguard-holds.md Fixed typos and Windows release health links. --- windows/deployment/update/safeguard-holds.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md index 558b46cea1..003834c35c 100644 --- a/windows/deployment/update/safeguard-holds.md +++ b/windows/deployment/update/safeguard-holds.md @@ -12,19 +12,20 @@ ms.topic: article # Safeguard holds -Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. +Microsoft uses quality and compatibility data to identify issues that might cause a Windows 10 feature update to fail or roll back. When we find such an issue, we might apply holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available. Safeguard holds prevent a device with a known issue from being offered a new operating system version. We renew the offering once a fix is found and verified. We use holds to ensure customers have a successful experience as their device moves to a new version of Windows 10. The lifespan of holds varies depending on the time required to investigate and fix an issue. During this time Microsoft works diligently to procure, develop, and validate a fix and then offer it to affected devices. We monitor quality and compatibility data to confirm that a fix is complete before releasing the hold. Once we release the hold, Windows Update will resume offering new operating system versions to devices. -Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services (WSUS)) to remain aware of known issues that might also be present in their environments. + +Safeguard holds only affect devices that use the Window Update service for updates. We encourage IT admins who manage updates to devices through other channels (such as media installations or updates coming from Windows Server Update Services) to remain aware of known issues that might also be present in their environments. ## Am I affected by a safeguard hold? IT admins can use [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) to monitor various update health metrics for devices in their organization, including ones affected by a safeguard hold that prevents them from updating to a newer operating system version. -Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows Release Health](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) dashboard, where you can easily find information related to publicly available safeguards. +Queries identify Safeguard IDs for each affected device, giving IT admins a detailed view into the various protections extended to devices. Safeguard IDs for publicly discussed known issues are also included in the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard, where you can easily find information related to publicly available safeguards. On devices that use Windows Update (but not Windows Update for Business), the **Windows Update** page in the Settings app displays a message stating that an update is on its way, but not ready for the device. Instead of the option to download and install the update, users will see this message: @@ -40,4 +41,4 @@ We recommend that you do not attempt to manually update until issues have been r > [!CAUTION] > Opting out of a safeguard hold can put devices at risk from known performance issues. We strongly recommend that you complete robust testing to ensure the impact is acceptable before opting out. -With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows Release Health](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, protection of safeguard holds is reinstated automatically. +With that in mind, IT admins who stay informed with [Update Compliance](update-compliance-feature-update-status.md#safeguard-holds) and the [Windows release health](https://aka.ms/windowsreleasehealth) dashboard can choose to temporarily [opt-out of the protection of all safeguard holds](safeguard-opt-out.md) and allow an update to proceed. We recommend opting out only in an IT environment and for validation purposes. If you do opt out of a hold, this condition is temporary. Once an update is complete, the protection of safeguard holds is reinstated automatically. From 5494cb0f161fd80d0239c3cc2b1c92f22deb7cbc Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Thu, 22 Oct 2020 20:53:09 -0700 Subject: [PATCH 30/41] Release notes for 101.09.61 --- .../microsoft-defender-atp/mac-preferences.md | 12 ++++++++++++ .../microsoft-defender-atp/mac-whatsnew.md | 6 ++++++ 2 files changed, 18 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md index ec94cef29a..1646fb22ea 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md @@ -338,6 +338,18 @@ Specify whether to show or hide the status menu icon in the top-right corner of | **Data type** | Boolean | | **Possible values** | false (default)
true | +#### Show / hide option to send feedback + +Specify whether users can submit feedback to Microsoft by going to `Help` > `Send Feedback`. + +||| +|:---|:---| +| **Domain** | `com.microsoft.wdav` | +| **Key** | userInitiatedFeedback | +| **Data type** | String | +| **Possible values** | enabled (default)
disabled | +| **Comments** | Available in Microsoft Defender ATP version 101.19.61 or higher. | + ### Endpoint detection and response preferences Manage the preferences of the endpoint detection and response (EDR) component of Microsoft Defender ATP for Mac. diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 98c20cb71d..763474cea5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -43,6 +43,12 @@ ms.topic: conceptual > 2. Refer to this documentation for detailed configuration information and instructions: [New configuration profiles for macOS Catalina and newer versions of macOS](mac-sysext-policies.md). > 3. Monitor this page for an announcement of the actual release of MDATP for Mac agent update. +## 101.09.61 + +- Added a new managed preference for [disabling the option to send feedback](mac-preferences.md#show-hide-option-to-send-feedback) +- Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator +- Performance improvements & bug fixes + ## 101.09.50 - This product version has been validated on macOS Big Sur 11 beta 9 From bd4bdc1fe99e64a341b54f0e3a712e6f1b2e6602 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Thu, 22 Oct 2020 20:58:50 -0700 Subject: [PATCH 31/41] Fix link --- .../threat-protection/microsoft-defender-atp/mac-whatsnew.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 763474cea5..f14a0d3752 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -45,7 +45,7 @@ ms.topic: conceptual ## 101.09.61 -- Added a new managed preference for [disabling the option to send feedback](mac-preferences.md#show-hide-option-to-send-feedback) +- Added a new managed preference for [disabling the option to send feedback](mac-preferences.md#show--hide-option-to-send-feedback) - Status menu icon now shows a healthy state when the product settings are managed. Previously, the status menu icon was displaying a warning or error state, even though the product settings were managed by the administrator - Performance improvements & bug fixes From 01cfc2b8f23fbde8fbca8052820e1fbbf524f511 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Thu, 22 Oct 2020 21:04:23 -0700 Subject: [PATCH 32/41] Add example --- .../microsoft-defender-atp/mac-preferences.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md index 1646fb22ea..e6f713160f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-preferences.md @@ -638,6 +638,8 @@ The following templates contain entries for all settings described in this docum hideStatusMenuIcon + userInitiatedFeedback + enabled @@ -778,6 +780,8 @@ The following templates contain entries for all settings described in this docum hideStatusMenuIcon + userInitiatedFeedback + enabled From 1fbdec80099c40a91fa5998a3104eb6d0b565632 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 09:40:04 -0700 Subject: [PATCH 33/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...figure-block-at-first-sight-microsoft-defender-antivirus.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 9ed0b239da..1b2577fef5 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -73,6 +73,9 @@ In many cases, this process can reduce the response time for new malware from ho ## Turn on block at first sight with Microsoft Endpoint Manager +> [!TIP] +> If you're looking for Microsoft Endpoint Configuration Manager, it's now part of Microsoft Endpoint Manager. + 1. In Microsoft Endpoint Manager ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), go to **Endpoint security** > **Antivirus**. 2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. From bd1bb1482837a161bf2054aba77141a4577b1b3f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 09:46:03 -0700 Subject: [PATCH 34/41] Create endpointmgr-antivirus-cloudprotection.png --- .../endpointmgr-antivirus-cloudprotection.png | Bin 0 -> 54219 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png new file mode 100644 index 0000000000000000000000000000000000000000..b2ce261e9e72c67774d268b171bbfc2f8dd77f07 GIT binary patch literal 54219 zcmcfpcT|&2^e~EIR}?`73st2^N9je1B4DUeL#QIsA(RkGXeuB`l`g%v1QJT&{v%9`>_mo;`c^>^6J&_D)rSf}EC|jEsx|@b--c z8QJ9-GO~-n>sLt-DfQ!O(ytp1Z$S_;GM44@p9}9;77s|kYt8@_xodOe52$!}*|HsG z|AORnonJwnE$yAi@{yfyNuXQKB+wf(h^dp6gR_-AnC#w-C(I-``8izH-of3;%EHo_ ztbnppoCLl77wTkYa*q1g*~-q0OlY6-2I^EaCI=FYArPG)3=4rk}+H~$W91u?ZX zA)z{vRs2MUlfc){!9Wuyuoc*X>?hqq010;OUw^2RsTmpJ%y;E~&}8lH?99Nl z7!vI2IhvN0v#l9f-g^HtGP1{HfH$wS+>%zu-95GD)6cf-Z{7NE_lcj`t*ZdpSIs}( z@;$t$_c{3O=bu;5v<|NtPTsr;R5Htd-_hSs%l_C){T-6LO6TSSW@-*rw-^~eecl%( z_Yw4oi0=L1g7oHxbVw5K{(TVv+<^?hR;AKj0)-+hZ+E z9~{pYoPUpOP-p5(C2#^;9WW{;%snEw4CoqG2MnX7t;c(BhlOtQ&3V*IW(gSTvu_8; zwvP^MYJ+vnLsJrRj2zhjk%SEGNB|oE&u^fqa7*Wd0z#M)E*0`nco8Ec{$y;wp=o8% z$N4MM3WF%Y2Xkz*nlz1n^Z+T#<&6~4(bgQJ>|saBpXFW((4@v0iFyOL={@m-KYSo5ca{89LEEm27DabQ z>7FFbci;rA7rM7)*EWDNlIH%)@77eUO53doBd*10Z|tp%Bg~{L$BXpjr`j5$v08?y z>IR|ZRz@SAR@m6rdWFAEL;vld;97mj z)&xS|(;kk4V+xgMP~`m71-UUug~f06iP*X>sSi4J25Q5bVfkmFvAC zl9zh&;+cN+DY_o>K`Wy+`=&EHhYE4s+GK2_N_J$ofw~JcyJzIqW9-_OQ7e?_mEzvm zPl116I(Sxbyn*|3`i(z8sRRTy?^)E_-n(cgj^F!2i;iGP-KaSB5Cd!adB3R4{gCho zSK^tNEr;S8+9S84NBW^D^y1719S>G~@~iXlJ0Wo2t152?(&lO;Q<`@IL{^9u<|_gU z5`()^NoztTyYC6Lh-5_FN1ncERP1t>7>F@g*O@_5)0A=DJV~klu+g^8r^vTu&+1vs z>R`VK$|`&Rc*--}jVBvF=AmJN0$i}KxZD>}4FdQeP zx_nBnJj%B7MG$^4$Uy29*4ZmAJSu6R~1J2Kwc&CpoVr_Pz~TrYh> z461y_eEe3vAy`k<0tLhj&+5XD#s^-PF!b(8YRu9m_Y{~wPV;a9E&}y_`h_J%f?q9# zZ`e27&x$Y@n#m*PWlz|F;5aiIR?%mC-gO>|P`+rr%2 z%MQ~|7{p* zz4FEKr6<$stF4fT1a$-W{kd|~61;_;^l5h{?J1~up%b}!OO4QQM`im^@1F|6)fh_F z`wYD3rP@X_)rZI%7)2m(V_Ql}q8__>%9N55Qd}2G)vXRJQywg8aOEoKhg7`l*_~Dl z6s%$#FAC#;IreYtBG3~-R-8b(uTbT_AH_s2$*7u^H3iGYpEWdWhyr0iy8NiB3St4U z>lVw98WpV5M$Kz+dG&N(&f@m+=JY_x*RNbTJxWJ*{uXuBJvnj#NgEgzL&21QCjS8X z&n6-&x+m8{*9KlisDxtFV<8&4iEk*BQuA*BCPdzAyiT~&2#ADx*}UiMJsZ zHR($A=sWw9)V;8nNk~HODXj#zdPI68!J&L1#HH4y_a^LY^e%v{`K4g{!QGdY73*Qq zSp)5dSRYHR5eV!w|ExD}(lcXik)^GmSd9P-0rXcT!+gH%7^qoy%g@?4={9E49v7jl zCOTkJYc>q7S}O-(i@Tm95XIEE!f9o1VSUPew=~1aO_(SU9{9IUDO{kLdROz-b@>{iZ=KZyaN}1WK!~hKi zx}M*O-7c0ssYh}iG^hos5Y6@e963JA&7#zmL-e8`{)L5D)Q7uA5{*e(brTq0<;a2n z+;Uf{*oaFbKLZ+u>o4e2BdCV}O4iSUTO{|gQq(*&ntWn-f>rpNcl+)!*BWU|muki* zjQM03`DElim1RvH&Cl-c8DAP6afZXyyees#x&)iL*_1c?Ik|LVvL(mUv8a?+I0=8T!s!bF>Nk^$~ZDQFSpv| z`$ud_(iJS_4ambEa}R0VHX$krpssiPqZbNOr-hZB@&pV@EsryX!A;L7moh6b{0pyL zy>IXqi^G8aTmr!e-X<@_@d4#gHiVGa=M+Cb1g=LR)p`hVkw545lk=&`y9D zL}B;cPu%z>9wYV&QfFwNS{}~XFgSRk?C*^0M}q3aANGYo)nX?Oehp`=@2h|F9Zsm2 z`J{hnyH>>x;Gy2RSL!pmbRf(FLU$Dxt3c|Z+^r5aH*p@Cd{A$B0ihnDx!xk;#x;7g zCTwF3P(x+iRPO5{m6hGV(WU#qD#l2`1F13_&PP2?@`pu3#Q21rGN4MPCYGn0Wf{G# z!^exVS+|`RyIAkCpXFBHa$KsJPdn!0Y!3~LP3mb-Toem8x9K)!n2u7*joBaOZ><^| zQ6xPT@1*ePIrkQ0KwT+UR#JKhIS}2wK8)q@tHo;>hVBpXg+1@b$6G4*_OkhGtdQaS z-59>|OYMi+hu>GWdy+s5jJtUNq0}z;4}u$zIZ!fc|66Rel>YqM$Dk_I>*wy9_V!kN zY#3<8mGkA(Vt$Lr(L=LaR2(&r8%jMnZ3^dnq1PXutcQ86;h$nqe+w8O942tzTf@uE zbvIRSj*;b8`SY(0F}i4r0M}tzal@z0eo8qG06J;)z3(+b1*Vmql1BZFn6OB*9-v;C zsBG$5T(ondp6L2o@3n~sr@`D7{n1ps@d@RdQcKc8dIb%fHmoKI>J=&c3bdoS;YWHe z&`yg=VeWO;Rz8YF!D|u}@9=mWRfHBax9^lm4`w+SAKMhJ_gIcKWeToN*5vyR7YJ7* ze6-e+<3rJoD_kSc5%OTrKV*FDU8gL4NDQ2HXp~zMS7@ZEV)?U;RWc#Bss66 zEeEdITMb-mQ4G{i@*@^&`UHn|upm z^>2gAuA~moA@I5tg0aM+f6?Eo4)7OQ4Oin?8&EAtZMke#_vPGC^KrLnYa+->ULB>pi;*g{<*6kqC zBv)#5?Z@@{S!S4*vk2}E1QoZ7z-e-Nq)$hk4WtK0e$>GgM-6reMR;G6l$yTK{Ij)aDs_2XY_1uy(3UF(@x|2k8I_9r{q1 z=F*clOrw<|4f$PW|7Z4_kp7LKMGl6Wum31IkGQulO~alxtc0Wz2Yw8^TN~Vo(ZY>c zE*M1#ayK9r$HLSYHe@T;kK&IZeEFt9IrWlV`_J3)T>7QQla-)r-4AhU59eHnOVbIP z?*haP#ipbV^sX`NFuABC=Db?>kuX;tungy48-%=uw|YVsjI7#!BpYGG{S@+3Z8A^n zP5u}X$E5<~ldsktUQ=Pv!*u-hbntwEk~1s}hG|_MjOt^OYyj4gs3_2i<{Z)d^N{P0 z9Pby?)hm7RdLn-~5i0ybLd%{LGuB4Q`C?q_1C4#($b**)adCTtml0X-7U>OG+x1`Q zGXXS8kA+_HsHlaw+&U%~;cBTWS;|pk1qoVgi9>(%8^7qfOW3U~gEh_?=rEj)UhLXR z3GR*?lPw8R)iSWW2~952Nezp+?ejur7EX6Y(n+bv_1UtW??aUCuY#=|K)D1&{ZNtL zY0!&!