From ac0de6c9a99f44ece4552743e63203ebd09790d3 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 7 Mar 2017 14:53:25 -0800 Subject: [PATCH 001/165] edits from leonid --- ...nternet-windows-defender-advanced-threat-protection.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 49287b61de..5e69d804c4 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -45,16 +45,16 @@ Configure a registry-based static proxy to allow only Windows Defender ATP senso The static proxy is configurable through Group Policy (GP). The group policy can be found under: **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**. -The registry key that this policy sets can be found at: -```HKLM\Software\Policies\Microsoft\Windows\DataCollection TelemetryProxyServer``` +The policy sets two registry values `TelemetryProxyServer` as REG_SZ and `DisableEnterpriseAuthProxy` as REG_DWORD under the registry key `HKLM\Software\Policies\Microsoft\Windows\DisableEnterpriseAuthProxy`. + +The registry value `TelemetryProxyServer` takes the following string format: -The policy and the registry key takes the following string format: ```text : ``` For example: 10.0.0.6:8080 -If the static proxy settings are configured after onboarding, then you must restart the PC to apply the proxy settings. +The registry value `DisableEnterpriseAuthProxy` should be set to 1. ## Configure the proxy server manually using netsh command From 7e613e2743ec476341da59ab3b9c9ce0ca5fe039 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 7 Mar 2017 15:04:05 -0800 Subject: [PATCH 002/165] updates from dan m. --- ...y-internet-windows-defender-advanced-threat-protection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 5e69d804c4..8ef29a6be5 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -37,8 +37,8 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe - Manual static proxy configuration: - - WinHTTP configured using netsh command - Registry based configuration + - WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy) ## Configure the proxy server manually using a registry-based static proxy Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report telemetry and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet. @@ -61,7 +61,8 @@ The registry value `DisableEnterpriseAuthProxy` should be set to 1. Use netsh to configure a system-wide static proxy. > [!NOTE] -> This will affect all applications including Windows services which use WinHTTP with default proxy. +> - This will affect all applications including Windows services which use WinHTTP with default proxy.
+> - Laptops that are changing topology (for example: from office to home) will malfunction with netsh. Use the registry-based static proxy configuration. 1. Open an elevated command-line: From 81db6093f6f48ffb56c2158a61ea64ea2334e183 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 16 Mar 2017 12:36:32 -0700 Subject: [PATCH 003/165] Adding 1 new limitation and 1 important note --- ...ange-history-for-keep-windows-10-secure.md | 1 + windows/keep-secure/limitations-with-wip.md | 23 ++++++++++++++++++- 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 858577af50..ccc3240c10 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -18,6 +18,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |---------------------|------------| |[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| +|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)]|Added note about Azure RMS and USB drives and added new limitation about folder redirection.| ## January 2017 diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index 39aaeb8dc5..a9a107a41c 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -27,7 +27,7 @@ This table provides info about the most common problems you might encounter whil Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running the latest build from the Windows Insider Program.

If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. - Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

We strongly recommend educating employees about how to limit or eliminate the need for this decryption. + Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

We strongly recommend educating employees about how to limit or eliminate the need for this decryption.

Important
If you're running WIP with Azure Rights Management (Azure RMS), you can open any enterprise data copied to a USB drive on computers running Windows 10, version 1703 and later. For more info about how to set up WIP with Azure RMS, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/create-wip-policy-using-intune). Direct Access is incompatible with WIP. @@ -79,6 +79,27 @@ This table provides info about the most common problems you might encounter whil Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP. We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.

For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking). + + WIP isn’t turned on if any of the following folders have the MakeFolderAvailableOfflineDisabled option set to False: +

    +
  • AppDataRoaming
    • +
  • Desktop
    • +
  • StartMenu
    • +
  • Documents
    • +
  • Pictures
    • +
  • Music
    • +
  • Videos
    • +
  • Favorites
    • +
  • Contacts
    • +
  • Downloads
    • +
  • Links
    • +
  • Searches
    • +
  • SavedGames
    • +
+ + WIP isn’t turned on for employees in your organization. + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. For more info about Work Folders and Offline Files see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). + >[!NOTE] From 923d474b200719858faa8f0c59b7e6974eedd0c8 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 16 Mar 2017 14:48:25 -0700 Subject: [PATCH 004/165] Updated with fringe situation and KB article link --- windows/keep-secure/limitations-with-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index a9a107a41c..7183cc590d 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -98,7 +98,7 @@ This table provides info about the most common problems you might encounter whil WIP isn’t turned on for employees in your organization. - Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. For more info about Work Folders and Offline Files see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/help/3187045/can-t-open-files-offline-when-you-use-offline-files-and-windows-information-protection). From bb021526dae5d79ad24b312e38c11f6e1498ab3e Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 20 Mar 2017 12:48:01 -0700 Subject: [PATCH 005/165] Added content --- windows/keep-secure/limitations-with-wip.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index 7183cc590d..ad8c162569 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -100,6 +100,10 @@ This table provides info about the most common problems you might encounter whil WIP isn’t turned on for employees in your organization. Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/help/3187045/can-t-open-files-offline-when-you-use-offline-files-and-windows-information-protection). + + Switching from a mobile application management (MAM) solution to a mobile device management (MDM) solution, while running Windows Home edition, turns WIP off. + WIP stops working if your organization switches from MAM to MDM while using Windows Home edition. + Continue to use your MAM solution. For more info, see the Integration with Windows Information Protection section of the [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management) topic. >[!NOTE] From a24763ffc2e3f2c3885ddc968983243d0077752f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 20 Mar 2017 13:01:05 -0700 Subject: [PATCH 006/165] Updated applies to about Azure RMS --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index f0c94d6dba..fc6d4fbfea 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -14,7 +14,7 @@ localizationpriority: high **Applies to:** - Windows 10, version 1607 -- Windows 10 Mobile +- Windows 10 Mobile (except Microsoft Azure Rights Management (Azure RMS), which is only available on the desktop) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. From 54b10176b832d8dbcb5f8381935f1c22e22fb8e3 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 20 Mar 2017 13:21:26 -0700 Subject: [PATCH 007/165] Added content --- windows/keep-secure/create-wip-policy-using-intune.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index fc6d4fbfea..6560a80e36 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -11,6 +11,7 @@ localizationpriority: high --- # Create a Windows Information Protection (WIP) policy using Microsoft Intune + **Applies to:** - Windows 10, version 1607 @@ -18,12 +19,12 @@ localizationpriority: high Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. -## Important note about the June service update for Insider Preview + ## Add a WIP policy After you’ve set up Intune for your organization, you must create a WIP-specific policy. From baafc02843c361a2071f9f3e1c00382735c2dafc Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 20 Mar 2017 14:25:04 -0700 Subject: [PATCH 008/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 6560a80e36..2ae0e7e014 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -378,7 +378,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the /*AppCompat*/ string to this setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/ + Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

We recommend that you use the /*AppCompat*/ string to help Windows determine whether an app should be allowed to connect to a network resource, without automatically blocking the connection. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/ Enterprise Network Domain Names (Required) From b4437638e9ea92ad1b1e1e465717a4fe8b031af2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 08:36:19 -0700 Subject: [PATCH 009/165] check in --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 2ae0e7e014..cc0b417bfc 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -378,7 +378,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

We recommend that you use the /*AppCompat*/ string to help Windows determine whether an app should be allowed to connect to a network resource, without automatically blocking the connection. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/ + Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/. When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access-policy-connected-applications/), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. Enterprise Network Domain Names (Required) From 572a75904fe5db3838f9fc8d682a3f57ba1e8393 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 09:14:22 -0700 Subject: [PATCH 010/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index cc0b417bfc..f7db61c525 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -378,7 +378,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/. When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access-policy-connected-applications/), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. + Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. Enterprise Network Domain Names (Required) From 9f1fd09d560a606000580011f4090bae77b93714 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 10:43:32 -0700 Subject: [PATCH 011/165] Fixing broken code --- windows/keep-secure/create-wip-policy-using-intune.md | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index f7db61c525..5a748154ff 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -19,13 +19,6 @@ localizationpriority: high Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. - - ## Add a WIP policy After you’ve set up Intune for your organization, you must create a WIP-specific policy. @@ -378,7 +371,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. + Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. Enterprise Network Domain Names (Required) From 51a28ae8968c78887ae3af359af6970312b0b712 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 10:50:54 -0700 Subject: [PATCH 012/165] Fixing broken code --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 5a748154ff..d32508207a 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -371,7 +371,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources With proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. + Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. Enterprise Network Domain Names (Required) From dc06f2f49c8ac551826e5bbbdcbf616dbfea1d82 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 12:01:54 -0700 Subject: [PATCH 013/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index d32508207a..22b83114e4 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -425,6 +425,9 @@ There are no default locations included with WIP, you must add each of your netw For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). +### Choose to set up Azure Rights Management with WIP + + ### Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. From 3c749ca9491e215d42e2f87c2b0b8714b592de70 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 12:17:26 -0700 Subject: [PATCH 014/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 22b83114e4..90a69c59bf 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -15,7 +15,7 @@ localizationpriority: high **Applies to:** - Windows 10, version 1607 -- Windows 10 Mobile (except Microsoft Azure Rights Management (Azure RMS), which is only available on the desktop) +- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. From 1d58cd4012ec4fe42eed86648dc334877373051f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 12:48:52 -0700 Subject: [PATCH 015/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 90a69c59bf..62bba049af 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -426,7 +426,13 @@ There are no default locations included with WIP, you must add each of your netw For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). ### Choose to set up Azure Rights Management with WIP +WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. +To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to start encrypting files copied to removeable drives that use Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. + +Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting as the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. + +For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic. ### Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. @@ -475,4 +481,6 @@ After you've decided where your protected apps can access enterprise data on you - [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) - [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md) - [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md) -- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) \ No newline at end of file +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) +- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/) +- [What is Azure Rights Management?]( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms) \ No newline at end of file From 037e6125ad0da2c8fc150859065a48379fdbf156 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 12:59:04 -0700 Subject: [PATCH 016/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 62bba049af..3b1d08495b 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -432,7 +432,8 @@ To configure WIP to use Azure Rights Management, you must set the **AllowAzureRM Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting as the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. -For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic. +>[!NOTE] +>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic. ### Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. From af97f15f3ea771af18102caa256da1cde16af630 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 13:16:12 -0700 Subject: [PATCH 017/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 3b1d08495b..ead8eddf33 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -428,7 +428,7 @@ There are no default locations included with WIP, you must add each of your netw ### Choose to set up Azure Rights Management with WIP WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. -To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to start encrypting files copied to removeable drives that use Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. +To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to start encrypting files copied to removable drives that use Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting as the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. From 8a133bd824f2a7a317959eb39c99c4bff675a245 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 14:09:57 -0700 Subject: [PATCH 018/165] Adding content --- .../create-wip-policy-using-intune.md | 384 +++++++++--------- 1 file changed, 188 insertions(+), 196 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index ead8eddf33..b1ce416071 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -14,8 +14,8 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 -- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) +- Windows 10, version 1607 +- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. @@ -23,15 +23,15 @@ Microsoft Intune helps you create and deploy your Windows Information Protection After you’ve set up Intune for your organization, you must create a WIP-specific policy. **To add a WIP policy** -1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. +1.Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. -2. Go to **Windows**, click the **Windows Information Protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. +2.Go to **Windows**, click the **Windows Information Protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. - ![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) +![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) -3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. +3.Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. - ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) +![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) ### Add app rules to your policy During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. @@ -50,19 +50,19 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** **To add a store app** 1. From the **App Rules** area, click **Add**. - The **Add App Rule** box appears. +The **Add App Rule** box appears. - ![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) +![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. +Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **Store App** from the **Rule template** drop-down list. - The box changes to show the store app rule options. +The box changes to show the store app rule options. 5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. @@ -71,40 +71,35 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for Store apps without installing them** 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. - >[!NOTE] - >If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. +>**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. 3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. - The API runs and opens a text editor with the app details. +The API runs and opens a text editor with the app details. - ```json - { - "packageIdentityName": "Microsoft.Office.OneNote", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } - ``` +```json +{ +"packageIdentityName": "Microsoft.Office.OneNote", +"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" +} +``` 4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`. - - For example: - - ```json - { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` +>**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example: + +```json +{ +"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", +} +``` **To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - >[!NOTE] - >Your PC and phone must be on the same wireless network. +>**Note**
Your PC and phone must be on the same wireless network. 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -120,16 +115,13 @@ If you don't know the publisher or product name, you can find them for both desk 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`. - - For example: - - ``` json - { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` +>**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example: + +``` json +{ + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } +``` #### Add a desktop app rule to your policy For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. @@ -137,70 +129,70 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the **To add a desktop app** 1. From the **App Rules** area, click **Add**. - The **Add App Rule** box appears. - - ![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) +The **Add App Rule** box appears. + +![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. +Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **Desktop App** from the **Rule template** drop-down list. - The box changes to show the store app rule options. +The box changes to show the store app rule options. 5. Pick the options you want to include for the app rule (see table), and then click **OK**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionManages
All fields left as “*”All files signed by any publisher. (Not recommended)
Publisher selectedAll files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.

Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.

Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
OptionManages
All fields left as “*”All files signed by any publisher. (Not recommended)
Publisher selectedAll files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.

Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.

Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
If you’re unsure about what to include for the publisher, you can run this PowerShell command: ```ps1 - Get-AppLockerFileInformation -Path "" +Get-AppLockerFileInformation -Path "" ``` Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. In this example, you'd get the following info: ``` json - Path Publisher - ---- --------- - %PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... +Path Publisher +---- --------- +%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... ``` Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. @@ -209,113 +201,113 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* **To create an app rule and xml file using the AppLocker tool** 1. Open the Local Security Policy snap-in (SecPol.msc). - + 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) +![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) 3. Right-click in the right-hand pane, and then click **Create New Rule**. - The **Create Packaged app Rules** wizard appears. +The **Create Packaged app Rules** wizard appears. 4. On the **Before You Begin** page, click **Next**. - ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) +![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. - ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) +![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) 6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. - ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) +![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. - ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) +![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) 8. On the updated **Publisher** page, click **Create**. - ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) +![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) +![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) 10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. - The **Export policy** box opens, letting you export and save your new policy as XML. +The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) +![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. - The policy is saved and you’ll see a message that says 1 rule was exported from the policy. +The policy is saved and you’ll see a message that says 1 rule was exported from the policy. - **Example XML file**
- This is the XML file that AppLocker creates for Microsoft Photos. +**Example XML file**
+This is the XML file that AppLocker creates for Microsoft Photos. - ```xml - - - - - - - - - - - - - - +```xml + + + + + + + + + + + + + + - ``` +``` 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import your Applocker policy file app rule using Microsoft Intune** 1. From the **App Rules** area, click **Add**. - - The **Add App Rule** box appears. - - ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) + +The **Add App Rule** box appears. + +![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. +Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **AppLocker policy file** from the **Rule template** drop-down list. - The box changes to let you import your AppLocker XML policy file. +The box changes to let you import your AppLocker XML policy file. 5. Click **Import**, browse to your AppLocker XML file, click **Open**, and then click **OK** to close the **Add App Rule** box. - The file is imported and the apps are added to your **App Rules** list. +The file is imported and the apps are added to your **App Rules** list. #### Exempt apps from WIP restrictions If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. **To exempt a store app, a desktop app, or an AppLocker policy file app rule** 1. From the **App Rules** area, click **Add**. - - The **Add App Rule** box appears. + +The **Add App Rule** box appears. 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. 3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. - Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. +Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. 4. Fill out the rest of the app rule info, based on the type of rule you’re adding: - - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. +- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. - - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. +- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. - - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. +- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. 5. Click **OK**. @@ -341,7 +333,7 @@ You can specify multiple domains owned by your enterprise by separating them wit **To add your corporate identity** - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - ![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) +![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) ### Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. @@ -356,74 +348,74 @@ There are no default locations included with WIP, you must add each of your netw 1. Add additional network locations your apps can access by clicking **Add**. - The **Add or edit corporate network definition** box appears. +The **Add or edit corporate network definition** box appears. 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png) +![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Network location typeFormatDescription
Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.

Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversproxy.contoso.com:80;proxy2.contoso.com:443Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.

This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.

This setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range (Required, if not using IPv6)**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range (Required, if not using IPv4)**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Network location typeFormatDescription
Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.

Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversproxy.contoso.com:80;proxy2.contoso.com:443Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.

This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.

This setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range (Required, if not using IPv6)**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range (Required, if not using IPv4)**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter.

3. Add as many locations as you need, and then click **OK**. - The **Add corporate network definition** box closes. +The **Add corporate network definition** box closes. 4. Decide if you want to Windows to look for additional network settings: - ![Microsoft Intune, Choose if you want Windows to search for additinal proxy servers or IP ranges in your enterprise](images/intune-network-detection-boxes.png) +![Microsoft Intune, Choose if you want Windows to search for additinal proxy servers or IP ranges in your enterprise](images/intune-network-detection-boxes.png) - - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. +- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) + ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) - After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. +After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. - For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). +For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). ### Choose to set up Azure Rights Management with WIP WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. @@ -443,35 +435,35 @@ After you've decided where your protected apps can access enterprise data on you **To set your optional settings** 1. Choose to set any or all of the optional settings: - - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: - - - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. +- **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: + +- **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. - - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. +- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: +- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - - **Yes (recommended).** Turns on the feature and provides the additional protection. +- **Yes (recommended).** Turns on the feature and provides the additional protection. - - **No, or not configured.** Doesn't enable this feature. +- **No, or not configured.**Doesn't enable this feature. - - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: +- **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - - - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. +- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: +- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. - - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. +- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: - - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. - - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. +- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: - - **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. + - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. + +- **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. 2. Click **Save Policy**. From 024cd88e44c7c649bd1e6a934872f75a5a634b68 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 21 Mar 2017 14:24:31 -0700 Subject: [PATCH 019/165] Fixing formatting and adding content --- ...ange-history-for-keep-windows-10-secure.md | 1 + .../create-wip-policy-using-intune.md | 374 +++++++++--------- 2 files changed, 187 insertions(+), 188 deletions(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 858577af50..1ac38ed7d2 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md ## March 2017 |New or changed topic |Description | |---------------------|------------| +|[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Added new content about Azure Rights Management. | |[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index b1ce416071..9af07a2e91 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -14,8 +14,8 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 -- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) +- Windows 10, version 1607 +- Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. @@ -23,15 +23,15 @@ Microsoft Intune helps you create and deploy your Windows Information Protection After you’ve set up Intune for your organization, you must create a WIP-specific policy. **To add a WIP policy** -1.Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. +1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. -2.Go to **Windows**, click the **Windows Information Protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. +2. Go to **Windows**, click the **Windows Information Protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. -![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) + ![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) -3.Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. +3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. -![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) + ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) ### Add app rules to your policy During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. @@ -50,19 +50,19 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** **To add a store app** 1. From the **App Rules** area, click **Add**. -The **Add App Rule** box appears. + The **Add App Rule** box appears. -![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) + ![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. -Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **Store App** from the **Rule template** drop-down list. -The box changes to show the store app rule options. + The box changes to show the store app rule options. 5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. @@ -71,35 +71,34 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for Store apps without installing them** 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. ->**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. + >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. 3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. -The API runs and opens a text editor with the app details. + The API runs and opens a text editor with the app details. -```json -{ -"packageIdentityName": "Microsoft.Office.OneNote", -"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" -} -``` + ```json + { + "packageIdentityName": "Microsoft.Office.OneNote", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } + ``` 4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. ->**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example: - -```json -{ -"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", -} -``` + >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
+ ```json + { + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` **To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. ->**Note**
Your PC and phone must be on the same wireless network. + >**Note**
Your PC and phone must be on the same wireless network. 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -115,13 +114,12 @@ The API runs and opens a text editor with the app details. 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. ->**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example: - -``` json -{ - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } -``` + >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
+ ``` json + { + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` #### Add a desktop app rule to your policy For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. @@ -129,70 +127,70 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the **To add a desktop app** 1. From the **App Rules** area, click **Add**. -The **Add App Rule** box appears. - -![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) + The **Add App Rule** box appears. + + ![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. -Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **Desktop App** from the **Rule template** drop-down list. -The box changes to show the store app rule options. + The box changes to show the store app rule options. 5. Pick the options you want to include for the app rule (see table), and then click **OK**. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionManages
All fields left as “*”All files signed by any publisher. (Not recommended)
Publisher selectedAll files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.

Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.

Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
OptionManages
All fields left as “*”All files signed by any publisher. (Not recommended)
Publisher selectedAll files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.

Publisher and Product Name selectedAll files for the specified product, signed by the named publisher.
Publisher, Product Name, and Binary name selectedAny version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, and above, selectedSpecified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.

Publisher, Product Name, Binary name, and File Version, And below selectedSpecified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
If you’re unsure about what to include for the publisher, you can run this PowerShell command: ```ps1 -Get-AppLockerFileInformation -Path "" + Get-AppLockerFileInformation -Path "" ``` Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. In this example, you'd get the following info: ``` json -Path Publisher ----- --------- -%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... + Path Publisher + ---- --------- + %PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... ``` Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. @@ -201,113 +199,113 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* **To create an app rule and xml file using the AppLocker tool** 1. Open the Local Security Policy snap-in (SecPol.msc). - + 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. -![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) 3. Right-click in the right-hand pane, and then click **Create New Rule**. -The **Create Packaged app Rules** wizard appears. + The **Create Packaged app Rules** wizard appears. 4. On the **Before You Begin** page, click **Next**. -![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. -![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) 6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. -![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) + ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. -![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) + ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) 8. On the updated **Publisher** page, click **Create**. -![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. -![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) 10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. -The **Export policy** box opens, letting you export and save your new policy as XML. + The **Export policy** box opens, letting you export and save your new policy as XML. -![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. -The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + The policy is saved and you’ll see a message that says 1 rule was exported from the policy. -**Example XML file**
-This is the XML file that AppLocker creates for Microsoft Photos. + **Example XML file**
+ This is the XML file that AppLocker creates for Microsoft Photos. -```xml - - - - - - - - - - - - - - + ```xml + + + + + + + + + + + + + + -``` + ``` 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import your Applocker policy file app rule using Microsoft Intune** 1. From the **App Rules** area, click **Add**. - -The **Add App Rule** box appears. - -![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) + + The **Add App Rule** box appears. + + ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. 3. Click **Allow** from the **Windows Information Protection mode** drop-down list. -Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. + Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic. 4. Pick **AppLocker policy file** from the **Rule template** drop-down list. -The box changes to let you import your AppLocker XML policy file. + The box changes to let you import your AppLocker XML policy file. 5. Click **Import**, browse to your AppLocker XML file, click **Open**, and then click **OK** to close the **Add App Rule** box. -The file is imported and the apps are added to your **App Rules** list. + The file is imported and the apps are added to your **App Rules** list. #### Exempt apps from WIP restrictions If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. **To exempt a store app, a desktop app, or an AppLocker policy file app rule** 1. From the **App Rules** area, click **Add**. - -The **Add App Rule** box appears. + + The **Add App Rule** box appears. 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. 3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. -Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. + Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. 4. Fill out the rest of the app rule info, based on the type of rule you’re adding: -- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. + - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. -- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. + - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. -- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. + - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. 5. Click **OK**. @@ -333,7 +331,7 @@ You can specify multiple domains owned by your enterprise by separating them wit **To add your corporate identity** - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. -![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) + ![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) ### Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. @@ -348,74 +346,74 @@ There are no default locations included with WIP, you must add each of your netw 1. Add additional network locations your apps can access by clicking **Add**. -The **Add or edit corporate network definition** box appears. + The **Add or edit corporate network definition** box appears. 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. -![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png) + ![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Network location typeFormatDescription
Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.

Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversproxy.contoso.com:80;proxy2.contoso.com:443Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.

This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.

This setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range (Required, if not using IPv6)**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range (Required, if not using IPv4)**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Network location typeFormatDescription
Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
contoso.visualstudio.com,contoso.internalproxy2.com

Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

Important
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.

Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversproxy.contoso.com:80;proxy2.contoso.com:443Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.

This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.

This setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range (Required, if not using IPv6)**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range (Required, if not using IPv4)**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter.

3. Add as many locations as you need, and then click **OK**. -The **Add corporate network definition** box closes. + The **Add corporate network definition** box closes. 4. Decide if you want to Windows to look for additional network settings: -![Microsoft Intune, Choose if you want Windows to search for additinal proxy servers or IP ranges in your enterprise](images/intune-network-detection-boxes.png) + ![Microsoft Intune, Choose if you want Windows to search for additinal proxy servers or IP ranges in your enterprise](images/intune-network-detection-boxes.png) -- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) + ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) -After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. -For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). + For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). ### Choose to set up Azure Rights Management with WIP WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. @@ -435,35 +433,35 @@ After you've decided where your protected apps can access enterprise data on you **To set your optional settings** 1. Choose to set any or all of the optional settings: -- **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: - -- **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. + - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: + + - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. -- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. + - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. -- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: -- **Yes (recommended).** Turns on the feature and provides the additional protection. + - **Yes (recommended).** Turns on the feature and provides the additional protection. -- **No, or not configured.**Doesn't enable this feature. + - **No, or not configured.** Doesn't enable this feature. -- **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: -- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. -- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: -- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. - - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + - **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: -- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: + - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. - - **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. - -- **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. + - **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option. 2. Click **Save Policy**. From b28c22277bb40c535fed8320b0fb9c4ad1447cb2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 07:30:38 -0700 Subject: [PATCH 020/165] Updating content from tech review --- windows/keep-secure/create-wip-policy-using-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 9af07a2e91..b3ec476d6b 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -418,9 +418,9 @@ There are no default locations included with WIP, you must add each of your netw ### Choose to set up Azure Rights Management with WIP WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. -To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to start encrypting files copied to removable drives that use Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. +To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. -Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting as the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. +Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. >[!NOTE] >For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic. From 86532a8e914f88c5d274ebe87227e62ebee01922 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 07:35:30 -0700 Subject: [PATCH 021/165] Added content --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 1ac38ed7d2..a3fedca01f 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -17,6 +17,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic |Description | |---------------------|------------| |[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Added new content about Azure Rights Management. | +|[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703. | |[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| From c9d828821706dc75d0c3e25546b9d86a71cf8df8 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 07:38:08 -0700 Subject: [PATCH 022/165] Fixing formatting --- windows/keep-secure/create-wip-policy-using-intune.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index b3ec476d6b..44605fccd9 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -71,6 +71,9 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for Store apps without installing them** 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. + > [!NOTE] + > If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. + >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. From 86a65acca2bfdcf80ba1eda8cad6c4b8aeb75800 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 08:00:13 -0700 Subject: [PATCH 023/165] Adding content --- ...reate-and-verify-an-efs-dra-certificate.md | 28 +++++++++++++++++++ .../create-wip-policy-using-intune.md | 9 ++---- 2 files changed, 30 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 4bd92ff06f..b05c43ed2b 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -94,6 +94,34 @@ It's possible that you might revoke data from an unenrolled device only to later The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. +**To quickly recover WIP-protected desktop data after unenrollment in a cloud-based environment**
+If you use a cloud environment in your organization, you may still want to restore an employee's data after revocation. While much of the process is the same as when you're not in a cloud environment, there are a couple of differences. + +>[!IMPORTANT] +>To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device. + +1. Have your employee sign in to the unenrolled device, open the Run command (Windows logo key + R), and type: + + `Robocopy “%localappdata%\Microsoft\EDP\Recovery” <“new_location”> * /EFSRAW` + + -or- + + `Robocopy “{X:\}System Volume Information\EDP\Recovery\ ” <“new_location”> * /EFSRAW` + + Where the keys are stored either within the employee's profile or, if the employee performed a clean installation over the operating system, in the System Volume folder. Also, where *<”new_location”>* is in a different directory. This can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that can be accessed while you're logged in as a data recovery agent. + +2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing: + + `cipher.exe /D <“new_location”>` + +3. Have your employee sign in to the unenrolled device, open the Run command, and type: + + `Robocopy <”new_location”> “%localappdata%\Microsoft\EDP\Recovery\Input”` + +4. Ask the employee to lock and unlock the device. + + The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. + >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 44605fccd9..0067c51efa 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -38,11 +38,9 @@ During the policy-creation process in Intune, you can choose the apps you want t The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. ->[!IMPORTANT] ->WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. + >**Important**
WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. ->[!NOTE] ->If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. +>**Note**
If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. @@ -71,9 +69,6 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for Store apps without installing them** 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. - > [!NOTE] - > If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. - >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. From 4a4c6efe5b9961fe1a6a6078d7468427a1ad9579 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 08:25:37 -0700 Subject: [PATCH 024/165] Adding content --- .../keep-secure/create-and-verify-an-efs-dra-certificate.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index b05c43ed2b..5bfc60d3cc 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -41,8 +41,7 @@ The recovery process included in this topic only works for desktop devices. WIP 4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as Microsoft Intune or System Center Configuration Manager. - >[!NOTE] - >To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) topic. + **Note**
To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) topic. **To verify your data recovery certificate is correctly set up on a WIP client computer** @@ -122,8 +121,7 @@ If you use a cloud environment in your organization, you may still want to resto The Windows Credential service automatically recovers the employee’s previously revoked keys from the `Recovery\Input` location. ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +

**Note**
Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). ## Related topics - [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) From 3727fd8bef3d24a2e7bd0bf981b2544fdcc4ecd5 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 08:41:06 -0700 Subject: [PATCH 025/165] Fixing formatting --- ...add-apps-to-protected-list-using-custom-uri.md | 14 +++++--------- .../keep-secure/create-wip-policy-using-sccm.md | 15 ++++----------- 2 files changed, 9 insertions(+), 20 deletions(-) diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index 9176b41ff8..b0396cdfd0 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -39,15 +39,14 @@ You can add apps to your Windows Information Protection (WIP) protected app list 5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules. - >[!NOTE] + >We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule. 6. In the **Review Rules** screen, look over your rules to make sure they’re right, and then click **Create** to add them to your collection of rules. 7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules. - >[!IMPORTANT] - >Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. + >**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. 8. Open the Intune administration console, and go to the **Policy** node, click **Add Policy** from the **Tasks** area, go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. @@ -87,18 +86,15 @@ After saving the policy, you’ll need to deploy it to your employee’s devices 5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules. - >[!IMPORTANT] - >You can also use **Path** rules instead of the **File hash** if you have concerns about unsigned files potentially changing the hash value if they're updated in the future. + >**Important**
You can also use **Path** rules instead of the **File hash** if you have concerns about unsigned files potentially changing the hash value if they're updated in the future. - >[!NOTE] - >We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule.

Finally, there's **Path** rules. **Path** rules are easier to set up and maintain, but can let apps bypass Windows Information Protection (WIP) by simply renaming and moving an unallowed file to match one of the apps on the **Protected App** list. For example, if your **Path** rule says to allow `%PROGRAMFILES%/NOTEPAD.EXE`, it becomes possible to rename DisallowedApp.exe to Notepad.exe, move it into the specified path above, and have it suddenly be allowed. + >**Note**
We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule.

Finally, there's **Path** rules. **Path** rules are easier to set up and maintain, but can let apps bypass Windows Information Protection (WIP) by simply renaming and moving an unallowed file to match one of the apps on the **Protected App** list. For example, if your **Path** rule says to allow `%PROGRAMFILES%/NOTEPAD.EXE`, it becomes possible to rename DisallowedApp.exe to Notepad.exe, move it into the specified path above, and have it suddenly be allowed. 6. In the **Review Rules** screen, look over your rules to make sure they’re right, and then click **Create** to add them to your collection of rules. 7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules. - >[!IMPORTANT] - >Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. + >**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. 8. Open the Intune administration console, and go to the **Policy** node, click **Add Policy** from the **Tasks** area, go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. diff --git a/windows/keep-secure/create-wip-policy-using-sccm.md b/windows/keep-secure/create-wip-policy-using-sccm.md index 49801ae337..5a51f50d60 100644 --- a/windows/keep-secure/create-wip-policy-using-sccm.md +++ b/windows/keep-secure/create-wip-policy-using-sccm.md @@ -94,8 +94,7 @@ If you don't know the publisher or product name, you can find them for both desk 1. Go to the [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote. - >[!NOTE] - >If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. + >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. @@ -112,10 +111,7 @@ If you don't know the publisher or product name, you can find them for both desk 4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. - >For example:

- + >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

For example:

```json { "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", @@ -125,8 +121,7 @@ If you don't know the publisher or product name, you can find them for both desk **To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - >[!NOTE] - >Your PC and phone must be on the same wireless network. + >**Note**
Your PC and phone must be on the same wireless network. 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -142,10 +137,8 @@ If you don't know the publisher or product name, you can find them for both desk 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. + >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. >For example:

- ```json { "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", From 5ceb091f25f0a22b11bfbcd023eb9f80a1fb374f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 08:42:45 -0700 Subject: [PATCH 026/165] Fixing formatting --- windows/keep-secure/protect-enterprise-data-using-wip.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-wip.md b/windows/keep-secure/protect-enterprise-data-using-wip.md index a37553eb2c..7f5e04babd 100644 --- a/windows/keep-secure/protect-enterprise-data-using-wip.md +++ b/windows/keep-secure/protect-enterprise-data-using-wip.md @@ -93,8 +93,8 @@ WIP gives you a new way to manage data policy enforcement for apps and documents - **Helping prevent accidental data disclosure to removable media.** WIP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - **Remove access to enterprise data from enterprise-protected devices.** WIP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable. - >[!NOTE] - >For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. + + >**Note**
For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. ## How WIP works WIP helps address your everyday challenges in the enterprise. Including: From 99106b6a79c9f9a212726400a5e95d94c908bbd8 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 08:47:04 -0700 Subject: [PATCH 027/165] Fixing formatting --- .../keep-secure/create-and-verify-an-efs-dra-certificate.md | 3 +-- windows/keep-secure/wip-app-enterprise-context.md | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 5bfc60d3cc..58a3228aef 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -36,8 +36,7 @@ The recovery process included in this topic only works for desktop devices. WIP The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - >[!IMPORTANT] - >Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location. + >**Important**
Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location. 4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as Microsoft Intune or System Center Configuration Manager. diff --git a/windows/keep-secure/wip-app-enterprise-context.md b/windows/keep-secure/wip-app-enterprise-context.md index b4ebd4ced4..c6fa730a12 100644 --- a/windows/keep-secure/wip-app-enterprise-context.md +++ b/windows/keep-secure/wip-app-enterprise-context.md @@ -45,8 +45,7 @@ The **Enterprise Context** column shows you what each app can do with your enter - **Exempt.** Shows the text, *Exempt*. WIP policies don't apply to these apps (such as, system components). - >[!IMPORTANT] - >Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials. + >**Important**
Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials. From 3399404dd892b2008e434e56644ebc383b2dcd4b Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 09:13:55 -0700 Subject: [PATCH 028/165] Adding content --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index a3fedca01f..1cdc7573bd 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -18,6 +18,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |---------------------|------------| |[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Added new content about Azure Rights Management. | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703. | +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate)|Added content about recovering data from a cloud environment.| |[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| From 661616568cb3250e73e1358c7c9e95ea221d1a05 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 09:24:24 -0700 Subject: [PATCH 029/165] Fixing link --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 1cdc7573bd..1cf0bcdc14 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -18,7 +18,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |---------------------|------------| |[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Added new content about Azure Rights Management. | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703. | -|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate)|Added content about recovering data from a cloud environment.| +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md)|Added content about recovering data from a cloud environment.| |[Protect derived domain credentials with Credential Guard](credential-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| |[Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| From 3662fd52c24d4f140632924e4d27b1fc6fb10d45 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 09:31:49 -0700 Subject: [PATCH 030/165] Adding content --- windows/keep-secure/create-wip-policy-using-intune.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 0067c51efa..4a5f3873fb 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -40,7 +40,7 @@ The steps to add your app rules are based on the type of rule template being app >**Important**
WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. ->**Note**
If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. + >**Note**
If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality](add-apps-to-protected-list-using-custom-uri.md) topic. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. @@ -113,7 +113,7 @@ If you don't know the publisher or product name, you can find them for both desk 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
- ``` json + ```json { "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", } From 63c502615dccdfb498758980f417b6d5289da9ba Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 13:07:15 -0700 Subject: [PATCH 031/165] Updated content --- windows/keep-secure/limitations-with-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index 39aaeb8dc5..70b4062521 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -26,7 +26,7 @@ This table provides info about the most common problems you might encounter whil Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. - If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running the latest build from the Windows Insider Program.

If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. + If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

We strongly recommend educating employees about how to limit or eliminate the need for this decryption. From c6d1289421374540d9be2bd6cc53b3c5c3a2b679 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 22 Mar 2017 14:34:39 -0700 Subject: [PATCH 032/165] Updated content --- windows/keep-secure/create-wip-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-wip-policy-using-intune.md b/windows/keep-secure/create-wip-policy-using-intune.md index 4a5f3873fb..f36171596d 100644 --- a/windows/keep-secure/create-wip-policy-using-intune.md +++ b/windows/keep-secure/create-wip-policy-using-intune.md @@ -14,7 +14,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1703 - Windows 10 Mobile (except Microsoft Azure Rights Management, which is only available on the desktop) Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. From fece0918b736f9be56f19dc01dfa044d7852ad0c Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Wed, 22 Mar 2017 15:08:09 -0700 Subject: [PATCH 033/165] review feedback --- windows/plan/windows-10-enterprise-faq-itpro.md | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/windows/plan/windows-10-enterprise-faq-itpro.md b/windows/plan/windows-10-enterprise-faq-itpro.md index 192d0910c6..60a48fef2f 100644 --- a/windows/plan/windows-10-enterprise-faq-itpro.md +++ b/windows/plan/windows-10-enterprise-faq-itpro.md @@ -49,7 +49,7 @@ Many existing Win32 and Win64 applications already run reliably on Windows 10 wi ### Is there an easy way to assess if my organization’s devices are ready to upgrade to Windows 10? -[Windows Upgrade Readiness](https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics) (formerly known as Upgrade Analytics) provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without additional infrastructure requirements. This new service guides you through your upgrade and feature update projects using a workflow based on Microsoft recommended practices. Up-to-date inventory data allows you to balance cost and risk in your upgrade projects. +[Windows Analytics Upgrade Readiness](https://technet.microsoft.com/itpro/windows/deploy/manage-windows-upgrades-with-upgrade-analytics) (formerly known as Upgrade Analytics) provides powerful insights and recommendations about the computers, applications, and drivers in your organization, at no extra cost and without additional infrastructure requirements. This new service guides you through your upgrade and feature update projects using a workflow based on Microsoft recommended practices. Up-to-date inventory data allows you to balance cost and risk in your upgrade projects. You can find additional product information at [Windows Analytics](https://www.microsoft.com/en-us/WindowsForBusiness/Windows-Analytics). ## Administration and deployment @@ -64,15 +64,9 @@ Updated versions of Microsoft deployment tools, including MDT, Configuration Man Computers running Windows 7 or Windows 8.1 can be upgraded directly to Windows 10 through the in-place upgrade process without a need to reimage the device using MDT and/or Configuration Manager. For more information, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager) or [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit). -### Are there any deployment tools available to support Windows 10? - -Updated versions of Microsoft deployment tools, including Configuration Manager, MDT, and the Windows Assessment and Deployment Kit (Windows ADK) have been released adding support for Windows 10. For most organizations currently using MDT or Configuration Manager to deploy Windows, deployment of Windows 10 will change very little. - -For more information on deployment methods for Windows 10, see [Windows 10 deployment tools](https://technet.microsoft.com/library/mt297512.aspx) and [Windows 10 deployment scenarios](https://technet.microsoft.com/library/mt282208.aspx). - ### Can I upgrade from Windows 7 Enterprise or Windows 8.1 Enterprise to Windows 10 Enterprise for free? -If you have Windows 7 Enterprise or Windows 8.1 Enterprise and current Software Assurance, you are entitled to the upgrade to Windows 10 Enterprise through the rights of Software Assurance. You can find your product keys and installation media at the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). +If you have Windows 7 Enterprise or Windows 8.1 Enterprise and current Windows 10 Enterprise E3 or E5 subscription, you are entitled to the upgrade to Windows 10 Enterprise through the rights of Software Assurance. You can find your product keys and installation media at the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). For devices that are licensed under a volume license agreement for Windows that does not include Software Assurance, new licenses will be required to upgrade these devices to Windows 10. @@ -104,12 +98,7 @@ For more information on pros and cons for these tools, see [Servicing Tools](htt ### Where can I find information about new features and changes in Windows 10 Enterprise? -For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](https://tnstage.redmond.corp.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1703?branch=rs2) in the TechNet library. You can find information You'll find info on features like these: -- Modern deployment - Zero-touch deployment, bulk AD enrollment with provisioning, UEFI conversion tooland -- Windows Analytics - Upgrade Readiness, and Update Compliance -- Windows as a service enhancements - Differential feature update support, express update support for System Center Configuration Manager and third-party management software -- Mobile application management (MAM) and enhanced MDM -- Advanced security with Windows Defender - App Guard, Credential Guard, App Control, ATP) and Windows Hello +For an overview of the new enterprise features in Windows 10 Enterprise, see [What's new in Windows 10](https://technet.microsoft.com/itpro/windows/whats-new/index) and [What's new in Windows 10, version 1703](https://tnstage.redmond.corp.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1703?branch=rs2) in the TechNet library. Another place to track the latest information about new features of interest to IT professionals is the [Windows for IT Pros blog](https://blogs.technet.microsoft.com/windowsitpro/). Here you’ll find announcements of new features, information on updates to the Windows servicing model, and details about the latest resources to help you more easily deploy and manage Windows 10. From bd90fb73437b361fa2b1de2be3da2a38837b7615 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:01:25 -0700 Subject: [PATCH 034/165] bug# 11035796 --- ...ting-system-components-to-microsoft-services.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index e0cfbed2c9..15e5b8118c 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -382,16 +382,14 @@ Use either Group Policy or MDM policies to manage settings for Microsoft Edge. F Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. -> [!NOTE] -> The Microsoft Edge Group Policy names were changed in Windows 10, version 1607. The table below reflects those changes. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Configure autofill | Choose whether employees can use autofill on websites.
Default: Enabled | +| Configure Autofill | Choose whether employees can use autofill on websites.
Default: Enabled | | Configure Do Not Track | Choose whether employees can send Do Not Track headers.
Default: Disabled | -| Configure password manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | +| Configure Password Manager | Choose whether employees can save passwords locally on their devices.
Default: Enabled | | Configure search suggestions in Address bar | Choose whether the address bar shows search suggestions.
Default: Enabled | -| Configure SmartScreen Filter | Choose whether SmartScreen is turned on or off.
Default: Enabled | +| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703)
Configure SmartScreen Filter (Windows Server 2016) | Choose whether Windows Defender SmartScreen is turned on or off.
Default: Enabled | | Allow web content on New Tab page | Choose whether a new tab page appears.
Default: Enabled | | Configure Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** | @@ -627,9 +625,11 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. +- In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. + In Windows 10, version 1703,apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure Windows Defender SmartScreen Filter**. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. + In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. + In Windows 10, version 1703 , apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows Defender SmartScreen**. -or- From 746c86805743639090ba7b16ea5eb61a26f12fce Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:26:04 -0700 Subject: [PATCH 035/165] adding SmartScreen filter GPO --- ...g-system-components-to-microsoft-services.md | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 15e5b8118c..666e671997 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -29,21 +29,15 @@ To help make it easier to deploy settings to restrict connections from Windows 1 We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. -## What's new in Windows 10, version 1607 and Windows Server 2016 +## What's new in Windows 10, version 1703 -Here's a list of changes that were made to this article for Windows 10, version 1607 and Windows Server 2016: +Here's a list of changes that were made to this article for Windows 10, version 1703: -- Added instructions on how to turn off speech recognition and speech synthesis model updates in [14.5 Speech, inking, & typing](#bkmk-priv-speech). -- Added instructions on how to turn off flip ahead with an Internet Explorer Group Policy. -- Added a section on how to turn off automatic root updates to stop updating the certificate trust list in [1. Certificate trust lists](#certificate-trust-lists). -- Added a new setting in [25. Windows Update](#bkmk-wu). -- Changed the NCSI URL in [11. Network Connection Status Indicator](#bkmk-ncsi). -- Added a section on how to turn off features that depend on Microsoft Account cloud authentication service [10. Microsoft Account](#bkmk-microsoft-account). +- - Added the following Group Policies: - - Turn off unsolicited network traffic on the Offline Maps settings page - - Turn off all Windows spotlight features + - Prevent managing SmartScreen Filter ## Settings @@ -52,7 +46,7 @@ The following sections list the components that make network connections to Micr If you're running Windows 10, they will be included in the next update for the Long Term Servicing Branch. -### Settings for Windows 10 Enterprise, version 1607 +### Settings for Windows 10 Enterprise, version 1703 See the following table for a summary of the management settings for Windows 10 Enterprise, version 1607. @@ -329,6 +323,7 @@ Use Group Policy to manage settings for Internet Explorer. You can find the Int | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| | Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
Default: Enabled | | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| +| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | There are two more Group Policy objects that are used by Internet Explorer: From 09503b610afbe4b86fb9a84596317d3438bfde66 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:35:20 -0700 Subject: [PATCH 036/165] bug# 11031857 --- ...dows-operating-system-components-to-microsoft-services.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 666e671997..cc53236858 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -38,6 +38,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added the following Group Policies: - Prevent managing SmartScreen Filter + - Turn off Compatibility View ## Settings @@ -329,7 +330,9 @@ There are two more Group Policy objects that are used by Internet Explorer: | Path | Policy | Description | | - | - | - | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Disabled | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether +an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
Default: Enabled | ### 7.1 ActiveX control blocking From a75ebac9ea6cc4d3655a040f943598111e2fc1b4 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:40:09 -0700 Subject: [PATCH 037/165] bug# 10765050 --- ...rating-system-components-to-microsoft-services.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index cc53236858..bc9040bd73 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -33,7 +33,7 @@ We are always striving to improve our documentation and welcome your feedback. Y Here's a list of changes that were made to this article for Windows 10, version 1703: -- +- Added an MDM policy for Font streaming. - Added the following Group Policies: @@ -263,7 +263,15 @@ To prevent Windows from retrieving device metadata from the Internet, apply the Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. -If you're running Windows 10, version 1607 or Windows Server 2016, disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**. +If you're running Windows 10, version 1607, Windows Server 2016, or later: + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**. + +- In Windows 10, version 1703, you can apply the System/AllowFontProviders MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: + + - **false**. Font streaming is disabled. + + - **true**. Font streaming is enabled. If you're running Windows 10, version 1507 or Windows 10, version 1511, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. From 4c524b4eea46aaad3101c11389cf96d82735289d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:45:18 -0700 Subject: [PATCH 038/165] bug# 10757353 --- ...dows-operating-system-components-to-microsoft-services.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index bc9040bd73..03954a19f8 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -34,6 +34,7 @@ We are always striving to improve our documentation and welcome your feedback. Y Here's a list of changes that were made to this article for Windows 10, version 1703: - Added an MDM policy for Font streaming. +- Added an MDM policy for Network Connection Status Indicator. - Added the following Group Policies: @@ -433,10 +434,12 @@ Network Connection Status Indicator (NCSI) detects Internet connectivity and cor In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was http://www.msftncsi.com. -You can turn off NCSI through Group Policy: +You can turn off NCSI by doing one of the following: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** +- In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy. + > [!NOTE] > After you apply this policy, you must restart the device for the policy setting to take effect. From f8d8bf23304e2e7be09740fdf132a711d964dd63 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:49:43 -0700 Subject: [PATCH 039/165] bug# 10756556 --- ...ws-operating-system-components-to-microsoft-services.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 03954a19f8..16ed4bfac9 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -35,6 +35,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added an MDM policy for Font streaming. - Added an MDM policy for Network Connection Status Indicator. +- Added an MDM policy for the Micosoft Account Sign-In Assistant. - Added the following Group Policies: @@ -50,7 +51,7 @@ If you're running Windows 10, they will be included in the next update for the L ### Settings for Windows 10 Enterprise, version 1703 -See the following table for a summary of the management settings for Windows 10 Enterprise, version 1607. +See the following table for a summary of the management settings for Windows 10 Enterprise, version 1703. | Setting | UI | Group Policy | MDM policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | :-: | @@ -380,6 +381,10 @@ To prevent communication to the Microsoft Account cloud authentication service. - Change the **Start** REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to 4. +To disable the Microsoft Account Sign-In Assistant: + +- Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. + ### 11. Microsoft Edge From 9db3448347b79594b7089f3b8eeee63a5bc59050 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 17:51:41 -0700 Subject: [PATCH 040/165] bug# 10756556 --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 16ed4bfac9..5635ee830d 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -64,7 +64,7 @@ See the following table for a summary of the management settings for Windows 10 | [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | | [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | | | [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | -| [10. Microsoft Account](#bkmk-microsoft-account) | | | | ![Check mark](images/checkmark.png) | | +| [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | | | [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | From a2bb7cebbfb0e53395ea56473fab44917fd1a10a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 22 Mar 2017 18:32:23 -0700 Subject: [PATCH 041/165] bug# 10214974 --- ...system-components-to-microsoft-services.md | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 5635ee830d..4638350b80 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -41,6 +41,12 @@ Here's a list of changes that were made to this article for Windows 10, version - Prevent managing SmartScreen Filter - Turn off Compatibility View + - Turn off Automatic Download and Install of updates + - Do not connect to any Windows Update locations + - Turn off access to all Windows Update features + - Specify Intranet Microsoft update service location + - Enable Windows NTP client + - Turn off Automatic download of the ActiveX VersionList ## Settings @@ -57,7 +63,7 @@ See the following table for a summary of the management settings for Windows 10 | - | :-: | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | | | | | [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | | | [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | @@ -107,7 +113,7 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | | [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | @@ -132,7 +138,7 @@ See the following table for a summary of the management settings for Windows Ser | Setting | Group Policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [3. Date & Time](#bkmk-datetime) | | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [5. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [12. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | | | [17. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | | @@ -255,6 +261,10 @@ You can prevent Windows from setting the time automatically. -or- +- Disable the Group Policy: **System\\Windows Time Service\\Time Providers!!Enable Windows NTP Client** + + -or- + - Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. ### 4. Device metadata retrieval @@ -347,7 +357,15 @@ an employee can swipe across a screen or click forward to go to the next pre-loa ### 7.1 ActiveX control blocking -ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. You can turn this off by changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). +ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. + +You can turn this off by: + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** + + - or - + +- Changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). @@ -1281,6 +1299,8 @@ You can turn off the ability to launch apps from the Windows Store that were pre - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**. + ### 25. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -1352,6 +1372,12 @@ You can turn off Windows Update by setting the following registry entries: - Add a REG\_DWORD value called **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Intenet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features**. + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** and set the **Set the alternate download server** to **,**. + You can turn off automatic updates by doing one of the following. This is not recommended. From 3f0929ac5c2ccd3e92c988f036005b0b6def9bd3 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 13:07:57 -0700 Subject: [PATCH 042/165] instructions for removing the sticky notes app --- ...-operating-system-components-to-microsoft-services.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 4638350b80..2c1ec4f7f4 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -36,6 +36,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added an MDM policy for Font streaming. - Added an MDM policy for Network Connection Status Indicator. - Added an MDM policy for the Micosoft Account Sign-In Assistant. +- Added instructions for removing the Sticky Notes app. - Added the following Group Policies: @@ -594,6 +595,14 @@ To remove the Get Skype app: Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage** +To remove the Sticky notes app: + +- Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.MicrosoftStickyNotes"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** + + -and- + + Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftStickyNotes | Remove-AppxPackage** + ### 16. Settings > Privacy Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. From cba4504cc7825c8e1d52f6fcf52a2c1bcd950537 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 13:12:51 -0700 Subject: [PATCH 043/165] bug# 10866362 --- ...s-operating-system-components-to-microsoft-services.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 2c1ec4f7f4..a97f65a67b 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1199,7 +1199,7 @@ When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings scr You can disconnect from the Microsoft Antimalware Protection Service. -- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Join Microsoft MAPS** +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** -or- @@ -1215,7 +1215,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. You can stop sending file samples back to Microsoft. -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. -or- @@ -1235,11 +1235,11 @@ You can stop sending file samples back to Microsoft. You can stop downloading definition updates: -- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. +- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**. -and- -- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. +- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. For Windows 10 only, you can stop Enhanced Notifications: From 05ee300ff5a0fcc4e29086f8dc3cf60e87f43bf8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 13:15:53 -0700 Subject: [PATCH 044/165] bug# 10215399 --- ...s-operating-system-components-to-microsoft-services.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a97f65a67b..45d81242ad 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -841,7 +841,7 @@ To turn off **Let apps access my notifications**: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access my notifications** +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access notifications** - Set the **Select a setting** box to **Force Deny**. @@ -1118,7 +1118,7 @@ Enterprise customers can manage their Windows activation status with volume lice For Windows 10: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** -or- @@ -1126,7 +1126,7 @@ For Windows 10: For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core: -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client AVS Validation** +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. @@ -1296,7 +1296,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows Tips**. + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. From b5160a9312019882eea05df0dc62686dd3f49869 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 13:19:59 -0700 Subject: [PATCH 045/165] bug# 10980994 --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 45d81242ad..8b1a5ec6d4 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -48,6 +48,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Specify Intranet Microsoft update service location - Enable Windows NTP client - Turn off Automatic download of the ActiveX VersionList + - Allow Automatic Update of Speech Data ## Settings @@ -868,6 +869,9 @@ To turn off the functionality: - Create a REG\_DWORD registry setting called **HarvestContacts** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\InputPersonalization\\TrainedDataStore**, with a value of 0 (zero). +If you're running at least Windows 10, version 1703, you can turn off updates to the speech recognition and speech synthesis models: + +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatically update of Speech Data** If you're running at least Windows 10, version 1607, you can turn off updates to the speech recognition and speech synthesis models: From 0db2f63916184463183aa93f8cdaf83b6425e823 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 13:28:29 -0700 Subject: [PATCH 046/165] bug# 10980531 --- ...system-components-to-microsoft-services.md | 33 ++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 8b1a5ec6d4..bcb8b27a83 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -646,6 +646,37 @@ Use Settings > Privacy to configure some settings that may be important to yo **General** includes options that don't fall into other areas. +#### Windows 10, version 1703 options + +To turn off **Let apps use advertising ID to make ads more interesting to you based on your app usage (turning this off will reset your ID)**: + +> [!NOTE] +> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. + + -or- + +- Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). + +To turn off **Let websites provide locally relevant content by access my language list**: + +- Turn off the feature in the UI. + +To turn off **Let Windows track app launches to improve Start and search results**: + +- Turn off the feature in the UI. + + -or- + +- Create a REG_DWORD registry setting called **Start_TrackProgs** with value of 0 (zero) in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced** + +#### Windows Server 2016 and Windows 10, version 1607 and earlier options + To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: > [!NOTE] @@ -668,7 +699,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window -or- - In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. - In Windows 10, version 1703,apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure Windows Defender SmartScreen Filter**. + In Windows 10, version 1703, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure Windows Defender SmartScreen Filter**. In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. In Windows 10, version 1703 , apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows Defender SmartScreen**. From d2f5bb171b78b9c7f3b35f18808e8c8a6815f1dd Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 15:58:42 -0700 Subject: [PATCH 047/165] bug# 10215117 --- ...system-components-to-microsoft-services.md | 288 +++++++++++++++--- 1 file changed, 251 insertions(+), 37 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index bcb8b27a83..495075dd53 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -37,6 +37,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added an MDM policy for Network Connection Status Indicator. - Added an MDM policy for the Micosoft Account Sign-In Assistant. - Added instructions for removing the Sticky Notes app. +- Added registry paths for some Group Policies - Added the following Group Policies: @@ -64,47 +65,47 @@ See the following table for a summary of the management settings for Windows 10 | Setting | UI | Group Policy | MDM policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | | | | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | | -| [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | | -| [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +| [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [15. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | | [16. Settings > Privacy](#bkmk-settingssection) | | | | | | |     [16.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -|     [16.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -|     [16.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [16.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | |     [16.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -|     [16.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | +|     [16.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [16.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | |     [16.14 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | |     [16.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |     [16.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | -|     [16.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -| [18. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | | ![Check mark](images/checkmark.png) | +|     [16.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [18. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [22. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | -| [23. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | | -| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | | -| [25. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [23. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [25. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | ### Settings for Windows Server 2016 with Desktop Experience @@ -114,23 +115,23 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | -| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | | +| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | -| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | | +| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | | [16. Settings > Privacy](#bkmk-settingssection) | | | | | |     [16.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | | | -| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [22. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) | -| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | | +| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [26. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ### Settings for Windows Server 2016 Server Core @@ -214,6 +215,16 @@ Find the Cortana Group Policy objects under **Computer Configuration** > **Ad | Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

Enable this policy to stop web queries and results from showing in Search. | | Set what information is shared in Search | Control what information is shared with Bing in Search.

If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | +You can also apply the Group Policies using the following registry keys: + +| Policy | Registry Path | +|------------------------------------------------------|---------------------------------------------------------------------------------------| +| Allow Cortana | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!AllowCortana
REG_DWORD: 0| +| Allow search and Cortana to use location | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!AllowSearchToUseLocation
REG_DWORD: 0 | +| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchPrivacy
REG_DWORD: 3 | +| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchUseWeb
REG_DWORD: 0 | +| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!DisableWebSearch
REG_DWORD: 1 | + In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. >[!IMPORTANT] @@ -265,6 +276,10 @@ You can prevent Windows from setting the time automatically. - Disable the Group Policy: **System\\Windows Time Service\\Time Providers!!Enable Windows NTP Client** + - or - + +- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient!Enabled** to 0 (zero). + -or- - Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. @@ -273,6 +288,8 @@ You can prevent Windows from setting the time automatically. To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. +You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Device Metadata!PreventDeviceMetadataFromNetwork** to 1 (one). + ### 5. Font streaming Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. @@ -315,6 +332,10 @@ To turn off Insider Preview builds for Windows 10: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. + - or - + +- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\PreviewBuilds!AllowBuildPreview** to 0 (zero) + -or- - Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where: @@ -348,6 +369,17 @@ Use Group Policy to manage settings for Internet Explorer. You can find the Int | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| | Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | +Alternatively, you could use the registry to set the Group Policies. + +| Policy | Registry path | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites!Enabled
REG_DWORD: 0| +| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AllowServicePoweredQSA
REG_DWORD: 0| +| Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Explorer\\AutoComplete!AutoSuggest
REG_SZ: **No** | +| Disable Periodic Check for Internet Explorer software updates| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Infodelivery\\Restrictions!NoUpdateCheck
REG_DWORD: 1 | +| Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation!PolicyDisableGeolocation
REG_DWORD: 1 | +| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | + There are two more Group Policy objects that are used by Internet Explorer: | Path | Policy | Description | @@ -357,6 +389,15 @@ There are two more Group Policy objects that are used by Internet Explorer: an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
Default: Enabled | +You can also use registry entries to set these Group Policies. + +| Policy | Registry path | +|------------------------------------------------------|-----------------------------------------------------------------------------------------------------| +| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds!BackgroundSyncStatus
REG_DWORD: 0| +| Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead!Enabled
REG_DWORD: 0| + +AllowServicePoweredQSA + ### 7.1 ActiveX control blocking ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. @@ -377,6 +418,10 @@ To turn off Live Tiles: - Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage** + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications!NoCloudApplicationNotification**, with a value of 1 (one). + ### 9. Mail synchronization To turn off mail synchronization for Microsoft Accounts that are configured on a device: @@ -395,6 +440,10 @@ To turn off the Windows Mail app: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application** + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows Mail!ManualLaunchAllowed**, with a value of 0 (zero). + ### 10. Microsoft Account To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. @@ -438,6 +487,19 @@ The Windows 10, version 1511 Microsoft Edge Group Policy names are: | Open a new tab with an empty tab | Choose whether a new tab page appears.
Default: Enabled | | Configure corporate Home pages | Choose the corporate Home page for domain-joined devices.
Set this to **about:blank** | +Alternatively, you can configure the Microsoft Group Policies using the following registry entries: + +| Policy | Registry path | +| - | - | +| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords
REG_SZ: **about:blank** | +| Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!DoNotTrack
REG_DWORD: 1 | +| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords
REG_SZ: **no** | +| Configure search suggestions in Address bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest
REG_SZ: **no**| +| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter!EnabledV9
REG_DWORD: 0 | +| Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!AllowWebContentOnNewTabPage
REG_DWORD: 0 | +| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI!ProvisionedHomePages
REG_DWORD: 0| + + ### 11.2 Microsoft Edge MDM policies The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -468,22 +530,38 @@ You can turn off NCSI by doing one of the following: > [!NOTE] > After you apply this policy, you must restart the device for the policy setting to take effect. + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator!NoActiveProbe**, with a value of 0 (zero). + ### 13. Offline maps You can turn off the ability to download and update offline maps. - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Maps!AutoDownloadAndUpdateMapData**, with a value of 0 (zero). + -and- - In Windows 10, version 1607 and later, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page** + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Maps!AllowUntriggeredNetworkTrafficOnSettingsPage**, with a value of 0 (zero). + ### 14. OneDrive To turn off OneDrive in your organization: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage** + -or- + +- Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\OneDrive!DisableFileSyncNGSC**, with a value of 1 (one). + ### 15. Preinstalled apps Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. @@ -663,10 +741,18 @@ To turn off **Let apps use advertising ID to make ads more interesting to you ba - Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). -To turn off **Let websites provide locally relevant content by access my language list**: + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AdvertisingInfo!DisabledByGroupPolicy**, with a value of 1 (one). + +To turn off **Let websites provide locally relevant content by accessing my language list**: - Turn off the feature in the UI. + -or- + +- Create a new REG\_DWORD registry setting called **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile**, with a value of 1. + To turn off **Let Windows track app launches to improve Start and search results**: - Turn off the feature in the UI. @@ -692,6 +778,10 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin - Create a REG\_DWORD registry setting called **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo**, with a value of 0 (zero). + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AdvertisingInfo!DisabledByGroupPolicy**, with a value of 1 (one). + To turn off **Turn on SmartScreen Filter to check web content (URLs) that Windows Store apps use**: - Turn off the feature in the UI. @@ -720,6 +810,10 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window - Create a REG\_DWORD registry setting called **EnableWebContentEvaluation** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost**, with a value of 0 (zero). + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\System!EnableSmartScreen**, with a value of 0 (zero). + To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: > [!NOTE] @@ -753,6 +847,10 @@ To turn off **Let apps on my other devices open apps and continue experiences on - Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Continue experiences on this device**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\System!EnableCdp**, with a value of 0 (zero). + To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**: - Turn off the feature in the UI. @@ -769,6 +867,10 @@ To turn off **Location for this device**: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessLocation**, with a value of 2 (two). + -or- - Apply the System/AllowLocation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: @@ -798,6 +900,10 @@ To turn off **Location**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\LocationAndSensors!DisableLocation**, with a value of 1 (one). + -or- To turn off **Location history**: @@ -822,6 +928,10 @@ To turn off **Let apps use my camera**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCamera**, with a value of 2 (two). + -or- - Apply the Camera/AllowCamera MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: @@ -859,6 +969,10 @@ To turn off **Let apps use my microphone**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMicrophone**, with a value of 2 (two) + To turn off **Choose apps that can use your microphone**: - Turn off the feature in the UI for each app. @@ -877,6 +991,10 @@ To turn off **Let apps access my notifications**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessNotifications**, with a value of 2 (two) + ### 16.6 Speech, inking, & typing In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. @@ -892,6 +1010,10 @@ To turn off the functionality: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning** + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\InputPersonalization!RestrictImplicitInkCollection**, with a value of 1 (one). + -or- - Create a REG\_DWORD registry setting called **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Personalization\\Settings**, with a value of 0 (zero). @@ -928,6 +1050,10 @@ To turn off **Let apps access my name, picture, and other account info**: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access account information** - Set the **Select a setting** box to **Force Deny**. + + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessContacts**, with a value of 2 (two). To turn off **Choose the apps that can access your account info**: @@ -961,6 +1087,10 @@ To turn off **Let apps access my calendar**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCalendar**, with a value of 2 (two). + To turn off **Choose apps that can access calendar**: - Turn off the feature in the UI for each app. @@ -979,6 +1109,10 @@ To turn off **Let apps access my call history**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCallHistory**, with a value of 2 (two). + ### 16.11 Email In the **Email** area, you can choose which apps have can access and send email. @@ -993,6 +1127,10 @@ To turn off **Let apps access and send email**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessEmail**, with a value of 2 (two). + ### 16.12 Messaging In the **Messaging** area, you can choose which apps can read or send messages. @@ -1007,6 +1145,10 @@ To turn off **Let apps read or send messages (text or MMS)**: - Set the **Select a setting** box to **Force Deny**. + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMessaging**, with a value of 2 (two). + To turn off **Choose apps that can read or send messages**: - Turn off the feature in the UI for each app. @@ -1024,6 +1166,11 @@ To turn off **Let apps control radios**: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** - Set the **Select a setting** box to **Force Deny**. + + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessRadios**, with a value of 2 (two). + To turn off **Choose apps that can control radios**: @@ -1041,6 +1188,10 @@ To turn off **Let apps automatically share and sync info with wireless devices t - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps sync with devices** + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsSyncWithDevices**, with a value of 2 (two). + To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**: - Turn off the feature in the UI. @@ -1070,6 +1221,10 @@ To change how frequently **Windows should ask for my feedback**: -or- +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\DataCollection!DoNotShowFeedbackNotifications**, with a value of 1 (one). + + -or- + - Create the registry keys (REG\_DWORD type): - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds @@ -1103,6 +1258,10 @@ To change the level of diagnostic and usage data sent when you **Send your devic -or- +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\DataCollection!AllowTelemetry**, with a value of 0 (zero). + + -or- + - Apply the System/AllowTelemetry MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where: - **0**. Maps to the **Security** level. @@ -1147,6 +1306,10 @@ To turn off **Let Windows and your apps use your motion data and collect motion - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion** + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMotion**, with a value of 2 (two). + ### 17. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: @@ -1157,12 +1320,20 @@ For Windows 10: -or- +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessContacts**, with a value of 2 (two). + + -or- + - Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled. For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Core: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** + -or- + +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform!NoGenTicket**, with a value of 1 (one). + The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 18. Sync your settings @@ -1177,6 +1348,10 @@ You can control if your settings are synchronized: -or- +- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync!DisableSettingSync**, with a value of 2 (two) and **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\SettingSync!DisableSettingSyncUserOverride**, with a value of 1 (one). + + -or- + - Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. -or- @@ -1202,6 +1377,10 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command. -or- +- Create a new REG\_SZ registry setting called in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition!Teredo_State**, with a value of **Disabled**. + + -or- + - From an elevated command prompt, run **netsh interface teredo set state disabled** ### 20. Wi-Fi Sense @@ -1238,6 +1417,10 @@ You can disconnect from the Microsoft Antimalware Protection Service. -or- +- Delete the registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates!DefinitionUpdateFileSharesSources**. + + -or- + - For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). -or- @@ -1248,6 +1431,8 @@ You can disconnect from the Microsoft Antimalware Protection Service. From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** + + You can stop sending file samples back to Microsoft. - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**. @@ -1276,6 +1461,10 @@ You can stop downloading definition updates: - Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing. + -or- + +- Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates!FallbackOrder**, with a value of **FileShares**. + For Windows 10 only, you can stop Enhanced Notifications: - Turn off the feature in the UI. @@ -1304,6 +1493,10 @@ If you're running Windows 10, version 1607 or later, you only need to enable the - **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features** + -or- + + - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsSpotlightFeatures**, with a value of 1 (one). + If you're not running Windows 10, version 1607 or later, you can use the other options in this section. - Configure the following in **Settings**: @@ -1329,12 +1522,23 @@ If you're not running Windows 10, version 1607 or later, you can use the other o > [!NOTE] > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. + -or- + + - Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one). - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. + -or- + + - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableSoftLanding**, with a value of 1 (one). + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**. + -or- + + - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent!DisableWindowsConsumerFeatures**, with a value of 1 (one). + For more info, see [Windows Spotlight on the lock screen](../configure/windows-spotlight.md). ### 24. Windows Store @@ -1343,8 +1547,16 @@ You can turn off the ability to launch apps from the Windows Store that were pre - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Windows Store**. + -or- + + - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!DisableStoreApps**, with a value of 1 (one). + - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**. + -or- + + - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!AutoDownload**, with a value of 2 (two). + ### 25. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -1373,6 +1585,8 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con | Max Cache Size | Lets you specify the maximum cache size as a percentage of disk size.
The default value is 20, which represents 20% of the disk.| | Max Upload Bandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| +You can also set the **Download Mode** policy by creating a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization!DODownloadMode**, with a value of 100 (one hundred). + ### 25.3 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). From 5f8522d31e9cdb5545305bc376dcbb0525780318 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:09:04 -0700 Subject: [PATCH 048/165] bug# 9978051 --- ...indows-operating-system-components-to-microsoft-services.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 495075dd53..20b3405473 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -50,6 +50,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Enable Windows NTP client - Turn off Automatic download of the ActiveX VersionList - Allow Automatic Update of Speech Data + - Accounts: Block Microsoft Accounts ## Settings @@ -448,7 +449,7 @@ To turn off the Windows Mail app: To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. -- Change the **Start** REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to 4. +- Apply the Group Policy: **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** > **Accounts: Block Microsoft Accounts** and set it to **Users can't add Microsoft accounts**. To disable the Microsoft Account Sign-In Assistant: From d6c43a9a80f8d865966bf4d3eb4ea9c7e209c6d6 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:20:14 -0700 Subject: [PATCH 049/165] bug# 10070280 --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 20b3405473..5237867f1d 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -171,6 +171,10 @@ A certificate trust list is a predefined list of items, such as a list of certif To turn off the automatic download of an updated certificate trust list, you can turn off automatic root updates, which also includes the disallowed certificate list and the pin rules list. +> [!CAUTION] +> By not automatically downloading the root certificates, the device might have not be able to connect to some websites. + + For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Automatic Root Certificates Update** From f4689acc4810ff963c5f47f9899f471221dec36f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:23:14 -0700 Subject: [PATCH 050/165] bug# 10980772 --- ...ows-operating-system-components-to-microsoft-services.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 5237867f1d..30855a3b17 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1296,8 +1296,12 @@ In the **Background Apps** area, you can choose which apps can run in the backgr To turn off **Let apps run in the background**: - Turn off the feature in the UI for each app. + + -or- - - Set the **Select a setting** box to **Force Deny**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in background** + + - Set the **Select a setting** box to **Force Deny**. ### 16.17 Motion From be5a51b0bda3886fd3bdb1a45507446b45a12955 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:28:43 -0700 Subject: [PATCH 051/165] bug# 10980748 --- ...ng-system-components-to-microsoft-services.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 30855a3b17..a6b4fc36ec 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -51,6 +51,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Turn off Automatic download of the ActiveX VersionList - Allow Automatic Update of Speech Data - Accounts: Block Microsoft Accounts + - Do not use diagnostic data for tailored experiences ## Settings @@ -1250,12 +1251,7 @@ To change how frequently **Windows should ask for my feedback**: To change the level of diagnostic and usage data sent when you **Send your device data to Microsoft**: -- To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - - > [!NOTE] - > You can't use the UI to change the telemetry level to **Security**. - - +- Click either the **Basic** or **Full** options. -or- @@ -1289,6 +1285,14 @@ To change the level of diagnostic and usage data sent when you **Send your devic - **3**. Maps to the **Full** level. +To turn off tailored experiences with relevant tips and recommendations by using your diagnostics data: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences** + ### 16.16 Background apps In the **Background Apps** area, you can choose which apps can run in the background. From 219065908da383f64a3c8cd2fc7f32ef22d3d9c5 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:39:28 -0700 Subject: [PATCH 052/165] bug# 10980800 --- ...system-components-to-microsoft-services.md | 262 +++++++++--------- 1 file changed, 138 insertions(+), 124 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a6b4fc36ec..21b9f91a90 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -38,6 +38,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added an MDM policy for the Micosoft Account Sign-In Assistant. - Added instructions for removing the Sticky Notes app. - Added registry paths for some Group Policies +- Added the Find My Device section - Added the following Group Policies: @@ -70,45 +71,46 @@ See the following table for a summary of the management settings for Windows 10 | [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [9. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [11. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [13. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [15. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | -| [16. Settings > Privacy](#bkmk-settingssection) | | | | | | -|     [16.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.14 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -|     [16.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -|     [16.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | -|     [16.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [18. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [20. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [22. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | -| [23. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [25. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +| [5. Find My Device](#find-my-device) | | ![Check mark](images/checkmark.png) | | | | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [9. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [10. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [11. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [12. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [14. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [15. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [16. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [17. Settings > Privacy](#bkmk-settingssection) | | | | | | +|     [17.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.13 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.14 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | +|     [17.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [19. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [22. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [23. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [24. Windows spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [25. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [26. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [27. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | ### Settings for Windows Server 2016 with Desktop Experience @@ -120,21 +122,21 @@ See the following table for a summary of the management settings for Windows Ser | [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [5. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [6. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [7. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [8. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [10. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | -| [12. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [14. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | -| [16. Settings > Privacy](#bkmk-settingssection) | | | | | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [9. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [11. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | +| [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [15. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | +| [17. Settings > Privacy](#bkmk-settingssection) | | | | | |     [16.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [17. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [22. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) | -| [24. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [26. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [23. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) | +| [25. Windows Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [27. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ### Settings for Windows Server 2016 Server Core @@ -144,12 +146,12 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [5. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [12. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | | -| [17. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | | -| [19. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [21. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [6. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [13. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | | +| [18. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | | +| [20. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [22. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [27. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ### Settings for Windows Server 2016 Nano Server @@ -159,8 +161,8 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | :-: | :-: | | [1. Certificate trust lists](#certificate-trust-lists) | ![Check mark](images/checkmark.png) | | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | -| [19. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | -| [26. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | | +| [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | +| [27. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | | ## Settings @@ -296,7 +298,19 @@ To prevent Windows from retrieving device metadata from the Internet, apply the You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Device Metadata!PreventDeviceMetadataFromNetwork** to 1 (one). -### 5. Font streaming +### 5. Find My Device + +To turn off Find My Device: + +- Turn off the feature in the UI + + -or + +- Disable the Group Policy: **Computer Configuration** > **Administrative Template** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device** + +You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Device Metadata!PreventDeviceMetadataFromNetwork** to 1 (one). + +### 6. Font streaming Fonts that are included in Windows but that are not stored on the local device can be downloaded on demand. @@ -316,7 +330,7 @@ If you're running Windows 10, version 1507 or Windows 10, version 1511, create a > After you apply this policy, you must restart the device for it to take effect. -### 6. Insider Preview builds +### 7. Insider Preview builds The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. @@ -362,7 +376,7 @@ To turn off Insider Preview builds for Windows 10: - **2**. (default) Not configured. Users can make their devices available for download and installing preview software. -### 7. Internet Explorer +### 8. Internet Explorer Use Group Policy to manage settings for Internet Explorer. You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**. @@ -404,7 +418,7 @@ You can also use registry entries to set these Group Policies. AllowServicePoweredQSA -### 7.1 ActiveX control blocking +### 8.1 ActiveX control blocking ActiveX control blocking periodically downloads a new list of out-of-date ActiveX controls that should be blocked. @@ -418,7 +432,7 @@ You can turn this off by: For more info, see [Out-of-date ActiveX control blocking](http://technet.microsoft.com/library/dn761713.aspx). -### 8. Live Tiles +### 9. Live Tiles To turn off Live Tiles: @@ -428,7 +442,7 @@ To turn off Live Tiles: - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications!NoCloudApplicationNotification**, with a value of 1 (one). -### 9. Mail synchronization +### 10. Mail synchronization To turn off mail synchronization for Microsoft Accounts that are configured on a device: @@ -450,7 +464,7 @@ To turn off the Windows Mail app: - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows Mail!ManualLaunchAllowed**, with a value of 0 (zero). -### 10. Microsoft Account +### 11. Microsoft Account To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. @@ -461,11 +475,11 @@ To disable the Microsoft Account Sign-In Assistant: - Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. -### 11. Microsoft Edge +### 12. Microsoft Edge Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). -### 11.1 Microsoft Edge Group Policies +### 12.1 Microsoft Edge Group Policies Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. @@ -506,7 +520,7 @@ Alternatively, you can configure the Microsoft Group Policies using the followin | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI!ProvisionedHomePages
REG_DWORD: 0| -### 11.2 Microsoft Edge MDM policies +### 12.2 Microsoft Edge MDM policies The following Microsoft Edge MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -521,7 +535,7 @@ The following Microsoft Edge MDM policies are available in the [Policy CSP](http For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](http://technet.microsoft.com/library/mt270204.aspx). -### 12. Network Connection Status Indicator +### 13. Network Connection Status Indicator Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx). @@ -540,7 +554,7 @@ You can turn off NCSI by doing one of the following: - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator!NoActiveProbe**, with a value of 0 (zero). -### 13. Offline maps +### 14. Offline maps You can turn off the ability to download and update offline maps. @@ -558,7 +572,7 @@ You can turn off the ability to download and update offline maps. - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\Maps!AllowUntriggeredNetworkTrafficOnSettingsPage**, with a value of 0 (zero). -### 14. OneDrive +### 15. OneDrive To turn off OneDrive in your organization: @@ -568,7 +582,7 @@ To turn off OneDrive in your organization: - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\OneDrive!DisableFileSyncNGSC**, with a value of 1 (one). -### 15. Preinstalled apps +### 16. Preinstalled apps Some preinstalled apps get content before they are opened to ensure a great experience. You can remove these using the steps in this section. @@ -688,45 +702,45 @@ To remove the Sticky notes app: Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftStickyNotes | Remove-AppxPackage** -### 16. Settings > Privacy +### 17. Settings > Privacy Use Settings > Privacy to configure some settings that may be important to your organization. Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. -- [16.1 General](#bkmk-general) +- [17.1 General](#bkmk-general) -- [16.2 Location](#bkmk-priv-location) +- [17.2 Location](#bkmk-priv-location) -- [16.3 Camera](#bkmk-priv-camera) +- [17.3 Camera](#bkmk-priv-camera) -- [16.4 Microphone](#bkmk-priv-microphone) +- [17.4 Microphone](#bkmk-priv-microphone) -- [16.5 Notifications](#bkmk-priv-notifications) +- [17.5 Notifications](#bkmk-priv-notifications) -- [16.6 Speech, inking, & typing](#bkmk-priv-speech) +- [17.6 Speech, inking, & typing](#bkmk-priv-speech) -- [16.7 Account info](#bkmk-priv-accounts) +- [17.7 Account info](#bkmk-priv-accounts) -- [16.8 Contacts](#bkmk-priv-contacts) +- [17.8 Contacts](#bkmk-priv-contacts) -- [16.9 Calendar](#bkmk-priv-calendar) +- [17.9 Calendar](#bkmk-priv-calendar) -- [16.10 Call history](#bkmk-priv-callhistory) +- [17.10 Call history](#bkmk-priv-callhistory) -- [16.11 Email](#bkmk-priv-email) +- [17.11 Email](#bkmk-priv-email) -- [16.12 Messaging](#bkmk-priv-messaging) +- [17.12 Messaging](#bkmk-priv-messaging) -- [16.13 Radios](#bkmk-priv-radios) +- [17.13 Radios](#bkmk-priv-radios) -- [16.14 Other devices](#bkmk-priv-other-devices) +- [17.14 Other devices](#bkmk-priv-other-devices) -- [16.15 Feedback & diagnostics](#bkmk-priv-feedback) +- [17.15 Feedback & diagnostics](#bkmk-priv-feedback) -- [16.16 Background apps](#bkmk-priv-background) +- [17.16 Background apps](#bkmk-priv-background) -- [16.17 Motion](#bkmk-priv-motion) +- [17.17 Motion](#bkmk-priv-motion) -### 16.1 General +### 17.1 General **General** includes options that don't fall into other areas. @@ -861,7 +875,7 @@ To turn off **Let apps on my other devices use Bluetooth to open apps and contin - Turn off the feature in the UI. -### 16.2 Location +### 17.2 Location In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. @@ -920,7 +934,7 @@ To turn off **Choose apps that can use your location**: - Turn off each app using the UI. -### 16.3 Camera +### 17.3 Camera In the **Camera** area, you can choose which apps can access a device's camera. @@ -961,7 +975,7 @@ To turn off **Choose apps that can use your camera**: - Turn off the feature in the UI for each app. -### 16.4 Microphone +### 17.4 Microphone In the **Microphone** area, you can choose which apps can access a device's microphone. @@ -983,7 +997,7 @@ To turn off **Choose apps that can use your microphone**: - Turn off the feature in the UI for each app. -### 16.5 Notifications +### 17.5 Notifications In the **Notifications** area, you can choose which apps have access to notifications. @@ -1001,7 +1015,7 @@ To turn off **Let apps access my notifications**: - Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessNotifications**, with a value of 2 (two) -### 16.6 Speech, inking, & typing +### 17.6 Speech, inking, & typing In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. @@ -1043,7 +1057,7 @@ Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https:/ - Create a REG\_DWORD registry setting called **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences**, with a value of 0 (zero). -### 16.7 Account info +### 17.7 Account info In the **Account Info** area, you can choose which apps can access your name, picture, and other account info. @@ -1065,7 +1079,7 @@ To turn off **Choose the apps that can access your account info**: - Turn off the feature in the UI for each app. -### 16.8 Contacts +### 17.8 Contacts In the **Contacts** area, you can choose which apps can access an employee's contacts list. @@ -1079,7 +1093,7 @@ To turn off **Choose apps that can access contacts**: - Set the **Select a setting** box to **Force Deny**. -### 16.9 Calendar +### 17.9 Calendar In the **Calendar** area, you can choose which apps have access to an employee's calendar. @@ -1101,7 +1115,7 @@ To turn off **Choose apps that can access calendar**: - Turn off the feature in the UI for each app. -### 16.10 Call history +### 17.10 Call history In the **Call history** area, you can choose which apps have access to an employee's call history. @@ -1119,7 +1133,7 @@ To turn off **Let apps access my call history**: - Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessCallHistory**, with a value of 2 (two). -### 16.11 Email +### 17.11 Email In the **Email** area, you can choose which apps have can access and send email. @@ -1137,7 +1151,7 @@ To turn off **Let apps access and send email**: - Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessEmail**, with a value of 2 (two). -### 16.12 Messaging +### 17.12 Messaging In the **Messaging** area, you can choose which apps can read or send messages. @@ -1159,7 +1173,7 @@ To turn off **Choose apps that can read or send messages**: - Turn off the feature in the UI for each app. -### 16.13 Radios +### 17.13 Radios In the **Radios** area, you can choose which apps can turn a device's radio on or off. @@ -1182,7 +1196,7 @@ To turn off **Choose apps that can control radios**: - Turn off the feature in the UI for each app. -### 16.14 Other devices +### 17.14 Other devices In the **Other Devices** area, you can choose whether devices that aren't paired to PCs, such as an Xbox One, can share and sync info. @@ -1208,7 +1222,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co - Set the **Select a setting** box to **Force Deny**. -### 16.15 Feedback & diagnostics +### 17.15 Feedback & diagnostics In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. @@ -1293,7 +1307,7 @@ To turn off tailored experiences with relevant tips and recommendations by using - Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences** -### 16.16 Background apps +### 17.16 Background apps In the **Background Apps** area, you can choose which apps can run in the background. @@ -1307,7 +1321,7 @@ To turn off **Let apps run in the background**: - Set the **Select a setting** box to **Force Deny**. -### 16.17 Motion +### 17.17 Motion In the **Motion** area, you can choose which apps have access to your motion data. @@ -1323,7 +1337,7 @@ To turn off **Let Windows and your apps use your motion data and collect motion - Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMotion**, with a value of 2 (two). -### 17. Software Protection Platform +### 18. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: @@ -1349,7 +1363,7 @@ For Windows Server 2016 with Desktop Experience or Windows Server 2016 Server Co The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. -### 18. Sync your settings +### 19. Sync your settings You can control if your settings are synchronized: @@ -1379,7 +1393,7 @@ To turn off Messaging cloud sync: - Create a REG\_DWORD registry setting called **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging**, with a value of 0 (zero). -### 19. Teredo +### 20. Teredo You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](http://technet.microsoft.com/library/cc722030.aspx). @@ -1396,7 +1410,7 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command. - From an elevated command prompt, run **netsh interface teredo set state disabled** -### 20. Wi-Fi Sense +### 21. Wi-Fi Sense Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. @@ -1422,7 +1436,7 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. -### 21. Windows Defender +### 22. Windows Defender You can disconnect from the Microsoft Antimalware Protection Service. @@ -1484,7 +1498,7 @@ For Windows 10 only, you can stop Enhanced Notifications: You can also use the registry to turn off Malicious Software Reporting Tool telemetry by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. -### 22. Windows Media Player +### 23. Windows Media Player To remove Windows Media Player on Windows 10: @@ -1498,7 +1512,7 @@ To remove Windows Media Player on Windows Server 2016: - Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer** -### 23. Windows spotlight +### 24. Windows spotlight Windows spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or through Group Policy. @@ -1554,7 +1568,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o For more info, see [Windows Spotlight on the lock screen](../configure/windows-spotlight.md). -### 24. Windows Store +### 25. Windows Store You can turn off the ability to launch apps from the Windows Store that were preinstalled or downloaded. This will also turn off automatic app updates, and the Windows Store will be disabled. On Windows Server 2016, this will block Windows Store calls from Universal Windows Apps. @@ -1570,7 +1584,7 @@ You can turn off the ability to launch apps from the Windows Store that were pre - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!AutoDownload**, with a value of 2 (two). -### 25. Windows Update Delivery Optimization +### 26. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. @@ -1580,13 +1594,13 @@ Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delive In Windows 10, version 1607, you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Simple** (99) or **Bypass** (100), as described below. -### 25.1 Settings > Update & security +### 26.1 Settings > Update & security You can set up Delivery Optimization from the **Settings** UI. - Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options** > **Choose how updates are delivered**. -### 25.2 Delivery Optimization Group Policies +### 26.2 Delivery Optimization Group Policies You can find the Delivery Optimization Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization**. @@ -1600,7 +1614,7 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con You can also set the **Download Mode** policy by creating a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization!DODownloadMode**, with a value of 100 (one hundred). -### 25.3 Delivery Optimization MDM policies +### 26.3 Delivery Optimization MDM policies The following Delivery Optimization MDM policies are available in the [Policy CSP](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). @@ -1613,7 +1627,7 @@ The following Delivery Optimization MDM policies are available in the [Policy CS | DeliveryOptimization/DOMaxUploadBandwidth | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity.
The default value is 0, which means unlimited possible bandwidth.| -### 25.4 Delivery Optimization Windows Provisioning +### 26.4 Delivery Optimization Windows Provisioning If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies @@ -1629,7 +1643,7 @@ Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windo For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). -### 26. Windows Update +### 27. Windows Update You can turn off Windows Update by setting the following registry entries: From e6c0a2417b63297e498d2e5f08ff8ab80ce695a7 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:42:52 -0700 Subject: [PATCH 053/165] bug# 10980704 --- ...g-system-components-to-microsoft-services.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 21b9f91a90..c1203cbadd 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -39,6 +39,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added instructions for removing the Sticky Notes app. - Added registry paths for some Group Policies - Added the Find My Device section +- Added the Tasks section - Added the following Group Policies: @@ -101,6 +102,7 @@ See the following table for a summary of the management settings for Windows 10 |     [17.15 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |     [17.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | |     [17.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.18 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [19. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -740,6 +742,8 @@ Use Settings > Privacy to configure some settings that may be important to yo - [17.17 Motion](#bkmk-priv-motion) +- [17.18 Tasks](#bkmk-priv-tasks) + ### 17.1 General **General** includes options that don't fall into other areas. @@ -1337,6 +1341,19 @@ To turn off **Let Windows and your apps use your motion data and collect motion - Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\AppPrivacy!LetAppsAccessMotion**, with a value of 2 (two). +### 17.18 Tasks + +In the **Tasks** area, you can choose which apps have access to your tasks. + +To turn this off: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks** + + ### 18. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premise Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: From fe8b0304d1c2577b272a6a456a5abdb067a676bb Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 23 Mar 2017 16:46:30 -0700 Subject: [PATCH 054/165] bug# 10980781 --- ...g-system-components-to-microsoft-services.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index c1203cbadd..ac398c6a26 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -40,6 +40,7 @@ Here's a list of changes that were made to this article for Windows 10, version - Added registry paths for some Group Policies - Added the Find My Device section - Added the Tasks section +- Added the App Diagnostics section - Added the following Group Policies: @@ -103,6 +104,7 @@ See the following table for a summary of the management settings for Windows 10 |     [17.16 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | | | | | |     [17.17 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | |     [17.18 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [17.19 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [19. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -132,7 +134,7 @@ See the following table for a summary of the management settings for Windows Ser | [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [15. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | | | [17. Settings > Privacy](#bkmk-settingssection) | | | | | -|     [16.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | @@ -744,6 +746,8 @@ Use Settings > Privacy to configure some settings that may be important to yo - [17.18 Tasks](#bkmk-priv-tasks) +- [17.19 App Diagnostics](#bkmk-priv-diag) + ### 17.1 General **General** includes options that don't fall into other areas. @@ -1353,6 +1357,17 @@ To turn this off: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks** +### 17.19 App Diagnostics + +In the **App diagnostics** area, you can choose which apps have access to your diagnostic information. + +To turn this off: + +- Turn off the feature in the UI. + + -or- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access dignostic information about other apps** ### 18. Software Protection Platform From 59374c28d3c4f360c24a2b4da60380d5357340c9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Mar 2017 10:59:20 -0700 Subject: [PATCH 055/165] update windows defender disabled by policy section --- .../images/atp-disableantispyware-regkey.png | Bin 50284 -> 38736 bytes ...ows-defender-advanced-threat-protection.md | 13 ++++++------- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/images/atp-disableantispyware-regkey.png b/windows/keep-secure/images/atp-disableantispyware-regkey.png index ae3d800c6949e598f559e2355ba846c3b206f00e..ed34f9dc65f1df650f36d5965408d4927a1c5fff 100644 GIT binary patch literal 38736 zcmc$`WmuG5_&qxG(5aNb5Yi#tJ+w5^-3^k`UD8M+EhXKZA|Qw~NSEZ$-JHRA|8boU z=lAK%b!{9r&pflA9rs>q-D?}6q#%WkLWBYU0MKQm!72a%d;kCd6AeU!)`WgHB7y#c z>?p0}3;+GNU=P4WCZ~kfqde7%J2-kcSy@=R0Ln1G^FeDde%Csg89iMJaWNIoVs; zTL8L>SSUDIDZU+{JTut!OqUi-UV>+J-HKFhxl}vnw5*K8KC%JoCW{@ z0c60UYVSVoEgD37 z@V~EVt6k9?VXr-}uR;H+T8uvbsk(Atxr0SIyjHzy#P{tM!NUIYQkL4Yu1z@2&ZZl= zden#az4o-4&cF0VgWeh8McbC*vG9He4jJ!V=jxfsa?hjZ#Nq1FyhE0DNW|Z7aEe*4 z(;gwH{l=LVwa&xi_aI>3y5BIjF(Pn^CUn(}sZhUE&K@A-deyK7187<|2}1Jsa_A(y zT=HdqIF6t>7S{KJd%WuX@U_horDMITnzUoCD}Ec8wN5@xOlwls;HrLf+M=86`M14x z27RgVvCMqX?-6oZ$$z(*W)Ye!c>10FY9JtX?e6+ib#Y5ABS_G5r2pt!#&UFRtPg5- z+x6nRv#i+YSuxO_8JR3&t~VJZ1}*|1I3W&7SFeI)CpMm%CFpfZ@RTpb_%}pJi*ECF zSN%ngzO-10Nd6DUJDm>SakMMdhr6kdw*|>`3~*o3kzATDO**>FV}8o5mezJ$7Y zbf#H8wujpXCWPhV+#GCAj28yaAh#Vz{l_aFNrifYVe1l>nRTk4HH`5Sr%Ed@rq=5q zhBG7CXNy#Sry5fi2E3g)0GMi=Eh1j2^9`0F22M&QRX^?}4Bb^$AY=M_80Am3*W?R4 znVo2Fmc3s~02hB+*Sy5eAYgMCd{ehNF5Sx(wUdi4P0L9uPlrGV&nY9Lo*B8Kmf<-y zmD`rN6C&;1+N`PH`7ZD>@y`sf^!X?&+$4`VmtHtWGy1E>Uz#OYNqq%OBfV!BS()RS z@B^PbkTH}p5Kymo(gZ7ZebndHK?ypYq@*K{6uUF!CbnCpY`iY8lDfTW4iRL?g z|Ep^73pt(+I3$0d_&|$e6+*Cg%b_G66j4@F*0y#z^Ey{dE5CX38l(7q!{@ z(%B-APkC6{z@`a$C8=;C{$T3A&pOwl&5cybbxd^W>1+wk3ai>)lcL~q{nAv~xKPLY z{J#tHJSOOYE?Vhs^%PiVXn{SYex9!fR;lF{I#0V1k_kJGm|I>SsNKjnhA&+BO z7?3kZ94G~vyym+;wIW{XtW2LC+Ew~IpJ=^m(XW?<+^>;Q)A^0VTQZ{rw_msMk;^YK z7?mc zPQAuHZL-h3&Nw2){nIsLn?}x64Z8RhDg;#IbhIzY`w>3 z#dhtS=+nM~!`UY-bXPH$A@K2ApX3{-<)o!GL^mX85njGDwetINJ{W6o?Z)1ae$K7Z zh@I%biF^7C5Ur$^K1oLw1I!KE71Fg>#-C-4_K3B4L>%{twV&oTGkJVoyRIbfC--+) zPIJw$Xj{7+T#qYOyinL2((&L{Ls>rW-*4fcpmgAi_G;m>7N?_nNBr!K^H43R-XD;} zjvEh|-l@iu?+%?L>rBLB=`#f-~2~G#hZgiODUS-8Z@|=5Mq7D}W{fHrqA1So^ z(?SmS=_#7gfk^lA-2F&r1N8F(c3!VXEr6JfCAUc2lteH&SF2fa92@$Ih`3Foko|4Mu-D*HdFs@g_~cf&ylGn%HH2qA1B7zW8vVS$kNeDbM%W_ z#|SU0Gte@T7X*U?!LbZBa4x`A3qt0?upFSa419njf%W#Q;AEVMWuHYaEHUCBf`<(o z46ftlyioJ!e|PHP+#RHVV1NH~G2E)>w=xu934D&#&2vGHpLCz#DTHCuVQHfKv+Yao z1hy$a1)=W~Hfy-(W#XEcbpfL&gM;=mwdoXKSaf?-2#VRh<=dU|X z2HCEH;pX6Ocd;hHX!%%~zoBG!z(V+Tc6b-}-zo`j3I5;Eli^Gmg9wKXPPGx{-x$O3 z=myh8?9j#v@%#sZ#;E5I0QbIr)93#|F!?%E0O{TC4xt7VO7-zRG<(TadK~-?fO#@_ zKCnJJr!?kTm=qL5s{xfC%Q8otxqmk(`h$U@OP0Jbbgi^KPhf<I9|fKBL-<^?VA7Ldeyl2I5WBXZ-v%2noK_fjDLTgT;CkU`tv^P zmkTD{UFHqW=^ee+X8~~cQgccz*xnlgxq>eHiF|#3K;+;KU=izy$Bu0HCrnT zg#{-9%<^RQ9wwR}u%(!*j;>k^oM!gvwLEW!n3}$NzOZjyucaBc!w?SMQ9E}c{nKUG zb~KqlSXa*V!cw#HNYPS&(zNL4KpqAuUwExW8SUsUy?XU~b_qQR6FiE67>@8Fe-fHi43A)S?R&O%sma0{u3hRwV{uv zH{7%%t5rx&JHgTEvG^PYbk_gX-#;Xys;WiXw4*FbFev2q5J{hLb7hZkWwg7T=s9or z2gQZhkXnmZ%xLh8D~08rsguZl$M}A%5c=QqXN+qs0;HtDZr`Fby)#jC9Kzxa79*y^8v7uezU_*3KJX=?xF;>Jfd>L-;8|*s5!*FbGwB)btrk1+$?M3@x|A zV3x2;UdQazt~k%a3+}VK zv_5`~&{0@nRDZi$^=3KuywGD|;{@6Rw!``5w3q-peUNmw`wO0q&uNF`;~8~26nTWI z9dP}GzV8H%ha>iGqqCW?$9nm&;df>GTN#F|Pit;>mc2_JwQE+Dr{0mxX4e&l2ExGAqxF%;8!_x;)0iee6_aV@SI7sRR8C5- zwT_U`bHrI?2>-$6iMj({1S-A)SKG*>>r~gsCPE-Qc+G?s3hO!gO>GUM0$5q8;Cu9M zTJXcQG@=X5kD7^azo56LXOO;WLly&1LdO!H&Avr*`bQ@JaTgrsia6Pg5;pK=gT+q^ z-e2e}7jt#U;DOEUV1c)xtd95R6(DZsk*E)#@aPxCSPAU-C>T_WimC~ya#SVqr@Mjs zTMl*&*-N=~ZFSzI zJgV^frJG_=L{J=YvtVNn(?m4ki_s!1oq{Nc%5g<=v@8}}n#-1N%9ndmI`1|puzub8 z(gEshW-9u81kXmrHxSm@{0*xvPELO|Lr~gI&nsgqG@pC(wzj+v(sD6hT_IojTAR`+ zoReoYr}a@wFgOSaa}7(scXwCoV>kH=U6ELY8f$3CG0FxGyBph|F! zh4i`PH9+b)_fLxDP5^Nvz&Sj7|1R|ENk>TSq-|bPWcni08|*gQv`PSp$9c)6XI0kv z)g871n4|#PLxGoH<=U|g*s|Hyf4cCT;yHOp;Gj_I>LJ%(o)mQ0dUGg3k#{`>4Vh)o zg{VJWq1XCeWHiH}gO?3pdI;&bJz&@@U}}>@@;AJB2hpfBI&^I`o~bk-(kp?^*I-qi zw3O>&hZq?VA7|;6wuQppufXxJa{N%4zmY6cRa#!-0Y<* zgGML>#+8-aHy?S=DIB*At$Hg$ZnL^@FIfy-U3DdumcR@))=B%1lTELok1zjj0XIoX zN0RfXb~XS+*zfqIU=Hs}r55>_7Q`|byUG^rHI$hm$!RLgM89+)FvAx`=_mr7*4+_= zr`jljGpVrPab(e%FOpQ^ME&b>Q(c!JAtG;=etFoJ5H2i0){P^=7oNtW_&<8O#k+Pvx0cYUP?n`fVoI4=&u1zG zo!~b8rH$!&i%uxqf<~7li3emw82B5Lm}JXt?cZX&YECQ}EK#m(?LpEMF?zwu!+HuE z+zYeMfho19P!dQE!moYc`1Ayg;6{-X?tWOi(Y%3};>L!ATf%(`W=uz?E2aX2PD7?W z6ybrNLKV7B7m~?A3wu`U?m80l=g=**H#k0ccq}O@qavl=W`@~&lRaB&rooD0bQ^&6 z+HW+#B}265zzY`tfMJCH-3csn;ubV`1aXeo=#vRVpkDN;Q>)H>Dy^w4G@F{4atiw- zUmw<1!+Ov%Hnv`sbM8P_te@G`9+Y1-~k@ZXdl$~c#6#4R9 z7DNDH8FjT!E3RVSeV(HOE+V`kRRKPrCHd{ddCfE>`fd~kpkT;IKEm=K959sY+D!=; z44n9(kixOx8lCkqW-xHnWGfw9#~BU?D9u>_Y$&fI=(ZRz z;eC&Jd{vr`Gd3yRYu>aP2=sgrZeq>YQ&*pEWb-r{pMiZJ5 z|7?EeXP5)SE?>hF;)%yG;l-+7~Zkmg&r^i6=F&w1eg0?uN+@z^4XoBX}X@T5Y zc?m^R5_`=L6F*xIRiWhrwAky`KSIkPaH;;0x$S;PPPOzOqALG`sBDe2aIJY41f&Ql z{}AZi7-*Z#GiQ5hs3&}zu6-j3;sS+@Q{RwyIKIG)x7Ug}|2aBP&KEdi-T9Y*>4-zy z&praZ(+5_|XMjOIptW+2zjR)@f20_m0!|1v&}hwk1kj_bBEp2W{=$YvuGtbYm^{?e=cDw0> z4HS4cTzm^-zP!#EGTuyMVk|wcd&LX~M6_WMj?HYX=$cc^b4$XGj8oE7#?CXv`e;=c z??SOeft}GE(m1OWI|+uUwmTc`b$%OM|N8avsiZXc-5vM8{esT@nseaw(*&t|^9pyH z?f3k!7DlMy8A*i(OfrZ2UCzDs1NFB0i}mDsY#=OtE*Y#-H8m;_aFzpS)ec+m@|ULx zb5BUAI9QAL6^X=$%PmS>Xv~6@WN(b;$CrwE(H&1I<+w%SKFK^2kJPUrecL~nq1&*Z z!jNAhRNuxi@8IMntT&ZMQ;dXdhx=uV!Ju9%RMx4(l>zx9Xwy-&@o}}JLf|1rUb8i4pnjORKz_Z_UOpOqPha?3p+^sHOxP-f&c^ioKAr@-Pe0NsaAUk9`5dB=xe8;K?CN|2fG)CT- zzekwcVhdWsgYFA%27Y}YH%=nlSXcOweh_67O&qNVe7nrqxX!2$#0UWVWTks-Dk=!AiBlxsYA-Ar-c)>aG_ z8dGBprF-YAI9G*2=g;$7)_fBYlDxdCJMkDxR5}EI0Kr5Ut54gnM{H>8iZw@4efLjq zzH3B3Ll{^!xv6$F(vL?%XQ$=hSOOA4!*#%GZ8$lasHudeT4CM*E{7s?($9m~wM|Je| z0pX3l%}=2dNbMNIFzN(7hj)rrKfcG5-R^GBAsC8fnbSm|D}I;{y5i-j?=4vQ0Ex_D zocnpZ_+?;$q(XXdia|5F^G)o*+PEFSf7!s-eDC7km+ap6yg~}LT(7D8QJMD2jr~1A zI0b%n1bJ;Ce*50@=BV=cJ2ei`xfaGG4VPYK-6l`)2Xun|E$HkXVSZrpb=zrux3T7aJoxo+btBR*EXBYR1@ZR={!#Dnql(=GnRfId zg8XYx)!bc5SQ5>gwyZldnyfqPi6NGf@MCBvUo4}aWv16iy5|mjgpbh%gXQ88Zr!$Y z{Xxa9XA>5MOa@e9fuX&*-wDBzee;8J<6-#yp&z7&cYmg6*db`|63hZ#n-9pT^C0Zm zpnGu3)m9OEo?RVSBbBx|a48QtPsjhvpK_s_?7^l*dwSdq>9Z5u@j01B>uLFJ0<_v5ewj zWHMwZfRv09M9dUa9tNVS*BvFd`tzn*ejlv3(nF)rjT=jtU2~b9RtC~7d`pyh7Ic3P zw~Qq2a5kF0u8MB`kXqDiAuL^sT70AC5xE%uSwDbY-JLwxHOyuE$32iwv`45tyf^>| z+qBw*{edbF3)qg#CMi1{$)TPYip2~Fp@r`;<6>Wa@nu=jSh+Ae%n2#~JD2aW+K~0t zfz@sMG}Zjl0XK`v{%t0XC}z77NaoDcbrl+HTAqTFIFgECR;dgCYwL7ek;as zf0pv9k!&eRD61K@GE+Ee<_B3{=fldYY2Ul8CoIERJO4`f{%qpi+1Q`58iH?xrY$@O z|NLc+`X1RwH(?@d@CcDMFEJBZZdiP#;~;>%r_OokrQJDi;yEPFeXV5FaqErPpe#*l zM5vpdzAd(L5Mx&@o>}I`+*XaKR0qX&cdx&LYezw&*6`9RdDJ|(%HZy@|M=i> zqq0avBd^@r&dyGJ{&2Py3DbLnD#q_%Y5WeU)3b%goqMtQ-LH5l0N`@T3lp%?=yyx< zwN1AJ4M6I9WwU`MO46+Zo6Nsx<(a(JDKISbCA=8o`*4V;(dqo)SLUE$BD~CWe9wXU zw2xKZU7of1b_yINeYo06@!Z1=H!IICOBU~S_cDEzcdfFIOY6S(lhv~P_~?rP!=}&O zI$0Rj4vTm>r$V+bTK4sKzt1e1@S4e_0?Q<%?Vl(UvzL6h@2cg%8PsI&=edG9j4cgO zy@iKiJ8>hXV||`B&HeRIvnd;4uy>~fnzR<(%zCI%xqV7`DdoHJMjPdnP>$s~=MJmA zFw2`0fKpbEwPFYs6ez(%(S8grje-bJnekEp6A9x*R|KwKfP?osOKv^slF&BHAX)ly zQc0A25u_iA>g<1snHbEfhoAL8|-gJGedC2^HvnSsM$9L5rMxUZ#qL+{XK4nSzlTQYi-8hw}hWQ_`3wcBj()YYSc+F2@qvHw6Uz7Uc8na{lp= z>4}~uG!Q{q`<;N>K?|&na75oEG^?*g$Tq=KMUEqy3VP4sf=3=7ncw>E`Cn|@;vXNg zaxG$u7PUieiyNsm!lkunV)FhwHAax^`s?xJ>p_M}__zmR3()Tzf@KG^7dW0K&Xh08 zum4LlS}U(7tE_bD2|;buQV*8aN)xT0XB0y*<4mi;ml2T&$I~_)1;PhJj$#J1_$%k- zhWMkJ&Pp-G6j>3k_DqrI?eVypo=YXRBf0jAbI6i%ct5U1e$D4&@xuVb3P13$2mWrt zrtTA6{a+}Th07g^auGc>Q^LK-6WZ9#pd;C5hJp;=PGG-{?oQ1F%@qea!Kvv)P8|w~ z&|0S_Zwz4-l5nwDHQ5c7E=p3wn2lMT;p{07j9&t#k9p49O>oh#{dExl0!7bdD@!}B zev+*mt$t}bjp3)4!}BgRxv-YnvMSnGzuEb$y8pd>zeZ+yw)n<}wsW|%+jY9~{5H*p z8U1`T9?4>2nJlk@SjZ3k;aik;Xs#$-I%0w)eJLLZe4TAQd@Xvt;WskqAatnkPIqY` z3%DmL(uW>5R(GJDX5b8tPq`nSbjZK+c-V`u%zqN0J(JOf=;d$&eoJ*h7@ws2{Gs5; z24gTB(4I$^*q+s{S0CkcT4D{Mn@yEfW1>N){WiA&E4mb1j!$_I{duU#4lvME?BIYc zy@C-4F1Q3aU~p~vP-=%UxF1%e>DX87gf6WZOTcg26?KY}kjqk;;@Bzpo8?`qicC(6 zlcQXJ$)+{S?0f?E_|q57!#CwQl zGlNFmLr{9-4fFOqsm8`fK`AI`7?tclh+-=)Gy4t9B3&dmyl_c#Me91Lv4IKo0%lfArPVqii7B_ht7H%QjS1=vg>j_XdZ z)cZc1X=w5)w!l)zynjv6p0^T8j+n1&S%x<}$(biD+LuJEGDL0|%`x}Tw0ZflJ zsv_ecc7HMP^dkMKO$_aQPyj)*{B*e}heNgiw)~SAQTyXbjF72(CWYibzEM?Jn^-XD ziQ?33rFo@Qqv}C&C5s^`O{t9p*Oe+1wX+^J#ElobD{$MqUdJc^ac5|+w&S)bejq6- z-5P#jlfgzEM2#P91t~BmTvvH0g=l0LmF34wH(ZBk&vpKkZT1Lni2eG5aA1j&Q}dv- z?VI}f&;3hwFVbsHNC6nDi%E~b8m!Dlkm>l#D>eD>cF9nGhak`CLz0XzQeFjA=#Y-u z!+Aw)AjYE8Gqn`a3}ZNEiEoKP=A*yWe{sN;98Bmfn*a>c*U^o<}$gC+Azsjv@D zrTz`^-QL>rnng-Sqz1Duex>dmseZ?m`@8FcB16NY6FJ51+4CPIQ|>+|=9+qT4aS_f z^OM-)mbV08eFwdkV4W0Zbiqc0*KEa;5Jg)lOy?k#|j>rg}kr-|Q zHK2;wPOrN$!>pHJLZ&6~FvRiH=R%CCgXGgmj;TW+pY|CFUJYvbxWwX-Z;Eoemko){ z^y3Upa%AC)mK_XX4lyRFG8*!NMURd*{pyFgk`&3c&OeGxQqP=0yC~7GFz@J*Ra?4^ znQGxO)Ts|Znyv9d4e+`e77@b898}Lkf)i)IdUASIvf^rDCWJ|n&bX~kpY^9+q7sUV zc3%cG;dhnmHI_s%|7g?_{qlAmh+jcElNcY~kpCYZbv_RpS#cLi5VRMLTo#NIs<__f z)phRY)%AKRTfDmNTOXP(emFO6UN|V0cYr4Y38OI7zke1O2@)N-o4N%68t=cotW%t? zJrLN`g~`2JjmpXkny|hI7fH3)gi?k&7DqO%Wx}stV=8mP)IV1^EJ`#E4Ifm^xScI& zN|kO?+zXZ8=JkSx^=YJgb4p5pfwG_(K6R)tjYx?XV>?KWs3nLF`33^x6l6|+rVS=m zV@8zf2vZl7B>D0w8&286^nQJkD}w$qll{tzOqU}vr!jz-J?PYQj3rJ*sR9+I>zS4F z4;4R=qP=nLW7AG9kU18{D!yW>1+exmO7BXF(ER1Gm3S? z*O%I7NxD*GC!If53u$vmlZc~!99w`)OKM**INF_uGode4tU2FZb$`bvUwevm-&RW} z|I8y-fn~c;C*#|OmW;Jpw#CFdOzvxE(A;Z^E~nI}5kni>K=#~S4>p_R{De=FeyC^f zr|OV~}j(5tR)Txm;5(w|6?8@-;?uk zR@K+{LFW(w;C-a%hXR;|yj9L=`=)f7`4;3>QJ_;#8rLGnl!J#>Z*Dhx8=` zb*f`Wx#1zlLoHa^Y{ML1L)`OfXzDmU1+- zJ6h7AL~obSr0P~s?x#<`(eEEE2f99gi$gPv`iCD?b7M5W|iF4bzy?j#f zF+x&YHtaw7mrj(C7adc)B$-82NBohqZr-ZzA(gXpBeOJC`$UPFJq)meYP>^OUB6?< z(}m{(BD?bNW=BVG-cHZNuJdU2n2~16Ap#}DRU6|Ejm+BnOe}Q}l~c@MvI=M+w2cQZ z5;$R?lXMp-h@8@YM#pm?ke0=wwA;mts-(ekW+qVQ*NfQRhZ4nCfxWfIqyRqz{BY*g zKNKpbcNz>ISf_FzVKVK(~n>%GmcE#+LeEGw`YWGJ&>!yxQ z?Vy{vT-V6}MmJ}kOF<0Ad$CEoQ_lyF6$YB)5tj2*!?7+mi*+ydLRciRL_1+YB{_@T7v+IlQx2+I*5&)G%XCm~Nu8>ntOr=)%Lt*sBeOrOluT3FvDV?E*R$)JxQM7+k-J zh(cJV@2xyf>%-Pf50pU!YyL21q5y)v6zfSOI+$GmOAk?CnrXGm@eyZZpgyZ$Fx)zS zx8+X^WE@M{5z*92db14Jh(cM&x4_ut>mTks6a-J6mNBlb*Pvw1vHx3I*G6=u&i#|? zGw}pwtTEcnWDuq858Q$Y}1fAcyv_eLPbmdD~=#Rhi0V+=S!hFJqMy-RQ&hyU6z~Q;RS09 zJT{U5<033@f2`uC<0**zL!0wv5 zoi`m?{;y6}c*#LjrmCTe^XK%g3FBdhyg)NF+{RgI{$zdN$mvS(by@1H2nTNd!(#a$ zCIDcs?a`5Xd9@ykPbg|jBnbxV9rr;hFK_Q3VthMebHiAtPlaADci~O!!F+I2jPqgP z@)afm-FMIS2BwL$eZh~^5W=REG_hV2{ z{g4B<^VULw5Z_?3y~|G5e2t)bha5}9if3Ivswrh8Wt#6pnTD^P3pL5mV9nUPDExLc zFM%EF|CYs2OQyXlAVa*c^dV6qiXI7Amyj;iAkiAlD#G@-xS293i@K5m>r5VX?&o=R z#Sgt&TNtlnSf*znAykuE8Vz~lk*Jc6!G7nmP2Zu%N`1fFJBR4cMRBjk>sHRV&AHvl zj_#X#rH69MZT(OMYwjA*(A{#c(p7Gtqs}X0!D7SA@29t<*u1w3+4Y>hxF2+G#V9lo z*d5%RnVj*>wuXx@*uVMerR3Qu8{2aE#rN=Yz;K~c=nx6#$WK*vO>^1UJ)Y8l$-Bd_ zP01%-dB_rG_9ihsh!fubebYHr{9B6jhBwy%Ys%+qYq!VH5=lm>aj>MPD#oRf#kw6L z(!{Z8Y$>fLVvYj!43kEW5cF0^vbl)|P6-DkdA$xcFu zvs~i%%beZ#{L*TJ?`qg{UjgB@W|hlH3qZq;N}sGUrZ-XoS*BJLIlGj#{7iEOCK1^s z51eVQOb|@18!O@UtYb~o9KT^uX$|dN-=|-Tixw9Gbee@cy6F5mZwfA}t{oyZTuuxA z=`G(r75R_BaJ_ehFX&@(z&52vs;7scx^?Ze@0{l2 zBvfCAaPkqPbbj0L2=Xtcd!U_r%v8O6(lSo}h+s#%1#Tu7}XpUi^@{iiBa8DIp?Lm61aQn{RIBL;7PaG*l=1AMkI_(mvE_udS1#2_4GIDfRxI0~*&GOmaU^cdX*wD*s z{)FpGYXu`iQskgpexSN*|NL38m%-qnl^tlPLMH<9+s`qIvyAMf+1ZeNoYRD)XC|INvrFsT)vOQ{Lxw zG`SE1R-oB7!d8haA%XWXdE*jlWA4cj#HGOs#&b;JnM&M-qs+iFM1 zxL6e)?5d+DmR%|we=qwsK~tOLwN~rVXc@19&wk%blaTIa-F#D?=j<{UTGbC1x{0g2 zdwWS+4ft;BAhGG{G^f7l0g!rzNXnal)pPpF==O^97n~#g`!>a|ZB*_mnHP9~ccXXz zgb64Kk=a0cO^OD)yS03zu{Gws{MIq|R|vE5Eyd?;w5dvtOq@7MhsMZmg!o0UIP}a1 zD!YLw8J!L8<+3dCnDR-WZJc)LN zj!r-W99(Hb~v|6k^iJhv#A zrOWcu^3B+XV|uI$>vT))%v@PZ@X~lFG0Jk&mE zK7PCyhOdPvGx%mXG7PlR?Y1Vlp3Sx8Tk?aweaW+iY0dnjkf}Ar1Mok154?law`1&~ z`oVR5V^cmkKe?Y54R32!68HHWKxRQ(qtqBHsuEZ*-m}uqQ4iTn6G~cleZe!!MsuIvu=FAQCQ79&#oxsewYrhctb4MkgTuVU7O`l@BeF}O;YabuXZ_#c1g}FnO!UrlFx3j(nq%H1 znaR1HXQqrbX{tb?9}5Qpas< zBpP9JB3P=kdQ}(GZz(Q`x3vDanf=J@MPOa}yW1%x=o8A&}9!=t(FIU7h_oJ4W+I*Z(-vYVNA?Sh6ruJ(#IAc%vlI}SeGp<6oASC4?&;T4&xx@)*P z%brq>Bj=G!up&Npcb(bYQ)D-glF9n4z(X*W>+qXh=-Iy_(0qk3X2UwG`}euIxzL8? zS_@3lt3jC;j|=Su*O`buaJk zmeDJGX;@xwJ`*;eNKf(*eEdI>ZS1(k5&&8V$kN(XFIzTF8h$&?u+NpqqNi)RX}__T zb;6w2ZI7UC`rXxP<+D?vhvQgr)67lF^0zljU&HVSZyo}Hg+%;kMG^PV=VQ`Z(_hF-ne|#XR!9f?sVUNeZ~%j9?BXr zy?vw@Eo`5mjAZON)J;D6{V5pnMPUN!BLUE}JxI%!N@(om`FUiRUfWh1igSfRoi-Mi zQV9nvb~o9A8bSBhD5GOJ!Z;%bqBXhtQzq3z#J0i*Jg4MlkX-@mWukbC6xM^(j0>A7 z;S)$~_GU5`>=S+ca~_o=`~PrYDb0(-J*j~F)=&0RuUWkYg0Iq|P!`vgB)M*xP-KM~ zEC{DMKT#@405e3bSMlUn{c*vR`-K*@iDRa;x=kOLC`nO5Y60XHF4Pb2y~NsS;p5)d zp*#_won<(X?Q>dS<=&t9+?mYTulR>Q>gYi?-^Br_plnw#+zoZ8zJ8q92^V+hZ?)}Lpv(CZV* zKbY+fw7ip7&l;RaatW4>)_1pDHpW(|E1BTCl+&4pl1)&s<@wJ}KVkc(RYb%;DWZme zC+R8c<(C@z?^ghf_mFFh<~vI6%uAnK5Xx+l-km-@}3H$<-A^DpF1jT8KwHS|4R z`k(1`{W&o_=ItCqDrkMNyuB)yEzAmO8GU{n`MBlR-+D>bQ~bnspOo&3>-*S(3H~3$ zHG?S;PwTp!lzOKyY;*bleKou6H}lKj+^v#5kONlWoa$2_KWftsdnqtMe|cumu|@Nh zFNIkz-8v^N+_Lu1x-MdeSdUV#Zpndb*($fPpLC(eJC)cc2_!Q=C>j|6L#l+n#;zEc zSV^$|*KEytaxU9wFkFA+sJAQu^H8k0h z6YvvAPqgS|#O~FSJ(7H)bU5Nxt&Kj}x~`?ki-w}9V#xhQRap&3G5a5T(aXGwR;SB@ z^k!Hi7Q3Zc)Bs1T$*)T2fAUdNcg2f_vw(D1MaYsq{5GNaDfVz!H*a4r&R`=;Q@L4R z4uONH)R6#!6^k>cWbCP7N)qS959ZN=M5V!&?<10Tj5nC@IUnG~ns!h(z8vG0wvm21 zp~pY7i!Ien@yN@68EpU2$B*hr>V?Tf%VK&qLMUDz_t?yn_l?EvUw$eS@qf=x^{q_F zZ5{0@X7`q+JRl0UUNv6L792hihp!Cyona{~4oY_8#OviNb(;S3JpJm8~BD-pR8dGQ-8Lr+)HIQjV|^ zji~^+nf+3rcFB8d_u!|43`vOQx-jun68<`sv`t39ZGo~+)lgd-?fAVEN==;~)I|;7 zQ!F%ZMip;r_s+PFeHYuom=DTD)R-{ue>u#uPE0+OiyPo)-^Il&sn4mdY1gi;{ z?{WJp!jkB}IQV^vOekpiTKb~tp3(PGTX)f9s#|-7#KbRygdQ&BMzV}*5TOO~r(>guL04oi`&A~SqZHV~9`r8y) zE5;^qH5dTcNSvg}Gi9^L?o5SDP=KquF7!x(kEkhr+C`(XF6bIXo8~LYg<--)y2&L2 z7UFD=y1ab&_Q@b@TfKbVpwAYbC;=o-3%>oN2Kh46!VB*nmJVT~1q+}X&lS&fj-)p0 zr|OX(YqQXBY7EA0B7nLfY15B6%jfH_CpN`6%;K=e8m50AH`Do_+S1oisq#wL3l~O4 zK8+v|F(}pf z>5Mun1-N!tGYcEjVJEeO#GAkXeLC)aE9;gwOb!X_)^l!=3_g#E9bTWIIipst&i!~r zF`5G@9!5AZ9;v-CQcJ|}67Yu;xZXz32F`%#F<3TeIGiSn<4+17}i0`2ml89aRJf zUd&-3Zax3kuylD>gJv)oC=709A$Uf?sP_pKUevX&vQ8ja)Go*S?CsQ~nZnPs0#6C_ z4zCk)Luy2Cvd;-2e433mr}OEcRw){3q6~bTF*j&eLk|=^5yLr5>}3nIa7)B2-y17| zo9*Alo81#t_-fP32<<4yp`-DgeP_d#yjY)LFfcOa!#x$4WvE42Rup;!+6gvNB{59S zzLBQ49V;T6^Y{eMl%=ycK5qQrC$Ap9I-&}n@F7D_smqD(V#mI3gr&_lSOJNZxdU9w z(X=Y)`3cq)oy;Mc)sxhC;r$xu$qde4-rDrf3jnhBS!OUB)&P+{@mnd|QJb=^;`Ps^ zL*7{3Y&}%_smrQtw+Cb40%S4-BGCWj0QX8CezIa-t*>lz3l3j1=-E4E`Jx|ISac+I z&fmErLVu)_;b6~x%$JHyzvuS68sAd<-ojibQ6}gG?^W^0(FZm124z2_B zSZ+>FPjl7XX9;>8b!jN9U2PpO4f`FH7WHSfl6m~X26VMwE~$R!_qnMa=ewv0BYPm? zkD|$ATHSiIcRc6kHnSAp1^9NLyTCgjYm&}NWlJVja8UcpfL%Aw?@piYm~F7j`s9qO zRLtRm0p$q4HHX2LpQ$$KcUivMp6S! zjuIMfb>lwg?7Po<-}Bx(zCT}&(R*O;saJN;c3|DxTw6X9T-iL43pWGYqd$JWG zp8R}T2Pn!2H*w*_-fHD+-j4%$F%;J>m5&8|GJ%QnCedu7JUkM0sH4(vVF zuaF|7Tvd0_^6sRO5|VdL-=ccv8gn)kr@#4{i8xrBh-`jNiA`oQ=g#J`R4(nex^%cUY&5FJ546>p3s+EhvOo3t;{{uo{ z89A5A8zlaAhVTLqM6&NI35sA>K=#Umn70+-VTGqx?Sw&M_BvN&APUb*Ya=w|&FHK9v!wGp3f&%1 zB_YHvZ|&;b1&dKY5GAavzoW}>>WWczTQfX2K;qRGaS1H%CPR%rr2sK1G7V=;dn?V3 zUjTV}l@w@Hjr*?DL-%R#LYJ#-rKxCgOGna-UGyuy0ZN@e)&zEcmT!4F_LM+4!B-)` z(;Au-H?)-Dj<2VzWjwGa>Dix@Y@gMe&K0q?tbKaIe36*9AbNIqIfXkU`u{-sBGAlQ z-Jj63kBYVIkAqJ5B;+MfqI9|Qe4DM1{XErs<1TeF{~#-|@$svdnaA8i!ZizP~;N!R#? zW`AuHC*|v|8@21K2SJM~mAlsA5Fi!_wXHoteEV%{clv3p5umMadjX>1{yCTYFM_I3 zUHLQTpf`v|GZ;{KDo@3TepQ!0r zKOY79kotS|w@H!!BCMb%bDo)0QWu1GVuh)KH&OSVh7~BrahIpFXG#m;m(hxmWmu{q zbztd7IOrc%UZDsrJ_%mij-p97UH_-%PBJ%_!*)a-r|5W?d}#wYZ(j4sHKSKpDp+%_z#{Rz?8k{d$1xJhis4HqYDc5u zkVHU*x*LH9F^Ff$t}YkObmlHw736IVnF%o95QSQ!TG*XCX>BwJofR$QrE9V7cL+=%r0Ig+5BPp=y4dMZx!481p^MrVyWeJ78rho#pCmA`5s?>uQE`S~ z_(IMKPH%xMFQTM!ciZ`3y6MFdLPO4`9Hb&tm)BDbDT7?Y7YnB;k$(C_M5ar1XfLa+ zK5^^yo8++E=Z1QnFM_Y4UNqfRX*aLr-b)nhs%wcE*ln$=rDQ}i zekuLPKLWii-1V;Xtjc(YjqI!P&X>3mcZu1B1soOTip=t^qctoXC0trsE49Xsi*o8$ z`;TZApn3gT`Af=v>`DaR=S)?F@U}hoCD;tlWq-3j;q5GiF@x8C1+1Uy zoOz>=o@l=wEnfLL;dD#7`_yc(>K-xSM|NTU7VN_0ifi@C>nv`Z$S_v?!Wxep;fw~R z@T&6W62VAHaR4h@JK+j|qu^H$5`#D)5#xi(L5-)c5{V zx}fRf4ZFKf=7N0Z+qJ^XzjKGKeyYM~dMA{bZCjrcBRnUkD9@zDQ_VlY`cbR(3$};H zeYg2kIxey3;%<_jmMSsd982;-$7mRd-PT<~yb_we==&SR8`p?o zP8P6ie(}{7289>Ay~DoUPhdtabEf&drlZ%ZcCJ*XtEj@dgX=iEv`OIF^LpT#UgCV= zYM@12@nW~_x*c7CTEKF_BC|H!rvAC+nj^>FYEBssOgUTPJ?6W`-giHHw`G(!eTyo1x#0>PbiSRah1jnjN-b9-r3i3%Ly1f&c* zXOR@Nf!Oog3?(_Wp3ucT*d|-7Qo7}+_7RtMg=B-$=5)$M@ngTVLZ4d$d~`E7^bV)N zT+e~|NYc5p_#!d+1eA$sS1k`SIZ!d?pa+=^NN~HrsT4;qZ z_veA1=&7zxcDaTOq))e|+w;f0S_1uxU@WfUC1_kpe?5=2tJMR}v0xuJ%r7Z&Da!A4 z_18<@m#Olr6r6g-p^nLGE?@Vp+u;qW}8At46kWf_MF3|=3!vW%+$hiaC8i_znq;-n%8!h+r7M09XQdwKH2FS*zvpu22MR!f9z>rGuL#X z>k3htJ=MMHz3$USy_Iyw^CD*iRuWxT^;q`F{KBo_w^jHX^MfDxRU!pGUyGu3eAE!| zM6~JYK3dpeSDNQoEf2nzftqSlbQ^AY+f9#Nd4Mq{s;%Y;#YcwCwwkxqm`(E46%R}u zXHsWap#lN#Ej(Y2MbsEkXqPy_R?2JonH(8?J36;x2g+06TgLUyhuJ&x@RB(JPOJIR z0gsakh`aADHae*5+OcM@r5*K}7v%KSNBlHc#iGk|aH=$WGVG2Q=t$-B1Cwd+tUT;f zk|es|GoRFm8Wak9sa2tx^c_bjgA9Lgm)%ajf?3+QviipocgOI3%RaYKozwB|KDEvM zWlE3a)ndOH#*7xKJN0P;K)-Ca{bHznsRsKJIgcr?_ZN;3|FHuec}EwD2g=`UeX@qJ zOOM|8R%n#$e4#A+{+|7EyZlR!ZZsvCcIMjqIF_2FZg0x%wDsnuIG z>9PK^&F8e3HLoa6$A4gS&eYl4>=R686j%JH`q*F?yrCzK20XiS(JmkGGRJ_IiSgJX z8M{TDGe?uMIlFax+wz$&#$LMR?aObLx_sR;{5d^62I6A%1eP`Tfb&4>C668tR`P1* zs$3~-{@5d-0CiVYo~}X@be)u38*oHJ^%sl00_GK+KMmKEFga_k^{a`_CparNDLWLo zyVXBWthVyz+v4ff!K%?jJT(<`PvP@}+)ZuPQJ&TiY_H5l+|}7F&gqd(^in^OWPRPC zH2kdtO?pQHQ5|k4hA|=OOf~Cf@dHWv7HDi?dwcZZ467rdPBn?5KudDj(zLfoLXhYf z)=G}ESm?W;RZbq*-FtQY!xOA}Zclaf5&gBQ%YWAVzHH!p)k(R&6tfFf15r;5k8Fn> z745n)dtUBfL~%PO1WhYOD7=*6$2PfR3^?}w7=mXW_!ONn^m$`= zj&Wr#&1z5Ps(v47hoS&m$KcLE7+XclrR)I3wN8q~wNMJ*mAqVyz$jvL2Cl+#6z(r* za%jT%V>vH+UWyXYni1?c*gwhfwkP5sQ~HW*Y($9WK~<>R4;bfs%H-KC#BZ&=h~J*8 zVj&MuCQKF_Z>4L@5uH+ax&ny@SVDHSL{Jq^v6$ z^2|o3m^l0QC?Lwjj)GaMeA_o81FWspT(oR zKf`Z?Qa32~?E?ecb`RlxZf@u(OEP)h(%X7yk``O+683sGmgW%w*xsRPjWlxm2vJVOM4Wj9!o@K?C z%XWsvIl?nd9admSBU+?JfQJ9doFBY3Q=pp(YnrBxa4GY?MZQi{x!jCvcNSJU7n z`qHejA%rLS4Pu0#q-TFl^Ff%RvH!##NW3_!iCJLc@>}Bcj5~`Bnb4>*8+No|a%d`G z(r{bAq)Fl(EOAFe3~-;RvK~KrD8JYnr}E9B71^G#+Os#Q`HtQ4Fc2pXDDogQ(Y9j2 zM2?cQm4Lt|)Lle@X7ny#t&ZUcYbBXZImV|uC@Q3+qaQ;z7&Ylo)Pg}6bni@e5fS(! zuQciYjae}fn;rL%dIM%W&bUP@IiUz=Saxyw3}5+`{%`HbPFf{yd~eP>(?nE9y9vd znS)`Z&h};v(`ErK@W%H0H>Q?xj<%RvMk+d6CX8o12LTfX%oXR@?&2xm)cjzS7-etw zMt4ToYG1R>cU&S4t%?B`0q^weC|Cn>NT7Rd2}pY^S#a|F0L4H~8Z!o9qX}w^$bZOd zBiut*=jHN%)oP8q;|2JwqZO*|uPN@0SwAcA&big|S31ZeStxkC`<;rcxu8dzqzo>{ zin(=C_I=vtd27tqZx7=<3(tD3U{wsjw^v}8v*c1<_ZqgZ+=+OcH3(#LbLlp*;E=2p z#w8k8V;1D^AIX6Kkw5*+mcT3|``lR+TBxQ9eH8OytNT*1BDHQj7*08(Sx)&%uUX1}fFWxn#e@4vaaJ>lstm!eJ?xNmBu%=OdT&XO=EW}ex~iD3SSC(-^WT8MYfovgP8o`XST6s zeLsGzuk|GY4_j_@aBw&RHVCFcdF=WX$OUbt-4F8m`*a3(RBg8Qv5iJQ7SHr8lRQs( zLXh9ol*dK%(d0qiM$(R{--aHdRWBtVhRes)8}v&SsTO1b&>3uHC5MHDRqwDpJ!p$R z5I^v@xE{(k-;AQ$Z0?Au_AZwGKFV1nkluuv9Nk6c2QM<7BK`PB7nLVy`5JLQOiRYh zsw(U1@_?Jj_~M0$si_1To7gXvkHB=$?f&5Aya;(%lflWFJ@9QXi-;qk3~$1P(EC-y zhxRj{A%?t5z3VeR=%y_3p>mMB$WUtRW8`eeHcy%22>g9y|st143pU zGG0*RsDw8=J4lhn+&Y7m3faxxqrtm&=wR&@5AA+#X9(x`zH=_yYf#T=!5;D|LD`>W zQ`t1Yvmo)vl_Ut?mEgeD0WY8HrK@{29K-$OmoVQPGHwq?ZQti}J}OH}g1kOgo8MyS zq+mw&!1dcu8$Ficc@Si10FjaZU)y}H{fd5)t;=x;ev=E`=xkQ~8WUU@u=n({UV-t; z)tck!7~s1~xsmwJBe&%G*y)2lGS-2X|B-4cbZdUM{cZ928NVT(J^QNF!v!8^;_&;c z&X7ipbaol#Lo>-?x?ueT=#4j)EWG=+D1&lE8A#EXAF!8|H9M)kH!&oUy&q*|TED)U zJOgBEiGe5*LPw7V?jtUq3u_%MeLNxz8N_8((Wxac@qUd^pdu$G>Ky>IHw+4Zta}LXSV~lfDdTzxF9=QN1}S5GoB|ok+ zUx9?CoYkz>KNzK5CdUYmj7ZL^&$YaqoLW=u=qG8DQb2?H<+6zLsS^ZYs^+|Nru_Uyy6JNMt^0REiIaDEBJtp zHE+1^@DD-j(RtJ0U{=G71mj_8^#=vEY7ayLI@#o@l$e9dDt_5Du$g2MS|gXd7hBHn zfTeO?23E!hPjX0c%eSo{tZaypHgBZSNysITyboNW(*9Tfr^u<%3I7e#RL{in*xJBO z2#h=*mjd?qDYL!JPsEC%DeR@QE+x^1cl3KRsiSfK=Sbzpkin#^cIZ}kbcwF5 zaIEMZEn)9)q7X!~*8sm5x-;a&0g zQ2}qumlL&*Z(d(76>JWhR0v7HZqq*Wuo>tTmp<=oty zKDhuVXO82$g%MtXmaz)>L`zezF{c+B%<9_C1&(hu-PVfr?E*_rLly=dXeij-C<#lj zLrFf?(BFv19v1*bYF$a`M!;f!#E%Ta_48DxOVABU)gxf4Cl};nkXqu!h5- zV3M6hMi?@#?5F#c< zGe}%=<0$&kfsVwBJTK3RE>*WJJ++}bMKf3eyfn!Tdlr4#*L~kRZnBH)FxgaGH85E} zchh-CpiUE>*^Z*NZJb9w;EIMWS1G|)2Qx0)J;3)M?5K}HV07Zz<@Hz@3UUxjzU%~dJlD7r7Z~OSivUYS$zrl<)>WS_t&hnFq_i2su z5to@z#tRlW%H!_7IeXCyumP3r+C0S~3>*p*eSP5~RdC_5_7q6GNP#$f1p~8OI=PER zyW(J3O|qh&ph&%YR6-7MA)wqq#Hp~_JdJ;YWkhKNBYo%>=!WxMTIX}-NR(?b42^O>kuw&d+Gh3h{nL%HUmuT&h7w*9A(`CP+n^lokuCSQRn_Rp0mZu+Qj& z#qS2)L9SGK#DG+Q0cnAajMmhI^qh$)^%mg%cT0_1H`k_V^;dU8&c5)L-Dj6_bWP2e3B(^FGJZ2>p|5ZEBM zm_4Z5^t3yNhtpN4L9=`BYh@c@q9NhI&IfF*e&~W5J2?iiBy3d!y!QA=YLx`)9%*f%_qrK#hNBxFkxM((3<*G&vwNyEieeFjWm6L$ z0F2hBtH8noDzA7s+Fa7^=aPjbxwgHfCzD@L zkg+?r{`VsNfIxwLeKOlyTPE+{3jy#rA)fo&3>1h-iu2tzfd74FDMp!Vi9%=MI3uoT z+%w*K?B)N`j6K-=i(G+*LYcop1~CJ8_s~o=dun}WfH(Z4AYo}45C z+~d(Dz=^aoEKHOl649I)$_>qhGo7nnb2!gE7+cjV8yZ{-m!WHGM?0IYE>LKVOZD}6 zjpNxC`bQ)9c8Y9C%aV*Mk&}><=Pl`8Q~0H`<1runSRqO_HA)^Z4edrJ>n)JDA_N|M z$BQ~npy=WT;mHOek>>m~uS%gk{M;S@0M5(LBLCrxe;V)zL$P9rj5P=27<*GT4R)#ulY+Mf3^_?q9$Xpwd3o?~w9gWAks$>5= zZknSb#Yast#G)I8d(euufg&wPmos)@AJM-wxdlk0Bbyy4Iv&RcS_(mS6 zcYf2*&!mw8tHSj$skAkwF%HL#oP?H3+& z^5id#$Y3AIZCcf#cvBcb{O&c9hp<^*%X|$m83G8B#NV14R5Ed`rab~cAcUqHt0?+; zKKblB$&>`}GbfDTul|tNyL&0qy~I?=#yeF3o684mu3${N&A8B4@D^!4?X`KGeo8eB&cSCo&7 zP?`S~g~2a07iU#;Aeta;y4j19Id7`Hof1`gZI{okP}IN&<1>Dr0^ODqgC!?8=wYe@ zNJ>K@FLL^)KF^HUn&IbjHjXv-_6-m8DFj(SykTAb;S2dB`LwpOr?!BB+B8V0si=hvu)FNr=xeHv3G6z)YQKO z@bM{)6si#9@-i}NS12w@y;49hr*%mraE#{?tReoFPOHy~M35F8-&YLyKHEYn z+7#?pJRqB*l9i+tfI&8Cvi$X-sBo7de5D5U%Z`hn`|ZG|BXmzP96kbJ(nl>>8>ssQ zh$B&G#p6$S@eX%Xz9bk~JjW&OE~aCYl{iGb{pv;CrwWCPpA53-RanT&{>X~R2PHdY z#=!qk`pW9Yvc1=C6fe!2e0Nh+azY0f$XuSO>MOSV#QI=G!;OSOV2-APlz8VxdiFN- z$e$~|Hi$4mE;QNn-&1V!A1Af`IM0zKD=1s>fkm?$P_-(?utP&2)-lsoi6{e49yJ7& zb?R?mn*QB^#}{QR#Ngc{!|Y-~@6G2?GK$@!DrBM$IL3le4X1KLQw4{b)YORr$&k+B zqXs}r=4*7y;Df6)7y%-~%-C2A$gwpvG=_itcsS3GWWzXY`};gHzHhGsr5-APdnc9H zl%67~r5I!p4e^h-f7qV*PPyJNiV!)~K;K`YD3UV4D2H_j+MQ-j_$m%P6f zt|bMK%fmIzhfSCJ4V2QC8eSD9j*h2lodbP+8*^i)NBsj<$L80^R=WpN_ZNSh&j=*z zc(x~=uu59XUTc1l;a9EaQ2yAWd2<)Vbbie`)eoc;@R1;)fs!CQpsihsc|g zM1W-NnyMW0)nMnxFq{7F!wxCxLwRE-Q1tG*pMM?&xV}`4Wpu$vYAE1GFbB z2VCRw4b$E_B?w^JyyGx|mY9W;x$TmNb4~Z%ei}nFZ3&x;>R>JLlQ#{u9t|NIYU9p% zx1csu5cj4}J0H9=EQhFz0X|i~PuD}UMB5qoUPUxJuLhi->xSj}9FPcuJI+h;O=OkNNXi>^rVMJs( zIowI z2JMw2SsuWu&A6dQmuI#J;9zTOyG4~N4PxiH6^S=$Xiya^ncPZ~dvQ>t!Y}ngDdGG8 zHE-80hk7g7XDs61z}lRD!di3BfKE~bsrN-!bAao>Vznb&poAB0{)-AZy#O(MNE)YA3Lq7b81ujMvwQD<``Naz|C681Za|Ch z5sxqpkoU_o9XDc)h}cRPUW#THkk@OQFV5&!1F(l2*XTvkPG$AUwAkDtZKdQ$;Ve<6 zTiMndj2nYuRzebzv&v25KYj#T&Nt=(p$-foV0 zYmC1-@5^c=@-8u}16|YG&nnlc7K{zUFHWm!YI6MiZfiFl(hZwK;#P%4CyA<{uG>UpWnzrpe5nDk%Q{{Bz`0s=%_j*oxZ=nlN%ka~5F5o**j1mS-romzi4 zGj(p`i9|A;Ch7z#Nk{Gw%UpZZpPrcqi(#Trx?*T9#gS^;k@B{E#t$R+?Dx+3?ak>X zv#*le$O6Fu1Wpv(=(u#MNzC+3kraH?NV;qB%U_D{t}lpMxpP87LiPbbIdJ_8RlD)P z{XP~jNeG|Ue4MzWsR=;8umII_`T>OZ?BOAY1!4+5RSgZPCU_ zIuVu1&EJ(uJHYLBfRS#-tHK-LBotwko*oP>+YK|iPwQPte|;P1mw+<4Y1&SBvX%XA zXan$LKtlnxvL(%B>F=2R5*m~zX0uYvt`6kbJ zxegz7>Dww(OE|I%avM+@OBU_e=rAAiXw#lBDt&uwKXh zYiIqLeVBtmAT)~|W19KJMB#o$C26dhUzM6iTQ_%(D?$bBm;&zT`S!YTJwCyxs9diF3*c*hBjp4A zWTgycUfERI&EylKqL|N5ZkJ<%ffSZPPFT`q&6Ai|e~gb^J1R!ON`KUg1l}?2c-hv$ zvIBlytApfrdEya+T|`58lNjLcOeDm|bE`gxmct-LYBOwPZFD_fR_buNm8p)O;)@^5 z+>&PwDVhAZB-W*}X!Gcrt>Wh6%v>K7%Jur#Q0O=}eJ@ zVe*%TL{CSyEz8T*UEQ`h!k1(nWldtTo06rT2gW>eo(PxuaHfz6xo09D;-SA?W3f)u z;U0o9!CRmNJd+I=Bs*dW0fWp(3~~rio!DPpIsRge*FTLrXL4B<84m?0%H@diK_SmZ)7?rt^GN(OpR!`s@=WqSnqmi$H|58sT^dZX- zZD7k8u^w^MdZiG#jlqloqs$+&Dn#uR_;63`)drG#_o7FPCkruYfD5koyly@@IjJly zO$AZDOAlbpKKNPlFVioq_12Uv0ntJXYh?wkJl}=~{~0-1T7D2MhUSem1L8eu%~2^6~$ha3af= z_+8Rh&^LDPrdY)E-y{J!Qb4&yX*T&7C}9r$JPt&xTu{y<1k@d`y%kQ~%?%XUydm&a zM}TZOJvYC=Ip5kxBm`*?OV3Q28Bzqj!p)5+xiwC`3+2;MmPyT3ue~4~X+^ZOD4q8I zmxz-96y$U+*&fXQ+0us(jC1~&k6+V@F!bz)$u~H+NQ7U z${|qJcBE=eo*Z#eqX-j*Kuv*aG?0leV+hGULrrBBlBZgbn+Xw!S0o-oeX7rDm`4pZ z3{kl5NKm#mJD^j$pTRCWE%f=O__v{cYJhc1a`z@@m>gl_=+iLtt{)i&qVMfygjDFM zz&JNYFf}oUmQu$!=GRb#HVy+kTFbR%Qiq-XV}pN63i?iLNfo~}vLa?mPy`Y20HP!Y zL6nd&-08{j1-yzDjDee`uB3%XqlC0sjRAInNqx2r%5I>L*Y#fNZ)EsK6miTkxUEo0 z`6Mfzl{miNAGin8kCoq>B~-;r8&Ef7S8_e;!@-*@t%2q8#pX`kb--qF&|aF|CYdv} z+OCRNlATZhf{A)cI$|uKMmNM{4O=T6BV-H+$t3U|+Y+FX&*%2*<9Z!-vh81Mi1#R^ zdELs?pO46j`_xAaSH%J2b2Lkc=?mV>X39`juYb;v;gWi?G%9;qX`{#UE=M%e)q1dD z@_6#c)rXPd5t$pbbcDz%fuJ9QAWY_3Jat`NT>+iOAn+0?e@KB-zuVu%NNy}b+M;FO zxKgZRtPWRa)U1K<`t*+5nQ38W!#%lj0rD3>EiylGC=(GA`tKrQf<$zDJ<4q)NB&Id zoi)*KHB+8J6ogJ2{AzoliT!96p3;klRKEz~|4w!Pk1Wnk44`SEwdOq+w8s?}YM2p? z*j7(B?)z78uA8OtMX<34wMOsK*;+GzjbpPVe$#Zi>eDois$4zkj?r z`3~=P@9Hvpj^J`9I@&D9L%sYKHpxC^J<8=V12Obatd=Lt(R9xl%2kk^I zHjuyQ6BwU>ig$3fw!#xUEY|)1T6D;XK3>0 z+e|7&9N0H9N5h@X<4e!0u)Gi?6a^{k0(q>d<7{Ivg3!@)1WJ<1Gh+qsa`=#|R!=51 zP6a`a!{+HDZmIi0XqYSAPqQUtAb@mH65up=1muE#t0%s;0ZOvQox{jd_@TEzRi4g` z?;b-`rSj)^qjLY1Ay-bX(v;`Xy~7CCzjSUM#%?YrDcr6rM?Er7sSv&OOG_s{?lt znu{N>tj}iiU!nJTJO&So-Y`e2BFb$zNiPu!S_7F1zOkOX_a~=@Uz<*j z7!ZWcu5`BA0aHA*WDH4{}BSkTVUfJ-7fO2R`rw0I1e78Hkj|O_xL3ujcxogQb2}k`??%8Qt%W38 zb{jwaXKpi^R2e8Tj3vlK8kWq$_XJ*ZE4e>El}|#JtOZlpX941xY)MEcJ@e_?l{sU;!#lqGm|t$%2^@N zGzjkeSGk2OJ~RoC1a{zfQS<$mx{J@cSYFFhb8~#-`vBAE0#xyu4i7c?W<23D4Q>vo zToqR*ayb*a``LW=8mSsvK-sI69#@Tkf4e%*m7p06LM$sLoklJP5H;O^hbY>OUK?q` zATIM8#}zt|Y4%(6HSa|C;jfMhL?%izh*ivC38I#;0R-Bfsm7jX$$F-O+z3+96z0?Z!${6qsm=Wpt8Tp719&vMXa5B-e++=d>qCN=gbWBz^MT z9&|yom|m~I;0T56;F|;hM5cf=5tP5v#&$<&;y~HUTY=BynomX&d(5e{ zGyUHhZH6sM`GV70k7Hz~trEy;ezM^I4(Q5-Z7=r9A%rCL^%V8`Uu|HjlhfM-Obh7|M*X&n~Ik5 zLI5suNEPnP{mG*(u+5art}tJ@49K#qSxT2~xtmEuDoO~+(cUatSqQ>KZ=ywJ{-+X7 z$uNdbPtNuw`I{I3R77#dkJ>PAm@1rEVk5ykUL+G^tjDou7M!0Z&tXY}3!1Ga=U1qmjKmo2$PKx33W7Je(PaB@{% zrw>J!aX44KeJg~V?4;Moj4)Z23Oc)wLbX~pkPB4#t6IE{2Jdy{{&XQ+0`#R?qj2Dr zv@Kgf39r=vc<93Y(FHfrSS+2; zZ{~{Su^kHe$KPfAd9_aHU#ZO2AmBRJlO5;d)gG{a{+II8Tnew$6&Lh?Ox#R>=g+K? zg&H2?q&UT zuMXnQfj1Y`49_5(vEHL~w1kg9$o-$~w@7*cyg`^b;EEj4?eijpcoVRCjRHW$UB^b` zCA%jKLd?UWA!3uo_D-_IIK5}kFV)ZYy6BHyJNpTw@g0Pp0MS}UM#3eSr1Jy*33m&i zTkWhby#@WUax4q4YBN<#I#9Xi^#v2LFcw9SdxsDW+0f&IstE7UE3nAV+5ts9j$m^l zv#na{Pos7+B41N!j&MwMa@iFkiQ`|yUpkBF?6P3!1nG~VVDl3FdH_OPv(pfgfOR#F ztkOa#t89qnBVMxhL?@?PM%(pCK34?t7l%Nmd$eh|m%q;-Mx4>)YP?hhC{)Dcyr|U~ zNQuUH=V(pSHGukJns9DuQ!KS#XzT|^1fh^*Wb|7b`t7K&8QKN=1K1>{nOA0j!9+U- zP^EnG@<3iN;&E@3qJWViC3bS+(1(28oX4qe+t|;K&N0n`(s8efOTGZ=5;Sr&Js|aM zrx{*$EFjST3WW-|0uZwlVCSZeyV8}hh#e#54@R+{017S+n?7-8bf9iuDD9a4C7RmQ z)%8V7gjEa8jOY26KZR2)qQC}`4QT=Jm&eeq&Y0V$D_X)vvt^m!aJ$9u zo|71epz&VwRf)c0L3e`D&xAw1Y(9P{P<>K}JaJ`o(P@OhYyf4zBhsHYn<7Y0_sYz`!gu@=`rC``fA@#Mun{eZ=%_iRPTLyQ^4ML zuq{-WOU{C(klC#6OG#V$(+fM{A=D(S*G?m{gG`Dazi=MA3Mh!<(X@Y|m3J#4cex$$ zBr4zaJniCKyEnny4DVQTw9`L;_lrNUS(ueIIcS5kx?hAaXD`ON4~aaSgnr-0w?*Y) z+JEIAGiUXHO?XR%gP)&Dh~9_RCqE0|RrQ|$Bet;+zvRf<;tu5@D4>>&>8OI6Dp@DU zIm0e4m8V+6jVGHQ0{Tq(?J`dMmM*^(sg^awEdojF+}xw!e3g@bw{J}{j0SLy$)<7u zhj=1LJ30^PkgS(FrxtF|yde%@HPc6_w$bkMrDbXiq~Fa5e4kDzlc`O?9dh99=`+c% z=XMf-OAjey!aX9^M@n1gc-ok&oSNpWvp+xLUAk;<3uw9-Oe59*#@K;cLA%AxIgTD4 z1;#Tap005NmWV+=MI>kdfXSO$LI<^We>3I;e)K9gde;5onsS5!1Elvya&j`H>A`n81&#K;aI#!g@#PVKwPMIyb&FNK>eUM zRLDQP*u4I67|{b13)AC{#x>}Sr)8lTY&8_@Gj0#QiXFeOY)KmvCRCmE*aO}lxH|6Q zs{4~8A!VY--V{FGXi4^>-lM?%N9z7Dso2lSZ`{~pOrhYeiz*Lr^8k@((gpCOfH9LW zy<`8ii_uNbd4*+)<9WQ$hO+!3Z++fhIuvd#=y1#RR+z^kx9~z#8?>&hKBfixFyPwm zr3xtXsG@CUDzcB z`T6Pe^?B%#E9=QI`6}Db+Vg8oI>+_Yi5)Ke_=8;pD&2cThV4DAOHsXZsqJ~~dNH7F z>OOe-E6yzGT3&bj;NbjiM~er{e>_fLXknMBrslG^3YAMc=sjhYrp|=9wi8=SzxIiYyty&fw!Ox;6w=lQkXnsu%ba4)gkO z2qVyxV^yKZT%D^}&|KNvu-ERj-*VvYgx5kyk;+`{v$^eHSd@r`Jw$1ZkNYD;Zs&#B znI&|0+uBocvZk@{c!{dIx-yHgsKg5Ym4&Ibb=fRf^Y!(dVbKCTI_5K7U(^BkN@%4E z?2~RS;qH1=i)T7-P^Vk}_o-knYOCpuT_s{i%mVQHfOVS@jZOhxH4l zlf1I#;^S3A@=JVTw|T-t*J?LtXtin>f$|Z2ZgP5fd}-+_u6L)lr;$cqO>1;%T-9+_ z69&_0v=y7)v>ZCGuWW3*mQp_F)7BX;uRf7Fc9s0>Nf`u;%NeZQd3hZF<-IP*4Gk5`1JbfBAi-eUt|T`tVzx+VE&1?##a1Q zCr(eH6^|^BOpgUFXN51Su}9}Nr6Xu%yLq@EvYo;nKZ-PgjR8TOTR!S7S){Pu^A*dw zl5k*N#9^@M%|FnEbq8;uHxUN)YUr4I<}n|7;5QR7F)`P4ax}N|I##OXkC=8jONF== ze%9RnGb0$~s;fS5+w68rfnQ)Enf-+@?7_P4BV6_szAw8FGDv zv)w_wywKS?;0=j7O_80l{oxHgf}hSpYai<~o$_jUn9mJFq)p82{t_D4g}-Pht9SWT zQM7POzHyp4P&q!P3D42CIKCjGxZ*#Rm4O{n%xh3yCfuv2EnIDXLpYkY5a3%fH|_7E@LFGAJLRGk?y*kG8)1L z2`f%)59^*kZT^D^W@$~|H@AA?G+uStePx#pr=!%I)@W=HfUos`ND2Ln3LZYvyw1X1 zncd*rPIYqoS?fSlR$pIiPoB|Wxag{Ihs?iOx5pQ&O4tj+9I?#9qLQU{O$#OG*iqb- zNg0}JDrom^k%G^cc(joA*3UrJ?ALq2@uw?Yx*mj8llLP4D=}nbW&%6cHErt=_I90C ze!MzfMO8BDX-3B=wzRK$@I2(4Z2kJYaNa~N=Y@327RTbk;d#C);VuQ2<>VKstI${y z&3#*gF8fpR|2&_Z!Ol5HLN)lGKZMqKsl_0%bI;^>xMy zM|*UKdPbl3(6b=vdxQ`b_mfkdlde7t^(0=pM$0QQuJPU20er;EInoEB^6s+dkgj+V zh`jmaue#r6rJNx`N86Q@P%0_)S*L+VHbWj)-z9hZ#cU%_WVQ(HZFLdp%wvVM1je9= zqpX10N{Gm%t0bM8zMJy5e#gs36X z2Az^xos#a;VUbir+ACdKG5Y(XTCJxJL4mJIbaTEh4xR^?+-qu0a?Aw%AyV3A&mgJ) z^TpPe0|jzs-9(d^$O&cJjNw;mYG6Grrs2GU<^hPYr0~0-w=^yC5YqG^@IKBwqrQ!@ zQ*L#?%!Y4zw19&m)UfkQplFG9v&pIC4p}rIcM6RyUr@)#hBUF7PleMYHPdA7r5{Ll zBQ|soUptr6p;$;qkP)ga(N>{C4eS}K78Yi7CN_sUpCaz23r>(Y)wS-(nCf??*PlKK zhL3|;PE0J~Ox`7Cj!PyTcx~Sf8iZ5_%<^KrEuipqSf{9dX5Gg{F!w~}D`>>Ch+)}~ z(cI}lVumUDdIO=JTYlh%G+xA`yk@JcIY-irnrXuA$h!A3kxM4qMDK@KpNl0Hrs@q6 z|G;T|@&K&26tI-6zX@9&Rb*^hgDrQtQ@u#F&?$(4sULX>Njz<}U#j2Ha`vDDuc&l!(#3P( zjC*i;SNr#s3g?X6%^9IPo97{yK32l~p&XPY{HtwYcb*l#WuE4r@esvB%E~io9p~D_ zyLEzH$j(jo`UBIw?HONM`VY3QKYa1}`65O&S=SqYhn&C3*k{V>Tl-iQT z8*LFBS4B|n0y^2acc?moagoYixuRr}Fz;v!8LNE|v)VHg8*m45yo-NMGI0Od#}QaR z%cE_~3D)NUf3QboezJ914Bc$33^A1!f;qXKcG#9~bh!(r2FzRC(kYBlu7y}=O}-oE zt{Gbk;jVA7i19Fad&FEewCCrx|>b*K5$3!{@9n0e# z68hg{Id@l-rq9rr6G^RBa0kB9R6B>I%nKlv+Y^^BTyStaCi)_!7McsOuE`PHU6S`R zVlJ9Bg3(ZPs_$eDE_k?U-9?xf@EMxXqkeGn=fj}@`Yf;2;jiNjzQ2EYI23jW nv#Gmuwtsrl3~*s}R~Q$4vWq|RuhW3w0g@1reOvrS&*y&u;~^iY literal 50284 zcmbTd1z1(V+b_E5ZloKfq?PVe>5}g5Zlt?GQW}&{IyT)cDP1C^bPAi;)LmQsf8ROh z-t*jh?tY#{%$^l9Yv!Hz7Za_b^a=}|3>^dlVZC`Rtp)-i5`jQ)@u;cEF`Q$0i2~QQY4s%Al-cA|t|~wEE-p{3(*rc9-yQw{~&`eXbgN4HRLz z14YsnZf34F&h9o&jvxXwT6&-y9ab*o2JfN#)X->5rTx_gTXB`icw+3S|+ZJHjY-H zZu0F&pbX{j`5vxj79hxD=)r%gNjW(-6%#EiKFt&9%8kq&qQgj!+dfdshMTmnN%M1YK%OAP6*|+fR;bh2A}0fm$H8d)+e>JFK`f08gRvXlgl=hPP;7C z(0}Nd#xzj-WblKcoXhDC>QyXvgw=RtRCLAPx6B^Vhty78@yO)6rTJI>A}#t#K~aA{ zWmpHG_4S_6)hZOczn@BRk<}{DfBwhf&Vz}do1-%;+BeWwxWs& z6^Er!x6W$LgP-Z*%EB_7hCx=(%+N&9<2u~o_eD!mMS;q5VZ*V!{*q9X8Un2%!+(#s zy1`$w-k-c7hR6^Y_AzB`ps<_wmzQ4lsmoD>--C>~kvCq`;AK(eV((xsKkkZ6eaNw8 z;2XZ{R>3CyYNfe||``WOxDnC3U z(ENIiV3I7rNuY)^5Zj6mVwORq(fl&BG_fPZ3l4PO{A$$v+xXhWS)$q2bE`Q_kUwwt zvoT?R%xWg`kB@nNLBy#Hm{y4vXL64sQAbEXix8o~^;W@(**^vbS6eNy&N=A(TnVtL z7WY^uRE?^agFi!-=;$QQG!ScGZl3U*go0Z?&RCWC3134cc8< zW3@m9k5v8G8YlZ_o3-`3VkCWV;1B&XFEYM0ofCVXEk0lLR>nku2Fbrr-XaN7gbYmN z_dX|w{DO;GMIgzd9YgRY&fuk#wm*@5mgMY6<#(IvusxY8^LX6BAc16%TMn1#g96#_ zGfWZOZBh@xR5mMV)z=dHI}quJ_r2Al=F9G%7$YlF3q{^^_}gmsayX-%uqa=G-`+aC z-FAX{^OPHJO|0$){xUbKCFeDnSt35YC<)~^Uir|&aIsdze$w{jp2ONBbErk0dWd~y zf=U6Z?W|kvn-LH!zdPjUAV%(G>h<`X{|cjQT*4hf|M%Xmh3qIq8o*a4L-~WTKy$S^ z%ocb8zv*YW=>G^_RMOA#AzM0Z!+w>$+gFvC-w#x&fn#*}yvC~cp9yo}n^Se&arbpU z%%}sQ-S-Rc{p14A!;hkPAur%%a+q%82gQ@u;90r2ZmX@zk=LB9YB}2)-aw|u-t>J- zjJKfb?n!j&EjH4x(~)m_V7u>LQs?&|sSU zU~&YhO{#vpH}5;CROd!c=-?04!#?c)5lTHYGn7DE4h~ll68i3^ELO*1?m{HT7=3Tq zbP9};+YsI^>Z^WU_{Au_Tcd7_)(LWQ`|r`K#R<-6e_C{lU4|2jQKq zf)}5MK7>z0il@gyT#){Dnl7_25PT?vy}tz%KYl0Sx4vw((S_BPj82$|Yn=Hc#Ds);c{dQC$4?8J=T&{gXv${J(ECCSBB{pxapE0Y+3A zoaYx@?Z2xo{lt!=j}FBdV|82P)Dbqq+ts947{8UAVagKUFGlH+C7fw0VIsUejLdWYkJRkJvSO2Zo zNB9cQ>S z1&tQwK+K`?>Qx`sivX-h94BOFvKOE+BeU46?)b@#r5};b*BeSQ1aU+9ZYfaF8efjA zRQ1L1YD&=xWX**2Yi!b>1yCziV#J`yyWeDEOAZHIsfObjg<}pXeXMkRox>{ zN_WrwtO~L6Y6n?AGH|#zXjQUv>^}^IZB@RGd$O!d`vL>-rx*J>>|WI z!D_7KO|0}Jwa!os=@7c9c4EplF}3$5PD7n&mi&0d%k(Pc1;5BUA;%$`G1kLA|32MS zFZznrE2mE4jn&Dbd2qktBDhaNrwI=PM#+RMkGNz2jYr`f)zFDFC55+dP9;T6UU>&NUrkUteO( zNAf)4>>_Ov4zO5Je}%5S2u8@RB^B~yGv01NI;czE--Mr7n=McEKl8{DG}3GE0nVCr z^FG$#=v}4{1RuXx_P-j~VrrO?ut>S;-u9y&T)12f3&+q}7unqH@TMv?)LLk{7F5c$ zD$V)ZBTALGU5^`#{N6Pk$K>Oy2^-Z%eP)TGG0D22kC#GrYcB$i22wZTvlt1MrpE!RNAb+mvn2Gxaq#_{RQs*ukId&|%lY)qUtP~U-5IIkY2d4(4T`j$oZGH`&*$ZTf8cqgt( zXV6jD-MeLlOglFg3IRq@c zm|6Rz%gaYB|B}!txw#wB|3qr*aqSXS+9=JK6|Q%gBLAv@?I=O*S3msz$AtC(RG{|R zy^ZQ$%xZwIL5NHt#?$jTMC3VVfbx_y8*g5t@L(+mHs=X1bbhN2NEx?)=&RaF=M-hs}xYA5*>)t)D%em3d)eBE+kKY9-06Bg`Ebo@;!9N{_U zsD}2qG{(Qn;KKgRAYbRykzh0Li*5&tx3|*Pc4qwOEM=7J{7jrd8am>r!LI19u}gav z|E_vd%UdxexQ^qP&gwc&?Pth_zI)F!Skf9BiIqap%lKoT?|KuMMLlsFeo-erTW8L_ z^zTKoML*AyY-WSq1daA|Lg>WU!~~8}DaTr0GxExuP1r0iO=K5mqBdcP8 z@G7)$ph(YpQ55@4Q-Cnl>^QydQbR%SZzSSbOZhWsS7vLM7+uj@*_eZD`}qmfmX1(F9nNCF}W_B1h3#Gt4B{%@`^ zc!mx^ZAyz2=E!54FqnF6bSxi-_sfJ9uRe)n;{Qi30jTJeGf%xA3#__a0(wJ z9EopAGJSm4ffhFqlgWl~ibbQ66^bdI#X>7cgyiZooRmBXHx;F|+Ns&dm?PuTSV2Uj zGEb|!aUl_=!D1oUl~QEJoI1FKgN}z+sYz=-!i-p_K4$xDA7ATbxU;-v(8}ok-kt;} zN&lRdQG9qfQv1zzcH^z>qE)>D5-O{qH>Fl(8*;1@kDt-*$A0V=sO@;t$x?>toNr_3 z@MCCVbW(o_yME)Q0?|Z-d>bLcCEaHHw*Lv~$wg1N#fH4`Sbl%a06m%1h%>|{5vuX( z3y)%qd{7Q{R%vb)uL&KUD>><2!BFPFvw;n?654G2EAL!A3E&n8ItqJP>ttdpPy0no z%)uzy``O)hFOs5k=g#9N13OndoZngoWsiQ*V9CtO8~inzF}1Q1d$iKDaxCAaT~j`>$+EYKEM`mWF>DiO1;#|?pi`yc6HZWj3D40UB`u$sm5Ee@ z_iRgIH6Ta8wqaxrg&ht$m*4g_g9EvwF6$xK5im==um0 z){H5H&$r0}O|Su4Ay*tiz^DY94ILdFi}hAGzP`HFU+JvL?@->u1q~z@=OH@sJPdF|&lGu9!hCpRC z{d+$QdOK}gaa*~JlJb}Qh2c|(qf_AY!!Q6IE`$S6)FUyClX9pMcl?3_0(uknlo>q_5s!%&_gzx(E z4o#~OZ6}>=9R=_Wh={iZA$1h3kI~k1XAGR51D_I*$)LZv7N+u!u-b4su))ga#G69j zQUr#)%)FRp1{P^hpr^LO#OF5EUmg?T?uzQdTO>>v8Y!s%MKy9bNS)8a`td4kHn|l2$QWiCT{C~ z24C2w_UoFPn?D^bR2wBaiKY(@XW)=-QwQ8xYgMmGORu^=-1&TWpHXyh;usLgB%5B1 zla&1aA|aSN+px7qZIT1eKxb81E2xbdK~qxasCffhb`Hj?fS5jNrm1C)xwp{)0Zq!! z2ST}>-ibMHssmeq>>}gbRVcx7B7I~<8&qBeBsxyF zD+zNMz}1E+ftP}j$w!AlOV2-zfTt>ySz7}?Y8#0Qzu z;mu@_6!H&txXBpzR02x?%RxNfk8XL6jxf36>G{iE8x^>;5*MVuqqp?_Sdj(~9z?o# z#%hXmkJU*W{gp5&htr(r`d*yf$cvamk(NA`Rx_8DUL+^1tAN@}7g!7F=yc1g4A)kU zSiW&@-aOOQ(Z|zv)&rva2)^WcuGf#A-d=d69R4X!=bkqzg+3Z^;?}6Oruco3#48|< z50FIcJ3%{u@cV3RPm`L2GIR~sJ}H@sgO*2dwq01=gA~P;tS6#`Y+rEC+u#Kjnu{`t z4q@_z4&MxoF7rf=z|8b4MAR78OluifD;0rOvW{+@8BgYk>>eFCh&9u!bC#_?ZN`<9 zb=X`#^EPhAS+L?JA>`8IP3IyUHI-Y@oS=_nqJt=svX0i%(;kn~e&HEn0&UGjN#T86 zqV)*C9QcX&G%N`ZsUKG*%h@~=TjIH%vN8@b3JRs7UX!DYkrDM@YH^kq_A1|#u5Z`* z`ue65>Z@c)zQkdP8gZgUr1|mqHU&S;r9eg?Tuqx;pJ}4VzBK@Z;DHzN%^JPfrI=pU zh7Rpf8y?Hxsdl=RRG!qEQPETHbu=s03Rxcb*YRJ1L%-pga$2h4Rw7qk47nbG7vNPw z@-f+AIjgD=tk?g)udO1R6>2{a8Pws-OP_+jhO%Qw(C;Kaht^h#+OEgb#8CWJBikw_ zlvT`D$xPjOT`}MC$(RVfQbh9cp*nj6#k1g@aiqz;Ri018hd&I&ED@~Xsj!B#q@kCT zmb%>hwz#;wG`+n%YP_93QTGY5q1Fg0TmS9EZX$KUu5b9Rua!cMwhx zada(7oyq-a3jSv2(Pf7qxpV97d80(TF)1?M8fj0Idtx1YCS{mC6D^x$h zbH(YfPikcAX^5pp21hx-OQL=Nl3S?mH4Tml)8GWT4I~*Sph9qNhMPDHw@ibj`Lgvu z0sXZZKe0?p7KGp%7NcH}*q+-dA3ZJA1f3=>?hJ!sp04GcB*{oB-Z)nE2uGB317YjI z+ro#Q$OqjLa(_7``m&SKH>iYnyyM(#5$l%>CGkt9;UqyM=wk(kIT4ekX(j4CSOE<0 zg(?m_kw90#Dp$!$+dmzGt|Eyx9)gaWrpuVvsMsJij2ayGYZEhUSe)FUXAzk$ERHjd zGP>V=&{6>81V2M(qMDfWb#i`%WR%yDU<4I)G?Y$Pr(xYV&=DEr%-c%vyC?B&;6l31 zxzl|qskd;^ep9=wlBAvPieNDg?FftUS#Rd+|#%6tNp7{s^e4+spQr64K>)FT?G-%`ccc z(j!_lb+CFWIe3Azz5?`P%i}#DC&&tFFXYI?Xl2)A2L9OPxjE#b?EP+j8?iAq-ng*8 zWMAg?E0Zj1|K&~GFDp8a6kuU-{EF%9rqi_QNq*dUdwdy!{tX}ZFcf{nb@$-}@mZS$ zs>v!vNR*($4T9*^x+AE&^3lC+k0?!U!2Ht(Zp(2&L$EpTZ22T-PPr!~s)g-1v+2?q zks2>sL?py9v@2KDJj(jXOgt_RkH!L_e3L?8ec7mJ86?Fxqss9GVv`zbL`qrwYZ=O- z$9HPCKc^v=Y>F0m>aWP{9?y|$sC)G%?fKmt{GMUR+OVWZGE+$FI&#mpybS)-1%Rf~ z8!J{Zg3sCi6?lGUimAEFqPB}X3jcW6a{+$C2Y4Q%Trb_>xSV~59f{5x-{qT~FD+0} z_4#kPg%3mQYsibe4;U!5FRm3a@C#loftlP*4hKQimV8rmESxZ9i+wGeE<$uNvx zpDxF1zm-Fbb-L3T+Lx2o`f+jbGJ!%MhW=H8sbdu;?YcMjZ#sMcNZx0V__zIZ!A$k& zYY?E^=Xn`J`2N&K_!M)pm%8kTgNsN?libh~orrmup|3C9O7+5Ni`bj4t^gS;V#YSo z6KbbZSuf&bx@^8^pIw4UB;_pcVi4)unsCei$)hy$ov06e6kTjZVA-Yg+VAs0?R1Eh zvXE5f!RL>RHWs(8QR(0~gzUnJV%=9sou7!9YQF%@{7MNE4%$5~g*zW=mYf5$28V}V z4>`6k0Qu_muY+3`fIkUKNv8dAQ$4v3eJuV4ZpE+Ujg5_!Ukql`49cB zjtAD)X+Y~h3BRv9zR`6r^#|g0MPqKVFpkd3+6CK;q|Fg^$sP_B=?41-llzO-Zfoe`7f(^6I^Zwit%P~c#0|g zII&s+NRu(Ju(3_e%|8j+NFX`r05D!%*`Hil1md9YHqL{!;zux3^)O8|l8HGdBR#7M z-l(@D2t{ArzWmpkSXkHts2n{VQ)YuE3>fdTHM^8id|;wQn&Jg=V|zvPv_E4jLSKn~ z_sqmo;i^Xr?Wf)sBZJj;GzAQ{Tm?zt9GME5)Uz6_QC+Y?HJoZJkcr{N4txPnT znrwr=^c094jrD&^8m(K4-vVjaz|#n<#O1VYln5n<;^t+{p2e56>^4V)2fj6FGpM{T zt5x#%<-ry%X#35bgLye=CSh5a8)o&1-on~PaLd|!Z1vsRP8MAd9TdpWmkvURh-A}m zvdoM(e=x^SzKjNps-Oz)MnQYmv%&q1GO1@L(8!N$s^p4RQhn+c&4{7|Q~Auh9Rm`8 zL!gvn0@wriDB0O;DA4gtCRJqAnKCW4?yqjk(wEqI%uL5B`oe9kG9V&yLS^|W3yH5w zOG{BgLqiivD)pL*s;d)w{s?Ba+5gsCKOGSf5me;RX6Sx-ZB0!O-`cwwPa~{b`}EJC z-~o*4tuG!6#%GnUa^8+)cbl^mSh9q1X0ezEvq>o>ek6=%>Vc&`lE(ObifT7zU~F0$ za*<_U`Y7bO%sK~_ntuO=zHdtwq@TrOA#Qh2JZ9a!UC6RsHBx~-2Z=sR6Djfp_|)~1 zF%VzI+s_)DA|mml85|#*nuu4LoSIfM0`f=vBmNgM3F{!{wT)Ch{Ea>y9GFka=_&e8 z2F_$DDdZqNu6S3Lpy`~iDPAYM*U57{iq?_K6!iLD=WM0P>4IRKw$Gnr>Sl*234p{-X2yM+`wVr4K#u}i9 ze*7?mjY1I-wj9wZ;W7{tA3)LF2Hg`(e&Zdp-Gfq5zkiUd?1FQGH+x{Md#GK;jhnLs zQC+_e0Dl%omE!Ur3Ww2vG<)R-KWk(P6~I2S;2aYgd`XPkvg&Mg!>1(}rw1ci*baou zPdCoJ*GcojyRvH6PkA`~@1wGA7bTvdLYBFzH?DlmQmAE~;`ijW9e>fIqdlIwXWJ8! zN1C0GT_NS3b1Zwy*jHm1U8p;LMLUqIPrO`_zqOz)!a)R45p4RU(%3N1W7uUI$n80* zvXET&>L_aYCg5V>4YOgsjkT+P(&k{7)#^?_pGVWcmTt#56NFN4$RzM>qpnx+7@t6q zyNds0rW5^u)_DtKlPdr<9RR5LTpqQyp#VNrMY6sCUb=Yx>qiF$57Z9~<7lSPLQ=^O z%dK>wDjuGzm$oBawcl~MO6!9wacZ{6o&5H*ewweSQ)^p6%>b69BY-QqM4s#0$lP{KC!34bXJ zyJoAD#92FL!dbQ!!D6ktWf1x3Z*Sq|2k5~HHVfz*9Yzfni+I@?q6xKD4SgwBl?Nb< z8_Yc+HtPx0$(9L5cfSuuO-XJtlSxfd`-y4+G2KofVL3001Sb!9u3-)YGD3dd%e zJQ_Y_P!9?~WE~m;`&KXA=+{DVN6Dj?DL&fQ9?N}ja+Mw-M>bq>Xn!4dlboaNV3qfM z?7yPcienp=*P6eVp9GRM8tSD4l7)c#W0R!f!0%tUxw96ixKmFUL8z+1xKDDRrJeg4 zV#<&8Lt8b@QjDLWsfPZ7mTWv)F$dGG2l<_;c6)>A%-IpCKP~sFAO{PjG)=0nRvVWy z0*g65v~%(3&Qp)(I0i$>-hh9(ys@iN2|R=@sNV}v^64mZaS9@LZCFal`nHG7?k0sU zs4$CB;mmK7CeS)4EI2}haa-a6C_;n20#`6Ql^c-`b(Rjyy^zI~!S;a&ewc(qNOm~Y zasrKJvO#Od?dk)a5T}AE_mj{udJK?@s zCqwF(Z4~$uDz1^@upgo;J^G)B-ocu<<@CT1*1d8*xpkCJHMDZhv2L{!5R^auh)X-pv>q879V>2ZLV~cqqfd!Em11AWh9r5q8YocNVGJJ!^wug z=ubzI3lH}TG9p#7OpR>qB}%FCo#0_McPV~lEYfV*{fxa(3tg+xZz!OQX{%`Bl{*<8 ziNZJ?X}q%tPC|7jP%*Q)nG`qp~OK>;x;4ZyGDhMkD9-hsI}@Hv@o)_sgY<7(GZZ1+I1`2)V5b@R|X^D$`y!< zEY|-nKJ#h--VsDIIpiyx%V&du90ujrvk9*lx%BNUX-e@h5s<(LbsF6j;-DlhtvX#I z^`@p{R?jySbE#T#;f1hPbK{DlMS%%q-1 zV6KMxbaBi3LJ?uh^VSAWZ9cu4mSbKK_HqZUX1IH>Zl2WF-(Nc>O;^*n*N)#>H!Avj zB24{;1%7}@E&mK7p^>}Z`HKbIEC;Z{pwNrkvsm@p)V-gg`o26N^3}4Z$ItOtJI|~r z%b(+U#0GI8^jx2puic}9*4F|bNw*bKpyYO{vR{@Xe97+y zo_;~Y+;bTni=0pw+C^vdAbkQIz&4UYem~?n6Y4?R;G$8b4AWzz}ux=0P0NjODiUDXgj`96Cj&Wc5 zqzQ1C_NCv}x*XguHd~1CI;=)s1&XY-i_^JQ?(Nx72)GiyN}w3O99og=_zv zo2U^u|5%m3@Oll~hXTQ3wZ`7J)n&o|P1p2Kn*RYZIt?SEc8isp^Lev&U9*T}No6pr z9O$bWaa7i`TimN@=bntx>dueME&rGwiIKNfdjuAqd@z+pXHHlyf^lo{hZe&Oc~49P6vX_FKlyE4TbxtwyJ zRl{(5t-pjhb7Eyy*}aXp-Cm#+pleNzwr^sdEGpyepl!wfZz$?qwBk`{aWT4Zxz(Ee z(V3gOUr20x3o6FsUf(KRKC-#F`M%MpD?p_4Mw^V@NYp$t@cQhdV)g1$#qaMo-wHSO z+dsZy#5&l`5IK{M7_WS7L${edkg4sjENBC{{)alvA&+R0X==m`fmOYo5=_@Px zmFD(h_I!ROziKsztP&dsG$H{&>X;TL)fIc0T`IcFLF<@Veey=f!1C;q{GPuLvj_)) zYKJy!gfV9naLaOaP7-NWq8F@szsqnNzPu**s!M=JC%JV+j@=<=unAz)tk6jYH-(tn zq>DtZGI6chR;PDcqN