>`EvlcGe8x$i&%q7_6adRySkIGq_UbinWWD8!B=Ma^7WsS?d_jTsyLi5r#)d zmLx5se!S%XPt_dlnk=7GbVQ4n-LLbvCWNdHrfU*u2Kp-XG7aPswufOdEYWwW1=J#a9HxBsit*s*oV^8dkogihX za?kCA7UBY5yM)nGLq;MVRq~|eITPQNVF=}k5#k_*H zoEHWu&RHjRKz|^R3q6+Q=G+It+hKGKW*?O$|y&`=J#1+A6pXfwy zR*oSinR}L~1oVJdH7lQ*j&QK`e?0L5sUM$hJ_f|fb?gqG-UTIZly+I8H~KJ3p*L=# zt=FMmkL@@z<8*Grn>P`30Z_Gn{w;IS9#!Mt=dI8ez-irml!#pJI&JPq8 zU^t??NbIbzkCfut>VnPYS9qfO&r_^qWVD0CagWOw1$wfxAI~>rRTx&qTJ^>PCzron zHr0ij?dSSA{KdPh?ywkmX-az9obd2ip^(n5GfG!#Kjouj8OX+ac0=y@Uo06rs$Umy z-;&1cs%w_Vt?xZDV*DACG&Eh?Q|7eHZ$}O${6(vrenI-+-`4x{2lM}A2dVxKvV;HI zX~h3`#82{(yQcwMUkoY9aQQ=p`qygyvFGym?()F$oooMyy?pW2e`HgUU3UBjlOZEb z`QPIO8LIz5B>Vpz;?G>-@jjxm@=uwefkDC9Vd~k9521fQSXqAO*M+?IXQxEH8kfSS zPoJ_pdNQ_x!XQV%H9WtC{-$52M&zij{qz;^OB8j?$l9g?&;0s^|5I%G-R3W;Kg)t2 z-~M#-3H`}z62E{82g|_S)u8jie`@=aUSzF2@hi1l$TFmj^+JZVqQJ*{YXc=_9Vbq_ zN_$5B$|Li$i)rOY^W+yCwk0SM(MkfYS8AR%lnFuNUh~&$J|^XBrF=iXTPd$Pr?saZeTK;T0Zx6c z66fYzX@#v&{AyQgo}NOn>xB!nm7#)61URK zNkURd)nZ6I_z?Df_R%fw5mG{V>ZqUn4-J_E)Uo@T2x)MYB+)*a7DN4=X6#ovfoC*U z@X?fXFMC}3L|41g#|^BVL?ZrARDbXzR=xQ@(xx9RRF*we;~!1h_(60H5DpB8-kYt* zv?4Z2l3zbdkqCrs)a|2fhxtQkh2UWp`9bQ&p{oUpVWffRY{Q7@dJ*2a8v5=r-7b90 z6l-+ZCPo%x2~|pML6LPEW)u(`*~zteY)&LK6RQVYKR;^HN>~0{b%^ucd-$tl2Gk3r zVa6!i8hkf}vqog&NT=4d$D&mo9%-?fVXn&AA4ZOH9K%$dq!_NnIT$_Z;A=a)#Q}+n z*I__y(R&rDdPI*kG63ThVzmU|L+brc|f>&Ryr>e2KbkG;fk52tDLoTk@z`Egi=vJH9Ih6DH1I z9*Wp>tV%E(k2T)ec=0*5ly=WVvu@T>7U*H-31s{(+EjADK0ILP7)N4`#@iM%CKC-F z{22arVba?D0v!l1^GBOicl&q?!&a`bn%Ut;Y%$mL*Y{`llsh|tYoKoH9|;{&63E)y z;DDN3m)LQhmzIqDpxGE#tVC!@4M#pRu_LfD+dm#R|hY zb{EpszD6jvYs0I>aj!o&vo!~}Pv~2_zdtzkv}$=<;b9LAm{_KRYtyNUO`Jj6PkLL4 z=xSL_{9W&4+XA5G%5yq{#aO+*_MAI(W0RAR_K9ULpEBU0MG+(k$oI0IxHArTXjs07aP7(uL)y2dz+8PM;sQJ1TlES|3r&Iomb5@hGh zS={`k!aOD%Pm%_!;`uUd%kej{Uo-2f5B3Y7=IdU$t9Bvj-=EOc@Be5j z`1wKLbu6I1dc>a=qiWE{>2IxTgc5}vWhU1 z`7zbbWfZu7q}5tOVNj=yu=3@#!#|954U3W_N>FsLYy8f7iggA5MobG(l8yw9m;*04 zm|Bm&mDL_8!a3}=Z2zbor$ol`%@r@a%a3Kg%r%g$B9M=j%Z!`GWu^}hSV4)w?wC607#mgmzQNsY9ID8yI#B>zseCKj^wKv>Y=u@!AbSr|-r%l+ z?ZO)_KJLx=axcXr#GeUX=>m&3KX5aIB6I$#ZG8CS+dnDV3pkkVhu{>GHb0ItZal*b z6wSv8qBrcy*2^>^c7lB(7KJ_*r0710hPP<%`;S#!m-%{JCwiZK^YDw3qKh$AW8YAa z{kr9fxuO@pf$UCj?ftMK%N)~rb)VfdxO!kt&_=`^w4m?;X2*S_MY7Ae4i_VBDj#o- zPkzWb|G+B8#?MB34R}x6FFv^`MDF!a+>m?3Rm@A@!i2owmn)WSQsxC{{ly(^CO1W= zvRB*NN?6|hcZY-o8(l6dyi>*gL|;cwGV5{L;uk)~bV!#0G}WCXu!D56nis|@4IrXo z3uKVZmG4!G$QLAAqz4KfSRJiUin+2aY`ntga#X{bq>b}S;io2M)TyH6WYti%kjwb&4LN}WZ-YYZfE z2t(q+`N4$U!_xq3xg&rrwak;HF0@*pn zS`Aql+xzv}m0{TdN{`lM5lRd_KQz~*j8D%xN%msOnu_0UMDUp89{T?02or@gC6Q+O z0oOjgNBaXSZa_nF;{@6N z3np%n+)di(@osA3U-Y-c-4{d#U{9 zM7684{bUzI()0hqAJSeq`cjHx!qyTd-$tsYVt`Rca@VT=#SLUKKd%S|(xI31?Ibqq zXhp2K0SOhSbas+%dLYw{8y|(pE>ryv5tnT(;R1faA(h%*H7tk?wMZHlh^Cj5Pju{<&n-Tw{e&W4`Bu(K zN5e-~*G616J%lJR+I8zINcr?oGcGR8_;F++m|Pph+h)CfeYU!50!hLZ{uo1c`G0Xm zP?yT}BtU}@Ut>6#%&mb~P(NDs0+8Dc>H=5IN`|w!Tx!}`#;IxH0iPrF!*_t7ln@Yn7VxvQw&e|2%7<6yqwn;c<`) za%c?r75~JdW{(j*FLYE&3|*+62tF2+Lgb|*{_-EXu>Tl5ThBB&dZ)1&U1j)jpr;|DwuI`Xn_^)QRuC2ldpj>gxHdKRnklM>_j9_x$O(`5Do zx!Pd>O0`LY(niUgW&4|7+1pVI!`&vcpV4@dMu3Fan?D> z?VpGm+372+1R0i$c2M7)xjy>(wKaPDuyxDY+a{}?xL5%rVIFyRV~$G`ZXYJ33d+YL z*FLIrx4%=gS#*ggVY}V?z$ZI+xpvOIDcV`w%Mvl$RYOQ2MP0&D{ZP$L7-r*B9Fv!)My^I*$e$%$47dAQ^dmH` zPB<8seV(%Vo}Md2HLid;K}j8%(Z~f!r6Q-hpP(gSSF`kh$z1D_*J|=L3)(D-%e`_r zN;l9y2mcB&?RR5eQCHy_!|d{HM*FfuJCedk9*THa^`>fehHI5qFA90VAIU>QAFYv^ zugiP-S!-GPrdHMgC#JF@Jbz}X__dvSPC1L2j%f5)F1-B`E_cNVt0hPlH8)Q8H_L+* zpt%1lCU)42r?duE-3E5;yZ|J+SjA61fKU{yN0qsN+e1Y<|DJ=Ak;Pc|K3*>=>@3#K zq4HlkBhIlA*|*sqK^n(dYO;Kii&w(WDl@43D;EN}cx-+%3aST%Mwz=)yo$*>LGfo- zvJ!6gf^AT9g~sfQZ^(BVF5o!zi^-jIY?c+y3X{ez(kStlRRQameAJhjYqXC=8X@yT z&&q5Ss@G#!yfUi{Q*`|A?26ehPxIPW3417?)hy%=uJWmy;W*og?;bHld+I zsW=arlYstD?4ssHMGi2a9E*vx%MJlO2 z;%_keqAGQn2(cc2d%^wX+_KuR zA@{2?vCjMO?dZ{%Hj%+7*BEmetFy7=X$&owITof_!X-)#Zbwh9P-0d!9UHEn&wMlL z>&Bf2Pg{#L+kgrpHHOum&7}rbAW-v{(?M~$M<5MYI~i-2!@4pya_pA$Wixff_!^xA zQJG7T=2d%aYKDjqSSp>2ZwW&mzRl>#7>_!Bus&vMBje&4*U398R4ZINnU^Zt??oo| zjmB0z^yr|2xn+GR1!ns**~x|8X1IGl~_q;@3lDi+_?kk^UCj}e6k=(%+~`oK zSRN>w%+u9)HH3hPZF`y3d!q2CfA^ToJZ-sx0VsaeMeMb3zA{ZzC4Y@!Tt_>LX^`mf z8hn7>ackBoM!&5%@AD&?@G@0(d9WglMTkcGn1Oq2Anw3mL*Q^^aixsxVz&#JgvEjns=W8#zF}Q# z8_Gq5v1e@1>AhTD#1D?`SZ;k?R)pM~{=j6M){NTSrQe2mmU~WeKS^Tom(Lr>EG4nwF=c7N>(v3D{tYI~0AfNNztzqiYG+)}b*yA8 ztC$?N^mdR=PZ;sx`ZI>U>iLzB32>w`rRo4vt*j`(dO#DSE2<)yH2Pp@xrqWA%(v21 zP3%cX-1rmdtzoa4r;7_jnhI8*D=?>Dc`UAwzRybyuYx&Ni z=sLH(-4e+;om#U@DRGq$NmwdwJ^JnH^CD{9>ti6Yn;n@bFQwO3)ZQzBJua5$sKAUN z;4?X`DQA?;N3_*2=bDn_hFDTBi?3Qzxq7=jyQJDM5zHZ`PTS9if|+lz2iaS+)|jFxt~&_AC7UCptj5)zRn|+S`XOxA^Q_?RIru8_<{~R%m(Thc#)^X*?t51<5`9 zFk7uSVqhd3}ZZQt7GO z1q~fR!G_c4;R)G+rtcNUwh9rXW7-f#Ru+4a44;v$rz7k&QdZD%7Rs#CC#1-Su+L4T ztGWVH@Oh`b#dO}yV1t%B@X{xnIPGSgWthHr=~5tOQ3_F?%xmblqVM85s`&Nzs(kL9 zQo&*cin}dEQ$zPiy?zo%sdO?H4)izWNYl47=4(9PVOsoO`(f`l*;c4v{kneX$1@ z_5N;&>3&l6vdY*OwE&%G^ITyVV`_8PU`PD3?E-uO&u$uWhV5C}1><(tT88Bu$eh zy7tLugZA;W%bL4YTz>fcR#@}U+QoEN>)$)`)3Jn(irwweMD00-7KX`!$uJK@?c)36 z2L!E+pOgn7Fo!_Ks^((H=^hw#Ok%`)%yoEX96?y2nY>&8K3@;;%Udc}9Ek1iN|dhd zi1w$`2 z(##xbZqMopGjg3=s$f1dM2uEMvNVSo%noTX$Rg0|C@xYE=dHtymKiUtCxotaG zt#XAkd?6vPbyq|%OGOedHAO+>_xRyW%T}Kwb+?YX1kqy- zD0$(r&`Na&6Zb>eko!xkq)*0$7AP7IG>BShL?U&V|fa%*i>l&z^jmyrR#PRvQ zQ#qfc$W>Cn>JY@3G0FEb!=i-;E2XgUVr8ptWD)-g`zE>N1b|^W;;XC9O2Gx4Re5hs zwIZJ@JqSYEyGF3&XZO4)7K%tKE@i^CGC$+0ambWHzEe;jYU0H-^)2-&+&!|v$wYWg z!HCUeFqp94TO01Zl?#Fu$ZqP?TPALo^Yf_<MDvyLsDijVO`9s%^q z>cNcVyaa~VU2mT7iW48l=}Xh?2@ouMV1MIuTGiiZtASP0NfCvMB$+|3qLLD}-0nTD zy*7f{tS&1c*WSfeGT%(1A8P;3=I`Z&O|zrjW$vN#sgv6O(V1W97sCr=GUIaD+`ZBo zUkv~1Y#Ei_|8>&&zkd$`gG@NGQ2NX}YTF_o$Wk-fAP%0Sr-iq67M~XUEwLvfqjK=3 znAuB}epWM%{QjK^b9(h3kZ|&R6NRCtY{n1K4 zKZ+qWhr*p>ddG?Bc+{Fiq5>dNZ(?i^dg7U{t*(*)yRAmpI!fzEL}g_iwxi&k-?+1% zWpk~(N#oRp9NvtIMi;e@{7XHgT{wVR!db#ivb&U3b`5gh5O>C`yj+%2k+UkYbjv+w zBZVmL0Iu886cHkDO0On;uk)QWg3&o90LAZy;rq z_BjO`dt59mZ}uyKhVqpj5ax?zQy>jhs%h0dcSM}NIkh&|to_EFWL;29h=8+J&C(bz z-~6k|NI5EO8srx%+OiO(#)wTR&E1^~pM`q-Da1338>LdOZh?#h>f^Xn> zLTPcO@>{g2H9Ao>7S^|#Ui=$|>J0_I!kA=4;jZEd(Rw7Wcw#axSFYwPeIX~2AphFc z|Eu59OiaJxgO3LdFc2Sf9Udp{iapdoFf9ZIYqSgG_iw8(?o`k7DQjqG9QK^N>;Y=K zj{UfX44RG1dTOTPED?@+{@lL46&lHAp8xxp+ooT#JqzW?XJWwYrBc75HxF$i&CeQ1 z%2|`zr%#(Jy;}O9c$R#H#8E<~J~Lt1^-L>%oOgIl&*va*-Ig(%`9aWm!YA+}eH4qr zqncIDC_`yozLi+{P{Tz;#pnnZ$T)Axk9tzC{~NcRHAbhZDy(XDdx49C$8fEbKe~V9 zdVLFhQbAc2N01YJ>V{*Za%j9H$OZzTVa+`Ggg(U2zc_&gn`d_p&J`HUm&b;@vki&V zlJYFKRH?q&`JK&To-?~_3w}aM34GUD5{?!&<|0?%5D{r&cX+C_%yCIjnhiL6uiXZ1 z*1|72SFLkMAkRf=BTd6zE)oR$rMv!R(mo~ZZ1fJ6@W%|>9-Z`FC?u|@wu|j0x7!L2 zceJAsOO@Uc$F4l5dp>4-Tv1)clkQ`~JB6L*kd!WH?Sx({ysp(HsHKK)>U*zJ{zyin zY0E-iBaenbfdT8?77srojS@CBMMs8kT2aOP_CYq3kz;+p3 zky+M(qf%`*4QgwBXQFI9J)m02KcMcYE0liTF(pH&BYN1YB&TxRV({lJo+p0)HpBIx ztIKyP&TJ$0QlU44=%48KHQ!_$t?(1>_vgwEn{bF+mFE+i_1QKKue^7KGx}vyi4clLR!Irh~j40Qhas&)rDVSGO+wyNT2 z`Hqcd>C!O!Y|td|H43bbpD~zcd)t!aaA{X=3UTfTl4KJ`lFh;XehtH7L-k-b6&h@o zRT;((h+Jxq;o{^Gx^G|9f#ecSe5%amKSBK=X`?*`HpFSXGr%8n6arzlsu$+jXB5`^ z=C{?}Wr%1SuUHDUn^0mOH0mqoLuVh$;`{W%rb}o7O2t=jQf!JE5l+Hj_3gnjBUw`$ z^NtpJls{9DmP1ik%)fl3OdTopRpT@t1g5YnFnkuiJbJGcPBgR@cwMHHrn)5OHWU4pM1Ux7-`z@W&1Ig-df#)Zin%b*s6ffv?tcbtB)rk zX2vDu9w%XOt->ei}J!WSK=NDqjf0>|^ zQmymol8wZuUI`l?7-a?kAl;X0d+rH6m$ivOUf=*E%#VqYH0NS0PSktsZZ=!YByf9> zRi3gA&pY`yj;+!;N30|vzioL~#N6%_Ni%Nw^>Mo&u zeaZ4fVe2g5+1drnAf?PyOl&ONZnV4s`Og}?5+a=xob3gA%um9OcAWoB`zN#sMN07h z$Ai%SudWIHzt{Kt?;G6z|I{E^&hbJZ>knzt%*zfosy`vXRu_Gel4aSOW|O*L4r)Yd<Wj)ON?*^t!FG(&%&HtPqQY;oR2~;8Ob&AiYf)+OhhICJX z@rvsLa+&hrzJl-_U!8x3jqGQ#vBxiB&-6a}@R*Y3?o%2$CiPZ%>46kU4?MJ+G#`Ao z#72S1vZozMHwKhsP*2*GL~06i_!xNBEqZqt|HyjL(NUo(xd84U*~=I0&R~~)`n!q$ z62D4<@}{v$ZL`L)3-&l!(4&+(!q_5Q;yjnkSKIDpsL+M~XumeOj_1g+3<`LEiG zq6_tEjFQ#Dx$2ks$?*w@W>TwQ19Mhyw0P_0O@!m{UlTxlQfS8mklcN@57H|)_v61h z72xWv{D@vfdXMO!%{omv4J5hdkk zuZ(TEG=dODa_vVw%B*UJD-xt?=!vv^o0t_hmA-_-cE_Q{JA3mB;zr5mN$=%IX4?*9 zQJK=2Saw&ir$6qW4u1TcBsi=IJ~^3k{$W1*z?$ExL7}0AI58DAO$w#^92T?pS@+{- zuK&y!%v38ex9e2z`&rF5;(&GtrWS#p5N^y0O}ICcEE`EhaFLSI2d!*eV$C+*)$370 zjoK{=b*ghq!G&!w%g7DA1)rBn`trPv{tl7ULJqYWEX!|VV|moDkp>ml`Aq!ST$!e> zA7_2>)o@B(3PSz8BtbeJBS~xUw^}7D$p>z$2>0(gYR{Z@n}@VQ6ISl)Kt0~J3E(R% zeeV>6s`qaPHHn4a2S>!(tM@x?09jX_>~~e_hChC8J;k2gt-AmRo*M?UId-#y0@Dcc z+lu);TKqrvNM?*(Q$LcQi(YY^nWQP**|bahud-Xo!(Z%{RVV&aOP?kWy|9Dt+s@o# z%il^}%I9HPZLp5wj~6CIfaGTK3qmO(!t9kqoQate+WgB8r%j%5s5@Z)u) z^BZfOX;?yl;B_~eLICbl77O6A)4#p+c>$-biQ$?^cXgFUxVnaGm~2V20HjYgW$V0G zT|6j|Nhp<$P&sNRh@{Vus!D9Ey+$2QP30kKY^*F{%qzJ5j}8kU2%K8LLkH2)3K(dX z{%&16)E9*UzBXgcq^5gj=B?evFg9fLZ`a{bk4UP$s!Ayuu58zikj?(5R^M58uic5W zZySn;x|aQ&YF=a{Pf4M1mw+?Itt3gGZiUArB^f}|YgO8{;IRkSOG8Z3Owk0py-nT|zWaCF&o1<4kySIU1O$6%_lZ)MSUoodf?y7E1 zD@eE{5ULR_)nD+af3CpVdVWQG{F%*~%Oqq8osZ!%-!9r9& z|Fc;%htT5xqAjv|QZeSgmH$7f1C_~q4Qyk)I@z!L{ch}7C zD%2QV&|p5@x#FN*GP=ge!O`b`^MUi>wwd7_tAx4#sRgL|;2B6KWSzyPlCTu34_0?` zt0WyfeKF7^(KYs)WFf~kZ>L1>rG5ujw;@|Xk$G145*rgoSOMiFR58(C@ts@pBVOEZ z81$7K3%?kckTG_rNFqutdN>6IwM)eZRVxR+w&db9(x5rK|zDH?hqmS ziI=~HNSyc?8gyPE(gBk@YJF1UUCH7vQdf|u0_2Rg;$Aj4jBp0U6@)rZeY}^<9_!uD z`-biG%f(mPBq!(IGu7YLWpJ~OSkhPaLA>1D$~=1LcL2aQ)l{iMr8wSv=*m#_GFx>e zY1JMV9r&b?f!}5eTiJYeu170J+Go`Io@v-D(NG7AcnNri<` zEX}`uY0)-T-6YLGSviDdnN;F%bawtv6b9$(_RnzN{eQ?^G*NjITlvmfH}dtf8!#D} z;)ZA#e4?fItq>vbN37d{`(?ef54QH1Riqll2<9#4ga!el_>Uo+Mm(hu6S~C@=(;_ea(WGz{6X& z=tZfdrKLH!xFm`LNJjqYQx%TDdlBHp)WxYWvzsOjWei|u?#ft59M8#4(gTSFo1A;p zb%cwQ$`6$cR=sNVul|6GdKSSE9z!PD*C^GohVq;`agYODC~!YRNec+n)Yn(Scr&CH z6&qu`2Zx3<496uW)6Xe(rs#5Dc{<)5AwWg1r4a5C;s?Psy?-K_7shM>bMi=CSy3Yt zGn_1s$52zRWt?1;dDtW$_H3&vE@ z+T*Pll{psZP@RMVq2=)9X8+YnzF@UU&p;G#V|0aTLu%_XCV#1Iz@4=-Y#D!gFm$-H zxIB;>Zu;tL*yheordq00lC)1sQBjeLvCr<3y35)K_TyRFE8icYjvoS!=K(4z6m%ls zkH5b^`PI?_E3+dNo!;5vx#IY=zc8uxI)(YoI@nN!=gcs_(NP!R#{rMGd+K7=T5Jlz zpz8kbw&1H*33wR`Wi07>)%5Uu_TYsfGTxw{aHrc$W6FodKE3X*46wJ!rK+wr2(%q~ zv1Oi+;n{f}y?XyVq`r>W;MZdy`ljLdtT{Dovctz*=qgz9+U>>lsg%twcJS1MhmPx) z4C%tGDPn!6!OpErT1tnECDU!3=iAA68#h>pmydKt{iCbE7J*uyxZTPQgL=nX;0VuDxcLd^>ozfDTqd*N}_OIg}w32%*@LaCVKi#5}G*mud16A z6lQ~Y>Z{{5agfDsv5VsN=;OK#uO6=di@diAi>eL#M+pfD5u{T|>FzQpX_0Q}?(P(% zyF;Wznt`FabEIP^siC{`ztGq3JJ?5iAMAawpX*{~E@sVo>VAHA-^=a1G15Of z+=>Bz&n!#n0***l)myKR6^2ge`n7&NNf!JSyGj9KswEAeI~>2Qb)VbB?SRK1gpBv+ zrZsElH8!~H5x;%=c9^_%r>v3mtGd!Q?xfKY8f`nwhH^*Im#!5~7#P=cn;(*`M z!a}{#g&7Fs+}{hv2_G!KM?qu!zat{1nIGeN@21o9VOFfuUl6p zrm)mBq4qnCj*TPRQ3uNl1lbkL((Fl>AzAvm`z+JqWEthcE&h7t^Vi420j@W0l@P zUYA&$HG{7)tgq$$x8HjmC*3twb}c-ho}g*DQ)HIpiKYY!S8YULneCer|Uj4nroXB5ZM{l1^hdpvvu`rTVf zKvq{v=1m&BS-s@m8Dr5RMi*07S(?QCg&Of+3C}PT9?F6BX@4d!Ccj*nhaJQofcmZ9 zqe%XO)(dw$i&S9=y-}Ub6lGYF#M;UDMeBXPvvj;+&EOLgYKRenqR#oN zVo}X^($0k0CXuF>-jGA5OO{0)Jv1Bdi#!`W9(qyj5B#4aq|^E%`UIZg;a9BJLaGd9 zXb;vQYc{ah&}>*-tV>cw-oepK8(GPHUcw}6^P45;^x^43)`2}AYh=Ru`jf@G=S5o| zPn#S97Is>{p@lkZcYbZ8SgAbi2e2QQ*;*o<%g3{O;sSnOiUU%;ZII z1@Ob`YCT!#_OLVP%NHdzwO-R~Z)A1E-qqe{!KhitQll&Dt5>gpq@$2uzZ9b=MCF~F zs&nN$TSG92-s$V>7az>>6XF59YfBn!MJx}>1}BW6k1WtK^_>w^Ivlknv&>wY?QAgY zWr^y#M0tPNg8|L3ft=j7Y9eL@@QSQe-elRMB|NjYI)r*%uec$=XAurJ-M~QW@x!}5 z?i?2i9$B+g=zOODZDFJjaYBaeo@ng9)n3?7ygg=}en}fIdhbKqX?5YV!P>g)pPk@( z+Fm+EpvVsM1`7)Wuz4=UFT%$8<)H=kPog}NygZjEyt6*K>VlB%ZM<#2+Yk(Hl;mZ6 z&bz-y+=!}_%Xr951;1oScjXybJ~NkpWr985y6+8r-3_}Mso2W91!sujk*#bsO1jm3 z08UW}DIrA0)`&aG=JsO^H$ySw`ZT(lQdV7P2d^pDNbd!!_Xqhq?p6&@U@EJiH$}w8 z5iHA0cVt|)TE4VEq>?Q{5I7A$oe|J@sk z&Cy&Ge3`+mT5p>=!1fUrAFrj&)oxJvD_632Gco}& zGqcwh^N!JmOSLU$%se*peX&%Mp^=gKz;?6zCVV3?b!-OHI{RDPV2ZHttaa_0Ga^uGtxdkc*M)&LDr(8BKzvk2eraKtOh;t z0cxqo{=uap){v-$&}MYJXzNY;3CqS@D=`Db`B#UNv#Lr0ULwLrp_7bHF^Es1+%qQZ z--yEtinz9zJSlpxK>rQbAsNf}>|2_Q+T3*K`)oW#6j_v$=8}$r<8BU!`IeqooMbh^E`^0fp8{sn9&wbQS-AFl()oE4dLwKqOhgq%ERtP zstydKF`k{Bk!6h!FD+$%h^Ia3dZEDPbL$2eT-*E+QAm6Da>4rzJ1ogQPmqyuaB;ix zWs>0t*$tim9EDWWhqMCOx=~`jv8BYHI~5MeBPNVB_EU(u0Na7;&(qb zijPw_9We%5PM76_!AZca5F$TA0TLpGQHc7?WAE3T35NsH#5^h&r97~Si?8hV!zkYR zFQ&fu+0q^@vZrgs9^n%U*Z7*D)I`EaJ=}CU4ekpz_P!5w*l#NT1-d$?N%z(psm7O^ zW-dymnO!ZmqO~H|+@cyj>2k#Dn)utVQ-ea;FHRI!FleJo4NrEhz)pGIzxs^Ra< zj=$Ja$WtmR>+ET+5qTBw6kBi`VH(Y6TwE2Iv)lSq$EiuH9!p=oCck;8ax>RdHl!#p zIreRV<$$@Vf0{3qsaZmPO&xIA2{|rlJt;Q=3D`ab9Vb1K= zB`vL;%881yvM7MnIt((`+AVos)DU;T0~*K}$P|iiYW~5=iHm?$cMUkBViFRMLal{` zg_)U|{&bnn?p#fAKX>iC!5zV5^X>8F(JH|B*<5zjqc0k~t~hFHYFKiQgaD9c1C)B; zE4%Ac^V_?-$A1844+dNh9MHP%HV6w3&lLOjA@Yt$65g`m;*Or4p0Q#zRzRcZ{@oe! z6bsArc&$HbYzFvx3;_D(i^Ux`TYzggY1?Aq?d2jrG7Dqle3|UI<1BG8F)^Dbk4UXW z^c=a6sfE1um3U-1#1I9&I}Rnw7EG=N-AiT!O$7N zrD+8O=CG?u^;)w4QSErT^*-_2x0jM^)1)x|gN#8Jf1XxT0ODdv-X`spoB7tT7C>7uu_hWNj2o?D7;v*&cD$L0ganP!g^ z{OGWL_9INENlP6~jBUT=W82fkD{FYV44<76=*6q6M*p06qJ0+8r^b#ex{OV>w3 zS9b)^tI1w{a=d`w5prOzjII`R-o~AroQ!H?rlt-8wgnJ~P|?u7D`ao@W}koo8D(X4 z6+TU8bb|c3010rG07myH;K)fF)xiFsmQxK233l=k%tFMcIzGfMG}O&b&6m%OBPPoq z^OUXHv;Py^5I&-s1tJmukHE~sa07`csPgUWKv%4CYQt-3REnO3Sm7KXs;sd5ttPnw z;>RWL*jY=TF5CO6paX@ap$Ma!pGEn~DACJX*>`OjX? zw`YpuFHmL&q+K5Z+)rBdN$*lJxZ`OpMUbOlsloBHY`&aVq8abZ$1r+kRppokydx`$ zG=^FpJbHg*>Yur`np!r}Y4f*7Ma%eqlqJN2{~Vv%?1rF)e_*%$Ug0N}uWY+sOS=pS zE$6du2XFUyUH3@=rTOy8d6&W`zQ3#95!OWh zZdNj#jNc)sJrKnakQpj1r&-Pc?Wan=txTtpkl!JXN*R=_N6u&GcX)WH8d&%0{TI8- z!