0nCNbrDcv7VZB(soQ^*S_| zN+hro(=EA>zg_*I4v3Ol$BkAkm=$S(YfJxX8mVzRc|_0i zc&r*HW09hK2B!_4!HO^86wQgCkSh=d0=Po=D0@8#&Wnm{bNkDC4UvJ z-D4qe-}ObO1RjxyqdlQ~-XL_KDgAdRD$QHRX{7~n2||IN#V-ftnd9oXI8=u&E-o~L z?CpX1+xo=c-=7jI0A~A~TAn_ScY616#bXybbC;%@KJy4y`F~f&6Xq6j{)^kM*>Net z#%FtJ)q1&X2gelr8kra-=9Ez$nweClK7&cp&qmk3cu-sK4SsSc{6na_BpDPXltYf! z_|tF>#c#T?`=FD;=a?`4p2-G7&mu33c~Xm?vM!?hm5eC|o&dPn=4t!*whr4l9ap6j zi%An39$Uu!?UmW%!~LS$f`NxTApKK$e^JM^S!#$nPMSg8KOk0+`kWW$EoA`q0dO!t z@eJ)se0z)XM*7I+ZY4opDZOWV*%VyfTvfsU6yz#s&D140u#~UyYSHj@;b_dzQIz1z8Tp5w^}p)eg%Pl)4|@XGPb15fg% zWnkOjxzjr_ox`;Yh}|y_@Jh+tLQSsV5+HFE9w?s!d{jgUE|CNhDo-9w&cKtXVaU%= z>T)GW!x$1RBA{GUbsP((;M@9_q^gU%Hh(2PM7HF+p#;{>i(j~G3*21j4?3yYj=M6Z ztuT5((Ux*_|2CW%aE+XeicNhfxLslIPr@4VSd~6_JVxSPR!`8ZW&?ycPL*$Uy(0*j zDIkD%%Vg7xf{Q9lGAUKdB`EJWo`ELx#_xExLi@iwaJf={F_d!eY{}^%Zc+*+VF_Rj1p@9Z>e{wXx^xH#cIiT1Zrkx!70Wt~nDzJ~q zW!oYur0cjXqW;{*KhFVs=Ic(^Kk(DeKKveqfqb(5=BCN_KBuE9zWUAmjm;I0J?l_F zrwFhXwcfuBWJ@hZME}RBGZv-E-Jb4Fju(jWA&8@K?`8{-?(lKUWRpl$WJ+}&;9OXI zicC2rjw4knjFYjdWkaJ?SE5bI-Q?$yE`I~45~-Y4e)qOp%W8QtT%4f%%Qn7X>An&C z%?(!5a3%eZWo|I-Ich8^^lej*k^iIhNlI(BCgi(c2b6CzNd{EVsemz!=!&3vouR)& zB=Dm;?6ZBPPW{{!q76%IkVU>N_qH6IG`K9(so)p+@&xDOUB*9Tlr%%F&7|68-n# zNXRFD@|K%$(}fL-KdwR$v9c~9t0yTTyYwgNv>up|4a&Wh^z)C3n|?sv$`@iy6U!`1 z6s3t{gRYa!SON<2tYRyq?T>kbx$?>4>z<3bSvZ5T(q|8yuxgDLA~xttib4ZZ1AX)^dGms59CxLZ0G^8#;U7TXytcS>^?zU>P)1wI(yY42Xn z+<{f*vAkYicL>cfpHc*fl__M4oeA@<0qJ-9fzS8m9iNM1fduj^;l%OalRte^%)E!P zL-idC)C|d2;$1CL`wY1J7OUt>hp>#sq(10Ejakc;@mPyqa_Z=n6tBPSdP|&~L;0ly zjVOfx3u%4*RiiiubUp0u@r|7z;*gB{`v3!OS)fVD}Ly1~U& zG{ZH|Vc6$q!Tc%^+bwmnZINRi2G@SyHFfXv)C!7Kc1CFaYJhaA!@Pfx(i^*GRyy7A zFqh#sY~7&D$&=e5t-@`AOhV0D&fm}OnRdG}wS<_^>FpK=kH3c1wL_oj<>#?Z7MfqH zrOMPo7e7{wnO2V1Pp7vS=Q=K@gODq_c<`rU3Xpjev-$Q`C=Rli8ay0SXFiNFr}je0 zDSkyDe17Ap&=J=jUE6BOuIX^dHqr9TKM)ClWC0~J#?v2Kc7j4n6H&77=*Tu=KRllT zSO&m&Np+v=mk#QF-uotJD!{$TC+j8`XEDCJv$sYzX`C#m>WYEKZS);yowQ0hx6i_| zxhJ!QXk|%Qdt3p6#Cw9l%Hn36H(jFiUytvEEFf9hx%rw#QrWJ{zH7|$VDQ^Wk6W7u zT_%_SqUy*bT}eH(j}>wJzc^5;glU8HI&Z&xyt%x8j+n%f9XDTeP{WEyy0?D%{-7eN z@Y`v4^)dZY8&<$iPDTXU8IA){%vnBmVBm&OODT1J9|iDEK-`&ZkhRAt1Lp^HQ+_sj zbFav?i{(voF@funr{0x2cA#LFZNwL7ViNp&^kLdz>7V7_rWKICzy ze&}v^y-OsQ$wHJ2@kyGsya@?f+Nn(u)N7R7?GAtd7AQo2=%g~3RC>v-Gr%LimGKZZ zNcxT*DS693Qugh1g+-g=$y~3$+1JVnNkx;09!12H?Gb$5b9}eLVm5!l!wmemi_@ua z0voltE(fl0nVBG^&tcOdR^6V4HXm;@&9A)!9XJJm$Q$2b0|ya#QZ=$-VS7wgo+7#|J0&UZx@TkT=`sGR#Z#cxEtkH31aJ%m37POGv{-S+v4}< z!%x7BONLJe0TUg0B(vf|m&;)m9LY#UDfL?kJGI5lq{GHvdO)xNW9Cln?^yX0$l0|9 zV9jRVI%wVDlpdcO0hwNsq>fl?I1_y_q=#l;V^l`9(P3hQYdY)nwy($W8J|7(l zhf_V6(|FA~0SU$SOMWRpS$&e{!?qX!Lw$r%Gt~AYy8tWHkxCtz_qQeyiXriqrBe;* zhTmlp2s2%`x{P(>Rc!GCj(zrEif7M!1vlP0dLCSwcqx9Iw{}=8U%0Yigv)`tv48%x zJMmUUOgi7u-w0dv9!rx+-2tj5($pvZ^eOrNHd^0e*taT$S3fTg+MjCPrr}=A{&;M$ zUgAtO5!GrS#ghE^?o!KW^cl+4_+w*swcXtvANAMX*w-(E4mHRC=a5Q;|D+0(y+-g+ zvpRq7PSYqwsVm~>?5C^1+5FP^HM9?VS}OhPf6Hpx?;ON{VbU$3QW%o|sD;LNC(%>K z%6!~2oAeOd6xM7-fdGxoAk-3+Bg<7E3U!3^TBz5b@~cFpO$?*!kB)DXqpXpVaGiF`<|~v*=!(E!|43~a!T&8y@law< z#QagFd;}W+4P;uM=SXg1XI;5ig}kAWcN^dh)&Ox&R#x^)3X#UQbfi!TVaROL*{u57 zAkTvS%s>`CUQ1f%k;`*>3|zcQELiIMzwg5*w4Paa1a+xM|LUWQi$lDC82A&e+?Om~IME%L&B zl9ke>jgr8U1qcfywQoc|1ZHKTd}%=Bb+p$6)C(@2nnJsDTE#S6%2@aoVRL^s%ry}F zl5>io$=?m2Wt6ZUe)gjK$O3Y4K|_MMxnEvA2sqq+ygOH1@#i_L|DO>QRc&>guN234 z8m{`ubw@H2XLeWJ{d0|Mi`SVfGI(e*xC5*sFa~pL(3c>S2tI|xQXN&7;GeB+!x?r{ zYniPw+~;L5&o01_=y$#&g?V;6{o9T@FK#t-`TiiB=DTe9<^Xxn$=y|vzXjlC-jL!a z6_-1xpK8N;uqS!buVT$pwZ4iR$Q6gi9ISu}!duQiEi@5aj-oFvX zr_}&Um*G!@c|oKp4x1qhMuGk-5=bC9;lej6aJVD3bAYw?*$fKqMb`p(_8k*lGV0}b z53N;vG?!J*YN~tZDo9_O?u2?oIOL_fqp6lBG2j|lRU>XKYDf;{uT1}};uU{JW9VF` zKXPlxzvVM^yi{|68)X%3f9cJAw3)^DJUM&Ckk=@;p ziL9qk$$sbBp^0=_*@6yWQu8n!#W{nFjg);7t99*punbDiBKkCcU4Lp z)y|lcR-*1Tx;_V7beXrBXn5IX4Y~^k=N6yDrb6>hq!tJle+N15E=r7vY}9{exabGY z7W%ncpSgSuvCtWy_s27nq%M@lyrUp&pCqu)dU4181 zU2B^iI@u$DMt0x0a$)wzUp1XFHZkgTKZE<7cUJ3FOB~r+!{v)Yk>>0#rWm z25$P;cLE5?d*QsJae>Btil#M zh?fr5|6w8<@?Hiv5oP17KaJ7FbvY@kqM;%Q_bMz|2JcONRZFj#8t4KRS1%Nd3L0M?g<5@>A@*zj1>`=e?3Z{oTV9q6V_<=*g~ zF!p_FkHijx9<7A}cXJxbEe-_R41RQ2xq~iFK+@-_V6!Wov?hIou4u08Qljgi$LG-3 zxpTwn{sd6Rs!Q&clVQ}KY>18I1U-s}zZ0UWw$;;@=?4Ec0)>P%bD(w2Cp72$@#JCC z(xXS&D6(+Vg8o=MmNOdQIrGvB5udypma%hCdO=%%1gW^xD>rlXe7&j+b2Doi^`4D< z8zEkIT*Gx~4Iv1Kd%T|V&~9?1oLBTm?h-lM+2zw~JeD6(6a{^6p)~ZMyg4=4|J~-S z-ME5d++I7=bp_oZzvHr;>+WU6ru+VA^KQEkf7`qe5t#~#De6!cXy&6!I-W2J8*U+h zNJil$_Hft#g5)kS5b4e9>uJ$oE2TSXl9vVxU*gy&nuH^vpW~LO7aW|xid{INVtEc^ z+BI2YRr!^Mfi?~<|9>TyVDUcUU}!!V)b};89SKx(D>l~G?)C&?(hIlWKoc$VHiy2@cxBo7K`;j+2R$A7y}DMK)Mt>MfoPtHyzO zzuV8;BPWr)C60)|l|pk<&}}ZN=se}Ub=7}FY6bQHKFUU`4>7JQ-9fT5TyDm@26L4I z){vjNi+Sgo|fTnpgD?|qYD25Yv|tQZnX<^`&fG4 z-Nm#sXA8{fCXqDZ~K!xa0bdVq_cT@x16|TdT;Zj&;snw;e%kPao|(+vPL%`!!0pOF`8{# zaJ(H`9QBl9fUiW>G%|&p=e|>|epIWpIB|A;d}^P8fr@I8+bPzU68N_F(Wm))vw|4J zhbstwdxYrM%auglv~&K;EjaJn*|l4-7$G^gq;0wDl=~|f8FSK!LSuP8Oikdu-YM$w zc(oBMl-GY%-0DvS;fP+mdfV~y^4dz8+q?89mf}u zI@xY(tj)%r_x8V_@^;ENHQ>JtHjirh-yI)QwzS4~X1ot~`(9%3pzEvrM`lo2SJUsI zlL6kqDbDwyFO#LYct0VcequI9fJil@C8L{j&Dr|F!GP?F5|CY$k3Qwp@oMkvLV!u} zU+bPU)2H z?(T*SoVE47pZELD7w5eD54JyayVttbT62s!=9u%+t!?sF>^3iomoN9*Kk?Re$Ai*+ z!~`cfY*fuVp~hjhtHQPU?a&XH*Jgd(;`TB=Ex}8^XQ~%Z15!G^&lT%W6|YEIl+$*) z+XcO_bss~YdMZ$L-EX7MP;U-yD!vAX=4t5A^%^TADYJUtzg#WxeIx`>cp$LwEM9QA zf_TI6cHr@q;avD}y*Hf6=RG@H1+6{!vLlwYB%S~*&%F9_D6WH=MuocV zp##e9NJ9+*-qeHXN(pB}>!!^stB1#Z#)*juE{Dyx5S!=;p96k{*A6+_E4M9PlA@>5 zXKld>>}+X#z#F7EVp#uGSbZ2J1}NPrr3sk)WC7X9 ztrud(+PkcjU+@0%Rk)Pd|e>vfj2ekzSTH6Fgj<_Gj%&>Cu3 zx6v2+6I{WkO|C^^k(O50WO zqqt){UN>{l1uMpJ*qc&|fI&ZYI$e64&XjkiNWTJrY9>%geDR&}p#%2` zh;$VDAtt{9@}cqjGH9{CeBAoD)ZF~J>mG{BBH0yQj;X+Y1iSc`hNJPw38KSb(rK6J zNq3asNw2{?c zH;e}9Z+s=~cyB}io|2s#NM@Mku`9`+=fuC!=G5_G<~Lm|>{dJPF~O(W80n>Ci_*4r zk+)!`SPukpB?ouBsx_H|g0GfuGQ#TM=c>-lh7?ZyD9 zpgqmmg)0wxjqnMEvmLuVO;3iTlgH`&{qy?+_38snIwGFbM>)$Rh>&*dt0(g{|8n0C zSPY1sFu`HmSHo(8F4jc=C}u#&R(q>WjUColtB4=mWIVcSx$i@virQ@DX;)~=3q2@2 zK0Tal0Be+?Kfb;9yt8?{=gRmUiaJxbPVQ>vUG+hR!0fk2tC`qbW#%vHx|V5>cJ>YP zr+r4LyA2y+CA5SU+Kl>^XF9j(N8Z76pp!hHkiv)=&^_SsU*NsyxnKpoC1Yl`s5E}8 zKiNnI()Vq7#60FA#&Ly>mrA{HB<~_9v$~YOuF{8w z8%XpPFdHWQny(|8^VwEd7=)>CZL3@dxP;bdBvR0XW0;jc>a*qI&;qU0mUZ_p^HN)3 z0r8q8LS|;_69BeiM&85}HSU#U4<0oXpC|L?>%O!K=oqUjH7(Q?!!>jCT8Q^!$q$5O zlU_d3O`goGgJ-g2(`E)PYicH(+HiJaWw=Ai-&RKvl=&gbW_F$JEezP-Rkd$9OLyv& zx%niCd#@k>c{Lyb1wCI4dU}**iC7*~NkYE_9NbP#&tLvjpi5GXY2WLebsW@NEU~M3 z9iUsC%BiUew`3>5ehfjTaUEZlz)J2T*KPEBq;n$=F~Dg`NJ2pB$Na1?%!Z_HwKSq<>&W!U}i~&pQ4~e?cKN zJezdiBR45&^fEj5%IroBN`gVEFx1AqEX1sV+xq^SFUS}CC&sLc$1u6DioWxwQ{d9q^N zAJuTE;m`+N@MA;NW-c7 z#JmO9_lbN;rSb`s))o{dD*FjvB~y&@jYSXNkA|pO)NDuzaU-D7tfBNIIvXj^SwX8SnSp$^oh1Htf1b^MzvH z@kjH4nnQ&ILmFr84)6G9a5cSQ@rg^rv8LYB(aIA;;l=Zo?voguP#-pR9EHT;b($4@ zCB|#I36c?faHRw)t19iI7gOfrjau;(F-AOMcXu}yF0Ob*&5fG;`ulO3kS^iu8>D)W z0e(t6;&x*ntXTJq(HUGq191!PL%kd474a_F6c}-@evkNa^}F*Zl+vA-8+=!k%!6G5 zFSBn(3d7PE@xF89Dzd1jB-g>4lv7x<^jbum8JU&NZ|Ki@_=hLi#r8besx8WGPv5w4 z1dZo@#L??CC-{qIaW9qK@(j?px@8ae7t*Gkv`Y@|lEz1=jUZIJise1k5@TlyMI0k- zX}A;(#1@y^?DN-5Ci0$YY_-%sP(9o+wTc&?&`!A$_UO&v6My-Zkui!21JoY~yuON%gIaJv zCqg0=%p`$ELm)t@V#^O;Hq&OZ?p2l44?F(`V0jS@)mlO{IPdYQ+tx*{EPv=i zynn4O%9yH;*ZgL7XgKoSSSDfxECS#qh&zJ~Zo&~JKo2hcH3Pfku&ElR0mGHBLr zHo?c4!s_9f9CU>4*oGa+&6?u99=lP0ltDWzEG&+l^`k>EcwH{4@&rG=x%;g{HFU<3 zxb$46SL3&ckJgq>53?$3(a+vGqIV*1lEXvQSl|c{CR2O){b9=#83$Sn5pI6`&LGaW zA$8#^kFdWvV>WZzaGBXCDl@KVW0a(8YXDnOD3xlp|7;QHKfrGhpTF-Nunv*{r|)}K zb<2|9jnK-pCy=)mH!$-LuPunDB`JMPl^Tr$1 zKekKU{d3RmDa!6?@C(kR9=6CY=K&2AL&1yh4Xw@xXGLthQq~Vr4vF{nv&xhzC#3GH z5na~H2&EM&Bw8%>N7XtMD(9X`6(%WV8WbY8WH@*Hf`mgtj7FY3->IKebQxJUu5>y$ zLjvmZ4vCt6Wnu?2(zLf5>H!CvLX|!)C4qq4UXLfu((HTSP0hEHzjUQO-qN-{EhkWS zr=}F-5F62rNlV!pO@SBX`~2aB&0Pmg+{nB|WMS6zr>O~&=TqX0!yg=LFB=ebORm^< z%X>Sa70F21xCj-_##<401kmu?E1eQr+ds1+2s2I3=b-N{g1Lr~w8h;+_ZN+Z0k4m{_$w zSIei5;WZTMjGRT-WTNFrLHdt{HV^584`S&Im-kc#WgGVKM6w$t8i@u>ZF-nBNK|~J zo(A!3ZzMG~Gk||lyt~(y++fbSxRJAo$2&DLFxT;2e{^s;KUs7@{4dP-%8&gUSNo`XSFEu8V)gHZ`TfWT~AGT~A9X!Xna+uaE zw}L%W@3_6G07uKbSiIL=e(^(~@VR1TZd^9swPG%ESzt~dSU{2f;_*eU>@u5 zyaG+ZJGwuNab&X$!c-B6d94@NyNA;_e-*TNJ#XI3HJQ&@{v5K|rt75Uc0Z?}mLoP9 zjAu77peRdnyL{T2bG)UXZfi^OtH{w}{~#{zzMVqOcQJ&X`7qDzbG}H01O@yo*!6rc zeQ3R0{CVHrG$Yry6o$&Qg#s7V60c-3W%x^`j(vN1&F)9ihXr}yft*Hz4(|Mt%lCf6 zXB6GnBX@+M;H1gj2uk*Nrm5pHz5G?+t3}P#S*Sd^tyXEJ?DbITX44pXEADAJ`1V8iU90irH_8omgsi0{ybrF2j^PY`)q$T3 z?YkmaHUt)yT?uAw6ZQm_f`qCjhLb~kS-;XKYmZL}o~d10CsxKMz6Lpp(>Hdc*tLnx zP&YBEgRxe8IkMuXyIa0%HGmsZEzCr(i%%&vBgqr$dGgeU4L=={%0xL3#%~uB9DAVF zJPI`~P2U&}3$d`E<#Z$Bq^5o=&Y5ad#*CUr@R|t19!WQw478p?et7hg;j&2k9$gNK zYorek03RZ=vGVUzVbMlEdL6R(LycPMQM9O{jC*ArADb6wd7jNMJoyZt*uDuNg1^35 zEs}fEt?5fxP1LkmdyaUrg)IHE>7}pZAVb}Y$~-@B-P)=YaUn@)$q)QEh-nQk$o9!;ff1<^Utnpb1%x~RWYZHmw9YT^A%N()l#H8zXNx90_q6;`hdU%$> zd}C4g_BXy?liWhZ>y}3@ng`<9Ydz?BY`G7JNKVGY+w>NwAaEDRGR2*9-%l`5rL4c(4jD-yLl^Ujg(5dU?D*jJF zJzn#@E1@`Sg`tJ~v`w~bdIaI^Nc&f^g-4;w+9U_+8#bW{l$`;^QagG1Ef}_@aSDm5 z6ki1;p2biLF=)K5H#^QYdYNd8UhMf67QC@gxoxxEa(D~L6n-1WoT%Y4YOP+)=EVH3CAG5E&k$Uuk3#KE?~NNkp|d`gN_yNUAKH1Eu`I*q za?b2oN`|$v(nQnk9t+)}aFD^XJh|PrvDx3tdifpgOSI2r?wF`w@5Wj#$)njKOVVI> z^@vZjY1SjLRE-k^W;8zu zjO-kn*9l|6Tjo@~v~%kejT-$q!6uN9PD8xw|9Gjyu8>qr9n?a9hFwR=hS3&>;=y+n z?nxO?kSyU^5n}$}`i90S=;R&Q%lInruc!Jdm^4ECAXG|}aEV*1hdW+Enf`cAkh_5# zqn5OS(53+vfNf|VuviAAIXNI=U$DJR(^0LN!y2mZtq5C@-GX)9*w~oRr%#`H)J&*Y z92I`4aYgHYHe6eo=m{4XZM%FmV%rcZ(_S#VE#mFu6PO2t`I{wlgbw0Tqpm$g=_N2W zD465uk<}BFlrGSX<#}thiQqAz)7sqo(MmMf7#PANz4lZ^;MdDVgdb(ULv@k9b28#1 z{6SNl(-y=N+!fERGVUM_P*N1Cs4wbVtX@XtC-2}dc%>_K%<9>|WNsvykH5BawO82}=u z8J(q4%I?20jQ39MBsDO0bQRZ7fjhf&+T^Mbjwv{Q5jmj}A>@$uURiXLRvs-h(CY^2 z?WS6ZYDGbAE_te!nUz(96fG7mQzjL;Lq*&3LtC_9Oi|%0SVvQz51-C7mYieb>!a46c0W=#nEIG3-bYeS|LoYFF&_^FyY!=DebG zdBe{KWi|X)t}VS<+ibIPa$7j*@7-abVTGr`h_y<>T_ zKF3xauiS15p)$AdWSnp)1|Qbg2eN3QkT=^!r6I^hIb5Gn128 zzIRE!_)DfyHWFD%?P{xwbFR1TJ+wX#gGiRW){U5)?2FHv!(PT*RVP%ne7=HmRl%JN z+t?gSU5TnEJ55YSTa~=4PA9HQtEkogdI8*sZ$ED0$(?sdMcelhweRV)UVw>P!FcUd z$4;FqPe-opkFHh*n68b5x5ut8Z@lg4*sbOtyo2su`FifNEyk9Au3STKojrceSbnG{ zUpmK`%S)*qo|!0)kKU+Bpuj(#HJecol^f*-_Q8S54OK2q2;rNWrm5duKEY|N^@gdkf6!l zlgCzs$B?KpAiaUL5x&(fqAHc??Oau$%EfBviW@G9u@dgJ$^a9UHo&S>e3>fAc4IH4 z^~+J7wnXPr`9%v?s$txsi@mV(g9B92rL#3qK>V7HLWQE?G@r>kw3oz}&sc$slH5_@ z=-bgjKs5# zarGzV3|%)b?q_K7q1SJ7J||9Gw`Gl70Ml6me>VgUurS4PLy0^^EouUTvydu&@RtIM z*(Ft$q-NRV_&R}Kr`f&}9W)rv(JiAgt8@&bYdIdQ3nV-V;Xwp>G*U|Y#INixIH1$s zqO!4OT%pCVyn<30RdW15fthLm+G0kd2IQ%-s}Iy^(0U$mm3{2lFJDP6$PN^JuewTw zzwY(v`OTm-p1X#sV5cB6naq`)+qbm}5B;j=;9c8x399J;)!;`~c6RKWJE&@%|F;r! zZgPv~NCNg{^laE#x1Ot_ToH?bc64;ab@rB&M2PlX8hP6Gwtql%AzCXzt)t(s{BiBt z_6-oK`f0B{Pg;5_4STtq_p!3(tG)V_Vz-R4QV195H(&R>3aZJGyqscIQ>$+eymS9O zl4bg|$o+KNTaCp3z!r>ZinlFp)X|oxc@+}~EDT|3=mC>^5hKJdeYIM`~(yEkc7`H|@^QeeXOH!U& zBq)}90qNyzo9}ZKGH?AG17pKa25Ur2B(qMqdvS<*c2r<;0i|nSN8o)~*+5@R!65ro z>$t0fy)9!i7aLo>_j$+n$<*a|vHzDpT!L1NpVJ-2>o_Gq&SJV`G(Yb(W(eVq$mVp$ z5EV_74TWjI1B8tn`E6D;8X%nq$J75uEGzEwpZOnExB9(;G&Xu+Q5?tG(FMG3d})+y zOk|D*eJ+&PqN0fMLKHZN=8XOcXqJ*l{&jN5XV(Os&E6IPbsbEn(?z)M@4$fO6>Se3 z_V1zQh%frBpFB@|bIQx3cx~GF*Cb-71vXc47OwM& zH6u8|UV9>pnV#e`aWL+nE$6)`29Ejt)x_y=w^_;3&TyI9dk&VyOF*y0G95HqZhC5J zN~($|3<=Rf(ZDu<>Cp&V(LNYCcofS!ee88U;A)GhuM30o@0D-X)v%&?h+uymmC~&KeEnv>;^If|TCJ)9cUnjS?8Jn`zpuQaf%_?aX zNbem)#(OK8eT^hvy1DFmMD18{Y;@hVwCw`6S$5Bla@8r?a1|^v zJl^rGv@*tyJ;eL0Pp^mfI^FH5U^lUT)Y($RyYBej?A2g!ac&77_lS97o zjCgv*4)uWZcypfM*yIVdFtMx@6j!Du7XavLmDVFgVkbvgbw}LYe(bqVaV@j`oPw-< zXYXKpNAUOzkV)*E-%Pg(9Y5*>TOS9owB9ke9Y*{*BY9XIYmwYmhClD3ex>w08+Jwr z7TL^xj(qvSZ1b9cC7uY{jr;hXrIlOTR(ofyMw}PFdzjo5wjqg@7+k53vJZT%Ynk#J;Up)f*)+ioXCuid~J84TX!l}XZ;-h7+@0^t6zQCMu_s>-M#08T4{Ok z?A=oRxc8s)hxrC5*LOBwR7(l*W1st75)jZEN+V{A(Z;k9PRJ30Hdflufd&@4u)}Bn zvh{+h0BvJzFR*7#xF@kFwMgj}38n$xEl??duCELfe6BD|N2KoZG7OW?bNv-exOm=8 ztdqu}TFD$NG?_B9v3Wi6i?fX=BKjFuWqozxYH<*{aHX%nMz-}<~2vBH1IWnDX+ zicOVnqXSuZ?^jY8Koh}|QVRq#5~AQfMMOHP5H7fUDlrHI*H<-GNa(X79SD9}*wI=p zyzF^FUZGUA*Awu_S$jH!@83I1V0lz06XXUSVnba{r8NtgXp?XrGSs%U&affvtB#I3 zo6p@E(}%u_juN_j>5IQO+hG{3+)f92(*udvL!_;6!r%whr(UWTHjhlUFVwQ$J>I<843%@U7nsR#Snr9< z{B%!J0>VP z$iPt=v_A^v>t=(ko<5GEc3~HHm~T}Wub>co+29`b&fHEnwS;3!7G`(fj_^4Km}YW! zIO_8D%4IGD=(htuvAk`ctyYpKG)iAT1@qMJ^;X_tt~bvb9q`NdXL+Wd?x_%WNj*Yt zsHAwV4UNqbJK3}r0vpMcQfAfc_UU(PiPNOHzla5hiD1#!fV(VzUmuO+;`g&fR`b~Q zgeDhunI-oMxQ}#1R5evXahX8#_9FW7G@8UbT2suxP=>r2LyE(y)STk7B~ z3YH99-ZHxI+sGXbdm{HISD7QEh~R+_RqQnpQOjj*kKu{0_TZi1*20hGio6{Yd@eyx zlCb<9+;VtQ9rBVGHrE-AWq5d4d-95sl9KPqS@0q4ru#^6);XX;V6h{VQ&IO}0Cm{6 z`oF{}!iP$c;KsYj%q=M$9eh8&vuqTb`!lnFEoyO1B0|SPiN-#$@F8>qHT)kEBR^pb zUv{RtvE5tX(bH?Kc7XYIc1GU$9uxY4H`IeNy;BP_J!nVRf$OS;%72NLWldH!@W5uA0n(y$v#mc1)r3O>Q%G(cpC5FmQ60EVRA*}-mGW1YDdz|a;cV`c%H*NGAC!~y1;Jx95cw|56<#W8VXf9ctj3ND!%k@cqf?q z-HpMq!k3|`gX_SIqW%4-TyH@1bi@V%kV_ij-jAO%n;oQDYE72Lf|9aQ+)hO~B{u;? z=noQ7lTxJOrvlK;;R+%#wQ8dJu%;Yd|W5AZu)hkGtE4> z*C3uR2o^rV{k!hIV>6H^80zqp$)c0_il=6ynH!7(g#J&jkHZvgNH*HT&53SpuyJ=I zQf0)DBn-3WNqAUAsBB{bwkusL?QEPwMlUTb_077Snj$62o7zx}VQw6d2*wZs&ct%W zu@GvM1{{BKJf{b|k?yoaggHt1xdUM=fhX*gr4TT7g=EMTL6otq?>SObg(=kP_3LoX z&d;xL^?ZnbX9YX%tRAZ44cG!qP$i&jrenV5he>2ZnGUj;*x5p{auKKHa?dVorD{VJ zq-Zg!d4WxrIj2wNt?<&2jHBOhzS%F$rt=ByIM4Ve@38%MGotQYsxQE=^u}z`5oV~n z99<1X{Q$6NPMGAy9Fd|I=`aPtZ;*;I5bOZRDFMcM2EM(#gTtZ|T9gmLl7vB`%hJmm zp~H&ND@>{^MjW`%{=0cdEVd}*IoPor5*517^K&O$up~oVb4}PF3irBZHv4JD|91<# zSi6!9^OHkAIIhVL;b&{!2+<>O%&u1%hiNCp12pqWG)-uG_LcC zijEweGe%`xX09<>STws?4tcX{lRJs61RJu%FFQip7A2tr$DJq#kn;28R~2dvEPb>^ zdNTDfV(qkE6Wejo69T8lSMd|oP1S*8#+pG@Va1_Q6#f3B8OxPh^}x72te>nyvah$} z-DVHV-{Z?4r5U?S&&v|(RZS#HNYF^nKzXyJhiJ{bUxAV=C$QZxT3Vl_IpG%QpBC8` znCBroZ?z4voA*@Nkm67Uwz26G`_H4#`Jq-42B&I}Zk9`P{wx9pug|dJ^T0=V3LMf| zIbe4ZYC$m!U?+yR9E2c!ynq(m_F9gfY6KkO99ysSTI1NU9 zI!EnNAjuQBcJ%R(8hi_kPGusgqXOAZsW2;dKRVQdD{IuzCCOK=P9GPRy zj`9Tm)7ZRheqH?R9vPSj^H$?v<7D25paUJ*CZT%;i+{Vy*;m3x#*1Iu$Jfhyz15$p zL~GkSHC3zD8!#2ogF4AR7<7{AL7#AVGJS@!8sS+Li26P6K|F*qkv{bm`K}(wz9fzz zHi#1(x9)*hp+w2R#rW4`zHt1?fb9A5A2bP;#G4SHvUoRakJfQQOFhbEtz(Gi)C82d zJa_k^`F-FXJWqet#duu?q7q{czF*~xh z_6n!Ohn>X_#n?4l!67e1Goz(Uk^;AytRrDwgXzG!?jgUJsHlS?zz;jj0B&xTB0|PW zjU5qqfd`9s(Kdo+k7V002hu$*GqRiXSVfg#`4W8Jr&wJb=rV#AKVdE$2nph5a_M%z zw4)0P1?T5i1lMxehbQWrrg}w#=W@wr_wrfQF+g~G3G$Xw&@YtM!l7MfHuU|9GD!we9fc!L{6@dox;Gx|+W8+~YR8GZ2 zH!nA?#+7ttmf;v^&4{j%lw--_8=8}%egZL3qdNd3$W|Cm!xA3pL_cum$uwtSZVv+-fZpRo~@`Ez|#2uczK^o`hVP{Al$zy80V`X`lhp{PuF%tNWv#ku2@! zxkeo&uSj+$1DZuAxrgNMH9;@G!kMN2p3MCPF>xgzan#9tcy$KhZ0zD0i#}Jjr>z-!{Wz4pxVp~v!r`W!-Tcx3 zmEY7Fbg?+GK<)}JkxB)j)PuyRlf>V4dm+G3&F)1ar~JiR8oNJ>3PI+~l(&FZ&Kzy% zIb4Y5lf?cthjR)e{>~_2WZ-c6+RcE@5JJ0vxLf~k5OXlZ0~Dl?x)r?bBSrFNY@aW6 zvMqgSYk-*K74dG3#NK4v7zqg?C*|Hg4yr5zmQ|Rcj3U; zTn9>EkTW&#cj&Rk7k%W>zy}<#|0|TAv|MvL2HB8vL>oFuN_Gl(a$=RW#KuK?d(I8e z0iWj9I<#N}7WZ3T9t9wqmIQ38$(N>Au>AM5jX!)r!Ru91#fn!LNPauD}39!(c5z9Zo5Qp^ z`bpg7C<#lS8~cU)a6wgQMLvjkVGvh!8ohbp-i%9sYOm`hm8<6`8(S zBI8=aYJp-VNq1mQfW@bOGWBT;;7K*gP=>#==O*MLMA7nTE311iJn|)A+EFZ{y?f9^JRJBKdnii(z#0?9~^9IN30 z4BByVC<@*8%AU6oZi>j+T>ZaN`<^KHVb+6aD3ILYQO8t2iL`?>)*;U*@f)g_B`4Jq_e-Y z!WncjbclE>O)5hfADWSJ5E?W`#yekoB3EvVzO1zsY!4M{p&c+I77!9ysqIF++=#d0 z$I`9ce}tR$F(OUn!sDuno?a6noE4CKixh!m7eI~_fi^<`a(*PgnU#AhqYVUpV~CYU z|0f_F)edE&0dC!%4tFG|h`W_S6r5CpoB{EYEAX+Ed2hV6kYB70R1HFZ2<@ALboGp# z@Wol}=wO6`ssX6HdPcx7mRINxT>RSL%KkkoOJKKNx(+1jUOGFQD6i$A=_B!3ZH%Lrdrgl?Ro5v6AUue{g7@WM=nqa2$>pEuH!y%1bRPPKrbV0E@JRIi7$l)W} zQjmERUx+GU&5_`*m-l$7lEfUAQ_hD3f|BFRDs#mL*Y-wwUD6;m{D}QVZ|R^$yksjq z@tXLsel+rIN!oN{iZoJI_eaG^WgwkPheYEhAaYju2KMa+T|z9vzcajp#|4*q8XB?+ z89)D%m-fR8KcQ$=_yN|go)C_ExCg`Dg1@$JQnvSc^kQJE5lxhT%1|JXD!t>eA29Ly z)Xxr=ecH~?VkLAI?Io?<2ia6^e9Ou@{;uHQd%Oy}9)pCVZ~9GByrgdy(%VS+CgC)X zXy7fmy4w2}Ek>0wIZa=YLlK5ja4IB}HAZ=hyHtCQbL<&96Jc9hOLH84i?GsuJz%JhY5K;Pv!d(cq0d!F_xG-f01+%FJJKPa`_dz`(*8noF0Pu;o|hu zED=8OsCXv=$y9{h59Bv46hnzWa$iOfs)I*SrYYjBt)$%4m@J96-!>Uy(j5oo#=7Ix z%8jS|w3?bc@;{2zNBPVR4P6rKH|PJw+j)8)1Mqhil>@{OgZtH&&u8~T6?glc40nv- zrD$zL6nQWeam6P8uF{lPg_|5-7Wq*f+1H7z*^zGIx*$;qj=1{5utIG0!0{mD{V5l(c5os)dNhbGJwg8!u#4lP)6F08@ zCkvA5>efLWLg21Y|C2Gd^#MxaB${m-%g{pM2RAzKE87f@Sk6u+NEy_$LvVd)Xb=xC zJ;fbg{OrLI{8P|7g11Y6Mc1}I_=>>Q;RxCF z-E*+wpo+>rte5XUQt{itEvg#O-z``B5-R?uG`_>Qj}F@0q5d?uijRM@H(~Hj)vu)T z_a6e{FbA9**$ITN6Zn_LAx;Op9#ommmz3b+(!^u9-J*AtPBd!t5u5z8W1Of;@xKwp z!SIhW@Yx+;DUeq~9)#iC0Lh|;AK*?qtU@$7@c4_}q-xqXL|lYXvjU{ESaUn=V_4Fd z6U0r4#672p;^mcf+nOi-l@IJNWSg#HCmU6+1QMUhyBcRVy30qD-#XeKaD0KN^p;sSx&3(Lc@)qs*2$kE%a)R|~od*1NG{u8Qucu&VZDaWRKaSlK`1pddjgQg7cGQH!bQY7ZEpSX&qJAmXBC3P*08M12!Bvqp&feNr{0bt9||N5cs zP2(l%dr=iMaZ)s9ovb@{UGI9z72{a!^}3B3uT@x1psbJgx*1=f2X63~P1lxWz%-UA z9`Kf;&=!dI8_z>Eod0iY529^NTg7OS@&wmp`a!@xejPc(%t(w{_3ePmb7v%LXR*OC zo!>LDFw5sp{a~Y|Lz|tioh&GAaQwKMC~x~E7u%wAT&`3+&31l$;if7evRPA`XIyK`0Ds>06ezkse4`GwGjqb5 z9@DL@BQ%?ESKa|)oOMKWUFC3CR-+a)MbxQPRO7!WI@rA97 z=qAS7->xs)t=M(T|7zub+zMhV;sx@|NS#9rpRX+JfV`5h`$RXf3P*r*DaeEl4PAY1 zV0P>UDpH`i4I?=~LXd;sLJfFT58aneKwxcD>{h zTig`C9QH%=SC>@rV%#OikjG$@QPTsete;v_!(Tr|+SYowx8kT*t$?>VX`;1Vmz-H?#4Q5ho{afg4(i4?@^#UmI6cR5jCWp>;2cD-a(hqACK@*v7sn&4BG0o{;>00c=)`6lcwPr z+nL-M4>@qi4JUpUS4WzhCy+CS0jTSfj6?EjZNYwA1<pwl_KgY%O(dU<{iw>dlI%J4tMIyBExb8iWQ#-%(h2gnk}e&G~eU62Lw*7#Njq} zpj^<24i6nMW9m~@GfHWB^5jGfbnC)>TmG*wDSH zZgbaNeDc>8ziiShM+{<@`k{|!zwrMVU`E(uOU7({E(nILN!=5U+I|HSdxSh3H$~T2 z&Qt+|TBb`OCa4k`TH3G$!1R>h;K)U2Pk`o~K$qt6hrU3{1%4{2ST9XXOcI;_jC8|l zgm4AV-!CBYv5F*&W0u0}zhI(T^*^%+p?^q3EFAl~PQ&{gXQhVq2Dzx3<{ zJgy!`Nzb!~6c+lcJ?SBx7`3=tjdmv2#p|8(0;Cdn^|8|aA5&Nr9U)~oYcEv)(HCD> zP>&dXckjTFw_sT8h4RV=Ri`?$ zwQOL!wzy$J5{fUKjb}yRo@7rk?OV7KRVX$c=`DbA$GIJ}Lj*D!y_vd4E~cA|VcK`zu&^-vi#qU7*KSC=gP|vEP z+rc)U9sIAtdfQI`sH&$5$9Ai;ypqPs$6~m^&{F3sti+r-Nwl&kNw5k>Tk zw^5MQJvTn_ljVvT=TdHNGSQnwCxY0Uet~e{!j?)4WI^s^huc&Ah0QT=75pYFg_@s_LS34~;ZPgOr5QAV^9{N{4i}G$<{dN(s{4-HkLT zof1lScQ?Fs^#AXDcicC|eedltM2GBi_S$Q$Ip;UOIoF&QrryzOSdmRX3$Z@OoN)f~ zpsKgJ0GmaFM?lob=;`6jM*`7OoP(wl4CvD!t+#6|UsE4X>1k^AL0fuX`UBTJruN6d zj3)$n>`aIpoz9eqx$|SaS9-|n&MMNg*khr%uYoNu>BEPXix3OV63#S!X>9}+IkTR6 zyAIiLvM%RTe~qqiMmx~YH{~KtF{vdUpni?6BSB)dmSVi~NyBt2(^QL2bY75Ew7wz1 zLNCgJwC}DFFLEu14E1x3RRwe_7+)3ZwWcoI?K?xPX6xCucp~qrs;Y`X8{?x#GnjUU zfOhS1T87NPbi6(dix{gNoSe~bipXG9xd~Sqtxc-^oMoy66Lld2_{naVbBUp;CQgst zNdJ?9E-pTq6H|9rlHZE4s~)0-WH?k&YETZJNAG0bGVMj&7Y@S{Zt=M2>SivqXPWL$ zX~=KRD`V8am{u*0%)HLcLL(wT5q{^TBNvy;r67Wo6Od)P0U;IiOpX9qDm?QBn`lo{#l|C9e#`+9xt=6UEx4qBeI znF-!#q<%b>viY_}`#B_}0c57S9QV=zUe&BAG>Q>c)eq<{qGItV2IjbZjg;A74K>{dCoi z>DiVmn{;^`*V=Ts43+w^y&|wvLWVs*y2P3;M`$6%TbovZUwkE##Nk`JS5L?^sfruB zZ{cy}!JkkTWiEo+U}(76!RX6drS?QS%8N^=If|Vv>+g#>ZS$l7T_%lbE?-Sdpf??M zphEZ`ZciY$!w>Hi)Z&I6dSi;~>*GO>hZk&Y!d~Ezgy0=sZ^Ro-$y`JRtqk=9B+0W@n+y@@jB1ym(`C+qS{8oX79{Nm#5=H?V3infPqy@wDX z3L$s*#wZjjC9Ho{*uR_tpaGCDf*Lpx+O0l0FJX$w9j#P`H{N>Auw64 z_v(kCqmO`J80`CV20L-!Y#ZJduMV-9P_^&B3jpd(A)-jT!frxZc~j- zbEn{pe+{cSAz>FsOQFfP#u^_}}KRj-5x~q+*%h{6i@~z`+Pmg5>l&V5y6B;p8ZOr}4G`*1=`# zux?qd0qu3JixD_tR1J~@9bCevmHEUB2NC3v-@u;R|6pB zsv=M>8_TLgkz{N3z+l7<_IwEe$}4kQJUNBD6(A>rP3Q*<#4km;hECMCWc;J5o?K_C znil;}TweJR&e>>A8yy|F-~?)ZN62xX4k~IQ4dPN-ZTHtj9YQ-Q%uk*T>0~q2u~B!8 z2J4-{EY+{JkhTgYKGHas{9f`e-MGyCe@Xm~9MAHDgAM{xjiZBoNq(&0_@CeBEkz|K zmoE%IL4(QIk9+HbNzeb22j2hvpFA+HeL^>=D zR-|Mz`gWig{ZHB=l-k@U_<puUc0un;O8IX6x{Ak3J zh0r)8m0CS20rTOWtyj`mo_rO6N}5_)8lY(t6fw}rB`+qJr5cRo%6`1+*UPQ1r?{^s zh%EZ@*E|p*+NKdN?{NjX-i#yL2Iwu8C_~9&F=!zbnM(;MRSf6%;swjfGtURH=n<*@ z{N|mVH>9xGOaF4my{W?+(6Bo|MDdOL-$HiET2len^8W7Z7u4w51I#&p(Q>hLaYLX- zx}TX_9j!F8{-oj7F*r6SH^eU0h6SAM63*s4`4e9SJb-4I0uY&1rKI@yMYYyzJSe14 zPF=C%&NNz~qooDPGE~su21X8zOBqopzBEy(X<)f%sDc$R1!Uf@N7bpQ*r4d3A72_O zda=XMW0y{Q(=ihb|KP+<4HFJ>-ZtY695;+;&KJemzQNi5nfLwwb}j+v%!b4!(C>BD zX~tS3#eJuw?iloBH4&)z%M?)<3tiU9HbKI#6=I!h~LfIzFeE%`|$U3K5EW+B%9R8ZSEn|}u zZQ|0jh;mj;@3b1xDH>+U{{kCI3DvNXy?PMBU&D!vk@*{bsMND@SbDHMxPLuUfAHWV zDDPBtI2F{TgGxS-IH|nqk75>D9dB@CFKAuiS8P>NCFZ9XoTONAzhe1Gu@jAqa$wO{ zg3bi(*ZouOhh5AZjzC*0&Lgh9D8mPX#5Vklm$A#=KkDxbXsCB|<k|+}I(3x|7?6N~!93UQ?pE^ZVuCPOQ z$XLYRVW9v+5td- zJee&PKR;ziZ+IK^RlnX~vwP*6+Hu6x?frhunEh1Wh3b>hHgCkBYVDDzikcO+dj8d8 zm)N&3C+WU5`69%M5%5w`LHeXUra0fT4xg>O8vWp;>q;iZkKFrMOjC!Jcp!FdG?yy- zy@`|(mi>3^=xbI#6aN_+N!I{qkFTlDkrAwx>urXnvq`PX&8!H!i+vq_w^L;2gZUp4 zw{5wi4GanzowW)PnEI42JhhBw z908W8pPmPAm_MI_J%R$Bg6siR>7;dsU~*slmkc@oK5ncC^PoSo=ny>&oEox`59_)T zr0EX%bdXYDFMz;)fQE`NVUqDhCOk6uUwzV|cWohWsmntXoE{lCPI_yQh(e9S4X`L9 zw%bCY#&84b`Why81MK}O-fey?523m1b1sKJ3V!0*1(Z|64=vZ{J{Qg4P<_08pc^WR zLl}`886N(0>7qTSPBIdLA6<-08J{5pRjQ&YOtr|2ANx7;SHldp7zbC z4^imJ8Rnm_6@6fB;5bnv8kt_`8E8RFsFp9u`}s%|{^>65pAOf-`Rh=bID^Ur8IOWKsmhnU z*C$oPKZD(dq-D~rHO;}Z44^hpgjWq?{3(BdiMk~&z^7$ zDEnA^eY5bOyF-tKZT(ye9v^JIBB!c>N(;3=D1XfzkWUsm2vnI&V8TU8(%Pzuk8e*{ z1Y`9mpF7-fo9aC;xY9vRf9Fhc4o;FyZ2vK(qN3*=0{FyD#cz-)4_BSN0_oDujE1WO zf25ju`NlR&j8-~BnB4Wcm4}^x&!}`p?>-RnWIo)K(=N-PT512g&mVMZM4mF-if|yxT-Fq`}4k3me2=` zfd}ZuQcG>_?~7YnTCRaECLzKICyO1`>Ov5m;B5Hs)oMhIp@-ads>s0skl4B;%lSjsC@_%0`7VIni zxV)<{B~V`aw~C#x4T=FM=9wUY1&bB&@YWQ)5sQb!7Zs{RD10V9*d#7&M0v@UQDvA? zNaAF-5HZpzA6L65^onkF$`njgH;!_S<@E;t<#aP0{{3#L|XFx9%W*`c?=Nw*naWTEdc4ymf zt*orlYijW3=H~3U`?zuaT@_%yyg*J&Y&AKykY>4t<4xhxT>kNa9@c;6gwNtMoWhrN znZBWm7n4ksHW3^UpyBJTBYMwDs^JAW5Fb6rynQoitaR~fz+M(D|ahcYLtv zuz;|JycZYMBj=f$6SsRz@rXG*uk-T8#hXsaH@%1}b=d8)M<;^#(7Bw6TYyEL`^|WUP zplwN!BVInt?|(PNB%qxs{k^HB@R(STP(uAsjz5_HX|IX>b^$QZDm(PQC(Y74RCnkV z{K`RTd}jF*l7iwlekc$KrQOB(kKF?c0u&Kso?6H=L4=m3v*+3Cwzh?((5dAcy&h?u z_=Zw@ay$Mo`3*%>1qM3TryQ-LeTCm&2(G#l{RxT$OLo4`7^ZYM`@wUR~u<+fmz(|C0^_e5s|)f zLu^oVwp-skaS^c9HmZNWp1=OyjVvq8s{akDfLG?V;lEmuUE|{%^#U?fuNXguevh!e zlgE>togMX72Y3QqW@P5o!FzVOC-Fb7gXl(T!zPMr_{_qW*H9(w#O{(O&3xLeQJAqN z*uZ31+`*@s#B^Wp(7re$Pzy$)l)|Bw$KCpXOV;aW{tfXgf9)HXBJ-dIzZb2opT4Tm z9)9L6+=CZLe&ww^_QQF=d5HAK;^5bM_My3oOIuxOCl57-_Dki&j%^WDJWt^>>5PWaiozOYTwOG3w6|%CILg?RLw`e z(oq9-#V$;WMh$#u9GK}{v&l0k(^%&sfH&1@ZQb*IGnTekz z%6;@zY^KF?9$GXnpnWdt*ax7l=3l6*>W9)ZuBHtG89{J%FWG?#pNa`f?TUNA%5+N* z+;nSMN=Lt+7yO}ww&Au{q#Et`IyQ7dak#w7PCwc0;VLx;tQ;&3j0)?k&SWn?8=8gA zNt5?eH4a%N&)yci{QLhfps=8Xv!!ByFWuQx>liS!F5{1m(r5WI%w1gtplDS4$&&zy zpG0M`%y2a?QohH>MFj4%`nF3_*we2c65n;`^bf`k}gMBQr6jKjr_# z4VDQ8Rhn|O4o&ju_B)AzG+!)O5o8&67zzM837?=Ib4Pxr7|m-w(i7*NVv*NE*5?7A z0%!mgIUO}Jx=l%u#Q&Ckm@1H{f2K0jAAqa)Kmu=P&4M^}A$?QQ(GU0E0-CUCepy?) zgLewXwJuxk3E{H8k!!!4d9HoqYFoMxKoDaJDTBAi$vf;9?;o{w$CI#wAzv6xx_l(A zH)%?o{5=G(Y;&VQj^o#_ik5pyIozDDSQ7+LK|ca}TZ4uxfEANIc;G2AOmO!@VY!p8 z3=70ViM*U*A$mh<_-QR^o4NrOMe}EP*iAJ8fZFiY#o2R)Mgn?**+*w0AUNur?mcO` zVwnuEj%;e?XfXXVqX@0?$`Unxk_E$>c7_ap)`M7*MD8{Xj{EG`yi_oN&&=+_A*~$# zD+{%CuLEkk?Kt$w`&RTaG8nlvPT4OvQeSQ)MoyLO`C|IjN0_$XlD0pW**L4S!!1a!dU%njYuWztId(ctr z2*T7j`q?YMQ27PvJ;2Ey>~%Ch=)TMs=9|^&8*?V`z9cn;h(d&{VJY!h=@7695HwJk z$!~QGLM0>?Crp{@&$HkR27cr%oxw^-clnt1IZtl2K9C6x3!4zk>PfO+y$%H52G%7FWsUa_(un1GtD@3n1dC$c(n&NePCQi6-6LYb0YK6<< zu|=`O8>xkPQ$;0S8nuVqd)Jo&el9O5xweweZoeJA!;=G)uze@{qFS{@N1CestP;-OLc% zK8h?}n?r}RK}}#i?K#v0!b0{R3MYQv#k&!Mi+07RA|Dpy&`Q_$zk z+kq(f%>t@{*-@`usT2s0LjeGs5jiTlt}4x{kdM8Ba4N>&up3?LG<)(MGnF@j;^nn8 z6jAJq=bea(o(%y#y|lDcILBC3Y)t{bKi?96r?V#_j7-^$4_V7=i>ng|7{A@qoT&Z` zbkif&tz@7rdUOSDcB?eieDar|DDW46m8%G67=X|g(>+&Syt?+-EG7J)wCYcjP~t-Epxv zh&W8y2wyx>tFzQp1HkFc5o~<0`3`G{&zrx#|H)2C@n`jqVyi>0Az;EdsajZ4zzvd7 z-%l8~Dgn+ZO@MJ?D#Dr6!%koeWBBfeWdo+2jo6rjB)h&`~GNk zwI7ZE=`}7Quwq9#S}Y2=@2|Q>7enC^^lKO_mETFg#`>bX2|^7NbG?C!PZ$%$|5+rd zPgHSLZK?vRv+vY~*Ab;I((~4J!ZJ5?M^02!qv;tf6+L;?<9t%6)d#W%WhzUA7WLfYGuc?4z_w@<;v&(R2R zQw516)0LoZk+P}xll~~`M*w=8TU(d#*Hh@Ts$O;xe^zJgpEG+IG%!Qqb2Heejrn?|dIO?|xz5z(y* zy(Goa>3P{JIou6#=EF)8tv8~a3E8Xm{DD@-#Syyz3K4PnwW%XBf5*0pXirnxu7!kF zDI-#4S}SfZPwsZa2M3?>kYdce&!1|D-q3*V5@xWx%>7GtR`m50|HaU;GqSk9CI@5e z_N<3gH?AdJTRotB`-VkyR2V=3p&^X?Ytf<@I0C)DNxI=Zf*&bEgx97FMTl+-%+(P8 z$PDukPaZt@w8T1m6iWT*c{+(U03Xfx1^aTm^fSk|*Kx>o40N-=K{HDNvD{IoXO2q@ zQcCAk3Bkbw2?%(E^*MhgRoc{huHS*1^w5PLs#0FQe0d0fFG*>Ud5UQQ3YN>^TH5G% z6A5Muw~02R#%gCbRuzuGOQf8N3dRZI9S5D&U$_r@W&oHFH=ASULRu+TfyvUUe-!OE>`K? zW*b^16ZTKV(BXU{H0H}&q1}47ssrEQw6< z*LD!%r~uCI+_mE&m)Z1c~yjz~D1* zn{~%u+YDi;-fw@-F2|*xHRg%O*;j9?uAMJH=HJ`{oN^e{Xt2JOngq4)vA$52mV+ zT3xw5FJ-hh9p&Yjy6)!&W*}nt*KQ@4_87BI3E$m-Q2o>r)M%b=Vz*qaC+#Y5x1Q(m ze(`v9si{9~GvBnUGTS<#7C)FX_y+i#^882eiAhOSe$$L1DP?v%S)quIDdU9k6$(fu zQc?aO9hewGk3tXmvhs));0&P#D>#-MK!45W6I5B?`?*yVr<5Y%j;Bqh`(N`x5b?L$ zeu?OF+44Ix?k{YQ%^zCA!2^wrPL&UX(A*|$z#~cz#jcTlTeTikz`yyk*$fb_P;YZk!s*7g>5 zuh_BUt~_}Y`8#)hY|3Ehqxq&ID!cl)u|uNJi8K@`t6t)R4wZ-!cX+#8`AF?(VnrE>)Q^> zHXY6O)_WBVKeNnGL3~|MClcT67WMa&gJ{2{Ozr@C$ZT`|#TqkX&zi)1dM@x4(t|?H zHI8D79e1cCwV^9Nc8upl_I2a@Exom!aARmSDER!m6RO zvT9|taB>1Hb<|~&w|qZGoCAxhij>8U>Xp~^*RNmyrS*q^lmh&t`AvR10wP{8eU^2f zzBq{t>$bd)Pr!9M$#6>8jk9IE39|~ZmA;S<>3Wq_^U{(*Y|W42RvUIBV&K8kz@J?E zhCY4fiY2=-2>+ZA>8GL#N}fih@_Ov2r_ZDuJfz1d$;JgE-D>lEt2?9nRP z!`_0D``F6iuKu(Z{{$ZsMJ^1_Z&nOvi${IA zIB&CAm3@Q}sNRdqQVdiQkcKaZB3Qpb_MSpH>uRT)<|Dqab=*uLkTzj5_hN~O(T~n) z(|>Jb)FqMaLi$`->38~Zv$L%$LS8CtiUg%@eF4Nv zk2A-OJ@OC=HZp|wSmurS?eKr*)Y-oHo{ul#+lJ_MKyg+g1HP@v!`bkhV2Ha<+jy7|!6u^F4{~0n*hj_~+DdeB}!Wt6c9C zJR=a#l5n!K4vo9Z*2|P%$VNHHvK=Rx;Bur%N-RC?VS)0=%~t9(w$p4Q0cK?UOr;{4eV1mRO9UL+W_`al}sC}oKU44N88T8 ztGhBP{fh{W=cTspDH4vlEL`xg0qqE83O)iP779-a@=#$IgXm)PMFDpU0u-y!<5j^1 zw2d5K{_^W&kW{${MKeS2c+KT=!)Z`!nNAS1aQLDnBZYT zjX2R=Dn5&&u`c*NYIM`m@FP=4u2I6g0r!8hL*2+K9xs zT3shJ(}B!xCT{t4r*uTU>qZ8i|A25}=u-}Bb_Q(h3DJUkyzvE?)w2u*7nowM5<7wO zDt#}EAn(q0lK7O*K+x3DhhmA%@J00%GVIxmGQ#`*-(XC-Ud#W0W4sysX(;XRyTg)1 z@|&IpQ(q5kfTOiD&nBcBVg?YbCt;J`*e$jh&|!*iG&xk^5{gnVnKF(mY9z=YN=r*a zy*`jtanymzLRc!@D0kH!^56XO(ole9pJEn0+5ONey1_N z|2vj1;o(MzLZT^wtn15Thi)+0S%hhi^sR^?+J{#@E8X2N4;uB0P{guI4S7JWp0Epu z{o;$%tv2TUE8myde@J}s-9ab&w>JDk5ROrfuSw@>QF-aB$kU`yN{*9eeqcV^I+Hic z2%mNGoRj%Ee#j>ln>)PL`?s%}aJ~fRv)!%FJqrv%Jn2eFOLL7}(a8#Yu^rf_g*j97|Kr>zvcg%OmbD%532`CZB< z&!EA9!p{!A@MzDluww`)^jUpQIpBmqq@!d9%9>Ww5b{${6_Ua|G7ezkwWS8PPt&V1 zevaf3fW%)7+l{2YWO zF@3gK-}w#^g3dnnob5a{%)!b;N8Ff_lDPJJO|-hr@pj`mv6JnXjB))!0w!LQt+HRm z^QJfARoVx*lW!(V?DX*W%apniQ3Ni0UC}P2j@;bxCRc|ua$FSh*3@*&ZXClie%@4H z)-%2u+`P$1sY_lFO>nkGX*TWGNRV)Tg6LT55UN@|Pp=%2m3dHfe;(tQtkUGMmi+jo z^h2Ye^{7(XoawgG$_g}~m>-UZgg==(GUI^EC9%J9?_uIXUa!7AZ>ROv;pi9K!Xo2( zk;21|L&{|G`tX}bG7}j(+R_byJW0%v7yK}xsgtv~#ReAapFS;--HC*$1;-jm4f2*6 zE#79_hS)OPSX!fe?G;9&rQ>p4n*Ag<$Bu9B_94f`DeKH;oBO@t=1(59%*T%pFx$b= z8Mf$9gJ&nJ2W2?jUDLR35ilF$ZaRYA)w~fg9!lk@(y!%CMaNrX-1L6QoS+-3YJIBV zh*EFA3b9O7l=?vS+ib6DqV!>w!ZhNYtrC+bBEpGo8bo}7`Gj_e$6xw_#h|C5*Yz{u zuc@DGnxk$-@35DQstEa=$uC&Y+Y_8^#ui#C!@nllroEkBIU=3S3POX8EbJH#hwcH3 z5{mNjz=Ar7B>}nxYBQc7R+V;-3Y}9ld5VVKo{ni1mhdG~<^-Jrz93e1?hvW7A=4uc z@wumX+KXid77qA+8`WG$a%jzE=-TQtdX@ykaB!W3WJ2?@k~Fh6DeU+gY<%3o?Hx?d z8sFS4{xs9fXzfRR_xAJ6Q9IvwtBvu-GD!= z#bI5NK3fA4Lc$I383e7<#$8_^x8tK1~-(d-~-@JvCN)*qXoukP^ zHdqX0o3S}>g`}U=uq1;llY-f2np1j-N$49(Fgd!QeHcG%osD?l@Uw6nxO0P{B%{=Fh_G= zrv950sESN+#aUdDo9x;is*a#lxD)dU+1gemaz!@2r(i`GqPvc0;!jlX{l zFl=Zf&Hg^6$dr8=ar*3xC&I^Sn#&;pR$chG?WW#K(3gyxjbnMzwX#UNXQSriRp3;I ztGF2(cV?VJk&f>BjIC%}J9&AX@2)cGQL0!FwDTWt_9=6g?tMSLKwIl#Kj_L({&+FPrxmPPlukd`FW6Qr_EpK3V8? z9ds@}JzwYSS5KCxd=W=e>2$(DB$H{GTcQH?7@ z@{jh9+I3EixmufDOVK~J^KZPF<9-)6+&Z#*gl_2c0oP{E+h2_4B7heCx4DAYLxVFu$!B>_$L_?fB>ii|GVYxe;1$8wZSz3IeLk-eaMxX9-+^x9TK1eku{Dem; z-hG_X!X;x_GM~>hWHh(@t~%`1Iqf1ibkuArYldH@P4DC`FPlS3-69o{`A+q z=Y(t)k5#sBnhqemW)XPKyLnn>CQ$)K=^J``*?g^irB(hBRy3^F_|bIJDsdV%i5J`Wc&$2Q{d+ zLKZU6&tOG&oGGSEDgH3ku1)8DabU@-$~X>}=8lUur+h%tk@Marl#KrA-P=dSDzg~% z<1Olq!6z2qsfNUPXJjd76JfC?5};%C_N-2nkV+m)SNkjxTmDil|C8kcoF% zjjt2hGV0{ak7Qar0Pea7^{7Tbl4z z+tlRfl>lFm-PXNFQ$!sqyHMzP(iEGf3C&JD5$}xI759|kluUxy03DKD{RS(d-Q&9B z%6IgaGM`(dRfi8$H>wJ!*P!}p&kBJERSqqzN0#uIx&N~pG6Vv9ASEiS0{bhMwFbFu z%a`P8Pmj)w!J46LYmmQe?^=L#bDV!dE14zbzI42MI&6%V&wlsQ;F#xO`}vsqH&D{meL-yAiliiB%!F$n+F$W~R@@6yO}H87;V>NGpiWym zkf7Osp?PL>sly4K3g)G2QM#zaA;veqrdA1=>TD9PiL9MT~;* zeE@n=S=jxMrF5g3Iz6zOIj{5SeC0iD>FhL}aY9(HyY+QIuHLq#Bs!}heth;rpY`_) zDX#;d6J}hqw8_m==ZRYit-hvk^MXMpyW<8`wg=qSp04HH7QTrdd)$8azKu=a5lopUeu@~^TQI22@uu3+4(m;#F3~*C>-wBCVlp$+NuWkPEUIqf1;5D^7Vxv4 zAR~FjJUcMtjGSdNI3on~{O6uD%wt|npp~$^bLX0BJPIfLmYUSWG;h(+-a3$d(Zk-J z{HPYvT1e9}9MUj!ff4rYB!VZ4mxMHH?bo1jqvMYH(1wbO4MUB`WccG9H!PkwzJ-=B zpQe)%#k-UsB<~pQSpSnlNK{p?_N4!)Xa7&Kh_BpsIx`=7wy&B89^mln8k>%xB1D{o z8}dWc*7o3KnG^O>tQ2XzuHQv5IAD-OR@xCpvB%B-a{J^(em8HNQJyV1bVE)wccC(l zhh8Ugln5tR=^QMdDM85{a8>$&Y>jmLQwoO%0jiqPzyh}dI_M`rGNN!8Eb6P^*^Lw1 zzqe+(sm;1R{rgMoNHGA0|NdL?MFz3&()4Xoi*C61M5|a}x I718(oUs~`wzW@LL diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 3a2b9f8868..7380cd8c89 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -229,22 +229,21 @@ If the verification fails and your environment is using a proxy to connect to th **Solution**: If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. You must ensure that it's not disabled in system policy. -- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are set to ```0``` or that the settings are cleared: +- Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared: - ```DisableAntiSpyware``` - ```DisableAntiVirus``` - For example, in Group Policy: + For example, in Group Policy there should be no entries such as the following values: - ``` - ``` + - `````` + - `````` - After clearing the policy, run the onboarding steps again on the endpoint. - You can also check the following registry key values to verify that the policy is disabled: - 1. Open the registry ```key HKEY_LOCAL_MACHINE\ SOFTWARE\Policies\Microsoft\Windows Defender```. - 2. Find the value ```DisableAntiSpyware```. - 3. Ensure that the value is set to 0. + 1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```. + 2. Ensure that the value ```DisableAntiSpyware``` is not present. ![Image of registry key for Windows Defender](images/atp-disableantispyware-regkey.png) From 93fc261a0043d521163e5a0aeaf90f571036d439 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Mar 2017 11:46:55 -0700 Subject: [PATCH 056/165] fix code block --- ...-onboarding-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 7380cd8c89..f05e878db5 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -231,8 +231,8 @@ If the verification fails and your environment is using a proxy to connect to th - Depending on the tool that you use to implement policies, you'll need to verify that the following Windows Defender policies are cleared: - - ```DisableAntiSpyware``` - - ```DisableAntiVirus``` + - DisableAntiSpyware + - DisableAntiVirus For example, in Group Policy there should be no entries such as the following values: From b16b2e0eec0e32dcbc89fff550f1d24842c1d205 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 27 Mar 2017 12:06:49 -0700 Subject: [PATCH 057/165] Update user access steps --- ...ows-defender-advanced-threat-protection.md | 35 ++++++++++++++---- .../images/atp-azure-ui-user-access.png | Bin 0 -> 692766 bytes 2 files changed, 28 insertions(+), 7 deletions(-) create mode 100644 windows/keep-secure/images/atp-azure-ui-user-access.png diff --git a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md index 95c54414fa..593b66f678 100644 --- a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -22,10 +22,23 @@ localizationpriority: high - Office 365 - Windows Defender Advanced Threat Protection (Windows Defender ATP) -Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). You can assign users with one of the following levels of permissions: +Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). Use the following methods to assign security roles. + +## Assign user access using Azure PowerShell +You can assign users with one of the following levels of permissions: - Full access (Read and Write) - Read only access +### Before you begin +- Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).
+ + > [!NOTE] + > You need to run the PowerShell cmdlets in an elevated command-line. + +- Connect to your Azure Active Directory. For more information see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx). + + + **Full access**
Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package. Assigning full access rights requires adding the users to the “Security Administrator” or “Global Administrator” AAD built-in roles. @@ -36,13 +49,7 @@ They will not be able to change alert states, submit files for deep analysis or Assigning read only access rights requires adding the users to the “Security Reader” AAD built-in role. Use the following steps to assign security roles: -- Preparations: - - Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).
- > [!NOTE] - > You need to run the PowerShell cmdlets in an elevated command-line. - -- Connect to your Azure Active Directory. For more information see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx). - For **read and write** access, assign users to the security administrator role by using the following command: ```text Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress "secadmin@Contoso.onmicrosoft.com" @@ -53,3 +60,17 @@ Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress “reader ``` For more information see, [Manage Azure AD group and role membership](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups). + +## Assign user access using the Azure portal + +1. Go to the [Azure portal](www.portal.azure.com). + +2. Select **Azure Active Directory**. + +3. Select the user you want to assign user access to. + +4. Select **Manage** > **Directory role**. + +5. Under **Directory role**, select **Limited administrator**, then **Security Reader** or **Security Administrator**. + +![Image of Microsoft Azure portal](images/atp-azure-ui-user-access.png) diff --git a/windows/keep-secure/images/atp-azure-ui-user-access.png b/windows/keep-secure/images/atp-azure-ui-user-access.png new file mode 100644 index 0000000000000000000000000000000000000000..dd7fe7dc4d6a4327f027cb6681e6404f903a277e GIT binary patch literal 692766 zcmZU(Wmp_R(=NRD;)`2wcXwOdU4jG+?(WWF!CezPxCD0y5L|)>cXxOAc;0i~@7RyI zrswXvtGjDvx~r-yN>y0~6^RfD005xM$x5mN0C0-{0K6X%`UCO)Mg;qDLv)hWbp-%$ zssD39$*EIae1HgUa!OJNn=nLJ(EJ6oqBj2pN$I$Wxw~08x&X?m$7DYs6t@pZ(%ki{ zi?x%RwW9+73z3}i14sG~F5&3p?P6_dU_ zbJD3>Pd)5RbJyxC`D1rYe{SwM!~uXBg4|-)^f} z`u~9bt4>rhqb1}2r2Yp#C#GSs_@7Pxe;I6>z7bK;ng8qge+qwC+hpH2{V7=+kN5MQ z`@ehqAGCmjM6%1*>OSg~9FnJ5;a+r{|A#`e0*Lqif*kiO|$3$rh1JuI!mk*w;|CjbQ+k4IMRlNAVOt!8>M*ctA5_zXYkQ2BE9KSjm>{g zd{crfh>#}Lx~Kooe_k~7#i|p#PlhPf&Xo#B&ffqs08+S64W@HKkJeNGu9kE=1=U?N z=8@sVf|Zn79+?~zz9}psxoo+-V1BBEbvi(i+_yQcb6a)%((59_<>E9|<}JZOEza_) z4HjYl*u2`j^KBv!>(AZU)O0N+hbIqq zO%3$lQ=&Q%@wgO+W9C8U&z{DoC2tgQh+m5w_O2XzL!sF+%eXKUPJkFkafScC`|2M}^`X-I7jk1V=;}lw zNDGAAq==hVh)v?sFitP-jISitB3W#kmwn@{_!uC0B$Mr;X;@e-V8JZVLWw|*&YQ>c ze(f1p0y{pO2eE+$QQ*ts2Gaorv|x{Df;6FGY-XA0eY~83`EH2El6BhfvdG-Boj#{cdhv_Ej$|HZ}TDY8C#Jc1eikZ8fXGM-pgrGoNrReKm?xm;3P&tj6kx?QY4^^ zvkP6Eex|(RX-Nc;cs{#oXg&!gUZIwoerD&gJ@p}&H|ENpcH1qlA>5~_S(-r0m>{Nc zhe1&5h@8KScfhI1G-dao@o_@#I{DN5UE#ulQ2J$K+-@UvJG=90pRZ?X~>Hl zj};Mji!FKlb&W3d*DIHC0`_bWg*X{SN@*km%TMUkp!`rB)bP(mD2Q~yU|ZMl5!LB9 zR9KeDalV|PGNojqAu_{&!xglM`KH*cf(Fir^a6~61ZP}ypb1rw;b2uyH zrB$T3o9el=tNvgxz1>`__HZ^46&49r%$IPAEJMDlnB}=J-zJvkSNMAjPP6ea^dMYHzB_tuzYT&83Dx$wQIDm|;&GkFg*zAUVzNt?I z!fIcxC3#Ko#i21ni9<}@R#QE|Qud^q9C$oHl|}nQI&nD3yaaIDuoF;bP;M2f{iAHsW_JHCv&B_XqV zI-3ba`~WNigTHK4+6U{X)0I-RBKBErD}u|QOW<|HLOj?w1B(2XJ(!Ib&UccG*Y^jv z!G}UrHmQA$b4tW>&%DmP0xg}6F7#*BFJfuS0>Xi?0uC{z&e7?+Hu z52E&rYW+`+mD(3XED}*6^)E4imFycRxGycge!{~w!h>;@2vGCPx zDFhoQ_8Kz|n5@ybQ$dI_Dpyxuo;PGOf7UlGwZ&X79vo_klhc3*Ddkf}oGu&2ru{mw zYvm)qWmv3>d}U-1*BRW8?fgFV>z@DaXBB=9(bq7T+Ri0IAFLGI{)Xps9!A5h(MMwj{^D!hDd(k5WOJ5}O=(T$+l?+V%lVd2CZ zJzP%@OtHs4S6w1}BG72S!qWs9*hB&(;2c1jGw!yo?)j3`9mTLcs`cUGpJV2xNe!9? zzf;9o(UbPF2w!-Ni?OXY5;-=3B)S-BQF>gA48TMTN!$@LsJ7}IRnL80+ZsPI<23Mo zZ$;)5BCeW+!(1qY2YZjaGCqUOP^>Fvw;*EUug6w_WX@#iSiN2o6(f;%_!&Y5E{B{u z*l*ALk}6k+1;L0z@Jkks$CtBR!}R^sw~wVI$CP~bnzmr6u?gEpn+K}~O@$mR4NvCm zAGiUkH^ywr4_#jq+)vH9c^U7%*doD8P7M(@JW7O7iBmPEBO&#}7Qts#uH@>XIb0@Q z|A8ruv9+8tG3H?}PWhFfkd7IV7QA9+=FiuKoEh|;CjbVeyar}Dm=?yB>LPN=5Q+M? z1*cNRMQFUtmg&H6c9#0ce{ph1v(R+EF)=_aduBmfgg*&OBY~b6_GcC3Y{se_AO<9i zUh%0du?z-o^$@etD3Dtb6-m)7s>XDd1_tAI95pW~*gej?a*mRqXc-Jy@sb|^b_$qA zIX;{bV`N84Vz!CV>Qd$m=#DtoRejD`Q(lpx&LwdZf^F5Nbvx>ZyoI=|GC*OXXuwK( zExT9WfPzPYLN4OjjjAZHqooK#8te|-SWVQB=T?K0WXjWO0JuR*q8FiIYg$f0)3;_9 ze<5Zl5Kqi&t3^OA5Vy;rui=^uNJd?mCt>H}d&viJ#q|u|@3>X*M zg|AoMf3@J1k4Csq%liHzQ34_K=#Sy_+NE}ziJg)+dK6) zN%RnE#}ju{4EtYEeU!)5bPmxgPo-5_A^?npZzkN$Xm&|xGpTm|q6OFq*o)iO*{|Nk zEC?!|FfU+r^o6)%2?ejoiK3IhdOZ6ZL>AQSi`tfxvEXcd4`5RjYB41fbW zr==xHhL!-Ee~PYmavR%I#SqAsNbCn7+h9?QT~26R9U|`kN*UVRKaLu4@k2;7At+s& zP527GhPQ0;j-?RY_!wqhc!8CUVmmrR+<@jqbz|?#n2A}RLo1{_euilHC>XQ@F-L&^ zg3(xlJf-L(6(qpoP7;mP!xeJGfZ`6LDz)k&D=rUEMFN2mQ^um8$!;m6qFARHVG*--aWqan?W>BVe3B-mpGUKAO#egfyRZm zszu?n3cu-xtKiJwvetnWWAG|lKf?dQDJkzL9D%@Gx7!Mhf^yavx`!%m&U%CBt32TW zL&EhIHF>2`5@2r{8yF?p0@7}25oXh)DTf2>jDNiGI7w!pfU8Cmk}hs zNj`^&DX1Ep5gb;8X* zk$zo+LOWMu_`HAnW|N3Zv+B*sk*?ssTbw*8#4E_JSEXID{>amH%bfEggxq3YFo+GA zfbaabp@a3MDGKZ-(g=Y5Q2d(Yf)L1_G+;B0LzJqwX4A8&-vfN4oMTWo=_#}NEaH*d zY7Xm>PIB;b_OCNF8lVSA&D4X*g>1f_)t0@PS#mKu<0*14Rpe*dlFH7QJ>$9NvwdzP z=)WzP@Ui{7vrc3+X3SHyRmaAKHr8gx=jBSf8+B;G^#0WMj9wgxDyW4lV(iJ(!eY0W z;-En5CdoScfcpUZ4;fZdDobZlCuLO&%FNH2qp9aGzBaGbx~vAi-&L-B)XynfS{1}t zU^p8|?*o)-{@PZ5zX*+r*q}jc=&lm_D}3w|eZDl7CY;F=$7f9B+rnrBzwk~LiN+*n zs?gWp@Zcfr(YkG9H9usJ71=Pl1>%@)7=` zef9(FUCm4e>Z4Ka@a@R7;JNNzR8Bk0%k)Ozk%)B+R^gaQJ_LWlu*>%Ma9=x z>)c9Gk)c2LIMLvVp{(cS?h9U~(Bkp2L zzyu){mji)oV>ch368k`GEB@*Xq#5fqK_3FGp%X%|H!8^5@vviQ6wsZ_z;HbGr~Q1E zw=491-O>oDFI=;;u$L{y#-31;52L^#F@{G*-s=iY%+j)6Xu0z8x9@%TW$fJ1 zxUyyW_i2Nu-K#s~$?k`3BcXt&;oCodc=uL2uaWJL{AR@EdOOcmxj~xLA-GDIp}qD# z>3}a{*0$;_GITa0?Ri?ow(&=zv~~Y$15GeP z$OVboZ>2;MJqgWUd{)3St!qL|q^fMYVS(760Bd5pOvti|2dm%NL7Any2h}hB_q+AV zb&NH^8ggm4oFb_V5K5DjPT?{qtUDek@KnIb@J{@qZ8H5oHd{91`$pJ6YPyTp%rRn? zeQ0yRA$jYf^zC5+IJzeuDrY3&mNAOAl4)BJyis z;I_abHOm6OBq1(+%Bf>5+yb8o542F}SI=zJEOhJ|cM(7vRQFdkIDjyq5aUZv!zyTk zF7uitI)^W%zsyMlQ4%z$M4yNVjXBGxH&6Ebjp2A{=vMTK_IH&6oH76Cov>)hta2%P z&v zIPz>m@~Tur#sG>UL=@RPxBR5zvEP=4Ol6R==p z%kFQX{}m$qb%#8Dn{cg3q~fq|oU@ONk*q+%v>mtqkxoU(q<1^qt^W2Rf+!lg#jh3L zO100=`RWCE^8Fy5SkxKYU^;qk)zSZ2aP!tQ_AT^C^S6h>+LZ1Bga$(#Ndk;9R?4|U zAoBdEFZ%RoY2?3a#eY6=R%7(8T{*#fzII=)3Ta@fkxL(a9G<$YN>0u!PA=T-^hUsu zY!L)l9M?A&M{PptG2s)Z&X*$d{|Q6|AK#I!(EFWUvqV6l!+fdP)HW3g%wUJMPG59) zdnH+k)|dWiT{_n?KF%+2T#eeY(G;2AV-VLSVMmY&g4io@(3wEO7_`QHCxtYg)LE5TC(gT@br&BOUp?3K{GCXta=<+(G{!xhUNw?+p$I8`x)JFW z=Kq$`Hh5AwxNY3QY`LS+tX((7xqf@8tVbuZBafaIyZ%u#x5r=b5TxJ*mHGbVGBEpt zPYgG1R~Aia6-F5qBRI?cH&)sdr-hOl$~+;#;$FBF#HH2TyU^*ETbOD-Nt5Iv8DPyY~!i zDiLcgh&!M9)W^H5AHO2(9vMfVE_G&pvHCtXbzBM^f?>#@ z%57zVgxjw=@!)oOFz!`|?5!I>a$+{y^~l0emkjl0h{JDTX{^8VVb~RGd3lv}1%zv+R|>DEt@e zT(jZ7d2eY?CW-q!zTayOwxI_-KkNc!>F&}WhXQc!_qA8GV4V9NZ5;!H;)T%eBRlV= z(&`X4BT@0Gpns}LLtqZWX^tR>@w6n=o;9F+%tDF0SOyLIV{cGj7MKNhRYRply=Ys? zaIF2>wcWpjWxdyj=J&tKh}RMPuWK5sdmQ9)42j|zjWG^CaszlouPa5aW8C1SJ`w-Q zjucxL7}`~s5KhkX%|Dz>S>WrrH~N$Q}ru9G`O?)tDay4lArz^Nm*^x z9B8uceVm*1l92U?2VACQ-3(Kv%I!WSSen6%ry}b4T%4|K=y!P#wY>gP(cR^Be0tw~ zOSm3@jJJOQ!0`?TQc0wnRI62fkjF64h~U}uBK@GmMxknwb1V=749w8ozG@cXHD-Tq(v zJ^A+OqP_w*)6Yx)Dsd@{BL@z~7MvFsJmR(R$hffc^iaCK^U%5JU)?dgeqPwIT8>NJ z#_j&q%sYR_ZA5KO^8yyvGdw~l5~OCcDT8Lnetea4M0V+<;I`u*431P&4cFpKRUC1e z>f3}xA)1hm(X9fA-#AIs#}g^?dg81BpI=5v*o7`Inlucl0a_!qv$jTv1I3@%|DAC% zgpeI*6`*U^H|42?6)4e}(2|nmv~EBp*xD_j_c?IhBCJ>q775wpru-9m<3SAQOS>Wc z1ZcOtvxNHO2k(LPNZJ4A#3qbg6E$K|nb;zz&75j@r%y2T7xAY}Bu6Bf(qIUkm~;(h z5K7yZZ4;{n-;`bXjD496N}btr7zfSwQGH9|Jh(qY!7su2r&d_Mioc@Gh9c&&IXHMl z{KZd@?$-=v7!J0w01V`5_Q<80{pO;&LPp>o2Ya^v zC)lEflDFhB%w~Buv>0!Xvu&iCof*Jx=jlE zcIB*Bb*2x=6+bLKpKpiy9`H`#agY8a2hxU_N^`n#R(>vZX%NCtC^;s%hWp|BmYMsk z8@M$eHY~N8a{K3L4dFcC`PS>z-C@39w$cI6N6`i}sCqr?Z0@>ital7R&WiIg>no9bx^E#KEKrWk{MWXe+Z&fX_z|rb?iTN&vGB1%a^%{~qmWS|XV# z4JYw-H5Fc%ohA*Ma)c-j%H=U%f9kVz zYR?MnJlDXXjAw>kKdN`Hl47GH>>hYH^!|gF{+YJuvUz{b`K{oovpt9w5$i5H_9u&E z`yXbjErfeK+Ck3knP%l5-dA@%?j)P5eri#cKLR*L_ZCYW?_VwI7gyT+E6x>izUK

Y-aDn|Xvj}Z|7h5(KYgbt_@+c4ptasdY(WvC9`3qiU1h$a zZxJxsdMp4q@tsAQTX9!I($vROpf65YAwIrUeZU#pb4_wX$g`jj_e?=*FKZnVrm*+? z!nD78hM@Y1*#gh=e7;^|eBk2t&tjGSAkEgC#=@=tt_7!{h;#gu88HQ_q<9#4N0hAH zQUA`qBPh~}YmwJ%wljZ?oPL*2^s5~i$?@}=V_isPrC5C4jKX4N!CjiUw_684};WGpDRIOb(AqH7?j+oa7K~Uyyjuy3z zSQUuu3mnZ)hG}ROdWs}wC`s5u21U7Ka^0(FcS9CSgZ*MW7yevYCs${lV~gu*tf{&) zj6@69QTp;e`YbW2FsmPvX$*_JXmUV%&J>$;J6yCIxB_dQQ3Hx$y?jj#H50z2B>xP( zrW6X;>_(4orKLEAP#N+(3O~g|emhAj1b+g`I5i1feTK({{C6&ZJS>-cc@$LSu2A$6 zPofIFJH^0ecSxPIW{;#s9a;es+$#g~=_B5ctnp;(s4mOPtG7$|3|YmvAK`T8)qlTOE-=)1w$am8sX6M7!)t_|j zQFGSvzY{6hZzpg5Yoby{2}zNX4PY(|Ej3s~9Bc$hZoFRZ&BKz5E6X1bm!wsr=EF1$ zuF{nglWPH-YyL$3at!1cA3?ZyrK*zs{qwH-JKnCxw`Rlm`}2Z3d6|?8^-jwfS)q-5 zu~-m1ff<#St*;aZ#EkhLb{Hz7LV+AC92xU7EB4g9Jy9tHsdlK0$PFPV*m!wlFsUp{ z4^s^sqAqNMTCY5(X6lHwKY zet&xvedqPMc2BwGC??1Z0bY{DIj%m9jk5Y}&XpMXu#dOR`M7)dY#yU(AW5@zjN6Yd zSv7&!vO+1{+F!oO<4feT>@7WX>3iLU>9cln1YR9BCeLnfQ@7|TLHe`Yh%ss$eO%#Wr1wo8m99g+`yh?X0+8=Uk(NUj*IP z|4EXEr~LLg0oazn$&nR38*1dq*)g>PG1qf`%zJ@>US zAFF`gQ)wZFQ0HF9k*lO)uPqYd%bV?9uM7CKINRmv2`;E{lL6R-pcP0^Oc}T1MN7=> zaV7=$Sd?+9OG@FB(Aieb{}Sk%lDqEgWehQntoO+z9e3^B7rA~pf0k8DDxWdJukjlma7GG%na9l(s_J>9dm%t)`Q$~a&ojmD`(QhinrY*LCAwAJSf$5gFxX@Yxn8a^c93T$UbjX}Sv9bJUtW z*PVaCBy0Vt7+tV?1M0Gx6lv3BB^l7Odf%=;SYWbs4au=zT>SIe-W-Pu?Qvb)_bC&* zk~iy=(da4a{YCV3Jn&8>fRfhtw9)ZL=Y1DTeD}*P>udA-`1#ur>-&};d*Jmr??QH0 zroyb|XCm;dqN@#8Dw1X_+3F!V|Goo!VksKOKHAbAk~NVsqNL`cqj8dYlee-rO*mZ~ zopn=Cu-Gi>H;LXWI}fg!Kf1hKYivmB^SbKXmdj2(S}_+oRj)51bgRP{h|_AsjS&b3 zsv1%TRfom=(})=PdecQ6&O8Vowx>rk+maC(=zPnNSgXbNu;bmiZocB84 zbA9_?4(OQX=8)1NMvMO-H}?;J5|1Lq)Fg}5-n~(QN)@&!?<~(QB}r1h3qY0N)!_UF zi84!VJ4@D6PMe*TOeyX@IM4l^W-y`(FC^ccvv2g+X!K0_*8cuh(S0|!yY=wBdCmL% z)RPCVf=pd`)ld6L>*g3pqk$7W-6x^c!FsZwmZgpe<;rWsWYK6xA+*v*&tY>3Zfzke zI(Av0){;!od)BLP<6KYC^VNu|JDi-PIGQpIxct33jf+w$&ed}fRH)CCDo!f|-@Ae+ zn=TL>j`imdd&--4GTNNk|Hk$lSxYjw)U2_HY`Rimo<9`NKLxt6Bjfpr$*1h8xYl^C=$#1d7z7A=rAO)Px5gEcAq zzNYWEc_X4;?O!8Crw4D3m{s~Y0?C-jOO?%NtE|Ma^Je;G=Ps<);TyH*H)I=3vp-*y z8j5i)k8a;O(I;5X)G2y9gR14RZ0b}gY>u+KEuE$s_Q?=O4bC(hy<&l|vQ?&M(4|dY z#;UWLTFeWCu%;JBKsgL0XwF^*NdPPk^UptKt9ZZ6Y|<3D8kMBwe2CK+;67n&HV!XT zANPnwDHM?JLBW^FEh!Cy)JFe${5YL{o{CK%E0u_8OIR`ufFzV7X-u}2=u2Pya|r|TFU9hE zQ25zh-D08pP_`n$XQ3XB$}aM#6m`rfpXa+_R=-`#u7@K_mGj*9Iit7n_3pPP@9tm< z+90%=NbKzK=v@C@%fKgEBd@nZ-Zj71$@eXluE!_dqowp_!%9u+&Kpc|FCO>Nih7M> zyS3dBqzIVGVuz<$W(LL%Z4Np0;<2`+L#Afg%c z**er{6~?5gJ-;DV7#;Oc2lYXXX3;OGZ}F=VPPSVxt!X)|boN z@wXe5xADu~PgoX(eh>WlncWda>CUQHXPo<9T-;6{Z3HV6J|x7Xy^Ly9Vn{ z@Z*sZP}G>uMN_fw%$}}gQOXDU)qQc+=+NWAGOr@Bn^L19K!eEBno>Z|d8ZfN&DnOh zS#1w#YA9#d-PRoab@cpt3jZ3&#_CzdI5?WyQk)kac(;oec!<|^H4;79bv@twkth0o z?$~iD?LK}uM11p2NahH1HCv@`^qOk)*qSTQdjF;$c!3ZYH1iydXZX~M*LAVneH-sE z?(7`!BolZeQ&I0bx=q_U7PACxqJ5 zyR(a}2Jf1qaY8~6?YK|F$s}t6w|?BL6r%Ly_!6T7@j8oIfuwmVxC#!fCw(+IdQSI7 zYkzUCK8cJCOS@(`ufE#*84+DZ@;mEZ0W7yp=X5849jzyOBv-*Z9nrW^&t118Epw6e zn9E27`k4j)+tz;9#c}tOhD>-}b>MxoQTy|maLu&40qRY5y?(RG#H326CXY+b zk1M;@ob;_m8`v>eaFyX`_>`xvZLFTSB(~jD0)#0}MG_dL_oTj1q#v>?l+CJgz9vC7 z$q9~6BGcWC5>x?8YW&=DFRO4D)6Afjw_fW?k)jfkEw?#Upkyk_ZuRx5WYtdK6EMuF zfi`pviK=`CYlinfO6_=`#kp`Wxt2-RR`RZz8a_q41boA-`GF;OUv7^Rln`@4cm|M6 zCSmvPL8f3kZc8bf#-z_(_wAci7nq;r*O2r&guzo;5qOG!-~1f# zroj4oXteTpEczZ@<2`kevsbS_id5D(-zAL=pf6^j_Ds)_0i7;$P!~z}d(8z9yLVK9LNNYhYHhApUkK6rL$ zJ-K4~ci(ugZg0VFi7OYVeC`bu(Ps5C1;|$HBLASQGS<14*DAdu)r|}75 zKF|bBfT4Jq4tSw#IINI@C^V%KrnS>hDx|}4W5vZ(!~LqoU|_c}FmTv1$|ApsSF(i= zD)9pmikmuJ)sI%G#fPat8qUx$rLx4ZP^b`z-dQQ@Z-gKph2N&u8CV8PWzJ+>x&<}V zdf&!a(1(Na5-o?WyVg_Oe{bO%4F0H4ig%w)$ih^QXwaFA*S>Bo^5cD21NE$wpMDKz z3#NymUKv9(JHQu0zuYUDsm(8x3&+1gY0m9>9doTOEbOX0?|S#(KjoesNt?kg<*{PSuqXwv?l9FP_XGDSk>Ao$sb)U0}ST0 za(K?oC{qn}N0rh}SbHGnELFoXhv67l2_b|P9i}S55;;|k8o_NT_1V9}5`9i(eZPJ` zvBcNO%3bx}XMKNq*R9f~04WsPNn*hZ(3sdlqaJsXYA+Ia*xREK zG`}Ysy%n#&jT;$!zkR$wMPIR+-*3;~ zcNgAYyM19;R_*Eq7-fM3b)5|4aw$JKMlA}~d|}4{sf1ioUXt!T6;yJjNl77U&jF!p zhQTfBh#5Z zxhWWuEL#vWUC0Mft{hz=3-Z0}WvES|f@1QA@3`?_1+mmxe3t0Y_b}w8lH|6Lykt}G z;8M^Q>Wz*D3=Y&av}e0BEQZ4s>(rXyyA( z5b(xm^j7o!C-723)MNknee;yydHuO_{UgRRRHPju=c+_3PmgyTRt)=KQ>^yaoD)mB zyF4+uR`PU{I~!cpwvz%Ksa`nznq%)qGPZ~8gI!bXH6rKoxlgP-Q#>bl0~Eg{wa@8e za=G_iJjI56lG7_#7N5!XOdWgxe0XhM?=Q&qM9yDuN7v3~-XGn4L?8ttDn&MVqhfS* z@zG|l_cXT`aY8O`+afU8xJ!$;Xe0{)z0meXF%Oo^ROBJ)po)syDJ)u}r|I;!MbX!Y z#gCJAmAC(VuQ!(OcavZ11Fq^-sw!66J-?mNtqZV(!6<|U!BVDRKo8MoRvty5VvZ2) zAw=o0#2fkF&aFRHt-r{0KZH@MMur6iK|xhAPRx6qE}y^UzAuoz4wJqw*SvPGKh4`Z zR{3_i?t6^k9c&XBJ@36=*1VNxPrlv6zn@g`uAM!L6r*jCbf$MzQ*(#c-NXu;t>>n@ zD|7m=YHGk>Y#Q38%F5KIa8cVH;>yvY8dp)Rew7f=F@}YW8MlZn1)2QO@O1FsbQSfl z`_ggweZlC%Rg9h+Ag|xWsKf$&Y_jHym7VJuKPNOLdEK#~Y!%1~Gj`07l#1970%}F#aldcAW4QS1QlEc=5N-nd=(a`E~yI&P3qv>?n3D0cf$&@BiBbwq}Y& z)2x{--8Bu<`#Zk38be~By(W0=ln&Idj;1-$CEhh)cd zZ^M5sFfPYif$XIzD+v)?&6gKkL~P zy|9*I7&=8h%~q}}SXQazxs16-D)B>%nkRS2#s7Vl#P{x$Y z#y{L=j8s^x{49@F%v3sN!(Q05gdiQ5I5JH#L^-jr2tHjTEsb=8ROWE5Mf}2wAUiVQ zqDV0TCglVb)e$&O9de{hF+rxZlKQjIlqa+MwixdL({S&Iw@*uVhG>y34RTaV&~Lak z`Sy$zO@@llz|{FGX|r^c@eJbKk1ZqMYH`uD>v6;F^-b_$;{?WF-RClG9PgSoxBqlm zhiRj6m#3iik3?9Wb_5Kl+($kRf5%e+r5_2i^Xt@aOdDoHu`qnD1k^}!6-QW2x-ACP zuL&gcv!Xb*a#XH^W)gdwMR~zEELw9)WJ|uI28Ez7-wb&F16nArVDqAC>L16#07M*& zVe&s5xSSaU+Fs}akpn0N3ixTTq2yVmAPnaLY`E*t7!%RRJMa6(a*JbQLU(^3pC{sh zh3>c8_lxuQ!raHi$IpR}`+}F-nXl`CPx~LyOK<0nA?t07c0O4Yf;We(id#K92{?+O zrQGk|zcZ&tFCtHF_#Zovju+plX{Uu5ib+HdrwuWvtO@WRC4jQ$g!?Ui#LrhOU1{j> zzGJ(_z!)5v_M`c@U>_1tjkGoAM zVoWc@WHp?A*zTJ7J7)ZriQZLeBQ&NnHJ_)`n7@e87n_en0=2m7A5DL$B@ihjF=I$a z4F0?^Jo4c;S`ihDaNMK4&cQu?qu7Eb8D;UbmY(UN*2TCfu6c!rxUY6(Q>)2g_|K6^ zo!(uA)_b0<2HuvEeOzxP0!5f&Ear&R=_ zNm2l%!BkTE9=Z(PRaIBzO(R!l@yrqK-o@q2y6sIP48F}Rb@BxSDM0qfyht!06bc*^ z`WuijEBt-?wCfPUdKSM7q@vEugOzvLd~|MqUYofWy#I0Tx9OjI?~PBk*4l*@B)3G& z(o+T~nZN`&(Le_4H2Lu>a7us*QlcQ;a=laduPfKkL3Gpv+g<1M#rosY_`8*^DSQJh zAQEy_dE3m)F_*1gvJ0U}K8oVmrCvRGIvr2%$x4&9(IDC)RTdlOdMZ}|m}@#Z%M{RW zU^Cl94_~Lb@>pr%%D%iyR#kui+Inv0NYQ&`)1rGVBs<$1G}Z0ne`w2#>?#MfO17^o4^ zQ`G@rzWtSJfAPq9`7%Y`AI2O7+&CMuEzt+NdyO=L&7?t#%e&}f^SJU=7teii@E%2PraA#R6#z53 z^$;%Cha)w`t2Y{Hx3nbW=2NKlw~`|1S@ZrbQXE7NFEih)uo^Pf*a?0eoM z*kNeYK}EVs1vK*pfgp2*+mM?fI$ zW%7XO#r}n9WT-1Pw!TYvT<@=-XGxgY7L2cCc&X9FM?GNwGQ49(HYBH}(PFq@_gQ|2 z?_ZTef-tZtZx#xEAjOAB3(m))DdMJFLE%|1n1^b3h1e7j2iF;+b;-DT4}@|4wMJkM zrUib@!N5NSrl#r2;5Zw@l7tOzx&q;UgMkfU(*QUVRe0UKnD7Z>sz`+O{VsIz26r;- zr6Bwr7dl)3QgNR7h5*6v7Y6QneRZ>#-g`1=)%jxP4*NJD-#_eHHo~$H9w$A1B>5=g zezpC`#(o_b339;ZZ#CGrG&L?Jzph)~G%}^cepPwQzYfJ+l$q|+AK@M29z+NjpWJw8 zAAlUnY2?XM3{q1?nxs@ac=_}q#DLSMQ=S7QQ4J~mCLcpFuCd-Q zqbZ07xe(H{0lH?#*eGjG$TY?T8#;wj0Vq}B$9Xt*b556h{*f;A+9B@ngG1f6ft3}u zD7|8QNU45hybRcM#kwnEu2`{YDBguL6Y0n%WjnXG!*g0($9fEWgFqLyCG~Lu$FcKCES|a~{Nl z{`15%SzXF+&mm68rv$6U;5f>8kVQ;#Ef89B1PFtVn3+$V&n!eL1~mQcPvRqxXw^(k zUFmMDPNYC56ig<55RA#U+~|%_QVVa5AWtqw&T0Fd#u%c?&}I|)zFL@p+UnT!G^F)GtUe-u&@T)m(ga(z5OmB74dM|!9vd| zaB^;c9Qm_=m1$KK1zhJ=>=d4TfAroXEqV1E`3Zz;lgf!hW+7WzWO&vFw=nc5~~}Wej38^D6BA($Pr$DaRPb6$FJ}YHNuk9pXd? zjQ3tTYM61JC9uw!$YV0@5rU-v1#isaC&!EDKF4|#&RAtPz%YQBN)#0ki#MbEQojDM zOjS1fnap*36z4vJ-nH*4mf_^&pr8@c@d^Y}N8w3{M^ect*3*9v-4|0GN+bU<`9X-& zJ>H0El>HhuL8F;<)sc>luVLL@JT0&UbTwxk;opN?w9sa36PMWktWp!8ga8O>6znai z)R%37Bj5+v3Dmf5-E0<&eiAO>5mXsxy8!V|R9_k5VVU3DLBu zOJyEu`=U60 z2oTAM0nFEMMYoANOBk;%zfpM$q1&N|r<0Evr29IC|CJe$E?GO|uY*)0yR@x&60B~B z;-DBf#(kaxWLY&gAa5=B3k{~Xr9PbFOeTLa%$3HvS&TU)Ox^_Xp&F0 z2lkGP^_)FARt+C5`_Wgv{D+Ins{-6owzRTf+c5-3KFk$zUg#;6C20q-grlKX)H2Ny zX_Gd%@5%*_`%x4`o@Z1l(^Mxq0fW>kET4Q}J(+W&Dt%w&0PL*|5%VuMpQ>UfUX#%AoI2Z>( zp-^;2`kZ<`cSg43j?E+(2j^J|>9k4OFj<^&7z>%LY;1sV>g7D&cgkgH1_nQfGU?KK zJ?)BW=kp>6thGi;?s?r@DIr8kX{1D&B1=$?l*(Y3vc`2{7>y`bD3{Vsth6?%0Rg)5 z3Z8G7S6{pV$_Xobe$DrMLYdXl=uX^eSeu4~20j(U!f3)=z<8mjH&r@I(?+{vje)gW z8sWa5C>{8|=Xr$jOiE`px(e|hq#8fK-$DEpVlnT)0hYKepEzo%?FM2%iK8AU6wqkH z$yT*AQ0ggE%Eg|ZW~GA7I%Jj+8-h|woi*j#7`r2>}!EIr0H2 z1yqYcrATu@n9or{h_+N)Zo#C9H=D`EdVA&uw1jo={bFyeXJ8=A5Nf*70Z#oWwXS!OIKD1|Rj$VatOp;q+^5eowaf?) z-q6^1*f-?LJuN>_`C_UKI7gxE?K_qmnW#~(=y+$f-cC|iC?>^xqm*}jrNkE&AcZKm zZN%k#zdcY=GIA!~Xe><6$fZ>nV+cUNfFF|OBZN3&0S$lGSeNDY_1&M|b#ex2jk&!SAo12aL>e~9^65wD+w_J!4 zz&b;mH3qpT9IEz?_JoyOCvGfVpVmnVO(g-b&ibC;+gqL3&iZPOxaQ1_*3tqxF?y=~ z!^2TACkSVpt}m~x%+4ZNeaqL$TF!z}C8<_;tz0PNm?wl_LFjX8tyUW=OR~AyUR`tR z>rjc&He*cC4`!;rEqH&IygyoU@0`}!Im;;W`KSXuH#hg~#~TG2Lq2%&_`bVtJ)Oqw zQmOR9D;MYH7Q?FVVC~y>(cKuzPv8LZ1G}ep`W_*~IVXe{grVnozTh4QtZ_yY*udk2 zQmG_$f>UO-rXa)_PQZas&_Wo5oVS}XNjlmII8aWR@R*>!2q-67npR7}xk4`VxZh}P z$}|H*K36o3TkR|ianv}SrLi*-U`;4ag@q}V3fyCHJ4x18O(=4?C<=-eE{&5`W0N>A z!ONAL)JjX`2smYgQCO{wqBQs+1D-DYFrtKNshm`xY>Nk{C76SalUO=Sp&9YQTu|`C zV12b-=qpoV8|}5`+8WRMIsc;PJ!fdfuCnhrTW1~FQZTlE(QWnPbbs=;WQ--CT^5gEwASBqaR1)Xk-k&y1Fz6#1tyZhuY%#$p<5`>#had=}a+L`#)2z{KSg8!>lsT(3aW0n&iKDHK zgC$`ua0Y3+k)^TlxhI4pL`x$W;l(`Vg-$C5b<`Jx0nWf$!G-5XSsJHl2VnV1iBl1$ z9cx@v$O|g8mRiazQ^ZlqNfh`@gpIWg9(sWnc6$*a*7rOSMvX+i*Gur{!&+lNVHu;F z_4TKpewx5WAwP9;=bg9RY8}yze(%*cl~O8>Aw<`R5paaUSwo10bKSD4_X)*Z_{CrQ zpGF62vrFq||H1z@w_Jbwr5~lq{53ZE%b$Dj?LWWtt#j{RTV1?+e)w}4h5rpGWejJO z77B$B=rmj3d-42@i?4;1J~$c%#Zt9$?!|MHyC-kH?dDS_PafJ+b`RXUy14wmZu)sNDw2V8M=ZPrrL6|lfz`2OH=NTii^-XZn(^ClpZ+&$& z@Abv)rdFB9xnoRbi8NODQ7#CbsG5JWeb4te8H_WnX{=M zi9)fY!8SLWP>ENFqOhE)RI7{>g1`$qaYh~W80R7Yq|Qv*>G*+fc+uwa02pIiO8ZUh)gA!|1NWXo{qt@t*D15%0l zCUh(ZYI?9oM>$h0qg+EfMzig-VSeZ+Q=o~q9L6~c$H5~Ms(!iGFXV*Bu(5*8CZZfu z#yMk*fy$sXGHWz-aBv)9t}rm%v+v;G*l4HSY%{%7UqqG~tDr3$BYqxEgN29!)Jkl$ zw>COd8R#n%3Q-U+3#u)(jyRjd@$&K_pBL?gc~}An1i9SsXy4wwrT%{52P;oM)Aj;5 zTN@u8p4gEu7OXbD%3fWYbsGVYz%YmaQGlMZs#UAI_T>GjFJCI>O1|$KLOaf8P;u7G z(spBYoz2Z{vH)ZSNdjjOcZ^2~qaX~NAqZTl%Bnqm+jkafwOTo!j{?pq7}eHjm2#V{ z&fV~sT~?h$XWCdoJrEDv0~PQnO1WHrwP)Kv-_T&WTn_!9EBXaaHAo}rtTY;CV?#-r zNnm5e5h&sS$KV8|6Wd06CwB3H;aO>>tcqbQNEn8P4j(DTan%z%l`A*qI-Ml!8Ds-} zYk^qfXfmgfg?`vOINaOUSJ7Enr(C8>b4$9>nyWVu$FP7kj(LEEqmEchD2N3ZKw!J( zL;_AYCro!6LupXW`+46nE!)kszKXRqv{FPlNbQ`XVUAa;q*QQ%z2(yY0^*1RB&%dGSR7I4~FU2aVK^OrBfIq;~|w{7I$ zv0|;Xv^;C4uC1>x!q}~nasmrSoU;zdG-^?K+t~QAeTBZl>eBq?X0tst0|IA>A&z){ zuD`c`&#uDu3GRt09wpAxje0aP)PHDKt-p^E$CMRsOm#Nn&Pof!fl?4=qX^Y<`M{p2 zw{Ngi&UrlGjB~1>lPoC>4>wm=*QTa6EQel&%p7Hub8Gbn+Gc;_cpsL$Ke#6#KNvJ| z5TR$amRZUejfyz{t&R1$xrML($zy`*VyUuoa`54Y?-60t=)`jiO9Td>WNT%^L3CH! z^{>!*>{gW%(Dk}hvDL~NW2{!rC{7@#^?;Cjk~<@WP8HLR5G!Ts1ymG-pW^^p>l^eD%uW!m`bj(v}%h%!k!V>FCiTr9!S) zF8hAiY&Nf7zy8|mmlo#c^2K7B#?rar;o)P)j*SkFEG#Tsym+CI3nzDM?;jXiSzmkU z#h0h2r~Od$_xGQ<>7)=M7lmHn%S_ELEnmHQb#8vS6&p&3?Ur-_UDbkag@};}oEsSI zKX~xq?#Z2D7-nhH3+(2`^33$~wJX=>=9jZLX&bFj+;ecx@uP=}A$#$KXRcj&V{oYV z;NhbKy+e7HPnz-6)U``*yuP@;Zm6&b8!FTl&yOokACQW7B>}Zu#%lXM26FYWn@9pjNydVssi-D~Y!J|ixH#?pAxy5VO zuFcNQYMF&zP_0A<_wN}P>?;V*rh%wD?;>j=p)Vk))1{Ra<>jP^2$ zXTS4oyex_Exxc?Z3`1qG*=Wto z&Ce|@Uz@%GN)6C0LfNX;bJV_@ECx$|GxJH7W)2`f zQTmYBx2o{Epu!8S&Xjh=C?9aPy0Y}dlixK)ar(%a(|aF$;FcuSnfmf8&z}eJdv@*F zXtbOoAX^zD>l`8PYbXZ$cZ}?t7;d!VpZS&Fcy}NM!28PLoLgQWz5m~JTYTh0r{C{b z%#X0le!Ou1TRcscD}bO8C(SsafXBQ@_@@)_U(s{9E4WaZ(P6l=GAzkldn}KcTa5JG06%TEjIDBaT=(c`O&`fr;R)o;2S7xWKhXVrx$B!P|yK~3R$-codP8{0x&;RFN zk_NNO8y8-`a_z=Uk~WcU!kJ^o4ovPG9~$Zhu?&t2+NihZ=NDf%_p+2)ce1pTYOBk| zXzzi&2M!!qo?p9mZOU4`_rRW!(V--1!|HOm7{~F;FTZ->)i=}jYLKf2VbCE|sf1~L z^G(MOA3ofQJLjH%;nKy6Fv#`vCUHh7g@aX=GCnxaw`cFpiSeP?nb)VLi8b`l;iKDk zOs=i2fB*Zh-ncOpH#Y#+UoA~ePE1ZtmMTT(oXKQP@VTkEORrv?nO<$T62g7%f#nOO zQXltn03pgTZK1VMT3ga?wWCsDV%PZO) zgbI%(@`G5+2lzXQ_dKx~W&lu2iKd1Ego0X4Y$_OKgd59XEwO;M)@o~*vt^&Hc2cY? zrnU0sP+v33vGJX#cd*gI>RMzZrPMjDS>yyKwyt4d1^hm5U~gq`QiIiJu43*w;KpW?j&;4Y1abDSYVPz#3tq;{$5K&`k++LZv)@-b; zdqg=x#p<%~$?%Y_}R^Qh`z8h%;I{ z`j()t1wq$89NGz*Q?Z2e{IIMbq*5sQ*wz>I=e#myB2HRMdiEODR$+ZKlWcyi(9_fA zCdmcSj%}TdWi-~kAj;}1ek2h1fQ2QU*2dcOj7zlFUrRg}GnqO~VL26^2@LU51f9T7 zi=kJ^6}T5CoAssD=FBXbZNNuIq`I_1D(fU@mZEts5g2r0DlK=uq0Bi)oneHUs0tUf zd0`_eZGf&S)20j}KquzTCIDdS1bN}>peT4CbECWr);l(OU_wmP7Hw>#9LNW*f&z@87}mW=ku2rF1%_M=d80- z1U7Bbt#Yt;C87TO9mNNDAMw|{I(YEl!GV77 z%^S(Tm;Z5Q`ueVk?Z5c*KY!xbq0xSi0WAsPVR6;`f4}p4zx_L3fYpQ%L4~8j8e&Y> z`_o3bprzY8#)d!g;rl*x$6b3SdvXEN435BREKFVfldpdD%YXFMnboHAd1iE>R{h0) z^0R@meztaaw08R)cb&fVHtvHd6au{Y+UtM($AA1s-~6+yOUokI9^^{xl{LSZzxlw9 zPd#wQEhkU(R%^RZ^|{P~w(d*!)&Bmz)tCk5LkH7pir!ucl$#`IiE0s!r z@6m^EIW+d<6W{su|2#c48+(Q7#N^~>KXKo&1KazG^z@7c zgM)L-Ir7e3WhFviaBi*cihvoTtdv9u0IsXmMLD=f8KZ<-1*0-Q^n?&`+;*^naibDZ z@OST-IC|oMa(MFD7asq{*Hc3doIG9}8SCFZF5Z|<;|-dn)GtT*YKNc=)`rytrIO#- zT!}b151pcn_=2)DYck=O=VuwAUYR)M&~el`WujamZAufXdu~1T3!l5?wHN08&zU!u zW+Z5+DJ*BKklV3$=k52LzU%bpw;zA`-~5|%ac7YVKP>g0zWeq^9=P?`z8#a>MgeRl zFu>A^{(pbx3yTYD8;zzPhJMc9Hdy`0{de7U>zM=l#zX)CqzR_3>!+W2{0|=c%Byc& zaLO@JsuU}qdgSAKb`QOL{<-b_x!X?PbK>~HTm{!=lK=f*|EuXYU%B(vvp@6br*1iO zrdp<{gtnjp*QV3|{M)}fePdoHI?6{{>Gv@B5DQ}8E~VcJ$2iiBkvZZCk7wE$i>TDw zQR*AtdMXeW`r|j>diW#v-yt~tFEB5>e4)8`BM2j90Lr=WQb}y89AlzT+S28DA28Bi zE9IlvrS;k6_4lcXA4Rj1Jo?XmI1|hHpS%!T6 z2mWnqec~DEjPJ2Rg+&DeAhiWv3R#tgy^;meFz&I4SK{`@Qx{&}v}XU_eYfr(-MMRQ ze60V*>PqV3Bd7QO;xBxrKVZN2+rPVfW4cWOqYGm@j{M_a{KRP0D<++Q`=@Td@A&EQ zwnL@2Z)$paesOkqsOLkspM3D1yN?|`I?(T@4y_oR;oR}v-~7|Bf9t7pH)a-DmK=w;h`} zv3JZ1+3WM>SO48_UYofN(;g^`n~oj5??Vrtz4dIV;`u&+#AwM(aOssR&u!oPjjuiV z!i%q#YCT#g=E&(Y$A9i~pIN-R@YS#U;lR+q$jjw|M^e9|DP_spgbtM$B!I8>;)oDlVT7C zz{=d_`R_jar(b{k`Ij!Pb&`}69rJmvFU@=o?inw~yn-KQnYN4-OLXtvkvng{^RC

2vZrc)w zp|HeI2SPz1y9K>n0or#o>MVh#IwLZ6t)|+jr_Hv?_lim{DOO#s1mO#n3PLqwAf9o= zSPSC7Bjjpfp+^J-rJJhVLT3Z1p(^dV0-LU$h<0$4I!C)~Vn;P$F&9P%El9>KkO`M@ zW0V!}2v~rj!Dw`BVBctIyowxcbv8HV7L%p*czQL+tW7dUY}jAO4Oi39pk60RapORJ zFfZZ$CikrGr%Ixyw<^4HIWSf&E-$n@t(;>b$XP-`1+0MO$XCVagtv2dI95xu&f?O_ z<{LNMwfSs)BY|m`d=!0*j~9FT`fJ05d~I+d3|zFNh?3fv7>-#BcnpOyAD_sLjiaY0 zwr+iWxjA(?SzXc_ZD@yl8P($OP%R*>&ib;F9SUn4ff3*VMBeWosqP*t?Hpu1;im31 zmY0&nmH65$ZAy|^?uVqO%m@1Xv7u_U+BdpW)Otmz71x-b$NDB!V9s2=_?pcv#Knpk z8bHBg13kh~WZBg7&tYvIRDlsRJIFLd2_lb?3C>xR3%SR$c6;;sw0!k7wz)cEl8{3w zwYj;8EF(c61k=Q~TRJB82Ob@WqttNojHk*2G zDH|Qh6?3^t#U`yzxs1TmDyvk>gqoN^TLY`oxH&&JySdtEUC;@)noGD0&Vcwp2%0AY z+r-F7SQr-~OtLgyUSGXFjcZq7HAn;qgD_?}D_BeMlp7FBpt&Us))8XdR^c8Thw~&6 zDHE2{gm-JKC_&dAi&)A)SR2eaFh^o9jD|)E5erJ?%`{nVu288sPkh4*JlF6`@HA>U z3{=Y#+bg5PZ*JB%>dlqw^KN#@tZ!K2&{sr%rO)gxS1Nryy+gaKOWF%Mw)LfUtMTL3 zD3SMGjqP6z*J$K!G--qtL|GpDx%WZ7PxYe}I^$qp*R@vytaH(8qEv$kv;=00~f-qQO z8MSfRDHOxAH{bNxPk(Z}hjkLn&!*H_E@-6`9Nja?Jy}~#UtjL4MZF`{6Nh$&;(n>KKm7J{(~YK14KEgNK6&V8AH4bAv&ROC zqMew9^*A=5`P@y%kM5rwVJ@zBR@?1%wNlCDRubK1?lAj~29O0omd3?O<@Bk;pLqDg zx8HoY=%E>_E7zu@sMg#fcm4BSwPhX2G-2DPs&)8QmEhtp)d-U0bUU57m~| zlFgR7di_ehzLx8+-F?sPpZ%GSA3n6N9P!m=yj*X#Hri3pUl?Ww_lyq@ellN3o2}LB z3{%j>001BWNkl)DE?q@!AW=9zk zmtVhOm95kUhDO63;{*M@y;^HcVJPcTDjWy_C4>;4SwKk%oq|x`<3SYCe6G`Mao^)y zIKWt{tTCCgS;q5uLSZeGQqDO>!HBWYW7~!&cZ@|5R@cq^!qW8I;?&I2@_IVlU)s5E z&vQ>an`}0FidE}Ht8rr59ZQHI)DZxhIYXVJU9DT&HG48!3c-XjC$Qz2XW`(Cg(b{^ zIW2&|rM}6C&8$^j(I)Ghg~{au3xuBOsRYX_nupQR69<3xbD#dm$(>3zuU>sU%}f|o zcWfUDM)|IZ9gH!w6T|&OhxR`5@V$?G^wwGqosLc$%&Dkk;;V0Ff*H7xq6vX+<)KQpMCUG#}6Oys9BoZpiHFF7Hj2N zIT#xqE|-f-o2|Ihq27BB2XB#L>^p&A0t)H~b&e1?c9FH?odlnea46!fl)Dlvw91cTNyO zJchsb=*Ltn!=8b91M};4b$!heYv>5Oh0E9ZkF`**$e>V;G$m#@!b z$M9edycldYR-28~u>8VOsvJOAPjBUp)B8U0&_id=+!jVyuD9Clwo(me?2h3br%xU% zu$pgkI;JyAi_KOR`ILb99!7dApM2m$BipwVhUK}9dVO_n_L`1&9NfKYVsvnzw|L1j zoI6V-Kv_;4JFxq}?(KnxmF2lkYXcmVF+!*Tqg(SeC9uqC1|=NEhI$^p_pVz1I0=gj zEBe}v`K9@#d{mei8h+^Bd+)pF_R(!MK~T@q&Gog!3v(*aO486)*I@{^a@1 zxXFW_By-v_IB>^^u}Vq_8|A%SyN5sdu?OzI_x`>b;wI)+TMTYsuy}CqU|;{;AlZNY z${)-xZh!{4eB_vyxu2Z4`vE?{-yr^4^kM*@E4lIRCkP>gIO~*ya!w*?W-Cjr9-3nS3N$N)X~vnt~XsK?Ep8lo!1{#onst(Ri)dTAV|p0Y|k}5>_$V-NAOP zOfAu_t1UucskOv{SnHf|4xrW%^rAklCP?G8E{^UK#+XlZ9rCyIl^c#r~= zqbFb5J~*~#BJ9bnXZ4NQx%%ZdFu#oDy2$_y4T5eJIkwRHeeNX zu$?xR*5%5E80gLA3M^M{6sjg)unj{AaY|clKp7~5Bh9Sch!aqNS`ZDBK?6j)kb09vjZ*qud*Bs2g*g zH>dQ%5;`$Ff_4GT;!0~(?wYJl?ko)Edg9(zTxysV)SDpD`$??+?*t?LwP!#7uSff9 z02=N1f&cN}K6l~rj~@2LU;X8G*1o^>rGNQbUw-$i#a#G}|M0(_IkfB1U-|WJ719@f z^_TyWcl+tXf~1PDpxCI_zw$?qNn=0rna}LqQ9W^VUzUAROZD`*7o}1jqmFRxdG0+g zbl&c1Z$;;Spzn3-5CLLs*E$WB5Ey9Zw)}UU1+k1VrnMuM2_bwBfX!sg1nC{?Gw8u_a2=UV8D3XP$lP zmG565T%5e=^hZAW@bEx>-|jspjvl*q`AXbs3n2jKF^rE@^10}_=bpRt`WvskdHwqA zJP&gB-+%v!6E_)y#~yp^;)RzNW@jqZo+Bqt?m2KM%QDaRyG~{fTf*&*fKuw1GulMO zQofX5USGR*wf@AnzWwIKH)NJfjE~%O;@~G9xckJ>L({Xf=PtatKD8bNzEyg0u|Ars z?$|NjSX)1L?)-Bvzxn31>nBg{zwPYNyH6e8xA)+gGb`s_y?S-&1~?fQ9l7I{Gk4v7 zD&lzY<=38j{`^aqt}SkMCim^T2$}#FEv4-&A1e^!Q(e+j%jyS?O zJ+Ob*!w)@p#~p_S!TAesJpJ@{Uw-*gCv~^ncK7k)Cnv}I8IWdK+-Mo40pfX{F(yfp zko1lZY+GO7c;ST?zVPL*IT}shSXf+MIk|r;JYup{=y3{T)ld=zS`{X zoj7&s^wDGc_U!EW*he2-UTLo{J+rWs5GPQko<51c)-Z*k$Fx%v5}OP3BGIDGeA zckSI#zIbKf{F8t7+;^W<(v6OcpT6bxYX5L%GDD2%j`O6ewNDxAntvNuOB}#Ctdmlz zG(}f-R2ylXHpYQd!I|e7N&!&Lt+86muA_=`8gP4e?>ce(XvN3t(^Cucv&s7E?2W1G zS1ynAA3AdA;P>|Ld20E2trBUtjKK@}caz*K!Mn(BAPxkUI7?l(bld_KloDzjEU^y8 z!fuIXcfT}etkK$V1FPXI>2?AI;-Hnvl5}|6u-GP zTQ5F;ZhCsAP^z81_4b|nk5FRsIiG}F1Wa4|p7Y*6;4=U2!Ds8s?B?|x0bz7`ZSCq=BKf3MIj!%C4F6Z1Azx!e1dgOn14!4LnUcmJznZh5`Yjz1JWm9Hv9?v;fRwaQ_zQ9rUHeh{PPrv4V71mXqyTdUoO1*LoZ8&noSK?yH1t4k zZftDS^SJFu&Ip_#=ldzk^PAs%{^I3@jd*5prPJvgK79D> z=`#oS@1hRhdi?RP|LK!!jn1|md-w0(_wa{qnVg(FapJ^N&%ZLiaycxN4j(`K=}&(A zwv%H5c>Rsp^Dmrx@x>SC7nb%MIC$*HvGKv-D>s(EKlQ?6Pd<0+nG>J>#DhJaxqRW$ z@BEkly0np|qIP9wsohDB96kQwhd*}Dou`z+cb~of&2N8oWqmG|t;i4VyX*d&Z@Od8 zvHzdF_YAV^JkP|QFPwOD=-iWfavltF5J(VUCYVG}vbB^Wt+SPoG|`uP~VR zzVF>Twr|_8dF$3KJCB{csyS1}LZ?|bxa+|FvCV_a_2lHK<5N=;u!dljN*R~EGOvuS zP0e7881k7CCwYB*>bX~roV$2^xz?GVnUm7}(1$+s7c;qNXs)VUFZvEFgV2 zKFa-t!Qp(lL{@c|7WMQL>NU8&A)Rnij2rF%5{3Xvtfz{xV750a_FVGpnm|WtA_Wfa zAd|_i>-Prp#--ZQ{KS=uo$FVzu!2Sx2H-9{2L^}}EG|Q&NRw1^2mwdH72q&rI2plM zF$~dcEYHu(PF=T4Gf1N@_a>Yf)r}A*$mh$$1H&6fOZ}BvH=4aUm7YF{iJO>PhOwR} z6RlwgN@KB!&fId$eI%s}-a9?J$;uV8#)SMf?wtDpfCa17k1M|U{V9aPj zs|BTva2p!)VZj|Nx~057&>zpv!ktHyYO=oLbu}SXNUaN&1=rd}Q3Ru56m$ydg6x{b zoz)uqr0HA7mlzqLI9aAWMX4pg^HIu$eHD0K z5+|*N<<{&X+7S~XBb_dhiH%-tCCe>O7NzimLb07Mquohj#WitQ=?W_Zgd}hnKrmQ9 zTV@1l3(g@O zVIeFGLEMsJSZgg~5d8K_8Dlh4UOAw&+nisVAHS?`UPNsf+->+}p~ASS$QtBJg$?V< zV;fB9E!S4-m#(DKGiGK^bUQ9!3`-jgByFToJ>xBu^Q^BbE7@?Q+Gxxp>LU5M-SPil z#hnZbfI>F>!k_;)5B+EVbovghc#l}Q^Qb@j%u|2zTOa;uSesuR5cqPVQLPO6`O@6- z@;AQuEdc+?r=QxorT?*q?;@ie$9?gY*E;iaPNm<;W|dO7?dJPazXj+=Qr?)wZKuZG zb{n==dmfyKOm7xp;6x0Taqhs&a4tEM9AJ`LDCU?<&M%aTVHQ`fEWdK-wbx$$9uXDG zr-nw3uHUj_VtQ_FcENX@J-c^4{@9~A56?b(^lM-H{PCklC#I*2rBkO)DWyL8$zLBF z96WgN;CH|K-Pze$&vlq3OJIcY@vEQv+~-c8yD&R72QGKr_u!_@W96!xoNS&var$q+ z@%8%68(x3k>GK!1?%W+|Ha9m1&cK-!J-w9y6L!rno8mM%eC+7?b0=merb zJFg!~mgXMWHd1=eWAECyX~VkF;j`0qqf*zAo^%QUl7@Nx(CdHo*PlOmakAd&T)2Av z`i(1`*%O`;C-b4Cyt!?%9sD<<=2j!yFQ1=ymI8^$rGo3 z>o=Z!>JuL*XR4l?(~6~ubsYhcJvT6r0V5CtbRiS$-@W6$dk;v4XP-Ot`Okm;&EuyR z7Hd%Q%8mKcXD)v5iFg0{NAAsKynLAPgycf>>YExv02Z68FTD8O7ryt}@mG!^-v=J_ z4-CBPU5`Eb=>0Lqy_cvdA^Vq4WiAmE*i{)!qFHcWTKalxPKRP-z^w5LvK6z|m zZu&AQ0V4!lt27x)M7<3FCo*e$Ex;OUduBsgYpt|37DUM9f)@|H`Sou+{hb$H>MYg3 zMBmULDHXTg|L#Y2-F?^o{=Pnki7gv9Y~8rA72(Xe^Upl@+zZdX0PtM4c;wWX&Aawq zo|qDjV}&$a0vt?&7)Wq}BW0Q~Iz>Vt@hYuh5=F`tawRTwSJ96~&rmg$h3Ds*WEb#6RvAyR3O%{Y!j3?0zfvuD5i z^lM-H`g83l1{VVx*N<%28AL?&>X zo%CnnV(`P92~kh#WC1b&m?cgO(#;kdap&;S6LG3)wNHHP1NZ#SZ#-Vi20BeHT^(=D zO!0DmkS}*)18YSlXX4J=JDHyvhtFL7%fEi+&;H<3fA$BT+P!)7C!`MDCSq>OTW*&K z{KB9A@twZEw~3e^@&o?+Dx3s>bPC^P0@~_kI}Tl^SHjHkJt<|Xlob*ghtb+q|B>uz z0y7Ny*414jWvsP=F(SZ{E1i&sT@hKOJFP~uwpw-iT}KK=oI?l}MIFj;Mw+Z2+gyyxC~@87!l#q*c1RtmX??z!vN9ykbtH;!HS`d7dF=9@=uOwG2JmX4jf zeD>1Kv5^gjPoA5&F$pl?dGG(g6Xi^1Vs`P!i8I%)&Y-XkLAE?R^6al9$W*(Xp`$ins5bF08A^-@!Zh)yL0|i+QU$I1I#~z!V$l1c4xnaxu4YKn#Sjj#d_DI+GJvT1A?`5dz$U1d-Op*u-`;A%Qh;TnGo8 zg9D5Vdb)Wk1!4WhjoC|=)%*lVffJ&x>M95c61I!rc zc#gC>Ng{M1nCmE>wp%)xUlxA0T<#wk@T=wg@L+rXCSnOq5K_7x_x(ihHYsogN?;>E zg-i&bWuYy>DkPdgJB)J@P#ipiY}sGeFNSi;v8(e7OE+&|Vj8s?;sm6mWghpzokR$& zv|L>6SUy##77C6x80H82oxy?D>>N_Xq)6i!sf2W4$ko;})@4wfwUZdefC1J(B`{oY z&u|IBrO_0($q6JG&k>2sm|$cXELk$J#2DjXmT?mDtz%2ff+=DaOj(mcc*upKT=A=Y z){)&>y|%D|l?LL}=Z+&R*JL!*Vxzm%4D&hRg<-j`Qz+Bq6baY0Z%9o_G-!83eSGO&)>mC-sWOB zq33fg2%=}20dRsPkT&RvXYH+^F6WRC8PS=qw`a%o&1;xnK&k+X`bv^^6U$L5dPDui zjq9EMzJ=AL+O_d`W=1Y8k&2`z1IIN$Y7AnH6lg??wT4s3huOSS>1Wvzv6UYvRQwKp z1U>7PJJl=sOz^M&*&qB+n;sE!TMKhr0`sG+4S=Vfc<`zBKG18N&jk4&j7k1I!f+l` z2AA6n$;k=wvx`fg|NQ4wyYYwr_%mZ0Dj$5}Ue9&4*57^gsA{&{Vj1>lhyXJ{+))hs zhq@p2$Vuvj`k4hc1VzLI2aJFfFkDC%!sk|MZ3zG;NMn$6(~dTl1DR~GSgIDw)lRF` zXf&eq+Qj@~YA6iy8`rPfwq3U;E16Ski@3r5nXpPn~-D>8E$>-2K4A zcWv9cb=~Ob^3tMJz4R2cTjt2&H!fbf+-i3Ge3AQsbUdxBlqi+*g+d{d$<%{DN_p+t zwd<49LB5hCin|`TAjZh{1amTXwaHCijDPR(dCS<-3t%P$`~efn&KFjK6|ue45GxOVmW)Sg|tO2uNeR16$Z z2)%6^M~14R-movc_}rmGugxshoiNYK`6N;2&R%(C@bEqR_w3s;>PX*_K{iuL*NB)~ z9>YX{VN4HHi(?xGt3}MrwO@MW<->0tt2GlpR}oHOX|?;t8>g#<(!1`vYtyjwn9$wG z5mG5dmIXmzfg3k&y!qzw<44}~`-crYtyrm8-n3~`F~HUFxo>{+TZa#yTwJRAe$mTk z1?4VXnrL^sLB{*9{@}wqx9;1r>FkN4Q%nhA9Z85{MP$G<2UyRY#ad>G6BuIx%n$>5 z)dYIwqcJft_l3`W;q{}(0p=D;y$YXmwN5?fyc&DgLMb>npoAkM^dd`k{S4DsllZI#B+LKmA7lKKMbj*YMw)LLRXM(@@Z-2Xx4ZrmK8$ZPC{E|Il?gaOJ#<@u&s03uXi!BHV$4%lm zQ3_;{$%KVMnj~vi5J0aW8Lg4BU>4}nF}Li}7)i;Aj8=dmE2Ll?mUFU66dRp#Kr#Si zjUuB!mIDlyK{IF$63j4Y2Iu0%i${+ho0ymqe%81lgfloeynpY3oR1d|9r{22kAHRQ z#4$I>=d+omg~gSXmG%9_2OfB!R1GVY3Nxyd_4jSxGFrj-_|mt&_T{gC<;(3Tt_+QM z`D(2lpTB(b)afh4JmmY~NH5>#J2Fby zt%a@yBgP1v7$eSMfh!kpo;-dwX?BCYA=mROrSks$d&kDcIvu?B+Tj;peEIsd89&Hp z`*H}q`K6gx&zvt7GMmOWY+2vG@4(*5q1Wrzm!#CL?A6aumRoS-DwRD44-|{J>B+fg zzw@o{zW5xa#^Jov?cBV6?L;wi-~IPj``*22)26|}!MVk&UDM%Sws&3M!8`Z|hhLa3 z1^~bqab^f9L;{&2A}p`QGfSpFc?*Y=sYVlvHPqWk4H%f!Mk_&@3z0XLx1xmcCfc3VMyt~<@_t?j z!@d$S8MInRH4LoQNs@rb^}TF=Uwf&D85eQ4t)qbXuIKrV--)e+aSaoU8E}vbFW}X( z(_gejH(_bqZlc~q6v0?V@W?ProO6c@my0ANU27mtqQN0->?;q2ZZ5fFaEcrW7zrbpbveP2E~msO9Z)y~001BWNklEE`woE@VWGaw7yJo1sWc5w~S>5t8jQy zueGPA_3Rv0R$0^rCpZC!Zs#ZcK>xo(7t?zH0w)-|wovY=V;I&*nYH`n)`6UJAy_9~ zZ7)q=_B!gzfbgYYifoja6h`_8T(?|c#axGBuF=5k0=ltIQ!pd~2{Y&|OPGg*qh&gE zRgamQ&$+pN$E&261I0g;rurXx9#b#38MmAo|Bf~Q7eVO0{C1nCo_G+zU;gzohfiPY zE&Q783QKJbVC>)P6P@Afavzj5d5KlR=RZZ~eWlV&^lVM=1{ z-PxUI@=E}LTj|5LH5mwz$rj?M@%(e&p)~r~$DTZR&wcNHWWVcW96$g3E3c(d3??Dp zW{yD5h~c(b!>!qY_q1eeEkVg}7`}F`EVKo886z-e!K~mQW(6!vsuKfiHJ2>a(Mn_G z)VcGc>(`BJsDAvDpB@<=x_0I2wd>={EA><*fbe~HWVnBHct8+1?3S^OANt_?U00SW z)i~8FtBp;Yw|cIdbWtvstJNwDb-Uf39a)k_H*eltUS1YnwwNs>nr3EZUp;(y%hs`d z+j1ZK#3u{6@ZyDYOG`^v zo6%d>Y3;&n-LhfB=m2M!n7DEM#zZGkPLO3z#_@8kW;DOJGC4WBG`BRA8$zmWqJp4E z00j5EAOWUlW)~NiL99~gYj$+ZY(8Ji=Zh(D<;s;quf4vw)H2o$vl+>Kn~GY!rcH9~ z>W%sNxKhsbmj_)D2qrmk4p>c=bgvMVU_ehB0x+_YbI!RC0zz;hn3P;Nf?@pHjl+iz zuP)X`w`^~95+dScr>3UnXBSpiI{lT*&h0z;t9_Twojvx(k-?8Vx?}ssPyG5*r9ydi zxi)eA=GpU?=V#|w5O8CNI5D$Es98oN$WTPqk#b=3=3U#jR4Ww~N2y9&*L8$UR5~*~ zdu9Aut=`tDlEM?xGXx?=)(RmU&JvXr3b|d|x9#1%lL6N*U%GbnN@r!o%Vg$eXWFg$ zgjBOsILuWG8NZYZeSt3Naxs7Z-FNvJ*ZM&#Vm8f`OZ~ZGj(|))TPWn>?p&+W zj?=^fwOZ};*)x-qlZDD)9OM$q=9lXy&Rp2HYv-nQh5!8bet%?W@XaHKXJ@Bp7ZzLf zx*KMz)kwNZX{<>AvyC8@k(= z|M*8AedM8!eDM8)gM-z_4M+*nx=MZu+Slk^T_;GY7Fzzx2Cz5Z@|`k(yeQ!hO5 z#XtX(LNFEVC#Cvy;A<+2v_}NpZYqeT=V7-!=*qU;&R4QefZGiZe zEn9{M`}+phDacyKNY}{~^U8p8l#362b!sFa6=cX^XavV=O?d^JB||+%BmB0<79k#>B{w)ro!mD z;T_v{oH}tTsV@z0-u%$Pz5Uhl&6}%d&z^0xn!<4aXluw26K*fs%^1KeW5gIShU?dB z=gwYUm|u}$wvf#G3l}a-PtB6yQUpnC+esHrxY|vwO-@hD&23rV z@B5yFg^68ZTuBTHq#zhL3v&6fZQGdu<97YJktg2sXf9Lqq_euRKxB69*_F@drNqe4 z=2u?0q8w=;f1dJ!ckm8=X^=n95%$il=~_ymmD~^#AOTk}7R{Dfs-;VHIX1*{ z#b9K(J>8GxhK}`GhD)Y^Qh#<}&@1FRNv$?Nl`PE3Zd+Rm1}24)EMG(p_6$XfMs7Q4?|GDsAJGg;{M$aUusjt5^p_ zM4Sst49Y?qSaKK_AQ!YUH&>sZL#G8!AY3-(TdSl z4CDw{odVW(rORbth($^|wq*<@(Mq?KQIX?vWHUj&5UsAD-9emoYt823N?0AtxFIsd zsMu%v2Ox!wR42AjDGUU0p_G%7<8Z|VI723M`^qQ7#2B;IQZK>h$Ivl?K$ekVmUDPnStvWDs>qik z9oO0kS_!NJ*N?3st|2`rjZU-M>9&$s!lPW?A0AFe*U{z6spXEb4!Fm8!i4Rm|0i9f z%A}qaj`loT$ay3ErLpx0MAT`;)05qao2adDojN^N3)1M>OMkzc_cG4u&i=nf$J`FT z^+=gpj}0KD6yO5T_7;gl;0#fxj+Hqq&7s}MSP>egQmeHf$>2$3eaZ*Qk;)p7M4^mo zA2L3m(W}XwSQrO9K(T^C3Bds46=GR|G+=|NoCnS0r^-|M2hPR(!tnbae{9`g8&gYw*=-Jm#udRK5F!BCJ8~h^~`sCFZZ#JJp7Rl-uK?e?;F21{pzc)9)0uJ z$qSdJXBL(gXZh|O!$Sk59ICnUAN}J$u#`k`CshP4h4j22lgT=+i&{+vu4jy4jJd9> zQnVZOMzbbekC@Pwm~`S)pE!PMu&@!e_nA zCd&gCg)mzTvr~1$03iec-A+=gHR33hUN-8cM)N|xv~K;zp^*^@bmFMpZgc6lP6*=d zcE=NLn8{_c()WFxD$nz+wE%qICn6X)k`o!r4Fd-=oO)!lT{Ar)T5~TDoO(PBV6_dr zkh?JvDWxRiTyocSo6V+DiU_$dQ^@D8jNf?nnP*IzzVC@go_Oqmd-fe%n4Ld$;`HDC z?bDaWueY^HjAq0bBZBA|NHb!LGnJ&de0J;D=J!7F#Lk`D1z@!HJn0B5EH&OZaBljE~)X|~{U=;D=$ ziJ66ZZFz90Kkz))!R8Iw-~FB6dg{ZEl`6#!=Zy{tTVhP+3jpAG-ujIjE?iym1D7!- z03k#i$4aScvDi%{7@Do**vYefrTqIId-%Zi!Qp}5`}jvca{Bbi?;U#O)z=PRyD`~` zqkO3x7Bb0C@M3?9@dq3L@!nV0`?7jcDg$tE#+kJsO8{9;OmN|a9x>HzMsX{uFTK%i ztRLz-uy^N{O@ntIylZM<^}^K~jWd@`qk)2i=fT8pX9@kY1ns}{{2T1~-{@tzKDcjN z8)vRg{}Kx`{hcs6g-%$I z85|zkwR`t(e)PR@3+;9!J-4qyxB&@&p# z3k$7!ZLr$s7ppU?od_B{kX|MnE^yadtw)e9=h9lZ47qGRlgYs0+H>MaWix^AqFGZ@ zH*VN8af!kp*GNgl%=H54WlJSDHE}zRilJAk_&}^<_z)fg#c`*xnsy>bxSacr?*=~F zF)m-9K7VC(|Bmv#_ul*F;ln4E76(h&2M_LdB~G6?bL!NYBvwwwk5$U71UbakzIn?4 zPQ-~g0qAt1W}|Jb^*kp@qbP0#;mE*XnSjNWx%v5NA}SOLewZ~~<4UfGj1l#EcX_F1 z0YR2q1D(1c4^~18A_pAC3L#3RQs|?!e&kc1`t=XK@BKY4Myo^!mg+QHC_853*y zA-!mjbfgys*_?I}t0->OQC~r)?Q0VlidCW#D8Y^63f~3kB-Tl{tCe+%eTf0Ag|@J8 zh)H7HqE%a^B!TP7K!7DWZZl$q!oW)E84)7LQ7#|5Uboq9HzPD7B;-p5*0cVz4BRBT z-Ktek6^t=56vyp$b0u!)0?)d_&1WJhVJxDARvOX5QZU>KtCjxs+bhy*l?tl9++AL2 z%`9W7jZR`1<0(N|2^bF$9HHcS-v%OK+P2%xS`CdRPa@YS7_DQKkTF6?4#9~@<^?kG zLu*KC#w`gUh41-65c?j3jXSAIQ*c<5S_bZLxDp$XMg_l)buoJHP;&E3gQf!ZtG%h^|V`D%&kA!kNG%vLI}Z$t!32RlGq5c z0hx9hBaRS7LX*`DObQvYz+-_&g;3x1WFEyW`_G7)RiG-5Aos_k9LYEaiK9R>slpqT2=I z(8_Wy856!A1VIo*>FVlgyWKA2OUuo;+wA7c?-2-+3jo?dtJ%D8?!4gk z)bSIYPRpce7>1m4W%SI>XTgNsJm6?S+c<|uJ z@L=c%X{wb{{ry!x^nxJcdu-Rv?d#SLUz=J`I%(FIZxIRT`NdcU#(KRNKg^r==om7+ z>?O|mn%BdvH5%&)mN{pfOZ3vd49Ju+aHLG*#B*FCasK>yYxVi#FaPGJp4_`**Oo0~ zTgS%kx%AGlk&`i;8H>=gE z<2csZX1m=bXtEZhQ=P<0I017*-DzFDc4Kv6_Qth~pL+5G>xTQbZ5^mqAK$rW_x=M1 zzx?%YoH~C#iMvjwl-Reu(PBSt#Omd9tvSCEI5CdS>S|ah@*tC{D9jhC)j~F#bzKL* zlG)M{*vx9tV6!t}ZQilrAt&r8X>8B6w-LD+15NDLRo;8t$u9 z!@vU&cbeU1qtP*`G;o8yQgNUR-4r&B8mr4`#B-G)BV51P?lgii5fgp%x0v+ zG_;mvk)qpbcUr9|ij2$tVI2 z>MblUuf}m|txeN3iW6kqUuN%p2k+qLg`c0G>#g>mM6_0bKyo+?f*cjA)s_0hbbEcJ zx_e{LKisbNt85;PF0?@@i-G>~=(-@Et=Cqjua9G44r%OzKtx`B8i@iUuC+~#=L+QszZ>S#)9-vq%jjs0# zm8hF)gOLwbp8_$x0!Flv4G)dx_cJ>X-{xN&!YjQ=^4i6WV4S*C*vT zj&Zz(rbxFz4g|DhM2s8sg@tUGlQK1kjLW1WTmz?Ta*6A+jA7wY5-&5$EdtJ@6kSJj zqW362?C+ZbdQ3)JLI`%wIB@t5n_+yX%*Pr<>9(izIvx7q~AN%YVzj5^F zaV|u!$AZ7j(C(T(?Dn6%1Oetaj_P)_b-`JxZKK&%gucO{V!7l7t|ZDAvdu-K;-r+x zx09N1MKPZXf&jqu^z4;u*NL$(mv7h2_3M)}H^xuA`NqyI>-O*4{rKaL?btE;3HM_J zK0W>KJDrv>DpgosT6y)*OINO*&lj@B@@}kLFT;czCq`-8P2%$xuL|z8+g;A3AGk}a zD~{{ON;4q~`MewCTHQ!#J2O2ub>qh5_~n<^58btY--8c5uy^Ok`VAjR6mCw=%+Aic zp2vl>B)}vXCu2;~T|Y8-aPOYG_iiz5JpJ6W7tfuazA<(F{MiV}K!2h9+n?IMcWTA04)uFb_#u9b8+x0Ooa+QbZjb77^!jMadJAdpH`a+YwbJM_oby2@VPKa+O9X2Eh#@hz1DSH&bUcZ zrJ_y{_Hjp=Gz~o8^E}V<1b4tWmr^(`xKIX}F!Wp*bvoeE3v<0SdNv4pRgjcYtBraP zg#G=4b93`kQ`57PH_jeExo7M4eY^L(=hxo#{>S!gShw+C{o8+2Z@qG3VbKZmrBbom zQA!yhM5oj7GCo|lR;#`A(o0rpG7845jsH?Ojw>A}2m%6>QUHvxLI@cIWRhmPRVtV7 zzU$z&t(yT5Vb{))eLF`0=$?}-kN|$~hV|s0Jv*+?%wL*nLh>|Ci$%xt(1{Y^dY%?t zV>su=7^RrDz50O67-ONVwZfIgq@EMRX{t4XAh5(3LmbCoEDXbiW-aGuGMTW`YLp9w ztnYEalY((Fh6<%ZEuxDTE;W`WuV1@-_ntim_Z_(VuDkZ`9xhcrr45^!S(uubXf>Ld z3~pXsI{NAh6W7jW@|j35E{ka==yszZE4-YTn4LIv@k$)Wfu9M2jKeTLzbLrlWpb_` z#GTY}Guc8uX|K-A&A#yb;>4AU8%Fwf>==9BCH?e^649BK3O(ra?T ztkz&gx`LQvbV^nm!{B+{W|KjaG39FcH-6(&zxC-)_Ep1^r^lat{)LxcetCLsl?O#v zI*EM?mESKEhtFKu^VEOWEAaOhfBM@W_@jURGrUMoEc2^_H4|lP7pA8dCZ~}QG(l?^ z0{}umN+v|Fe%=p(0q914p(GtnL;}d=GmMeesq4zF=3$sCgxO@JmUP;MN_pex$mY#k zCBxj@!nt!7R#$8Jp}sg(i88`-Q>~0K0JPQsgzG4yTkQ@Q&lU5Y9|oE$ZI>38GdW0s zZ+`Qo%V$mou9FxRE0CKtgwS>4xXXk*d-nAF;=-<-TbrHsD9aJC!I9BRSFbY0ipAnW ztA#)ms(n1_w7VU6f~k0Ae%i!s2Zgv87b>J;n-9mGSE@eCNB(TBDe+=p-epwqbRGT6?7Q#a9sK<8Ho2HysPb(cv1aN|U<|@=otUVj>NQ?#+g9vngM9z+>d+`P zBcujyAj_q&nDrbUH`}VVj8+|S$0n)ZJ;O`B=0el+jUwBlT5fAld(17P9swlRDi9lJ zW2h%*7J?HaZJ<+VL$Hh!6VTAA7rf;h+=4UB83UIJlA!sTj+HT?s_KdXfy+_m2sLGm-|jP4Qw`pVm|3cU7`%Q zBe-T3hQPVt(z=qQhk<^%Zb%GOk@bnx>ePf@oJXteB(V^r0k|$W01uqQt|{c#3Stdy@G=T4PsMquGh1vjqJAVzz2_qUnVdVCzq4 zlg|dD{pBA$@S)%RXaD18e!WMveDPoWaijfTzNKm6uOxn~dqL9aKuXtfgb-`_9R$vJ z3MM_SJ1VIyWwQQ5k39N`Pk!{^efwH54!w5dOJDis;UmY|t=P#F9O)a*BbEL~oZVX4 zQ4StQ9dOP$H(V%fX66$@bKY~l?QXU2RosiDNRgDtmMCgpT57eVcDH-6ow&P$Ajk|543M#d zcxHYD&W{QkS8 zX6Ic)v-|IR>#es|R#ui*i-A8nSt`H!)7Rd5^Pq)s{aldAgWOaLV@X@~JdfGt+dDir zSS^*)bbTh5B_-oTlMIAZVU&bnY(YvnI;>y3cyap1^@|^#zkK=fKm6vm?%lg__wL<$ z_UtJa%R<2Dl&vKtl~l$Uo$B^%erRB@J%j60v+un5)}goGMrt$J>{6{XJlx;YGtgG( zXeO3fL~-i1J8_ysQDiuy9M1@9q=_de)7};dZbVVBT#geM7R@lKH{v#JO4XXLFfcIC z-rklPe^t2Dwp`&P>lO z%rEZSURb|w?%C7Z z9jsPx>Eear(z4??)*{iCNTpiW!rIpL!w>D-x%IAXckj9V=8+Rgyx^+97}KaD&Voo< zi)IuXFP085Ng+wV(b{TjAO%SYSW?oYWWdD2Sev9qYYQOX*5>(c97m3$k|e4Ymon|S zbt6N)-CY2*)4uaWIC)7si`JtYO)~D%dZp4QOadNDklgs#$sh< z)$1OKYqc~DL0S=28};!UH&&Kru8&<=U0t=}H}2Z8@zF;gAHR8Pd8M>mZOVM%v+X%d zEbOPGF)XDbg0(P4GaCp?1W7=e+G>eCx#Ooy}PZmFA;vV zUT@0=#bVL*Go)maB&(JB{PObFtpoe^?>~O}^w{K7rBW&MwH0#tN}N_!mQ~UeLWm$E zp~S|M3bY)u@7aDA}UX)--GKRL0mYg_+4yZ0asw~cO= z5@Xk{FD`WX2;fREBp$-&PmYaAgtm zbEsBeQ-(2uj8F_otdxbaR=}?DAZve&UK6ul5qsXprw**nbQCktjJmctzd<*Fc2h26NRlP zCxQ_mAxQ|stc}$qq$?v(2tci|Oavh;TWy3S5JMP8FbO2hCeKVqE0y{A(&A8W?@(K& zJL`6~d+i0c;8ItVdU<`btrS>pYRRAZ}SSg5v7HsaMU*jYB zG`A$ukOocyR|})9wMZE$iAY$M0;)xCu_J^d5XW(Oc{!fBX>Of^u0UBRf@L%{5&;pw z68s!;9uz@GXx7lE!=`JW*Z(kRjTHSSP^mXRJwN~ZfAquO|Dzwa7@4+Q<`c=F_&I9d z|Cab`w{#&}nb2&Zwb5FGTicnnATo(l$lmw4d;al1`u5`wZr6<0-#-4@YX{#vbfgiP zwvJxm1!2Nk8v^~Uh6Gw>F%|$Z0kCPR93L#0MHHJG6SpR&<~H|@Zo6yeqmMr}qj|ZK zRx7Kfp0owoty?$ldSvGlk3Zbo;f-CoIdyxsQcu9H?-w?1+MH2pYU0ZB+!RXl^TKY} zu%U5}LO2k?VzBaB%PNXDs2jLEmPkBp2+Hq%qri*vW;E35N2u2m|Pd-r{A z-`AB@{t+7-_cTey0&wt54 zo%nD(UY>{NS*`E8@4m+$e{6VoSV1YJn2ivkHT%PCnHjxRT;CBw8Ut&E;{}fI z*Q(*{?A+M+^(P)1-Lz@bx~p^)9ZXXo)_#}=1XSBi_UnS1u{f99EI2K#$VQUSA4N;-}qr7g5!18m>A z<)H`nR~pT$H*OVIR)p_w+`RdTM<3d^|9)Y|L7InBzE!wM@(cL_`3QXl>%M^$uFB4G1xV z1q%Twnb}b)k&3Jx>K_;#9nJgrk1xOdmw)l+SFc{p7248-Q)68}XoSt)-rkMt29w4M zUwQ6{dp@^sbldx9$L5kK%;oaTum-M^aa>ob*vM8~I!Q&+bprwOuzlr2M& zgpi5mM8g2X>jv)Kx9`Hu>8YjFX556L-MjDJbI;Df!N3A>94n<9&+Y8&%=NB^u*I3N zXm)CKX?b;emJFVH;^|GByRt!cbadPJ#EqGmxmpA3H*earZ{L+mXPZ|qmWw5bkOUR- z9fO0zLBR=ayxNSbb&}+OMQUNRP|}y=8qL0>n5~n~ZrL#4lfFHEr8qrRT#N`-2(jz# zJ$LWiI5@PfQ0Nrox(=B&1LB_()(W&r9N;5;9s|&EBFI>)VKk%_4k;3>W273&Zd$+Y zg=e4st#5pFeXqDNvHIg5|L~1>KUl3cA|u>PUb${!jIkl4T$>vEJH*Ulu~Kgqa=}Pn z*RjQx`OD~k_L%#qIq{!e`F9Lqg@CjSzyLx@*=m`#y2PypDwAj_R&a-f`B}YXh1J$o zUM796|{G@=Z8iHciz4AiLX5K$dh{{aOBvT!^ciH6XW_>hJM1)5H|of=tenJ}k+Er4^3!Gs^KoCTjtu5ZUSJTW8OmzIW#f z`wu+OQ3&?zzPD74Pn+ z2)M4_Zs1v~l*~x!A+^P&S-TZzs?Wx z(@VwTYQ$+G-5^aiYz2hlc*ghOyBgZ23}XceAq3l&zD587Y^@diF+TnyGTsVs%Quf1 zf&c-M!jb^NSZE`3N^GSRa0E++&_J57_SiTiTkL}o&<-Wq#zMk#kn!LJ0c0A*akZQz z5rlz5%7H7ausUuw5NR|*TUuC{@z7mx2m0HG)@Qqh@_s(IVIzAm(Q?B!Y`F}rktU9| zN(&ak7}Ayjh7tyjl7=9dNJ?d-f>waDrfCt@QRKLSB^hgDqoETdF_2kvbYPN}s1=6V zN=0P?3&GSf$rG(K6hXpD(Tb8`0u)F=C?ZKPADON2UuQG)(M4-nu%B85*F$IC>+f_s zG8`qUT3$SV7S$5M3WSE+iqj&n07=9eZU!Bl7#_Aewzl`}&pZR+r~$H*aFjGlUj+9snHed@**|yrHpLp48q>OFph=?s|2qOf9NJzj~Bnf1UIHuHk3UHJ)v8k4@ zyok6Aq)-xI#0Ew{IDkTsMdU$Pq;+r%0(=Ke7v_HmtNE7m%ctF2KEi?BTSxl4rWcCS ze}k9d@Bh&c|KAtiJ^CmAdZfSWpM2$s-~Xc@{?b;o|5+%{1E96G)_x@Ek}%9kTCR3< zwtsHleP8|ZSDt)idtz|#_0xa;=ieK@Fb%F zOC*)+x;jpbMj|kAYx?q)u}Alh4zFAP+u#0H`?j6$A3HZaHlI|Y?dvxjc;x@RH@ZUl}eakczyq~&wsH|uT70lcJ~iF`K7Ns{Kx}C!=3dgDc75=`vJ=$ zPK{=pTEy0}R4S8UM@C76u#xNO&*gHdMQYg3=7sB*%heArjcwnu<(UUIeEG{?_WZ1t zKfOG?TId-Z8S4A;^G`nh@b17tJ&BT7OX)~b%%XK3a?4UpwtR5qQn7sD>iE5rdv}fY zeEG{?%IEW42jBbf!u3q1`|(Gg`n4}UziUe_2vBd>*l0*1M=`T8##)d7Nr$aS6Afwn zoTFS@t=6wxxpw8+=l1UCd+xbsySjUOy4tT?z6f^ux;8%Y;A2le^XT@iZF8liQ>RW% z-kM5MQ?6ES-oCZCv^+36^w<-Rmx`rhM^8=6EUw#e|8M<+-@b3xhFk_*T}!gF)`Hmr zsWsZ7uP6BWSH9dkIQ-oo{bcOst&O9jk3Rb7=Rg0{ri~q|6+V6b{Kc!+QpO`sJoWHn zpI=y5ID6vA!tE&=C7rq4-FtR-c6G%mmX{afI1+-{A~lJSij6RAg(Pb&w}$(KpgU=J zQV1e4cT(|8tH~e)34-sLW>ZTylg(zFTwh;bKA%q*rBdnE^h{}~XqDe+#@dJ+oJPde zv8kn%mAkeK9eD8muAa{Aciq)<^4i?Qyw*BRVJ(=2weUPoW_@OkQ=MwpSh6fY1R+@f zEQ|%%GLdjxaz$#nSgFh|U~4a)d*O>Kv3~dXnWhz+w{3m?*{ApHxyx82kxkN=nSI~i zv2)j+hn~!4Gh-hfnH(92Yqh{pcWoZ+@9$@W<>lh)>gw&8+4l|~zGvS(&pmzDSAXL- zySv&?o;v!@;rE5gD%&|UurwXsvwa!0rRP zM}K)_o-Ii`wLTuphFg(WYs0V>%xu|0{8bjFm1zx-5DWt;mFv0^Xm4-dv}u!-Ud_)U zQyAzP+OzHMhj;I}Yscoox{Lx|d-L4Oue^T!#+2jbT;po1jFrtW(H=2ml-M}YuJnvh zjVNw3nL#NdHpV64=5vYGa|??f96P>cV`@6swy2&hDN^AGm+( z)~ySxy7oB?t1LuM|N&p z|C3iK84e0G_Q_LojCDf{|is=-Ls9q{jJWvzO&~qE*7gy-u9h)pMU!4FFv-N z1P&cOapc6AY9(?y+Cx^MrqEDiSvh{D&|a@Mj~zR9;ByoQ$!f|6);DO#RKsf;vMii|*F2_yljj1tWBp@B-_&Jh}v5hE-npGf0Kvr6t#=;m+$hhSKSgE3>u@WSUD=Uk&#s(er z4|KI>vm?WqWD7;hh#IIRh)h0#lMp*DD;J&zM}a6p>b61|tZ=QgCK7L_K9 z5M4b^dzRP%0sAddiX@ zEnuub>c9$U4Of4ZX>F}--3&mfR{PCb%VO<*)wZ1ETt~W2BABhVQb5wDO*g1T#|SW_ zhO|@ zPy&*%77OyhX)?BmG?; zUHSQI-(M=MeNindrJUBJlC{uHmlFi|+^%iE_0?Z{;K6%q2@V~){QVbSJ$2!lF-%^e znR2sOwjiZkPdPFFEi}MuIio*oX9`Q?kWkF2ASIPpTq++uerD6iz_a)5+O}z3e$%?q zoqOVy)V0)|%dXov(9wq~aOAD`4;?x*JGW@8a=i8+=-7Af-n%y9p1U^9-X1SxmFJ7@ zzTU3hp82K5$&<%#-kOF|rE=wi!$*DT+_!h=o4@__z4zb0yi{t28Zy{%_m18kOx?n} z?;SQ)fE-IsYDAJkI&QA59ij*!EHp!SerEHQt@qvA{rE$Bu6%f}D@@=}e}C`D`hn#l zu3Wmju(VW*>Ryod+yJbMfo1~|CbaQt4_F{E(q;TIu2Qs-JtTs1n+3vP=I}WN1 z)X$q@9uegpxyuclTU2jIJ&e_$>;kvZ5+yZsFo}uF1V=yhe?ueE67ZSNNKGB$M*xz z3q-ToXoObyfY8QVxpL+8*WbwdPw(8+|J)M?)~_3!x;ZI~>h9dIbNfhJ9?NC(=9_OG zJ9(m3Z+JmRqM8_< zLIFb5!=|6j+;{)|yLS2u_wSmYx-QZsZu|D3S`AZEQ{&?|8jWyba_YSg4iAm= z-?P2riD$krvT@TB&pvD6Nz>8OJute>uSK|Wnkd>hn+k=5KzzyPGatTKM6QUwr+ocW0N&L9U>Qg&~s|76}Qk zB#;DKD}Et;_-{P@!0&wXxo7{`|Ml@k!f;>bAO7w)@v&p;^`jpiyD)xW_vrWj;D7zZ zVgP^myWjjbfAQKUR(@LMIo#Jd+}m~h;(r5zMy{n7V9mtcS}RBi!4Lo}!&+tmDd-~> z1|NG6xPj%wYLkSC1orH?x9~p)O>L64&bpzD%5NMT-Z2PCxIA0DJTdvFfBKhK&t2ta zn$KmMVd8n7pUIOG`~5S908nkU`oZaQ zPBzy&@U0E~^6@7gT)$ysu~ca$CR=FVym3gRIDG7=j$>$1sZ?&=x|Qx8-gn>qu9yFE zM2n&N?oVDh`0C5AzxDo5XQsQObK{1-FZ}uwTlU>OIWyUa8vO&kcWv9zlcCwUDisPrx zEHAAJIOGYo1Xc`Y14so(rCc`9HikBaTiiPeo!vpcU9*ZBF=dr<+R|D&H(z=0(5b$j z!Dk=axp&WK-^jYB=N4AVl{m5M*KgagIS3es-ahx^7hk%5^ESMkakJHwjGI*+wDJ;2 zKbH#y#&1l%d+2aqZ|8=Q?qB=r7a!RF$hE6i0Nd5w*3;WLw7zeCq5Q$gvn`puW)1Tz zMa-}8_Z7d`yD}EU?2z!#lEw&Q$w+0vFwK}&YT;7F?I|GFj^Xvl>#pH`zs-+prRLIH zva*aMZkhHb7AysX0xM}rSmRijHP_fy#+q1DXILSaq!8LzSPNqz1c(3=hK*{u(zCvg zTL2J%P-BC_LNI-%COR$!hUFSx>i;I-@m>~lXFIzZg*Jp$L}8+}BOtXEMmo}AMv^it;7Rx{1&)?nj~lCD6=?{`aGX|bHbBC_ zF{BK+nv{{slC{cmDlLHpTO!-?#I-_`v{FHVrL;<02@SwnwzxxPeDVwPSM@R$%#iH5 z=qRA44ectSkgCgKWj-h^hxHPh2(AMMus~uEr|<}dVJ)f+ES7kwB!&i5-pRJLm%6)b zXFH0kp)m#)Ei0USw?DkDd)esEA96^vYLRpd^sU?A> zBnc3#5#+EDXr`uC*HK8h!0*T;oo#U@??#D?rI%VsRzk5NC`HO+!y?tNCKb>C(ikZN z!7ub*{+9>GE{wl%?7}yme&Bn5@Xvqa_wWfi=HLIT|LMT)(MrAfZ~pwXk6-`B(+~W$ zX1yQz@BaL??=KZv#(PrAmS0R9$7viRuC}%5J$ttQ=GVXc?9=-a;MIfYzWeo2`FerZBSZobeRiR{em@~z3~o$E(-@5t@kcCRm? z8MQ`wdwTkh|HF3(;Lu9bIP_Q3{f{d@X(R zjdw3y9!m|RGZM*4Rvh9_Ww+tcAY z?|*Rc;OkeeT(Q<@f}=xNKmPFDTZSHebZ_gP;^>9)#Q620 z4)=+N?BMpB{da4i0lfOgwb>h&fBmTk2ePBeeowRzxd-~PYkA;?A zlGLwHOr5!KdDG~+ox68z-?`(R_fF*Vc_Bdr&kLA2O|_$wFbRVU41pnCKTw`XVy!8K z>i`jy!$Kt5f)U5b_3_DrqQ0@mx7$ZY2EE?F9Wk&{$H~*zr^YWo@xZ;^9UC(FjO%;4 z*_@oZdGpro?c29*+u&^-*_DxSfUtp?naVrw9{ItKUrDv?=^tpu(b1EqU5`pnJ^Jwe z(cO2CYK(>n9KcbSp3$$q`ICbO4@UJ+cpXB>R9g*zWDsPf>uIfnd^RjCPft%x-nf3? zp25w7&bGl_tudrXV{Clsy+cP1zV*)Z+_G{5$j>-ak58pY-|6x=j*}*7%dR&Go7}7- z@cIV&zV%yQ`}OCa8|kKNH_I=*^wKM@zBW6*60~>jNg{{KFGeR`qzyMOp+t;f|y_%HtO&wl#v{`bFj@$^FR-~7dEAFce2-}}E?GSBIQ z|Lzkjf8+Q5ZHtTf-XHw)Z#@0L-}E%57mAKpDSfhM3WeBjuzi?96jwYmAlOkZEK7EaF2)3KA;Z1&;%_wL)hdB^qv!hpTgnt1i) zQ`6J4uolvppI;CcJ36|x zXYZulPCdd^MBNC&b9LH6#hSO9d zT`jGQjg8&6cTamZGkJUd!o@3%X5_k_V2|%)Y#0lGkXj7`qlIKRP7q|3aubGy2r`9i zuDuynQmy^HtEFglMfL}7!E5Wtq(hy0F#tzgOE^h{as;!1WT{{Q&qpTfwRiUB z+w+eZ0SHTuA=il1kTRqUStBe76}h@-mS*kZj2|~c&%heQj8upSu0g6J zkn|~OCK9OF#j-8c+06x+T&}0H+TDSAHEK4A0M~)5yn%tP;q~1EBXGRp%3^79#@=2) zv65rs2&>7&V9Sn#qS!TH+j2OzNYgZmB40a>;{^G9?0HtMg)3QM89+-0p%X4TKgMM@BiK(d~)Tn3*)aJ{jl};=dXSL)A&0sd0Q+DL1?XY9K#qWmCgA3_ip;y z3!i`L@ds^+_dYoH;)^dHJ9#RthoZfk9iNFD={ZullHw?`siDut#W2JjQH+m*CuU~0(ARcK9T_mI4AGd;Ze-TC=!P zoZq+mo`Ih3q#n&Kl+Iq5yghYmOJ8ASVNSZv^zB&$IVGKyV(IO74~=!W=gyx`jTVl_ z+OkQY)1(<)xpL*Dm)gQGoSR>Oa1w)Dws7hErFiL#w~E zU5o4GX1O#mIlfw~dtNrS9t%&v0k@hD#1IT_>*=X1FPuDgu31|tE>7*)zO5}^fTdb3 zy?kl>_1E8AH#qQHzy1a3qS~l?nV?w?MZG>TG4akj?-X+W#fujkjfQfZY&IKd0fyr^ zamu%D-8y)%GBJMn?5{){WC=KbV@ioEUPwZb6Q6f=07;{N$N9 zTBjpahx>Bl5#Y|Sj^AQ{^*C_J$&-y zBTql8@|~KfRI4v8&cA=?-76O_MfG~2vlqe}8^7_BmtI|1d4Ob+&$+H;m!TVtlgEy} z^X^+yb8{+_^*x8RU}N=~O^MaAMaIAi5QJ!1o3)HZnXOoJI%C|KtN?_Rf$N1PAxewI z;#+T>vnD)t2Oz0UA%Oq5yr0PC5b?4;7AAtDOjP6f%FB*VySZO z!^M}{)bSH-TXyY@$qSk07Uti5^YwaZQP);(Ppq4`alO%KWIDQLX6L^5gCES#AK28} z*5-0RB&?~IE9cK&ICSXP<*^&N?mpiO8m02JvGIDna_iR3o0AU>_IF5S!+NT?(`a10 zdiI?|Z%oWg6gs-1)UA|j$BrFeSsI+beXU+=dTtO$shiJ)t}3o9z5UMXHY#u3Fq~0j zbmEX)UM`-$aOKGHQxj9Onp8H|PHqs#pWS=@qkH&|wSJh{rYVFafa4G(ckSBsg+~s2 z^-EtI?kQZodiyVb@Zvj%jxH`2A&A_7l_!X$NR3WfpEAK3%fGl1`q+i*(+kCqOEO#d z{+q{tzu`_3moxFOgSS-06qkfQAq>N_AcT$6^V>jM<^SyJTaplsrI5BRv zz))l3lRteOSGt2M*RF+8l+Cx**nv)44Lp-3=PzDxL>SkK8`rP1q@V&LgE)+qXC_Y^ zKl$GAv-MD`j$TLyVR+-_t?&HchvQ?HZ|vVU*xQvxQL7W#Xhg5R^5)d+3S6IppjfFN zKY6Ctm!}8&*R9{OR7tPTH_lzY0zc37Lv&U5l9eQ$7*5Xgp;N; zkQ$aCkO~J(5Yj?PhQpT03er#v*$VP8sMS$i36~e!^KK#6*3&nVAf<)^l$MIU)Br(VcXkrU!AsDol7zC}Qg|N&pm~lp#(yMHr{h1nI*`Y%{5qR@{Zf>|nQ-@6EP%sGcreTZT!%6te^;l#+sH z$g#>rHiM2rVW6X}JE^kbngf2^LI3Fp&Z*vk<~E3l;_-BV-kXYzFz9pUq~7IEtF} zQd%u4N4Ua~E~SFv#6XL@6XbJ2wYo~=I?72kr(u-VYqr@$=(=qgKi^Sp??Pq;v9Z#D z=R##gSGVf!^b3Vp$I)sjnP0(51yL%L00|b-FdHJ0B$Ob_)^R}+)^Hjkth%vJIWO;b zg>D<%Hg?knwFbzAfdUb-0eafJj&`FQis}MN!qrw7Qku!YLJ&ZPtR_RkG8qtqEF?oi zK`0Apq1cj%ZKG+b6Ir`RYtKFZ#YZLZ;_FAh^ZlP3J$XKE>O%jphDuTs#|eyynL)yFRi-^3{Vj8p=+1f3 zvT=uUB?H=|tSzMSGg%=KHcD4+%#2OXnpfU-f~?OTl32tsQ<6A#d3D(%&(G$YRY+@H z*EMnT(2=7bo;_yMX5b1ziB!zM*u;dFZL_3YElTw`2=ZNhL#sby@33DVN+JiVPce{GicjT)cR3dTJu;OHM)s zO{}%nQ4%NGSn22bhK(z&pf~}N6asKmt3lxAJCe%s!euG|mO)B3wnOZEQn_rlo&g7iG`0h)8@tyx@t&UQiZ|et&XeQW*eSx_b#rDW(x&HoncI#>+0B9U8+t@%wIlvAs@JwrF8Rk?W~q79?Tz4U4PNj+Twb# znYbM}MHwZPbOgZ&d24?8!qn{9@u{V1GvC$CQr()k5#)2Jbp4J#@-h~(+Kk_Q|Im>W z$EC8Fz^RwZB25dvw=g#!H>x9Bx6LiDC?_jy3T@Up^2~QUj~PO+kVI>T7l1q7qQtFM z0}Eyi7J@{SgqF1+b?(B&Gv`k0G|YIOAunjlq}n!O&C&~Ud61LZST`D(Lc8w-r#>7z zb^elcGqLfM@1MJP>E`w8u8ElAhUQFnSECV4-Msy;4*j27HVoXJn`ne#wqqEIVL?jS z7;p&8V5?kst_zzMtBvpd@5$iN?+~P{P-b{K%)`eR9|Lnb6vn0uJCib~UL}uO2tzVGJ?mnl_wJuqi84>P!h|H|2bLpAWm?3&F$EU5PPE}T9WMpK7`{$p# zbCz?~vzZ+i^&fom+pmB3@1m4zLs!=#RUfcbn9S>$n4YDck9z;Z2Zz7=#BdDdQ8}3f zm^xHuI)!zr`rYsR-8*l**>}tmB?ikT%X=Z|CT+FkrjkRC-rGN6T{?)(S?&0o-$N%@g{oViT|M{JhX*t~3_Ha?T92aCWA|lFw z&?JOAoA~XMleBq#;s>WffloQ$pZ`z)8u-^wIpC9(=Eg8sk)qfog-uG6dar{xPm2P; zXk&d=oV@q;`v;Hie`9{^d_8b3D38Ij7)`W&wmKV6$47N0qnmf8b0&i#3bVBXH=9hq z`6qw&;oTqdgt@2wzz#Q9{FA-oKlr0>egAuZ=U68v$9bM- z#_sMPh+5Mdx&AO44Cm$a-Fpvz>l^=}nx3qUt`*Tlx3zmPM)ch8&!^)m$RGXLe}4T3 zZy%jJaJjflNOZHm`S{+U(+$Nya~q6}f#u4e7p$N&)n z@9WugltW_3Tn-gxo)viet#=O&$Fs^0bECwf!p0ai9s-GQmMuX!b8bA5`|o}5@BUr! zd)XiQGVVP&arwH?;ef6`R9N6oxl6x$Ct<4kB$zIdGrl>Jj!XK zZ+*$fagOK_BN@)bQ1B7ziTt33Fv^qZ?!*3#t>Iv;-`jfO)vr#DH4Gjjf2fn0uS%2^ zY5{Uw+rhQ%?Di|$KXrSsGpMG=^Zmyd7dQ@(EkrRo*m?EN;MT2&^I3KO15=J?hljH$ z=vj>V=ne2vZ*Vi)F|{iKkHgVeP%`p};*Sx--Zzd$=!udk^m(;g~RYn1|u0KQ4oCiM-m*BWxKEbpY*) zI4>H}cfq2L0DFL;v$`1DvT%NFrU=(Iapxsu0bz<+jTn(Ra3*z)N+2pR8ip~Jh!re? zASv03#VaokZoG2St!;Qd8P6XdA8K&|j+Ws9TjBJR3NaK@R%6Hn$C_DC42K^+x_|BV z=AgFL^fr1gzE&23`Yz@(jBaLkzHt5LzB;`1;@p=H-+kxF8*k##BSeAidHA{#G0Kjk zKw?qbKzWXe5foI%qX+TH&b2$&5r;asJ-ZWT$;aS@F1uxP?8N4W(kk9S&5i(y8s}vM zj2T=znjE75<^s$h1)9hib;BOpS3D5K^3X<5DE5^wDQA;;n@+n+4?MaZdp&?pD&qdN z3V1U07;GJRt&18YAOrHi5i=_rSi{UdvGn@u@9!S7I#q)Ru;E@F*+>XB&tiGzGc+nZ{1I4efBVtns-Dx{cn)Q71+oGT&{BDC60$6_qZ?Hf{mGMcin+}hpuvrp zZ|pvPaNu`CQ5_r?7!Fso7l8l(AOJ~3K~#{h&Cx^FkIJ zsN#v!L_1P*x}*s5#ZkZ;0b7i zd}B5T*n%PToJ^)sp#b@SS*#*Rh+SFtDaig?50wZgj*berjiN%$`S`({X-(b6!~Igh zJXkwAIF#aWACl%dFefrJTHl*j{o(rIbe0X*RdwzKW@~>Mf&9s&1QDbH)x@l3jfl#U zz^1IqvMK-}RbW5^%K%$TYBfq7d|id3P^ARL`M_aXLrExu;Yxs7gaC6%U&2zwo%EWj z3HZ9|_gxI-^yuW}J9qxafBBog{_DS%5Ae<|{@4HW-~XH6{=@Oy^+%hNc@UN1dfyt8 z(ozr!sgs!MI(%wK%;!de>9R8dfT{?!)vnX0=LNI3#A&VSnKdl)crYuBFhvUyQH>hG z0Ky5PMNWg8U@bh`ydS|uGGQQQ*i(vk9~_W)R+iCP1T;=Sa=h;e;(}(^UN{&Rk(iC~ z)0u%Iwv(bnc70sSaT!!Ij4R*(s{O$bfPh@jfDHsxs}h6qTH?Lk8AJfa)I&XJ#4b~{ zN+y;ykf|Accp@r;-A5A`2GuYI&eT3~Zv)Kbw0!*V5Xh=o1OkW-QIf8sH-uV%CUL5) z&i3a=b5i}@hj#~S8+}+Gq@VXf@bz>ubfz93gfM;W7yjXI{Ko%q>*na2|LOG~yzzsg zsIv8IC0i(isVXA~j#%Nr1n~f7lR3ML%=NuPuUZqaW@`e5M4*5&_fh&OG}78y9m9uv z6T|=&$P79KS&*}~7mcCJX5<2s08-ad*N?}ZRT*oDM#_rVPO2JqSPM-KXHcHb{N4}W zgR03hp&k)|n2oj85Sj2S$?UG=N}db3JTFEWfI^Z}fK&{i%4`t~g8``_5gPg$Mil4s zu?YnfFnz!pRm52xYjQax=&>C?-pp^_=x=NW>*{KbgA*Fh;O9W4T#JaPA}X>R0Qs8d z6GNbCrgaHF2M2ZrWS|+0i9S$OQCYJuLMWg$458nnQu2B24-Us~zhg7H)f--0+pu5y z%3yTu;e$uj{vk}BGO>ZFfBnXbFTb?DHgsim^!|M)K?I>jS?IjLd?Lk^Vnj?74`Pi_ zs8LZ>UqKYH!iSFz@?oZS`<2^+_02E*%+Kwu-#8g;Vs8)Q35pp+kPY0cuWi11`}S+M zN9+BA!^e-_edo#h?_xYgv{ZSG?1uf`@Y=>pcO=8{jqU2aw`DMjbq(i`^{};NZg1b* zSz9OZhbR8tF7{3^t>FV=iKy7$J9^jka@u+A_KjONId_jn8+fn_-bWcQ_h81xD0}(V z&KF)@+u0(g)5C+K5AM(3dx-rh)w)JGXIWiVuHUZ)1LRzllX7|-n1y}RS~-YHgm_jU zf*lZ0PV3pROvjmQZwv=p*LRMlFMujMx{EKoI?8&}CkNO&fD)Wz1$+cpRf$q@aRwsT zVA#WO(9iO$795WK{*lh6P=Tc&oC%B&frU{slr#gp_t91%2SBKbI33Hh7;SF#w{AL* zd;3So_W*KYqc+nd*VFT7yC{H1BXH=T_~-oV*jfMe$a0S1;3 z0=%HAGA|3K@1p##jrkLX6QP6quZhKYWyp*0&=1qyDXb@ao}Of6}uu z?BS?DErUj}`lLG9_jL_JA4`M0WcB(h`7z7cGzzQtInVPt zl`sym-|OAEef#TQ`-NZmmD^9|__J^Q`S1MB@BYpA-weWeZ;)!oput=OP$fu8`=Z=n zDbFH{U$v3{O0B<>hyZ3~JKUx=UDR^+sMsDRDOVQ&L?W`o!8v&ZfU{wM&6s4ZoeY3T zl7qYLimC!e)kbPiBw`k#6mHn0xFQ2XDQq*PaZUBkns$~hbI~tlB?r|mgauHrLLqEG zs_pGd#dk<4olcOYv{M9P1p$fh31C_4Bp~mfj+19VfjW2qL|Hq?NF5E$*y?Ia2%-M^ z&wuTg{_)p)M!*01Uw-E=zBL;kt@X35&Gj#T`OCld-~akA{a63E6#VDE`Oe?H^TDi! z8dfr7ELs~ms6xTKe7kKo9Ck1`=e__w^(PG(r7qbB=8QmrVU%R~6*7{{Saue(43K(0 zpVcQdDrL_-LS$YTbxHy7*Nlg>3_}&%6YL9wFdz3Y!;nwuF3*p`y(+ndJw6N z(bu*5kmYvk`u3eWKl`h{`l~XAtno1ky)9W1xv)VDH92~5@dN5%KEY0d>4(V z#%|XpYN~BRAy?Swm3&s^8Df-{X_;w@YBGO7+cM9pU>Z2PW*xKkVMs|E4<`T!)LKG_ z7$1el56e4W*w$!C=jHtH(W7{D0v}S0P$IPl5fDMC2MmoF8Z%(W%2MlszNms2Gm$=- z^}IKUZU~-4g+#Emj%6O>yukejhq>9cx%tBF;nuZRHolm@bnW2qa5}xCA#zo(Id^;e z=8df_%*$eTmpPSTQUFFV0Id<{)*gXohC#$_u|y$(kLwhI*n*-So(O#~CLWrs2fB0X z=H@Uz-d>xZyc}m!ltoUQx&CP5*5-{H!_C3*`0&9yZ|%MD1|B^|Q5qQ4pehXQ<=M{W z+RpXO=?mA#J6q9LlPb((5SRDY);G7eHwL46JUP01cmD@Jz{7`_O$Q>q5Nqb?!^aZj z2~)#zNW%G?2)%7DTy_Vh>V>gDqoy}}#qc?DS@4tWa;e-9R-oe9%sOBmZ z3B)EwF@~%qAodJ4vz$Re^dv+GakEjyPX9uvAx((fYcxh(V3!hkrLC*8)TP!+6=wzfBK?`#hSwkjv(@d?IbR3#M6>W{>0 zMbe$gz}G(1gv>x0#T3Vf<>7&>udS_bn!(_KWzmRUc4K>M=Y{Q~t-(Aqm3Me)8~vYl z{!Xv1P)rAmJTrj!7{s#XTvW9`I;q~ehnYu+@Uv>~;k)mTZV$5UmtNYsx#jxy`1*Qr zaA>M}qnF=Y-^kXtP7EJB_>hebU%b9GaX=<9FWv^4)u{|NC$J?(hHpAI5Q+ZQd|8 ztAh#{OGVEbMp%aMVtll@vA(&!_LZ-G`78hMjsk!FH+O&kKm5TPZ@udkMw4yM z+*Oei5&3A0;`DjX`;Y*WWq@I2Au%vQlHRLo5I{8u6s%;7&GHOnoN*Z$YmCdt1&{=R zG0-+!mYzOk8rW0w;geG8TZFFp1MR$emg8HStout<)t;lmoxPk+(tKE+4Cz&t?8)wQ zAWA495h++T={uxJodclUAwi^uNL*$kq$@J0X&S4Z%V$a3eRpEBG*{1^pC8YSaB3{N z%HwFMF$6SM0WaQ&4{`tC=v#kX{^_56>-T=|_l}Pz$ebPYi4#tsb?_@7&=myp+{j{0 zPE%J~(EQ9{Prqq=L47Vw)jtxBx3q?Lk4d)?&;reGj_e-8&b6=%#H6o`F%gR8{xTDh zF=qLPX**zTp5L=r%=tS5Aws)!;!$ZZ9KH6BzV!94{p`j@{&Qdb>0kQApB*~<(SLgV zkH7gRAKZJOY}!Ovryn%wmXz*vtK0E8CvW?naTw?uvCiXg@D$@KjX z9{Oj>^BQuuy|I?v*kVK$v5X#P^8Xh6PbU*( zS$*F=mTGeF#`z3Axa8`X2bl}`tXI#p|QF*F2eW((;4at z;I#2ZKnY4LfI`$DpbiRyK}1C9aeP=k+3Uab@+M>0@87<5?cSZ2w+4eReesp`o7WGk zxwV7A`udGQHk4O~EV&OlpHi$x{T@ils)94NmrrKX*~7iJKRodD*vA?{aQLKt5BHd2 z@cC%8J{au0c1Lf&Xrgxnsphlk{DbelH#<05fBDwUS6*B*1{(X&qk4wgn;vCEwaQSj zMY^s`BBhVHTF)6Ml^9Tg3Y0CWC=d}#j3YvQLaHbW+M$u#*jc~v!VRa6BRHxRgtCM$ zpUe)A_8;AQ|E+NJ5L{y|!(sV}E+AL(yvmYhqJ*+6Ma5dfAYWGZ@8AE%H@@-4o3Dds zZ@l?NoJR~dTsEkKin7geADjHsLVtfGDIp*{7Q@3~%bC7WJ8AegeMy>d_>2>Jsgr%6NXLQ3`q zAcQuqZFS_&y@Y4xLC_hy<>{8g+2gS^J-QasP@g{!Pqp8;k)a9xJ9G96ZW*_;zF`(Y zW1{*na~cjJ20&=b->8CC&Cb?nJlnbwVmQsmISst79*<|XxR&DU6%v9F88aBhy87Pt zzVH429)0-k-+sRc*I#-OYZ(~$^Vi?~t$+JF-~P+ji_&jhyER>1WV)+3Gb-&~Mhn5}`g7_j zrq;L7K}+dFX6_cT)8{2fjLK(j;?kStMWz|mE4h--pgd!Y5&*Px&!nzLA7C9pl@uDa zE~fjtyLSg>ZB*><$4PiMqq^! zmx<|H6tmsECu{FlLpy%_I3Ca71yMu@1~7nzczk$r|3RGX7sXyUI7Wz2MGPXUCeIxi zh@Z|vF*)4ZJ$&@x#ur{$zjfWM4ajApfqa|>IVh{~{{F*v-`Dr=ubG~v@^jU^+}}U> z;Jz8p<7{3%+1Fx9F%pYN6pm_%ElX8Gy;0|gOs$HSnlY}Pm(fSm zetLK~+1;!5_weX3#z#3*pVfr9QOU?|xU8tX-`k&0_U9iyIJvbQ?tFo+@3_c_frKJU z0o^N49vmLX(IFl`!NDQs6*6m?LhV%rh6Cz^d`MXod%K74y?->H&pv!4bqysZqpA>L z7&00~kP(Ukk3QTDm6YT1=tj1dJNRmCbg=*A!TTRn(*k5-<)MJF2E?F*za)J*c{xly z)A9c7k@I18@Z{0#;Ug5Yq*M~AGNm#g0h&@uCmJ}hFnk0d223aQ-tP3?`*d;~W7L!5 zYtF6r@_I7fee3Oskc@_$Im4(Vi0V9e4VC(;>gNn9%fh(K_43JdI(@k7e2jGs??DWi z^~)@FayCx#_R^aoFN_wPUPcaKm6c19jQ8f%z5y07D7Fhj+vXQdDX z<4N^sudqfqRC`AlvC=iGcg|KQ%e2M_P|1{4tn zJGVei#3&4@Y0`0DY&5zFShgB8uBGuCvbFTJv%5Qc`mTg5nV=JC|zkF(Hb>$?g z3(NKre!0%U*cQG&Yi4)vlac(9jh~BU0Ei-;mi!SY3;;0Lz4^np{>^XyzYiaL{VQMk zsh!O=3x$Tv@`DEtzW3el|MmC2^X3oUe!RD@?6UsA$1Gr>UU%bj(fD7~&!==rA?Y>Y z^Q5Fu>+&GpveV45afe68Z@l?K@n5|A!Gn1f*yd1cO{RpXk=;Oo2LRA1Vi%u*!_u2i z!^?WnE&e#iW7Qhzrra`yvS{xZGfTwdM&y_6CF}uVUTmC%i`F@29=jR2>@2O4U)cdnLSI2W%!Tp(%mV4?k zT-gpzElqKSTyyr}JteN+XSNccBqB5|s|Szv-hAtQp*vMMx%=J^{`f!s;kUm1SI0#) z9B$^r_1Qdp{jW?eKCS8^rKvk-p% zH!pWQY+Do~Fq9yq0+J{owq%_eBLOfj-`HHcc3rHk>w5b5Ax;jEai2Am1vH8hITtts zTa4DRbsbqBzQWM~j`zWF=+smNLD}?Xfotl+jj+Da-`dEH&Zh^}(Jp2OFp-E{zEew% z(qMgKcx^-3D~hr_)cFJOu6S!*IR+8mMTg`T-z*K2R2}XYg-ug z(a)1t4=J^Z7gHLY*HX<8<_I2$5HX^8tr;7pY)(42KtIFA5W^AR&>MmnwTCE_FrQ&O zMLkDRAXX!TTs*2GlVGzU+|Eg@<50l~)&|%dnc*nQ9jX|ER{<=A%qmCt62%;)U^+(# zWUUjCvSgTko}bK$-r9!d{fgO)HV4->D>C)*A@&}k7~702Q&pGDY+bLaBHRc8P)0Aq z#?Y)~YE@#Dt4dkLvX-jGtiZg6b%XvueCPrEce0)ivGZDY;%^gH6e&ErXaC-Mx;Ifqib+E3?T-D z00>yEHDO-3%#uPvU}kG=S(b8qIH-y^n^Ymf^mQNDyT_neRWr@i9c$Sxew3hKRrc zq}Hmj<@3-WQ>AK8MR1It)cXz^y4F_7j{xXKi4U0NFE6 z{$(g(;Xfx_M2b0G1GN>?Bwk$sVxY=Pyqi;R640>B3Gb*MT_fquQy4lI>b0WWwz_=q z^65@}a(+7(@Cdr|p1QPiu@WIb1RDE2cYSC3=GG`Pq`sC=4+g#Ibb54jbaXPA&C39? zCg-dl;i7QI8|rlHPsDar5@Qx|N$J1z-jc0j-Ou{U8tb^ewf^!8FAw`}ezgDQ-+s?4 zTz|k>55^WnZTkIK*FejQ(G;TstQs@RLv-%^dCGiyx}2R?7tPO$j$iKNGLm@iJWLnX z{cO3Nl*#)k*Sliok#tZ``#Gx+01+iJ&}2llrWC7k#A-C&Q|220OT7HNpNlbdqSR#a zxQuj|jz9rQgl@^4DW_v=U7lxUSwJ`a z@FhJjO8`XkCIQmtZ4hTWuLPUh5F}R7xk0}-@O71E{L%|MTU-55Pfw2a_Vyl^v)b9* za^}U>#F6Y%u3~vV5;V{0av#!4;@Vi?<;4nsv^=I0t*qMOCwGGfFQM5uCvq zRAclMC_w?nS~cPs(U5ZV^&szAYwIXJh!TqeDoC{|8E}9lSio73#Yss%YM#RYJ|fRy zGfWC7p(t`^v&RASQ;c2NkCkmtxUsGuql+Z3vGfX%@K10W>> zjzl^j%XKgcg{hh6tS}18Fd1qBX8<(-GZBcP0Wm^rKn!X`4=o)i<9s0NRUM}g?-czU z89{(h!wYch$32c#@gwu$c7`6_sa~S>1vb4bN0e0UrOEsPL}(xbwbASgl)!a#(k zdNT@Z;S7A$@Un@ZfGAWEssYz5HQ2ypYBH}BL6O+>^9Vuk@N-B62@nwoX4{%P#0u(> z5n_e9hP4A@$w!S)X76mU29CglC@4z=4+0xvs8LOOm2(*x=S71M*r))pf_N|?5yKRK z0W*kE%;Ai6##wT#iV#CR_knDda({l*lYX_OeWv8xFd_vyEXKJQqpxa&0A^<$fEc6g zF^FQ+=p)(O<$Vze^9s&2ZE^$z)L}7~u{}Pz+pF-30#QyYf=m9cvo>Ut`|#qHS42Te zez~*0&9kqa?RT!xepXGVE@R^G*ZPIFJrSK!XP_}dOJzdn#i^7`NS%H$WAa<`QgRl6K zUC(BwE-GjMS*@%o8{Lt2TY0cCjNthYW|ujgekJ_J0GIWL2b>^H^i0Rb$tPJuM zFXl>qQsj~`N{uh6`72c?1%XtUSwuvI0VWejAs+JxwU#MJM2zqhDGDL8PE~`zsDM;d zv?^gE=Y3IuicvS4_f>g;zWk3uf5Iv$m*;;3fmQ`6-m5RUvR@h`Bf{>Q82qTem zK$Vyg$!esULS!%f2xl?_BZ8>pAweau3Irj*d$578iCizYk*E$4F*q2nk}Jd6;UH&A zg)qCsW>WwFAOJ~3K~#`(2x5u~nLrGYAwa!{SA>WVtoHy1AHW3Tpb7~olGpg(lrvuYl8{`%1 zOgxGJCRmHi!Z1Pr6e_3{5)pwSSfnWQsH#llV?FnC*YDSLiQ1FP01FMM1t?=5g|k(2HB`VeE>Y1z!KIsVXYx%fy;B_^17UGlUwUX4^B? z`ruLdwEin08JnUC5L87YWtMV}cNZw`6<$yqwL9GuCFRKnxkIs@Aa%WoeC}jMe6quMuk)%e@|^<=R?4 z4k7w7-`E7%>coR$P>6U#l=p^gOz;(gAake{YOFKN1dSpgATl(>VDk)!p)OS@&-=ut z@~R*x8Db)^l1PwRMWmNmWeysK(tjQ)kjhS z!%~(3T-Ozp;oKrwZxUssXt`C=%_l2L02Aw~X4%=UXTpWzBJan?lhqi9WxagaW2r4^ zoR(5ooN@_Xr2Af&Qsk6v-1ev8A1s}2+2?ttjSJ(9&c!l>APIv=&g0I7e38OR(t^2; zGE18CU|^Z@Jg>_l#^|GlRIS>%I!LTNG!WTSn30NHl-u|zsbtRYe@tB#C{i`8^hy~c zLX0rwuGgG8_&NZ+^^M`$`tfuYs{kVaJ7emwyzsF=(!@EHGxA)NZMi>}&fB_t-&JvO zGL(-zUUfCqO9#hX)Xv$nFhw7_atEi7$5Vz-dei1bTFy#Cs!KH!7AI68g~*~Z*K+sH z%P|Z>%K3xyX8T!rmhlImyaZJ@0nl|>nylaJ^+K#s*5sVcY<**NCe5~RlF7sqJDG`X zb7I?e^2D}n+qP}nn%Ks~w!Y`w^PYRpk8iD7y;fIOS65eU)JE+M!87d%msgI+!D&JR zNvH*@hV?%r36mV>d=1_m6#@F zBAbT6+@mH!{*VJ|$mo7zrR1b269ZOnW)UfcEt9hvJ`1-`!pRE04ahtl!2|)dBlTMG z7zwUKYkx2TGYDC8zjsban8JLP5m;Fi#3K?S^36S?r$b~2gn_`y+ppn-sRYR9H9if9 zw2D>IOW+In(-W4$55t0*4anOi{%S5 zQ=rgih79S9G0NAR3e8$=>=cXW7dd*pa-J?3BraF#QcM)Ph>e5TYRSd_bg6` z9fmDY)jz(!6w^;WmJk_|)CPZYtZ%^FQsQ`4$Qp$TmOv;9F4k9bjhZ4Kj!4sw><64| z`=~btOBUe+88V-q@ULFVHS~$_N&)D06RUNS!^h+z3+O;77!e{dvDUJUvSJ!NtU#hs zSbi-CTLXL&wx6Jdv$p92)QOx+m2Dz?h%)n$LcJ2R#pR})!yrh^Cg2LB02NXa8Es`E z@b3mV>M55N+X22}p^?3&^v{KNWvr_&gbWHat75oN{o{r70)?68H^nr>$bmx8aT$y# zB5=KaNa}=C>1(}nwnKloDdN}xDMk#Hv-gqATBe|U8%x}1BqYcrhpD4FQ_(|>LdJRb zvn;aG4syqj%y>bb}9 zFqpc?5uPG%Q!U9C-x6F(o{QB0WWcG46XO?ZI<6JOd`ZP1GTW%yNvds zX_X+GE)*;Ie%wZiL4nsYF7PoCK#>IA#GAZ4-%?y%0cGVJdAH#7rFz>a)>>v1p)gH$ zk&=O^ifqa;V!N-Y*!q~q9 zNR%`Dk)kaL%5Vv*ENm5q$1u`q87m^6~Icz$26u#HxUlkr4@6kn^h%F}TR7yfMW5!P0DA+h!uOoCP+x&0T+r*9h) zJmFx@1Sy!3&1j6&=4@4@aMOcU*YiyRU8nKzX@*HqDA~Q$(uB2K&|um5GD0#`hmw!N zYVAl=7|+{2P(%4ag2zgnwijL5^8R2{&-8XgZ7z{`$Bg4@Ca&V)PNMoCA$Eey;GAzB z9bFwY*#eE_bO%{N-TQmt55$D#-)P!i;V8j#m=WV3f$ZvaV+PV~;M4Ke8I{jr@C}hD zG+rJ@$RNRmgA_j%D&dr&)bxoe%YRVf+i+;(Q>YC!j((4$G}CAi5>If#1!s`N1gBE# zlPH`_C;#O?I04e4URHP^b}F)8VX=!4ABbF}2opez8HOv~H(9vB2t^YCCKVT`@N>M7 zBv6lJCHZ+-+lx!ciVO!^hA@&CL=0L2RkO8}zc3x0xlaU|j8k}GndxLj!xth>4;2X( zllDh6th|yL<*-eL=^Fo zDU&t%8E{~xtil6S*z5@EmQMF}5`_Viwao5#hr@!)6Gf}(hBe!Cnh9Jpp0AG>Z5}I~ zu{N$zMR@P61BDNpsQJe$67)Z2jGNp0xUEuZ{QWW5wqNI0rHdjea;Xzq6ArEsU%vvU zwI0p*_|a=-&}^#zlxleEdJyDbg3QKe)f`|QwyjBjejd(i%W{HY2qthWRlC#Nj_w3= ztRO{4z3m@6balnggR*tA_3C!hr zx?X?~PCTs+`wKA+yCASsL^fnxbPv^Teh2%9U`Srrb?jf>vOHRTT*+`g^XhUOHU$G= zgKTop;6!Hm(BAS&*kCK8P z{v$lA96tJd`3HvsVI$e;t3O6V?qe;VR60Ez2x(jlct6tIeJy`dDvr!-c&)ty6%Mz} zi=;k4VEjY;2bj1iY>ynFJ4G%kzfk^yw#>)}=f#tz)_Fctj>F=ygp6d!taFSu_s4IV zpRNE`ZsF;sFQ3laf>#<|#g+^OeB~z-dyGa9{sAeia0XBwLyYJ5Q5a5?6rCKwIO7SP z2y$(pHfazRS}8rtw^3L=AtQlHwVh{O!nN$_Az;L7PRGieZ#A z`XZ#~()im;qU6&;PneS?8takVxV0AXl2Z{7`@{9dj|(#UX&2(pX`o4zFBr?1E$Lb@ zd5gEZz@*$x$GR4nnu^gV@kd;nlZe5*nEw_ijPO&k?uF9#Zw5gD9sIe|tkuzu1=X$> zR-D-FThL3LY-epimMqE`m4$CVZZV%v2%h(Sl@jQ&YmhHt?u&{wC~(r!DAap|3X{l* zmsn6oGhfVPh{8M%p+ylZus>T2N9<=C{+(%VV;e17AmH9^eagCCo=a;Z2)^)|{*YBi ze1%raAxy5B+ke6lLcu>?=g)18kua6H1Bq5CS<_9SD$_BUu1Yb#M%T>7gXB@q`=5hb zxZvs@X-jQUu8UEm3bn~3w`AdJ0=d2 z{>|q$B6%hh>1Eb~#!dzCWvl=M*+xNt%Af3UsZ5hZC=v?8Fzg{S`L_``g$i&K3(=LE zGNF=MXszi=LXwn{>II;9=F@^Q#0iN77PTRoFQzM|6Rx2W34xHgOA!b z=qV>N6D#;8Dna+p87U#{inJgq2O%nXQ!Tv_82Ag>Qsts2c((Dl41C;U)t%j@LB zftedemA(sJcO?wZr19TcER5_aI}tJj`)=)3E}~}MfKN|STbcJxoyT;NT%<-j4{AcO zCK;LL+?3Z4X=-evXlyHF3LI43nATcfz6?EEwzVJiEP?q5f*2Mqn9-9pNMx# z*b5xY|FT@>_)b+%wB}gmUs9;a&7|anR!sf|E*CGY8>x;I4p==1BZ#9iyz(ER6cDj? z`GEdLGl{x>lU_pckivy3#Gv0D{LPuE;L1>X?Ql#WRLH;n{FKREdMtTVO5eeWt%s&B z`y0y$LWpc2%fRT*Px&02d>0QEhTJE*=13_$L9sw`IIN)9Aa6i|R80B>iqpYeHVnUNDUq6j0v7%lV~j8po+GD-qDY7!I#YR_OX~Z zJ!h1nBEFAOnxb0FD%UdP2T4DCIv1@kvM742nV5o*X*r$WoMRCPKo$%J-*~9@NU2pq zj8M`jtgs&ro2Z}kD00w&+SldBH3`R9tH3hZpb zVQ=#fEk}0kI0K&O%!tm)al*%4w=`B*^*<&uUdu>&K$_@{47gE}*vI-^l>@{&t+5zg z+OQ#Ndq~I8iB(9Cw5?erocORF1ypadZ(7udFmbFKWh65#BPbfbHVMOp%EstQ!TB@t z$`zqXgY-(zWbZtPYUg?xKzzw5>dYL>WsE&Cl1M8Xup+B1!ZsoLgNnOtRa=xFd0-X>+i`y7VpjikojnS8Xull zY>JWL+oD7dL?DUyYpf|uCsKV=PSsLoa{tqH@+*9m?^TsDlB#tD=Z@CH>5&G zBqyp^gF+`Nu3nIuTK55i`D@3MbJul*g~)4tNsiWGwOClAZD$CBou zv*eKy$|e`H`Ii0|MFtfiwz@N@xh~PvigCT^6Ru%@A^`ILqD)>v*D)=1(k7Y@|7qkV z9@*Q(sxv+2oVm-XuiF#; z@ICE1u{yi0eJEt&bqUS?ZZ$!;C~hWVrD){t%j9a>|Db)EtM9AlDzoE2K^+I?4L%kh z8kx8?U_m4tU0l4`axC8D^`c;EZPbY`G&@sIV4kYe+q^~HjK z{02olK83#;6ylo(i21}J?Xl-Jw~?{33TU8MdPdkC>|m6T%25}Y4S?oJcl!k%y~oUK zCuSA%FZGQ~XF(1fKVs+iewwdMF3)i4*RBgTS%k~wp?j^Dn>pP-Zt^cuPmIkyY;e=s zSgG?1K5$bp=GU4N`B&gwFVv~BUPmrqyWWCPerI=|YwLVH8#dQ&o2#@RCyda25Bu@O zYrg+=d^xU)+I96SrIH!XQ|n{cJ|1Dq6Xu$=8J2fps~y)kE@pb-eN@9fyXL&WnP=O) zSJm4?%ewq(4)6C>IeaLQ*voYGZJjVa43%e3&JkVub3EHANl*3D>CM2ED*rWsD~9^y z;$c?s-(7nWOraDSA+Y;z7d}|v{D|OvA(Tc8umb2P;QSz+72XWMs{bjSR)gOp6|@fj z{Unf@6v`j}Uu8=cCMlNZUVBZJ0m^^J9JN06f2#fQUBBc~bD8;&jLjkW5k2p*tG@rI zD`1D7nXAHQN8pm39Sb}Q+7Mo^=v^KI$UgtuLbXZ`!$J6pUKu)q{J-9_1+Y%8bk@7L zyRTpteTEOMi%ypeFo?@93g}t_gPulFC&k0=!CgB z6QR^yC10~odYS**j34oxNk30Nea=ICWABseP97EupBWnZ-~acoYlU`d!97mr{yY<2 z_vDNWSg!dV<~KA3ST^E&8TkKdCN^r|9RM6$KJlNST$ubmR1u63=Bo?efPbb0IA71? zupj@^$T`zt6Q>Kcc)MFQ4TI&rOG|e9|5`!uJW|{J#c&{bho4Y+f6pY!zihjBygBqn zZz$D)fI8;=XYzsHuBJpMg@8^Rc%*4T+_|u(dAJ549KXZW>q7k_y2lc1wetTd7m)Q$ znG1X{MYUeC&2Y+#mD{$B$&szSe}0k;n!<_{C^69 zrR4KL&u6WL1CPugB?WQxzD5*lml-?sf0G47A6tQ*)F*T*w?z^wH#G2Iy+6FyOGS#f8%w; z%Hcq|Tt+>~b}l<2-tfMIsDKEpb%7Fq%uY}j(h9(wUgo%afC%k|In*JmJ|NHP43DMMBDW%Spd+us& z@S}jvt2VZ_Uhe5}j^F{W;h;$SQSF;-#~vdv!1vzPvzVHjUZYLZItkt$RiwUcBbcw& zl?*@y)>qD#y8=WC*{yzy9Wl3y&G5;JsWs-Z!}@cvF8}GJeX`;gyXsv|<@E>szahPq zGm!e|ck$*>WEj5`9H{{UA9VIEf44_nIdOQc?cB)En|I~2b&pPJBiiu~Aqad?>QhF< zG;;m$F2f*w!vbPtyXsX2i6(Z+hEDQ&^QzNad}LM-CGjj(x?cdmg7Y|Tt!0IRE3<=K z;!<#ZSs8IXV9AVGBr)HaOxB#`3aY>Sbdkc%fbM|5AJ$Ha4Y^+KG%A^U!AVz=ji6ru z!_fHqtcP|X9DD4ym&=ikRhVzHejjvNT}(Sw2O>iiH%7-U-=R=eLfh-_qxXm&?g2# zfhc};B#6war57_WZkXqUT5Y9q8s>AN8BQ!$ab)Fud(en%=q0zjav8or%Nm0})bJmeuMikD*m8h-?(2DfqEmWRE!pJVOhAOIer~zh zDQ8aIm{jE}Ef=jR6jtic{}D%+!5uY-@1oJp*h20Fjwh*fkOh{nlLv;WmXS&x-Spc7 z6v?k*4|WA6xPqJ*m>eZj4TVIUq0hC={=;KO-!AkRb>r8!BcBpbnvXFE zhnqz(_xpIECR5|KAETb~$Ql>ONdE`5@mvTZp#7g_NK&$TR+H{HAact$*@x@f&jmDa zWT;adeo}s)j(Dw43ZqK`$5%s1TZt{G*G`Tmsw(_3BfdnLOTVbkc-}iu@MGJItz?=t z<5(ZAv*AQ7UJXGZ)w&!EIaU$*LWI2V1FF{#b2AXiT8}azAA`Vg=6e8ldl(#pWA~h) zZ8gkP&!pdu@n;iCFAS9tDn#ujvLYr9aK0!3`kdAKhC*wN1sbzBZ%1PA3zY)uOcc0o&y#6a4Nl23 z#*;wmG{41+B+|JIcag3Vq$fN!Io}5Qj;gOuVtHqL1bYy_%qNb%Djl|)>*LE*%otf* zp0~l6?N)Y&>4nt^0lk%)r*BjNgD9w7GnO^&uz$BG;IvCQ+$T6pZR~vhp_HB*|JsFY zCEIxFFURC;dl=Zi25|1|JWzsyAcf9O83?6@iPx;wT?AV!(cocIX#R9I2%V^RM2xZm zMIy(dn$}L`_Bo#ghK`k0k1ADE!%@c^fx8N&5iMRdA4(Qks_C|SYr4&D~X!3%TTe@hTwWQRs8f`csKPhD2X7KBN9|7WBfRu4I1n?)39Ar+~q>wGZ zI8Rjei2+uBoMcSqNlgl5=S}uc-xhNUy!DCeD+_5vLQ0U5=^sVf8ZP5sm;*bgCDuP= zYVZ(`N=DnJ&y_M~i=!-hZV&0S8tQHi=yW!oDo_#>k1d@>C-SMqLysZn--rd&q;= zhuk|eo1esd?&)5vbwl^wI4JUZdtY&F^c4{dtrtid_+Ms$7wgDN)zFGuz71yOye(8M zTWwXg)x?^?@uOXUX$@)lb^0RTM)SHqk515aHa2~cvv6pO}><_Vg9mqjc(|7 z>#Y#QtMS=U)C2G2+d+%>8vVW~K%z3ZjG$w5is?PZyjdPnJSr+PBe) zfvbmd9A)f;<}MRC6SQGj%5uBP=8#Q<2jyeZ@2FvcIq9sc>)0#&A&>sOGc=!HEw!;u z#1EnPOM5K@V0-XUrtop00L@{Nf9Cp@44@0ZlKxWkG5boi{+I?BL|E@9 zNv=K7x^;bnG>+dQW>g>mrKs>l6$$5dabt=qgb+$pZ#=DQR33ETWj7>2^4Im$Xs@!B zViO{~Ar^=LtK7Qi3sZ{q&P9>}}2 z&?RdsC3?YA=o-y7OW_}FEK?_y=Y_cZzb908S^wh;Fv$NCu0Tbw$eLB!a<$EC;>BU= zqXy6YysqSz$KJ`-Kmqs2z(YhtdKdBIqJrR zvw+bKRs_1LfR9GF-`eNLTnq<@<6X)Ne(@7A!O@li_ni}SDqSXM^3o7r6bKk>eo#Nm zvx1B|Ls!-a|tXDwqx>}Wg)K;9?yg)`-)6kvy5JG&gb-44k_Q>}?bU44S# zKDkXK8E(2o=&ojJyKWJ<@x}MW=eU|`V{5&S#W&|}mp6|$N%9}qr5SQyH*+yhXTU7J9KRKv*Rncq zCUSUhDoS!@>NkcL<43U)1owbZWa~U9il;PLt#ld;Oecz8AEnuB)Y?2>T=!FEcwDZZ z+uG95m$BuoO6ScvH1C9h9GJpa$M#n821K{H!JY6ypVG@f2F=wgonZ~dK$bPROI6SH z)PW8Mgv9tKMMzzpLGERuE}NOw&5YX~fKUCMPwd5rQwdD4T7|E+kJ&zQ{MNI_^{e*7 z;f7W>MJE+dH_(U z@F08{ZyWHvWkZF?wUU^jLPSiJ1@9Tn`tltg<)k@@5(?@M=gW}B0jGbrv17?y5G8TGI{Jv zQ!}`qPbEjTx&7Aatv4YDLXiWZl2^ky3*-z4E~jmQr)$))YKilO;DTYq3b)6azBGU zvpLN9gd;(shG#)nF4L+XzCVO-FSUp4`fOd$1sf#~Rff+0dyF&}qxb4i?9M;g53}^4 z9N12FQLh+Fn^n`;$Qj%Rf|UD>#y`l2K;ZNuPZL3KIADPif1DaZs1O~yBYr_}F}Bwi zr5UL&6kFN9*4ZKXMP2EG$n44o==2xlidIV<$g|1tcv^^_GOX1-NA}O!@MLd&QHyNn zGy4i849B!-ud{hwPM@{6q<}L7bbqW|+VD2NeZyV0VVytaelPKPm;`zvI$Leu5A-}2 zxU?0txZml%P;>#p+lS~rel=72mNPQNF~C?v60o}ENl=I)R+p8nmkTu^*+e!?hsnjW zm!JQ3b$+VZ)?#>_Y{F4_kD%kdK9Sw1b29vZMeu5Otcv)$-V_v-Azd205sRaWbo*>m z&Hgxgj7#fohi0M``1yRQ$r;GX>)C`+x zy+3JHs)3Ow8-uXA5-ujmZP)mS_z!y+kw|6jUKus>RVi{(5UT9~fyC0Fon;lxL_PWK zWy$a$YdB%a-YstVu!vOc60*EJXNrlOK&E}V*lqzkWds~;OB}#IRH$x@Gl)_OHNjLJ zRXkozaB4NJRRhhH21X5Ku|h^E0!;k7IyBAzSF~kUy0gZVy*2vqV3I^!lRh=7T^IlG z(R{<$-&zM6XzjfZH!=&v}hUO7NWr!03AvxlJLkIM0(Mr zM$0BWxLk5c3#qDj^Ic<28fm!9kUCQ7PWoG9()z{nvxBQ^ zgg6j$UlF!Fjs|{BuirM=e6n=E=p*D?*b1jvqm32))&eamZWVcp{9c-bHEfu6qlx-U_w`n6fNzqb5nlWpZ<9PXS6k1=>nEn&vJQTl@= zaz;5OCmpPkjCox;&0^hr04yFL!%|f^$?DP;Uo2ikJ>h9y?OQC~#JXV1Gf`hTInEv> z5)!Og#et@uzcL6$BS{BPj~5pm$&`>swI#t9zARW-pp;)S;~*(Ou2Umj5|Hq7XcECz zf6&22(%QX4uZ&cxKp9xP$usXKUuQaR*fn3E_1wzD`lZgaenV&wY3G(aV-$LEeO>!h zW?a1agx<5B;I6fsT7{<7FHnnKiLi8;nx1Cm%*5ifAkr=cM(A!H$`mo0*L*MFj}=vNMyY zRUDdSevQ=Os<@$Y zPLr{oT*Y!HT}0gZJ zFi?K%-^sEi4Ji#O*A~=J5o_=>Fp1T7Wim6ez4nw;SW~LBZpPNFI{_n)M557|8JX^O zGe|_VVFjIfjrEgBOQkGZScT4`LuNE(sOnocG|Slzd^ExOA)RS$^|o!8^=_5m#$Is)XnISH=vanXn1+_|M#4v)(E039p^JxU6O5R@s>v>#=MU4$ zT@Y`ILP0|3Bq}(*F^J90p=l(Jt}A9mD6qu6 zv!eEkZH}v0(dsyJ0P17K@haLL)48Q01Ni1>!bbDt^%pAEmIvYSjo|#+)ov58Yv*3_ zLdEeSgOz&{f~PBDaU84)$%uz5jD@3IYi5G)jwRx!Kgt+LNkZnDG##qbT3BegzK5np z)*W;a+^GB}E+Y`H9MbDkGd3lO~0&7+1K++zd>`6kI?KfkP`KDE*(cPxAO` zNTtW1fZF0ozX~>g{a}YOdId063Q&Uk!IYJUI&!_ZE5}$nz~2rQVTdF1EpquLn8PSK zdwNjLV?6!pI63rMZ`o$&(c0|3SX0&Ad>Xf~F>=6=wi3n`?QhOEJGia?eE~B_B%Uqa zVOmo6(|nJ-7__51bC1%E=R znob&+7?ekyBJ<;f7FRG)lU9JKC9=&ej3Uclxn-&Bnix*Qr|%Ecb67$|L`5j&A%omi zo1)VUYbGHo$r}_FJ;+DXQ`3~S;*Lq{gIQSOF=w_?rm&Rm!khG(4)zw5IBs>23m(G$ ztQvP%vQac64G5@nYneqpb1OQL?u8bvnPQew-3^b@P&P`}tQ& z6Dp#o9bsv%mo87pbgavy6$-^+&B}peS-H|g>C2M|qpR-aNoXBiOrHxIncC;G-srYdZuuDRn7vrBH+$OXtEN?T4qA-+*M6hM>#k;dvv(`l#T&4ysb^~I zw<}ppTIO6~phTci>YOo#4pU+)Ak*h|B4yAQn6IQ9ric?)wluaND_GhCVSED z_7J>iv0R;6T6>g5x~|bAzuxS%KDDfUmZ9hY+`{Y{mK@=V?l4*`o}FwyZFK|o)0svP zdLGX<-=2Ef3`e3foHrP`yK#+5Ox8WNT@9~3zp0-QsvBBmyR0E*Vd^^XKW4O8>)3!V z$r)LyCm+vb^EzJd}tsP*PN#7YkG!a>UU%jx5(0OxOqnneS z9#tVo6ophoK5?f}#rk_bGPPOP<>JS(b=@_jj*r(YFobI z!dVo1RnPrtg$F_>LrPNuxyo^u1hP75Eekq0O#*TI?i$UqRR<~S(L$M`EYF>kgY_D* z@`TV<0*vUe$P&`f620$SiJAKci>A$HU6)QBUC;gA*0N3*QMd5~Fxa#uHXdGs`2Jv` z&rOn-4ekbl?(+s3AY?3Nf$B`Prq%fDXt5&MW6Uc~buKWCD{DG!K0!1l%X@!H5u;eP zrJ+;-55S~VvFLf^VWEhC7$4th5?1b9szGxrk|x@}FkoLT0O<+d$7SE9|60^TF>k4#J{p|@6U95cC!RY3^0y}7j{oJsN@y7 zxET)Ba{$oK0t_(8y9kQ}2L+N(k%hbZmQk_ISQ=v01La(|zvbIiZMwj1&B# zN?GoC^~iB}&IIGwU%}mIncEjdI6fHaIJq+k2`=YyxpcjDc-pqTSi-5+8lUu@i@S{eOz#AvGn=7 z8*hn5FB^M5YAwZcv0D9tI3cMOT4u{pG z)b5vukgxNzoSd&KpwjN?{f};TY9>Ujv%$eh&uhZVL-SXfe2{>0UUnIMrg}IHU~)Q^ z>7bHfQjP{6oK_z#-eZh=QC_9jFaaZCKy=1sO^qe|Pu}o&7+`9?L0vvJdB5NR@IwwB z|0y2LO;jqr>FB*yx>BUKKF(+&I857R(|MvwQ{47dZG8Y{NZn#MmzgxCRIA%_wS=eb z%msL~dy1`!WM{+3#M-zWSr|^Hz;&_yH67AglQlDvM)xMi=lZ~ME0{$vDm~HI*|;3} zW?Y#H&wZy`+hwcyt~kmruUSLF`RPN!vh`}MLFb>$-#&YzX`b!q7IpSU zrk3Q+X_L&yN1SQo_VetneKRsMn8EHNdnz*29s7@22p>x&ymu!*Pvy`LPxfgjm`ul{ zg7??1pQYI<*V+%CT5PsIv#vh=j+yv4*)=C&I(%-d63!?TpnG@vNB50~-OOycT#;RV zEv(ev+#PduCt9-ddOsslS*_KYFM?loy$x^Hbl$$6)kL_E*1PFolU_+8`7Y8|X|%mB zW!P*rf+^BSWpgPyt|hS_tr%BL)<#JYZYH+_PSVuA1K_XB7abR2l!&xC+!QxGkB%;u zH|xDDSXHyxU5XFSjpWBTrAr+ECZ4TzAL*LTn_h2ZETqx~wmU4Yu~aNqJ@?J{+`fJixv^%9NXvaEmiS<)6$eE^7X2lkiB{yySurfi+jW+` z{j%|`WvjDXeqbm92<6iiObk+%A=rzum+f|rr93>Ww+T7i-nZvL&J|^-nym2crr*!3 z2^$=}ZvHW8KeKxrt55dh9b;&O#lwIEgXCI+O8QJ;_-oHOG`f6gz6&df)4sjAwm2LE zF0b&!%GmO~OXeqVnV)?>#(LgDI$CVbMSkga*&N?zeT}SVDueH2==!+wgubk?eYw+H zy*wIroYZ{*c*d z7B|s%F*Og>X4nK?$3N>ydLVxF0w5umdyFs$5U88S52wbR@udW@VW?sDm6oZCwe$un z{Sjc6M9tuK=b8PXkog)qs2J0-Q%xV?@(IN!&ntr!Z?vdj2YVBdzGZjPs*TBXIBEBp zW-{W;oOK(FEE$+(!n&UqkT#tU%^#3k?>5_SLlz$Js72|8_U88P_NV!DcTQ(28y+*8 zJs&S2*4uT(ihE%rx}L8mC9+wZhh22_o>S$@Js;N?-e=tz&RcedW)?L+e}Amuh!&Tm z#}A(V4y)E~IZ}Muxbe_^-7EeP#>xFKn63M{cWg49jY^S=odJX8@fCnj92KV$*L5>q z7lC1XOgdw|UJHyid$LmJ8Rl=x1Kr&CwyPidE>o^ zj_1DDq&kd7$Nl917z!}r+uIYfNij4}6wS!kkrmsf+Y{MUr{US}C#|bYLnpePW)t(~ z{mh@gwACwyx6T|Pr^=R20a0%}PAMWsVJ6vcy9nNlO!K&9F~9@`96(+-^)8sx;o%5p zq4GnN6hnq^;zBCxPF%r?C1a~2F3)KFsA<_so36A&3H?T=_mR!(SjUI(6Ge33-hcAKbAy_wIs@VF^T zdAwLpd6^qDw)FH|?t0qzI_bFVwj+Y!Vp?@SPnpSN_lVnfFJe%UJiX|=23Jv6!bb7` z$BSU6{06=O6OgNVC<8oU8!Dd0ZX6}0$F0W$QGUYe9c;xR4>%_(=Xwv|7_;5=Nr>&1l*+kI)Gd&c3(Z!GrtXKKChi zXylvf!vA6>vpJt{RI;!dTnx8SbmymApTH=VJM{p%JN}vW!-5X$4d&-m5t=Ln^=i*n zpSMxNtIMJ;8l(6%u`TO@c?h>!7~Fvbn1p(P-<_%!@$52rnJEC=w4+I8lBBplfBIjX zJE}l-IHCjjY6mOJ>BC1;;+Xrg%gw?He`aK==Whu8q~~fL2QLj^0)eX_U_q@bry`r- z>={#>D5x{vT-zNUm*7re`<;SxtPU56VAyJIVltiLw9OyxzArG3*0uzudemH4# z*W>vVHsbxccT+&tG)X1+ATyZcj%?w*IZTt&c9!koQrX5HaP_`l5c9D&Mwa81XL=~6 zplP$>g`xAC*~#*?=W9=}<-FBl9#6|P_o3?Rer>gx0-MRmybqlD(q_rF)Uk}2%RVWKTdm_Q4^EQ(jmgRR z4&B$oyB-B5tzr|d@A{t9BxMLBXR49gUng96-aFV}-p~8XpEn-cU#t5u$8O2Rb~=t? z+5pqPW8X}4+#PQF&sBeQ`b>D`v{K~!cKBTAYZ#F&UX)g6@>er7*Q?ah#;MRzM1LuW z;d%P{7(mE&djt#$hF1J-RJB^8?>>Hz<+gR{Uuk!{Z?8h}K*)}b51|ySrVkQ|EoDVr zL}}YUqOnNHGu?Yg(RDZ6&RBG;v~7}M+H-B(XH3E+Hd6>;5;nG1wvAGYu!m;^iZ8RJ z>d7t7K^Qu3Jzw+NJWpq;o)U-I`(n$z1ZB5J7HmGZC@tQfusK_`aCAKkFPm4N&toOo zZx0n7z0C|t6xzv7#$nG%1sGR7JugLc+^u#_AG;wuUZ<10y4;@@adZ3>;tnnfdK%do>nu?63cBi#JjbrmE?$*Q@S3g64oRuAi+J`G>pf)5$H>>Q=Dfq|ZP?;!s#!`m z;*_@C!Qe^G=XqVy#0Zba)vIQ+&1Svz(C6=w2xC?TR=a^{i>tRuvg#h^`_Z&>NZ#j9 zS)coZw0VrAxz}q68CWQJCK_#Kj!jC9spisTIEk|C(5eBY-W_(2)5vnJfs`+cH6)J2sz=r`cVZYQcgE^Cpdo-^*rG%_Nk^;m1B+_^iAY zs&g|NZAZ~Fl!TL>|@JYz|5!}U$mO6iIi zbd3|s@Lg?JJAJYnZ4d1@tX3V)AG<_k#l|LfrzX(AsS|f#iWV;#SOIF%>Y~G=Z60*?