_OXP+v|i#CVG)hfWr@9j13Xh=;-K2C!Ccu0nM15joM&95m#30Ncaxfd+t!dBx5jp1Xdl@?R<6=2x6; z6TVX>W29_x_N3r*?r+Oyd<&St=B|;*mGz!}R|xfomct;2pI1{eTVwl49Np;-T4(L+ zGCB!f+O?tf(0GTWM$gb1V3Br@U+oYjJ|MSV>7y4ry1ub{k{id7Dr`!-Dqvgr9+kX% ze!jMzdxxN8z9DeZ_fjx7ZlhwQx061lqLU^Roy(-kg8lY(7>iz~HSL9=$svX9(At>g zcsj-8#%@$<)7jt)rXd#n3rWVSl@?Ps=PL{sS#SL0GYyoX<$OJIgWr}EO4t3;3|~w* z>QiZ{3hwAEL#&rGm)4I9&lu^EI=;x$a_i`Nv(91am%B@WQ^W0$8yxeHOf z5YxLVBg!A&?QC!~1T!I^8t}Z7hX^&3w!---s-3`e*%6^#LCnw^Q`o}(0bj3=kdMet zGUh54`StcZ>;ts)!ZkKcrayx)`oiI$wJ-8}OH0;|A3w_WC0?A-zP?A;9;UUyEbIQ& z6Kjtj&fSK-`CGEX4s~WNBXnB4d7+#A1HQ`Z&*)O1GnxvQ#RY&W}6PTiK*%BSu@+Rlb&n zhc%8Q;-+wvQW+U=Z9n&n<>`_uxhY=ye_f@j_~KUfiuBFV7W7LhH5(2WbT z&9{<|IBVcsCq)d+mNM{ttz|>eyfJZpPZ|L!3%GT1*k^v#DWZ@NGV0PBrRF~K3vRE%rgy3o(o3Aw(gSPD`bRWRsQ za@B}MM*6#k?ki~;9B!ba9iKoa@%C4#5V4EESJ-wd0siC32z7ScehtVwm2Z4eTal2( z-YD~3x;DadVT*a6sPa5a@}Lku=W!AmA2U4+oCv8CtP5|XBeOg4F8uxb_v!XzIAE+O z)2@F9AU7uFl<(KOySuGf5FPL(V66bx2dMzF6wBjuvUr|srv>NhEf7$M#_B;z2HU#5 zi1QpRhMnCi95akXo>MAAQF%NyEVii)t|jLJYOQfIKhV~N`v~cgUa@VDLv~1hkLuf8xs_)j zi}-M5OuOoCh{}|4c`mk+1f~*Dj2%T)w`nG!(O+n;{`@>z_rx~pcw$&wS&qVlOxToB z#`=>VzHkKUH1}P}{D55ZcVCWKny>Qck|mT2ZV^|(v(y(CULP(<+NpTsrl{Qhbc!9j z-%g>4HQw}D*9*0mHTCLH-#XqfIvV5H02L-PO0;%saRaN);#@)0rxdYaWX{ZG^au{hX zor(H~gM3;peI7~gvE>v@s< zRx-QmASeW!bObx2DtRQ4gpm?E(uHtEAfe=-a|ILCpJ(J6#e+f_zj%tXY8D`7U3|4M zC!|!2_4ayWN;^NAdX^O*NATEe#DGzRMQcem)6Cwn^9RU+kd=#kB)#)$Q4tlB}Q(*W#f70xhT#QnX)ph-v*!0x89=x1PG@XvK&RvdoC|+$zXt<#6aQTR;I)A>^3l=P zeLTnec-5aaCTA{|@u!c+7p&KzFa8oD;NF7&?M$=pN@9q>hBmcW7$7isbm(P|p1A`Z9FWJBQ zLXtk!@p!dV?v?O1(o!z?aX$~twz-VRfRAd%ZHk%R2TLyz4>BFkoUDGdp8Lb-DJjQ@ z%aQHjOwd!9kt@{O^xF);`fVp*B1B{v$KK`zPVD;n#ACg1*O)rD7o5m^2hsXHyY+7 zcw{&h?O^ub*j_HA(h6;?z_rmoa$`)99nEz z7^PP4bpnGuIK7z~t;IlTnP-Um>-S=P zzO{ZoRTWr_H2^amspxFN9M;|-EsF~i=-98Rx@UEGuU8XiXRK!nfx|%W+j4bH!sM!V zhUcooh27|KZK8EmG;7ele0nu04jOdP zN?_)V%UW{s?dUi&QkX_1icQyh!impfF!)}^?WN1pqSl9qdPAWM6Rjct?(~^>tGni$ z)6&YJuTOlu%~qB3_Y=lTDynZ1&P&X#PXDauSLywh97jEeg!d0fE03)vl~0w()+3J1^|t9l`UsYp zKihxZ!p?}f5}trR`XC!z8)A;d)v{Ms1nu7IV|K)`u|V>TZOP& zo+{N>x%HZgMh41Mat0gGnznbGCCqH(7HcL4-a*cc2P5<1Wj=g}aP9>p+x}F=6gdY# z*3A-Abz-3zG)U8Cq@1RsPk(g8UZsnx z0Mv%4w$iZg!`;-f@~3Jx&dhqzP3R}M%eR$&IoJP76J{{OSD2I!mD*QJ>|zz&J6aC z&M3h8RvscxFUOtAEWcj(#iW*G2%mTee|y+O7ObEEo!*n>?5hVE-St@i4$0D`eT1??`Z9zVnOpe8P$N>hpSk^}Qa1n~wxwWW=(q!@K!{D8Dc z{b^%@v8eXeHE!_i)R<GLMO6&&Wpc@zQU=?EO&PBdD(8AJ4#u%GoS{eCLaPK z7@oqmMGmYfnDpuLCTZQ-ndvvg?Nu=HAAb!>sMXRvw6;@f2bQgj8_BZcV zVIUt3hm(^xkt5&or~`jGr&1F|zCo*}A>w+m_f^U3#MML%L%Ej4m{6@pzu4#R(pBOGcH!JS5%o&F;_BHzp2JODgsl zT{F~17_lPP@p{jnBF}yI{nL{}>Ub=h}g+|x0I{Xq6ML48GWiw0{E=z^%e3Tdg z6-&7{cHsw!voR4@fsD8hlzrQjrL$R;;D-(Go;Pajq*?(qRWBF3r|8r1d$<^TZwLoMTqgEE8BS&aXSjW0J^@#cBE+D#v6+AYc{qq#4fd;g-f|WCs zPtZ=IN<~w!`k*4FJk|1iEtEl&EO!tCM!%Mnz{Pw-n)$XLs_!+`$B^u(6OsX_uBbAl z#W`TYxHARX#^)UI@oX$Ld*RuT>n%8JYE~^Q$9O3Y6MmKt>UAxZ6K7^ggOyVQCgN+f z_6>d!SYP5-wFNwZPZVX;_D8gdS%0@|-UuTcpSfx%OSnIX z%rzb5bon3iLloq@izB14hLvVKp3*1Z2O`H_rw<{2*ElbpNw=vkT(T=QQ?jdl=Iwo# z_|-`-;&h!Nv`$ZKZDV3y$muVcJ8*7~y&MS$PPs?!Whe^lc-aT(Sn$TwF5;Zo2nE?y z^>lnwq;dF9@}oRHo6LVZe>6(&@c{5-vR zfgiixJX2V!zen^TwY)`OaZ=~+fMRX7!BAw*vv!m%Xl-`yDj-72;+wIhmQq1?sphOc zYX#2E*X?35)_ zX*B@(hq=_5CeoR>QmnJ_J)ciM-p0(qr@7w%6DB4$w_IEv#c5(?rRMtnFX=W^vKty| zl}sF8ht|1Y1e|OajyRZdQIs^F2-^nRsNjysQHEcY=q1SpC2Rg=F~Ah+$$=3k*?{ae znba%v+x)r>GEbNvZjhB8%54dk-kP!VOeZQkzKYgNCndaK$I_dhQ^o=#mAaDgC&baFN^S+2I*)Gp#};eTe)Be? z`(0+gZ1e2di^IAl{!qsyy`>RsdzBs43I-p_uXq0UUu7foy3vyThHdb+dP-#(=yUS& zg5o-^D!BTYBLY|QKQs*>?C{gjtQC||F3?8+um}hqWviFh!SA6LRe!etuoyr$gRt#Q zw)Z~&=}@fM+9>@5d}9Bt|H_%xQBdYn@#{Hl*^V_aC;}!nwY>Z{H%Dx_+`1rdegFTIo2HqW6oZGdVfi_t;3aVz#l!b@9a@C8Z1EK@wAeeV`e5rZz#J-DjoSw_?oB8!lA?s zu*NtVr0F^}OPDGu#l4+ukd2Fwco{s8QyA+4h|(U8l6dbs5Zw+&Unk#jN_=6rcVjbL z6p#i2O@|1HrZ#vOf#;39y@$zr?k~sk;vd=Ru{zK7p062Kne+{oT+a5D?f>N(eRAzP zZ|7S}TL%{7X$yss+d9fj-w{2?M;bz}E`g6$y>|TMf_>2s@e^Kd(?23guVVgK$91BW zO9!dVw^RocQ9W~rnQ7PznA86&t7P47R7#dy|LLPm-D)BG?a-!489^*b zN3iA#86GtUpHbB4-p;^Vb)kIGgFXJGjh8kGi?T_+sXfK+;T6&Or86nLe{Q!lCdY3?tK zx@lrjs|^fjdV}9*S_q%0;IgouvOQ#k&TpQpOdPXzzC*=2wmi=$Tb}yLtd*|U;JR4H9CJ@%*_P57JpG<;i%J7bVs7=EbLWzXw>CZiEA}H=`dw~ z%A^4arGp__Yd6#v>xiEwTjlt0B1tmlk;0Cd&r1vPi_3an*(^$L%o{@a8owg3;(yLa zmg?VeS7yt%cbfJWGHGrpI_lWu(!EP{WOIvIH!tUx*c2~lh=OypcX@%XI|LeucHxTG zxEi^$vo74?oRLgvjGeO%KMZd9yO63&2x_P(}`%-REd` znioS2BB73ROM_WWsZ52H);H(Hu@wA?6rP*qCyj`dpGptfy}L61Y?PA%fO>#TzdeNC zCTo~l#BB}QueBAV=;h%US$1ez90QBKrekG%RUf>{?kN4*e#tz2snj@@xf-an<1N0{ z!&UA2@`k}eOUQJoUsD3hVrM>)DwWd~4WtV(QVn)wTN}XMUz?4h=rf!OmuVw6%3SCg z>9bN@JF^tJzs8wrc%qXHGLfS!-zarr@Ym@G@N!#=Oaz}WXr#l0FfJXZn(ET|-5FC? z%`SLL$e=^F&fbNG7K@t&H0j`&uM<|Pvd-J9;ha}v%vQyH52%ak{bBeLPgJeuhhunE zISR|iZ?4=EwEQ;Lc4_gOe1^98v8se1KEH@N*llST_sy+r+abRvv*jw2(t5a=HRV^FMKLFQ&a*$l0S+bt*Obab^ zyeb+8Aa;jcCVuq{JgF)!)?{vW0QcqmnU%fqM0fhgp|Z9cl%$z163?CWMeRB_q&OmL zp(~B~Q_3po*un`J`B!jM9^$tH+zq~vw-*sqQIMrh9h?srqR%o#Rs!uaP*jVTz`*Ov1w|<3Hl8Y4{HLcFx934`9(jTH$rCN+xpn`CJs#IQo}*RdE5XE6Vq#JMI;n?(8|JB(EH;YKv^Twy?#-T*lyJ93 z@1B4}1lqebUx>d!0; zU}t$dORItD!r+aY<}}fBGeL>0&`|9VZ#v7X{<-)PH?A;VSLGvN=%1){H>_;FZi?lCA9ee~fpBYHPsQ8#`-GIreIHHhUw7c(S#s$E87F z6}j~3=n!9UTnK;PG1oNz!nZ{CgTH*y25!N&Z*~(yI!%@kCV$fUb-v_0v&6W^_bxtw zVtyp$?OT9%^i-alkqYXew59ZY!&m!c-RL9s%s(tl`WppCL{;Jkd3%OZCl>(p>=@at z16yJ-D5En`#zHOamFLf@L?CIxD8B)dfgTXj9`K5_mQ8ag5V3K#6L+KfxhxMv;JCtI z6$gKJUZHz}9wV$N5Di)mUCO%HH9z)YxH^9QjsLHOI7mK)N?vSDVx7EW7ITlRt?TzI zSyJ+`_UHRA2ZcwTqS)Jm6$=i`B1W@88@%b-1M(MZ>$4k#JH0VxeC}0aTPY`ior0*J zs>rnhc1Ba;JQS?jKPNPONO$~_JQ6D#!G`C|E7Rcn= zY(85Sj_A%Lx_qU$HX}wEy>Vm-YpM5TmD_(>=D&4T0U^3blc9i~ll|eJQm&(S5?x=V zYA3W&Vcc>XbdD_SNR}GLJhwveNaj)bBBkpI=c}Oc*Y2a54o{!+LK-gLTT&LXtf(Ya zEO)1t*jrru-tne&1)yb{q@t}Tnk|^$J$!zn(o#zcQi#ug=8opLA@^A!JiiE-O6pLR zEno7r$1api=(vY6*;B;9mwZq!qo0@Yux&WsWJP|( z0ooc^_(O(c%tZLinntO@o-S$^@5OACfEY$GaUF=4rS-`*tDfPa46CQm)YhvEDG-Ck z&55k^3b*ecum=&+Wk`eYY1pW0A3}XWcNNvI5 zRJa`TSwt|KnQuzq%6Uacvr{*=|Ij(8-18|H-{pOQxRnd*JqA z@@XJz!{JlP^>W~&iZOe+mEG9D_@_6@F}Vd7sD6RSr9P+^uj^}{T#oIMkI<2k#s6p) zc^V9I|D!SdKk|b`ayBR2@7;5fMiDy+$$S`5M$VVt7-Nx#^00pn{i=l^03!H1e&AIHQv7ya zPvLa=Rs~VA7=u*6^!EWl8IVc#MIe55T_|uC&}%*$)>CAYpHT_S4>7|(cP|bGdT*Mg z`PXwSNq|~lo$CeB%()64tZbszEvwsr`9lqtdTn&p4!rPko5ugTc>3h}i^I7mCU~pq zgFtX#rZRiz6T+t1|JCP7Bnw%mmWK@d1wcr4dU@>)d$u2O{*#ITzZhM4RH$VnV8$LX zDp=gT8aHaeR{L1`-L5Ql$XO+G3T*GLL09dayB!62%z=1pE31H3F)!Iw?{lpsK;D)3 zXs17D;r$aEATa;)4}mWOpM0;QC$>N^Kd zR%mwMkw#0wtK1t-wU2zfU#;V(#*6~VV5KgzS;zIo%v+c^1JG*gYBtT2xn!SjRB_3?+u^%7v5 zvLgnYP#U9X@IHf<4YfBNwXBQv&qw2`7WgDWe*HTbtX`LegLPNtY?>!jQ zVFf77`@WM6q+x0Eg?Lw6R?b4%+73sd z#!!Z~l6v>lU72-jNd!6g&fC2Hv>qTv`#-4yodKlqT3^Jo7?6=1m zMwDB^Qwh=j+e-uR-cJkg1NJy)$txYtE(ok2|D9y?pRamcpDNb;G4#&) z`u^KPk{~t7E^o$xp}iboe&?+;XLw|*`~rNyrDtUqxzgge!!EJlFlD?1WLaYYiPpYw z&&kP0e&xJ}F8WX5TZWQLoU9i8d@YJbuTW!s6&REgYvV~tM2rQEQfoI$vt|Sg%x>iw z3S*fYBlL|l~m+Al>OR}9x z31-hm+9T8WhZhcrM;7J`>Vuys8W}^g;DxP>i}1IJOR`70i)xW3*yv9gd(RVY=s4`Z zpY_@RkFFsVbQyx`SbZF?8byoRv+4{!=O5~kgu})NKi3Y>1beHXNPcxze$qcE{n{N` zgyH&25y!+n~M*3<3TPUk4T!hwkg!b7$FU3YlD(3U$?EG(3g^&jW4c69O?`aoV-=BPN< zu47Mr{3;i(#_X|E8or$-fwGxUd05AE)$6Eisqfa$K!40U+4~IxuzS)m!1D7j_q8pL6e8dq9iK*3IA`p~M1-8HW z_UZY>Xnw3LW;yk|_J_$?Y2X;iN=cy-uxNj)s>1OTJZOps{y=-YBMQAK2Mvt*iFndF z5hLH$tl2~?oq}xXZOcvXN2$T}nQ0Yl$vFo^>~o!T7fO)(ej|c+CJs0~K&_$}t+<5_ z=|bx@p$8KB;WD5UYSB&e9!xx@$x3)g4p4E|Pi1%PhdMTj9*#~lL>I0HQ~2xi2*=5$ z>44BX8w;E*GPjIBi)D4UkAp8znkC?YLk}s?g4K;vV*Y~)Zd3JYvsmNv-Pz2s%Sn&E zo1ti|s0q8>TRe}DCyMq*#E6|9$F2Lj!>gl(GayG2I3W8kD5P-&`y%teDFF1Ec$5D`4eTu?Ajx7sV@$bG3t@SwCq3n1 zPjMyJb#j@(-%B?bI17T|Ogh+!lV zi)kteS}WV{kz+FO;Gr3BZ1^9UWO1^{@qa@?LKFY*hlI?t6&HksYDc#|+#TpF{EfiE zwm*rq^~x=7w0r*%kP&%OX$SKBm(0^+7k(-_-b*$*CYSGCV6Ha-UV_?3<2`dS-|{>ruUMCCtYc2DK&tg2j?Q` z;NY*Y07WdQMjYG zdQ!(N`;i-2^L2}|P6&<&D(XPWS=!Q8CsT&-d8~!ncBnj@RRMFZX0`2-h{$Q{AxZOLR`X?}PEnE_32nRZg*2(Cxz+2-3i>%N&ywSLTO3Jslc2MTGJYL#_l z!m~9J_)!@4p3!~_@z?MbdV4?0I266pP4t4v%M_(NFN$up^*$te^*a&8LUMM={BSyF zZ_SR+qrd$@^n72qZ2M;9;*Ny%C@H+3BTZ}^zQ#T-3YE_~S)cetZi zI032&i+289Yg2(=R`bS7m;#IZveDZ&d&%|g*J1y~$=%fDp0;Y<`*r-v4F*5E>gwvv zqh1O%clY|Ka=n9vR)cP|$?0iEplp-HMU@sWW4TA>&os2eU0*x-BnGh9o+@Dxzs66q z0ph*akCj9ssMtxcUHe}xz>+s)T5JRMvrcp5AGU=*j3r^+7~juvWZq96ob67x{3zCw z8fy!BYH_vDOVwyDpKryJezOx3RxOjNRZ6V&X{4s8!%DR~busAOI z#9SA`efM#dNKP(P^$D#;i(1}kt>EeB>a-_pEWy$p?qY&OroONsVvex0VG=@pm}XZy zUwOt-z%yoJ%`~uvbEXf$mz0a4)@Fnql+R+n)0WDbXlBk@9?-kAu4k3-sdX9}W;Lhf<3HnXr=Nv>y= zku?3pR>3>9jGt3m%suu&`|2tsxpEq1BG&ZdW0*x__a@eI>>{fU)}r&fd)ZS9#$z$o zA=`{gF1u61n$5H-dtYuoIMAGr;O&@w0=+6zVR*<`dVD|*oDC5`kF`c&r+NpmICLNA z%4GxqDsBe zu%&ZZ(NoQV`F_qNYUAT1RGGkL?{#QYe^u{=kM53gO)sHZ8Q4^c+qUxcV+lRG;xG+L z`8cIQDM8t>r3E^bk)*1FL*bTtM)c~H-#693dxG1+9>di(&cS);#M+=0Ph;!i#41nv zK-T#!+C%}xK|)xIDPau{^m`L&(RrTjHIt`aDicUpD_o_5RqLnwc&3r%c(g0ebtV<_ zqH>YdI^mv%m8fR^ zc;?f*A@q~3LrSy$no3k3cX>W>QC6Z3{P6ci}da>L&^1em71X;GG7@?bZ9^=Wm$u^YS8o zbaBOX>AW=Lpyls4R&E^0{-nPC{rB~^yM(;NQA@km=&&0RTbO%|j5M)*;QqZ?-{jb~ zes4T75rII|1A_wFPy=lrumdV00C z0Ko^0SgEnwoGjasTN0^`4~zHed_(g#AEmW>z<;`)NBgdscKv=Z(*w|$TAcLW{VErC zJ^k^pdg0ZAzcBjZ_?GSk-F8Tlpd|i~Rrs+3am|i+aq$x~mpGijgs3l__v0SiELu4c zv+rxh3wSN_x=?JX-NEWeJn7G@Wz<%`B14ANae!@bc0tUln;`qh>qw zeX?j>cAXNWo6w)(@n)f~$Ww|FP}q({4yIAR`cX_e(TY2nU3|-Jc2#t9|8`I{k~wHM zx^LvEWM7NY>44s2F{}vNk8)k58f@ZA8az~M)7jLtKaL1m&#tcHyMkVoYk>3zLRU4K zij-z;55~|@_Kp*xrfg1i6x)3&-c7NrszlBivuBJOPofKwB(`vL>P%IuL#$-f_IloB z@64TV6uW4|W)ZoJPNO8$$!@zr4tFk6(OQwHfNuA@pA$>h2$V9hy`4}h$ZrfRjFe5n zv4*(mxcf}k?7NibZ4(h~q#9ZW{%#r(NKDE&w*D25t8HinDQn2gN8`kzQ-S@QulNzL z(4gTysWbx8=u8MqOQX_HDy<%X{doI$FE`N*WhvwDOp0`XPnT$cCy%Io>fB6Whf z>XPXZUtg+Kl?yYw9yUc7kO^y-jB)4t?2#q&lyg+qYD2Lorq45rtEnRB`e%K$Ka}TN z6!AJf{+~BQ%|(z-22bupC2K|XWh_?ZY>I{8L4NE%cd zQGZVIq~4X_5$~n{eQ_a-(9BquV(O_Pk(EUk&sLW%Kl3-d6krD`ftmDB6t6* zIQ-*OsL05{Eheu=0T$H*l-iZ@S35zA`_LFB*R+GM_?W$>RLebMn)PHltl1x9~25_Qo7LI8O z#1Hy~r>!Mr6nAJ%Q~s-s_K^KW>N|YI(M7Ql$;WCTGF`7uiISe5UBpC{)SHCYNr~cc z0zLhRYr4reh*RSR+21^UB*N+Ox^Iqr%V$?sqxzSknM706nD=4WmE&QnzNYeKvHSl9 z>WJ8S4m$l+>M3-v_|p7K)~P#d4&6r)NcB$wyoHp1zxIda=CePV!u#FPK=Wg{wQG^^@RaS#@>UE&y5QV>w6f~q&U ztWu6aM2zwDmx_c3V~XKD_OZj;s6lqKDce!wCSKR{JZSJ6D|T}s-JDgGpmkJJ=}D0% zl0ZX46=f}HR~GBZK{hduarY#5kTU!T*AZ%46p&@7mi;S>M$BV4onaWiQ;$n-PaMj& z%EGqrF)2F03s*F!rIOlXpGHE5YRTRxU=w2sl!ooYpyFNHKkeC~^DK&g?IlAHhfy)b z!!v?4NsWm&q46ih7iBd4@v7)&f6Q=z_A=x%mDn`jDd73J^l zf%T4{*x6h9X_0MwED%gxQo_~VVKcxTraxcnP}j=smZO1c7mkfj=Awfqn{kWgn$0@CXauH znL_v?0Xunn^%5!5#WvaMb}L%L$E0?|2bU!ArXWZD$c%+f}$;y^oPo z3h<3H7O_t5=;X$PRS(2R3CHV!$vgf0-L8t2m34Em{HjlH0QKM{GX0lgCqsQ}2)|yR z9X(LmOMV7SUIQgt+Hd`4oXd>UYW{tQR};og3As$7OlhmvZgO)xj{H_Gyy)D$*QV~X zixSmptlqQ_YqwW~KeTGEaee8DE0ZafTotE9nq_Y$+e1b!jWMEu(ZX35@P(~ZBwG*safpR!sVhFj|?^m;V}A()Cz&6WiSmBTNv!hx?WtuYPS*|DhOp1JPiq z_5E4)udyM3v|F(&i;vClLI^J~;$kDtRbk)-fdyw7V zI9wMnVlJ8FrBK@RZ>y4*8@T3d7iDSd(D%z)_@wRxNc}nRHI>*D8EwkB_r+aSd`5)O=lA zTk9nU#XJARet#!IQlVcOZL<`NmZ9%@APPKMw(wJ@ZXv**?Y?0+d_*C+^U2s}DKl^e zbPjmOcJ6-~PQkF%lY`1UwHd^Ok54if`>Vtu-V5*D-PB_bkB98WQ{WO1%uejAMkpCc zpx)Br;na#x&)4j>TfthUNRiE7k5L zv5v?n*uEBH4}7asJEr^=_TzZ>OpLCvhLX~IA^YDCXT3pY9*Deru(9`CjELL~x;DG8 znBHe_2Gl;?VqQOD5Th-4UK%WPjspN#iHVC7{)z#34+A0a;r){>z2!3qDuh>88-jMo zME1s9yU(p`CtD@UIQ~kC%AAgzgL`+zzeFJ%t#Y*^Ir?6b1a9Uak!qctos`ToprwM? z*c%`RNAp8I+1J2Y_`s3RPQj-TcRXg9x(aXugT(pNH^0Q|A=V zy2Pm8!Wf#8ozv&dw$nl!f9^@HqI~dPg%pRW(m$={M$t(S&wIb5hR2t~`G4T2y~}Q> zue8+NUWU3#b}vV2Y0Bj4;9KeBO-Nw@2JNK+T)KjhwnDe?Z2{!<_eLIW`N{ilUfDHP zmZ*#Wp#5tY&ttCm(2A3Do&gH}n$d)>P#*Fcmklbw#Q7Y!aiWTdEYq-U?H z$7)?|a5<6*;@#yShFo26QP{ZbfoLbBE?H}4ZowI?zw?L0lqY-D8SkdeoB%Oui=j>a zo54{#N!vN8KSeTyCwQe2pzZ~=$Sd9NzC0XtdXO7kR@pV2$hUtuBCUrrLKSKw$OzWu zj(Zr4AIj+gL`Eb-Nw(6zI?r1x-l-2lsfo2Qp8uOl>OP|}K z0zbhYqIU~Mxqqb1q2Ll1RDG0OGWlEmRbv3DiSC42_jctA`kjcPW^vsT9rXfsjRH?z4);^djoiB}l^yi$fRlveE$f*19mR^GFfi4| z;6xDbZrj^rLeLuvC|l(S{il`9L7y+$WR-(;t^=9Z;q1C_?+%{)PlgUppI7*YI*NGk znMeL|%-2?xFAAq!@Ks{Fl6rQD_?mQ}2!;3j6Hc5cGFCUf*D(^3SS}%nsJ3DSNTsRJ zpHPb=)B6Vi0o_o(Uq=5RMoB4Ju=VPC2_|EC#+1oi#b-yc{s<$HD@+@U3FS$;ZznB0 z`7#`T0F&bAPBu#Qw;zm9Qah;QP&$EZZV5S7Mw$nA516xE#HG$jV8kf{WY-hZO!4;@ z@lkpCpMMG7=oMeY`^R%0wD)4fD1$VdK_00vuc;ug&|tvgBkaE|vK{_@6q-**dze7C zN4F+X;K8NaN0^9>Mlrvf0)9lx*QrQnrl}So9o2JzhJ%dmC?pg_MU%_zY>jl>|1QdX3)0nPrck}QGfgbKu`FT2K^sL9v9uN zDX`Q2o%@}xaxI2drg_>I1=^y8>)P0a9)mP=M<0kDXSDXRxm9fO{L?*8wVZpxCe*I? z?Iw?14*;&A4O3D+BTvGOz7{DSTBOz;bcmzDfmkX1cL*L|oJ*b^Kb)9=}p}h;gX!>)s%!vs zX09<;w(H;IGPvH9^P+WUE~fp{=_A(0PwRylvs|5Gwav(?PDH7I>YGqdP{NU_#e8fg zLK+zzeLeD}@F^v&Q_sgl=V-lW=4i>T-$s5``QCooaMDNeM^5!drz&lg+aQ2q-o$;W z>JWtaD>{i3Q22F;7I@TmoL;|eDt$h*`AB>Q`UDGQiexZcc#qo7n6TE%j+v0{|2axg zF!?50!&ro2;*Rqv1NW~6?cVk|Og}%?*qQFg99CwnJ}@J2$Uu7nTaJj}Vk*{*g?jEgN* zrjt`o1G-2^ZZ(112RBYid{D`X6Po$SrAGN`95J)(-SBp3=G09QhIFtPh;UNp@pjdt z)F7(9ZZmSmZ6hPvT$yvU^F9XI@T{v=PBuC*nlW)g@mJe{MbR%cXVW%P6_66^xbdSJ z02aC&Rv%57gYSZD6Vd>{S*R%Wj={P<1B=s|N%r9FE7_UXmv{VuNuoXI<%!gSXzA#A zZjNDkSu^RF`}Ugr%^KxL{Cm3H0BB6l=}WePafbs_Vo#7Ym_oGNpc_@)ajKS=n*6x# zEgqRUYwO#>u4_-zELO#;oCV&m-+18D4ii|>)8yh~>#8|?=#7c*zwtxmb(wJ{{`%4f zZR$IKBW0ZRCMCb~Oh)F-`>?Q?ThKdiH_6N6_Ujc)Yu*5ZOoQo4B8o*xB)I850!o|e}-licL3dszV z9a_Go-IlZFurCbP?KQIE<7k0_~u-nc25I9Rw2^ z4kwyp<@E#yU@O{1e*=Dg1?mLCxYY{GN9M4(^Kn=JcRbQA)ca?MUM2lNG&!B4YBKe+ z6~u{^Tc1Zi{2x%r8-S?b#~aQPGVnqmX~fs6m@hv<&lvFMn3Z*T6E&m?;vby3vO+6Nc2oz-)U%hWTwhLB6Rx4K?XoDWdQaA0@&Hv;><@S=B8HL&0cbv4+s!=4qg=ZDjh$sNLal)5b#cR7Uxo0M} zeMyt699}%(lmSM1!z}^3p;}ytm5aPMs81Xi4{-c7-P&tzd$#pV*~zJt&T84SZaz^i zPDUQf99o%X3%QEjQL6K7)nx#ad>rj7-3tV#wA;JeGqe0 zu6@~5L&7EMI;*(Yc=-*czg=qhm~^$HMR-D3KRlJ5%&2~iAO$d-R~Yo}9L>e{M1F`m z%lM6*k?b31CmG%oo~Lh3a`oLa1jGe_oSW_0a6i-3-*z7Qyhwb9|5ly7Bu)4}o+#@5 z`aBYA{UuwsE7dr&D>2=PyGl25XCqG$*TJKTPSG+-S4oNfVs&H<*I|*5e0M^9u>01^ zO=XOZ>?K-EjLzd6g%BHG#$i9WF*<0eZrx^@nHc0u9o|Us(Y6jkB7adO=ojFaa#g8= z%g(QxNp!!guXUi5Ao{)FaAe`-P#yPlf4_`Wjm=U)BMZi|Z3wlvKe)ii_0%j~o;^%; z-1(hmMS?A2UDHe<;%Hu-p{J&r#ioIcz%W>^h0i=i=y8c#ON@MY*x6N+YhZ!kixmB1 zyR|znm1LhJAwEK6JsbdOI~NA6uF7LCjfYgM_FRx37-XO1gpAm;Z0WpJ2Tzsx=O;j}Fkf0{A^e+-R&iv*O2ftWE81|Atc)rv}BX^6EVHJGQ06 z#rGx6o{kMu=;Q*Ro!r4dqQbRIZgMgf*>a6+>vqSDU^i<0%d-xh_4$BD)&3e;V^JCg zd0r#@w_7bSz-9G!V|%P1Mf2%fx$YTBNtd0yWjeedOz6+2{wZxjD_ZbnE!x))l-&J3 zAPxa>hR{{_oH_!(lOgEPQUeb%#B&Bv%jwR(WpWlmNr2U6cYU2)f443B!){Z!d}hI~ z3lAIwVKza1gi-P^-nMy1%y&RG#}SDjR6B)E@xKys&aCjz3IzEQgVeGs^Dq+ov$vn4 zb(bDmJM=Bh-w)~{2AT90{IkEBbyn0;5f0__Q{iyii$8~k>DzSkH>dx#? z!6?o-p<(+NrLhDWKXTE(_xa&A;5bsM1`0UPMvUXhwJ@Z)p;OvWZ#g<$U-zSa zyT=ie?vt{EX~&#jI?E?17%7DTdzUP~imU$20H|}~0YG$qh~-oa{@oxeztR1z&+-kP zk-=2OIK3q$EJHdXJvexDsxr7nwCU*RKs;-4yIeio@*mLN5KlQMYjm`*t^xjqT1Nft zKtsjV!R8Z=0sMUSCQ!A$G}OGChlL6{%xi%-`QC=E7ARwRJ zdh0)w`~O~-qvTJ@lwGOv+Wbm;`?mYuivD_?T-XgZNl9plWhZU(PjKaz-);diV@5+c zAvP-}SI`)X$)PZk@Un3oSa3 zsIIPtKp-d95&)Ho^*ARA*47+Bb-86CMC0k{slD#2ya?JffVUgouU?78R{~3fS9m$J zq6Lc|*!Q2b4mm|4obnea!Ba2sB#^WOgC+=nNTomZFAWfpC14rZ0=HwLfOrD3yzwQd z;MP3rmHE^n$E!r$wrVr&RaobN$qv%dhHF&b=oN%#=1L#um;~UkaZHM=E^9*!t7pXK+CTVd2niLR^-i5BsM&g7x1F;7gRyke6ljGKi{-_^b9Vem z1e~IyGvILey8;YAzF;tz{b?E57gG1vpbO@Nk2BmbG_UfpMMDOAYl_e0l2QfTezW_! z_ff#nfdZk3oQ%ZrNj|%Y7CeK{2`}7d9@D&Z27Bt(HnH#z0PemhRxG6Yaz9U7keImx z>RLTNL?94auC66pTU(8FmIU0ct&NQa6bikMh`rL54QMU5^_q)=8=JAO-OCj#%=OnPV!YNZ1BJ0NAaOs_&4k4+5qAI z1NiF0ecF)MT{1NLuC%slB9mzc`&|kbNCI0ymQ;v|34;e;SJYcXK>-^4JahG4BV~!K zQ32IXdH5))r$~y+6_GhN5rH1*FKuCGbP2Y8_1#H+)n@HyCA}7Y=mn9I2;Zw#qZiNo zz{&vmF*6~C(f$;R*dxv}0B(+?WzgB(Pt)yk9M2nMRs={^e>6zHnQ8lOdG`%-bgCEP zMy#!SeA}nl)*(gU_C`MX3$Ilwkd+ag2RH%ObbNCc9fKWWM>~5CXO>^-cO9R4fpXeV z|Fgfh+nb>@2MOsH&n`7n4K3~59vf`W?IKgTqP?*E!wl(a^zE)8B(+RQ{041mD_xxM zRJ7)zt-5A-wTa|hZquIJC+vc?Vk8rhg~nL7xv+ivJ;>U!rG4fEe6~{#vl?hO0peLNn${oia@UN5nbc)_i07i)nEHW4E6W<-X*T=2KmO zD92a%R23kwBksF?9;z_3kDJYFElizT_0f_Y|E{`8QZASZc%x&wdWW~^z?dd7YQiI* zphNkV3D~mc{lr_qChIv-){&omSC`Q(XY4=n4;;%xum!=}V{9kh&)#g;A>_9}9!T26MnjZsi%il|A<@9za;se?kbCHV)(GVgOWqN0GcL<}o#*T)GV|HwJ z#UKufLPk-DRhsOb7V#GC4i^U#I}wF^oJMFVEa~2`0IPC04X!t;hfQb)^%qV1!Nq2E z45Ve7QmC>uib(C9+tf>y3mP-qzuGjN6`wbvrY(W+jWavU|e< zQyZ3W0atm&wfsz`ref%nF^h$y`0t1;o`N0UIKQYd;lm@jMF5T^N=X(UuO&#qsz5SK zp~KLb6f35zV{|Y&q=xfrnpWDj-y|~$iG0&bqLXiC_)ABj;y31*6V|wKI5r| z_#XPr*H=7Jq*>=AlJ2}@Iw*4Qvs9nG0cs$JyacJsFHd3eMLegG(DshWJwj z9GPwEc!vkPjaS7o69scerUFdYp05DlPFBiRBeK*;5sP1~3aI0Ad$J&&X|B!*bVQ{L z%c)?TwB_5pVRwVVt$x>CARN8rnq5fEi>d5GNUghll6v=!VGV4s2+CBiF) zaNWrwj*b^6;+kN0AIAue;M)Pm_xT-01l&D66{0^>gAF!IHR;A1Ye&A+dc#9(Ip9$2 z(s{xb7Y5cB0P9iI5cR>Z=tYpGme%fkl9TQHuLMAHoaR;jF+R7VYvP%9M=hHwIkIW# z*=wrVmm<-3b@?3Ue<|{jw;Pr`f8V#DsxyO!;o5i#FgF=??N)DQu}iz>9QO#cX*xzV z*AAAU^ZX#~Wj6L8{_CHHFUGKCBVgcQ&t|8U_sO`Vrj(x0>0)Bdnal6!s-=!TP_!xUO48wPF~J%SO%LVRovw?5v-60?mxuC`^-nnsN}mFr zr2XdwC!^e1b}MM9wZ@fiz;ZQ9;ibXu&qM&RZ4lF#>RrpsT$5xL)f#^&Y#cq*jUV zhkMTnx9IUeNA;;lGlE>>JT1K52;GGqOLu%|Z}QeZpz%iWBmfb8%;$#EgJ_)E+2;h3 zd)m}=^=-S%-sBGE)C5re{Q2{lnVFd^8q}hYn5}WSpe_)g2J8{8RP*HiC2dz%e#MHU zN580?`&phIVAZq>#1Dq>!-Bh&3t^b*p>GRoNq2Utu-xK)Wyk%m*)&449SZaMpu__~N1m z61eZ{{O9t-7DID81p|`Q#~k1nX7taSu|=agu(a!&&(U7^!Hp}vqhk)0N};zsEpes& zWoY;C>|?)mh8ms|zg&+aSLeX81mn6BD!NhmBp~<=@BUtXwd!+DFi(1^&Y75}XL8Oi zM-s_4jTDS;O{R+XAV4;aEM5y1(CCtK0R$)b7eB+u`I)o$e0By)sjR03o}E(=xMtdd z4a8gaT1NG}3)~x_!U`w7Y4fsq^Mse76Nj-*I*m(?*}hwo8u{a!I&Ltp8eTO|wf#}@ z3xkXpz)`O_cn;;3n(v->YxD0<33@}r?mGghN}#l~u^pXsf6#5ImB6IVW;H*-0-|>95GK?_2w?IjX~Z|g9TfW!8NKmL*b>v+J9h2H_Zu=>)XEW`jCnu89ALK zyjK$YUOSX8k+Mnv#bV;*gLm4m)2nG?8U6NHN$ZTSHub#U;JkLbPMz07`7r&U(ZlJS zHuU9Di8LVlKk#K>D4FZ3*p27(b;EVIv+G5{Go=)Ua^Y-0COKV;wVn0Y^~{omL5{z~ zz5QrC7N=YtH3Othc8ros%mQQ%shQd>+6mW$Z`HWI&(|6RCQpGVrOu%#ltEx(Zp7b9 zT@SmVq@S5gR*4M7!pP(QLy+~EJw;#q*i>%MAF@#w^!xPt&92!?pbS3tt4)kurn`5` zIMlqjObDWEQyJ{t8Ec21vaCNxZPeCAciX6_vR$}oG3Gn&|XfAdpj0A!1oHM&-D;a2;$CA!o-r8UK^oDWH0>0*c3Gf4E`E4>i=X zOZ%Br-52_$oS*Xet>9d7Z!ztvw~Uh0|NNw`_4IxeSvpfRy1QWWS^deKhYChh2{RJz@CtvJ*6a%|yKTlT_5VEr9V%{NbQ@91km~$yY zX1M)w;@vCi({Da^wMHR-Jk=>O-1_i7)`ES~2;p{2X(glo>AJwho5ehhJEjWX`gHxJ zU%qXL(|G{13XzI7UB+MKB_X-0+@GzE28M#$Uzta{ElSBHA6^AA=)>@%lS6s>CGw)} zo4*9DOuPIeUjjtf0|-M#J-s8jvDo${H}-q?9s^v3700s3(GOKbWvL@`10GGx)KaLR zn<$K8@@reOQ-D*wGck9H=#|{2upQp`mKQvubhffxv_m2@cK+~o1lKL~MjoreofDLM2nmW=x7}XLuz|rI=3FboTv5u)d74X+^+=TSYp@J_)R0V zz)&)jLI z0s{8vVKbj|M{055i%e5%>e{%`UE4+4qk*209m|i=wLCxktTil;ZE9)bsF!*^xkeI| z@j>T}z8$wD0<3D-&DyYvR$V~0<}}m`##=*5^=5K%(EsaK;cy@s{NU|6&yg#ptK6?S zZh|P4`Mw|wSde#FIV{r?6#@_A&0Pz^mxrZXrrxWKN?-P=@!bkMTHm4Z+2{%-{)2lh zljjo}2Nur?ipy}s3fiK>>JZ^&s~^pofBjW2I~4|%)gD~p^q@;!`YyZVpvz|dd%;bA zw^2>zy+fItx2Wc-{0x6-?u(hH_uqf!r#{6INzTV+^J?HXuQpFb_Z=h;lWsAD&X(c+ zu&s}nI#5(=&KoynuQ_t~5u@Wj^H0G^4&@Qlk6Fz8o>`=f`7hWv%0x zE%#k0!>8m(s@ZKqc5UtQn&;UStY7)0D05=^t$1@bX(oqG?JVy&PbVOtT7!r*+0XdO z!OJU@IGNdeO)`t^wZhW?C*Z1mI_AB@cfx z{!hfwl5YKB=Fv(*axb}s(R+~0t9*AicipGnu8DuT(=2{9m!Ik@4e=U|_tm9#qr>S$ zzXCA-g9nJj8Y?C;QQ*@7>kwX~oFJucDxdQ4)=|v6f@;{-SxGS~c>x&!*)^z|59RqD z)UN}eWGu|~{#u<)6l!W4D_f!n+6BjRqjvyH{d-RGn(_a4k?;R&x?!Ti)=4+Z7U)N9 zSCek_x*wO!ogv`Yd0HQ^|GmAtb>KV7sbd9IYl^rvRxOB!MSI~w8ll2)vhc`Au>P?2 z#yCIY(9{Xi33x(EAjXZ-!b7|iB4*u|^{}#ndvED!uv3HdlK6u9zJk@XrGmO0(yE!V zpYpx`{>Tgh#BRED7f<0+lZSYKs8eyo)7#~z-Lb+pX_ZT@No)|dz4)b0smwpFOTIJ1 zTG*>j`f)2#wJ)F!(Oq4D@_aq(29`c}KTUj2R7Rr7p|R89o>@$R-&6I&@8iAX|0Hy` zAV9#^#zt2y_Si*5vn%C{?W$r=(ORgB*d3*(PXU{8p<*`RxK#nSuDYJfzJ1xit$QaY z4h#+;?AoKBeOWNTx~_Qfn( zT{MtvLhaTEY=1WPsg}W~`J2C06!GL+Tz%GB5~BDC4BYclA|Xm4z4h+z%Ww`TDs_}y zqrf#A>sxuRgIzE3=*4_s9qis?rKg{g)zD7?Jz7mbGca3s$!3oPU_T$F1$z*Bw$2gK zZ8A7A5{U}Z=?U7~jLj|Igdp+TnIMRcb8}^T)%S;@9^=DPBo&pQ7OU@}f;0ePIGF`i zPuSRpEvR^==~$JRqlGhSwJyEsLzu{Z8a@q&R#G6TA* zyLu1h*prgJ%v`2&^D}*2=USiz1mxj>^CG>o>@MOyd6S`+LEw&R>jj*dD_Fi~aOE_)P!*JQOi4n*$k zV0gNr{grmFzz{*yQaMXVg;z-t+SPeaLq52+b(SsSNBai7zTW$3T|Sk8_-Xs}!xgkn z90USxNnj$Nji23MCM6btn@pPJZ!4A}2G@x{fv>K6 zNJc+D7_x%THQ1PlvdM_@xLvAY#v6drxYH z0CqEjj2+4`b|b*=DP4{{f6YkwQn2cS^K| z^<3he_x-g1!dIcXp(JdeKAQg~CTZ%2vx`}KqtAb@C?4w`P4_Qi?bYHN* zEP@YP;R$u6PnMiK7n|O#f6B=iuJcu)U{Ok6IP>x`2?>>&qU>Yskt$%QI(errbX4FF z97RJF{QPbQ>AXeP8)ANT_zOG?E!pq2UmEw&)m(fMLK~O=EZAfvF(sY4gLcsQ-YnUZ zt#vyFC@~n1o-lR3mt_Hi(`9rSSbekOXB!gu23>9o~T%-m686Z~0*A>KE+ zW&0LhIh-uvfk|2*5aD=pAq9sBI6zTF-)%$LE;CGs%N)ZFjA}R5AOwtpq)U75S?0xl zf17O{X-IRE=khlHv<|O$RqR3BJ)Axu;qn_G?KVQn?RBUQN-INc%WY%?;?j1KkHpx~ zh7pFlb3D_Hx>7mt@2)X@4@{(^qFqqeL;6^$>s0ogGvuP@nH1_}Oj14Ln3nLD9no5z z>X9V{CgBrOqIjI!fkA;#N)bjHx!26jSpdw!xQ`Hce#KvF;wA`4LRpfy^e)bR(gh}3`q@Eg?r!Ur@f{e>Zy1(4dqf1~SaC-{{*Gd{#D*^V8|eDCYwr*1E}IP@Za>m!F# zRrh5bTJ|=>;0lb~GCsR~iMe7CFI+|D2^?Snd zDKV^EC+n8<(&9J|{nuTUUh8ZiTUWrR02r`B(ao>#>+u#(F3!S=U>)Mp@!p4Q@v})l zMq>cZqT%S6V@`^InwttFjMhJobS2i>t)Cvp+Bl^hE$^JGtvmc~9b#3ecdksSEt#i8 zxF{BRAJNH5`N9W>XBYdN>sKPK5v`RgGb$GC-B@314?(WKjQdoDy;9kjqZqp-(>J7I zk?84-&2kdY;OlOwuJ#Kj8#lgM!o^;q6cnqH;7L2ZgB(~Y2GJlfd=ygO#L1JoZ3~d1 z7!L=FF6?K)RMiIaCc}J$kih*Nk80%F|U*{R@?>zM$#DUF%(20R2ESwYb z`4jpOJv;2OhsE@)b9WFO&&RmkX5*B)-}#v(Sqg5)%}Msf2P?cp_?dZs82Dz|56#2A zBYC1$ZJOpIPY;g?qlTZLZset;zqq}uSGchAv8lt#7}aybskp7oCO&G+btovD*XvhS zHUY=+n^2Y4)Z)b$466&YiaIT>6-j?<%ax|MmalsM}s_9e4$g*q6QCPufc0fySNlnQm&3wua>*v z5a{bzcb6md^o1}07iD7$v}6?9@(sVDHM5A^pY4{arjq7XYy%9e84dY?Ok=;PqC}_H zl7$qHHx^6=(3)##>7#?2?pC)hqQqI$2PX6MzWl26wC-}ah$~QL=sCmh7$)a+%fi9; zvV~xmlSkH*1S!|;Q@1`x8##0nmF=4;9YyZtzDMPy+LM)~L?&{conZGsKQq%Nm)(h% zp5JJJ-!s`xt@1QtynMCO{nh0^dcyb#{FA~4Koj1m0$e;2_!5qH<^M7sY>W*;qp=XR!mzw4vOFDs$ajetGk zm`qu%50ZH&gORyba?i?BH7R4KXVuhEfPhKt?3_ zb4RLqty9Y`DAx8C8mZfdNu)S&TJ3&FBnG<-+AJ`pzR4rbEn

C~*&LvVULIyP2(r z`g=KWNr*S8K@5snA0R6>p{0bE>5&T$_N^AZk!Bq3r8W`wVzp!Nzl1$NXfjhSJXhb4 z8I3PWmvuLpnCZXSB&Bt0U4;|JQVOVG9h90db^CTW(B!(u91E>#6k-Keta6O4yt2m^ z?78<~CLvVI3*4uh2rH-dk4LN1dW6=+!)MZ-L{wi#y?Y_7ZQR`$aLLT~j*zXwV|y<# zOO-8t@ul=rtv?>Nd_mH82Wgxa3Qw10LS^ZN&;{|Zgx4}_kMzCaV*Kr~#QET@3h8$> zan6vnyZQ%`I5S1(!=I6pJQoJ~wioacM+uD~lUVGTz_6LH`Xi;|!=n#blP3B2HIcWz z0UHZ%UoQMi`1S6L+BAOneX4}_G|ux#reX`{$&oLlm6J!-I)8C7_Ep1v7{hy;apjii zhv)%YKD(~ypvc! z2=CzI))=WmL}SD>Hw=t)Jk(7RxXN^l`nhf*D6Dg4_WA)epO5%{knwe7V8V2pA9KCG zD(((?x>f$}OvGZBe9~jBK1Z>Bb}ue&4sYG17m7>jb^+3zsmkuCvBJy&Gps!qdOgR( zuk=8LtM!-7q-yIgXA}CQk5az8#^PSV4z4Qr>jxFzy(H~ek5<955;hyv!zhWnBSnfYlEqr3yjf~-rm=|Yybsl_HgrQ4)DR{h;q>!jTG zGO6T4Djl1h>VufuBs(8n;;+^^z7^FW<#G+qLBKZc-Rt`8&K%u4H|ua~T5vKmFhhmZ>W7#k zsJqD1`b&Q)#0o5eHzR0T2-tw*Ug`G{7pA&+4YW>uQI9UW!_{Fu<>$M|Y%t%B`88O^ zQ>tORp)RnZ8$g ze!Y6fVO)dfUcun->l@{ss2pZ4l)+g2l56eT*zSS(c+nEiZT8a5E1gHF?3im+mN)!e zXX!%(XXwFgLd3~uj*iyruQsN*o^>Ya*=`qS3r-HCnqLt^2)s}oS&QlPwo8TxI)b~uvTPM9%T#WjzX^bHAK-e>jn2_f_A@i8|RZ!_k zC)m|j%8wk#!{ZMV^P?-d$2W*mvDP+a4mDylrDOpUMB}-$P_u4)VfmjU`&`R3_d?$9 zcVJ>I=vs5i@7%YzY^kDmk;Q6!{c9P{TDZmB|9*Z2vLgqZD9jCwEmlUBQ&3(NlrjE6qCnsJqR&(sGrj1Nc`y4!+1cZEz7AkI(N4*d3Jcp*OapFLxe2jlm;t-uyiWzDTbDR~}^wR7Yj;Ctfy~6Xr zG{Tyt=4-kV#)kN6SNI({Bb*5M0tvMCZIm01_&%~te!MvXLIo#s=T>Yd?enFKyFoUm z^E1XD1Bg>Ddv^#svFdTrdJ5$waWvkUBwP(84V2nFJa8quQdlTL^2a=2e+7%%b@Crw zJ%tXE#3N(`q310<4)F$!RAOY`QgVq6x@?-wo$uCJrK%O6Ml10Jh zQpcdUXhEssWaxOpmV5q*82phPaXKrL>k0@N_Dp-Ic^<}ezqiTvA0LFDwC4aiA4ne= zP{YYw-~Xwr;S!3c9WzuRB)Q)ORG79f2L-bnUbL^?QOc;BSXnN@h3}_pXXce zAS>!_Cn;C2>#Jaf7L)s$Yji%&I64gK%pcWlj=V&nez8IA*P+Cw9`W2GUWY1Kojnn% zY3(N0StkC#p_6Urwq%=S~nZ|eL(PO9;kypAKS;WizIV4^#m1bEIrquWH>AUJs@%cic)Kjx$4IKU)LoYi%)f&_Vg123-F)}=4?ldp zjY00A|M+QYIM^0gT0-5-9uFd}j2e{k;kMDtXxMZM3sqgNJG1@vC1yGpqyDQ?Gx6s< zFLbCYy`$4-3O6jg{%Bqfp=3^SJka36XdCt=8pbvQ*af2@-28k=X&5Me) z@WjH*#&S!{QpIT};eyQ{cf1G+0u?@ZSbeK^xhUxgzX)=SSs%Ktp z&fk_2kd!W{&A49Swslx$u#06Y|0*<{WPm<;JaYs14kRRtq{O)*vt@@`O=8ZhAB$dT zYrj(La@odq2xeqsmsu71+G)9IE0|)QJS&7FW^d?AR*G|`<+ymn8=-jg*4CVe_j4k aKwvOpEII{+Hun;*tth7^i+u9@_5T8Dva!Vg literal 0 HcmV?d00001 From 2b6e3347b8b2e36de5c12cf8dbbf991493eebd58 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:22:45 -0700 Subject: [PATCH 35/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...first-sight-microsoft-defender-antivirus.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 1b2577fef5..119645ad8f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -135,6 +135,24 @@ You can validate that the feature is working by following the steps outlined in You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do this if you are experiencing latency issues or you want to test the feature's impact on your network. We do not recommend disabling block at first sight protection. +### Turn off block at first sight with Microsoft Endpoint Manager + +1. Go to Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. + +2. Go to **Endpoint security** > **Antivirus**, and then select your Microsoft Defender Antivirus policy. + +3. Under **Manage**, choose **Properties**. + +4. Next to **Configuration settings**, choose **Edit**. + +5. Do one or more of the following: + + - Set **Turn on cloud-delivered protection** to **No** or **Not configured**. + - Set **Cloud-delivered protection level** to **Not configured**. + - Clear the **Defender Cloud Extended Timeout In Seconds** box. + +6. Review and save your settings. + ### Turn off block at first sight with Group Policy 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and then click **Edit**. From 6ed4fe9456fda14ecbb6e3c43ab0875ea2f54a14 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:25:19 -0700 Subject: [PATCH 36/41] MEM config --- ...irst-sight-microsoft-defender-antivirus.md | 2 ++ .../endpointmgr-antivirus-cloudprotection.png | Bin 54219 -> 11884 bytes 2 files changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 119645ad8f..5a2cee3e2f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -86,6 +86,8 @@ In many cases, this process can reduce the response time for new malware from ho - **Cloud-delivered protection level**: High - **Defender Cloud Extended Timeout in Seconds**: 50 + :::image type="content" source="images/endpointmgr-antivirus-cloudprotection.png" alt-text="Block at first sight settings in Endpoint Manager"::: + 4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. ## Turn on block at first sight with Group Policy diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png index b2ce261e9e72c67774d268b171bbfc2f8dd77f07..d9751a49538914e43767baa4b7955f5852431864 100644 GIT binary patch literal 11884 zcmd^_cT`i`x9?-+h!l@X5d~C0q^mUPD$);~(2Gb7T{;QP21gK3sa(R!#%eHDrvmcG?i$kX<7bcl{)*{ zBIkFNlCk$gA8$u@Pe=i_T@_T(d4sCQc3w7~Fb{8-yBp-vxf@)do|am#=ZkOM_a5-?g50*3?t4d&6AqAmS9pbKsYA)L-=7?Y;f1J?$VC9>>(v&;M>5=4Inz z4NmohRDS*x1FHX^RvTG+y20EWAfK#_2V&JlH z#D)n7@*9i1p^p@PVR$oqUijB@fh)=WqTf<}n0v>&iWuU5MRrPYE9r@3dv6~?9^FJH z&4nPhROLhDMCPhJ?