{!FwPC2Fp zTWJT(|L(ZdYMAV{+v|7fzI%%KybrrmOe>30F?Xspx2{N%sN%Ul^-GA(kxe*N^?qXF zYSwo7B6IGl`x@NZ9GSa8^Zl;Y2g4VND#G40c5ca|Q?uzY^3&yV7sJ3`I{any6e08@f?I|28eSd!Lku|!OXn3*R=zPYwvJqXgH?b3zX zoCaT*@IY_gj8A>RE%t~(R7}^&w8&w%yIp7-tG|zniV7p1KotJw#6S@A66*yt(srH2 z2~QAwtS<9@0ojiRqf=>xyd+-d-RtEA9&gVRjQIGO=(MBFMwiz<&|?0g?e)OawQ>CC z_^IpcA!7@c1O~E~QBfT|i-XMpv^$pBxyl%IX!0E9O43LkS2QeLNy=beB6CG1+ahh9 zIf`&U+rzIE zB41PD{8XQsD4qySC?qf`6Yqg+meB!Q4qUn3%~C7Z#NP{Vz9cX5W3)A5Ewl@e2-VcVTrvA45Jf+Yj;nzVuW z86KaVos99qL0@Xh4Wip=!Jp*WU!=p6!$c&s70 zD(?wtuFKAkcBqw)y-QI%ulv8d;?+^`Kj>np7V9U)2Qdj`3fMVquSaJR$eOLxA9jAP zTLZUXuSpe8r&!KKNPt_Z5BTmud_!h|k}mgwcG)ebt6}I&ZsqRJaY<2xbLn0~!vUkS zqU7MHpDbA_cL!s?YdV|Xvpra?+NQ0$oe$@0KzL&ICDa*5AADZvQ6nad{t>}<_OG&* zh8$Hnl=Zx^ktoW1>n*KaOTC}ST)Yk^a%>jzeu;-W&#NLEw@SJ=t~wHhsiO77(fc}EL|QKq@4{Kt zsl#B=VqLCEXs_d$Hn z8W35Jp+G`LjDI`a5E4ty0ELePRuIpmeS*xsiz1D6Z_=iJP!9dgLQWVaTlw3*JvW~m{>$_2t z4&E>A=t7=lGjwy5gmUpPsJg*nPV!C$k~~zET2-(GL4DNW3bd$OV;m8Sq}SpfIBeCL zbiICTk5}707*Y>;`X+nP1Bg-tNxT ztBwF%_2^Wr)U53Fo+~|__D0qtsisvkL294@uQjPjXT9O+`p3d<1Pk4Y?ErGX`}M@g;#IXEd#xJ4K3^h)CufUub3 za~AUT7&qd5kMUK`6#~^uaRD8eC5#PeP?WB17<=qCTlH;+M!7kn1dSw{KByU;&e@wk)R9w-rHHt$B z?(Po3-Q67;0>Pzm2?S{fZjAKCudYg(;r3qa*ovV=A|3E_FO4olbUDOS8h@XB zXi(a~(SOGQ78OPOb>Ttf<>iZu1^{|Ep7fr;ih4#`$58Y-!Z5HOK_`PkS(zF1twxaPf*3jBuei$ATa`Q?*;GjV&4=YM9gob}l$ zoyaz9`FgDRzCIT1oywwgb~I{mV;WeK8T6F6TREBO_bHxWa8ARju}!oZDJGJsBCDj< z2AmsfeOt2DCAHB;(pBm&lZ~U%?{;O;*0pSKzRAEJb!bo{lkn%|Xt>hZcj)D>m=%hu zYV7-}rMx&1A2n6RwzJZ5RjQub`S6%Bni^ZR{@e2{AAX->;+wD*-l8%pTnWd-nEJTz zpi=UH9iRCp-Wpw&t;}h{{kSYazm4%if%V^@)5lm+0cX)~2Uh-dIzIN}Ih46X>rEb` zd|w38qUP@?1;1Yl4h5owC%1k?W0uMrqYLkmRnLP1q)>3Wn)^J?9J*J$SHUf^vsE5k zH6_+2L?sDJllTA1;1n=ALC*(~3ni0L+Y6v1A#=;WOf>aJSLG1T#jkQ0X-WtU7T%7h zm-r5;v5h5e@dCP^FJWY7aX%{5=)_eUb$YDs?b4=q1P&)L(x1<;G~tkHfW-0*-&4Vv zr~;;C>qJ{86rO7LV71EmPhUFitb z_VQEa1GvCb#P@M=pIzNFP&vmdhCa91;)tKscJfv4NKNueyJr( z#LM5grdJD*AI{s~0v9I!+6AMkfaJS3@XO+VitP|YZWRJ)!?y2MO68*>+;7*5dY;cK zGZKE?Z+KfOi3{Cy<;EQrySJwTPV0(7@_*N4X*nl5=$um0vj(8KtA76$BKP{Ei@gX= zj6U#dB@3=sE0UsFr+?cVX%ry;aKNEDZLCwZ9vFgvQ1;tRedT1RZ((G2`zF64BE)vKwZFViK}3_oyfY<2v7#6z~!Tr1=U zTTHnBrCOb!ze)TAHwCD&-Ku|1AA&2nVIE1-t7K)#UG$T4jKE5c7W+%(I~R3jAo8P% zyvEYg&<0pCQXjMR`BNHdDIEzH4t3y=EH*xf(E&QfF9Jf!6V|Q7EVj~J6fxzr!=ZLh z&&j&P;I9_u|F_jB5)lmst9~=Lzl{x1U{@t{m}6gV2VFHl+rM2%H;}kLJwGIOe`tgNGq)G&05X5*uYPE%0 zK4V$%H!|KUvW{yq!zo+Bi~1OkT%$=Zx?l#^##(D4g#l*|Ap_2!5@IYWamr&L&Ry^G z&0tmj#3r(1Dsk9j-B`M)kA^Ag4?YAXHFoR0?6F^NJceqRaw-|JplTWtSLju~b8>nO z29^Ix#z&is8ngnBG#d?T^GUA^w*3M=w1;Wtd|jLo|F0M)ZVf$rm&+l&)8V6ecs;pkDRIB4VPec@ zLXbW5lNxXXBUmq6GJU8jF#1k*cwO@2IG}-;+l-Ca8%$62f+nTCX4js@KQ>aq5!pYE z3+_cGpDz4HcSw6L2hFW)y*-_84=$$nIn+N6h+>l#JOCO1N{c8wy(mfX^u1A{92{A> zG&J>N{4}yBG@tbfR`8JwfkfngI+|S~o!7VUtUpkf1!2*^!C=Zt!hLJg0PXTt$D#j- zjg6aeP((w^qOV6Al~+TsK&Bm`Ds7@+4{`JAAg^b*<&PvPD9XXBK=`R$^pj#hklLF0 zJA|<4r|d+UTte)RA8AcX*z6y*898Mc_->Txt!v%scWFBMmxfRceqFWv!jVh3>EsO@ zHFgKqu=yEM+W#R4^X95Zv^H>T5f@zTcjJNey`%8HDAuos%PLaVOHYxN3XBi-ZRl-JWcn^(M5{+n(}ZE$Bn&$2cb{V( zr9)y|tJDH&F)I^50|nRZ_O+v8aqwyFt6~kPK!Zs%{5OUjr|rKd`ad>|LvBa%eZ;DX z&SN=3uisla#|w6aYel-=*4FQ`-7AjN(_wMwP$ux0w2Newi{wW_*gV?OmYqjUvUhrp zObkYq_VbfWKrtsf)zfwJ%6h^so|jwSigxpt)kocy3#uY<7z1e~;pkxCsJK?@oB`RJ zPq%9zK@Sf09utx-7DHDx5Ih_yo?WY|~>3$Auw{RHj7SMlfzgbc!bs!L10ndf!>{G2rU86E;(6D2Thz}dVDIrX$&S9qN-1|hhmwl%e3=WIQ`dC2osLwCt@%;JUvMK00&%XnA%=N4H&-TW{)o(#U zULfl)?(38jO$^)t0_lbE3e@o~bmRdyH#)Vsx9Y^h7TaX7;0*APP^mqjUg@$fVUjdd zv~naI0udTe%xY}NdVHV49U37-WQMV4HZlMwP|d*ulq|(oHUk&VjDGD6>UbvrxL_QP zlbYF03=PQ3*AW@$oz#@a(B!RFSj1*X1_NRGh!~TUrs>L^j8ex6m_ZZ6Ts%C7s+36W z{=jkyOoij)JV|lF^)J~o;^(mGF%j+!9S>42f@E_ZJ`a7Y4!v63)fGPN7!ZXnCi&jk zR_)wVlo$ULX~678V7pBrNyY|xPPeQ*kb#CqOIAA=T$WBuJd`|Ae@56(C5WsY=8i%w zxG!JGH@;Z^$A+3FqFWWunU_S!&hRVid!5EN>f3L{&HUIVlT)0mo3B(+5v7$;7MsR) zyx;GLNAW|!dKHgY^+lyN$LBU|JNNY-8FTI1K}n{|_nZ63o8lW%OtQ|y?zJz@BNbfg z+23DghIz2XH8p9diL^-7k!2hxXti+}Lm(f9z-2dQ)g*oC3%(YVa#9%L4vC?3zyVGk zS}J;LnXYvO@dn;FYd+L|$EkCNy;&Nb+UhEVy&kj4QJ)-lByNmU1QsjRRB(|~2KUck zzcaq{bC9Xo=dEjp{SkYyNZIYRlkeo^RXP&6|Cxxas-?veDt$3P8eN!xb%Xw3B`7Zr zZzdDBxRTk(6McB_Kjxk5+F>}R=VI&}kk{NnpoVS%_}xcFyyluD#{AC9JW^kJ1R#IyE{@YN7l;WfLX2#gG&QFp&12!p;eSMk(msWGG1I zeyT?u8frMfP~Q*3yw>bIGLB5b-Edlg#5%49`C8m*Tm}FII;lM}_n)6rdX16q*1m0b zikyqmbvG!O5~*8=r#Esgs~%|yQEN=a@3$~q?U1)5&j_9S5m<&&yV~ylfP}5WMKNPn z#i5Vy$XaC_aeWV$c)$$!r_l9=JkcWdmndRP%E0h zcp;0jO`V>0o^PVawNWj^*V0<4yN{2LH7#P+e+3QhLf{N?>_>SpFXHIA9y=_~*E%RZ zo0@ic?{Y8btD%8<*ip<7_KlR4HYD-ri!WO3%z%5rg7m1&tvWXAKASU_GVj8I6B~)A zm1zx*Pu17%k2`}DD?;5#P!n;_lZW^_odUzEuZk?v=-sM2;16)KE67^!BUX{MjtOLB z2R1fHmHP93nA8#A`iS=ne!;6`)z?;b(t=K8i`<;_fz;y`3 zJi1&&V<*dmx)<+z5EKfB%{V{Ts)PjMz;JDEWa6di&3jRZcZ=10z`1x=$L|F^KF-e# zTDy1-(q(8T?7Qdi*vVR0fR!OP(u=mtbKMb+3dSmP=K|BM>EjfC)$mKEr~c1761F$D zrhnpNmp=vg@O_-v2mKfdwoF%=X|0hFZ`QiGylwf{)YTGO+VSzZQ1yebfw4L89R2~O z3>=9%6K_5LHYM!OCiw3A1Z(z?-@VDX4Q1z(k4*VnhRYjiFN_-;Kh^@QY>s&j8`ca@ zBYSoA=~*}?TIS_UGGP&dy@+#+B%GOjH3A|Y5J-duv;qFsaLq~*)>e*H%!&`!)qs0; zO!%@Mt;jHj9tPD_RWksiFSUBC)$wUtQ<;dqF$yq~(0q?v z59kU7d~J2DX=^>NorMd-a-$8jx_Pa&T{}(d5k#~j8iQLI6ufPVSiVQmWAqBw8-tOp4 zKmKJ1Qzr{l%8wxG4{{mSv6&~(NZ>e0I5(RExPJww#%-p8$xLrH9fFokHa+z}cHzGv z9B`wq5IJ496%J)Dbh6hBGmP>uPGQIZ4bpiSRsa1f;*zvC;@Q0Wm5)OI=66*zw;Tw>7*+i<`#kHN*6mnt#eG@-$A{mTE}O(bF-i z=)y*%DY!HENA*!2YKfv~6(&h4!*-`d&U5;M`fD)`(G-W4n0^QDxliRk#9i|u@7L~f z{kMh-32UpEo)DZz#c+nhJ5lX2lal#EiJTS2fI#JU4}(Jek=>GpSBnhA*7KJ1?KT(6)V=aSN*5uiu zNZh;+?ADO@=5|wAyEVapvp-)5;kQ%2ICs6=inve6vpRegJp&1Did>hS|LCx~r9_K0L;M@(*J1Vrr0TY}3+O$x2Dj`eGa}4CNc|m!5Y-!E`z3#HI zE;J@Nx1BbLxOCn0V3N1&ZkT~SaCH3JDvnmsV(QTv3L{4NH_Jd?S{;KNe;H28gDq(< zYeAFRC(Fm&SAxXD(3iD)yn8=Jy01WwLEiaryX-Rlv8&##xMm5UVX|!1epjq{`i$uCMh5%F~U1aVkB8< z)UCsrff)cy_#9c)Vf@9J#V|qd2*Kc z?rWwWJNJvCK^1uQn=?Le^Rk#HW1xBE`$j(UJAT`(Qh8k4dHLAlo`x@#K>r(o(FuUV zY#1B5MC3#rjeuy@CrvT3>*Kz;^>^`ObfqO(=S!36OA5!D?;SahSeD=EHS3^h`SHRr z6sJvIO=`Nq;i+-?8c5oaCCmFMo~B^#&tRV_f(6zt0>9w9^!l8`sP*~e3TpiOSF0t) z-TGV4vP+kTxigiWHlWu8*tQoXRU;(86Bf(f)#_(RGev6>^ZZ^N>2LM!8SI5ZHdg8&&dhi*UlB&-Q z<1SqKcUs=nw9k{K;WCd_4b_TiqO1 zqI#D3@a>xeWx*fv#xqhwdwWk2chK|Y=KXC-|9`ZYV)qBM&3fH;xgF1gZ<`KKu>cx| zkw^DE9yu%vkCF*I7+kPqUr&ROdJfo}4T+~L-8~Mhx)dx()LaVR>H2jS8QSrEXJ|FT zW$_^_;NOqbw7DGbEo4^x8mkcUDk~*zLqx~HAovJO@*{jN-kbXr+|r0jm5$emS*4q5 z#$54lPc_S!0rzp3D=$2`Z{KmF3l)BF)UX-a;bfFJRt)bhl8a!j{rUl{f4_>eOi`#d zEp^dA)RP6VE=%+Hqs^_|(Sus^efDcq#jCmEXegQA?W^xu>(i~@55J?jl-b0U=A3|s z`=i|}&O`Kiwtu!D;`hDd$P(9>5^vL(e)khBTTknLTkoO^iXR!19AocTs33eOb(JzI zRvwid?x4WqAX6kYDa>zI>%)a;j`iP9Q@&>{`#n!*-K%&xg~c^eq<7C63yO zO~1lnS2HeDfsWPw&2=L2TC9Wd*qK_~IP_d_3%yveLpH42v-@$B0gsE8&FhblCyM88 zi5F;R`pxV0L3C}-dtCXNW7AT}cpR6}61KSdv@d=Wi7au~kZbt4n+IAg{xCMxoT`BC zgB}syFw~BnfbotIKo*M(Mj-5XLZHnW3dp3Pr>*@G- zTEFDs{r;jd6UXHhh?Jmt^VAOspC5&$ z%WYn7$FD-sT&ee#{*SFXHq<3{Yzrm&`PK(d%>Qg=@<-@(7OswhK**jJK#&R_9 zy*B3J&u(<@(d}y6KIQX2zxN0t^sr=s541W*FCMa*I%?b{%n3Mz-ub(CzJ2ssO?VsO z@Haotc@g-&FH)N;WT4l}*8P?2bV&SqvM~4I8v1;~cxFnpfvk~p-yrdHrNamfb)1VQ zww8}G#=x{d%1nThEm0kz!aDv10q4uV2wna1e*OFYn|F{1%J#cS=d{Vuixrjq9EsbL z%anf3wq@qSUn^m?O5YeVmn`zD)q@*JRG(Hw6n4PIUucsg5#Sa|D<&GqnAq8kANIUD z{d$8Q6evL(`xHt4!EhxrNe ztE+(LnJGezT(R6;Kd66GL<^*6TwwjVCEz-Y6m#|abKmgW@jKbfZelRvdA1u5IF25A zB-MVMTevw@Un2is3!rRK{}hflLjtyF7z@n{1U7)Mqar9DH#lDYKrwv`05$tP0%|-5 zP+0HMs~WJ=cE5x2yd`m7Uu1)giT5FCz{U7x-B-2-dwi(w%Asz0m!B8*5*n=XU+; z9}z5N?Ktj9Wl~~LI2}Hk{Vjn9JI$p9Nfq((nQfK-IGlUYE5C{6;?oJ47~4CsGDjAF zDF1QRY4^r*?21LQ5X|vCX)jp9dpn2}n=dn>T$OBu&>c|aT1wSi-+hv$pIYu zJ3L+6b${8TK+(Qi>i@{|bbH$N%`WS)O+Ds_F;2{D>u}R*i-Y5n|9+ds*baQGgx~&Z zKQ!RA$5-M$=%Y(#f)#lgZ_2>8?aelq&O>?L``c!dr>nPXMh-IHIu=V8Pfr|jYQftb zIGzo&l^jfB7)T;lUbO_4p-yf(mJj%_Sl`6&<~0nCK zwX38boeh?8bV4m|qIERHhPUvHONZs>tTM*c4(w}bKj6DLXh}0U*wvmb{2_WjsX+PL zZvBQDZ8mYhKB>m{tL1f{<4f)c|01d#DU&il=+6h@ zM(VWP_@nBpw9cFRX3y*Acm1RH;AY3$$^7e;#`nvc=(IE$J;ANd^E@3E>+dk^c{??Z zi3G=qO6Y+!Z;d%0Qzm~biRq`?^Y0I1ZK)8L1;esSXO7SJ&jD{K>(AQDPS@%a#wMWa`GDh9?aGMlqbbw3 zYE%D{pxWoXv^A&K{}(?nU$D-}9l~&Vy3LS~h=9@Bo)UptihLyC9Hv;Dr#HSPSxn_v!Q+RMuHauvrMLAMk ztOa$CtuaBu*Hjytd`|k4Faqj3n{E$eFjv|GHoJSmBCbRj@$n9JQ9>CuiwV{Jw%a7U zFT;`u**__(s#VA&M0_^~H9ijrlip>9WU1@ zT@!RCsC01E?fss}uruFv+nB^?N|cgtmCZi(*)mUd z%*nmDl}203y~d1|!^~3QD6FF?GlG0Bb+v{V0x>o+625(ozFP;~4}EgCftrZEjyOb* zs&w>>nKgCI#mk1FW-YS?YlV{}!jmGHEWIEo(@ns9l#~zrE%nX7Ee=vP`xLVoqNqz# z==jxo*H@!Mm+@}kVOGQcvBB39Q~Y7*6T*E{HdlnQ4V%;q>G&A@xsL4u-!SkDM6Q)-a@M=MdJxIcBOJ-*TVxtNg6&hxt+(caYsO zC*3*qQaCei&a=D)`v^Gt)U;?`0~ybcu09iK-z zGpsjE2GS0F=M;1puqZD6toasJSlX3(`k%%dhxbNAi_=FQbuA6O%H)^bIveea4amGH z$SK*tg)k|iyudC`b6YlO!yKo+-Yy4pF|*r0%a|+Te~x@6Nm`=c4@z@SB?$J@Ttlu&6KD~a}=ExSl9lP3xcF?03beazT zh?v?B298gk4C|XbhDdz%Mm6w4|I~^=`c1E z9OQmyyQ7tbtH{n7MJ3$V`}+(|jD}wrrBS7?NwR<9Xvq%*eMk+qgWj=swY(|>{Ofp6 zDWW-YKCONqFZ9uUSZoRQq0(2fXh5JDyJ!1SxpTp2^0J5fp3IG;V3M^w?PX$?l%#$p zY>60Na=jmGfOdV~+9^+Rnc>TRev8TOyu; z`7g}ev$~|Pl--m>;`Qdd^WS3b{Qrlr`R1`B?YXhmJF5bnld4xOp~C6y5v$&mq6$+x$T zvk}f=8GfE=j>|DsMLbPlT;hllSqd(8@x})!dgGU>lf27b;K~KAY#U#xiK4`18=B+% zw<^^|N3EVz%bqXO8nbbbb|zG8Z0vn9o=k(7IzLFooQH9$H2{!QWbUj{B)O9ea|we2 zE17^?&gyjZ(9*LO7Um{O#?HaqwtG{bo_lWH!gW*MPIPSv;Ha*V{I+c0DBmX=kE4sd zl1I4r_(J0~p{pH>*TJK)GBfLH4f?A6U@X9x)=QQ^YyH==SWag<8^2|jcoz}5R-7nZ z9#B;D>_B-CyoBAbP&Pne<_jFZZdim+B*hFkI21i7ri0!~pnQ>4N+=Y7@c~CW~#Bw_VSF11>cDFOt+R&R?Mt_b;{nH`fm;AD>*< zVh6ETa$QPp_t2JjcW{Wzc7E3?aWmL3r&`)Ev=Qt%uXMSHQv4XP*PRR`^_RCqU zeA^Csr&>L%?VR4HHR$W5L&@uGXBIf^avn@5*ycKDK2lgkqREz&6YE!qHrMkflw8PR zM~RjP4(%IE^VWlomeJztYXa;37tMM3j^3B+t+LNtlE*Hgz-PV^GN58e@8eJj}63A5+3rxp&v)fJF-FSJZxm@N`#gkWH&G**iXH^qvOhFI?fas?U;oq$)M3MN0*KPH;FAhP5mJV2 zwQH)?sBmr3mCb??L&*#{tX|@G`-qccIeF6N>+Fw)t#sAHX*J>Sj%survTmM2I!C2d zl|D?=r9ZOes*Vhg;1nUD%^(4I4se)4Cr5q7Zd?B7%1S2HPh53lR2~(Fez@y>25DFixGe8a;j%$wDk_?L zFlC+j8!KK}fV#j}Hdrce2A!|w;WL8QK5|+ps*_b7xZ0k@iENV#M$IgF(mw|Eiqw&f4K>v{!A~qQ5a(+~U}nsv&*}d7$G<^&2kr zAW`0>r4C`kgQcxHf;c$XY2XM-BV(Q?|!6xrnwm? zd8}#t!b1L3%aT7EuBz|BY>iGkXK9m*Ct6XNd6at@28M@mFWtz&06w_!*hbX~l}9PE z1GDpB{I+3I6=wjBWN)gNT)-MyH94M7mbYa*RZF%Y!#D9`CHZva?Wo|hZzzz5AAW}E9EtuNSa8M zSX=G%S&SXQP$?!a8hE}`-brgQ_<4{^v1JO#q#6(#{2mOl&3r1v(-AW>jjJRmfg z*$5{}N!MU}0YvQ?hs5LFVUkk>)Unp*^BCe`F`A}JMjvAubyo-pgXqR?S+zTu?*(D{ zZ%lmgQV;ijJ*Z16orodbb;L@UNzc-U@7v%nT4)YKZPD}5Nh;F~b>!qJ1!<-@nnz$) zwy-G0d@%Fg!_p;T=$H2w4l%3h{xe~$rh~r(eK8qSELUPKuOJa3{GJ+OJUx?&HxU97 zB-;a-T>B=HIN6s8O2ge;8d=(BlqG_*KlTVkh(ZYnbd!{onPD?Po)cWwfE_mXHQ!5h z`XEJsj&jqBQo(;cPvQ2QpU39!#nvioVPoOqx%f83N<)HA;+M+YGv+9x$VWt6 z4y08q6*(8Q?a?}+p%1FSUmV+LE zkZ~c;lkT`*esbLBUjeT0B{_qA1~oX0YK4CVan6m0ka}!}jd1vH2IP+n$!|4?R_z%Nu#W;3OW7VkZa&g?QdULkmXqa9O=YEp4qTe~ z$6Fn3x9bKECTi!ekS(;aP+-otQ%z}y%F#yx0KAIYL6|3EPm{XnzDgBp0GVoiyfH;3 zMr-0(wn$}r#VqYq>m0vX-hzrH<%q1r`V33_Ah2c>`@LSa%k*UP;(5R`{?-5HVsTwU zHC^n$-k1#%{WPfnJ)V$sNJ5>Egk+aonTa>RD1(t0H@Bh9j9hA#2%gxUl3!>2BEe>Ys7PM zR{kGJo_zrqB>rv)m7z9{o<%xn%$;BeM)qe2V_CZVz39nO0*hNma6(dKBy8RovKx&B z0<2@@9b->KXCDsGHOFr+ixFcu43Bm!FB04!`fV3F4Tsom6|0Z_qd|BUO_i zD1w+_8nJZR-2B?%GMt#m+6hZk)7>O(h9)z-#h9=Y)FZ#0^We7PZFYa7f(A~CSQ0|( z<8_N`jD}+J!mD-YT}_ypm83Zpml=yu&&JCt(!oKHVP78Z20JTmt;!Neg1VdmQM$4E zm?|nV{rko~T#+;(WCnMnaAEjoD*ZA$+6o{-nh*m}Rlcx_NjfJ%8IL3l*Ddb5nQL1u zB&x3n>0D;7tjYmEkFcMO*;1#Xm2|M=y$ZTDz)-4Vc2HS^TtT2bQ|b0$V5l1dBqri> zyIa1YoX+ak<^0^26U!g|*L!8&4-fn5*}~RFuC-Xjbdo4$l>PiP_3H#C6G(_fH9c`M zNMOb33R`6|wNFvSBqy81C$PwjnRSz=?L_Z&vNS;!B6qYh3(cO)UVQ<0x2QVK4q6~z zRRI9}5#f3lw*@|D7KR=&Vc2q%U;UbuI=&dfPO7s%&e;GDH5kP7E$eSl zWBhVw*@CGVu+=eMAU`@x+Y&nPbUYZIXDq*Z61H3PlziEU)sl%gUbjv>$daX=?V1c? zs3X9vbb2*Liz%h~d!CyHB@cfI%jJfnN9*{e0$ z42~&Kwx3VuK6*np%S$J|pNp)E`#pZ^6-jBZA{ghMNW_uF`g83IQ^E*XBbAh|j>XVgi zFanjA^I?EcIft(WKvZr?DKj7~6@sUfwsZ_kUQwdv{K0rITAlnX)yI4RQp-MD9MAJ; zHEH9Fs4&f)76!YcL=^dDe9bU89KdYY#wAU0kyb)tr0bA03Jh;##TA;Hxra4zNuW$> zomT}*d7``!$Jk5^Yk1;qC)jQxhz>$@FhbsEem*asFY5#Z7SrB>**--P#Fa0 z747HdBxla>7qI>`sb94-mi#SYZd7BQz;!3XNWdox4l|?CeCNQEbaA`8W5(C;Va-GZ zkOOrKY(s;=Os=j<=ozvfWL@Jzyu>tQ)soC$M1Y*lhg$d+Vh!$tw!cXfj+uNq4>CtT zvFHl!0D%Lts_JUfMM{cXqtcmw7?f0Tz&)@AL&)&h#Iwap7QdqRi&Bq}nBP%t!iUF8 zRBiV+pZW<+DbfHbq#&I5pin{jpo%;3#)yzc z8{NQkHGEe&4F~`ygQVb(=Adlqk+7BA6eSZDt}G56i>=S)_rW+q1>7B>baS(F=FsHH z8OsUoFiC`pjc#gJf*FzhtfEjR3#1%ps`+D{q^Lfk{+OWzOABte1b77CbW#WGPK>b- z*`J6Nu&dRUoeE~ z>$9-1rFh(yOaHV-6BK5=-@~PY*m2eMSTYFPBVF5>qD8`kQu@V zjJyTRKg0r9)c1wwQ-T#z;hKH*2t;emtHOY3n2n8Qz#fczRS$w23nwxmvaf?almuVq3rI4{;={qOu+p2tuc|$e{F^XXGa%~c%0Fenw!-%P;eV%C zs7|un=ky#Qjp!b&TFkB%5 zUSA-8lijz=U!PFE44$%R!R`pT$xbmLoiB%}(GDAuHRpOPZ-69q0H(%)iRE@UlJPfY zqSauCcx57WtRHyEB=Uef|}tsYZ<| znds=(E{CQ#;&iw0jgML$hK_m2RL#W=)(l^6%Ep#Eo8l*&kPSK-X_4nVjrUE%*q*BiZ?*QN7 zW8;uIS%O?WCBNYQR8vW-DOsAReC*TaLAm%Z!|BRrtx3nJ1M0LosN3=}Zuri&p<2Bf zeU6W(VF2YH8qrLi&aRxK89c~sg#ou*N|sFyS7on;J+20cB?uylc&qG`k%l9J5mcHH z>4c;Xfq={G9o#}=GdRx0c=Q2$Hv|4pGi|C$i=UOq+v|h`C5Q7Wa9Gp1g5Y^@rM{m5 z1Xxl^re+zYou>UCTInrL$dC4ad4|`zXN@^3JB7{y36rHhOe~;iu5n}Jdh$6r?vAgT zIn?Su!Q{V`b^jWx@Duw$7rs5Zu(PHfs zjE6O^f(Do>`19}HZ3nQ|$uSsxI_glu^Ym&uXjQ&vc25U&K*THQQ%LtX_SJy3*L`~} zmYPMPtX%1$cvHUeBydR8;qka#hp5q?SQDn^v~yaK3Ww1tU-AnF)!vok=xf!&LXwWM z70?28swgm64CJy=UOW&^Fs(Nz35Z;>uhk>9KevG(FNPnV&DvFw&;no=bU$={GN#e^ ziN{9|#GvMsp({y_D!>BU*>{=PAE$5dk6D!LwSIBnlFU4s4@Z!huk1hABPb|0gEeEx zVxIKmGa=t6Op~jKx{^)e%C}Vj$oYS@0Q_>=>&)6t zRhy}^YioMPtEB7T_1oJ+)g}~^FZ87j=;7S)|pskz)88cbfA3HsrD5&4M_?|#k`!a(k&XrOTtE67U;wjuSg_`rxZ}-O$3g*cD;*= zK?}HIE6x=hEZh`N*yC3)(<8gGPoLcrtJ@z+n}Le^UZwbMr@$gCIBx#kGpq0H6sP!6 z&SZv;9fqY%UQF2Q>jEa7M40F+k^dEi!z&E|6LBIHfEfwhkjd`ALMtUQrV!kK)6&=b z2-dFiFZ~b(EPIwi&IH?}$Zt*Uyy-R2_X6xDyvKq`ogt73Td`5g01W=+%06&VC>yB> zM@$snkY7=H=oW{<6^LiBN3VzyJcMd(@qw#MmfkW`vPd42hK65W7UR}zj}6yv^KT) z`)8Uy@iOi3dfsTpbghXjq$IR>d_IF8Q`a(jMPqsZ_is(( zC~!_IyKGUs-1$IjKEDt-t3ZV!;4T}>AI69sx94Fdm^hJ43T}wJ? zECN@R3O&}v=TFIqojEch%$ zuA`;-oM_R}FEGvZ?rPywTAxxPQ9ubiYII~36tOPzT>VFiqvLZ`j*HV>!osN`@}c*? zuR*%CLa*Wl@W#7kKa0_Vl#`MaN-QSpk|-`hL~QpD4&yvdipsp~HU4vW|L+WQDcv9Y zP0enE3Ro zZ>-ey(d!9n>t*&xj z^9&GkOKq}ZNCQIWuup)lidg$v)KQp2D%VuhpX66p}8+u7w4$u;WDVr3ZdOc9M~ z>yXk!!lE$JCMymkDJv0$kLgBZBhU*jU*a5V_WG9nX<=)IjLXDuNtfhnk+csGQOAg8 zg8F20`hCqA9J#3Z8;cJ)ox!CBtrr~xf&Z|nw>AF=F3=8&eoj^_U4nIQc$N4!k)HD? z>rbpF{)`+t8(4Bg#0mtZJb(?U#$h8c^pG$6f)rF~``%YOZ{|&h?!c5Rx?;MotNO~I z>dC^%npJy{!Q5*;ZGff7hOuzL(rEAF6seQwB_-=FP%_5Hsu~#Ol%0ho+>PLpchb54 z#*}~E%jiJNnHYAvCg+W16ibgP{4=c!rdGsN=6^BX27f!~`DUN~*Y1>ZKtqgGmF<6? zXTtphcR(i*hT4P)%y>a@kxNd(Jk_nM056&V#6YvUmN7O5%oFnctV&bYBLRBQ8aY6VmpK(H-L_T!y! z>(!9g&9g3Nf8F_!hU2LD<3cH>xS*@yxBri+ua0V~Tiy;@3KRmR5Gd|eAV|^T4izZw z?(PmniUo>Gv7*IYiWm1F1%hjVQmkljzSH}@_x`^9M;42fbym)v*)#LZer5&}l-WQ) zKqyT|4~{hEI{lEsv?gCp&A_K5(D043 zO~==OEVLz8#Ty9yn=oKio z3{#CNRp4jZDF2fo>tVHV>AaqsnGfYo)nBdC@y6lADs(J!-QW+w%t`${(AFgj4DA6- zLUh80i@_l67QNZcEGA5=BI4tCt}-+xitWVBSMQ8N-GA3~%Na0-ACYCb-&%!Evs?vf zJx7s;M7-^6_+%af^a>YE@`~M818rZ1GX3}LK3>DPH7UYjo!K10G^_Av=Px(q^2ReO zOzk$SZ2CnI^rJiMjQ7Jw&=0p=Eh1Fv2yCoD-}WT-UEUap>@^G(O$SFbJh z)-3!5mh;)=c>KvLi}B%iYQIVSS-*d<7)aqan7JY>b4uFPou3KG+AUP0T)9Hk*Vep=W^ zsiyV}8u8JZ9Q)m)93W?|ra5C&O*J4@EU>3+08`@3<*2oDcFxtWm&7vX<4`(u6Y|d1 zRG(R0=9D^sSvS?Pr8;nJxVgW|!oge%8Du}NLN-(}s;kdP`kIJG3Tisy8$= z@R8$A?tZ9n<`_SvtxI`KXqr@UXOl81^%X^e_pWM^{j5Z6;C-`gwsp=C_GXD(2DVj7 zV5#8hetQWzp%6@5xLYE{k|D0vC0~PL{{x(m=PgpXCl=3ORZr%T(BwKrIYGx8J^MNm z5#gmFooNFZapit8Q!Nw~qH;+UhNvJ&tTFe9ck!bEo(1v_3cMm;kL-L>o9r!No{Y-v zv2!B1C9~Mrt>Vpu%)vpn-txTOfm>TV!eJ5ND7S0jEjkn8oRfrt!T&hrzlYz|7CQFc zS7c7KARD&M9t0^Xn&E~89X;j}44Vi|6e;ZE_0UN{a=k}?egUTX{JSwon1Gw73{}{Y zGoX^IVIgI#&$TQNxwy)~`QrW<8F;x#B}To7{UIc-DxY|p|7huYJn%tSjPwo>c)wHY zGrgJvTs5^Ow~AOrxSKIzYVXMt&?^#|#_)~WF>OYrKZ&n>c}Pa1rivIO=Sk#)3!3U- z<+3VGQ&!+PbsNf}INTO|man%SVpk6;Nw$845|8-SGIx{na4L3tl9h3H5aY@=a<{y! zF&W94b3Z_0xOD$xlPNx;8H2M1Ux=Qz*!{w?&(YeE;`-9c{gBjb@hogtnz=z9_ zz&*1oCpFoUOxI+R$Sq&~)rY;+JCFKKWEa&#bw|Jh)%_tqzvD_v=lz=D!xqvo!2K)N z_I3)#+!njyX(~Y%PhZ3TBkw@QF%Mh>Ck?&-Ea=@JXh~OJ&afp zTW@Db5aygnWNgQ!tG5xO%BRtc8%v;ey$=A(^@imaqgZg-!9`lJFuHqPHuRMqd0U2M z(AS2_q7ZiH+Fzh4b1Mb9n!x0EW4AvR$r^nbR*WyA5G@zeu{7VyX7#{S?!kvtOmI8?(=2>(pV|%Y3vg8 ziZF?|=czl*G#q;h`Y~Njvo2q$^QI8ays_92xtFH2LnqeVctANMO2H2+J_7LTth&#a zbmm}NeL75tDNj>%b#+Tii;qKCZy6Sk&Viq`b0I>v&3Uu`YmWbMI8X=m2tIfsY3tt1 zLrL2!)YPADXTG(x@H@&KH;>aXaAtMY&_GAeV1LPPFUBL@{*^b;Z|8V-Se?xhpomod z7YuXN?(Jb=dx$F0Hs4mVLmf0u)(DO|+ntmuy$&~rlAQtn-r9pvRVG9I-}~pMqup_w z<+~myWvQImoz+65`!_B>vC`S}RyusHrZiVYm~}FngqOn#f#uNjYOV;(_AZVL`AK2en+vWadpSBPd_}{tmCA9i8)bcYy!N5& z0m_a)NtkcNCav)(Zby;su9b9mVmh47Dzw=h@BNsc61;Eg(>HtZy%h zc7Nzfp&8rpFt}rHWANmzdExE(V$5Y4P@S7tXTyBMh0_}yo09wXC ze$fBnL+8R(lZ@!lh=VRUG~`9eK6~~|-HM1IZ>^6ERn5daZ7#tk6UHQMmf0XfoNNL< z=hMzGZ^WzPJD0%NuufX)a*4+(KzGPvoui$7$AA$cukw2M9)8F~75J^SL7(VANwZR~ zJz#UAFM6}~{<^HH;{d6UB+*fd04m4=9|H6>-2XJK1R#IM>>YL7RF3JmQ{3MrzTInq z^E4e_=JIUki{0N(_B>iPh>oC5Z+AX-x{I`J2=DRl@jDov5vwToYdxO0S+l346}HsW z)Ev(dv#eNNT=YHr`50}Du|BpPd2U81^da5T!y~g$*f7B3A)|@~^N23pPc3}x-pl*o zc1sD71rQ3V5Qicfuy8ua4`GD1fnNPAcZPwbaZT&b%sNG&357)s;#E_vS}c-M)K4H? zO?4GWQdo&YW*d5cR%(V$Mf&CQSjkMwe-C+yR5AhoR}dV^NfOp<^LI?beEbcmvw&|+4?ib2@gFX`wzrF9^}cysaRwq= zadtQjJDjej3Y9$X&%&_OO4#>qkh2eeRv)VC8uSt8IUV2b#O^o6?k}ny?iaS$Y;A4R zYa%x0%+hf>t}hM|IRTf(tywZw5#)m!U&0DqpMT1MT_80yQsEWs{uKV@XxcLR%^Hnu zZA-gunEC4==i&HNqN1HXaNnbLd&RY&V%4UZ3RgybC!(_LL*$1|~rVfdA#`TXp zTJP@e)}8DkQ%O=`&iRv8fm|=spK`rVd=8N`Ql+U0E$;nNtXN9BP|Ur7CW$^x1~0eW zk~wsdQcG1& zJIugRgeXFpF$4k=m*J_2J#DNSIT&MVT@*%eROz=kIeU9+dm{79k4C$@yZag%@|ZoE z_yJw^!yWtPH*EoLo*Aw!Pq#-kIoPXZXG(l`Q=Yst`}*T%*NQ=)Wm9EopTp5fSTvG2 zRW@HC+cFhim8EM?(m(S?P^hUEFtLpQMf=YX0%b`@Py2Tx#j#W1yI3agYy^v|>VMM+ z@$zjB3B-v4QPYW$GHpDLmFwoiid||81oI><+EkrEf50oV>ln6Htd%X0Z6pKJDLVQA=I)YHb z{If`kbgqp!dIVx=d*w>e52z-(cjASRR8;b5$2UD@L?`$l?RC`tX_VQgxlTh8f*)RU zkNN~}lZK9khY_>`{_;c(;e7*%3H?(>EOZ$mRY-M?QOwR!Za8^x;%z-WE=`Xesq>O#ylB%yIZ0IQ@YGdHmuKElXv46O~ ze{exkm1$_8r}L|k2FkyE+nk)d)i)-$7r?Ejr*-H-lH!9y*5-cI*N|LB0eQ> z>3(3mSan0D^nZ$;BdiduK>qcjE1l6CmqnVsUkhPA3(vO!Ks?zy3p)@Eb_j=I$K_7v z{b`d!yZSd1wOH<+EQg!nJ{;uH>KM=A8FAoww60_4DSUV;p@FDW$kp%QcVY63fjXYt zroLs#dm=}@*2e1UcgY>C)pPbpO0oIDaz5PNFTK-AvW9LI=++>HTiIFJ0*EgP>%L@zMmw%2! zZuUmmOAAy`0PL#v86CRuDk4;(oXgB8Jv~iQ9kp8-gj?fU$sF~jtf8TX!cBnpPwJf)Ys8z@mm+62d7gj&mZ)0cI@KI0nSi_ z@~O(#AG;o{GTSLFSz&K7cpdEQL<27WWFcio%50UCMh7>)c zVpXU2$))q;a2@;eSWHBv{!O3nQKq5p^3qay+0cfnX0T3P3%R>cUxhBe*wxwU(Y_t2 z6!cmtmE-RC6V>fv=l%V0e$2g*)f^!-ROcWz0w#xMI#xJB0t6j~MDtDpqo?F+_lNh1 zOwWNTDZ%XQZp*3OdH-48K)d;4=@;5_cFE_rQk8*yFlpK>BGd+xfb z%cWLqqNf(Za2|g2J%mwby|EM^4{+asTN?UZZ5=H3rx{f7LvYpHy}bq1dVGjPNN2i&`a{;80^f#8;xa2y1sgxkjfF;G5xizhWO|!jURBk3 zKC9b#yTyqDy!cLQYpdvVUJY}t2HTOF4wR$)?gCI)Z_}D4vk1Wa7PQ{9(x8Jvx`NV? z7Z*TV7*C)F(WDbC>U%A9a|?C#7!ClcC^b1O`yI6-fxbYN73SNMRxUg6tWRRs0Iu^j z*N(JNAxfP55|!)3*srCoo?@=aVd#Hz&@_-AIfnD{FvAylXx& zyX9@`>FFs#CSbXk1@GV9J~Rk)^}U%)956!cx<_k_Y|R^0^RKMlU2c9l@^km)B?GHW zYA^lz#B4iY{i?{OsZ)$H*?Y3X>)0hw&rnZSf8Sk7|KQ-@Nx0NeI}}rV69)}6{OGi* z^ycOUXcm5TM-?Epe?%;^C`XpWXTA)fQw#4g?p!t82l|4rm6eqtIP^!^Z%Ru;yo~nm z3NGNyVGiNB72O|gc;^@ceZtQhfbFip5#b3XQVkPOb@{ zy-5D7sFs7SEegSt0y0Uhz(2n>Z{O4U>{amJZ#&*^Z;$aeH8$R#uih6{+7gtM+VGMc zTr}~&qPNw^OBz*kjvn=wwYl)4PT5?-T`~q z$_-%Q$nj2>ypQVG%UH$8VuowaR;0d?h7sg5E61~_Z0&*b*-j=4%0qIz=9lL0{%nqS zUSBVE0f7^Z=?Tr7VH;OpWa9Y!W=54m$Qe*D>xW#{CE)-X3^fJrtTg32V=#KWENyJ1 zkbm_VM)k@YH_~jMz8XkWnsU20R(5a058*2-ieFt%x5u*Xy3Wf|TeB`^FW{R4pB{yv zknYqEQ5h2Qo9rFi~us2vAw@KMU4t%k(#Z zg_tk`{RwC2N8mYPowK^X%EgwPs@*BTQU>1~n(XHn(D9nN`486J)r%lwp! zy&~73J!#`!?hG1mk+l0Dk1nyaxOj6r!a0jLdTuEfV!XndIrMQ;CD0eVmteP@$+m~B z-2b^qwBEInedG~7;^F4#p;`>$om+a5(R!0O74kw5;n1M0Qays+QrC*y()9e;b9b=3 z{2Vx*yTe;~i;D}3cN-&O$?o<{o3)j5pYwiLSk9+ue9fn3c>lAnT6Gim>CB3wgT0vF zSpkqo!6D%^Y_E4VKFE}P__clwpDmJZfOl7e9}|enWtosg3<~Jh>w32)TVl*F#m|$f zQ5s>X4`D+}`! zZ$FyFjNw4N8JOOt{&P+CpHo4V20)8gW7tsE`HG{xeY^Yl!ucM;ap_x4^GwynBWe$& zXuw~zy6h%EEgT&kO>Nm&b+TgnFAs7$ZZCkcR-c=(hm)L#aOA^}o6dWn5c1pc&--P^ zes$||dt?i?ouggQwRZM%sdj^LE&ip0=fdTs!@g9K)U@2}QNxdz<-jGywXU=2(4V4Tqw z!|;lk#zu{1=fq<`Nb}L^>gr8u;0>blcGz~A-gu$uhw(3?Q2T(Y;N zrKM_o#ZfJTD@4%^pYp`xmfO3odtyd*;4j$Oms{Lz0Z%1BF6wt#&90QOGpj=oR*QO~ zc9PQNMZc2TaRL1ZF%=}hvmsw(kC5)=x_I085-Ha+vNK+hZMf&L2o$COhC6XsszxkZ zWM!en#rgn90LcDs$rSN+3k(d*!Hu?2M^yLieJlUpc>r!K<)=&t2a5L=;z)5ZKT*CS z>+s(jE*uHGY3)38OQjT97>>SZ#@Si*Mpi_VaN>n80^eDhn;WbR%iwneI=56*t#44y^xQ(fYOQ`a$f7>GPVYs5q_D|y20RBt<9N2)AZG~0}H)B=W z|89`uy$-Cl`W-E9lqngmS7eZI8tCb_*7HC}Q_W@Kh3nee{dX?D0%Hcw zy+jN;oYrsqaDaIBo-^Qltr8}FhnAevWdrc=Z_2nPse~X0dfQxc;5fq z(eB=&^~Wy6)C7h+^v`IBf~Y;_7+2ONH60{lE@Or+vg3%y6+=;9mp(;dfw&7|VwrV~ zlBbhW)6#B(ZF&d$nG=x)(zUdfwrSew=wx}IAZhhoccJ#aFpsLea#!z_Lyr>;0)}hI z;c{o7`CZpmnP$LonW4kJ-SXXqXj+svem1e6juX=v6ZRo)^~=8zxn)cYp3zRk>6iR1L8e6JU`G)jd@IS z*?t$G{btbJep|jA{DtZ5=l|b2B^30v*=6heVs&~acS+3{_RNP-v#&y<=`-$d*UzpV zxxcCDH-S!f*Uuf>yzA=RI7(r1TZv42hW^L%IUSck69LRQmJFeY2zK_0^2*Bi!Xc+i zFVmaEPof>jwaE*OKwrs+P^$~1mLJBqiq`-xi|n^=n>;LIs;o}=D3m7{4Poi5E;9b>&rlgV)9>ZJxB@8LO; zKYQQq=+LsQb|%N}C^b;FHd zt)&5mVqUl0{7DQ>RyRGYb!f^WNw*;)h|}5-`ZzTAXRyrIF?ey8!=Ej${60~1bf)o4|Ku*1o#gI* zwAgC)U7ALg(WYT>M?;f@grtH6r1tk(3|L$3hFV&G@vng%Y0SV~K%k>zXDKVK3r7?{&jUiod>T(f3r1mPO2o0FLXz4&v&M2zBsWzYW7#c4%TB$;!%_^g7DQNR@~$q9x-W@_goTcf8qkZ^rw% zm^E=IOMm|bJI8rSDv76O6Ms`v|0dyR|F>d7NiBWtJvSjB$Sh^L%UWJ{8XWaLbXaMd zhlRR*Hg967IlCMJiWWZh80#b8>B)s*$;ruK4qsP~91r#npU4u>=Si65F6wLRw74Dn z>Bm0uy=(6RG)F@;0;o({PX9KQ@cQL^okbu7-YuU9{Au=|kMW?_I-^ScSY`d}!Xqu&q>=5hD-W{~OsAH8Pb8Bq7r)k?$M_i(kAhMo8KJHH zJ>A)yLVnP!83jS3WszZydJL71=%1$@8FD(y#S^_=J7KTmD7`GbfO18otD}S1LSwa+ z$aCpg(a~sa*`c^kTaV51O1-num`4)Qbt_Vk1`X+$478>&DCS3|Tu~*2E^WL3&o6wJ z6t@S3fAUJ8IFlqey4dK`Kd0iwWl>mWX|HATXjL_ysYPPFvxM=D&T75XPMIIwVoeU! z3K#MTCBtPzGc}!tFz}Sx!8XCXvot9TTlNghMyKqyO?14o9kD3p7`8C?efAJq-cX3z z+Nj>?44XYF=*rv^c749*yKh-z92uFsB z*^SdGT(uAV9|yA%6$AlPb=2ffMyC1}`j{#a8Vyx`PgJ=`_Xf!rq?4H^mFOkaHPyAd zt9fRd+tLpp=vLg%sOnVmYi74dpQFu`R+iZWgX5YA=mh^FK8Pt+Zl$dlc`#{zb;GE# zG?2eSwcPaql5Ar9Q+G`N03%fKztP9LkJC0WH2~8|I!2tDcFC+CLt2{bu8qJL zW|<6p1!U?93_7U;zea?>B@Noy&jz)mYuQg%e2=8`<(@_|D~8J3dMj8+&-7=6r0w`S zAk~Lv&9%1&BcQU$>FLd-th`q~YGGKV@u0A=Ogd@Ph~ju2H9jx=M?0DN)m8=1X)PLK zzdr-ZYd?O^R?wT0#VkSnE@%$Ip@ov68~2ifHL(R%TpHeNL1_X5+Lf5XN)xbn(5SFb{da3X%}vzutx3X$lecd89t;BRTD}x^iFsMgL(K0qp?6lLW{ixtT9lI@gi1b z7!CTf<1KW!wr!+*E-PxJXfGJ!oh(t1dT3f$7?B1B^~_q=@UUG((ptNwBwfGwvr)MA zj-Ix9DQg}$k|sDJ?TIrCH3&t}VaNqb#gvEuWCr8;n2y3gOHi^$#xpOk{ zT>}vi^&v3dXM!L`Sr(t1XJK&Aguo+$$xk;M%K!JqIp_+}-dD^NSJu;{;?QLcRErDt zyeT3`aQa6Ez6Ts=t)zKNqo#TUNV@VJSQ4E#DwrkM2tw1%HCN5o`|+_fqfUND6m(Xa z8n~Nk@5NGgXo#5S3Xzuq6R}1(JG>~06idLO)sosLb1rvgvNlPg1<9BiKZ$6Q{xYcv z`8W?juto@e1VwTw!=Wm;WHQdYKJt-j$yogf&So%a^B`E5EP8E)p28O+M%4)EV-#q& zAh$9#Bbsfp(Ol5{4cXT|X7gESBFf|3NjI>Jw0uNNuC^@1f?FAiUW-{e_Ni2MhB-bd z?r%D-SMU!}&h)UJb`mqb8ccJcK(`=Fzs(_%>|n1XbN^%6fz zOY_S1TIt9nvTL+e6{3P@xx_I6L?eN2Dlk%HZQlNf>y^y=he5&N+M>#dQ`0OQ8fwaV z-q*8JR=i(3i{{^=TY#XUS_o=dTYS{$G;QfMIuh;oVddHy6Lzvm>^umG0``1D7yDt0 za4kVXLq~#tReHRKg!AhG^GTAO= zmzcin1`-DFQf}aldhwO%0C@cN-|HBuDH8*3Les?6Mi!`&9ZD@11WsYJdHK8MN>1@Vc4gsU?s ziN4O;Ob8T{^Zrm~6syaicI}QYJ@)yacd;j$A?GRHNpOwemFV{su*8%wX z+CAE z&tMgW+E-sZ#-VQxEE6#vbq6tLBjB{=9f*#14?9*582i?|@B8E$KfNWm+-;E`uRS%y z=T0S0>_~b;Pq^Au(iG9$`C8xrLvr8_{BO(`utNW0o1y15M=~kT*EFgh*lCvTeoksS z6WVT5@5iTbQ7)Sg&a@xA_i-*Bnim66ZtT{jK;oqI?}f9-v+YGvlk-n++lejTjQn*w zs`5GBo3Hq`e+kF^IPn8|+I{WyWc&vT-?A&{jM{G7wb<9eGhe-7<`$r38Qx3e#f&U_Fivm9= zXZq85V?5Qfj((0Y3^uK=hH)qCnNb-yTW$}OC@f-Mvsj44R1uJ=o~l^Oi_ov1xZG?M zGB$S{I!U`-7n|jAa;0gZoM#DM%bWkg5&xLA_Xilq# zx^$R3sy>RgR}0~8K(yo%Y~gFRj9z~u?OYu8irqx!FkV3+orp#0)y+t1I9L!X#Rr*JU}$M-b<05 zaJ*$)3ugudc1^@9Qu)wOY5d|hS!qw6IIMWjIs5D9*?;r?kLE1>1GBxLX)&deQqxvi zz7;0T_Ag8XDPNqmKsjPZ9`ndeP9bK^UY{fZ!&U;ouFsh57qZzfVBUSHJ9?Yyl0@lc z53$?e1p}i11HLMs`=^n;pGZ>8S8jkF`dGA6=sQvJDGj<68mHqTKkU!8EZ%KQ>=GM(q54XgfUxG7p^AW2cHcVgS;( zQ_)iLyLL}3jR52uu*}d(-)$>4yQ)(W_ls-P6W+HmQ;b>rdQm-W z{!W1(jwQGEz+}2J5`8@25-JB{L9N#hln=6L;{I29C zi$PNDn9Rn?D28y)N43l=0aX1_Cqj!9H20=&xsEIEA8q&xRT1{@VN)YvlDOI{rKJjo z%;R=~q)O#46pW3*U$ViG5Nv6C?BF+sr2_{Ne@5}`BD2N(*>?%V;&;SGqMc>?pBuX2 zR@nq(Pu>XLd3NL=T=@P<*s|+$zcv0lj4^hj@)*LpHfqyg`ALTXh`KsxQ;*2m`wcZ! zTiqL(Ul^jC1|hVuhZym4x8YNk_M-5H z=4@v7djq)dZRXo=uBWJ*S+-cG7Z2sH@;ZNC0gtfEnMd;beCg(Wj!s-0j8Q(V^=!r> z!>Y7To^BTWs~*1wR z&NGh2#`AdkhIACYT`1`N$MOI;(g3Bvh(V~vgk)phv<$UeTJoC0+{PePth;SI!nI;1 zLj=t=_sr(2i2+lp=E4I>T8`#eS@r{v0lyIR$+2sD_3Xz)KBGJCcscnzrZ{$9&#T>l zsW?WO|L86{@bg*I3W?TtyLIr216~q4fNNSYOFT4%t!L={PD-^Lc z;zkv7QeJHksS+a_`LdOrgs6?y<%@~PPq|YJ6jmnVu;%|n}DFdq7W0ZBL0ZZ zpo)Uar~O+Ul2sT#W6ev;iWMpTR6Havn_sDlaW1 zP(e5OQZT_x!`z^pxbaqjNF@XeGp4KY7Ic0eyPmAb%8C0pNnCR5B`nXI+uUBn#BJf! zf+Pg5)Mo0ju&d8K%>fSH^=SP=56sg5t`oSu72b&l?5d^1^GM3Ki-_Z9r|Fjp6ThTi zSfPSGxFmAC{;Ke!poGlJP3=L<*YTcwz|Nh$-|?&L@U^*s4o(p0yWq~PD}xN1Ic$C7B6l*C znGf`*PjtSq+Gw6h6~8asc=bX0VWn)fPwM7I@u4X2N9XS9*^%MG>P!h(O6pG+`yEqio5AgfujASgTq zwIBn!eGx7GnZDGV*a^r8jAHL{v;4b2_}#6D2{|qhXgZorwm3N!1A+SN*E_Z$0^C&D zkV#62!-N*O1P?~PJenSwQ^;qVq|u&qqQr#%tdlt7(S!C5LK;j^{Vb?jL~dI{Lx*_k z3qhwvLb<}f3+3B`4z3cr9Z8N>l4;W8=Tp!@I#SIBJFH3wb4gnD z>@O`4ty6|;Wx-3#dV?ru)n|+h|5;nMi4k-L8xSEkj;(smaacI}m=<7+7+dPME4IVhiTiIkx4F76*y9oNdP;Qwyz?ffaoCaG8`lJ*k= zDMmvzM7;bpPilzVY*U4yArWn6Rd3?c%4uhYvj)N-4iGK3QTIfKvv&A?(!Wc%RyBr@ z+X9p)uS&(xp9Ym>aVJSVMY#)VFcyhvuPg zBp}`(OjB_-QhssuikGd9)SY{iqKnp}aCB$f z?ulpxX!J#=wfhvpxKN7+x995WN+322tYbS;3o-3D5{`9UL@+5J4C80EEvh_j%C_Kd zVw&=jTHew%^RUI78pK#OEOu&cde2?3F>FcHPMw1Zl2uiRwp^NHWAQ+L{8t+fW(=wh z1tY$h#16e^rpN#E7TZ*rr7)@1URSXs$%Wj~&ThYV;A^b^j`RKr03G;#Es6vn4?2AoGBb?i8xf~04k}O4dVD?PkWt>%V8pPESu^(5N?d zi?cf6#$JnvD&9v`ZsXMp=ly`aDEAOqRkJ&;?ps3Ih~O^<6c&icYqWGY!y9H{H9)m9 z!riqwbH^Ls%dTk)k7QK$A(Gtw=rp2(bx5DVyn{DmY_i7o;U@4QP^w4s7e;?tb91w7 ze$DjK^~>^tzKLuXc!_ob^e<~GqA0(8x$yuFhaVm~wDidJGDmep@xLCfm{?a=jBjKJ zjoAD)X*Jh);7v)Znht4a$CZkD%e>4|f~WL`nDiwRQ>-Yh;CaD~6a2-9j(uh|;WkeD zxZ}fUPrrR&-%vHxcKlc1+}$et`2z6gcES?0ammCd$m?bELA2;pHJHVu3%JjM^k#!1 zQ6L~$SsoA>4AjQS(soyoI>Ju53Jyw<*d`0xS6$NXhR`zj7@V1L}S zBr0}R?YQX8KEOW%3gd-6_8}065iHDDUPn1$v{g^wiyEFZZm^M;mzSAYffl>y#hmGt zUp8@00*Mp6lUJ`fx`E+yLIOGY#`AH{R-Q=mIuY}I4H=fd8nngX#icV^JBY?-h4LMy zfeFSP^MeNAzmo&?f+e78R=@PsqRmq5he5v?n8-X%FWz@hn(=Be6E)h+PtDJhe$0h# z<3)S1g(b7SdZ<4Clb?}K5pK5lMjh|c@-)}xMAhvk->hufXEVs~yEmr^qd z1$|5PB^g==SBf10L*G+0uj$`bo)j<1IV^Ok1^#sz%{xn$FEA7De~?WCp@0eurj=c# zV`abOTB)J*2a!R|tiZfz6}V_UyeH!`#OS3CEuB60IE*D-4)*p3zklc19SARh{ND31 zBBOlO-@A5d+gD87t=zYhjrTMfvasMMBzNR=93gBPnwte(8or%IzwaQLYJ)-PBi>~x zHRz}-(rjXK!Au6u8;|C$dY`@(0Yu+tay%RJ1*Im~gLt3@y8Yv=7{+&?2F)xWfF@&X zp)q;LY_Js_)Xh~;kRg0IS+GPZ|BlAHnd*V}ycmch3hK7bxQiwrwO^!KxEg*41nEj%slU$3i z{9~Pa+ynTDUwU|HE$4@ho)L3tAMwEVF#> zCpAPZDQ@xWMRnS(355O4n_Y_OyS`d>9ckK-GCQj?=8= z*2apnO5s&!faf%eyo>z19xHx$98BGeuAL&o@X}LjMgFeh5SOBf8tYAt=wBN1_C&4} z;6kdZ9331E0UA_Z!f(gGo5enp$y#>6cbpXY6jEam6B7sAEUr=tx&696-_zIEcP4+h zM|R@(Ow^VG19=*El(eUhFUq#Do1=|8WzWI%?0C>WepXYFlmL?@kOP$(-ZDh}sR z;fqI4j@+YRTTD=+%7IY@(cmBgf(dFK5T-a9$JR9aqr|qf=~`p}O{f!jxW&>>O3-1} zcCF6AW84#aD73SxgZ}!Jj?y0KELOv!LNKn}cDD9Vhd&mOsw?8NteqaULmO7a%?VVuI$2?D7v zPNt>e|Ht8NRccodOYzBJ;<7jIFp_MTBSjRNc4eCMZG3wZ1Gzz%_ToypT;$Jwe53(A zl8ymR9~a01jBE8BqJ>)w!iC@k8KHyFl8hksIi!tt+Uq!DbtoX%rC;c_2kYBm!ur^O z)F962mm1Hb%QbWrY!y@wX__?nO|I`0ueP;z-+Xk~9BL1)OfM<+EV^}FGqZ_6dq zR%sIAt{JvTUC)TV6asR*zOL(s@bK`sp8Om_uJ}6o`L)&6{b)RR&d)eoWk~gL9jJ+k ze9F{-i5MdnaQaeFF(`;2V+OXb(vV8b=WGsO!$1WEt+iv#wT&UdvHVLL)3 z{iXLUHpXBl84aC#7amhvfw;coqC$!YKtUfcC#;OLIrz~)Ax5yg*@Z}Ax=0-7tx1xF!(aQ6!al5rrRTd@N+@L{JNm>I2n4VHU6Udx#t4)w``C*3z?v5g zY&013qN7ug&%*h$Qn#onF68tpH;almb)nu$+a})nAjKg=C^+&YfqqMofm)ZqAiv^MPpOp*rO zk}WoHMvM*(M4ddX^Bmm><{UdRR^|i^)+>#?eR`E!bgS+3sAAqZlM8n@*c3(}`HpqK z-thLj#@C~@FV1@q%51(<24}Nl%rp(M`dJl-ZBN1Uyqy7;t&dB;BX13#V~PX2@h+## zQ?@WX$)F?Db3l5v1c7K>|_iauW;06ABV~*geFL7)=@2@jyB#n;@*8 znUV}@XEAxDKg|ep_XHV4ogG(MXgB1!p!`erYlJm<%EnB&#d!Rk)K5jJFg z^Lo6ou~DZ{vqTMU_$_q*+=uRR9X~K_yjcfrCm0GLO~34XKsGtvt|RN}>OkzVh1KMo zi8#SVmG#u2?GATqb>pH+G~xD(#t?#oEZ)dD*pa?AkED0@x8hjvy!A z=Sr}o6R0@J_C?=IH1>$Xlz@KMZMM_Shr1)-(1i#i=%y z%5EC#F8G}_1}M|H#GG5nCVzLY7ZhKlU%@3P@y+U{qQN4V#|#8!d93rEfEZ+zb>@yL zJ{CtaMN~pc4f?1OF-S2|`9cjSOXo*@(Rp*1`qFXL1VkUiY5J+djJJ%83k$OWQ+y47 zgn|06t1~uF*1<&$(kZ7w#f%tA8V>`2P7e&Kg9bqp!i?ymvF}Fh`Jh5VkAe9l7)(2r z34JH4$dYVkk>k(+xGeYGmxn^n$vlRg+b%3< zb$J(kUkOoZ!mxPcw4!MMv zuHWKY&iA?KA9Ic>6NNZA`kC4PkEZVqr}}^YKSn4cdW%DZLiQ*-JCT#Z zA=&HLdquX)3P<(~;Uvk*R`$vsWs3?OnPqRk+vj`z{MA*L9Opb=_w#;?`*COL=-Y=1 zQAD=?g3J5rROKg)FMo7bp(u{(DmF!w) zSzNqgFl}G|3&%h=$Na!xOXIt$mfhlbvx~KcRs)$b4eNNfTA0fiU4GE%YB)yJWLWh> zDwUNC8~B$7IXW>^Z#~d}rMifC__}Tnc8WG0uEkEIUc&3V;h?`ugZZFSIMCmZ#K0oI zg2yKQ3uT=Tx_DbYnEj{>3$?r`UOAba#FFqoa#U zDQ?_6sz8j0QwZ>^s24x9X6pcSEGn&3s&sqYd5JV7_2jH z2_%Z#FDk(>7_?l-ebt}5T$kaBdqmrgUATs6lC)tCW&0zTWXWF@M)=(F1C$vd0SftY z8YyhKM+o)ORV&TmaLV*1yP)67B%|L1@3#u=0qR!-3yyR|YX9rth{QUgP%$~hp3}O9|f#2MRu3~Fzi-LmUX=bP74g3#M z(|&dDIo0giqyG}o`u6CsckAKkC92i>$EF+)<}<(N45rwstWD|%W94&xuwzMj#K}#h zulJ<8a$XGGo6br%u58H^(3j=-xAw~sVPaThw7U0Lu|xRUHS4B9V(#lkm8o%JqHIMNTl6)lO)?)px6+gn zN6*vtqzqS&OdANY|S56{aNuGE^|)JbU7u(4Hj@~!>R^>Cu< zHP;5}O2?}>^Q0TT=&Ey;YJ+|c%CGzpR3z)rjgum{|KG0%OGhCp_KRz4N6=cXdmAIe zVU~z0xM}m|h~0=y-rk!DhfG<2Mw;lKzB?-gV};JJo_9T9_Y?HEY$?liBX)_5sW5ch z>FNpdHk0-x$3I8~@$RV>*6|a6san3)y5mn4OimW&Z{U4LWrki3%E@o7mY#&vSsK=6!E_H|&_)cV1o-%p#-3ROE0Z8D&>}R5+a>d>T{^;gEc0w6&mrAqE}E*!8*=iqU30vVC(M5F_i$x!!J>#{V%>4GAMNuYUY`knrX` z%fnHAwOpMG8n)lQ7J`JYgTZdFBbz{o>_QM-3T-gqAS#?ugz-x3b(h@cHb#mdd-xvxrFReJ)E@-0 zP%BVB%}my=6k&}1ny(J?WPWybFNJluXkmFm#V9#BIb3Q`Og8ty#13%XVYZ^vhIbLB_PMb>7O z-XPk}r}#0+{29mUneBVyE^H<4Jl05gZn~IpjfjNM6t@Zt$I$}y-PlrQHl?^K)yIly zo((RQ`>=YY&JRqpjuRg(eS8=ZITAsa1s?R26h>7bamvcdFgGv$@U`^Uq3_!pJ%Zp@ zC-1pnDJ>%-BP~7s^(zrVlb!j#OMj*IJI(j^LUJx$Zg!mHQ{{1Gy6)C{Dyb^l>&bErs@~< zOPahVcZYfG7NMiRtrs`L-7KeZ)auBoElh(8R=Rb?wgo(1#`5SVQEpJ9_R639cH`!l@=uFN!h)p?&`TF<-Y{X}+%pCGt8DKenz0*tkEbQt(A97s#$e zF0PjuQRfhvdC|fd*YOlIOr1~#I)usOP55~pZTg$o!^G(7f_o-@NX?_$xj#)EguYPRArd1+6g(iSJ1-@|dDDGc5={pR|;?xMrD}_hfmU_g~ZJ^CSpV z`pjaL#@finq#c@74XDVIJ8x`q`~@4r%QlXV;G}Kz-(Gh>PH&Y%%KJZmUjlia5GJp+ z@ss&@^$yqG&wzdN0e9y=-%7qdX$;_UiIk9&T*@U&STX+@QxIu3qA*C- zG*nq6ot!Bz?yLT2#jk9K9wn+Vo=o975|Svh=MBP49>jx6^9aJhbJS!()YnEuc&MpN z-zi*iY=YO^q-fE>8bop(v4EC}BC#l7+BD6s&Ch#u$=C7URS|B&8)WSOEWKfdU3t$@wI>4c_+y|o$43w#oe3q zEoo5xbE0^xmCKd$#OOWwr${EZ4ZGSu(G{MknE1aU&pwmHeIf)(XL$4Tlv4o5W4dl! zzVDlP!|B#1V*{e1N<_+bmpffQJnHb5*HHou>>__Ae&0-~`YozJzv%a&EMjnhv~iGm z^xyye_a8v}Dn~rIo-SM1Cb?~R2f{pesK##}&g{`e;&a=>6k+1lyx1>#)FkX_x2ux7EGkG)yQO@*WQzT@j_0|BUtTkt@UX=d z@*0)dvU^0VpYg~GZhG7c-d8!a1|?dB^3?a=k|$JHx{g&Aj!0Q{N^gJDO0pDX?9O6G7 zcvKFYe!UhaTiXJi!Z5{Wp()DcG{nywYmGaEm0cTbYG9ijjeW4tJDtMkDFb+;PRk6o z2&?bAOr*%KuG4@0iz?IqeF-1<$QKe>#7>8k&utazUND?AMRq8X^~WCBfI4b-(D$Ni zg6pNezW(IP)%yB+{bl{44rIAxWWkkI@dWlnP#ZV!%{(P<5-=af%bpJgk+8I|yjxgM=ez>I+Ub zOkd=Dd15rXs}6KxGbsz}FL$T{ONAxBH@z>cw+JPmrLcEaldgKt)95$tLsAIjT=)SO zXn-&xTa>T&v9gMaeP!C5M5EalOK9IhSd z9%Qx$8@j+o|MQ(o)CFv)0?;GEV;3e7P0vUbjIycH`yg3h-GALTckD)gri|~OVU9@f zO21Zam4oISzTi2lcAO$X6t#OIQc_-0mSwVupCzkKFdP&-D0RaJ?o<44F8

WIP isn’t turned on for employees in your organization. - Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/help/3187045/can-t-open-files-offline-when-you-use-offline-files-and-windows-information-protection). + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/en-us/help/3187045/can-t-open-files-offline-when-you-use-offline-files-and-windows-information-protection). - - Switching from a mobile application management (MAM) solution to a mobile device management (MDM) solution, while running Windows Home edition, turns WIP off. - WIP stops working if your organization switches from MAM to MDM while using Windows Home edition. - Continue to use your MAM solution. For more info, see the Integration with Windows Information Protection section of the [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management) topic. >[!NOTE] diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 1c7ea0a9ff..85a6f3d8c9 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -18,7 +18,7 @@ localizationpriority: high This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. >[!IMPORTANT] ->All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md), based on the tool you're using in your enterprise. +>All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md), based on the tool you're using in your organization. |Task |Description | From bed4d7c02bca53dd51f1bcedf512ffd764080a13 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 29 Mar 2017 08:59:07 -0700 Subject: [PATCH 085/165] Updated content --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 1 + windows/keep-secure/create-and-verify-an-efs-dra-certificate.md | 2 +- windows/keep-secure/limitations-with-wip.md | 2 +- windows/keep-secure/mandatory-settings-for-wip.md | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 1cf0bcdc14..10f723df74 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md ## March 2017 |New or changed topic |Description | |---------------------|------------| +|[Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |Updated based on Windows 10, version 1703. | |[Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) |Added new content about Azure Rights Management. | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Added additional limitations for Windows 10, version 1703. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md)|Added content about recovering data from a cloud environment.| diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index bfd0d8535f..a872b455ba 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -12,7 +12,7 @@ localizationpriority: high # Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1703 - Windows 10 Mobile If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index 70b4062521..9d6d1d1907 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -13,7 +13,7 @@ localizationpriority: high # Limitations while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1703 - Windows 10 Mobile This table provides info about the most common problems you might encounter while running WIP in your organization. diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 1c7ea0a9ff..8582716a30 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -12,7 +12,7 @@ localizationpriority: high # Mandatory tasks and settings required to turn on Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1703 - Windows 10 Mobile This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. From 232c08786864e521d2c5f063e9467033e3202c67 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Wed, 29 Mar 2017 09:13:33 -0700 Subject: [PATCH 086/165] Added Mobile section and tweaked WDATP txt per PR --- .../whats-new-windows-10-version-1703.md | 37 ++++++++++++++----- 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 1749688be6..8d699e5eda 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -58,13 +58,6 @@ Additional MDM policy settings are available for Start and taskbar layout. For d Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10, version 1703, adds support for customized taskbars to [MDM](../configure/customize-windows-10-start-screens-by-using-mobile-device-management.md). -### Lockdown Designer for Windows 10 Mobile lockdown files - -The Lockdown Designer app helps you configure and create a lockdown XML file to apply to devices running Windows 10 Mobile, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Using Lockdown Designer is easier than [manually creating a lockdown XML file](../configure/lockdown-xml.md). - -![Lockdown Designer app in Store](images/ldstore.png) - -[Learn more about the Lockdown Designer app.](../configure/mobile-lockdown-designer.md) ### Cortana at work @@ -95,7 +88,7 @@ New features in Windows Defender Advanced Threat Protection (ATP) for Windows 10 - [Use the threat intelligence API to create custom alerts](../keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. - Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks - Upgraded detections of ransomware and other advanced attacks - - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect attacks that previously went unnoticed + - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed - **Investigation**
Enterprise customers can now take advantage of the entire Windows security stack with Windows Defender Antivirus detections and Device Guard blocks being surfaced in the Windows Defender ATP portal. Other capabilities have been added to help you gain a holistic view on investigations. @@ -136,7 +129,7 @@ New features for Windows Defender AV in Windows 10, version 1703 include: - [The ability to specify the level of cloud-protection](../keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md) - [Windows Defender Antivirus protection in the Windows Defender Security Center app](../keep-secure/windows-defender-security-center-antivirus.md) -In Windows 10, version 1607, we [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment in version 1703 with [updated beahvior monitoring and always-on real-time protection](.../keep-secure/configure-real-time-protection-windows-defender-antivirus.md). +In Windows 10, version 1607, we [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment in version 1703 with [updated beahvior monitoring and always-on real-time protection](../keep-secure/configure-real-time-protection-windows-defender-antivirus.md). You can read more about ransomware mitigations and detection capability in Windows Defender AV in the [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) and at the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). @@ -208,6 +201,32 @@ For more info, see the following topics: - [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](../manage/appv-auto-batch-updating.md) - [Automatically cleanup unpublished packages on the App-V client](../manage/appv-auto-clean-unpublished-packages.md) +## Windows 10 Mobile enhancements + +### Lockdown Designer + +The Lockdown Designer app helps you configure and create a lockdown XML file to apply to devices running Windows 10 Mobile, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Using Lockdown Designer is easier than [manually creating a lockdown XML file](../configure/lockdown-xml.md). + +![Lockdown Designer app in Store](images/ldstore.png) + +[Learn more about the Lockdown Designer app.](../configure/mobile-lockdown-designer.md) + +### Other enhancements + +Windows 10 Mobile, version 1703 also includes the following enhancements: + +- SD card encryption +- Remote PIN resets for Azure Active Directory accounts +- SMS text message archiving +- WiFi Direct management +- OTC update tool +- Continuum display management + - Individually turn off the monitor or phone screen when not in use + - Indivudally adjust screen time-out settings +- Continuum docking solutions + - Set Ethernet port properties + - Set proxy properties for the Ethernet port + ## New features in related products The following new features aren't part of Windows 10, but help you make the most of it. From 8622757a2e1d4fcd20829d080a8fe2ccba21e4f9 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 29 Mar 2017 09:45:16 -0700 Subject: [PATCH 087/165] fixed typo in DMA --- windows/keep-secure/bitlocker-group-policy-settings.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index c0112dcf47..c16db3871b 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -32,7 +32,7 @@ The following sections provide a comprehensive list of BitLocker Group Policy se The following policy settings can be used to determine how a BitLocker-protected drive can be unlocked. -- [Allow devices with Secure Boot and protect DMS ports to opt out of preboot PIN](#bkmk-hstioptout) +- [Allow devices with Secure Boot and protect DMA ports to opt out of preboot PIN](#bkmk-hstioptout) - [Allow network unlock at startup](#bkmk-netunlock) - [Require additional authentication at startup](#bkmk-unlockpol1) - [Allow enhanced PINs for startup](#bkmk-unlockpol2) @@ -86,7 +86,7 @@ The following policies are used to support customized deployment scenarios in yo - [Allow access to BitLocker-protected fixed data drives from earlier versions of Windows](#bkmk-depopt4) - [Allow access to BitLocker-protected removable data drives from earlier versions of Windows](#bkmk-depopt5) -### Allow devices with Secure Boot and protect DMS ports to opt out of preboot PIN +### Allow devices with Secure Boot and protect DMA ports to opt out of preboot PIN This policy setting allows users on devices that are compliant with InstantGo or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. @@ -137,7 +137,8 @@ This setting enables an exception to the PIN-required policy on secure hardware. ### Allow network unlock at startup -This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. +This policy controls a portion of the behavior of the Network Unlock feature in BitLocker. This policy is required to enable BitLocker Network Unlock on a network because it allows clients running BitLocker to create the necessary network key protector during encryption. +This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. From 5417922baecd1b1bfbbf9d92fbf8bb0ec6c1f583 Mon Sep 17 00:00:00 2001 From: Don Gill Date: Wed, 29 Mar 2017 11:30:33 -0700 Subject: [PATCH 088/165] added the updated highlight icon --- windows/images/w10-evaluation.png | Bin 0 -> 2830 bytes windows/images/w10-whatsnew-highlight.png | Bin 0 -> 3111 bytes windows/index.md | 4 ++-- 3 files changed, 2 insertions(+), 2 deletions(-) create mode 100644 windows/images/w10-evaluation.png create mode 100644 windows/images/w10-whatsnew-highlight.png diff --git a/windows/images/w10-evaluation.png b/windows/images/w10-evaluation.png new file mode 100644 index 0000000000000000000000000000000000000000..19d690b694db672bb5d13d89dea638a00d281f85 GIT binary patch literal 2830 zcmaKuS5y;f62~bb5PBD{f)JHZ1eGQTC=facEumKtNT?cWXc6#ILt6zziV)#OgoGA~ zQkJNfE)W4Jf|LMK12@tGvbkr^zU}VA%$)z3GiM&YnQwk+)=(2Zz(oKH3k#o_DcF`7 zqy9E7Hl}YrU;aBYu!h>27_bnBF0C=eIX``fJ_}2IHqVI{2UBxDGIa`NVG$1d+gQK* zN;As=ug$>vuqgMfVss#^=W@?P&V4SE-wc4c*Zoalm9jx+Z$#n9>OVmKmF5KJ$~=G> zvijVmZ!wckR00Es9_^a4v{lG!eafrgWpRNZTWaUnwY=cvioS5x)Cqh`W$wVru*Y!>LVd!xYkpjoJrFa)<0< zMGNHL&5&@Wo;rQYBh_iiQ78~u=4PqbLsuS3q?F7{ApFlb#lPU|l-*gjlJy&L0Nw;zD zDJ%vq6fE#scZY! zgPE*hOUlvpq6Qdilwe7A66lLUxwD@%^wSy;!ofA}#qK3H-O|8ST#)r^e{0n6JverL ztiVo$2a-=YnvkVlNhg`Rt3b(VcS?eHnrGe(4jF{Cd-ta&zVd~it`LSX9jaWV1H|ah zl!`Z_4>C^Mk!y~9kw`senfW}p7^;3aUKX=@^?kHSvIY-De2q-P(SMd)KM)^m}Ft}a8gDVx2FCvFX50xkubn6N@ zKxU*bRU+=h08e){NdJ7)BAO{nu;ogCLe(gS(-uWKW%MLl@b?jrbw)*&ORBMuf;FC{ zQl8+WK9Upd*2I4N0)bPBJgC);{(9m?2*;H8U}nqLa|=-undCsf&>2iXko1Jj)gNjg z7s-hCah}a*hz)M$M6e=ep`WP z5}VKXfznqX1-&$NoaCfB-YUQxH#qL+NLl<|>Oj?m5$6bBn6cuEDBOn1!H|oCadZ6h z62|U~F`;WCXk%T@LO8r-RQjzC;BA9>&E@~J#JfvezOOkVN$@mCkB^O$MC)Bh)z`x{MyxoRmG=lcw7()mdMnVK%&^T3hi;r0fGl%aylMDxS?)&E*qDZTl9R? zI=(Yhf8XqOU~cY>FFY|ru~px?!J_IBI?sc1cxd2ny`O*!_ub~Y1kHy%I{w<+SFppL z{;o??>;T4y`fn-)6&41L=>8U))~rR#EO3amz4wMedcBX@&TkJr?trK_OK9X;Re7Nc z>9VPPatBf8GE~(6x;CwV(VcqN(g0U%3lCHbdR+fa zOjQnlQHie3$ZoAg{ON6!-*}{VJ3oY|zPLFzhq`2DtjK@8)itqNEQj;K*4!XSZ&Qj& zv;j9)Bd6&_-cHwselb4=)q-f!Me@0VBJ*Sa`u!Bu41uHB@}f##UjKMPDp4F~B2DXK>JYFg91m*vYFfqo)=17kNb6~vLjzK>TH zx-Sz~Jdc)(@FYwL)mbgI$@@rx;k8u*`(b+d)Her^e09a&;%8#==vv9WsF0@_ckbF$ zNs-x6Nlz%luOcZ5oic&B_!^KaiNQN{K1~(I`cGW0=B@larwi2Yb=v;>;WddfW|xI)k(8g7=$XvR`25MHzf=|e!uFN{J^6-wQ+b3W-~tX`$LqsC+Jafa*Bi0 zZcYSCBrZ>^A6rrH_7T-jP6jo2QkIwRFd{V_VudC#i*~t3YfkP))t}5pp8?L?zTn`t zY$A7W=Znd|R?L{ai(wPx8~ic|ZvEQbM5o~&@}4@{bNd`9TWx-4ZB$dN-zjOx=*3rY zn*8w5wU_LOdz}64*v73+=QP`#?#tCGPFUJ-sv>%vY>agr4--$qsit9iMg>bp_|mA-`0e<&ZIQRg zT|a5FaokzhkC|hd+SZRNBRv;rs=!daA|1Jo)yji_9KX6~-eUMWDY_Wa z6(hWfT=rl~Xz1WI{APJ`|3-Fc(7Ue(Jstf$3%~LcAkjBFR)@FW-4b&BWfnJI_DjH{ zr>K0ggWVoUrzaj2DfD_Pcw4_=x0|iw7aTh{U5=9Adp@x@>Fp$-fK4gFTSZaAgE~T0 zEqXO!GO9C1%xjXFcCrjF&}IxWHcBy!-R(I-XGR(O>Ur(g;Q@q~d+hg+cH$FJU3;Sq(r0PRr!~u-E^DvZwCid z@e5Ft)~-M92SG8;6F$X`R8IJ-MuACzq}01o?%QXqUWiOl_Z7H0lVMrRjG$nmfoI~s E0N#my(EtDd literal 0 HcmV?d00001 diff --git a/windows/images/w10-whatsnew-highlight.png b/windows/images/w10-whatsnew-highlight.png new file mode 100644 index 0000000000000000000000000000000000000000..b8534ef41dfcd25b44d6907c4cbd392d46772c11 GIT binary patch literal 3111 zcmb7GX*d*K7bk1BjI9#Jz6_1EL6+?MmMufJ8N-N>UA9QsLo#D48OhiSm3=Ux7&Q6E zSR%U+DNAMs@AST(-w*!}=bq=>bARWa=efUg&q=qlG38_vWTT^_<1{xjvZv|jzruQk zw!UR9e?U|8VfLm5bPc0I-)RP;pT4y|9o_33cB(fM%|07q1`VU5;|c#O^mD#I8l1h; z+(_Rs+T%y**>J}%7YE&CT|qEFfK#2TTYy_8={=}GWM+E80iB#8?#6hg=?(Y6Jq2-5 zOLhc+KZ(v;wO>!A$V%XG(N=!Hf)88;DyllAnvZCb$u}pD5wyn8>f=)?VXDJjYf+)0 zD)W@N4qV&L+)lSu=pfx~qv_}CT756Cm$LC&vx17b9o59JNCP`!%5%(FePiC_3~9!H z=ja0w$5jp*yYN5oPKb(V6U%iNpb*1knBDL;@yS}WIkQYQh{&F+2 z4WwxYh_aD8;27P|Y_#J3f|%dN`n6w8#!y(u1y5@vR{E+xx_RW*9asA8!WJJgX_~?} z!iwe|)gfct_BW^wQ4eg_9>g$@SyB}prB%9wp+u=4SFp=F{DfuNHqOQ+v05eld%Z`v zMMa?b_HHUBE+!9> z+faOgP~;O9g)xfIHNX5q#%du^@^0b#)-=&d#;A+AShkzMn=)_XScdz`(%kzZ`(4xo zhoE(*E<8(uzoN}KL~T1kW!5mBnhUR{cs7qPAOANdwAF1JaZU~;3s6PMxonUhozoZB2F2{-_*gWQ>K&iM<*~Mxkar`Q0򝷃 zAI_d|f8axWS$8+bj%>-)7vob=-;c?q73bx7@1Qlg_qc^{Qe<~~x*IHWlV6UiUd1wB zKY(e(1)Ix)pN(v7V6IF4K&8rRIa%cz&PgjfX~vJb+3!u z-PIx=YGvLZp4luEO@*}ni6sxtr(X~kJofPr@o4^2hks*qDjBo_nUaFK@$)W!LSe!E zon!pRUq8eoWoWFfEL@RP$1z1k5Lq`T_TTzo0Tp@f7hK>n+dP z1{+@#xxT1yK&%+QMWHA`OA@U%HZa6|jB_Oxtkq&7X#X^$arLO?>g86DR2_sNzzb1T zOu5kOvgfj}HDbI*d-X8aq4ARCgS;;{QB`g6Th7Z4uPvtt+cJXq-v$Vb=e7)XjASsv zVRxkd9ZVyUmJixnV5!*L$6`+>xd>-_;)R$yd#^qv-s?se=ydtgXZON15)Iy7?sk6# z@cv2%fW{DHopyJ<+rq$=SSrgwkb zLW0j*mqjRzRAUA+SH&L2#6(|iZsVIE5ggSLAI*7&zNxX)iTn0slxU?YpyT?DL3jrN zr0=Fth^puhEIuVQ+{la+*#;E{^+LIq6o|mt&Y!g6gbWCN8oO4t-D+24W;_niNn=lU zK5T*gKA?TGgP7xP;2S!_OY?>F^yiF^bmQZvX6pNUNf?w{;iFHuDchQ~N6Zi2^0xV-=x`cS-b^-=4F*P|pJ2QHWkNo{jx~KBp zEv?vaSD{f!6)8dd5e{)?ZXxpC_`-JY`{p9CyB79(Ax>;zL0!GHu7m)~PbZDI(5hh; zCoW=RsZORFk^fj?SmRKH-e<0~{HF|R_En?(S`>e`m zd5c(puyaZI*g(rh!$7^dV(89FETigzpdrHzx)9Z?j4%4E$v#_@XooiUE-k9?KVPH$ zACtwx35g_Kn9MO!jI&b%BBX1;ar;W2 z2$Q&9oI~kh=TyHcFfcD!w`RVSWHyZH_4z2saVx^MR`)3PVF|X$A$zE$wLZfQ zdzYD{_F=k4$tg5bGYG$xbsgEHv5;(5Yg7>)e>q~XV8b!U8h_hGOou-UYE@u$Efvzq zOX{%B+HG!i79)X(-*gu`f-84=f8gu&I^Xtox0rXgt!p2m*L{1$CNh{w&oC)ejJSY0 zAIf#x0j}u(vz8d?Rg-nQHR(YfMNyV;AAXyg^OabCH>=j @@ -67,7 +67,7 @@ This library provides the core content that IT pros need to evaluate, plan, depl From 57f5a6fb6f8345120317fbc79cf9eaeac33ba896 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 29 Mar 2017 11:37:27 -0700 Subject: [PATCH 089/165] add steps in AAD --- ...ss-windows-defender-advanced-threat-protection.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md index 593b66f678..429ac0c65b 100644 --- a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -63,14 +63,18 @@ For more information see, [Manage Azure AD group and role membership](https://te ## Assign user access using the Azure portal -1. Go to the [Azure portal](www.portal.azure.com). +1. Go to the [Azure portal](https://portal.azure.com). 2. Select **Azure Active Directory**. -3. Select the user you want to assign user access to. +3. Select **Manage** > **Users and groups**. -4. Select **Manage** > **Directory role**. +4. Select **Manage** > **All users**. -5. Under **Directory role**, select **Limited administrator**, then **Security Reader** or **Security Administrator**. +5. Search or select the user you want to assign the role to. + +6. Select **Manage** > **Directory role**. + +7. Under **Directory role**, select **Limited administrator**, then **Security Reader** or **Security Administrator**. ![Image of Microsoft Azure portal](images/atp-azure-ui-user-access.png) From b016d76cafc7052ae8bde7744da09e579ec2ed4e Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 29 Mar 2017 12:42:53 -0700 Subject: [PATCH 090/165] Updating redirections --- .openpublishing.redirection.json | 45 +++++++++++++++++++ ...onfigure-windows-defender-in-windows-10.md | 16 ------- ...ble-pua-windows-defender-for-windows-10.md | 18 -------- ...ed-with-windows-defender-for-windows-10.md | 16 ------- ...md-scan-windows-defender-for-windows-10.md | 18 -------- ...bleshoot-windows-defender-in-windows-10.md | 16 ------- ...cmdlets-windows-defender-for-windows-10.md | 18 -------- .../windows-defender-block-at-first-sight.md | 19 -------- ...windows-defender-enhanced-notifications.md | 18 -------- .../windows-defender-in-windows-10.md | 16 ------- 10 files changed, 45 insertions(+), 155 deletions(-) delete mode 100644 windows/keep-secure/configure-windows-defender-in-windows-10.md delete mode 100644 windows/keep-secure/enable-pua-windows-defender-for-windows-10.md delete mode 100644 windows/keep-secure/get-started-with-windows-defender-for-windows-10.md delete mode 100644 windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md delete mode 100644 windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md delete mode 100644 windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md delete mode 100644 windows/keep-secure/windows-defender-block-at-first-sight.md delete mode 100644 windows/keep-secure/windows-defender-enhanced-notifications.md delete mode 100644 windows/keep-secure/windows-defender-in-windows-10.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 2de0d95e5a..18e4f74620 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,6 +1,51 @@ { "redirections": [ { +"source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/deploy-manage-report-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/deploy-manage-report-windows-defender-antivirus", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/command-line-arguments-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/troubleshoot-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", +"redirect_url": "/itpro/windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-in-windows-10.md", +"redirect_url": "/itpro/windows/keep-secure/windows-defender-antivirus-in-windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", +"redirect_url": "/itpro/windows/keep-secure/configure-notifications-windows-defender-antivirus", +"redirect_document_id": true +}, +{ "source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", "redirect_url": "/itpro/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection", "redirect_document_id": true diff --git a/windows/keep-secure/configure-windows-defender-in-windows-10.md b/windows/keep-secure/configure-windows-defender-in-windows-10.md deleted file mode 100644 index 32dc5bdf7d..0000000000 --- a/windows/keep-secure/configure-windows-defender-in-windows-10.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Configure and use Windows Defender in Windows 10 -description: IT professionals can configure definition updates and cloud-based protection in Windows Defender in Windows 10 through Microsoft Active Directory and Windows Server Update Services (WSUS). -ms.assetid: 22649663-AC7A-40D8-B1F7-5CAD9E49653D -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: jasesso -redirect_url: /itpro/windows/keep-secure/deploy-manage-report-windows-defender-antivirus/ ---- - -# Configure Windows Defender in Windows 10 - -This page has been redirected to *Windows Defender Antivirus in Windows 10*. diff --git a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md b/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md deleted file mode 100644 index 0feb3a91f8..0000000000 --- a/windows/keep-secure/enable-pua-windows-defender-for-windows-10.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Detect and block Potentially Unwanted Application with Windows Defender -description: In Windows 10, you can enable the Potentially Unwanted Application (PUA) feature in Managed Windows Defender to identify and block unwanted software during download and install time. -keywords: pua, enable, detect pua, block pua, windows defender and pua -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: detect -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: dulcemv -redirect_url: /detect-block-potentially-unwanted-apps-windows-defender-antivirus/ ---- - -# Detect and block Potentially Unwanted Application in Windows 10 - -This page has been redirected to *Detect and block unwanted applications*. \ No newline at end of file diff --git a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md b/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md deleted file mode 100644 index e9c2b82470..0000000000 --- a/windows/keep-secure/get-started-with-windows-defender-for-windows-10.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Update and manage Windows Defender in Windows 10 (Windows 10) -description: IT professionals can manage Windows Defender on Windows 10 endpoints in their organization using Microsoft Active Directory or Windows Server Update Services (WSUS), apply updates to endpoints, and manage scans using Group Policy SettingsWindows Management Instrumentation (WMI)PowerShell. -ms.assetid: 045F5BF2-87D7-4522-97E1-C1D508E063A7 -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: jasesso -redirect_url: /deploy-manage-report-windows-defender-antivirus/ ---- - -# Update and manage Windows Defender in Windows 10 - -This page has been redirected to *Windows Defender Antivirus in Windows 10*. diff --git a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md b/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md deleted file mode 100644 index f8f3682a5d..0000000000 --- a/windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Learn how to run a scan from command line in Windows Defender (Windows 10) -description: Windows Defender utility enables IT professionals to use command line to run antivirus scans. -keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: mjcaparas -redirect_url: /command-line-arguments-windows-defender-antivirus/ ---- - -# Run a Windows Defender scan from the command line - -This page has been redirected to *Usethempcmdrun.execommandlinetooltoconfigureandmanageWindowsDefenderAntivirus*. \ No newline at end of file diff --git a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md b/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md deleted file mode 100644 index 2c5e7c8ce8..0000000000 --- a/windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Troubleshoot Windows Defender in Windows 10 (Windows 10) -description: IT professionals can review information about event IDs in Windows Defender for Windows 10 and see any relevant action they can take. -ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: jasesso -redirect_url: /troubleshoot-windows-defender-antivirus/ ---- - -# Troubleshoot Windows Defender in Windows 10 - -This page has been redirected to *Troubleshoot Windows Defender Antivirus*. \ No newline at end of file diff --git a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md b/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md deleted file mode 100644 index dec540347e..0000000000 --- a/windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Use PowerShell cmdlets to configure and run Windows Defender in Windows 10 -description: In Windows 10, you can use PowerShell cmdlets to run scans, update definitions, and change settings in Windows Defender. -keywords: scan, command line, mpcmdrun, defender -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: iaanw -redirect_url: /use-powershell-cmdlets-windows-defender-antivirus/ ---- - -# Use PowerShell cmdlets to configure and run Windows Defender - -This page has been redirected to *Use PowerShell cmdlets to configure and run Windows Defender Antivirus*. \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-block-at-first-sight.md b/windows/keep-secure/windows-defender-block-at-first-sight.md deleted file mode 100644 index 4c9af5e903..0000000000 --- a/windows/keep-secure/windows-defender-block-at-first-sight.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Enable the Block at First Sight feature to detect malware within seconds -description: In Windows 10 the Block at First Sight feature determines and blocks new malware variants in seconds. You can enable the feature with Group Policy. -keywords: scan, BAFS, malware, first seen, first sight, cloud, MAPS, defender -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: iaanw -redirect_url: /configure-block-at-first-sight-windows-defender-antivirus/ - ---- - -# Block at First Sight - -This page has been redirected to *Configure the Block at First Sight feature*. \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-enhanced-notifications.md b/windows/keep-secure/windows-defender-enhanced-notifications.md deleted file mode 100644 index b63c67e65f..0000000000 --- a/windows/keep-secure/windows-defender-enhanced-notifications.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Configure enhanced notifications for Windows Defender -description: In Windows 10, you can enable advanced notifications for endpoints throughout your enterprise network. -keywords: notifications, defender, endpoint, management, admin -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: iaanw -redirect_url: /configure-notifications-windows-defender-antivirus/ ---- - -# Configure enhanced notifications for Windows Defender in Windows 10 - -This page has been redirected to *Configure notifications*. \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-in-windows-10.md b/windows/keep-secure/windows-defender-in-windows-10.md deleted file mode 100644 index 4eb81e6c4e..0000000000 --- a/windows/keep-secure/windows-defender-in-windows-10.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Windows Defender in Windows 10 (Windows 10) -description: This topic provides an overview of Windows Defender, including a list of system requirements and new features. -ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -localizationpriority: medium -author: jasesso -redirect_url: /windows-defender-antivirus-in-windows-10/ ---- - -# Windows Defender in Windows 10 - -This page has been redirected to *Windows Defender Antivirus in Windows 10*. \ No newline at end of file From 30b03115c14bbdbf912b528093e5b405624cdb10 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Wed, 29 Mar 2017 12:58:11 -0700 Subject: [PATCH 091/165] Added content for uninstalled in-box apps --- windows/whats-new/whats-new-windows-10-version-1703.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 8d699e5eda..6d7cb38604 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -131,6 +131,7 @@ New features for Windows Defender AV in Windows 10, version 1703 include: In Windows 10, version 1607, we [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment in version 1703 with [updated beahvior monitoring and always-on real-time protection](../keep-secure/configure-real-time-protection-windows-defender-antivirus.md). + You can read more about ransomware mitigations and detection capability in Windows Defender AV in the [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) and at the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). ### Device Guard and Credential Guard @@ -168,6 +169,10 @@ Added policies include: To check out all the details, see [Configure Delivery Optimization for Windows 10 updates](../update/waas-delivery-optimization.md) +### Uninstalled in-box apps no longer automatically reinstall + +When upgrading to Windows 10, version 1703, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. (Apps de-provisioned by IT administrators will still be reinstalled.) + ## Management ### New MDM capabilities @@ -246,6 +251,6 @@ For more information about Upgrade Readiness, see the following topics: Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. -Update Compliance is a solution built using OMS Logs and Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. +Update Compliance is a solution built using OMS Log Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](../manage/update-compliance-monitor.md). From ca04792b711e7b435624ec34f2683c84a9c82c9c Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Wed, 29 Mar 2017 13:38:59 -0700 Subject: [PATCH 092/165] updates from review --- ...d-permissions-windows-store-for-business.md | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/windows/manage/roles-and-permissions-windows-store-for-business.md b/windows/manage/roles-and-permissions-windows-store-for-business.md index 344a02b036..8985c21e1c 100644 --- a/windows/manage/roles-and-permissions-windows-store-for-business.md +++ b/windows/manage/roles-and-permissions-windows-store-for-business.md @@ -34,7 +34,7 @@ This table lists the global user accounts and the permissions they have in the S | Distribute apps | X | X |   -- **Global Administrator** - IT Pros with this account have full access to Store for Business. They can do everything allowed in the Store for Business Admin role, plus they can sign up for the Store for Business, and assign Store for Business roles to other employees. +- **Global Administrator** - IT Pros with this account have full access to Store for Business. They can do everything allowed in the Store for Business Admin role, plus they can sign up for the Store for Business. - **Billing Administrator** - IT Pros with this account have the same permissions as the Store for Business Purchaser role. @@ -68,7 +68,7 @@ These permissions allow people to: - Offline licensing - - Permissions (view only) + - Permissions - Private store @@ -80,12 +80,10 @@ These permissions allow people to: 1. Sign in to Store for Business. - **Note**   - You need to be a Global Administrator, or have the Store for Business Admin role to access the **Permissions** page. - - To assign roles, you need to be a Global Administrator or a Store Administrator that is also a User Administrator. - -   + >[!Note] + >You need to be a Global Administrator, or have the Store for Business Admin role to access the **Permissions** page.  + + To assign roles, you need to be a Global Administrator or a Store Administrator. 2. Click **Settings**, and then choose **Permissions**. @@ -95,9 +93,7 @@ These permissions allow people to: ![Image showing Assign roles to people box in Windows Store for Business.](images/wsfb-permissions-assignrole.png) -4. - - If you are not finding the name you want, you might need to add people to your Azure AD directory. For more information, see [Manage user accounts in the Windows Store for Business.](manage-users-and-groups-windows-store-for-business.md) +4. If you are not finding the name you want, you might need to add people to your Azure AD directory. For more information, see [Manage user accounts in the Windows Store for Business.](manage-users-and-groups-windows-store-for-business.md)   From 66991ffdfe52a732da3e9f321e16ef7be3ea80da Mon Sep 17 00:00:00 2001 From: Don Gill Date: Wed, 29 Mar 2017 14:01:49 -0700 Subject: [PATCH 093/165] Fixing links and alt text --- windows/index.md | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/windows/index.md b/windows/index.md index 2692beeabb..32342a6b60 100644 --- a/windows/index.md +++ b/windows/index.md @@ -45,7 +45,7 @@ This library provides the core content that IT pros need to evaluate, plan, depl @@ -76,19 +76,18 @@ This library provides the core content that IT pros need to evaluate, plan, depl
-# Get to know Windows as a Service (WaaS) -
- Read what's new in Windows 10 + Read what's new in Windows 10
What's New?
- Get your + Get your
Try it

- + Keep Windows 10 secure
Keep Secure @@ -67,7 +67,7 @@ This library provides the core content that IT pros need to evaluate, plan, depl
- Get your + Try Windows 10
Try it
+## Get to know Windows as a Service (WaaS) +
- - +
The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. + The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. - These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - - - * [Read more about Windows as a Service]() - * [Download the WaaS infographic]() + These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. + - [Read more about Windows as a Service]() + + - [Download the WaaS infographic]()
Get to know Windows as a Service (WaaS)
Get to know Windows as a Service (WaaS)
From 447df9ac387050f4cac3497893df6a32c06ebcd1 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Wed, 29 Mar 2017 14:51:05 -0700 Subject: [PATCH 094/165] Added sentence to 1st note per feedback --- windows/whats-new/whats-new-windows-10-version-1703.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 6d7cb38604..48bd0d1e22 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -17,7 +17,7 @@ Below is a list of some of the new and updated content that discusses Informatio For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](index.md). >[!NOTE] ->For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update). +>Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).   ## Configuration From a8da45d964ed28afed892b84cb8aa29f3e78a4a3 Mon Sep 17 00:00:00 2001 From: Don Gill Date: Wed, 29 Mar 2017 15:02:39 -0700 Subject: [PATCH 095/165] tweaking layout --- windows/index.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/windows/index.md b/windows/index.md index 32342a6b60..dad59e644a 100644 --- a/windows/index.md +++ b/windows/index.md @@ -12,8 +12,7 @@ author: brianlic-msft This library provides the core content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10 or Windows 10 Mobile.
- -
+
@@ -72,22 +71,20 @@ This library provides the core content that IT pros need to evaluate, plan, depl
Try it -
- -
+ ## Get to know Windows as a Service (WaaS) - - +
The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. + The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - - [Read more about Windows as a Service]() + - Read more about Windows as a Service - - [Download the WaaS infographic]() + - Download the WaaS infographic
Get to know Windows as a Service (WaaS)
Get to know Windows as a Service (WaaS)
From 073b05bb363843e7e624484e42b9a4fe4a8d7619 Mon Sep 17 00:00:00 2001 From: John Tobin Date: Wed, 29 Mar 2017 15:07:24 -0700 Subject: [PATCH 096/165] Added Cred Guard topics --- windows/keep-secure/TOC.md | 1 + .../credential-guard-considerations.md | 62 ++ .../credential-guard-how-it-works.md | 48 + .../keep-secure/credential-guard-manage.md | 197 ++++ ...redential-guard-not-protected-scenarios.md | 166 ++++ .../credential-guard-requirements.md | 128 +++ .../keep-secure/credential-guard-scripts.md | 488 +++++++++ windows/keep-secure/credential-guard.md | 933 +----------------- windows/keep-secure/images/mva_videos.png | Bin 0 -> 139543 bytes ...-logon-dont-display-username-at-sign-in.md | 86 ++ 10 files changed, 1186 insertions(+), 923 deletions(-) create mode 100644 windows/keep-secure/credential-guard-considerations.md create mode 100644 windows/keep-secure/credential-guard-how-it-works.md create mode 100644 windows/keep-secure/credential-guard-manage.md create mode 100644 windows/keep-secure/credential-guard-not-protected-scenarios.md create mode 100644 windows/keep-secure/credential-guard-requirements.md create mode 100644 windows/keep-secure/credential-guard-scripts.md create mode 100644 windows/keep-secure/images/mva_videos.png create mode 100644 windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index eeb1d26ced..b427d098bb 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -574,6 +574,7 @@ ###### [Domain member: Require strong (Windows 2000 or later) session key](domain-member-require-strong-windows-2000-or-later-session-key.md) ###### [Interactive logon: Display user information when the session is locked](interactive-logon-display-user-information-when-the-session-is-locked.md) ###### [Interactive logon: Don't display last signed-in](interactive-logon-do-not-display-last-user-name.md) +###### [Interactive logon: Don't display username at sign-in](interactive-logon-dont-display-username-at-sign-in.md) ###### [Interactive logon: Do not require CTRL+ALT+DEL](interactive-logon-do-not-require-ctrl-alt-del.md) ###### [Interactive logon: Machine account lockout threshold](interactive-logon-machine-account-lockout-threshold.md) ###### [Interactive logon: Machine inactivity limit](interactive-logon-machine-inactivity-limit.md) diff --git a/windows/keep-secure/credential-guard-considerations.md b/windows/keep-secure/credential-guard-considerations.md new file mode 100644 index 0000000000..bf97ca9299 --- /dev/null +++ b/windows/keep-secure/credential-guard-considerations.md @@ -0,0 +1,62 @@ +--- +title: Considerations when using Credential Guard (Windows 10) +description: Considerations and recommendations for certain scenarios when using Credential Guard in Windows 10. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Considerations when using Credential Guard + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + +- If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. +- You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: + - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. + - **Event ID 14** Credential Guard (LsaIso.exe) configuration: 0x1, 0 + - The first variable: 0x1 means Credential Guard is configured to run. 0x0 means it’s not configured to run. + - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. + - **Event ID 15** Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Credential Guard. + - **Event ID 16** Credential Guard (LsaIso.exe) failed to launch: \[error code\] + - **Event ID 17** Error reading Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] + You can also verify that TPM is being used for key protection by checking the following event in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. + - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. +- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business. +- Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN. +- As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running. + +- Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Credential Guard. Credential Manager allows you to store credentials, such as user names and passwords that you use to log on to websites or other computers on a network. The following considerations apply to the Credential Guard protections for Credential Manager: + - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. Attempts to use saved credentials will fail, displaying the error message "Logon attempt failed". + - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. + - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. + - Credential Guard uses hardware security so some features, such as Windows To Go, are not supported. + + +## NTLM and CHAP Considerations + +When you enable Credential Guard, you can no longer use NTLM v1 authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for WiFi and VPN connections. + +## Kerberos Considerations + +When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead. + +## See also + +Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. + +### Credentials Protected by Credential Guard + +[![Credentials Protected by Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) + + + +**Related videos in this series** + +[Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) diff --git a/windows/keep-secure/credential-guard-how-it-works.md b/windows/keep-secure/credential-guard-how-it-works.md new file mode 100644 index 0000000000..62b860bcb2 --- /dev/null +++ b/windows/keep-secure/credential-guard-how-it-works.md @@ -0,0 +1,48 @@ +--- +title: How Credential Guard works +description: Using virtualization-based security, Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# How Credential Guard works + +**Applies to** +- Windows 10 +- Windows Server 2016 + + +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + +Kerberos, NTLM, and Credential manager isolate secrets by using virtualization-based security. Previous versions of Windows stored secrets in the Local Security Authority (LSA). Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. + +For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. + +When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP cannot use the signed-in credentials. Thus, single sign-on does not work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault which are not protected by Credential Guard with any of these protocols. It is strongly recommended that valuable credentials, such as the sign-in credentials, not be used with any of these protocols. If these protocols must be used by domain or Azure AD users, secondary credentials should be provisioned for these use cases. + +When Credential Guard is enabled, Kerberos does not allow unconstrained Kerberos delegation or DES encryption, not only for signed-in credentials, but also prompted or saved credentials. + +Here's a high-level overview on how the LSA is isolated by using virtualization-based security: + +![Credential Guard overview](images/credguard.png) + +
+ +## See also + +Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. + +### Credential Guard Overview: Credential Theft and Lateral Traversal + +[![Credential theft and lateral traversal](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) + + +**Related videos in this series:** + +[Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) + +[Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) diff --git a/windows/keep-secure/credential-guard-manage.md b/windows/keep-secure/credential-guard-manage.md new file mode 100644 index 0000000000..88acb2d41a --- /dev/null +++ b/windows/keep-secure/credential-guard-manage.md @@ -0,0 +1,197 @@ +--- +title: Manage Credential Guard (Windows 10) +description: Deploying and managing Credential Guard using Group Policy, the registry, or the Device Guard and Credential Guard hardware readiness tool. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Manage Credential Guard + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + +## Enable Credential Guard +Credential Guard can be enabled by using [Group Policy](#turn-on-credential-guard-by-using-group-policy), the [registry](#turn-on-credential-guard-by-using-the-registry), or the Device Guard and Credential Guard [hardware readiness tool](#hardware-readiness-tool). + +### Enable Credential Guard by using Group Policy + +You can use Group Policy to enable Credential Guard. This will add and enable the virtualization-based security features for you if needed. + +1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. +2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. +3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. +4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Credential Guard remotely, choose **Enabled without lock**. + + ![Credential Guard Group Policy setting](images/credguard-gp.png) + +5. Close the Group Policy Management Console. + +To enforce processing of the group policy, you can run ```gpupdate /force```. + + +### Enable Credential Guard by using the registry + +If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. + +### Add the virtualization-based security features + +Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped. + +If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security. +You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). +> [!NOTE] +If you enable Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you. + +  +**Add the virtualization-based security features by using Programs and Features** + +1. Open the Programs and Features control panel. +2. Click **Turn Windows feature on or off**. +3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. +4. Select the **Isolated User Mode** check box at the top level of the feature selection. +5. Click **OK**. + +**Add the virtualization-based security features to an offline image by using DISM** + +1. Open an elevated command prompt. +2. Add the Hyper-V Hypervisor by running the following command: + ``` + dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all + ``` +3. Add the Isolated User Mode feature by running the following command: + ``` + dism /image: /Enable-Feature /FeatureName:IsolatedUserMode + ``` + +> [!NOTE] +> You can also add these features to an online image by using either DISM or Configuration Manager. + +### Enable virtualization-based security and Credential Guard + +1. Open Registry Editor. +2. Enable virtualization-based security: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. + - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. + - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. +3. Enable Credential Guard: + - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. + - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Credential Guard with UEFI lock, set it to 2 to enable Credential Guard without lock, and set it to 0 to disable it. +4. Close Registry Editor. + + +> [!NOTE] +> You can also enable Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. + + +### Enable Credential Guard by using the Device Guard and Credential Guard hardware readiness tool + +You can also enable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). + +``` +DG_Readiness_Tool_v3.0.ps1 -Enable -AutoReboot +``` + +### Credential Guard deployment in virtual machines + +Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The enablement steps are the same from within the virtual machine. + +Credential Guard protects secrets from non-privileged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: + +``` PowerShell +Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true +``` + +Requirements for running Credential Guard in Hyper-V virtual machines +- The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. +- The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and running at least Windows Server 2016 or Windows 10. + + +### Check that Credential Guard is running + +You can use System Information to ensure that Credential Guard is running on a PC. + +1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. +2. Click **System Summary**. +3. Confirm that **Credential Guard** is shown next to **Device Guard Security Services Running**. + + Here's an example: + + ![System Information](images/credguard-msinfo32.png) + +You can also check that Credential Guard is running by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). + +``` +DG_Readiness_Tool_v3.0.ps1 -Ready +``` + + +### Remove Credential Guard + +If you have to remove Credential Guard on a PC, you can use the following set of procedures, or you can [use the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). + +1. If you used Group Policy, disable the Group Policy setting that you used to enable Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). +2. Delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures + + > [!IMPORTANT] + > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. + +3. Delete the Credential Guard EFI variables by using bcdedit. + +**Delete the Credential Guard EFI variables** + +1. From an elevated command prompt, type the following commands: + ``` syntax + + mountvol X: /s + + copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y + + bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader + + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi" + + bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215} + + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO + + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: + + mountvol X: /d + + ``` +2. Restart the PC. +3. Accept the prompt to disable Credential Guard. +4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. + +> [!NOTE] +> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS + +For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). + + +#### Turn off Credential Guard by using the Device Guard and Credential Guard hardware readiness tool + +You can also disable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). + +``` +DG_Readiness_Tool_v3.0.ps1 -Disable -AutoReboot +``` +  +## See also + +Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. +
+ +### Deploying Credential Guard + +[![Deploying Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) \ No newline at end of file diff --git a/windows/keep-secure/credential-guard-not-protected-scenarios.md b/windows/keep-secure/credential-guard-not-protected-scenarios.md new file mode 100644 index 0000000000..f656c9038e --- /dev/null +++ b/windows/keep-secure/credential-guard-not-protected-scenarios.md @@ -0,0 +1,166 @@ +--- +title: Scenarios not protected by Credential Guard (Windows 10) +description: Scenarios not protected by Credential Guard in Windows 10. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Scenarios not protected by Credential Guard + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + +Some ways to store credentials are not protected by Credential Guard, including: + +- Software that manages credentials outside of Windows feature protection +- Local accounts and Microsoft Accounts +- Credential Guard does not protect the Active Directory database running on Windows Server 2016 domain controllers. It also does not protect credential input pipelines, such as Windows Server 2016 servers running Remote Desktop Gateway. If you're using a Windows Server 2016 server as a client PC, it will get the same protection as it would when running Windows 10 Enterprise. +- Key loggers +- Physical attacks +- Does not prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. +- Third-party security packages +- Digest and CredSSP credentials + - When Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. +- Supplied credentials for NTLM authentication are not protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. Note that these same credentials are vulnerable to key loggers as well. + +For further information, see video: [Credentials Protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) + +## Additional mitigations + +Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. + +### Restricting domain users to specific domain-joined devices + +Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. + +#### Kerberos armoring + +Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. + +**To enable Kerberos armoring for restricting domain users to specific domain-joined devices** + +- Users need to be in domains that are running Windows Server 2012 R2 or higher +- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. +- All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. + +#### Protecting domain-joined device secrets + +Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. + +Domain-joined device certificate authentication has the following requirements: +- Devices' accounts are in Windows Server 2012 domain functional level or higher. +- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements: + - KDC EKU present + - DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension +- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. +- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. + +#### Deploying domain-joined device certificates + +To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. + +For example, let's say you wanted to use the High Assurance policy only on these devices. Using a Windows Server Enterprise certificate authority, you would create a new template. + +**Creating a new certificate template** + +1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** +2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. +3. Right-click the new template, and then click **Properties**. +4. On the **Extensions** tab, click **Application Policies**, and then click **Edit**. +5. Click **Client Authentication**, and then click **Remove**. +6. Add the ID-PKInit-KPClientAuth EKU. Click **Add**, click **New**, and then specify the following values: + - Name: Kerberos Client Auth + - Object Identifier: 1.3.6.1.5.2.3.4 +7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. +8. Under **Issuance Policies**, click**High Assurance**. +9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. + +Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created. + +**Enrolling devices in a certificate** + +Run the following command: +``` syntax +CertReq -EnrollCredGuardCert MachineAuthentication +``` + +> [!NOTE] +> You must restart the device after enrolling the machine authentication certificate. +  +#### How a certificate issuance policy can be used for access control + +Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/en-us/library/dd378897(v=ws.10).aspx) on TechNet. + +**To see the issuance policies available** + +- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\get-IssuancePolicy.ps1 –LinkedToGroup:All + ``` + +**To link an issuance policy to a universal security group** + +- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" + ``` + +#### Restricting user sign on + +So we now have completed the following: + +- Created a special certificate issuance policy to identify devices that meet the deployment criteria required for the user to be able to sign on +- Mapped that policy to a universal security group or claim +- Provided a way for domain controllers to get the device authorization data during user sign on using Kerberos armoring. Now what is left to do is to configure the access check on the domain controllers. This is done using authentication policies. + +Authentication policies have the following requirements: +- User accounts are in a Windows Server 2012 domain functional level or higher domain. + +**Creating an authentication policy restricting users to the specific universal security group** + +1. Open Active Directory Administrative Center. +2. Click **Authentication**, click **New**, and then click **Authentication Policy**. +3. In the **Display name** box, enter a name for this authentication policy. +4. Under the **Accounts** heading, click **Add**. +5. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account you wish to restrict, and then click **OK**. +6. Under the **User Sign On** heading, click the **Edit** button. +7. Click **Add a condition**. +8. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**. +9. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the universal security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**. +10. Click **OK** to close the **Edit Access Control Conditions** box. +11. Click **OK** to create the authentication policy. +12. Close Active Directory Administrative Center. + +> [!NOTE] +> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. + +#### Discovering authentication failures due to authentication policies + +To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. + +To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/en-us/library/dn486813(v=ws.11).aspx). + +## See also + +Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. + +### Credentials protected by Credential Guard + +[![Credentials protected by Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) + + + +**Related videos in this series:** + +[Protecting privileged users with Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) diff --git a/windows/keep-secure/credential-guard-requirements.md b/windows/keep-secure/credential-guard-requirements.md new file mode 100644 index 0000000000..ee45ea20a9 --- /dev/null +++ b/windows/keep-secure/credential-guard-requirements.md @@ -0,0 +1,128 @@ +--- +title: Credential Guard Requirements (Windows 10) +description: Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Requirements + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + +For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). + + + +## Hardware and software requirements + +To provide basic protection against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Credential Manager uses: +- Support for Virtualization-based security (required) +- Secure boot (required) +- TPM 2.0 either discrete or firmware (preferred - provides binding to hardware) +- UEFI lock (preferred - prevents attacker from disabling with a simple registry key change) + +The Virtualization-based security requires: +- 64-bit CPU +- CPU virtualization extensions plus extended page tables +- Windows hypervisor + +## Application requirements + +When Credential Guard is enabled, specific authentication capabilities are blocked, so applications that require such capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. + +>[!WARNING] +> Enabling Credential Guard on domain controllers is not supported.
+> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled, causing crashes. + +>[!NOTE] +> Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). + +Applications will break if they require: +- Kerberos DES encryption support +- Kerberos unconstrained delegation +- Extracting the Kerberos TGT +- NTLMv1 + +Applications will prompt and expose credentials to risk if they require: +- Digest authentication +- Credential delegation +- MS-CHAPv2 + +Applications may cause performance issues when they attempt to hook the isolated Credential Guard process. + +See this video: [Credentials Protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) + + +## Security considerations + +All computers that meet baseline protections for hardware, firmware, and software can use Credential Guard. +Computers that meet additional qualifications can provide additional protections to further reduce the attack surface. +The following tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017. + +> [!NOTE] +> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
+> If you are an OEM, see [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
+ +### Baseline protections + +|Baseline Protections | Description | +|---------------------------------------------|----------------------------------------------------| +| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | +| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
• VT-x (Intel) or
• AMD-V
And:
• Extended page tables, also called Second Level Address Translation (SLAT).

**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | +| Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations)

**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | +| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)

**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | +| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).

**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.


**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. | + +> [!IMPORTANT] +> The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Credential Guard can provide. + +### 2015 Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016 Technical Preview 4 + +| Protections for Improved Security | Description | +|---------------------------------------------|----------------------------------------------------| +| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU

**Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• BIOS password or stronger authentication must be supported.
• In the BIOS configuration, BIOS authentication must be set.
• There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
• In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

**Security benefits**:
• BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
• Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | +| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation

**Security benefits**: A secure MOR bit prevents advanced memory attacks. For more information, see [Secure MOR implementation](https://msdn.microsoft.com/windows/hardware/drivers/bringup/device-guard-requirements). | + +
+ +### 2016 Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016 + +> [!IMPORTANT] +> The following tables list additional qualifications for improved security. Systems that meet these additional qualifications can provide more protections. + +| Protections for Improved Security | Description | +|---------------------------------------------|----------------------------------------------------| +| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
• The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).

**Security benefits**:
• Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
• HSTI provides additional security assurance for correctly secured silicon and platform. | +| Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.

**Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
• Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.

**Security benefits**:
• Enterprises can choose to allow proprietary EFI drivers/applications to run.
• Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | + +
+ +### 2017 Additional security qualifications starting with Windows 10, version 1703 + +The following table lists qualifications for Windows 10, version 1703, which are in addition to all preceding qualifications. + +| Protection for Improved Security | Description | +|---------------------------------------------|----------------------------------------------------| +| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and executable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code

**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | +| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | + +
+ +## See also + +Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. + + ### Credential Guard Deployment Requirements + +[![Credential Guard Deployment Requirements](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) \ No newline at end of file diff --git a/windows/keep-secure/credential-guard-scripts.md b/windows/keep-secure/credential-guard-scripts.md new file mode 100644 index 0000000000..1eca33e2e6 --- /dev/null +++ b/windows/keep-secure/credential-guard-scripts.md @@ -0,0 +1,488 @@ +--- +title: Scripts for Certificate Issuance Policies in Credential Guard (Windows 10) +description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Credential Guard on Windows 10. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Credential Guard: Scripts for Certificate Authority Issuance Policies + + +Here is a list of scripts mentioned in this topic. + +## Get the available issuance policies on the certificate authority + +Save this script file as get-IssuancePolicy.ps1. + +``` syntax +####################################### +## Parameters to be defined ## +## by the user ## +####################################### +Param ( +$Identity, +$LinkedToGroup +) +####################################### +## Strings definitions ## +####################################### +Data getIP_strings { +# culture="en-US" +ConvertFrom-StringData -stringdata @' +help1 = This command can be used to retrieve all available Issuance Policies in a forest. The forest of the currently logged on user is targeted. +help2 = Usage: +help3 = The following parameter is mandatory: +help4 = -LinkedToGroup: +help5 = "yes" will return only Issuance Policies that are linked to groups. Checks that the linked Issuance Policies are linked to valid groups. +help6 = "no" will return only Issuance Policies that are not currently linked to any group. +help7 = "all" will return all Issuance Policies defined in the forest. Checks that the linked Issuance policies are linked to valid groups. +help8 = The following parameter is optional: +help9 = -Identity:. If you specify an identity, the option specified in the "-LinkedToGroup" parameter is ignored. +help10 = Output: This script returns the Issuance Policy objects meeting the criteria defined by the above parameters. +help11 = Examples: +errorIPNotFound = Error: no Issuance Policy could be found with Identity "{0}" +ErrorNotSecurity = Error: Issuance Policy "{0}" is linked to group "{1}" which is not of type "Security". +ErrorNotUniversal = Error: Issuance Policy "{0}" is linked to group "{1}" whose scope is not "Universal". +ErrorHasMembers = Error: Issuance Policy "{0}" is linked to group "{1}" which has a non-empty membership. The group has the following members: +LinkedIPs = The following Issuance Policies are linked to groups: +displayName = displayName : {0} +Name = Name : {0} +dn = distinguishedName : {0} + InfoName = Linked Group Name: {0} + InfoDN = Linked Group DN: {0} +NonLinkedIPs = The following Issuance Policies are NOT linked to groups: +'@ +} +##Import-LocalizedData getIP_strings +import-module ActiveDirectory +####################################### +## Help ## +####################################### +function Display-Help { + "" + $getIP_strings.help1 + "" +$getIP_strings.help2 +"" +$getIP_strings.help3 +" " + $getIP_strings.help4 +" " + $getIP_strings.help5 + " " + $getIP_strings.help6 + " " + $getIP_strings.help7 +"" +$getIP_strings.help8 + " " + $getIP_strings.help9 + "" + $getIP_strings.help10 +"" +"" +$getIP_strings.help11 + " " + '$' + "myIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:All" + " " + '$' + "myLinkedIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:yes" + " " + '$' + "myIP = .\get-IssuancePolicy.ps1 -Identity:""Medium Assurance""" +"" +} +$root = get-adrootdse +$domain = get-addomain -current loggedonuser +$configNCDN = [String]$root.configurationNamingContext +if ( !($Identity) -and !($LinkedToGroup) ) { +display-Help +break +} +if ($Identity) { + $OIDs = get-adobject -Filter {(objectclass -eq "msPKI-Enterprise-Oid") -and ((name -eq $Identity) -or (displayname -eq $Identity) -or (distinguishedName -like $Identity)) } -searchBase $configNCDN -properties * + if ($OIDs -eq $null) { +$errormsg = $getIP_strings.ErrorIPNotFound -f $Identity +write-host $errormsg -ForegroundColor Red + } + foreach ($OID in $OIDs) { + if ($OID."msDS-OIDToGroupLink") { +# In case the Issuance Policy is linked to a group, it is good to check whether there is any problem with the mapping. + $groupDN = $OID."msDS-OIDToGroupLink" + $group = get-adgroup -Identity $groupDN + $groupName = $group.Name +# Analyze the group + if ($group.groupCategory -ne "Security") { +$errormsg = $getIP_strings.ErrorNotSecurity -f $Identity, $groupName + write-host $errormsg -ForegroundColor Red + } + if ($group.groupScope -ne "Universal") { + $errormsg = $getIP_strings.ErrorNotUniversal -f $Identity, $groupName +write-host $errormsg -ForegroundColor Red + } + $members = Get-ADGroupMember -Identity $group + if ($members) { + $errormsg = $getIP_strings.ErrorHasMembers -f $Identity, $groupName +write-host $errormsg -ForegroundColor Red + foreach ($member in $members) { + write-host " " $member -ForeGroundColor Red + } + } + } + } + return $OIDs + break +} +if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) { + $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(msDS-OIDToGroupLink=*)(flags=2))" + $LinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * + write-host "" + write-host "*****************************************************" + write-host $getIP_strings.LinkedIPs + write-host "*****************************************************" + write-host "" + if ($LinkedOIDs -ne $null){ + foreach ($OID in $LinkedOIDs) { +# Display basic information about the Issuance Policies + "" + $getIP_strings.displayName -f $OID.displayName + $getIP_strings.Name -f $OID.Name + $getIP_strings.dn -f $OID.distinguishedName +# Get the linked group. + $groupDN = $OID."msDS-OIDToGroupLink" + $group = get-adgroup -Identity $groupDN + $getIP_strings.InfoName -f $group.Name + $getIP_strings.InfoDN -f $groupDN +# Analyze the group + $OIDName = $OID.displayName + $groupName = $group.Name + if ($group.groupCategory -ne "Security") { + $errormsg = $getIP_strings.ErrorNotSecurity -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + } + if ($group.groupScope -ne "Universal") { + $errormsg = $getIP_strings.ErrorNotUniversal -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + } + $members = Get-ADGroupMember -Identity $group + if ($members) { + $errormsg = $getIP_strings.ErrorHasMembers -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + foreach ($member in $members) { + write-host " " $member -ForeGroundColor Red + } + } + write-host "" + } + }else{ +write-host "There are no issuance policies that are mapped to a group" + } + if ($LinkedToGroup -eq "yes") { + return $LinkedOIDs + break + } +} +if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) { + $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(!(msDS-OIDToGroupLink=*))(flags=2))" + $NonLinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * + write-host "" + write-host "*********************************************************" + write-host $getIP_strings.NonLinkedIPs + write-host "*********************************************************" + write-host "" + if ($NonLinkedOIDs -ne $null) { + foreach ($OID in $NonLinkedOIDs) { +# Display basic information about the Issuance Policies +write-host "" +$getIP_strings.displayName -f $OID.displayName +$getIP_strings.Name -f $OID.Name +$getIP_strings.dn -f $OID.distinguishedName +write-host "" + } + }else{ +write-host "There are no issuance policies which are not mapped to groups" + } + if ($LinkedToGroup -eq "no") { + return $NonLinkedOIDs + break + } +} +``` +> [!NOTE] +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. +  +### Link an issuance policy to a group + +Save the script file as set-IssuancePolicyToGroupLink.ps1. + +``` syntax +####################################### +## Parameters to be defined ## +## by the user ## +####################################### +Param ( +$IssuancePolicyName, +$groupOU, +$groupName +) +####################################### +## Strings definitions ## +####################################### +Data ErrorMsg { +# culture="en-US" +ConvertFrom-StringData -stringdata @' +help1 = This command can be used to set the link between a certificate issuance policy and a universal security group. +help2 = Usage: +help3 = The following parameters are required: +help4 = -IssuancePolicyName: +help5 = -groupName:. If no name is specified, any existing link to a group is removed from the Issuance Policy. +help6 = The following parameter is optional: +help7 = -groupOU:. If this parameter is not specified, the group is looked for or created in the Users container. +help8 = Examples: +help9 = This command will link the issuance policy whose display name is "High Assurance" to the group "HighAssuranceGroup" in the Organizational Unit "OU_FOR_IPol_linked_groups". If the group or the Organizational Unit do not exist, you will be prompted to create them. +help10 = This command will unlink the issuance policy whose name is "402.164959C40F4A5C12C6302E31D5476062" from any group. +MultipleIPs = Error: Multiple Issuance Policies with name or display name "{0}" were found in the subtree of "{1}" +NoIP = Error: no issuance policy with name or display name "{0}" could be found in the subtree of "{1}". +IPFound = An Issuance Policy with name or display name "{0}" was successfully found: {1} +MultipleOUs = Error: more than 1 Organizational Unit with name "{0}" could be found in the subtree of "{1}". +confirmOUcreation = Warning: The Organizational Unit that you specified does not exist. Do you want to create it? +OUCreationSuccess = Organizational Unit "{0}" successfully created. +OUcreationError = Error: Organizational Unit "{0}" could not be created. +OUFoundSuccess = Organizational Unit "{0}" was successfully found. +multipleGroups = Error: More than one group with name "{0}" was found in Organizational Unit "{1}". +confirmGroupCreation = Warning: The group that you specified does not exist. Do you want to create it? +groupCreationSuccess = Univeral Security group "{0}" successfully created. +groupCreationError = Error: Univeral Security group "{0}" could not be created. +GroupFound = Group "{0}" was successfully found. +confirmLinkDeletion = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to remove the link? +UnlinkSuccess = Certificate issuance policy successfully unlinked from any group. +UnlinkError = Removing the link failed. +UnlinkExit = Exiting without removing the link from the issuance policy to the group. +IPNotLinked = The Certificate issuance policy is not currently linked to any group. If you want to link it to a group, you should specify the -groupName option when starting this script. +ErrorNotSecurity = Error: You cannot link issuance Policy "{0}" to group "{1}" because this group is not of type "Security". +ErrorNotUniversal = Error: You cannot link issuance Policy "{0}" to group "{1}" because the scope of this group is not "Universal". +ErrorHasMembers = Error: You cannot link issuance Policy "{0}" to group "{1}" because it has a non-empty membership. The group has the following members: +ConfirmLinkReplacement = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to update the link to point to group "{2}"? +LinkSuccess = The certificate issuance policy was successfully linked to the specified group. +LinkError = The certificate issuance policy could not be linked to the specified group. +ExitNoLinkReplacement = Exiting without setting the new link. +'@ +} +# import-localizeddata ErrorMsg +function Display-Help { +"" +write-host $ErrorMsg.help1 +"" +write-host $ErrorMsg.help2 +"" +write-host $ErrorMsg.help3 +write-host "`t" $ErrorMsg.help4 +write-host "`t" $ErrorMsg.help5 +"" +write-host $ErrorMsg.help6 +write-host "`t" $ErrorMsg.help7 +"" +"" +write-host $ErrorMsg.help8 +"" +write-host $ErrorMsg.help9 +".\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName ""High Assurance"" -groupOU ""OU_FOR_IPol_linked_groups"" -groupName ""HighAssuranceGroup"" " +"" +write-host $ErrorMsg.help10 +'.\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName "402.164959C40F4A5C12C6302E31D5476062" -groupName $null ' +"" +} +# Assumption: The group to which the Issuance Policy is going +# to be linked is (or is going to be created) in +# the domain the user running this script is a member of. +import-module ActiveDirectory +$root = get-adrootdse +$domain = get-addomain -current loggedonuser +if ( !($IssuancePolicyName) ) { +display-Help +break +} +####################################### +## Find the OID object ## +## (aka Issuance Policy) ## +####################################### +$searchBase = [String]$root.configurationnamingcontext +$OID = get-adobject -searchBase $searchBase -Filter { ((displayname -eq $IssuancePolicyName) -or (name -eq $IssuancePolicyName)) -and (objectClass -eq "msPKI-Enterprise-Oid")} -properties * +if ($OID -eq $null) { +$tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +elseif ($OID.GetType().IsArray) { +$tmp = $ErrorMsg.MultipleIPs -f $IssuancePolicyName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +else { +$tmp = $ErrorMsg.IPFound -f $IssuancePolicyName, $OID.distinguishedName +write-host $tmp -ForeGroundColor Green +} +####################################### +## Find the container of the group ## +####################################### +if ($groupOU -eq $null) { +# default to the Users container +$groupContainer = $domain.UsersContainer +} +else { +$searchBase = [string]$domain.DistinguishedName +$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} +if ($groupContainer.count -gt 1) { +$tmp = $ErrorMsg.MultipleOUs -f $groupOU, $searchBase +write-host $tmp -ForegroundColor Red +break; +} +elseif ($groupContainer -eq $null) { +$tmp = $ErrorMsg.confirmOUcreation +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +new-adobject -Name $groupOU -displayName $groupOU -Type "organizationalUnit" -ProtectedFromAccidentalDeletion $true -path $domain.distinguishedName +if ($?){ +$tmp = $ErrorMsg.OUCreationSuccess -f $groupOU +write-host $tmp -ForegroundColor Green +} +else{ +$tmp = $ErrorMsg.OUCreationError -f $groupOU +write-host $tmp -ForeGroundColor Red +break; +} +$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} +} +else { +break; +} +} +else { +$tmp = $ErrorMsg.OUFoundSuccess -f $groupContainer.name +write-host $tmp -ForegroundColor Green +} +} +####################################### +## Find the group ## +####################################### +if (($groupName -ne $null) -and ($groupName -ne "")){ +##$searchBase = [String]$groupContainer.DistinguishedName +$searchBase = $groupContainer +$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase +if ($group -ne $null -and $group.gettype().isarray) { +$tmp = $ErrorMsg.multipleGroups -f $groupName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +elseif ($group -eq $null) { +$tmp = $ErrorMsg.confirmGroupCreation +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +new-adgroup -samAccountName $groupName -path $groupContainer.distinguishedName -GroupScope "Universal" -GroupCategory "Security" +if ($?){ +$tmp = $ErrorMsg.GroupCreationSuccess -f $groupName +write-host $tmp -ForegroundColor Green +}else{ +$tmp = $ErrorMsg.groupCreationError -f $groupName +write-host $tmp -ForeGroundColor Red +break +} +$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase +} +else { +break; +} +} +else { +$tmp = $ErrorMsg.GroupFound -f $group.Name +write-host $tmp -ForegroundColor Green +} +} +else { +##### +## If the group is not specified, we should remove the link if any exists +##### +if ($OID."msDS-OIDToGroupLink" -ne $null) { +$tmp = $ErrorMsg.confirmLinkDeletion -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink" +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +set-adobject -Identity $OID -Clear "msDS-OIDToGroupLink" +if ($?) { +$tmp = $ErrorMsg.UnlinkSuccess +write-host $tmp -ForeGroundColor Green +}else{ +$tmp = $ErrorMsg.UnlinkError +write-host $tmp -ForeGroundColor Red +} +} +else { +$tmp = $ErrorMsg.UnlinkExit +write-host $tmp +break +} +} +else { +$tmp = $ErrorMsg.IPNotLinked +write-host $tmp -ForeGroundColor Yellow +} +break; +} +####################################### +## Verify that the group is ## +## Universal, Security, and ## +## has no members ## +####################################### +if ($group.GroupScope -ne "Universal") { +$tmp = $ErrorMsg.ErrorNotUniversal -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +break; +} +if ($group.GroupCategory -ne "Security") { +$tmp = $ErrorMsg.ErrorNotSecurity -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +break; +} +$members = Get-ADGroupMember -Identity $group +if ($members -ne $null) { +$tmp = $ErrorMsg.ErrorHasMembers -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +foreach ($member in $members) {write-host " $member.name" -ForeGroundColor Red} +break; +} +####################################### +## We have verified everything. We ## +## can create the link from the ## +## Issuance Policy to the group. ## +####################################### +if ($OID."msDS-OIDToGroupLink" -ne $null) { +$tmp = $ErrorMsg.ConfirmLinkReplacement -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink", $group.distinguishedName +write-host $tmp "( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} +set-adobject -Identity $OID -Replace $tmp +if ($?) { +$tmp = $Errormsg.LinkSuccess +write-host $tmp -Foreground Green +}else{ +$tmp = $ErrorMsg.LinkError +write-host $tmp -Foreground Red +} +} else { +$tmp = $Errormsg.ExitNoLinkReplacement +write-host $tmp +break +} +} +else { +$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} +set-adobject -Identity $OID -Add $tmp +if ($?) { +$tmp = $Errormsg.LinkSuccess +write-host $tmp -Foreground Green +}else{ +$tmp = $ErrorMsg.LinkError +write-host $tmp -Foreground Red +} +} +``` + +> [!NOTE] +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. \ No newline at end of file diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index f36732aa45..d0fba3ca1d 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -16,6 +16,8 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 +Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. + Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials. By enabling Credential Guard, the following features and solutions are provided: @@ -24,928 +26,6 @@ By enabling Credential Guard, the following features and solutions are provided: - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. - **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. -## How it works - -Kerberos, NTLM, and Credential manager isolate secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. - -For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. - -When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP cannot use the signed-in credentials. Thus, single sign-on does not work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault which are not protected by Credential Guard with any of these protocol. It is strongly recommended that valuable credentials, such as the sign-in credentials, not be used with any of these protocols. If these protocols must be used by domain or Azure AD users, secondary credentials should be provisioned for these use cases. - -When Credential Guard is enabled, Kerberos does not allow unconstrained Kerberos delegation or DES encryption, not only for signed-in credentials, but also prompted or saved credentials. - -Here's a high-level overview on how the LSA is isolated by using virtualization-based security: - -![Credential Guard overview](images/credguard.png) - -## Requirements - -For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally Credential Guard blocks specific authentication capabilities, so applications which require blocked capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protection—those computers will be more hardened against certain threats. To keep this section brief, those will be in [Security Considerations](#security-considerations). - -### Hardware and software requirements - -To provide basic protection against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Credential Manager uses: -- Support for Virtualization-based security (required) -- Secure boot (required) -- TPM 2.0 either discrete or firmware (preferred - provides binding to hardware) -- UEFI lock (preferred - prevents attacker from disabling with a simple registry key change) - -The Virtualization-based security requires: -- 64 bit CPU -- CPU virtualization extensions plus extended page tables -- Windows hypervisor - -### Application requirements - -When Credential Guard is enabled, specific authentication capabilities are blocked, so applications which require blocked capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. - ->[!WARNING] -> Enabling Credential Guard on domain controllers is not supported.
-> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled, causing crashes. - ->[!NOTE] -> Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). - -Applications will break if they require: -- Kerberos DES encryption support -- Kerberos unconstrained delegation -- Extracting the Kerberos TGT -- NTLMv1 - -Applications will prompt & expose credentials to risk if they require: -- Digest authentication -- Credential delegation -- MS-CHAPv2 - -Applications may cause performance issues when they attempt to hook the isolated Credential Guard process. - -### Security considerations - -All computers that meet baseline protections for hardware, firmware, and software can use Credential Guard. -Computers that meet additional qualifications can provide additional protections to further reduce the attack surface. -The following tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017. - -> [!NOTE] -> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
-> If you are an OEM, see [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
- -#### Baseline protections - -|Baseline Protections | Description | -|---------------------------------------------|----------------------------------------------------| -| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | -| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
• VT-x (Intel) or
• AMD-V
And:
• Extended page tables, also called Second Level Address Translation (SLAT).

**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | -| Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations)

**Security benefits**: A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | -| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)

**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | -| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).

**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.


**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. | - -> [!IMPORTANT] -> The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Credential Guard can provide. - -#### 2015 Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016 Technical Preview 4 - -| Protections for Improved Security | Description | -|---------------------------------------------|----------------------------------------------------| -| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU

**Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• BIOS password or stronger authentication must be supported.
• In the BIOS configuration, BIOS authentication must be set.
• There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
• In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

**Security benefits**:
• BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
• Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | -| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation

**Security benefits**: A secure MOR bit prevents advanced memory attacks. For more information, see [Secure MOR implementation](https://msdn.microsoft.com/windows/hardware/drivers/bringup/device-guard-requirements). | - -
- -#### 2016 Additional security qualifications starting with Windows 10, version 1607, and Windows Server 2016 - -> [!IMPORTANT] -> The following tables list additional qualifications for improved security. Systems that meet these additional qualifications can provide more protections. - -| Protections for Improved Security | Description | -|---------------------------------------------|----------------------------------------------------| -| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
• The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).

**Security benefits**:
• Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
• HSTI provides additional security assurance for correctly secured silicon and platform. | -| Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.

**Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
• Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
• Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.

**Security benefits**:
• Enterprises can choose to allow proprietary EFI drivers/applications to run.
• Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | - -
- -#### 2017 Additional security qualifications starting in 2017 - -The following table lists qualifications for 2017, which are in addition to all preceding qualifications. - -| Protection for Improved Security | Description | -|---------------------------------------------|----------------------------------------------------| -| Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be exceutable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volitile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both exceutable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and exceutable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code

**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | -| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | - -## Manage Credential Guard - -### Enable Credential Guard -Credential Guard can be enabled by using [Group Policy](#turn-on-credential-guard-by-using-group-policy), the [registry](#turn-on-credential-guard-by-using-the-registry), or the Device Guard and Credential Guard [hardware readiness tool](#hardware-readiness-tool). - -#### Turn on Credential Guard by using Group Policy - -You can use Group Policy to enable Credential Guard. This will add and enable the virtualization-based security features for you if needed. - -1. From the Group Policy Management Console, go to **Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard**. -2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option. -3. **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**. -4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Credential Guard remotely, choose **Enabled without lock**. - - ![Credential Guard Group Policy setting](images/credguard-gp.png) - -5. Close the Group Policy Management Console. - -To enforce processing of the group policy, you can run ```gpupdate /force```. - -#### Turn on Credential Guard by using the registry - -If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. - -#### Add the virtualization-based security features - -Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped. - -If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security. -You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). -> [!NOTE] -> If you enable Credential Guard by using Group Policy, these steps are not required. Group Policy will install the features for you. - -  -**Add the virtualization-based security features by using Programs and Features** - -1. Open the Programs and Features control panel. -2. Click **Turn Windows feature on or off**. -3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. -4. Select the **Isolated User Mode** check box at the top level of the feature selection. -5. Click **OK**. - -**Add the virtualization-based security features to an offline image by using DISM** - -1. Open an elevated command prompt. -2. Add the Hyper-V Hypervisor by running the following command: - ``` - dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all - ``` -3. Add the Isolated User Mode feature by running the following command: - ``` - dism /image: /Enable-Feature /FeatureName:IsolatedUserMode - ``` - -> [!NOTE] -> You can also add these features to an online image by using either DISM or Configuration Manager. - -#### Enable virtualization-based security and Credential Guard - -1. Open Registry Editor. -2. Enable virtualization-based security: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. - - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. - - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. -3. Enable Credential Guard: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. - - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Credential Guard with UEFI lock, set it to 2 to enable Credential Guard without lock, and set it to 0 to disable it. -4. Close Registry Editor. - - -> [!NOTE] -> You can also turn on Credential Guard by setting the registry entries in the [FirstLogonCommands](http://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. - - -#### Turn on Credential Guard by using the Device Guard and Credential Guard hardware readiness tool - -You can also enable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). - -``` -DG_Readiness_Tool_v3.0.ps1 -Enable -AutoReboot -``` - -#### Credential Guard deployment in virtual machines - -Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The enablement steps are the same from within the virtual machine. - -Credential Guard protects secrets from non-priviledged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: - -``` PowerShell -Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true -``` - -Requirements for running Credential Guard in Hyper-V virtual machines -- The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. -- The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and running at least Windows Server 2016 or Windows 10. - -### Remove Credential Guard - -If you have to remove Credential Guard on a PC, you can use the following set of procedures, or you can [use the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). - -1. If you used Group Policy, disable the Group Policy setting that you used to enable Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). -2. Delete the following registry settings: - - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags - - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures - - > [!IMPORTANT] - > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. - -3. Delete the Credential Guard EFI variables by using bcdedit. - -**Delete the Credential Guard EFI variables** - -1. From an elevated command prompt, type the following commands: - ``` syntax - - mountvol X: /s - - copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y - - bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader - - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi" - - bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215} - - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO - - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: - - mountvol X: /d - - ``` -2. Restart the PC. -3. Accept the prompt to disable Credential Guard. -4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. - -> [!NOTE] -> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS - -For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). - - -#### Turn off Credential Guard by using the Device Guard and Credential Guard hardware readiness tool - -You can also disable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). - -``` -DG_Readiness_Tool_v3.0.ps1 -Disable -AutoReboot -``` -  -### Check that Credential Guard is running - -You can use System Information to ensure that Credential Guard is running on a PC. - -1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. -2. Click **System Summary**. -3. Confirm that **Credential Guard** is shown next to **Device Guard Security Services Running**. - - Here's an example: - - ![System Information](images/credguard-msinfo32.png) - -You can also check that Credential Guard is running by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). - -``` -DG_Readiness_Tool_v3.0.ps1 -Ready -``` - -## Considerations when using Credential Guard - -- If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. -- You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Credential Guard is configured to run. 0x0 means it’s not configured to run. - - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - - **Event ID 15** Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Credential Guard. - - **Event ID 16** Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking the following event in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. -- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business. -- Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN. -- As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malwar efrom taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running. - -- Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Credential Guard. Credential Manager allows you to store credentials, such as user names and passwords that you use to log on to websites or other computers on a network. The following considerations apply to the Credential Guard protections for Credential Manager: - - Credentials saved by Remote Desktop Services cannot be used to remotely connect to another machine without supplying the password. Attempts to use saved credentials will fail, displaying the error message "Logon attempt failed". - - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - - Credential Guard uses hardware security so some features, such as Windows To Go, are not supported. - -### NTLM & CHAP Considerations - -When you enable Credential Guard, you can no longer use NTLM v1 authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as NTLMv1. We recommend that organizations use certificated-based authentication for WiFi and VPN connections. - -### Kerberos Considerations - -When you enable Credential Guard, you can no longer use Kerberos unconstrained delegation or DES encryption. Unconstrained delegation could allow attackers to extract Kerberos keys from the isolated LSA process. You must use constrained or resource-based Kerberos delegation instead. - -## Scenarios not protected by Credential Guard - -Some ways to store credentials are not protected by Credential Guard, including: - -- Software that manages credentials outside of Windows feature protection -- Local accounts and Microsoft Accounts -- Credential Guard does not protect the Active Directory database running on Windows Server 2016 domain controllers. It also does not protect credential input pipelines, such as Windows Server 2016 servers running Remote Desktop Gateway. If you're using a Windows Server 2016 server as a client PC, it will get the same protection as it would be running Windows 10 Enterprise. -- Key loggers -- Physical attacks -- Does not prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access high value assets in your organization. -- Third-party security packages -- Digest and CredSSP credentials - - When Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. -- Supplied credentials for NTLM authentication are not protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. Note that these same credentials are vulnerable to key loggers as well. - -## Additional mitigations - -Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also need to be deployed to make the domain environment more robust. - -### Restricting domain users to specific domain-joined devices - -Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on with devices with Credential Guard? By deploying authentication policies which restrict them to specific domain-joined device that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. - -#### Kerberos armoring - -Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. - -**To enable Kerberos armoring for restricting domain users to specific domain-joined devices** - -- Users need to be in domains which are running Windows Server 2012 R2 or higher -- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. -- All the devices with Credential Guard which the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. - -#### Protecting domain-joined device secrets - -Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices which authenticate using those certificates. This prevents shared secrets on stolen from the device to be used with stolen user credentials to sign on as the user. - -Domain-joined device certificate authentication has the following requirements: -- Devices' accounts are in Windows Server 2012 domain funcational level or higher domains. -- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements: - - KDC EKU present - - DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension -- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. -- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. - -##### Deploying domain-joined device certificates - -To guarantee that certificates with the issuance policy required are only on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. - -For example, let's say you wanted to use the High Assurance policy only on these devices. Using a Windows Server Enterprise certificate authority, you would create a new template. - -**Creating a new certificate template** - -1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** -2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. -3. Right-click the new template, and then click **Properties**. -4. On the **Extensions** tab, click **Application Policies**, and then click **Edit**. -5. Click **Client Authentication**, and then click **Remove**. -6. Add the ID-PKInit-KPClientAuth EKU. Click **Add**, click **New**, and then specify the following values: - - Name: Kerberos Client Auth - - Object Identifier: 1.3.6.1.5.2.3.4 -7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. -8. Under **Issuance Policies**, click**High Assurance**. -9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. - -Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created. - -**Enrolling devices in a certificate** - -Run the following command: -``` syntax -CertReq -EnrollCredGuardCert MachineAuthentication -``` - -> [!NOTE] -> You must restart the device after enrolling the machine authentication certificate. -  -#### How a certificate issuance policy can be used for access control - -Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/en-us/library/dd378897(v=ws.10).aspx) on TechNet. - -**To see the issuance policies available** - -- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. - From a Windows PowerShell command prompt, run the following command: - - ``` syntax - .\get-IssuancePolicy.ps1 –LinkedToGroup:All - ``` - -**To link a issuance policy to a universal security group** - -- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. - From a Windows PowerShell command prompt, run the following command: - - ``` syntax - .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" - ``` - -#### Restricting user sign on - -So we now have the following: - -- Created a special certificate issuance policy to identify devices which meet the deployment criteria required for the user to be able to sign on -- Mapped that policy to a universal security group or claim -- Provided a way for domain controllers to get the device authorization data during user sign on using Kerberos armoring- -so what is left to do is configuring the access check on the domain controllers. This is done with authentication policies. - -Authentication policies have the following requirements: -- User accounts are in a Windows Server 2012 domain functional level or higher domain. - -**Creating an authentication policy restricting to the specific universal security group** - -1. Open Active Directory Administrative Center. -2. Click **Authentication**, click **New**, and then click **Authentication Policy**. -3. In the **Display name** box, enter a name for this authentication policy. -4. Under the **Accounts** heading, click **Add**. -5. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account you with to restrict, and then click **OK**. -6. Under the **User Sign On** heading, click the **Edit** button. -7. Click **Add a condition**. -8. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**. -9. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the universal security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**. -10. Click **OK** to close the **Edit Access Control Conditions** box. -11. Click **OK** to create the authentication policy. -12. Close Active Directory Administrative Center. - -> [!NOTE] -> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. - -#### Discovering authentication failures due to authentication policies - -To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. - -To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/en-us/library/dn486813(v=ws.11).aspx). - -## Appendix: Scripts - -Here is a list of scripts that are mentioned in this topic. - -### Get the available issuance policies on the certificate authority - -Save this script file as get-IssuancePolicy.ps1. - -``` syntax -####################################### -## Parameters to be defined ## -## by the user ## -####################################### -Param ( -$Identity, -$LinkedToGroup -) -####################################### -## Strings definitions ## -####################################### -Data getIP_strings { -# culture="en-US" -ConvertFrom-StringData -stringdata @' -help1 = This command can be used to retrieve all available Issuance Policies in a forest. The forest of the currently logged on user is targetted. -help2 = Usage: -help3 = The following parameter is mandatory: -help4 = -LinkedToGroup: -help5 = "yes" will return only Issuance Policies that are linked to groups. Checks that the linked Issuance Policies are linked to valid groups. -help6 = "no" will return only Issuance Policies that are not currently linked to any group. -help7 = "all" will return all Issuance Policies defined in the forest. Checks that the linked Issuance policies are linked to valid groups. -help8 = The following parameter is optional: -help9 = -Identity:. If you specify an identity, the option specified in the "-LinkedToGroup" parameter is ignored. -help10 = Output: This script returns the Issuance Policy objects meeting the criteria defined by the above parameters. -help11 = Examples: -errorIPNotFound = Error: no Issuance Policy could be found with Identity "{0}" -ErrorNotSecurity = Error: Issuance Policy "{0}" is linked to group "{1}" which is not of type "Security". -ErrorNotUniversal = Error: Issuance Policy "{0}" is linked to group "{1}" whose scope is not "Universal". -ErrorHasMembers = Error: Issuance Policy "{0}" is linked to group "{1}" which has a non-empty membership. The group has the following members: -LinkedIPs = The following Issuance Policies are linked to groups: -displayName = displayName : {0} -Name = Name : {0} -dn = distinguishedName : {0} - InfoName = Linked Group Name: {0} - InfoDN = Linked Group DN: {0} -NonLinkedIPs = The following Issuance Policies are NOT linked to groups: -'@ -} -##Import-LocalizedData getIP_strings -import-module ActiveDirectory -####################################### -## Help ## -####################################### -function Display-Help { - "" - $getIP_strings.help1 - "" -$getIP_strings.help2 -"" -$getIP_strings.help3 -" " + $getIP_strings.help4 -" " + $getIP_strings.help5 - " " + $getIP_strings.help6 - " " + $getIP_strings.help7 -"" -$getIP_strings.help8 - " " + $getIP_strings.help9 - "" - $getIP_strings.help10 -"" -"" -$getIP_strings.help11 - " " + '$' + "myIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:All" - " " + '$' + "myLinkedIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:yes" - " " + '$' + "myIP = .\get-IssuancePolicy.ps1 -Identity:""Medium Assurance""" -"" -} -$root = get-adrootdse -$domain = get-addomain -current loggedonuser -$configNCDN = [String]$root.configurationNamingContext -if ( !($Identity) -and !($LinkedToGroup) ) { -display-Help -break -} -if ($Identity) { - $OIDs = get-adobject -Filter {(objectclass -eq "msPKI-Enterprise-Oid") -and ((name -eq $Identity) -or (displayname -eq $Identity) -or (distinguishedName -like $Identity)) } -searchBase $configNCDN -properties * - if ($OIDs -eq $null) { -$errormsg = $getIP_strings.ErrorIPNotFound -f $Identity -write-host $errormsg -ForegroundColor Red - } - foreach ($OID in $OIDs) { - if ($OID."msDS-OIDToGroupLink") { -# In case the Issuance Policy is linked to a group, it is good to check whether there is any problem with the mapping. - $groupDN = $OID."msDS-OIDToGroupLink" - $group = get-adgroup -Identity $groupDN - $groupName = $group.Name -# Analyze the group - if ($group.groupCategory -ne "Security") { -$errormsg = $getIP_strings.ErrorNotSecurity -f $Identity, $groupName - write-host $errormsg -ForegroundColor Red - } - if ($group.groupScope -ne "Universal") { - $errormsg = $getIP_strings.ErrorNotUniversal -f $Identity, $groupName -write-host $errormsg -ForegroundColor Red - } - $members = Get-ADGroupMember -Identity $group - if ($members) { - $errormsg = $getIP_strings.ErrorHasMembers -f $Identity, $groupName -write-host $errormsg -ForegroundColor Red - foreach ($member in $members) { - write-host " " $member -ForeGroundColor Red - } - } - } - } - return $OIDs - break -} -if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) { - $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(msDS-OIDToGroupLink=*)(flags=2))" - $LinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * - write-host "" - write-host "*****************************************************" - write-host $getIP_strings.LinkedIPs - write-host "*****************************************************" - write-host "" - if ($LinkedOIDs -ne $null){ - foreach ($OID in $LinkedOIDs) { -# Display basic information about the Issuance Policies - "" - $getIP_strings.displayName -f $OID.displayName - $getIP_strings.Name -f $OID.Name - $getIP_strings.dn -f $OID.distinguishedName -# Get the linked group. - $groupDN = $OID."msDS-OIDToGroupLink" - $group = get-adgroup -Identity $groupDN - $getIP_strings.InfoName -f $group.Name - $getIP_strings.InfoDN -f $groupDN -# Analyze the group - $OIDName = $OID.displayName - $groupName = $group.Name - if ($group.groupCategory -ne "Security") { - $errormsg = $getIP_strings.ErrorNotSecurity -f $OIDName, $groupName - write-host $errormsg -ForegroundColor Red - } - if ($group.groupScope -ne "Universal") { - $errormsg = $getIP_strings.ErrorNotUniversal -f $OIDName, $groupName - write-host $errormsg -ForegroundColor Red - } - $members = Get-ADGroupMember -Identity $group - if ($members) { - $errormsg = $getIP_strings.ErrorHasMembers -f $OIDName, $groupName - write-host $errormsg -ForegroundColor Red - foreach ($member in $members) { - write-host " " $member -ForeGroundColor Red - } - } - write-host "" - } - }else{ -write-host "There are no issuance policies that are mapped to a group" - } - if ($LinkedToGroup -eq "yes") { - return $LinkedOIDs - break - } -} -if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) { - $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(!(msDS-OIDToGroupLink=*))(flags=2))" - $NonLinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * - write-host "" - write-host "*********************************************************" - write-host $getIP_strings.NonLinkedIPs - write-host "*********************************************************" - write-host "" - if ($NonLinkedOIDs -ne $null) { - foreach ($OID in $NonLinkedOIDs) { -# Display basic information about the Issuance Policies -write-host "" -$getIP_strings.displayName -f $OID.displayName -$getIP_strings.Name -f $OID.Name -$getIP_strings.dn -f $OID.distinguishedName -write-host "" - } - }else{ -write-host "There are no issuance policies which are not mapped to groups" - } - if ($LinkedToGroup -eq "no") { - return $NonLinkedOIDs - break - } -} -``` -> [!NOTE] -> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. -  -### Link an issuance policy to a group - -Save the script file as set-IssuancePolicyToGroupLink.ps1. - -``` syntax -####################################### -## Parameters to be defined ## -## by the user ## -####################################### -Param ( -$IssuancePolicyName, -$groupOU, -$groupName -) -####################################### -## Strings definitions ## -####################################### -Data ErrorMsg { -# culture="en-US" -ConvertFrom-StringData -stringdata @' -help1 = This command can be used to set the link between a certificate issuance policy and a universal security group. -help2 = Usage: -help3 = The following parameters are required: -help4 = -IssuancePolicyName: -help5 = -groupName:. If no name is specified, any existing link to a group is removed from the Issuance Policy. -help6 = The following parameter is optional: -help7 = -groupOU:. If this parameter is not specified, the group is looked for or created in the Users container. -help8 = Examples: -help9 = This command will link the issuance policy whose display name is "High Assurance" to the group "HighAssuranceGroup" in the Organizational Unit "OU_FOR_IPol_linked_groups". If the group or the Organizational Unit do not exist, you will be prompted to create them. -help10 = This command will unlink the issuance policy whose name is "402.164959C40F4A5C12C6302E31D5476062" from any group. -MultipleIPs = Error: Multiple Issuance Policies with name or display name "{0}" were found in the subtree of "{1}" -NoIP = Error: no issuance policy with name or display name "{0}" could be found in the subtree of "{1}". -IPFound = An Issuance Policy with name or display name "{0}" was successfully found: {1} -MultipleOUs = Error: more than 1 Organizational Unit with name "{0}" could be found in the subtree of "{1}". -confirmOUcreation = Warning: The Organizational Unit that you specified does not exist. Do you want to create it? -OUCreationSuccess = Organizational Unit "{0}" successfully created. -OUcreationError = Error: Organizational Unit "{0}" could not be created. -OUFoundSuccess = Organizational Unit "{0}" was successfully found. -multipleGroups = Error: More than one group with name "{0}" was found in Organizational Unit "{1}". -confirmGroupCreation = Warning: The group that you specified does not exist. Do you want to create it? -groupCreationSuccess = Univeral Security group "{0}" successfully created. -groupCreationError = Error: Univeral Security group "{0}" could not be created. -GroupFound = Group "{0}" was successfully found. -confirmLinkDeletion = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to remove the link? -UnlinkSuccess = Certificate issuance policy successfully unlinked from any group. -UnlinkError = Removing the link failed. -UnlinkExit = Exiting without removing the link from the issuance policy to the group. -IPNotLinked = The Certificate issuance policy is not currently linked to any group. If you want to link it to a group, you should specify the -groupName option when starting this script. -ErrorNotSecurity = Error: You cannot link issuance Policy "{0}" to group "{1}" because this group is not of type "Security". -ErrorNotUniversal = Error: You cannot link issuance Policy "{0}" to group "{1}" because the scope of this group is not "Universal". -ErrorHasMembers = Error: You cannot link issuance Policy "{0}" to group "{1}" because it has a non-empty membership. The group has the following members: -ConfirmLinkReplacement = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to update the link to point to group "{2}"? -LinkSuccess = The certificate issuance policy was successfully linked to the specified group. -LinkError = The certificate issuance policy could not be linked to the specified group. -ExitNoLinkReplacement = Exiting without setting the new link. -'@ -} -# import-localizeddata ErrorMsg -function Display-Help { -"" -write-host $ErrorMsg.help1 -"" -write-host $ErrorMsg.help2 -"" -write-host $ErrorMsg.help3 -write-host "`t" $ErrorMsg.help4 -write-host "`t" $ErrorMsg.help5 -"" -write-host $ErrorMsg.help6 -write-host "`t" $ErrorMsg.help7 -"" -"" -write-host $ErrorMsg.help8 -"" -write-host $ErrorMsg.help9 -".\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName ""High Assurance"" -groupOU ""OU_FOR_IPol_linked_groups"" -groupName ""HighAssuranceGroup"" " -"" -write-host $ErrorMsg.help10 -'.\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName "402.164959C40F4A5C12C6302E31D5476062" -groupName $null ' -"" -} -# Assumption: The group to which the Issuance Policy is going -# to be linked is (or is going to be created) in -# the domain the user running this script is a member of. -import-module ActiveDirectory -$root = get-adrootdse -$domain = get-addomain -current loggedonuser -if ( !($IssuancePolicyName) ) { -display-Help -break -} -####################################### -## Find the OID object ## -## (aka Issuance Policy) ## -####################################### -$searchBase = [String]$root.configurationnamingcontext -$OID = get-adobject -searchBase $searchBase -Filter { ((displayname -eq $IssuancePolicyName) -or (name -eq $IssuancePolicyName)) -and (objectClass -eq "msPKI-Enterprise-Oid")} -properties * -if ($OID -eq $null) { -$tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase -write-host $tmp -ForeGroundColor Red -break; -} -elseif ($OID.GetType().IsArray) { -$tmp = $ErrorMsg.MultipleIPs -f $IssuancePolicyName, $searchBase -write-host $tmp -ForeGroundColor Red -break; -} -else { -$tmp = $ErrorMsg.IPFound -f $IssuancePolicyName, $OID.distinguishedName -write-host $tmp -ForeGroundColor Green -} -####################################### -## Find the container of the group ## -####################################### -if ($groupOU -eq $null) { -# default to the Users container -$groupContainer = $domain.UsersContainer -} -else { -$searchBase = [string]$domain.DistinguishedName -$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} -if ($groupContainer.count -gt 1) { -$tmp = $ErrorMsg.MultipleOUs -f $groupOU, $searchBase -write-host $tmp -ForegroundColor Red -break; -} -elseif ($groupContainer -eq $null) { -$tmp = $ErrorMsg.confirmOUcreation -write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline -$userChoice = read-host -if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { -new-adobject -Name $groupOU -displayName $groupOU -Type "organizationalUnit" -ProtectedFromAccidentalDeletion $true -path $domain.distinguishedName -if ($?){ -$tmp = $ErrorMsg.OUCreationSuccess -f $groupOU -write-host $tmp -ForegroundColor Green -} -else{ -$tmp = $ErrorMsg.OUCreationError -f $groupOU -write-host $tmp -ForeGroundColor Red -break; -} -$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} -} -else { -break; -} -} -else { -$tmp = $ErrorMsg.OUFoundSuccess -f $groupContainer.name -write-host $tmp -ForegroundColor Green -} -} -####################################### -## Find the group ## -####################################### -if (($groupName -ne $null) -and ($groupName -ne "")){ -##$searchBase = [String]$groupContainer.DistinguishedName -$searchBase = $groupContainer -$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase -if ($group -ne $null -and $group.gettype().isarray) { -$tmp = $ErrorMsg.multipleGroups -f $groupName, $searchBase -write-host $tmp -ForeGroundColor Red -break; -} -elseif ($group -eq $null) { -$tmp = $ErrorMsg.confirmGroupCreation -write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline -$userChoice = read-host -if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { -new-adgroup -samAccountName $groupName -path $groupContainer.distinguishedName -GroupScope "Universal" -GroupCategory "Security" -if ($?){ -$tmp = $ErrorMsg.GroupCreationSuccess -f $groupName -write-host $tmp -ForegroundColor Green -}else{ -$tmp = $ErrorMsg.groupCreationError -f $groupName -write-host $tmp -ForeGroundColor Red -break -} -$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase -} -else { -break; -} -} -else { -$tmp = $ErrorMsg.GroupFound -f $group.Name -write-host $tmp -ForegroundColor Green -} -} -else { -##### -## If the group is not specified, we should remove the link if any exists -##### -if ($OID."msDS-OIDToGroupLink" -ne $null) { -$tmp = $ErrorMsg.confirmLinkDeletion -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink" -write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline -$userChoice = read-host -if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { -set-adobject -Identity $OID -Clear "msDS-OIDToGroupLink" -if ($?) { -$tmp = $ErrorMsg.UnlinkSuccess -write-host $tmp -ForeGroundColor Green -}else{ -$tmp = $ErrorMsg.UnlinkError -write-host $tmp -ForeGroundColor Red -} -} -else { -$tmp = $ErrorMsg.UnlinkExit -write-host $tmp -break -} -} -else { -$tmp = $ErrorMsg.IPNotLinked -write-host $tmp -ForeGroundColor Yellow -} -break; -} -####################################### -## Verify that the group is ## -## Universal, Security, and ## -## has no members ## -####################################### -if ($group.GroupScope -ne "Universal") { -$tmp = $ErrorMsg.ErrorNotUniversal -f $IssuancePolicyName, $groupName -write-host $tmp -ForeGroundColor Red -break; -} -if ($group.GroupCategory -ne "Security") { -$tmp = $ErrorMsg.ErrorNotSecurity -f $IssuancePolicyName, $groupName -write-host $tmp -ForeGroundColor Red -break; -} -$members = Get-ADGroupMember -Identity $group -if ($members -ne $null) { -$tmp = $ErrorMsg.ErrorHasMembers -f $IssuancePolicyName, $groupName -write-host $tmp -ForeGroundColor Red -foreach ($member in $members) {write-host " $member.name" -ForeGroundColor Red} -break; -} -####################################### -## We have verified everything. We ## -## can create the link from the ## -## Issuance Policy to the group. ## -####################################### -if ($OID."msDS-OIDToGroupLink" -ne $null) { -$tmp = $ErrorMsg.ConfirmLinkReplacement -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink", $group.distinguishedName -write-host $tmp "( (y)es / (n)o )" -ForegroundColor Yellow -nonewline -$userChoice = read-host -if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { -$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} -set-adobject -Identity $OID -Replace $tmp -if ($?) { -$tmp = $Errormsg.LinkSuccess -write-host $tmp -Foreground Green -}else{ -$tmp = $ErrorMsg.LinkError -write-host $tmp -Foreground Red -} -} else { -$tmp = $Errormsg.ExitNoLinkReplacement -write-host $tmp -break -} -} -else { -$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} -set-adobject -Identity $OID -Add $tmp -if ($?) { -$tmp = $Errormsg.LinkSuccess -write-host $tmp -Foreground Green -}else{ -$tmp = $ErrorMsg.LinkError -write-host $tmp -Foreground Red -} -} -``` - -> [!NOTE] -> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   ## Related topics @@ -959,4 +39,11 @@ write-host $tmp -Foreground Red - [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](http://technet.microsoft.com/library/dd378897.aspx) - [Trusted Platform Module](trusted-platform-module-overview.md)   -  + +## See also + +Prefer video? Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. + +### Credential Guard: Credential Theft and Lateral Traversal + +[![Credential theft and lateral traversal](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) diff --git a/windows/keep-secure/images/mva_videos.png b/windows/keep-secure/images/mva_videos.png new file mode 100644 index 0000000000000000000000000000000000000000..2a785874bd0fd809b74bd64ee2e125de6e25cafe GIT binary patch literal 139543 zcmX_{Wl&qu)`o*iakt{`4sCIl7I$~|Lh<5K+}+(>8=T@++#1|z2_7KG$NlbbGn3hw z_pIc{b5_n?d&v(KC0TS-5>x;HfG#g5r3L`NzJ7!eM*h!oN$^GTbwP2F)BOqnVEp>e z8zz+ngY;EIa+m)ijkFC%j6;DacJK%C|B|$hySRtDjk6n|vTjoDRYG%rm82}cn!DM$ zxZ65A0dP^MXkK;H|LBs=F5Ygo);8{d8qCR$uPVm>t8SL2|1qU>w{^4x@If$9Uaz41 z=Zdf!-@BaVCZNHj3n7*320owao;$LOt|H#^=ZcesN)_^|JgNRoR z>A&Cia5J|A+`NRGzL`lnJ33lAxdUz|(|TVu#Q&IS*t$Dd0xHht7+ygDCd06g*fL%|LKj*_NA<=_n4wF zTpOO>N3dT2y0@#)_0w$oItceLPoAqULodX)m$3Kw;bytM_xsb$Y5mJfHvwSt;{E1D z9wgxIzL^k~t}_Q79smzWAfw0-O-|_9g9LW}+ZlPGMNU8zGx`2bd@jb~(Xk?6STI9? zJBh!ZCxMe><>U(tXUh^Yw`d@ygkX#sCeXe=c-Kigw&=U*2|i=@_DlpAta*Y#kZ#~<+rRY<2#C(hQ~qqt z7wqdvDCP;S^FPJ;v)}E!-s8FX&2yv&-0f??T*UKDMjWK&xs$y2?_B1>K5-+DoxQd45reo2vFs4 z8VYS>R9b#3Oi=0k@gL6x!g2D57h<(^h}RSrmPO-kK{S^q!d6YRr&z@egG9V4r-*ExO#^DXLV!L z*fpa(+Q6tPO;_-r_>x+w`M-qYhRDXA-k;oBRjAV`O(G+5_ zZWfiGc;`Hl$tK*;@I`sysrax+G#4VYdI!xaj?+9--^rRxU3*jwzGR?heQIjzQnE&f z6X`K~`n$=_3=^xf4c}!`McVy56wlX}a-Ku`L{r@%kO8!RX7$d-q_{PKE_`oDCgpNc zdPyV0rRxJailSx4x!bhAAQPZcuCKm;Lgs$^jXYXd)Wzbl(sC1jvJ9#aLVk= zY&7SM#d6vQ8NJcESv8BepEgKh-n`% z$S4*YY4Z?E^x!8^N2XEZs+n000)AOXI|h}sKIZAfH^5u~mugyXhXgijlnkz%3!i^4y;fIw)V?SWQb(6uvw zrW<|@u15$x9JqrhE;;A6PzU6q`*%1}icv+fy=WOqTI>Yd3||V}E$1i`=)E5^fQfdW*bymNWMIi` zE_N6lqu*E*%*6MIczgBb)7eMIB7_2#+P{>RTtptX{zAfH!nE??ZWW7<+@t*zPgt!5 zWW_B@tx8M}GR-6s%A!?k%MM0lgeQU7C23AE=v*CIR8YSPvqFz|I0(dKSELm4QG(gw z(ubR`gI{H7ZF{{pL4WN;_}N9+J$c~dnm4*38{I66N`R~dUrgnqNE|a6@rFEM-`l;j zv7Sw(!>juQ-roVMLzv8jB1G(5N}bz+@;6KG}g*DAPx`AS$a?SHGASye*SZ zf;3CpsU(2;YMWt^$+=7EN6NXFSpM5?7vP5XUzpF6Zn1lsrCSOE4#LqF@BSzMmEtq$M~3E-!ice-Z;YxKC;IX8uJqq?ffU#13dHbbEijqbIr^R{6vV4yBZZ)gBZ|L3S*OIiIwm1bQ`^h48kF}!We z%N(%=j}E-{X9q)l=6xXPWRK41tv1j85Hcc!xu0x~u8=KbmGn$X&K+MXf-~j;50~2z ztcs;PETKs;Wc#crH1zl9qJfNt$pE8H0h+0W2mw`z7i6#TdT%sm=VBR>^xeC8fB~a9 z2UQWhotzDm``BLMIss>z?YlUuz|x|=gpRMgl=qqnvL^+w(%#`2K{V52p^+mwKNq4c z-}8~xhv3r>zXmJ+jW0;hWtmqK_xi9jU4wm58^!}?ZiKN?&FpP86jBvn6hC2v-*_bx zWv61@MIMF6=1VFkqMMT~aO36AzgJLIO!@&^0r2@0S_O-~^VK13w#_x@=(3(rHS<$IwtNs%+<`mQ%nVx)J;s7!~om>n6=mmhiBqkZn>}n<;?0 zZcUc5fzHQV0!p#rNJY>ai_SZVSW4;`f&t=Q^6yfx1++o8my7;ie$W0Ln`f|EX{%LK zT%qc;x2p!EXJD(@%jNe?+Mr7$|0WSFDlp{3k@s&bF)z5L(raN)9H; z;v*9V94s?lcs6;W%LwoD!lX&-0EEV|@c!lYT$PZC>7IETSFe2UfMeDgDm;_pGKqCs z!<&Z27LN49Wxh`nl2MzM4fPLUd1I0E>=vlNCBd7uI=HX)X>m3U2n3e0tvjwmdTP>y zq~dn@39x=CB_rbSGPTU(j3@Dg-k{dkAv}~vhL%&p$9Z|-%B_68U*V$~eV{Qh{T>@r z)ABq!So=BnfOCiNGjntrVpCbJ>FNdIbM1(eF=a7E_+w@ppLo@0O)17)7f zyq1~y15Ap1hE`z#+p{p@;8^aZ6Wmes!Dmvh4B1Q|SEgJm194Pg+I#AWf*$nCh-rHF z6frS0jm$c+LQ#|u<^=(f_azRrL+4obZ!GR~Bt9)9QTY~b+t3_{vw(AKH9Sn3B*8Ge zJTheT#lLLWMhIeK*dDSlz0>?8{S%{QsmN@EsmC}pL#qQ zlILIACqiyXYZKAGU_Wyq=(bqZ^694&jD=X*9?laF0^ngwZ!xN*W#VecIG3!H?d8#e zlV{UtaxWI151L#2=guS_;C-gG0_LV1Nnn{WXlTTsUywy`SSHTFINoDHU`@k zP>biZSq&HiQ-4d#gSe6rROG*#d_ovJgVvq3eKRX}uyq*1T{QRPk>WQTHE6>&z!H|7 zF!`p-qblCJz%(|`#d_5rqaDl5o8KghW@cylvnbAzk=D(vB>DYclV#N0?D_?}6L+a9 zna~i}kERyCTuna{(sKP1yO1CzV=h#z^@(gagR>P_TPwZt2Xyd>^+DO(R3ddsvSFPabOT9mM7 zx`&cQ67A~qt7?_0$Z;V-Y=h%1ED0=+{S`_&X)Tq<+Hl-epAxxdtjq-6E#$0mEy4^! z3>Bg;S_x;;EvZ)1tXd|jBT^?;m4Lnkfr+Yyc*9a+m{T{pxEd$|qn49qReJm@2~idw zx1*&=24g}?^Z4f`^Mr)EuWpv9Dj^N7hU?n?i@qpzr)v(nX^VRL%a(>q`z@@AoH`D+ zwQS!$<_=Jr_yF!b5b{E_;rChF(+Ps@;@#^XQ@AISn{~7lCf({gY}3#`|3RYBlP&Aj zF$j3T@P-VO>BO0fGaUY&=pb8t`u&A~oLVyQ*-tfQ^^HY^Tk8OJl&cXrdmMQjtch~I zh;6N7yZ`z_n+{I(pY`iixJ5GZjYJ}i4ctY}okLx}zj3?C!r_zffhc?kuHw2Ni~t`D>QUphQ)9%%@MGfa zc5B(O6UeSMkDuK^y69r76G_1QafOD@_Wc}QL1Uk^O|mlWojhIP6?6)t_x;RzG8w7HxwrmQ~ z#*u6-TKvpPPurrZV{U3M`x;(zrnDxpQc~iH3(1BfZ``WBvB*O8ju0jE?jIY)s>abd z6O%4h*TpYPHE_`ujI@oz<|Eq2h|-{0)_DPVG&8@EK@dZS(8QpY2SZDJCpc zURU4-yRqNZF|O~$qxUb3^d+>8o|`00f$e^P{c(NCNn(>s@v5z^-h~;gjpL6=Qkp-Y z$#7NPY>B28x_WroyKL;49HEu0#2)B$OOsyuKB?%nc(qEKG;)oW$d(Afsve~yyX8J$ zZbb#QW&uq_OB@Y_u`lnsyMh>oc4tWjTh-syLTbnqZ?IG z8nsbA#ULFn?1`Vz_luvYH2Q+}_{pNK(YQ&>6VE;k(@BX>t^M;^UsOh5JiPMO&4RF- zg5ALUd_1P@Y-~0vCvpSKF}lt87wHWm(r^hkV`2MP24{w8x5?wkzDYj~Po_6o9lJe| zegpShDt*EJ@oF@LKPP-$o>j|Pvta7ZXvf3vODM6n>`$TlQ!_6o47WWV>6stK72ofY z&zJSOy?hP0?KPS{*g*g0-w6YmnJxi$_|3A|rP!pms+ew;#YSt6`J)pSJ8U7RlvvZMt>Tb=3XRmf4`n^XpKpNqd5P~K4l`^qbjc9p3$iL z5e-aR&7rcjVotOcm1znK!4Fi@$>!E22k(cy)}cI5Z&!GtBs>EU$)|&Gd31en)T)iu zD)gqOhJ}sPos1mxk+oGiH8d2p-6~QJLrm&@?qsnn684D79b+JnBUaKvug`j-AK1Wa zKSlj1ts8cJ3u*tioD@79Q?%+Qo2B-D*}b>j97X{TJrI9Quwh>lYdW<3`)NeLZoA)k zNNoWP7CpZ|SeUhHtF3`}d$f&M{A|5P+T(5mdIsuthHi8NA?uc#O}TF@9D$CcMEyo! z;Z=Rl89fo{4On42-R}HG=4K2Uf{&y1CRJ$6(w+D-#Z^}18B_&lY&2%6!TT%aSmZSS z9NF_N=e*}wNU_iME@MSp3Kxk@M zPK;jMB~Ea5U_y}vecuL-t4u8yHH8Oo8H7QyNKOO7vz%m}vCe zpL>nUCs8R@6a!2lR{*MIFB>#)YkbH4GrJ+- zQ&$lTy=U<~Wl<2@hH~^--nsTo14NN0qy|QlcKWj)ZR7xQrwDYSGafeSjYYnjjFbeu zeM_54Pw`-o6`HICZCZp{oOA;HgLw?Si|UUh^VW$1PShe9zSI6fE0wJNxYK4bb_67y zkYMZZW$%G|3qWVLH}slN1e8<#P$2zFq?u*^9K0V93jRzwo96jV&s+>{!!^W1LZ&|9`n(*?|L6 zZ9`{)Ku1T+^(O(pDFH%fO+8J-@5e~N7vJxAP6)X^rVfL|#UM?X(7GatuV*z2-6Bf7B;6o6d) zNdg7(K;0KRmGR*;(l!G~`-ofJ6tv9nzmtRU>?g5sxT0#37vFbfe%?VsAmTUGx`C5h z*K7+4`G7FSHK$ixUYdyn62?@MF0-?W%Pjwn%7$K9E#+VDbzq!-$ldoXeq=6A}RQJ+7Q~Q=BLc$>e*lpj3CB3WtvM{i*&Hsb#e{)N}eYejubDrC3Q%tB?^t2Wlx9a2VnIen-5=Dk2Om-FgoV^5}769`yIKfQCQSr%)`bNYhaJ_ zy65-x_HvlJbJ2^!dhZt~rvDtzmu+7p>KWZ%n*EwA-`>?t50E==BstMcc}P{G%?mJWNLP6-}OxzFjb8IUbC74(O79c0<>y=m$uba zgWp)3t=}K-tQ(ySc=p`x2z&=2)fpP!?u|9i8@7k3B584yeB#;h5h=FZ)eJSRiwc&u z=1z5;tT@gwv@)N(aJxUl$8z%$jH>!Fnqh_SuEqVqVpBMkp?R3Av0)Y0-UQt+o#N$a zGg%SnDA2MWXW--6Y!!pEn8nAvX4n`8Z^WO>LW1G;l+ET?$OnM7K{ohUDb=ltzB26S zHM+6$O?=PK&=X9=?mX_+x1Y*lropKQRYPp`1SB^ouWQnk_PZY~t*x)AZ^8t?6zlKiI5}8K%aKD9pdHu%6 zx-qK%jYW5mf-KFjYBjmQFN+S`eVSE#B2>zSp+!jr|Am~<^za_g*RYmeuaWy>`)@#} z!Y^j+sM*7)Nq}3G4x(@!Bgfez^G7`!c5~JiSxSK<^crdnnUOwPckzm%%$^v{$nhSq zTkDX`l8L*V-PC8(@Kj@qLfs)P)a+pHg2e-G8^nQr^_HKVA+Z)Z2KprWyOp{jAJZ56 z)V0CTxU;3wi8co|3vEEcd;YTxerFKGaT7EPIh*TQ@40{7M}ap_^aw8-ua$(Jh;&!r zKj3DY|2ky7=f;1tt=rlEwOsQZ=m>%?0e^y_8;}j?U#i-k_PUrS9~?5IB7>Xw6eJg) z#RA*cO4@((TD8Ky%OI6mRAjvgoiBLHRwhq6S@=%|*qOv&%xZh9)hm5$=;RTcRL&01 zH;FOhEmDsyWdVJb7w!{Uf^8`lWiR{bMU*@f*;nKK=Ce zvKAT?-irUf7~J2p7v$6pUhnzmyXgdd4Y1puzJco69l_9V>us<3N`Ii^#pM}v z$#AV51gypYk25>qVZ_)Jit@LZ)cU~tL~)pLaclkJUdC1;;*t;(_^a)h=x;V6HX1H7 zK<$F_!GC}C1FINE!;A*AxR;)tk5|lCBRc0^rUStT3Z4K1GBWWl_rK;Z`nwXU+_F+l zXjZeqlJ-jjBE)M+e+sFSrquAL?~=d45_idE*6B4S#8n`$-gCm`2^oN$*OiK(8(Ld+ z;=XnF*iWv%9xir^?+kl3F|c92&|$RBh()`lkcg=3y;Hz4R9i5H&jnw{u@A6y+Lz)Q zsA2uPL>s^IsBil)j`8LfI>wN{6!FH$fx5ukXd3FEZy!Zh|J;%rI#n`zlnmwA$9)T3 zM#&V{z#H)R$9_xBf?&| zU?U;X-rJ&o`eNfQGE*cOK=KBIXcbv@`q;`3T6R)aoTp4Qa6jkNN|C-&9?SL6#xPf) zeRP+i*x!J;uGmY2xQLGD{O_EaF-hqKUT>4`32+x*lO}dXJ#Ssvtjh6tTO*QBebpp!Xe=$34i&AC=DC7nS>`e~Ff@m;A1wyNQ2#pf z=X!Vlhsv8UWrTj((c1!UAVK~4%`bSxOyw@HPVNQ@zX-|6aQ*Bsx#nFKAuLp`aMw^O zlpzXOMoayJ?l7!{_fYb!aejHC*jEF951hU|cZC7Hc1r7<32b()h zCOt`zTgelq7hF-LSZHv{pt16lnFd^$dy`A@mj^}W1;_L@5ZS^2Ik$Tnn0i>A0>wix zQ34ATN3XD>i2^4>%*(@JF_2@e9M1?oxY(U7m|(K%Y1KAnr7^;qZO28xkyxapHbsWH z$ZHwni_K7TjPCJUatYy@O%#`k1zR2PXlv2p#r`^hAEWpBaK?#Z<)03mR?d4mf4M0R zfQ)=syHU7I>>5ZErZi&ELK#Q>gQE4uV!#3>;soCt+{oVT31|=-W>!D*j?vA_OWix% zs$-u19eWap?G{Iio0?ifDIt?UCV0BW5}B1a+<<6HqATJFZxZ5+>)W&YiPFon`S$$e7E|Ol+PV9utk0+D3ky9I)?wUGgvow%{pc7rI{RwRv4*oB zGW*CQp~U+*KS=0YA_(Ju;%LS(GT+G2P5@jOi4-YAO#vdeJfe_;C;Y9Z77xQBCthZ? z;%G{ev9-Bij&=f%GM#iwQ+lxevmI4eYKY0}&S5c#@XmHB=DH?`kEk0B6GqS8Va;a~ zB7^Mq;Nux#*(lRIX)_XtF;*gU_{n%@?2W~T$6QMk<3d!FJ{f&1=?3Q31Ip(MjPP*S z+M2z^wmtu)2A3g2*SipLrNx)IfRmT2DKs?;i;pffUv|o5)9I-Q_9_qoa)$1zW{ic0 znP{^o>%NfiGuPXYSZ10;5NP`>s?96jB(`Xyh4f*6yHFc_z0J`;DIC!}r2Vwk&^e_o z9C|?bbwwga=~TUliDvh=6tfWOSA==ufzi+c$#vY3es@M2O|CDtBpHFere0UFtL>5o zUly4iB4)m1$0#6Jw=iqQ;4BCWeu?W|;2WgEAFFIEo#AZf{8#jcrYR{3)tUHrO*arBrd6Z!9SChdw9nFO2qkrx?uInAVy>Nt6Si zFOP{c-?wWmKS=BGJ${!q3f)FsxQM-&K^~^If8cJl-}V)-pPjatLPJ!vCsAeMSyQlb z80%;m{z$tLGo?pnXd)9Yqi8SFwp8`|dr9P1K`Z=jIJsM1wuF)UF>i%mJ>aOHc+FM> zPEz_a%F6-gL&{GlS3p8VeTA>y-W@q>_pOHvrEpFts}~=ycT3)pN9&VyUlU2=ewYBM zxmhG`o5G`Ufwe``6h2F#U}rPj!^7ZG-+C1!P%YyJ_4flFuj8Npa6Dhv(*lSzM=r%y z6Jqy}`JX=E{`f0EiEC&7Ubi5JpOOV=BbH-UxTd%H#)4$8I&)|Sd*#QIljFr1#bY0m z$mMo`UyuL~KXjYoe%AP5pO;dWtf`1g(wpfjkDT4 z7fYz9h+>Ia&oTOEz~FM%ONcS_`E*cNTg1R=6B_XH+q&mYT05f(SqEW;lG|G(1dOfC zgoqG0+nhaZc1cfb9);7mfm;fM#C$zH()-D*M*}(QIZVXXr%m(m1V>4!ER!oEMmlF^ znn}${=0(gc`p1(*Hej8BoYzTb@_SBO2~T}`9A9%pj;pzd8=yLh^XF~P9vkRWx$%0y z1?XuCQlsyCd7gPy|2R3+W_<*My5vh`$s-@@x?T>8_{PFTK}Cbwm(uzYId|Pdf2Nug zaviE8_UV32PKePjQD{67H!2$2&W>kGSz!VfdCBIDjq2GpAmhV7wAXPPdW`tcp z!7EOP(pK9`f4>a*Cew_3&@v|3Xo7X2{9OxD_`Bc}o%<6?E3WSIN{yquo!s{1Dk=9o z>@)!nY?}#cXI`4L<@{bCn{gxiVd6cH)syKzouQMEK4}ep+r^4odYuu-mCn6(<{>ww zZo$;*e)40(WPFunZ%>v*t{``rHi57~N=;{!V7hMvZtAS&9mff%e?!kc8o^}{dgFt8 zcYQqH#tM2Z>iY(q*0#6(vzq8c(qzV@>6~8i-48Oj19iW#h)gUg(!66mlDNhgMta9I zcb9IXi1fo+7Z(lI_;bLcE}^>Q?V##mvB~TouzT`6pzHS9@U_T-%(6QYQmepoLVA*; z#Mr%%;N-S|l!yj=?+}RXpon396Jy!;4!+-%$I*(w5jU(?uV^ zkNTUB9=#Xh^~l%IXYJ=X@7ri2!G?GP?`jGLu@EHpH8og-dNar;G=f%yi-@NA((Lq zne2`-hL`I(HRUTN5lf#w{HncPr)1l0AaecCy!ldCf1{oM&uYSA4uVD#*2Cz`910lsEc(VLqN=2qSh-r@*Rb_?(vYsV`|s(C zJ~zK?CFet9Kp;z@J1mT0K{h9u;iEx$df77p*BrRY+Dr7n->DX&LD0nfG)TFp;GJi-ssXfOP{uOm*b5E38@)g!BO{)VCJk% zoyi`)M{S1GDvriR5rSpRSL&QaNThdN?j;ABIhiiz74yGyIWfJ`5+ z6!O^-{#W=me_WT3o3nr0K$8x-OB4GiXAy%@Uo+?bHYkB%#HDT3bEbov21ltufZNE8 zlC}NONWYqqBXz|_(y>R_PE{p!CkcrFp==Y{4fA?68@}Q9Bq@kuE##6`np@@xKTMmN zgGiCeon7LJ?M1yJORN%A8U}BrM$i$_%2$};_KyH<|CpVjWB7sPZE;;E|>0lI11jngezymNooXOa;Wvu#@U4v1E>=9k z5biWnq2EH9F04Oj`~E`OY=5KDmc)>#p;{YxpOjY~Jt0@_e=hpQa9Dk*oj|Ukq>HzJ z4?6QU5U11=WbqC}eb3#%!m~KEbDqtvqWr% zB6niwd)UPLy92uK_H`Kq!ku$k);}M9?G4)Sr#lr}!egMGrmk`NH}FR;a`8f5KI_y( zoSgcS#*g^8oi$D9cT#7>{`DsKHm}l%*mysp zUXB8p)i$^&ueyaGqkBK7bDfT^$&UuA&3xS*u)6lsit*88{K><-GFaYeSnr?=^D%w> z;W7E&O?(^VRvij2(royU+|JJiDTk)^_}^>y9!gRSJ3s&1d?<9jFRRz`tYv#+@qqRH zVjlePCp-ToB;XFyf9tgO8MpWGNB#47{o@{k=mkFb3Eky!3-fWSJpkJNvL_pWx+nV` zDl78*mEwi1cQ^Y?`EEMk!XNB4L-D8{a5Cd}7VW&+L^<%@T zorFI{tO3$FWV5(q2>Y-+FvuUTUyeZW$79l=D{(crg;EG3K7{61?cBdC8NW(UbrPq^FD=q-r+ct7% zN?!dI@=+~TRTv?`~FX1v_|)Ir~JGE zWaWQ-eEE`*A9L_8v*!ofHzNr_6aA(-I4MkCwf-AYet!?$Z z^M8~b4_IyosLH&|qy?i?KT>XcOnMz@U)wm><_^`;dw&Lu(t1;K2}^&?+t5hk#@=k| zZG!bQ-wlQUi@>avpOC-yoov^6JC;VjGiGp5f*)TCgw5!0bA-=jEON^$Ws`+F=id`0 zN$Sk0sv#RT)G%V1;H86AvR8BD7t?fEhP>~P%o*1Ww_CrRxT!jfri_^OEUy@d9F-Hs zqAAGM!q!*3hG}?Xp`*oQG3DM+UsW|h<&CPaP0sm@>Twa&fc5wJdG2czcQf#6wQt>V zUQj?@B`?0OhRikL2=;fOkXsjQkX%y5Tq*YN*pXgJ+XDDSTl8Wkov%X@Uxf}ZhluyY zZ)y5JDQ8s!r>-hAnX26QPQokEB6%;{JYiav3{QZ?|F#Z0d+t3pTl^tzoqntK`Os;O zmp=@>XV>?H)gV#-2l&^Xx3Q6c3qsMmSmUc^(U%_#GkF``w|i}Z7RHc5%${9g@WUO) zi-c#uE=!MtFq`Q8yL|uWogsmMb?t!dV2JNVbi&7XT!t2=O5Cg<@6;06l)>{hG6h=P7~ICFdr_Zmgcr7E1TLo z`(UG#{tRH==F`IdAajh1I5%D5W8nCsW6LrpsU@gi5P!3My^U`-`KnVl8m*yZ zVxNS?%8J+?*{@PsJ;@=SNDOsIj6yH%R%ch{leXKVMMfG8kq`NBZQw z(mF>J+`j&AdmC0Lnf4x(4D=$egpezITH(M#w(mz&jia1cSH_G=aIs)f3oSo*%o(>H zVz3KtnAmTVMM?p(ee?80-0SuP6Tbrpni)usCFqvHAe+DR9YvwqDk%$D9iJJAv=te4 zDOsyI%H%~?OQc4zlrUE1!PSgQjc`U?(x@R7Q_Ibv5ezjLZU}QD?n?dhFl?VBx{@)R zz8(5x5V?;5b!*$tU+84{1p4L8x72R9nL8ifo6L4LWO7YMPDB4zdzs46TYk< ziC+5$K#{)Rr@ze3yf`8?TD`G&{3Y?IQJ5=H}nsY}7D)3%}ojihWH;WUnIY)7gf}Wu%I<+)d~}R)mMs zT^ynfoc10rJt0*M#7fvhxJDR@`q?jJOpj>rZ~I_FzG7Ljg3la6mBAmc z&1A3WqqU_YUq2k4(w-y5SKXe9c^hR^DCKWK*`0aQ(O5nmrfW*BoO`IDZK*NIY|m>R z-L-(ah>`gfo@k^F-uncUr9;5<#$xie8`9lw`C&8H7rgG6ya(EaX$<=-Gnacc#!(q& zLT*!X;WUPDDK;VT^EhT1t42aZwh+Q|dxYNbardZ0oG|z#T!@6J$v|i3`5iHf`)Zl)J zRq8KkJ*MMbsTsQ$0^DP+BDe4%ex*=Zng0ERNo3PBBFWi0I__QRS*pJl6Gtw(bO1F9 z2ba04-%4`l6|5X3iI*@zTC5gWk|ji6rZa-6d~$A+(zB$tv;B`0tb7STIicuVaiE$HKY zgZt{V@j`@RO&2A?2xI0Z&g$7IWid)Wcb}h`GfK|Bi{vYnm-1D6EgiWNa(mUfJuq*i zjVLs_)H3?SD#}793VBBm>Fk%zz!XmFJq?3~uT40AT1yR`{!=8=BUrenGxGe!DiBpq zmN4V~RMN&Px8YCy*(G^{ukS2DS{4cpJkNZOV8(n04Q#Nb~pnxd#1kk63y6VZr`o_W?6Zn z88@VDzTfM?%{phF^MTR*sztWiTh0>kRjsMW2EF4WM(fX&Uqtu`jU6Mckk*uEib-H zRghT>iNl)kWYEMStHAIj*ET2QgfquTU$Mcxv4||a@LLgczoJLKarMESZ*(h*z(PJO ze$hpeG#!j(9vcOPQm+%Vns(dK36UQ;UiN^YK6?4WzNiC+wS0mc>8CEn!7!L=!k+#b z#G%eANBaDH2d0B6)^PB`K|W z@e9@}4aiz0e~xrSIZL~Df~5O3qczgD6ZhpD6~@L|QAitruQ%N6gMps%>AicCiE@rg z1cn%lcQ!P}(## zHNhpO3Zc~cx{DR z+>x(|a<~r*#$bpNDu!Br_Ornw$Q@<-DcFPNn+`LqR5xHk>HeKXd7w=z1Lr zoop-wcq&00{1}dfQI4pf~52ZQk%Bnm2P&r z3blp{0<>onv6cRMgn4 z+GkW)GE1(n*SnIsdU+GNF}?<1Y+(J`GD_jiG%M=Z>ESQ*9QU4$$+M$0il}EC$yC%; z3or8llqX3+^X3UugedO?9R@7!X!v4AYQv9Z(3Xd4y3DzV!Wd17wb({q-S(d&P?9O`+!tFzbIGQ{lIlYOD! zQLrl|H!m>or@zRr+yYtfG|lKfG|7w7#u3S{UkyFbr&qjE~pbJ=H}p1Ofql%|Hu9-%^7Y zktnA-zMvxzO?sn2|FHwfW7`fSEJ;LwK|f!on}7f5hJ63XcKY+~X>g-;X?A40W?0w* z*<&$V$)b;&wJ2HA5B9v<+IZ<`S?%I=hFpW)vkfZvPS zg5DUX_YPl(uJsEtoND>}a_#s^xe>Z*zfQHumnS^CCeJ8Eq^lQWF- z>&w9~dQ$Kuy)`m2k`;GB%!h~0k}z1Ze3E9RSX7YGthOz|W)Gv}=x{=+EMW{eHn2Bf z1>%G#Z`D>8O%)%K`(c;Lao4D`vjC5+;|GR1n5(5<;Y;;Q`DfI!>b8GR&)dwx(L9iu z!>{&B-J4GB9=fpI64t%$ab(-sMfHn}+S%BjrGBiA{d$)pi$*(CqJ$jduWdv&u4**& z>zeg1laFY)w&>}d?30lgKMQqkWRW#ensBGoFsWD*)ASOi!L)Jv$XLEgcEf`uZ9>Jx ziVcn`Twb*eQCc8CHknTahAho;t`8s2($8Y+^k0!5Luj-4k|#r{dmb4oRSlzGQj)1;35 zCEE#}AutFAacX`H1PkwdhhL z)0hgy4O2-^)KUZVEk>QNN~a8B@sixYy~VK0!KC_K?YUnm{@N@@)NUrcg9}TMaqZIw zzFrGilU-4O7lKMifjRs|#JePbS(mRIVAe1uQS;Q4%DdCgJ>S)LfGO6yIxl6>6lYV5SQsNycLf_j}qIx1FdOO89-dd#0Gr#i2zLwY0^RP`pef* z)v6#ilKTzW;@RVR5AJ|L++922sNfJS;vd6OZGIP#gG#*llGDi<%FvuaYmT%~s#|`F z&Bh(3NS|Gkc`Amo_#&VN)&|c5d`uL~Q37vdVB*MKv&VDmE;&S?gkYLT4frA4f4~@I zADQR8LW2n6z06gSBMjMx@E$q$+4{*y69{HjV;LLy@$c=!-K828Vk0QALEc!2{Zi%F z7F|j?Nc(%KL(XDBHKJG{{|p_BC+@ycdE<_rq^Omv%PCd!y66Pj&L5!m2*WF9PN)21 zAv*(Kwp(vH?xv-xGXo7X_%N`IhG{wu!9vV{@C`>_i%V2$pj0Ym7FKG8RWK}I^S z4?(B@G80;il7$|CAs=bk%i))wSm()lS@&>XZ9-CV5{+Yos7IF5=CCgACFo|*;X@Gw z&9xm5_v!-X#91Y|+h~2A>i^{&J8vAUiJ!^TcpV2<9qTPh3Ho za*mcwbIrf&l02&774g`8b2jQ>NMM&1^kUVpS0f{FrKoFd{(Wz+qM|osyzbO@I%slB zAL;+V{h-O?lf)45o0tB3v@%wnR8m%$@b$GOe#PFEiNcEY2B86ZKSoS?7K`t0+>E#n z&0KXG4gnLF;Yz9@^c23ZUFtwfsg+EHO9(p*Jh+I+XCa1hF|mEjvCg0$OS*9x4_EyP zbq#;OKNh>qusvd^#fr4i4Y=7!;J+?Fk;ZktQ$a6Mcs3;H{Y)~82TLZWr$|u!bUD&d z`Gi%*i;^giCt3I2bO9}Pt}(GkE-75SKk%U^Z}9uR?H||v$RoUVpnT(;td9qtauDI7(Pvr;bOhu zDVb7@-l(`m|NA(o2;v|IlA{fLJlgdJ>(``3V|AI)6}_*P1XZ*vI~rl4J~=oWohh`* znWqvxQ_6q7->UsFCgoFeK#!uHim$1%pC}J+geyt>Ad=npJ$y~wNvV-RdmzBnOi4ej zXJL+sCz>H|>2D;VGOo4KN*C9X73FJ29(GrJ9qjjgQ;u02;R*u;y+-?flT|ST2>`aa z#G*gc#Q+gc=o6VHV{wfuz(}Y=QG#LX55`QKDkTyzghFq@L04ZOFPSkhP4<`f2+0pl z7^jlE%|e|BKMlBfx&%gYGNY%kTgQ+p@1HJI3{Y7J(|aO*CAAyF(*#-(x=FY=5B>d~%T-5t=)_w!iWRdQ?AEN+ zGxXIK3gyO4>>gV(&I$wqzqqr&CFlD?o`r9U6H5b#r5DwINI9tTR-Qw&W84!-)WK`-;KelTxr%U!vTgp#~ z9y_do9+xIX3LhnK-SpprKLvmgU0KP+)BTi)AoI-`c}KMLcuuMdK(Rh?rftGju#TVA zmbptuUt?1FjZ}#G|5%jhG-rf=)Unn}2q8`gmKaNwdb)|iL1&uqqy1@F^S`5`LHe|w z4m;Zr+mUIqpu zNqg$!%n*wp4Pkb2{)?3_S`_h)59Zh|+&~86h_?bXLavy0nJ2WAAl><>@U4@UCQc&Uo1O*Ql@fQDPHpsO zAe#@(KO0*`wfslS0SedZkffWt{=A5c%5YR=J`xxs!0Rrg*aMJIq~f1!sj_<4YVpjz z%&j_fkBI2${j;oJYYtPe~>picrD+X6C9PGHRTnl#Iht?m6iFJ*NDuzKvJ( zj;n)?R$aG(cH*(k_5hsubM$;lu6qE zrmcCp_j}G+LZ7e%u^|lDM!1*6W;fnq^VBj^k?>IWsD&ZP9nZvGLy2ma886IT)mme$ zEMR&I?2o_L)-Y*IkF(>b)jwUdnJrWiwNndj6X1~sx+H$z^}E0vCn)}8DD4dJa6{{o zCIypIYB`cXr47WAW;RNMmh$jv^P!m8;$S#~qws*cqsR#zI+Vl2?xd|Ax(R2O?aV%! zJ3%D?fui#-|LJs35vqK%F3*V*sV1tJRfS`4iF^xasF|su7B=yxw7--`#rg@4Q0tQ_ zPwn=6uDE>=)fH-I1ZW}CZmvy$ zugkniyPE8+`+IyAL!^1{y;lemw!!4ooTtK)dm+Mz*C3Hdvrk3g{j|#jt*jg(!h;;5 zA^eA2{8hQ_tXvj`WwfzY4hn{K3+K}FShqMPEN4AM%ueXbQ#S&XB`zA2LLp4-!D*wb z=I$LiWHJP^Dka?PH;jeMBsFpD*uy(g$vp9I%h^^=D>i}K8mivN!@H@VoxwoKMk)_V&Z_UXcI{{ z8&@c40v;`6dDrc0Hh6R~W6<42`99yW!aHPBsWZLBYAAgu$05JBMP<}dM z3rYYYyKDCwciXRDFWD&(vdt$#N+zVxjHJ;1aNtsYQotc@r}*sRlhPOE_YkJD_6vN^ z3h#%igx6nF>&o|Bhi7$-Dx9xd*)Ka|1x%a^M%sstX2(}g1w zGnPfJCNvNj_CzQ1l9`58u0wL??wBIN@BXm>c`7tIEib!&;{~q5U?2@?NP=hEc-RDm z8LMlKisyGjpfW^E@%&Qe-x|<2G5C&d#O%dHN~QAy_4{sBb$E|4jy7(lGdux*8_9<% z#kNhV44C!BC<80sc1j!RuhRL+(iM}=nWIcw3~b${CsP0cbBZ2Icc6@r%Y-x;1mJ0Q z?M5ZL*xW#@1&^;=wf^~g6gR&`<<*^Xv6>|(Vm?LE41pX2Wm{)Q$O?&g_HSspq@-+G znu)EEc|5U9wmoL=Q52j!H#}1{&f1!vD{>Q6uoN3Vpt_+ArGt~@!;iNjbl5e}+>I-$ zQanW~p~PutU`z6#a1}m8qS{-I*kAR9#EG9lj-#W` zsFVsIB;Jd$)j@F@--+Os<_K#axE6xHjqWBSXn83UD0lD#^1&zW1DuNdKmy8i_?4I1 zmN*E{70`akI}i(Au@Mp#5N~#(q%O18^Cx8#?{)!r59of3f$Ev1l@QPtMH*`^vJf3q zz=2q4douj^m0xL@A4KS8Za@jKZ4t#K`WdBf2V?nP-8rv3d~{eGL=qHEI)N3T1rDv(u(BhGefyjj!O-S;2ji2niykbf zS-KxHH$WC5%k0K(XmeY0<2F|E#vm{|u?L*gPs1)T*>8f8DrBmmHq5hfh#S;Wi}bB% zAa+m1;sW$!6S{Xf=_Oa4ROrIordhxQOg0EZ6;T4P{PYlx1+=e;zI8$+wd6izWGbkq zY@y2Yf_Hhi`8l8&t2(%X+f6KM+`$fO=YQ@U6k_qKbHmgIWxb#4gLr3ClKj(!AoR*4zuk{&eu=RQ0bQUW zb6WD6o+8uB!59+1_)K)FW@NEW*%aN$uy3|t{MR=Eq(>5z{o(xuf-4xqbJR~Dix~}7 zC{Z5dSMfTZ)+QCq(x0gQZ7`oOoi>iCE9fz&LFhLjASLwd)EVPvtw8|=6PiQr=$`+S zsjC})I0z`XC2lPaEuGX1*YMl18#sLyS#f%NV3;7dr%Ksx{x4fS^D)0-sP{1~k(y;( zb<*LDt*{Bjhy~0jQbWmxB-o#;(dDvn581Nut1mMs@i&Y8614e#vrjtsF16ClLEgWyW?H;R{$Uez(hBU@n9~g0r1L?4eNJExuEG@XeS?*Z;g^_A zgswn@eOh*ax3o5EdvI|%g7-4H{uC3aTyPc{TxOv|#(&$no%iaQPP9KT?EFCwBLL^$ z?+MITQ}uYcP=b{1(?SG;Zn0OMP1+7#lzmWsL(#mc~A zndQ!GOM%2b-znX$4TOyN!Qk+qL6C%)Y}^G&KJa?>JpHBR-a=wg3%sNwHH1yBqKbP4 zSs)`S3DNSi>&4V^kqp1Vepl$3%{aZw@n?kL{E-V*q6}w%miXTcH!%8jb_cn!j*17~JOHu$w~>C#@yRij#~;-G^NKVwS5ih&5DYIf0b;Lii`hD6fc&i&suDf7 zf;>Z|=k(*$nCd=`12+b-gjLV+wA(_hAb~LK4*sqn!N#ERoC&lBxr8rpE-6p#U`2yy z>}HHpb-n|eIQnP8l}-!X&6-^9@OW6RI_$zYojZ<477;-Z2-IjDi^qLA(=B6s30} z!E|3iiDPV`cv%vPfw3jrFrHuyOEy}~n3V0kg_-nR*Z~ygPmH zQ&jrP?q8;(&W!xL6ZLAF_Nd+Q(*40&OvcRh6`sYeKN zbFwo6BOl4nN;DyU&_+193yv0mF1|JVpIgNXoPsdp4M4D{?{ZFY_#(x!vq^peOy2Tb zmV{tPW$pPafxL^s$}>VLKtP>x?7igfI5dnfua6yYA{J8u9x2Yg)B(|Esz^qHCE3n7 zyt@{0#xkm!x}pfmy%XGV?sm`;SE(~k6;Y;6kmVXApg^`QA?)bEjWhKh3s~}LSMw}U zh)Lky5PgopU{o91oJ^sTo`lX69frgO9eB;{2aViik`aBlY zu|&4!@#zuy!&x{XFx1YM0eN8^KXH)a1vmyW{4oa#YS>!=0e@jRE&XYk?qFi^HD5%4U924YQEL9~02(hE;7!WYV_-}=p3oFZp z`Hw=lppYzJdyI?`dYEwIkLfea!5%DUR<`EQhz3P%PjL}tIS!CisK5?4fx!@z%tGtS zVVLV7En`%+wS^oGfH~nbV1_3fGGi?!kpfJ$;|tGSR)I+i%PVB!pi5KY|D6?K6(gU; z9I-+LGF!kwE98?3*@l4}6%&DWk9~OkGy^89*K!vtB@OvECizu6awjM!FGy(!`}4E8 zOo^9AF$3m8D_7MD*_nGF?+&Wr1Rps>IjkujSmGTUDW+60o)8nnXKJl?GvCYbKC#~$y8en1WSGZo@kq!c7M1+1|mDo}Mkpn==N0EV2$?Dw@?}))W!|y?2NQ~;11-$@*IV2cg z@ZE0#!u$L?k1$0Tabik2KT3#KnecV9NkIcN@ZhE=e(5B~#^G||YdHZXGf#|7_kZvHiDhhhz{*b&IB0jXlZumsW zRG!Ko|EUk&WY7b;F@QqS)P_vxTm~E14m-rbMoC7%g$(Kk9jPZ5g+#^oHA78a&P5T{ zUysVd&ER$o%CUPT?Kpef|BY@lw|1vl%rv*83kc=k+iE`2J69bbH5hZt2DWMJU%)Uh z0#hyUU^b+njbW1Ko{4PcBBq3@th|cq*PRv=Pr@L4R&J|=IY7;&Hhvru3f}Y=TAkaL z!F)ERwu!uG4gx7j#N09ht3aZTS{yDJa0We%5iqpP+rD;|CURQ}|B+u#PnB0V9s6&M zJQ)=DzyDNz_Fo7f6o$$2W^=5{6*xz5hvhl4mw3%f?08joQ9Pn+Qfe}B^Nla$my#xG+|XVWvGqiaW1mp;OETZMkk_QOvutsz^zQv!bYbn zUph5G@&Yt1qonhrQQV4;Wky}o?T;IK>##lvgqR>48&H(*e@u)Jl z|IMf7(}RX z{S{%cFc$VdksVK!2wmC{h$_1PQU07oKI@E2;SfP_ynCEWDg`5I9NaOwr`B956*8Lu zM?k?UD>zUeL4f|Q!_a2o=jqNa+umWtM`RYstEa+dSa69&N`MDRBFL16s;pj&Sz{@KVS&5Kim62MGdzhJ^70if*S+moc0VL90>h^lUw1>Z>aoE0bZen~Y}u7AGH1 zoN+e$rwg(Ih9nkHeFM(*2_prHP(=z6Jsv&ArB;RODojJ@ZXyd4-BIS$vXas-5K|TJzdGWgTuHo29ARr*&egTNY zXYarR(!v@lw#)yGov?ov$8=vO=)sNMZ7FL`gzOyJ{yo?$=5^k`5e-jNQ|D3!q`_nPJ5<)n*+8$I-cn9kt+NbdU%9L&z|whJ891W30C&*I5!U1Lq7Q!$KbPE+~Q}Nu+v`0r!ifyyek^ zD6O=XeiQz`oJJA#hPtsD2tQ`&w$8;`V(VR6Yvp`4W91+Le&zUG+uy|yaX}M(>f5G+ z92~*nm>^cxqxmO==Gya^E0N}emd4iU5Mxn)mK)1SgK8=;a~q>E<4GEZ#*V~R5-iuI z9SIhE!5kg)Nq!WAVdg~?q<-Adb#50(E#~Cy*mO(}r-39T5b4WB_uk|Y05y|KQuEHn1PBj2W*rpl$ncrTcL! zx@}R!_cmp{yWPjhER01WH>>-Vp&$zZ!k_U@6k=HGbt_GhMl%18Mow_gq!?ovPE}V|DX-I4MdaiV}^j<(7kQ;BY7G1q!yM^NkFMkpKP+ zlKw540WUp{Nr>OA&5kZ2*W556c1YNXHE779?^UDSya6u}CE-fiY{?6=r6+Z}V zboa*ADZZnc%h@d|9YT3^PruQq9n+T>$ z4eVYUHD<88z|oG*GE4hOn$pBw@4A7qVA=@!KQkZW8{CDT2xz0Kt3~JUeIsNrCfgNP zE{~C>V*^xhHy<_2wjT8q+v=>OA8>%#Mv78VS&ovcCd-zqL5Zlx3?ww%Mi5LK+TT6`lNcxXpUVAuz(DNi;qnw%l)1@ z>&<1zfK}##H0yyb_<8k@MNx5sl&RkP^du?guYh=f-ySvtGGLzLtDssJKYqy4dN1qz zI1GL0II8-*5<%psVX#lwnheCLf%Wwuz(gWAf%*OtvA!wUr8%U z#pN<_wgL~1EjO3gSditQ`;SEe38_mX^%B|ukX|X7a-2b&rXUatP-tEv3?^42%Z*6% z)FO#7g)eq|jw$O#7|u!`^4%(z6I2;`H66_4=xer9>`as<=IC*|#ZEvk5FRD~)Q7ri zgEz7b=VM|U$gzxiqe#~_*H^?1DkdvDeSq{p4-kqcQBPLqBlJ_&j`5~5>tqrvWe^HH zF2B?CoozD*YaQq2y?7_?!6V>5^q-&Xf0?UBqlOV>&_79|km00El51*>-(rV7nv1@bF}LTncU&oJ7HAC*esi}<6a4d)nQwz2L*Usek$tmP9IID5y&%#&LV^c37Z zqigrMCm&eIrBSG?l8L1>H7ftH7?ZsvE1gR9Zbl)(02lLH5eIcvPD*%Q{^%JStHfQ6 zJ84_ra6U*NXcO%9Y|Rvc&ewpIQ;RA60JY>a7kW^aZ5D-|+FS~frWRw9Rm2YPFoLT?O_z7v z$@--cL|oIAPfKTBIFAChsR1dZ%K=HBh#~Q97M1XKTY_t4$IA+p&SU?lZd-M71@j|)k3G=Cso3;M@Hfhw=dmT-Clc|mvb?~RPjmyAhIpH-4-FSw4k{?<;P z`+F;my1MhG&U@)ao!g3a(}}>pqyJcBKTuWi@r~wT^gdSUe)f@fRO@g`FrpiQ2ma-c zFH}z_CzF-h$gAwXK<~7>AN9RXqw}6m_I(xfq{nD`j;i8w*&E8@dq1}QILP>X->h0` z{Y)L!nBa6$Zi2Uciel68T#tI(yydqz`>xt{7EH%kycud3x_$e3v##mukTcu@C|WL^ zAhYtlZ>ZA1hqL|IJ~x-C^4d2>c@iZ?6L*!%r7)j}T-s*j2wbpSPwtYW& zo?KEUY&&qKv%epE>~KBp`1zR9e^t)ZsQVE=Dzn;NP3OmUf7+j(Jf80C`h927MTjn6{Ayg2M%RqunVC zGPm%UU%jx9bPwNt-vZc2l8?C(`JR1-UFDqUH!|AS2HV?}7*iS#D@XpiVNcwv2#sTb zCvacnTaI>jYQ!40nhDhvDT7!N=~wgZvs4TqHeiG*1n@AO^%13xK)WK3ERqKQoJq4DNBowr6%k6eMK8JrT;gO{kL4(d}=`6OmgpZ zTC1zpizHp^)AOXp8ZVR|pubRqZq#mY{=eD&1Y-uwm_cRjx?SpVg#;qGm0>iEn_nNcXfl)>J3j?v%rOgRhhL|D^4!B8S~_Mh>_+!OaFBCSaO-$j zJlp#k?|4yekS0NjME&JO;!`v$#aP(2vht-6EMrn+92%hB`N`pNmtS*PBH(eY!-qN! z8qw?UY#&eWowt$N#n!F&KV5aMU%tWtz|eJ^&-X%n-+ju~U$WTvKIuMBRKH>Zw3=Nn zyMK?b`#$YyYQgwE{#i{{RiXO~9{spN%syLse^sqYTV;BTSM8n6c~ltL8lgMqvAeob zq-DRX=&Y%B9<+Tw4*f7Mpr*9^wl5?sOcT~-|8I>5LC#Gc?Dwm)it9uluUKAw%`fWO ztz@4!ZMqCry`|u~zB>(8xNh80bw;Y6D*Jw*`^v5{LWcIv>wY#Yw!cT6pH}8zFg@QQ zc0TT)ccoNe@je8;r|^ERb$%@U#(%52-F!NbcDLQA;p+(Zr|R1A^?iKid!_Vxd}SM> z8S6Y>KP<1zn!V^9Z(8b&!Si{RbnUphS^T>8gjbc_^_ouW?>n4cz+uPL8MnXZMb7K8 ztd0Av?fc8>rt?Mt)Hb;*0_XVx_NL24na}YW-$w!6ml=Xsoa!-D*dg#K=xEM(yLFKP zbM`JZ;WHwh!1_*5tRq<)^AXj`F1D^Zycn7em}gS_j|G32gMNV|v#{&0BtY?-UsxDi zVAbj`ub$4!@0n=DdhZcZB7AeDKW7Ei;p}pIdWR+UGgH(`LGVFVBabwH5=;3&_YL7Q znF*-C!e;p2p908CRkBD%0Q}sEc>HaRZuxBBnLZr2DqFbz9V5R&NP7pyV&yqU6U0Hn zc(oGt&C@Za1#k#7i+c(bV#VJfGKmbQ&3F{&fjA%rpg|2~z8>pvFCQT%mvbp-}A!)~)h8`A~H z595x4auTz}J!V~#Xt*_O==*}S<)sjVzy3Oe{&~zs>$&ZC*>-!m@z{+xLEDqD zdDGnL)5vD+?BjH6t;yE;d2j1B(y+Km{|Abc-xBXDTFrLdX*R3EmZ{vE_1OTHO{tyS*~Yu5>yK8F>y9cK_%tC!6OKbzL}ao$!tz4uW*pM2jB zG_zfHA8r3M2t;jWh}o!hR~t#BGU72>Ekj~0ap%Bq`#SNq^ z;27(iD=SZHF)FHJeqs**Fc-gem7`83Gg-xSJdg3knZ6&D&5UT#|5)5kZZsI0PuMlo zv-7Ry2#Df)na~A9ZiW56fXdqCmn@)s$U=JG3(7+M+fnagmMlYt&4W>G#iE2r8DvQO zKHt5R03<^8x1B49QIzxxw3SZ41`9S)XX)$<q_l)h^Gg(MVr^|cE@#G+&cCI+V|I#N<4s;(=d~z=22>#_oy|azV3_a zW38-MqXX|@2-1)rn4ZknO+{rc)LnIS9=~Wpd!rI2-4+riH@pq*d+0xkZoR0m6 z%BaUkDvK85;YnV`XNzQVf`0Bjl za*b9tE_}*4s0hgP^1Fl(LP&r_IjYScQP&EYxX7eGamIFw9Y=P6Cf~s%{?i4Qu#Cb; zZC?zSA9;efwq`O4d$(>W|AJmo<01r0bbvJ6$1tP+4lDvqcVSjAxl+vTeZYr)h|)7; z5e{^_2@(~ostU%s*nGTi-=9N}zOS^tYiPy&+JQ+Fr+BkZ=>CFDI~2ia-$?+!$JN6w zB%vZB=IaZr-9#EQ0~sNavve0_K~@V7y_wvHeHBFaIK%#_a&x+YE#( z5ApewQSDh5nuxpIXZL-#M>1IktM$o!3!GMR!nK_mnqCD{5MZpKjI3aefGm6$Yf8PO zODPM}<3@3k-OJ3`uwK5|!cZYwP2JT`JpG2!?VR}JND|CXB`Fvh)~(Ov&{jX*Dq)>SeTsgXd>+$8AYZxbBj-KwB*P(0YW8^I~&nM3>WJGxNQ6BnV%mI-rxMeC~(GX zAz))&xVY5~{lH>yWC)1qCpa00-PCZfyJi+x$$aP)Mn{1_>F4}5N+o3(2e705zGl-|!IR8O@efD3qQd>0IBEnbV5nxsfR`B` z61VI#Yqm}cOds+Ot%yrsbY^f%?F44e+>->7L0>u&1&g^!0T|O90-E)qr?6+G`eKsr zY-wp}3sHijUGdOgqVE*0TgSG6k@mg6`I#){m!fs#XRmfn=aVBUqMt4#V0w*);HORl zatY_$U>C`zX|SNp=ye5<4f*>I^tY1?T;<%9L2d?~Vr_Y<_O|2~2K$H&YmnRuQ*n9! zv0zSPKZIW5NFn>f0EuLYeS&z8(9#b6%DhGw{j-7&u?cZfkl!vEs8Ff%P%EkXnvQs$RT^a{ys$Gx;B6A^lRnCYPx!cGv|!TMCk8^M(77P zrrC_6z&p3S92JI|0LuUonh{exmDLUUp0MC2CZPh!Dh6*}MKU(G z8k(-W#(#<00Wlr_*Q9PLf388KER2m}MQ9ht2LU%Yv657JiSv+j#m^Zl2yx$;l^KViyn(sv_nrso_bLi`eBS_cN^s zo8bbC)J-C57G7$DYfCE}jhsN)k7zJwP|>6dT%W#Ewf{1arAAls{Hh-g$k%>uAC!v+ z?hrwDVVlenKmUPKzs>|PfXI#birNlr`PS`-0EydMih<;VAx0sjkeE2~_$U`+lW%tC~w#Kt~!EIZp(W}LxN#t}qy5c>vO&PZE^%k`&T8B-r-O1LiP&5z+?-urzQ+iA)&k=#g5vSAVHz(d`S zKYBDMX-XR5;+jNyV-C8`Akbn)+!90z)>#lo^()X~kz)uTnH8;BK9JS5jgUqF`AN^> zSjf3E7;&D|f$!ho^KnSeTb**J!H&fA#kb*uMG2k^xDSrCWfca0?-Y757=-BzVEqld zCbM7;1oX@*8}l0?g1M0=q1%C)YDwSQ-5MOe)yZ&KPDU^Lkc&$v8W!wJ~58R<8XHrhw`45#$$Ss zmX)QhuFmUlw59j_r1#tx_Y!+uL5hBk7P*f8mlVB)`#y*@4MhMsbW$EP+Mu zlzn{FeS=h{$vWf95~&RpLmM;DU)bnp7IsqV5MM%yKvmY@cEXss14>9xTufmZPvLkZ zgSDVb0aLf)y!NQK7XELIq{8M~`p?HcYH^9zTW0V3;^(8P!xCLFHsOf&CI@jv!o5xPuyZ=NjYSL3jl)a6|=9(>cb1dZjlF(M4Zg?Pq*?r9S~1;#mSH#2(1TjR`_{Az@Swh zm$ab@#A62pJt_+(91(IcP0dg^qY8|If(ls$e8>44y^x3O(L@2;3V#7H2npyWHB+q4 zK)=a?l|0O>X;>6c#iJV48K*SlDtP!?BAdzW{&W?$zf11f{(So|wn)p>*k*6#zS}qA zu^%g?0isS5>csZKb8=jhe!LwVz$b`K2>E8-1#c6s z#}lMMFVYZ;v?PTaQJ0Sv-ttcuF%1N&m>p*`lwf`t@~^&`$YA{K+;SM|KjU&fJFCo9 zkVcpTs^|{(XLEwgFK9~&JL!J)a18oI(-0Mz8$jo|+}woy@Rmg8|Xx;$+WyRNr8 z997q>Nus#!82P@cI8}1ngJO`2G~1uKSvJ~6iMMFW#P_WH!i=wHmZ~j!H=!+jsgZPR!rW z9XKUt8ID9jyT|iJ*F!sA*FNmkLjPC<^ASlTC#TO6d21>{LbBhMYp3YEoKahj(~M;~ zf27fQsb6-jC($gBh99NOcVjJ5;({cNc6{zVlSNZs#m) z%D-9qs(hX!Jl}&Sy|>E}T|kWoiCc&Nu|Nrz&2=enml43aBxVF)3KG}#0gTn}O>135 z3-py29!7jyZ)G>0>s8y{YO8#X`KSYTEhaI)nmf3Y9ovIfQ@yXXg_Au1@NAwQ z-bH_Gvt8LY(|@VUuFVnu;qfx0cs2(LQ>avLW4nj#q4nZDPUtQ?`8tM+5r%;MXg4(U z`1~OtusI0dMSudRk*v-hUSH_HSO{LwLf39rNg7`3(P~X75C<$T1ecw!+zij7kZUV1 zCPbaLqNB4}yF~wxjN$gU>Kn;*Iq1`{KYGe_QNt{SMiGK`pa(Fe7=N!`dKFPu{$1K4 zR}eWKi@kJBDvL#J4*W&T>;vj6t>={A9r2IFa@^TFQqc@e1yaB#g%DoQFV^!%P7Q6vmKh z_vNL#sjs~t8%PN-;wPMUdDge)P0PzQ-p^Y)w}WIFCTAYZs1R|3ky=i>ExoGQ_1Z7D z9p0Mn*FvILghJf#d7XyBuMWItm9vowNkvMVj)gugC1R{2qp6@#Ri!498Gz_oTIv3~ zR8neX5|XvrcwVn#dTlPt@j5+-kd(Yk@>?n0Er3{?07yzGPz=jlpl4AL$Q|$mhm91~ z5s?fDQeV$L#fwmfc5$?-3#ADhL zjn?y66B4`H5pnH>>1hk!x4aY%6W@7pBO%gwoY;@8<2;~Gn;%jN(h&A*qnh(^hmPlc zWY*a_tYL{O{bLDZKC+L0ed5fuvi14vM>4kib30k{Qhc_uVd<3G=Y>gkqvjU(^0iBm z*7sR4S+=W^$8G@gDqI$x%y@dZr518StG9Q@Lh2t2aJa z7NQ9awoe=5bggeQd~XR&C|!em&smc`7m}tqo(rv;ju*3Z+>alxcxRK7ZFel1F;zXG zd~e^j5=Cse&;|h~(K%!e`kg@(m_#ErG4jYws40Sq4_L#<1Aa))o`%p|Nf+OG42cDh zBozm8EqY>7ciJGrZ-@Os#)4>xTj>*M$ESC+;?u;Hm+j;B&(p-!+4T&O0m6(E3N~Zv z#aY?Em-P$*jTpAnC<0}(%}>joDk^Ljt)Fo|O^eo~uZT1$M+AAyEW&2i=ZLv9zk0~& zDcAmt2I;qSKxef7{-9Lq`0fRS39+CRUQNg5LSWVUukP#uqdaP_cNeWkegprs>PjqL z#LgCjjz3b}5S|r@7hsOS$RM|fd?vL`9G%kz4vD=n(U>F;QZll%h|-H_tODm7DoR%x z;5bt-5)RV{;fe)EC1GYk(z;$06c($vTkbd!zYW)g zOtgqex~Fx%w(>GCV)l0tgD6nbY;>Xjc4Ap^v(whtP(cdje$k$JW2@;~27Q~bo49ty z)_EKsVV^3vqmzHb8nJ;6^7kvp5P^fe?GtgqSVgEZQbE#xx&X%h9{&3z$L<0`XyKn* z3T2Ndp*YEHi_cN}GU4hyfI)8rZSL(|-`2*tQF7x{lr^a_3YeQPRZSkme=3OKy*EF! zUad8v!C&*eyU5`Yo03S7fsL2-xuIh7@jXnK`$(gO`x@klS-AK`bm-I#-@#VZ^`IGv+>AJ9K{J=u5; z)zNtyX05e-N3Z$bFPpx?5DLz9I{i7p`wA&e5WSCzp|p9IOaHNWz_)QlkIBLK?AGPE z+2y*B*2Fcb2AFZ?yo})v4NaYlkG*aEbbVj!JZgJFr^PDoy54U{`)G`L>-_XuJxA|2 zBjtN+OW`(W_n-7N{!Hm~n_syhne?0p;A2&IvC9oH5(HuP90dd>0l|ky5m^eUfpu5K zVnjqQI{5&_ShP!r>v*ak9La|L1gHVIH_YFZ@_PV)P&K_FhuJ4+0N0^0Oxm~7G#SQO zmwlrKik8f-zJ-KgBQ4Z*o7P2Z*VQcQ@pzK)x(CeS%ZtZD&#aB^K&X&{`}=J@wMYc~ z4YnrwroVrW$7azVc|G3Ncp_HWCO16>ClT=I>X=2qEolIi4cJB*gW-)TT|{qkcAMYE9>UPJjtMjRR!kLzc2isy53#Oo5n%5Q_)w{SQQR#sLRK)5t94`0O7 z>&=?AcxycvZCw{sQcMp`>dHO46CTgJjXrCphX@uria_Ej;4@W^|MP=eOig;psZfUs zoMc$2M=3Y}{xm`@SP!4Y+#2|TS{=dTjv}%N=#QuDUpcv0wfnt{Sqm$u+ZHX}GT(g6 zhFqJQtKH=oiZaVh8$RMI(otebM47wZVwyN5lbVm~i)L9Uyk8A?TBw2<8fct9z#+{i zhu^@>Kwa{F)Nwr!1M-G%Ww>&(<}9~}$0}VfC!;qU|Bt70jIOhbw(yDF*tU(vPTJUZ zW1iSnoPW=lZ}whm&$Z^{cY0Qq2lsd0Q5~`;?BNH!$Cx3`!$S-NXPeLM_y4tluQL1QC#H11A3%i`tsXyH$qwohRnoo; zEPC6{FMgoHEDH;3RI-LAKUqPX-x@E~ce>5XXl$G~A5iSR+~$1)xBaJ!tXI{>Rm=L7 z4Hl`mjr+}xb*}F`vy`G>Pm!fx8D8_BFc_xX4(8li7`v4|@4wYP2gfCZopf4f>Thj$ z((LNNoUGYl2N@~Z$#kpH`nwRXa>nN16ri7FULjK}DMKbAz&Y-@AgjiN_EgG|zQg z`DRb=U*73?oD23$Ok3M0QeGeU!YT+V5v>den;!q-w~A|V05@uuxNWbhgMzG+bZ_D< zJ3C`cgXUdA>b?EW_n_D)}vh!pW zU6>^*$iR)MS-2FT+%AT&d{e7|{LoWi%w8gn_`AocjcCxmyQoB{AMr7j%pb`eqU|;X zZJv!48FeVW#jEEMMY)S2A7vpqgVwbu%gG`aP0jw!2lafd)dSa9e!BhAr@q#3f9K3Y z9dH!us?3-FtGyoo!99A+CF+*JV>irQY1zxngmpj&t#}ewNp1tIWX& zpJ}1K9v!TfIkc2M)-D7*IChS#Y3`CxQWxaQh4cVwHf2Qam&_L zHY%P{>_=Yc1{HJd1Lrfvx+w-N9L6U)4Uz)NE}#OoJNE#GO7H<|Unu49vm)%DE@1X7 zjqwFJ?Wn^(f48B4gA6`EXE3a1$XZA<# z+O6D+GeB(0M9%lJ#EeDMIkra-;zd@15N^>>*qGi$JCyCRZ_v$6eqC_j@;!Gbrx0izoo+||BQ6+03c@s4CkTIq7#p^kR*s_zKCq1c2{%o zhho)JuyY=U4TGaL8m>;vx&YI40p9t!I1%J6)3KE_K2HARq@wMA-SlCzDv~CJW?J5%798 zVSVf7InPgk%2?R^lg(Nz6n!=Lk+}X6s zFa>jMh-wgdvwl3wXTKkL0k$Jhfl%O!)q^rZ&i7QZ#V=hjJNby_!WJPzjbkSr00^An z2a;%eqX={Y3Uk~p14XT*qc;8M2qmhRFtb{xDMEAFD3*1eqjtS%ak#;m0fzc3t%#uo z>OZ1+;>x*(`uA~#R%&+W`s#|$&0t&~Nz?rj8NxlhqA^cTykQ({N<$g4-2MgdRjh+? z=Koj#SE)KoLdgQ_l`Iy zs4ffKKNg4B*ks^`bV4*)7B3pX$sz!}aW1oDTHL+o*W)Cw zEY$@k-K`#d$P0NNf>H-V6`6$tzx~Cgk?fFZQv!t*^mRmLL}LgIk(l9jcHI5^I2*_i@ZcO?B?iWD z-KGEP1!wukLWQvQBj+y>jd)2)dWnEn8xs};hlwK1QQ+5-3zfMg7*M+ze0=%3n9(W^ zkweLAr>9#lW3G54E@!3fb@7B;91=-VQ1=iPIQJh3xIa>oBX1VS6vdB4hsvnA%91>& z#m04liz}~eMd6pRvVUMga9|}Wkm}JPht}j36Be`iAc$Gh z(ySt&t13MR8* z@+4t;$zRQa9Yq^=&?~{r01Fu*3YlQ=bo@XLq^q3%O1J5iOj1#$9{}?ytg4Dg9a+%s z`B0}-$;2{goBgj3J|FvhLO{4J2EjhKo$;OyrpXS4^Q?fgN@N&q<{ND_Hi8u0yF>d3 zoi3Okhy6B2`kRG(DAu#dPf!2&{3zEmV-Y zJ)a0H%?M~v_5$@hJfmDlZa>U@brdFk& zC&$x3u>)FjP73OlCSEjJ+-yu%4}$uGmf3_vPuq_bu}MAs=|R<@jJafEbqiTHPn}Ut z_J=+bWF_ULG;lp#ZDbrq%W|qmfVmK^ z-`}IhM@qbUS)Mjdg~C|^2pVwUNZ}Sm1OYnconD|yzvR&ty25GRl>iOfpn$?TkdTe2 zCQKRv+oF?DTUB*KWc8OmRFk$|A z@x#c+Zn^-XLV}?4qeE>Jvgq?OY3FN)%xUXFTFRv5Ya?E+_q+8_W+xpG05S+GX#DQ9 znU_~n$A-l|TpC8L>S!+1Ujvp7osOmgr0C)5d)S%EEC&XOsl0fn)n-<$B>mhH)hK+O zwGQ_6*gxTsK{Bkjgzmuq?%=nq@7_s2_Fv5CaHTNoG?*&=n2TI4NnjlRDx8s6(+!Q} zfTcnlR+Sh`gXOXD%o0AH8*RE5-<9`vW$j1hJR$+QzI;ev01Ua-u=)_#V0C|zLMy!Z zt-L5bYB3@-1U8hufW${|5T1Q9$T-!+8sJ^<(YcGk!1(+xMv$#th2~|D*%9U1EtQ;T z`B$2w%p}+O-K98w3NpvP0E66mbcU4Wn%kf{1Y<-N_!u|==SY}wgXx|UERryyE9ByX z;_HXwsCT-PU zxsG8h#@{!y*5`mgz4VH7gX4d?(9%pkue)WFiVKvs2uXcl6V~!&>k`^`H5$!Xlym`Z z)-dB$pyaQow3I=e;%b!cV|_dGu)1wHFaN;vEj?)|u@oVrehO^qFyCY zKJ`2iUW0?b_R1wyLVLa4iOQjo1Ox`EOH(YkgLRRc#}=5+mEZyj&}ZiO_{xP$k_yZ- z^W73x?05ZdAJZKsF6QTV$0{mDcqiT4Z4|zSR}@rK@O}Hp`dyDoTCfl(bGJP^7cU%> zmsKYg5~Do{U-jXMQF3l^-js?~|FM{g`?i@=1xgeLicQA)bq!9Xqmvs5m{0iV0TqnR zKW|GYt3;$AUsQpST*AE|n?Z-ag{0YyHlac=AF2g|;13c+>|+_!wF@HWGR9XK0iA`| z93T`G=F2%nmKw1io+W|W7Se}Cu4WjqXS-&A_;S9OCL8B~{R&&ogOHO-2y-HP77RH$ zGqdKiY@`~^T_;D&bECFu3J=N2s}p{Tm%B7{3V1P!5NCx1zstI3UTDFwDQj%i8DW9T zbZ~IRMAWyi@vmin739WFl#Zo<(tbt(FrhpHDvtm*XgbN@!3Rt*!#(nxYI1m}TV{r4 zC?hw@_RU18$N-;?bPHpy8NQVn-m!lyIQ59YKYvw2JGjGQ5rI#`qK5r7(;lQ(-KhIz zX+v;9w^VYS=<6_+vTZY}+%L|BP0=8mk#WM75zz+=NJorpg|>mfJrEe{|fs2N{11Cox(u z@hPeo@|SH*a1J1SB~q!NrBlUrJ$M`3=|NPJ_`~R}`f6M00_nLRm9a1Q1fb7ModKa= zwLnh6Jb+|iO%L^lGXN+W-eK3xCegiA{Evk<*8$zAi93FSb6fSoL1;D zp^A#tM%&VPefYI2F9FXXN*tN!=`PHYdsBnSsJ*$JQs<^ARDC_*h$mFbWKdgffdlf^8n! z>8({vQ1Aiwk%QmxxEeT$iDP2e#Y=8fpIv^!Dk`fCg!)dXyxZLPZThT!*@E3~%LV%D z(7n&k#jnZzTm|O*{3Zfg{c$A|SUnnxC%6CeYn6dG-(z)yV57n>bUG8J`n2sWlJ)T*2f~M0r7PQb)J!=29n3itElA8%ttG(z_uq5OXHehfpS!6vzrE2 zyHNXgO>z)_&Wh_g-PnrYh{x)MbCUn6SXemDzg*?fQ^4HrNV_~Xj34rwPgbn+aA!EH zU>sq2xd!7`i5Ugx-i1;zo15J50w?QM&THtxuZtK4i%Y*stCqdx$*1m&M*s(9yT)ngtBH>(HFt)+BJ zb<#on5tf1H3B)V@6vPt3;7fKNxvr1)1qq}G4o$55y80uEV8bgj3)+I;{hA{M^_7ba z8uY5h&(O zKY;>3(m23b0-Zaf15g!;u#nM&3}Fq*t0ovbM`6c=xVIC~XF1kG9Qx|$M47&3r0D9- z1u=)n))c?K1hr4YE{Ja=gc zsVBH~qnc`L&R!$=z~s*Ggl%|F>S5TeBBmmv`w)iN@!ZI$q3&-7(=}z;OZuma(Cdo! zk*`W%yp^aP!Vd)OD8>|!-JFMYjFVLX2%=wQUH*KKbaniU`h43imspsQ9YncQqyBNF zL)afAjCRfn;DDYtGCOTq&wyYH=nj?Av)#V@c<3j5{k;l&nO>*34C(KR=pdyfB8i_r zs$+F-zsyJ@;A(TY?9MH3I~Qr%3LrUS>5Yrre_lQdTWo*Xk!rBf1Qo?9>*jmxQR{Gi z_d+BD9RZ|0E>s6Um~4#x0KsFn!mPY(?*fsyD2*avr~b!+8`)?SRPFxi^ZBaM>sH|5 zWBiA}LY5x5PfzQ2@HT4kkSHWR2T-q?+uuD*zAD;qWb)t;g0fhcw`#-1o0hX$t0DkP z4C=w=KlYhPht}EUb}CTM?es)lT^Q9I>XAQsOQ?z(%ITJyt#8c>&zI_q9a=Ykhy+I% zh?{n6I%D7yEz*f$(fvN-f;*z)i8Bqx$8y{%v9GaSopFn^zn}21(kU%l)< zQX?w535OF2axMJY(DS`4uA2->uB}-@6$FG$UZ+_lM|%kX5K? zBW$Jt{MTfW3w%e>4(nvctR2iOnat2&*+jON1waUJ}Bx;Wd;W1|qOq+=U{ z*=T|IhX0$6_UTmF4A-0q{4=idJ7U{e(MjKAaY<|YdFx~2qa*jlttD=?t|IGV8tfuv1esvVZFZ@Eu~XeNCK$nv7#!D0=9>T%yBe$Gf-zOQdOCzWuU zeiW5>T%NMs&K!SuZ?-n-t}7Mtn+ib8Bmx4(q0x?7%@Z>SNlnq9rw>njjs!OZ$Y`ESttKkJOXHmRlr<@ zU~`bRYH_s#IqqoD>9LB{rX_xSd(lmb|SOHU@fT7}iRc^u!I?tDfCH)GLuW{ zYUpYw6GlX8tZr;N>uZVZ%oevR z)AWSv>k;}7H8spIPtq`OR`c@KbsN0?gau7CMM>}~qex~kg=mhkslgW$yR|3v<_BG}OO-tNcWDp!oQIA(a%ecU-qH9D*L*hBPdWPTGnjXg}Mxv3M z=Lt^LLd4*(1`#Pbs&W?aIZzM)zbhv{woG`vo10bLm$nUH+v~;SNB`!dwv5C-79e@P z$joalkIQnQJg5o%Gz?+FM3Q|abRbLS+{DNVH zs?%zBv4aE?7Q~{)i1H;B(FYR&zD^o6#ALn(V^5p2+0%Kf9i9`$2Wi&2VQ?;7J`^9y(y99JCTJhJ!1s?GYdgzd9l!d##$l%7-J%klgs3^+plk4SkOGh3ltjowUpTnx0A0+`xWH(_uP6F1ws20(>aSU z$Wl(x_XY#rLvvm{#bIFV2=bf{r=X9C)gS|R(SBjE42-@NvByPl z3Jx?9M+_bLuWa!B1R*S`eA;thwD@UF8Mg)rR$v!rRG?fa84+;yb_{b4&6xwSoeB}` zpDt?1iPk0h?icZyP2jC|npzv2y?Ha~7#I%3nCY!D4*@@=7jS3;>j%tqu&t4u2Y6O- zaSvrP7TjQb;SvH@E2?o-Q&#CX2c>hU@}ti5?27HHXU-z1NgX#1R7x~%Jm zMgCW_JAA?*F#iRg(Jx%ob-J=!Bs_QKMkMgrntR@j(gDxWw;Z{?`Slolnpp*$JUKX+ zP`h}07^sS7F<^mun5ZqL*xjE0<8zkD*ZTc?L&ryCYvVvJTVy3~jmu(Y6h+fp&A!dT z@)GsHtX*n}WZy~-k<9#4ET7ctgZ9iY_u(Q3f#(yvK}lY;A}F95A^8N=&9{V&9r#>M zsEOM<`Em9to0aO=Di!LeJyIyQXGEzHOQO<_g;h*qLL4oK1XB?R=tT(GVi{zMeJH)qRU1_T(l}l5B&zYafz5X z2pQqWgo`I$GWLpHj*{j;rI@;9hokRUq{cBR_c$N+-@kj%70 zGd`oIXaA;)ph}Fp$u>fhg&AAZ%VI*fY*|MLK)F*syWp>7O$uy@!%?dm9?eZO5@x`b zm+n{unWX1`yT+trd}#^3CQ?Vb;?u^ABKdtj@K`4p$Fyq1n8$CaiArM5oLQ~wX!VjY z`X_8#7en*1y*yNx)XUkc6YK(^HPsZ*z;cMK>!(#D_Sje?e--bL$+9H$5d}6Vqr0Jq z!3BUMytHmM`+SloQJ9P8&9a?5wuWDuWe1oLz_?)p66yF6mHbiRJY zQFVgDZY6ErIEG#=GW5?PT)R zia`Z-yaW&G+}}2Aru}1)&-k`ls{8K$4z;!J z&k$CBxIM3K_%@g}`_*UuVSo1BD)}>&obaPmtw|};wzY7B4&K& z$RoQG)c-6?Sqm>Ln3yjG2eCH$+@tY>ntJwTkHEJ9#7QtL z9hK*!nbB_@x19o?8&F%;z?akd`|@>{5kN3&8ZMhN86|G<`#O}fiKedhv z;6$cg>-F`I&(%+tQA^#=UEpVi%f^SpZreS6*1CFW)cSpfR;K&zw%gHt zZW|t9$IS@gQ_P0Pr}H~&)`vDf{)a%N=P={PSjP`po##KFHxiM0{gGP z4Zzb3=0!v<0Wwh>z^L@J`tN^dDl#C52poL%ILwq6g2Uxu6;T-w0!qW$zFp8O_u+Ci zA<$i3e{RbE$OU{0qUC?1es6yC;UC@k-gzz2`LTf6c73?f=wNZUg3I93Kbn~NNy^x? zOM4Y5m(J7ZZU0FQ=kv0$XbbLhul86`St;;!)_cxYt|b}?TJc4(FrzXVSnEM~A*FUU zBe1T8_3Gf^C9l)pGm8qDmO5>>*w=?bjUAP%lZua;K?CQb{ktS#Nu;EO#n)}rh}3h3 zalU2@i=#*SN2gg(v1^9Nrg+SJi^?Jl7_!%f7AGpKr736CLv1K^G*b1j?#OctRJ)S! zd2Jux2PZQHO5OR0jdbIC_nb?2|LJ1e)xnVTqFA-tu)LQ;4o4pjz(mDGpXc%#4{f5? zeR0j>xe#lHG}bMV>>#XfdowNagCcFlFyJrk)ZLJ0R=c-d&+{ ztCE1}R$*kyodH^lG?SwL6;Xp_UCus$6vq=NXo)W-srE9Kax1DGf3R1~>Q5YQ%S)e# zfmve%-0TRj%L|SmANdsvw6+5N8F=r{|J~{EcJ~}<)97LLxlvxe-O=89fO$|puaM__ zxuW9zdf{L?LBQ>~gaw&MI|_H~?mF;~#k)--xWc?&WH5W1s+{!SQZcC-4&llT=FGG< z%XuI%&`Gz+9U%W5);OyRx|>&j5n;Oc?QEXV@!3ed_HU99Kj5eh1m(q{eHy7m7_4t< z<=}&tTof`I86M>0Y~81^*828%0?zv?aZm@g@+}3?=QP~Ki94KUcbl;DR%i10V{y~* zwtn#9eW6s(<0)4!`0;IdlkAvfWFkYa{d3*tA^-E?AWdP%sO5eqX@ddTdtb)K{$;Of zHsy7o*X46@^YcW@=Xij&g4c2I`-KsVB>?EL`su#6Z4i6^vA?VLv}fJ8_7+d}(tB3{ zTyL!BGT>=?T^*dvq8;4zM}`ITl1qOr@c94i>4w?UEUw0PLxC4WOVi0dmXeZf!nZ{M z?`?+-*Si){!jGdLB0two7c1x)NXV)=9YcBBzvX5Khk&pGj=d>0k6ga^DrhX>9fZV# z#kU}#bfcruumN)M;LQ{AHu)dAXn_KDi;bQ5Fzh(xFa?|5w{e6HdtD-fojmiq3|#^n z2A{KO-XhU8^G|;^?>WM@>II%NUppMMC7-)HKMOyfvV2Yo^{P7OS~!lIoEiP0Y-}lr zC4VV-C=kbQX=kIq%y&*5J+kgwx??up&YAV_3ejdl9e=gS@d#zsJZUif3+D}F$#kiYgQr;&u--Q)7Zhou!Cjq zG^fBJOd`LPmjw+VFY1f`r zG!1Xu`WqCvxI%p1a17~h_jXZCQWulrX-&z$@yanXDk_O$3W;4vly)k6v%^Elu#WTN zHM@g^DG`OYaHFOZWj?1BhH3=OZ^v>S&v)01?zCT>jQ`6df0c`z)V6<`TGOvc%hy(R zPmOEPo^~`{Ij2Wxq!=XRbX&h)q-Qwe_SzAu2&0RPizh{|WMFivy_*X~ogD@zDq*7^ zbHO}lMa&{VA*xsJxty80q_Fx9+~ItLZ_&~O@6reN{qqe}q{y+PU-Bo2MY(Hv6?5x1 zD0q&(*@%i{=r&*%3~`nUmKFCRY37?}N?@rESY7u4nTd%orl;Xi-qnxU9N8W=f8o#AGixY)u>w( zJK>q7k!8c__fkP*W63(}KDI1&?Df|q3uE+>BKG3?YwX+Z?-DpG(J!{U*g4atAfZfj&d1_$Mq3Akped#7(T(J8@+$B)5p>R`yRK z24u?^GMCIRLmI=nFp^>>#b3MxD#ly{k+W>$HFVGv- z=S4ga>F(Vn!Rx9DlsS(T)aqAI?y& zw^e&PbEi<42Scyha2z>P=3cw9oje@YFDRhVk2x(ij7S&{X#%1pL9*)?XqVV`K>z^= z{W*Z2Hl`lUTXl?ODPaMKjL(D3g1V$v zY|4New)gg(vnkT{qQ@9woQK7ekNPl7E08+aXvnZ*E!ZGyFKeZ~LO=Dv;cPA7qP!me zcJH)-U|Ii(m#?@J&H;cfu92QoC_uLJzdc!ImXQ#FBMCwyCRA~m+reD?W0B614Jfh~ zM3M#wLlZ|fY}5!72RWLmaPxmlEES_czJtsBj3;y(W`B2!MwX@x0V!ke1K)rUt^f8L zFs6=^hRM_j9}}CJoE%s7I+^u$r?aV3GE$z@@nrs|6;cp~C>$_gCTQZ!fer_fCqtYK+uaOAnz^6|YMk0Z-;QqA% z;L>pd(>OI>k;t;7Ac&z92_CrS^;LTZI)=LI)uF$H6ALu@G#^26TEfn$L84cvzVk_F z;c(Qb^`~~P9ze|D;sZ={1TkCcnm*DjbF&kdWgozklmV!PNF3D~h5AeZrnyW8K82r9 z?JmDK%+_#F0Tgjx8DO>5Uw!C&0Jvd97^8)-d&7w{OD=70;i9&eb!8e7Hc@UoR-|}_ ztVu`&v+#~9Z>nseiV6%dQma@B=5rlg0q3}cTDZgdybkSe#&ts))-1fliXzH?EU0fh zZ{Jd$pS#y~c1}7}!0Ez!a8Ua#n2ru-g(b|LkfoMdEoJjb6u`4<=`bWEsCA?=*kmL^ zrfrj*-9=@!0yan~1paN~+(CkzCZ zSNSrorc@{5SR-l~vbN4xx+EKN;t)j3Ltm;B2`^sHVc&LFDbc));Jb7@aZPqy51f8n zlV*t_!=Ql+VQ_6Y{~puQmx?e7ji|O1xxN+noH+k$@E3p#E=f$WJFS%U;tKwAXQ{Xl z6fi`C#$Z-aZXC$y)Bmx-vyndo0(UG4vlQm3Sj<_vys2>^x@VEG#NLd0FH|+W2KtZ1 zcZU8|W|~W@EVtVYM)cq>pUG0pRZDsa=i9!-{pZV??w9+qH$x^LEvJkI?s5?C zAB&7U37;wU;tc7Vk(-Hwhq;|+)>BJdT&Ty34faLWTx&l3ullpInqq)VBF8Tp>hY4t zYx3R78iQN`Es~~u6jqR3lLeA*QECeNxu2gg!1NmL)YOK+dm(Fq$hzs*K`D_eZgz!*rC_#@gX`Q#5LB7zem12v?a-4geZw%SbecZVd{|&D9nK_2 zaIA_CcXBQKNQpf@aBTxsQIcBW>CnoKGC1B$HrCbK+lF^zrP0N0@kDu;?8yrx8QCbeFcj9{s@t%VoBQ}3RaH_XypV`*ULX3iE1 z^55ICxv{x{oy5;!cwga?rdeFNOU-kH7rU|=x(mk~GSG%+$2J5(2^1;xudjoZhuVlg zL$fsZCsSH?Hkegu3DwOnPP}s~Af}kcB+eWY_Ft>#cO5qgm75+Ix;KV$%dMt=v20+qBpUqT zvC6~K%Rp=)8oZ5ud0st{zCu-5R{f?>JYrDBXI0F-O<+2Hc1T0f|LjoFl0nykQI`49 znuO^NSV$fw)6)tNc{S?DcbQPjb;2p19vFUGBPA^%f$Rpz{K0t4qe|&U!4;WE29SU| z!<9v@|I>wn2;@`&4xJI>^K?I=7p(WKwa-(EocHZUt6T!ArewEfIDE%>#(iNZ*9wvd znhXDDP~`(4^ZJf***-AOk65bZwmsqb;unr-UxflHvtSu`jaUO{nf~m#FZs~z_P*Mg z&%X8ggLtMW82}Sz};h3(`6=|(qz3tkPouwZ(TXy|-?kSv~^0!{hhj#>3A#Eq_8 zFw;E-Bxu!WuG54T+74)=Tbhlvo^`w2X(ZR}0X(tEgZXW6nmAU)1Q;++JfId+kN28S zzRaQHGWPxpqZjoQUJO#G)oFgb;eSx`fnffo*10gakm!FSa7 zTP75A+eIHNP4Pq~e|_DOfPKGEu@xR|IeRu0Z3dZy$_Zx}CMM?1abRe2w?!{Nakz#` zT}#VixUG%T=cucrzc~}IdYUIS3fKC0rn%m3X>MHo{k#6-Q-maiufp2#1U)_D_OQw0>g+WtCyUf%tYC7A!|3q2i*Fx`hG! zzM~}?Du@c``R9?7hMM}zeBH|~MFV0`AOzUQv@$h|+NoCUxK*%04jek5#s> z3*62UcsPdXD%E?>X_w+-#=bQ(&Bt7SXfwrMs=d_OY`ZKS-2S2amQ0IyxqS>NvzT-+ zN9(h*jMAmfk??f&yTj|<_^RhnfVN&m8N;5NzlrxTqHu$*3&#+vi$#5r9|;S9J^f;n zV4s>~4qx0w9=-oh7e=hhLP{`)2*kLic7aSA1cTzvSV0WBFFS;qpiBk!*+7u8dTaCu z?AP~wM$hYtM;`+3mw8&ox9&pyj*1b5U$81N*{M{RLO+=CWG8^V)3lf#$TT`j#|zsc ztpqN7Uu$@h;?`f)z`NGA+XpW* z=a(}3C4b0Ak8yo~pwl7PWb@BGRY@^nKVzaqs$^-LAFx+*p>bNPJV6b(tG)M;=WNGD zcK!=LgRci3%nT<|VE^-9D9IIS(5Yb@JTNkb3|~!oK8C94I=^qf|KV%9g!$8XFcdR- zfQh+778Mn;N0b`azKm0DUOxT8az!-NwkZjQkgQF)4c^*3;8@1@yTYWCnL0J` z*Ec_5(rjl{*$h1GLRvSVXu0`Q67AJZ6dAZlqM}84WW6M84MvayqVFZ{F71d;g)gn4 zLB6s|qGagkH$6}*ZjA`g8oK%cWn*%rgxG*)A++N0a(0r^QVTXb0#4U1Yxsu52%)~_ z=4P8pIHOrAguyvD(e=6&lYhF1jtPsuQk-PL*4l>=c|FZ@s`E!`Zgv~1i)qkAtjS|jQPE|dGo;I{XYKveIZlL zYhMai0dLdMK|pe=aMN}S=YF;GR<84LRp2Vh<>RSPz z$#?x)@tpsiu>IsH;c?A@+7nLqAB)QiK99`nv!GqdZ3n#%668GWY;ciuCf3|~y#5SP ze`Dg^Gu+LV!+U|ZJAWS4T``=Xyo@cv*U)(t1+L~GyH&{b)f5RI0lF$frn2cDC-{1pLyS%5DU6?? zxWRydd-=O+J+tQ3b;TBb-U-3unEx`pa*P<^!J+*=g0BV*Br}foImw!OaoMkaRdUGB z=_?c-u}5&B{uM5&jy;_tK|&VJF)AhwCDoVRH5*LLf98@O);Flei#p6Z`ME4(YrupF z7n&-sRV7U{qfQQbZ^W4;>cOzOi0}Biu3kbmUc)966bo$>CJA#yIW5?;EdrHkd!Hbt z>n!bj(|zkKyjO1w{|zJA&dH6aoG>SH(HfymC1|$i^hLHr0G67=(@)h$;e0&6<cSDKtewk~m*b)WNdz<)1Dr%RWcko3<20^(h>-wg^hY$s}XdHA)j= zbGN^t;$}BLKlk?sNgh5sT9ntX5N-9mwXut{eAych`fqyP-gXpI$;=SU4eP&Qla$@s zds#ae7#mMrg4Ir=$JC=^k}y&#f%`=iuu%m{ll)A-4?((No?)XMWeFoOX)wZufcjxHQ=qh^#HbuY^V;9=*29+5$EVd1xaz4c5<=E9Xxk$r ze+z4l4e(ya=jB7k!^Y=+Qv1F}O$WX33R%w}>mQ4Ko^4>KnGCUl^JV+xoYuz?Po>v* z!e!foiegWm?_=BJ#v$)(Sa}BZkdYy)fE&x~3M}L1uHN(f*Y;wUkK4+Rg0)tDCD6cK~qTuQ31XyXlCZuUk{{eodG~BWKDc1i%QZ4bf3)kPA9|K zAFFRe^-xS9{)w_@w*uO1VbCE|aW}C6P!m}K>!GM1*?CxZ+;9#_FvSD8ZzW(J!2uga zyk}$<6`N^NyXw?1{vkhCZ4wDujC?eXsiJ0VD1HSg7Ey)GvdN-=n^^wDnwbml|9HNr zPr`3=+#ETWP!}KFd4jBlcqrklWz{f&C+&bXCKf~a$AV?CJ2IGny_5~N83RyGmz~&f z&R~|ZRk3<{mNd_jOMsmQ>`po5JX*W3V>x-1dhkD4}tGKf-R@;1o!bBnA(u^tsP` zCFEsIU$OB)4zdcTdIW^Vu1lYef4|TGQLeGXE<0gWe{*R`8XL=$L0Ai?TK+^5aB{nNDW4vqV#oV4F&$=clga{P(uZqDUi)HO&N+x&I+>8zd>F zrtL6)bAgUbE}XZ^Ovuyl(O+zdpL zW%k#J){O>5xMaTF9C=?G6@W?V72w~!7^C7Yna87%Q(sOq5vz-5Jl6FyAw^Tmkvo)! zLbF&@jU#GCJs&Wne`67ELL-q|Gc_A38|R&;NTPI{9vYV?MFuShO?N+cL=)Mn*q`X6 z5&8NqZCT3xle(TmQPeIz-d$R|>_RufxUQpveSDNGM7NpkpDu=@1N%a{eDyg{m?{30 z>W+W`NRX3OA`+9JS`!avIlpFL3@w|QnN4uX?J$w)4~s^m7<rbe7lFJ}z7crDv3d zwPmq_sK#wCKY|8zoq{S#fS$Wrz1xm%=EfdgR`iG%ir_dlvfwl%0say6%J7SP7u7$a z@G@m@cse`>hvNzvI^S-T5VNKsK&lbJo&pKsj6lldp1==H>jagw(kF7ZwFOYG-xi`n z4bgsa=q2}NBD_=yxRX?oj%gzx)lG2JuzMe?@|RTpFee3T%|!;)=$|N7 z8q9J#ReHG8oid(S;0`X88W-~4LAD+(ougNxy;$w6Oqf=ocMY=;^jL{)2EyCz- zq`SM3?(UE-rMpEsq)Spj@Z}fZ{R!XC+5J4vxv%S-%EX)YES$2OawUq4C8_`S1gzBX z1H+7nr8P7-YvqjaB}*D0(Hc_C0<0ac(W}agdukI&AQeO$#@9$5aMHRUD?sHSp z>yRTc!Ta+7VgMcDX$loWt}|QN zsnIj`XYcI(XS!`J?|>J3>Uvb2CbG{PEImThjGs7!7AR84i?5bo-h}wSouq5YGs!?j z)0&i#FfFU11la@(qCWIxGaRClJlFP4adu!WHuhtGu>Z6mgkXs&ra++FIhn4G^9KcO zFqM)t(>H(Qhe(LDk$y^I)<<;CXhH@ckpl&C9dFURROvd?1*qdJW-9jC&2`*YTTXYw30=-&d3mQB*c#8 zuZjidTEHp;Nh(U9`2s1RHtq#(7br(1{ZTHjKSkR0gr8~GO=*sQ_w@O`e7m-|(}|ir z4CF^AKb;N!4jd_d9wOw%#~5YNa@|J4Z$Wupdo@Lj0@BKGa}6PmCDz=uLt0nLxvaAJ z`wRr2Xopo(4if!15q%1ju`PdS6akuHJq`x!n|7nQ95)+_QAvhWm`n(gN##8pzHrB% zj*+}S!h{U9BBzO%|Kl!Qpw1i-CSwQ*;t8R1MlCF%9>%{A7@09QWTpiv%Nf3kG5No* z=p!p;Qg8Pbys~D=P|9DM#6;Js|Hl%qv`~?H;jSc0I5|0rt2Obe=k37ix)63)mbH(n zj%kEC4hbF3t51e|PsTa;VHOFpf&!OA95KePe=ht;ic;Dh61*LDq~pqZpYu4k_;hWY zLkh4+_@?5zxOnz1kxn%s%?|^Gy8#-?OI7KOW~)8%@oe5u{pb>kz1RsW^!>cxx z%Gwd_fUrWq@IVuanOgGk#gK8CI*W$F0#J7kWnn<8c2(SUsY}Ac>gZcwELFz^MKYlz z`~Tjr%bU^DOiOc~I-R|rkpxH6ySO|?$cF=;Ua+ALpNs6Dj>QN`x0@*YZ}a*0daFN# zn571M?Wkid?+Z5+RqJ-$X-p+u4%DNgQD3$W%hQ<}6*!~sNq?j3eC3Ijx!9L;HqzL$v5z!8Ld-Z8QWHe3KhO!>|2GUMWHh+b_)57Pl$eVra0ql#gVPW-!2H5@Ijk3Ge+EAD2l zLFSiQ62`_iq~NED0sj8G>qN=l$@0Cj+6o*43D!%VFp5O`mpdqsJ1i`#Vu`<<-jvi4 zv91_~4+x5zI3p53pL&Ul&J^r;Cg57s^KoZ+MIMR3GU#$~KH$wc1prIMlL|l+Va)## z1s>k}w;z!9Exo3rVdouy0S13fgsQE#i~#*(Z!+ukmz=cq-qr{aJrylxBJe@BO)`yLl=)~#XP6k-1S!m zzYvSTU0J>VSf~z+ulM`=cjE8i@!Cf&xGuotV=F#PXbT`;e4Gawph|x{N~zWTD(s)3 zlPvy%jT4!o@1Rl0ey29wHhCL=CLsdy8kK7~zwrkRAqT!LIDQC7SfFgt7xqaMZd|mV zrYc{Af&~W$5io_l(6)+h#{CFT&PR2+iywWLC2-w?Ja};KvLK=PIB3(2Hq*C&S-SvT z!*NGzcKJhaL*25wyvB^N?1{G7Sxp)iRaIl&%nAr1KQBnxns%~Rv$_SA7j*lGuV5Kq z+#hQwf4i|nW&MJx{PaXaUE8!mIuw_?*r%Wz?ER|D$$`=;q8>=(2Lu!)$jPCMpQP9W z6j(qWt71Us|8owMsQM+l2;bDTS%nYN`3O*hrnA-XfPozR*20jjIMI;__Byg6Q5 z(MnbQtjhho4bz^IQaL@KPT}VwDRl&y988Rku4>p@z@zFw_U1gGa}J0sd4c!(O;z2r)7sQLOsw z&*a>}mq^F0Fp#e6n~}bzXk)`Y78v!uo6!V$B;>ni3@wKY-KDuMPZxB7R!t_Bw9Vn5-@-&XJjrjGOeuu=9&q@&Sw!(zp_aL&w|9=6 z65k1lfz7R$@ke8NVzKnDcwgh@ej)YlBtbFH-PF%5TUr5sBuCeIbEa)LrHpAupg8KB?C6lK{ zXYkTW`3(=o+Wl#gPT)TlHPXI3_vn)7fyq{KKTIqre0ain#$lS;Qsw0wh6s&k&Z<$9`>3^EPU0c)h?c0uV z7CtaHt6B~Z6NrJlZwT}=F#v)IF~GMc%W6AnuT^r(i<^fcWnRCxlvyAH068>FMjW}a zW26Yl`$JzjeRBKwbWtR^U|Qd4GRj3zKYLQNIu z6gdMbW0Ko~x9FfjtQwQd75aOi$CDd2YC*bmE+bIoLpJBz$^EPBfpOO?&R0hcSp<>2 zzcGLzuo1C2pr3w1tK}i*KNgx{5B!$++-+#@j$QQKn*0D!NIiP(7`Ih@{?OW29gMy7 zOb-^pHo?(Um%CSztzQ(Yma0Hianm=~1w%CkzgU20i(FxwXpiN!-F@YdoSuS&Y+YmnHWbE)WY< z1&i5yVFSZ=f=bRcvNp|M{`Eovd>ufyeO2A>^yF)qTkFqmt{=W5S-l;%A&B9O7dhnT zn3O81-LLBGsjqKQPl8_vC6~-prK*rSI&jXcF;e}=5Rwj~ZR{NwJ@f{OTVPDd@p zB*jGPDAOjLL6ZVuXw_7WlZe!IJTiDJ+A_(^v4By?6muVFyCADgBTvLcD??VtPj(y? zD$5=zAd#wrMPuCB#9ba0-DWcPf3NOr%j^jT5dw3FcnL-%?JDpqWAV-37uvNSzqtO* zISURnm^QU95%ciyG)A%#sG5IH0-b2uMa`}~#j5`n0AN|<)a|}T1qx^}0{rf2Bti|9 ziYx|QDaOOoA2~m89|!s!znetH4%=sT>-5-M$n-O#)2~Wt48=mtu#p~+914zpXi5*t z`B1ffKK2uojV`j3$?3Nr^U`(|pMZgUsN(y{nGv=39u3zcGc7RjdQj*2jx^(e8Q81@ zLTcgO`Hqcj2N7_9eGCO57aUE`sfX8pdFkKTA&z#&jHt2Z{Z&|O*r6o%%js9oiR693 zux?`Gzy;0e+cyNCc-K{ylfBTW-=DjG`=<-jDqcg$T3)KyiJa~Z-!K#)zOJEEWRGF= zbjFd@53;f?W4G1kt)|oRnXJYnu6Z<9soCWDd1oOJr^7}$wHW1r2-dXxdJPk1<8VP$ z80Kb7kg8wSlRNNhISq6$dOregDgqHG;P~?VfRtsVv+5<^UnoU1M7iO=#j}K0fqM$z z^g;TIJ`Mf%q&O!&IGld>A8T*8$J&C}p4?ZSragl?cDM1ne2#Y=dMeOe3gZRn>>Q&V z_M`K3Z0IH~6aM7wfFzkCl6n&K_B?7N09gJ^QG9Y6T_SHxI9ah3j7=JmKnp+enHuX5 z=_r8OrjCyK+&9qx4Q((Dd2@=egLQ0XG}1p7(VTv8gbE;$x467~4HL6sU zvcjb$4_7k7qMAwslYFAO_HOT=+~<7Xl=OKlVq_#4fS&GpWt65$VUiKlstQUUJR=ml zP39002Gr*@rK|}^iB?MdX^3GTY1<&6IjV-+X5}vI%$b2SErpDWWn8t?Iu+vv`yE+z zy9})&!D4V^>S?OA&|{nVpp6a&4)_hKm#~J+GN)y=<8@-^z%C?C6rJxiM10O!zAz1p zbMtv_!9JsD6#VQr7adHu3S^zHFIh4E{bce)f|Iyuij;YYbr{~<3_-h|B$cYqX}8;! zc*Xsd;BIA{Mi3aVNFjpiUC*jB#Ok|EO>XtS$0t+h!YI_3o(JA+RDFQbP(CTxMG?uTvA-oQ3RN`b<9J9H}EE^6B&NEIIJo8 z`C&ed2FjDsx1kwKNYT?5)u6ed{u0-E{o4QXGDqT{F4Ce7Ov@AdOn+0a6_iNQj4HDs{q=U@|rqPG-_F>m*^Q5W(j(@IpWU zU5w&K;Jr~pP*=23!<(LE%_h>yalGr~rhpFxY$!ueH=juA3T^b#)Eo(9IG#c^2l-JG zJqp4e)xj2}w>P}!355~^31E2TvrADbamH)P0PnTNmsC!Z#K7gmNX4cJz@lzeG8W}~ zdiqS-$sU1}5#aWY-kRV*Cui<&NbHX}97x6RtCEQ7e=M3WAk?dgRd$(3`g?gZoA1 z8%A_R8l{CK_a6~TO(rt1E%#ez zVaP}a6Se#A&5D}N;v|7-VIh4MR^6?(Q+zMiO!lK|m|+MR4xkI{oH#n!6mv*wv+zb8 zugAdX-1@kQ-WyrPQaD!}bvI55GyCW>!=LXIrFXj=zbm-^u>hgC&M)vr^5VJmj#lZO z6A4H1(ztDSc9REiV&jZ~|9*>x9KIw^;!C|-x3*%8{FC&yHL`;a!eCS{O9ifnPQmM^ zsmao+IOR5S*XfO;n`INKYO*970geKh02v!7C0`p#Zg7#0208p=V|K=eKc~a!Y0B{F zf!!tNuA2Psf*konKVQ7A=gHc+ecA5D!*&T-Z)$7&+mmg}NO=}jyltUPo;190GjVWf zg&p~5%a4XqRv1-y=_EsJ^X}r3QrDv7D~_t%w&QM*D)VdXsy7(}7AilJe`QIs`Q4Zj za|o!KHnQRFI0a=kvElo*ybu}V6$7G-&kD2F4Nx<>zVukaB)L^gW=^gsMUt}gARs!;SK_V!Ry9kQ!p6)eQ*85Ysjs=wn^WD-9 z9&q#$wd+PVQO`p)4AjyZ6DStB+I!*C1L7*8c$bBy=)QR)Ns0!=k^Y2|;n(qgP>cup zj&}nzWCNYPma6F%>S@A**@M)^;CVL-AMMOP?a(${cW!8s*J)5VBFQ*_a#(>A0YRg? zRvkpw>(3$L?JyhEbX_|L8ac(B$+yDWarDU*FWbGL?4pw@MXTYsx@MkcU@r?Qr#d2U z#F!q~qi2a#u#?#62NnMEc{@sXO! zka6LEmp*KSc3c8blceCH=QwYYg3@-k<3Dn5G(C#Y+VtrzY?<@ zEzW0Mj-F$Qj!wo_R>s&W{aH^3gk}@j!rtdo+4CaUa^XCR1p+$LL;q)ikf;K&%JRog zs$fU+^T{knOvKv8$q|Sob&959Im#lTFw|#HLCB$dN%qC^+(YGNeQw%()HLMF-ViqM z51AehfTs3fjEDvswI%Q)Qd+pzZ+lW5gG!g?P~FAzprHAHjqct5`$s&8Lh(_e zAQY(=4Q^}gdxHFlVU0~aDfr?M0x^TjUq`f1h)|k&JakeVg2r_FlkoFdVj8{&r0*2m z6}9%RbVL}{8-5o;e_c=-WkUQ;*0vIlTKEeBjv&9x$Cw4gZi}X!Tp8kQ#P}c7mQ~(N zM!wp%`g>oH*Kob_;+U7#$PkKGH?9NiR5VQ~@p(g5sTYXMZG3*sTX)j4r+9jYTCRTL z6I{FH6D`U8J{Gsv<5&1wMdo})h#Q>%W; z43Af3&3vz#F67dDeni1!ijs)pPt>yv_UgZ;esI_?f9G>dC>)y^NxED7$zgYgTz(}Z zW3og-B$G;O)#>*}uWTJ{0@DeCD?%9q8m^ip;4LL(`N_nAgWrBr@pTgPASg%mm;Gnt z0;t8|S3rQRF0ydYDYu^5>EC-J*C#@0l>jul)qo(BG_>QE@j_eTN_wbc6>5u;){VBu z(AuXt+;E4giFQ;=F6_5{Av$Q5QSSgKxdX#z+~W9Px(!cN0bGJ;veE`MowS`l*T<^n zD;ZRLbdAU79dq)Hal@l@;AJG6$oi|@DR~JY4i!*C)$JRA7y^;UpyYF%NVKU)J^f*&Z z<96-rqS>d@ZL%*N94g_!`8okYFBdPP!a%3RpeP-}x|D|_{oK=okw8=HI|SUp3&Zb` z^#eSKhn#3R7)s^QTNN46CpD!#&ozGCv=@+nclOwP=J*^(!YHPm)ppA(ZCBjB&enhR z|7^VHdb?)UrC?6O+-nZ=@_R(5_kHK&q}wf@K3>?@4PzoDPFeik;|#!#o~I8iy{8_S z&_h=Ia`TjPwlqOK0ItUzDy97L{ZSZ&yjMkq$Wu6MP>=+pfKZeIp!|x<;I;1hK~gMI z4%eNsf)O8H|D_BdS3D{qNP#QBSjQ?#2;0(T(i}a}NinS%Mb3)6S9_b;is>O-HV))R zyZl3Af^#rPFvCT6$+Y1Vqr73>vTg+vsj6v!{HVO^gfHXtyw6}Uv|*MPxY~J}dlKRz zOtn1TM$HD)WbnlgaImdw&pczjb<23?dsFhT&3)nE?bWPylFMnRXnj0xW;^C)YAB%F zr6BfC7ot={aW2H<5(u(d%0HBLYi-U4eNVjxho&QAh#s;)l;PR^d+{k6FdUUwg^opu z*wkb;YJ`qNG@)d$ReOYrc1jnXd~qJ@^9pjXzz+N5Z&j}LvC4liX&_XEVMbzS-tTY; z0KhZ(CF|o>DZ(vya*%2e}~|!;hH^$LvGSOH2W1mWk1jfDlRad zu*bcP+lotR-(ad;$F?M7B$h(3t24Zr|FlDhKgL;xNjPa*(86fEp+KOOdYz#)^kiPb z`GK|R`|dG0g4y6Sp+)Sd8XzcFb*N`4AsGDUVmHgAl(8=GqV0fs0V8N6IXnLPZ4O_Z z6?b8{>^~Mi)1Eh8vqk$eoW8OGRG?FNtB;APw%zAfoAZ&vd6Cd9X2!9SLB9rmnJ2zQ8M80RE#c$yFx*^e= z$kF%FK~ep)oTlu?iZESE_BU9r%vvkyn5kh~w~%=;ogz1KPvN^|fe4TDR;zr!o2BeE z^Q7n7dq1vd7&jwcMYH@X`OhLgHZ199kPAV#V7VGD>&$Hn$)~~=F}W!WObmhIT%?em zHECl%fL{-YLITo-0m9d|3PM8i;_n%=*39rB1C`I$R#ixS1GbRmo^4w%So5t8|C0Df zh9)>hLBsKng-0VrN9DqD-Yt0Om*uR$WtOg+onGe(nQ+nO3jzgmMSja{Cq_U6teeGyP#{R0xiSh!=gv%~nSFDG7}CSNm>(4!HA?B3 zM``*|lj`%$D@BGrkF=R(rZ6!t3!#s0lNBRrZY-!r9Lh}N3|A@uE(U_tWWLT(n>i~? zdVgHt>&4Ny{>MVos^lzwu?EyCptK=@Z7jE<^a_&s-bkJk5S+}&`7!$UptZY{ zB~rORC;NM}u?(itPKDV*$09~V9^p^iy*1VNGpch70V9tOF1b<_Y{8x+4nrvv;(mav z(A}Hq8~sTG;}sg{A*uc2ebeas8nzTC+>iT@ZAVM!fh#-{S`yJGNH7GH z;LhK07Z_S2P4j*}UJ^t*%JKV~7FiI(bGsYDJJxB+6?dH>Ak>eEj^Y8fJMbw8iCv^`-l95Keh{vaZF?t(kls>XyOh~en6_s&RQqxiq41-$QB$ZHc<4%#)X%=t?dp##d09oZIx!9p{ zdI54pengAfv%?SG-v3wt!u4bzrdVm=A_u(Kg-pGD$Nc84*a2uGxmp471^d^|dU7lp zw4d|UZB#F6Fb}twb{Mw;vSsN7#QnpdV{7$@iJ0wMn%63s^_zmwZ+)CEUhaD96Wv}) za2HcS`CiR783zP?iX>x^$e5Z=3Y4-(7NO&AGV02m<1dTr6|_V$zGKU=yDxS`*-pNi zl^xTT#0F#K+8A_t&s|<(q>(N_^g4Z9nlq6jz=3@Zejtg}mOG<07R&b>u7d0tj$(TS^>@P!3ka0_i3v$x6l? zC1Za`bD~MdCb_0$oJ#%2;-z3CZoC2bu~^TLr?&jLj;Dct)LsELhQTbf^y!V|f@oWq- z1{;chvzG?0wTY%9b#r&wM5p9KO}d_wsv6^i5p0TXHyOPbv6C21TKLeYNWq%zSYShlN= z!Cwlg)rJ7%4`HZZYTt;wlJUd0IOczyloDy#P)Yz{1!mmTKmg2~a>Mzb19q8$Weqv84Ri5&PlxP78&$U`YJV%chrf;zO;6lHGB+fmBTvu+s@rBAXc+)C|KQ<&B!MULk-nAQQ~p37>T1%s zY0M$ZpvFrsBqAo>Ll(-$t&v+!6G{}$f};)^R&U@xUG;rjJ6L98M+jhxa@fz$1^A^z z83wB(iE}rgRg7rs7KQA*FPQ(Q3m^gmX&V&eREQln?5Cy2=IU=h>w5Xq@zzjm00U4a zuPlcGf$T&Cj?vrCz~5mX@Gb{&Y@*(IUo#GGz44>597zPssGo6s;IG0;+WK=Cs%07k zpbr+Mb8{rXHy&}0J9OAGP!(_=Mgm3UZT1Zw{7PR;W!`O7SVz28U1P;l#pd=tcBYGc zOUz@P0U1c+Yxrt0gM^PSDH9aVgm!?=KE=VUReCf+mN3K#uSE>|g^4>3s4svwraU3E z1d=_WVKM{X%gckeU7NJCDl>`=vYIqB?D)IR5S^#Aw9-W@F5{5rbcX%TCbj`4Ak!z+qJ4$w zQcgK_98P9o%{FaQ7aUt!((KFwR{D@{V;BPjsG6t9N%GKoEwddOq10VeI8^B{Iw~QW zI3NmjRLkSq-h8U2f%(Mp}ak- z*qawDw8fD3`Qw<%s+Qe=$a*~@e}hAI-|czEny!+15qrC6-i3Hx1O~alz&AW&GNUju zvM85i3E28Ar{m$nK%d|9-KyoTExVF1kdN)r@Z52^W%g8)*tz?zCts};&NT^SLFu9NP zX}&D0q6Nk6wUGfN;BaGXilJl5Yw|c~>TIFl#G3ehVo1L8uQ>-Kzq#VZw_uayT%GKJ z2#^!G!UYf{Ka{H4)Xf3rOxq{l*rIXz$098OscFJ545`r&hb-I(K=J;B&FoTpc8*wj z|2`(2He+bNJjD1%f~&Bz{yy@!X+U!|>2j5w?)oj2F%9gfe4~@o)$Q;3>2$$|$F0;9 z;heWC8Sg`;1t2hJtTDz@F z^V{#lab!juW&N)cIp5dlU1fhZO%3jd)eyPlwB^gV_Gmb`4=MdTE)fRLH&0lUC+bu` zdF2gr0XJ9`5fo2+-5Jbp#NzQYV(EwR!v_q6Ftt@vphfifpP1A+j;#HqXDaJ+N#2y0 zm}i#p=dy{&M5SEjb0iS~6jgM`CZy$Wx&Qb0HpL`21^SCYrN8;pHL#&<0V99Z0~v*g z?!pHZjs%zzXG&QfXW1-D-BiHrxBW(R6V%w{97SJL4X{!(uANM!+G1&yG_8xKWsZ8} zHKFyKgehr1!prN7JB?%h&|m=w%UcyQT1bU->;r=VR4Ny^*hUQ)U`W0aLD?d^Y$We) z5glJ3iqf}+?}HuLw85Qo0ZHeuwipWcv0v|A>On!e)Lo7bzu$fExGY$A6S1Y{f+83y zQ4}^dDjQ;CAOgl!RisYhVKm;0Zp*Cb?0q-^C}GyqJTCLn-5s^R?>_u#jdn?M2s6Uy zsVj@(Olp=!RU9%eWerR(7O#)3m^1)TS%9ZJ|LG#BZB#IC{43{hB&n=_e8*k}ak>Xf zBVHV-Js?GwK`4s>3h#-+k%2?Gh$qqfXau&>aM%^4DH{4mW}}$9hA*OvUm<}a7y@;e zrCuN-=R@ZpIRtfbvutUeAOsN=-6;`g#=_|8F<;c9O9R_rp=%28lTH`-)qXn zoDK)~gBihXvKW$M$KHTS zYy?7vfHqE3l3~>_+61wg*#pa-zoMLQEP8`gSh+~72#1!L4ikd}=YVOS5*3Vy zux+kZ|6q8JMS2B7AMmnl7%LpIue_xi@v#7Zd_h42`i^K`U9$c{R#k@HXf`am4VWmD z`Ih^2iUYTw|s;p(BK+a8KWp$k1@uL78e_`Nj`#x?rHOyk%1SibM!;75h| z>}^RnJZECtb#9lfK1STWf z@modF)w)vWvhK&8uPGF|2xc>siH19qONsPj3f^0XNi{?uwK$mU^#y+gshMaEGt=z+ z=+(Q^f*?#SxZ#4p(}Txgb!cUHp8U&^Ut?*$1Ypj>inD4Rh~q z_##}xoN;(l{h_(=$?@#sy}Ee=Q};hb}jp#DgRjzlb`+p=cQNx|x`Q&l#;nJH=#RjlXK9 z?)2A57O;Et$aidg!!dMKv_TEC=<6Q8D#pfOLdl1&a&Q`w1&p%7rY=-;LQ$qyGUcbK zEU(CWc&BnW;yI9$xv&5-thx015da9F==2T~Z)QNFv-a{I3k1z;wmk9YktKx}gb`R^ zkj!DTSUn#-rNGa#T*1vkjee&|9~Bi*B$;A2k5|wxiyy->x}AH<_H0qZWG^5roRU5> z>ZN6KoLp%Y9*yP{;Hs95v9h_pqq4!AkE73PTacnBin1Nw%=|xx7?3oA{s6$5o!IX@ zJQ0UW8_^&jf0%g`67Ofi!UYOt{Ww|^BzTH6xQC8zEYp%d3A+SeMVHU?bK=442TTY} zu@kuFJrSt-1y60OPuT_Im(W@h+`LFm;NTFaP^aRW*>HZYmKjLW2qTaYKe91%l7$?C z61N&ie}0He?X}s&|2$Nb!Onhrqy6XBcO!U&x2^EqN!)#c!#@_yGFt{^Z*}Tti(k?Z zw3H;_rcRKin{e()K4m_TV`ED=kU*VzYaBn3d7hWHRkW8O*owG~4zuFEp>zBcEq!Aq_VSC8+6CHf~n2W>Ptf8R)%&sL;xyl_YSJT0p?+<)O{TV#s=-f6!aru z+2uIWl9Svyc(MauDH7Fs3s52)(mwy?K!NL>&YgW)Ulv#O8p+-9{``mIciycxwFD7~ z*(%3X&_<}wzGn;-Y)rTjWp`*|*m}Vp{t-tUW(e8ttjYMS9VF=S>8`1L!0Y<)%;!li zN;F7YLmU1T2u2GRy=4lZdEQ)31078N_B`H~y2`U{?D&TsG~k!?i2 zbUh~4uS{vyvMH1cz$HP@v0-c>WZ2$TW+Tdb`*~=+D05ccmC6Z)`(?H#(cU-%Av)Q# z{S|S-IlVXw=6)f5oP1$@6iDVt-o~F`@S9h%oas4m$RrJA=|G{Ruu38S{$(kgkoQBm z0BRgx9r?8GaJTufd?&rleNj8(QN|%b)!V*GUK&8aSf)_}O+<2diOCmP4!dNA^o)`U zXbcXWIY~_aE6WdM2r;q?F1D$wmJsiYS!};T4|nyg53oSmAHetD>Gb}wAe5VX0*(3j zb_;cAU5ikTtm4T?=F(~8Do4gHd0 zD)Wcdz8qf7q}cIS8kU{7Kuc|gqQ(UDcXPkCxP)Z`oY^B*`ccKJl50;-;$J|&W#`2X zf9!>k5Z8}}AR`EDQdf*x0F66_FDU2`@kvgTgr+?Cv1yAKil{R2&%4jk|5yMVUt{jR z0I240y~Kt9dq4xFzyLpYn1m6IMi3e*J&Y>Er~RZYMFI{*#F0HTH--E-G2KU(7{K%4 z%ZcondLX0q`?yBo7_{)<TGZ$A<>cE>we14m)6dvb zhj73Fw!eDD{Efr5$YUqk*8h&k*Q|z8}-4O&9^Og%qb#4M;B@CH zFQBa^r>4TK(TBAJ#PlC?N${mjv;1*TH zu4)b)UQWMSyYI?`-IRRJ z<{GP=qQ+`)N(X)YHP^c?;gBp->Y=_!ZbUTzdnt=aN?(c{Fi$9L1UJTzU$RC^@?yb< z%#F%MuYK^@cB*@d7QQoY{!y!S<18nOG}+}mFp1$zos4a4eloK& z!;S3i>}J|v*&KGXl6(XaF+ZSDGXx~?+qNByNy>iOb@|fH^XZO~;7bV}^-8-Z>B86c z5AMDBOX;iveWv@`xn~jzc;6JvkIJ>jOq-l8%d@rLtWkoo;WFY|vR`~|+kH6#o-=f# zu2%pxw{E}9o(>tip2nBEAD$~aiX$)kakahzRNyE>1L~jBDPXl6NjM^59Pn4+k`b0n zCg?G*g}$OG#K0V@A2n#>F})ZFdoaRJi{PzntyA^-DkI4+!>(iw&FPv+1#2cYhhq@F z*!}-|ze@n?=H-TY?Wkc{m2Z-Cbok)HX+N`fhAgw9cH#r!@3#1j_(?P*hje2}l)y>+ zUW(mdIKkMWf>FE}O;D0d98r8d6Nejvls4XS7dDl^H@_gy2T!m&&)n_ffwoz+WDf{P zbES_i1OB~}t;+>=w>p`+1;cqvMb}$B&z_1R9}w1yZsw)s85^O^M}C`|zbKGu^hLin z9`T=vM1biw6_>s7H@v#qPj{AUI>?7VofVuH$)^Iwr++!Dhl28(Y{|S9@t_mvYu0FV zgAkTqy<1ci@z%y#{racjiHrAt=l zAVVe%f4}=49<=3jK$hH_nd_6HIPC3<9jP(PeMmlAq3Gm;Q~A>pvRqI9 z%w#JsPOVYVZr~|ZMc6@ORc7OmiSND=RrUAHaq;&Ld&4n?bE~X7&3E6ecx{zsyjvIk zG}rWaIIn;l+jQfE?sie<`_zf+cRp}L>!J{9=7Y! z+1-xU{ORZQneE%<)|dAS^BVI!@gF-6@@W!?b9)DyDJ!kes3$ckk(}IL*M57rJ-Z6b zty5G>Eb2klX>2Mhe|}n^IdpX&^FIzx4_noA`#4_gJG&4Bql+;y%l5iS$~+RVc)i$M z`7AXQrFogC+JRL4l65cID5#c0E=cbT+Yciup`2|VGpI2z01|lU=z2n6ogW23qTouP zB7E;RB|AxJec;GCrPuV21qVRHTduU>n5Nj(CbuIEAlYCu)Soj1%Dn#u&TGB{%G~qT zQRdb~r}@TL{E4XEGsLz$4u*f-!Y~{z92u<)0leN+u_lEM3+1Be48UFvZ_^g!s2&%J z%DDb@`f23DUzl|IGFk~~Q%~;$TTXX;BOwQN!O+w#pa(LcX}9+2@iOP{3z|rTqY-AK z-Rl@rb!s_e0qrnV#|N*#A^gXNzrjI8*)kV1U^sv8%JKifet*8#MYHcNN5Y0nLT3g$pGa(c%& zXjs#;S&klFv)X!{z4evk|Fe_&{;6dBdS%Jgq|#|Y%dE%Ko~!$2Y&W^a1@D73Ti0cS z?`6#~YwF+8zc=hpI~D8o4X9d_+Au?#r!42^^lYiGL(N698mg;5E`kpi!aFutyFut7!0Um>+yVi%`3~ z&7$4M*LRZq`Motg+5tb8Ht+VIE^4WNZ~nr%h#;6 zd3s@09|qp`o>3pi^Md7;gPDlZ+Okof4e#`YBin|P2e7D+D6u$?Pp6=^U2}6YRGGcJ ze{E)oIcSZHQ-j{HJi^tyYpwDjMd{UW@evFsUn`HPh(7D81YE+Lqh<+>My`-wxV(&?z9c_~DBcW`5l1Db6w0xf zRHi`pi~Ds=9DACr41gx7lA<&mi3m9^Vm?eY4<|QFnfV1|n1c>V6FzKY+o!ELY~oX? z(P$jXehom;dSA}XRA?e8p51%%|6C3{DD6v>G!0CiiJ-wnu1}E+68Y`QIi1hdR~=2J4{9$r)caKXN9*Zkj1cm7DsTeC+s<%j#m#wIjzomZw#`9PECuB zwmYIp8h4nqHkzgpXJPbx;wy4r>1=LzY2{cN_op;X3L47f#+%Mg7q*uIKZE=6Rr+z%(zq!G)HR#;Y zGlAm}mcq)wUCDH*}Rg&+#x%JMGybr%KVBG73ahya1dj;4zhf zkk{3IX{$SF?)|UHKmF8y!(;zu&$q|?(?x;r)#P)47<;u)kLB7!4>a5+cIko6FbvWY z-2aXR>FfS5q;M-d35cKl-Ga9=;u!GUG%Hr%Mf@viI4o8!x~#gz%WsK0yD`AtR(t;P zSfGM7AW@c>Ni|!WAYLVyasA2=bKqR|Vr#P$18j6cm5@8E7j;$-!x{&22g<>ILVXN}C`bHsLVd)7nvnt-= zdN!_==aPrhKw}ODE;rG*x@+rQB`|OjtkV?IjBe1y zU7EZgKW8r!f|P?4;TUMf1caOAeSz4#DkAP{w#%T_Z@vKhUNW8#1q3D-P*A~)Zy2*Q zKUJ$Ru-=Fv9Tz3b&vU0#YHh>=IOvTViW_bjDw_Tn(yY*%22gzw5ImP2pjs{=5aVsh z(dzXH%oIX4+Z4t`-27ZFK&(jCPC z0x%{L^jq$=pt?1yAp%~GbVMaG)?8isb|;P&ArY=c1^Y}@Y+FWhQr=4pm-XtUknkJg z#9f`LS$jH8{<|gicLncpqd{7l-S_TI_tNd^X3^24$n9~~a*Z_~WBc>(0X<{k?3jK1 zq4)Oj!{04z-<$C>Ew1OABCdg4cS9w?+%-?aPrH@81KP_iSkN^uci*#t-VgWkIjh}1 zo106tJOcm-mmvy}1BC$TJtEVII0!H_<4t-pvHnow`-Cp~=jrb+-}@rcZqJ;RsHhh} z2R+XC4{yu@X6s{S#(7_hQ}iI7xFzFvIBfktpZ#M|UQvF-i)5%dcl@RhiG8ykVykwf zTPbrd-{>grn?6#2$uPcw<2Rf<9NzpBTM40Te3ihi;@5p%@8u=LYex+HBw_ctT74oD zkJu5h_4spqk%m%jN}d**f(Iaw!~ed9+Q9o_YkB={=lR&b$`g4uZ|u)bSKDu2y>$oB zw2$gL3jFRm^90G8CtUvm0}VCiE3SXsX$e|I$xf>M zIc_Oo9?EvL3`V24*CNzJ8Hfu4#p(3gw731;#|if$X@< z3S%9@j@0quGjFY$W_VDL=x^|q;;QnG)fv1IU;+C-7K0^&q&52GX4NOUFz!Z)rqbPq z(Y(P2Jf#d%KI>*#py1+Yfw}h5r?NCHznyxefHP(eidHFnLw_cmAeiQlaS3Bl%gKu|c82 zX`k_!1=|7|%Q$$RShA+b^+T(TDY^R(8>e6N&6QRNmUs3eWiEPBD<&2bKIZh)P0xOr zh%oM9hyu^!pw2`Y^9=@C&hqUZ8{Y3j42+2bU${b+;k;(8n5rI9xU9g#k^g5hi=as= z#xBO{5n0wh!e|5{r(`Q2w;dn@Y->=u=-KIlag+Cs9Q|!#?p;H!&&gA&)^ql@`vvto2Ki3nJ<>dl&5L-Z}psc2LW`9f%J+P&aM%+}i$uY}V6vvbNTwjYaom=RuZf%v7e-bbO7rST3KvG zrE1Xtxb3LqRRI#!hrFf_*vY-m3_QPH@o}5UFCm;yfcZ#kKSaLY>5L;iJwrMu11!});{foa!PdlFGz-l^WvY$n1+pF`CNQedrYL&w|M_=D zs=dt^r5QuHNzsMNH=LrBe4~qG$|utG&a^W03VdOjq0Q)QBFhlqr$xNP~7V&*aj_pk!g-&J2TS|=4g zqOs)hf6G6?xG{lnz|k}_Es1YrO*+@@4aQRXA^BnW%UbS}(LYL98xU+J*+KWOWd(n) zNi=5ZS$2sS8dGU7G(i?`jh{0lrpwE2^aCt09QiJ;t>$aV9nA{Ow(xwjCMLA#a7!l0 z#~BRXAGdro9Xps*H}PFTy}KHxzw1ZccZyR|W!`U0uRLU%zRPZY6E@;-U1yz3%m*Yi zdjF3_^YP6Pd*7u&c=|jBf61$xr%0b0s{7@!hsuW|div~&cm8)Xlj_FeA|eLDu{hs3 zRAz^FVHGCilJBy!-Am(duZROS)}?+AdbAkI$9WHEy~UyUVK450^06k~6}@`z-yi$M zPO<;;u=VXzsb5~F2k7hl0xor4LVuIZbB`JeT=O*bUT4($kQJTgLjfPvFFY-|r;oyB zV@kHtynHuQf;}ta1OGXXa_AK=v}4)xbdV2iavF@6$XaKjXag7rv(u8v@7~Oa zQprgxFhs?u!J#fTO&yO!#Uxu??izWoBz0zlzBoE8rVBl4I$iQs!>yNtE@I}(gtjB{ zsUQqSv!|P*0ZYTN<6&S|vO87YL= zLSIORCBsKAIo=DPl&Ew_F?}M(srog|vE^ks;|?0Ad8Eu0q#&y9gZyGY@e^5Nm@))> zRq+`7O#iWXFTdJ+w#P@E>&97>M0RfbB|VQN{*hH}`Cd)TB7@9IMC+2(os4SJGS;q@ z=1^Xd z8xVru!R*4k|E?ZpQ)PNz&bQrbw;f-v1RNdp=NVZ1J*CEfIg0m9#0@2|epIsOj8@-P z0yaxZPnY5UpAqY&*9d0|Lfb7DxiCxV-;WHrDVY{4MvZ4PYLviO3>Xdb9dD#+9GfH> zE>G^K4{yYs?ia=HZ>*(I#}6n1(;KOWY3EiKRQ@CO8Ts>$!8#CUMcOL~lV$F=HHigs zpP9eTYrAVFj;t`p9V7N@Vc@tE=E0F@cHWHmNZz;EaBiandVg8%llt$L*ikW5iPL>W zpOi3puQ>#A{me|5bCP{;KIY-)#tx>qFc|Vv7={jmUr4zyYZy4sI_ZsM8h$XDt<5~h zDC?PW8_kQC6R$b7+Cj;b3E;;50Gn?>XL#X!xWVQ}*lfyzy_gzD9R_4L15+^*m%;L2 z^QHqos0m=m^#8f#SzU)`GIAMx1h$ zE6sKCr&v?5$pB)3`$~92BPvBzEDU5ttiJ3CJ%#NOU%Ry%Q!(v!^7U*|ww-$yDZd5r zGTLYgJVL4%VM){6Fm?wimHbG80#X&One93GINY~R$!tUM%jwjJL*+LneG3C9wjwZP z+AS04bqiMOf{3vGoe@+q^}-u@e4=OJcs1hzorDwwF+0=eG*AwutfVRc#y3VRreWjM z5o<{vfatrgFXZv1ZYFrE#r-?SFTmKce54<2Fm6#Rr&EC^o`DxAsWaJ6YozVCd5?a< zO`g(Ac&(4OAam%JFsaS45mP2qGo|i?OTQg490l5bHu-}6r7E|L0&g~@ZYSD^wES<$ z0?(7Bt}W29ZE94m=Xto;>UI1ZT))$l9qo%Y%=#1@VTAVKt%s|q(>a90mpv2ZVr0xA zEhv9p7!j)~+W z?D|>u^k-I11&}$hO!%Pg0Q_1g3C}S8Y)rQ;{GnRH)uzg?n?6A`gWt12 zz9=3~1|XZKZa7FQ=yfPP5vmE1Y@vZ?Fb+IxW2v2(8oiQV{2)jys?^Is2LW~%Dz`jt zCQe$27eFyyf$&?g3?S=R*l(V|r~xKbuka;dEnNcyJ4%}(^9JDrq8?wg&1sH;|NKnJ zlSzj_hCi%8Sr-!urJrJO^b(&1^A@PA)8{SYg2#G`eNOy-V&%p| z>g+3zi4WY@qQy|k`))w-GOk_Q!V2(SGOh=eCjN?vO?JZ zzIc#iTTN6fkm`|KbZtdv!oq3@kIodaYYtDgxKLzd;5mz3_e!zIs(MBp- z+9v8yVjbnwGuPwRzHc$WX5OQGctr;%tIDlF5h*@uhV2l}>)iD#GXI;pAv0Mm@FS>wy)Ym#SEx5g}r);uz= zcDu>Lg(COfl*=}RPe`#!`&f!Op8?3vtA>}Zf8RDls!_?)$csyThL2BryBOV(0Mqxe+yb5o%R@;(8(ComjKm zX(W0cF(6q~fnGS1h-}Pr%ky2!5Cyjt`3)mBy&Tf`;7((n%RO492idhslmsMRRy6ww ze1Fry^SAbrkRQxsq#Gg_wp{?ELEh~Y%3&2{Iw2wyixA1@h4YB=t=N+C(*5z4$vFZj zx}H` zX3FncS_U&v#7;aHk1Hfy)?$%a=IDtdzSXTAPMg5YL`m51&1M%5Or_*6h8tP{?Bm<% z!r{D+?(UMx)hfhO%9gZ5BM?3I$I(dy5Iy}Rq9@D$Sg_5uM_25R$d3F-4@+6G?o2d? z=xm7ey!~{~ApQ(fHV7LUGH#%6C{2jnN!vo70FALV{u1)nG7I_y*NQI)ARU6+lP6q` zDU`pp@y;=BA#zGXo3rgb7gbVo40#68Lvv^9c&=TBsZCiC8NJ2?DPhruJjumfcAKKNk440s;1>q8l`;xHzA z#63)lH~tne6}{**_KtPvEu#g`CpT3uy*d z?6p-1fj)4%h8-+O$wUe)>rqj%+cWxRwrV_PjF+%Q&LZ|0gqIiutg_t=*d_@| zxT%v86O#>#rXsFCn0XX`dUfI1a&UN1>A3KCTs6Xti4mCQb2P;9bPJ0>EcWITUb_u` zenKpgB5wRBB~SJkU+W7d`Ces^)abp%1RELqSypUE;w8&tDLm5bz%3TPWW{tVc|kyK zpr8_kCPcPH4vdvvey>o!Xom5|U6^Y&-ga=^&Fdtc9{Kbii}z^-+#)i6X|chM zR-L&1is{`^@_o+{B07q%5VZq$gGPVdG6J{~F4hL-`v=H3Fi(?Q82O!4QFNY@R!OR3%#Vp zf>IrV{G{9}V3b22HaJLce@aLM*f`V%t__-7J0qNAX)_v^CFY#f;}R?zvYt~?$mx$| z&cCS*II}rgI%j{8yjFoAUE3`EdU^TvR9>wDxBqU7D4!9t9ez%2E|fW@tmp>B`ZbTP zl{nQWcyuzlR#=h5$uNY2LS?mhP~~iwCx=Ere1Cn#&`n0Z70pwVdPvJ;BVx;&-|RndqcR}^JREmAWP)W=HT!( zGx!<^u-Pqz&?qX;3p%Ig-Oh%Z0zVz3zh| z`O-Bsy>I32jLq}|Axe&*JnTkzfO%Zi`)g$$p>YPardv@{WpBDqXooa~D4>Lu(D&xQ z-~E)f^iCe~vbP(;?hVs7zzB5#$$=lGA)KqZ(ZWzk9t^ErP2!N@Z-`pEx)xQ4Y{2=e z6CB-e00!RE$dy+&J#BY8fk!L%=1l?X9e1-RCktS?0A{nni^ui$Gm`(#$m5I4%ge3P zbhr&KgO|le@a^bwPC0Fmfl4WS-J_|bw8x?9S*M~RdV#zpEL25*@48cTw$>3G9$;|k zaz6gBDo0g8=OK5w|7q;i@y5vBtW)#e64D=uehzybYt0h*BTekC-*fzs6W&vsz3@e$ zO6XW|S1ujv#X{#Yd(0(sLxCU~CX2G#nS=p37KWhHoaz5XP zL^o%XkKXeFr@d>%0U^cp?s8p7GlizT=l*`^~dZ1?-QqpEn9X* zg%3QAFkI@IK7HKzR=(GCdAQhyf%R0(?)~lhb3tVlH5|?m99BitfC%VKdTr-2B}2jOfSDa`^cY;!@H~nop~lJr2Pwd=pT#I zD|%m~pM3XQLMA4G%ZG=ph3^5`aQX%TW@f#z^YY8PgJ)lgZG=(Qh|(>kI%N3zT2Qgv zEC2PT+=tS@TU0r;dQYrvX}>a8BJlc{edTt>lW6+#WgiR{V+LXQ&LI|OR^R4Up{1)y z9o~w36VYW782AXf@8F{&D~khBU}D0R*4(}^1Gl)l!<&p9Ul2BduzTrxvDyJ2F|VlG z$68V1D|gQKdk=qBZVOgE=QFFh^F;O5In0VP9#;@c6+E@XzT3V%%yt~D6ZJ)W?PUobEmywpbG6U;pPJ`t>FO)seH&p#B zC9gl-NMIpFI8w-@Wl@6cr&YMG{HNL@e38oj(2+mv!9BLEZhs zw>6M%Od|MD{lFg)PlB0b*x*xp(_wnw_R_N+6Bf>} zAB(=TP`vKd0_135y_aY_qls^w-gjxgS5i+`9k$5bleLELnL^AbV)9h&51p#9t&?i18p4anVuiq9sa=#8W*PbJ9vqVFA{OXb4{v!8iOJ>bu)e- zepr{f?tQp(ZG%6|U zal~u=W6=Vq)b^gD#$hS!3MXN>0V66(o1D~e6X&Ky;V;6EKW^>P?9;3QjzWisFCR7o z&vPXMkvDC3$OmhTiKJ|8Y*;F1c4%wro@ucvfwD$WL+o%@?TD|R9z)ef=jq5i3@eNT z_#e39PK*M(^(0otM9+P$!9z@!mANIyrUpb>+nMUz7 zKI{MAm$MyS=Sa-8wti_!2&sSR>1i^n7zrUUgRd|iBW7QQG`2OzFj+|9E2k)h-?&IK z4Lz1_L1vdjGx~Id7az$_GeqNg5ef;sY(c(&uXDa3{6+*jq*h})DZI}2I`hh4!!NHZ zOp+9`mg;|TLCTbw)m1`f1I0Aln>h0}$NMImEFs?a>sbmfh{+Nfv0fT@mU|bG>wkCh z_X0h#OjH%B1jCS#0|UBI9|JwL#VwRXYss)Frbj%C8o0O|g^lc&?oULk5Kfl|J2R*^ z+6YA)oOh~cmk20Z99En?B0AL$=3Um zk>9Z+6$;(p7QWF28W3wQSkA8V%Z*4JR!&?5tRnq2mBLR|FoY0{Ckr%LX=>z~fpKs` zAy%%sI2~9y0ALCuU4Fo|b>M~b?Rwxz+rwFOreX)bfH$SERA3SWk)9`FG+f=3QyAZD zNGWbn-SPkKAgjW`N8W(=?Tro;yD*FN{8~v7vSwPSwlGQ)1f;;TA5vT2T{!T}Jn(S$ zu0rhVjli5}W_7}WvSF?io&P#|` zsxTDVrZ!an7Z;Zia#D}K>g%JT33OZ9+T<+i)cn0`GZ&=Qb*d~?Y%NAuBCLzpz8u@0 zaJHGgpX&VGMrzjiJw{SS$ohT@Ud64Nf3^L1C%btM_F?kXuv1P&_9G!O_i^V0D3>)9 z)5@LQlVh|$GGQ)Qu^T`}6UszEVDyT9)S=dpL%`6FYlG|AYx&=#Ihs=(Y5VeqQXIWO z-d`onags&xQcKZWgQZm{k4^}lgG`f?$h7x>iD}WBKU|d8*gn%zo;+`W*Lu}=eY`m< zh;Bo9K73g}9s=KhDHt}szbBc77Q^z9aR(*lpw40r=xUio9n-3D%ly8MS$z{MQz$5; zS6BPmMXi?tmGS@V9jPIJ5H|hSt_^Wg%7b)5@>J$Va#WEjgdAlfZ~sc&5Z|xaHHp#^ z$Bpd0bdGSL?KQJL5Q$?{(AO=&H%bAq+UWUe)uw?$Dr=a&(f&%c7(Q8G7a!$){Dodf zQ*&@7b-U|*HV)*eVwt`z3WHYiYNO|}?edA#)%b%}dA*GFdqEfL=fUS>Q#=UA9on}a zQGb*~LRr#n{*p!Sr@hGNxMu-;JnpI#$?0XBH)2yxf{iN5eh6u-Dz$1^DfdK7_iTDJ znK;&u*qI2a#R3`Q)mLP_OMwM_xXv@w1+ z^VWAFS#OF8OWdM7692^os+IVzxTh-?y8fG3HPd8zsumK-S9gGC`nzYk2QkYehD+ak z)mRZBl5D#;4fW2>3CFuPgVRo6G5Wr9k0vMd$7SrDvEkQGY=RvN0k;SA~lkz`*TPg<>)1|=MlE|sf+Gx$!%!v~G2p)1C%aH!ARQ?EYZS{?jk1U>{^KsF^;!9H1 zVe=tIbg`k3G>pl;QXs0E052?EW;x`fE_O#tc%L13g z_oolrmk&pmm@$`q2(aJO_{_9t+rwQZB9mD1+U7{sfkOIIa{J^dPeD6)hCD;!iR%r~6g{-BNYffu+2~VZj z+nfS2gQAM*%RA7Qlk?2iuZSg&^ZohhfVS3Ob9%M0e1z-2a~?Z8FE8J1AAS^BTwKgr zs6$4q`VS5%ISq$#v*^}AFu!Yi-kjZCUQnS>7kWY!8R+Rbskn|uQa%vn^u6Mspnx;Y zDFYQq5Xb^-(dOIgi1MJ-HQHXF1OdiTE?_YYX@+U;F^d>Lcv>W1w}T=BlLb*w6m}h( z9cbDG9B@Bm+8lsttSDX5#q%Tm$6_;}cFE0og~t9x<%?N_`wB5H2g%#LDYF$1NuRB( zDpf!)CGmA7+|Le`3&43oe`1N9#yY_4?d=&I4 zZ7BTIMY-7)lX58Q*5q#M!48*jarVQO@0<~odWirjNNaj2OzzCusDi& zA6rcRsyLuoCx6YtyIxG9D+>l<=%xW=SaEe3)-$G4`+p4rf-ZCLid}oZm1hJ%rEyar ziWXd!RDKV)J*djoTTx~MSnK7|SnGMVy0cRoAq~ct$VTm^rskWoz1+5z2JiD5HQkr} zSq_HUtQ?x-;zeJGeQp~P~tadLZoslY7v?(js$u-u3JB8M3F zQPJ9?UDV3Mg0ufAyzMG5AlMdmWW|5Gt0(COy+=KY@#XbUm6&0Lut5n~^y zHvke^dJrY_1rOKiTn;#1G!J1@stOJoM}O(YzX>Vmw%(po&CbrM`q?2GZ5;;F`FagP zivbg5d*_9sOY|hqhiyaC?Q(cGc?#$N$^Tez?9ief)QGXYLW-K@JS?*tej`OA)unv> zE){#v*(*#TV9CbAYu(&GK|N|Azm^;;D|iYj??l+j^sh45*rejdBbblxuEXwx^nPx< z&bIrlrnlHB>)xm^|0!CVzUTVYueI+<*~jajJ#bW{h+YKNY;el!Q7%PB!m$9-5D4qb zjL}m+w%(K5pw91LE-*Gd@?ov*a%*;07qLVJ!whGD>KHz`RdS%<#pd~gr<8091(4jd zKIuzTvnbWoogO%R!3V&Gu=4lPSdpAd!is4uVr#!eb-TltkvswS$!#!)^QD#hRGT2E zns(J1hwCq?3Qwy2-LLe4H1e|KkoUq*289m)u^4)uupvWwt5aP_hM{`+u(1zHyJ5~_ zq>MBXhpaGSn?H7eBsLn}olr^X5``bkc{1?ERX6zEvj-xb@8E&=D~*Z^6!0Ah?uQ99Mq9Q)fbMj#NMCT5&?rOE5M<6{2wrYpV@ z(uHmrUw`Sm-0XdK#jveU_bxBN33Jy=D4sV|2obIO_2N%Gig5tS=JW|)c6{URI zDrQD;BNHPRT5BE3h34c4&A{Ox*+%{8sXAAsBEGnY!+Yh*b}oJ=VFbtVY-ONCTtO8s z#X`kWMZId-JHGl?U#9kmKneMVmEk#Wgq{b3|FMYZPYupr7Cf&r8}eOhz1Ka%mAu(5 z;8|WIy!&{4oAF%VomG>A^(M-|zTCy(jWY9FCdF_^)9_kq?`iO zL%7ck?a}|Kq*SceOYG@OREvvnt%DG{VWQZj=G{xC%Pi*ZC`b?9AD-HK>ckv@w94-L zt-i^{ho`HwY;Ibhu`YO2tSc-@+|(_Or=OBeBm1I#-m5UgPW||%NbxgAo{~W&T3&&~ zXDJ7=Ol7$vHvW*>D{=)adP;4t?AHl|^Sm(y=uF8M&QV{Q4hj$djcEQl5tqB`r`pD$ z{XH6WckWR;72<2onPwSO_Bd)}TP+Rk^ZHsA7)37c{U=d=VQ z_0z2$D>fO7oo_G|=ls&51k4ZQ%fk(fUshIU;eB&8lh^7!b~P0j0C|*7pQ{JlcIDpf zTbs7}JoQuBg%^Ib*${-LMR{g-fk-0x!a?6@VW#Jn|KdWvzE`r}H#hKP|8C3V6-got z-JO36wh){-^GDk06Y0tHx*VZXeGyz|uKIc8a&xOpn6|IT<4Y&q^x(KkgnLWt+`C13 zq_nimP5zRzCl@DsmLNU|hRK&6Ra#p<8wWNg?4@~USYPs))T8~Nr{X0GG$ao;Gw)+U zMgsWB$U>@Ngg*DbZsv%ef;ce1Ou|txK7&3vdVesKC@P83>OvB{S61@Ne9L%qaj*4d zYUPXE`2`_0?O6&oN5cXbhK9XuU{!c?G@vjF|Mb;fk`*cYh@M*i-1Ac7ErL4=+V!>i z_&3u7u&UL8#;ePYVB+6gf4*C9zY-aKw-A#Ke-WTG#rTg!`YsWsD)k&#E`VJvs8mFlSU+SU#kVXY{O}4~a{&voSZm&z^!*#B+r<<^JSWkNB1UHOhiTf#FlrBiOnknBA{l$jW}(H! zEc9M_0JceN^C&vkpd zF@G<|@e12{j>aB({qfaw>Ga_rrg^_02CBwk4UuDBLr0py>|C?8>dc0RuIWr^4%JlZ zw0Q)C8Y%3`ZD=H%o@>Ndw7U9(;Fwd)_t6)%@R)hG?>${a$yyrRtO6UHY}1{2V;Z{! znE(bRG78GCY}jPOnQD7nK_#&UBx$doc0_Dm4q|l2&l&<#53Oyk_OgfECbb529Ywev*VywFmi9FtG1$H+l^Z)xhxkZ|i3-Nv% zuV70@(!#JE6?WGDcO(Kk7Lq7hQrZ5Qt8Q^sW$>_TBDz>BZEAKQTai z_9G5UC;4kiSycv!Fp!1EHJksW=vUaM??KIFD@+`u1=rh?#1Xs@3I-q_sHn`pW>l#3 z@8L)}yua568Ov&+O722gkIJr6Kwrtn_g)Vtp~PwyDd%2d?-rt+fpk^?rCc{7)Ni13B;>1y`~pZP~abvI`aDa3=5;EHQ|Qthy+P{Ic?QPM*p_@6NRZ%}w z({%FmZ^gvRB;hW=aq+I8Fw3&ige$K=u)^Dhqw$C_87xL1W&IZOcvRRY@oVqbr{6w| z&`@6aS1oQOm~vI$<^gYkA{91baocq7;N|^OTZ5VQ}^+#PjLx{k^%fUYg?s@<)b&n2SLq#d^B6 z%N5Qm%fcg3&`I*E)t9C2EwD29(m26ji6iQ_X`q)x-Fj(mv!usC+-#}U50Z?x7H1|a z%t?@^h!@iD`}U#F8L{~Is1b8(UWj-Jej0nZ7_l>5ZMQW_gw9EjN4jVR} z*3}iYvSQQK1hKG0_a;IdRVO_|VN7Nz?MnUqGv7y_3^1CV=%LG===mFhar*kEUV{^V z3}-T~Azz=W1Z$d=t`B2QoW=o3RcjOHf%oUKHO)izzE+pHB%9SgNB`KXI_R{BwkQ3I z3oBYF|2I*{e(bcvw0VAIe8(_Pv;?L^uh#V^QAdzsK9k7+09R=F`Eh z5!%w-h7rLf(;qcYb#!}OAm6Q~b#&LurKvUAAd1l)NheRJEhgAd1_w zKsiR{+t1gNM&GhQx-8uqv-a4!L_iWifs)isn6xZ7@;5lTyBjz1CSNK$ZpKksfE)C` z*IW43*bBnkmv1>=qYTj7SV}F?lV#d@h)y4)pfOR3EDVOMJ4I`=yuee7Kirrga!mNs zJCVnd^6v_lDCN;f1j0T05`(0?c1FyeOydns?N`e3no4}uzt!#{H%B|{^c6h9*~qjK zjS2v|ih@ygU^Q85GV8uK;sJg{@>(;~9sOg8&PaFrrs64LDf%F~vQ30;VG=D;PQYwq zKCn=X*V(6o@LDc0dhJ>~YRwdF`bD~i>pV2OcnSFw^bPGD5!tYO{!tDa6aC&_^=$zK z3{98{fZNd(ZL!($JC|7_pX6g=?Y2(lZV? zpDNVH7nM2>nxD2SCxxRhKE0FO@yU7C56}vJlm~!VwKZYJs%by5vPjn^|Ambf82W0A zQYt0>vFHUy^7B}$My`C$q*xQ~(9lf;vmm%qY$~!+yGAU^xQal6anQurJw^J0`WYo! zbK3IqSa z=DMjtYr5$$Ic|bv_cp5dn{3MNf=U$Cn^2i=FVPao$_g{OE2wn3vEs=VmxTkDaI|zn z%)B&IwI3Khz;7rVr~1LcV(D${^~`1KbB2Kxrp7e3f!eT;?xCTf_2aoq3C0rGB}QUa zX-45|n8jKCUL!*=?JtV>DyfS;KEe=Jk*9I!iuTj+D$h~AC;H;m{gkl+{a{8eyCt38 zxuCkH+*zR(ukIkNyO zi52R{4to!z4jvaF0BEu(Lli8*a?V_Pcg0NML;?bzJmkmsK`LchEIPGIhk9gsZ^EMm zmif&3KL63JfM4k!??|Pc_kZS1d!Y@v3VTAIj!((+(Hp~r)Rs}4Gfp07YB97v&s$o9 zOK5l!FkwF!_>0h;70|gK*r)0>$;`pTL^j5C#pG9)x7K-GJs$+34yMBL`f1B@`R!Wy z_4SdWm^VKqnGlMd{sBNYe7H`{bAAXgla1c2c`eJvKVCM?z{E!toQW;%ozOP=$fG_ zXmDLa8^6|Vo-j$-4v&8IxstAuUQOGuSdoA;$9bTdame&uSiwwK*QAGoQGpZUCq~y) z;hgcsee`XgLjo{LCTxz2KS|!hfy=_)!hVm7KTfr$(A>4#Bj$L$GVtcf%KeDbwuLHQ zTOLengXftm)jt*u-Nj7HzS7N&jXvjlJjnnhRPM8P&icA0B#c~(OUt?5)`!V*5V7|yCm5O%E{<^j+;8jMB?8yU*Q z`zhph1Xi&trc4{orz|)_DgXf68y`4qI(*2~oh-|MmCW(+W6Fd?C1PD_FyxIT9q8m!6gkO?H@Qf6|S*XXGj#C^G)yr`@$41mdD61j|$nH_M+t7kI zEprg3ooi8CN4Y-vm6j=JOWZ*{y7z^=gL>{c63g0dSSz)?Oz(NQesbdT`L5)FV<|+WNLTv<7@VLL47aKM?vqL@%n`VdeBbtFVE~D#K$08;p^AqO> zUkL0H0`0zj&P#&XjV`~)Gl2lC*ThU!NW{jyJX&#(`EW)j{ruCQ7Fr72(+X1o-rs-J zpMBx71MVAw6>us2V=;8_i2fBphdP<4?H@9N0Fj-o=(iVl-AU}GM%Mv#t0S-cFX&j^ ztsA{3LWG``SbtdhswGcispTrJte{#-&LY32!TALefhToe zKGh0+F;l_(!wNC~b@Kfm3p{Bk_IYC*2MM#jStcmekBlwNILLL`#URZ+3en%(+WaO)Tm{EC2TPjO zx_Na3$0Fm!Gw2p(kg^BC8yh`F`&ffCFEOIYvrRKH@>b%00B%B%L8RcPz&F2$Beltk zDT9+ecx*;}((B$Xcz4H4lCPP68!R-;yBd}u8JpkiD&T!d`osI;$l&k}I zoiC|_-O6=VuySzO3m(S|{=Zg)&LsNsi8Wz9jwU8q%daQD;o*PB+=nG7iSboAP-;kH zTM1_Q9GaQs1B2#+g8Lnk1lZwy6Kobqf>5QD5PvdUDtg&jcg8E~g%EdxYa9;G&z+e2jI)l5t;=(z8fu9|7K56*F?me(WRA2O2QjM@O>*y!nx;eZnF@r)Nw*T>TmQhiE zUl$*c7!YNKE~UG>yE{j^OS-#57+`2nxiEp%5=k}I$DTjENvMXo(M zk$3joIs|l>?1PG`-djMLb_aR?^5?di`);aDR5G z@o?FaLJXkiv$;1SGBhU_XCka8T|#iciN{(4WpeE378P*qG(SZ73}30V4%eC`w{g6C z`C@jz!btF{2$J4bvk!0~0DyLI`mN7y2q;ZVx_* zK>O9XrGSWp5OZv+`V60R!6IX(wYdt9^CR54VGw^@CoXVUc*T9UX6#ZZ;dv!27 z@7AQ4#wahUREuq9)sNHmu>glwwUoH^`-jsh&y{aPUaIp0eO4?R4z=<+Ha50$1V422 zVHNrTYgTZ0auKRWu*c@(1m(T&a;P$zQW+i?5U%qc*F!*AAr2^#6h-Y95FnmJOY`{< zD?DeGERIhFR+8rRXFB!ZVbq(hzkiVy738I(755hYGfFDm9hnz2s;Nu~t@>S*T%ug9 zVJAhEhwX?Gu0%1!t>XNq*_i*G1(kn2%LI>-(62Sus~{9~Eh~*w-LaVA^9O*`YH}z= zP6fyJJiP&uhl8dMfG1*rN_-t!R=eW5rzsJufxx#`^9SW`|E&?fRj=v#3F;wIIfKU? zHXMS9%f~I%q_V53!6zdoVQ zrha~2#>?1|P!-epI!~8*L!LOQ5;Waxl4lk!II>6lTBzBO+zP|mHy@FfpJs?DxjoYV z^{~>3*4Y^rba%Toa7J7o_AoLF0d~RRfzxHtf1ST z>sx1sJG@KNqf#SG{KRCr%e^ITI%farGsvcT{e~s4+UQJ1Eg=HHj8T}v)XQ(J2G*#= z#>0>NE>VDoC*XvR{T4cObl%>5wmU>=et)efsk}JDRh0!~A(N$}QG*b%(e7};#vS=z zu0QyDdCl|f!yR=fbUY&PMu+P!eL#Gk= zJ}e^re3mi3elz}(00NYf&q^Uh8Hn{D!DxYCTNB3t z-@?G}EO8(!pItuOPO63S$Q@f>{fOmc`(x-w%TA%en<`243>k=x+L$RH;=Y82{r$Oh-}K{_fs_K2IlgBzaB8t`FWp#F={z5J*qYA%8ZcdqBW*Oiml|U_echc z6w3#QUO3gs>A>cwrle5w5EGd9rdlqdrj5|tZwzOYY`Vb6-qiM&=F=Wydv%EV#2g`M z%LJ;-ato3w@#kyR{9QtbuHa!q0<~*PZhZBh-@uwdZXP`A*_m(J+NWdZOaHWxFJ~h+ z*uK15Iq?>IrFoaoS?k}u_Tm9K6+>Xsv~{+U4te$4ocu_BXbgDNZ+^O#*uF zrmq=L=p16z-V%Yh{9?^d1LX;o)YG1KC>Y4(u~G0V`~b##Jq8f*eB!J5$<_&+vS{Q~ zZ);G~^n0D3dW<~iG=0Z0y-$BWs7@hiF3c%&+1A6O#Ps~(^t-)ao)LiX4YdYm=RYl8 zczMr64KOPbxh*nV!A3W@J`Aee`Lu{ke3=l%N1<_ix_Z1$)_*~Rou2Q4fwe%>zfK=- zsimi9Rk5R}C&<6*q;slJ|7<9ERbx!9;nCtuCU$8u9`+^IywL4 zyQ^trHTq%U(_?QtPApFmicmdzMy+g|jvUH1Tdta6+}VVI8dijS5h8XL4u|v3zK{K< zg^`Wggq8J}Pz+4xqvDkF@w<*@B3U+*S6G1Igr{4UQ00qH z&FwMon`?KLQ22Q2y~Cnwe&k!{J9O74lr*Lm6ERc!>nPB#Lp(7`(B=X3YeXJqVA-Zi zsC$l0i?sx<*!k-npK&jPS1tbeU&sDgITvcQbB0`&R>xA}RZy z{0zhM)-OvEn!z-!!6ablkOu$-6%RZ`@@K)v1+uuDTUt%FpL5r@yRm_t z=7PzCSEz+S;86;IlUd2-soa$9B3rZo5D!2Os74`s5Nl~`a(a#p#JBH4$?<*>N0Viv zup#zaH}RhqQ&|V9P>cNHmr+Qcu3oDuoeqe~JM&pamt=rs%@^X~pmJ@{tYMH41;DTb z*7uhEqtmv$o)$Wyee~gMQu1yGX*{h-4~8l8&!?;cNV2{e)ED(RvnwZV2ogRQzs+4%m$kA{pY*N zQ5uZqMZv=0$CL3D^6!*??I--{{A@TB|`T+2>A_t^owNV3mH&cHw?BkP>~s#u;+ zg>W&GKaoFaaq72w_iByc2hlnlQVxv{9!r*@9C?Du%9M8rqc6fMfO*dBIp0=JM|4g< zY|!8^SZfYYeA1We{oKrBS%$v_8rw~_8#?&gI$JI(*p5BA($E8COy11o4KwFy?>_<` zzv?bje5dR@F*&+hkM>0Pk)UDcTOB-mKuvH=N^}5~M*XEdM5$MP)3FKbx7wD~YDVBC z=h&&=Tt0Sp!4IHN^5aQg5;YM%ei1okE*e1Bw+6wCTO<-3KQ-poq^yZk29sVypVmT`*6`s4^okkJ(& zSsc?KvLO@{#1ZcD%Dbyl{=EA(3BpY?xS-)XT7aH5;$i3E9G#9^Aw9iA3t-98lm(@4 zrA{zQ`)DL5b4)F#e3Ya|0?&x%k%NM)oR{Co<$1CEFltG%CSkRwgZ-JJjZ^`>7<6B5 zDNU|(Z0p(%m}j_i#5RxPPKxRC>wXZ1YQ86ABb!xoH}_#PXxOvDix=I?FQ=af6~zjV zJGVnJB;5*xxOU-6;T8LskjiRouoX<(3cE}Nx7|Ojip{6Xf!mrzYL^q6>-yv&d38I! zy;#%rmZCkEZIkprPNV;-3FAvZW0Z!f*Y6pJQ6v^|Z(H(F`FIu5;>w~w4>4_r(kwblpI#vjYYJzE;Z)R$a?7yY&}`13SFj28qBaBabnoc^37-ufH-j9cKR^eF z%i%PwDtTMbCRmX=5+U&a-_Co5k4D7Xk+tqNvuNk><83Cv0?Lv~l}rp3=btyvhVLP7 zfGQS{q#Y&P-taQ{5sk4B5Aw)?ST7txJL4zA10wDCcgQ?7HezfEjWfZ+MXy^FDJmMt zg08FldbgG&VD(5j+XI$(*?~WL!yH|bSW>YkWVrkkXDs)9E5Vsr`W z-)t6Is5ak32mQc%+g3$p88*(&D~SQvUn1J_a&F_keQcOI}9jg4Z-di~+M9b5Vs6>d$zX)~z z&6v!