$-%{jzU7S0`+6*8XY}Ye}8-Vlr^lrXZ||%3xp=dmXTUs`}_Y< znZMdHCK9}Ho+qva&SJ(bs_@b9xJr*CVp4hnWy-r`br0MuG%gF7y{>~1f7I6KEsS7jq2zMzlFG`+fc4dZnRv~asvxW)2ba{pELx{Nn( z&RJA@=B)2pa|b5xo**e9m`pegb>Tgi`-?J83D6=2zyaw=Ru;Gpa&4tM4)6KK^5~dR zYyx!3sSxb|N8j(EHX3?qT4!!KL1TLpYhIm+I$U<3kq8&rB1TL;FBuzC8T(*S)g;^1 zRq?lmr+LxQiKgC)Q*G^v8ez6YWRn1B7eHO-TmO{#q8C* zt;D0G$WtsS4wI|zm#vNUsTi(q>mUl4D;{C0kmm`hGAh;Z6QBoLHHu3_O#J)|yE&tk zGGn4)&K6;2XlkSMxo=bxc&zb-D}QP3_0Ns>|M(jJLKByMSH`b9us-lgY^RZY@K)A| zC`*Y?70BAm=_=FxVex#s(ZzcfGgFM>`Aeo|oMXF!?0rw>@+UL$2XkqSvd)F57R5B0 zrqQ;}un!LHc_at;R2wr5PQve)<+VJ+k@vF~Ub(?L2tRY*zkZw%tQR-ci=7iTG8){n zou%pTS?J3xkX0j2Z#*-OTso(3zLMhKQo#wH!s7+Ide>MSuQpnJd$V0Gu;KV{jgc$6 zHMYk*(;JzAqmpFDZIeJ0slP1^s*{$l!X%XnWR{d{XR+YDW#;k?dTqCaP zI=kD96ggMe@{1>FYzv|g-d;Bf9|Rh38ZD}7DvL9__x-5-l0Hq8DO6QWIlP_wmYb*9 z>s*TXpJcj(4{#;%OQU@r?WVDfPiJX@wWAcJM2Gwf(P4&$OAE8; zYz-Q}ucK-16_)OB#njjlguFFYe)0xRS;N(DZP`Wy!MJE@1X}uhPPdY>Jn)iwtC~!j zg(p#4OP+6@id#AwK1gNqlUZ_$;~-pA6dG|FTiHuVp}e10d%btx${IU*f~Ps$>~|9_ z-uakkgXxm-=~fhEP_&Vq!{|(y(=2mvDIL4{z-&?lUfxW1WE;Q4qFKAF(-W&G?lqHiZ4xH0NZiYJMLES639ygo=z<>p%6?{8mShFtkw-J^ z3tY-xMn}cv=wC8Q%6R|z?OueX+&i-j(ecIv)YhQ;kO(DMAu@212tzP^MP#Ax5#lm$ zv@M-06M35i$DS3SOZVp6aWj7I_`?^^r#WpnFIH@7!VmNEu`r6U@0Wa{krp@g`a>&$ z*hzu%yc)AsdW2zH`c&_91A(tldI~xNF=*0lyk9O`Q;qB%-a56oz8_IR{);i`zH;lW zh;!oFV4b0eyZ4{KNe`?W@+A&4(hpBs3kkmxAChvC87~v-c9XVBRc1~U-?Xg#j;@MD zF4$EoY!=|&v71_HmSA!}x)n(}SmBkE5!l6uVD+(D!oF^DQR)qO*LsWO;iN)t;%0%6YG8+hF`M@v-0YL<&C`S%b%|L>Om zT^x|*o^pq-?ez&oIrw(|x`~EHq$OfSJYC8w_xXG9%Dc?Z7Jd44QrxYE6CiG*%w2q7GT4lw<3+Iye8BCX_mM|RZu%w*Qyec13j zs?RWb&*iTTf&45MFv8{+7rSdW0|uD+bxQg=nEpCBDlr@|XJ?Jk(NU#gtVONiwn?zU zR$4t*F<*X3PcAX0T`fqtl%mYT#jPg?{C?BZyF3@)q+F~At=&%ki=R1?{i*G~Vwn*x z{+4=sa#@#nTL>y;yI=s7ddcvEd&0^WM^b796uR1Zw@B&ka=Tnx5^<3NCGN+jve-!< zzd9`5oyE`52<|g?4MSARW9|1lNVX{b>NctNP0A1EF1M8$W(^GuCwF&|>XpuP86Jg@6&&Hyr%&E@ zPV~RQEY-l<@raiE@00i%L)ICc4Eo{W#^;o?ryw3BS}6G<1Z5SPzCLpa4-OW#7y5ku z_K5j9u`cmfFa@)6VmxZa>aeqZf-pSABY#ZlsvAB+9S-f`yK3c-C8)mI70RJ^ZHdEV z-tbZE%w!nce2vKh(N5yS6f{zHBwK8@X1Bmyams zHRGJE=^Vw-uJDYL+eshfk`}50Er@ISP*)+p`q<`GLzbMOuHwq(^TUx#+5K|)HS~M@ z19M}eRnKhp8AEmyTU?EbEroV>Igi%ESFTFBU3;*ApjaKZgnD z9M$~ROVc(1girpD^>r$95kj>&v&uY;IwdWa*9HI*m^VeF1FUhuG;E&=y6E1QT3q8K z6Ea@|LyeHkR-wVs2K5~Jdq0hF6-)uYL93~XhqzjRX}eAAgkw!v#`6n`hz5m`u`A74 zskrt-bOF8Ta5!}~iDf06njhWYTPk+8beZWd(BA`x6f6I9COG9*7F%CumrIjG+E{n) z&~$Ky$E`Er5iDRFf89p+H~P82w>^!cw(g|43vWEJ3EnACR=ygOgTyp3enS!vIWZFP z@AGuDJ_l9gUO>5F`8|mFt0$J*=$lR@U3M!A8uNbWepVT`o5Q_d5tNvk%=v@iO8fa4 zLx>fICW&oncgRPKmSoIz# zPI;vnx1h;K`8a}c&WT-hx{Q-cO6k(DN!8Bz%8W28EGjaA>asvb%W0jQUb=~|Q26gGqhMXNXxE(4bXS3du)r zOS5(9JaSgN(sXucV3E+t=?t9Ot@d-{Aac4lw{wlcP zU9c}|2WQ0i4dVCjXh*W7XfP7m>0Lj`{_$OMyT7a}Ou{vsDap)6F7a=kt?KIdO&_E4 zT}ybPaUbKhTAfi6ZA<%Dmz4!RiPdvwCTvnX>6RK`R!Ll-5Ad3ENveUU?PuNdv_Dvuo&VuZHc;Tv9b<>K%x@^zgFV$MUQVj`#na*XE`ir zTgt8l*pGGp97BG_2$aecJ`l6Dcz;IE=7wQTfam?h5m2z^4A zYHhVf5p#Y{%}T+>d`XVVezY62EUf2)e(-g6RhV?HO1} zpDZWZ=sl_6ls_Q>@MKo3f^7<-5Ay?_j1RvU@gqfS&eOT4#DX7A$e(xhdDa zACC;=(sKul)Xnu>N%MLhP9|)QA|o_szM7`3Lc@323BYY@Y7`yHcQDH@Lv7`Zp?te# z!sdzJ>0q{B1}kxdt)#jC2W%WFR{LJgm)((2= zW*`Un2L^|mHtcq|U;g9tG-=f~59kYT9zQCs+l&At;cSWDx)Zp5WVO(|cA%8i2mtvT zX0D+n%(@$ZF;3cNG2U&YD#M`*xiHZfo`OOp#ak4W=j13U?DfQW&$cI@RRJoLmUOHf zhtOm?Fnat!U2IVdR3cY7EB6nGKLAAX%VVw+pKqJl zj(|cS4=lJZElK;WHq|7y+|hz~RJFO|b8>3^aG(4u{}Y-TTD1MfQW>vVv%N72f{h($ za`~eF5P#^Y_si59|IaOh%6q^AFc8Wejz5COCjqo}^}Y?b+L$_6)Ikw-sE1bGQzJt@ zPf*#t;ecF8!mm-pq%VVaQE25pS--;)qhTdp z2KN$i6{|zLvQpSDU81oB=#eqa79G#0!TIaab@8_jZos57QpaA(INJw5VAn|cbf3u} zgA@>ss|fb6yFUt|iWw4oV009}6ui4q={`Of6LK&Ge>F>|`Eb;fQ9>H%$z;Gr0-m*_ zK;jeUq=4XHwAOFU2X zc|r0}^-Dan#tA9qvB{hz$hkJt;;fV@*9}9~Si9)*ZQ0bfPfy9ycRCa{$75m+WJ{*~ zb$17MH0V*dCd-aA)YrNum$aGa4l6Txa{5v!yF-k?e?WF*<(er=4z}g8b9gC#lgfZK zHcxMBe$&Tf70JB#*)(w%2^Er5!BlZX4nN=B^IgoYAXjq!?>SucPbr<2fG=(E+DkwPh4KdOK3)R{(m{LP>^DciJXX`A>VZsEfe*zg;~;?84*vub zbas_{f0*LyTv$#H2nO1x538Hf=A20bw&O^*iE(=;eIjhvpKDHKKzHU;JF@N)+fi^VfnAz6iI!pIZNTdQ|ngL}GtM?FA0YGRlb-G1XitbSmt7 zH`Zb0XCT+3v(e}vmYqN--?v40>8Gq$Ixp8Pz&)Qa#j>q=kOO1ko}?7cR+Ca;^-n0J zMxhoE@I8uDPQCnx!_qg|_&%z3Jb0uTCHQj{*7I@;{arfAr{ID{@no3p@FNj0`(=!_ z?K2APqGUS>SsETUu9Ai$JI#USxP1ru{(Y`yt! z()Nk1Re1Zd&e5_NRk#A?2oClC1P>B&8Fi)w#sEC^0rI?SR-alF)diLENeM9EI zH+`4=(myC~ADrgir&TH|2n3cA^j&;`k0zN$@i+CpmEY?~-En#|XKYoU_OXt(PyjodBOe`hm z5zH$q*7`%MC!fDh9*0G-Wf_iViBpd}dgQcCB3LZ}+7@T`TI}ZwIwTQjINP7at?5>T zkh+%P#+nLwiHC)*=OCfV`SI)Qc>pP%Ge>r$uvoV^PL=k14d{Pr+JYBv_k`WsG$5FL z0DunnDeAq`J6%Px7P!zUJf=Idp)F~YGmkcnJZc@wmBhT!r^Y7*Q^D$zcn&Jm4U3h% z!@Lxcyi9mIc{EA$^|RfUpPP8#S7yNynJQnw_2Xot$izfuo{Q(soE#v|{z-))J zG65c6{LegYopy#;?Z`Q}ley>;YwT2Izj*X^rFalC^hq!=c7>;upTjq4g&l1;Gu2gt zVGTA`>pO$L@*^>!M!_b1Y3I?_SlG0QmJjp97%%N(E$_dV7L~8y}Kg*wob5c*Ui`=R{h+ zts^IYcEn3KKxETIdbumiOu~FWFvfFuY{ze(Wjz*r!)Yj02B>0 z<(`)ejd$?@#?z3WkcobS{B}p{yb&RO&@u{8d7fcgqNUPcTlQ(HD|~lWreo^^oXG@L zMyIk(r!+9dSkS1z&nFWvbkWHOWruoobF-lMPBX^nJutg6M(BtJ^pwW;VW5~5pj&UR zS77oK;w@Yn%f96N>Ib5;WtAbHq<8V`4$tdM(j#B?#?F0u&JEh-uNe_crFes3(jrd_YrA_K=fb~O1xxkrH}{ESg!eQOB+J?8iV`Qu%7w*p^f_f7M~61 zG3H;@z#v2ypVfU@Fp{%^>AL5@*#?VrqU0QI9jV_2w|`I)K! zf1c<}N9eYEga3{(9&6kh^jRH=^bv})P6JUu(l}fLFsl=6!!1h@C?MZJ7@%Ykyi`<^ zs0M_22EW<%%I)8TO9z4IIM7W|Gei)YoBv4r|6|KN`z(-~xQ0DWIBM8?xV(njv&H-q z>EQ5z>I#fU$wzeyF^h(`K*;pVL*eg3eEr6VR}{l3pv|sa?UKvm{B~52wd)0;8bi`r zPwEck*nEuTsOn1(fcs7Eh69z+gVgZ>ygA_f`#0)D4oZb3j@77d0OIo%gjnG7-;Dw8 zLyp%&kYduO&&T2w6LeiZ=NW<=c8bzfey~46fVvkTuAotfpS|y6$b-`D3FdMP$h96$ zNly#7ng@_PbO_!T=G3AwxE@#9sQ1yZZq)uLbcf$f8_-#w?+`8Imn~uws&~B5u)FQI zfQVwq38gI00G?aE2CZ{cEWWwaxVbzLU(n(kl^)~d>LjAVsl=zbqnLsVtf1@_gj3^P z-Tgcjnb}4#Wj|WjG)2kHarbLi2su-6UAfuQU}cN}sOyV&Mj{HeTjGxEz05nJ-DMz< z%hVg&Xt>X>44ws36Y(LW_oj1_>bs9Pn}MIlC_~Nb{%M=Btd*8HJ3V> zs?De%0kopOv(o0(xDf*zz_=L?@S^MlIrDA><;-ES0Wdp+w=_lh;`V}4R8uOGqs!Z8 z+B!F`rga&2$z6!UO<(k~s~2SQSHE<$Ij5#+-`15Re&1b$how(Nl$JFEPv4;)Z8mrK zvlw`|$-S~?EQ{^e)`Yjhof3)^mt?b+9j4S1s={aYN(UQ+2EQJtIUgpW$I)0AK|;SV zz{w6pNje@2)b^ru>T&W6Ig1mX6zlKHC+|L=oND)i3XGJGLXXS+F51eE$4_Q0-tNo2 zhjLH+>nt^m+I_$HrtG&$~i|1!LZmPMn{qOuQO6ew2cRAQaoz4y| zEyR&V>OOk^^)g)m?sdbjeXmTJBRqoR$&_-fp=HG^%4JQw?}yRj%`moAFiQyL&C|jQKVTv3!Ztn4)FjAKvel zk3fWDYI6C9+O7LF14Mxjaf79@2cx7Vij!Q62P|LWH0Q_#Jj9_HBox!zHKsPPm@>3G zT7lHz7R!>)6AC*Gd2mJ{#9xW?xGR;X5~M0Zf>sr-5g%*cBw~h4{DwOv7e1^$Mljv& zddANi$N}f4ib5cc=H|h@yKi_HDqQr(@iNUoqWD zzbSg0VJ|fI{&&(z0RDs{n(dFJm5B2ORRiW*Ivwd!aKO`t8~OOX8#hx z2WhrK5lKoGy;p|}im_1D?te+&%teohxsn~@NO!}T`k0O(7Hht%c`8Yddeeb8P}ypk z1Q4ImT+hGQ>y)3_#~hGHE6t4V^yRxS_%sLk@jqZcqV;Y_-!01d+O#~hGdiY_?BlORUI!@C(;ZeF}bg9To{}*D47jUK}rjgEca1QTa*J(!)RVzpbeOVM$&NV#m4Ji8aZ?6KAipQ5fpXaf$-_D78%8j9s*BSo1AMtN}d{|VK3M@(b5UxxXbiRMI-lh+hji+9Fzom zneb`;WS;iG!_}T=Hu31C+%Bbk%7e^sxoO~JozOr1AlXRIc21^)%=nX;=NxQMR=ax` z%aJ^H(r&KPgyWaj)~FyUJsQ@ZpCgHl2b#%^jxemi&-io|dyB_8{d$|#)0N{D(h~>% zuEn$Yn<@Mi$%>fNm--uQn{O2JsEDd?Y10Kxrax4=-G?p0$+dO!M}BG_-f5+)nF!E3A1>W->6d!H-}S<#1xuf8 zqd$Yi48;6O9i%ffD8u5+Yfx^^7(e6p@3e!`r<^+Fe!^=SX}#@Zx)>vcu*V}lKF~ik ziU8}$X2a#_({m;HzfDb zkj#*wF|2bkl|IAw1J=71k75A-mh9!NxE{*xH~^SMQZH6;-{X?oiCI++2Qu#BTTu5e z&Z1ER8v~@1ov526z(RwBJxlqAa7MOuKN}Ag2^%#&qDthU`0KsWk{F zlau9P%GCW?5X7Uhq_`S|Ea1mW-^8w?zGU4RTKPBn(GZTAXDP(KfRC^$mDB+8drc;`lrZy&G#&C9UtNVPaWLoM@ zqu>4u0HxA7V|C7}y;PTx=nSJ>G*wN(qeexke&>|65JP}3!xqC*u4Kpo8lIacsHh|d z@<5Kt0u>xzfo8?jIY|%WE) zjd@kjLM^Yz-$E{d=T7Py>zKwEejD5Ba0?R8XGvZk>USnk+Tvy@|fmwq4 zzGvBL{m`;8qN5WtCNU&7>~8U=sQ8s$su~;_=9f6Pz#wpeb08n~y0g75H=;p0fw_Nig|zD+h&uh&t|*!L;RYSg<@a4RR=3f(ueCeiU2!BF+`uu&{v%9`>_mo;`c^>^6J&_D)rSf}EC|jEsx|@b--c z8QJ9-GO~-n>sLt-DfQ!O(ytp1Z$S_;GM44@p9}9;77s|kYt8@_xodOe52$!}*|HsG z|AORnonJwnE$yAi@{yfyNuXQKB+wf(h^dp6gR_-AnC#w-C(I-``8izH-of3;%EHo_ ztbnppoCLl77wTkYa*q1g*~-q0OlY6-2I^EaCI=FYArPG)3=4rk}+H~$W91u?ZX zA)z{vRs2MUlfc){!9Wuyuoc*X>?hqq010;OUw^2RsTmpJ%y;E~&}8lH?99Nl z7!vI2IhvN0v#l9f-g^HtGP1{HfH$wS+>%zu-95GD)6cf-Z{7NE_lcj`t*ZdpSIs}( z@;$t$_c{3O=bu;5v<|NtPTsr;R5Htd-_hSs%l_C){T-6LO6TSSW@-*rw-^~eecl%( z_Yw4oi0=L1g7oHxbVw5K{(TVv+<^?hR;AKj0)-+hZ+E z9~{pYoPUpOP-p5(C2#^;9WW{;%snEw4CoqG2MnX7t;c(BhlOtQ&3V*IW(gSTvu_8; zwvP^MYJ+vnLsJrRj2zhjk%SEGNB|oE&u^fqa7*Wd0z#M)E*0`nco8Ec{$y;wp=o8% z$N4MM3WF%Y2Xkz*nlz1n^Z+T#<&6~4(bgQJ>|saBpXFW((4@v0iFyOL={@m-KYSo5ca{89LEEm27DabQ z>7FFbci;rA7rM7)*EWDNlIH%)@77eUO53doBd*10Z|tp%Bg~{L$BXpjr`j5$v08?y z>IR|ZRz@SAR@m6rdWFAEL;vld;97mj z)&xS|(;kk4V+xgMP~`m71-UUug~f06iP*X>sSi4J25Q5bVfkmFvAC zl9zh&;+cN+DY_o>K`Wy+`=&EHhYE4s+GK2_N_J$ofw~JcyJzIqW9-_OQ7e?_mEzvm zPl116I(Sxbyn*|3`i(z8sRRTy?^)E_-n(cgj^F!2i;iGP-KaSB5Cd!adB3R4{gCho zSK^tNEr;S8+9S84NBW^D^y1719S>G~@~iXlJ0Wo2t152?(&lO;Q<`@IL{^9u<|_gU z5`()^NoztTyYC6Lh-5_FN1ncERP1t>7>F@g*O@_5)0A=DJV~klu+g^8r^vTu&+1vs z>R`VK$|`&Rc*--}jVBvF=AmJN0$i}KxZD>}4FdQeP zx_nBnJj%B7MG$^4$Uy29*4ZmAJSu6R~1J2Kwc&CpoVr_Pz~TrYh> z461y_eEe3vAy`k<0tLhj&+5XD#s^-PF!b(8YRu9m_Y{~wPV;a9E&}y_`h_J%f?q9# zZ`e27&x$Y@n#m*PWlz|F;5aiIR?%mC-gO>|P`+rr%2 z%MQ~|7{p* zz4FEKr6<$stF4fT1a$-W{kd|~61;_;^l5h{?J1~up%b}!OO4QQM`im^@1F|6)fh_F z`wYD3rP@X_)rZI%7)2m(V_Ql}q8__>%9N55Qd}2G)vXRJQywg8aOEoKhg7`l*_~Dl z6s%$#FAC#;IreYtBG3~-R-8b(uTbT_AH_s2$*7u^H3iGYpEWdWhyr0iy8NiB3St4U z>lVw98WpV5M$Kz+dG&N(&f@m+=JY_x*RNbTJxWJ*{uXuBJvnj#NgEgzL&21QCjS8X z&n6-&x+m8{*9KlisDxtFV<8&4iEk*BQuA*BCPdzAyiT~&2#ADx*}UiMJsZ zHR($A=sWw9)V;8nNk~HODXj#zdPI68!J&L1#HH4y_a^LY^e%v{`K4g{!QGdY73*Qq zSp)5dSRYHR5eV!w|ExD}(lcXik)^GmSd9P-0rXcT!+gH%7^qoy%g@?4={9E49v7jl zCOTkJYc>q7S}O-(i@Tm95XIEE!f9o1VSUPew=~1aO_(SU9{9IUDO{kLdROz-b@>{iZ=KZyaN}1WK!~hKi zx}M*O-7c0ssYh}iG^hos5Y6@e963JA&7#zmL-e8`{)L5D)Q7uA5{*e(brTq0<;a2n z+;Uf{*oaFbKLZ+u>o4e2BdCV}O4iSUTO{|gQq(*&ntWn-f>rpNcl+)!*BWU|muki* zjQM03`DElim1RvH&Cl-c8DAP6afZXyyees#x&)iL*_1c?Ik|LVvL(mUv8a?+I0=8T!s!bF>Nk^$~ZDQFSpv| z`$ud_(iJS_4ambEa}R0VHX$krpssiPqZbNOr-hZB@&pV@EsryX!A;L7moh6b{0pyL zy>IXqi^G8aTmr!e-X<@_@d4#gHiVGa=M+Cb1g=LR)p`hVkw545lk=&`y9D zL}B;cPu%z>9wYV&QfFwNS{}~XFgSRk?C*^0M}q3aANGYo)nX?Oehp`=@2h|F9Zsm2 z`J{hnyH>>x;Gy2RSL!pmbRf(FLU$Dxt3c|Z+^r5aH*p@Cd{A$B0ihnDx!xk;#x;7g zCTwF3P(x+iRPO5{m6hGV(WU#qD#l2`1F13_&PP2?@`pu3#Q21rGN4MPCYGn0Wf{G# z!^exVS+|`RyIAkCpXFBHa$KsJPdn!0Y!3~LP3mb-Toem8x9K)!n2u7*joBaOZ><^| zQ6xPT@1*ePIrkQ0KwT+UR#JKhIS}2wK8)q@tHo;>hVBpXg+1@b$6G4*_OkhGtdQaS z-59>|OYMi+hu>GWdy+s5jJtUNq0}z;4}u$zIZ!fc|66Rel>YqM$Dk_I>*wy9_V!kN zY#3<8mGkA(Vt$Lr(L=LaR2(&r8%jMnZ3^dnq1PXutcQ86;h$nqe+w8O942tzTf@uE zbvIRSj*;b8`SY(0F}i4r0M}tzal@z0eo8qG06J;)z3(+b1*Vmql1BZFn6OB*9-v;C zsBG$5T(ondp6L2o@3n~sr@`D7{n1ps@d@RdQcKc8dIb%fHmoKI>J=&c3bdoS;YWHe z&`yg=VeWO;Rz8YF!D|u}@9=mWRfHBax9^lm4`w+SAKMhJ_gIcKWeToN*5vyR7YJ7* ze6-e+<3rJoD_kSc5%OTrKV*FDU8gL4NDQ2HXp~zMS7@ZEV)?U;RWc#Bss66 zEeEdITMb-mQ4G{i@*@^&`UHn|upm z^>2gAuA~moA@I5tg0aM+f6?Eo4)7OQ4Oin?8&EAtZMke#_vPGC^KrLnYa+->ULB>pi;*g{<*6kqC zBv)#5?Z@@{S!S4*vk2}E1QoZ7z-e-Nq)$hk4WtK0e$>GgM-6reMR;G6l$yTK{Ij)aDs_2XY_1uy(3UF(@x|2k8I_9r{q1 z=F*clOrw<|4f$PW|7Z4_kp7LKMGl6Wum31IkGQulO~alxtc0Wz2Yw8^TN~Vo(ZY>c zE*M1#ayK9r$HLSYHe@T;kK&IZeEFt9IrWlV`_J3)T>7QQla-)r-4AhU59eHnOVbIP z?*haP#ipbV^sX`NFuABC=Db?>kuX;tungy48-%=uw|YVsjI7#!BpYGG{S@+3Z8A^n zP5u}X$E5<~ldsktUQ=Pv!*u-hbntwEk~1s}hG|_MjOt^OYyj4gs3_2i<{Z)d^N{P0 z9Pby?)hm7RdLn-~5i0ybLd%{LGuB4Q`C?q_1C4#($b**)adCTtml0X-7U>OG+x1`Q zGXXS8kA+_HsHlaw+&U%~;cBTWS;|pk1qoVgi9>(%8^7qfOW3U~gEh_?=rEj)UhLXR z3GR*?lPw8R)iSWW2~952Nezp+?ejur7EX6Y(n+bv_1UtW??aUCuY#=|K)D1&{ZNtL zY0!&!>`EvlcGe8x$i&%q7_6adRySkIGq_UbinWWD8!B=Ma^7WsS?d_jTsyLi5r#)d zmLx5se!S%XPt_dlnk=7GbVQ4n-LLbvCWNdHrfU*u2Kp-XG7aPswufOdEYWwW1=J#a9HxBsit*s*oV^8dkogihX za?kCA7UBY5yM)nGLq;MVRq~|eITPQNVF=}k5#k_*H zoEHWu&RHjRKz|^R3q6+Q=G+It+hKGKW*?O$|y&`=J#1+A6pXfwy zR*oSinR}L~1oVJdH7lQ*j&QK`e?0L5sUM$hJ_f|fb?gqG-UTIZly+I8H~KJ3p*L=# zt=FMmkL@@z<8*Grn>P`30Z_Gn{w;IS9#!Mt=dI8ez-irml!#pJI&JPq8 zU^t??NbIbzkCfut>VnPYS9qfO&r_^qWVD0CagWOw1$wfxAI~>rRTx&qTJ^>PCzron zHr0ij?dSSA{KdPh?ywkmX-az9obd2ip^(n5GfG!#Kjouj8OX+ac0=y@Uo06rs$Umy z-;&1cs%w_Vt?xZDV*DACG&Eh?Q|7eHZ$}O${6(vrenI-+-`4x{2lM}A2dVxKvV;HI zX~h3`#82{(yQcwMUkoY9aQQ=p`qygyvFGym?()F$oooMyy?pW2e`HgUU3UBjlOZEb z`QPIO8LIz5B>Vpz;?G>-@jjxm@=uwefkDC9Vd~k9521fQSXqAO*M+?IXQxEH8kfSS zPoJ_pdNQ_x!XQV%H9WtC{-$52M&zij{qz;^OB8j?$l9g?&;0s^|5I%G-R3W;Kg)t2 z-~M#-3H`}z62E{82g|_S)u8jie`@=aUSzF2@hi1l$TFmj^+JZVqQJ*{YXc=_9Vbq_ zN_$5B$|Li$i)rOY^W+yCwk0SM(MkfYS8AR%lnFuNUh~&$J|^XBrF=iXTPd$Pr?saZeTK;T0Zx6c z66fYzX@#v&{AyQgo}NOn>xB!nm7#)61URK zNkURd)nZ6I_z?Df_R%fw5mG{V>ZqUn4-J_E)Uo@T2x)MYB+)*a7DN4=X6#ovfoC*U z@X?fXFMC}3L|41g#|^BVL?ZrARDbXzR=xQ@(xx9RRF*we;~!1h_(60H5DpB8-kYt* zv?4Z2l3zbdkqCrs)a|2fhxtQkh2UWp`9bQ&p{oUpVWffRY{Q7@dJ*2a8v5=r-7b90 z6l-+ZCPo%x2~|pML6LPEW)u(`*~zteY)&LK6RQVYKR;^HN>~0{b%^ucd-$tl2Gk3r zVa6!i8hkf}vqog&NT=4d$D&mo9%-?fVXn&AA4ZOH9K%$dq!_NnIT$_Z;A=a)#Q}+n z*I__y(R&rDdPI*kG63ThVzmU|L+brc|f>&Ryr>e2KbkG;fk52tDLoTk@z`Egi=vJH9Ih6DH1I z9*Wp>tV%E(k2T)ec=0*5ly=WVvu@T>7U*H-31s{(+EjADK0ILP7)N4`#@iM%CKC-F z{22arVba?D0v!l1^GBOicl&q?!&a`bn%Ut;Y%$mL*Y{`llsh|tYoKoH9|;{&63E)y z;DDN3m)LQhmzIqDpxGE#tVC!@4M#pRu_LfD+dm#R|hY zb{EpszD6jvYs0I>aj!o&vo!~}Pv~2_zdtzkv}$=<;b9LAm{_KRYtyNUO`Jj6PkLL4 z=xSL_{9W&4+XA5G%5yq{#aO+*_MAI(W0RAR_K9ULpEBU0MG+(k$oI0IxHArTXjs07aP7(uL)y2dz+8PM;sQJ1TlES|3r&Iomb5@hGh zS={`k!aOD%Pm%_!;`uUd%kej{Uo-2f5B3Y7=IdU$t9Bvj-=EOc@Be5j z`1wKLbu6I1dc>a=qiWE{>2IxTgc5}vWhU1 z`7zbbWfZu7q}5tOVNj=yu=3@#!#|954U3W_N>FsLYy8f7iggA5MobG(l8yw9m;*04 zm|Bm&mDL_8!a3}=Z2zbor$ol`%@r@a%a3Kg%r%g$B9M=j%Z!`GWu^}hSV4)w?wC607#mgmzQNsY9ID8yI#B>zseCKj^wKv>Y=u@!AbSr|-r%l+ z?ZO)_KJLx=axcXr#GeUX=>m&3KX5aIB6I$#ZG8CS+dnDV3pkkVhu{>GHb0ItZal*b z6wSv8qBrcy*2^>^c7lB(7KJ_*r0710hPP<%`;S#!m-%{JCwiZK^YDw3qKh$AW8YAa z{kr9fxuO@pf$UCj?ftMK%N)~rb)VfdxO!kt&_=`^w4m?;X2*S_MY7Ae4i_VBDj#o- zPkzWb|G+B8#?MB34R}x6FFv^`MDF!a+>m?3Rm@A@!i2owmn)WSQsxC{{ly(^CO1W= zvRB*NN?6|hcZY-o8(l6dyi>*gL|;cwGV5{L;uk)~bV!#0G}WCXu!D56nis|@4IrXo z3uKVZmG4!G$QLAAqz4KfSRJiUin+2aY`ntga#X{bq>b}S;io2M)TyH6WYti%kjwb&4LN}WZ-YYZfE z2t(q+`N4$U!_xq3xg&rrwak;HF0@*pn zS`Aql+xzv}m0{TdN{`lM5lRd_KQz~*j8D%xN%msOnu_0UMDUp89{T?02or@gC6Q+O z0oOjgNBaXSZa_nF;{@6N z3np%n+)di(@osA3U-Y-c-4{d#U{9 zM7684{bUzI()0hqAJSeq`cjHx!qyTd-$tsYVt`Rca@VT=#SLUKKd%S|(xI31?Ibqq zXhp2K0SOhSbas+%dLYw{8y|(pE>ryv5tnT(;R1faA(h%*H7tk?wMZHlh^Cj5Pju{<&n-Tw{e&W4`Bu(K zN5e-~*G616J%lJR+I8zINcr?oGcGR8_;F++m|Pph+h)CfeYU!50!hLZ{uo1c`G0Xm zP?yT}BtU}@Ut>6#%&mb~P(NDs0+8Dc>H=5IN`|w!Tx!}`#;IxH0iPrF!*_t7ln@Yn7VxvQw&e|2%7<6yqwn;c<`) za%c?r75~JdW{(j*FLYE&3|*+62tF2+Lgb|*{_-EXu>Tl5ThBB&dZ)1&U1j)jpr;|DwuI`Xn_^)QRuC2ldpj>gxHdKRnklM>_j9_x$O(`5Do zx!Pd>O0`LY(niUgW&4|7+1pVI!`&vcpV4@dMu3Fan?D> z?VpGm+372+1R0i$c2M7)xjy>(wKaPDuyxDY+a{}?xL5%rVIFyRV~$G`ZXYJ33d+YL z*FLIrx4%=gS#*ggVY}V?z$ZI+xpvOIDcV`w%Mvl$RYOQ2MP0&D{ZP$L7-r*B9Fv!)My^I*$e$%$47dAQ^dmH` zPB<8seV(%Vo}Md2HLid;K}j8%(Z~f!r6Q-hpP(gSSF`kh$z1D_*J|=L3)(D-%e`_r zN;l9y2mcB&?RR5eQCHy_!|d{HM*FfuJCedk9*THa^`>fehHI5qFA90VAIU>QAFYv^ zugiP-S!-GPrdHMgC#JF@Jbz}X__dvSPC1L2j%f5)F1-B`E_cNVt0hPlH8)Q8H_L+* zpt%1lCU)42r?duE-3E5;yZ|J+SjA61fKU{yN0qsN+e1Y<|DJ=Ak;Pc|K3*>=>@3#K zq4HlkBhIlA*|*sqK^n(dYO;Kii&w(WDl@43D;EN}cx-+%3aST%Mwz=)yo$*>LGfo- zvJ!6gf^AT9g~sfQZ^(BVF5o!zi^-jIY?c+y3X{ez(kStlRRQameAJhjYqXC=8X@yT z&&q5Ss@G#!yfUi{Q*`|A?26ehPxIPW3417?)hy%=uJWmy;W*og?;bHld+I zsW=arlYstD?4ssHMGi2a9E*vx%MJlO2 z;%_keqAGQn2(cc2d%^wX+_KuR zA@{2?vCjMO?dZ{%Hj%+7*BEmetFy7=X$&owITof_!X-)#Zbwh9P-0d!9UHEn&wMlL z>&Bf2Pg{#L+kgrpHHOum&7}rbAW-v{(?M~$M<5MYI~i-2!@4pya_pA$Wixff_!^xA zQJG7T=2d%aYKDjqSSp>2ZwW&mzRl>#7>_!Bus&vMBje&4*U398R4ZINnU^Zt??oo| zjmB0z^yr|2xn+GR1!ns**~x|8X1IGl~_q;@3lDi+_?kk^UCj}e6k=(%+~`oK zSRN>w%+u9)HH3hPZF`y3d!q2CfA^ToJZ-sx0VsaeMeMb3zA{ZzC4Y@!Tt_>LX^`mf z8hn7>ackBoM!&5%@AD&?@G@0(d9WglMTkcGn1Oq2Anw3mL*Q^^aixsxVz&#JgvEjns=W8#zF}Q# z8_Gq5v1e@1>AhTD#1D?`SZ;k?R)pM~{=j6M){NTSrQe2mmU~WeKS^Tom(Lr>EG4nwF=c7N>(v3D{tYI~0AfNNztzqiYG+)}b*yA8 ztC$?N^mdR=PZ;sx`ZI>U>iLzB32>w`rRo4vt*j`(dO#DSE2<)yH2Pp@xrqWA%(v21 zP3%cX-1rmdtzoa4r;7_jnhI8*D=?>Dc`UAwzRybyuYx&Ni z=sLH(-4e+;om#U@DRGq$NmwdwJ^JnH^CD{9>ti6Yn;n@bFQwO3)ZQzBJua5$sKAUN z;4?X`DQA?;N3_*2=bDn_hFDTBi?3Qzxq7=jyQJDM5zHZ`PTS9if|+lz2iaS+)|jFxt~&_AC7UCptj5)zRn|+S`XOxA^Q_?RIru8_<{~R%m(Thc#)^X*?t51<5`9 zFk7uSVqhd3}ZZQt7GO z1q~fR!G_c4;R)G+rtcNUwh9rXW7-f#Ru+4a44;v$rz7k&QdZD%7Rs#CC#1-Su+L4T ztGWVH@Oh`b#dO}yV1t%B@X{xnIPGSgWthHr=~5tOQ3_F?%xmblqVM85s`&Nzs(kL9 zQo&*cin}dEQ$zPiy?zo%sdO?H4)izWNYl47=4(9PVOsoO`(f`l*;c4v{kneX$1@ z_5N;&>3&l6vdY*OwE&%G^ITyVV`_8PU`PD3?E-uO&u$uWhV5C}1><(tT88Bu$eh zy7tLugZA;W%bL4YTz>fcR#@}U+QoEN>)$)`)3Jn(irwweMD00-7KX`!$uJK@?c)36 z2L!E+pOgn7Fo!_Ks^((H=^hw#Ok%`)%yoEX96?y2nY>&8K3@;;%Udc}9Ek1iN|dhd zi1w$`2 z(##xbZqMopGjg3=s$f1dM2uEMvNVSo%noTX$Rg0|C@xYE=dHtymKiUtCxotaG zt#XAkd?6vPbyq|%OGOedHAO+>_xRyW%T}Kwb+?YX1kqy- zD0$(r&`Na&6Zb>eko!xkq)*0$7AP7IG>BShL?U&V|fa%*i>l&z^jmyrR#PRvQ zQ#qfc$W>Cn>JY@3G0FEb!=i-;E2XgUVr8ptWD)-g`zE>N1b|^W;;XC9O2Gx4Re5hs zwIZJ@JqSYEyGF3&XZO4)7K%tKE@i^CGC$+0ambWHzEe;jYU0H-^)2-&+&!|v$wYWg z!HCUeFqp94TO01Zl?#Fu$ZqP?TPALo^Yf_<MDvyLsDijVO`9s%^q z>cNcVyaa~VU2mT7iW48l=}Xh?2@ouMV1MIuTGiiZtASP0NfCvMB$+|3qLLD}-0nTD zy*7f{tS&1c*WSfeGT%(1A8P;3=I`Z&O|zrjW$vN#sgv6O(V1W97sCr=GUIaD+`ZBo zUkv~1Y#Ei_|8>&&zkd$`gG@NGQ2NX}YTF_o$Wk-fAP%0Sr-iq67M~XUEwLvfqjK=3 znAuB}epWM%{QjK^b9(h3kZ|&R6NRCtY{n1K4 zKZ+qWhr*p>ddG?Bc+{Fiq5>dNZ(?i^dg7U{t*(*)yRAmpI!fzEL}g_iwxi&k-?+1% zWpk~(N#oRp9NvtIMi;e@{7XHgT{wVR!db#ivb&U3b`5gh5O>C`yj+%2k+UkYbjv+w zBZVmL0Iu886cHkDO0On;uk)QWg3&o90LAZy;rq z_BjO`dt59mZ}uyKhVqpj5ax?zQy>jhs%h0dcSM}NIkh&|to_EFWL;29h=8+J&C(bz z-~6k|NI5EO8srx%+OiO(#)wTR&E1^~pM`q-Da1338>LdOZh?#h>f^Xn> zLTPcO@>{g2H9Ao>7S^|#Ui=$|>J0_I!kA=4;jZEd(Rw7Wcw#axSFYwPeIX~2AphFc z|Eu59OiaJxgO3LdFc2Sf9Udp{iapdoFf9ZIYqSgG_iw8(?o`k7DQjqG9QK^N>;Y=K zj{UfX44RG1dTOTPED?@+{@lL46&lHAp8xxp+ooT#JqzW?XJWwYrBc75HxF$i&CeQ1 z%2|`zr%#(Jy;}O9c$R#H#8E<~J~Lt1^-L>%oOgIl&*va*-Ig(%`9aWm!YA+}eH4qr zqncIDC_`yozLi+{P{Tz;#pnnZ$T)Axk9tzC{~NcRHAbhZDy(XDdx49C$8fEbKe~V9 zdVLFhQbAc2N01YJ>V{*Za%j9H$OZzTVa+`Ggg(U2zc_&gn`d_p&J`HUm&b;@vki&V zlJYFKRH?q&`JK&To-?~_3w}aM34GUD5{?!&<|0?%5D{r&cX+C_%yCIjnhiL6uiXZ1 z*1|72SFLkMAkRf=BTd6zE)oR$rMv!R(mo~ZZ1fJ6@W%|>9-Z`FC?u|@wu|j0x7!L2 zceJAsOO@Uc$F4l5dp>4-Tv1)clkQ`~JB6L*kd!WH?Sx({ysp(HsHKK)>U*zJ{zyin zY0E-iBaenbfdT8?77srojS@CBMMs8kT2aOP_CYq3kz;+p3 zky+M(qf%`*4QgwBXQFI9J)m02KcMcYE0liTF(pH&BYN1YB&TxRV({lJo+p0)HpBIx ztIKyP&TJ$0QlU44=%48KHQ!_$t?(1>_vgwEn{bF+mFE+i_1QKKue^7KGx}vyi4clLR!Irh~j40Qhas&)rDVSGO+wyNT2 z`Hqcd>C!O!Y|td|H43bbpD~zcd)t!aaA{X=3UTfTl4KJ`lFh;XehtH7L-k-b6&h@o zRT;((h+Jxq;o{^Gx^G|9f#ecSe5%amKSBK=X`?*`HpFSXGr%8n6arzlsu$+jXB5`^ z=C{?}Wr%1SuUHDUn^0mOH0mqoLuVh$;`{W%rb}o7O2t=jQf!JE5l+Hj_3gnjBUw`$ z^NtpJls{9DmP1ik%)fl3OdTopRpT@t1g5YnFnkuiJbJGcPBgR@cwMHHrn)5OHWU4pM1Ux7-`z@W&1Ig-df#)Zin%b*s6ffv?tcbtB)rk zX2vDu9w%XOt->ei}J!WSK=NDqjf0>|^ zQmymol8wZuUI`l?7-a?kAl;X0d+rH6m$ivOUf=*E%#VqYH0NS0PSktsZZ=!YByf9> zRi3gA&pY`yj;+!;N30|vzioL~#N6%_Ni%Nw^>Mo&u zeaZ4fVe2g5+1drnAf?PyOl&ONZnV4s`Og}?5+a=xob3gA%um9OcAWoB`zN#sMN07h z$Ai%SudWIHzt{Kt?;G6z|I{E^&hbJZ>knzt%*zfosy`vXRu_Gel4aSOW|O*L4r)Yd<Wj)ON?*^t!FG(&%&HtPqQY;oR2~;8Ob&AiYf)+OhhICJX z@rvsLa+&hrzJl-_U!8x3jqGQ#vBxiB&-6a}@R*Y3?o%2$CiPZ%>46kU4?MJ+G#`Ao z#72S1vZozMHwKhsP*2*GL~06i_!xNBEqZqt|HyjL(NUo(xd84U*~=I0&R~~)`n!q$ z62D4<@}{v$ZL`L)3-&l!(4&+(!q_5Q;yjnkSKIDpsL+M~XumeOj_1g+3<`LEiG zq6_tEjFQ#Dx$2ks$?*w@W>TwQ19Mhyw0P_0O@!m{UlTxlQfS8mklcN@57H|)_v61h z72xWv{D@vfdXMO!%{omv4J5hdkk zuZ(TEG=dODa_vVw%B*UJD-xt?=!vv^o0t_hmA-_-cE_Q{JA3mB;zr5mN$=%IX4?*9 zQJK=2Saw&ir$6qW4u1TcBsi=IJ~^3k{$W1*z?$ExL7}0AI58DAO$w#^92T?pS@+{- zuK&y!%v38ex9e2z`&rF5;(&GtrWS#p5N^y0O}ICcEE`EhaFLSI2d!*eV$C+*)$370 zjoK{=b*ghq!G&!w%g7DA1)rBn`trPv{tl7ULJqYWEX!|VV|moDkp>ml`Aq!ST$!e> zA7_2>)o@B(3PSz8BtbeJBS~xUw^}7D$p>z$2>0(gYR{Z@n}@VQ6ISl)Kt0~J3E(R% zeeV>6s`qaPHHn4a2S>!(tM@x?09jX_>~~e_hChC8J;k2gt-AmRo*M?UId-#y0@Dcc z+lu);TKqrvNM?*(Q$LcQi(YY^nWQP**|bahud-Xo!(Z%{RVV&aOP?kWy|9Dt+s@o# z%il^}%I9HPZLp5wj~6CIfaGTK3qmO(!t9kqoQate+WgB8r%j%5s5@Z)u) z^BZfOX;?yl;B_~eLICbl77O6A)4#p+c>$-biQ$?^cXgFUxVnaGm~2V20HjYgW$V0G zT|6j|Nhp<$P&sNRh@{Vus!D9Ey+$2QP30kKY^*F{%qzJ5j}8kU2%K8LLkH2)3K(dX z{%&16)E9*UzBXgcq^5gj=B?evFg9fLZ`a{bk4UP$s!Ayuu58zikj?(5R^M58uic5W zZySn;x|aQ&YF=a{Pf4M1mw+?Itt3gGZiUArB^f}|YgO8{;IRkSOG8Z3Owk0py-nT|zWaCF&o1<4kySIU1O$6%_lZ)MSUoodf?y7E1 zD@eE{5ULR_)nD+af3CpVdVWQG{F%*~%Oqq8osZ!%-!9r9& z|Fc;%htT5xqAjv|QZeSgmH$7f1C_~q4Qyk)I@z!L{ch}7C zD%2QV&|p5@x#FN*GP=ge!O`b`^MUi>wwd7_tAx4#sRgL|;2B6KWSzyPlCTu34_0?` zt0WyfeKF7^(KYs)WFf~kZ>L1>rG5ujw;@|Xk$G145*rgoSOMiFR58(C@ts@pBVOEZ z81$7K3%?kckTG_rNFqutdN>6IwM)eZRVxR+w&db9(x5rK|zDH?hqmS ziI=~HNSyc?8gyPE(gBk@YJF1UUCH7vQdf|u0_2Rg;$Aj4jBp0U6@)rZeY}^<9_!uD z`-biG%f(mPBq!(IGu7YLWpJ~OSkhPaLA>1D$~=1LcL2aQ)l{iMr8wSv=*m#_GFx>e zY1JMV9r&b?f!}5eTiJYeu170J+Go`Io@v-D(NG7AcnNri<` zEX}`uY0)-T-6YLGSviDdnN;F%bawtv6b9$(_RnzN{eQ?^G*NjITlvmfH}dtf8!#D} z;)ZA#e4?fItq>vbN37d{`(?ef54QH1Riqll2<9#4ga!el_>Uo+Mm(hu6S~C@=(;_ea(WGz{6X& z=tZfdrKLH!xFm`LNJjqYQx%TDdlBHp)WxYWvzsOjWei|u?#ft59M8#4(gTSFo1A;p zb%cwQ$`6$cR=sNVul|6GdKSSE9z!PD*C^GohVq;`agYODC~!YRNec+n)Yn(Scr&CH z6&qu`2Zx3<496uW)6Xe(rs#5Dc{<)5AwWg1r4a5C;s?Psy?-K_7shM>bMi=CSy3Yt zGn_1s$52zRWt?1;dDtW$_H3&vE@ z+T*Pll{psZP@RMVq2=)9X8+YnzF@UU&p;G#V|0aTLu%_XCV#1Iz@4=-Y#D!gFm$-H zxIB;>Zu;tL*yheordq00lC)1sQBjeLvCr<3y35)K_TyRFE8icYjvoS!=K(4z6m%ls zkH5b^`PI?_E3+dNo!;5vx#IY=zc8uxI)(YoI@nN!=gcs_(NP!R#{rMGd+K7=T5Jlz zpz8kbw&1H*33wR`Wi07>)%5Uu_TYsfGTxw{aHrc$W6FodKE3X*46wJ!rK+wr2(%q~ zv1Oi+;n{f}y?XyVq`r>W;MZdy`ljLdtT{Dovctz*=qgz9+U>>lsg%twcJS1MhmPx) z4C%tGDPn!6!OpErT1tnECDU!3=iAA68#h>pmydKt{iCbE7J*uyxZTPQgL=nX;0VuDxcLd^>ozfDTqd*N}_OIg}w32%*@LaCVKi#5}G*mud16A z6lQ~Y>Z{{5agfDsv5VsN=;OK#uO6=di@diAi>eL#M+pfD5u{T|>FzQpX_0Q}?(P(% zyF;Wznt`FabEIP^siC{`ztGq3JJ?5iAMAawpX*{~E@sVo>VAHA-^=a1G15Of z+=>Bz&n!#n0***l)myKR6^2ge`n7&NNf!JSyGj9KswEAeI~>2Qb)VbB?SRK1gpBv+ zrZsElH8!~H5x;%=c9^_%r>v3mtGd!Q?xfKY8f`nwhH^*Im#!5~7#P=cn;(*`M z!a}{#g&7Fs+}{hv2_G!KM?qu!zat{1nIGeN@21o9VOFfuUl6p zrm)mBq4qnCj*TPRQ3uNl1lbkL((Fl>AzAvm`z+JqWEthcE&h7t^Vi420j@W0l@P zUYA&$HG{7)tgq$$x8HjmC*3twb}c-ho}g*DQ)HIpiKYY!S8YULneCer|Uj4nroXB5ZM{l1^hdpvvu`rTVf zKvq{v=1m&BS-s@m8Dr5RMi*07S(?QCg&Of+3C}PT9?F6BX@4d!Ccj*nhaJQofcmZ9 zqe%XO)(dw$i&S9=y-}Ub6lGYF#M;UDMeBXPvvj;+&EOLgYKRenqR#oN zVo}X^($0k0CXuF>-jGA5OO{0)Jv1Bdi#!`W9(qyj5B#4aq|^E%`UIZg;a9BJLaGd9 zXb;vQYc{ah&}>*-tV>cw-oepK8(GPHUcw}6^P45;^x^43)`2}AYh=Ru`jf@G=S5o| zPn#S97Is>{p@lkZcYbZ8SgAbi2e2QQ*;*o<%g3{O;sSnOiUU%;ZII z1@Ob`YCT!#_OLVP%NHdzwO-R~Z)A1E-qqe{!KhitQll&Dt5>gpq@$2uzZ9b=MCF~F zs&nN$TSG92-s$V>7az>>6XF59YfBn!MJx}>1}BW6k1WtK^_>w^Ivlknv&>wY?QAgY zWr^y#M0tPNg8|L3ft=j7Y9eL@@QSQe-elRMB|NjYI)r*%uec$=XAurJ-M~QW@x!}5 z?i?2i9$B+g=zOODZDFJjaYBaeo@ng9)n3?7ygg=}en}fIdhbKqX?5YV!P>g)pPk@( z+Fm+EpvVsM1`7)Wuz4=UFT%$8<)H=kPog}NygZjEyt6*K>VlB%ZM<#2+Yk(Hl;mZ6 z&bz-y+=!}_%Xr951;1oScjXybJ~NkpWr985y6+8r-3_}Mso2W91!sujk*#bsO1jm3 z08UW}DIrA0)`&aG=JsO^H$ySw`ZT(lQdV7P2d^pDNbd!!_Xqhq?p6&@U@EJiH$}w8 z5iHA0cVt|)TE4VEq>?Q{5I7A$oe|J@sk z&Cy&Ge3`+mT5p>=!1fUrAFrj&)oxJvD_632Gco}& zGqcwh^N!JmOSLU$%se*peX&%Mp^=gKz;?6zCVV3?b!-OHI{RDPV2ZHttaa_0Ga^uGtxdkc*M)&LDr(8BKzvk2eraKtOh;t z0cxqo{=uap){v-$&}MYJXzNY;3CqS@D=`Db`B#UNv#Lr0ULwLrp_7bHF^Es1+%qQZ z--yEtinz9zJSlpxK>rQbAsNf}>|2_Q+T3*K`)oW#6j_v$=8}$r<8BU!`IeqooMbh^E`^0fp8{sn9&wbQS-AFl()oE4dLwKqOhgq%ERtP zstydKF`k{Bk!6h!FD+$%h^Ia3dZEDPbL$2eT-*E+QAm6Da>4rzJ1ogQPmqyuaB;ix zWs>0t*$tim9EDWWhqMCOx=~`jv8BYHI~5MeBPNVB_EU(u0Na7;&(qb zijPw_9We%5PM76_!AZca5F$TA0TLpGQHc7?WAE3T35NsH#5^h&r97~Si?8hV!zkYR zFQ&fu+0q^@vZrgs9^n%U*Z7*D)I`EaJ=}CU4ekpz_P!5w*l#NT1-d$?N%z(psm7O^ zW-dymnO!ZmqO~H|+@cyj>2k#Dn)utVQ-ea;FHRI!FleJo4NrEhz)pGIzxs^Ra< zj=$Ja$WtmR>+ET+5qTBw6kBi`VH(Y6TwE2Iv)lSq$EiuH9!p=oCck;8ax>RdHl!#p zIreRV<$$@Vf0{3qsaZmPO&xIA2{|rlJt;Q=3D`ab9Vb1K= zB`vL;%881yvM7MnIt((`+AVos)DU;T0~*K}$P|iiYW~5=iHm?$cMUkBViFRMLal{` zg_)U|{&bnn?p#fAKX>iC!5zV5^X>8F(JH|B*<5zjqc0k~t~hFHYFKiQgaD9c1C)B; zE4%Ac^V_?-$A1844+dNh9MHP%HV6w3&lLOjA@Yt$65g`m;*Or4p0Q#zRzRcZ{@oe! z6bsArc&$HbYzFvx3;_D(i^Ux`TYzggY1?Aq?d2jrG7Dqle3|UI<1BG8F)^Dbk4UXW z^c=a6sfE1um3U-1#1I9&I}Rnw7EG=N-AiT!O$7N zrD+8O=CG?u^;)w4QSErT^*-_2x0jM^)1)x|gN#8Jf1XxT0ODdv-X`spoB7tT7C>7uu_hWNj2o?D7;v*&cD$L0ganP!g^ z{OGWL_9INENlP6~jBUT=W82fkD{FYV44<76=*6q6M*p06qJ0+8r^b#ex{OV>w3 zS9b)^tI1w{a=d`w5prOzjII`R-o~AroQ!H?rlt-8wgnJ~P|?u7D`ao@W}koo8D(X4 z6+TU8bb|c3010rG07myH;K)fF)xiFsmQxK233l=k%tFMcIzGfMG}O&b&6m%OBPPoq z^OUXHv;Py^5I&-s1tJmukHE~sa07`csPgUWKv%4CYQt-3REnO3Sm7KXs;sd5ttPnw z;>RWL*jY=TF5CO6paX@ap$Ma!pGEn~DACJX*>`OjX? zw`YpuFHmL&q+K5Z+)rBdN$*lJxZ`OpMUbOlsloBHY`&aVq8abZ$1r+kRppokydx`$ zG=^FpJbHg*>Yur`np!r}Y4f*7Ma%eqlqJN2{~Vv%?1rF)e_*%$Ug0N}uWY+sOS=pS zE$6du2XFUyUH3@=rTOy8d6&W`zQ3#95!OWh zZdNj#jNc)sJrKnakQpj1r&-Pc?Wan=txTtpkl!JXN*R=_N6u&GcX)WH8d&%0{TI8- z!_OXP+v|i#CVG)hfWr@9j13Xh=;-K2C!Ccu0nM15joM&95m#30Ncaxfd+t!dBx5jp1Xdl@?R<6=2x6; z6TVX>W29_x_N3r*?r+Oyd<&St=B|;*mGz!}R|xfomct;2pI1{eTVwl49Np;-T4(L+ zGCB!f+O?tf(0GTWM$gb1V3Br@U+oYjJ|MSV>7y4ry1ub{k{id7Dr`!-Dqvgr9+kX% ze!jMzdxxN8z9DeZ_fjx7ZlhwQx061lqLU^Roy(-kg8lY(7>iz~HSL9=$svX9(At>g zcsj-8#%@$<)7jt)rXd#n3rWVSl@?Ps=PL{sS#SL0GYyoX<$OJIgWr}EO4t3;3|~w* z>QiZ{3hwAEL#&rGm)4I9&lu^EI=;x$a_i`Nv(91am%B@WQ^W0$8yxeHOf z5YxLVBg!A&?QC!~1T!I^8t}Z7hX^&3w!---s-3`e*%6^#LCnw^Q`o}(0bj3=kdMet zGUh54`StcZ>;ts)!ZkKcrayx)`oiI$wJ-8}OH0;|A3w_WC0?A-zP?A;9;UUyEbIQ& z6Kjtj&fSK-`CGEX4s~WNBXnB4d7+#A1HQ`Z&*)O1GnxvQ#RY&W}6PTiK*%BSu@+Rlb&n zhc%8Q;-+wvQW+U=Z9n&n<>`_uxhY=ye_f@j_~KUfiuBFV7W7LhH5(2WbT z&9{<|IBVcsCq)d+mNM{ttz|>eyfJZpPZ|L!3%GT1*k^v#DWZ@NGV0PBrRF~K3vRE%rgy3o(o3Aw(gSPD`bRWRsQ za@B}MM*6#k?ki~;9B!ba9iKoa@%C4#5V4EESJ-wd0siC32z7ScehtVwm2Z4eTal2( z-YD~3x;DadVT*a6sPa5a@}Lku=W!AmA2U4+oCv8CtP5|XBeOg4F8uxb_v!XzIAE+O z)2@F9AU7uFl<(KOySuGf5FPL(V66bx2dMzF6wBjuvUr|srv>NhEf7$M#_B;z2HU#5 zi1QpRhMnCi95akXo>MAAQF%NyEVii)t|jLJYOQfIKhV~N`v~cgUa@VDLv~1hkLuf8xs_)j zi}-M5OuOoCh{}|4c`mk+1f~*Dj2%T)w`nG!(O+n;{`@>z_rx~pcw$&wS&qVlOxToB z#`=>VzHkKUH1}P}{D55ZcVCWKny>Qck|mT2ZV^|(v(y(CULP(<+NpTsrl{Qhbc!9j z-%g>4HQw}D*9*0mHTCLH-#XqfIvV5H02L-PO0;%saRaN);#@)0rxdYaWX{ZG^au{hX zor(H~gM3;peI7~gvE>v@s< zRx-QmASeW!bObx2DtRQ4gpm?E(uHtEAfe=-a|ILCpJ(J6#e+f_zj%tXY8D`7U3|4M zC!|!2_4ayWN;^NAdX^O*NATEe#DGzRMQcem)6Cwn^9RU+kd=#kB)#)$Q4tlB}Q(*W#f70xhT#QnX)ph-v*!0x89=x1PG@XvK&RvdoC|+$zXt<#6aQTR;I)A>^3l=P zeLTnec-5aaCTA{|@u!c+7p&KzFa8oD;NF7&?M$=pN@9q>hBmcW7$7isbm(P|p1A`Z9FWJBQ zLXtk!@p!dV?v?O1(o!z?aX$~twz-VRfRAd%ZHk%R2TLyz4>BFkoUDGdp8Lb-DJjQ@ z%aQHjOwd!9kt@{O^xF);`fVp*B1B{v$KK`zPVD;n#ACg1*O)rD7o5m^2hsXHyY+7 zcw{&h?O^ub*j_HA(h6;?z_rmoa$`)99nEz z7^PP4bpnGuIK7z~t;IlTnP-Um>-S=P zzO{ZoRTWr_H2^amspxFN9M;|-EsF~i=-98Rx@UEGuU8XiXRK!nfx|%W+j4bH!sM!V zhUcooh27|KZK8EmG;7ele0nu04jOdP zN?_)V%UW{s?dUi&QkX_1icQyh!impfF!)