${R=mgq_g@Jcnij!s%I>@^*I4{!uzE_QMfsOD(;v3#ik~)#9dah7ZEP6isSGyY!rR%L1)p0{2i;ZwS+gPS+iwE2wCQ)x`seKVDUMZdttOvJOXQiG$p#8$OVkfCH?BO)d3 zDg~JRoq#?nHO=e#z|2U^Ko_sH;KiE{&k9}hS)iLK#(8w(QLXBMW+QLaMbtHlC!fbg zr?{vqvyD%8lN8XX6euH;Wak1t*|)vX?*DYJ$n0tdnfB{CnZLrg}l>Lq13YTDbH+(9x-01a3Q6hLP19xt9IXEal3 z&~doGM~!-LHF>a=N*ipdOV2+C^){Wym0jq6Na#f2g_*L?k_>hsFeF9nk>-PP=GWBp zU88DHJP0J;YuqujIV_sw+xYVIRC2@IKP`~fVnuA1Ak>zMM(6B&aN@3r-1k9XIJ6?C z2pUaOlp}j7%Yck^U|_J>=zFjvQ8YFz%MebFT-PIvDVC&20vHH3TSg&c9?=uYTJAEd zTiy6KyL;G7K3?RPXl?Nq*aBG8Rt2(T>|Rel<6w4fw3lLNc_;du*q-C70D~%YY-^~$ zKA!b=Z)b(JW9uzie!^R15R7rO@rjC9h(%mMk%>iJ*6hSFq@Z8yv&|SpodZ0Qk=L~e(`yDvMI%}^clN61&xyb5xXkaa=`dLtv9ToN z#u!M@Zz#tnMB;MC(-hV!@f=z(pR<|hKK{2xJUSNUDZ|di6g1@qMfy^o)~HsMy z0`p6-+Kyy?sE?fqIfS?{-OrQGw4^{Fl8NULtZBFsaduW{;Y>1>N*GeXFsz?du(|%V z+b#R2bIwquL5@W)%Yy)y_&rHZW5B;iv-l|Y+B4~7^hEMBC)VF{9ZA#$xP zqMFKD+wv)q`}&8|ozcW-_YC85YVfjw_^Wq^}I&vf( z8;xe8HsU&JS=73W1$LA}jmwczVp3z=R;7ykhJ3yQ@aS9wrAEfT#h%)|eSCZjm#e-I z$xX}BgXjg5aMbyIm~833z0s!ETrBIJ{QL=YhCgLob8x?r7f^t2!mU_N&(^`B_<>V1 zyG~N~gUsB?X#J`1ZI&j-%RIjKyHU1(M;#L;|E-b7d+K!=iHpHPA-RW zK#>Zx@z{u23gzOtDme$GKj~2hz(8hyI^f!!hjQY!EQ?vnQQ}m}UrjSha>_*JGZR2~ z!uy6bzkKjC#sI@a#uWdQ5G)6z-XbMJDY;SRCYG`NMslku5%zc*MoLxoXSJJk)5m6J4EN>sgG{G95B}fVce)pfBS!*nYQ(~8H|9PJY0Bx;yw=G^6kxT&MphO zL4`al4WKZYHsx~A?2Hye#m{CR2tFR5#U(dTw$ajtXKtoC2L}V_i2h1vz;*LYyHAs8 zt?$0w7f+Zd4^$*1et_%~DIDTGD^4v6a9k-%Qm#|D~UOTuFaE8P)sV znL>n}aKMRwDrusb@ZdT1bzjQwzC|r$G0vYHEc=CAC0Xz8_YWjss`T}{SZ<7LTkX1e ziivv$TTQ{ABss+8vwLh3*pygwb9W9fh3;&(9*5<0_ssr&Np_7IWoG%Rbf*40c;vlV zBI8_H5hL3&OKvSTre-ffQ(2NNJ_e{z$DfDYIA}3hESBNAQzpb0c%g zGqA3YVEqzk8uBWJfo!bH$kxiP^!SFIM#W# z=<+JOM80HK#U|>Jibj12usSLYs%Wonn;3)jt&FSP6xnTU9i?g;Do*}v6BYf|x56?1 zN0%RoN_7Vs;#GS9UuO^t$yZ^RMD>Kc<(qo{Zi_7Qt3hEmp#HgHK1lTXWfuLuO z#$Z`FjXJ~OI!3j(U5G&NiG=?)RY_ld zG@ZY&s%*^UR=^8INo&Ekq$#vZgTfkmV=diRZvy3G4lfH>DzYtK(C?DFe`N_RM^ z@|o*O7;nSpw3lj0G%SK%iF?f?#-BgfHwn%P2T=A@_Hz;6zO&XC@D$ra=H21xXw!W} zRV;+^P=o`)vQh+DzlJD7R@}unr0EQtI)z>Um}}_zfqJO;OS2=mD-U;9l6MD!%enh? z`y5B6FFAm@@W#ERS7&ZX0u^Y|^A|Y{D0nkwt4A%lO>fZd9xU5m%~fA;;kY;oBhgUu?P!^j|YR?nirj1LNb(wF_C9cFn>RFRNR+!k#vM5EllY zWbeKdRJTRGRo$Bmz00nB;|#B(%)^u#tE^$jl3fDYO8s&u1(E;L!jB``0w-wh?X%X_ zF6|wvo9i{SjAX}1o0rgx@Ixm5^nqztuO+Y{qVpxPv4i;aSuXIQYCc3uKWbSvlmu4zJZ+?pGe! z>XFceVoDic|J!+&6#<(pR^Ic8H+Ictq;^8*A%0Dr0iPUT1y&!2|E5|ffbdrAz>H~& zS=bYzIA*1sK>x>so50RMMCX;6Shv;a+``BkwVK7UsOPJ#eeY8@wEk)FyJt*&*+4f! zDH4Rbeq`!eLytfU7%ya~=U4b9@6GUs^Q7fK6e<)2m6zGo)}yB&&Pb2?S*- zL075hIlsI1qCO#<*0kBIfqnIpX;E|wZY9z#nQNbIIz2v{ED#Hb-|_9aLv)9EAPTTY zXh>~;_@N{QQEbVG9*w-G($-gC0s#AstxMde*Nu2+hTAb#M0E}XlXS;DcnB}jMZ(V+ z)FTXiOJ^!}t#*w;mF<$!s`aT>x2Lkl(w)~O`B`ucLGAlKS+%%scuTY`PO2-rJmMJ|ki48G-Zv9gHU84aJ ziKewnb&>~u$Tz}ME&NS}wSx2d^QMw{weyxccMs#CPE{^*E)Vy+yok+>)tjliwpk05 zAAj+%z*=gwjP6m4R!%N!xHNcZ`tzc35znoV=piyL*i#VXj z9^HxOMJkp0>@O2HzlS4Z%CMOWQ@@>@wh{t7q7E-tlV|P|LEHS4AK!k1y8YAQsuyW^ zFcJ^By>}Nn@6!@=v8@$Cpfb5!WArHCrbts6$O6B`D1E2_XR!j>nkZ0DHZVWFaRIqG zE!P=a!*I>C)BL*pI>DC`Cg$d052d&{Ew)&9$QV##&QmMd!}Tni&V z!xIcGY5iJH!Yubr3HVxjN_IU{mZlK;e1j^9PU|@Qn#%lc{m*{BvtL1Fd>nBFjRclo zoQtBh$uo*_gQyZV#;rLSJsjGS{(T}Apae61mGi}bec{8pTc~?TNNEUZ?8hJf%}0J6 z_r_8_`aRv6f292~NSNedP-Q(_PhXWj9M7P3O-O~8c67IPw`JdbgKU+8jZvSIqG1^K zfSig_wfkY;AKF+Wd4B-N`c##dE8Lk_?uy)KVQx~aFp5|C?0BfuZ_8A~CN=u+xK@Wj z(O-{bPWaz()fheA3a-BT72z^*%N$r!#%Nip${NXLBQF(!wEcbNPwj3EZCK4)hX1IX z0|lo5Qj1RB_m{^ zSJpetYv1^o8e13Jr?u}WO996W>fZ#WLDq0xoCI>49*#h$aCjB`_N0%K13~Fu^JML35uV6#%uhF0QtBTpc3p0|lJ_ zt&z~6X2bki!Mhb#KcqDSiA5oG64kqIqem`I0>&m8xPKy7d;D=N-^CSu(P}Nxb81IO%7PGzRtSc`aqN z5C62l1j?*Yu6FB-`@8?}F?C6mNwdHSp!9Z&FYsUn`)t+xwm|Loixp2trXJz+<84TK z)baVRC0Gg2+afw^;qb-{pIS)Ea&_IZs33p>wTAnLtL;lOSk*#Sg{yp^sU7c}_sZjz zosg(xJ$%rBmS*C`M(JPLqQ(}u^SqC#bts(L1IIsI9?r#L%Y=O zpH98|ta&#TlK4`_$RBUzsA4cw9zBhz!+qO3*QHGb<&58se9XWXpzO%*6Mzb#3)$+a z<|WJi)1qcqB02)}ZD6zW4)@5f?{~sv_qF%c?&d?#eiP)lSeGQJBZ=thHLcPy_A5Fn zP;sLjNgjC&$Ppix;w8kkvoc;lTFi?NtFfC0O?-q~THDUPZKn2Qbl{}v~S*)P+R4CLM`?LZx|3NrEn+Nw_qC$;Fgpqd`!Yiq!HqFabk+jGZr zjX`QR`o4c!60>VjI$l~E*_OP zuxpScR7{x#(ODDY?Xb9kfx*UtxROtwYq990@w0oMp`Ckh)2NK^JZMSh2djIeV>*!7 zEal}T)r_}?CC2RU@RZ)tdcAf)S@bu08BVRl$wQ*BJmWGgV*$^h-oWHB^ET#Zl_8eO z-oO31{7!0~M8fZ^<{-^oykP8*)@bYwA@|bA2B_A*$=@YT_#nPHEp} zk?K7N@Eb;sa&Bh)#$ED9R@n{GXB_?r@l^Eh!XI94sG)kO3}R7WmEcRju{r}8MLuAC zi|4~G@|7uoa%4hf@|S;GfK6QO=`K0?(2~|aAO&w3z-w;WRAj&R04@dsHQt%B1qnnIlZ8~%+EoG zWu><@LLd!03{u=GPQ!olKgu_XmGo14?2`hEKxKZbLAa^w&*Un5|2M%F$emsMklY=7 z^>DQZ|M@AA_rv}_Er?H~WwbCGG1!6%HQExXbx>#&c+&#I7GB@4`?Vh;yP?Yh<8Gl3 zyOIyblrQfd1|CN1!>*-Q1Xf#R=f%TLGh~o(c?TC;7>Wg~xnfB?Xz$8%6@!+u=0Mh+ z%&#}&QwJI}%3u6zJV;KrUCB2FF3WWLyHqm*L~mUp#z6FmyN3IOpY(;7R;JeR4K$)O zovwSI8C-5`|Ff&C`{qG0gqsNu^ol=en;zp9&Pz8~4UA7>_!u~nFPUTkbD*+0g~CYL zvwtQ2A_LOBo_ix_y4(_|1(AEF4Wy%DOqK8%R{5Pq5YH!Ki;tpeQcE8W0=8+83)TWR z|NJaLwb1#9UpMOb-=2z0oy~6$rwu;cH+QWsM3;s%a~6nK1-JoFo)Pw98(e)y<)ZSK zU%R=!L;UJy{7q`H*Vaw-_g<;$~z@r-ou?F&U_ad-W9?93hfSlceT%t4pt3y zk%-#c;$=$T*oRe+v2}Qs^_*yZtGp+Tn;?!Oq&3vN^SQKGoVJ2}-Cl)@G3c4ZP><9M zmwIRqAN4AxDus-DAC*L1pz2bPvr9Rn%fiSU5_th>f?IySkuLQ#k;DnX1>5!gjfzn! z#!F3cj?6mv78G5C;p`W(VD4sYEE#rw&iHg~jr#N@?39r*`0N=EGDmLeMIHHNd;app zcE_h-~QyXGgKyQ2@m`NuLj2`Z#q zg(5_{RXrr7r0Vj-7_~NENB?ONhqi&ah`1|!y4R0v-XQpqAy>Lf`r?@mfv9|c_E*(F zR)?_DkW&+!Emn3jWhH+(ZN~UY=lN0}8g)2rR6In`Dxb3aSLJV}s*`V%MgoEfe}+e2 zTEPNNHU?hQ$?hal|2T6KuCSVAUo(7OR{n*AE8pEnf!$$G&p1WI8x@Sz0ZYvgW)Mne6^4E(ZIJSLAWI*+c@bH)58K`M%OfvwIRp`%e)U!C zyi0?1f-a`HEi};i<~dLvbpGrO6z%wmljCasuKPOS={)vH{T0D*7xanYPu zX{<1ssPP!Iq)eCFT9D2MKV$Qt?G7|X=P2AduldRP7SpFgM3_lEq7`7B&9*$!$ldlg z*QU}2jU$c5m7jr%J*n(U7~`AGPqn(-vUSx^FicRjS42lF4={8s8;#nKSO%!9Y|vxZ zjo@r;BDFw)idw<0`h44i+yk^Bv%jbIQ?jr&d`tziIj93)P4}GQa$CSGoTlq?WWSiZ zEL}LR%w;MqxKttTikGkI^r_&n{_u0}i2#I8#>7ouS2~reyQ@1j8twu->A7;uUW>q- z5b;%UJhaZX`XT#{PFhTiVj+Po-BuU=CVJsQlLm&0t@-c_4P~#iH8mS7m%adhihQ?b zQ9Z3&e<;4{dof(_o!0PmPA(PYUEbDzXRYt==!hF%7DRpOACdbWWb5fCWXcxH8R-oq z@=pA?t_a4WINMFQdKN(?iF9|7vNeI|!V06*v^dJu)}RtDmoKX|A5T-+2nTJ~KCeS|z?qxZ6)iNaV(#(%8lK z4lt5iNNIQBjv1qwHQCs+^v zhernUOL^~;F*1^Q0Fg-=3-gYPqs`Q{^hU*DU$M3IUR#Vazqho$n+yu%fV_vU^2{I ztBkK$)hI{PD^EE+?t{h!z*ud*uTqb{hN@~%4H^KDtxsM0rWts5W8($f6v>z{{_?*A z>9FLZe^ArIdMPd^C+BkDfXqSf%Z+v4PVzhi@{IJguDi8smGUyS?kVo(Bd288%wc=j zmD}UtYyvAV^r5uSDUj_&hE800!)S~Et<&v4EpX&mNUUi0f{Hyx9Zxl(dfG!AQq`;;zJ0Jqe zBb4-8O6ik+{Pu2^2-I)YNX651^$k~C*+3N^yZi+f@=NJQ?J*GG7f`ZZOTeOTz#=C4ezW!FFllQC2CMj$M30p61 z_o(qcD6)owV5aCL)D}B`w?KafR`2$|Rgn}4lV?HuNmdRu=F*yvC&1IVNKRv6e*Rkf z*Dpr(@TC@)X}(#zCdb^{`;Gh6&a)T}rQaGL$9nS3357ZkRxUAsKEFk(cm8>#B;jETkkq$@E`-^C+7n>V;n=sXmG zw@Bxtt+Q46?c4b1*I^*jF1K-jt`Uqf&5hkms1Zn^pY3qDle+x&0FT!Y;qYajy3CmU z9KflrxUWlm<{8uW4V3B-=^-a~Ol{&k;R5N6nRO)WK-NUy<=@>YQQK!=6kXf--d1YY z$jyqXsH+f!cg}#~@~9|g1i1+=9O<^^dj4ibD(RmVT<1|&5)1@05GWO%A2!WL3~QoB z3oGy>w=^GV-(ULky4rp9<(I22IkS$4h}%cp0T4g%FQBb_Vg#}njz((9%>7~8+rF}GuSMYr?LdUx@vSdvrz0`aO))MgsR zG5H;&tGQT;#j)d1(t`Du%IR_xGYPTiAi650YVWgc>}(8k>Po3g_;sWkZ@nW=(nL%7 zcb;a)!KpGPG#oHOD8|>a$wrcI*KjR&1^`O1D@V&eEwETN2v1PlS!m?7UY|oxrF?sY z1(#6d98>7cUod)3wV>x@zYS26xotZZpc~}0<6$Lz%uC1Ym6c0Tdrl+Pxhwx#_BFl!=Sy`GD_FyO82^}_u{FD(db1&a?)cWdbCctK z@!FT_+l|#l$Jv5>w>Q<7_xA@IR?~dyz|-~KsFvF55u<4mc$U_D3@r9su79VKasi}- z+6v?zkf9TrzmllaNwaPlv&jxU{X=QmbvJ={_#w$So#!$kU1KFtP(hsP1&we*Q`ZAU zY7_$)mWewu(4F6%& z=QNX&S40 zv1ZnHgKC^y-Rr&Dk^U2*1MjGc$({T&X$;~H;_U}6m$Qoh{94zm0o$g)2sFaJPg3?g zyid-#ZU^C5Gk9N+nV5()xvn&6u^-+avXX>T?Ml9+c!ZtLN;Rs;7Q8b_peVmtmQq`t zmKm0bys~UI5>)S8LtNxsg?5@5J9TRIUZwQIN`khz$^LkJ(K{h6$7Ag^0Ws+HznDrr zryW|=IZX?{T(~b6H~T)FhV^f%E8sQUdh^KLZqnBF%JknF;Y5P|+a1Xn^agA6 zAuBV~B$2kV5K}>)m6i)T2&Jp*Yst>X!pHkCvqEuDLku|x6pZ~nsf><$M0;hlgq(av zo;Vc^A1kKUX9c7lEo2>8_P{gp@!q<`1gK&qC6L$TT4cy&cB9gW$3z&eCZ<@GuS?I# z11O7i!|5c)m~VN}F!)e@Xd%Ic{rp%aTW)>urZSBNCn4ZKlJ4Gkd!CuGDHs^I z>OkgENkDs8OrA)` zk`JJx##v2(a=hO$r{scq=tVhg4Lgo;<}^{#S@8bzhA8jRL#11g1JAXAc(+ z?rX8@CP^eh$TydMYhXYg0*TrO^uJkqOg3+ti+D8GTmJB{vWhsEz`y)rPASvQp ze|y;;ghzFL@zxQ3ob!?U`<;5)Q2TT~m=SLkGsRQJrWfpF*0t93-wcrq-`4)E;}9o; zIp?Fys%((pxzf;v~MO$wI~MTrYH2qeSFQWT}B*a)@r zvBco5;rDT=<;YIkwvsD=WECp_$vPr z&>_&i@f^zLG|!YE@07(-Biyq0l`Xz@*h1CuVoZ;;$jkhCXIC(3bUVvvhlT#Z3o*SV<6#3)a`I_qrH8sNdS?!T#UMFxobpAK02V|DT>87ou#s#EO5`&#UGci6H_ z+16)Cf+6_Tb^g_5Y+v#I%bz_R$xM_%0?A0UoJs`T$q(d34$_cD- z6@;z*P?h<-4~Uu(Av=dC`ljSS;bR4x$+>T5+wZ0sk%*q4Wph9enidAeP_Em3L87sf$q$tv< z^MABPw{};LW2H@D8N*^zjagIfvbh&ga2pJm^7^RTQa(C*_u<188YZ*`lPGQQrH z6cYM5aU_yh6fmwr-@r0@OXsD zX*A`I*4x%sB$a;fer$|2(rf>mmVN}j1jKrH7_oPiey)Y+Tzf0lAdhAL;F zO6Po$MYgG#4=-Z#14c$ZQU;T&xnF_`e()mLfqerry?!%tmE2-J$D(E61sD{Sb zZB_el5y`c@!ovJQm!%4$`gtGQ{WiyCyV;igS-8U+X`7I)4fs*eJQB8gmulFUO4@9# z^2?Nf)In5!0>*IhU1wVHr!$e5PeQMm1dqtoDLZ&UlTG|59|QIJ)P+&Vr~mk!+uQp{ zaD4vrNKikSZVQGM@8}+koLuy3Mmk{?{bGsQjo{R)0vUjG zq~gW`+etG9;gOWc+{}=kj2SOYIZuFgdi~#yr#U~#d;PFe&blwLhvVa){G#1E*IpqD zr?2pFl=7)Z`ktw;g8oIkbn|icF&URU29)jVM_fWvW+q2867Ws5asv2yc2MBIHDaUm z+d+7#I?gr)Cn-*kJiwZVS-Jxkm3k|Kn8RiuuI9;V^Ja~Y#dI*mV-hE&!N(lVXE;*()fUG-e^aA$_q6=mZ7YoWlBnF|C-h3@qH^a^ zX*1162k@PU7aN6cw-w9-jq$D)&=8?Y(6)O|_gN1OJlMDLGwE53l8Kn+5t4LA4X$*a z>bm%`^_&NIsBA+8tQ<`fj0Vl;4e0W1$v3@0Ui1vC?+cMoy9dsv<)^mgi`YJ@%G80F zzqPMDV(q1ynub|97~X*(GCE)+DjABwHF;BXLO5JY)fE1Qp93 z|8zs{OILR*q5o^n6C-;%ZUv@($Rq*WzV%=0QCD~}$3NYhLwqkbPIybA%SzwI1ES(s z>Pm{n!l?t9&xp%EK>t{i5w$PPZ$Qr_6DRko5>>+uzGTmM%V zI%bAh$?}3cp1_Eo2^b2pDuqAjB{VFphVKft_%V(hK9DR176>qxKUYGN0$J6)Xa-WJ zaPj>Z1;27PBF#vqcyI^^@hzttEp>6ox@fevh47YIVg%ad!(4L*ns_hp%{z{qQ{*~? zajTV5f?aKemeM!Ed7-Z0?-+wSre$S5CHe*q%r*Sq1jTqh}-$OiuE`T;0GPR!+WdxiLaNBGBI#X2^6=HgLt8r|+CD z&;K_!qYz|;C3Eg)M3;nb$bQBfj8Tc4G~xZTRzluz8?e83OC{Cge5yuJVtd|3Wx2^V z5T_iTCnJa=hpIh)VIFpTbk+5AH^2N)jLaRg;d7^DO@jF(P2C>6|K%oqDQvNk_?mh; zHO&w8c^cv^O_ug``rnLu)T{-vy35!u#9h-FuM_2+8Pt%@on_cEGef_ii=+idDST+{ zVHS6TVOGsv`$osNV#cO)n_uMw=MFn3*D{U|xBMztxR#cixiy2=EJe@I_3X>U5nG%m zLxrqZE8ke%P!eNK*9(qU>|cso|7v5Yn?4Oa9TPvzo8J%FC`Fqr9DD2*=33KO6{}34 zCLUF@YyVp#;m;#jv(N3=w;i!ha_V$nQxRT`u^PfIg=|&P9{%w3_466blx!1cI(+|W zqHO4(Kst1X$9~1UMONkD5V?chPB_yqZlkmxf}hvG#uyqnt5f1x9$sp(ak0ntjaE6u@XzdauhXxS+ads3 zS{GF1J2M)WruDJuxU&9_8+PuiS}@92mYbeS+xmJFlu?AV@92LBJ%!9*3P`4SPkdbw zQ)jZ}7$MO};!_Prf%HvbCVxz(^fRSI1=*y$#(S7a_cQ1427uyvNj8|F7{a3qIyveu z80belG`=s0{dZ3lIb38ikMBQFn8Z(4zbp3;`Hi__9HAs8d!uwX{qa;Bj;As*s2A`H zL(R@-Z(!{GZLvj~E>X{c2>a&y=(>HX;bK{j{nQ`$!me>gOk?!VjUwixomCD6P}lGj z{ywKEX*pD*dX3NbMd>o`O&0jtCen*A!~5n3c4hI~7AUp! z{oV4RKBq&4#YcslF1CfqKJ4+IH`jS`S%bcb|~ zQKMVBTR>V$0qJIRcXu};E!{|WcL=IMgR8Q5j|gj z|4aV$PY*c;mL6sJ2WC2!XP#Dd2Z#T>On--}KeF_FivJ*kZ~YCeZwyfwZCYX@PbPtX zYMgqstWkQ69C{6~GN>B+^0-g_uo{gbE|0vXIwi@NL|+o;P!_|-cfzlLUkl(aXgkTypuBuH$&5nVW$9vDj>We1|qQ&yHmn)Zqk=?dQ#~U~o6O zGh$${7+v8(D;lndY4~)|ZzTTWyfuN^0C82F17+hS$X*yOTzHSC$6Ks*H#<}D(=iZz zleScq3ZNqV{d43l_oGB|NGLEst+^CWT8|+Uk*pZkflQ z1H=t)D3phPAgN=>U7%inXkJ!QZ;x7X={i0lEx74zY$NS#?^B(+vlG}w>Yc2eiK1y+ z>1V4GywdVRqMWur?RaRI-5tU7nI{c81qOZD7dT75eHHB2_v+$l6*NLA3MBsqII0`Y zdfsfx67{qxts_j1ze%T~^9ILqdVaSuDsSTR*XZ|g?;DmdOTe&~noD6u%%X>LOO*>= z{gS7^CB^zyaX9>NTV-#bJo=H!Vq2170`i82ZNLeqXvSCj>oC(!m!*uerf5{`AEwEB zIoB?I8^NJsxy0sh;8)if+$;fO@@;Hcf!^=F%n_uO|LOw7?axDz>6L!OG^p{D7%gA^ zm3j1gULuIWg!BgCs0rU%{&J>-Z`hplC-p|v$E3x`W|1sOc*2}K&6*}WkX_3NS!d+! z?lH3%5Gh%#^i@B&;bJ>oTf&`Hy5O$j>HAXO60uHdpF6|Ob*Jn5tEob{3&_Z78}{ng z+m)9gD>qlQG`9wRHGxlKEk9m1j?Z^nJ)>N3Kl_yQHXS4AM=jB(1qV;M{=v^-Ze#l~ z)n17$3w&Miy(;H~@DRl+O21%}IAQj=ZzXT&br?9yM8<$lf1s&qljSSJ2y*ucfU~nv1q+$l;LUml3QV3WsrBt z%dAFfgv7G1XGLQ+%{&ObXM5zw?IHNEetBuDDb(Vc|BD-pp(Z3_vq$iey@LB|;$xS~ zC!%)@pJF1?R1tB10`>>%hD-}^Mshw68^lYDWo%GrP5?+J3MkbMcDhc|FEzvPD#zxn zPV2?epIWywN`5QJC3>HTq&GV|eMQB4bQkeHdv4o%nvHu&13(!i7?BDoYqd*j?QCB* z6je+8z;o~P)pr#eVLtfB&!$ZYff=_bZW4GskmU8-gfJ12 zLVsY$>*^_!wT1kL*q-nbwOec%-0-E+=Mx7}=O+RjB>VE@S<(O2&cDeMqA+qU)n;?f zw{h2D?JA3z!^DXr>_=0&W_?qqnUS|qsh9h8!zhM*CK>Kk^e{>i~=EM>)oGaC^FL-Ac z6Im&z0f z^`sHTl^BaPN*oJ^drlTV<0@C`D?}SJphV<%P$2XoqMH!n7bD)Aa*)Mc(!Sn@|AGm4 zv`yVa?f$79**|Yw&9uK~HT`+ZJ}LTme)e_lx!z7!SEI4kZfPz^%XOu`Y}DfF#jX#& zjv!(pwmfxh!Usf1JKV^l^ZD@YWBi}Rz|EW5*NiCv{Ti!8bQEV}8JBE)|J`c|sV}EW z7^^*xE>KnHzLobd+XboW^-vE;fY3Rz^X%kV`{@GLc zO?6>*1`>WTa%ufZO@5=5YySvysG?M};oN(=3SAE8jlFmrU(}elfki;Am=xni0`4k- zD3?b?|8zQvOp91L(~pR8Y?LoIIB6Ga7%PQ0vR{+|bNDj;ARAxwb0pEUh^1wQI#t9H zt=tcuEOgJd@oh$IsrROqQ-4plbXGldY#!E|czIu9HG1_aTANCt+?;KTeODLX8O9hrtjDEk|JB6< z0aWPA_C5@@{q_3!@20sm=&S2x#wjrOwvm>xZeT@x?x55{41)s1RF7j23g-X**=_M2 z)T%L*WlGpRxu|%Zs0y_R-FHVvI_j7onlgBc6Cvme-kp?NEKp|b6P})w zuhCJ}CGJn}P#Q$LmKsRKfNnIVBzLT(tS8p9JwaQj?b<07I?;4HW`6vhQaucvZsoe+ zT15k-910fQH4sgDrSosAFb&-?)+fKPWMn*Th zjH*Dx2w=55|45&<(`w7@m?qYvPzU!pdo)%_%>Xq$aVLu*4tHK{E;z-=1%k< ziz3~xOpk84V|iBlJSZ!dv3LhR{b5%4`BQOc02w#)=<@n<7b*%aZc!5gd6CG@r0Wlj zjPyg(gv97z7;TS+|k zsvp(o1Y!16pqjbWNiiMRUmO|GI}^#DuojR?@%xy9uUNmncl;n(io*;Dxpu}+IiS6k zVaU$q!{z(YFEe90%5@W;-A=&USAd2L9VejkN8k$ShdTA;KiTI$+J>vk3ih2ouajmm zFaKkq8q`@@cUeI2RHg}+JqeJk>QPS}TS`dkW&GJAvRG{*R-yc+Qik3Epco+Nhid-U z9?c=y-?s)1)=Vnd;aq-AgGu!g8xCZxBuwgwBBiNFMb3fJEg&#Xi{Ng0h{Vn*5%v&G zu|=j_C$L|ghoe%5kWDfrmiS+%Qnc>>x!4BYy;y9`Emj^~A6Mta->H&Tw|mg;AGPxI z$G6=(lu4`dFD||OL;F3-b#{)fc0`&h{&u?%u{`N4MR5(yg)5JkiI6t*QnS-aHGoJfo3 z-2DCDY`hkHj7zT?e3bGyyG>M8${D?o*|ch1G0XMJ-YZ}#ZRFt-vS#sY9{Cj@h9EGi zJ7J&G19{06q4`m*PiNNKIwyjL(`)@aVlsnwEKX$nq*Et1`9OG+fc?nWc_tD zKdwmecNERPy2w#pyRA}xYvj-EpO76Ty|vFKV~}i47WC_lHq~Z1dm%~QN;o;)CsBJO zddW|@a|dBjRzZWg4qQZW0`X8E@VJ?p-03$9KEM5g-K}5XH2Uez@CebBojwKcip2!L zy9pq1H^nB0VT^7fUsww3z&oz);X#KmLx+XNP`+DwIx|}Sx|>l4YX)7K0!E?PP~Fxi z%XwWbud9cnot-ZJ*IuYI-nF?f)~H0mx<#P?H}_n&feh|0A^8rli)#pDG@X&Sco zTlzkk_Pwb{T25$vosF_;(w)d{KDm~naPE2btdRNv2Z<{@LVAQ5CG+ZGZ{W(9txD(A zDqb1(^m%ER7`N*m3;Hl!=TU&<-{`J=G`@n6{!KOT7RI7ntYTlq8_XDY(lJkQ2E#8- z_GG4C@<;4a@DZS)S=!%JcVJf}lUgBn)b;)t*${dLo)i@LnAb=U(q`s9_^i;R_)l`m z_YZP|(J|RLHvY#smSK!`Bl!FIkF4V32Zqs}S-A$C1p$(UeYl;eZ7ye{Enf=#qOj~3 zo-DI0d3?%^g|-kE4sk)OTJDOGK5p$RDyHg=Dl!VpGsdN&OuowZf_b<+$o$b3HXOjG z#&ZTxETzehKOYi3xh~wh4ZN&9;w;zlNqh!&mO29Ol@?l(O%fwqPU(k|NWCI!^A9`% z^XUv`&Bj7B5m7KwX8y5=i#b5*&qo2~H44C?qfU6yf^FlNc#DiH9Z+ag2q_xiYI zf!Kcnh~M*lLX#U%-!?>+9BWrB)0%K1@nsW#>yK!rNw4I9cH71O>o7vEG_n|&e4P`O~WVrhnskuv9cKPeo_rh;ts4Mz%<91;`ber#nI&xwDq zx*>CSz*o>~oyRy`R3M+ms|Z)j?WS^4{DzN)4;qtmEnZvyxgb3>2*_4J)1^f z+9sqsl-N{&=aAMj9WAdRQyXMj?kzR#Sv`R>6pf9SL|d5ujE@6@=))0&O_;=Gp9=)- z{7DANBFOP}^N6UM^Ld7vdMePe*HKnSsIG@h#&?KunY2E zAfa*bd206hFlMt?-o2 z{kuGcOMJ_nIj5yu=>bPXrqJ|k%2-q{hhz*;0e39t*7I}$6wF2X>76DYEJp77hQM)F zOMg`vafJPg_J&>YSGT|QjTp|Thjc~tgb8`foW zw?v9r?mwKEJl5{w&Kts1>Fht307dnC^y^J!vkPcy)Ujz!R_BC$yr3AreET)uuGagW z8fvv?qf^{{@}n=R)!R)bvOIpZNkAt#DWgY$LvL(N(Mnzr})Gg~Fn(Xyapitq=>%G$X0bm|W6l23Cz zK^89uQnP*g%yxJeDv%9d9}X468kM;MN-fb#Pg`f6U>yF+M$36qIek!IP8=Z^PczvW z^`teCDW4RTNP89+Z-7bg4fO@P7fp6J`MxpLDQ?hXeCS0-c&G<}zYl&Ja{ zvT0uIoh6nA>Vr-)0X44yp#!0G(F)9yy~rWRJ1JduEM-#0!h0&{0Lm9r>yX-OrRwh= z^5r_IYV_JV53uR)i3RogyGCet=~qU!SB^_?kzzfb6X!qK-j(Kz>SOd@k`%WsNz`eE z40`>YvQ(1$`zQzfQ&_sxF9Cgx^joet9aH6rOB`%(4aqmzG*hK*Q8Y`Y1nT3@e-BMX z0``22$RuM#A~f~g{z>Hgu&vMDJ^3Y)Fb&gEQ#K>wT~Y{eB}=-LY@M{cODJ=TMkICI1gCRYvKQTG$UFns@7OSeCW|9ian?XAb)u~1cp2R^I_}FDAAO}j}Kgp;Z0F?*r%DGk0rjUe=nO*V#Rn{wS>KfCZ zVJ2DmfYq;-t{xtsKtVcV?BC3NIc7Tpz3a)0OqiU7AY>!7ws)S-e|T$tgr*Yincr>7 zRp_qj!FQ*Cx`|Cupw-q^Tdv~8TknA+~;Nr$$v!SYmS$2w@#pl0K`wz3kBHBHwPs}al+nZX4hbwXfg2OhJ zOIu2}8!}Z=gzRsnkvODM(IJ$o(g=-W)*dVx0p`;G>Y^;*=P4e$Kl+~!M3RJ$^tSj^?;J<6&tL2G>+S8NCJ^=0Pl2xSH-nMSFzw(-5zZFB0o|pK<8i zW@CXcG88F_o`o!bppZ>+^lg*}Tga9O4EZk{)~yEp`PL8;H{*v_&d<7|qW+bH_v;X9 zUyQhhNQLSC!_m=Eky4h|+w%8gm_A?G`-9ejXWmsIxc|*-1qK2@9R2jk3ArPd$7L?1 z%q2c8-=FB81u0Q3F&&!XcHWF;{+h-nlMF`plE+Fc889i1q7J%&n5LqgKE7m7> zHV2%JD4aYc@H&ADuO&PsfFD&UwTIPPsx?@RvMkA(CteNclbZhzl?){w zKb1>o@HP&z*`-eqi5O9pB|Qzi*bypfnv~~8&x#zHU|aOxd+NBESSGi!I(-W*DD*o0 zomApX4a4M^A3c}*!3hGA(eARS9sLfb0&}K9tp8#Mk|Oc_urzko_vX?viw2z&H{PX_ z#FWLxl@t3RUW3k^N5<&Ri76yza=pzXEeL;=x`n!Dyp?6*DO_Yt;6~c`>$cml;n|oE zTT2|R2J(e#f29k7&^VVoA9xr+N2XRqQmWtti<^^>mN2MVCxS|CM0NZ{!QgVOUWyOBrFHZ#Mv zcJ&2s*AcbEyvDtVkfdLX{VlKh3HO$d$MXJ226JKbus1_b0{_#}l$F`)YMj^;`BZk>gBFc2TPcn{92(RiP{soJNa{wV>R;>3@vKbVDHyTPTzNY+c!k{9Cz7_THPw9?JMiu(}kbq(Inc}yWwmRoIjiT7o zV@eC8d5^b9^hp6os5lfMZTnT|6fCl$QH8HI1kS8|>~yhEs7p)e49N3YC_-F}moSeO@e zuOxAQX)#<&7f+daSfL)BIs*j*<`GSKp zW1jEZpTAcgIefWR@Yz9Ye>;X!z>f&d#E2mm<#FiKEbNPxos$#EfFLME1x?4pLXVL` z8oPhWc9HzGyn3(Zz-j6H9sS_*%o=MSAN`G!Q`OMT#kyE-`6T)mSpqLqGO)y2FvXna z-(&2T(DBZv4kgj2?Z1DT{_bu*wx2x!{f*V^KeoS7d<(*S#q=uNFx6!HMD@XT3Af5v z^}DKswBSuCZJ*t3R%LLAL`>y7czhDQ0X47j4Szn1ek^|OD2TMW)gwFFEu9p~fFEEzIEQ={rLUx}c&B@lHP%1iE0aBe3%H1z_U4Cr_M$rMdp~=#`>N0FW!)GxTjDDUpx;g4j?;46)ufKPRvo8WK+opJoleT!tGS-?SZ_G*mF1 zb=350HaaC(I3%b?VSMIv8*=Ot5W=((x>yg*T5T=bDYzXuo}agRsz}m`13NoE-2c}j zi}R3vb!>8xyUXD{4s#aDlK=$Ap-jW`?B`H~Il?2e-Db9+De^E%j8+qpSu&~&3s34Y;Byk*r6J1gBi&ot2Y6G}_V8yHcCQm?+r{l1HI@RsnA&i_QE@kK&dhkK7*otNA$_ekMF!_P&vD}4v z?%u+tL~T1AHPdl^H!JbiIns>Wr6=b(G%*M;!&_gSDn`aC)q?OQ(W+xX$n($n73{^! z_g{~^_!sxli8`bPMO>`TYS2(6VUr!ZwFP67=XQ~^X}t1WSIP|28f8x&wx!N&LQYUT zKXZb*6PZdm)seA^eplVusS-!TkAg3|TWsn5B5ws!^g)9Kn$Q#(+^ zeso!;BQMfHB&x8WrWO&8f6ToTOD^e_{lhBFO2I`b<&xAQ^;coxLDFOLj zPL82E@!Iivrz4(3X*x1p&x>zmd|s1(xYVFz8~=OxV-iaL>J$o`VsCHntn;eUJrhTA z=Qu62+Nmlk!lb?Bk3KbnM3^fsfYJ;v167U!)p4Oz8SRcDUpu_%17H$2tb|Q^2^}|} zMLm-DAB#+~!RWpUUb>GTV1u@Z$pnQGH@9GNyVpvoEFdMauSDI|22H$LT1uHhjjk_e z2BH^L7?W+^i_N(3Qo69m<@V_YHdU^4O44V^(2e&lU1$BPJ}0%utNQ&iCGko-2g0L` zRTE|OS<>*|U;gBY-tW2Ab#^YS9N)hP@mh1vQ1-sP(>oVe!$S-KP^m?`X&T1_!1LlY zY0!M2-7E>(zWr~^kHP*Bgu&y#9IO1|`P<2`PogU{TfrpH^0`d5+0_(jTC+$+XQHDR zT*euOH#od336FNJon&+$Z_RqJVuMAWgil5V##Ws`?%|N_JW2JtTGV4lXi5=o|-B(c_f>Sw&wY#?^86 zFPWkCNc-c}{*Jd5@I?L0-<8L*YfTcY2nP4F8wqo-xSy}SD;$U>7yf!NL%j7ZuU@k% zc8gfyc1-Y0$oo%V!;2Y>UDJ~80N+UjJ&UmC;_{{{GH_G8yVNTrK+Y7QyN4;l0lBEfjKYX=!QrusEN7wWFK< z!4=+4A7(KCld45gR%W6q?IPUH76o$QOGgfI1V^i?0it-Umm1H zn^E?6i9dFtLXs`1ESM;+l9qL+e9O4G980*>;FDpf;!%Rg=XY>w@YjxaubO-|>5xb{ zt1|*D!7=75);p(j)^qmvnLItqu=$5&ZrGO}IM{g4Zs2)i`8&0US7JFhmoTOSHv$u~ z74Vi}7>ch-YYg*RaN2kjas6TpIexSHJI;zaN?R)LLK7+6VTNdnJ6y6I9DcA^N`tv?(WeN;e zm}=UT|BoeOcpYJTGXIYSpQzFWYvUi?q#glf9fKR*xnI-H5LTn(^&X~@!DCNeUtDp_S43Md(Q;s z*u&rG4qnWrvSOT|`O?K6{=L<-v<+HtKre_5XmcE_ z^f_}r$L?f66Lc`wsEcf8_ax%SzE8(D;hQ@mff0Zazz~`u0Z&U4On1In)i`=k>8TV> zcOF;BeY&~QZfUtqUu-DT)Tq!=tI(m5(OJkU0b<^(CrL>t_Tz;KyvzQ?(Ej=t$*OE* zzT4zcU`d~M*)&rSn~|#BKNh(ZF{-qgC~jP*Atm2Qr+G-))I*0Ae05h@Jdl*1V%366 zzcFQQn@KRri35w9#S#_sCN~N9LXuG@XJ>`2FU=?eVuL4STB8#By}_80{WWydvhRL& zugBs`PrVH}CUqfjJSj19T76#}*l(VS3gqt4FyjzzvJY(o+2DPrv}U`6AX!K-?<-)v z+h^p0Yp2UTaY<0EkAV)~gPNz(N_b zsg(CAsb(1Qdx-(K{;7^QG(W96_yrb==ifzo)`={Jn8t!@cxpMvFc9dR4NGF55jfMj zJllvfB5E)E)wg)l43Q}Chs7z_0BdEw@uN~J=lPBpiKLt^mCEF5iU+`x=j2}t8=m`6 zBwL!5?Vn|J3?^k7Qh=Q|`RHI-oS=>U{o?TbkdZACBGYv0E#E(>{LaGTNf5$Zm>3L_ zxETG*U=mWSm_niEr=Ut~?~4$u`p%AGhbFa-f>_By!Z(4;NJ3rPXqH^oOwx_&ghv4i z#YsVPFAne#CRPR6?)VdYTmR3S(Db7+!CnL;?`M-;_(wxdy*bKevq~ieON5NovZfKD zFBVt>9Ane;s9V!i0X=HA)CuiI*Pb*g{EzT4iM?(4`Q=7^kr8fWi}!q z1*Sp6yJ3`jPv&=~t0txLt0}w;H?|!g>#e!LKHwy}0%u)wY1g_^(%nqY4Rzr>s}I)S zmaab)9TGP5|BqDPdU1pWiIa{Z0HC9d;=_{JH|O}A=nTH7u3$bS#Gnsvv@3`e)0H(g zA@D)^uq}EbGBVN%Ug@JzDK2ZCJifWuuk{MEL@e`f20<6`pNrm@+;D(^F#swGA|!(f z&4a_zfSh2l7ysSWWogl zode}vM*S~+CX4{z4v=KUUnpw-=XI0@8x~Z57!3xKF;G)z9GfY@reN`7KiFL0VCYOu zS6Bx0a%1oMOE1`+D@972o%Wp>^gh201RkN3fKr+4BY6i!JQ_<$;98sR&*K^1s=j^s zp2pbifI>D)8`sAxGo6N|&q27&{mRq_62wI0nA*Ia!3~iMJ$L>bav`#HG;pY@B$4^Z zD+==8m`M;T*1!mlPPPIPQc^o^;)oiLtKI0RC`2PTc+>(<(h=UPLh^<(bu&Q{M~%KKt?MW$EA6}WuSaaDd@oQxkQSPbz3P9HgU|FLF^29AW%E>#h}XJl zLFM5{AfZ!APB9aC*^i#Wu#_Pp2n@PTmIRl9QT@d4;n8VJjI1|SdTSDr0A$Kpo90r1 z0sV1gBc=2lpn1P{2dz3p7Oi-;_z31ydNN|RW7(G!yqA0C_vcw4Q{?1b-*Wbm8ntO>iXb$Cp_zHUBLE}Q)MlQvOkL7Rc}UKO5% z8$7UlcKAsuS}edJFAlzt>U^Y#*-84%GOLj>(RNh>6qbQ;}nE6jd$zL%0R389#RXO~CQ@ z1whumWFDZH*+P-34RT6Ihj84(*@w&$$c}~<^1ARif^{P3=yaU+2`_&9f)A#L&(Ga# z_U7}j6!F`M$cd%ikAC^4s;8PHk{1GCFRc1OnGKdjVh_4sjz05>qg9X+lTAi7?s<@* zq6`4a!l9!Ursors^lEvtP-=<(W}tt-CoHK~siP36)%O6WT4ygtJ-ve%w?DCjwbV`C#x zrU{i;u4S$q64zj%X&>aNF5U-EkcU^esFq{)C*>*<2I11mi}lin%@mN73U;2o^3@rH zfFb2CDzDU<e zvCO@@PI5Yb4hq$ySmwoF{8VsxWUUz06&?f(a0yp{6f>pjSf|+>nU%O?=?Zg$1UM8d z3q2P`_4G#*#;24mNv0(L%22p|LqSkk&pW%)VL2|^MJPDy!(F2OiJ72ocwn~~ zr6{_bKS?i}!{n7R5Xnca@ObH=6evshA{O?lp`Zk4uxHIk%bkq^WJ6U^-%kuC$G}4f zV`k?6rhX1TFi}^_#h0Ui<4hpAY<1CqN(8@%p9ll;F?>z>KM*46>(9RY+y|9NetQoi zrZ%ZylU!(4Y!2nv`k$>r>2CiU2Se^DhkADUgfAdmO3J~AP=LP6b+99-DXGJac8uXq~h zZ`4ip;VunOKUg)gW=7hNSElTqYJsN>ki$A2^lSB2Im#=&ye`hO5I9)S38yp~1h%-Q zP)wbY2#^d8?a%#*Os2C5@gzrzFI7;KT=YSk?B#9H^RGV&6b?v1pf=|L+z%nFP!~L* zBG^dqh2k;c>n4`oxz-BK$e7Q1(H+dznr4Z zUTllcK9grGtsq^2z;p+(w0-xPwuT=V?JMazKufjdU zWTBF_$&c(ovbG2<_$w~fK6~4p#Rx8!o1fL_geZ!d0b+zfnR}QR7{yyc6`z9`%Q4=E zVP>Q47NE;8Bn0Hz44#mD2o%%UdFYJ1Hv%mN!a~3pfe`-xGB^A!poi-`vDFz|6Bppn zP*h?H8f1u57WMwLtdUoatO${=(2H-ZEOj+gw*zkgXfhpdLPfrQ^DyLO_dJ<039kCS z%Qr+|8?Cu`^AjR&^=PGo+z*ggNxKcNP7ZjQwqj<}?6zA*?Nji_G#iGKq)3Y*0vh7l zN^FwmOo*9}fh*Axa>1o7EmZ*L(K|nMad7DD&P)h<5TLjbs6jL)E>rS{3sjQ*c4!LK z!u({RLsw@CK)fI{ekDA9^<>jS*z#Rj3Z0WeLmqRCg`hc?H&`cGp8VJXQLXG{Tynrjuz zWJ}ZnkOkJm_SQ+LHBt`C%IMo3vp>kze0hK&V9DTc2nm%>^k02We_2vc`_6$el<*dW z*9fw?P{hp$T%6Qql@jIX!Pvoe|JNU#fWQ$|mZ4N5AQtnhWX=`=M+k+iObVFuM6_`A zS!arbj5ut|>}bxeqeEDHT~ehtB|4(x_h!?{TGMS;SD7&~Bjwq_Nx_BuEFtxN{xVWF z?uFh?^ACrCCC_)oPVB!(l1d4dG;TU$V?nOxLzw;W9-%%jeT3dG)zgJ$9Fib)i8(|I zCYQ-YbF@>O7hiPGOv|4NSYKvYO*ujSxygX$^~^Jl75e>ZwXgW%ta zDqq9IlIPo#UoMYz(Dbo(JOZ3&2bS`mIqD109#e2XyfS6M4hfq3ma}X`ZRfY4yiY<; z4JK{E!q};0FZeQ*_|~Q|=RLJ$$Vbe?d)(yD`az3JJmL%XXfigonU`ls05~VdSR2s> zmWtgwAOd^k5$6pNDblZVb>we*9;t%#?{HN}!iyJX?nw`9Pg52d&6lsd*KUb8*KQl_ z79g^l9$yGwe*wD8+r)X&-FG@XB!fd^sA6T|;7F;Nh+L^Wkfch7fzl>8ERQdA%ObzA zJW$3Yrzw*r25jVu)3v4N_)&0;r#Xu1Q5cj@ms88(a)c)nsrKMj$He@ZiNAt&DVUk zJW_^V?soW{El(Ee-li;f`k(+fEci!3n0iMhZrOmYTOWqmSVC(-jDb{?Uv73!1qp4( z(jcpZg9i~1gJ5)PQ5r`gI23*S#SQj^Cu0Y=K1dzG;c5i+X%HGe{LM=4G^xYoID>+i zAFugFg)uOUT~DAJp3i+LNiqO`G4IMOS~My~GiVj6fA^h|8xUiN6FqnEj|IP5?}U)M zN3_lSQ&{#WqHowtn+2YNJ$D6Hcm0>>+Dri{Vi-1OTb`K_#I``p!v44sJ3}$s3no=2 zauemnl2K&*0Yl6}OOtK1d`pDLRsTt=(gz$E4mr^R}+@%Nb)8Y zz{o3I5Ky8kg7$khO$-`9bmM?;sI}>M!hh3*pLvWkj6dw?Ppt@Dhf}Xw{bS)_01ODp z18k#oVvR_8imr{tU~S|%>JwpBm|*$tbI>+)mhXm^y%U`FQ{19A2`hU@j!EAVr(x=D2dMKIJ*La;p$@+AB>9TEL9luIdNw>XARyKPZ zijR*AK?O$O1&W0Z9Cr^=U5#^4HuhMK{0w_LN@u_sx0BVrHP&$_8e?e{s*cglK@rw*?X2Z0gXmau zjVAlCL)2Q=O-iHHzWA9x%FmfUOWDsebR+1gv~%s;u49rNtmJJKU0Rnf!qtVv?iE z`D>^A`<2a$$a|SZ?%MTLIEWOS5>6z?jIg07h$f><3Fy_S*I){Kjh`bHJSt^M7!=VJ zR-D01WGaN(-G$u^1HSm|1tqYT&)FCgzHFLxJ{+86cJW*4d70t(FM1O|xVMTIthnF( zmg<M%>BWS!hwVx&O*03@XSRzJfw=~SuwolIU%lUdoZQ2BdG ztY{vT*U}!o!on*kSXjNGpPCl*D8i`Uvnn1DxQ+Ar89zk)YGyoU*OvVOLjf4wj!x`H z6IdS;rSnB00AfAJ>UyOJ6RE71ojPnC>SAMcj6TcCc6YoNd=ZLrY-${!z^q(5X@t|S%2JHm_A931h^mYU8=iZa2u zot-5Er0#lk3lX{WpLO=93FxPfg+Mpm0=O#ij_QV1u-GG67#5&3VQBE&3f>!OF@06)nEq)D80&~{D@PT) z5gV)D=8g;6((64SF!yr$c#zRom!56s=ZIFoVzgqR7pA=kd+<*3EQK*Ux<4_mD8}+z z9_@bk;51hc- zIuw?eE$=DnWPK|Zia-(QD5~6spwsgy>RCra?9F>7Bt##t?KFO!AZsWQD-dPKcBp!)D7**_u zz7br-UpEhH<7uK*Wo@=*W_)2=7Ih3bAjw!6oPK^&5{~!4K3RD;Zp^L&&%r1hiqa_E zZ87Q9p~&Q^U_AJ}co(5%ajsCBwwNkHRs(H?i`-1p5FmTckwJD4X>?LAQbtOVQ(z$Z zqWd3VXB0VwnLT_2|bre6Xmq>`;ld%103~W#gCop=uMf%E z2<*?bi_%Ndonvpa-EJJ@*LoHW1E$$^Ty|HU42smAHG(+8T-Fksz9--hre@Aelyv!> za^o*iRFeQ?V6K+PYV}fg>{jril33#UYfZH)R;pdvR}nw^GYF85Y#o?8j7qo(r_K;< ze?=uqh({xUT5v~WMmpntwCYG%;FRVdi83mSEA2>Xb4LMlK?3?A$}geon5l|OPj(GI zP5B@HvFN^5^gT&Of>hMx&rz|M2x5#_;qwwT~pY%s&5(d7g@~q zD!Eyk(lAvPJSkja;JPW+AXxeO-g_vY0wp+@mNN9%Nr-&M>$xo9 zS{*gG)o$61wEG}SB0WlP&kdy_G$pgVF`yR22$Q4EU71(;{xbMR>Y+|CL8F0diJNi`LPV`11o+%pL`;K76%93 zZ*HyX+5cwOI6+!;!V^ZXzGY^fTI9W?vFE9*)&4djku+=FK*f3~em<-o;AqN}=1XW|_usaTSAG zd5cQ-{m-X+ty_wvEN7kj1cMx}(t7yaGsHnEs30VfVOA#z?;onPk{UEJGjqpKEhVIM z$Iw9{t7w9WJ#~E8J6v?_V0QpCJ`w4N?@34CHFfDCneWq_|E>6t=8SJXVOpL|h}i&* z?km0s#GjL~_?FX4&c#I0bI22&N{I;8FpDF$9-mQ|j7`cYDxQu@(;M1h#oG6U$24@Z zM%qBU;phRSe|1rIo`A5G4q`&3X$d^YZI$G4AJ9-qTz;*gsP43+;E}2M?)ot&uLaRR z%)BZbqK5gcR)iy}>yy#>L|(M$uGbf?FuZ6KFiz^&x#;+o z+=I)>ZC8?GL{lUsvbO*g>)KN5_m;{1XEcZu>zVVj)9?AXf02~FJ5S{KUZxkt=F(LJ_!%jg)kEN_TgQ(%lWxjnd6`{bu;TaU2=pJ$~oz-93Bm?p}w^ z`=mK$QK3s@(tsvDDa?028sm)4(WC}aePE&4>OZ3^K_gNKe}WJZz|8s=daOYa3s>YO zog2hc7zA!=S$gN&gsjEzOXfXkTMI?dMQQD%zh!GIDH)#2U|{Dov_6tCL-{`bfk+j0 zg6AmuW65oy>BKR<&r#gR!Ym`5cj~7Y=(JB{WCOo+6(%KM2S`Q5RPBkJ$D+rUgH>qI*|BH6|AQd!gS>)I948$~0O!T3@BJ3Ut2@ zNveHi(y*IhQ?Corv%Z(vokKH682(Oj%vfzj8pbr~;~R;WQKAr|e$l1C+rte_GS|Xf z>OakLn8I`6PrwF_k}TfU+bq9IqQtgvUN<@0%#%@T&lU_xU64xjp`sR+CJzAZvm!*j z!zQ^SDx9f`p0(q_DIci|{c*?~*my;x_9mtu;&}FhjRPQ<1kwm0Y|G9ppII8u8XsC|kW79AXu&3Dd`(?!8P zGT5t|%0nmXXydzG)U-2A&eFo%8?-=LE~7#6 zwmq9S1vFY3DP@bW#wKD{j1Gh^@zcA!-m;-OmkRag82pAAbnml;Ff!0lwmQdCZw!CL zk2i@f7N!(28%YbfFC^xSM~aAoiX|g5`E=yZgj1hmIh)U;{|QcrmKqm6lxV!A@it`F zqNJKTtV%i$v)2w=EaV*9m^prFk|pEhfQiTb84I>>+bC;F7>JL8X%=yEkt1W)rDR~A zsD{)$PL#@P9jRO+2@1$s7+kz`SxLgg`^Z@d@#BYI%zVdiU?{a0I{e4FW|vig(Tyl6 z8mzb3GwhbP?|QyDss+BpahP9$veDK61V;i&taF zraD?cnVEtJQ7My_5~a`?O_(ab68&Z2+QT0>9*J`pb+>1fo zw0@yhcmf+eUOS1xF-8iu{Ko$*gWmT*3z2O01*8!x-9h@JcvQVMbbeZVm4k9zaa2?> zjs;HgUl!IjjGJjwN<0{umeP|PsUrCVx_qq?cbQjnpL61dzLQ@?%m@X)zW&+-mlns{ z@SDLI4Gw=lYT9`;%C`=W4QpPI_YS%KyfBM;#@a13=$O9g##eT>ABl#pSOs&W)jDl0RHKBn=Kd z`1Z%t!c(cT{;$I#$XG{`AxbSSqMH<|_}A{v$FBS15_Hp9N=QIa2r2C1Up<5AY3tnR z9Kk!e@5BCL!*=PCzi2<+to_+LC`B_R8uE7#i(vEVMaH?&d3nI zygpZ<#~G;{FYFyQTTEa?TyuyF!>g9jVX#Msu!@!!HTQCfT<(|L1qKCXM;+3lHqy=;3X6W|7Z;-_WTzH4rwgnL3^%%)>@3W}DVi4w z+~4LEqmja7#imPw7lDWd7K_JCI4r%z&RW_Kp`=XB@FxEg{{}+05{m%m#Vk_B; z?hsNny7=N9w|3Io_W^Ds%BiqvFn&D2i3=A*eR({G`E7n(#o<{-Zg1#Um0{};-ixNm z#Kicc4sOdO>+W4rv7B)w7F8xv;N(~5T1d6L3wXbKm(k13D%$fydTy5U*M<&q7yhR@ zo{vBLX+omhmNu5o=stp!ro6nI4DkoqA0UT&j&NV`<-;o`?{FbVb=*!@puQxk?u|?9 zk{{->*rT98|7oXF78nkXU;MqUc!D}wB3O6;iI*GJDT+i|aB*vD;K9IJ^%)DNUez?+ zm?-)^CYiRh0`H$cyu^Dx#2v^qe}_a<(d=8pDKh$F?rFCm3bB^G zrCXP!jdwnrwZN`@k#Y3`PF6~>$(Qcr!|cJTbu5|2<0oTh%Bxfz${ku<#0A<6#}`QS z`Sb+HUH)ga_i&I}lzP>;X%!uRij&bm?pu*oF%pl2?=qjF`_e+>$~5|t9r1Kp!!+kz~#`RX|0H9*Ml*$%y&!Ck_Lm5otljy5j_a;IsB} zl8ZqSq2_drMDwX$zbnwG-3yv`8+-D^ArjT4^6TU#C3%G_41@vlKlcP|rXy)}4K41% zb!y58Kfx?YmEwIm6_XDl(y~}epmvEf^@584oLSB4wU~Y0nMekVF8PhW!G0K8ZoslG z6rQFwxm_wN)Am+-@hI{)U41268ZPWon`G4;q12lA`B?qUIqfncbs}`m`t7pwXS*Q4 zM2cc^BDNY4|Edt^PMeo4iz~nMzMc!(9O^@F2o(klL<$jB8VOQ1uQ_0a10`}gW>J5M zfzRD{*_TE*Gh2zyZL5`Hvs$Zy`_fcsBYoraYpG)-ss_Pt$MyF z0bJmM;LsV3hBC)bv%p9Bs~H;@qWYrlry_n3{UD5qgy|_4H4d`HY_eY#( zEW)tPs5hWNuY=NSNH8YkEe2g!z5qQ;UqINpN!rhLM7~HE7V`deQWM5+3$Kbe@uruZ zsq*ZQ;T5_jzU7`y&9a#VBSXc+rS$sDE784>X-3FmXWzDUYO$S;%h^MqfVMAtVChMw z3fX8JM^}n>w7&<3|oBMLX@=MiY`lQ#>niaPcKaGxEbv znv3^v%#J%PaXge15E;xa{L$z#qVllhLv1EIW-&^qg%VvP~_<&o7;+ zAwJCysz*dLgzET#&TftM?kGuGjOF2d7Ps6AIL$ko@AHOeIq8&NFkm*n^NW+Sfaa_r zkAiu|qIsjZ9$(2^o06u8*Y*8Ic=>V^U8Raz4ZTZ?P-x*=aJr~7b&=J<E#&T4#bqM4d-RS$uN?O_q zY6xs)dy>HVTVW-sgvB)DQD@?AoNt^_{~_k$qkyxe|%wg(Ah6 zE~8ofZx)E|i8#{CL?DU67Lm!8eGr$qKpCe$)!RJk@8QXX0}kSa))##=8uc3~p@N{O zd?&-*deol;Cyz(BDA{e~>HQl5r^H}vA~WuQ6gBW9G0j(cgSdN0_-rn;9!y(DRN379 z>4Prr83#{QvKtn8vM2VXzh08+8p-@plWtNWbkz}ugUsNH6!oRK@oPttf19aPd{j!= z()uzWn4;bVRWx;NK!S5;ymco0@ovc;?hQhEVi&EjwY7{wbz~70+CZ^|B5{*9Z65N? zdfwy$atlwtjcPuYhukWtZ;O`}lP2hWYsi2IT{78HK(_o!Iu+lcE(Q9ywT?L%`tbD# z0fEaYNqfSxT}WN!ElEg7N}Z*@v98lRln|=bhI2kx#9&QBuI(DbzfG?*m`z>O@T#DV zT!t&DlWkb_YH^_TXr8D=+=+T1LgGV&;s<0$ae;P1Mq?@Xxfg`<_GfHQKQsexm3^pt&(h{Ew8t zR+en?Wr3z@Hxq8`gMNX}Vo;Ixz8beNCCZ8(5X9~=o{g=MzjJzVU&J>ZfWHZu7&!eb@>)k zf98PZOERfTxXCtFqLF<^v7#3!o}+SbO$oB82oTu)5B}LVDT13S9FU>EY(culNtuf- z0~ZdZa*uWs7|gj8f?0?CZHFdPbM~G=!`yhKMm_W8g}9%c7D~T1YeGUu8GosKm#335 zoejKW&6``p?)q`Ae9WA*wLTT=d0f8xc8oUfe9I_D*Fv*K=13L~=c1AjDT%t#sOXz7 z5A{Rd4=36)vT6iK*Ra)WkYCouDGUX2x57SIjG5u*dQAO=+Jj4qH^E6mpNP}tB-P>w zM&IRANe&B|oSufQ?Y@1+qAV-nR=GGNYC-ygSdVUFXtbYezIVWtCJ@nS0hb301YFs!ZUb(0jN;$i0 zh?0R;eaNhcDQ+`gMT9q6i?aB2D>v3B>kw`8sQS$$J(NfVEF9vU{!OS|cvJLs0#6kvjncbeXjoSp{Vkr?}kpZZ&{?WSm7#X9`ttb>- zW_XA#JLE$ET@c!LZ7DLvz?)|*+S`7_8P&^AOH?BS_V`VIo)fp`Ul&s>v{QyU~)#^Vcgk9p0=K!xsj*=3d` zv*{_#aaC$I!@SahSanel4I;2C{)AY;u=V6uqheD>F0tf|3w_Sp^R}N+S8Nz@PGl9y zFvQ;|s7oHf&co~*ru;2(L6CaM+P z3AhagmLB4-F(V^>ajUS$*w@a#WYp|$u-;tTOKi#HrVC~*Srt#-fL(@9aDNk z;}({c)2IApu6yp~HyVDTxnB34R<(jeoMBMBaLrQP1Be$o~pP zE@EsEEm@IS_0KpFvGnLUP9aBL2XStKm2TiO7S;&fnkT0$4Wd><-gG#m)tPA(dmc*t zlYa}+ZpSTX8w%TrFPJ-n@uV0yS|M=um5tr0cTtlsPF(^UsuvR5G7x(A%m_O7(2L6z^0m z?b=iloCXSbNSi~1kJ(+=hK;H9+G{DoHIf9Dd0pbdlXf|h3zUO>#4t>U{2ANPjl}6K z$tDX|S0ajd#=g6+MTs=vZR9UYh#WY`?jU;7#*ZdD4$qz&68Lkh_Dsl=*3-BR#ZZ1u z!lk`yJWp36?HR9hBJ0Z^a$>7rPdlFsWM8E)`mYZ$e0(3jSnB3>Hy0_NJ8Wgic5XC^WpQktW+JPI(EO~mx^_HGKwMG3#3Mc{M>muKa#3Le#BQAtB}q9 zx({MKuWQWC|G8q7g1Uzh9f#T9%QS;4@P@n6Dwx#;1*+57$gHZviI{+HNj&<1%1P(| zs-*WE!T;OTq#X80ntDkwXZal5u$GF(K=9dgT|I2u$9mU*Qo9wKQcr`A)5xi^Saav|6azT?Ktd5Fit*(}vuwz(Ua1&GL+1`eBer@H+#YTTNO!-p)! ziY#z5^9vJBT9@W2eMyIlNZW|VKb%(vux=+R=HTI~?}7~TlZ2lRhl5zNVeqK< zYAuizr#Ym^nyw&&E0kWaDCAhV`G7kCF-BcqXMEDui8GL6E5tYiH!6C9VnyV-;4z64A0bJaQ#BWrsK->J6@rW*vN`v2iHKROt zhc%-aZw6Zk&OId##d$%lPF}E*d0bLIXu2KeB6Uss{Bk|^#SqI8ek+ zbXwXAyD3B<(gwq%=wR3ULx!sqtXi%@4c#tkrOG%>`m4wqg%!R*3C?ce(sncOf-2Mg z9-)vIhP0Ny5qk;_=w0wqtml`ij3D#N;}kH=`l(1tQ_onmFzyqH z;Fz6x^~1*Pm{`n|{9r)sraCmG6f$LphlKNJB5zIvQDP42TnD3*d!shdcttR4f>NYe zjM@*dN)a3pvEii&pDQHuS#w+Aa2!4(B_E!8KztUhTZUx@p@cZBZ3AhNtC;Is4Z8f$ zJa5sBww zLRc_U2L7R)WdVPFgfIm^G<_#%WKAP)*ent$dB4Y(N*8I}oui=JZmj3dCisj6owm=> z;@t-3y?ryvTm+7zjvaw7Bfff#agSB4Miv~0QFq3gF1-GXW`|-@uvYp zdS6?pUt%H}X&LL0a$}Y-XolKJVTa&S?#s!`v{4#X!IeO9DUwYzlvNFH?qWC+Ich`2 z>1QV|ha7rUOvBm__`m)t4wJNYC!mng#q*Pn*tOw_Uaj=H*ZaP=KlaV+!A0FD-x>4M zDKl@qjrx@zGOfxXC)Q_;Um2Ttdal3Y)%DzdAibdyE_M4d%s#6#X~hw$OY9!E{J2Oy zt~k{XNsG*x$dB`im5WcU~CHKQyX6>eCVG~oWM0LMKO~CvLdJCTJ{8{t>Re7SYS6^{`4>fqka8{4WheCx@hfWf>(5Iwz*{u*26}1MAK?Y zAK_Ch%AA*K&DkOZy+D&0$<7@bk;c=K1Lz`{Z_r}btsYnBQBz?kHZmZCzM_uy`B;GLWhD zPnhGKot?g45gJ;n^VkU`35Ya&lcY&nGTB~deey<}5|`w@Y5Vgd6#GKI!Fsts@L@0J z=;pt=-!}IvWSqPO;+I>I{>kpQF;r49Mi)m7HuKe6^!hggG1L_;kGB;bo0Q(l6|<@v z$7~oe_A~?enL%2e#3KNMx z9&8pWmHq5zRp7ZqtmgO`Q378n@)_x5oL08!-H1gG+{3jc6BUC?qkWK1but7}r&ZVS zbaCQ!l^2S~oWW)H9eLMg5{0?-`cF67s?%(``{kkeq9b_$+^!foEb^2fqV46k!zs?{ zUvFyqJqtgLF4ns9e*PlPcM)~}Fo?;r<8Ci()g2r!o;-^#ukyuU4t3OB+2W1==!G%;iTo{@g?C*V#v*!j|M)K z>E}-=K^hFdU!Qt)|jZ$eO!3awc_dSeYR$E?7jBLE??2#n$U&r zALgtAT@b1QJOfJ?8Z?cuxEM9$@6VgFj>n4%`E;HOLGT&+?T;6pcb82rHqo(h@CGVA zFBG@an01@a30JQJNnz2Jyq|UipKio+qJx?XXLBcn5;SncW8*0O<{hEg;Y?!5TS`nM zUQ?f|N$>{Z+DwN`n%U_uiVB-e7uJ-Oc5H9{wen2w%Ai+$9Wl>Lu+#MSHN#!3c{R;> z3o|MGawLrMd3Y7L25@Te=!uk4um|j7L6ZUL4Hg`Ou1t zvx@jS$g14(?m+wy*-VBS&nH~;?fY9^%cZ%lb^1CTWVmkuck6kfDw_7rd_7kxR-St+ zuE}9%<{(sP$l=*8F8)pX6TI$1n<>@YhP25LvK)KN6Gw^0H3T_P zB$2ho z>TP&K$giQ+S~=VHMk}t*X4|a$ODc|^CKB7P&nGQosLUe+kBnk)$6!98cOHzc+k8RD z6qw|9nL&OsZGOf=ZgsgM^0DVtWNnmhWZgv{|cMIjgOxa?MX=Hb=4}>prG}C)MQ{V2_FFbud78YAjz36eU zxGEig6}F&~VIP=A5O80kK(f>hZV#Sr1ex2;mw}l-u4dkE zjvhDdjAi?(#jMRRY9F`X9d~tg7o^z_z~QyJ&6ex(x*WeN{SG&1gJ9Y-m92n*@f9+{ zwc4_#yHZOqM2j-t<<#;OqH*Bo7TOs6afgG}xWt_Q2R3Zi;>uib?y#KiQ^k@XQ z!BL6&s^=)baPZI)4B2~ib#-hpvukx{j4d$;?H*tUN~XQw5grHVE4Xe&kzNjAJvoPw z8N+{QTBq~YdGJpz-wqtSZ0@wSkILfJGW7Ya@N~{uzh}A!`zpy^|1YAH9ql*fJdfRN z{67&MEd;u}iATb`Tx>t2G<`j)>Q(cM5S7y;Tm~G%jm5b>8@1j;p+LgMPaNMSsKn2V zO;2CUdOysTzjD`mwu=+j-o;GU^}oy>zfl0ILC*XBzJzqH)_h}aEjuT%kRrVL$N()V;m;F>RlBpImHf->|1gU?V-;w?|efcKyM}!3xW(mpv5fEagIl zU{VAzzz?)(T4Mxz2q7pC)%!quwfUs|Zk=Xe8UC%_xK_h7cd zrRVz?ax+<;mtex9ZN600Et21#A-2)h+u{;#Q_fY7vqok7LO9In0#Ug*p46kN0C+VxKNkM}p9QOH^!|K6zFa|FIu%*(dz@Msx0@?L< zVs=Emc5rhgqR&`h_6{a6c7VO-e6(&IYMF#3r&--$lQ@B)l+(#{xZd|e&G>aPLS&Pp zmjNHzlI2a#$O2$k$;<*|)ZxtMt;q49&tQ(_C6Kyw-83pcMt-cMU1(+87@&}n-g+04 zqdlRpuk`1%87X%&dVv3(3ITL=$5H4!KZDERp@Q)5p!1U<4KOXbpqnE$In1&C9LrSC z7yaB(WWHq{!{!MF_jT+nw9TL?tMa1u>TNxst%snT`tf%5$@r>VSFSE^IFI-L$xz0! zyPV#a+LEEkXDm+p2j#pzo^7k^d$MynmibCq@i@lG8R<05n6sr{;h*+P7^eJ_9Yew$M&rV%H@ zVT5~D*JYV^c|<4i6-!9`mQ!zq9c;I@W5FGxS)Fl0D^Vr{~qT z&@0k6VnrXQ?1S%@@VUyA1IrL-HWH?586KW(-mG9fc0DL zgNYjja?{opMTAv%B%6XI>1d7?OfacKhO*L&+MnK@6?~>cRV(jN@@=m1hp1e>%7?mh z+EU4Fl?yFC(_}3L-BH_1>{LGKAJ9LHTDX|2&5~|H*F_=96=QCf zVn0qZ$b&*w?@H`&Lcjz&5EDZ{&0t#K>FH_Xd7ur5xlPknLYw=g>yW;(Fnnlpv)$f-T~FzhKAAo$M6!6I z{9M>MeoOVg8fXol{L!Cq6^6{8$L)l?>pqu`OjBMiMZHC8b|F<@*r%Ris%UaH~%f9Z&7pSPO6o&D!?J6Nv zlk(91Zdu&?5|aflAVT7Qy>?l==h@LEOF3^Y(rU z61@Knb{?d&T(`yRy8G$wa=Ju};@>JU@Vo6Df#WLMwX8|$`O_b9`C7Gxdu;T}nx17@ z#!fCS6*^6r7_;}sE-_R_aiK$qufGZ(sJUO|8g%UPdCS*Q-J)*H=dI0ul^HnD@8#AD6VQL% z_6n{({XQ~f`Ga3H`LXKstwxii3GBaV6eg^B%1X^ATm*1$MYQH6z6nxIqLXn%*P6mk z{wVWSp-c{`jz`9_lQwd&qN0o6=!=PwM5a%WGRK~>qh2;O_iBKt$}P~+8)`Krq4i}< z^;gi%w)%YXWrtUv4U7+OSUQ~uWu}%AZh{BhTY(>gg9&_fV~8t(rV*6NY2!7hyDfVLpr>ox@t(Akbh)f&)UbYkx#pBS;1QiD$lLTbx#^TDR^;ELnp zjnS5w%m*6X8ZjA63TPMu#24?A?V}jIjx0w(JiycU+5@+$X;NB1i-?wTzUpYbTCser zu=Kjgypl_KCl$R#CBR>EqVxM-xn?QXU4pjxSh-9cG{vk+5PSnb)4Kx4aqXmd-%*MYTl($_bXxn&#Uw5kLE|j_5_3rX$ z)W%EClelb_)a`uys_n${%}`36^O4r1aItM;Pzg#>)Sj9KTnyKaD2JQH{v{T>`6OHI z7F=}g*&m2tr(5X!w+iEFribk~b1nzD&_TqP5!m9t;7A}@1qHko;wX3wqCOI&o{l>s z>D2oPinL0<`(+V@SXlY0KW+q`tvIfLyy3WU1NDJw`j;}>Yl7uDHFP-Ls69}w6GgdHunH0V_*^E_=~ z<-%7rG+ccTW!gVDxckR$0AtoPk5Ji`1loW4e0jQC z^#)1e@>xx$-N@bTtsmJONEpE6+jed1CS#BTNaOz_OQo{7o*%#14_`;(D$_3t2@EH* znVOlojx2E_ApC29U{AQfII8$`34ENM$KO2gzdU)>TJ6Z)`tT{KO$NVzr1QG8n~bEv zAfQ?;*30sTZn(O-UhfrTu7J=A631k!e$I{?8;B5W`$?wLjOM=#rv_xiKe6QX&Q0-r z6VeQx9v=uftaeXMTo&!?qA&Z~&7_YVRylZ>-!_SXXQZ2D4R^=j6wEX#sbE#rsm7yGDHC>}(Ni zi8X}V3);yZ6k&nkq_>8ro1j{n8z{#MjN0{$kszY|z&~E?SnZc-;d}MB=0AU7H$k;} zrtj&LIXvIwFbg($B@m%Ydlsbmt&{c6Qf3PcE46_f28dEhI#3H_Xn~$~4-_V>@jH+{ zis$?V!{tsOe{O->EiNhlvYl*d-F~wTbq|Mz~mIMRVu&y*SB0Wq*cZNLab2v4-(YPkC)s|+Rv8@GQNap>k>(T?`ax)^~+`Oy&YfW6a}=; z_;@s^R7xJ$a5|Xbzh0||rSbwAoZwBrJmA?KYLQ_2+S8uA_w9D74GBKJ>&=$>zw{V% z6kpIt#bjq^k7zhqvtbx~z*1nEK5(K?vM>Jdyho60-m~$@%ky7MB`|6mUCvd?#!JIt zpqZqhN7%|be;?jdDq3EXH~$ragFIc{@%SY^2i^ie0@x55lmYO#csjOS2m*hgAY9-$ z42rBEoa8;-uk9s&ug9~@j^BZVOGhBSv>fxFxS`>DZuJn_r180(mTJ}uj)d%Qbhj*^i#FsM!u<8*v4uJ;HNPT3*hiouyaNAQ-eNg-ky;{qd`3v0Lw;AQrl18DYt_V!g?cD zszL{pk6|IJm2a`GAW(8V{rTPf`H(4GJV$_MVZSI=N0xdAZc0;WVI91Aj|`23gha<# z`iaK|;i_2M>sEM zD4lnfj#`@i_~@vvSqAWAu(Xgh;E4BtbalI50){l7>kQMYm$!m1?(XhzzG~K6CDS!o zOc!qrCW5K3niuCK`VaecvwC;e8bTi zfHKH-!515*vCwlI5AZ(YBu(aa$R9`tqYI4_b)Dyp6W{i{3ePW_QcM2%HtB#goeig1 z=Q67a8OWUwD2SBkdzFC6qz$||vv=!Un8GS_#-*59l)fuc>2}BK;*VVHKHzxIcOD5p zht?GGPj!)hI+y>KRAh?;EhwyTJ8YAEZ%K4A+LQnJfSws{j@b zc8ltbcDeg*%e}5+CF)sB|Xz{6!+~8NI8QVX{C;-_F}H0h zK^m`C+`pND{#IaRK)lv#b}U*zbpxydvIg=s#gw3s;(XUYi*Z>LJSIL6?bgY<{X4}X|*3A?I%~~;C8!sU$YQ3R8&-Ss~>kfJ&t-FJIM3>{n;rr*hfXjsM{Rp@Gqi8qU2J_aR&%-6Vk{s zJ!3Kc_|2_x4;X8u|KWmV#d58A?6M_bX(ci3|3ci|aSIwmty~8Q0-U68om}zxk&SnY zT8ZcV2I-Zj_s!{6iCWn$SUQhVveujJRGh!SlFD!j!Cr3xGXmePdY-timb?p`DA>vL zel(2acRq5Oh4$g`JOkvy#nv_|7#y>#o@Xxn3zOMso`{gRzJLFWukgrgXmA1Ve~H7n z3?xlmU0r7)fy=5$;s-87auCRRxCH^b?!jK^W@+8aPt5>SOIeP43y>ZjaEFD<;oNUI zwLB#PA|gKNs2Esy)XqMI=7@VpBLW1y_dJw0MuG&LZD;KsAMFjtGZwSe(l0sr>Al-| ziXuDrcBJm4vr|Z3K5`4H z{e)Sg(f~Ya`w2+1PirzCN-w0j_Htv}Z>I_WJu*}$5F=KAD70w7Kbrc^{8O14v5X~6 z#%Bur3V0SSu79U!9e=}Z_)c2SKx(&~p)+%Ep>5N4@dkuf&{BR0N= zmQw1DlqZ23xfdVwls*YqBajWGF5LQK=7(^jpRu5pNn}!;a=zG~mKOIKbzeCHt4HXra81wNr>EmzZ%-gAA)e;bXFPla^nRdR}z1y47wy8tz{l{`( z&!$V%>7y1p+;_*wRl&F?4Yb0?$43xT%NrWh<5iZ{L0a-&*UoezwSvPWa!Qp)r}fitPF;qRckZWqj?CSg$|T(brXx3cO>2S6E+n z1E)@)JqHHiaug&R$4gDpHZ|rTrMO(QLGxP!I}4GX99mTI9IWeMeyX(^t_`HpNiLno z3HTdsj=f^&E$e}RT96|EdISdKm;!VGr}Ma+cY@eXNWE#hTR!o6yxD1KX%W1}BVDR@ zS_G0{-av)!-B3C>0-9D;C;tHsD;I%KRRH9FPcU_d1>_euXFHK$VU8?Z^XVuMd}bJQ zVc-$4Y(QiM^7Se2abwQAiBf5B6nec4@*PkHM8fAWJKxQG z%9k@#C(m}Va>wZ9?C|J4h_ACMO?}i%E3vB%Ol})?6|enIK*#-H$NhPMU>i8=R?~x| zznT3z1?~KBF}v8NW9!q9d|4*L)C7ynuax}j7HX}kmt>G%HE18_OPcrN4b!LERhXwA z;B9~(*aa39$8#}JpJ-SBz?Dtq2#<*P$BKFdAFJ}V|9$0kGpN7PXtyz~u3u)4O2h@W zr!SfpxDkl&v@c&a^$-(y-lvK-_m>v?3wV%rXs910FAcbnutoLgf-#MMz7ddCve}{e zRX>waq8N-Fe-XA*fXQ_tz5Fx~e(?RCN2Ajx`5Ur|Da3mGd({UD= z&sYeW7#OU9z1iV@#WeW(myeIn;h~kUknP#FtaEl)@*tt@Ym;)}$*9Rc!Q08ckGX_{ z$U}ABY1V-HQBch}_Z4d3uAe8l3vT-YdtqWWw zGz^UFYZ+d|S@MO21<;YGM2#8n9eL;CaSonKH8D*D~~adJiv4tH)A!3SNbWZJ%IX>jl$CsF_z5z&Cp z#L-bDPpRreL94^-0r+|Z1O#TCMgvblNQ2MPYQCQzv^(yfBsm%!6!CL&WaYi3CI_(U zK;cT|cdySgiH(f~LFC7r{T4*^;hMDU{Pvv#LJzgJXrbQRFTdN}#MoP!H!D^Q7VBN3SGz5R5Iql3_erKF?);cfPQ60k;d)H77h z5mv0zsCJ#q58n(G5D;K3IwXC%u2^nyNgWB1m674~ymjpAz+0;pY>#!=KG=x(Z>H4G zKBEcH*9U@sB7Y{|U-mg&7#92&_D%O?4J*=;l6|A2f?v*Q48vEX575OtJnlgV@$>T= z7#Psf)}HUMJJql`@+E-j3@MT)d3bmLmt%JWt2jG7jUeH-XinuO1UZx^@GrnS9_;U@ zoxt{FpklaKhe?Q@QJ4^hCS7|)xdg~k?OK4G>}`2A?#w*f9dck$kfo)ivXT;q&C0(+ z=Zk$+e+4-?IWMpFcx4r}41VWBe6(!;pFcsG-fh65)26jN{yT+*`_wVFs>lv}_rYw3 z^NC)lQV|0UO=t4s+}YbQaW*cqdmgamfbOKG@2$+h5zz@qLkLBA<>B)l2?<$fw2RHm z%=*5bIy0lzJ5x`71@q@qrjZj*x_FLegSD=sW33RG0$n_6Vl=RP6civbYWz8<=*Zx9 z2xRs73Dc%=j|~l}G~1sPS5{X3^l3c=hrYF~?PRq>@P~yKx-eoH5I_L;63+f}{dWV% z19t81fm4fOe;yPzt(bi~=9jY=#zj{c2l(AtC8zEq-`}JTmIspsgGABB<^&WyeiQu; z3S=cBNu;PS`MwNe#!Fu;+SIw)^!*CO^L}~=aM&3o%xEc%0!mR(V1{H~vXoRmD3f4h zWQ2ivfPsPes#T^}!I@d#Lr6?a%(9P$^s>LdU$eu@6DTCc(}=Rz&sZ4eZ7FiV8cqrV zDu>X+?|b9Xu3LoLumB!~G_s6|nc0O5{%3FR$wHmwa0)wEdNA45%EIE*e_c=p9pWQv z)eNgcO-2TMK8)o|skxaM7g#h;GpvVeFyW;A32-nkFCc%YIyu#`E!%{7c(_e)wy`}9 z^U};UUemqDckno9`W5^B`|aIMhu+)Wd3aWF6aMd9Ur*1@21iC#stge_Qoig>P#+Zh zxwz1+HtLTc=3QT32lWm`t2Iw>(@G3duz*&RwPAf3lPh~zF6b1oRDO>?i23A(3_4OQNWMq_- z8-NY`y}0;nX*s#)cuole4ZXgxado_W2Z#t@0z~{@fRhdUEBPjzaO`2V*GXPcG)_J1 zE&PYLt0H&X)%dH=5uJWaQ$)LK?7OZegN`;gOLpj*jQ&=ef+Xqj4s$UsHiZ%igbzRv_~U zFPes)zND~{hL2B&DG@mGftd-UFnSTf7~T}-XDqyz>OZG`Wrr|OP*AY3Ie^KRJn6@P z!vaBT6=9q0AR}DVa9`is07w zZh;)ARHOnn0>P_Sz||t6p+$y<{!2NHj5fhf1FP-;DNaO0M1Q&48>+LJhxp9KPVF@t zyK)BM-5dOD3zn&SgIzP~xj1-Q?!cR}d~f(s$3HWEa47#Omh86%0FxgX83Dq~<>h5Y z21%P9>8n>MQBjpf{V{WM8qCZUfq{V_Xy+;I-M=$G_+)4(cx|9Uq} zii*rbUS7DN%e=3UPB$#xg?TpNseoK1b2YV@?_!~SP#d|xXM?~un8^H(DASR)T^s4$ zzB;)HZ4LN1ML7Os)_ODJ+RYpof#4s{oij5ST-*B+ZLQu}3Va$UG0)hx3_uv1VLwiR-`d@tZ>{;5rpB^HayLu zv&o8m^yMY`S`o)nO^O%ldL#+Qz=DwQ9}f&}s3+*7QLz{ejim0$v4)J<*;((>_f=Hl zNi1s6NH|D1c6Z(m$}o` z@_8+=!-pS6MMX6?H)muZK@a-q3r96ilU^yU>J^TO+Tmn3}vI2zVG#Y&sr1ybJk&~12vAB|M@)Y#NSrDX4fak-q z%?h+&CB6%aM5$}jyCz6q2*^Fg^?w>+D)HS;2kg`-5<|9vk7PG+YR@~=m#GqvNsU2ur^-__tBARV%6gkmBDF+< z%W!#sz+k;FDluf9t2OaACRt%smSkEHm&@H%!USSome}WK3ATF@dOQa{g!b(6#W{H|cV*pQRkz;a zLs?FOMijL|01YH$;i$gCWkRd z*OF`R*M~z~J}QQ{lZ)>(h}m~jm6`D|z~Z2~^RMt8p~uoZoF>uinpB1?cJp7=jfz`h zaLAd@62^`wx;nW6C+KmvMeOl|A4L$J?y{%eI@5 zp(UA&mbg9bz~o$Ib~*VH%*_~`LiGy-($+|STJ7dWFqmt0NVp5F!j`p#>ov3eBOV=HO zXu>?%TC(>XHl&OPR~%;gXY?WVQ5ihG9sn>v^X!yZg2cz&yLaK4EEWsou?(_$6A}`_ z!on6O!Dc2G<>N=i3sO^4bx~%9hPTLyHl=j&z{CsrEUlZ)pxM~Sr2e6=uV3Lhx@Rnz zb5CA~E$RPboC6a4w_5BrdIZ8ha~nc+b#;Ae6{3lv2*f~t|0Me(&7+WXJJOV#rb_ag z#pKmDtZLQ1VVT~%{D!QW%HN?j+B{<5%!lh&yiQJWvAML|UvU0#9e1mp@-yyD ze%=u9{B0ttk}4}JYvRpMTVlT%88IpQVnv~Ro`YqYYT$4rJV8lfEP!d8C#jZ9l8?8f zP|C{7T?R`GFk(zF7m<+`XGG;gI~Q=KfoUh&*1(~ZWl522p7SjWQk7#y=cpi*0${6e z?N%ePaqP)1Uxfbw0yhwT3=~}f{AOus86F-Es#k%-3Gf@5w|ALgmJZypbTBS1?*9Gz zAo9v3gD~57yiKH%dWlN?_Wk?A`1sKC#}nH*qG#+cuv=fZw*$xTEvUGQ5B&1z5o)7n z97ZoaqpckPFgZCnIWR3ilyY-(CnhGqdF=o=j*5=vba%J*?X9HN`K>xfy1)-59HZT_ z4N5&Ka<9>yD6@%pO`v}nomUwcypj}nZuk!D)g}bo{MwqDsiy9OZZ}9(>P>`$W|Wy1 zo(i^zDN;+iL#uk{yPA;^+YE_S9u?&$)+s(Z{5+-wwnCqdSJ*%r5!bK1;WSZsRFLc- zyWO$ailK;PW7Qm{#i48j8mD4ooic-OarzFo-^>i@n-BIYa(Nz!7Lbo#%x%AGY`)^P zXUK9fgf5ljMCnD?7V~L`AlS`CeODkE+dAI*&V;`{$u!uceH7+%XQ;GHePCu0+k6mX zvBTpl!w!5ezRLP?_m#^)h}NnP{(FNsP1c@S^>(?zeIq}lpgWky`o?OLhn9&sS) z>2ftYh6a(4R^E#_PsM!Hs;fM-m2EVK_?;w^PC(gv&-)oRh`l8Hl&=*yCgz{p2YI<2 z`z<3u{Nq(LCzki?*Cx=5aZNWn!|M=4lKkeE-zEWdGoA&pAK^D7alKzAR)nd zf95NZ26GcCEuev~o70>=+9i)H7S&dFKAIGZbaM~u#HP5}mP~iu_!D|N)auT-3gLJK zuYVD9kL&OFy6kpwAKM(Sg(I^)2=p|DG)wBUYxZ|eZd-afd(OtZ@pYFmGq9y%Q1F@= zET^>t{res^_$td-3CqwyY#-qXYM>>(Gvb9Ht|LtrfIhBb z;2Pp$!2YBV+e{eHpvOo+A-!`uG$v$+O7DdMsv)ok&<9dYj^HO|2P^uYU;aP7ut2BN ghXeM3t_*XxVF4>f7Vuks>EISJ&@~|z=+Hv`3vbS|NB{r; literal 0 HcmV?d00001 diff --git a/windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md b/windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md new file mode 100644 index 0000000000..db24fb9fca --- /dev/null +++ b/windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md @@ -0,0 +1,86 @@ +--- +title: Interactive logon Don't display username at sign-in (Windows 10) +description: Describes the best practices, location, values, and security considerations for the Interactive logon Don't display username at sign-in security policy setting. +ms.assetid: 98b24b03-95fe-4edc-8e97-cbdaa8e314fd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: brianlic-msft +--- + +# Interactive logon: Don't display username at sign-in + +**Applies to** +- Windows Server 2003, Windows Vista, Windows XP, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2012, Windows 8, Windows 10 + +Describes the best practices, location, values, and security considerations for the **Interactive logon: Don't display username at sign-in** security policy setting. + +## Reference + +A new policy setting has been introduced in Windows 10 starting with Windows 10 version 1703. This security policy setting determines whether the username is displayed during sign in. This setting only affects the **Other user** tile. + +If the policy is enabled and a user signs in as **Other user**, the full name of the user is not displayed during sign-in. In the same context, if users type their email address and password at the sign in screen and press **Enter**, the displayed text “Other user” remains unchanged, and is no longer replaced by the user’s first and last name, as in previous versions of Windows 10. Additionally,if users enter their domain user name and password and click **Submit**, their full name is not shown until the Start screen displays. + +If the policy is disabled and a user signs in as **Other user**, the “Other user” text is replaced by the user’s first and last name during sign-in. + +### Possible values + +- Enabled +- Disabled +- Not defined + +### Best practices + +Your implementation of this policy depends on your security requirements for displayed logon information. If you have devices that store sensitive data, with monitors displayed in unsecured locations, or if you have devices with sensitive data that are remotely accessed, revealing logged on user’s full names or domain account names might contradict your overall security policy. + +### Location + +Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options + +### Default values + +| Server type or Group Policy object (GPO) | Default value| +| - | - | +| Default domain policy| Not defined| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Effective GPO default settings on client computers | Not defined| +  +## Policy management + +This section describes features and tools that are available to help you manage this policy. + +### Restart requirement + +None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. + +### Policy conflict considerations + +None. + +### Group Policy + +This policy setting can be configured by using the Group Policy Management Console (GPMC) to be distributed through Group Policy Objects (GPOs). If this policy is not contained in a distributed GPO, this policy can be configured on the local computer by using the Local Security Policy snap-in. + +## Security considerations + +This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + +### Vulnerability + +An attacker with access to the console (for example, someone with physical access or someone who can connect to the device through Remote Desktop Session Host) could view the name of the last user who logged on. The attacker could then try to guess the password, use a dictionary, or use a brute-force attack to try to log on. + +### Countermeasure + +Enable the **Interactive logon: Don't display user name at sign-in** setting. + +### Potential impact + +Users must always type their usernames and passwords when they log on locally or to the domain. The logon tiles of all logged on users are not displayed. + +## Related topics + +- [Security Options](security-options.md) From 4c9c10af99947f0b4b4ea2a877c2b63116eacf5b Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 29 Mar 2017 15:46:30 -0700 Subject: [PATCH 097/165] update image remove beta --- .../keep-secure/images/atp-users-at-risk.png | Bin 36823 -> 39706 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/atp-users-at-risk.png b/windows/keep-secure/images/atp-users-at-risk.png index 4e86dbb2f542b7c3b73cdc01e23fa94fc0558aa3..cd43cdf60711309408e22a5bc72c5196a2408fd9 100644 GIT binary patch literal 39706 zcmc$`g;$hc)HXbTA|N0lCEX!NcT0DJG$P&It#nFDcMT;ijdXV?NSAbX%y;-b-}4{5 z>wRY}mNRGWIp@C5*>UZ?uWgu;f+QLWJ_-Z^L6epeQ-MI>|3Dycq)6~!gR= zFQw%KfuMIk{lO*DqZ5F^7tYf1;xASah;SIO9xM`r{~Hq5bpGJtY;NZWDXAEi0z;_I zU`Wiw$;i>d-r2&=7V-v}i~@|KJdKOm*?Txzn3+36%3clgf>HGUMjcHIpDrbJwy-gQ za9q7Y2Hzk*eWPk;>g;CdXado*hdo{X^1sO~oQ$ju!KIFnhK|}8FpTsx{L#?S*22~d z(m}8l0>)na&+lCvjZ7dHu&;andzq-6jg5(|GvsnOsU3_VK3%3};cRUJDL$N}fj~$h z(qbRf+|&0L-MrP*FCoWHNAy!{@hOz?DAND*#FamUhlh9IEB)Zoy(nsKD$T7Zwpwuc zXkA)S@qB1-o?bkhR9;#5S)i0W60(JH+|EPY-Q9W+hNv(`T$pED*28{?$JwBVU2hB9 zRi+n-VWfDTa^>7hB(gvZk&J%ZhJ^#yPQ1Iz1-th+FUcrp$ezakHGE;gK}8ICMKX%u zPbu9Mj3(U9 z2xP2t_kM57w_)tWdl}M29Ur#6&=!Otf<)%bfF+I`BtjiO@VTm%!J1}ug?n_>9uGBG zArkGsNqq+%hE1J@Ixh)?@Qk?2{#%LY!&L1olLd55_~};QhsB>}O3?luK?-hzHjx?k z0~l9&XUO;ke37Hpsr&3{s*=D)Bye4z3bNB{@DZs1bBp}x_cB!f{{%As?m)O1sTdfLMD)-W;6#|LbOe0VbqIQ_SU!T??p4|~ZsLe5Z;hlS%TX68WTejfzy9yg znv@vHr6-4&+FQJDPESuABYNUuV{>Q+ms-8t_J8MWlY8b#xw>AC=ZFdrkFE7YG`sB8 z``o!o$8kr~GcY(eFO~=*Kb-+lMnzl%C1w~+miKAAqM!qBM#G}(0{B_EMromi%YUz1 z-T>iG7rQflw^LcP1z=mC6%`7Um}7!>WpjH17t^XoEoYl@4%8_~UflC1B! zGo>g*#OwU;pkaBb+08D~4!z9nXeo~J*P}#iZf-7E?JWfH74iMFs^X1zTT!OxI{|@* zI9bLjO@uI0-|F=FIb%YJ?y9ydg8e^27W zq}0`Cp57fcAJuE=YiPLcl{YYI{#dzAmkxJtUBcCOUybHF)NHU_%$W_7$g`TO&};Q{ zVaD4Z{{5fqOj9|=MiFq~U}4FnbDt>fDapKi`O>cSLPLNkh1+3mIEC%%V8IRcaD|JD z3)>+3@@r+XKo-n4Z`wGveRqF0HZ(XGeL)yqT4yz&70%A|B~MpBcVPcMjjg`qFEZX}5fj;oqBd~$poBc_k80P-y>t1_AD-@UINDaN=N9uqAs#Q$9xmown=@2A!BG<%lAjKdBYmNic5Qy> zmvulx6m9o?;AMXYq=JYH0|`S!ml3z1wxpy4Jg`oK?JbjW`||Sm_=+TprV?A-x*pgo}^(oVv0OxpA|Ibk32mzA>{^mc7hjO&%JuLg&PBqQ-0wlmyZ#mLuA z+)YQ*cP>2N8d+FayrGuE~4McI4;1DSCY?+qN?fJm)u=jctmjd@{ z;6OZ0a#E5nkdBY~9-G-8zOu{Tfrk*h+hV%1bu}wy7#=F3R#K~e<*!fnjk<(=DRPCt!xa`% zH!M7q?prGQFn(rDxxGBN13Jv8RlV`oX-r_+(zNCVT3V6HY9gbdp&{ukp{AzBf82qP zFj-pB^e$GaOux0Mw$}OYPY3UvS zFK9NJ4)#kMs|OANQP=+0^YGk+q@-v<9>?+Q4==JxmX8d;Qn}(0jEx&{dlk)$Y;04j z_SV3rZw@BDp;15$>8ddu(Qfm;>5rudK__Z59Z3a7RFh#gj)DL+*qr?qSl+P|HnX+v zu&;<{yoVn#$pXh;Tk25?BTe{q!wWOusA5sk)60(Wiz(M?GEA7Osn2|MitX*~wdWqj zTjw7A#QbkjplNf6W6iaB#MB8$B_-y-(2&*6iG`(Qc+Y1Z9-hE&O-;O7Nyucm zw5Dce4a1ca6DnB|n&q?L)SPFa>PPLcN4lc)xXjF@L(5!RbYlLW>z&8${5tj4DJ(|8 z`o%1tyF<;{p|pdin?uP=2EKnxlI7Dl(IB^1N3b4T18*R9c@j~W&wd%R78Dg_IZsNj z_r<*MpPZcJu$qm;=h#iPs(|yK$djC#nkPYsV<{vv zokn?p<)5!I>H|m03zq%bF!RQ^Xv$+3eD=Bg0|9C;u3W2KE|E8}efD0j$+^QH&TZL; zi);hfQ*(23DOp)7bMx^^Ls8ML79g0w)Vb_V3q9;8n$|R~GtvRiO0j)*gJ>A5-CxP;i)4@f6B-Y-Z>*YkY|(F&gK%`C%Zwl|6Z zc2Vi~96sRd+@D6LZ6M~p3pNeqS~Z1VJI7yg01cd)o_+>VD5}ZMCdEK1)2@S>jb(Bz zI>)zZD=3V9XEEB{+uPgS<&Ku6j(@nlm}+)BcLENqpr8O4N<@e$uBVw*g& zDhVbOY0kcT;c3IEBOwvIXgk*5Kkm1-OOPs8*wVsZG-c7SuxQ&rDLr96ZO*P;K5Nfi zw#-K!8%il{+n}R9BSi_M?$Dll-_>g`I9}n~t?O$DGaf3}l6zj?dJ3PLEjUJ?J;2kJ zk8!AIYd1Lp-J<_^_`AvoXieWFpOgLjm`u~%EG^)rh`o=0nPqxx0kr~-;OEMhm!rUe zNKvkx-GDu@1sF#w3C^FT-t9b*;0Pfw5AlE?N-rWX4#fh*^u zC7=82llO`jRyM%3j`5$#85tQlIGi+YXEu9X9SV3|*5+dgg|QSie5uu9lvXh{-2y^< zaXzKE>~pm!;CYV6VL4qlr*FlY0_pg~Y&~CVu{T>zMMVYh!W=F+*v$74J-M*Yz(k;- zp)n@Yzkh##)DR^`o?6I57@b5#9Z!c7u><48LyeWn2QWxoy;WY^Zuf^K13(#2=qW!5 zN|1Xd7k-o{o1Cg@ykPYOO@whwB>+VjBHGeQ?yWT1H8c4zAK+mSyfe4 zQxh;}3wG^K2#9C+=W^Eycl7#C&i80gXi{?W%P-kxm>Q)Q)kBPXi_O5bH81<#9nfUD zlM}~exz1bgkC~a78F*|azHj_Oilk9mmz^z~#Z~4)pEO{M&*y3legUKufX%CZikR-t zRRp#_b1ob%$p1cBm|z0i@BALsU90^A10KNCU$`yUeBsk<4vTo~!Dlt@7kWI2sjjY8 zFV$#0pOgj9`6L8Ot{>IZj9F7ODs*`~&;PN3qxi>24wM-E6Kl#jNeF-qg@wJ_XDK75 zncEBO;k64Axfb|iXXW%#+OXZF20H_0yy5=-6%YNS&E8%KpTW-K?93u}^mL(6On~M*!-2); zO&)UDN-?WffW&+oFm~i7+}zv*mH`;r+fH-#CoBKu3w-OeD3|j;fN(i~v;qJ=LgDX~QdV2av z7CQrxZyTR|{ZKhq>K70xVPt5S1BLdTqV*3wz4#7lr;y0bwnhlpOo#p95U|8q(nf%w z!H&CLfs?-MBk{XuPV58_jW^}jC*~A6&j9FBNTw8}_WTbjX;wT`n{a8KXjQBNmsE1; zxFtHKAxBaSU`MC6@d37cZ-Fv)2IP?teNS3WTU&bwtsf{ng$_c1KX5LmIH^Vnx1O&d zwDk08fkdl26W@Ndqg#oep43tZ< z8J3=&4vb7=ZSA=b>?Wp7OnoLs@b=%6`PnP0VP#{ZlGgrdZ#YDGa&vQ&T9_h7oj1X4 zF-aNIcNXJ!-?ewKdo-HHbySe74-b*Ckj0I$UGI&uYdMh^BEvIcOfIFmo6urN0*fp* zyH)Bn<3QfMd#CSvv+2%X;fKu~?bN6Xl#D7sKr`)YJp)UM95`~n&BTw;($b5d0prP4 zdv2hTo%_IR0mW%m%n}6Kd<`&i%%u#_WZvi&eY+vT60oxvNSfsuA21>%@_v0f_H6a^ z@NY}i51RKpJ3n`pvCz}Y$fbo~pahBJd|Uci0sCV&Aat%**HXK109M&P3(GB@3kvL7 z1!DTJWX77pF26VYtE++8#Yw?|V`|5be1(w~p`v+(t)7=K*lr)>zij zh37@{PArKCR?pce9}|9*;Mp)+Vq#*#q&Yi&L{G)fweS+vqRvN!bRc7l+O<+s08;>^ zF4FURxCs2V+7+_wv7O;bBn=Lk0q4!L4lAfL(nG6bTTC^>l znJ+w6#s~yf?4!E+!BT75wueaQ(n0PklPBROS(c!i>AS6;hJZs;#>$&8H#9VqWowz+ zLwg3FpyIi4RseZT}YIdNB7AqD#UaA9UUc8&&-VaNvT4;S1?G0GkB@ zUs*J?wRf-XE;_S@hlc^u{P&y|#1+7>fiU(q^_Jn{mfthA5P*LY=x^7frB-!y^*Bl% zLUfSGIlBQ63k0li!s;`rsi{!tJ8@<3abb8D2R#H>1|oFHp-gpkAoq66cnpk;z@GqH z1x%}_thB4ED{z?rQBYz6AqmgL!p7dYVBz540E+|R0*eDjU|vZHY^_ldEPE!c37O2M z8cjMbZXjRKq2G{t9UzO_S8AEt9+@Ap#4E+sv8ZCD{@sKCn2IHi5tuabG}(lC?a!Z@ z2Duj6{KR$^^1v_=O*6(xQR3s{GvGuFZK|ld9L(35r8`KxbBfhuxCG+jbNuT?JdI)- zK-B2Oc#c27gSEpRjsO_F=^}Zw2b$^X90-irc;zHGT7Wyiq0lJeE!#524SL4vHM>5^ z8@PP{pQd6d$)7?*zb-T`=H4U*tx1)RfTsZY2?DCA+mvX_HzsV7pSXMfsWt(z6v(l# zv7PmE?JqPO6)Wexqo;2NW-I#TtEWWD#mU_RHa51WxY3-4oX?9web_$Y- zXM#;@JO&f!sx++uKqJB;0N&!f)VN9$%m}g~vo84Jq(STE##)y*-s0loA(bBm@W?3n z_;ma_6kqfNKcykwh2{PpaDoztCDcXGhUdPzx_-L=j#T=8@>k=P!h`eTe{HXTsk}Mc zavlO+6zm1>S(O0T42)e;x*>5?#4c%?jPsfXB7XPdlc*P9T!e0dYRg~pX}|1n{@*9U z{Eo?cHCa>k@0Gw4lb!ETOJf>EVoZ7(F6ahgbm9T%{;#{^zpv6d@ZN}5jda#GA{j-h z?7B9;(#L*!o`0HBaac&t@QliF>!&0UARwjqiP>33?P(Kk%U3)E@lflve)}Fk3oVF9 zUV%jdeRbyLne7SDp5FgoObVWqphKRd6v+tHzqVx(Cf{#ZFZCR8zwc#}ZXm=)G*Dyi zVy>`s17JQ6{><=jl$gFQ&9fKav7hCDWWy821SzU03^0e{JFm@=qpaHyxXFuT)<92P z=bP*oM_ZA>(}=UF_cL+@=RTin_n5R;88Z3e_gFaVlZnM zhC76K_*NE;(h}ooUhdb=*pNn$-xOmiF&4nph2Z&r5BT>1DjeCqhB>CTMJ_KdAA!qM z0fokyq^Jy@9Xu1gyjrzLot>Vp1yKUnzjVLHo40S@W)Ltu9X+p@WgJ7Vrk2*9I4W5H z0kFhD;CHXKh*6NR{?nMX5ky=jLrF6Ly(knv3Dd4p$$+@G;4;XJfovEgTfS&`^@P9D zV!qyHA?dvi4oVO&Ek9zmrQBZGqkM04*D9VrGyn=W1sf5b`91b8cd^}u@A=<$thm8A znQb5MgUR!~tU(MQz_=988$tX7;@nere$RmZ30noE3HI`)CQpFjh+Y#z_RpovTGU(~ z`YwoSVVp@xk`XX{*D><3s(s_drR!r{`Z4z^M?II8PI`HFqoWnG%i#rLo_mez!8nxo zX#}@J0l}MUH_N^jl?xk}d$Sj3XOr1^xio~;w|QO6h_8GmxL3j!zrwWY-M3dq^^8dA zMz$*~ZI;zJlGHR+3}w9D$`94wq8w!Yb27N|5^D5XT&kZ_GO|Bj1^3QXQL_hfrCyi& zf0|tA3G2lJS$gsKrcwCEXyOL|e%;#M#>K`ax*~mpvM@oL5~LtAof}u*pllgR+gBa` zefaX)1O+2GCBGW#-_l1D5+Blhr!ipNg;VUwnwBk&(;rFuY9o;F-bG@^ch+Epvom zW~Q)jMJFX>+?YPNvZc89(fXw-MNtXE0wcdyz+Jv>-s9o!;BSLu_E}G=PF0zei;~77 zH?F#+%ifs1w!hc~@Xw?41g9MqLY>Oi#GVp4ZK&XuVt#$J{>fBmJ>|HV^ zHP%5;oOO+GBtHxChB;f+b3XD{?`_T{r+o~2%=1@`L)ask{Uwt*1gdg(emT|jUQ`L5 zC0-S}?fHMBL$HDTa4}%b`C+&iiQp6&@@L?$&8kfM{kZ$pH{JF5){__Q<}J4m^KOho z1nD;S8zILAI9}-zw|_U%y+iEJ(tVO!bojP+y#-WnEETPL*Lqvwc6P!J+q4iN_NhEp zUL@)LuQ6yFUOiWHDDI5`1SO5Bp+5LD0 zL_Dpq$GgZX*Ek);s)8#kl>`P%pCco4Lwb}Ut?S@8{;7)vWSEh zvLwP$k=h4BXz^9mNS{569@n^wyC8;xeZlqqOXB z5VCB`Z)&OAiu~N~rz)`_N+|GDfgNsjVdZE8^a?*<Rp zP+?I!2F7h=AV8=_9N;^&dbU;<<^FIILl8{~X4U%)9%kE_%FsuHgZL=aeQyjtZbt1{ zJ@;>x;3@Lagbg-z2=$rp%KhD2e%@9Z*6t^+FYUMR>!Z36X=x;!(q#R-sg?(O`ZOc{ zrw3!J??pm+W+1ufJHpF>tBh4pU9F;=Ao{?f@swV)+MO;z523(AC2srYuYw=bS6W&c zBgRSGvVF53J%5Qtj_zEbxts&R#{1@HZrz7)UkxNgEXy z>?WINR`ImrQF$P$P6noB7dj0?j(>cwT4=1&Qo?OVnXlVou;wMNH{Tntpc zTj$E!;%1pcg78y;sS8EqmA1m(LMBnqqtF6`hD$zjC>iaJ80or2yVhAhE+4_iR2*Z@ zddK^1qz}u6TI0o4Y^3E@ysqG+T=11|NI2ZDMq}nGg1f59Hv=Sbko9 zZL)KfED`2G5zs{}btfhAa*;u2{;fm+Gq>Wd6R$&Z@kuRY>E*82lfQ<8K*Dp2p)yFT z9*@Pn`p(qSap%kTUr6(LlPD%jo}3q`*oAn0R8BZQKVN=0bo(zGyOUTRA`OsccrM|c zIX>dCyovYV-b`2cdld`~&HgDTRu%&kA1Y5q+50|^V`DV)MWg9efiMQdG#o8ke zV<}7Sqn*)@5Y=hb5XFXI68(J#okpEtJ__mb;rOyw^bm~1+R59E+1+k5iu5c6dd)^Y z*C9z464ST6m$m))R-v>*vRw;{lO&363izM&n%F#-I}v+Vs?KUKQ5Fso=>qaQv9O`{ zr=t>d=~6;M7Fk5IUg|h zQGK0qWv4#U{?}-gL(?@JMaw?6gm-_|5)5bCRg=7NXdZW{w|_H4J{A#QebvwNHa1<@xDg5RXHc!`~QfjWY7&Z-2rXdxg*x+mFtA6@8I}m^q!C zs~UBh?8ii6ruqdu+7@iqN%WS^*XG)4ytJt=YvBFMShb8G%wD4ACl&uT9xYng#39*` z*nAur=yVo_pn-I(%r~=(_QAK*a?1 zcqLRhH-tw30+|u6<-aqg2xgJ3x4WgXNer=+(&{tP@zi>*e@ygXWbZOkBg|7lz?(CJ zYFh3>WtMFUxGzWvHGCPODQw1SSM=`;t}2TcJ=rzai3|@%P(Uj-Q9d zeUJt?BnR!5jA!p0#b8{;*7w3`OLX6C z*S2iye3bB0$LBbq{oShYh@M@{eR_Er_}<7aTewj)+XRZkZ1^4`$V%{m{sA=9 z0rnyPUP?*fL-1}8-nOc5Jj?8*l7L|KQfA%*)gVz&+@@>1+K&tlJw4uz5aJ)KDfJKD2LOaC2JIEgPJVW>0Wy^43!1bU*4B(5<)r{i^Zy zE2I|WGwjSSYeQs*t4{-kE9I1#w%k8iQ%jO9cEfe_e4WBMifn18a@XcE3J&sHlRffl zfBB^s6MvX6i=(Z9V`>ntgYJ3Zn5!7E!RAo)@pJUYOz|j#gYc#dcruJgE6&)qpPa{6 zCi1_2LW`|GRRGwbC7`#KHB|M4+sbYpwte#JXkRB+$ne>B!JA-=+Ka?i}{O| z%XuphU2loL5>V6Cy$97&P@`@R&((Dr;h>J+DdJMdP#6L5*RxBxxiNHUbmI5#fA-wG zHIj?Cs-@nO&mVNrjm}ydi@=7Q-DXgHQ;M(VtnQzj+*smLCDby$&E>xp*P3R))X(lw zQ1;_m6eFTOoQ7ZjooNcepu^$~TGaROk@waNpc@)2uMArTHV#)E6Qz4C)my1Frq_Sn zB35?%?sc`z{Sl&Oa+2g%?IVG;IVPsNAK*1b)D zEW(tew1RX)>_6)}355nw_$&s0&*$iwZiV}Us~qggR)@-39V#>-W`R?pmCsc9lK;fy z%?k`UW^qG^b%^AWQrb_e1Sc^!RbA5r;oua6AS$f-Qo6=I8X-Zl(lpV~0enU2;2>G* zT450i$VMN<#6`{ci{)KdmRf41WpI#AJC~r5v{51rof9R7y44q`P>zY_%2g3J^{XFn z9Sh4L#0EP)7do(Z*=ogpmL*nx0qPpux!ch+b*j^RQoa35y6OiDG4=}EvWRwex*~(5 z>t9L7QwAP(kIu_!Po^+o7}56l@rzc3)C*GrA?&W-C||~3qac1AN_r3KbWhc{`*x7OJ*zyUoP`YK5K6_FYR(;$Ju7|@t=pO!?e^hJ)5;xS+n#9n-776 z?kcrQM)1#mYVcWSh?+;jxlO|ch+Ena+bE{KITbL@4`91YbgM-podR-O=E(6P0AR%GRkL$N6S=Jk2z2AFR{)8RAd@&DM z$zu}Y>7o`4Q;xPO>ej6UW1j1>M zDCPFPJ_bqN9a&IT76P?*VbX8&9olz5X+d3y&*#=z;EWkR3KUDUTihKOaDc)J<)|Lr zdJ@Th9CAhW&$n3Z4p{z?AUtILS%fr)*-y@Q*10^&-|7o)SEDKoW-x zNn&sX@2^K|>H0+}ia3cKvP#iCBIt{{vj(5!UlaPuMJag+>^-EWZ&HpFw{Aw zy{-6ezjtbqiTE$SLumh-Sc?~C=VVS*Z?3DT$Q_9fOsc!Ce_qslK!(ve`1!sv?DLw$FIdw=I zjgaogSv8_`kTSfXwADkSksGRrWYGH0;bFPoLTM(@E(=Ledl=g$;I{uHiy#Whv?Hbq zO)h&t)B%mfvTI6RLqkPoYI0IL$=K9XCXP~C1tpIcGea9ej&6qDyh&}8-tifp+HHQ) zT?h@--Mc!|Li0HaD(5Vvwn)V*`aR3FuTGKM=hc+hz0sfQokd8g+2jpdYfwE~rEH{- zL$D8NnS><6n4pKYaTm!hWSjAmKZXX;hB*mm60jEuMGTvM)G{>HRNcJPCQ2AVoaYl& zWAAlR!i_7vACdfXkhpCZu~GC=K<{&K5JHr?`z!DAw_japXl!1~m?H+D4s#+UFe7rn zJ&%JztCmtk6qA2ISsCr~6$^jUs4}>sc)0%RkB1LgskYa-q*~Na@GGU&>z7?e;wzd9e=4FB9Swr(cu_8YkpJjA9#-A5{nvi8L1J>$!w zYJ>q2qvPA)PkK^~x0KD|lsyUoaMMATB>35Mg~(X$GS(8KB&yygTMg`pLi@79A_DVc zxMb4>hv?-yQ=hfUXOpP3w6p;42gJLv{ffi(ix!=$KPJqr1)6B+>18njCnr_Jc?x&f z`Lv53t2R6Y>FM{RX7dvsH#F&d#^=_Ey@m^s*aZN<$T=7;Gcbqh;wmzdd%uAAZrUnFu&@`ge@XZaUm?(>VK~4D*;R zx0H9qB9WC7H_F}4$%WYy-9969m=@r$NClv3lHbsl!`Vja!4`i z#zV+q23eE!{h7g?E2qrfW$*GmBi_q*3H~#}M_L;biu~jj1_|N@FvgX72Ol=^=ngM{ z@-y4*oP5aRriry?uP=i;5&|q}wo@Q0r*9^y&+8tSX)X*j#3-Z>2AF)D>VqV))10jD z0|jUKn~(2ecIW20!B>w|Q4y{ZE7@9>=aqdqg;A17E+#L8YQ;#VN@Ii-)YWWi2`I_( z_ZlLcElHwCkpTBZr`@+zko%6=YOwk~zA?1W0@R5L_72U48eS?Y4!4023s!dNbL}IA zRlLw^bweFn1Q{P8Yw`0~%FT$?5iIjFQG)z9BO&QdI34cV)%SEjRo-PkI?C# z?d}1X%rB=I#*53)=$S{FnD6R&&}cMzXeIY0w7;8e(9JYdAO0sC&(Kj3p+_nznlb!F zw)lQiAr~5NaKlSrT$305jVa`kNN_d6X?+tAyyw7r+J^?P!%Nx<3g~InfjoI@0Yi)9mY4*ovJVMTJ&0o+GrWw6BR-F%uHQnt?dD^{N%0&~BW%!0yPf)KkI}Dr)_BGHwaF>z zg2CA6aQ%sv#$id=VKa_9qi0_4r)+q|-t!-23j}skpYr_#hDAPR#6rlN&2I%tU0|_L z=xw^Do>_O9;A@G!h0&4MD`z$~8qv%j4B%l5)a zhO4#kPZ>~|{xsa}!FRH3lTy_g#8?Q5k^GG|`BuB1nsZsAgqZ4CAi8;(8`X99BR5bcWw>srj2753b0c?LOsbVJyk*Mjrr#f!Wyxo>EB%XXp5G_x>e)Mwl9WE*v4^b zOuR-%$Bp*3R&-FjNCaut4<|-ZU%rA!WCHG8(<)X-J~O1h`cyj6BGTmh&4L6klh8y3 zmw__8>zm{%q4|gx3%!@@G{(IUcNvtapjiXqkgzl#2U}IO8N6dGR)&@lVK{$GR+DTS zwOF3i>GMg`2q`00t3Tz3`nEsyr8i}oeJvdn6a>Jom0pRqzCJoc&!#ZxtBY%{ah*1x9D=&?`pLE7Y2*`4jZcoa z2nt=a6Lu1FA#*xeFoRk`O7EhA2Zxvm*byjY4qTU7J_^6JJpjeG?Gta!m*B{~2yVmVCoeWAf5B4KCt`ufm^-e%m9Ig3lZ;u2Xvf-Sm z1HK0`K1@9$bEXB6oFm{IfJzn@ApG6mdqaNL+oa7{jtmU!@FK7(@Sli9^i3bajT1>b^9-tZjJZ#!)Qm8_L*b}+|GDj(t*Qgg2f)vul zW;RO5>uiqO^4%uCu!oz5W_y@z?C%dlQ6HZN<&nxFT;%QT?HEFy$pcq6^KW|c6;XZ{ zxrEXt(V|yWpg74i4~m9>2Z8nhqv=z_mkINhtyC+(FfJBao!NAB$&iV~0Zf7=uOq-r zPAzmGOpcF_-wlnHvUGeMy{^E!Lzz5O_vsfr;5J#z$40Kq@MMevn%7f!mhr}N?w9gf zcd8^PqozI)759qfWM6;4i1z6aldREX(1X@(N#&Qt0SX(S`a7)mmK(IUwY2CS5m`3` z7{e$DhpjoEi0)v=0l`nNy$AWJf-Fg%sQwW64HO|ZH#Pt@Z|Cl){na!0$STen7^Vnq z0byU`;vwLpUK}iZ#9AQH`HwMRkUJg240xwqpht$^-5%sW)zuT{_G~<4v$OyWF8k+C zZVHM#D-E`%75-`F3*y2-qSpbf5wK|h&jOuzkP4}DjKKEm6aAo~Qg(x!S0t1aslCLo z3Dm*qyVT?n#1YdRj`K?6B@~!3QI-4o|xPumhK{l zuo8avN`$Yv*CvskQg@6MBcB)_S5j7fjUF=ac=Y0lMBvN|$lbb($+WIjOekPCNa($G zqAvWJ$B=ezWs$%5Ft$H-(~umh#N@}e-G?+;aI$a;b;MAKt{v&Gcq&TSsM!?93Nhc5 zK8*FMBF|-LXVU1#V1>-E05)}hwXTLnJs|P{lC0~3I11=3?U-+<0O|@vcX!@2&rZ5pTkIL2c{*a(Q%%QAh4rDAn%w7{8QJy z@ydley#`b_kOj3~Yy#AuUOciu!s+Nfym*sFAocb2^>)i`z`RH+Dk@6Xf&{*6c!oP%* z60+4Q>gpW8(gCiHLKxPQ3J}ph2gHrC+}zKAup1z}B31ou_B=Abq{IRc&H+Fn!pg~I zF_1%}u0@~sBZwPJ&9&tAkPC@d--;+{`~I#}ZsxmCg{P6FinI@jjf$bXG6%KWeov%~ zwyK&uv_!}NEFlS&kYd2O+e)(o<>)C}mwv_E1lC^AYyn7*I`Vtp`2H%yINwGjw!@0s zC|rGijJb)QlFWN-!#`EhN0zP!#y+BZwK>|jwEU&XxSL;UQ#^chwz^i@qsKoJOGwSu zeWSK3D%0%dpk)%J%t1ynh35NfRO*Pvt-YGjz8ISw@$siNu8QTCYMNYgAwg}q+1)QP z@=6v+4L+rHH0|e?-nrfb73M>6#rZSOH&e4GF>aJ43N2TnN?bk^P}6crEYLlBNtMP` zhTI?4MeU?4J=Il#{O%TZ8I;&t4B+F1CU%quxuuN~7+v~ZS^p1}EHGNxY%YSi7o6D> zJ+UGstKp4EXf7?FQvhP+zvXt=NfZVI3(cE_BVj*3?FChL$D7sPh*5idIS^0L`2N=j zirn+Q&?58w){&f$B+h_d|2T8C#>4aT_UIAzQ%?(YG0OLG)B4L8?w<>;04!b3TD$%e zK!v>(Q^Hd6kk(XIHC8YA*p$zLr-6nTH~rga+eDryj@t1Vu;Qw$MUD{oUhR?Htn>fx5Nebcs*B!0E-bT@f(42~`NHt%zMBDq4ly2MkG#Xju;)81a z%^0YFgtV^p9!CDkQOMyf9$qGHbN_J=9m@#$-pXPR`->PI2NLNRJg1_fr}Z9p^>fse z@V|b#MiL1mK>A`u3o<|uS>(3`=bsE}BO0HYoD91zK+u8eJPFa!HEkGPN$V%#X-TB(bLwD8}ro5PpUB$&X##hjB-q(0n;oCgRUjFH` z!5)oJpc%uZvF0^b;l||!1#YtnczcqzD_NrGbZi-AOT8-u-I+%Tfv=M2e00 zP?hfOCxV5cNmh;6BKw8=V6OI;f4x&F#zuvjT6RvzAgIEM`0lY75G|8;2+<zXbVcLJo(TAuFv?`SX1D>bgBa4Y%~D>0=k(o=YN?s00Gvgu>K2U+d! zPj?g2&+fG0R^onH$hwJxyo9@H?9E+MciXpnP~oG9kb{7vkIU+;l#kSN|DVHx3}|p2 zPPji6k4$;5bA#fwnR8eX;U%kW_#t>6pEq9Rk5&)5dKAPrr`(yn<$*7K_t}-=Vg2}A zqzD4x%G~|=P!n8TXl&TzFHZsNy>`(Sd3Y{hp@WvYCMwY}9yw~&4g=Q3KY2I$>&Lm~4;8T;2~_rbUR z>5(Nxm-Y8e=L$NAE^=kRyI(X0Z2rJv&$ug$~X zE+lgo0~mUyw(Cn`BC`ypwp%w^@rb{7MNbdT1We=ye6@n>W*nlwX-W}ubwA!yHfUuR z++o751_WhR+EtzQsSja-OARCO-VTnJzcZ7*DkkNP$B_Ys2q}`-#P?h{h%Wm$XHF%@ zh;Y{Z;GC(bmWdr`I=>&3RSTu6BP=@ZzAj_w!I2>?`QgW4=jjo(Y`NA6cN1gQc*w&h zswl|~pE{U%KY2HwtiRM5vbHO_ZT#0>yGa;%>@_4#DRs~HJRIXeqqRnP5)z(1@&=MV zx8SLvxL18DC9gzhk3{d*SIA_3d~K2!n<|E4zYzi05mFC^nrYLomud!!6(_Bmg8NcV|3k7Te z%g3&CJIg zWS`rRT-sQvZfnkl6g1r__N=iYS`-j%Y}<3Iu<`&#J1XK=Pa#ol?bKi6L8dJN2?`Hs z#Zc(-5lvuirfwn&Xh7leI5jSvNtL2JcT^Ks-gmw04toh8(zA3cE}jTbK6dEFUg+jo4{m)gV%72Y8cQ;B07FE9=& zaA0OjJ!L)WB7M>ptDgJ0b(Oa>LAV7m}T}P!M1LbGp>oUVmjJqN( z*P|px{(JGM1CqIy{Ee=~>n%%LCJ$v}l_zF8H>xOdLxXvL&<*_;NJ|+oKH89TAm6Df z!lP4!QKytuP2P5AZ68@h7S}M2^0YSJq|CGxwVhKNM-^q8GkjAzkg%Lze%Gb^gFu=) z=jQYL23&oC$%N!b_bF7}Wd?_vL-R2P(O1CIG^bL6DhDVJD693V{=nyMj)fQIF44Q! z7zv*5e(`YwZIor{TKd7{XnM4f8dgS(Gyl%;p_v`a__uM@{`(Wh71ntA`n;pT=o0e?*3ijEqIrnv|&>=SE!;pYzzvHYFL4OrgU9GKdn$ zKwow>sREKgO2T{ljq}4oKY8b@2blt2ilt5IwiCTir;vr^v7rq*hm^*YbygHRo$D^Migz##}ge{qc<|#*NGl5vdxXz3_FCH$j9YZ%h6xyhUqZ9lc}7#jr_r3{DaR^)bQ3HgUxO4_% z0RuiccZ2W9$kX-mKFu3S>%~g5 zA(www_Ob0GT6y%%StNwn!r$d^b{vpQL$*=?=S@E|{b8;ks=-IouGU_ckUL&_t*wu@r(w|kA0 zw%vENI(rqOIHOD-hr{@EqrdzxOpF8h2`HF=A_c}{K;{;tKa1o|7-g4d`_>YY4>oqVy|gdJ-M>%a4Z@HCEQ;M z7h^|Wh88(rfqFoWddiM(`>IdA69Yb1ih3_|Y<)exkLswd-(>Qu z(k_3B3SG@5K__1O<3%OtK+H?HeRxFQt_DIsn#!?P>G!Y)dO^?Cb4|}2=$933E z{K~dl%dt#>?a>TCe>hT+IcmGJjVOp`IX%pimFz$wyS>)=jBLq{p8=);ws}4Tv>~mz1{agpf-N_&-CB%G|ZnS;jH3DBvaQvy^LuC*aPruXg3!l@iRBolvQs;rkV;wzRl*ga!4pV(+Y!^Rh4*BRP)bdDr!~fJS1TX_L;$pQH%xEYHL18mQ!)| zLmCr{$KuNvb@@u~O`qenb1%ulbZ)m2OAU0cAtNtsLWzoMtrB$FIGGP*$|>$&pb{lL z{-rtzgQf*d;uExJ;?ho$_DDe{jy`^Oq4kY16XHp-o(umUWp5QwRrf}FZ#qQ~l7(iE zAjiN&rh^iLK_gb9`UYX~oAwi&$K~_vHKa|!N^9hG|_1({Xw)2>YLO2o#sLNq6)uMhpzJB1#^(-VF)8($95F=v=lMfwq}4ePT2@hdp^A_(m0)hGiHc-#hgC zhlbdahwGLcQ2Oi%`rKPqfInI~+KDGfT$Z2~Khnz_(f`UqTDpUVBz~*E1xsj6Xxdzx z(t~x@$6;J0wEF`MJdgs1p|R7e?9ABkVzrnA94KJtloW+6-zb%Mr1+YI#7C{ahkU(a zfXa$6)4Gw0{fXzlg+Lz3V4GhUDd^*T1+&xS^JN(wjsO9tC>2Q5M{%gVoF>Aw?~v97>|VrN zG}m`|A&`^Ko3Q0q6XbgAsKf7*;86KIY_)sc15F`rCtkC03v->7U%VyRPib(Jj#D(s zsK4U~v&oNqA(qlzUB#Qz#!u&)i!$Lqf7nKh*m$CG}c8Fr|=bqLPDY$3?@-gzJRHLdIcC!n*l z@}!!X4`SZior08F63zck99?af-;9?SKebR$d+n$HN1Uv-GD~P!-)5S_?GCiZDXX>j z!Tujl=1bAx5eG%dW2~$;#^21c7B7{0SOila)t=(c%#4yoDg}j?St!X=bw|PFYP4P6 zFD^vU;*}s3GJQB^F_7*cCXJ5PbcPiYR=1E!;-cu|@>QT2o8i!yF}IN%wnuE*o` z9i`3I`lKhnsn{6%S&tA!s@t;t9eKRv_QI-lQeY@OMJWdITKQ>}Z9g~p;8|V<~(5^du`MEWD^{5U|&Nc4#!2weCgk~TJsBHwpz!@|N!BgZyQ5x@SXCTj$) zR57K@ar0S(^DL)5f>*tBmNg=a3yGLQh!`SZzYZihIN{XVCG_@*>UMEpZj4}ZF74gkX73UPv{cUT2~_+%-^7(w zir}yNk%zRMMw=)FtDY46gka_sSXzkQKo8nX*d$iLa4(ngF{l}(SkvNcq(NDo~ z>sq+g)pyOFZUZGB3Heoe_TS}j%z11bC5Tu){uuTvAscZ;wofE7kG^br7Z->f8<>|K zue|<-8&!_<(y#2Y^rz^R2PNJt3v}3T7BR#gDfh*ebRXhRJ}j({%`wTrTxSHGe@%NZ zRTtAWu@$wc81z+>EPlttvDXUF7mgL0_J9Q#-+&`x2bV>J6`IjO(=VhRn{R5B;@2FK zv{XxJeY;=ZSUeBGQl6b&#c3m?Z*ZBi1RFf*zqx=bXTm9pgY?#_C)NeJ=6G{-lkrhM5njNjFV6sKmX;xzfH#MWyp zCv@JfR)fAA>>4*)T8p1&h`%p!ce=~_(=uR6ZxGx=e5UJ zVWV-OoTaN z!q~fkAGz4-w--8c_nA+Z&OZD;$mQ3HPNz?jfeO0yoEM#z>4O2mn|NYqsgqsZq;606 z&)|z919ObXab+qabNDE*hY)D#WVek{`pTffgE1T>?H)2qle|Hcz*?>-)VaXLen@K+&Non81K zm%=k!^~Fxo*A-K+SVwE+j(_9e@o$NT&}so90gDRgOGcyVQ%7 zOYWA5h)+=cEU1tdTO}crg3H&?I#+7KN#;Di2bm(Gc zZ2a=}5KOi^K6yYcp%ss{!3LA}AIIH;$}!F@j8K34D6>LG#65K)hyy{VC+0H!U{>30 zzRP?EjZ#6+P>X}ucDBC@gawIal(Jf(9>;x(T&&+3KLDF+v-X@%967^mD`}-=#e3B3 z61z>y1k2tc_kCAqUXq(P^(}1)?|UQ~L4#n3{s#x!czt$#X<=oHjKw*@!IPor+#U7X zw}E^f7I(zrdHaNO4uoC@(FCyb9Ice{#fCf2(PBhfO#x~Mtv}gcTaD|5%F@EL-&1qYacx> z94w^kT&_$n>UMWFye)m_FKmk8U%`4(Gsy@fh>xrM52^Mt?}N6#U7rG!WG7bcom*E- zU!f=67Fk0sP98i)+NG2ZAMqV}uPRS)Qg!q_E(eDC-f=#;lp=%@m{*$xkqYKGx5&z* zWPhsfu+3WjGBxgkQ?K9xiya?`A&%44NqcLym1?;%#L_02NdwyIT5*dAZ(b~2z)$K; z(~^t{>#q#pY-3=A>=l^-%v>B`aJ?9`LC*?2wshVhjh-jvQf_~#WKfZok&$U~=b4!9 z03}5LDmuXKm06Of1yq#7npVD1Prft-!ABxUhBxLvN-6w#k#}!&?Z610qzjXG^l8A|n5$M)eivSx+6-w#2#hr{6ezU(6riMVC{ZAo?`q!Uysdod4v61)-{@I?K11pf4w?3B zrOdX14mN$FqvsGfpOfs3(NteGnQ=u#V$_7J1^HiDjh63)=3_>#9FNL1>{#bLiSWS> z+MkI8831X@d-Jj1z&NX>p>g1N3Ou>M8wy&H#{-zR3USHF$pt=kk!N7mUE+?ZsPd|7DcvF`g<{t8W z=U!kDa!}S*s+Ry zP0sl+KHvSuD-H)R_8$~??KbDyxx!@YFKs978{Z|uq4qV<@e2xJZ*ng9*Pw&ik0h4}Ue z8ZqPH;o%iNhpL*|Uc*!xzb8Nx0bs^dj}Ctj5bikf>&0DsJb;{oj#Pd3JnOo-6^TC|Vdy|w&$rk>oSs1gB-zL34W{cK>Gwa2BD zcFus*s9*#gTUm!2Sy+A`1q@-@I+nyPvCIXN!ET>i}g zZsMrGy{sKso}P3LuS_RwbdO;J;IcjX_yRPUVTE#@iFBVWMS!9-Aho?f@fM5@<=xO4 z4!xpe%F~>_Arp}oW$-@9nBoLUy?8JH!=~-D7a!dDY@_F3mFxSkL41F)_v>Fh&yEuh zI0h!Q0QkM`!0Sd+xX;HWh~L6?>^ZdpgwP9B0vjO+-DAxk0kQ@-Wm9Z&YSRFd*#PJe zIt0B6KT{0f0el0{%6NlKE5PGPT%wEm|oK2>0kYArtRx$&%Bg9Ou%PkB00tBIa}D27u!>5kErp-X~%sS0UX8KnC~W zUWc@ZH&$i8ow)+6!02qo&$X%=8pKUW2by=8%-=f3z(x$HO(=81WgSTMwGg{l+Kdl} zyBoP%@NX&>K@}X07OS`Z9=pipXSH^~Mt#RO1n`(;&}(fjEoCB#EGk?`i>lTmRX~97 zjeahf0V7Elu4#cjg%0XESKssv!}z}gYO6MxhEXw?cx&aw4YHKrS3P}!%5?*A{LxU1NyQr+-zAGP=ZN?>O#!vdooA|(I z<{k$O@TIoRjAUJNu-@VQzNAZLg_S$9-Zh0;=}!uoxF<1MjFzQ^h5xKfzK;gvHz}+6jfa4%S%vy$u8#~)8(i} zQ)tDp11*Mrn0wj|mpnSGFnTm0A$Y-g7lp55a|Kk*C2Ee4Xz*l0;z~(rhdlW!ww137 zcdaUgq@Ow7l>7-VgpuC&6JHEMr6GaJU=V5>l9_M{)fSE0lB7@u>T~c1fMAgWDWu+r zjqf?}q{_z+#)6qTKHiKC&;HtuaR{7B@ZZ{y>+JJiAM)&dP7}n7$4h>*#{=S&KW^*P zE|ez2j{Do3QM6)hQX7mxRx5w+bW@k|c}V`QDx1KOJZ5_1ts_@l+H_yaI%wueL_1=< zY(Z@RdI8K>U}w2dry~7UEJTzH2ti_$m9T&+M_O7MfXj54G~U2~Ti-z5?~ODRjd=;D za8>{XXSTc|v?$C39tHX<8vehS(O)6vV;&TXzBeY)rc7jmXD^7KVoeNG_{HGk3*rSk zWoZl%0BZzXo7h+YywUMG?Ez~BDU_Fi$}JFp0d1b1CEV`ZC$mM0ngFxpa>_jl{Ks2*z%EjdaD$+0>^)I6(EU!yeRM^S?oab5V9HM$kSAm19-|;OkIq7l zV*B(reh_af&h1Ph@~eGiov`JPl$FGhpz_8%VPvU4zHQ)x4MoNVcmUNy zkBz<6{w=(=df%SMxnn$kL%&+WbWM9K`(>49YJ6|Q2$}JEP$?1O=clNYw9Dc$gwn+d zw)K^VUO)EoMpc*=h+Frv8qJube4U&u^Ij{meZp1zWGI?7MX|QBm)TEvtIsB0ZP``~ zjpH`O+4a*+BQt*HF8%Y~y|u#;dydC2_f+uIf?p;S4%`y+$4&bK%niB{WSWk8aT?86 z^>&RJU47-bVg;`YVIedZBj|*^8?D#9-_<8GY3KrL`ElGR^t%nf-ht(WhU{0@u(T=_ zR=dHbN8U3l_QrcK!DWKw29_A0G3NDcaM$t#C>Iu5deUP&<_chBjgC|c5*ZcK41l>5 z;CsMR>a+?$3JOsuei)LIP%m(s+Zm&>pJDjn%eTsKoOaW-Fg_mg!8JCAg1C{7<4NI$g^YxxI_HUI#s*h^cAr z>hWxyepppiRk(Q83e51%Ipw?WUkI?#g2CfXz(orQ)^;63+^=ar#@?X9Td#{>GBm?u^LmX!KE*Jtf&Zh_?j*m~xst`9jnL!=m=^tcI_c^%lFzgD#pG_nB z78%aT;QdtiP!XYAA3ip?`EI@r#jpAYp4-N$iDq}p4|n%F?v;lRprGcf+T>VjW@Y1b zMR-e&BKz8F&-;sROIP=*OYS#8(_m4t2+Yl#wTm2|c%9F>UhgI{J*|1R zm9`x&Jk^pPW37!eTt2VNJ)F>JqSLzaMyA*V4J*XJBcn3ptDZW*<<2JLbq8L3O zE&*nWh>4sAMAFTZzg++`WiJ|l{uNzXL1A=slo)^|!*D;Ss!;|2EHV-%70r)M`;-oS z&1Sb#;A>4!=+F=A`g;OanlC`z58dJho;KPOG{G69#YhtAhioEsv%MzJi2h>TaPl3t z-4OIRDQBVgXI!PxLSZ;=F~?XF3`?!z^Tg9!ekoX_eJdV6DPxbUV#rwGAVeQu$0ykS zU2u&yT(7kDk|djE{2|sIAmlB%h0ZmsU7E@nsyS|Mqo{_&j#4j>Elsxtg*?%Xih=;K zkDaNd@gtdK`hsKmtuR};F15~ufUA}9wrKhilVVeB11t5m&twu)zOKVuhV|sN{9O2 zMA6^4PjP;n3MO;mlzb(;wMEZ5GVlSa{kzw>l}HtJHl%&%mA}}1=dt{kbQOJQzakkM zN7rCe8@q<`IqeuaODwc|6Ft#MFvD=+P>U?$KkfjE zt;&_SmRHI$vYz{y)dG8Dkd(zPR?pA*v?7pp?CEVUVg~uQdTn$?8fL#}YZxu%LPcnB z;MiCe^V{~i6{J)|K`po?zk8yK7P>t*DPeJBm1D|+T_19D$W5zazcw-a|7!tuJY1%F zJShm?2N}F^2LR<+8Cv#4S-=-X@3Bp)mmtF^n+0okiweyP#+V5p3KSyo13Vrx6B9s& zrKE2bB2oPOxoGr5{jzP|WMZ+Tye_EK|Hyo)+cVzXNJvTjQPa?&L=>R_Y>?gIVZciU zLdq()Q^TTZkDj+0V4RtP4Z@F13Kud!4Jjztn}V4{d@wUQx7+cMW({Y}sFX&xA;iwW z!Xw+y}f5?=SExIVuxU7?Z`A;b$ zZL*G^pQ4Q(PJ#&PQsdcqJk3s?;8tW&5d0o6E}O~D!}Lt@wCbndj?=G{v^u&CgcVh( z6aQFYDXN{L+~f-E3U?sM{ez|3zv@j;Gj*=TF=^=nu58ANns98&MAwZ^B~gS$n@+VScQ z4<9Q<)Xa4i-(3Y%f5p1%NjrH&*=G;oDNYgfLuaWm(Fsm^3lpimJ#$+CiWuUXi8E?F zdt5JgV_ zwL>G|`WYSlCR`lAGC6?7Fq3lP{FjsXuBpWQO1)f*@-02TA(*2}bN z{@@Y~m(>^`Z(lU`tMttc4Yz^Vx^q=#uSN2K{&y;0$#vN|e(~@~o&P3sIwx3avU+=a zySw0>$oC#YTt2t*Spc7PEfWy`icS{rV$|N70GfONgal~Vkjw3GMiCnK{cCM$?{d125S3%8(E5?S^7zv{1MkomM`^pw3 zpV99z%afttI7#k0S7wXfzyllsA~d#Qia`ET_0v)82s7KUPyWp^zN5(d!(XW#Lb4ky z-}wr!B!giFiZo1*({wL7%Fa26B33RF^SE>EanP%uW?j7GU3_u`G6}7JBI}5xZR97# zqJ`#WA>Z!QJyB!3<)x-p-gm6OwjF`;Yh$omm?R0NINQw(QmCsQs^{Ua?o8gfccn z%O@jVHmi4(`TxHT}WFv|^e~4m!3)bwdo6$1cpq2fCbWiiJ1hd-n-E12Gem4p9 z|9^B|(4b7`bv?S+n*`SM`%mA89me#t<(!aFgM0%XSN^i1_kC!e}d&e0BG0liakjs@;5VRu7WWoB52^g?J&dMC%D2 z5eKm~PbD?>$=|bB3FjB@`gf=JfWiyt-|n`PO>GhX6~-^QJY^`AR-Mb1m0BmASuEE! z-lUpwBQ%C@37ELHq!?_yp;rrsjzfa-W4;ce^FBk_U=4b4(z@={+v03OVv%tOFaF#o zZOYP{y-{4p+`tQ=p;+z|bXWRhUwHCwHe5xZqzEnF^|k9h9D!2cC)kI)obX?Q1f63t0&2$SUZXTtZK>Y4U9p5$v#LwJVVa6G>l`qtlDY;u(d)R&! za5WK37GK-jlG8g5_44Gp8<~ld6lMSN-GmI)u^40o5D9qQfZ=ht+{6iaiDmilL4_Da z0qAVJKxD$-FE_w(l>|W7B#22a*=ijv*DIc&MudwB4|ySyi$@T=kOsR^lAXeZNXkKB z4OBG+n3-QgN*nhJK^ewwzLF9h(aD}dP(424t%|gX*34um+9D~b@c3R9c~Wj{T%4}M zAIkgdu8$FrL%tIjFV-WcSC(-2xcGx@rcVp=!w_A1tb|f*P-c=ePg(*Z zoNl|k$^jDBaA&HX`JKL1=o6Pn{@~CScjUv2H5ojVM0P~*g)utvmcZ>ad+Y1gOF?g& zD;qPH*1Nh?>TD14{aEjkR|X{l1Y&+@Y=208C5RZuLI>k@?KckK!2N)z!DDHW35R?^ z6npDnqGx4cdVnFoyUN$tfA%!rZqTcZ|5s|>wfh9dqDn&} zBQtdXsS7-0uHf1D0%HewVTUfO7s`Ap_zMDbS3#J9m0dlu;4(Eh;^X1*@$tLy=MDitGe#U)8KJd)jcnC~*st(h@G5njdca(q^hgC1PMcVGFcSm7bQO$-}x9fXca3NG;6uyRUr$_4%s5cDW1 z9Z5z9BsC}#-(NA7y;lJoRvhFzq4_YC;p~h9f~_Gpi+Hu-#tviD*OC~QT`TAl6qo%K zr0X z$S^hpYLG4#2@cW}`)uf7dp{&*X$>x|B+KRhgf_pDouer{j1DFV!90f0Wk@f|U!-GVqKIXYV2EXT z)C3^uk6a5^`7zPd4lTdsSqphS+#kx|?v<-K{VvM_-C{~s__JI#qC{f+Fh9Olt+$le z@>&9b8?s8;ULgk-h}eo?1T9@n+zn^gZggcSA1CWvPvEWEjW|HJQ}cc`kvm&u8m=!) zKisR>Q}EhjH*`|-#fLQ4_X;wM-UOpesESaAtFsTBUk9KER*LU!)jVaQ+A9K4fH-#Y z&LJ9qQ>E0TdBitg=Mpf?|?MLQPAKZ?5ohn~#OvLDG+1 zmBHlBH$c%Y$Yf)E@`rdSO)r`%E;|IjFhzmEViO8}2k*I|S8s)4)w8y!omP8(w9(Di zZ2|i-TI9|c2eLNa^U9atmyZ-P3dE~Mu(^T5Mc%*RBhy(Yp0Be|8sFSsHv33s3+oVb zy`?C-j+09h4?^$6(`(@Q-#zrD~FE&FtN z{|NpSv=H4rIb1=y2iOMh{bIjkPykRRT}CfD*5U^}W+~1Px7*f}YImZhkaVv0zeokQ zw9pVxK%XreXmmDzh={bz^VWSGkh>VzrnleN9QhWKLUmLu;y79>pX5SLq@_QBf(B`) z_}yV^l=g809n}F}u(`wgcC{ z2aSMhK84T2D3FZnNa@GRM2W`rP2ND#p6!1DrZ~Ug=P|zS#Bs_Ml^{Sw{{qcR&=wxl zTC1ZrPDk?UO}wh8pJHC(EOtZo=bI0XVcrOf$z%)F4MYJM{ge+|>lcom)f{A1xFLc2BPn_Bj52!(TGn28Y+k;Xum(tMe7@ zRaq$bt)#rPjfIU^Z7P7rHOAL%Ap;S0Nl$hq=?-fyKZsX;&I=AALR5md55h?DhPY?sR?f}HB;cy!{02|;zi*K1-uC@_&LD?3#og35q# zkUhkX??8O@=Y2RG>*6bkN0sALs#0D8Z!dco5@YuDvSUL+4cuHuFf>4$_Y(le$;pMU zkPRJNf*3WBs!3g8G#3e)t0y-bk)ACpAmvU*4><-4h^uv*-701e7-?w66jDLFf=An! zaiCK)dX5vwJ^)6PF|%kk@avYyDJXCz%I0lcs;Vu6>?$CBFwr_N|=Kkn0**|P&Y(otaCiSnY z%8H-69>vW|7UD?9u4k`PKor%NTuhzf4UnAp()b3}77h@n0?`D$;nkl|81d}hYoDXdUhn_%x&w8=6_5)Ag1=5d3w712nBM#2e>8acs zVIM%(P{F8pd0Oh-5OjOQ-3@U(8yuPC{fnR@Z2Vi6awH?G3D6S6fqawK_#FSvM+NIN z89?hAfJA9&XmD7KB`Y`fQy2z8224xaOPC2r)B|UKO~f|``sCQ8=prCk1PF{8D>rlM z>)n8z=q1z*5a?`ekH9aGQMkYCy1MNBCTc^fGv26aSpeuK^jS1Ne;%~gHdMIo4kl#A z9`BO@fsilqro(Auc?1#C+@Iy5F~8)+nP@7D8;U%g6+zFFTU}Ro1?0TE>@8b>?*cIc zs6GU5H-73Y*pGBevh4pmrfLg|3=ErUIP*Z!2p}Z&jlSj(33{_xjF6w z1REgD1N3%Zgk(GCz+nvXo7AS+UKue|gGe;+V}YATe}`C|+E0J! z-U9uHE!+R(0CnWi#gH%P6LxgJEh=uLv_-0|3he0u{j6F9uwq4ocyvA4Z_TmH^ACgI z*`UWN2ydC;|LgWAq=(n!lkEJf5-UI8R72z)+5J|3#10=h;o;b0^fTkq5Kk4ETt?jC zBhR~a1SoUA3z-7UfT~5GC%FF!3C^o%Q}`;roOK&ZoWcZPTqBVm$+%z%LO!R-xghG~ zd2SWHeB!Q$GK2po-NFBjfMF`!quna$9RNdABxKSApof7V8|$YYj=yF=WI`FDIt@#Y zW@z5@k05{hAHnBQvVf*>4ZU^dJkr;lC1yg>swpc7iIdUzY6z;!uc{jk+2o*bF=i2d z(*7|>C0ZuK21!$Z5&;M|fY}O?DgJ)ZjHXb+B18k%=L=6Nh-m~nF_7E2(iiW`hy`Yqqqlv~uW1!q#~5O4i;p-C z!S(GhdHaX&4g~#z7&eg97a^X7V1?jVonfMrt2GID&AbIlNTm>LoP8=J8 zfz}v5BRF#Cn~CAnCpe3!D5AgoUIZd!^DNx?x=mI}rcxwh>?MeiNe95%-P8K0Q=~-^ z?Fpz6zs??{3i>{QGAGD8s#L^%xzV`2qkn~ha8Xb@w^^#kfXJr=I<=pB$;b=>VMCqG zqBt$T4b*?*d{Qi$MIy^$0nC5kLC|Txq>x~V0ZaNO1Voqd07sXg;Ioq`PF%l>!V=xO z@KGsEt!0=wuhoVv^(trA$uHLlf=L%o6WB3k6)f)RLHZu71!|q4O6NAIvGmU}DgRET z34$hMzlr@zSn%kw)XMtDYTq&;3gf#pnk-m&X!A21dOzNP1u4&pp}JV<3N|)_o2uy) zoA-DS-1tV$mmxotKk4YSxSyL!?(eADvNxi}&O!FyoqSoO7ivbsD! zV}m@x;A?SPublOLl*#So==)!;l@&Zb^NZ62?VXF~m4{1e$7-I*F`U#}OZIV9lYN|` z)h)WTIJ4_`a1cd{bZet$1{laxb^fBIk$o(*Uz9`_$`J0mqd9)nIvNvaW#T&0(bKL# zi)qGzxWWXH4!^N^vF(chLUs5Un`z)n!N`c}*;aKt(0OHG^I3-hhup8@`&a|zHkJ{! z0i^w!$YNcB9gRHATjdBhk?_1B2Z5~4cfX-J{_1C5m!@0@YSr_EWub)1kAyo#Lya7)4~PFld3YvCV%B3qahwGC%fk=p9IY?wg2m z{-QSd`ag|Bg^>iv2yE4)I%Rrcg}`?y?Yxl&k+v_&n?+8t0I=F<^YsN0h9L6D=ZfS# zSR;n#9S+(f+{!;?8jLui$QJ}l$AyEXYy_mzx_R<@*}m0zz!X`$TXP>XKYGLM#)1>3 zMhX)&q`QC9QTal9bD7b9N1Y?q6c_4uvlP*4-`y1Dp8H6a{Ag?b)mmrJJbjXGE93F? zPNO`*VutBf+9-ch(FS*cp_VhCW#7wanC|UK2I?j9)E)UrI5c&)s8v`6@uU%_7vzzb zm7M$5w@^-YLj}8N^irkn-7Ib;GC5LHyPZXF)81XUU6MqMV?`DiOHUaaOxfUVA z<{t$^l#cToeN9&d|E~7Lz>TBL?xW;mohs&~wsvET_vl}=8U*$X^BTVQlM8n*F*m@5 zgJ+<`!M=7jn0bneQ5RkP|iAk&ibLxCz?D{*5!f8RiN>--*P8$);RstB)HHwEpLL%XWFzn0&~str19PIn_={p88|3|ha8xQX zk8LI3F#}Rcu68*7k$4F!gQ2pgM($9+3*v%fC z<;++Jswjhs3mjJHaeo%N#^Z3HAQ)Nx+`VM+5QrRxO%rvR)y};!4j%c!^`(7$q6#~W zT{Ijju1hQ1u=*ux2@^U9YCroPCbDn{=v|<<`&q+8jx&{E#YtMk zk(N~X!$QUo-?DV3%Kh5Y`p&dUd*UKM_NyDgx-`74t)z#B49X~4QFw`9c7`w_kdjP4 zW@8h$MPBjUIhmQCu8g%&8^8YZ9=d({(fadjuHd1v z5+&E)9-9+THxdbv0{xvu@&c?OzQ+2<>2}h`S!^})A4o;n=Z5>k?5ACFl|cae*!c!y zE+4UrpbsedK!_5g-LmE-FL=>q>FWLw;WZHhEvGgri1NKXxNXOLn;Lw85+{zP#PWEFRtO7u_lvQpLfTkjJ z*t4!bTG`qPT(%pB3)E%q6;OtEc_fe{m!QzW!`@;0h-55Lx3$%5^}LmXIhTv#qCFqP z94Y7bw)X%vEM@$*O+mFp^%a{PI6vUT7^jR2`Sy>w?DDhw)LgOV;X^ULk#VH7?{ zr^&SA5hOzx7*Kq@N%#!>T3Ey&5ZHE7#DE%!*0VF5c~rN-jNLBmTz(F!VFp9U+*T~r zaAAlH+wh1T50>|O^o4|Y9?-4={*pZ2<)dIX*nG@11>$7LGJ6KZ4)EFtqP&Nm7)6XE^90ZZaqA=C} zegtt}g}VNg3v=Otm@Gbkc3Ud?*Ud|VLvSQv&rETX?u`#Ttc4p?dJ9Ex0T zPcBPNeT=ShXvc__%PvK1Rq&>)Hw8#E$yV!axQQN8WiwhVVp(>!mQU6i<}m3>T{Cy+5>`4mWd~fqqW-bj9MfTbkB58`-Gp?i)9>)}ja<-gaAzFDjyo+W0Dl zg_+~l$?Zm(8n{i3Q?~0$A2k<0;j64Cc?^{~O=s-ZA!M0dvosxgsfc?1JLny)L)cl> z`XZ)x@YmF2Ut7UBYl3{4L_hy^!K6UhsuS1Mv=09WJzGgxgj}+Q-Xcv%3y=IJBQH(} z-9_o&k*geW0`X*eqhCSXdaYz1x;k4bGH$Qa-BIBm+8dbcG@C5c8FR|rEPbM6ydImj zfrBb9>6SN$dxH+CyE@5qE9H0#Ul5%&lYi?FWnQX#iDu45)k{#4e)5;nDrj_9xM&%@)JokFGn} z5TT%0PY>(Hj)A=c88nVRMQEb7MEfax-B1v93_(7+%OS7H+@yNWVnb1kKzr|E;FE+} zt6X_k6-XRy*63ai1Nld$5zRCMr{=3FQ}xA{DB0y$a&`hHDzdH)bl2u&=ZLKi=Vo+| zgrKkjwfXzsJ11a5JaTYt3HCLWh#ozByBR=RYP|R5hEWnTh2SI^d7VXv*$s%Cy95`* zhehl=-M|1KctK~5w@vKufYrf+>+tCkds8jz?_F0yTlJNdH*Pj1&yU0Y+6cabkk6%A zm)4IuYX2HyTV*`8fHCP|oE(#LmEcEf6Xln!#0V?tLkJ7QDBIz`7}m1tQaYa6ysbC` z+7Gh`L@CFQ=AMHWfh)J3UE-M7YW;AO+fruS&o!mD8E`9+wRK?a*JQ5OZNAIZ_~qug z&h>a)N$r}b-S?hvdkE-$6aQ>JvLZ>j1q;D8i~p2xpHcte&|+v;lf&$>IK5bO*kXA2 zQA5W&f4Zjp`pUziLWk}hy?Ll~1qm}83aKA5X^4M7Gu1grv`=X{CZ!)K0`~wIB@)ION># zm>t{)%?vv*71ul(n;qk}-F3GYCv~46gG5^!2y?(9TZw;*8dq! zqV&K4g4?*K-kz;j=H(H-cAIt@rqXWN$_4gZATi^`C)9u)2q2&#K%Nrb#S~2TAM+88 z(?I+=KV_olJ<&KP-J~;})ypk)%l(3DZtUy% zz#g?3@Fu5S6DdWvCUTe6+H;$hfkzp~eH1y!7_M};TBBuViM~0ry?xwT%?X}Kz|Yq2 zRAG6aIxkCr;?(U`;qv@abQg>qw57Z zgOf+;+aZX}t3?6Ej1-gZTXF7N-+nRmHE#NPKP|=U?Vf!KG?|`}{2JTPGgTwO^nn?X zKpZ1Lnet7@%#1onfnF7c`kkGf-Pm|{Shsq#yZeG5X60?p4tn_m4*?jtzI=u0nHd34 z0EU!<`r%X@(J|$3>Tey)GNoF^0P`o~E{XdE*80u0PkQBDVuTRO=~`uqb5%<4NUz;fdM!#- z|C*p|gNBZ^ShoBoBFk?L7sq7Z)UD5odx*a8WmuP@2w7Pvu_){)f8Ol3~&!e~6!8?&GQC?!E8c$lE{1$8@qB znNGJV_m+De<%8bckR+zasOs<8^ zfKsc^k}zMPQ#!-}3!W%cliydwbj#wE7bgEtb65Tk)&BpFCB~A*wZ_O;vJU7*mn)G4aVO0-Tf=R^UKWR{g`tebKd97 z`@GKUxeeMnIccq9nxs2a5;t`!MhD&%^pm9=PH~b@fc;dbxo3Pe$mz9pj+WW5@Zjl`K(_Vu@@+Hd{UUmE{8DzsC6&{qkp>pBSQFZs z!fdE&n4vdg;KC+jS7D>nk(Y{EIp=`NP3W|#Si@dA28(9mpNKc_IIA#>$b!nhJ6T8{ z)k`x_y+}BYUNU8QL#p^|lXn+y_LpW(dM^w^AKjaB*_Sh))HP-KsWyLM#F;Dpu8OVz1QZ{UtR(9B3H`tz;G?DW(>Y)z{0L=e|C{r zRigPQUnVzB=~DrBGi0#Q#qzJu+OF-aw^U2fw12oYy(N82yYGgHsLYvYS~wo(zc+eV zpn0)y|H~43fJJuaZSp>O=KApp>&1}lC+S#rRkxC!igjOMzdBaPKe#<7N)kPfzh+sZ zUpG;EvOYJuAwAak4oj<>I}(^|o(ZQ;65J@x&dbHSrj{EtVJ&U+#Lsx|`aV>+C=29G zaX8EqfZDm%z-{G{5X%Fv!oYj)K*y0Leae3(y14T}Llq70*;3)YQQngZu7gaDGq?CM z-RsKk+QBnk-RcfbAWW|MQzap!_~7&}G3+}NC00~F+BK#hGv|)sxMI%)Ew{z-i_-MI=hZl-zGabH{l2+6WyHqZK>C{?H??= zG-zi*(M#0reg#LucfsK)4K6%S-KS2`ZE<2pXdG8Xwm?K{p+cCyvr4YAOMQZsOe5ZI zCCv~*#=;&VVWX$gybh_SdQo;%Ht1__Z%3p`8_F6y?UF(7Z0sIzC+A}V_bPGI+rF-c zP1CaaX@weBkH>c3<@{>g*t?}Q(ic*_Kb+Ip&m0@e%?e#qXlul+FDE}<$1bfo+|t&5 z6i=ibBv!UZWvoLGz7q9UV(FvMVn#0pC3&48++|OA+HItT7^{46yltYn^V5H1CLho1 zZqJ9GG$TcAAuH8F4qej~qLyY0vXJtY1f$E02|s95eB*~H2|J44G|<@U`trG2bD$*| zt!SZ1FW{AK_`gDifICAEdkR7bhr{~8b>f&ik-Uo7J@ls4)dh#z#U2GU-AM15Q-^R& zNllNOGTo!)r~j1e98`pnxpeZE8R!F8mE_??kkvf?lqx|RJ;koKID|JTe&K-n)c^62 zIU)a1K@`>5yBSra|G^{er-Abt*)!Liv z(g|1jbcFT(=`!j*jbpdevwrD%(+zziY-VX~;|}GR;;T!Qk*{~k3m?xz7$7Y!SJvc> z)!ay>P4Q`S33N-V6R@HUwen1iM#|=TJsA&pR3wtK7|pDBQ>49jTC#P87<^t|#(FzU zFCf}zn4odo@vD;L(D3xL6?^SoZ`DR&><^A>r`+ZH9PMsLVjVVKk9;2$%=#R1!#D89 zux;vik>-xM=`S7CRqvwX>bI_qv#3CH5BC|n2z1ff zT3UZQK2E3C7eQI41M;XP;kB7%R2V=e4-OnO#9w6mYB48=#E&05z|PYV+QcK4nMM!Z zKlkMWgyHUK{prAQZle0@)d}qNXiqP>L_tHH*M*IYdL%eYsXX5RY`k z#D#aA<8^QZF8@9=J`Dqf!(qQpZD<_~59;IH)w{@i!#ir;2OL{fmo1g|16uC3R49+X z_p8evx>%Y{Vp*aJ@Yj+fZf3aj+XqE4>c9Wzm+DM zY7S6;GJw%10!JeV+M%Y!$=&*UFZK^I9B(lXNz#s(H^$iw^4;RBR=5c|gQS3kbIi2mDa?+1au^?9MflVMYb+Tu9(WXcwY;LmK=$Rq%^B$-E zv0mBxhOv-rXFox!+8mg*kp!0g>D$eVs~W&^Y8JMp#W_VaL`Y@YdW`fb`^i=9m{4lC zM9iMh%}jNyMP<&bBp@KU(vPr+UVjeuHLQ9$r%jH(3;ISR!6D>T$FA_1*bX#+gBM88 zKJMwzgFOa<8eWX>B#qP0i8?vw_EMxn%d_f_YQL zOF(sATdNLQu~mY^fYQ=+a+QgG=*^+z>9@|c^ad*ym=69oL(A0R(NTB2wIln&lrgOl zmtUVNX@65NB%*r1b=CGB&Ur)bFTL_@{@0)HXb3Kn|1o)veRfXrASvpzWRIMMYm-u# z%v2Kne9k%|z-VetW_3|D<0U-G2cgDRx!1T_BH38#&AhG)VIc$h^H|_-n zx`!?D03^ImmzG2|zNNV5$Ox5R^L2G~MZz@#my(dM7xlTu?!Go|Zf>@=)Dou=)cII1 zEqMJ8nH07jc_sgP->eHiqTxoSfK>pDRHnhff*w5Gzo1m_)!t}85B^L71OulUKgY4d z)G1lDM`G@c_f?4jKp-*Hmmju}YLce?hFHZu(ZwPHCgQgRf(BxJV|I|&mTKP8#bTXb7oD6}V02+eo z9rNeCKtuqb1az+PD>!s4@yN)^vWWNt-wa?VxEs4Q8;=@PvA5sV!~@vH@&;$WC+GUF z;&maAeDF=uLc$jT%}@ z5s~A+w2qa|&HHS%sC_S@hI*q{ekh~rfK5mamMwNU@r9n=GrY$ zlWe~?dx3E&Kam4cDOp+S(TR|dkgl%oeS{J}dr18xrdAulk<)ieZC>Cn@YNpzDhicP zdVg!}Z#$WT@D4Dd_D*m}?DwZv>d8xha0ZJUxc%W1yFqh>zFoA0sP(5ghT#fj)lLr) z{;>v!iF#FuDz^N8_eH_Wl`!gF0_7c*%bwI3-1)~{(tf=^3&c3=INId2aX<=>nkX- z(3*I=5`>|}7#P3@h}>XSVYyG^Y)WsB6({C1FpB^KRH+2fu6tvfzqb(C`CyvXPK{W> z_d5bV4X~&JcTMxQ-*XAeElX7D2ypS~;O`bK;W?i?pJY6bK6m!_`Oc9bt%*PYwlA^- zVd4|E|0TI7rA=HEgABmM?(gq!O#E-mG8?SO(0AU~-GX#?HypZ=4yC)hyQE9Hq`T{G{Jr{B`>hL%-n@yjkQ5PA za?v?Thu6Z~ed(WSy;*U8ZgQ@5R4#U`F|(}guA6#kqZt98fFMH5kWUZ|Mi8y% zr)c?Hw=gFzm(!t|l~q|ZDS{sYyPTz1VmyWi#w<-U-X8DE{8V73I$31O9G`duwFbo2zr2Y485jv<&IobrV zT=XGZFz(>^czJQL`M_2;`$0~v9#}y~M+PkPdb`bD}EBAF5kBiJa2DrU0q#%{`Q(0R=%izFTl9NY>TdRl4{+iUT3jTXSo!F zO0rUKz1r0!^uOP*vx(W?-{-R52`A#gxnN^sYkzru@PkEG!?FEN&9PuNOdo4koFv=D zY+l>wTh97AheVGYS`-`{&XakPhJE38n^F8?;dtwto7E0`3Vh=eH0R6Ct3QAK%7q?pLX09kePPmn7^osd1M@#i5QjD#a z$IU0#`!mJvH^+=Er%(#>NMkbS&C5DkTAy7`^}M}bHv6MUxE=ofoyeu6q_kkmk)FWc zzuBE5n)uP`!5wW~#uW3q*e0Q4)Di22s-M6U=z5&>)~|X!3{qvnz{4xT5B~K17YjB7CywZcR=^8ex19CK z@;^~vA*CnitI^{;mX?*tNJt|Fc}7k_FL*MSMbn zbjD{cW@d%rnRChG|KhPBBB@D2T6*;MY;)E9q;-2Z=|VE!S0nwiD>EzWbbo)ocoZ>0 z@%+&Exb;9Z*_WTOx_gIf6)$(YnN!0_gGSxKsH-*KG20(k^Kx%m6ZpSR9TOWH%jbCyObzbL%#6q6_pCm**0!P|q!lKMd8R-ibTqV6 zAO9j&aa1mfa;wp8;j&l@^5L?p+sKQbX9;Y>2$woqHd zP=>C`Sc&zU3Tst6)ewFZjs~jvNIz03)zF2R&kw3mD>4L5gHy!V_~)0OUE3U0B`S28ZZc>H0Yd9P-)-QA-84zu94~u6 z9B}|opZD|U)yb+iuwJ+npf&z2kW(`+2$Tba-N51 z-@ol;@1nfn(sl4bX8(|yL30)FljnLp|5IWOBTsIc6jx^G>#Co?lYJ0G8_S+MSSMso zd6$$#j~sg22WDV!{FW|j4UZHrK@oEESaq}BdSmK#bIfbACg62PucWLTLCkxfpsM3r zs}&vMbK!uVb{<16?)3t!f#=Qg>3VlMFD8)84@ij~A1}to&M2c7&NlmHQ<#nC%Cr$K zHv1yF`(dRyEEiehPrFh1-w}UKMycjakE4?Hdb*lBrH#LPIBC!S^$R3VfuY|{;(0m2 zbJ8+ZZ>?)os?++T^aQ54BXVavv)y)6ELq*u)Ko@h?0kE;KawalJv{2mW)E5AkFY7PUBSY*_5 zg>Zi8MQo2_1f5g*-^r`Z6YnQ`o%6^&I(BKz#3}}<=IdzF#j1#j>LjPX)5d>KY;~^1iOc zGqg#=%Cy*i%sBdFx7R_n6}|QX;Ej)P{%>O^vW0_z6nP=){WTg4hcNek7)8a!mHOp6trZ99JkDK8 z&(9CmJIf=Yzun~M@-{pC{rtew`yH;0A!WAvlkqYnj;U1?TNNc!R;`S2O&fHLpiz9MNEjxigSHWU6Hsxi(r@ZUe*zl**bdvtC z{hNWI_D3fKjC}fqQ`>Pq``N>QbWUf7$k%ib@`4k>2#N`5t;ZDeD^@W{e$$X=5!2-p zvet!{O?2>2yfm$1DTlHTHv211JgLY13820%I^qLD;AaO7f^m0cOU?rLD@ zT?gRc7(hZm@X^SoIhEhM07qXq#C#v-aNM7~%8laxaJhU##N&LG$#i5Yh%&hj0^)AE z@^*BDj$kPhFYcLd3(f7foA6O|)NLxkB;)p6ZU()CiWGD6gdGd4Cckxl2W^?rF~ zY`XVShLHAM3`>)i0jJ&p%eRq^&tpA6eq43kO&{lbu(&;42j)p2N2Bz4 zzqp+5@l+Tg*suYCBOWHEO}p7i?Jdeou_|N9A$2(P5nS-!rF!d!>my(&^Eursd)Ul; z05(~6_`K!JnVy~o;G|yr*92gbL=)iS4>2}3An-&{$!3U90^d3U(yd_ie4&W4_sf%W z2yULq72K$u0xW_mw=uzeckSPhV*`1mnn6P98Z zE+Udyvqcw1{6~B|4B~5k&D{D+q+V+_0|f12sb>Aw))ug*JN@Ck0aOJ5-Q}5{=cflU z7*p{y_67ul&+WFDz{z_co6NMnV3H{XRtMVd?jLBz>WcM?UK@tlNT4&q!!YghErQ>k#?(I%* zNSqEI7mLeBb*iUm=ysD|53pP7w_E~hzTBiBVcaa(vPwMN!~AB1wxyWAhmG(S!gcs< zkDsEjoF2p|Fh1c5-i0WZAj7ze*<$jL8z`I!JtbME8ed_ihX0nWS4bIHh0)h~}1sMjv{=3Hpg>qtN; zBFLkc?)7xvce+HyqF4&BphLh4$clMG-*kRlfbQ27r;5ht(IgdXz=) zvyEORDhbqK%g(z71n6A?kl!yLxJmfzg@fMtssgYYL*^RT5gG1zr(6xBxS{E(@!B)g ztn7WGnhUKanT><)ij!C*-jh6>d}Q@aX9dINzh#`!v6#v9MU$+SJ##-Y&exdi6j@5u zli;0R-LyY$S8HlGwcP58Rm1{?%2_6KC0yd0dVxz{%!bHpr9!0;<1xKa0YbqLTWqWV zuGwARf_=A#pyg40Fcfgc=E0L;gEyMEI?5IXu;*f`OG9p&5Po>|grJA~2&syRi9x7u zlm_C9@Ux4}p9b4#j9cH#OpnU%_6?FED!G!&E?(tG=r7FQr!k~IrTPtrS#|~v=-&zmTL98{0Z@IikRLFXdi6JbxE+KU8&8%Y0A&LpYkX&&P}l2@l3;sC z0S_n(Iy*Z#3FG}me=6JoaF73PD-InU-2!%ct9DLDv(b)H)8Z|DzHspSu~h^Z8+1a| z-Ldp2BAy^w)cDBd^)5*fdjQRetE;QuwseV->f9!82*_1(thg91)mfGVAa6Ws=NTrI zogvTB97QZuBg1)dIQ&NCw;l&;xl2p~NTK5Ug)xrRnwglZ;SZ_yf&5HVyC#Hp-vVT9 zPTHW^iB&_*8)dK>YbW^KhQycM=vSOB^Nw|!#QuX|r-6rrlK|Q!!zmGlnt(6!q3$Mj z=`@qW3_zXrT@OHn-#|d#C{cwD><~pekJ)a45;qzj8*}O-#|mVtB-?<60!ejJvK}D& zR*^n)2Mg7Kb@oA~^Z{a8g%9`lIk4lLzc3Q`JZ?|N`ClFZ!0>W^P;M&7x7pHZ3)HW* z=5xnO*6mL~(TkSwI&TZrCM=R7U?`UTH;%7x_5SMMW=_|;G9)rlz1@qKqR@J^ZQcgR zw7Q;G*aXs0bV7MRHB4O(4PRgcltXe*vxh6KJQUC-KgP|WOz=q%l%UPnOn+wq@a+k> zyLIbTq9UW-w*t7LFgrPu#J?20yie)QD}tJ5!;z?HS|~p|MNjwkR@?dCqhS99&eiw! zQ@^Bd}^@llOychI$IV2hGqvG(N+_xbkP3Agjn^Ho%P z*}NmDI!Ax|ctrO8()^|~Sl8o1`$cf|`tOwU&QK{89l;tXmF1joZ;Ib#GVPC<=@;RR z`)O1j2c)p{6df}z4L#9Ho214AXUD(uu10dxZ)?~8kgE;;gUo2AXkTpJzB`3|Phb;d z=;0_Vj)tyBaXVR7RAfd5de>tfAYbBxfo5BQ*tUy)f^Lq4jEt@<4^;(ho*`!)rCjQS zFM-9LTBB74=wIaCYkr`NkB?8Yb;gb2XhNWfM5+1u^{YeO#Dc)l)6)~WAi7&Rku+`( z5cW{-R__<-=;+K(R$2$7rKNj6S4-4j>}WrH*NdUX zp{!uD{dE^UB|vV-s0MH48-*~`2_IsdZ9}-%=J_Buwnyt9B_$>nWIm`y0!c|pG5zY{ zboPCz+60vc%>zkYIfZo7aQ9N{5bGeT?v}JF{$k5RYfCN0QC#M1lIT0)fz#-hMLxRk zn&+QfHDVY_8@!^vCe?7z>1)$Ynw0P8IM;pBc5Ingiqv5=;#vihRR z_{V`sS?Pz4fnjf##PwitV*amkF6z(8CJrmBT$>^Q@fC36&uHmUytzc6_e=D)UX7mq z=8rZOf>;R*46}t_dx<-A4AJT-J>+M#4h~$-n|FOFe$o}Vb<9pf2I87)j$l8h(6BH! zAms`R3v1V|5oR5|=HHuDZ|}iaN)HU%?_4Cfwk?c3iG`b1C3-_e4v)mrzS|X>H>S+A zw+`UqqBG7L85S$L5}%SyN|Zl2ec_jJ+}C~8JF!vNvnJeL%R9Q>v{A41>INaTmRPCI zmzFV68=BQJ?PgzS_zXU`OTxVT{C0o{^@m4&p7X-WVc=xMJ@fll;%->{b>QAhSxIw3 zJO$%+f;TocUa|Y$RQ`qJZt#RDApnJfNxTO7yfBjRUaR_$7x3ZF^}|moQmZsjEyJQi zLqmMP@dHpnmqN`Pat}2%H5{uRQ+IOjY-#?ng|{bNeOYPlZ@#2%XoD317OK&H7eKNx zx@~Bz_@ltsoB(;^mC_LKA2VsSsSWmPZMmG30#2RvBu1E8jn|a$9*@aK_am4L-}7mu zrAZjSI!X57d}R9{cc~NP+!(T8!DqV>@L03j!%tFSsiK18t_)`z`e_OO-8c8zIoX1| znPXqgY=G(P;R0Ut9~rvwLhyek_ZfTPh+YEF2(U!|p3~1%^wO0jzii*DeBXZG7kzj;NRWj#X(5n|la1j5Ix*EukULix(e;-cq zE(uZoe`a_^2>cPIe*3grZ0xp1?%jS)cAYe3JwHGPUQs99;@U6IBtz0`hlst@b?5GDrkrMa%J}vBl80O~lNJ?@a`IF& zlQwx-JIL%R#x*`tC`}dKBt)*^q{?ennPf2GAxW0h^)kP_l*wfo93Z$O2F91`b zq%>XgeTv=c55U#lTD}tG*h%RSbQ z`~JvQ_lM0RV@_}Criih*%Kf`V_~zV-F> z-IRshlMqp{u{n*WQIu0om+80u`byS*XpA|thxPmE*F4XvYcmr=Mh@)ex=7Z*Wd(v8 z>eR36^$Q{gcc05Uzx_ppEu7=sNG7h?TjH2E@>ucyP;QT|WIT~0nw_2fRZx#$*GEzk z*l-)YkV-P$*VtH>j)v6WY=JC~K?S~FKWf%ld^osUbKLxl0Q^BjRByEVsZzW>3<6%f z1?;KtQQkg@1hJU*^&hgb5=M57 zWA+#$HcFTaf+vH(ex6bku>h-)*(|=LD-Fx-C!|D+t!q^rt8UuHtF}l<29Ujmv)d}j zLAxIHMbWxW5N)I>Uj3?vE~DmzkMf0gccEbikG)dNV>6C5ADi#*ID4xxw`2o{`E(UX zX{t%(mCRi2i|#Yz)Qh@$RCv5e;iCPcr_Wz{>28X_E*BS6MkWi2G3O?RSh8?ZswNyH zo8jaM9Ji2MC)F*inZ1KC{0sT<%sCuhqK}^JDrXKggd2`I6?c$xpT+6#GAk@G%<(TC zB^x#?G%q+6M^VMdnUQODnGuQbC-if3i?^R~J?aw?#deP4FCyOP`qpOI-qTNCYGh69 z-+5cX*xmtipaFzWHY95cn@&Z5ZEPJhA|xa%ys+`1lUr}}2fHg0UH$x{K)_+#UD99l z4UJ;n_DKzWZea-?@BMuOq|2*hCjVqrCGGMF&4|S6zRg;$8E3dJK_%c38utFU9(tFS{oA8ki96_w=zQayT|10^^hOIry{2>bel+Z+#}awgLrrV8uY zZ5uOOGxRq%SG}s?m`4ha!)0?jD$c2??Uw<>loZ6pZcIYg?UG?72FJ}9qvsAK8|mMR zN;mMggcONGV|k=u{Q~=3DHQ6shkdlZ1_rq;rQFN(olxTfV_BUy&U-fPZp5DwcjB$5 zDk{^aC;Y_h*@pkW10qME5D464%e0t|j*ipQ)A)F-O11D_dum8~`^$8pqU~po3EYU@ zSviw!?iCiK(GXb%tsaF{AEt2-Z{}75jn9GhEQt?&e8+k8K$sbNe#1=3pC1F*K$2Lb@(WCBwDU%W4&nuU16{%V zCW$E5AMoT`M@ zxoP>J?YB$AYO};Y_fphEe@8M~>FB!|SJ|yG|Jy2|vHaL%;>K#p^vu&Q4NV17LMtQ$ zVL%2FAOm(|zZH#R{6w;%!Ly5wSCs4BIg(Ui4EPCWTXLG8u~I9x$q_;OkgzQ|Rn!xbbiUU=k4RbHapwf8WJB?i5c$6(38!60aU zdAZ=x6Qu7>=!c+ZpW{J^Pk-_FCBKC#NvN{I%pwsknz=gehrP*s0u-Ek23bW0D@6Icil~1QG zSpLb>$|4-tB`=xwqh0Zfjl<(Nut$5*DYy5T4&|JRC$9O)yO<36jaBr}p_}CKh!%Mj z4URDL=&PCYF8qrRZmAVJYYBm}q60R`ru90=H5~9?(!dIOYfUA3?5H9GD;Z+IqK|2{ zyrLKpkXN>410Jp*DNE`o4g~gUD{e6e0_e1;2{jt6XT^ONU<2lqM6k9Sd$&)>*ECM~ zQWaHYWo#TAvsw*`jBZgsKR*x%1Tdh(Nyp$22>eX#4eXbD`rkW=$#c6Z{OAnr-;}H} z1JfW%GYe=ZCnzz`6-8)`4PbARp!-CDK^SotnFIpZ+(6a4FmWqdNydVsY5{xy^1m?> z3%J8b73U@0O~w789(8v93R3144bR8T5_B}x62tTp?zC2TR6m?T+^v_yL9cFp>v@I40kyzlX7@v9{1Vid`gvy zac{{wrnwa?f!YfUx<@tHUS`*6lC;}7OGTFbi$2lq%;ro}I>fBCO^&pxUBEe}M96rFY{|B3Izz+<>TxvE$FFNkW`h-0G7~IubVSFScW0T- zF5KocgV{7OZ2Us3WH0D8f%tT^`O_u|npV+3V}>_-64hik`|F|cKG`yZq3CZm`k+Jl zb~1s-(J-jEUOp?SJ>|9>Bl!#4J1e^8N%0y|?ec<(cUmeo5#=t|F<)#87mRA7=H=dT zEtNA%4l}F@a`uJ(p0=PXE`3X<_ro!7zl~`j%Q#RpG9&gGQag7adc#xH|CgQPmE98|tt??QWY*RMt zAf(J>PGP+p0EddQdNea*a_nP){l^}Cnu(3=3XsN50EQ3HT|7KJmo6>WjvEnZQ=+4p z^g4WiDg`S6sA@0kNaW92AOJx-@`LTb!p--xqJrr!!mK=P!f*7%0Xy0JS}ltFo=3Hs z$JV`~qF)n{gI)M|a8Ud^Q9E-wyHv+~9PPipANFRqEW&qhlThxEV;rgA!R7{Jj_lgk z4~K_9Zi0vFxIwm7h1)A~AG*kLI5%({dbqOe^8dI<`P}ZZrFmP#OlxgYiM{E5RFNFT z&JDErLE9f9p(a`%@Tl1@HM=|8fx)MlC)(@h6t7Om!LWZ6;kz_kMnoPUIY3MQlA7ni zr9(r@Mqc71J>smiIRf@GMZpbSntOy>8a3FwdW-R5X`Jv;GoQ;9$kn&d+&Jc=bwRpw zILm+Of?S9O%eRl!OK60cz7gOvIL*oDaP{su%Q&JV!0dO^T9jFzE^9bNkT|nQ5|c{634n_4zd zBh1HjLPiCv8fA7A`ell;Mh>O>qai;#@*DZ6dF|(S(+nEV5_yE*R8+dlacc9SC@*ye zXvj@i1}W#Fu-7-=rhcd`yi6pOym9?e|Enk?h146QFl&;nqSJXb+mTpCNUr4}G>#;g zdZ}50{g}RFFoL2Kt`*R5Xge;7mdI|s^5?a7&~E0t`C|{L*}bAPnR9RryCC=L!@Y%S zDxoMXu&ktH=OaJ~tINrCnAEcaQL>fm`EU(@QW3le2;^Y$C$f;)Qbe;2^msGEXXl}K znq544sEgCHv(U&$l|rSY5m7WIG&gj|+wDFv{m|_dCK>|9D(N9djerxgw##75wR-|V zhvsP)0n4Vv;5mfoU!|=qBKHd*6v#%E-7wG8Oo(g$kBq2ZB!rF-qbQMqa(v21eYTs! z@M4Gs&RkXpzv3;F{K&L0ch6$ro?F0-&IKDazxuRCW5wsGHy?g9=;jyIWVAy@92y4l zo<_k{$_6c;1U7bUVy;;(h{NL>S5`y$3%YewzJ1ssDffFvnU{XWv*CcNKfpN$mtQC)^lV=lW@3oF!8|5P zN_Z0>Ik%%^*u9p%T@NSudn|C~N|%ALg-c+gr5aie!EC!lyc_T|J@c<+Ksr8)0TQIk z>Du?HU!IR={eXTxb>P})jr_+39YzKw9ngM+K%XhrqsR0$WGQoZ1f3KYz4v02duaY^o5Oy-zsi6VGbv!08AaDY15A zqG{6_jSqaL>$xpjIvL&H>exno14`B1-^ez5 z+AxAQw7L@m(xc`0!wl@?(JZ)voZ@n}L>RuNPe)-wTA1WDOt`k!5GLFY6*UW@E1B6| zpdS#0=B+0_+NjjtfgRA}qWDwZ9t#xU^(AxZr znzz=xAR~ViM&G!;FjOT8jcvY$^cKBV*HuTCkyN zHUhOt+~(-FGH?~Cc9crQvf`N4R90tZSWG*QFaz(5XvcY6P^v!#uuJGIn-n)Gq!p1F z2x?k7OuwHlt2p_$&tGBN%GqTaA&;O+7INYk}Rs9ntLM#>!% z18kC!p>9gHcbjIq6YWhBPL(MHS=<_Um8s77T2H#4m~S5PknLk+am~sJ`%~bDX<4Ve z>*OH3$MFQ{2IH%ua^pZ1u#)jhDA|Mty?NOBU3^}MSy=G_&)A@UTBn^_Voukhty)>1&^i53?HfCH!P3%eaiG{&**6+|ZOR}>| z#>4}NzWy069FKj+8@tdWu->hO^!4lJeZVXmc1UfTEN#=6Y?_W72dGhmN#!qLzTdS# zsZBDgPQb1AfN0aeM6P)2lxQM@CLHcUt2;;gpZNkMTKIQ(Om3Hd!@_nTGb%kOxPm<* z2iXR%3-C)imD_Q@#%zYxB>sjo!xe)RNSz^R85fN=WgrXEvQ-Rf#6|faEtnHo-0#-!qD8n% z41!0f@u)<4?Bb_gILoi=&SJeFT%m6f+(T}nM22j7Jp?TMY&=^1+(8cILzi75ft%XJ zf3m16@By4M`3$|G}muYAl@AS|w$u z*3;}H;X+6$v?I66rkQ(=BWP=e8k0A->^Qa}pcE;M4x}-Y?H&2Z@}{DU<5$6N1Wig0 zy*_XmA!Pus-gaRytu<0S!t+>ql1iWtQC;z4QM*0Wak-u-S>n;6W{P?NakuS`$J)>+iQ* z>vDG(^k<((xM4R!c?;CDJ-odSl1ilizS`DW3?WqkT!Be|=}<&%J5B?eLkmW~5>VNJ zBx1Q#H+eSVWH8FA$F9uDfhg`qT_a;sK78E$U38wGIu%C#@aS+Gcz$vZpvoQ}IUtji4yR#r_qfOvgoBS|j4Wx~6zM59jwF)oX z(E5i>hZ$f6=mRW6qCdMC4lbJ(BZlSYZZXOzG_8E{1$!{DphmorGNhUL_Hc3#c6_n9 zi1Wh_Iv6zK{AXKG{;j6e2}%M8`R6hwb&7+4iJcNO{8fL`#sgt+DB}62T{Uc_Q0&{$ zp)Pp8h99fM^nuZp&HQ>Ic8Jq3N1?8SdL5BfOa7Emq65T;3C~S+x21zck@n|d=KI|W z!z7XM_B;{tpYdp)s6V|(crhH%t4EgwD}2WP*ezp?8cRPqO|bvti*pOb(Uj?^dZ;JS()4RlGI~~^=a7#y+@^nn6{6R;|gN*?c4dVj?b<(4BopSz|NA^E&9fYa`tVz z$Hz75io{+B?xx;t4&!?fx7smUy7~f#KL_(tX8YQ!kihf;2b`^;VFnG)*6KKtx3b0c zRp^Lsx_pa`c9;I3=X^2WhZHsXzE`VZW94*~|F)&`gg7kNWKQO&VzqL$0+UlEW-S`f zx0-Rm22{=}Mz$xD0$f8#$e0K|+PMN>Lm~=@hQy^S7{F8LEt+4|QY`&`RM=&~mJq6# zSVVTK#@oAhau<*d8&A)2=wTWS4$&82^Kipyz)1&dH(U9cQ4@)-|CY1x&0bNrEa}_t zC|YmAo?XA$D1a_zfev0PNj;#Op9q={tVSbL@=CzYe}@?l1s~Y7a2R>ddW6NGetdrI zY2k-a!AJLaiJH_l)`w4$2@h~;y@R#(C(9-TRn>!V4W|q5*X&I{O#5DKp!FCJ0$Wo& zl5lUO^&w9(4(*Hj(Dl(0|LvMTgJxZg3Z9uS0k}&nc`D;;8&UG`q%z*TyhSLsiD?!dzlW=yS}0{|V~cP<`#bds$t!F} zM`);t5+L$5(uZe6(I|saN%#PNYH1<~IvxqhD&TakJFv6q7M1%@qx1FaI|3Pq-V0DV zqkdq{%gbvlU*2>HguKCOvs&hE7-)3dB7}j34GanbREz~4U7IDbEoF87j8yLjm%;n$ zN8+J9JO(GNKlVh>*rS->gW~-k?oh9{j)6D;#@9%Py-DNg0{N94klx#2{dcTl|X?yW|oB z(PO;r82!OUM@{|L&rN*(9`KFgAO(7;zgSl+5IB6aikE~;5CFo;O1EfJNUuR*L4i+5 z&EC%zcQ90miaFpm1Lq?nA)zVWP1kku;=UEjt^9qKYNd14q)er=1$x7yK$`$KM*}s} z+^OmOOL6eDoV z#^8SnPUAFSDyjvn+-3_QC>21GTG?a;>?UfV~`bg8H;4EzKt)NJTd*C>PA zAC?caj4pJ4tsR(CeeU?EI1s_UuE95MUh#piw7j8E$GP3GssEREedot*Ks5VL47P+& zTixfRTI;x8_^0w+&0RGG@6%=4e;uEH zr%hm?b4lx5|6jk#Vxn7aVO?HcSzfqway@=ge!^0#yR)60 z-51Q{)dt(wO%)avMvrsykoDT>lMl*ZwLc?rrdU3sNKIU^ojc?2Ti99kTF6Vi1yn^9-Ugi;7td{}$UWH9Z1^X39Rh<|jXVVHxO9 zd3kvV4nyphpK2+q;jc^2XV+9=)L<;Dmw>;0RYB=9O zx9{9^DC9owzdH|?>_4Hr8F#y`z5&8Yk*?5icTNFpS77J z+r9D|!Jd}YCP6Tv;x7`#FS)3a``GxrcebZ5=4t^6^qeR}iG^ zOu&|JWKx#KZOF%{klz7BIp|(FN+eX=U$8z868}A{;dA}EqJEX<7tCR9aynW3H4j-)JIjGz@Lk6BFd_Wf zd86e;<+bb`9T{m^E+D7}h0g@VoN2o5@6$mc!_fc50m{EP&~Ca6PX|dLzI(TY`$GV! z2D%1M-OqJ?Bn+F*hRI{1G`L{;{6GEGG=P31uCZ<1LjL-5=PW`^GE?`C{I4VWWwD|! z00mXkrYU6$8})tTIgCII5xPF<6XF1v-8m)hMj(2t>BMux)9*S%d zJ*Oe3sDuriD^MXXiK2?Igsh3#A#~~J6reLw4TbWJ2Z}&b+GK<0v69P4N!?sH#Y4Hc zWXu+Cpp<>-lfL%flnDcIGLs7eP9!AT9RL@f$g1+=GprV~8rZ7;TF*e+DVb+!{_dyj~WE+_Xn{HY&T^a_raZ>g3p3i&u0!Km~+LJ$yTgOP9rurM7 z+74jZeR>Ds8wt2?-Tm8L#^k+DDiVPLl6Tkqy!h58vK9AlBb2R}m?drFP_Q$)3o5%- zVxdWK>1bh_VT(gYEL83Sp!5{#mHc+4gRjL1$M|S`wm)T(4Y&Jb^PIx}XsVg!dH6nf zoGLwRX7=>?E1S~C_At$CfVTBVuS&ys#+J2@R9?ZOUinzcHOxg8G7R%y;FfB^xG%JO z^T)l@q5hEu>~#acW-KcDYEckpv1Xs`;wUIPPdjk{9qoa|dF ztH)Gcv>IndH5=Y>@j!v-{wnvLc{$dtgT2pyBnOmEXnI15!znO_%0GxB{q=v@BD4?sU}kV$%wrHDEL z>TWxSFar$>?%cF@liY(txIuoJJ;Ym7UVo2?>ZDUby~xnho_AL)Iy~8vK^tb>X)I=l z%5aOb3EuCg^;hL11w3_|UKPQm;bY{)9D|$tFkz?jR(hKl^T!@rce>xEQLtQAKVYOx z2q)EvQf-^@7y!|cM7oM8-9Dx;vUhbBS9h0DY_o#CgwMuxeK~tl*tK@vuD=uo!y47c`{Ihb$!*d4j zpc;u;$~Uad5JH6H${E1Jos43!bNSpLpZcZz96K9D9Y>}g5*Lrp`@)EP1klWsFgF&o z!e~kGxSJpV-OdXFE1UX!-!IyPV4$w7JhNvFEuM~Uus{YhaB6Q2b1gdoo-{2DjiG%X zSH2nZ(-ugUd~94?HhS5Yw--J}S%VddobXbJ2nZn&5z2*16_^O(HPEI=O98$!dQ1Ru zu`T6{tCdS$^Jjzn{=2k%;Gh%0NC7fG9U!$TGusVI*JT$&tWdBvWAPi+MR$lV*yirT zpzD&zoRhjJ@W@+MbTQhR3FrQ=BSu_C?ljZf)@N@ZqZ&!_iSv5 zKHXzlInJZwIBKe2vpLrL(KbRa&2+vAG-8c2r*%Z$W)*JpN5#q+$mV5ul#gbvg4&+Y zWdr=$1?ca_U0J_m*pwhO4zs+gzYDEo+{&OX@vr?%l8=^{j0`Z7ql3+KB2DU(pA#<# z31_GI@M*jOKZKIoP(HhzY+x~@gZLN8tTqqrT)%uhHWkWEz!!i*!c5S}A_B6uH35~M z7%82TZf|MZ#@|+Kn(+^j?25>Ga!mt zrRTJz{;D`DBw+tlQe<&Y=a6YvXxPW5vcGWNgE|Q`#RbRPF56G~RS`L6SRwYd{_VF& zW!?S+YxjGgQDO8d2g?iR)wKjzK#hs|zF!3y{VkHVYKcMa1kd7AX^dlMF63EujZKMc z4)E3kT?-C;63Ui!&Y7uELx(DOmCesmH5{-KYp!LygiKxa`Nb<~MMLKMb-uVco-#OR zGis@Z4IE0>J4&@pu~t)PNi0^)2w+a}2>h8s#e6^pxY?UB=?+4%yvebw*M_l0`ou>@ zmTf*)2K4T2DH4(Pl&Mu3{LT_=b-NOJ^1k1rYSbFrZ47h=`{DQX^jsb-;f~J#luBx7 z;7mU*iF)q>Gu|9BXrxhP6q-vC;0(BT1UQ40Xans5hkuqGz=TD=1G=kSFLpk>gL}L> zJ3G6&5)CWv^qIAb3D0Tb5zYfBB(xVbq_Rfzc{i?m(f5VY4O-70m9wszZ++2l`$IY# zCYN)WHoBU06^{Ww2|oWBCIHBkwO~dWD%b2DHyiH|W(NAW=S7W6O9$jK{zI*kmp@Uj4atKwgRl`TL zU4$6t)So#dLlICisf)@^ek4a_wJG19fc=PIE$N!A@|d1|#@HJCaKKQAE_Qw!y`f)B zJhoNv=)MfGQ$UK!@yU@E2Jb#>0{*Fb7|BR8Gg}8BVYG3pyXNh!z$m#z2Ri_~eP{?l>tx>izR^+uihikvU0tv}1ZIDvuEjse|fWgl}v*bDJW}tp$UB zwU8`;h&lVBFfPjRX)O3zWJLj=$t+Ow1C0gbV&S(yn{5;!m!GwlmS5Z5PHJIcp@)G4Bbi{9!}V#%CkD>6kypS za(?)mO|i9YtV>6A5Kc|6V1s%cS&${F?2y5cnQ5fER&=a3sLmD`%I!?@p>j8J4ew(1 zg7bt*cJ@K3y=;J>7{6m;_Kmnu1QsWqNx;BubnXuktu#8vs<_&Z!R6`X2HjwU-5|)C zT9?AG)e~L6w`PiBU0RJzOfS`?>V3%b7n;rlUOzg}*=_nZlMjG_tD{tM@NFOHSlz@E zSMCp*K%J%&DuuRy#+^{kX`sqQ2cyT&U(V1*DTjnBi9Yig4eal}jg?9#UALBQd~+Ly zo2ROOcE?HiZpX;>LKSapVx}zz+H9)AvG*omD6;v|$wI|;&eU69;lYup2E9au7GZlM)O9D?VJ4`APiCEZgFk` z^0gmDD~~YBhmASXkYV&2EhB*W0s8%x^z#ATfxJl18F^q|4Cjo(wn$&Es&tEcr z6)NuA7^gYsli&`c@3V)RTOr1JG@p-vnL&*Uq8O3NNPVG+MyFsq>tu&q2!!4r5{})t z4r1rwVBfB#DdO=I#k^KZ1B0>xA*9g&;BI3Sxz|eD*u%4OqyOUN9pd0=#kLE|4Y&y& zRO9|7PHr^bPjg-PRg}V#&PlBQ3MBV8rQx#+6;O{@#1`@fod%cv~3sQp(Fkd}Tx zKuSeE1 zYz9GZ%v#=8Gill?&3%2N|nDCTLai7+OJJ z1VyVQMdT2R&GjK6>E}jxdo&MCtu=}Ac~=+wYtWFa%1cqHDb;qE1`eZ{O&4iia2}iH za=emOAVAiBDH+l*cR*;{x@*^Dy4Xt_GaCNjE&Hfu&FxUDUjZr_0R^6I)OoAh*pxR| z_Gj~(J2Gn&*eKRlgb)RfHAc3vy{(v=4tCX&+N~Mo7@VsFKTp& zn{kP4r-wS^`e8(0;{are+L4~q$C#Klwkk$|_Beu50JsO$XOKF>CglW>OI3P$dTA-H z+930m0kp;q3=Q?~acUfyL$AwR|G~WuxP}I5MVhOd1fg&lg@wOmWg(BYB?=1*o9b3* z_7SH{SH^~9nVFZI5O{L3QAWmOQ)QuF_V4tyhpZ$NALE@Qm*__nyv;nTfCUI|8&6AV zwY|VINmt2<2O*j}{V*Rd6hDA_HeWsYQwQrekshJMFEyPem=$Pei*?-^guMk{ol;Xy z<^9gz)~YHx-CUN)GL8k;pb$Y%LspEO00E2Eio6#KkE=znw9X)Tj{=juXG{6Z3&+cI z7adeFZg*){zW=N=P!^?^)rfxG2HQ(pN*vg?S zCJe>vvvjLNm+i*B`7tlh0ULXUN)=Z8!`J_OnZfUfPl@Nv?o7?mQ1*)yg}G&yIf)6KPk6Fvda&)ieS3o$*aC#Ur1$O#1JkKGNHS9) zPZ{o!qKwQ;NNKi%&(t4v>$@=u8jnaZtKudz8vh;1PGnlU+JR*(?Sgf?J&f4P+Ss1i z&zzp@Ond#f8(dPMD{g}AXx=<&U=^r+HAC^Mn>;o zRFGZSJ%kR9xbtEtPYzLwp zP`JJcxSLb4nRSy47Hk{u_|Ov}X5mkbaLfmHzm+U^c|Z}{H}kLZ?26U>2M(;E`zLw% zuuhQK6)4c3-Wz>5Y1`qMP<>IGbl#T6G9>mSvMpt@OpFA}DNvlGJdq4F+HZD)8Mf_j z7WFFwEBN9m6rYJ4y{N)$_}cIn{j^LIs8+O6m6-oVf*xC=GNRq);#`> zkdKyHn7t8`s8%sJTJYbmz-=YP%uDhc6YH(ZJS^Z>ej!x9yiZ2ez&y6JJ^95^KpR4h z5T>cy`xfHj%(1KuH`P1`@m<464z3aj-EM zB(p6EAx1&n<%UycSV*&mj*x%k7USy;9dGK&*Ik8X5gBobnWAW`B(vPzd2+$8fJ z`s%1na75YR`u<}hkB0yLz?;zoduQj`3~>$o|b0&D@rW0!}{8I<=18Y*Kb?q0UIy1FO+ zd2hoYD3C1toPWNh?7sMwL!rS)4*o?RJ>rYnZ9yYJF~JtE-&nrYg|;mcHYsP|7mOg` z$SD7~cUvO5dHkBa;dZ$4Ja(w|YjMbeqAL`kkg{yYdLdc}q1dZ<4nrHCKE;{u;Mp8_9d~YIr(#eHANKOn{eV;-N3VCzU zC|lN^?ryNThcJH*(xb2(4c>bzMV`+wed0J%@PeAs@nlAD1;~GjqCI_EM>;Ua0j(9kZTxAiP^MHW>kFzw;T)FYhj6Xv-Ur-1jAhJ9!xUVo`94UtZ#&Hy)5ubr zO_rB;XZA;C^~FcR=4bPakvy>aRS8Vsb@yfnrfzdL1)SRvJhR>Hbp0Da#p*soR(F?x z;0TV^f>MDCf>%IsxCbaT)t>o7Yi&)yeq3FXG$2v#P)kU{V>tnA8h4Hp=N5@rW{n|m z0QdF+=8D5N%YMC|%c+9yp@@)>5Es{1iE%VEOiau>ch(VFa~*eyh)|Sli2&e*%WgJw zzr=jLGN7hY=+o!NQufx0MD0~Md8yWJH~f+^R;wj-C%70vEy{3&JK{TVL-3x0Le)Wx zw+6*waOae!S`v$?HsWTG61a&Se=VW;H$wx1R<>rU%YP{#1Tu$!rdZOXIJg%=9J1O$ z=?&MLZzjBG0sC5U&m0VrQx7S|dmH_Q4oM9UI{kiqUuP|B>Z9tVEyi2VU-{nOBB$jV zxUE&b{O8-BuU!@M{_tLi!1rvU&kxv^Yjyp{C-ETB-_4ZldQY~5X|}q-Rt6zM9k2qy z^0N=61T|fYSO#p7NjT z%d$5|u}BbiI5|0Kg%D*Mk|1W$^pl2dHd@!|*>}*|y}+?62cRGD-(ClOS-pY+$XJnZ zTPFn<{vL0<>wb10U%16$p9XPL>=V0yz+F~5QGw>MG(l(Ug2xRP^GH_@i+HRFd-9ff zuTzU?&>m7RQjK~y?Cn(SSn~`an*J19&RY`oeUZBNDG2BWXiK@MbxO-tE^#4xQlzA$ zp#O=6E9738-!Bxr&&+HIRbPKu_qEEW2Kv2SSM@VQ4OjIJjZV084O(V;x*p^!LI1SD z%S9zaEFI(bvMb$$mJtUB$JTg>vnMIewW6-_pQ7F`@pja_ud7P~$S2Cs{BE8^LAv_x zp{`DX|3D@&`s2rpQS<4a&L82e2dVn}tE^|SHh=dD2@aNz0w)GEp=8p8J^PdS3sj4y z$_%C4+}yxdz}QzJeJvU@{iAmT-PZE+Nt~oezkB0R78ShpE9!rx_=tZlu#i7Nucs>`V zp_Ui-3=5w>=@{S4%9i2V+?nNGdXu_&$p`MA(UwbVEZ4E$A9`$-rCnr}(j8f*rR%&r z>c8u+IOn!#Ak?%LnUGKe#0h{|bhNhz1O|4rw%&&iI=bwf9O?V`&)(1OdWx7ofmf^k zKt?K}My1YJ9U^mtqDDc=*}UcT*?H@k(gX_#^yOWIUP&@vQwNUjS_WL65LJzD-Lrjp zXXOIycyrwSWU%2)OiXNVTau&dl3)Kw zivQw)TYv$)0P+NgM%F=SEx>I9cQ{B59`B1}v_0Q_o%yKi_&#+$k7wGyZB6W!H^xkh zX<1J42d`H~l=$C5qarN^ftY1PQHOB;;{*SlUdVH#0}xaYAKC&6M~lPrp> z?bE*5&d4vE8A5})<=Q$?mY-q{pLqN-8_^`QlkV-{s)*S*#c_HKx_x4*s*0^_9Co5w=i_liQ>Eo!r4?I@v8k#k1 zdw#3%q4{ZocB@g@fXsDV_tGYJyN$06r< z*WXRLMg%@9TMSV+yp?a?wY#~!`RmIFTe}VD@nDqj9c%{QGxwiA7*T!R?vo&Gu4k;W zwKGtn#aZExKdJv6hQ7q<|9|WY;P(QZ%F5OmHTCA=_jx$d2`Gt)iRH+p2|Mr3w6;F& z)r&OdZ=(P5y02N`K%(m25NFQ?Ub)hnL6#dJ!!@R-f5YDcv z4eFcwP@E^R8|kqt?E7gWTr$kR?xX5P;qQ;A$_NN8JDvBh#1?Nh!-B}%@DN*VV*@RtMVK5uq~n4 zS;a(V0qM`aU(4aD0;#$drkm4mL$o$%Q=M}0gKdVHR`j2pZzOw+F#+nM1A;ZKg3&jxFXPJbevMs z_%vEi(XFEH+M0rrkL6f72qqLm|2pzO^qhP7grUSm-AmXxpjd;QerD*=mYC1C%UnZe zQh!I2p-+;@f7Ixi>gd-DWtg3kqfXVoYN__e#YS6I3#pgWPuobwfx!eKx7T1>AlAYX zEuF0xl8xPVL33?4VT_SJUyZZn9{Q24S^!2Jg)697kTr#uX>6t?05@W1Z$B6+_6hgM zBYzy)+8jxJWW3gXl6=~Jeazamgq1#8DYAiWAg+--S5&-ayit=64i1{iyF7PssV-UGd*%?j1e#MOUbzk?AHvLZVVCfwh_dT2AD&%W@W*-l z`)7}8vU)o!)bnRtl+srw)mM{-l?OUH-|XYv(af2p$#XT#-)vKFYZ3h@YkxSAt{hUN ze}I0WO+AEICVaSliMxS#@%5z^xLBYecTxF`dDO%qR^^8JU!jH|_Gq!={=ax?DVP)EgCk;UZOfoL)<8j;7+qCH)ImEqy7EqzzOQh%d#5c+{0&E8RZzYXde{ zZBt;p`DoXJOg>0L{i}J1)+x@=*|K1NR*SgR-?)ORvHQ;@)=B0ktqW=a`v^4+Ii+C8 zcWE!u`WBV9RejD&ceooEcf;d`PEtnmdXtJA`qE*G6#`->!1S^QGY8mf$3d?J>u4?N z-?26;L{o*WlM_$I5HwDJPpKnZQFhQ7Nee~t?&O#Cw>NJAV6g@0i7)7*v{&jLKwrI8 z8ra<+s$`HV5VZaPg78yM;b}~;3dFz60lRt2gJkKOX|V44n?EGPAfaPK;NvfCU+G!= z`Te^$p5qp!v~Gnya!4H!J#y)*_7|@yiV6#=>`(C|(W!~Ovu$bwSKA>l z>HTa8H9K}}LeiSKiB51$w7m3Bw}Mz@wT7a7c1e5<+V;l8mwLFwG0X(a$|D_1k-wG~1joVgAz}=&a_$UH?wERWk+^9R7)|ej`o>~&B zC2f)ESw={9$q{mSpL$l6FN{$!R6;{kmzCu$4fC^t=3PBhcC4=?V`ni;TJ>BlHwwhZ zY-Nfh2SlFvM_v9>9$g*`-ZrrAqf|p^bI2l-+EJVoUfiSI8feRs0`?p*Q?!xKO8Gqh90MxR6`YaGRijV`!^#wZ zO*RIlWrXmbpQCEJZKIrNgA;s!Q`S;m4!(N?x8d$!=52?pEI&+SYbaG0GA`cT5r#-x z{CuhYtr?uf^4i3@r9*tsbxp&e1yl0}`Q3?4GM_C{_l5&rV4w{f6<7kaYwV1HJ`ToM zttu-P#Pi`X?RB=@9rioz95S<`-)P3z%H@ooe)wyxawN`*Ho+#N_)So}sN~C@!rc-Q z7VwPR>=B4pbN77vyY0Dj>m%m1Saq9*IXdcr6P@SQ@6Vp;?1Z+&RG~_Y6zVmLfVN6hY&=MP{6+^%a zxwM%aJF>wuZQbXVs0znp;hQ`Bltj#0F8G;jm68TiI!1gdTerS*O@(o zfTrKZR)ZCnOUnLux093%0;Yw?=v#JE6Vug`b=sm0_Vb(Te6yeVlxYc-l})kWFkx1W^?!wDHJsh&=L$lm95QfrXY+f8jj>7XKI z$h#PaxwDpgoY^7&rVw;0Z3_(zh31fK>f@R)FS1b~1X$Frpmh`?Utv0!Q8njgG5^ie zqutCeAi!yBj0FThT_;Qsk}5}FY5<(`IGK>Hp=VH;r@L7WlELBx=@-yw_t3W~q;Csu^t;EnzcrNs%faoVmw|`ofe+%)F1xiq=y2bb=8{}#EFyf*Y_U*| z)bx-V$Le3fzkRT8d8O*44K~k5n0@>4TjzB9H%3S|hH*BmDIWw+t3?(Uy$h)aCrNqr z8Phhzf#J~eV~zceIv#;=0Nb`vGFn|rjrjC8L2Wu#3n#phv-TStV`;Wo_=>)3MRt$5 z2v07!(rt>GaUtYvoc3$I_I1yoU8B|N%D1~15Yn5(TLPv4gR*$Y z=!8Z@>`jzqihWv$Yq&8`*SXI<)3#$4di0rdSllmz9(sgRL=e9~hIyhp>m;kUHf5H z!i&56ME*NVP7Z(*U{OEZ>3&q#8AM-mQ!AeGf#%1iy3Pju&()p5FK^wyk?#PPxcH5F zs+kKH$nG2_joVc@PEZh_jw>zEPTen7P*s<2P+N}qfG=E9cCgMZfg9qg zDS(l35&_tzvmkjo;mk6;c31JYd|yhf_q&@d+R@U275E}{W8QazJd&R@7r?ukzT5t! ztC}Ty)Wmx-vB}b#;od8vQc*Ev+ZyPr0=n}2787n>k!7#+f6AE3qwR*iFQ(hf^no3Qp!=YmY zF&p_{VpZGPkQ?{Ko?@Zi$`5qS+PC2KA*}9%7Vht%Srlq%cG;kxoou{3!O|?wfzR9p zw2bP$O0r9me4MgmwDBE?BZMb#wupUKEhR3*h$sQC6va?N_|@+N8g&BO3lB(@=ds#J zl{$zIH=w@~Uk+{2DnY;0`49r(fmoxT3WPk93?f@hT$se2z*j#?&@j@`i`NI*wHoe(Le7S9L^E~~9!R6mahc=xh zGOFK%WOm%*j1~@kw{Erai3-1ZK`p??<{@dgyhp|-$e#mFmW8hZdmJhKVB`UNV0f*i zyTG736P&LXtA88&R=luMn_Wr@_TT&be;dLt7Q$ z`mPHeN_F72)?JIWWMsf`#Sj!VPX1S_WhTa)Lb+>ejnH2!GwQ-mk-hCq%4?k*5fPD= zru*c{jYgkag#@Ieu0MZJe{*n#j>;Sf)h?glz?sMP`Lc?yh&?E=AynU=;0Pzjs97)B zJ9maU2ky&FW_5=F{^D{}!iM^rg4Vn0{$$iLk3ae;P)C26&E!uC@u+;pM8fcN#`q1D z#Mztng49rjEX2tB9#*~jXR>8yCtdmDpYuzJ(j4eDtDm{)&w^?;AhR$MoE=~2^nO|9 z=tt&s`-@9;-Ci9ARGX85d;2~iPuw6Z+jOR`dVZ6l)i{5-_{Vh`{TI;#<0B^({c^{& zsH-Q{SS&p2rbJv!ZgMC}l&{6?hpTZI)sdvXV_2HZ9MG>UM$-v0hmq+Cs&ZYh>+Zlp ziA1TO7<=>R0%7rnjIB+>P-9}h&t>(9fauV!Coy>w$^rV_@v@NHBgm=9%Y?Cs@0?@B zrS)XP!}t!tsva0?(d*>#I5nBdnc@=?v{m|9KR|PT>!6!AC!dhW;axy=FI>y}_|LB{ zFTk9+D$r`T)|+rWfTGR2B`uQ2F0#Cw6Pdo%3z@U`C~p@YODgGKKL=YzC9Y@g{3+D< zg4&cKcgO`f^=-Od4rLC89SC8F}~(vu1`UAs}uk2HX`I zMoVrol50zxvkHpKqK-R`msXk#wF<53LmwlLy|i`zrOIcpE)3 z(*vu-%qr8RmkRYX^5KDk!6k>(RcrLS+E?xGCF$ZynN5{it!3+DUvC1=K~MZN$+KT3;7I z6d2ulHomGV!Y^w3*M;HkZH-%T2rUljhrb^<%iug9m(T7;cXbZzdQDOMlrBrpg)C!>6a1$Jtd?6q1=sYAZy%!F;7UVCh(eB?$Yfes1URpBv`OJ(!D&k&SVz1#o z0;$^NU@64oZIVxj-qUb3dPd#UTvL%pcg%g|1)2}ESZ{G2NQW*Ncd!Tbqn{-u&J~6K z`2CBEsCaggrg#kxrNeTOw{`Rgj1&zB(}|<(+oL(-88hVCJ;ZcsxYXn~nAMNq z1U0+XjNk8Z50;~eWs8GuwWXS3LTfwnsq^K}^+YCKwU=SfgGVQ|-a40`XDzCbql`IY zC8@9ee53arOXq#GeYTA9_geMS7N>-=mhF1oaiS(Yop6`}5<6JvSwK4fSDLr+d=kV+$%0jm1pu_neu28`uYL3F~GU zlR2e*?s6i%QO8+Odr|l}%g~t*cRYzxZ)Qxqi1i9G~yM{{C*S9=t9w=|#EgA^xHxi6it5Y+xO94-!|8XsgFVz$( z*g8)(N6|81B9~zZu%5POYU~vi@qq^fT5_T476d5&{My+P`1NZERyslq2{_^dUFf|_ zL>o*8gXtW19fvpi_p`D-gKmFQMMcGgylINYpQZAxvFKB<0V*mfO&`-W%>@igC_Y`^ zqN$5%zw>&vf$*~ngHD$m0Z~aS(*R#*G_abNpi~6_@;q>Dz}I9sQMw3otggq1Ee29f z?LHrY==AU3zY#hv`Y;v2Qh}NH^ylC*OfUm=VgTI5Llls31{R*q%Yg>aOJNxvhNlCX zFPWskwEqTt^$^OgAGM&{F3dc;{}HO#PYKCxwwK8K_sTTBnkv}Z9^DwYx&uvUXyDH- zu<0bZcgqlfKD2k8R7OET`5mwaj~p!Yp4S+)%4Uh$XVAr4XnOaElXJpARdp;^A(Kk+ zoz{1sLY;;`2CVV3_IMvYeAtJA8=HjvdLqO=^>xI97;!UK)XB*SuxlZLY*)dV_C_8C z1~iOaaVJ*+OPhZh6{TzG*91E>@j=fdv##sRUimNf?7|Nr>F?H6Ep(99CLCCpr)2o_>gezFWKHY@|<+irTcHisxh|o~KJjj^a z19=~DmJ|qb;L}&)|KvWk6cM(HT3Q~*KL;T(0LGraG!aUta-B zWu$X?7l}(Yi!=8>nye6LvP%wrN!Dd54P$y16^LGU+<$&#hLr+~X2Rj+-|4x%{v4UT zssZ#gQ(pIR!SW)hoDr7ao%Qu>Nt?tD6$P&@e-?L?k$GDFvF2$p3D1jYSc^jyylN@9 zGW-83?)*Qq1>aZIp*dNxlSoTT1BHI`Z6jy_@D$NU{hthZ=-E_;kh}CRawDaK)CSb| z^-b36KwGYp)$bA18zPrE(8B+kL;aV7TgmFHeeGHLC!u_PehvtEdAV<`V>#`XaQHDM*2(aGY%KXIf8-$} z_fe0vf`)})da+P$aa-u1fk=MdY$g|x+EwFEp`r1~JL{wOhDVmZpWR1Dn{S@xzXUo+NeZblPKZPF za!#2j-?>M9u;jVF07A)j)kbG$xD3P8Z~vv|3;BlWju%kp=9W!l{)%oyl&suw4fq2o z$0pNAy~3Y1sT)s4XK5o3e|GG3fVFc=OK9o^O(L-k$I%M<}_YHFYCY9!GFVb59^ z;~8QtL`XFDm)0mvixF{vb~Jnf@aeYgf`vHkC;RQKYu7?ez`9>n>LD@J3(s2~DAeb{ zgUx1vF7NosPy+tkJK};cE8cb)K=?f6J{Uc7rH%)3@MA}PLw#$3pY|rTO=4_Cxkciex~9Ct6h%Ri z;_@u@&>JUi>BswC8cmCNmb32x5LlwP*su)XK$-(fgOG)tF28>-D=kFg+ zWG)s;OUrU_#QVB4W%(^d{{wa~Dud z=d37a_DyzU*(N0H;7}5M2^(nMaQ6((R}!0>v{qYGF798cY<{o~X*yn1=}w8Do_Ihc zC%mleYl0nN`Z#PFu|WgVf6K7E&x{c;ad05k@e{b!z#IcIhvcKB62!OY9w77aBt>24 zY-J0+W33nhXhXGt=%gSw_X&*_vY)@d)nqx!t54F5F&GvCRR-Ucuer)Q(;XO%B+Qio zKPZgV!ic|#XkSRzV~ls-@t1aISi&NlfcCT2V_Q!e=ZGXFa z*l~_2QJ;%fG7zmu)TCvxNeETlMOrsz#W8p;F7omp(5yh57xznKjGEcSL+Y#WCkNBR z%Al$$bkaVwO4L+s8eNI6Bz`X^`=P}P+7~;o^WWe^gIYzq75Y*{%QgFs?jb+gvtVf)3=g_CO za!-5a6ARshVYJPCy2=Kpuk3m+^770cTgn1l?s>3DMs;kX+gElM6VgXSY-Y$&2m zusnG>FgJIxqrUx|*qoE!00IT?FxXBXn+;`k zcYAL*Ig){AQj{>R4=|hVt1)W08)wS5(NX}FE4t#g=#PMs=4>PcIGuy$6_8}>`0jIS zFcc7wzhRuPo{Q5Px7&??O9e`aR`rij#sva!LV~Rl{B+;~$tB-HT&KAsA`tJN0!F(FU8%Nb{_Zl18hRCEt!e5W%=#?xAn@Nws8v3**rj0GX?RkQ|1|^I^ut1lmNLG^evP&L5sLSk7oVV< zrgeb2Lt32ou=*gly-C{{TnvLTh{)Z5ja#?336nB7 z8U{CXU?h8fJq!nch&r__`70kPRuNG2YqYL8yVs86Z2_;#^Ru9z3=9nainV|$(t9ym z>$o*qFb?;V*ZzX&wG@CDg6ThI`Wi_>dc#ceeMZLj}jt5*^gp$6)8}(A}j-eiIR+fJ8V$_`5gvM%_22IV^HUr{v zl!jf5oB&SP-1vzAXc~qjrnh#-d!$=VhhtnPTT03^Eg90wK;)i(aFC)WA4qnK4p0s6 zrE7xdn9Cj$6#Qgo8gTrvij#mhejzH@ZHkkQW))wCQXUbw_RZR$OpTVNzAk*7;mCRZ$sy=Jzr1N>w zb;l%s4?Fr;wztRPZo1pUlFE5}tG{NOYKBC)qdKIg@#sBMpE+j4h~^86psZ+ z7=iDEMB~HTq+5}6){8Woj27dQn`DxhRf0Gs3bmI3H@e;$qfF(v(>$LXb@qEUpHM8> zt-S4AXu6W4xNiT2J;1_)j~4d2hbYn3KMsAD?h50vHajx6J-lx`Q)BpDs^k$j=X9K=6UgFepUF+YE-YHT~9l7^C4;91=_Nv{Wc zB~u4Ro~~bYC|vn#$9V3>_IiI;7mS6IqkkFywi*OF#HrQ_I7z%O&mMd=1F`0MpqoXB zhqX1U*d=UU2xj$tm>LHzlRzMnL0V@*@jA6@M~rzT6rg#sJxQRS!s2!dTG8*C*p0gh zbM6)+qoPVmNL1M1eRq?Znv(d%C%Sk$?QC9Ln?@%ggf?x|`@PeRIJ$RMRG6SW zMXZcFB?1ol>0NNBh9$k9Q@ZKd6h0xa5FbF+c(|sl;`7Ptyx)#1eapwN5747!1;wm~ zCerB2W}oX_7am0~4L)=YoOCsPE}U0(kQ9T${<+ZLXyBh9cVKqx@{fs|!W5a+bkCYm zR|L8kcp8Od9NYM8%S+qmeoWADTurL`Z$09^28zoJxq!9sTB*I!%n_(U) zzugK)PdJhELt)Qo=MSW zMibkk4VSc!_^=WkpB5fDPe7IG7(JW_Tg0^Z{rSSjUqbj+QGu-Pii6N_9ik$k1^pZ1 z14v6aKasuH%WG?VQ@p-?y|MESBR#-ZUqgJHShN{8qDIX)l*qFx0~b%oT<#3`EG8MN zV5+p>RSL^HO0K_We^m9ne?MAj#*5+@hkHFvJ7`MVwxYzviYLxr8~n45e_b{(7dgif zb}uJh*%q-qEv>;D;&L3QtL_Z*!RKN~TmQ*zwn&5erD1yJyd!hvK}cdFWkQI<<57v~ zPdPW2q9oR!U92sndMsW4k%A(p7~NH#YdnUO;B-rmY`%!O@C(mze2J^^Ap;xpSqjuk zGtd;Z;TD16!ho5p#rc}dWu^!kooq5+6NG9(%>!cKaeBy8DJf^@@{UTV7OEe>&~0)^ zRr;j;EBp}Fd7K>%7cCiRtt`o%3CBDK3i2^J%s-mp*BKgKq!BdY1{d!4otfWvPz_c- zV^#qC6K8$&9|iS^H5F+!?j38+RM7f)|AgGuO%FLvEdeOHkv1!3Kv5;?Q{iI!CDRy1 zX9ZTy)lyk@X_r5BgMeETQ3`%T!GrZ z7Ls~zW;U82OAVTQ`UT`PX2c!6pXOHkBGzd6%Q=z;nyZdpOLt!9wSE3paEsOV5$8sF z@m&Aa@D#%%VG;)M1Q_CxPGJl-(c;_RsI$rfbLXIsshWzv27@VzqqIY zhJTpXe-t`GvXStzPhUBrOSbt}B!x-FJWUdpT@qPO1u~Q;iaDFo_(cl8u_HEMILdE9 z#Q2ycd2VUzxn(pthVKFkGk02J$cXy3*_6P#iwg3F*LC6Bb7yrF20bl4?>Et~eR?Or zCL%XTTT+3&I!Ve{H?jl8J~Xq_E|G?JIG1nXmB$$nVn})43SIo0Me~)V5M}+L zhO%ctqf2Wo4PnsC$3(Z{LCF=5El#HxvU3huKf4KdlMc(Sj_EUe&1xp&Jho}5Asle`Sv2! zji0V+kpS>I?#$VJxn+>KI1`w;xQ;_rBcq~}l$3^>CFtc+3&*!0yC&z12Z0HY0*DE1 zEtH*}Z9=Uz}X}Ce+yA#c=CgmqMrZGHd~lP0-Jvv1c@?7|P&HKV22JUKBOtLZpnoC6$A74rr=FhM3l?!%o|ul%|_Dhd~Lyg8ch zs|w~6dEQqHXZo9LAj>(IQv6N$NivQ3W#A6R{k6Wld~5qdd9=-=YtqmqjPugM()pls z@+^9L0K1JD)8~BBh7{|))lZCZx<@o7%{rG>W_-bcNOWneKWxZe+ki-wG$0@XxROh| zNaFXjV+i1cv?#1_q3pqN-@75}hDKuvOD)^WKW9To)r3P2C>AhGBF;*YY8bQ!cHj5% ztGZ6BFGet7M*bd7%z%c9+GR__FRp2hN0y{Jx1{sE!Yi8c9# zH)_OBmiL>U{CP{K>9V8Nb7osHoz<@PfC+Sesa-~?-MU930N`5GT0UBM_>qcL98N7B zEmzmJ7BJU7e~$h_^uCxpOdMxhLIMT_s~X~cP|!~pR6--v7#gxZS^x*+hcVJ;z~X1p zYBl1dyMO-)r^_ds@4J*b459 zwR9_5#?1{Z=)m}A&|`%sPU|uS-0q6 z&{WHtpaotx`;8x?63oXmicWH!9jtCFKSC$9{w#0OJeA4%j2Jo5E;RNhA0ML*9f@H-Pk!B_m&pb$cD4v9W8uVQXX((=M5*<-UYEC{oiOOqv-PE&e zTfxcVx}wLa!J<8wn#adal3=D?@Pu}FjBV^>WxmqaZ`*rE#35e|>_-}#Xtw62h zwRF?Wl9*2rD7DM>3x&U~Zrc#yAg+bkDI!~ISZ5lDO@$qfDffq8I>I@z_)aT`e_v^U zu>?0ctGvkH?Jpp6e$L9mq7*)d5Gi=+zPw5TMHJ*?A^0XNo=b7s@jzUPk`sn`va()h zGyv@Q-W|hK=dkhd!-rDa<@Rf372?@;b7zP6^)MFRJw}?_c~=W8nY<3jG)QpY`_L}F zIKT3#9h%Zto#XzN!5!{H0m6n(5b&FU-UN!_;k$RhfFVTi-dTL(2re?7H*=5eRyt>9 zw7e!!(7JWKFGd+#0DO%Ho&_$@aAB}5o_9gMrZB~ZExaa)Vx9ve)o>Rvhwut1@$t*S zhQMVzV9LMtTZtqLe9nIH;jIt zHsvCKWSni}e*x1@i6_wNv$Hz{(hP`0F!JhPd{W7`G2SF+X?^`R=JS^?XJ8oCWUmO$ zKY>x0cng5cYtb`6F>j_+UtCPA8G?0y^-a;iCnhE)Ah@M;9ad%B@IP(17BSWSZ4bZL zp$UaizuVi};C{@`%DT4lc!MyV6d8F_i6cSQm4)a!u$S`h+e)>CNx^_z!1+fZ5`!Vi z5O2Ko|NKN;Rc{2#M=y0jnx_vR4ab9j{3yuowQ*T)3$&2NmO26gp%G}^9Hh!-6v ztG*CKBp(i|%#S0pG=Q)p)_>7a(=jV)3U Date: Wed, 29 Mar 2017 16:24:20 -0700 Subject: [PATCH 098/165] split exclusions topic --- ...d-scan-types-windows-defender-antivirus.md | 2 +- ...e-exclusions-windows-defender-antivirus.md | 344 +------------ ...e-exclusions-windows-defender-antivirus.md | 278 +++++++++++ ...e-exclusions-windows-defender-antivirus.md | 459 ++++++++++++++++++ ...r-exclusions-windows-defender-antivirus.md | 84 ++++ ...fender-antivirus-on-windows-server-2016.md | 2 +- 6 files changed, 834 insertions(+), 335 deletions(-) create mode 100644 windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md create mode 100644 windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md create mode 100644 windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md diff --git a/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md index 242dec94f1..9217a21aa0 100644 --- a/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md @@ -52,7 +52,7 @@ Description | GP location and setting | Default setting (if not configured) | Po See [Email scanning limitations](#ref1)) below | Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning` Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | `-DisableRestorePoint` Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan` - Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-exclusions-windows-defender-antivirus.md) will take precendence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning` + Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md) will take precendence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning` Scan files on the network | Scan > Scan network files | Disabled | `-DisableScanningNetworkFiles` Scan packed executables | Scan > Scan packed executables | Enabled | Not available Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning` diff --git a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md index bffc7f3297..bed4fbf9c1 100644 --- a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md @@ -33,342 +33,20 @@ author: iaanw - Microsoft Intune - Windows Defender Security Center -You can exclude certain files, folders, processes, and process-modified files from being scanned by Windows Defender AV. The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). +You can exclude certain files, folders, processes, and process-modified files from being scanned by Windows Defender Antivirus. -Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). -You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools). +Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. -You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), although you will need to use several different cmdlets. +>[!WARNING] +>Defining exclusions lowers the protection offered by Windows Defender AV. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. -By default, local changes made to the lists (by users with administrator privileges) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, Intune, PowerShell, or WMI. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to disable this setting. +## In this section -PowerShell can be used to [validate that your exclusion lists are working as expected](#validate). +Topic | Description +---|--- +[Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender AV scans based on their file extension, file name, or location +[Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | You can exclude files from scans that have been opened by a specific process +[Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions - -## Types of exclusions - -There are three exclusion lists that you can configure: -- Extension exclusions list -- File and folder exclusions list -- Files opened by defined processes list - -The following table shows some of the typical scenarios and which list would need to be configured. - -Exclusion | Examples | Exclusion list ----|---|--- -Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions -Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions -Any file with a specific file name | The file "sample.test", anywhere on the machine | File and folder exclusions -A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions -A specific process | The executable file c:\test\process.exe | File and folder exclusions list -Any file opened by a specific process | Any file opened by the process c:\test\open.exe, even if the file that is opened is located in d:\folder43 | Process-opened exclusions - - -This means the exclusion lists have the following characteristics: -- If you exclude a file, the exclusion will apply to all versions of that file, regardless of where the file is located. -- Folder exclusions will apply to all files and folders under that folder. -- File extensions will apply to any file name with the defined extension, regardless of where the file is located. -- Any file opened by the defined process will be excluded, regardless of where the file is located. The process itself will **not** be excluded. - - - - -## Use Group Policy to configure exclusion lists - -**Use Group Policy to configure file extension exclusions:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - - -6. Double-click the **Extension Exclusions** setting and add the exclusions: - - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** - 3. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column for all processes. - -7. Click **OK**. - -![The Group Policy setting for file exclusions](images/defender/wdav-extension-exclusions.png) - -**Use Group Policy to exclude specified files or folders from scans:** - ->[!NOTE] ->The exclusion will apply to any file with the defined file name - regardless of its location. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded. - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - - -6. Double-click the **Path Exclusions** setting and add the exclusions: - - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** - 3. Enter each path or file on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column for all processes. - -7. Click **OK**. - -![The Group Policy setting for folder exclusions](images/defender/wdav-path-exclusions.png) - -**Use Group Policy to exclude files that have been used or modified by specified processes from scans:** - ->[!NOTE] ->You can exclude files that are opened by specified processes from being scanned. The specified process won't be excluded - but any files that are opened by that process (regardless of where they are or what they are named) will be excluded. If you need to exclude the process itself, [exclude it as a file](#exclude-paths-files). ->You can only exclude files modified by processes if the process is an executable. - - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - - -6. Double-click the **Process Exclusions** setting and add the exclusions: - - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...** - 3. Enter each process on its own line under the **Value name** column. Ensure you enter a fully qualified path to the process, including the drive letter, folder path, filename, and extension. The process must be an executable. Enter **0** in the **Value** column for all processes. - -7. Click **OK**. - -![The Group Policy setting for specifying process exclusions](images/defender/wdav-process-exclusions.png) - - -## Use PowerShell cmdlets and WMI to configure exclusion lists - -Excluding and reviewing file extensions, paths and files (including processes), and files opened by processes with PowerShell requires using a combination of four cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). - -There are three exclusion lists: -- ExclusionExtension -- ExclusionPath -- ExclusionProcess - -You can modify each of the lists with the following cmdlets: -- Set-MpPreference to create or overwrite the defined list -- Add-MpPreference to add new items to the defined list -- Remove-MpPreference to remove or delete items from the defined list -- Get-MpPreference to review the items in the list, either all at once with all other Windows Defender AV settings, or individually for each of the lists - ->[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - -The following matrix provides sample commands based on what you want to exclude, and whether you want to create a list, add to the list, or remove items from the list. - -
- - - - - - - - - - - - - - - - - - - - - - - - - -
Configuration actionType of exclusionPowerShell command
Create or overwrite a listFile extensions that should be excluded from scans -Set-MpPreference -ExclusionExtension ".extension1, .extension2, .extension3"
Files (including processes) and paths that should be excluded from scans -Set-MpPreference -ExclusionPath "c:\example, d:\test\process.exe, c:\test\file.bat"
Files opened by the specified processes (executables) -Set-MpPreference -ExclusionProcess "c:\example\test.exe"
Add to a listFile extensions that should be excluded from scans -Add-MpPreference -ExclusionExtension ".extension4, .extension5"
Files (including processes) and paths that should be excluded from scans -Add-MpPreference -ExclusionPath "d:\test, d:\example\file.png"
Files opened by specified processes (executables) -Add-MpPreference -ExclusionProcess "f:\test\sample.exe"
Remove items from a listFile extensions that should be excluded from scans -Remove-MpPreference -ExclusionExtension ".extension1, .extension4, .extension5"
Files (including processes) and paths that should be excluded from scans -Remove-MpPreference -ExclusionPath "c:\example, d:\example\file.png"
Files opened by specified processes (executables) -Remove-MpPreference -ExclusionProcess "c:\example\test.exe"
- -### Review the exclusion lists with PowerShell - -You can retrieve the items in any of the lists in two ways: -- Retrieve the status of all Windows Defender AV preferences. Each of the three lists will be displayed on separate lines, but the items within the list will be combined into the same line. -- Write the status of all preferences to a variable, and only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. - -In both instances the items are sorted alphabetically. - -The following sequence of code examples helps to show how this works. - -1. Create an example list of extensions that should be excluded from scans: - ```PowerShell - PS C:\> Set-MpPreference -ExclusionExtension ".test1, .test2" - ``` - -2. Add some additional extensions: - - ```PowerShell - PS C:\> Add-MpPreference -ExclusionExtension ".test40, test50" - ``` - -3. Add another set of extensions: - - ```PowerShell - PS C:\> Add-MpPreference -ExclusionExtension ".secondadd1, .secondadd2" - ``` - -4. Review the list as a combined list: - ```PowerShell - PS C:\> Get-MpPreference - ``` - - ![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) - - -5. Use a variable to store and retrieve only the exclusions list: - - ```PowerShell - PS C:\> $WDAVprefs = Get-MpPreference - PS C:\> $WDAVprefs.ExclusionExtension - ``` - - ![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) - - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - -### Use Windows Management Instruction (WMI) to configure file extension exclusions - -Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: - -```WMI -ExclusionExtension -ExclusionPath -ExclusionProcess -``` - -The use of **Set**, **Add**, and **Remove** are analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - - -## Use System Center Configuration Manager, Intune, or the Windows Defender Security Center app to configure exclusion lists - - -**Use Configuration Manager to configure file extension exclusions:** - -See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). - - -**Use Microsoft Intune to configure file extension exclusions:** - - -See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. - - -**Use the Windows Defender Security app to add exclusions to Windows Defender AV:** - -See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. - - - - ## Configure auto exclusions lists for Windows Server deployments - -If you are using Windows Defender AV to protect Windows Server endpoints or machines, you are [automatically enrolled in certain exclusions](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender), as defined by your specified Windows Server Role. - -These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). - -You can still add or remove custom exclusions (in addition to the Server Role-defined auto exclusions) as described in the other sections in this topic. - -You can also disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI. - -**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - -6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**. - -**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:** - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -DisableAutoExclusions -``` - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - -**Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016:** - -Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: - -```WMI -DisableAutoExclusions -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - -## Use wildcards in exclusion lists - -You can use the asterisk **\***, question mark **?**, or environment variables (such as %APPDATA%) as wildcards when defining items in the exclusion lists. - -You cannot use a wildcard in place of a drive letter. - - -The following table describes how the wildcards can be used and provides some examples. - -Wildcard | Use | Example use | Example matches ----|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters |

  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my-archived-files-43.zip
  • C:\somepath\folder1\folder2\Data
  • .test
-**?** (question mark) | Replaces a single character |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my1.zip
  • C:\somepath\P\Data
  • .txt
-Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
  • %APPDATA%\Data\file.png
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
  • C:\Users\username\AppData\Roaming\Data\file.png
- - - -## Validate exclusions lists with the EICAR test file - -You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. - -In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. - -```PowerShell -Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" -``` - -If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). - -You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet, replace *c:\test.txt* with a file that conforms to the rule you are validating: - -```PowerShell -$client = new-object System.Net.WebClient -$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") -``` - - -## Related topics - -- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md new file mode 100644 index 0000000000..9a81b2214f --- /dev/null +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -0,0 +1,278 @@ +--- +title: Configure and validate exclusions based on extension, name, or location +description: Exclude files from Windows Defender AV scans based on their file extension, file name, or location. +keywords: exclusions, files, extension, file type, folder name, file name, scans +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Configure and validate exclusions based on file name, extension, and folder location + + +**Applies to:** + +- Windows 10 + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center + +You can exclude certain files from being scanned by Windows Defender AV by modifying exclusion lists. + +This topic describes how to configure exclusion lists for the following: + +Exclusion | Examples | Exclusion list +---|---|--- +Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions +Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions +Any file with a specific file name | The file "sample.test", anywhere on the machine | File and folder exclusions +A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions +A specific process | The executable file c:\test\process.exe | File and folder exclusions list + +This means the exclusion lists have the following characteristics: +- If you exclude a file, the exclusion will apply to all versions of that file, regardless of where the file is located. +- Folder exclusions will apply to all files and folders under that folder. +- File extensions will apply to any file name with the defined extension, regardless of where the file is located. + + +To exclude files opened by a specific process, see the [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) topic. + + +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). + +Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. + +You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools), and you can [use wildcards](#wildcards) to further customize the lists. + +You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) and [validating](#validate) your lists. + + +By default, local changes made to the lists (by users with administrator privileges) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, Intune, PowerShell, or WMI. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to disable this setting. + + + + + + +## Configure the list of exclusions based on file or folder name or file extension + + +**Use Group Policy to configure file name, folder, or file extension exclusions:** + +>[!NOTE] +>The exclusion will apply to any file with the defined file name - regardless of its location. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded. + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. + + +6. Double-click the **Path Exclusions** setting and add the exclusions: + + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...** + 3. Enter each path or file on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column for all processes. + +7. Click **OK**. + +![The Group Policy setting for file and folder exclusions](images/defender/wdav-extension-exclusions.png) + +8. Double-click the **Extension Exclusions** setting and add the exclusions: + + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...** + 3. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column for all processes. + + +9. Click **OK**. + +![The Group Policy setting for extension exclusions](images/defender/wdav-path-exclusions.png) + + + +**Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:** + +Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). + +The format for the cmdlets is: + +```PowerShell + - ", , " +``` + +The following are allowed as the \: + +Configuration action | PowerShell cmdlet +---|--- +Create or overwrite the list | `Set-MpPreference` +Add to the list | `Add-MpPreference` +Remove items from the list | `Remove-MpPreference` + +The following are allowed as the \: + +Exclusion type | PowerShell parameter +---|--- +All files with a specified file extension | `-ExclusionExtension` +All files under a folder (including files in subdirectories) | `-ExclusionPath` + + +>[!IMPORTANT] +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. + + +For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test**, **.sample**, or **.ignore** file extension: + +```PowerShell +Add-MpPreference -ExclusionExtension ".test, .sample, .ignore" +``` + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + +**Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:** + +Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ExclusionExtension +ExclusionPath +``` + +The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) + + +**Use Configuration Manager to configure file name, folder, or file extension exclusions:** + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). + + +**Use Microsoft Intune to configure file name, folder, or file extension exclusions:** + + +See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. + + +**Use the Windows Defender Security Center app to configure file name, folder, or file extension exclusions:** + +See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. + + + + +## Use wildcards in the file name and folder path or extension exclusion lists + +You can use the asterisk **\***, question mark **?**, or environment variables (such as %APPDATA%) as wildcards when defining items in the file name or folder path exclusion list. + +You cannot use a wildcard in place of a drive letter. + + +The following table describes how the wildcards can be used and provides some examples. + +Wildcard | Use | Example use | Example matches +---|---|---|--- +**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
|
  • C:\MyData\my-archived-files-43.zip
  • Any file in C:\somepath\folder1\folder2\Data
+**?** (question mark) | Replaces a single character |
  • C:\MyData\my\?.zip
  • C:\somepath\\\?\Data
|
  • C:\MyData\my1.zip
  • Any file in C:\somepath\P\Data
+Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
  • %APPDATA%\Data\file.png
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
  • C:\Users\username\AppData\Roaming\Data\file.png
+ + + + + +### Review the list of exclusions + +You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). + +If you use PowerShell, you can retrieve the list in two ways: + +- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. +- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. + +**Review the list of exclusions alongside all other Windows Defender AV preferences:** + +Use the following cmdlet: + +```PowerShell +Get-MpPreference +``` + +In the following example, the items contained in the `ExclusionExtension` list are highlighted: + + +![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + +**Retrieve a specific exclusions list:** + +Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: + +```PowerShell +$WDAVprefs = Get-MpPreference +$WDAVprefs.ExclusionExtension +$WDAVprefs.ExclusionPath +``` + +In the following example, the list is split into new lines for each use of the `Add-MpPreference` cmdlet: + +![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) + + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + + + + + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. + +In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. + +```PowerShell +Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" +``` + +If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). + +You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: + +```PowerShell +$client = new-object System.Net.WebClient +$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") +``` + + + +## Related topics + +- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md new file mode 100644 index 0000000000..fb9259cd91 --- /dev/null +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -0,0 +1,459 @@ +--- +title: Configure and valudate exclusions for files opened by specific processes +description: You can exclude files from scans if they have been opened by a specific process. +keywords: process, exclusion, files, scans +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Configure and validate exclusions for files opened by processes + +**Applies to:** + +- Windows 10 + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) +- System Center Configuration Manager +- Microsoft Intune +- Windows Defender Security Center + +You can exclude files that have been opened by specific processes from being scanned by Windows Defender AV. + +For example, you may need to exclude any file that is opened by the process *c:\internal\test.exe*. + +You achieve this by adding the location and name of the process to the process exclusion list. When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). + +CThe exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). + +Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. + +You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools), and you can [use wildcards](#wildcards) to further customize the lists. + +You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) and [validating](#validate) your lists. + + +By default, local changes made to the lists (by users with administrator privileges) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, Intune, PowerShell, or WMI. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to disable this setting. + +## Configure the list of exclusions for files opened by specified processes + + + +**Use Group Policy to exclude files that have been used or modified by specified processes from scans:** + +>[!NOTE] +>You can exclude files that are opened by specified processes from being scanned. The specified process won't be excluded - but any files that are opened by that process (regardless of where they are or what they are named) will be excluded. If you need to exclude the process itself, [exclude it as a file](#exclude-paths-files). +>You can only exclude files modified by processes if the process is an executable. + + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. + + +6. Double-click the **Process Exclusions** setting and add the exclusions: + + 1. Set the option to **Enabled**. + 2. Under the **Options** section, click **Show...** + 3. Enter each process on its own line under the **Value name** column. Ensure you enter a fully qualified path to the process, including the drive letter, folder path, filename, and extension. The process must be an executable. Enter **0** in the **Value** column for all processes. + +7. Click **OK**. + +![The Group Policy setting for specifying process exclusions](images/defender/wdav-process-exclusions.png) + + + +**Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:** + +Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). + +The format for the cmdlets is: + +```PowerShell + -ExclusionProcess ", , " +``` + +The following are allowed as the \: + +Configuration action | PowerShell cmdlet +---|--- +Create or overwrite the list | `Set-MpPreference` +Add to the list | `Add-MpPreference` +Remove items from the list | `Remove-MpPreference` + + +>[!IMPORTANT] +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. + + +For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the defined processes. This exclusion will apply to any file that is opened by the processes that are in the specified folder: + +```PowerShell +Add-MpPreference -ExclusionProcess "c:\internal\test.exe, d:\org\ui\compile43-h.exe" +``` + +For example, files opened by the process *c:\outside\test.exe* will not be excluded. This is the because the opening process is located in a different folder ("outside" instead of "internal"), even though the process's file name is the same. + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + +**Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:** + +Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ExclusionProcess +``` + +The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) + + +**Use Configuration Manager to configure file name, folder, or file extension exclusions:** + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). + + +**Use Microsoft Intune to configure file name, folder, or file extension exclusions:** + + +See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. + + +**Use the Windows Defender Security Center app to configure file name, folder, or file extension exclusions:** + +See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. + + + + +## Use wildcards in the file name and folder path or extension exclusion lists + +The use of wildcards in the process exclusion list is different from their use in other exclusion lists. + +In particular, you cannot use the question mark **?** wilcard, and the asterisk **\*** wildcard can only be used at the end of a complete path. You can still use environment variables (such as %APPDATA%) as wildcards when defining items in the process exclusion list. + +The following table describes how the wildcards can be used in the process exclusion list: + +Wildcard | Use | Example use | Example matches +---|---|---|--- +**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\*
|
  • Any file opened by C:\MyData\file.exe
+**?** (question mark) | Not available | \- | \- +Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
  • %APPDATA%\Data\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
  • Any file opened by C:\Users\username\AppData\Roaming\Data\file.exe
+ + + + + +### Review the list of exclusions + +You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). + +If you use PowerShell, you can retrieve the list in two ways: + +- Retrieve the status of all Windows Defender AV preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. +- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. + +**Review the list of exclusions alongside all other Windows Defender AV preferences:** + +Use the following cmdlet: + +```PowerShell +Get-MpPreference +``` + + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + +**Retrieve a specific exclusions list:** + +Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: + +```PowerShell +$WDAVprefs = Get-MpPreference +$WDAVprefs.ExclusionProcess +``` + + + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + + + + + + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. + +In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. + +```PowerShell +Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" +``` + +If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). + +You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: + +```PowerShell +$client = new-object System.Net.WebClient +$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") +``` + + + + + + + + +## Use PowerShell cmdlets and WMI to configure exclusion lists + +Excluding and reviewing file extensions, paths and files (including processes), and files opened by processes with PowerShell requires using a combination of four cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). + +There are three exclusion lists: +- ExclusionExtension +- ExclusionPath +- ExclusionProcess + +You can modify each of the lists with the following cmdlets: +- Set-MpPreference to create or overwrite the defined list +- Add-MpPreference to add new items to the defined list +- Remove-MpPreference to remove or delete items from the defined list +- Get-MpPreference to review the items in the list, either all at once with all other Windows Defender AV settings, or individually for each of the lists + +>[!IMPORTANT] +>If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. + +The following matrix provides sample commands based on what you want to exclude, and whether you want to create a list, add to the list, or remove items from the list. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Configuration actionType of exclusionPowerShell command
Create or overwrite a listFile extensions that should be excluded from scans +Set-MpPreference -ExclusionExtension ".extension1, .extension2, .extension3"
Files (including processes) and paths that should be excluded from scans +Set-MpPreference -ExclusionPath "c:\example, d:\test\process.exe, c:\test\file.bat"
Files opened by the specified processes (executables) +Set-MpPreference -ExclusionProcess "c:\example\test.exe"
Add to a listFile extensions that should be excluded from scans +Add-MpPreference -ExclusionExtension ".extension4, .extension5"
Files (including processes) and paths that should be excluded from scans +Add-MpPreference -ExclusionPath "d:\test, d:\example\file.png"
Files opened by specified processes (executables) +Add-MpPreference -ExclusionProcess "f:\test\sample.exe"
Remove items from a listFile extensions that should be excluded from scans +Remove-MpPreference -ExclusionExtension ".extension1, .extension4, .extension5"
Files (including processes) and paths that should be excluded from scans +Remove-MpPreference -ExclusionPath "c:\example, d:\example\file.png"
Files opened by specified processes (executables) +Remove-MpPreference -ExclusionProcess "c:\example\test.exe"
+ +### Review the exclusion lists with PowerShell + +You can retrieve the items in any of the lists in two ways: +- Retrieve the status of all Windows Defender AV preferences. Each of the three lists will be displayed on separate lines, but the items within the list will be combined into the same line. +- Write the status of all preferences to a variable, and only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. + +In both instances the items are sorted alphabetically. + +The following sequence of code examples helps to show how this works. + +1. Create an example list of extensions that should be excluded from scans: + ```PowerShell + PS C:\> Set-MpPreference -ExclusionExtension ".test1, .test2" + ``` + +2. Add some additional extensions: + + ```PowerShell + PS C:\> Add-MpPreference -ExclusionExtension ".test40, test50" + ``` + +3. Add another set of extensions: + + ```PowerShell + PS C:\> Add-MpPreference -ExclusionExtension ".secondadd1, .secondadd2" + ``` + +4. Review the list as a combined list: + ```PowerShell + PS C:\> Get-MpPreference + ``` + + ![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) + + +5. Use a variable to store and retrieve only the exclusions list: + + ```PowerShell + PS C:\> $WDAVprefs = Get-MpPreference + PS C:\> $WDAVprefs.ExclusionExtension + ``` + + ![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) + + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + +### Use Windows Management Instruction (WMI) to configure file extension exclusions + +Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +ExclusionExtension +ExclusionPath +ExclusionProcess +``` + +The use of **Set**, **Add**, and **Remove** are analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) + + +## Use System Center Configuration Manager, Intune, or the Windows Defender Security Center app to configure exclusion lists + + +**Use Configuration Manager to configure file extension exclusions:** + +See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). + + +**Use Microsoft Intune to configure file extension exclusions:** + + +See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. + + +**Use the Windows Defender Security app to add exclusions to Windows Defender AV:** + +See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. + + + + ## Configure auto exclusions lists for Windows Server deployments + +If you are using Windows Defender AV to protect Windows Server endpoints or machines, you are [automatically enrolled in certain exclusions](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender), as defined by your specified Windows Server Role. + +These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). + +You can still add or remove custom exclusions (in addition to the Server Role-defined auto exclusions) as described in the other sections in this topic. + +You can also disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI. + +**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. + +6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**. + +**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:** + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -DisableAutoExclusions +``` + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + +**Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016:** + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +DisableAutoExclusions +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) + +## Use wildcards in exclusion lists + +You can use the asterisk **\***, question mark **?**, or environment variables (such as %APPDATA%) as wildcards when defining items in the exclusion lists. + +You cannot use a wildcard in place of a drive letter. + + +The following table describes how the wildcards can be used and provides some examples. + +Wildcard | Use | Example use | Example matches +---|---|---|--- +**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my-archived-files-43.zip
  • C:\somepath\folder1\folder2\Data
  • .test
+**?** (question mark) | Replaces a single character |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my1.zip
  • C:\somepath\P\Data
  • .txt
+Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
  • %APPDATA%\Data\file.png
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
  • C:\Users\username\AppData\Roaming\Data\file.png
+ + + +## Validate exclusions lists with the EICAR test file + +You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. + +In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. + +```PowerShell +Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" +``` + +If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). + +You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet, replace *c:\test.txt* with a file that conforms to the rule you are validating: + +```PowerShell +$client = new-object System.Net.WebClient +$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") +``` + + +## Related topics + +- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md new file mode 100644 index 0000000000..c293dd3358 --- /dev/null +++ b/windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md @@ -0,0 +1,84 @@ +--- +title: Automatic and customized exclusions for Windows Defender AV on Windows Server 2016 +description: Windows Server 2016 includes automatic exclusions, based on Server Role. You can also add custom exclusions. +keywords: exclusions, server, auto-exclusions, automatic, custom, scans +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + +# Configure exclusions in Windows Defender AV on Windows Server 2016 + + +**Applies to:** + +- Windows Server 2016 + +**Audience** + +- Enterprise security administrators + + +**Manageability available with** + +- Group Policy +- PowerShell +- Windows Management Instrumentation (WMI) + +If you are using Windows Defender Antivirus to protect Windows Server 2016 machines, you are [automatically enrolled in certain exclusions](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender), as defined by your specified Windows Server Role. + +These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). + +You can still add or remove custom exclusions (in addition to the Server Role-defined auto exclusions) as described in the other exclusion-related topics: +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) + + +You can disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI. + +**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. + +6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**. + +**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:** + +Use the following cmdlets: + +```PowerShell +Set-MpPreference -DisableAutoExclusions +``` + +See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. + +**Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016:** + +Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: + +```WMI +DisableAutoExclusions +``` + +See the following for more information and allowed parameters: +- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) + + +## Related topics + +- [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) +- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md b/windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md index 9c5a224709..3510bcb390 100644 --- a/windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md +++ b/windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md @@ -40,7 +40,7 @@ See [Windows Defender Overview for Windows Server](https://technet.microsoft.com While the functionality, configuration, and management is largely the same for Windows Defender AV either on Windows 10 or Windows Server 2016, there are a few key differences: -- In Windows Server 2016, [automatic exclusions](configure-exclusions-windows-defender-antivirus.md) are applied based on your defined Server Role. +- In Windows Server 2016, [automatic exclusions](configure-server-exclusions-windows-defender-antivirus.md) are applied based on your defined Server Role. - In Windows Server 2016, [Windows Defender AV will not disable itself if you are running another antivirus product](windows-defender-antivirus-on-windows-server-2016.md#sysreq). From bc97e31e58acd93b31726d86da7faa539bcb69bf Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 29 Mar 2017 16:34:45 -0700 Subject: [PATCH 099/165] fixes --- ...e-exclusions-windows-defender-antivirus.md | 228 +----------------- 1 file changed, 1 insertion(+), 227 deletions(-) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index fb9259cd91..568800ecf5 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Configure and valudate exclusions for files opened by specific processes +title: Configure and validate exclusions for files opened by specific processes description: You can exclude files from scans if they have been opened by a specific process. keywords: process, exclusion, files, scans search.product: eADQiWindows 10XVcnh @@ -224,232 +224,6 @@ $client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt" ``` - - - - - - -## Use PowerShell cmdlets and WMI to configure exclusion lists - -Excluding and reviewing file extensions, paths and files (including processes), and files opened by processes with PowerShell requires using a combination of four cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). - -There are three exclusion lists: -- ExclusionExtension -- ExclusionPath -- ExclusionProcess - -You can modify each of the lists with the following cmdlets: -- Set-MpPreference to create or overwrite the defined list -- Add-MpPreference to add new items to the defined list -- Remove-MpPreference to remove or delete items from the defined list -- Get-MpPreference to review the items in the list, either all at once with all other Windows Defender AV settings, or individually for each of the lists - ->[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - -The following matrix provides sample commands based on what you want to exclude, and whether you want to create a list, add to the list, or remove items from the list. - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Configuration actionType of exclusionPowerShell command
Create or overwrite a listFile extensions that should be excluded from scans -Set-MpPreference -ExclusionExtension ".extension1, .extension2, .extension3"
Files (including processes) and paths that should be excluded from scans -Set-MpPreference -ExclusionPath "c:\example, d:\test\process.exe, c:\test\file.bat"
Files opened by the specified processes (executables) -Set-MpPreference -ExclusionProcess "c:\example\test.exe"
Add to a listFile extensions that should be excluded from scans -Add-MpPreference -ExclusionExtension ".extension4, .extension5"
Files (including processes) and paths that should be excluded from scans -Add-MpPreference -ExclusionPath "d:\test, d:\example\file.png"
Files opened by specified processes (executables) -Add-MpPreference -ExclusionProcess "f:\test\sample.exe"
Remove items from a listFile extensions that should be excluded from scans -Remove-MpPreference -ExclusionExtension ".extension1, .extension4, .extension5"
Files (including processes) and paths that should be excluded from scans -Remove-MpPreference -ExclusionPath "c:\example, d:\example\file.png"
Files opened by specified processes (executables) -Remove-MpPreference -ExclusionProcess "c:\example\test.exe"
- -### Review the exclusion lists with PowerShell - -You can retrieve the items in any of the lists in two ways: -- Retrieve the status of all Windows Defender AV preferences. Each of the three lists will be displayed on separate lines, but the items within the list will be combined into the same line. -- Write the status of all preferences to a variable, and only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. - -In both instances the items are sorted alphabetically. - -The following sequence of code examples helps to show how this works. - -1. Create an example list of extensions that should be excluded from scans: - ```PowerShell - PS C:\> Set-MpPreference -ExclusionExtension ".test1, .test2" - ``` - -2. Add some additional extensions: - - ```PowerShell - PS C:\> Add-MpPreference -ExclusionExtension ".test40, test50" - ``` - -3. Add another set of extensions: - - ```PowerShell - PS C:\> Add-MpPreference -ExclusionExtension ".secondadd1, .secondadd2" - ``` - -4. Review the list as a combined list: - ```PowerShell - PS C:\> Get-MpPreference - ``` - - ![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) - - -5. Use a variable to store and retrieve only the exclusions list: - - ```PowerShell - PS C:\> $WDAVprefs = Get-MpPreference - PS C:\> $WDAVprefs.ExclusionExtension - ``` - - ![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) - - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - -### Use Windows Management Instruction (WMI) to configure file extension exclusions - -Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: - -```WMI -ExclusionExtension -ExclusionPath -ExclusionProcess -``` - -The use of **Set**, **Add**, and **Remove** are analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - - -## Use System Center Configuration Manager, Intune, or the Windows Defender Security Center app to configure exclusion lists - - -**Use Configuration Manager to configure file extension exclusions:** - -See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). - - -**Use Microsoft Intune to configure file extension exclusions:** - - -See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. - - -**Use the Windows Defender Security app to add exclusions to Windows Defender AV:** - -See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. - - - - ## Configure auto exclusions lists for Windows Server deployments - -If you are using Windows Defender AV to protect Windows Server endpoints or machines, you are [automatically enrolled in certain exclusions](https://technet.microsoft.com/en-us/windows-server-docs/security/windows-defender/automatic-exclusions-for-windows-defender), as defined by your specified Windows Server Role. - -These exclusions will not appear in the standard exclusion lists shown in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). - -You can still add or remove custom exclusions (in addition to the Server Role-defined auto exclusions) as described in the other sections in this topic. - -You can also disable the auto-exclusions lists with Group Policy, PowerShell cmdlets, and WMI. - -**Use Group Policy to disable the auto-exclusions list on Windows Server 2016:** - -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Windows Defender Antivirus > Exclusions**. - -6. Double-click the **Turn off Auto Exclusions** setting and set the option to **Enabled**. Click **OK**. - -**Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016:** - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -DisableAutoExclusions -``` - -See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. - -**Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016:** - -Use the [**Set** method of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: - -```WMI -DisableAutoExclusions -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) - -## Use wildcards in exclusion lists - -You can use the asterisk **\***, question mark **?**, or environment variables (such as %APPDATA%) as wildcards when defining items in the exclusion lists. - -You cannot use a wildcard in place of a drive letter. - - -The following table describes how the wildcards can be used and provides some examples. - -Wildcard | Use | Example use | Example matches ----|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my-archived-files-43.zip
  • C:\somepath\folder1\folder2\Data
  • .test
-**?** (question mark) | Replaces a single character |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
  • .t\*t
|
  • C:\MyData\my1.zip
  • C:\somepath\P\Data
  • .txt
-Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
  • %APPDATA%\Data\file.png
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
  • C:\Users\username\AppData\Roaming\Data\file.png
- - - -## Validate exclusions lists with the EICAR test file - -You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. - -In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the cmdlet within that path. - -```PowerShell -Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" -``` - -If Windows Defender AV reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). - -You can also use the following PowerShell code, which calls the .NET WebClient class to download the testfile - as with the `Invoke-WebRequest` cmdlet, replace *c:\test.txt* with a file that conforms to the rule you are validating: - -```PowerShell -$client = new-object System.Net.WebClient -$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") -``` - - ## Related topics - [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) From c9520a4595f0eaa08b5fb8644147cc4f3c03606b Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 29 Mar 2017 16:36:17 -0700 Subject: [PATCH 100/165] fixes --- ...s-opened-file-exclusions-windows-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 568800ecf5..313cba68f7 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -38,13 +38,13 @@ For example, you may need to exclude any file that is opened by the process *c:\ You achieve this by adding the location and name of the process to the process exclusion list. When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). -CThe exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Changes made via Group Policy to the exclusion lists **will show** in the lists in the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). However, changes made in the Windows Defender Security Center app **will not show** in the Group Policy lists. You can add, remove, and review the lists for exclusions in [Group Policy](#gp), [System Center Configuration Manager, Microsoft Intune, and with the Windows Defender Security Center app](#man-tools), and you can [use wildcards](#wildcards) to further customize the lists. -You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) and [validating](#validate) your lists. +You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) your lists. By default, local changes made to the lists (by users with administrator privileges) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, Intune, PowerShell, or WMI. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to disable this setting. @@ -202,7 +202,7 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use - + ## Related topics From d129e6c0d8afdf4a8dc94b0258d8650936e314fe Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 29 Mar 2017 17:42:29 -0700 Subject: [PATCH 101/165] seo updates --- ...ed-features-windows-defender-advanced-threat-protection.md | 2 +- ...nsor-status-windows-defender-advanced-threat-protection.md | 4 ++-- ...integration-windows-defender-advanced-threat-protection.md | 2 +- ...t-custom-ti-windows-defender-advanced-threat-protection.md | 2 +- ...hty-sensors-windows-defender-advanced-threat-protection.md | 2 +- ...al-settings-windows-defender-advanced-threat-protection.md | 2 +- ...tigate-user-windows-defender-advanced-threat-protection.md | 4 ++-- ...ew-overview-windows-defender-advanced-threat-protection.md | 2 +- ...ences-setup-windows-defender-advanced-threat-protection.md | 2 +- ...ew-settings-windows-defender-advanced-threat-protection.md | 2 +- ...file-alerts-windows-defender-advanced-threat-protection.md | 4 ++-- ...hine-alerts-windows-defender-advanced-threat-protection.md | 2 +- ...nse-actions-windows-defender-advanced-threat-protection.md | 2 +- ...e-custom-ti-windows-defender-advanced-threat-protection.md | 2 +- 14 files changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md b/windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md index d7678c4832..1bcbb15c46 100644 --- a/windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Turn on advanced features in Windows Defender Advanced Threat Protection +title: Turn on advanced features in Windows Defender ATP description: Turn on advanced features such as block file in Windows Defender Advanced Threat Protection. keywords: advanced features, preferences setup, block file search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md b/windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md index f00f86053f..22861fbaa2 100644 --- a/windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- -title: Check sensor health state in Windows Defender ATP -description: Check sensor health on machines to see if they are misconfigured or inactive. +title: Check the health state of the sensor in Windows Defender ATP +description: Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data. keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communication, communication search.product: eADQiWindows 10XVcnh ms.prod: w10 diff --git a/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md index a645f8ccad..07d789ce14 100644 --- a/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Enable SIEM integration in Windows Defender Advanced Threat Protection +title: Enable SIEM integration in Windows Defender ATP description: Enable SIEM integration to receive alerts in your security information and event management (SIEM) solution. keywords: enable siem connector, siem, connector, security information and events search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md index 670b72a6d5..188403ee49 100644 --- a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Experiment with custom threat intelligence alerts +title: Experiment with custom threat intelligence alerts description: Use this end-to-end guide to start using the Windows Defender ATP threat intelligence API. keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md index 0e7e6fa111..a301137ca4 100644 --- a/windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: Fix unhealthy sensors in Windows Defender ATP -description: Fix machine sensors that are reporting as misconfigured or inactive. +description: Fix machine sensors that are reporting as misconfigured or inactive so that the service receives data from the machine. keywords: misconfigured, inactive, fix sensor, sensor health, no sensor data, sensor data, impaired communication, communication search.product: eADQiWindows 10XVcnh ms.prod: w10 diff --git a/windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md index d53c76fc27..aca26a9b12 100644 --- a/windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: Update general Windows Defender Advanced Threat Protection settings -description: Update your general Windows Defender Advanced Threat Protection settings after onboarding. +description: Update your general Windows Defender Advanced Threat Protection settings such as data retention or industry after onboarding. keywords: general settings, settings, update settings search.product: eADQiWindows 10XVcnh ms.prod: w10 diff --git a/windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md index 276cb49632..e0b1346b9e 100644 --- a/windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- -title: Investigate user account in Windows Defender Advanced Threat Protection -description: Investigate a user account in Windows Defender Advanced Threat Protection for potential compromised credentials or pivot on the associated user account during an investigation. +title: Investigate a user account in Windows Defender ATP +description: Investigate a user account for potential compromised credentials or pivot on the associated user account during an investigation. keywords: investigate, account, user, user entity, alert, windows defender atp search.product: eADQiWindows 10XVcnh ms.prod: w10 diff --git a/windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md index 73f0e86007..4537784b7b 100644 --- a/windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: View and organize the Windows Defender ATP machines list -description: Learn about the available features that you can use from the Machines list such as sorting, filtering, and exporting the machine list which can enhance investigations. +description: Learn about the available features that you can use from the Machines list such as sorting, filtering, and exporting the list to enhance investigations. keywords: sort, filter, export, csv, machine name, domain, last seen, internal IP, health state, active alerts, active malware detections, threat category, review alerts, network, connection, malware, type, password stealer, ransomware, exploit, threat, general malware, unwanted software search.product: eADQiWindows 10XVcnh ms.prod: w10 diff --git a/windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md index 1523930b5c..dab6725222 100644 --- a/windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Defender Advanced Threat Protection preferences settings +title: Configure Windows Defender ATP preferences settings description: Use the preferences setup to configure and update your preferences settings such as enabling advanced features, preview experience, email notifications, or custom threat intelligence. keywords: preferences settings, settings, advanced features, preview experience, email notifications, custom threat intelligence search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md index f1e4b41964..8ae02a81bb 100644 --- a/windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Turn on the preview experience in Windows Defender Advanced Threat Protection +title: Turn on the preview experience in Windows Defender ATP description: Turn on the preview experience in Windows Defender Advanced Threat Protection to try upcoming features. keywords: advanced features, preferences setup, block file search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md index b7812a0ba4..e9d223c9d6 100644 --- a/windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Take response actions on a file in Windows Defender Advanced Threat Protection +title: Take response actions on a file in Windows Defender ATP description: Take response actions on file related alerts by stopping and quarantining a file or blocking a file and checking activity details. keywords: respond, stop and quarantine, block file, deep analysis search.product: eADQiWindows 10XVcnh @@ -85,7 +85,7 @@ You can roll back and remove a file from quarantine if you’ve determined that ``` “%ProgramFiles%\Windows Defender\MpCmdRun.exe” –Restore –Name EUS:Win32/CustomEnterpriseBlock –All ``` - + > [!NOTE] > Windows Defender ATP will remove all files that were quarantined on this machine in the last 30 days. diff --git a/windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md index 0e2b10168f..d0c899983f 100644 --- a/windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Take response actions on a machine in Windows Defender Advanced Threat Protection +title: Take response actions on a machine in Windows Defender ATP description: Take response actions on a machine by isolating machines, collecting an investigation package, and checking activity details. keywords: respond, isolate, isolate machine, collect investigation package, action center search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md b/windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md index 22b507a210..a22e882c62 100644 --- a/windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Take response actions on files and machines in Windows Defender Advanced Threat Protection +title: Take response actions on files and machines in Windows Defender ATP description: Take response actions on files and machines by stopping and quarantining files, blocking a file, isolating machines, or collecting an investigation package. keywords: respond, stop and quarantine, block file, deep analysis, isolate machine, collect investigation package, action center search.product: eADQiWindows 10XVcnh diff --git a/windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md index c155873b90..ba2be9225a 100644 --- a/windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Use the custom threat intelligence API to create custom alerts for your organization +title: Use the custom threat intelligence API to create custom alerts description: Use the threat intelligence API in Windows Defender Advanced Threat Protection to create custom alerts keywords: threat intelligence, alert definitions, indicators of compromise search.product: eADQiWindows 10XVcnh From 122b40ba2c5dc4f204cb5776d46c722f4941f436 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 29 Mar 2017 18:15:14 -0700 Subject: [PATCH 102/165] fix related topics --- ...ing-windows-defender-advanced-threat-protection.md | 4 ++-- ...ght-windows-defender-advanced-threat-protection.md | 3 +-- ...unk-windows-defender-advanced-threat-protection.md | 2 +- ...api-windows-defender-advanced-threat-protection.md | 9 +++++---- ...-ti-windows-defender-advanced-threat-protection.md | 7 ++++--- ...ion-windows-defender-advanced-threat-protection.md | 4 ++-- ...-ti-windows-defender-advanced-threat-protection.md | 10 +++++++++- ...nts-windows-defender-advanced-threat-protection.md | 5 +---- ...ode-windows-defender-advanced-threat-protection.md | 7 ++++--- ...api-windows-defender-advanced-threat-protection.md | 4 ++-- ...ode-windows-defender-advanced-threat-protection.md | 9 +++++---- ...pts-windows-defender-advanced-threat-protection.md | 9 +++++---- ...-ti-windows-defender-advanced-threat-protection.md | 11 ++++++----- 13 files changed, 47 insertions(+), 37 deletions(-) diff --git a/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md index d551629b2e..48a38a9acc 100644 --- a/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md @@ -75,6 +75,6 @@ Portal label | SIEM field name | Description ## Related topics - [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md) -- [Configure Splunk](configure-splunk-windows-defender-advanced-threat-protection.md) -- [Configure ArcSight](configure-arcsight-windows-defender-advanced-threat-protection.md) +- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) - [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md index 21b8b172ec..636c697802 100644 --- a/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md @@ -180,6 +180,5 @@ Windows Defender ATP alerts will appear as discrete events, with "Microsoft” a ## Related topics - [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md) -- [Configure Splunk](configure-splunk-windows-defender-advanced-threat-protection.md) -- [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) +- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) - [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md index f40c7d579d..708ddc8854 100644 --- a/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md @@ -135,6 +135,6 @@ Use the solution explorer to view alerts in Splunk. ## Related topics - [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md) -- [Configure ArcSight](configure-arcsight-windows-defender-advanced-threat-protection.md) +- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) - [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) - [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md b/windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md index 18a8804998..3f71267756 100644 --- a/windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Create threat intelligence using REST API in Windows Defender ATP +title: Create custom alerts using the threat intelligence API description: Create your custom alert definitions and indicators of compromise in Windows Defender ATP using the available APIs in Windows Enterprise, Education, and Pro editions. keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api search.product: eADQiWindows 10XVcnh @@ -389,7 +389,8 @@ The following articles provide detailed code examples that demonstrate how to us ## Related topics - [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -- [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) - [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md index dd97cca65e..da53066333 100644 --- a/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md @@ -41,7 +41,8 @@ You’ll need to use the access token in the Authorization header when doing RES ## Related topics - [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -- [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -- [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) - [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md index 07d789ce14..9c83ea0f99 100644 --- a/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md @@ -49,7 +49,7 @@ Enable security information and event management (SIEM) integration so you can p You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from the Windows Defender ATP portal. ## Related topics -- [Configure Splunk](configure-splunk-windows-defender-advanced-threat-protection.md) -- [Configure ArcSight](configure-arcsight-windows-defender-advanced-threat-protection.md) +- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) - [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) - [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md index 188403ee49..b7f9bce85f 100644 --- a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Experiment with custom threat intelligence alerts +title: Experiment with custom threat intelligence alerts description: Use this end-to-end guide to start using the Windows Defender ATP threat intelligence API. keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api search.product: eADQiWindows 10XVcnh @@ -82,3 +82,11 @@ This step will guide you in exploring the custom alert in the portal. > [!NOTE] > It can take up to 15 minutes for the alert to appear in the portal. + +## Related topics +- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index b8c5694f12..5498802fbb 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -53,10 +53,7 @@ The hardware requirements for Windows Defender ATP on endpoints is the same as t #### Internet connectivity Internet connectivity on endpoints is required. -SENSE can utilize up to 5MB daily of bandwidth to communicate with the Windows Defender ATP cloud service and report cyber data. - -> [!NOTE] -> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. +The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to communicate with the Windows Defender ATP cloud service and report cyber data. For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) . diff --git a/windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md b/windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md index 1e062c51a0..b41b8bdaae 100644 --- a/windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md @@ -71,7 +71,8 @@ You can use the complete code to create calls to the API. ## Related topics - [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -- [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) - [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md b/windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md index 670143cd10..5e04c5302d 100644 --- a/windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md @@ -190,6 +190,6 @@ HTTP error code | Description ## Related topics - [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md) -- [Configure Splunk](configure-splunk-windows-defender-advanced-threat-protection.md) -- [Configure ArcSight](configure-arcsight-windows-defender-advanced-threat-protection.md) +- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) +- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) - [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md b/windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md index fb4e54687b..a67b250923 100644 --- a/windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md @@ -73,8 +73,9 @@ You can use the complete code to create calls to the API. [!code[CustomTIAPI](./code/example.py#L1-L53)] ## Related topics -- [Understand threat intelligence](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -- [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) - [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md index 96e53b49bd..d1968d5761 100644 --- a/windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md @@ -46,8 +46,9 @@ Here is an example of an IOC: IOCs have a many-to-one relationship with alert definitions such that an alert definition can have many IOCs that correspond to it. ## Related topics -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -- [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) - [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index d1a50e1df1..40fc971abf 100644 --- a/windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -46,8 +46,9 @@ If your client secret expires or if you've misplaced the copy provided when you ## Related topics -- [Understand threat intelligence](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -- [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -- [Create custom threat intelligence](custom-ti-api-windows-defender-advanced-threat-protection.md) -- [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -- [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) +- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md) +- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md) +- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md) +- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md) +- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) From 6cea5eb4a8de48b3ec7be93d5ea3e7bfa16b236c Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 29 Mar 2017 18:34:09 -0700 Subject: [PATCH 103/165] toc check, GP, PS, double space, and xref check --- windows/keep-secure/TOC.md | 10 +- ...d-scan-types-windows-defender-antivirus.md | 16 +-- ...-first-sight-windows-defender-antivirus.md | 4 +- ...meout-period-windows-defender-antivirus.md | 4 +- ...e-exclusions-windows-defender-antivirus.md | 2 +- ...cy-overrides-windows-defender-antivirus.md | 28 ++--- ...-connections-windows-defender-antivirus.md | 4 +- ...e-exclusions-windows-defender-antivirus.md | 2 +- ...e-protection-windows-defender-antivirus.md | 4 +- ...-remediation-windows-defender-antivirus.md | 55 +++++--- ...ows-defender-advanced-threat-protection.md | 2 +- ...anage-report-windows-defender-antivirus.md | 9 +- .../deploy-windows-defender-antivirus.md | 2 +- ...ployment-vdi-windows-defender-antivirus.md | 6 +- ...nwanted-apps-windows-defender-antivirus.md | 4 +- ...d-protection-windows-defender-antivirus.md | 8 +- .../evaluate-windows-defender-antivirus.md | 4 +- ...ased-updates-windows-defender-antivirus.md | 10 +- ...ed-endpoints-windows-defender-antivirus.md | 16 ++- ...ate-schedule-windows-defender-antivirus.md | 10 +- ...tion-updates-windows-defender-antivirus.md | 9 +- ...scan-results-windows-defender-antivirus.md | 4 +- .../run-scan-windows-defender-antivirus.md | 2 +- ...tch-up-scans-windows-defender-antivirus.md | 2 +- ...ection-level-windows-defender-antivirus.md | 6 +- ...troubleshoot-windows-defender-antivirus.md | 4 +- ...group-policy-windows-defender-antivirus.md | 118 +++++++++++++++++- ...indows-defender-antivirus-compatibility.md | 43 +++++++ ...indows-defender-antivirus-in-windows-10.md | 44 ++++--- ...dows-defender-security-center-antivirus.md | 4 +- 30 files changed, 317 insertions(+), 119 deletions(-) create mode 100644 windows/keep-secure/windows-defender-antivirus-compatibility.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 19906d18bc..20ab6d7c93 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -802,9 +802,12 @@ #### [Troubleshoot Windows Defender ATP](troubleshoot-windows-defender-advanced-threat-protection.md) #### [Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) #### [Windows Defender Antivirus compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md) + + ### [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) #### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md) #### [Windows Defender Antivirus on Windows Server](windows-defender-antivirus-on-windows-server-2016.md) +#### [Windows Defender Antivirus and Advanced Threat Protection: Better together](windows-defender-antivirus-compatibility.md) #### [Evaluate Windows Defender Antivirus protection](evaluate-windows-defender-antivirus.md) #### [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) ##### [Deploy and enable Windows Defender Antivirus](deploy-windows-defender-antivirus.md) @@ -831,8 +834,11 @@ ###### [Prevent users from seeing or interacting with the user interface](prevent-end-user-interaction-windows-defender-antivirus.md) ###### [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) #### [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Exclude files and processes from scans](configure-exclusions-windows-defender-antivirus.md) -##### [Configure email, removable storage, network, reparse point, and archive scanning](configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure exclusions in Windows Defender AV on Windows Server 2016](configure-server-exclusions-windows-defender-antivirus.md) +##### [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) ##### [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) ##### [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) ##### [Configure and run scans](run-scan-windows-defender-antivirus.md) diff --git a/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md b/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md index 9217a21aa0..1f2fa78b86 100644 --- a/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md @@ -47,7 +47,7 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use For using WMI classes, see [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx). -Description | GP location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class +Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class ---|---|---|--- See [Email scanning limitations](#ref1)) below | Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning` Scan [reparse points](https://msdn.microsoft.com/library/windows/desktop/aa365503.aspx) | Scan > Turn on reparse point scanning | Disabled | `-DisableRestorePoint` @@ -75,16 +75,16 @@ See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune: Scan ### Email scanning limitations -Enabling email scanning will cause Windows Defender AV to scan emails during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: +We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware. + +Always-on protection scans emails as they arrive and as they are manipulated, just like normal files in the operating system. This provides the strongest form of protection and is the recommended method for scanning emails. + +You can use this Group Policy to also enable scanning of older email files used by Outlook 2003 and older during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: - DBX - MBX - MIME ->[!WARNING] -> Is this true - can it scan Outlook 2013/ 2016? -> "Windows Defender scans Microsoft Office Outlook 2003 and older email files." - -You can configure Windows Defender to scan PST files used by Outlook 2003 or older versions (where the archive type is set to non-uni-code), but Windows Defender cannot remediate threats detected inside PST files. We recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware. +PST files used by Outlook 2003 or older (where the archive type is set to non-uni-code) can also be scanned, but Windows Defender cannot remediate threats detected inside PST files. This is another reason why we recommend using [always-on real-time protection](configure-real-time-protection-windows-defender-antivirus.md) to protect against email-based malware. If Windows Defender detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat: - Email subject @@ -97,7 +97,7 @@ If Windows Defender detects a threat inside an email, it will show you the follo ## Related topics -- [Customize,initiate,andreviewtheresultsofWindowsDefenderAVscansandremediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md) - [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md b/windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md index 7bd0777196..0321537068 100644 --- a/windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md @@ -135,7 +135,7 @@ You may choose to disable the Block at First Sight feature if you want to retain 5. Expand the tree through **Windows components > Windows Defender Antivirus > MAPS**. -1. Double-click the **Configure the Block at First Sight feature** setting and set the option to **Disabled**. +1. Double-click the **Configure the 'Block at First Sight' feature** setting and set the option to **Disabled**. > [!NOTE] > Disabling the Block at First Sight feature will not disable or alter the pre-requisite group policies. @@ -143,7 +143,7 @@ You may choose to disable the Block at First Sight feature if you want to retain ## Related topics -- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) +- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) diff --git a/windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md b/windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md index 8846515965..ab5f73d845 100644 --- a/windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md @@ -57,14 +57,14 @@ You can use Group Policy to specify an extended timeout for cloud checks. 4. Expand the tree to **Windows components > Windows Defender Antivirus > MpEngine** -5. Double-click the **Configure extended cloud check** setting and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. +5. Double-click the **Configure extended cloud check** setting and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. 6. Click **OK**. ## Related topics -- [Windows Defender in Windows 10](windows-defender-in-windows-10.md) +- [Windows Defender in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) - [Configure the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md index 9a81b2214f..ebc0cbd396 100644 --- a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -201,7 +201,7 @@ Environment variables | The defined variable will be populated as a path when th -### Review the list of exclusions +## Review the list of exclusions You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). diff --git a/windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md b/windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md index 6e7a6b7927..58d8075e0c 100644 --- a/windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md @@ -53,21 +53,21 @@ To configure these settings: 7. Deploy the Group Policy Object as usual. -Location | Setting | Impact if **Enabled** | Configuration topic +Location | Setting | Configuration topic ---|---|---|--- -MAPS | Configure local setting override for reporting to Microsoft MAPS | User can disable cloud protection | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) -Quarantine | Configure local setting override for the removal of items from Quarantine folder | User can change the number of days threats are kept in the quarantine folder before being removed |[Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring file and program activity on your computer | User can disable real-time protection | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | User can change direction for file activity monitoring | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for scanning all downloaded files and attachments | Allow user to disable scans of downloaded files and attachments | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override for turn on behavior monitoring | User | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Real-time protection | Configure local setting override to turn on real-time protection | xxx | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) -Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | xxx | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) -Scan | Configure local setting override for maximum percentage of CPU utilization | xxx | [Configure and run scans](run-scan-windows-defender-antivirus.md) -Scan | Configure local setting override for schedule scan day | xxx | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) -Scan | Configure local setting override for scheduled quick scan time | xxx | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) -Scan | Configure local setting override for scheduled scan time | xxx | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) -Scan | Configure local setting override for the scan type to use for a scheduled scan | xxx | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +MAPS | Configure local setting override for reporting to Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) +Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Windows Defender AV always-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) +Scan | Configure local setting override for maximum percentage of CPU utilization | [Configure and run scans](run-scan-windows-defender-antivirus.md) +Scan | Configure local setting override for schedule scan day | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Configure local setting override for scheduled quick scan time | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Configure local setting override for scheduled scan time | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Configure local setting override for the scan type to use for a scheduled scan | [Configure scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md) diff --git a/windows/keep-secure/configure-network-connections-windows-defender-antivirus.md b/windows/keep-secure/configure-network-connections-windows-defender-antivirus.md index 4bba9f4ec2..21303b1d7c 100644 --- a/windows/keep-secure/configure-network-connections-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-network-connections-windows-defender-antivirus.md @@ -191,9 +191,7 @@ The Windows event log will also show [Windows Defender client event ID 2050](tro ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-in-windows-10.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) - [Run a Windows Defender scan from the command line](command-line-arguments-windows-defender-antivirus.md) and [Command line arguments](command-line-arguments-windows-defender-antivirus.md) - [Important changes to Microsoft Active Protection Services endpoint](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/important-changes-to-microsoft-active-protection-service-maps-endpoint/) - - diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 313cba68f7..4e972c4578 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -165,7 +165,7 @@ Environment variables | The defined variable will be populated as a path when th -### Review the list of exclusions +## Review the list of exclusions You can retrieve the items in the exclusion list with PowerShell, [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune), or the [Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions). diff --git a/windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md b/windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md index edaa9c351d..6b0d0a8a25 100644 --- a/windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md @@ -42,7 +42,7 @@ These activities include events such as processes making unusual changes to exis ## Configure and enable always-on protection -You can configure how always-on protection works with the following Group Policy settings described in this section. +You can configure how always-on protection works with the Group Policy settings described in this section. To configure these settings: @@ -69,6 +69,8 @@ Real-time protection | Turn on raw volume write notifications | Information abou Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes | Enabled Real-time protection | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Note that fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. Scan | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the AV engine is asked to detect the activity | Enabled (both directions) +Root | Allow antimalware service to startup with normal priority | You can lower the priority of the AV engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled +Root | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Windows Defender AV to still run. This lowers the protection on the endpoint. | Disabled diff --git a/windows/keep-secure/configure-remediation-windows-defender-antivirus.md b/windows/keep-secure/configure-remediation-windows-defender-antivirus.md index 6e3c6cb619..ea6dd93746 100644 --- a/windows/keep-secure/configure-remediation-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-remediation-windows-defender-antivirus.md @@ -1,7 +1,7 @@ --- title: Remediate and resolve infections detected by Windows Defender AV description: Configure what Windows Defender AV should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder -keywords: +keywords: remediation, fix, remove, threats, quarantine, scan, restore search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -31,24 +31,47 @@ author: iaanw - Windows Management Instrumentation (WMI) - Microsoft Intune +When Windows Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Windows Defender AV should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats. + +This topic describes how to configure these settings with Group Policy, but you can also use [System Center Configuration Manager](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings) and [Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#choose-default-actions-settings). + +You can also use the [`Set-MpPreference` PowerShell cmdlet](https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference) or [`MSFT_MpPreference` WMI class](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) to configure these settings. + +## Configure remediation options + +You can configure how remediation with the Group Policy settings described in this section. + +To configure these settings: + +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor** go to **Computer configuration**. + +4. Click **Policies** then **Administrative templates**. + +5. Expand the tree to **Windows components > Windows Defender Antivirus** and then the **Location** specified in the table below. + +6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. -Main | Allow antimalware service to startup with normal priority -Main | Allow antimalware service to remain running always -Scan | Create a system restore point - -Main | Turn off routine remediation -Quarantine | Configure removal of items from Quarantine folder -Scan | Turn on removal of items from scan history folder +Location | Setting | Description | Default setting (if not configured) +---|---|---|--- +Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled +Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days +Root | Turn off routine remediation | You can specify whether Windows Defender AV automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) +Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | Never removed +Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Windows Defender AV is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable +Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable +Also see the [Configure remediation-required scheduled full scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) topic for more remediation-related settings. +## Related topics - -[Configure remediation-required scheduled full scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md#remed) - -Threats | Specify threat alert levels at which default action should not be taken when detected -Threats | Specify threats upon which default action should not be taken when detected - -https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings -https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#choose-default-actions-settings \ No newline at end of file +- [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +- [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +- [Configure and run on-demand Windows Defender AV scans](run-scan-windows-defender-antivirus.md) +- [Configure the notifications that appear on endpoints](configure-notifications-windows-defender-antivirus.md) +- [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md index de668b5c69..314ccc9c79 100644 --- a/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md @@ -30,4 +30,4 @@ Windows Defender Antivirus will continue to receive updates, and the *mspeng.exe The Windows Defender Antivirus interface will be disabled, and users on the endpoint will not be able to use Windows Defender Antivirus to perform on-demand scans or configure most options. -For more information, see the **Compatibility** section in the [Windows Defender Antivirus in Windows 10 topic](windows-defender-in-windows-10.md). +For more information, see the [Windows Defender Antivirus and Windows Defender ATP compatibility topic](windows-defender-antivirus-compatibility.md). diff --git a/windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md b/windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md index d2905c2bab..56578ebbbb 100644 --- a/windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md +++ b/windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md @@ -45,11 +45,11 @@ PowerShell|Deploy with Group Policy, System Center Configuration Manager, or man Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Windows Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Windows Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Security Center](https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/en-us/powershell/servicemanagement/azure.antimalware/v3.4.0/azure.antimalware) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Windows Defender Antivirus events][] and add that tool as an app in AAD. -1. The availability of some functions and features, especially related to cloud-delivered protection, differ between System Center Configuration Manager, current branch (for example, System Center Configuration Manager 2016) and System Center Configuration Manager 2012. In this library, we've focused on Windows 10, Windows Server 2016, and System Center Configuration Manager, current branch (2016). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for a table that describes the major differences. [(Return to table)](#ref1) +1. The availability of some functions and features, especially related to cloud-delivered protection, differ between System Center Configuration Manager, current branch (for example, System Center Configuration Manager 2016) and System Center Configuration Manager 2012. In this library, we've focused on Windows 10, Windows Server 2016, and System Center Configuration Manager, current branch (2016). See the [Utilize Microsoft cloud-provided protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) topic for a table that describes the major differences. [(Return to table)](#ref1) -1. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Windows Defender Antivirus features](configure-notifications-windows-defender-antivirus.md) section in this library. [(Return to table)](#ref2) +1. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Windows Defender Antivirus features](configure-notifications-windows-defender-antivirus.md) section in this library. [(Return to table)](#ref2) -1. In Windows 10, Windows Defender Antivirus is a component available without installation or deployment of an additional client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date ([except on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md). Traditional deployment therefore is not required. Deployment here refers to ensuring the Windows Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref3) +1. In Windows 10, Windows Defender Antivirus is a component available without installation or deployment of an additional client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date ([except on Windows Server 2016](windows-defender-antivirus-on-windows-server-2016.md). Traditional deployment therefore is not required. Deployment here refers to ensuring the Windows Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref3) @@ -88,7 +88,4 @@ Topic | Description [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) | There are two parts to updating Windows Defender Antivirus: updating the client on endpoints (product updates), and updating definitions (protection updates). You can update definitions in a number of ways, using System Center Configuration Manager, Group Policy, PowerShell, and WMI. [Monitor and report on Windows Defender Antivirus protection](report-monitor-windows-defender-antivirus.md) | You can use System Center Configuration Manager, a third-party SIEM product (by consuming Windows event logs), or Microsoft Intune to monitor protection status and create reports about endpoint protection -## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-in-windows-10.md) -- [Configure Windows Defender Antivirus features](configure-windows-defender-antivirus-features.md) diff --git a/windows/keep-secure/deploy-windows-defender-antivirus.md b/windows/keep-secure/deploy-windows-defender-antivirus.md index 6f98f62d52..f81ce50c65 100644 --- a/windows/keep-secure/deploy-windows-defender-antivirus.md +++ b/windows/keep-secure/deploy-windows-defender-antivirus.md @@ -35,6 +35,6 @@ The remaining topic in this section provides end-to-end advice and best practice ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-in-windows-10.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Deployment guide for Windows Defender Antivirus in a virtual desktop infrasructure (VDI) environment](deployment-vdi-windows-defender-antivirus.md) \ No newline at end of file diff --git a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md index 100bffd5f8..11bd032d6e 100644 --- a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md +++ b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md @@ -85,7 +85,7 @@ You can run a quick scan [from the command line](command-line-arguments-windows- ### Deploy the base image -You’ll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs. +You'll then need to deploy the base image across your VDI. For example, you can create or clone a VHD from your base image, and then use that VHD when you create or start your VMs. The following references provide ways you can create and deploy the base image across your VDI: @@ -152,7 +152,7 @@ Scheduled scans run in addition to [real-time protection and scanning](configure The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. - + **Use Group Policy to randomize scheduled scan start times:** @@ -229,7 +229,7 @@ Sometimes, Windows Defender AV notifications may be sent to or persist across mu ### Disable scans after an update -This setting will prevent a scan from occurring after receiving an update. You can apply this when creating the base image if you have also run a quick scan. This prevents the newly updated VM from performing a scan again (as you’ve already scanned it when you created the base image). +This setting will prevent a scan from occurring after receiving an update. You can apply this when creating the base image if you have also run a quick scan. This prevents the newly updated VM from performing a scan again (as you've already scanned it when you created the base image). >[!IMPORTANT] >Running scans after an update will help ensure your VMs are protected with the latest definition updates. Disabling this option will reduce the protection level of your VMs and should only be used when first creating or deploying the base image. diff --git a/windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index 30d7011a23..296bbd7013 100644 --- a/windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -46,7 +46,7 @@ PUAs are blocked when a user attempts to download or install the detected file, - The file is in the %downloads% folder - The file is in the %temp% folder -The file is placed in the quarantine section so it won’t run. +The file is placed in the quarantine section so it won't run. When a PUA is detected on an endpoint, the endpoint will present a notification to the user ([unless notifications have been disabled](configure-notifications-windows-defender-antivirus.md)) in the same format as normal threat detections (prefaced with "PUA:"). @@ -66,7 +66,7 @@ You can enable the PUA protection feature with System Center Configuration Manag You can also use the PUA audit mode to detect PUA without blocking them. The detections will be captured in the Windows event log. -This feature is useful if your company is conducting an internal software security compliance check and you’d like to avoid any false positives. +This feature is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. **Use Configuration Manager to configure the PUA protection feature:** diff --git a/windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md b/windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md index ddb0ce57ac..abdb360aef 100644 --- a/windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md @@ -127,7 +127,7 @@ See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](http **Enable cloud-delivered protection on individual clients with the Windows Defender Security Center app** > [!NOTE] -> If the **Configure local setting override for reporting Microsoft MAPS** GP setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. +> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -139,15 +139,15 @@ See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](http 3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. >[!NOTE] ->If automatic sample submission has been configured with GP then the setting will be greyed-out and unavailble. +>If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailble. ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-in-windows-10.md) - [Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md) - [Configure the block at first sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) - [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)] - [Defender cmdlets](https://technet.microsoft.com/en-us/library/dn433280.aspx) - [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -- [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) \ No newline at end of file +- [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) +- - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/evaluate-windows-defender-antivirus.md b/windows/keep-secure/evaluate-windows-defender-antivirus.md index af84e29eb5..4f51b16a7a 100644 --- a/windows/keep-secure/evaluate-windows-defender-antivirus.md +++ b/windows/keep-secure/evaluate-windows-defender-antivirus.md @@ -24,7 +24,7 @@ author: iaanw - Enterprise security administrators -If youre an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection. +If you're an enterprise security administrator, and you want to determine how well Windows Defender Antivirus protects you from viruses, malware, and potentially unwanted applications, then you can use this guide to help you evaluate Microsoft protection. It explains the important features available for both small and large enterprises in Windows Defender, and how they will increase malware detection and protection across your network. @@ -44,7 +44,7 @@ You can also download a PowerShell that will enable all the settings described i ## Related topics -- [Windows Defender Antivirus](windows-defender-in-windows-10.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Deploy, manage, and report](deploy-manage-report-windows-defender-antivirus.md) diff --git a/windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md b/windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md index 39ecd14409..e1142eb8e3 100644 --- a/windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md +++ b/windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md @@ -124,7 +124,7 @@ You can also use Group Policy, PowerShell, or WMI to configure Windows Defender **Use PowerShell cmdlets to download updates when Windows Defender AV is not present:** -Use the following cmdlets to enable cloud-delivered protection: +Use the following cmdlets: ```PowerShell Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine @@ -171,9 +171,13 @@ If you have enabled cloud-delivered protection, Windows Defender AV will send fi ## Related topics +- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) +- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md index 87b9ad4cbd..7228604795 100644 --- a/windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md @@ -56,7 +56,7 @@ If Windows Defender AV did not download protection updates for a specified perio **Use PowerShell cmdlets to configure catch-up protection updates:** -Use the following cmdlets to enable cloud-delivered protection: +Use the following cmdlets: ```PowerShell Set-MpPreference -SignatureUpdateCatchupInterval @@ -145,11 +145,11 @@ This feature can be enabled for both full and quick scans. 4. Enter the number of scans that can be missed before a scan will be automatically run when the user next logs on to the PC. The type of scan that is run is determined by the **Specify the scan type to use for a scheduled scan** (see the [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) topic). Click **OK**. > [!NOTE] -> The GP setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run. +> The Group Policy setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run. -**Use PowerShell cmdlets to XX:** +**Use PowerShell cmdlets to configure catch-up scans:** -Use the following cmdlets to enable cloud-delivered protection: +Use the following cmdlets: ```PowerShell Set-MpPreference -DisableCatchupFullScan @@ -185,6 +185,10 @@ See the following for more information and allowed parameters: ## Related topics +- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) +- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md b/windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md index 8112758cdd..28197fc0c6 100644 --- a/windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md +++ b/windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md @@ -74,7 +74,7 @@ You can also randomize the times when each endpoint checks and downloads protect **Use PowerShell cmdlets to schedule protection updates:** -Use the following cmdlets to enable cloud-delivered protection: +Use the following cmdlets: ```PowerShell Set-MpPreference -SignatureScheduleDay @@ -100,9 +100,13 @@ See the following for more information and allowed parameters: ## Related topics +- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) - [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) -- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) +- [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md b/windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md index 00e332bca1..a9cc36fc65 100644 --- a/windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md @@ -131,6 +131,11 @@ See the following for more information: ## Related topics +- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) +- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) +- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +- [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) -- [Update and manage Windows Defender in Windows 10](get-started-with-windows-defender-for-windows-10.md) -- [Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-in-windows-10.md) diff --git a/windows/keep-secure/review-scan-results-windows-defender-antivirus.md b/windows/keep-secure/review-scan-results-windows-defender-antivirus.md index a2b534e2b7..aa7ec15eef 100644 --- a/windows/keep-secure/review-scan-results-windows-defender-antivirus.md +++ b/windows/keep-secure/review-scan-results-windows-defender-antivirus.md @@ -40,7 +40,7 @@ After Windows Defender Antivirus has completed a scan, whether it is an [on-dema See [How to monitor Endpoint Protection status](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection). -**Use the Windows Defender Security app to review Windows Defender AV scan results:** +**Use the Windows Defender Security Center app to review Windows Defender AV scan results:** 1. Open the Windows Defender Security Center by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -87,5 +87,5 @@ See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune: Moni ## Related topics -- [Customize,initiate,andreviewtheresultsofWindowsDefenderAVscansandremediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) +- [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/run-scan-windows-defender-antivirus.md b/windows/keep-secure/run-scan-windows-defender-antivirus.md index c2432a6ac2..f494c10f93 100644 --- a/windows/keep-secure/run-scan-windows-defender-antivirus.md +++ b/windows/keep-secure/run-scan-windows-defender-antivirus.md @@ -59,7 +59,7 @@ mpcmdrun.exe -scan -scantype 1 -See [Usethempcmdrun.execommandlinetooltoconfigureandmanageWindowsDefenderAntivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the tool and additional parameters, including starting a full scan or defining paths. +See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the tool and additional parameters, including starting a full scan or defining paths. diff --git a/windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md index 098ab1250c..50ca1d5359 100644 --- a/windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -82,7 +82,7 @@ Location | Setting | Description | Default setting (if not configured) Scan | Specify the scan type to use for a scheduled scan | Quick scan Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am) | 2 am -Main | Randomize scheduled task times | Randomize the start time of the scan to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments | Enabled +Root | Randomize scheduled task times | Randomize the start time of the scan to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments | Enabled **Use PowerShell cmdlets to schedule scans:** diff --git a/windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md b/windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md index 923b49d30a..321924a398 100644 --- a/windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md +++ b/windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md @@ -40,7 +40,7 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration**. +3. In the **Group Policy Management Editor** go to **Computer configuration**. 4. Click **Policies** then **Administrative templates**. @@ -48,7 +48,7 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi 1. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: 1. Setting to **Default Windows Defender Antivirus blocking level** will provide strong detection without increasing the risk of detecting legitimate files. - 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection). + 2. Setting to **High blocking level** will apply a strong level of detection. While unlikely, some legitimate files may be detected (although you will have the option to unblock or dispute that detection). 1. Click **OK**. @@ -62,7 +62,7 @@ You can specify the level of cloud-protection offered by Windows Defender Antivi ## Related topics -- [Windows Defender Antivirus in Windows 10](windows-defender-in-windows-10.md) +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) - [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) - [How to create and deploy antimalware policies: Cloud-protection service](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) diff --git a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md index 0006cde7b3..eabca9e983 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md +++ b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md @@ -2283,9 +2283,9 @@ Description of the error.

User action:

-

You should restart the system then run a full scan because it’s possible the system was not protected for some time. +

You should restart the system then run a full scan because it's possible the system was not protected for some time.

-

The Windows Defender client’s real-time protection feature encountered an error because one of the services failed to start. +

The Windows Defender client's real-time protection feature encountered an error because one of the services failed to start.

If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure.