}^?WN1pqSl9qdPAWM6Rjct?(~^>tGni$ z)6&YJuTOlu%~qB3_Y=lTDynZ1&P&X#PXDauSLywh97jEeg!d0fE03)vl~0w()+3J1^|t9l`UsYp zKihxZ!p?}f5}trR`XC!z8)A;d)v{Ms1nu7IV|K)`u|V>TZOP& zo+{N>x%HZgMh41Mat0gGnznbGCCqH(7HcL4-a*cc2P5<1Wj=g}aP9>p+x}F=6gdY# z*3A-Abz-3zG)U8Cq@1RsPk(g8UZsnx z0Mv%4w$iZg!`;-f@~3Jx&dhqzP3R}M%eR$&IoJP76J{{OSD2I!mD*QJ>|zz&J6aC z&M3h8RvscxFUOtAEWcj(#iW*G2%mTee|y+O7ObEEo!*n>?5hVE-St@i4$0D`eT1??`Z9zVnOpe8P$N>hpSk^}Qa1n~wxwWW=(q!@K!{D8Dc z{b^%@v8eXeHE!_i)R<GLMO6&&Wpc@zQU=?EO&PBdD(8AJ4#u%GoS{eCLaPK z7@oqmMGmYfnDpuLCTZQ-ndvvg?Nu=HAAb!>sMXRvw6;@f2bQgj8_BZcV zVIUt3hm(^xkt5&or~`jGr&1F|zCo*}A>w+m_f^U3#MML%L%Ej4m{6@pzu4#R(pBOGcH!JS5%o&F;_BHzp2JODgsl zT{F~17_lPP@p{jnBF}yI{nL{}>Ub=h}g+|x0I{Xq6ML48GWiw0{E=z^%e3Tdg z6-&7{cHsw!voR4@fsD8hlzrQjrL$R;;D-(Go;Pajq*?(qRWBF3r|8r1d$<^TZwLoMTqgEE8BS&aXSjW0J^@#cBE+D#v6+AYc{qq#4fd;g-f|WCs zPtZ=IN<~w!`k*4FJk|1iEtEl&EO!tCM!%Mnz{Pw-n)$XLs_!+`$B^u(6OsX_uBbAl z#W`TYxHARX#^)UI@oX$Ld*RuT>n%8JYE~^Q$9O3Y6MmKt>UAxZ6K7^ggOyVQCgN+f z_6>d!SYP5-wFNwZPZVX;_D8gdS%0@|-UuTcpSfx%OSnIX z%rzb5bon3iLloq@izB14hLvVKp3*1Z2O`H_rw<{2*ElbpNw=vkT(T=QQ?jdl=Iwo# z_|-`-;&h!Nv`$ZKZDV3y$muVcJ8*7~y&MS$PPs?!Whe^lc-aT(Sn$TwF5;Zo2nE?y z^>lnwq;dF9@}oRHo6LVZe>6(&@c{5-vR zfgiixJX2V!zen^TwY)`OaZ=~+fMRX7!BAw*vv!m%Xl-`yDj-72;+wIhmQq1?sphOc zYX#2E*X?35)_ zX*B@(hq=_5CeoR>QmnJ_J)ciM-p0(qr@7w%6DB4$w_IEv#c5(?rRMtnFX=W^vKty| zl}sF8ht|1Y1e|OajyRZdQIs^F2-^nRsNjysQHEcY=q1SpC2Rg=F~Ah+$$=3k*?{ae znba%v+x)r>GEbNvZjhB8%54dk-kP!VOeZQkzKYgNCndaK$I_dhQ^o=#mAaDgC&baFN^S+2I*)Gp#};eTe)Be? z`(0+gZ1e2di^IAl{!qsyy`>RsdzBs43I-p_uXq0UUu7foy3vyThHdb+dP-#(=yUS& zg5o-^D!BTYBLY|QKQs*>?C{gjtQC||F3?8+um}hqWviFh!SA6LRe!etuoyr$gRt#Q zw)Z~&=}@fM+9>@5d}9Bt|H_%xQBdYn@#{Hl*^V_aC;}!nwY>Z{H%Dx_+`1rdegFTIo2HqW6oZGdVfi_t;3aVz#l!b@9a@C8Z1EK@wAeeV`e5rZz#J-DjoSw_?oB8!lA?s zu*NtVr0F^}OPDGu#l4+ukd2Fwco{s8QyA+4h|(U8l6dbs5Zw+&Unk#jN_=6rcVjbL z6p#i2O@|1HrZ#vOf#;39y@$zr?k~sk;vd=Ru{zK7p062Kne+{oT+a5D?f>N(eRAzP zZ|7S}TL%{7X$yss+d9fj-w{2?M;bz}E`g6$y>|TMf_>2s@e^Kd(?23guVVgK$91BW zO9!dVw^RocQ9W~rnQ7PznA86&t7P47R7#dy|LLPm-D)BG?a-!489^*b zN3iA#86GtUpHbB4-p;^Vb)kIGgFXJGjh8kGi?T_+sXfK+;T6&Or86nLe{Q!lCdY3?tK zx@lrjs|^fjdV}9*S_q%0;IgouvOQ#k&TpQpOdPXzzC*=2wmi=$Tb}yLtd*|U;JR4H9CJ@%*_P57JpG<;i%J7bVs7=EbLWzXw>CZiEA}H=`dw~ z%A^4arGp__Yd6#v>xiEwTjlt0B1tmlk;0Cd&r1vPi_3an*(^$L%o{@a8owg3;(yLa zmg?VeS7yt%cbfJWGHGrpI_lWu(!EP{WOIvIH!tUx*c2~lh=OypcX@%XI|LeucHxTG zxEi^$vo74?oRLgvjGeO%KMZd9yO63&2x_P(}`%-REd` znioS2BB73ROM_WWsZ52H);H(Hu@wA?6rP*qCyj`dpGptfy}L61Y?PA%fO>#TzdeNC zCTo~l#BB}QueBAV=;h%US$1ez90QBKrekG%RUf>{?kN4*e#tz2snj@@xf-an<1N0{ z!&UA2@`k}eOUQJoUsD3hVrM>)DwWd~4WtV(QVn)wTN}XMUz?4h=rf!OmuVw6%3SCg z>9bN@JF^tJzs8wrc%qXHGLfS!-zarr@Ym@G@N!#=Oaz}WXr#l0FfJXZn(ET|-5FC? z%`SLL$e=^F&fbNG7K@t&H0j`&uM<|Pvd-J9;ha}v%vQyH52%ak{bBeLPgJeuhhunE zISR|iZ?4=EwEQ;Lc4_gOe1^98v8se1KEH@N*llST_sy+r+abRvv*jw2(t5a=HRV^FMKLFQ&a*$l0S+bt*Obab^ zyeb+8Aa;jcCVuq{JgF)!)?{vW0QcqmnU%fqM0fhgp|Z9cl%$z163?CWMeRB_q&OmL zp(~B~Q_3po*un`J`B!jM9^$tH+zq~vw-*sqQIMrh9h?srqR%o#Rs!uaP*jVTz`*Ov1w|<3Hl8Y4{HLcFx934`9(jTH$rCN+xpn`CJs#IQo}*RdE5XE6Vq#JMI;n?(8|JB(EH;YKv^Twy?#-T*lyJ93 z@1B4}1lqebUx>d!0; zU}t$dORItD!r+aY<}}fBGeL>0&`|9VZ#v7X{<-)PH?A;VSLGvN=%1){H>_;FZi?lCA9ee~fpBYHPsQ8#`-GIreIHHhUw7c(S#s$E87F z6}j~3=n!9UTnK;PG1oNz!nZ{CgTH*y25!N&Z*~(yI!%@kCV$fUb-v_0v&6W^_bxtw zVtyp$?OT9%^i-alkqYXew59ZY!&m!c-RL9s%s(tl`WppCL{;Jkd3%OZCl>(p>=@at z16yJ-D5En`#zHOamFLf@L?CIxD8B)dfgTXj9`K5_mQ8ag5V3K#6L+KfxhxMv;JCtI z6$gKJUZHz}9wV$N5Di)mUCO%HH9z)YxH^9QjsLHOI7mK)N?vSDVx7EW7ITlRt?TzI zSyJ+`_UHRA2ZcwTqS)Jm6$=i`B1W@88@%b-1M(MZ>$4k#JH0VxeC}0aTPY`ior0*J zs>rnhc1Ba;JQS?jKPNPONO$~_JQ6D#!G`C|E7Rcn= zY(85Sj_A%Lx_qU$HX}wEy>Vm-YpM5TmD_(>=D&4T0U^3blc9i~ll|eJQm&(S5?x=V zYA3W&Vcc>XbdD_SNR}GLJhwveNaj)bBBkpI=c}Oc*Y2a54o{!+LK-gLTT&LXtf(Ya zEO)1t*jrru-tne&1)yb{q@t}Tnk|^$J$!zn(o#zcQi#ug=8opLA@^A!JiiE-O6pLR zEno7r$1api=(vY6*;B;9mwZq!qo0@Yux&WsWJP|( z0ooc^_(O(c%tZLinntO@o-S$^@5OACfEY$GaUF=4rS-`*tDfPa46CQm)YhvEDG-Ck z&55k^3b*ecum=&+Wk`eYY1pW0A3}XWcNNvI5 zRJa`TSwt|KnQuzq%6Uacvr{*=|Ij(8-18|H-{pOQxRnd*JqA z@@XJz!{JlP^>W~&iZOe+mEG9D_@_6@F}Vd7sD6RSr9P+^uj^}{T#oIMkI<2k#s6p) zc^V9I|D!SdKk|b`ayBR2@7;5fMiDy+$$S`5M$VVt7-Nx#^00pn{i=l^03!H1e&AIHQv7ya zPvLa=Rs~VA7=u*6^!EWl8IVc#MIe55T_|uC&}%*$)>CAYpHT_S4>7|(cP|bGdT*Mg z`PXwSNq|~lo$CeB%()64tZbszEvwsr`9lqtdTn&p4!rPko5ugTc>3h}i^I7mCU~pq zgFtX#rZRiz6T+t1|JCP7Bnw%mmWK@d1wcr4dU@>)d$u2O{*#ITzZhM4RH$VnV8$LX zDp=gT8aHaeR{L1`-L5Ql$XO+G3T*GLL09dayB!62%z=1pE31H3F)!Iw?{lpsK;D)3 zXs17D;r$aEATa;)4}mWOpM0;QC$>N^Kd zR%mwMkw#0wtK1t-wU2zfU#;V(#*6~VV5KgzS;zIo%v+c^1JG*gYBtT2xn!SjRB_3?+u^%7v5 zvLgnYP#U9X@IHf<4YfBNwXBQv&qw2`7WgDWe*HTbtX`LegLPNtY?>!jQ zVFf77`@WM6q+x0Eg?Lw6R?b4%+73sd z#!!Z~l6v>lU72-jNd!6g&fC2Hv>qTv`#-4yodKlqT3^Jo7?6=1m zMwDB^Qwh=j+e-uR-cJkg1NJy)$txYtE(ok2|D9y?pRamcpDNb;G4#&) z`u^KPk{~t7E^o$xp}iboe&?+;XLw|*`~rNyrDtUqxzgge!!EJlFlD?1WLaYYiPpYw z&&kP0e&xJ}F8WX5TZWQLoU9i8d@YJbuTW!s6&REgYvV~tM2rQEQfoI$vt|Sg%x>iw z3S*fYBlL|l~m+Al>OR}9x z31-hm+9T8WhZhcrM;7J`>Vuys8W}^g;DxP>i}1IJOR`70i)xW3*yv9gd(RVY=s4`Z zpY_@RkFFsVbQyx`SbZF?8byoRv+4{!=O5~kgu})NKi3Y>1beHXNPcxze$qcE{n{N` zgyH&25y!+n~M*3<3TPUk4T!hwkg!b7$FU3YlD(3U$?EG(3g^&jW4c69O?`aoV-=BPN< zu47Mr{3;i(#_X|E8or$-fwGxUd05AE)$6Eisqfa$K!40U+4~IxuzS)m!1D7j_q8pL6e8dq9iK*3IA`p~M1-8HW z_UZY>Xnw3LW;yk|_J_$?Y2X;iN=cy-uxNj)s>1OTJZOps{y=-YBMQAK2Mvt*iFndF z5hLH$tl2~?oq}xXZOcvXN2$T}nQ0Yl$vFo^>~o!T7fO)(ej|c+CJs0~K&_$}t+<5_ z=|bx@p$8KB;WD5UYSB&e9!xx@$x3)g4p4E|Pi1%PhdMTj9*#~lL>I0HQ~2xi2*=5$ z>44BX8w;E*GPjIBi)D4UkAp8znkC?YLk}s?g4K;vV*Y~)Zd3JYvsmNv-Pz2s%Sn&E zo1ti|s0q8>TRe}DCyMq*#E6|9$F2Lj!>gl(GayG2I3W8kD5P-&`y%teDFF1Ec$5D`4eTu?Ajx7sV@$bG3t@SwCq3n1 zPjMyJb#j@(-%B?bI17T|Ogh+!lV zi)kteS}WV{kz+FO;Gr3BZ1^9UWO1^{@qa@?LKFY*hlI?t6&HksYDc#|+#TpF{EfiE zwm*rq^~x=7w0r*%kP&%OX$SKBm(0^+7k(-_-b*$*CYSGCV6Ha-UV_?3<2`dS-|{>ruUMCCtYc2DK&tg2j?Q` z;NY*Y07WdQMjYG zdQ!(N`;i-2^L2}|P6&<&D(XPWS=!Q8CsT&-d8~!ncBnj@RRMFZX0`2-h{$Q{AxZOLR`X?}PEnE_32nRZg*2(Cxz+2-3i>%N&ywSLTO3Jslc2MTGJYL#_l z!m~9J_)!@4p3!~_@z?MbdV4?0I266pP4t4v%M_(NFN$up^*$te^*a&8LUMM={BSyF zZ_SR+qrd$@^n72qZ2M;9;*Ny%C@H+3BTZ}^zQ#T-3YE_~S)cetZi zI032&i+289Yg2(=R`bS7m;#IZveDZ&d&%|g*J1y~$=%fDp0;Y<`*r-v4F*5E>gwvv zqh1O%clY|Ka=n9vR)cP|$?0iEplp-HMU@sWW4TA>&os2eU0*x-BnGh9o+@Dxzs66q z0ph*akCj9ssMtxcUHe}xz>+s)T5JRMvrcp5AGU=*j3r^+7~juvWZq96ob67x{3zCw z8fy!BYH_vDOVwyDpKryJezOx3RxOjNRZ6V&X{4s8!%DR~busAOI z#9SA`efM#dNKP(P^$D#;i(1}kt>EeB>a-_pEWy$p?qY&OroONsVvex0VG=@pm}XZy zUwOt-z%yoJ%`~uvbEXf$mz0a4)@Fnql+R+n)0WDbXlBk@9?-kAu4k3-sdX9}W;Lhf<3HnXr=Nv>y= zku?3pR>3>9jGt3m%suu&`|2tsxpEq1BG&ZdW0*x__a@eI>>{fU)}r&fd)ZS9#$z$o zA=`{gF1u61n$5H-dtYuoIMAGr;O&@w0=+6zVR*<`dVD|*oDC5`kF`c&r+NpmICLNA z%4GxqDsBe zu%&ZZ(NoQV`F_qNYUAT1RGGkL?{#QYe^u{=kM53gO)sHZ8Q4^c+qUxcV+lRG;xG+L z`8cIQDM8t>r3E^bk)*1FL*bTtM)c~H-#693dxG1+9>di(&cS);#M+=0Ph;!i#41nv zK-T#!+C%}xK|)xIDPau{^m`L&(RrTjHIt`aDicUpD_o_5RqLnwc&3r%c(g0ebtV<_ zqH>YdI^mv%m8fR^ zc;?f*A@q~3LrSy$no3k3cX>W>QC6Z3{P6ci}da>L&^1em71X;GG7@?bZ9^=Wm$u^YS8o zbaBOX>AW=Lpyls4R&E^0{-nPC{rB~^yM(;NQA@km=&&0RTbO%|j5M)*;QqZ?-{jb~ zes4T75rII|1A_wFPy=lrumdV00C z0Ko^0SgEnwoGjasTN0^`4~zHed_(g#AEmW>z<;`)NBgdscKv=Z(*w|$TAcLW{VErC zJ^k^pdg0ZAzcBjZ_?GSk-F8Tlpd|i~Rrs+3am|i+aq$x~mpGijgs3l__v0SiELu4c zv+rxh3wSN_x=?JX-NEWeJn7G@Wz<%`B14ANae!@bc0tUln;`qh>qw zeX?j>cAXNWo6w)(@n)f~$Ww|FP}q({4yIAR`cX_e(TY2nU3|-Jc2#t9|8`I{k~wHM zx^LvEWM7NY>44s2F{}vNk8)k58f@ZA8az~M)7jLtKaL1m&#tcHyMkVoYk>3zLRU4K zij-z;55~|@_Kp*xrfg1i6x)3&-c7NrszlBivuBJOPofKwB(`vL>P%IuL#$-f_IloB z@64TV6uW4|W)ZoJPNO8$$!@zr4tFk6(OQwHfNuA@pA$>h2$V9hy`4}h$ZrfRjFe5n zv4*(mxcf}k?7NibZ4(h~q#9ZW{%#r(NKDE&w*D25t8HinDQn2gN8`kzQ-S@QulNzL z(4gTysWbx8=u8MqOQX_HDy<%X{doI$FE`N*WhvwDOp0`XPnT$cCy%Io>fB6Whf z>XPXZUtg+Kl?yYw9yUc7kO^y-jB)4t?2#q&lyg+qYD2Lorq45rtEnRB`e%K$Ka}TN z6!AJf{+~BQ%|(z-22bupC2K|XWh_?ZY>I{8L4NE%cd zQGZVIq~4X_5$~n{eQ_a-(9BquV(O_Pk(EUk&sLW%Kl3-d6krD`ftmDB6t6* zIQ-*OsL05{Eheu=0T$H*l-iZ@S35zA`_LFB*R+GM_?W$>RLebMn)PHltl1x9~25_Qo7LI8O z#1Hy~r>!Mr6nAJ%Q~s-s_K^KW>N|YI(M7Ql$;WCTGF`7uiISe5UBpC{)SHCYNr~cc z0zLhRYr4reh*RSR+21^UB*N+Ox^Iqr%V$?sqxzSknM706nD=4WmE&QnzNYeKvHSl9 z>WJ8S4m$l+>M3-v_|p7K)~P#d4&6r)NcB$wyoHp1zxIda=CePV!u#FPK=Wg{wQG^^@RaS#@>UE&y5QV>w6f~q&U ztWu6aM2zwDmx_c3V~XKD_OZj;s6lqKDce!wCSKR{JZSJ6D|T}s-JDgGpmkJJ=}D0% zl0ZX46=f}HR~GBZK{hduarY#5kTU!T*AZ%46p&@7mi;S>M$BV4onaWiQ;$n-PaMj& z%EGqrF)2F03s*F!rIOlXpGHE5YRTRxU=w2sl!ooYpyFNHKkeC~^DK&g?IlAHhfy)b z!!v?4NsWm&q46ih7iBd4@v7)&f6Q=z_A=x%mDn`jDd73J^l zf%T4{*x6h9X_0MwED%gxQo_~VVKcxTraxcnP}j=smZO1c7mkfj=Awfqn{kWgn$0@CXauH znL_v?0Xunn^%5!5#WvaMb}L%L$E0?|2bU!ArXWZD$c%+f}$;y^oPo z3h<3H7O_t5=;X$PRS(2R3CHV!$vgf0-L8t2m34Em{HjlH0QKM{GX0lgCqsQ}2)|yR z9X(LmOMV7SUIQgt+Hd`4oXd>UYW{tQR};og3As$7OlhmvZgO)xj{H_Gyy)D$*QV~X zixSmptlqQ_YqwW~KeTGEaee8DE0ZafTotE9nq_Y$+e1b!jWMEu(ZX35@P(~ZBwG*safpR!sVhFj|?^m;V}A()Cz&6WiSmBTNv!hx?WtuYPS*|DhOp1JPiq z_5E4)udyM3v|F(&i;vClLI^J~;$kDtRbk)-fdyw7V zI9wMnVlJ8FrBK@RZ>y4*8@T3d7iDSd(D%z)_@wRxNc}nRHI>*D8EwkB_r+aSd`5)O=lA zTk9nU#XJARet#!IQlVcOZL<`NmZ9%@APPKMw(wJ@ZXv**?Y?0+d_*C+^U2s}DKl^e zbPjmOcJ6-~PQkF%lY`1UwHd^Ok54if`>Vtu-V5*D-PB_bkB98WQ{WO1%uejAMkpCc zpx)Br;na#x&)4j>TfthUNRiE7k5L zv5v?n*uEBH4}7asJEr^=_TzZ>OpLCvhLX~IA^YDCXT3pY9*Deru(9`CjELL~x;DG8 znBHe_2Gl;?VqQOD5Th-4UK%WPjspN#iHVC7{)z#34+A0a;r){>z2!3qDuh>88-jMo zME1s9yU(p`CtD@UIQ~kC%AAgzgL`+zzeFJ%t#Y*^Ir?6b1a9Uak!qctos`ToprwM? z*c%`RNAp8I+1J2Y_`s3RPQj-TcRXg9x(aXugT(pNH^0Q|A=V zy2Pm8!Wf#8ozv&dw$nl!f9^@HqI~dPg%pRW(m$={M$t(S&wIb5hR2t~`G4T2y~}Q> zue8+NUWU3#b}vV2Y0Bj4;9KeBO-Nw@2JNK+T)KjhwnDe?Z2{!<_eLIW`N{ilUfDHP zmZ*#Wp#5tY&ttCm(2A3Do&gH}n$d)>P#*Fcmklbw#Q7Y!aiWTdEYq-U?H z$7)?|a5<6*;@#yShFo26QP{ZbfoLbBE?H}4ZowI?zw?L0lqY-D8SkdeoB%Oui=j>a zo54{#N!vN8KSeTyCwQe2pzZ~=$Sd9NzC0XtdXO7kR@pV2$hUtuBCUrrLKSKw$OzWu zj(Zr4AIj+gL`Eb-Nw(6zI?r1x-l-2lsfo2Qp8uOl>OP|}K z0zbhYqIU~Mxqqb1q2Ll1RDG0OGWlEmRbv3DiSC42_jctA`kjcPW^vsT9rXfsjRH?z4);^djoiB}l^yi$fRlveE$f*19mR^GFfi4| z;6xDbZrj^rLeLuvC|l(S{il`9L7y+$WR-(;t^=9Z;q1C_?+%{)PlgUppI7*YI*NGk znMeL|%-2?xFAAq!@Ks{Fl6rQD_?mQ}2!;3j6Hc5cGFCUf*D(^3SS}%nsJ3DSNTsRJ zpHPb=)B6Vi0o_o(Uq=5RMoB4Ju=VPC2_|EC#+1oi#b-yc{s<$HD@+@U3FS$;ZznB0 z`7#`T0F&bAPBu#Qw;zm9Qah;QP&$EZZV5S7Mw$nA516xE#HG$jV8kf{WY-hZO!4;@ z@lkpCpMMG7=oMeY`^R%0wD)4fD1$VdK_00vuc;ug&|tvgBkaE|vK{_@6q-**dze7C zN4F+X;K8NaN0^9>Mlrvf0)9lx*QrQnrl}So9o2JzhJ%dmC?pg_MU%_zY>jl>|1QdX3)0nPrck}QGfgbKu`FT2K^sL9v9uN zDX`Q2o%@}xaxI2drg_>I1=^y8>)P0a9)mP=M<0kDXSDXRxm9fO{L?*8wVZpxCe*I? z?Iw?14*;&A4O3D+BTvGOz7{DSTBOz;bcmzDfmkX1cL*L|oJ*b^Kb)9=}p}h;gX!>)s%!vs zX09<;w(H;IGPvH9^P+WUE~fp{=_A(0PwRylvs|5Gwav(?PDH7I>YGqdP{NU_#e8fg zLK+zzeLeD}@F^v&Q_sgl=V-lW=4i>T-$s5``QCooaMDNeM^5!drz&lg+aQ2q-o$;W z>JWtaD>{i3Q22F;7I@TmoL;|eDt$h*`AB>Q`UDGQiexZcc#qo7n6TE%j+v0{|2axg zF!?50!&ro2;*Rqv1NW~6?cVk|Og}%?*qQFg99CwnJ}@J2$Uu7nTaJj}Vk*{*g?jEgN* zrjt`o1G-2^ZZ(112RBYid{D`X6Po$SrAGN`95J)(-SBp3=G09QhIFtPh;UNp@pjdt z)F7(9ZZmSmZ6hPvT$yvU^F9XI@T{v=PBuC*nlW)g@mJe{MbR%cXVW%P6_66^xbdSJ z02aC&Rv%57gYSZD6Vd>{S*R%Wj={P<1B=s|N%r9FE7_UXmv{VuNuoXI<%!gSXzA#A zZjNDkSu^RF`}Ugr%^KxL{Cm3H0BB6l=}WePafbs_Vo#7Ym_oGNpc_@)ajKS=n*6x# zEgqRUYwO#>u4_-zELO#;oCV&m-+18D4ii|>)8yh~>#8|?=#7c*zwtxmb(wJ{{`%4f zZR$IKBW0ZRCMCb~Oh)F-`>?Q?ThKdiH_6N6_Ujc)Yu*5ZOoQo4B8o*xB)I850!o|e}-licL3dszV z9a_Go-IlZFurCbP?KQIE<7k0_~u-nc25I9Rw2^ z4kwyp<@E#yU@O{1e*=Dg1?mLCxYY{GN9M4(^Kn=JcRbQA)ca?MUM2lNG&!B4YBKe+ z6~u{^Tc1Zi{2x%r8-S?b#~aQPGVnqmX~fs6m@hv<&lvFMn3Z*T6E&m?;vby3vO+6Nc2oz-)U%hWTwhLB6Rx4K?XoDWdQaA0@&Hv;><@S=B8HL&0cbv4+s!=4qg=ZDjh$sNLal)5b#cR7Uxo0M} zeMyt699}%(lmSM1!z}^3p;}ytm5aPMs81Xi4{-c7-P&tzd$#pV*~zJt&T84SZaz^i zPDUQf99o%X3%QEjQL6K7)nx#ad>rj7-3tV#wA;JeGqe0 zu6@~5L&7EMI;*(Yc=-*czg=qhm~^$HMR-D3KRlJ5%&2~iAO$d-R~Yo}9L>e{M1F`m z%lM6*k?b31CmG%oo~Lh3a`oLa1jGe_oSW_0a6i-3-*z7Qyhwb9|5ly7Bu)4}o+#@5 z`aBYA{UuwsE7dr&D>2=PyGl25XCqG$*TJKTPSG+-S4oNfVs&H<*I|*5e0M^9u>01^ zO=XOZ>?K-EjLzd6g%BHG#$i9WF*<0eZrx^@nHc0u9o|Us(Y6jkB7adO=ojFaa#g8= z%g(QxNp!!guXUi5Ao{)FaAe`-P#yPlf4_`Wjm=U)BMZi|Z3wlvKe)ii_0%j~o;^%; z-1(hmMS?A2UDHe<;%Hu-p{J&r#ioIcz%W>^h0i=i=y8c#ON@MY*x6N+YhZ!kixmB1 zyR|znm1LhJAwEK6JsbdOI~NA6uF7LCjfYgM_FRx37-XO1gpAm;Z0WpJ2Tzsx=O;j}Fkf0{A^e+-R&iv*O2ftWE81|Atc)rv}BX^6EVHJGQ06 z#rGx6o{kMu=;Q*Ro!r4dqQbRIZgMgf*>a6+>vqSDU^i<0%d-xh_4$BD)&3e;V^JCg zd0r#@w_7bSz-9G!V|%P1Mf2%fx$YTBNtd0yWjeedOz6+2{wZxjD_ZbnE!x))l-&J3 zAPxa>hR{{_oH_!(lOgEPQUeb%#B&Bv%jwR(WpWlmNr2U6cYU2)f443B!){Z!d}hI~ z3lAIwVKza1gi-P^-nMy1%y&RG#}SDjR6B)E@xKys&aCjz3IzEQgVeGs^Dq+ov$vn4 zb(bDmJM=Bh-w)~{2AT90{IkEBbyn0;5f0__Q{iyii$8~k>DzSkH>dx#? z!6?o-p<(+NrLhDWKXTE(_xa&A;5bsM1`0UPMvUXhwJ@Z)p;OvWZ#g<$U-zSa zyT=ie?vt{EX~&#jI?E?17%7DTdzUP~imU$20H|}~0YG$qh~-oa{@oxeztR1z&+-kP zk-=2OIK3q$EJHdXJvexDsxr7nwCU*RKs;-4yIeio@*mLN5KlQMYjm`*t^xjqT1Nft zKtsjV!R8Z=0sMUSCQ!A$G}OGChlL6{%xi%-`QC=E7ARwRJ zdh0)w`~O~-qvTJ@lwGOv+Wbm;`?mYuivD_?T-XgZNl9plWhZU(PjKaz-);diV@5+c zAvP-}SI`)X$)PZk@Un3oSa3 zsIIPtKp-d95&)Ho^*ARA*47+Bb-86CMC0k{slD#2ya?JffVUgouU?78R{~3fS9m$J zq6Lc|*!Q2b4mm|4obnea!Ba2sB#^WOgC+=nNTomZFAWfpC14rZ0=HwLfOrD3yzwQd z;MP3rmHE^n$E!r$wrVr&RaobN$qv%dhHF&b=oN%#=1L#um;~UkaZHM=E^9*!t7pXK+CTVd2niLR^-i5BsM&g7x1F;7gRyke6ljGKi{-_^b9Vem z1e~IyGvILey8;YAzF;tz{b?E57gG1vpbO@Nk2BmbG_UfpMMDOAYl_e0l2QfTezW_! z_ff#nfdZk3oQ%ZrNj|%Y7CeK{2`}7d9@D&Z27Bt(HnH#z0PemhRxG6Yaz9U7keImx z>RLTNL?94auC66pTU(8FmIU0ct&NQa6bikMh`rL54QMU5^_q)=8=JAO-OCj#%=OnPV!YNZ1BJ0NAaOs_&4k4+5qAI z1NiF0ecF)MT{1NLuC%slB9mzc`&|kbNCI0ymQ;v|34;e;SJYcXK>-^4JahG4BV~!K zQ32IXdH5))r$~y+6_GhN5rH1*FKuCGbP2Y8_1#H+)n@HyCA}7Y=mn9I2;Zw#qZiNo zz{&vmF*6~C(f$;R*dxv}0B(+?WzgB(Pt)yk9M2nMRs={^e>6zHnQ8lOdG`%-bgCEP zMy#!SeA}nl)*(gU_C`MX3$Ilwkd+ag2RH%ObbNCc9fKWWM>~5CXO>^-cO9R4fpXeV z|Fgfh+nb>@2MOsH&n`7n4K3~59vf`W?IKgTqP?*E!wl(a^zE)8B(+RQ{041mD_xxM zRJ7)zt-5A-wTa|hZquIJC+vc?Vk8rhg~nL7xv+ivJ;>U!rG4fEe6~{#vl?hO0peLNn${oia@UN5nbc)_i07i)nEHW4E6W<-X*T=2KmO zD92a%R23kwBksF?9;z_3kDJYFElizT_0f_Y|E{`8QZASZc%x&wdWW~^z?dd7YQiI* zphNkV3D~mc{lr_qChIv-){&omSC`Q(XY4=n4;;%xum!=}V{9kh&)#g;A>_9}9!T26MnjZsi%il|A<@9za;se?kbCHV)(GVgOWqN0GcL<}o#*T)GV|HwJ z#UKufLPk-DRhsOb7V#GC4i^U#I}wF^oJMFVEa~2`0IPC04X!t;hfQb)^%qV1!Nq2E z45Ve7QmC>uib(C9+tf>y3mP-qzuGjN6`wbvrY(W+jWavU|e< zQyZ3W0atm&wfsz`ref%nF^h$y`0t1;o`N0UIKQYd;lm@jMF5T^N=X(UuO&#qsz5SK zp~KLb6f35zV{|Y&q=xfrnpWDj-y|~$iG0&bqLXiC_)ABj;y31*6V|wKI5r| z_#XPr*H=7Jq*>=AlJ2}@Iw*4Qvs9nG0cs$JyacJsFHd3eMLegG(DshWJwj z9GPwEc!vkPjaS7o69scerUFdYp05DlPFBiRBeK*;5sP1~3aI0Ad$J&&X|B!*bVQ{L z%c)?TwB_5pVRwVVt$x>CARN8rnq5fEi>d5GNUghll6v=!VGV4s2+CBiF) zaNWrwj*b^6;+kN0AIAue;M)Pm_xT-01l&D66{0^>gAF!IHR;A1Ye&A+dc#9(Ip9$2 z(s{xb7Y5cB0P9iI5cR>Z=tYpGme%fkl9TQHuLMAHoaR;jF+R7VYvP%9M=hHwIkIW# z*=wrVmm<-3b@?3Ue<|{jw;Pr`f8V#DsxyO!;o5i#FgF=??N)DQu}iz>9QO#cX*xzV z*AAAU^ZX#~Wj6L8{_CHHFUGKCBVgcQ&t|8U_sO`Vrj(x0>0)Bdnal6!s-=!TP_!xUO48wPF~J%SO%LVRovw?5v-60?mxuC`^-nnsN}mFr zr2XdwC!^e1b}MM9wZ@fiz;ZQ9;ibXu&qM&RZ4lF#>RrpsT$5xL)f#^&Y#cq*jUV zhkMTnx9IUeNA;;lGlE>>JT1K52;GGqOLu%|Z}QeZpz%iWBmfb8%;$#EgJ_)E+2;h3 zd)m}=^=-S%-sBGE)C5re{Q2{lnVFd^8q}hYn5}WSpe_)g2J8{8RP*HiC2dz%e#MHU zN580?`&phIVAZq>#1Dq>!-Bh&3t^b*p>GRoNq2Utu-xK)Wyk%m*)&449SZaMpu__~N1m z61eZ{{O9t-7DID81p|`Q#~k1nX7taSu|=agu(a!&&(U7^!Hp}vqhk)0N};zsEpes& zWoY;C>|?)mh8ms|zg&+aSLeX81mn6BD!NhmBp~<=@BUtXwd!+DFi(1^&Y75}XL8Oi zM-s_4jTDS;O{R+XAV4;aEM5y1(CCtK0R$)b7eB+u`I)o$e0By)sjR03o}E(=xMtdd z4a8gaT1NG}3)~x_!U`w7Y4fsq^Mse76Nj-*I*m(?*}hwo8u{a!I&Ltp8eTO|wf#}@ z3xkXpz)`O_cn;;3n(v->YxD0<33@}r?mGghN}#l~u^pXsf6#5ImB6IVW;H*-0-|>95GK?_2w?IjX~Z|g9TfW!8NKmL*b>v+J9h2H_Zu=>)XEW`jCnu89ALK zyjK$YUOSX8k+Mnv#bV;*gLm4m)2nG?8U6NHN$ZTSHub#U;JkLbPMz07`7r&U(ZlJS zHuU9Di8LVlKk#K>D4FZ3*p27(b;EVIv+G5{Go=)Ua^Y-0COKV;wVn0Y^~{omL5{z~ zz5QrC7N=YtH3Othc8ros%mQQ%shQd>+6mW$Z`HWI&(|6RCQpGVrOu%#ltEx(Zp7b9 zT@SmVq@S5gR*4M7!pP(QLy+~EJw;#q*i>%MAF@#w^!xPt&92!?pbS3tt4)kurn`5` zIMlqjObDWEQyJ{t8Ec21vaCNxZPeCAciX6_vR$}oG3Gn&|XfAdpj0A!1oHM&-D;a2;$CA!o-r8UK^oDWH0>0*c3Gf4E`E4>i=X zOZ%Br-52_$oS*Xet>9d7Z!ztvw~Uh0|NNw`_4IxeSvpfRy1QWWS^deKhYChh2{RJz@CtvJ*6a%|yKTlT_5VEr9V%{NbQ@91km~$yY zX1M)w;@vCi({Da^wMHR-Jk=>O-1_i7)`ES~2;p{2X(glo>AJwho5ehhJEjWX`gHxJ zU%qXL(|G{13XzI7UB+MKB_X-0+@GzE28M#$Uzta{ElSBHA6^AA=)>@%lS6s>CGw)} zo4*9DOuPIeUjjtf0|-M#J-s8jvDo${H}-q?9s^v3700s3(GOKbWvL@`10GGx)KaLR zn<$K8@@reOQ-D*wGck9H=#|{2upQp`mKQvubhffxv_m2@cK+~o1lKL~MjoreofDLM2nmW=x7}XLuz|rI=3FboTv5u)d74X+^+=TSYp@J_)R0V zz)&)jLI z0s{8vVKbj|M{055i%e5%>e{%`UE4+4qk*209m|i=wLCxktTil;ZE9)bsF!*^xkeI| z@j>T}z8$wD0<3D-&DyYvR$V~0<}}m`##=*5^=5K%(EsaK;cy@s{NU|6&yg#ptK6?S zZh|P4`Mw|wSde#FIV{r?6#@_A&0Pz^mxrZXrrxWKN?-P=@!bkMTHm4Z+2{%-{)2lh zljjo}2Nur?ipy}s3fiK>>JZ^&s~^pofBjW2I~4|%)gD~p^q@;!`YyZVpvz|dd%;bA zw^2>zy+fItx2Wc-{0x6-?u(hH_uqf!r#{6INzTV+^J?HXuQpFb_Z=h;lWsAD&X(c+ zu&s}nI#5(=&KoynuQ_t~5u@Wj^H0G^4&@Qlk6Fz8o>`=f`7hWv%0x zE%#k0!>8m(s@ZKqc5UtQn&;UStY7)0D05=^t$1@bX(oqG?JVy&PbVOtT7!r*+0XdO z!OJU@IGNdeO)`t^wZhW?C*Z1mI_AB@cfx z{!hfwl5YKB=Fv(*axb}s(R+~0t9*AicipGnu8DuT(=2{9m!Ik@4e=U|_tm9#qr>S$ zzXCA-g9nJj8Y?C;QQ*@7>kwX~oFJucDxdQ4)=|v6f@;{-SxGS~c>x&!*)^z|59RqD z)UN}eWGu|~{#u<)6l!W4D_f!n+6BjRqjvyH{d-RGn(_a4k?;R&x?!Ti)=4+Z7U)N9 zSCek_x*wO!ogv`Yd0HQ^|GmAtb>KV7sbd9IYl^rvRxOB!MSI~w8ll2)vhc`Au>P?2 z#yCIY(9{Xi33x(EAjXZ-!b7|iB4*u|^{}#ndvED!uv3HdlK6u9zJk@XrGmO0(yE!V zpYpx`{>Tgh#BRED7f<0+lZSYKs8eyo)7#~z-Lb+pX_ZT@No)|dz4)b0smwpFOTIJ1 zTG*>j`f)2#wJ)F!(Oq4D@_aq(29`c}KTUj2R7Rr7p|R89o>@$R-&6I&@8iAX|0Hy` zAV9#^#zt2y_Si*5vn%C{?W$r=(ORgB*d3*(PXU{8p<*`RxK#nSuDYJfzJ1xit$QaY z4h#+;?AoKBeOWNTx~_Qfn( zT{MtvLhaTEY=1WPsg}W~`J2C06!GL+Tz%GB5~BDC4BYclA|Xm4z4h+z%Ww`TDs_}y zqrf#A>sxuRgIzE3=*4_s9qis?rKg{g)zD7?Jz7mbGca3s$!3oPU_T$F1$z*Bw$2gK zZ8A7A5{U}Z=?U7~jLj|Igdp+TnIMRcb8}^T)%S;@9^=DPBo&pQ7OU@}f;0ePIGF`i zPuSRpEvR^==~$JRqlGhSwJyEsLzu{Z8a@q&R#G6TA* zyLu1h*prgJ%v`2&^D}*2=USiz1mxj>^CG>o>@MOyd6S`+LEw&R>jj*dD_Fi~aOE_)P!*JQOi4n*$k zV0gNr{grmFzz{*yQaMXVg;z-t+SPeaLq52+b(SsSNBai7zTW$3T|Sk8_-Xs}!xgkn z90USxNnj$Nji23MCM6btn@pPJZ!4A}2G@x{fv>K6 zNJc+D7_x%THQ1PlvdM_@xLvAY#v6drxYH z0CqEjj2+4`b|b*=DP4{{f6YkwQn2cS^K| z^<3he_x-g1!dIcXp(JdeKAQg~CTZ%2vx`}KqtAb@C?4w`P4_Qi?bYHN* zEP@YP;R$u6PnMiK7n|O#f6B=iuJcu)U{Ok6IP>x`2?>>&qU>Yskt$%QI(errbX4FF z97RJF{QPbQ>AXeP8)ANT_zOG?E!pq2UmEw&)m(fMLK~O=EZAfvF(sY4gLcsQ-YnUZ zt#vyFC@~n1o-lR3mt_Hi(`9rSSbekOXB!gu23>9o~T%-m686Z~0*A>KE+ zW&0LhIh-uvfk|2*5aD=pAq9sBI6zTF-)%$LE;CGs%N)ZFjA}R5AOwtpq)U75S?0xl zf17O{X-IRE=khlHv<|O$RqR3BJ)Axu;qn_G?KVQn?RBUQN-INc%WY%?;?j1KkHpx~ zh7pFlb3D_Hx>7mt@2)X@4@{(^qFqqeL;6^$>s0ogGvuP@nH1_}Oj14Ln3nLD9no5z z>X9V{CgBrOqIjI!fkA;#N)bjHx!26jSpdw!xQ`Hce#KvF;wA`4LRpfy^e)bR(gh}3`q@Eg?r!Ur@f{e>Zy1(4dqf1~SaC-{{*Gd{#D*^V8|eDCYwr*1E}IP@Za>m!F# zRrh5bTJ|=>;0lb~GCsR~iMe7CFI+|D2^?Snd zDKV^EC+n8<(&9J|{nuTUUh8ZiTUWrR02r`B(ao>#>+u#(F3!S=U>)Mp@!p4Q@v})l zMq>cZqT%S6V@`^InwttFjMhJobS2i>t)Cvp+Bl^hE$^JGtvmc~9b#3ecdksSEt#i8 zxF{BRAJNH5`N9W>XBYdN>sKPK5v`RgGb$GC-B@314?(WKjQdoDy;9kjqZqp-(>J7I zk?84-&2kdY;OlOwuJ#Kj8#lgM!o^;q6cnqH;7L2ZgB(~Y2GJlfd=ygO#L1JoZ3~d1 z7!L=FF6?K)RMiIaCc}J$kih*Nk80%F|U*{R@?>zM$#DUF%(20R2ESwYb z`4jpOJv;2OhsE@)b9WFO&&RmkX5*B)-}#v(Sqg5)%}Msf2P?cp_?dZs82Dz|56#2A zBYC1$ZJOpIPY;g?qlTZLZset;zqq}uSGchAv8lt#7}aybskp7oCO&G+btovD*XvhS zHUY=+n^2Y4)Z)b$466&YiaIT>6-j?<%ax|MmalsM}s_9e4$g*q6QCPufc0fySNlnQm&3wua>*v z5a{bzcb6md^o1}07iD7$v}6?9@(sVDHM5A^pY4{arjq7XYy%9e84dY?Ok=;PqC}_H zl7$qHHx^6=(3)##>7#?2?pC)hqQqI$2PX6MzWl26wC-}ah$~QL=sCmh7$)a+%fi9; zvV~xmlSkH*1S!|;Q@1`x8##0nmF=4;9YyZtzDMPy+LM)~L?&{conZGsKQq%Nm)(h% zp5JJJ-!s`xt@1QtynMCO{nh0^dcyb#{FA~4Koj1m0$e;2_!5qH<^M7sY>W*;qp=XR!mzw4vOFDs$ajetGk zm`qu%50ZH&gORyba?i?BH7R4KXVuhEfPhKt?3_ zb4RLqty9Y`DAx8C8mZfdNu)S&TJ3&FBnG<-+AJ`pzR4rbEn

C~*&LvVULIyP2(r z`g=KWNr*S8K@5snA0R6>p{0bE>5&T$_N^AZk!Bq3r8W`wVzp!Nzl1$NXfjhSJXhb4 z8I3PWmvuLpnCZXSB&Bt0U4;|JQVOVG9h90db^CTW(B!(u91E>#6k-Keta6O4yt2m^ z?78<~CLvVI3*4uh2rH-dk4LN1dW6=+!)MZ-L{wi#y?Y_7ZQR`$aLLT~j*zXwV|y<# zOO-8t@ul=rtv?>Nd_mH82Wgxa3Qw10LS^ZN&;{|Zgx4}_kMzCaV*Kr~#QET@3h8$> zan6vnyZQ%`I5S1(!=I6pJQoJ~wioacM+uD~lUVGTz_6LH`Xi;|!=n#blP3B2HIcWz z0UHZ%UoQMi`1S6L+BAOneX4}_G|ux#reX`{$&oLlm6J!-I)8C7_Ep1v7{hy;apjii zhv)%YKD(~ypvc! z2=CzI))=WmL}SD>Hw=t)Jk(7RxXN^l`nhf*D6Dg4_WA)epO5%{knwe7V8V2pA9KCG zD(((?x>f$}OvGZBe9~jBK1Z>Bb}ue&4sYG17m7>jb^+3zsmkuCvBJy&Gps!qdOgR( zuk=8LtM!-7q-yIgXA}CQk5az8#^PSV4z4Qr>jxFzy(H~ek5<955;hyv!zhWnBSnfYlEqr3yjf~-rm=|Yybsl_HgrQ4)DR{h;q>!jTG zGO6T4Djl1h>VufuBs(8n;;+^^z7^FW<#G+qLBKZc-Rt`8&K%u4H|ua~T5vKmFhhmZ>W7#k zsJqD1`b&Q)#0o5eHzR0T2-tw*Ug`G{7pA&+4YW>uQI9UW!_{Fu<>$M|Y%t%B`88O^ zQ>tORp)RnZ8$g ze!Y6fVO)dfUcun->l@{ss2pZ4l)+g2l56eT*zSS(c+nEiZT8a5E1gHF?3im+mN)!e zXX!%(XXwFgLd3~uj*iyruQsN*o^>Ya*=`qS3r-HCnqLt^2)s}oS&QlPwo8TxI)b~uvTPM9%T#WjzX^bHAK-e>jn2_f_A@i8|RZ!_k zC)m|j%8wk#!{ZMV^P?-d$2W*mvDP+a4mDylrDOpUMB}-$P_u4)VfmjU`&`R3_d?$9 zcVJ>I=vs5i@7%YzY^kDmk;Q6!{c9P{TDZmB|9*Z2vLgqZD9jCwEmlUBQ&3(NlrjE6qCnsJqR&(sGrj1Nc`y4!+1cZEz7AkI(N4*d3Jcp*OapFLxe2jlm;t-uyiWzDTbDR~}^wR7Yj;Ctfy~6Xr zG{Tyt=4-kV#)kN6SNI({Bb*5M0tvMCZIm01_&%~te!MvXLIo#s=T>Yd?enFKyFoUm z^E1XD1Bg>Ddv^#svFdTrdJ5$waWvkUBwP(84V2nFJa8quQdlTL^2a=2e+7%%b@Crw zJ%tXE#3N(`q310<4)F$!RAOY`QgVq6x@?-wo$uCJrK%O6Ml10Jh zQpcdUXhEssWaxOpmV5q*82phPaXKrL>k0@N_Dp-Ic^<}ezqiTvA0LFDwC4aiA4ne= zP{YYw-~Xwr;S!3c9WzuRB)Q)ORG79f2L-bnUbL^?QOc;BSXnN@h3}_pXXce zAS>!_Cn;C2>#Jaf7L)s$Yji%&I64gK%pcWlj=V&nez8IA*P+Cw9`W2GUWY1Kojnn% zY3(N0StkC#p_6Urwq%=S~nZ|eL(PO9;kypAKS;WizIV4^#m1bEIrquWH>AUJs@%cic)Kjx$4IKU)LoYi%)f&_Vg123-F)}=4?ldp zjY00A|M+QYIM^0gT0-5-9uFd}j2e{k;kMDtXxMZM3sqgNJG1@vC1yGpqyDQ?Gx6s< zFLbCYy`$4-3O6jg{%Bqfp=3^SJka36XdCt=8pbvQ*af2@-28k=X&5Me) z@WjH*#&S!{QpIT};eyQ{cf1G+0u?@ZSbeK^xhUxgzX)=SSs%Ktp z&fk_2kd!W{&A49Swslx$u#06Y|0*<{WPm<;JaYs14kRRtq{O)*vt@@`O=8ZhAB$dT zYrj(La@odq2xeqsmsu71+G)9IE0|)QJS&7FW^d?AR*G|`<+ymn8=-jg*4CVe_j4k aKwvOpEII{+Hun;*tth7^i+u9@_5T8Dva!Vg From 303ca19ac9b1c8fe379c54860bf45c8c9fa990d5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:33:40 -0700 Subject: [PATCH 37/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...igure-block-at-first-sight-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 5a2cee3e2f..b72871a931 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Enable block at first sight to detect malware in seconds -description: Turn on the block at first sight feature to detect and block malware within seconds, and validate that it is configured correctly. +description: Turn on the block at first sight feature to detect and block malware within seconds. keywords: scan, BAFS, malware, first seen, first sight, cloud, defender search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -24,7 +24,7 @@ ms.date: 10/22/2020 - Microsoft Defender Antivirus -Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. +Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50 seconds), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information) when a file is blocked. You can change the company name, contact information, and message URL. From ad9732bdc729f827c348655f5a7b050faea99064 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:34:42 -0700 Subject: [PATCH 38/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index b72871a931..b92391859e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -97,7 +97,7 @@ In many cases, this process can reduce the response time for new malware from ho 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. +2. Using the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. 3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then select **OK**. From e33485f989257216cadf4a8e854fe249e353ee14 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:36:19 -0700 Subject: [PATCH 39/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index b92391859e..b2fbc90101 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -128,7 +128,7 @@ Block at first sight is automatically enabled as long as **Cloud-delivered prote ## Validate block at first sight is working -You can validate that the feature is working by following the steps outlined in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). +To validate that the feature is working, follow the guidance in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). ## Turn off block at first sight From 6dbfad70b5295a5884edee874c044f3e64d127af Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:37:13 -0700 Subject: [PATCH 40/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...nfigure-block-at-first-sight-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index b2fbc90101..b13d1ac34a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -135,7 +135,7 @@ To validate that the feature is working, follow the guidance in [Validate connec > [!CAUTION] > Turning off block at first sight will lower the protection state of your device(s) and your network. -You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do this if you are experiencing latency issues or you want to test the feature's impact on your network. We do not recommend disabling block at first sight protection. +You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do temporarily turn block at first sight off if you are experiencing latency issues or you want to test the feature's impact on your network. However, we do not recommend disabling block at first sight protection permanently. ### Turn off block at first sight with Microsoft Endpoint Manager From c52294c6e806a25520d3b0182b17b972b1454e16 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 23 Oct 2020 10:43:18 -0700 Subject: [PATCH 41/41] Update configure-block-at-first-sight-microsoft-defender-antivirus.md --- ...igure-block-at-first-sight-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index b13d1ac34a..75752637b1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -147,7 +147,7 @@ You might choose to disable block at first sight if you want to retain the prere 4. Next to **Configuration settings**, choose **Edit**. -5. Do one or more of the following: +5. Change one or more of the following settings: - Set **Turn on cloud-delivered protection** to **No** or **Not configured**. - Set **Cloud-delivered protection level** to **Not configured**. @@ -159,7 +159,7 @@ You might choose to disable block at first sight if you want to retain the prere 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure, and then click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. Using the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. 3. Expand the tree through **Windows components** > **Microsoft Defender Antivirus** > **MAPS**.