diff --git a/windows/keep-secure/use-group-policy-windows-defender-antivirus.md b/windows/keep-secure/use-group-policy-windows-defender-antivirus.md index 3402536f1f..b9a28ec92a 100644 --- a/windows/keep-secure/use-group-policy-windows-defender-antivirus.md +++ b/windows/keep-secure/use-group-policy-windows-defender-antivirus.md @@ -18,11 +18,7 @@ author: iaanw - Windows 10, version 1703 -You can use [Group Policy](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx) to configure and manage Windows Defender AV on your endpoints. - - +You can use [Group Policy](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx) to configure and manage Windows Defender Antivirus on your endpoints. In general, you can use the following procedure to configure or change Windows Defender AV group policy settings: @@ -34,10 +30,120 @@ In general, you can use the following procedure to configure or change Windows D 5. Expand the tree to **Windows components > Windows Defender Antivirus**. -6. Expand the section that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. +6. Expand the section (referred to as **Location** in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. 7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/en-us/library/ee663280(v=vs.85).aspx). +The following table in this topic lists the Group Policy settings available in Windows 10, version 1703, and provides links to the appropriate topic in this documentation library (where applicable). + + +Location | Setting | Documented in topic +---|---|--- +Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) +Client interface | Display additional text to clients when they need to perform an action | [Configurethenotificationsthatappearonendpoints](configure-notifications-windows-defender-antivirus.md) +Client interface | Suppress all notifications | [Configurethenotificationsthatappearonendpoints](configure-notifications-windows-defender-antivirus.md) +Client interface | Suppresses reboot notifications | [Configurethenotificationsthatappearonendpoints](configure-notifications-windows-defender-antivirus.md) +Exclusions | Extension Exclusions | [ConfigureandvalidateexclusionsinWindowsDefenderAVscans](configure-exclusions-windows-defender-antivirus.md) +Exclusions | Path Exclusions | [ConfigureandvalidateexclusionsinWindowsDefenderAVscans](configure-exclusions-windows-defender-antivirus.md) +Exclusions | Process Exclusions | [ConfigureandvalidateexclusionsinWindowsDefenderAVscans](configure-exclusions-windows-defender-antivirus.md) +Exclusions | Turn off Auto Exclusions | [ConfigureandvalidateexclusionsinWindowsDefenderAVscans](configure-exclusions-windows-defender-antivirus.md) +MAPS | Configure the 'Block at First Sight' feature | [Enable the Block at First Sight feature](configure-block-at-first-sight-windows-defender-antivirus.md) +MAPS | Join Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) +MAPS | Send file samples when further analysis is required | [Enable cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) +MAPS | Configure local setting override for reporting to Microsoft MAPS | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +MpEngine | Configure extended cloud check | [Configure the cloud block timeout period](configure-cloud-block-timeout-period-windows-defender-antivirus.md) +MpEngine | Select cloud protection level | [Specify the cloud-delivered protection level](specify-cloud-protection-level-windows-defender-antivirus.md) +Network inspection system | Specify additional definition sets for network traffic inspection | Not used +Network inspection system | Turn on definition retirement | Not used +Network inspection system | Turn on protocol recognition | Not used +Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Quarantine | Configure removal of items from Quarantine folder | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Real-time protection | Configure local setting override for turn on behavior monitoring | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Real-time protection | Configure local setting override to turn on real-time protection | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Monitor file and program activity on your computer | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Scan all downloaded files and attachments | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Turn off real-time protection | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Turn on behavior monitoring | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Turn on process scanning whenever real-time protection is enabled | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Turn on raw volume write notifications | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Real-time protection | Configure monitoring for incoming and outgoing file and program activity | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Remediation | Specify the time of day to run a scheduled full scan to complete remediation | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Reporting | Configure Watson events | Not used +Reporting | Configure Windows software trace preprocessor components | Not used +Reporting | Configure WPP tracing level | Not used +Reporting | Configure time out for detections in critically failed state | Not used +Reporting | Configure time out for detections in non-critical failed state | Not used +Reporting | Configure time out for detections in recently remediated state | Not used +Reporting | Configure time out for detections requiring additional action | Not used +Reporting | Turn off enhanced notifications | [Configurethenotificationsthatappearonendpoints](configure-notifications-windows-defender-antivirus.md) +Root | Turn off Windows Defender Antivirus | Not used +Root | Define addresses to bypass proxy server | Not used +Root | Define proxy auto-config (.pac) for connecting to the network | Not used +Root | Define proxy server for connecting to the network | Not used +Root | Configure local administrator merge behavior for lists | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Root | Allow antimalware service to startup with normal priority | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Root | Allow antimalware service to remain running always | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Root | Turn off routine remediation | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Root | Randomize scheduled task times | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Allow users to pause scan | [Prevent users from seeing or interacting with the Windows Defender AV user interface](prevent-end-user-interaction-windows-defender-antivirus.md) +Scan | Check for the latest virus and spyware definitions before running a scheduled scan | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Scan | Define the number of days after which a catch-up scan is forced | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Scan | Turn on catch up full scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Scan | Turn on catch up quick scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Scan | Configure local setting override for maximum percentage of CPU utilization | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Scan | Configure local setting override for schedule scan day | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Scan | Configure local setting override for scheduled quick scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Scan | Configure local setting override for scheduled scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Scan | Configure local setting override for the scan type to use for a scheduled scan | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) +Scan | Create a system restore point | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Scan | Turn on removal of items from scan history folder | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Scan | Turn on heuristics | [EnableandconfigureWindowsDefenderAValways-on protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md) +Scan | Turn on e-mail scanning | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Turn on reparse point scanning | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Run full scan on mapped network drives | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Scan archive files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Scan network files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Scan packed executables | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Scan removable drives | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Specify the maximum depth to scan archive files | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Specify the maximum percentage of CPU utilization during a scan | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Specify the maximum size of archive files to be scanned | [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-windows-defender-antivirus.md) +Scan | Specify the day of the week to run a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Specify the interval to run quick scans per day | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Specify the scan type to use for a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Specify the time for a daily quick scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Specify the time of day to run a scheduled scan | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Signature updates | Allow definition updates from Microsoft Update | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +Signature updates | Allow definition updates when running on battery power | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +Signature updates | Allow notifications to disable definitions based repots to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Signature updates | Allow real-time definition updates based on reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Signature updates | Check for the latest virus and spyware definitions on startup | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Signature updates | Define file shares for downloading definition updates | [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +Signature updates | Define the number of days after which a catch up definition update is required | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Signature updates | Define the number of days before spyware definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Signature updates | Define the number of days before virus definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) +Signature updates | Define the order of sources for downloading definition updates | [Manage Windows Defender Antivirus protection and definition updates](manage-protection-updates-windows-defender-antivirus.md) +Signature updates | Initiate definition update on startup | [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) +Signature updates | Specify the day of the week to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +Signature updates | Specify the interval to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +Signature updates | Specify the time to check for definition updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) +Signature updates | Turn on scan after signature update | [Configure scheduled scans for Windows Defender AV](scheduled-catch-up-scans-windows-defender-antivirus.md) +Threats | Specify threat alert levels at which default action should not be taken when detected | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) +Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Windows Defender AV scans](configure-remediation-windows-defender-antivirus.md) + + + + + + + ## Related topics - [Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md) diff --git a/windows/keep-secure/windows-defender-antivirus-compatibility.md b/windows/keep-secure/windows-defender-antivirus-compatibility.md new file mode 100644 index 0000000000..23e1a82978 --- /dev/null +++ b/windows/keep-secure/windows-defender-antivirus-compatibility.md @@ -0,0 +1,43 @@ +--- +title: Windows Defender Antivirus and Windows Defender ATP +description: Windows Defender AV and Windows Defender ATP work together to provide threat detection, remediation, and investigation. +keywords: windows defender, atp, advanced threat protection, compatibility, passive mode +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: medium +author: iaanw +--- + + +# Windows Defender Antivirus and Advanced Threat Protection: Better together + + +**Applies to:** + +- Windows 10 + +**Audience** + +- Enterprise security administrators + + + +Windows Defender Advanced Threat Protection (ATP) is an additional service beyond Windows Defender Antivirus that helps enterprises detect, investigate, and respond to advanced persistent threats on their network. +See the [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) topics for more information about the service. + +If you are enrolled in Windows Defender ATP, and you are not using Windows Defender AV as your real-time protection service on your endpoints, Windows Defender will automatically enter into a passive mode. On Windows Server 2016 SKUs, Windows Defender AV will not enter into the passive mode and will run alongisde your other antivirus product. + +In passive mode, Windows Defender will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won't run, and Windows Defender will not provide real-time protection from malware. + +You can still [manage updates for Windows Defender](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. + +If you uninstall the other product, and choose to use Windows Defender to provide protection to your endpoints, Windows Defender will automatically return to its normal active mode. + + +## Related topics + +- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md index f319c7029d..243eb9a1c3 100644 --- a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md +++ b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md @@ -22,6 +22,22 @@ This library of documentation is aimed for enterprise security administrators wh For more important information about running Windows Defender on a server platform, see [Windows Defender Overview for Windows Server](https://technet.microsoft.com/library/dn765478.aspx). +Windows Defender AV can be managed with: +- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP) +- Microsoft Intune + +It can be configured with: +- System Center Configuration Manager (as System Center Endpoint Protection, or SCEP) +- Microsoft Intune +- PowerShell +- Windows Management Instrumentation (WMI) +- Group Policy + +Some of the highlights of Windows Defender AV include: +- [Cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) for near-instant detection and blocking of new and emerging threats +- [Always-on scanning](configure-real-time-protection-windows-defender-antivirus.md), using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection") +- [Dedicated protection updates](manage-updates-baselines-windows-defender-antivirus.md) based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research + ## What's new in Windows 10, version 1703 New features for Windows Defender AV in Windows 10, version 1703 include: @@ -35,6 +51,8 @@ We've expanded this documentation library to cover end-to-end deployment, manage See the [In this library](#in-this-library) list at the end of this topic for links to each of the updated sections in this library. + + ## Minimum system requirements @@ -47,19 +65,7 @@ Some features require a certain version of Windows 10 - the minimum version requ Functionality, configuration, and management is largely the same when using Windows Defender Antivirus on Windows Server 2016, however [there are some differences](windows-defender-antivirus-on-windows-server-2016.md). -## Compatibility with Windows Defender Advanced Threat Protection - -Windows Defender Advanced Threat Protection (ATP) is an additional service that helps enterprises to detect, investigate, and respond to advanced persistent threats on their network. - -See the [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) topics for more information about the service. - -If you are enrolled in Windows Defender ATP, and you are not using Windows Defender AV as your real-time protection service on your endpoints, Windows Defender will automatically enter into a passive mode. On Windows Server 2016 SKUs, Windows Defender AV will not enter into the passive mode and will run alongisde your other antivirus product. - -In passive mode, Windows Defender will continue to run (using the *msmpeng.exe* process), and will continue to be updated, however there will be no Windows Defender user interface, scheduled scans won’t run, and Windows Defender will not provide real-time protection from malware. - -You can still [manage updates for Windows Defender](manage-updates-baselines-windows-defender-antivirus.md), however you can't move Windows Defender into the normal active mode if your endpoints have an up-to-date third-party product providing real-time protection from malware. - -If you uninstall the other product, and choose to use Windows Defender to provide protection to your endpoints, Windows Defender will automatically return to its normal active mode. +# @@ -67,10 +73,10 @@ If you uninstall the other product, and choose to use Windows Defender to provid Topic | Description :---|:--- -[Evaluate Windows Defender Antivirus protection](evaluate-windows-defender-antivirus.md) | Evaluate the protection capabilities of Windows Defender Antivirus with a specialized evaluation guide and powershell script. -[Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) | While traditional client deployment is not required for Windows Defender AV, you will need to enable the service. You can also manage how protection and product updates are applies, and receive reports from Configuration Manager, Intune, and with some security information and event monitoring (SIEM) tools. -[Configure Windows Defender features](configure-windows-defender-antivirus-features.md) | Windows Defender AV has a large set of configurable features and options. You can use a number of management tools, including Group Policy, System Center Configuration Manager, Microsoft Intune, PowerShell cmdlets, and Windows Management Instrumentation (WMI). You can configure options such as cloud-delivered protection, always-on monitoring and scanning, and how end-users can interact or override global policy settings. -[Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) | You can set up scheduled scans, run on-demand scans, and configure how remediation works when threats are detected. -[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-antivirus.md)|Review event IDs in Windows Defender Antivirus and take the appropriate actions. -[Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)|The management and configuration tools that you can use with Windows Defender AV are listed and described here. +[Evaluate Windows Defender Antivirus protection](evaluate-windows-defender-antivirus.md) | Evaluate the protection capabilities of Windows Defender Antivirus with a specialized evaluation guide and powershell script +[Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) | While traditional client deployment is not required for Windows Defender AV, you will need to enable the service. You can also manage how protection and product updates are applies, and receive reports from Configuration Manager, Intune, and with some security information and event monitoring (SIEM) tools +[Configure Windows Defender features](configure-windows-defender-antivirus-features.md) | Windows Defender AV has a large set of configurable features and options. You can configure options such as cloud-delivered protection, always-on monitoring and scanning, and how end-users can interact or override global policy settings +[Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) | You can set up scheduled scans, run on-demand scans, and configure how remediation works when threats are detected +[Troubleshoot Windows Defender in Windows 10](troubleshoot-windows-defender-antivirus.md)|Review event IDs and error codes in Windows Defender Antivirus to determine causes of problems and troubleshoot issues +[Reference topics for management and configuration tools](configuration-management-reference-windows-defender-antivirus.md)|The management and configuration tools that you can use with Windows Defender AV are listed and described here diff --git a/windows/keep-secure/windows-defender-security-center-antivirus.md b/windows/keep-secure/windows-defender-security-center-antivirus.md index 335bce95e7..1e01273256 100644 --- a/windows/keep-secure/windows-defender-security-center-antivirus.md +++ b/windows/keep-secure/windows-defender-security-center-antivirus.md @@ -55,7 +55,7 @@ The app also includes the settings and status of: ## Comparison of settings and functions of the old app and the new app -All of the previous functions and settings from the Windows Defender app (in versions of Windows 10 before version 1703) are now found in the new Windows Defender Security app. Settings that were previously located in Windows Settings under **Update & security** > **Windows Defender** are also now in the new app. +All of the previous functions and settings from the Windows Defender app (in versions of Windows 10 before version 1703) are now found in the new Windows Defender Security Center app. Settings that were previously located in Windows Settings under **Update & security** > **Windows Defender** are also now in the new app. The following diagrams compare the location of settings and functions between the old and new apps: @@ -74,7 +74,7 @@ Item | Windows 10, before version 1703 | Windows 10, version 1703 | Description ## Common tasks -This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Windows Defender Antivirus in the new Windows Defender Security app. +This section describes how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Windows Defender Antivirus in the new Windows Defender Security Center app. > [!NOTE] > If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Windows Defender Antivirus](configure-end-user-interaction-windows-defender-antivirus.md) topic describes how local policy override settings can be configured. From 45e13d3fee05d5e934031c67d804464ca009d113 Mon Sep 17 00:00:00 2001 From: John Tobin Date: Wed, 29 Mar 2017 18:40:45 -0700 Subject: [PATCH 104/165] Updated TOC Cred Guard topic hierarchy --- windows/keep-secure/TOC.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index b427d098bb..9283a8c055 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -23,6 +23,12 @@ #### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) ### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ## [Protect derived domain credentials with Credential Guard](credential-guard.md) +### [How Credential Guard works](credential-guard-how-it-works.md) +### [Credential Guard Requirements](credential-guard-requirements.md) +### [Manage Credential Guard](credential-guard-manage.md) +### [Scenarios not protected by Credential Guard](credential-guard-not-protected-scenarios.md) +### [Considerations when using Credential Guard](credential-guard-considerations.md) +### [Scripts for Certificate Authority Issuance Policies](credential-guard-scripts.md) ## [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) ### [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md) From 1cc3d260a12f8a9ae184209a4159d765653e2d50 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 30 Mar 2017 10:48:57 -0700 Subject: [PATCH 105/165] added info about ProcessMitigations module --- ...iew-of-threat-mitigations-in-windows-10.md | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md b/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md index 2e7af88cf4..718ca488fb 100644 --- a/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md @@ -365,17 +365,33 @@ to Windows 10 features ### Converting an EMET XML settings file into Windows 10 mitigation policies -One of EMET’s strengths is that it allows you to import and export configuration settings for EMET mitigations as an XML settings file, thus enabling a straightforward deployment workflow. To aid with security configuration and deployment of Windows 10 devices, you can download a set of EMET Policy Converter cmdlets. With these cmdlets, you can use an EMET XML settings file to generate mitigation policies for Windows 10. +One of EMET’s strengths is that it allows you to import and export configuration settings for EMET mitigations as an XML settings file for straightforward deployment. To generate mitigation policies for Windows 10 from an EMET XML settings file, you can install the ProcessMitigations PowerShell module. In an elevated PowerShell session, run this cmdlet: -The Converter feature is currently available as a Windows PowerShell cmdlet, **Set-ProcessMitigations -c** (instead of **-c**, you can also type **-Convert**). This cmdlet, and the Process Mitigation Management Tool collection of cmdlets, provides the following capabilities: +```powershell +Install-Module -Name ProcessMitigations +``` -- **Converting EMET settings to Windows 10 settings**: You can run **Set-ProcessMitigations -Convert** and provide an EMET XML settings file as input, which will generate an output file of Windows 10 mitigation settings. +The ConvertTo-ProcessMitigationPolicy cmdlet can: -- **Auditing and modifying the converted settings (the output file)**: After you create the output file, you can apply and manually audit the mitigation settings by running cmdlets, through which you can Apply, Enumerate, Enable, Disable, and Save settings (see the Process Mitigation Management Tool documentation). +- **Convert EMET settings to Windows 10 settings**: You can run ConvertTo-ProcessMitigationPolicy and provide an EMET XML settings file as input, which will generate an output file of Windows 10 mitigation settings. For example: + + ```powershell + ConvertTo-ProcessMitigationPolicy -EMETfile emetpolicy.xml -output newconfiguration.xml + ``` -- **Converting Attack Surface Reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET’s Attack Surface Reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy, as described in [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md). This will enable protections on Windows 10 equivalent to EMET’s ASR protections. +- **Audit and modify the converted settings (the output file)**: Additional cmdlets let you apply, enumerate, enable, disable, and save settings in the output file. For example, this cmdlet enables SEHOP and disables MandatoryASLR and DEPATL registry settings for Notepad: -- **Converting Certificate Trust settings to enterprise certificate pinning rules**: If you have an EMET “Certificate Trust” XML file (pinning rules file), you can also use **Set-ProcessMitigations -Convert** to convert the pinning rules file into an enterprise certificate pinning rules file. Then you can finish enabling that file as described in [Enterprise Certificate Pinning](enterprise-certificate-pinning.md). + ```powershell + Set-ProcessMitigation -Name notepad.exe -Enable SEHOP -Disable MandatoryASLR,DEPATL + ``` + +- **Convert Attack Surface Reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET’s Attack Surface Reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy, as described in [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md). This will enable protections on Windows 10 equivalent to EMET’s ASR protections. + +- **Convert Certificate Trust settings to enterprise certificate pinning rules**: If you have an EMET “Certificate Trust” XML file (pinning rules file), you can also use ConvertTo-ProcessMitigationPolicy to convert the pinning rules file into an enterprise certificate pinning rules file. Then you can finish enabling that file as described in [Enterprise Certificate Pinning](enterprise-certificate-pinning.md). For example: + + ```powershell + ConvertTo-ProcessMitigationPolicy -EMETfile certtrustrules.xml -output enterprisecertpinningrules.xml + ``` #### EMET-related products From 7db0606499a8d90758ebf969ee8cdb78279de95d Mon Sep 17 00:00:00 2001 From: jcaparas Date: Thu, 30 Mar 2017 10:59:17 -0700 Subject: [PATCH 106/165] fix heading2 --- ...ortal-mapping-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md index 48a38a9acc..580f3684c9 100644 --- a/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md @@ -24,7 +24,7 @@ localizationpriority: high Understand what data fields are exposed as part of the alerts API and how they map to the Windows Defender ATP portal. -# Alert API fields and portal mapping +## Alert API fields and portal mapping Field numbers match the numbers in the images below. Portal label | SIEM field name | Description From 1f331db181fb63d70afc988460707314f0377ec5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 30 Mar 2017 11:15:06 -0700 Subject: [PATCH 107/165] Squashed commit of the following: commit e7f5087d8dd9448e1214456cec3f4f3c5ca10b40 Author: jdeckerMS Date: Thu Mar 30 11:02:52 2017 -0700 Michael Niehaus feedbak commit dc4a2f61d474098ef74a5ebf74c1d7a792176f2b Merge: e3cd98e2 7db06064 Author: jdeckerMS Date: Thu Mar 30 11:02:33 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit e3cd98e2a3f6fb596891ac952fc40f8fa41678b6 Merge: 28663d90 600440b3 Author: jdeckerMS Date: Thu Mar 30 10:11:12 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 28663d90febeb5c8eecbd45f43442422cf1fa0d0 Merge: 3af7ccf9 4a716999 Author: jdeckerMS Date: Thu Mar 30 07:25:11 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 3af7ccf9c2c7ce216a4a1974fed71dc2436ad25f Merge: 2b6a9d39 ba79b4bf Author: jdeckerMS Date: Tue Mar 28 09:48:45 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 2b6a9d39d54331662b9cca5d236dde7486834d9f Author: jdeckerMS Date: Tue Mar 28 09:40:40 2017 -0700 tweak lnk commit bac2d1bbae5127c1f2db3f803de3b11b69ff299f Author: jdeckerMS Date: Tue Mar 28 09:14:28 2017 -0700 two mor elinks commit cc20dca6163209b3ac1c3ed2129e48d9742b008c Author: jdeckerMS Date: Tue Mar 28 09:06:32 2017 -0700 update links in table commit fb0b999debce51fa600909dbfe38aaed8622a5d4 Author: jdeckerMS Date: Tue Mar 28 08:43:01 2017 -0700 start screen size commit 837f33b4bdf74507b00bc4fc3fada9daa67efc7d Merge: 9d11aca3 e0cd4034 Author: jdeckerMS Date: Tue Mar 28 08:23:48 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 9d11aca3d8b9e922c57b0303825d3b0d6febb31b Merge: 8713854e fbd1e32c Author: jdeckerMS Date: Mon Mar 27 14:56:24 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 8713854e6dce2df5d976fa2585d0a775a784d682 Author: jdeckerMS Date: Mon Mar 27 14:53:02 2017 -0700 Andy Fu: apps feedback commit 047779a8f2a66f647a74219c2a22c9015f909df7 Merge: 4a1bb976 ebaa19a0 Author: jdeckerMS Date: Mon Mar 27 14:09:11 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 --- windows/whats-new/images/wcd-cleanpc.PNG | Bin 0 -> 5841 bytes .../whats-new-windows-10-version-1703.md | 22 ++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 windows/whats-new/images/wcd-cleanpc.PNG diff --git a/windows/whats-new/images/wcd-cleanpc.PNG b/windows/whats-new/images/wcd-cleanpc.PNG new file mode 100644 index 0000000000000000000000000000000000000000..434eb55cb08c92edf57413f1fc7b2da0538c44cd GIT binary patch literal 5841 zcmc&&XHZjJw7n=uQ&1747g36$d;~!$p$Q@=grZUcgepY>BE2OP3o1=1p(Y>*0zwES zNR5g#DWL=@p(sctXF2HhNrlMxc~q- zWpqd10svU@nC~!-6U?*XIiD2s!QyXWs0UQ^i7qh#tGlj=E&$+?xam%8Ow9S@j*UM6 z@U;HBSvq__x&nZ}BO`s?`ymdL+-YAigY=I5;~~GI4aN74hv;zeT1%Zx?~gk7%<O=wFOZ_71vGJzH7NV@l^H-!zTm>+sV%+ax8F z;+-L+cqOJ?UmaSE2*8w9tde)zgF4n2chU+Q%gRi1Egwu*G(`IPEK#Yl7yn&_A53kd zm_(yKupVOtfV{JkI!tt#<-dab93VG4PepOHnEyh#t+o!O_Nb^#mD>ZYOk?+WKm#HJ z`q0*1-Vq}KutbR)t$L~Eoq<_G!UeEkQUKDfk@_0U3s_&feo-gMTf?;Wt7oZLPTr0Q z*z4EG;u6{yF4M2zf?WQPjz^5+B##BW-3j99S5$@c3xyY5>o$+N1{oYGrKcxghE~7I zA0(My(m@di=Yx68S6+UA@&F%`U$Ay&-&$dWT+4`hD(m=ZsuD9Omc7V-gkjC4|0pMl%i1@H;c6H||-#^b@6k8Q9>KGp; zka-6;!PVD~D4}61<;O|yE9wGH4yMmekA-I-`%%YTwn$+Pe(PY&pd}eHxGu3bKJ7_t zv>S0Jfs2(N&!2elz(ys^=~sB9CerN%p0O@jK0_n(^v@!5@>=V;Z@4dbW-a4_O7WWW zlP;Uy8n?r}>&2ua4%K@RO1eaXk2iejram!vWV%RmXtH=?cR;oA*wYSZhw0FX71RSP z?+{wK4^@gLCJic!^r}!&v|;yT9pB#TX(=uM7i^KrR0$hjvBBt~%uq{PnU=R9Fq)S- z&R|5AYGo&8wKE#@82U2NjTY~UNIYnKvFO+MydBy=g^WFZt`vM|ME)2#0v67(R9ez7 zSRqYcHBQbcK`sfAM$oJKjbQ&wd~^N=LBj}XZg~E7`%T86M!xp=EAs<04dG4@z-9!0u zL@f$U$$D=~@ej*sTM35s``H&YJcbd3Nh-F@bKD2k!wg(jjrje!nva~bF%3R4saaVZ zgI)E(FH7s-8Cp)}SsHh-AHzb*idMe!XNf9pH_)oBHDHIS=m;XIKHMFH_O`{FrVOZM zFSH%6S^eVHP(&;#y{&D9A6{JNg$xd4-VHD#+aj|;*L2uF1{Q40>CRF66^mQ)V5J8V z6Y9FHLsp9(R6%gPC3u_IJNV_-nFCoorS{BtiMPbwI|J*sN8OUm4>TYt)jujG{|+&> zva@Q-&_Ky-ZRsI5VI)7-NWQ!&vvc1pv_qqQt65L zm042`Qhojzu=S0l0bh3PX;gg+F~DXCAee&5pXrEkr2?J>;?RoN@*agxPoZLHpjk6? zdr%`~x!+W>>lp~UY#uwE7Mib`x53kYtybsBJ%%h~Ew)Bh{f4^6aA8`H`1Fu0bl+&Q zyvAGHH+uy-z8&PTq5z*P>>Ddy(VRJ!TJh_wd7x@iMlr)Zd?;;(9#J`{FdoBQ2jOO0 zR6i9N5cM!1e!y&oSEQI{`^nqUdD@;AH5so2i3$t;NP~&Kuh7rNmZ^Ru{P>>334dg# z%@2Ljj>2mXSk;uw0$`d0^0KiZZyDmskL}9!yAeX0aPScTY+H%BT3W&QKe9OgN z!*5Na9_5wko;P}w{f);#N$vBi0DDZfhrL=5DA5EI-%L!Ufdhj}pHduopZDJjz@?h* zX`RvFZ@Ke*W7Hq#D*LHlpe}M2l?#5<^_*hSQw+#PLAK-Kmh|@ zXmi_$bKqanYCrO^RFzopzn!|(8h85jV_2jS`7kmAZGo_b*Rd-f`_tBpMglpfV4He0+tIrYTCJcJM4)zuj>@AA-Ax^dt0dahYd zq4qrqc2)bV+=3$$wDl#NQG0ooF-QN;l05OW!-Xt|1bbQ;a%%6AhyS09t{mEL?3N8Y z9znYddB+^h%})fd9IJ-|cy7~`2-TNJa>(l%dk$&T2ANRaqKMc zWVz6w4-Mfbson_>`PEw{YceHZ0jW9~R555Z?8~Nd!?n@c|MC}}u$)}yEtI%FSLllx zBYNz$x~Ul{?UV!=giF9b<~|6@{a_2vLC}h;Rd2=B4mB%$Rg{Vd>Et8t=@-h_t3>;? zJjibM*j)@27Jsn2DpXi!2!A0eERc5wvGj}e6yzvDCh1;3_upODcQtyWKOxyXS=5e< z@W(YlyVti9Ob3d3!Q*}35A|3q@@uciZN7{48ac!Na@E{x+P8vOaudH1*!=XDVC3zj z+RefoMIE}+(FvNx_cg6eCqfq#G>_9-`o1#fG_G}17jrLTXui7rIBERt!F}wD0Hl#N zcL1+B{i)&fqRn_q8Ub@DQY0z--vOPOhyp(FLCS=an;6Q-Ifdp980#P1vOcWsv>}m7 z8=n?_7h6{WC`}Li9{1Qt2u9TIXI4~S7x@I5_#=g(i;bA(7Vh+}4v!1hwy5if++Hpx znGW`g(~Q*!4;u}C3Sr{*wtvqy7c8x`!r48x=arVrH(e(x0TZ#!jbriU!9#7L>Gm4zXm6o&`Eh!aj*iToqD|>`M>VB5XgPg?>U4EPqOe~)*0drZ4&{6<_D&LQ;!OgTqZgGgK8=Gee0ly6za;UR zK}gdCN5}7(gu4Q(5x=2cEXR7ygEUo!l8m{M8QPCxbUXM}2creB1q&=Jr8$^5pbNpx za+#ZTu~=tpopew8@+F=9<9(Q42`ujM)=LlGtwcQh@@_aKGg&V-5Nsqq=4TIHdKfqD z*A|*K2>KAo7WQ)n>`d z^qKwoKKoYaBNFcQPy_zP@(Qx&yqvx>eJ z@iO>RgvJGzqJBIFZEqCcb>;4a%Xs+#CNaOUPM>Zt7Jp4v&Zg95Q)WllL`JZCIt&%cGV-=6PYH*dnSb%M&1&K|M*sVvMgE~7_^p8*Ck z#?jmtU1EgPW#O)i0o0qFkK=mgN-y|KR>^S*kOF#Q~mKY2ITh1`!9oLL37P) zUszHh@UjMaNbK!=kR$sa__vEkde2Hy9_`&+&yHG2-{+didPgnrhH-Or*TC;Et}mmY z{n*zV>c(7V(O;kpv771fzrTVjkx0-^&adnOo zpJ_QqApIFtiT!BOi5AGIhKmHX#9I6GOix(5=`{MB5M-DqkQX~Mhr1>nr@L4k&uhR? zIx;3Jw+O70R9z#kRBkWkvX33!!T4>vMtoSQ43%C_+joP4=Hk?=12g>dCEj=Lxc_~7 zcsl3`2oX?e?;upA_?-d$Q(#TLhznU57x28*l0a%u@2myl=c`IxF#+`C7 zyfKo}rOauJqi{MI4&<7ryT8L-IvMuWuW0k1s`8m>r;Y@Y#A8Do@fKN6dn^^F)V5NY z$#RMO{?1kq;z zIt|ByXy0cj7#FBp{XU~q4qNaH;1`0+Tz9wo8TF}kZhLD~vE!|(=2P&J^=}m$_oj)H zPKI5q_GfuYV_YWH^olpPw{liSJ)!*0{iK4?g?#vity#g42(}nod2--qQ$tRY z^LH{#d*0JNKS_{a@5Dgo3X52}RhQfV2kk!J?F1>$abieqJHrljlW#?LKWK3{pFU8S zy#+l1P2R@(YQT0QC}ZNA!hT;xxxlRgshiT~UXW-Tm+8V=CKmsLE+GmYP0chVS{!rrdB`;{NNWY*LUUAIiBrYN23^l>-VP@65r&=#s#J3@Sx<27jLc<++*(-yJuoI z_3#wR9C_C5btD?@FPIV*vh!2Kj7LaAF;O>^3r+y{m3P1K1Qt>lwY^ zh4L;^$~$&5_Gk#G0)sp)_U0+#*VFNPckczN%z<6z33UAlK!Z=zs-qEPs1FF5F~t zD(cUPE}cf&mg{PcBK3;k$q2%TxnLjF`|ZxNIg$nsJ)N_qSsV?CaI!)idx!nYoXAkd?c9X}XZQ~)EE;kQwi$_l z1xHH5i?3<8_zH4cy|m4()ENUc2Wc3$V+Qaq50m#>yYl*Ol1BU^C3a-Tu00T6NNAJs zmY8iD-R5>LRNXFOKoLYE)}296Vh%bDJlyp{6m69VO=`YY^^r@}AkH zP5k?-(u>lW`{s83s&3?5gP$Ftb0HhplKO`S3X4|HL$99VFpC6<2`Q+rsR8Ld&j?RC zjY6b;8yzfYBBXS>MfXI3ZfDM92NPG!ly8pX@U}ARv6`M}B1@%0D!>MXt`qHiPKwvr z?KpobP3PmjtizNGIyV17D4g1iT5Y6i*%A=Ut6A{SaG4clxGi?&SHtH% z8kK-qZK3(72mQ@xX1aEcY6Ho@`fHcj_Jja3yl!B=H=8oHy!iJo313rJH$CdL*zX_q ze0xGFJm*Oqx^YfzTb5~sJui}CabB-qsc78diu--_v!O&}>gwlNp4`1@1+KeYJv}EU z{fS`PXIU@UJm!pTGtY={oCW{|fe&nP1~08d=({(jBX03(uIbDx3!}sldrrCTC5~sF z;#JtVlWh-kR_scSOgY&WMFT6&!R^ON`k00CcwuquI~hvPOdTA1HqnL(Ws zmN_HYR&R>qmu2nLpnee$1AyyyJ?SFYjE5GoJHMGupp!A@Y2xB*ogB$}+&p!yobiz?QVkYN9osK= ziu*LO?<`-owXGM6v&i{-QRi$OoA^!F1Vq2H13*?$D$_%{iNNW+zGrT`Ol8F-n83d> z>u>#($>(S%E1WYL=0AU9#yLis@92KtDTcZ(UuA+x^E2jObnKG9q(g7TD9G^~zLP)V zf!+(biPO0{civpgTbdBZjQBNQoC>TPzhE;&U|$lO_vf=~f+)6%>-8TT_W$t~AzK?v zGNXiU^lf{#2OWPe3u=kuBWj0{ZmEA$*={sTHkJiPz_ literal 0 HcmV?d00001 diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 48bd0d1e22..1467a5bff1 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -27,7 +27,11 @@ Previously known as *Windows Imaging and Configuration Designer (ICD)*, the tool Windows Configuration Designer in Windows 10, version 1703, includes several new wizards to make it easier to create provisioning packages. -![wizards for desktop, mobile, kiosk, HoloLens, Surface Hub](images/wcd-options.png) +![wizards for desktop, mobile, kiosk, Surface Hub](images/wcd-options.png) + +Both the desktop and kiosk wizards include an option to remove pre-installed software, based on the new [CleanPC configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/cleanpc-csp). + +![remove pre-installed software option](images/wcd-cleanpc.png) [Learn more about Windows Configuration Designer.](../configure/provisioning-packages.md) @@ -54,10 +58,16 @@ The following new Group Policy and mobile device management (MDM) settings are a Enterprises have been able to apply customized Start and taskbar layouts to devices running Windows 10 Enterprise and Education. In Windows 10, version 1703, customized Start and taskbar layout can also be applied to Windows 10 Pro. -Additional MDM policy settings are available for Start and taskbar layout. For details, see [Manage Windows 10 Start and taskbar layout](../configure/windows-10-start-layout-options-and-policies.md). - Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10, version 1703, adds support for customized taskbars to [MDM](../configure/customize-windows-10-start-screens-by-using-mobile-device-management.md). +[Additional MDM policy settings are available for Start and taskbar layout](../configure/windows-10-start-layout-options-and-policies.md). New MDM policy settings include: + +- Settings for the User tile: [**Start/HideUserTile**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideusertile), [**Start/HideSwitchAccount**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideswitchaccount), [**Start/HideSignOut**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesignout), [**Start/HideLock**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidelock), and [**Start/HideChangeAccountSettings**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) +- Settings for Power: [**Start/HidePowerButton**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidepowerbutton), [**Start/HideHibernate**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidehibernate), [**Start/HideRestart**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderestart), [**Start/HideShutDown**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideshutdown), and [**Start/HideSleep**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesleep) +- Additional new settings: [**Start/HideFrequentlyUsedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps), [**Start/HideRecentlyAddedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps), **AllowPinnedFolder**, **ImportEdgeAssets**, [**Start/HideRecentJumplists**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentjumplists), [**Start/NoPinningToTaskbar**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-nopinningtotaskbar), [**Settings/PageVisibilityList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#settings-pagevisibilitylist), and [**Start/HideAppsList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideapplist). + + + ### Cortana at work @@ -177,7 +187,7 @@ When upgrading to Windows 10, version 1703, in-box apps that were uninstalled by ### New MDM capabilities -Windows 10, version 1703 adds several new [configuration service providers (CSPs)](../configure/how-it-pros-can-use-configuration-service-providers.md) that provide new capabilities for managing Windows 10 devices using MDM. Some of the new CSPs are: +Windows 10, version 1703 adds several new [configuration service providers (CSPs)](../configure/how-it-pros-can-use-configuration-service-providers.md) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Some of the new CSPs are: - The [DynamicManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dynamicmanagement-csp) allows you to manage devices differently depending on location, network, or time. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country to avoid roaming charges, or the wireless network can be disabled when the device is not within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. @@ -187,6 +197,10 @@ Windows 10, version 1703 adds several new [configuration service providers (CSPs - The [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) is used to configure a proxy server for ethernet and Wi-Fi connections. +- The [Office CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/office-csp) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool. For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/library/jj219426.aspx). + +- The [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) is used to manage virtual applications in Windows 10 PCs (Enterprise and Education editions) and enables App-V sequenced apps to be streamed to PCs even when managed by MDM. + [Learn more about new MDM capabilities.](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/new-in-windows-mdm-enrollment-management#whatsnew10) ### Mobile application management support for Windows 10 From 21cbfd5191839776f310af57363bf602156733dc Mon Sep 17 00:00:00 2001 From: John Tobin Date: Thu, 30 Mar 2017 11:44:24 -0700 Subject: [PATCH 108/165] Fixed white space in cred guard requirements doc --- windows/keep-secure/credential-guard-requirements.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/keep-secure/credential-guard-requirements.md b/windows/keep-secure/credential-guard-requirements.md index ee45ea20a9..59e3915359 100644 --- a/windows/keep-secure/credential-guard-requirements.md +++ b/windows/keep-secure/credential-guard-requirements.md @@ -117,8 +117,6 @@ The following table lists qualifications for Windows 10, version 1703, which are | Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and executable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code

**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | | Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | -
- ## See also Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. From 2b0d3f5bbe895c7871ea737d631835d600ccd9eb Mon Sep 17 00:00:00 2001 From: jamiejdt Date: Thu, 30 Mar 2017 12:09:17 -0700 Subject: [PATCH 109/165] Add MBAM support for SQL Server 2016 --- .../mbam-25-supported-configurations.md | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md index 888cd863a1..99a8d735a8 100644 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ b/mdop/mbam-v25/mbam-25-supported-configurations.md @@ -283,7 +283,12 @@ MBAM supports the following versions of Configuration Manager. -

Microsoft System Center Configuration Manager (Current Branch), version 1606

+

Microsoft System Center Configuration Manager (Current Branch), version 1610

+

+

64-bit

+ + +

Microsoft System Center Configuration Manager (LTSB - version 1606)

64-bit

@@ -294,7 +299,7 @@ MBAM supports the following versions of Configuration Manager.

Microsoft System Center Configuration Manager 2007 R2 or later

-

SP1 or later

+

64-bit

>**Note** Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software. @@ -330,22 +335,21 @@ You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** coll -

Microsoft SQL Server 2014

-

Standard, Enterprise, or Datacenter

-

SP2

-

64-bit

- - -

Microsoft SQL Server 2014

+

Microsoft SQL Server 2016

Standard, Enterprise, or Datacenter

SP1

64-bit

- + +

Microsoft SQL Server 2014

+

Standard, Enterprise, or Datacenter

+

SP1, SP2

+

64-bit

+

Microsoft SQL Server 2012

Standard, Enterprise, or Datacenter

SP3

64-bit

- +

Microsoft SQL Server 2008 R2

Standard or Enterprise

SP3

From 92a7674f2624eaad793441a62c5c06609a71508d Mon Sep 17 00:00:00 2001 From: jamiejdt Date: Thu, 30 Mar 2017 12:19:00 -0700 Subject: [PATCH 110/165] Added a configurable timeout value for UE-V Logoff --- ...ence-virtualization--ue-v--21-sp1-release-notes.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md index b4759fe68c..061e95a56a 100644 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md +++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md @@ -130,6 +130,17 @@ If a UE-V 2 settings location template is distributed to a computer installed wi WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have computers running the previous version of the agent, create a separate UE-V 2.x catalog to support the UE-V 2.x Agent and templates. +### UE-V logoff delay + +Occassionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS). +For DFS support, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://support.microsoft.com/en-us/kb/2533009) for further details. + +WORKAROUND: Starting with HF03, a new registry key has been introduced +The following registry key provides a mechanism by which the maximum logoff delay can be specified +\\Software\\Microsoft\\UEV\\Agent\\Configuration\\LogOffWaitInterval + +See [UE-V registry settings](https://support.microsoft.com/en-us/kb/2770042) for further details + ## Hotfixes and Knowledge Base articles for UE-V 2.1 SP1 From 6ffa56b5f105c13a69782a885b7fa2f94790bf14 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 12:28:26 -0700 Subject: [PATCH 111/165] sec center --- .../windows-defender-security-center-antivirus.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/windows-defender-security-center-antivirus.md b/windows/keep-secure/windows-defender-security-center-antivirus.md index 335bce95e7..f4f2ceb8e7 100644 --- a/windows/keep-secure/windows-defender-security-center-antivirus.md +++ b/windows/keep-secure/windows-defender-security-center-antivirus.md @@ -109,12 +109,11 @@ This section describes how to perform some of the most common tasks when reviewi 3. Click **Virus & threat protection settings**. -4. Toggle the switches to **On** for the following settings: - 1. **Real-time protection** - 2. **Cloud-based protection** - 3. **Automatic sample submission** - +4. Toggle the **Real-time protection** switch to **On**. +>[!NOTE] +>If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. +>If you install another antivirus product, Windows Defender AV will automatically disable itself and will indicate this in the Windows Defender Security Center app. A setting will appear that will allow you to enable limited periodic scanning. From 0d0225ae408015a8ab6b382a91ab345ed81fdcd1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 30 Mar 2017 12:54:05 -0700 Subject: [PATCH 112/165] Squashed commit of the following: commit 7ed211f57c2b9150eade4671bba70163b1ff2260 Merge: e46251bc 10e43562 Author: jdeckerMS Date: Thu Mar 30 12:53:09 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit e46251bca2a9c4a389f1cef8e75345424b22099f Author: jdeckerMS Date: Thu Mar 30 12:40:48 2017 -0700 add note commit 271173005c78cabccf0ee86a9b54f28499dd913e Author: jdeckerMS Date: Thu Mar 30 12:34:00 2017 -0700 revise commit f602de6420baf4b64c1d3f18edead0a3bb72daa6 Author: jdeckerMS Date: Thu Mar 30 12:27:00 2017 -0700 sync commit 8a384f4b6fbafa76531ccc03e81726ee956647be Author: jdeckerMS Date: Thu Mar 30 12:16:40 2017 -0700 fix format commit a7184175dfbc5c3720e816c532196e0a263e03b7 Author: jdeckerMS Date: Thu Mar 30 12:09:47 2017 -0700 SH improvements commit e7f5087d8dd9448e1214456cec3f4f3c5ca10b40 Author: jdeckerMS Date: Thu Mar 30 11:02:52 2017 -0700 Michael Niehaus feedbak commit dc4a2f61d474098ef74a5ebf74c1d7a792176f2b Merge: e3cd98e2 7db06064 Author: jdeckerMS Date: Thu Mar 30 11:02:33 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit e3cd98e2a3f6fb596891ac952fc40f8fa41678b6 Merge: 28663d90 600440b3 Author: jdeckerMS Date: Thu Mar 30 10:11:12 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 28663d90febeb5c8eecbd45f43442422cf1fa0d0 Merge: 3af7ccf9 4a716999 Author: jdeckerMS Date: Thu Mar 30 07:25:11 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 3af7ccf9c2c7ce216a4a1974fed71dc2436ad25f Merge: 2b6a9d39 ba79b4bf Author: jdeckerMS Date: Tue Mar 28 09:48:45 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 2b6a9d39d54331662b9cca5d236dde7486834d9f Author: jdeckerMS Date: Tue Mar 28 09:40:40 2017 -0700 tweak lnk commit bac2d1bbae5127c1f2db3f803de3b11b69ff299f Author: jdeckerMS Date: Tue Mar 28 09:14:28 2017 -0700 two mor elinks commit cc20dca6163209b3ac1c3ed2129e48d9742b008c Author: jdeckerMS Date: Tue Mar 28 09:06:32 2017 -0700 update links in table commit fb0b999debce51fa600909dbfe38aaed8622a5d4 Author: jdeckerMS Date: Tue Mar 28 08:43:01 2017 -0700 start screen size commit 837f33b4bdf74507b00bc4fc3fada9daa67efc7d Merge: 9d11aca3 e0cd4034 Author: jdeckerMS Date: Tue Mar 28 08:23:48 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 9d11aca3d8b9e922c57b0303825d3b0d6febb31b Merge: 8713854e fbd1e32c Author: jdeckerMS Date: Mon Mar 27 14:56:24 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 commit 8713854e6dce2df5d976fa2585d0a775a784d682 Author: jdeckerMS Date: Mon Mar 27 14:53:02 2017 -0700 Andy Fu: apps feedback commit 047779a8f2a66f647a74219c2a22c9015f909df7 Merge: 4a1bb976 ebaa19a0 Author: jdeckerMS Date: Mon Mar 27 14:09:11 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2 --- devices/surface-hub/images/end-session.png | Bin 0 -> 78949 bytes devices/surface-hub/images/wcd-wizard.PNG | Bin 0 -> 12354 bytes .../surface-hub/surfacehub-whats-new-1703.md | 38 +++++++++++++++--- windows/manage/new-policies-for-windows-10.md | 2 + 4 files changed, 34 insertions(+), 6 deletions(-) create mode 100644 devices/surface-hub/images/end-session.png create mode 100644 devices/surface-hub/images/wcd-wizard.PNG diff --git a/devices/surface-hub/images/end-session.png b/devices/surface-hub/images/end-session.png new file mode 100644 index 0000000000000000000000000000000000000000..4b28583af4e05b6d8f20e9bbf6d219f54e41d73a GIT binary patch literal 78949 zcmW)nc|26__rPbtSjG$?+nBLbMr0dhFc=1-$dW#l(jbJ0u_PnLFxKo#N!gcZQ%R!i z`xZkAEsTB1GKTES&-eGoeck6i_c?btujkz7ocB35*2;p&&nv+T008*Un;KmL0Dwnr zAeNi!sHc!p>wUE2a5cDS006vC4BoX)J35wjGQD&W0EmVI0P#oL{*h1^9smfT008rG z003?p01)r-!$sZ)0C-j02?VS21cJ1culH?tPZt2dv_1Rr{mYk!jz{;^-Ve(EstURk zHTtCiFz_IaWbF7v+yM=SVKm;$6o3Scjh@PyTD8#ntxjAqdM_Y+`5oj0H(E{1__C6> z$&a|Q*EO4L_U`0s@1+l$)w_$eeb+?+sU<2I8C+(-49x;^m|J8!9~?IK1R(hAgO<3GplA&C zq*=0ZW#7Xm5*bRj#ZKO?LmLQo$7(sI@ayd=l@~r4d4a2pY1JzEU^8-SS!A`+T!z>Z z^EQSLQ=O$GICkv4$wSpgiW8a>!0MnGm-sksK zC8jf9ONQ@xv%YaZp<|r>QjeAY4E}s-usP*iOy&SJ15PPscDjDMIdJJ)W(@*xd}Ys8 zed6bUv2mrw$I1!~4UGE!ORK|sYu*=r|1u5|->P;Mcyk!H^mcDR0^raSd*{Pi+?g_7 zTJIS^$DiF>->?8$QK`4oQ2l54MVv}3$l!Crd!H*;9t&nPs~;0xhwocP*XO^jb3LKA zoWy3_)LJ!nd`MF+lTx ztbK;J${nYjv6=gH3*LNC)LMN!c3?};$|;^Uc<(fxx&%S<3QG6yw%$A}^sd`dm8Me0 zPp8HC9j<8ZyEYb2oTNWvY4x5&NAwbMItOSI4S`B#w;KvLpjN7GRr|B>AgG$AB zklH-i(Pel#H~yTWH+4$=VUM)8wU{uc zF;Tq0(>kZrN|^5>*GJ@k;V(_3Oz!0cS!-H5mD&yxHN@Y<{2>0yt7QnzarhtqEO0Z- z%kWd7N`ZHwJmamJ7?i&-;eAu!Em^hmPd+|5)}v=GIfJ+@fJw}3zV)7cE#$S-4^(#x z@4Lw1(~H)Nwu=G*pj|Fv%L`@?dASOWfM+DVYLIHoZsZ?7<--@KP;+XOYbD8b(vMZV zWfH7;piKqUUE)+E?0 zRc1cL&b0r8j5}mrU>-5AJbyCN{D-VgYGDV64fDlpgSG{?6F7{UOqFT1+Z3^7R*%OA2*5_;_js%4+L;riWV0^LQxJ`W_%*xfp z#W|xhs`GaDkB*$jQpGYFXP%0liM(<_$3pUX?Tvzp7Iz-k&W)3A%%UFmbf0tbWGB$e6{Zp8%! zE`_rHaHYdw9 z7>e_?>$d+H|7ZDM{+-$d+Cuo#%Il@q>#jfhNw^oTP0%IP+SL+6t`LlyE#)i=jVE(X zk<#)rORKMbu=FFD-B7gicy*=ZM|x#eWkx_*K->mcsyvb2E0N8WedDv(%_y((WxYR= zLGN-RNd=^Y(R(4+#xCW)s<#Yf0PZ^6ZNRvxim9Ct*A~AmQ7M)v-X9;Fz)sLk$dU9A zBZ{x6FJlheZaJpj8gTO+yWBSTOJl6!*ZO^oF6Oaq!pIrF^6D?!Tx-f}qTTBmK985| z1KPuHjk~`8UeG>4FMf1#to*z0&kN0`f4uy0C&IvmL-m4K#+&{hy+0&hTiVutd|x3r zjQF(u^#|kJ$VSZ4pzqRj)^tL5`_kazlYoB#g&Y36*LJ}hg|L?}^JuQ<_QZum&-PR8 z=jCsfoG2-@=*zyCwcWeayQX|j`LA7XwQL!(%(x8frS6sQ_1!D!_xImIzi<3@)m6g% z2+CSBdax6?%towUV&9^ieegBt2IcMA@;{kvj@`?S;rQKkPm zl`r~471sy7&SejlKY3Vt*m^u*UtT*mo$$u*`qg^mb=0RiSNcv=IKPmj?m6VB(Qtar zd`WQHUiseDXU&@TMbRRjN@8OZ?~9AA3X<)y<=+E5{+t^;w_F*vH1q3KWvJ3E(VJ(^ zDU_k9_D!d&cM|3`AB_e76s&j38!Y!fwCJ%I?H#`f`vS{2pE3P7VP)gjA8QL0mD8ag zrdgvl@?*Y$)$OlBl5XCPqHC_f>seNnly6)zr-M1^Ru6?NuprRg(F{thPZ|+^V z*LrUSMuz`>v01v}#<)|8jnR5SVV!rn<}~&x-uu}z;inIu=^-YhByO z0`E=v_XL~@NDMFz;Llmt8~Jwk*PnyJ{-kJ&7dbDr&OG?M4jngd%(Qg%>+8)n)7SLV z8{Z4GH1FHz6BPCO$F%{oTdxk>PTei$3$X}sRrz&O?_TRnSLdtvSJ^{KZ||+&SpRhB zylS&co5r`_d-eCG=4)?%xH1ZdnNsyXc>edR*{2$>n_p@tHkjl&R(8rxoMq<4?56>_b*ui<-(p?o`;On{4SjU*aih9-4Mp|adlP!@R=@=3VQa~l8L6ut zw|-~jRZcann)uenUZqF0HYL<=>&)ccu`jIqX?(UT?^hJ{=cscBb8D-OC4-i^2b|z1 zYkS_OejmA&03NcbtsejYYx&;>e544IJnB^SH@@a?<9*xzzN4=Tz`)u2mW#BNo43EW zpPM&X+St?Ou8WtypR}5WvZ^%ts=Jr7_kBMF>7Ez5N3szA^B0XF<6vQaPPiweK{Uv|Ii0#H{~)6`bQXsfGAtEp+9#cFG4oW8XB4FFj0J8xugIgqqi z%aeC<$a?JN=IHX5+IyqVLNtCV*_yJwoIIslp0sjs?;igkmX?gCDdC~PEzA?ioJ~km zZnKyrPjv?{@Rw4XB#E2(=dqG)`H%j^waPCWwfp;_-#?93mFvv}2g7f@|2)I8cCeRoGin8lNc(SSC~Ej7vMifYZWvpP$o*-!W4hvzNe~s!4YGP&;lMc<$dlKF=g{8|54V+#%x_jG!(RYwt ze4sR1_Lc7+!1{?HsU-k~FJ3oG)6(CNa}J{o??tZ@B~1$M>I`4F+5!F?P_T`QxpCF> zQ3|d7QdYKEvPzLn*0$n*gJa!kjnnL=?bNA7XGcV2W0Eyz=sOW)FCQ&)b;?&-R7Iz{ zYiSFpe9_hDDoHWWdgHyP>z7NTKb8fU^njs{zpl5Yp760vn#P`nz@<7B&wm|>bW8r8 zz8zj<63xyd|9LHJ&AQUiNKh~TIb~0EnBx3z0Dcpx z9ju{`D(;9Y9YllYDY7Uop%cJ}iNIo6@<^g!aYg~)VdD22?f+VVLA|bsqz|3nivd07 zrCzxZ{|lE2T=h8IwURFB{-*M2@idNNB zI*wAd!5m%lzRDe3;n;tC8n;c*PL69XW=#xf<4%9}BpJr*(puv^7fK1GC;6CpqaUqSui-dlUaStdzUF?BO-S z{}fISPZf83@zX6z+r-s{=N9}9uv(Tvf_}M%4jTM6FGIqhnT%-F;|}ueR{($HaKuqb7m zpq0$jp0bSjsa<26Qw zAX3#=a+VKnCc4 z{=$QNA7A{fXy{>S{3I(y(O0>YzRH_m=_JZsDHnS|uC{9Q_2M}0q61r+^@#m~ebG}i zI(&NKZcD(UNAsXwr`t8#tfz<@K3dh(7-r?GCP%gdpMFMrH%Gwh$$n0w%14#izpA7? zc6> z>iZM3{Zp+8_IO>p&OP0ojUcnNpvXc7=fNpNYoxWMBd<-MdiXAIf0ZIA3*pxV;gF4I z%uUYPJZTbs&Qc{4!{jsD1papv5dKv>@kQbP`riq8YClvkKaw5hd7gNS_vo~-;{y7* zYNUdl@Hr_?p{M^Z{!YqV?*E60MqVVUh5S{EJd%-jkU9PryFcSA^Ei|Ql^rXdsTWIM zwd3t2z8WQhm5sWm+4o)uR3R1jYy#PYM=OJx^#XBkdzC>-t5fKJHia^9B`IUARg0N| zR&?nKtQx%onAR>BZKpeW7S}=zHdES4u<`O1t zBGpL_9=iDI9AaUw0#0k(CO~){|10vn3sY~PLlQP&V{P7LQX8h@)+kU##huoxXcbiF z-T@BKqlrQwZ+u6IQuCY5q;vc>ffG$~0mA6ZBLX8opH)~@DJh<7n5JrMX9E(0YM0${ zV;17~FZG(jU6hCV?hQhWwB4tJ!<_zZ-y-J+PrLpa|D*iIT)!NMm4i=-QRvIr4vNd{ z%tECxx9A4T{jA9xSI?IcE(O0WW)&8d(RaU79E+jDFVXo-A6*3OX5;xu{I=Bv+U}d7 zsRRwO_t^!&!1*{_dQt@%oQ&L74etP_uVwVP3@_JZCHZZ~?9kLn(q)r9f;eJOdTUr} z)LsKm3&!E^St1ji`^k_&)B!LpzYVVWuJ7)DJy)<#Q@8Y~{aAK%>#D^VkgpF$}pwQamd=g9a?+f))v$3(2Xs~Ne&SYNA}_%p>}B&&&Yr7e8go3 zD+0Yi@0eBegZ-l>y!@SU@>vrAj6lL5=Wwcff01pMgD()th! zM-RRK2j%dhVIa8lc_xynHwTf;_G26$nwm!Rs!xeDziVwZF3EfVeG+V7lg`h~q5E35 zU(u_~k-N?Vc^`U6eVgXt9R0hY`5vQA$Zl>#IH$(y*)#jV|5k-u*1cx=edUK=CZomN z(IfNUO5S{%AHFwq)0LQr@NvNfZ@rULi`q>u!L^E{;J)7eCZZYt=Jl4#?=1RrY(}n+ zfZkZ>;r<4b4iBpJ4&D9rhr3j>3o@!YTq-2rP#rJH%<*8io^@URqzAta0@Hb&>So-Pl_9Gnv z|Jh$i+!uF|wFkK48GRvxx{>lIM)|Y5c0a3k_r9Mrlpe>s1BHcK2|U(y_v_ZOHy(eg zX(erb9vb;;e;A~Hu$6Q;e6V?VFt#z0yFaoltqOxmr|SUr`svZuMnToffHKL1sINUe z!<}jJOM@?L$`-M*LGCnP<~X8_Sgo#?bM&%(nH8#a9o@i)FwnHGUHkqOWC6?>&rw-d z=cN)n&bMTFFlD)TQiT%xjnpRT0vzb_2W54y1E*qZu!U^hs#r92K7-nMFrjkLbTE6k zm%CAaFm&iUyR%z=xI3y>agx$_^|^SA_VagNnB`K&fQLem3o-B2v+$i_L3`_#hZP}> zqQPPN+4XDp7d`4`JQiD3sP99*Uk!OwyZzOBgFOY0rd z>}36*_EK<`3+JpYGv6*Vv4J4YPD!-R_{&w5R5PXc?Wxgi9CUOTeoxP%XpOJV(!7W&^w_k zEBm^;sVdvYcE5yfuKbkO-#)+lW^Cuo{mMp3fpv4o%_hp-DkJV<9+y8a)5R2Ko!S#e z+VwWnzWn=fV`&m~ST#0A-CY`Oc07^p$ZaSb?q@LK1f%2BfDmPbz$RLy&GIHzE?B&(#&ZHp&f$+X@x(AG9{WvI3Do7T!c8<|-cFQd~qkeCC zr&9CMiX&)tt@cMG4TqND zIyU6UK%cm+bHZtf+9-{NtadFOT~7=g4rqm`pCww(h-do7|nteUMx+#d(GS((Se~AUJo! zJ$GiFC7KAKHY7|IP`fx*n77Lyl$(_4M|z@0T2tIfjGFr^Bpv^`WFq*%#^S1s^qv8{ z{LAL(15GJ0Nbf_}bh>w-v6uc9UEeK~1qpSKx5y$NFlDl2aK_Kf$2)l{l!E5&+T|2t z$A~RN#|$nsjJul%;EggImww`4)M!l-mMorWkmkOx&kBQA$<+OO`b)?gwQ3KcP) zZD5A(4~70Y*y}s|eK1|Wm$4CgxN`XMe$AxRMn#G4SN<3<{dUKC-DYhc^uTMAl&0VLqDg#U8xWOV;#vKs z8wXjA5U ztu^#uY;#O0m{hm?x32da8HCkygz8UpT1^hih}g_{kcE36qQIYK91FLi;fnpVRCNh)UWAmxQ1@H>eUne zFn0fp?f*IWDH`1U@Uo z{Vn%veE2St#N#q?rX^(a z&#W~kWD{W|wmuA82|e8XGpx@}NviVcUpp8&+_A5XZhh}y8Zmg(JoM01j%QZ>@>&}Q z3vyyM*URxn+Kg~N$JbK5ykPvi{d$4uNa(Kj;n#%Zxo|CEXat7hU9)Pkd;f5GYy`g7 z0LOYkMdc2d5dArmU9H?Ttz|4(2`k>T^S`NekH`~hBy1!w2-h7H^`@%!*6+NkXOABC z>a48q-0B6(uQq_;RcqTvQ$}1fC`%+Q9;%5A)LHF2+}6Ke(lABF8V7P|3Z)OW3P2(F zn`8fOj!h>#8vqX<<0H3Cl79gT{_(Kd3($=<>^Oh^!t|M``w;Z~?O#aSk{^Jvw=akD{A zB8aJE=!o?*T8Rzwyw`x8V{5u&lU1s>;}em{lBVPsoS1w3$_r7j(_9$zV5xrp6A1-_(7X_Q z_fk<*EvFV1a7@P1jV=!r)yuSLShYHrB^0QI(P-}IOrqy2l}~6*cM>F0c=z4``1Cr> z>d4HgFyvMd%q_ENIbz`Gt2v92eaMWz1oSZx6ql%3y6e3b`|*D5-MI?Sf^5y2asI?-Y(}F2Dd_L4?g~Y3g+`zF z3KO)#Vpx~%8;N&B?a1!Xj_3GEB?^!NVF?{E{;(_}3y{+Qw~DF(xFST~zHbzr25Xkb zQ{-96x&F%~|8r#O{{gH{KIf%##J?^2aR+~QQQ#6J?ECtYS-vr8N z2?AY5aqkLJ97X;TmB*WkA2 z*3I%bGG3>gMsnu-$}|ixXSYcroWs)a=VUO>hT=JNx_|F@GN8*E-i#=KMx9{hBj&^8 zX}fH-$Ul%`)ro;4*X)8=Tc64tcgK7j}2Y|xx;^&@NNj6=yp+hS$f!CoY zqDxFnS6Pr3o4fmacIP)Jup!#fhYLk{kv5t!8}VCA#bT-%b?|QUCDY|t+BQdg)}vJD z{e~o;Tk+|QZsNZPa(jXY&EUZN$*a`qtGI%|Rz=ddw_~0lN$k1|__&UmePbBmR!kV8 z86Qg}BVIqt!>u71NuC|;&I&Hq?hEn_mp;=Dgc;q4uxtDZ3>h@2OV(G!P%fJJb6QT# zLKDkBJZV~v>dq;|Q>-+EVUeJ!5@J(n73?G--x{|(U;PBtz)e$)w=!WfovpmeD7~0v zVAPqKds|Cm2X|MjGi~yy!bn^XJUK&M%*f7(ITbr9zC*so==Ov1e->Y(!|5kbDP5Yu z&6-<#oEmHKn5g(L3=wF_IB&ZJ4X(-OA#!>xOdt`CRaiyZgDgv&lUJCQEnVIZ-erW zB38hrqtZGfcaxGkTl>#7xV&B2*Av(q}^*Egq-p}cQ7AtU=!=4LtNZ_{Sx|fz@ zd=;yMfZ}tQsGmNiQ!)k2X6-1Go_v83*5~yjx8-oc+nKtuN$s0A9&MEKVrgzD z*h0jC_im;4+ST{WQ@;6B_K~CI$cvw5r4&-WK8hnB4xD;vr6HYu%&CPDBRvPCxKs(L zdNR}QbQKiEANp{iPX|_WS-x&Kk(~qIL!WDoGle_+Cs(z_gibobfP{u8J{JT}GMt)G ze>En~@HV7+MoF008H#SByRY+{LUuOTGq<1Tl@Vz;6VC$}1)CT5) z&-|-pE5_VDQ26wKDy*&FE{)5gmw7S)EGM6Bm4l|`3u>665HNWn-h0f%8)*d4ceIDJGZkBo-Y`&4+Vr#5X(YCCvb7q?GW$lxD-=>6p{ZE1kk ztV+uzKVmBM#33->;KQ; zrs#ZH57*xR75*P$TLjn;|A*4X3smn3{|~e&^Ck^jx3q`~3{6+i-t<*=e-N_cwr{Z5 z6z#gNhPW|q=+gb}+Xuc!WAh`CUFqY7TeKyXol;+bi!!9ZeA`a1@_ESVcOql0d0C-f z{2C&2yub1#U+KM3S7%psE%Qwu>bz72pSi6$bFZbf70?uD(^Ld$xTkf7dscg(%QYus z%@Y!q1f0hC^!=@U^Uo;AE~7hrtt|v^w^kD@MbRP#9fj2H_`$1niL*XO?B#XV z|AJ*&hv=TkbuAUEI+gAyKg4ga&sX4b9(}!3vllS$!n9?gCtbpEtjD>n)@>98fpxNH z>s2ap$OS!{#CE~qw<&WMe`mavQ^8+n#{7Ll0aqpY;*~IfiT{GPDd|UGi82UG@5cSK z+CeYk-iy-NuPSKl5L?q5;z<~6m9nI&6&2|+c@f%&ozNq>x05s>Ssq;?g&v1rfl?Cd{Vj({`B|PKqmGm|py#6hQX~3V>6*JxBviwH%P? zYoUVJaIdmSyYOmnE^uC54+7nOxupqY4 zffb3IEI&|)5ODw1Xwla-ANB>hn&k>?gb<7Tq+Gz3h!jyIsB60#7NgNSeJ-}*&2(2^ zmoGbuP98!LAc9H?c>G%%mbq*PwP)glt^we zhhY=jSI{Ls{Cd*8_^DVw2I;xxR?J^@so!aDdpwv)i7=*Juh2GHk~qa5qtWG)tdBTd zRfy{|oz(7HRa%ItDAn(Ztoig~*R6^0k#!6>5zYf>s%}?cWdjWHfTN-k+6vzU1%1MN z^$cN(^J@He?8MXAskrj-Ktt0MNbulSO~IlJ8Hvw!w>@;3GYA|oeUe^Y1uLX;Eu7HD zYX^=$V&mX@b~c(rOhEXU+i+=yKTBGrOo5MlF$5R)IXq)2C%UFXXb3NUpV4d}LFwW` zY5=peI=VAI7kK`*iDD0;_DpP@+de56sBCviZg)|%Iz%CxQ;K86+D7meR@PhmYSGc8 zYP9|#m(vPdD)Qqe<$$e^+pS7LDHFdWSw49We%mPLr05Tz+ktvH5Yj>cKjGljlqsN|)fw5AbyMi5fvOp32!bJ6)o6SZFcds!OpQ;$Ikx!pVc4A1 z0Z>DGNbpFPphco~UL0nAiqnv*h%*V#gil9!^~%WSr0LWCmRoaJ^oG5H;`pi!?5nd4 zHyS0Y8qKu(w9t~i(1Q-}XtHhax`~8bana^3-JgIt~{hF%Dx}vhmxm zL&YvGaTo!O{y1PdCrX1JhuMB1DPv>F;G@!1)WG^x05gL?#m&~^2N1>cllPm4z#FE6Oe)6^r%tMrYh?R8}Q`RpddGInn9 z>uM%2Pk47A_E;vFc_Pv(6?n|nd3pOq2`(#?{R?)cPH+m$vOh}1pk!NyiUFZzLJeEF0y)ms0a4^=5|J!pME zk%s30S=-48#OGf07%7V6w>2f6-@eHc@OB1yTM)2|WXYX%+$!>MKycGhpT<8a4u1-( zRTyDK)t(x;f(*OWvZ`pOVTV@Rvc3`_#!Dz+Hr-_Tg(S}I+p;IY^iNSg zmBEPw9ORz~pb+aDB5NpZXI-{NAXF#LY&>aB;a^0s0)%u<7E}rk%6k?(*e*^@1}+)b zj=xJ0uga6Dya=UYZMf_h9I&o|bBkBFbQ#^c({7M1X%sEwBDrPpZ}?&ZPc2hMe=~{G zF2G1I0fIrOhLsy?@HTl}K?5lQ(!bi?V}zlFzqwP!m`06FVjV;$8C8jB``?D+fo)#j z9UB&J7=UFpB;vSQ3gu2L3p#i%ad`>Hm3yj#v$-`E!UNcjTe!j_8;KoXjrRp4s%&wh zu!go;Xh?lN6a7HUMhtO*XNCD3%72j>bg7FA&XDpo&JRRBG@^9L66YG`@*?+`(s0OT zM@FSXi5hj61CefQkRqhcO&UHM_ovG3#yLKdI#%KYK?lE$W%Ae>LMWXRPkIL9gh4r}cM)v@)9V^dwmPTyjflTUBv3uxSE zT6NN7GG})V>JL{A{eX}&MIVGjzTAG_eK!2WEyrCfRZ20)G(BQzZTRBDKUu@6FoU$* zTsdb~bh@0dSjl?QLBBqGX-*XjmE7rwyX9a7_+q)b7P?mn(RlYklY}ZZ_DL3DhjA^O zR4?ey&nD&O8by%UjBl$1Lk4JNu_iLykhoZCtQXK{D5G{MkZ4<)p>3_SV3?8udu5{Hz(5Kpw(CfS2c%Fpty3(>LD*m}d4n1JN2M%pIX( zfZ89g?Dy}$A6PpeI=bx-e6RXPNr`b*0fWRixTH(xcuMKG#oz?l0dQKz8y5MJ5s1-H z=~q-(vG}%gHo1n{l6 zP>H0d>1b-~^EqIONZ^QN+SpcJyTNhvvHH|D47DpM_kiFtVv(FHgbz!Wy74=|1wc^% zU&KmmY)nN*CX1F6EyPZ6an|q6pmkwwoECuuN3~;aCXc61!iOqke(@MeMnS#zR53WC z3W6SNA)NG6*feD3Ct>-vB1l;( z+8uo!1$?aYuA;uP=C*S@6y4hmZD)x|q~ghkb`i7etPKAcnMYbryUBi9VRqwI%7m`5 ztv1aWUP3Jl6Mf2m0xfM9jdtbt*V{oaJA4(TjSKZ8AUC&uo=)9z=p z>|WB?ud#!Gz7o^MwZ?8m`|U0}l72@1tomoW+B?ehzV9BhW9&0ysjpURz0MY7^fOK$ zem#01JDBs4)gEr=_Koe$XwE|5$e!=bGwK%gFx(WS`^IQ${l>?)_x5N(Z|yG3Z;!6! zY+@7h>`lh8c@V1;GygziEdH@%Gp+1^$PHzou1+;9l2yA|yYjCxg+Lx1H@NWEzqH+d zr~2_^r;A%PqIxLW94KDioyBI!P5Rl=C4<##>{2Y1qsQ;=Ki917T&-QpUhx+<>%Te5 zF#n9m{+375&iLj-I-il|Uo*(5!Yuh(_-6X|o;c|1rJ?YUyk~H@8Qixy^)UF{ujra0MOohw zX*tgb4RT{)!4tb)wTurxiv+D88Hx`_(t(im7ed|N-%mZn-dr9|ii#yg;W{{_j7&PB zCVf2v|N0oU_seOcw6pBT1IvEnko`o*{%0+jBq5b9T}N~+MqgX0Aml+v5G+Wj<_t22 z^n{e4nwBhDHzK0bgbqTm2FzN+hB)RrSD&vx%_=O(kItjkD3cy@(;koowNsqfz0xYG?MrVJZar?{qy3_i*R@!3twgS7HAQ4 z!%cdys9i>>xJ1tAWV#ELM$Y69m)nc*DiCVA6gZoM3Fd6j><8l4n}$(8QxqvFm~y7M zc7qW{S8tvLy9@9&-~!YLSxd_eBx^P+1$jC{LRdik3PIoErB1V(6+(R=O-d|M%hXAk zuD+Ly5tLrCME6-r$~rBCA<5woTLM^{OF76b$Z_FTw6Cm8RNP?FV!oibw4W?blmU)V zcN7lUzoBn1bbpHFDbe;y(_&IQ*lK-*FS2H2^-c?o9!C1OsvuX5!POpJ7GWsgqX_e< z0e(?Xt-#F4-zcC$-yLetaB}YOiz;F@MRjz5ZS(Y*hUcc_^n=0@agSLsdc1@VZW@M{ zPslM(m5$%O2sJz}Ar{4*FYeKdrUA&Z8X8zPC61(Ht*=$LfaGLI-Z+4q8g(o=X)nFl zKoIHVF<@;)m8IoJ)I8@CcFC8inn7IP$LlxeT6xX2ajOX|5Gc2Ngk!5{htF_Y*65K=-Gwg`KYy+m?UT*DAR4d5b z04@-JkpUb6&|@{ZG9&GOf^d#S42ZH@qm^1j1JGh&22ZIjQG(EL4d=zl(wH*$P`9Rj z_JeZhx4^X~m6sTf2I&`Z^qmy7rH4+lIpxr#0@y;yK5#0WYDlO+ZC6KMU8n6;=u{*} zZx|d!A2})R*jr_dJbe`&(CioB95OcpZaJsv$AeYVh8xT0Sm@4i>b(6HraEOzq+nXD zgsasKBcbnky3`_`BY%P^c+4gX^p;`s<7STj6)U%P7Z8Y7#sI-_RM0sW=v||%D`fbb zcng%obD~DeWiB#vu1FL3B;KiqNMNART=xKI&;@=g$fkzUy;P(Hohx=!vT!=yYIQ3g z%{&5g?gC}j@npQ+WMeG1swz1R(vEjZNgCU6IQBSZ?(q#TpXMpZ!>tj6^f;3UQDGzn z5BXQ{P68D8C;q?KiiVJOsry?k%DvznABmnf(u!T+!ANjhKS1mv1K}GUK#p!6m)MzC zaDQbLumzLOW;;6fh_Y;W5DdT5^v6iPUk4yd@=D~|QbJthMY~n&+GX=GH0Y};o zFIJO2PB>X~@-+wdJ!_7Lm%iSP_r_hC6`2ZVCbE*-N_^bV@w~tR z8lvW79#kk$Otw!;Km*iT=wUbeFDy-4l>{)3!Q`LmhxNvjvXO8X=2!j;poGCVFjT%d zLROdaUn3+fo*7PZ3nz8?v>C9VktOfdB2ascD1SNQ%&OTpg0(Oc+JI{Q`J4IZ^@oC- z5h;^^Diggyo&*-;D;CvsBOL=xv=Vb@iud@*`&3N!lD>%%yn{>|MNShb`CvpxlANp% zEYDoB{8RxU(VRoQA|KNJwh14`-rtl%FvSDx=WeqB)-;AIQAR*Nln^VYb+Uri{x5fg!lUKc##QAdyU`^*v?2 z-o&|W`~6p;)4^&zMM!^Te<^%DIgi0*$@r@KdFOwb`{+B4wAK_XHjwVY`(p3j$K8V%_! zTFc@xR&&$Hg8wtLG=k#@DNL0>y6Aw~?I2+&+=birR$$E`q?AuwfZ7E1=hR1ZgpG?& zW62;q7Mg`ei`1+lewWZPJtiptjBZNv%tEo6i!}Svar^W9k!UWuDl6hWpu^V|_1G2J4y>mR< zgoE*SFNAa>G+E8y=|Gzf-6g_40Be}!CiF9E$IX?tmn2NqOp` z$XiyY+_*%i8!zg)Jy*`LJ_=32q$8~&kfxIo#tp+(rf$WEJ_3(viDuo*Q;$U=b&7bD zC05BI=>NO)*nrY-(a+P9#0K}k0xX{Rj4%2lGsufRh~oZeMbR63e(k5T2 z$)*3^a%bzL2Lq7ywtn zB#r>1*K~%-tc1iQa;HOR4-`>ugn{;PTdSRuW^;P=qPe0P&sH1}<*?+d3{LXbFm=wm z9jB&v^m3d!94qkEdp|sm${*9=NCiI9z8A5hYxg ztz`|*G+pCJ^o=ObXQ4T_-8s_J)z>ctKFCQqo&x+Ak@|@9vlK^mziNK6i?k*Bq`v`5 z!%?{Z8;y>0L{G(nPx5AR^x?BQEw$IvMC*9eoMg{-wP>;M9t`9rBT_KcgtVLw{Fy95 z0Tn2@GdZx3oMf48kiIKy>$%e2EhRDCzD~1R+$4b5LF*8zsgT)ruTOS8N(qY+%)7vj zfd<|T;~Rb#wac3w6f6(&&d$vu%6~2Q7*J_{X@R{Tl5H|!2z|mix7gmhNAPeGn&VrW z^~q2xq{PGFs5Ti){+w2bJ~RH@n$OYhv=OP-z^z&a5OHiMrM~BKmO^v^IcXxl1I^>E z5gfsE0Y*<`JPL0E2KHhWAVk2tb=_|(ME{ecGmutLl9kR(T{yee~1B27NrK7$O~#TXjbLr?o9zLkMtUZ&1nGg z<7NS(6l{aYbhp6Pgm&O$kM6qH#aVp7V5@ite^By`bcLa-%H2m9oEtLi$7`IPU+Zsf z6G0BKLEUCmD!Vt5vT44T1wi9^12h3&?lTpwvHKsefG51w|d69EerU?6^6T zXSB&6&0-`^4k}K>Up7F_;Ym0-6+!fh9?z79%rGiw?2fqOUUD8?s*6L)>20uRC(DhM_yaJxTiE}(UDT}Dig!Y~bTS}( z(_Gf0(10p@$a1q;4R5W)9r2^+-xNSOWbUVnb|yfO! zN+IfW=f@bGXpk~tl$XR;d^9P@?w5fhKlELq5ir3VUmfK$8Pp zc5?pFIJIv==GsDgj^yf{x^khw{gxa07v#~Zt?X-9nINl?{ zaF*u~@Odq^12AqMxL{xYCWeVSWkiTvHp~{#1vW}m#ofnT>E{lh%5eFkLZcoJgS6C< zxHRukfk9a%UpLQ%(8<@qMM}bq{uwOn%xe`fU3oDKm{5~=x-AeyqR)_QZr>-0b3!z5 z1+zbuSuQ$ic-jw|4ta_W|!6xy$DB^v)PPxAOZ5BcEF%dJ6Q188i1<1pzHKaYAiA9)R?8* z65?v2OBd8{ZI$-UCWBK@*Q=l*$u52)!BHEyU9^_?W|}MwxRk7f2?yBQl7{x*SR!;X zFUv^_vJa!ClmXdkX6!!qbFb$^62rt1!h$HnL_`|F{*EN;7^Q$mb-5IyDGZZJ?`Z@v z2lVM>#Y81c7%OZt8bmd`wiY@3nXL{jjH!;_thw;33NxT|#$q`YtH5fX z9VK9+hfp@lou;`J_*fvE1vvt-!BD|PMAl6Lmu(RTyrJ?A82yd`o41YxLUI$G9{27B zc8bR_(#8^3B@IAP)fctX&h2L(k-50C29AF)4@o7M$a|RoPW@U4s?bJ@^;g$^AmqhW zX>e*UrfWcGgKB;R1;0I7dGa0^rG?LEn`IOAaD;>uq6IL99AQr`%oAB*Bz7-DA{YrH zXB>%(^%^M!P6zp7Lg~wO((V3lepi@}T_zLNP@1&V@+k&vOn1HFX5AHn(4nKiI-2)~ z4oL=Z1~>#k5+2(s)^5IyD;Rel^4)7oH4Hy9ef0P4cS~I~D#g(b$wZ;#?w#)7Pp62dQuV{rcCh^f@3%6PFui2lhM`%yvp8 zS*rv8(8k6LrgaEh7ZKpDjW4eL7AZz8sDlA>0|0x9kND-HBFGk*0Tn35wvm@=PD~Bd zHjA;>|DNzO%WHccp`+^KFVjU9k^|l&CN|(KlFvFgE_W>aPD#tOCpaM*#R+3t8 zmPbH0Kw-vr38t}s>7ah;mZgc~2K<-y+gEf{xZebRkDROp|2S|G|d zNNXj?dx>PG2NTqubaBe~J8(&N#HjDZlJH~0%7OR4u3T`W3$!`ep&fvOy^El;0mw>6 z>(@fve4$FFx9l!QO<2uEu{85b-odk6EwDU3Z1fDIC=I@T&yn&%k;xx4ppg=OrDnz( zp|Q2dqs!7Vi#^BG)52A~k&91fZnRmG$7mhA>`Di>=RH-WGtPttrVP?~`t4Fck2<#b|!PDOQs=I^I`z}|{yu^aa z4c0P%A3IkE+d-Rjnamp12zTM#hy^L*;dl*v&zN^7w{7M*Czt%tUEw!0jyL23N$0r- zB$nA!PX=x7BP<^IU69*r?D`qC3QPrKuE5JjmHtdC-O}}1$1~j0J z!VW=SLQpY!%4owRBy=$@BfF;laig51!JSIA-YGDVLkGnx%2&xq`Z1eWQ!jPhB}pG& zNE-P1+WmI-J5ia>C`k}ZwC$Z@K3m5s8eQ^6rK|i8;;YWeR`^w^-vj!rVSw%!#(zIN zSt>7Q+%sT5D$h6k6B{d(wtGnU3vxiLgcvV7ojzEnL&z(SpWWTx+C7`t9siiMI&=p2 zz(N;hz;NV-x(6ME?>7LRtYw6=eS9+o^1IOg3i#{XoxhpRy@NqTgm58z!m1MR!$-q@ zXW*fH_V~w*lgYo^lQDYR9{>gp;1vS~&&Egh&fk8$^U|ZQYF9?wbYFKt0UM^8tL&U^~1UHCq@3uW&5B#}2hzbBMQHEsfEeuRI#nzo-zo{djNiFPQQ6$scJP*s!7H;W4o^)7!>NbO0|yi;%r)i~{wUG zuayCnGDrMw8Bm}>DI-xPF}INC`{b%bJO%P>L$2r#ucTa6h3~r3CJ2|7e}W;uOnZM> zrQ{y$#fcad8UBgdPd~q53BZ`9{ux$U?6yiWOfNOD~~)ok*z#aMoF8(kRzf1nvFrDR*km9ITw z8*V?CHbI&Aa&94pz!nGN#0Q@DNe_0lk0nd;D)Pn7ra3}!w#P||iyXbPC~1OTAOB7Y z=K$M>S##IHJCZ;@E-}FSXO?MRlIDx|x#6xxAbaC+US(<$$WKNpeDUFH?`l3Fo(f*4 z&?j0?=w>?^zKB-R*Yry_?O+lkC&IxSGB^Bf(s%6}N+e`%p`te>+<;Pp~7ENKun_vPO9L18M!6IEmDZ# zP}Z7S9s+Ydu8sS8a-rn~<6FZ=f=(o?a^oZ9lGIHokIyuD_FX%k?;Wb3k>gAd#$u_< zZYzwfQeHCj0aUz8IS;a8@Qjib^+a0$l0iyANDe&bkZ=)hA+(> zN-l2LNWX|P&DtV|@j8C(^|j(gb%3{U|;O%U&Bu9mglC zY3IumG_ZS;;ph<+@k{A3R4^M@ z8!CgSM3;l-AK4Kyw;e!Nsg>&|t2c8xuJ zY*qQwWTK@Py54hd2#CW;yp>zl<{aLzUVZ^WOu_c9=cX>}QiWNDY6B7Sy(E4?>9FcA zg5fit3-iv1Fjw+1UP@AbEE!Zvx$xaCy(nMEH})HQ18)xlOmAn9dchtcHcdfiED@7) zQOb%-*Zr?+zrlsjq$sNV!!B%gs}pT!h8ql)&P>>aCN*&;>ezD=$mlg z;3)Yl-<0;j$aN7WD)DtteriD?;oI)R7PtQ}zL%20x<}WRf0{9)(>ES)^Jf|k zO>w6LY71|^B`GuZ>T@NLd6d;vs74Y&$^q;0LmJV<$+zO_zUhMCNo6qh4s9k1pj{;c zgV-e96Tx^3GIUgLBe;h6Vsg`O+gVVPREB^j8BOS8=QpPxDT&7*$$Z=!QMN zFq@N*r}qUx5DWWlKkSqdL|fU7CgD!yx<;&M$h8yuyRd@INmT|fa@40ZJwzsdQ<}4 znT(C1EkSl}(DHn48H!Gqy<*CHwI3>O*%`X&>|L_DRj)X9ZEP(?)g`SagiO=zN?7VB z1ktfU%(u9UjSb9 zShqoBfy`+aGxk>dK^TppZ`Lx8BOX&IR#qSu-ED4$OxEOt>NXVa(K3<-fx}n6khpUh zb?o83(p(D^ynNbB-M!Fp5=j3TPwxmsS6$2(h^`X3hgV}5EH#7}KC)Bd;k7p>R>TZk ziKTcDj69F)?~OWZ>iezLj zg^)Mrz?21YRanB830cEAn2xKN;)Y}KT~Felqr8iNb^zLx9V=HL_u&*?Ju=FDtUye- z;gKpUyoX?`Q!y1KcwXBMjZXHQPWGHAO8&MXk4P@0YmwE*Dk^Ntc2DwoK=YxHTL`Ua z1n>=!F^>GM+YZuU#}Zd{Mw(1yWX_>+R+2_abqOPCV*{}?6Wz1>pm<9ZrND<~;kk!@ zNJ3o`)KpE21drMAmkoaUN>@%Tu6dy7!sd|1nS((`7$m1dh&#Fwh>~R-wCDbipIap^ zmYo)97)XXh+Z!0VRyaa}XpDNZK=2p=61G+riRT0hiYIx00DadMAHxD4r+!15(*}G! zfNMt?x{bgS<4bMEPe`0C1p+X#sVCVach>YIYPhtw;NJ@@9jd;#65~X%LG;$gK^&FcpeQ<%g!|5^W(CfAd`hxdZp|O9IIN zfhbE3QOgl{4KJauJGm)&J!Ji(PNU? z2}!6Tl!eGUQQk{t)nOz}zLnV*Cl>Vjd?Et{_9R8gaL-lYvsqK&Jq7~g4+*Y{ji*EQ zN}vuvIcmPzgUXE8*o^BK&@&>hoYb^lmczzTA!aCVR`$ecZUCnwB0KfY!+HjbnhRDI z3&i(4UC}u2ngVVlXv`e`yymAJoXJ`j6m6_SV7^vcvoQ;?!HjU@VyAzesdIM8^KuXK zst&p!fc+SLz$C+uXfPOKCWN8Kn*dcEONEttq$~FTJWxI9jwFs=Dpv)nzsR&vTd-d| z1hZeRx?BiYN?#n3?Rd=3s)$eMB4xY1Pyv>LT!QyS@>BVPF#P1#Xu!V zqNY*F7k}G(EZM)^CyI=dlo4Xq;W>spZmjp!vr}H&$nFFP^B`HF_!m6<^n4J_{t0b! z_T7NSvE7ADBdmRbkk|o3?UZ-Q^YWU|DrR3cVR`e%K5<3soSqxTuEddh2+hMGC9729 zB%mAOa*UudMV$qTy@`$+OBU%TCkIEFosd0od$ES#I3)1!IA zXhy>7iFskvEKNeX;BPe^&=qo;^EB#v0q+_bvQc*-PQsb~C@ywztz#I8xG*w@PJx&k zJ}=CNM5oII?qLHeP*TT9VikpAJ@~xSe2zfceVcm>G;94u7FTg4j3W!{(3;NPh)|Un z$@WrV-l+~jtcL|dfAn^6cWya%8+Be zJP1MO@r4d&q9_j;3CRuxHu@WeiFA$;xeDv*!f9?KEn|?#G?rS{ZLEPDo{ z9Vl>&DZyU`Bt~erdrB?|M_l3#OR=HTvgN||oQF(aMQqEB0{X@QWF|YeibMz!X5>4| zb&CY-BWDKsG)WYOozPbgDc~OY6FHG?+c@#3<%vxd=$JPp|?ra7oToa z@*C5ep9NOn73d*|k}Z()$=OEIcKkWivDXxb=)~^epyZaB*r4^27w603jA4#MQde!N zGL|@0%KbnsC$YMQ2IxZM?d8L{a$3=bjxuY&O}!nC>Y}b0fjPAv_Wk z^b-c4!@Qvb=ECznc2%FKH9rVBJRq*}A^Sbf#UaVd>PA;l##rPel+0Qnask)y}7@N*DHD$gHzn ztIoOZI|$x!4db_kQkWQI3e4B&2SduaDlIO;rMP|;>Ia4~9>%ZPNlb9s3{9Q!Sm@Gq zb#?A&gvhW}^z#~6#BjUCYL@A6f0K;3sEqe5fRBErP5g$efuSA`n-BFMpJeN~XC$DG z6_Fxyg3(|pX|59!b!?%ZV&WcoFcAwZC-F|PPr4%C=6)elhg3a%hMgaJ3`v0w3o4U? zF%ss30hpo5{}Fmx()?O46q7ahIJI1Y2N(IjiI7XeI^=znwwTdco5`{OI385$jik_` zY;<=_bU`SI#ne5Yd_Y^hnz%s_$-Gac9MB*To#sJFj%g@~rP<4UCqqPmTG|D4F&P+- z;J`qxjGJQ9Vv^(ex!Q`E@o?(9QV0cYK)t+>FTW#vAbzQ0^(M)211q}+EQwiWQ#?9* zk(5!>g)|gr70(7pq%pRlSqDsO@`rnwSj=>?3xb)(OG4vhb0lXBS)np)?~IHZlF#V- zxfI4JmpGl#L76=Vfn#N)Fe?(lHHlBf0mY1EAAigeBo>jB?O*Sr!0@1=2^uqNqabZ;kPGHWRdw>hs5SU>ZGFi&(KYRC{we z!6+S%2gT=W1wtR3=1aBFC-Ho(k-{O(Uncq_Af@8|2^jDCRo6aj7pxYUPnbkP~^^ zdZv7EOObg(zEH0?3LESvZ1zDzl~F+581g+XCre*~19QLfV~xj1Il}?ZEeYTlfX1qb z?UbR$su~96evK>QUe98P)<%0{Syn~WJ`TH=o@iF?sxxoRozDi6`zEo87#-YoOdEYh&OPP*Bu;d7+c*8Zcq(GBsacKD{lsL8j{YlVJ(0%EoWIG#OGU<78;>MF)ZTaZUp+Ckhw%I$imbc;Zc zZTxQ0Ix*?q`Fw#`OzYtN)GNr+y?QYPXD6hQA3M??+tWxu}33jWx6q8V?=|HG3jB|DNweTx>b6)dO~l`6Nh>R2X!$Ut_qH z8&9#zS2=rOz;Y-huqlzmM3@YRDTQbcwpL|*d`&i<%-2)UO~ibQOUmP1K6?2o8ct>A znzj5r#U>eC?Wk+MnAk>&Y1BN_;?g&la1)h&g#Xan+pF)z>O@Vw(=M=};F4sJ&Z_mkPo2el*weN*}k z55`qShr`i$xwl=P92uhx_igFj3%C9b%h+(6*28v^Z{pR&7rAv(!|Uqbp(zYceyl9-IL{OypxOQL>` z(x_fhP$kOPt*jdwo9lKPQ_ntx#J77r(>mIv)fvXOc)qP{&tszfFI@U&C~$=(bv_rx zvKg&I9lbZn@H~Mc5I^wCf?U=o1eN{faQ#hS3qa^U#dS(7D^ca7pRv3y+cPbj5Q<2m z>2ZEq#r81+ra-a+NWQ9^mNqrPs@c&(F9*qLN=psrtX+o?Z}O z!h&fpUS;4s``@I(3ilO!Bl~=9L0qDJHio&k+7;=Nulm-l51x=(1$J5wU2?4u2oqKe zUbHR9c>gGlXoTXbPt?tqKdqT~_v<)+|L}AnIJwV^Y(M3sn6~EMT5$PAtnQ9L4U3Jd*Q4>$Z82Sg1m(gzSea=LHd6m%>W3-7Me|tEc25kO;Y${90q&wSrSa@q#0~p#r?e7 z_(UDnjjv@DSa^Cx4muhBsN#Nz(y>)xMdG!JPl@T*DqRZ9A*M=$f)(8WG!q1%7*!`% z3#Ks~463vM3`GvYTNQX?161D-lsUSY{vbgHU1VTfc4D*{#76f3BZl412cD6(erCsH z;5H;q-0oA@3V?l@VTLwwIIbO%p?;J+@DRljMJb8tHs|l)*~7!8_``goP=Ane)#Ufq ziy1HU2x>7-n^I#wKLEOvJc{(40gxBO5$7X(Rt-{t82SOOA$`GY_YBSRC3xv23wo3s zjF=v|@b)*}W49s+0UoJnd?}l|AAaKfdY3jKt-=AKu9h&Q(N&el%Ghsw7adFmUK!63 zPoOho_$|(@>yTXZx*Q8SMOo1kz=W?Pl6koF3{8^5atMQD9iY1EcUC@%gnChm6^|~K z5hLoOA@ZJknCFKY&fj``nN^!#f6`Rt6A?%;*Hf3}V)Ya*&|xk*hb%93H_Q3Fua zfmS=K=kkzi*dk!J7!tz$mirVsa0e+4s5^J70-U-Ym>(1WZ?P zmF27LpoB1ArR9@(t86ep?c39oyehbMzE)h?fa(QrRyM^bpY+Rmv?}<@)@p^098GE{ zpAWQS=;_BeSx(8*1jl{-#ZN~I{yg3?)0;jJcpoo=JaY1wC0)Z-KZ>Tz$ebVGV zYw4+ElHq^3)A+Znm1a&2JM05ZNVw?guzh~o24lH(acTicTpf(dV)T|CPXr(|ew$YN zW$Tr`PVWR5DX|-V(dK?WVA;ZW?I2Q{3z~tzq0=%{_f+CdT_1Ka(X-$buILnRh9Xws z(hGhDKv{LmQ16^BgzX*_bzK_{|%wHpY_Yfs&$I z?V=y@ndzK_ky;5sZO>4omr0Mv&`-A(WF06n@xu(F-g!KdmW!p9CNYuU*rG1c1E&@y z1=`Zso~pzcwDUI%!IEjv0~8U4Z}HilVu49WiKCMvbxpn@jkld^GiQPV5jSGwIGLN=n5zeV#Mww%@*@Su42X#)6i?O1{bvnTWujNR04CUa@O(NFcRAG;3s^56N%>5&W*1o+ zVJNloX>o|O34CBteKR4^(>vQbU{6-M{M=(koAZ)-nhcEjYG;z5#dGys_j>!P>Dx@C z$u&|IN`{d|>5zU}biBKv6J{3J$k79+FcL9j%GgKM4eCC-6S}$kyB5ra#S?U=zt#OK_JyP6iU!jO@wbsm63JJ6(W4CktiJsM>#P! z7%k2?xS_Mp`8QvTKCENZ6y5j2Cm`J}9mF!s& zj`NH%Z;1k5E2>$xFps2nHi6ynC2<{Wx-1uq)(iu?<&+MLfQLTEMX6eTx!XZnXhVa1 zv91QlhzOGL^TNz38^-@!XvMHMWZfU^*G&`nGBqMX%p;EI|>!BHGm*^FjxB#s<1dtA9CUC4tV3t7MuB*wnPulpS>26K~S=b2u$Im zD4@Tx)~t?)`z7*XJ;jS)i_y3$^LT9BEQd`LT^aRAOQKJ8#>ZrQ4uQ=MtYfCLnH4F) z)lcDy1H|o@hr#Fq4xJTRj*~FR z?nWRIgb+C_7}hwc?u(u%z2leEM81SU&9Cy|ZJ8=o@)+HoW%IKyf3a6yBG^-PxL6%i z89i7HvjN<~(cL4K+~3r;-oqIY&?H&0Xk)T_=%s=rLiV&>^AQnlKl(Mz0BV zpNUK&y7wzqCO;v|Qyrg#1iN*6<{~CFq5(hNYhw}4&kK?C@<}X0P2}|fZ{YHvRKHSuIzN><) zV&9uLBnTpUZt9HODLYJS>z}WAH6SOkVf~jczH+R%EHBo2&GUKU-aVbkx!%up%x~NG z4pS%GtI8)d?E2q8Vg8>KC+9l${zTHt0wTv=9SVOc6Z`aIVGhY~X)Q}C5|B0!Ct^6RsrLRoDY?`W2C|Dp{I46N;vwFM6_qynMb-n!PGETZnE__j z%Qz%YmQGiV8g5Nq*Dj{t0()Md}uai~x-!o3w4VTLC$ z;rIQ*4F1IO|HkC&Pzjj}+r;{WpBTn>Ytk=@JpB$h z{=GUGpXBujeI4C-NFS__)vne=LY7MEh?Muu4`j9!ytt^y;1~EAW*J0rz{P-IXZK*&843eCi*@?`xIg=%h1u&peuC_-bZn@9oY4 znnGI1$`KwXkF>8km|HzN!Z=1D85JLEId<^QheCh-{qJ_d@8q<1!8i4x-ztJ3(BX{C z`twTW_+CC8u4iPx@lo2J|9GA6mz{5T`dnqg$K_S+;#IiB^iV-Q_?({amE444&MWQ^ zMEM{uU+)TiAZ#0lSwwR0Pk%Tcv`;h09rE}5A~}RPP#kvthu9w~(pkp)nMpMzsyh+9Pi>Br6Ds7H9HY4P_}6X)sv-C#?%ua_v&fs1dxa zjPyq5tBFy-rv53_lAwX5!H1#~Fo6@^Jn^U0caWf^s>IZPoccpKnUbt`9ZtRY&VkEI zF4c${mA=w@LNmcO)?!{vu7cp{tiI>jh4?Qevhm_N#tNn_Pqg#Hz+_m)lBpfCyH7zC4r--e|| zCuNbeI9k3P?T6ASc#y-jC39`-aBhut++cf46S9cT|GYeOF<9fZruN;rqgN$2eQzyK z+_`$|JE7_E&eE;@EAM21l0s7ssdGuUqv4M+oXmBmWj`{IFm3Z$_0$oLW6*WDF)5Py zKk$3|*(Lkd_EzEOO$1yHvuuxPjQ5N;2H9g_%(trtE9y2+coSk16LXuN!1X5Q9=Q8c zxv!c>Y}H3Ry5*lKJFE%&_2)sL!nM{1j$4u6mMmYN^oZ;{>R+on>J>l^J&)b&40v26 z>h*o$h1>Nv`=8$gzWEt$5Y+xhc*@T^}fn`TpWf4n3*mdQi*D(Lja8rQ_A+Z{JrB zd#dnK?7t3@^`jeWOA~8b-fB4tH?QR4uV49{ZTrvtX!YNw)6vrUvJ2Aj;yW)Pq`;@2 zCeHC&5&wqbH%sD|^)bJj=Wd9-uyVGsa@qV?b!Oy@%FFx+HEN9wuQJlkAl1?5yyXA> zSU%#Mm(yU(JWTd+&tDF3@{0WynAg$!CEYg`!&3a8^u_n-nm0;2?^kfWepWoof5EZ) ziDXi2p6Dw&Ho*UTTIsh#aATBat$K*+siuQo@SL5={l!7umaEJfAGJyrM{joV5Q8|Eft$&aER~PE`;AzJYpYJ^Y*L2-Gs^4P5LmGVybTDN{gMf%2XvuA}W1rbU{?)dwh*lg)QYL<8twG?)u|n z`n_3kKZSHLNf~KboBiOF2;pqzG~sHBZrHMaksWgmwb2mco4b%E^X^Gwm-r>;S<@n>3T8Uvj8=dhn3*%65>_DeU#`TfL*)U;ST-LESsS9~AfpJ{w-c)NZkTc(hdG zPC-Nse=dts*8$nRv_Sr=?W*3Ez7@s}V@4i4$9`>|f+}*ojDYTkK?^oGLeFB@OMuU3 z+ISbf2Lz4=a_g7W*T*%P3a0hwQ!BHdSoz`GoURGHsUhsifsLbJf6FQ#^={weUH=paddHOKLAz7r<1FYari9aU-Y1J{H{U!n}0bgV))vj9xBgL?_ciO(%Gl=f>L_B3$n!&1p+b&r$1ZJ>rUmqb zxk!>drbTiFstCy!%-q7ad)fZrkU~HgJ73;`>OF-%#7!CT=!LG5>*RLskLKHjev=t? z;y1V$tUcAH9^$TQle5M#_r7Uy@>Zlvr(S2z2j|$i?H0EP?T$mM&lA}qM?uajHw_M? zTH5Y`etkxhoQhQP_Y2O`e3d#A4_(mjHjG(Mj61G=cdN615xy6{(B&`ES=IMbRIH=a z?K-IVThqm--=?4bncIq=DQmxcEFkCkeB>nbwk#)K%NI)bMtY{6E9E~`?=Do&uj?k4 zsX(5>PTlUCnCjHHs2?bm(N2qfXu{W3xi@cp->MY6xL=R?Zn#w>`tIbJJW>^L(AQO@ zIs6lop1ltFCueSV;oenYp2xPdspPQc4I`g{^w9t=1GAwemT^s4E8jZ*^LOu`*KN?c z^-z7=#Nn0ge-5u-_l(%g<}KdXiV;yle!QPt8Q^um=XKrrTI>Uyg5EQ()46l~cV?Ya zrs*F-Y&W}Q#$$PHc=U#~4#HH@IxOJJ?3~F^OW(fY?<%jpcb-SSZ*C;VUYc_kS`@hV zeSWcXGPd|Jyv40f{*+IB7P&Z}{O+>_h?jb5p67K&zK9gqSD-yA$o0kk8#QvBTyL8# zgdlmF^+ogHqt*(}m@6zqg%4GAAGvgLt2m>*lacK?W2CDe!=FE07puP*{AB;- z-4m({?|qnjIi$68bF%wH=jd$m@AcrHgGRo&z1?Wh;#dV^p;>6%Y)q!doVtho zpBR1F%tpCPVTVi8WiS5yt$=*8Jv$QFF2`w&*ye4I$C%rv;N+7YdD4uZZGVx26u2dO z{kEYZFgH1C1jCdM2%*rXF-tNM1MRun&j2&>IpY(1a!daqu>~UvK6fM3S(osgGD6kQ z@jm0W0B|ID@apTxg! z#y|+QBeKMT-RB-U z7k<-BIL+33X5a4h7qWtOZYXo*Qn}!+66}SJNs`ZSfZcze~tUUt% zhUQ|s9(K%pL4hOF#)|TM%o2-!9&}avqz)gVxYW+Cz6}_@_eiAqlf@8j)k!Gm4}LAS z@<#Z)-pJ7s4fg2uUsuh9nRfc7h3jg|PN)5=+w5vhFQ2}+r`4WVonKFkyrJqLE2;b8 z#h1FCgiVNnk5cT1*E@P6!dF`YHFf7zM8-cW?|d3Ie!m>L8UOp0!I3au?)DQ4W$EJgPS8yWQFpI9yIu|MUiMdt$K<`=PB(iTI8)hfWGbHH%Db;y*vyslP*`8R z@r6+CCF7FflW*F$&uX16@~&9FyuPTNZz7;?-xMpB|Kj;uIrUJBcgi_zwkwU7OEaCC zB1D_`Q{fV{m!*R?hPCVK&GYefk=jcAjgwt4f(k~NXI)Qz=8u(loMO?V_G~P(+5L;W zVN3Nr>ljp{Q2Z$l>)&D8EN1!EW9yoTmz^OE=a< z{B!y(&9mDB4{jI~28)b!Bfd7A-)P8lpj>Gl40avGQ7V6w;rosvQzK&_fdJ@>D9`N8_$%g zzPVLb2TJ`XJ8JOO;o*4j2))RLc6bwUQcct5k1@kBX$XOSTYnQ~Jcxip!rWVXI-LUS zb{6cwz9|1muv_s(SjX7kXU(0zgszspnRwbRC31Ch&hgH`*5ub_EFz!5X%_e0MepqG z!zQiPN55We?--mufEQeN@y0*Gdt{dC^-rOt{cc>;)bo7ZxPLjnw_m?mRr9+Y@aEF^ zjzGd!=N+XG_g6m_U4I{i{9*q+rIe6+F(kXm-dXy;SUa!;4_ElyQ_YKy@0E#mTir?j zrD6jKwDcR;w39FWeEjxa>-7$YXA0M+b+#P*LlMi<-R@--Bf*y+_>jhnkw&$fx-24DCqe_jaQ zF}RsC+*D5R5t_g6pR6Mi*gmKucO44O4w&6gMP{e|{DWxkiMbgu_(T0^=aY!E9(&tM zS7-Oc-uwyPDgC_|xw07a`-@gZ>-@hdxx?}8w1l&f9i`iPbrjQ~{-b>_Zv#a+dr^pA zFyGx9C#TifP&t*h!a)DlLst>2Qq^VEh97o{vXW+s3Z?Dk$zeCBQppdJpUF?7=iD{D zT3p=2to%1VHU+!h9eVnwV0y9ou2Hne+yl&E>4mojzisDR7E8`@!@TOBjx{wsjZ2Ro#iOo`2m?IKu1wVGNJG}bo&~bE*KLP?DQmtw zIzQciYgSc6{o|?2JkCHWJU6z9PLC;_GnTND0Jnvg5275h2 z_*PcqbVRt$i5#hlX3DA$V?c(p1e%rhM@n=NWeWK7TE($~)5#5kC$vVCe6?Z5$ELz9 z`E5>Kr;_V?0&+%Z1u5||lG>aOzUrVX!c-*l?ADWMQpEEr>=@C$RqQPy$So$|3(nco zKe+POxma?$=k-AF8`3GnBWUzHO0}PPYjXZx`t%PUuErdHK)Xm7@F~*iF<_T@tN%?&Kycxp3jH>A_L+=aR&^%{g@aQA@%>{f_8v^lRc+ z({olFH=lrOuhhjQW+mk;xFyd69EeZfa4Pvfvt?Mwr{qKb&)Ua#++UxzZ&R19L_Up7 zJ^WU2qaAd+)#Og)kEYLyS3i^6AJZR)LxYRYa14e@*Y z$78Qdd4IEC*mAPIRn!Af4X_eR<>S(gfC{kGIyUr8@O@)q<+d|(7}m6gvS0QJl}#=%Lmk`Y*nm(7U#E@x8_!;#TjRh`g{6JFqZ9 z)o59g(_GVnuajuxcf$^+0}z>aX_iQCcxLNFZYBnlvyW_+?byeJ_o8!i2I`FOM3I#_HNvVD@RZra6fP3$Hh5k+X-D(>)b1Gk8*^zGLIl% zj#Pe+R{l2KdTxNu*~~`!fQ^PP=wQUb;}0ID=(INBP#-(1;l)VWRouzL8?lu#^T;oI zC(mvnZ=Sr8Tks~!1a3wIE6(0~O`dRbo|FlB`Q`G$h}z7Q^Ya&-=a$17Qp(ZQ=%j{; z@AzB)8Hn{?5q+0RG0sg2tV=iUOEh@IzJHzj++GN@_Dqmz_wkvz}JkI)wO z?fo(T=}U=?68(iVCChzWl;>#Gy3c6WRvC0;jd!P_Y=Stdn*(C0e!?Q_H}!5U{Q0-5 z7y0}1a)8%uiHjbUNkF9*zzU1@2T#(Exu5$2`^bksYO}L7>zzw%p^a1O+9)HEkddNDe7vUrK8GWDv_>m7 zPGq>Ey{-skqtddq1J_ye%9|~3?z4U;kz-XvB$)CWvn7L&d#xKel_84l_GT=DVgwAB>0hpD4@tiZ+O+NU00 z1|$RJhjKFBM#yj(BcsDfRqC8I6gKB}M!oa!$dWBS{gAZ|KFhk*LpJWu3rEw}733<= zli_FTb@`x*g+zLwv%>IEuA#(8#+&&o*-ENjG?jsl+tyT-vz-kMEl%30`|h;iy&ttq zNB{V3);)E%?U}FJ^6;1)sW02<UrnXJI{-s zo@hy1EV<^xuZp6Ex((I`_U7OJWBaNv`zpKjz6Zo&-4+!Ee;)4u20xH`%*M^ z@viX-7e~X!yR(bdAF2{X1TAG6%*|T&`e$0QaFz838ivWCTD|SxhG-1tPEz9vIULEB zw=DHJ+pDPP+H}@V4bNKE@5)gO6|nT>jO4^@P7YR4n$R#$;%`Gl7wwWN(%=V>&a3?t zw!+06#dICTBLxYPISM8wYkcL2qo|G)QV)Fva`Hw3K$;0ki9#Wp+f- zz_~B6>baNL+TxvRnROXOPsc!UvKnR3w)#*GM)*eRsja?Yqq>GO!&w^*7Zs(DHfM

6N8a-xd*koD(SGMo-e3bc zsw8b&BVCr0Xj-pxhb=GGt(VOgy*Fzb2=iSY%unF-F9oT3_!!-?yMoKriuRKfa$jZ=eTcmz;*Tgi&ER6mhJ z;5&{HyHU%aSrb99(PG|UkXm06!T9<^R=MH%)|tQF#sftHqd6(FB8kz^U!RW0tSL}2 z87~n;Wq@N4o}^+!c8{v2mJStJth17F!-gBDY;fWeRylW<)z==d@%kyN4m;}2`5M83i4qtY=w0RWy{z*mF5DCM_#E zO962j$fz}EBMqxolCGtP_RCp*mK{I*)m9m;TDq|&888v7K~FNHAzH^qE%6{jA4wK9 z(Vg~YtS!Z@r+TKL(BcDfj30fQjZS~q@^;7i)vnFR!M1x18#XfQwFiofG*rV;3^b%+ zI3l(8UURDB4}t9*1=lPJ+;kM@e*j1kpOkef#0!J^Jvjx%#OgVD6M+8Jc|FRTJC-@O zb6c;UaKp~m57=yF!4mbjCqHvZWAYc-Xz(0cIB~U&TW4%-?`<}BVxP*T3MAAxGG1P1 z_J#`W8#Rr#6ZO5Unb7b=VRv25W9hWU?%faD`iVO&d+?*y*tp9U$166Ij6~Ofp}TK= z=eUT&71{6_)qNWDi(p!txd2}wsyjM}Y}jLwCt(CW&htna6g`Lv_Lx8|90z}xj${o3 z&az133s@Z8kTixK$VJ4o#&UZ7kqs14b>&q~$)PMf`-oMKyu?lpzDADpPOB>llMk_6 z2sSn{OP6PDU@Ho1Rz1k7cV@)LlA;;)bd8Q#XU?u)@7i^D{gpj%>@9ZpnGacKNxr8) zXZsWmjRzw;J-1@V7tUC#+tQFq5d{pC3?htU3W%j}p5=4lAsG7=FpVfK7hH&VTqe&n zmXo-O$f9EX_Np9#LioY83V-jnd(*pYc=OY(dev9iV)i2Ce^6ols)i@(QRN)!{hAGC zs9+20!|#@W~V5+r@Fog;UoZLBW2aqc}Fpw%zOlZ z5fPL{f27fcdQ(E%x-})_tee}QuAcPJqSdc_o;8+llq)!DgFZWB*DY(Q$7PaE6yh>oYAOk*v#rDt#aS3wtDYv);oEhdg>LMQv^X2QL7BqZVD5b z^pu73LE3;HC+78pFsKg}UO6ETBPVUElV9=2+k2AWC;sr41k#EJn|h&hvFcQ3Ph(-3 zc;QO-8ga-+6q8}hH~1P76tB`2Yjq7T`nKK~+WLxy9KDXUTeH?o_t~f~=cXY?y{@QC zkw|6Ol8h>fa#|{kU}Cp4)+J*7nsFZP;0{mC>1EFAHL^WZvfT z1<})0RFfG$L9i93x_%zYvIwVvhLg%MbrhEilFvwjDt^WfV^Qzrj$&lJQNxz1%hv9m zwb5*9)u(^9ZCv$2>r{>^w3pN9%vvK`ujg>QG(vt9i`)n~oH&K>w78|K$q(os*_yi1Y9P|Dr3%0OdsMH5WAu^=hWWLR<> zye0(}TNT@L_I}%Y>-)_<^fnuud!N-?E7nd1maeU-jk<~wRF()rp?IFQWPa+ARW_EB z>q(pK*Cz;4m;1JR^A&}zcGm1`H8rn%-siLXcvMrozSx3%f zU3t$Pn9)dWWX&@@tFG`RYSVh6Buj^uD#}n? zyZ$4<0M0rO8Ht+=EnUeZS7;XTknqBZEoX)jT)zH(Abbc%26b&e-zGy-Jn>YB%1hS zT;cVI569HDe9m6aHOx^?Vw4<1h4fO>1}8DUQrz%I`8O}i=>k1KJrE6#I2i6Qap}&2 zj2ikdDe6vyB5YKnLaF%oAy6jX^EL6!m#*wfv2JVq)7BlYT31dc%V(|C-fsgr1b*Gj zfA>T~kt*{yERRoCtUA+@L#|t=s~S~#)*i^|uG>oI|e^1IGR`F&VH?<`p{VW%6(h9Fz%x^40O!!Wnu zxMyivw|ua!;m2{S-+ZI3T>DLSymF140+VR!`4wvOh9qwsR|tL5(v?rsSx>-bSbVofHa}jMd`HT%U}qbLCC;PvY4;`8J$u|b zvuCW*kOR-g&I8UJ(xC}}yF%aniliwBF5)Pp44WBtC(s+azPJeR5cEJO5eGmISChiY zF#Buj8P!Y4K8J%uihI^Z*F4QSSHIYLv(Jz$TQ;NdbYg3kRWNC0+1cr;q27_b9J}g? z`G!J0u*sol665p4UkF>JkWpA!S66hM@BfCVtzsg z&Zod8dEsPv35&Br21Aw65MbQ!58YBZ$f|W!Ro@cHYdBc5Zg*(y_OjK|19HIZ!;xyZ za#DD^8cL+r+)zXz^ck}-_&PC?DJjiZ?K8Nm6gT?Mc`Vck2{$suWJNTE=d8GETJUp0=$11Xn6Virxv z1vC^2r)^e1tlGYM-DVCy&qnh%=-Hg{B_k^lN9_NYu1mo+{OH%Ly)kEfjhp#CqtzKI z>Ja{BZvB<}ZS~_Hw95VWTDv=tpipg4Bj{-3bEBZF7Z%p>iZ2Bg`O%{ud z6m_lLW}W*!Wc|)rtMTK=iDcowJHosSU$UnD79+`7FwZMh@v)|JH??kU-tKwIUfXl! zHMX3|q4bn5sjC>9?aEOrIH@vM;q4knNMs5-!S0@;K*3>GhjTq)-FrzXHT@$YIIsUO zF=SJbYt4u1>07gwvI29^u+`RHJMo<7*x5s0DFt4ZL+J`JpL);QpssMYF|^k3v^6`| zD*qKWSh~l<-?>WLW;HgSyZ3g>Klpa5-t*_Sw|>gz)3ZX`v(wG0+>D|UMGt$1>Pa>D z=eIX-TF}O)<;;!njRm_~5u1?CC)^`B5sb-y%ty~Lb{|g35pedm2@VC9#a3~JVIv0j z6~aM2q7LNb=`IP64~hdB>cT&@mmw1|6pl)HTy8isJ(E)$b1lAWVMpzxD(9Q= zy~?sJD#~C7&~f*Sbx(fMlGU@eUq;@VV{Rw0o}#pIf6+3w;j3*ZVk5#(6vAe`inMBV z5uymB*WR#|16SICv&(j>bIj7A9Fm?Tijat{d~Z)()o5dAq+OLhg#xx6dhGVeOz#NA zGMz1)`!TU0Cgc(sr7YjggH?(HDZ4sTb-3&%HMVxAXU*k<)_?vNStDPR7GgA#Wvbyw zDq|T9tlH259gWXx z%CjT`nh`O?C;f(c-XZafq8Y`}iBeO=+}vZ9vQHa`=DzC3S+JDajTuLv|F{J;vO5HC za~ZBXOFaz!8FC;NzJ~Q%=bpb+MFkozuw-3#r1(EM3G!CP8Yb}Fi*oz^7{Ws|;Zcg7 z^F0i;P=?Ri$Nb_Mldvj>TORWHJx^1~rmCo+w`%8xJ}z?XlKTI?94|#VGH-&W7iBGw1wKe zwlRCc?pqqz$)*gYGONg=?GXe!b62u{u_>+^k|6_81aCWdn?OI!`w&=Q*imQl5U-&I zr^n>0?=c<$V}o5Wi{aLUhiL==$H+&V3=tUr!!zGtXw)R9R7426vOX&?EA=Z>jPGNFSBSf5%kpeSxLf|_DXW~ZeD+Q|G923cxu)HE z@Oqm&aJ?-gMO4N{LeyO6%Ug{>d}S>JPT`_3jVPR5sW`l&==#qb*H}hTWf`#y5hIi) zvh9KLr?xlI(4yP1jvT{-FMO%3KjU-M+vPU9(vl(1+E_z`Ov>ro&@sa>TD3&c!Z=;B zVTL*FwJXp3xgGexYc0F~Bi2Y(t=7``x|doyn78@ftj)*@6ZM)2-;c-``wFiIRla#x zP+Ct$>n5o`szV1mYz<|+@X?erYYY<~GL4lm;0H&XHT}~)YaTFp^7?O)=$;8i<}5}^ zVCOCJHRT|9?a5MXhEnm7&}vg;5H%H|6QbgIP4e*GUQrYC9Aga?jOE#*Wfhp$vkj}& zjw#YQ=M#(hXi@T#;q!TTO-`e}AwF~4NV|%N`l@5zYU>Saoc)j;%s*`D;+l2#EZW!| zF%EQ5&l=XQwyak@D>??&=+D@xM%`9tL|DFN8}m2WspHSGrPV(X&&=n@X|!kkSJ2PAe@A4 z*)*1B$zWc$N@GDo0vUo7t8(~S%l6FJdUc#W)D+Ps9hsxh7aq1r)CrQ_wP+S62TG5jh8pnSC;O zA{02r5bxhV&_(Y?ef)Aw%=Kx;R033Sg*9=!0S;NwiWS}v9R}luidp}`E-!&QS ziY*O$w%i}szKxnKcN$h7$bm{`;9&{5&qGK~EHvZCjtA_|DTB`mUzm^_&1wjjO7`qe z0Uat)gm$if{9`{4+Mtm(ToOV9UOvOFWa{9r-F>UB2tmDAFlM{zZAB`3`f z9HnBrGR$qyo&~F~e9}5=rzKZKETW5rS_7Zl)Nly7LW5{_x+iatc4Jfl$392lI^o9Q zu$GHHFm8yl3qP@3a2L{?e-J_gK5RR@A8~i>>FSxH3+9 zWZHuU@eSX6f)E!bqu02;pjGOv#$+{Srs0tKPPv1^V0mqd(GyPNSom-()ZFlgiR~9xw1-fQ3f924yF1Hm$_~d1b1zh8E0MusfFL zR}blthz{0D@D{|s2a$2$C>X{#=ble=E9$A|>oO}QBQyUze63lrm1fn}9RznHVSsOR3!sOy$PBNMGW!K3_Jv(bps(sbPiV)@nsGsHQl8KxIe!_j1 z0EOg|D2@r#5pP9g@JX|&dzC--FD;=-STU{^;Ju<8qibap49 z!++|J<bd6m*QG=TdUKxs(_u zMY=mOITwtd-kmv$p`P(Z!*`R?kOF5_9}TST+t~Mf?LtqXI71(dlSBQnjDtCjV%UPi zQ9|K1e5j;|NKS)|aIuv{y>(L&Mr$ZT9k3#DM)}q)Q{>d;2ZI}Ha!zOD4A^ag1!+<$ z(NrDbG;koZ@||;%vxW^qU#)FeC0Q50azrxFf^X_q85e>6i7p&CU+DT^O2o1`&|;R^ z!A{SPjqkT)M)~*5YDia1^!CIe3&7y8GC+QEN#du%+oRFY&Qz|n#_S&Jubj62nfF`T z=I0sZjO5rVl3#nIp^c)s4OV`t9Fy4|8Ht|V1aLczC>{p%rEZ0;#L`>|iRD1*#bhwP z&`1h1mLf6P$?j2O^{UO~1D3Y-Sw5JRK>4Zvu8ms7>r=vGW(f$ndm1zMn5dIOXg+w{ z#&_JQo~&QiAlv+i$Ju)s?1_#CK<@5UYi+w zIf$xy&$_M4usSkmjp9YqkjYv(JBAzNF4SN6RE{6@p$C;`P+jWf#ZR}E6idcsnCT!> z^uzCjcC0--s|e|&W$8fPU|>mA&NRb$)@?AJw;r3=GIYW@f|Jf!G-jfs$~Q5p+yCW? zpsMQ8S!p?;CZK2szbbfFd(>(TH{veNWu{}Tb=7^(ajUPdSPjRVt-E8VU}aGCjdB?J zWNB4&4J}RNRE4fGvutw*ud!O1=svZ9_$43FRjRtElHW=}GEV#yHbK5SU>EufSsLR~ zX_^k^1w25Pkt_66*gW5p63HNjQc?^nQwUt0o3qybtK}G$lwGQ?9w;9+WZ(@CMQD1&+0i7m>Nn*Nm;xF@Y8#M{F6rwSdOo( zBprvQXEoL-$jCBTA*I;NmPyKa(K#=p7%0piRyM5F;B{loI!RMKE8ELy;F2js7u`O2 z?IAXF3gj4YMC?)7R|G-`&UDM7dgCK<2J`EutvxtxbCq*4uw&L4-)rN6jMYxq9?{dO zHLcfZ*qR)|I9FuTl%cXHO-5Uni{KOS+L*Z>h8`UqJ=IGTi<2%)6JCgLkby^dL?$^7 zjQIvRtxR$f?!Ci~CC5)#Uq_D9;iu31vvfru!dJ`cE)(8ZF&E+Mw$nLV*Lk#W!Rm`g zHFUu%=ouADmegIyUV>+`LlKETn}WlZp@$mCuXhWe2^bCioPgd0k7F49H2+;i-5I9FL5>%aBG7h$PzTG21dC zh91oH=c0*Cd$Xivr?a80?0KfO58h<^6n1y}9X;l(XWssT>8IRJi9gsp|CT1{sKFTt?WZUriz>U-KY3cyry7 zqi78@wCD~kn~}5Lx1{#b<6+HOeZDghE=6;rRIW&Zstn{P#LrNjLPJiWy)m-Ev2!+C zYg;PWWf~4?tYrO!Rh}v@AHk|oUtm@=!>$3?-EQbnaukH!dgj-=15ij_mtmL{54|NA z84+Xqri{FXlh9Z@(fGW>PE@mdZT_auw$+6zZJ6<9L}i9DxRi(jm%|UvDEuC&=fc?3 zqb+ykU~c=MRqnmh=JQo+COxdt$Iyei42iWFu8=fJamdx^A9D{lZ=9DN>kknIZ#JrR z98|#pKTO=zfx>H`qm+>iWz^l-hONvuZ1#$0*>z8OhRtY9zIJ-m#+?lx`wwJzV|I-i z59AQ#Tx4mv93m5piN^d*-M2);+1{EZb8S0v?M=4#y60JPs0oDB99q4l54HL zyvLrR(yjTHEnl&0d3#{T&ORt7(NOQsCNeU1{E_v&=dQ4wox*;&!Be=CfE)PaO81C_ zw>qToR)pc#P>!O@FfNm0Pz1NaM|Crj^A%TEK58oBX!z?;M8l5&QJ#s`5fjQywf0y; zvId{k^=$Q?JFUUnpyZtB=-URvrD{|Df@SDT8mlekq@Z9ofw#kj9R*5B8|^01NC_*f zm5{Pp9_W_ZbR}}m7{1`yMIK{#5w;J?G1&o!<%ll+RRN-prZl~| zSZ7hnBx9J#`mU(smWC4z;grTMtG8}_=)G1yeXG@~XRO~E+nGc?ouY!eV(7v_&}$*{ z^9TQU#mW8-%%Au^7HS_>Q)rMQV}@=TQ)zNY#V6%5#GVX6PNH(n4c53$J^#{PIh!l2 zFJs9!&f4hIiZwP?Y$olBPaIs)OZ$gma)@jOlTc;tjGWnurH79yczC`Ik37fLs&iH! zB(`vNWaGO(Z0TL^wz&u1Vtej;jkV8y)HV*wdE{+d?J@LPvgP*GiX>)i*kwNm4a>$W zVwE`;_TrF1OEwIBif9791!BuDb#TeqUkmFfmY0i1;b@8<%BCYlPkr80%v)>UemQU{ zc8%c!U$62ZUR8OjGJl4XD{|y@t2O7XcCKni)^bZv-EOt?lyxQJvyG;;vbrrQ;2YG` z)*8CRdWziyuseP0u>}wcLj?}HFnq6S!K34 zDy-Wmf^{`ssv%9omo|@7*H{*vCH&}d&ALK5R4+T%ZrIUl589PCTyM352W(9Y_B4nZ zW0>kA+4!Y0#u8+#>>B0Mn@rrQ4jJFb+QOIGMrGY*mgML(_P2#)J3U_TkJ>ut+IH%W zuJ!Ktqz&)i&Y-{xc??-QaK=FJ!~u8IXisS)2+F@S7Uz-bF!X| zHR1bLNuUX!G zrZp>nAmwXWFKt<^KW~je#kz7Tz9O=JR%7O-J?j%)JMzxk><>pjX;lqdD(la%L+euB z(T4Tr&!{dLXeQ&-IG;8tOPzbh9zhjOAd6cadysfes!$Zvi#Pcwb=*XYV+f^a5d#5a=UL~*6PD` z+t*vOhWKBtw(ag&4ZWW8r8c_yADEpP*^R@#H9qkNwsPC=iO>gZhR92fj0x9Mt*2N= zk;b!*owko(eZQS}uAI;{uN1{!WJ_oE*o`NT+u3)&)=ss5Njx3#^%eD0Zeq}tVK&4+ z5f)AnhXD5z5bLgrw2@94d?_lZif;`)dh6C19kRZnhnd>#io8~=^}H{z6W4v6ovuH{ ztRtr&r<7Eiid-~I<89E|vSrN&<(^h7n>%VV=SFtb@BWFMt^7BuCVYH1Z~UI?0Ozl^ zVOW;otRK=cPi`pmPV6(`#{3ZaJOQ6BDq!~rB)|p3z**tDuWB@n`Ky^P@L}iXmY!7= zJC;Ld-NiL$y`?q%S<{OPQHCKE2+vZpPaS3i6YRL||Nd%U6}I=UwAADEtTDX9n%%#$^@Hk>pZ#n*^%*a&MQ(rz-sQh+GgkW zi#$2Y!N4{ixZ66Xj>~}(MWjBA8T0;F+9Yg3Iks*~yvSKrgg>?3i;_nBB%dh76& zR&N|q^fi=I8E6;->blRXxWI$wV1IJ^P*D3ovho)bmAnlZ$}ccSWVW$#&bn)BY9HN@ z1`>uHqA$~#nAwLga&C+AIIK*NjiiVa&B>di`5k5fCRv9Wq&jg<=wEG$w?FqBfNC*r-mb?P?m zoRW+AxO#6nk9W)1|a#6>VCvK@FBo(wIkYYffGME2iQ&)Jz*hkd~8?EH?Y&8K?z5{_y7rWh-D)#``oC@dFMeCYrTc8A$_mh`ol~znRxj?~cqmfBsJvHI zgh2$w{9+TsOH

gO$dNZ5(}po#-vtjGSV6;^S6deV^^Aov`M(5mm9WbHo?3`d2v2 zoq?VWVB(gDgroRMR#0WrV#!o|W#?8cmt(fJq!&mXp~djB*@?aW;t zxBi(2t=(qHvm%6s9B8$rVFN=4B8s6x_e^y%jHp<9ywB3L70WbSsbrZOeuhp8$4>qww_<&@Z{v)d<~GaSWf7S2`M%;e6!)GYxl6KVY+2 zM+Nv&RZfLBOf2nAi7Yhqt4ZcK3g)2H6svm|tvP?S+Ee@xov^>DoR0ry%MMO_x5Dmr z6et4`00+8A4~Il>2APae|3>O%MsxFuAfBxUGKSSiNiJusU+4<6ys_sdQC==D7wK}%^bCbwI!SX=z})% z<~Q1bx4q5|-S%6yxAS(}x94M)FWqIwtE+adIcL_`ZwcGjk2l0BleE++D&#Tzw>NNL zBZdM48)S(MW)9f+(6x4EbfqQfVVhl9wZ*k#HaEW8ns&k(%+IJR_mv|uUOv-iZ;Y0_ zSSp<9a7K<|!S*JnY_{`0OEmPcR&HwxGq%3xX32xswQR4aAzCJyB!9ST_auTc7dhiq0x$AwFt=_53rz{s~Su?e>mA0L!?y+if!)n7bmJaTh zRm)^rxICO9EWxv!A4V#pV_&DW!N3wZqCAd0jo?k8}tuEI5L#&aUjp8PpZQku^$gTfqH!S0n5=tv; zqZx(yeH*GL?^k9eE%ok|zIvXfLSGsGs3ja4UNE&T>qv%u%N3fRJ0~N}Pg|?9W^Kj! zYl=2p@1&erjo-LX_^uwYh%C;xzMh5>BQ%Mgg^epNY4g+sjh)_N*4D;iT)cZ!|W_5lS* zZAomcuY6glrhQ~BCV7Khl zI_%+*%&BJ=dy@HxHzqjFg5fRT0|!4CpfE4tAOoh?uV@&-8>dPxdCO_D&t{^iVXiBu zdggwAbCV3^N(OQZID188zFwvx+4~oxLY2$;iSA+ZfMmmPs`vq-MEI-O$lvIA#$5<> znp-*dVQT?}ciw$~s)iJb-WH!R%vYs^=PaL@u}WRNjtr-23g`K(oF(3}hSrFs!HOEH z3TuUi#aQFooE^CRUQ23yTT?{QQSUylXv5gZ1%+n=7xjp2v|kv>!%c-|Vuqea-izv< z^&KoWN`~{cV7FO4x!pGA?zGjpdt~gVWZbH!H)~58mh3y*vc*-=*YB%LM?((`T~&+b zTFy>bJ_X1~NoU?62F3kfV^l>dn;b_|l?vYm2tDp4vjEs^JIo3*(04rkZQ6bUqDuhZUb(ZS^FRL2fgHQ#L&PZuxx;^B8CFIsAB0 z4O6#X`>ap8jztTTynIS;He;Oy@mrsm(wcoTHbQm8B}Gd4!C)!6_gKm&$KmrE(&*Wmdgj%;6}l7Z z@?lXi*I}at87Z&xI!yn`80BQ#IiGjcWng^lfjvvOWi0fqrU<5*Ehs`+w0@P(w#`~H zHn!$ZH8e`b>MhlKkE(S=5q$U1Q2pu|HGE+uDNDUQYLXFQd=)t?CLB{m5ItT6Hq6t>GT)s@^q!y9)1ck^>VBzDcg~`_CHs7)bINE99cd<=iCzv)M)Qy+=c}k=jf$V1hys3Qm2e zcxN}lu67gw?jXGLLTRNQl8SU$JyTD%IV;_gR@c_`oJ@L9VY_@L$q0jS5$ZJ=O4PuE z!aitCxq}`bTUA|+VnG5D=b&!g5nDYhQ=f;Zz6CMd>zRyaI*KS18}R!XqJdA=d#aCJvFrNBhiEuGVGu7k3ttHCa!C|rv_?xx*U)9yHGY(* z)?2lDb=4N+MEQ2}TvJ0HnA@DA*dCB=!9Qnl%dkLUP)|dNQB6Y`IXp@;!P$_rtjmWt z6ne>ad9Wo}qweU!y=;?@`D@^|nX6@t}pJ%Tdo3@~K zbyEb9oKYT@ACG;Gf?0Zg#HTQlsCz4%S5yp}H48nyo@^*Y9w}62>3DZZk;FdLwcj?X zOLn|jw^PlUjG8wcO_5CVviD`-Pdku<8uD$4{F@J<6h$%gz~Nx+b#d%7OExD)D~c*AibQzjDxWX>QwZ4g zj>4ma$(c13zRn$s8p((lWwf4Zy}`1=SQLj|ls6iz4jj1A=7jU=<=CmJ$t$=!j#*pA zRPR+}95d?u88oQps|>7@RMf)@rxcO>BV77B7)qh0I^<)B1oD#zDi1DesgN-BIGE(jHGf_fVBpSCp_|K<-Dt7mTY$2N2J z9E(*|>#R=7Yx6eOnU@Qp$L75S&$ffYNpN7(?70Em{9cFuz_VnXGRZ3k$ImQ|lA)ZF z9Nw^HO_6P*d*#GVtId>$4Rn%omUj=REfSTNGZ^(X5@F)GYb&*(4fid{2}>rbi+y$& z&M@!0Q_DOVVbcz_Ui+2W;Jh$)lUN=O#qeVy7WKOPbYL|j96w@X8KW=VR-{nLR}{{& z+L2%NmYTcmF^s6%m4mTeecx%j{pdM6-BwsX+GFkBg4O%X6Y#x(>`M}7<6YJOp^V#$ zy%?Xf-k|{DQZG(`-;lFlQgWD#Z9~;|gqoeB=G1#1S|8XU^``R}0-sazc0mzPrNY83 zdUkLTNeqQU_&uR5<5n-*T7d-_HU=n`=A|b;WHcOVSg|1tZOLYzrGtGk zE;*Ct3Gvpq`Y^GD4Gk{jNcYL$_HSg?SRKl_G(=~^PHPx9s5ER}S2Xr9c;^@PgE`6;T((sQD3%_^O}8fmnx z-;#suY3MXum7iNz8}@8CGjFSM@*~NsK9rnP<@OHj$qDFv=)cd0>6%Cn)#M<(Xo1}d zZm1IhP0mCW1iM&EO-ejeIL@`dTPLi*c_>^Zp57#jy;|Ge&-qf~N@)%nIl#+VA{ z0G$2-6x+d9tjUl-WoU$*frct_6mKU;Qb?=|9FA{jBSZEmLG&>x%L+y|ZSfg@N~_n- znc%E4*(&~sr->xs6UPS+LtaxVi=vSVi^eD~XXHP9n2l_xUYQT&YNN572SYACFq4tW z+3;JQ6!r;IMLw)$NJZ07-Ev0nt)ba?tZU|N#V@}>iUS%;KJdf!_I?7+onrlCc*hV$ za?l@s?y$z&B{`WM6PEDf9+w4b{5UboyF2b%7(!JUW{niXxV)7wk+Zi{a#ECn%oLp@ zwFNzaKiq?ytJq>c3mnF7f%C&}>4JnO@i}-Z`f|RVwr#N|J)jKR>jUlr3zgDNdNi&> zN`(L?g*i)EeY<-Zmk$e+jNVn0R+Ryl%aQ$ZrA@hq{sqoomBDeVafu=v;6bTG3J!%8 z>7r(R-f*xnZLQ@88^16)%iEevLye5ZVr&?r@)#!*zFsT%L8U+7#({AlE22ToI%p-D7SU-7eyneK5o6Pk&il@X)xHuZZs zkjXW4e>$$@?H%8_`)mtylaq$(%D+yi_mf*7ecX3-ZL z^7w256Nwle-VY{97;zTv9Cc79e?}a-^v~o0)xn!0c;}l7em$*lHJ<{2n<7CFXK6;0J!+35P&#zcn_?zcQ4#? z<~ixQK;h##sY>Fp+YlcSOnO}m11LL+fXO3WOwNx2JQNjXh}us`_iKg;To*jC;xkE7 z>yL;O=w*2*`hBRRD1q0zGNK`~lX58jbAKg>`iK*75)>cF$lOWj7z&4f(B<{f%NN5V z%n;f>Ym8>C@gc_J_n))%CQN>wddAJEiK0d?Y`vz$vWT_ zhcSf$T-3W8$|@vq3oZ_K7Jk+}=^PWsF;UARtH6gDXgtb=Zu(`RXec1C=^TIwy2lcH z8#vXm`MV&KN};{@DZ#`IH<2?Kvucrb6W&ADjNkGshD)0@{`0`Ss5|#uNgugk28wZ9phSoF_`<3R5@-w6Rd2$>CZiU|vjNu&1JEx+wb0 z!pw?|Vt`40o!o98bpU^1K%2*8qR%&Y@g8;(^6TuqyLjM-k-NPO8}|7`yD;X2pHd_W z5MRtQWJKzGjO9ZKFbj)LzI(Us{ig+ZA~E@=K`d)+|qVY{ms!}Qz4Ka_QQvA|) zh2JbqS~jDSENF7!DtzZv=!n^R)j@~N?%KTiWUmU8x=`9}0HvKY5K{+SqR?Ek9*iS^ z-kkaVTw`L)_+FEJ|}|JW>Dm=_($NDil#_!p&2 zFb;UdEBWDMiZ>10K}dz?Fbend^+Y17-}jtgXu}e2IVFWLEjhQkXs-4f)>8VQDk%&_ zyYlBOwY5}&@z#-agddb@htXP3j)8^sYF9ayns{U5UUx>j3EV>#mu0{{B&L9p*6kuF zo2f?uuD7g&>{&PONoiQOz;AdGLNm^m0?E1fa%k5y8E1uKX#GSz@~lZg$1)y0Ly389 zC`0rerV7;huR8TVB8>~_BaUM0b4bioJt4lEk*;w(K5wGjyxL=NGpm$+YkwIk!-l@B zeIt>XGyeA6GVqZc+@PiiLj3i`YrZ0cERL!x8d#KLYFY;z8baV8`C^mLwTrF#fHCMk*xd8}TO^$@&|=keGr7iC4W$Xh5XAuW+>J)N<> zoC80qJLHXl91RP&eA5`$JVwmLkiU*9(PEsKUGkYZAsX8ipPGI1amp6OHhDs*EuvY^w@I zNW)_N!O*|dV!8Ud*P`}DiKM?@$ zI@pqMBu6H~aYKb~fT$`%DskrR#SjtaB_yQjKa;LxttcAFvP|Tw&3Vmwxr9B5!S!Ma z1u(zhKUpBDG_sZq1Cv(R>JxH&vDlPWu1jjXc4OiX=OKl2=fQ_w3ch7T{OC+dCz{E5 zBy2rbC?yd9J({nrP+l*0si5oth(LG0I0*~`Gz>f9b)=tlfG&nL3_|!}AGWy1u-W`3 z6}dA*MK*Xes+J=u_S1aO+Ty!9JgNMID)Vw84e{M@rm!>XA6GGqDI%gw z4zcfhJ}ANvzkIk=lS8Rg_A6!1KkKe^<&YGy)Uuwj*t1jV+FIIkItyYh6`)^37={zb z-tQId@X5afTpl7=pHk||AlP45&61jRI3;=(CpBU?Yl&?v-WHci_o0jmr3`Qp_<*UnN zU`b2kdl_m^Wtb~yD7;Q(Sj-jp$6ZRpNw{Hqef+sFc(1K|J1H)YdCqD}-Y3wBVh_IW zgp8Jt!}u)TBa4K+8oa+%K1B)jj>w-=njAt$PJ^i!RamRd*xtrITddC7f;FuzFO=XI zaFMH^hHWfyIo59%87b;gm1H5=ajGQhnjv z`9Mw%tC88+v4&KQy7h3F&|i!}r!awC?430~04oCqN zv}0&CQ}k3L<(IPhmqZGwPc|F2v2aj%n>MR)|E!cRtDLi5lLF7!(%qaZ{=YqNOlkUIkWV5XaknjpY?y%doOa(?8A5 zlcufn3Hazv8Q1SCvRJnDR^Lt@?AgZR$W~dQ$#e0=w?9-Ke@pQAe>T?V^EIGz*7>P*b!w zmIEFs%EKX6#dllIdLUZX8jALsH^`aq*Rykqy!Oda$zfDiB@;Ofm!YB^7MEGemItZT z?m1=il2>n($#F8TQ7?piF}j|_u$6T+ZNTpI8O4%hW+xbzNG+%hU732;)ke)W_9WKs?A6d^pm093ZoMm`QLn8qn9t06 zb&bulda;)UmQVQ$fM-Exp-lwxvPHVB2!|mDYZWlGq7|WsUm+jVavyi|^($M)CGsRv zed{S-r`}YVfue~-JhpA1E;yH?JD2Z~6S!CW{*H|7fUVRLyZ4H|tsPoZgwVC__?*=S zd##-{Y`K?Pb0Fs@Cs<_zV9D-yy`o5JWJd=TYoC)rR*%~8<_m1YmW}N++xI+R_0>~~ zX!^F2Eo(^DU^@s&T5{M{2=Jt1!oR2JnxR5%G%ML9k}W^h#8}cQQnTY<`n63{ez#wVcSp-M8C(x?mLzjp}N1ma11Z%-T&0t~Pm< ztXWM(LSCEZC=s1JFjZxV3P@3s9YP%STzF z9P)j^6N$Vg^|vk}kdMNKgy#yeN6CirbmTDjdbF!D#V?}Qv&frb|yMIM8cPtUt@I8|%+=Pen`h=_*G zCBi+ZD?*X4yy}RxW^Ys^bI9iThUD1&mY=*|b(~dJ_57kSQ)I&LjF%K}2XHC7v%oRC zBTRZ?dZZyC!>*BSh$f~_hP2Ppk_=rDpqDG8LX*04@koJoVUt2YE@U8j_%1}vQAz5) zT%Bd>{42};$qt2+I1k*FkBhg{E&xJj{`x=Zm45)HXoBAn%{v3jH14h`%;wc2<6U}a zN=UjBMdEHiDwyO`=sm2fckfs_maz_J)Vs5|2_+U3c5qR^P#}vp zCp0Scvqr*4J$i^EqsMg8b?|u;2N_09IW>NhBOk~?^hMKT)7>h&c=IdlY$;P$WYM%% zSH{wPv%;0TXn<}p&5qi@K zZ?K3^E=bqzf~lhrY}zWuCZiuo;cL>c6bHaA()}|E!xfSbWl`g1p?D6Aucb^Vp~Bp8 z*0rRr@!i5<>n4jfPL;RUFn)fYJt3GYXbjux1=(gE8KVgleE854t-l4%pxK5{Tblws4JlOEaX>uN0uhd(!U~#_)wY|T)BpeN zy$Q5s=~dsi?-}m+=2ul+T~*y(J<*z5qa_(JNH!RI8J3Mrz(7cxtd%${+lpCUjz!`X zhJ--8WNZw}Cd3dUuXx#l*oF|v23a5kvV;aSbxYmqxq7Ja4R=0c{=a?hsk-&*z3Qo? zu2$Xs-gnRRo$q|Z-v4j!Z(NYm0w}~rf(P+Ql@)HQNnjcQ>pO~P#;N7QGs>u4BvDm5 z495e1)q%w?R0~m)u_#NvvSE|vij8Sqmo^c3uL!lcM3JTIBy3f~+ARCw>4V%Hx#Gf6 zOzmSabWu(Cs=YIkLD-<0k%3h%VFD8RKL9dDP;!MI7H+{bLFFzPmYzz46^INdvs0@5 z&pvHQGPRvzV3W1NmX7`@nG?7A(t8`brLU>kYV0V)zGdYZ8|by+p$%Jq?K@=}Y+BNo z*s`>!$;08#RG-;xGE;zS%gt@>jD9khaGN=XTz zsXvlhn!3Ke!zR15Q<7rKV# zUtSP2<5cKI#7|UFF_gH_*#c%n2;~^^Olx{1NgD4yErHs$P&O<;QELOVj`C zgeJ1Vpl{LY5sO!DmH>66O>``u(9kAkmGClw3T9++-bxUvu=aB_e>k@~#}ZfF)BT!w zOgyP&c}VLCGcx(}XA(%ae;BGqRLpy!6*^t0`&XXpkfn)#( zl@sitcIY{T@KRQQBlAP5MqxppG`~=wK9mNKcb2WWe8{KHvu`SzRAqY;axABE;=Do~ znNO(=E<9zE$%~?*OJ_F{RSY3zRZJMdRN|OWwM!$F2H?AZ zi6O^g>g1FdQ?;%HpS>!izxzZlNv4Dl21MXvE2PQ~1Ss*w9kQQ$QhIm1k*rXS#^kD4 z;b-{MHzI2NtK>UEQ9q_}l7>7cn1!sOHG43nD@Lb9Q}Ix^EIw0CMyhS6wyfH_n{P{4 z*dTeJ@Fq5ukg`ixCV}vw%M9@ZWOSayi4D8b6b1s7GtxZHT(IfcFIq7CjIUT-v__U4 z+p_h$|E%5iwm)n4eB+<9*SzI>?2fztoU{!FqD_>2%7@);8$No!gz!E~8)v)?q)=LO znLkOqt~3ngRI@AZ4wgq6ma9LIghpC4Ddx_UHu8N?3xQrlAFF7@_t#k8bV=z_9_P6Q zN`JL`JmW@~_@=KF(jH>PQ=A_^y=~3uIcs$=L{?QEihIt2H!5=nm<843l~F}-<&8zu zX3nbqkK(Rh*{2MHW+yN9=;+X=EM_Xw$0X=tzC>@x#+BkO^;Jr}p0l|QTTnF;32?h@ zgJxpgLwBkUyPH-;RaLB99jOK@ttGX17)vO{|J2}DWyiUP0GX@dx(7&5aBdpuns$q^ zE=q4}kRV7~X-UIjZO&y0WoNo$8(H6$LJ3E6S^kyg zXvMOJw`}s*Z(2G09SKipgSE^~Z#-q6U;i`qz}l{k%}{9cvQ));U!I(iD{o zj8;`N+$3NwL@dW9J(wZPML7M0>i7G_w5&MYwI*7H zGWmRW;2YM^c<2(Me6I!Ol0#T@B$6<-$Fq9Iw*TlNk?e5!l7KdRss2ENsuW|F^PzGC#e$VN!Jf4BVGJ>Z?m+3%KT&egYGMSZc^b#A+Y#w7B1Q9c-i8# zulFL`I(d)fx8EzT>mG1abd{&lU>LrwkQ(Wl1G%o!zh`QKR;tHq|-f6VN9bnIJ$WMJ&PFkP2Ho z^LdL#s=2WD!@f`cqQdj(-QHl<7Q=S*ek>JR01~(C(B_}ey@8mHjdiMZ9=ykd+JB~Y z*TXP4UUCSGx82JJ1%`iK*F)VyGifrilK=#4sM=Gxls!7cBuG6Zd_eSU++0LrxrLt4A4D4KEYDq5?bDp*K+ILvmIw7y;>$gSB8;GS2OKX@i z;xbXKJhGky_^_~Na`xABPeN-)BrupPh4q)1_AFC`*{QR<-;Z32&~u)mVN}=pBDhrf z@HroB8!(nIH1(BOYIh{_BWO1r)7Hv!wlW=9R{~o$p0vK=K1N6dGzi&hI&#f~=FCjs z$Gnk3rc%ISHpwC1y!UXL*m2dwH&36owe8Pa_ZgW`XYRAk@DYXkd)6D>ZyUqRZf=~h zL%}Ht-P4NML>kJnz9CZ}V^9`tJ{US|-jnG&f@5%x^vTtKq={kY9KC}QkWj(oAOlYE zD&jM~H%cgTVsj|a6d0WOliwhax!v+<&%#zJ;b#`v1mVy;)VtaQp)-go_^J&FbAtp#bS_A z5Zi@t(;96F+BmaTUs4yZTX;-nNRyWPBNDI`g~3kZQpvN9WwDsQDXDEWE!Q<*(HM+u zv@M}4reZwW6I2M%*lSjgfom4HN?-s52M@Ul7`UUFmcsEj#QI`rpFS=>^nx_$3e@u@ zx*pSxGz+3rMiEb**D2XLVk<2J*0lXi2??O+|pzxKCOdhjv#U>f*ytFfBnJRwL2jovC zn&N~|GEokuBNXR5C6NVz@JsH{>w)G)8fm^Q>EV#()}0E0GnsbsbZ#TGox5LUqdVVf zS$fm~xRA*K;>idUD2=R1`^xITrcG&xgN7YL%ee24tat7YtsOn1GGPwPvcNM_p2%hs zh|=!kN)GY5!Kl*WNcSb6pc0)CVse9#^266(kZ{n|Mza~K9L1^5WG;+jF{RYkmPBA> zM|#8HepTI1tEQHKN)U?dsO;^rEr}U>(t{D2yrs+)>>q z-{YV_J=UxH)!v zCUD52o`9ySSkv&yOiY zMNSu~KFoa|mQL2AIp_`k3Y80OFyL9Pc#fq-tV}z0Xwnuq4{dkV?EGtQ@g5b-E|wUJ z#*B4gSFxdMNS#dDRhKx+MaQjoI(3ZXALY zDTj-W>zSL=C{&~H@J7oVF(KRaQI}RVx>Q;*Y#wjP?TG1aQl@Rn-^g~`Q%hG@Eo;9; zOvYZFTT*eGs&Nn7xGlSzY0C7$ODoAy?;8@5j%ro9uPySolK|(2@6QzkaS;_}8(zHw&ab@}rw5RRL4YbAG;BBmcC8WC9h;3B4zvU|a+n zNSD$?I!n^79{x{OKJfdtsxmx}@}ci-04@T}VJ!1V8U@|hzLOczy@AM!Q-5C8lrQ(> z;FKGf0EtRa9VC<^Fz<*OlrnC267yqjNi#{&@^=FleJbc%3TcP^7pD|v*X2c9Xy=+ z9)6X_V1Tn6nJSG3lZlk+679(wag|;Mq$zXdk2a0MlvUPIKD7nbo$#Ergu?ovG@SKg z*1Gu>Hc14(%)M9Gp+EwFaZ^p7%A_ugI*Bc%%QDfVG8BCq4dQlflK57#6r@IXuPKjjBD2<8I< z92Wx543lW0ntt0?Ngp?565eu;g&TL;H0cTeVh7xY1HViR2PzRgOg({ewjncd#d>GX zT4U!cHtB9z5=%?LL=%8aq)9N^(^p1U9GFAHaX}T`&_DqjVE$IMoR}BpkbtL=?CDgD zH8|ok9@AEzehirkj49X>AAU%Dd`^{O({ic7)2MG{t79p(9E=&Vs4o2*4QVD#+itAb zSWqb2b!pd%r1VbC`v7nRyiWMKBn@c_8s=xv`M#><&Vk{oG5sdW=ddCnjA z&>>o_NuAHCh;6K}HJ;8uCskiWKGW|#KaJep81699q6 z(%{0eZDwQZe)-cDU--P)a%RIo<&d_lo5r@)$-JSto1(+eJ3`~BP8Q?@``y4KhVp*< zss{o7qP@a5=naO}lpWj<EhMp?j@yJBmlb#@JNmFOkf!)-PI;VJfmS#0INL2AI-M)4w8Fl4i%i70m z<>V`Eva~9*Lna!->StY=As{1@E_W?O<_P&UNu=$iw!D*B|EVW!T%NZg+O@Pfl-4Lv zm}wNi)lx#4F}$1@E~uutUXL3uTL1=U+}XLfO(4Nlpc+LgDP3|hFRB%$dsgITtGeF# z%4co- zw4`OD&`0zGaWU!A<+U8SC9 z45A}K3v!x?$&E^4Rxt?;kZ2N+tW+^uR{}h>NpwaxWdCLzAJWTu1+0CwWb4*><_TLJ zeabq^GB1*WwRnc+0e8vVV5O{(0aem6sOnIrr*YRhcfa0()z{h9bV-c5Y>oD+C92UF z=MXm;(?Bewm9VNeLhtcIO-HnJ%WK%Z1V{UeF9FSj-`#$ah53XoR6VbR(9Z;>9Hm9+ zCi6O&pB4+C(c~;wP8YG#+f}|vbCdSgZ`@>)o8D^SO~& zoHP_zgTB$EwDoe$)}DF9cKaWEvNnsvfK`xWxnJ5h7dc@Fnh%uH`aoV8SojV~;G8DiL)}?e>0!xG-8Z zR=i^gCcQ$lwK4<@kWwcc)=>o?1rUBIh-qXG<1PgEk*5ss^hhBGn?z_?Uq0u1?KnLHmWr28#t9l4l#CvDj?n|D~NE%4cX(uV!9 zMKNn91eRo~#i$|m-BPMCML~O9#j{e05hg_p?St>sMTM#2nvDD5uS(jyySBu)p!tw> zPTDVfM%xZTiwVc$Dt4H6n0#eO%xOoE#uO+INE;>wTLE-rZU_(04>JL9)5=cI;yb_5 zo;mS$nH(#YwU+go3Pd2mNZKIJEJHJ-7XxsRxzQ7-o*dp{OAiW=pZEo9$B$XFdBH~P zAJjZ-W5p#bCe{`pt&JPDEsgF%H?Y+y)yJ$c)zfj~ke8rqvO0s$W_0Q71|?UCXS@yb z(jL!%D;c(K51S2jk72!H%(7>BengenkY!&iNMum#p0#wmV65q=gX zKBRiwVpL>T03-0|uG;FcTkOdCVe7SZU#3bCG%b;^OiH%g9qAfPLTm~k;1rWekce)j zJ%H>)omv_{#QtkTRV*s1zdLJVaaU_KiYIZ^*k zve??WOueLKMb;LtN_*>cZR6-MJG60=^%~1QlC%&QcsoKiQQoHli_9VxEe@m!qHqal zrg3VM!5JGo^_Xz}g01PhErEcQhpi}AeJ;q7OqSJ&G!_9hveDA@G$M|qX+bsJ&_IEm z?7L=(DX5*OM|{y+R$pSqCsU(a+g5~3D~~N@bYG(-rrcI-HL>pauuPCss=Xexd`Via zIIT4m5U>(0OZ_W%v&KkY+Lda%YhkMTva_n%kVRmccJr~Dt$p)x8^}kRrsC~TU(vhS zs^YMu+7`12RXvc>BjHlqQfzO56sA%|N`*@$1CBT%2!8u=cg+bwB4AjE@1oPpg9RXg zSs{>>5SJlCqB99~)gHwBD_b?kqDjz8j^QgUI}dNmJ^mP9kF3~ zNcM>UL}4(#!ZoY}ZB7~??K(}BnLs8;r`BQA=h6UOsqV=ZTao5wq`gGlL}O*;n@j1=qX!Oa|O$)v9=}b18WCU z%cK^Mr%QHW_0_hya?-Y+*|K1G-c}oZ)pC6s`_5bvoRB?1Xvp*!Dm;OO;t@F*0CPN$ zkkKAOxlvnts}twdp;Gz%QFZSc5PFOUMZn}32Ym?Pa_z^zCqU!cwGU}uddC|piLzY8 z+!7rJNyoy@nuNcpbdPM>7+SNJ+IVu>_a_M%p8eLpAam{2b|KibtSMn0PAwYCF&kH4 zo;JIdcG)>hA4qqsHyYTw?uXl@jlc3Qty})Owb>p(=HOWBbjS{Ax$;~PU54~(p^;(w z&=^e%2V-fJtBzbG^u{5|gcA0I&zT}MN8I<*KH{ESc)*Yt87)x$};t; zS$&L#3}5fc3%fSTyLvpao7da6TG&7C^$+;uLv119?U-MXizf2sW8d$|G7{ z0WR{dA;9xt+ImdIr07{o=2lYxF_bx`nv#Lc6n#%xM<~r8MU#+*h9($hL)$+4*v8{6D|)g&*6vcRcg#xcZWBNh&&Umxx66`{o&=~RLB^JzsCrE; zRV~)ldjSjGPGz?bCl-$dLt^F@8{LG7jT#f5!k#lL6$X|-vi@{6su6+JuYiq52r_Ld z-mQvi?}d#Zb06O?jtGHCVO2=fzWO6<1We$7u+5~c2jbvKULaGcuC_8DtSnA-B2%5S3DIBax<$v0TI_6^G4Rm&4GEX*k&@tzX^L)WgE*u>d+TC^>S zm#ihUES`G6!iPU)M=yLzrkV^!*3PJy+vB#NtJB3^59gqYE}bptITHIq(6XUgidmrg zYwP@YcEMUt?}$myT2^kmwopg|XiI?F(~)X9X&V591h&caXqhc6smCo$l|K7;uH0=K zCtqvFkKZaVNNj5;Q>5(MrnHtQpGZ&0Y}{cB0hvFpO`swopi=cEJ-(cr&H=Mfu38UN z_=3i94GEdkzrI8FVs*oJPeXzM3;!+}4 zp|moA$i~Tg?C@Q0wsh@Q8%ppKy-zx0F>c9(E%^-rTP2bof4uHqEAM!-^;w0xIHp{dU{Cro9T+DOS~FxdrNnZn%!Q+OWlCT=#Gy2S@hM9m zz0b;r@3)n~d4bT_qGY1?rLja)n+Ej0(2F2*BLE~QGXaMy4T>MLTs>UWbcHJufExUo zNQ=@9AXO8(bgAzV54u0G`*opj(@hLKC|#h6z>-N>p)?F%F2|PQUnR>VC$XtazIHIQiEB3tdM?DABeZ1Ycy&XxFg>0pkvnJ#m7QKl7-(XXfTXca z;<1EC^<1IrR@b7H;}Re=2?<6Z^|xT}3#r_Zv<+zjQ5sq-M#qlVl{6G)m74Xk%vP4W z*6p>d7*A|^VMk9@So+DNuCwrOAnk$)P)HENp8*`EtGjI};0Xc&SRm6zv82iFvT}9d zt;j2XPt~P+kl(Iv&Akfo4*Cq51NlH3344V2lx=+%i15vh1SGUh5KpFUGi6*EU~v=S zZ&)HzV^}DSYbR~(6@SuNH{ETMuxBH>EERWvh3|M*D>HJ1&dl}zY#J&9+KCGJ1BjPL z7c77DbC#X@qLjHaw%Ts^dLQgBn$em|Pt=}tENFk)&-9q<^-zJ(5Vgq7s}QwkL&B^K zB(LZ)m9P|zuBEc2JLQ(|pHWB)7)>+FqYZ0p+#w zl0W83C}_%4;nSm23BIl+*z}qdsxiFIfHA}rF8sPv38w%+?|PenBSXa_&OA)GLh!lL zyO(-1B-lD(SVWBG1Yi`^)Nejswn901oJuQ7QlFYXz5VqTeZ$)3oHT>6P21}VZ6bjf+fq8VRw9AQW6SalX((L@NZVS6j##$d6L2(b zB5*3QhV>;Zh182iQ-VSRsf3fwgrcd0TIZ#-7dFsJq`gEEvPgoPt86cAYU5B)365(Q z^JUJpoP?jd{$%bk?=fQ30YtSr%f-w$7cP$ot^|XSUqXM%1!b+wsbPE*5tGp zx@SpKf>91k(BR>qLg#V?;}noP7FL*RDd1n_-qta@?M_ca!cv&k zIuhI=vb5DG?fNJaygckoW|@F0kOnkWSUb|7!lgrY)19xk%~!p_?8vRQ6|LHUW&O() z#Y173@-5mC;7$dA%IC79G>@f`ty$3Cv9wg$hipr@WF4hFzwi}1|CtY1xbviSTT=^~ zfY*wp0;s4IU@K!Y<*=JQ3*LUtRF&+$KmkuJfa2Ln0^-6%KB1ngwhm-D#|WJSw`}`D zH*En&N18=3J|_V>Yat6iE_W>xGiUi!3>@j5iE9wN!wADfHDD$HVxUshFbDvIHk9BG zq><#U6>F?+T7L5#mgst-+L;}}BpVV6X%7s0l=cwhW0^IH$@=%vqr^2-oM}^mXyl}a zzz1QW)9V|aoXQZXn8f)&j-#9pz~QJ%((J2HF_l&EgrR7>^yT~M(O`#jm-8xz9{8s0)|`k`!ZnIj56((@z@B?N6t^?pOO@bbzLTj{M^L#9X}o1cw~ z3)%g7lDUkT;zHX+BJiR;B4SH_-6rY?Js?N>iZ7w>We#Xm_u0=wSNL{ta8-gUKj$5N z0~JU>M#~0KW}+?Mh)Oo!No6J_HpctXiuE>++u9xPu=Y)N%c43VtKpDL0~P}6TG;F< zNI5W627ods7CcU0E(z*rD|Yn(tWt?VBvimgQ@KP zj<4cWhO0JZ^dX}*_2Jb{Y$rClc5}~cwH(@XByB~;IYZ2SYJ4UDkx+-Kv$L?PI8_6d z=%qo}V;Tw3TolJ@H7NwP0uML^xBw5_%+eqCN|_s7nGk_AA)kn*8Xp{CioHbN;yknQ zWNNK$$JUP?v17O0VTX>Lw9)Dj+i9-Yw#;-!;369Nnm>5OvP1j}&XhHN;qvP8j|Iwbe~29mlq_=es^pqG zd8MPTbt%sFaRX$uYU5B$i(L)hTNJ6bV;mLCGBv2h{i7~YOtqGue57wnc-EI~hYS=JW$LlGX$;L;}cAeq;J$^&!PnX^<%K*#R4dvg^+$412GIx*Cl}PxwEzy zT(v((x97=V3P8_B-VVV?LWEPo)?2gqmbns2DSPPZ*?s3w#^ z=iZwk;hh$~cgRG3G6ajkMu5EDl+7VoL~D?+v?TCpX>l^JH(oevckP_B3(_uY&P3c?^U~ZR;-Zr&=kcf7;$BX6=%v|$4lxM5uj$q`%p`w88KsDToSNVPJJr>O8uxB_`7 z&;S#GH7Qlw=2Ev!8UfuQ?PNyi=*^jNa6%(j0t%l_!Q- zpO_ugFjcz+?O1`dh-MsH8p(tp?efdcX9#H4SP@7G00amVcu3k4T1mkoFwA;GgP^-o z>84keHVO*_14^qgZJc=3zg zJd+3Zj>x1&_f^~Gt*(`^m^$0Gok3u`67Hb{tRcHQP)(glP<)6&AVJQgV&|biMnWMK zzF<8DJt9~i6)A@q$ZbnCO~Y^ zrXa8^651su0uV7;KDJok88N9VZ%eZfu#%8`pnOUcW+}ie1V*8?Sgfbtx7|mdu+hVx zv+|h-?Qp(jd9Q7|N@Fzb3y@MNU%9j{F|;%fFA3M)$QzDTO>>lqpjrdP#azKS-Dv^u6i*FtG3)b@(3fK8^2Oq^+BQ$D3xBmw}N z*jjkj?3s^S^7tQFc;*pn6=Pe;I@X;wZ9DGUxSLp8@yv5p+*GbBN~Q9`>q3(3-(F}G z&xf9iMzH{j=S}+o1yJDCW5v7<6cQ4tvkCmUPL0Q0shR6bKgK-qi zHQVhSvh>zhS$xwS7Oo!knm?0Z`ZQ}P=xHf?UYdr)T!IcTF#?ehjP$%n05J!owl`GR zK6y=AjJF!%U4SE)*r6s#hTXya~0mUC#JQ7Gq zBVirVHjCDjGM$>+!p%(K=^HSw-mk(|$ci^}P8LA%{OP#>#lrM>F(e+W1|gBbvzpf# zQ}?Oq97^<<{6q+KhwDtWaX~MGgrqGVZZV3pl&u{mHW?3X(x;16A}v#d2Eih1i{k|t z5{N=IeiTUiC_?KsR0~Ubnd=d&HqXLT!XyES1yuT8$#CeRBL|30gaNwe2%)$TA8rd= zhNOQJw<{Y^`#7@N_*2*q&YRFxeZUBx8Y+CTl(aE)|@^hqvnG3%D!@tL1W8u z%}R4)Nx>pj#36FqGuN-GF(NRx5~lp~mA5>{0o01e7qmaQ=|SbDbMOExfN`sw)#*Z` zcp-$)E0c5}yOj71Snv2r&#bA?+02u) z_=gBrrk1Y5A%nhnjtgvg+Op0WX(Z?V(9+W%vG&=I*=l;)yFCYun{5;vwsF*vM$wlx z^^}6{E5Br@Wh=e_&VJ;d^s|{61=x8k(I_e&U(l8GY#If$0E!n&;>8Lmgua(Jb;h*( zN|2PN2r$<^8B4WdBtd43#6;QwYkjlgHUq0V(gxb$z(&)F^>dc>KVjv{Yb{+qVd;_M zW^1d~=`2gZ=vpRqKUFPI$X-V)ppC#agG^?C?nDilGZHihj)ub0A2D*IfOJtUT~{?E zLYPd9J#h16jt{E3#ordV=$Ql$aEpZ!h4;k3JCOycn5@B2^h)(75T>9sqlvMDdpT{` zcrdiQ|Fq>>4_ox~L)IRiw$;X2TM33TZ|Dz-Z4xcnSm|j>+iKEV!dMZ-K}L>iCUsoq zsY(|20nwVS^tYhPX#o^pBl4lo%CuVkE;6S}TIFDH{_%@Jg6)h@j>E3bWnv(w(g2zg zme96jhDgPZ7y-Fv+u5e=vXayKrrF^Qiw_^QX!VF?@rFWPvpiL3DpW=}vZ^0jItpnJP32KD?dn-uag+%oZ6{+Q+dkwA`#SJl9`6NRofbgxH6TRCYjgcp=lp^Q z`kz&7m?HE{U}O6tFW!JCV39`9Du#jyso>PMs)Z*Ci{;@0)!I=uF&0*6OW0OgQuTw0 zu>sJeShwBwx=mJYv)--uTCsV%ZAl|3<0S_NMsAiY7Be#^%w!hu@tW%L^{6s_ffLBl zN+uJ)#<}iaLcdGrN{cUqixRE4}ZXN%*bS&sHS^&jYnczj&*l7e1aav^^`3WE(oM;*V1@eW}PwkBjjj6)) zY(4WK&M9w5p6NPm3lLOWN2#q!=$53ahm(<|0*@qa*tRr@zCdLdu36BzS?0(smLEQ5 zq0EwI>yRZ3MrtX1g;5NTSs{(Y!gCU0+6-t@;7bxJU2|m54PQA55R>p{O*ZEQ-YVF; zjJP55C{6(`F_hvMif=ai^vDD@K~Q(Mt(b0GIXQ3Xxu+~RD{vS+X5C=h)`DG&7#WHd z({5NoFHLhr@msYd)3r>lrsB|&Mipk5Z8EWxUzswHy*U_A)yk^;-b>`OM^JfIWjMS{ z8DOeZV7{O$X#o^pW%5ePf2tbJPyGz$L{aCex`P_e+K&~Sa7`iT8Q`H8y?c-L0d7%K zOMuEU7O13Nk+Yvg7O`eUWSi5zcds(2i!RAY#v-+5{kFpD9JTn+vNbnPm>oK7qu`BF z=Wp`{L?(E-i870W2b@i1K2(!dF^A~toyPQngaUxrfrPXWM@)&ZAtvhN7D@|f6iv&r zzz*%6wG(8@d4uUBj1N>I?yHDXb+EWNF2U-nwe@Wj$`$ zq}@@7U5goAsdo#3$yizepA2OlG}6Sn#YjLhl7=9FnvAVE7)Zu<_2Ge!id5h>?n{6L zI&{M}iydnRV{0p(mZt*1%lVZvn}#<@GneWg2}FV= zxtNdY`_`E3*mTslrCQCQjh1RWlFBW()g?%V3 zWgydm)u_;jm`N*ukS39vv?SMRfIMJsQPW>91f0^N>?R1R?VRSe0E+9K%AB@C6(R$) zXb`2_Qvyc!DyE8_GrCfBf$aXkf;_Qi$^flcpwTuqR%dH~JRhj=6;L5n-rwbDwr&H3 zkvSOgEf-<^U?nAtZq)Y@F-)o&CXZtAPAE`f(V3>q5PCPHScD@RX3{SF4MvJqJCd`! zU6Co?GL3?eH8ANBskRWHA(S~D)yEbLcRkPoC|=Ga;YF4tew9#p;h?T#x6{fm6G3O# z_iO=BracL=u5*TQ4{a>r9ybeX(JSKqC8j=x13~4E$~>iKMW7>aU_8Z?we1vcz2B4T{L(ZDCkPZ21{2EiU@X6-b;KKtS@6-Cl3ibtU-nEjbEUeL z9pL~GCejRaO?RcYCzO4Qqw{V^F#Vln@_om1p9=zS5pQ6L#!{sR2GjQerukZHK`$-M z1BLe>(K|<}(b%~FitCstv{~1y_Y?>yq8tHLSw#}KF!OFhx;yDbC`(3Uq}DDl00bfu z&X$C@EfJnHm>w?kL_Q`09lB_%#dTJFQWf(!=zc_~{XUh7xF%paw`%@anhjbAyOcGW z7Zi`s*T;-xLa=9O+E^C;%m4^*&~t`w({M?!C2M>>lyebe2@u^0NSn>xR5kRPHop z`Z~HH=B}zF0SCJ5g05>qkfZ{tb`OwV5gY6<6uh9u2OtCh8Qy$!Whp>l0+xiEK}}`H zhGkEsPZ)Gd#@2K|X{u5{GY|{NtSC5ALm=$bD11w%hhvF=hGp~_9&StolgWYMFb!iH z(oP{L2?Yee6XE+@59WCYXc~<~eiH{FG!;_8;4_AadjrRUt|L-;shk*7QB&P@y3i=D zXL1mjok+k!X%mhI1$%1HEy`4Nj0ruLKSpVz4fq|Ga22>}b$^Rt+2|7`b0=7DB9Vqt zNaGk*pdg~6NA+~=L>Gi7(U-Q+*0-8E3JL&}yyv4MbN_ZVjGMJQUE?4S2LU3kb7G@= zMX2x42wNE_BI1SvRPei?mzv-sLAZ*Ha#gV~AdhpvVgVG_IZ>i=k%-Ddxvi;K7=m_>J?@H$vvfZdtqqEBMRufFCApRYI@w*CR9v z2%q8*J))O_o0T8#_oI#grId!lwLpm84DWgcH1MT}fi@fidNw!{m^dKd2v0|a@0Sa@ zE@%N1FH>@H;>QV9pQ1F&=+)4PZ%j_Jh<+x$BPS~xGu;Q0itC&%id%hBlgemT zoK9Y3emN_=OE;V{nNGN%>y?lrm!vH*$&Eoec{N(-P^(1I3p1!0EF8Hq0*C}{Xt(94)+#aB0A@q6i5 zpI6t_S$(+VgTG5u`@0ryAG&yZ{_B_iE)sls8EKe~F z)d6;_pI7c8gSwG>t=t~|nZ?)Rpy%`7zbqc^PvBinS%Ft!^bus(Q?BMUi8_ydk>KAJes8MG>s-M+<7j%6R zrQ=1V6Cb?gEJ7D(EXRu4ENsL02iB8d)F&OPjGbU-uu$*8Mug%aT_ble)q9cD#8?uX zxKdX<+mH79#tU^?E-B`R5nh_3<*l`BHFG+-eC@&WI;4{dAbO!w!;l~m{Hv(fVg3WUD~0_bWWumFhb zo1D=E5RAqHBv@tJkN!-Wgs*^I)m^n;KXETGZN<2kn637GiFs>RZIZOt;deh*KfCxb z|3#6&3@RlgERf?PJ*`?K#{t6Gc{adIk*Z7)h~K^6zPe*-J!^XI=c+LGqdM+iO~?3J z(x#L$)LLMP#!xcXM)z2L0F8ihVK+KP>!!%7-h46iq6S>;1q@t0mz@TXn&#)XFX;Lq z7~XeXR~a%qoD%br(n+YAIw+)3=nm_3`g)sU47L#n*m+FEpztb`OC$L9Be8{eK=1mu zW;aFkJc9j+`+O7bFBBIpb*{j2*1FJr)(iy-+@~Hf2PO|Nhf==}@swr!s+#v|vAmM1 z5U!->7fMCs!G3gL@(&<_@irrsk59DoaGANoq`N|CM~i5x+?X4b>bGI6dgj|c?2WnJ zW%RA*tsd3#>kHR#@8VpKswAE_)tW+mtP8sag!+TrKbR2~^wN{cPvw*O&sQVb15axW`cGsJ`b;VfmaFj?dBUdvoUC@BQ5sUMr`c zN)~4Ex#$!pJ$pWmJYYG&%BTP^*uXN4M3qPAW!Q;i`wkP!dn>jbb*!hl zsh#&F=mTfIGU{0{l^Ck_av_Bg0S>ArxOl&;5NPgmnA;Pd3OZo3d;x0Yoml}_W zW&~4(k-5piCs{LtxJZ-Gk?jd0Uz{hCOZ~frue&ufNBphJX+FC1&$;iD?XDme=wYqW zy$?O6%7QD?!;>nt&x7_x2GTulCkXFs9S{~DVsS(EWCc+3&P{fPEhy8})~6%S_kMTD z;+*{069}Ck?Ada+1exh>fO90|f&VAcM0PX-lLXCHcL2sIiyU(ok?*cJsT9rS3 zSu@OB3#kS7CBe<<}$}ONLw4n)WOSC)S9jw$wPM z@>#aDdAmK+RGGA5d+pXK+fn+*EOxAX(Z@XOi!=-0lg%TpXXYIj4HnlW{lxu+0EHK@ zgnvGf8*|%C`f6qALE12l%$H%}5-Gi{G6mgbrN=5v)YicT7WcO^|rkkwW?fNsq>?4D(`XG zu`(`g=gh;lGfwSPcDvcD{wy%>Dz3q+d&*m;3)>Z4A zd-5?Gj)qca*KPaQy_UY^FNqnk-Nh(UcN3}lL9lMcm@d+h6|J$f3tAIm_D~kvz&rah zPyKy;7?0ek@|S!2y+Rf%t`)JY9v{HLtGb^jlK(_!Dia!2Ne^Lqm!6)()5Ha#_Z`o4 z+^^WU&x6^5IzCPVf%J2}&vWIO?)dA~1KrjMK*qON_7AT!?PotCts)1f;% zi&z<~Wzl%U3IPQJtwL!OVJ6vA*(BZ2;^cAL{I~zaqRv!U*;iIp4Zv3=MeQJ<2$xq@ zehlV;NJLfGez`As;o@(W@S5>5)w)YdOMXpbCW2QB7W9HL=o(TT-@U|r;)%&b8tV24 z8Zc|1qmhT{0av_akE?FBoNiS3S5j=2QCw`tj( zud}Gp5ePI@*&--1CuQrlrT(&dcP@iD&^gL|AVI@^_BOtK9Q%@#x$*$pK#mrA)Og;n zhhSfFp|`}tIlh`#UTsZ?(n1XKbfrlg^|N6LBlg|t!ZWq!_Sw7m7!TV1HQUptr)!Q=Q+QVm)hA>sxY za82Ba_e6ry>-GE|jkDYvjYhV%w&vHQvvzeDHO=4Syna@n*Uw)nnvW|)d^}F+$Rc() zSGjLpIB&Z97?QV(UR481j`L2Cn7Dbq3$_vnmxi59v=BZBS zo^rSNAdJk z*j?Z9U=Jjse}G2uf~0qz`8{K2#QD4+*7Q7UP+`q@iK#An{sampL2m8gNGA(S)@N<|H_K*mI>S~wB& zA*f=qaw0iEh6sm>*(xoWXY0IXU&l+=c$Dw;y}@_{a$bF+JTZ(o;j)OS;9a=P~T zq!a7X1Sg- z)#=*r**=cZrD4HdvP!Sg;e%lvIQ0$X1%u+EQlP2wpd3PWjF)j3HpVs$6@U3_>Y8Eq z83WV+n-@VZSc2yT;d&>80s+Sn?^<)nWKN(})NX5Q%fSFM1kgBj>XcvO7vf#Cu3FGI z)^0BtaPQ?rFjBplPeHGNRA{UOA6SIii)_#>DHXSsOAsY&4L}j0BB?qu_aIjOTnp#I zA$W+W)g&yr00ZV9O~=+5Pb`*zOau^Vj4={htI@VV+Fw&(vZnH5tm3eoS`tVTj07?& z9{>jxop(7#Hn5mDqv|v2l+mX)Qu_Pec&o1~y#kU@!q}Kf!vsfmZFB)4E|e9CCA%YA zUS(VfnoUP>7fl?|VVDqyHc*7B$fQll znnEwoyMQ}kcrm|VdcobJdx={3w%cxV!9qytn)Q0nCLjcv^Z^LO5s<(E0sz9XW5?Xg zsLhR)l@*UW;K4o8gH};%6m=TwYmQvcgU0m?7ImD-le#PW{P_#k-mz$&q)37Z;)blX4?#?Id(Es}nWtIrQl!gj+o`v+8 zYu1=~5D^%*JYik0!ZP0`LA(GA8eSPFcKhwO+dJOz4*TOj{$mG^ot+&Y7xHc2_H7cN z^X`v#YCx#-tQNL9&GUH))#>-Vy^it%B0lsMgp`@MWQ5r@6=O;`lg;Bcx#jhsfqY7J zHL1C}&wP(1+5T)UL}R9vG#(NdTNcs|K<&lxMLLD=n=$Jg&83tH5XCJU?@B{hmT*sZ z?O3m{KmRTF*jrzD%+KR|Gy`@_!)&VKN)1fe z=~_6T?Gi?xTyxd4bYYJ!znL4Qe>f68VHL`e8+di`^^P_7?A%M|$%WIW> zoW71mQ8}FxK>;@qO8Uip#JOW>97If?W=#T!Wz3W}?vcW(FArSeV@A)44yMOoZ+HfcvSbnK_ zUF({GL#>(A0L1+oAb2)^ef<(Opx4(rN>s@6FWVbeckH&| zLv~N_i2e0%e~rCnb=BJy^L$BZk;y2=FB=1eDS=^kc9j>6d%hEz;vVD!c|lw1%kMxr zFjiSAO%gr^bTyNqHK*IQr2AodPNvX#TM9z^JKy&v`^ML=S!a6Qg7H~t8UQJ6H~XaJ z1v%oTZ;}rlh>|$5ikqZ3>O>MbZre6bS9S zFeAul761fo5+DBXhwY;u{iyx$5C5>8J9p0Sf7f??m;K-m{-8bm^wW0s>{&n7?HFhn z{eIt`c;X2^Zf|dUxBv*?Q8#|p;B>ud6PJj10Ta|-#8ow`fI=drnu_fP(I`}>Ne#`o z4m-Lpzzkz|rTft{YFpj+F%{RuwJeh2e;3;i{=x_BW0S|N*F0l(;iFcLKP!#stl3uI8cPzM?6j4mN3BdA z6J|VYd8X&P%hn#;F1cD4R!GPOj|-UYvn+km^5lp`t;ojxM{RfaK^yhYS`xMF=mV+A zsIhT(U^|;Tw!68iT%#T9TBcuNN!!UhZ`;ay<+q@Lxfpq)YpFnR618m-DvyGWCAwG8 zhJo^gR#C`rp?srFL+-`0-wgp207MNA5a-;Z?V;8vXp{JfpZE#8^Ugc%o4)Cr?63Tl zzv6)LxzByhzV~~-*B*ZOVf*42zi40j(wA&1l@`GHsh|2Od-BOA?Ngunl>PQ^|F#b} z0~qKjp}~|M6aWK|xL!322M2m9yz6kbjGEM5R#38BHgB*khx#vuGu;ciVo<5O_%D{_ zZ=~9HAiuG~QU1b_*TT7mqwiwg&`uExpeB-noeTDjx7}jL)&};zfA^bahhAk91|Kc0 z+v%N=OhmeAk@&ju-4`Wj&mF!@PQ9} zz~1wo_t-n%`A&Q9d*5p}-+Z(EXe_?Nb z#ikS@)y&z=c6Oy}pFe-UO`l%2t+TQH&V3KqUGI98*(-0g{u^(#U;X&UY-c;R!O^FYtPuX|BBeib{kJ*k)8fpA?A-lzF+OifSB2~swh6Zp+ zU|$lN@fp9)bESCu8kFG;0Th72yjDR5(#F6&%n=$ZF+&h;dN}AFz3;yJ?DXl=_J%jS z!9MxPPueg3;xF3I|NPI}KmX_d+_jD0`@P?@@BjYqw@-ii)Aq~1{LA*^KmOz1Q-VXI zfa;!-mnBGCq?d^Cm1ku=>{vB8U7BgLw6s&&px?BpyJAHo5K$gC>tVIe}g^RG<*2aj^)j}#Ww<;q-|MK z5uWka*Mjzz3}2@C!bun8AC5UFFE&;$Y8*u^WDx50^*WBCj?a8t=Fe;MfHnxUiFd#I z-L5GxrsB+*GxoN(z0JP+yT9B0(S3?W0RYfm0Vr_IyJ!{w4&S0N6aN6t^=f)l`9k`= z)O{SqRNzPLovod;>4`Us!6x#kymP=%%^t`;Py3cjC1)YqDpd-E;=XDcD}K0=_J79* z{y|Mu-7-TWCT_JDygabwNy~ogKYZ4H=m);f?m4z;uROGDZ+p!#d*?UbBQSr|-udcp zw0FMg)z-N=w7+o2t8BBoYCruO57@i@^hrB$qG`YKp~tLyp=m#K^oVVL<4OCC4}Zv3 z&KVBhfiP5XgweY>qBef!@3>|NG59@+yR`GS4- zfB9B>@S#)orH|Y%4dbYVikGjVMTYL14+o_mIw0TXU-2@i%87MLnP)<7lnoZnr6HN_ zQM6Z~g06$fwsju*kdLFFD;Q1VfUjIemG)76czztk3kHh4g2y%X`8-f?oIiglX+9nt ziD!L;sQuA0I5JWbpa3)wa(XoALWR&2-v9phyIH~<5P$%4<5zy=SL}fY9&oTk`@odp z8Fak?1?h%}6LTF{@{C1tM@S>@7Oa#60wZ(E5%b1lG<5mIicLa!+2A zK0i4yjryJg4bS&D4p$ImL`}%h>X1$ug+RA$YSt<&k=ZafzibzNXJp^fe!%Wb{=gc^ zr|qL3|CrtPrNmZt9<%o2AGTMFzi5B>Yky#0`C`L9Fy6I1*|LW|^PoMbayxRy?5$61 z*!w46wg+}od;H@~>wn=3cGuDcJD;4g-+K5_`^-~aTl)Nm>~)WR%I8CvWT+erFa?LZ$68vFqY;JD)HQlFZ6!_sj-J|%a+dMed>vO!+>F4{z6Pi!E zWn*i^Jxd#rZJm9_hW%X$W@f{a@3ft_{kQT(7ogOCF=0^3rninQPfyu2V!g(y@y_>> zP|`{a^@EZKU+qUe0&$;b9!33-XA(jdxeN0pE2eE*k#@1NUfTGnf%Qw(=;FCiXJp;* zW^3msE#Ez3<5H&KddH&VoOPBvHVlsndCpsrp0#$fZH==sEz5gstMQP`8|g}oZ?&-X z`&NdZuw+Y`;E}r|hM5$a3FE!2dEwPot`s)zowvK5TDP6(F+1CNPy%$fmB}HQK1xR- zIjTfy4=Ei74ej=%SLLxk$pd*LFUkhT4zxKMPs5_GVp*1ECxFsX_KO5!}y#9;f5`*AGc`jsAbWT|_G2Y$@kG32hi`km1&O}jiY5Pgw|j?;jvlq~(h0Nf8-2(K zjj8eRd#xOItt}u46u*{t>F!5YNk0;~Uw&P5dhVLSEU%rYbY^lzUO@$8U>E?WTLNqr zAI30bY)8n{``X_Nq~{G3Fd4#MGuvJPm9`*QOL-t}FGsia+OQ z1++OpyhHjJpvC!9Pd(*n1SEJD(}eKwk3WD0jqRn(1HMgK>hp_n(UG-esuBbwRCAQf zS5OTuW@F(Lrkpctk!AgvY{V=|y{LbcF;3?m9#x$OOKAHzYSicI5Q;qX&$;Xo^+=l8 zvf{IG&hne@wc(M&*572FiGbwnRN96#!y~&kJ@S}s9c^1V+OcB~{jr@4GnLJwX163( ztPQLgJ!7^pwodVcbsJAuzjem8dQV!i@==SLecARWr746qU0;$ma>O==ud&VT6V{G? zO^Vg;DNmlTv%Ov0764^~d(4L7gSaUyTehiZ$DXuYbV%?%&J(vMujU={#VO>bfE*?n z8lFF|9x)`7fmnbzw|rVT{#`!3U|tmQD=JX7`Ax*)YtqvP+s7<$1#flys!G@TzAXTu_ebY6sE%Z^uxM}j zMN9R*6#^_(Bq{l`Cmk1^QGx8|$cH+gE_c;_t&|a!P1UIEYmA~j2o&;?-N94_Xe^Dk zthGq_5Gb7kYumuaDo5WX43qIi(u-P!8{!-xA&jH4<7z>n*5w||_i~}V!bE=5*Yy!U zIG)#F36a)XBf;G8yqpOn=e57-SCSo@1}#gd@u~U96N(w$*_SF{*_Wt2_a((lG6egSVWB*fP^mU= z$hrLZh9dYAfT0Qaz7-ebM@JT$;o7IcBfL6#t(#bPC^K#nN8V!c8;Ib3ONYFz^rGc|L@YU#-6O@RYB!V10q1 zfSIJqpE9v5SW{frq@1W6WF{8*wjIl#vZ()zJ^qn@Wj6_kd&!nfBf$SzNZ+6_voa~k z`>Nf}`Q-R5C(2rwpA9Jdg&D(h4%GsMaBOUBxGG*#?Y9=H>z($dZSQqW+^_TExjfs? z-`AS176%%?3Q1poXUop*PV8K;YQ5w4*zq@fi=CF*KIohf0H$KniC81Co=Mvhld?#D zA~iQ{bj3GxWfIu_%ya4c6(8u*Rcm(h63qC$c_I`5NIH?u00NyWZ03gnZvM*bQ`KpG zqdF44pU$W{)lI)&ABhVmTvz8F4#LP4k7nV`AFFKS9gcN+h+!$SZGS#zLuF5m5?#OV zU#r8~kB}K60oW;X5#mhWX)$KP*VG_P85u!WWw0v1FRhvH*rtGd{rs2g{*V5qt%d_@ zu~tPxfLeumFexs~PAypekA_{JD5!gs!wUflguZ?U%2bO&wDJQO`+)-QE$F48y4-4@ z;Jk8yYE%ioGy_U-GD)mInOfOBVoB$)bx*$8b{ZR&^-frx(pE6BI7}_fr0OH$(xOV) z_k~=Lx2TQ?-M?`K)qGV8(kw1snI7;8Kylea4@2qLUluQ?I{X<`yRlzMo+r4ApP8K; z5GN<%fmFGl*>@BMXEZzPM^~i9&q>SP`!x~1G#BJ(keFL4y#zmC@e{dLGq!1(S=L^&bD3;k0Y@Y|Ao3MqQtK3F zUDeKDP-zozK%0ej#c2wq`q*ADAZKhTfH$8_`aI|&80<&zD0wn_ zUgy#Ly=Nm2-;cD_?2lseX@Pj9`qlwRDLJhC5FRJqC*=*zECO6z2}q>TKK64rAGc`~Uw~+Nl6p0rE6p$A%894(A9QU$WTLt0q z4B~p;?}A<$qI_zGrW`0Egu!IHdc&(2Jd!Qn5~BpNX&YhNcA{0AsHQ^r%jv*60S$^Y ztmXP`%Is+S2+hb?9h-(mhA16e#&!AE@u-$(+h4HuqrLC%C7vJj?Ad5OZ)$fC&HIJ8 zuH5ra&q47eXf!<+UYxZATrHJFOQy%Jn;tUyT~lEh;4$4(DoY@LSz6!PaL0Oz&$*zm zvz^G=iL`@*lT;DkxfZ4e-@L0^5U%b+fg+QlmRBAr^Q z@+&0tVcfQIBD_Nm94|tzp6Lz!R9~xt zzglYM<5l^q+cox5^#$c43kKz^GERJyyUPDOEUYa#^WEKnWyP5l$0jN(-)ltIK`ejc zU5g{2Tj#N4lBxDrX3OQIsLTTeZ9{ebG)~-lOIcsIU|%hzSE0QbJ%4YZOOf6qS~WL@#5p=zbDbS_RFKs?%KUK8SrN z{_6Vx1#D04OT*q(816Ejp=%Joa?ip_wJ2Zq`T?IgSWpk9Y7B{=DS-MTvj*4M)xLBw zLbNaF-_5Sstt*IFAl&kcf903p!B-aR2$X$YP44J@fMSZa(U3W)Jc{GUQkjSVMIddF zh4tuAeJ%u0&;<)`uzf=X7>dSCHy?G4qSgxHuv)r(A=oztu_j|EhGl{g%n3Mf4`O}= zjbO|^#5AcIB1?;8dX!?!%mflt3SwFs+SnTthTcou#YVq^D)g9L>?K~f@+Evn#N{O< z_RM(xw12*kw+F$J_wx7(;-nY3Wb|7s!B6xKi~p(uc9;%*AXv4&CK?7kQIXzArRgQs zlA|m8xkQ`pZZryt1t13#91k!(IH|`02KzR-O)7*;#kk zXa-PVNI|9Q0v6Ib3zql;SO^0qr8cV=RUZ8QUUE(33i23Kr9pQo)inI`p4QFaGci9FWEGif+$d+}gTxfU`Ra(X61S`30?@RdKkJohnfZI7MR$cj- zuMO$bjN>|(4oJ^_Hob1qQ{i~H=dp`lp)#4h2RLEcp+zvCgLaEtp8TnRgQ?_vwkQP_ zXaxwm0`@r{qF6w`=MxucUe*hR&zKsDF=Tcy_f+;5M`mJrWSMFWd8kpOJ}&6%mw*B9 z8l9=IldxrzpzX}Y-VxZz=$SQR!hpGWg{||NIlUmP1fBYd(7CS_zrR^aQn zDe3AletzjWI4uY|Z4?N&@>%CW&h&EKlSY>bm>F)5qQaPpuz|)g^>T9)L}e7|e!Cc3 zGfM;{mCzqVwXB0L4S`psT`&@M1{AgFQBw$7=^BppSR6w`x=Uz32*&t6L2_{dxkG!4u{_EoKx03aq<2Ox1$`*C@~~b5#(+2Hmf)z|8Fb2do#;jy1l!j{pDw07*qoM6N<$f;H7;h5!Hn literal 0 HcmV?d00001 diff --git a/devices/surface-hub/images/wcd-wizard.PNG b/devices/surface-hub/images/wcd-wizard.PNG new file mode 100644 index 0000000000000000000000000000000000000000..706771f756961ea08238c57a5e14aa7ab234b12a GIT binary patch literal 12354 zcmdVBXFObeyY{~b5)qL^M3Cq$YDf^hlY|(eGl(9Y(V~k^qPHMgqLmWhHsyo0K;J03d$#QsylH z;An!6z#9bM%B#*&5%33&<6C(t0N(#-4LrazmwY1$0A-Ox=Z5&;F`@lSZASpO-Fo%F z>9or;0RV2)D;Y_(5BiwY`ABv3v{mdi&%EoTXPGqnRg3=J6Ba_FjEB-kBJXTrb}-Ve zgO9-ok{scrbyf@2VU1fExAKntg)z#CKU~iFI_OC$Q{L7E+{0^6P?6&dGrBEHr-Lg+ zCd&C}bbEHb3MFQaX++JLr_=ZxuaHoBc z54t>`cVPhlRxT6~3p)BBT6x4_dy5+r(St8odnS6awCr$#jnl&i2Bq)EZTKM5d?u;F zoUp>>d#kc1g|qbY(CEeMbFrD?bueNX>#VctO&K^a=zsOxZqmpA(NXnF?|wM)8Uk0s zPE{Fh(9_Q%jks_+7GHvn!4FHfkA8dSA7csYgL%1Wwml#h7efL|xn^g1=L?fZ=oMZpg?;`s&%A04o zg(03+M~>*z8N+9DXCv}6m91DSk0;d?G>?kA&ThQ{Pi7wpYGwu(5QKk}2NJeTjK?;v`1r0Qll(m?DCpvDnK~GuDcE>gXEGR0r&F z{AC4J)NS9uYbUe8#@tyJ7Cw+!^+?P}ma<#@M5EtpH@!cwg!bNIEdUTnrof!N(>fUw znNW_q+>n4_k6)M$SEsQcd>5sx4rlSHgIxRRkxRNV4*DiRcJA|7vP<#Di31o*z&9`> z0}AOGzjRe|@$%GPeuTsxY-Wj+P3mXP?`L|NpioP70#U0CdgO0o7fz+i+4{@LuT}v9>54uA~M~kLp%Qt2>yrcSj-m@ zGLLErFa4q7Q#w^yYLvFJy^8CcnS1 zq^-Rad|RfA`!*KKSA31P(&H_2bJ-c*DEjn_P|y`Uu#5DmJlhZ%Cl~*OVOLG>QC4m; zxHW0)eU?-7;jpw}GnI`1Q0Bs4ayQOHjy2X30q=JF|E>sp(t!hj0@;5SgeZ1Ef{<1d z@VzGi{)Wl-@BWArd2s4Fk3`b+A{z(NW2dRbm;~mfGt+X<~AGzOoX1cxlYPccRSh3RHNoMWEkXt>g zPUgg)pg0){wY0(dm_%LCU5@+G*z&FSD>?D>n!qY<0q;&QS@9>nuuQUYtco z(Jj17nuj&h85>E$ysYB8-R1EgoRklR4T?1+;f(<|-+Rdtj2HTD);)R<2~|&UGres( zZIQ%ZB+hZWpcCEQNBye$E>d57{7?}WJtdvTQCXv@MyVhV53jBvfay{8KCUfk|LsfD zweGKLT4g8KGU!#F+c(D!!%$SZn&X>zOKF;L%qYv7Qh25rs+qiak~jsiJKOWfiiWmQ zn{vJ}H(-G4=qPCyl?FQ>(@*d}U09|Fcq1Jw&|4}|q&VaPf$(e8oK}AjT;J&X6Kd|o zD=rY(D9e0>O-08tyjms6OiM5oj)Ts|@lcDVKoH22k7!K_@WL z$lr*Tp+_W}*0?^5urfpP^|n4He@rBke@00t*xBwLqTyFo?&hAuhoFp^COz02wVALc zI-E{mmDfPTnNWQ(O@W{Jn0h`yaN&)qQ2Ytu5nnfI^mO@jK2Z<3BP>5nNhtvrm4eDy zI55_*Z;3q_Vy#YGi?>?lkDLg9RQ#o(vx-5}z?*^*FR7@agt+n%GbZbUq2Y@vJ?|~j z#h~dWm-*9gMq?i=>lLT0b#M@ecx>sbD+N^1x6W~4rVFulY0ySq{^zU;olD7L{6Wj) z?DEx6zJcQ=!_gi?JSsRlqvQK@S5#K^@r0epIX6mV*IKHGdAv(3T8-6Zwam_%7p4ZzlBA!L?(r-kN_4) zaNK5Lk2aE7h@g;bEPcsUXQ%isQ-XKNvZnsTEF96XS_{QGkML-wi|o0>5#m^X7|Jx6 z!D*F4yA_uw$u_XB4w`M13F|gT5q}JN?qz-cd<*6v;SiKTB%qv zQNzj5r!%=(ZH6vrTi2Kt&~I9rW-Ci8tZz)vC?bBoc`-!8K-KPEJIIe9ucU8bdlRPa zPox73);~`U%k~rHBu^%@x}(^R>zkHyka7d&mvRHhSowVjRyx?P7ES=j{=sk^?2`O~ zO~HzfSK@{PuoCMl-vE@E$J~-qUu?Qn9U7iEC1_e*12_by5;ppdAU!AS^HWR!pv*G2 zn{kxpC{2f$JN)xx((61-4;KKO7eohAtFFp~^HRhBSor$i7yy9QdLAiiOUy2D_kTCafKMq&3aGxoqVFT~6MWt`k?Isvj`~|uPLwUU5|D33n0a1KlFic|cz4c| zt4fGpC^}(I;%S4z1)Ri%?q`TxZXPCbN{d|8XbTLw1}$o#7` z?=Qqhl<`yEw6}N#4@=g4HlBY&2&E7XcV)kWC+Q@eH!^Co{vwr3Ijd%UxE!PfE!E$_ z*u0v0{CXc8Zz8RF9r1nP9RdUD zG}n~la?l0Ka}C?{uJ3Uq26(O*kUp2KlSMuq2URa}wa)vJ1_G-jb3lD)r7-Uum5LUe zO|6RG2;Wy<4qvw|5WHr3?;abQvI2m_XQHuCx7KUmQU&h*0vP}VfFO_<@}dJ`nO9(qnmsDG^Faa4Q0D<~LNMiONg3dkuJJ+qxYYVEDe-Z=CgW z#OJs@r_1(KVp6xCOpDndM+k3lAbqSKx>G9YJ>28NrA(|y}|JD4|=JD?w^>T;v zfZoJ++Tdlr@RR5}&;I~T5i0yq$5l3@kGWl9Wi1lp6`lpRA)b5TdgR0~-lL=*)%e$;==>>)w z1VWrvT{7(mk;BQpD_&4Mtofu&J!ZU%Hj8AO4lymEvGQQXfi>Rckl`NQ4_nLUy5Dus z!Q=X?=|S){Z`wi<+xW323Vi9K?lk^0!L9>>D6zZPFX_>eXL5IiRn!MJ%uRateKBG~ zkp3xq--1&bkf~@muwL-EV&WkWD)7aVc-fHhw z{>D6L8P-29ktZ%m*G%<6id=bPAOALF|7ofYbvN(WZp8Z6iTNT_H4GJqp&pyO<3(+o z+J?V)?7A1&uqzz-h)Rxj9Abt}h9)Yo_+TdISlH*!e=ZMEo+3;>LKQN# zBAM?=V*+?slJ}m?r^WGEOpul(*uKpPUCM&eTktVy)`;MAKOeCe4c#rYgLDmz57^}X zd6=t|qqrreL@|5HoE0Zva*y=gkBM4r^OMNf8hNLkx*YKpt*OJkf)%py?1Z4ntpuJK zedM#~OEu+wcdUEJdfu%MZC_}d%k;(SWxY3NSwd33+Yl3@5qA*@Qg;!jkc$bzulMAP zJm65TwN7Mwg6#R1tbhg!%d}8lxvWSM`;EAQ^yb-^wE(1HWL=Zpf)-?2_RFH^^!aWP zs)i3y=fk=%9ecpbIL+eV34vMGpU<##5Z53vO$V~=1v{fINtKh8xUfc?EJzz(8Yv_+ z)t*`sY^emW{7aU@x7;=I{}BCPCwbEvFJI(+A^u_w`_r9q#AR=!j)@6lbQm5#o0C+a ztM5_8qPgwLsIAGM#TlHd=N|Y!VaGfcAI3=(`Ec=A_8W@V+}QdRLtas3^TbZcV@JGVS7<6f>*e_E^M~u<>O~tOasXi?{e0-{`P9i9v^^tXiOw1@*Mq=}g8snKGZT z`XCQl5rl8VJIm((<`dtIAp8WbOb#_2l{QGV@_Q9VrL<~v!9?ts9IRRbOCs^`+TsrB z3uZsc9pj%)SbCz!NHeMrhXZ92E-F{JYo7q2!Eh=Oo-}ANDCPrYH z+GPYSY8)1|NKsK$uN&;Q&8CNOogo4PL@g&1d>sGg{GqaSQmKNZeH&lr1*5;F`To zul@Q@aDmkaqZaG@&R_K#hIz*2q;a@7yVX@3tvZCrBv;(?hYoD<{b)mMZ#XB{y?LBl zfg853p{J9;4ge;9tG+mq>Lp(r&s!R1&dvq*MmfAVGPlF1B=5Any>+z%4K#Z|Q#)!B z7t~MTZlHb`J6=Yt8v|j(anP}ulp{U#ZBAfSFo;Bte`};(?bE(dN=#wcK?E_`h$B9* z%D0bTJM|Cm zB{%920E5N*s`Si&g5ovGS)` zb~Y~O_9JYQFTACe6-qfkz;b`cKFJT65Y}gTR}Qsg>nmo|RLtI;FApOsPv^ z5UI4B8B-9?UXTL$*pcA9ugP9 zh5L<^bJps0gsdD(vEDu*vb{o-Q?qY+va^eUz0dwq=Ynr&>`1`bAxkyU?As;|TzU2~ zc*(`|IeV)TWfCU(on_Wr2t%~ldSr6E87HO<_NGl`HpX#~vXlA*ep#j9qs&Tejnz(L6-G5xHq_O}aSwx%ghi!W`8E0#Y+ zLjtZqc+~dnQu8-6y-=uExx?k|^ zzBh3ncaz;0TbIUXOX~@Z!N}i&0&)V<)iZ;JBa2Rm}4QKo&5`+7iG*tMBy{0u!H{!WvNcbb)bIqLA$QabIu%FtgEI{|H$ zKa1s|L55y2eu@Vgv#{$bC63-6wWCvV#$L4h0e_69{rN-VGi4BFDB=dR{$Lnh;qxaN z#9Z$s1+@^vR(`T?{vA!Mgy@?J{^NG^U4*vuzPl3eQknm&*zt(@@E?loV2G?94*=>T z4Wd2LgsuM4UOkV~k=N>*%E4MzYP*fEU4Pb~_geKOoV!7s#nnd02E@^?t=s|h#W!w7 z)W*CQx2tVYSH<g~w_kM0b` zK^Y>_>)DXh>HGvJb~7O+$rVo=z=>%6xpRt;61V=^L#ywZKw<*AAP>Q3oEnzl*f_ch ziW12?G6DfYZ)S5MMznEc-3z%mk)XmUm;4(O?_dJ zea>sZs)icey@mag6l`owqd}So$cPXd%*MFBUxSvQBKoF5tv$$MT7^9X&A39yF9N_f zYSo!r`+iK}Trn8QIPA`ZKylt#sHP^aMIIsNhRo5KiPYsgpBs+*y-)u1HpHEDh+k1c z-uWV+VP}f%q?^HOxQ1WYyVfG!`jI%@9+TDsFpeNsiC^>g9~MU^T4>Ciwq<-)avd+d z!c_nfY<0{VF~%?;#WTvi5usmdQAKjasSGw!AFZJ}t?v(Y=%yh~IoCfyr;RiS{7$W? zM!(Y=yI8FZo#&WL^#8ds=RoHC48#L<7i{E|BB>mSF&dr*^_dPD{h7nHhh*@{a>T8k zNY8R>ChEs=*o%>ZCs9_qZKj%H?MqV@LiCzi&z;6rv_+XAwudjv!?g}i%c{-q(W0us z@6YqKoB_wJA6}fdub)e3(9EzEdOf=tv=u9Alcv*E#kq^NtO?(M7!E{zJPCzH8)9Rw zPg}-3-$*qKnt+@!qlNSxB5af&(6~2LlsqxtG#P#V9diIXR+>7kbMi>CsdD;i6YBEt zVaRbI<%-FNMy~qK4kVRbqRClsr~LF!r``3G3$f3FYbh`UChF00 zxApgP_thh2A!hHHx9I;JN0l}e5^!RN<_3OCqq1pBmH^S6ZXi0^b}0@7^d+lk;kJO6Cf!lQk{I(2Q5j zDYfiYyQl5&PPjPi@?y5*9IR7RBeaB>_CgsG^b9J#9*d18Fm#U}LMq*CsrcaX9NXE7 z&T0fAM!k`BTHNWg^x}tGq;35})j=D%WSH(AmBy@PF(tC!i;Ocm`5=}nq%=2&ohf%4=AXv! z^i1D6qw1K;q>z#3=4?~MDdQb+ioQ$#0a3D{?gESH%g*f8I0ktg_s`s3K6)e0pH|lHh9+<) zxTrk z!7;CQN(^NPio+u62W?P zC0hM;qW>=7Y#DzOX4@!}9GNJ1o=|nG^K7KBkIYxft41lI9AW466Vv0_VESp%ufLJH@d61zJph_~~> z1Tb~p>AW)NtV;-{X0)p@gN#ta;%yNnbP!i7D=UB?HFrpjgKX0RF<7MK|Bmg!k8f>< zu=?M*NA$V>bSobah0tBt_rH^_BlVIi5syXs2n)RBy3PVujbLp}5{HfI-JnfH0%wax5UPNc*YLZY z1A6hMkq|2X4YFscF&U0c08oej57|Xt;`F&{NZD6G0j54WlU$}GJBZM?bZXT72&Pk1 zSLu{$=US03eWQ9}!V(w_P5xcnC4q#Ev72-IJmo$T^XV7iQ=m~;tzVG4gI9K68r)&z zy5`!R`U8{dALa)7#-Io3#Mk5oKYi%??KzVs-_f!cIReC&d&F<)#PG9yt}*(?3Gj4` z8jYpf_d%1?o!AQ=CT1XuKMjV(>X`*qciDk`UbYE(E)GUb4DQB5c4<&X8A0>@6OrU4 z06;6VR6yQvC9_g(vo(9K7HC$74}~k8;F@Wfe{K6#W7^JVth=(;7$3+ZZQNqIf@wY2 z3eYO0QGwEl!=_-57rWyOzJS-uUimcmoVPDbH~nGU&{{v`6*Uv>C2u!Qao4z` zwONBsO=pMt->}Pqq7`4wbb*9jhurGEG`q=JX#f7ZXsg6$)izSLI^qnfE`pKy(N7Q- z(?xo_PxYUC)yNHv$ABQb9E-bUKHy|Q7~4r)KvUT{6D@fX4M`|&`|e-v)6YCZ&{dV9 zLRehV_2bltUWXTkx#7s$;4MYafuZNn`){gjsy#0%A+ne30VymnyKCm-na-oz#~+Kt zYSlH)%y(}Luaw(evc%Jx zo+r~}EdMjVe`tR!b$RED;jMbTM1}=eYW&BxQVEgmQ+|QQQ+LrhJ-cb2 z(@(xz==f8fJ{-?1K~GyN)TD>6%UIVd<*ow#;t%LhNs4oe)URc`dq-gWLOZzMf zqB%3k@Z%S#2tAQKauDhUMRdrfC={I&qt}ZIQxaD`)b!_zD=FX1tws)b8O_+&&ur-$ zs1;E{Y!Y9AaS|;G&baBkW=dq}9iO&IX z3vC|CnSi=wrc=i~zgzh4YYLwm?Y=TvvNArY4jcJY0i!6x6}Zc7%=$A)ixU2M7hMnl zi}<-rg>4BLChED*?o;gTOxLkNUZUy=;+=W-@S@EBu=`(F;nxmXOw%n-Bvk$^r&^{~ zn!6-bVMOeguT_dC0avCjo|lOtosj_)uAy%-{ltI;W9f&#E&#m#D1RHA{lOza5&*1( z`g^#5GG#-?9UwyytOddj6ML4J*4;IZl5qk+3s%XAO4&}2+tX~Sx^j7x8kQutMOTCV z!@mQQ`zv^?xBZ)ps%uP50Sj>Hs0s`G-w2T|W(>+GiPYMS@0$kufoOMZ{q|CSIN78F zx?JxX7|!K^nap|z2biP_@;j=Zjw`-iGD;$)0;gyMz??mWNLxO)xy)K2@`SM0AK%yZKOoS~{@B>&`TbwRF;FtT8nYtRyH4;#O1*6j+8chWLCU%L z)1wYT>=`fZ#=sT}7m(opYi8=dj7SWYLl1f;|6>^98KiHx^WG`E_AZ_zNBh+d`z`9H zp7HoeoPQ=0QD0U-^$~8DRwzc0!3v7NzDBos*{wk^lr%mbG+h*HRH%B%UHt@6ptU`r z%p(ehlls!>h2I7=Ra*GJl|t3?EN$9u0*#+<6jvi%j0^uQf0qI`Qb?`Ep zsoV&OQ+>uX@8#|mfaOUOQ)4~DPWlB7{ zzePbo^AZ3;VprrqiKLLS-k|8yU~m{A#z4}z9~EwnZg)LI2AeNu_X=Flffx`f*keJ5 zqcpl9)N8R#Rg*idZwgHoj|r2wTgtDrQb>U!&7-&rx@N_Sg>e=FQ>VI$per0OL8GKg z4w1#wZV$pTy|rB{9YHHO-`*(&eW$h>C)7MUd3X`}ib8 z0;OR6*~-QK*zVYob1+xTTAN9R>FvYEjz^(Aj|w4`VzaT&q?ugO!8|PIk&5=nZYT}S z1x|9Asq1u2nwhuTPxsELj{0<_)6E&L@*uaHqvGn#6FfUE>v~O5n%*nX#;rHnPP;!t zV>e)H=n~QCGn1thg9#BGY4Kc+s12!17E=skuTbV=6*<4W)QL>3jZPWf-WaP=(I_Rw zs3hY?L!GTxVh=)ekBHmXm!nyO<0Ua#x?59+FXdc@SjaW?qr1K@5_R*@W#&i!B2lfh z-gT|c?TJ0+Q1qJFzh@J>gJ?spDra0&8OP4!==GoX{*R#+ElO76?LEWDLaz8qnR{o) zN|mFbDbjOINh}UhA_;O!VPj01Tn2yuaXpF+^8FllM#z1Nr{)&oAaW(K zUl*BRolcD&bvZ#mK2zByPJ3;93R7Rq$M9N!$UwWd4w1h0Na_wz`r2`CFYSlhPc^lh zW#{K-X2=$nW11hq144UJJ*h0zkFoW`Jrcq0ukg^Z>kjEsOjeVMkg#1E7x%e z>th&TZnHEB->jId^z#Ma)ILDmJr9Eb5KF zb-U;6Dpczhh!CDwdWpdL;gPwwxDW@B%J^>KG=98)hZTq6RWMe><)9*K#B=vXJM<$Y zwAB{%ymN%bJ@qMuwGkYx5Ikes!Fv7t^o^N5n-jqn3S%}S8odmWaqEmc3gx_CO8l(k zh5quCiz8GD9u^H1B|eH&%7+oZtadK9@raor(usZ-&)i>k%9L}Sm;N(}$)u6^f;L!>iH2o$(y`#*s zb;^21?nQ^tzufXbI2y~kJVIEbt}>@}Dd%r>JYZ+79?=JlZ{mx6i_ltb1MR5xJ}~%N zmKq;gv)iN;2mP;G7(s5(ObmaAlfj}=c4(KBaFukSOh)3aA{f6h>dn6#MI4}x=6}nc zaQDCsQvLxX_np_BT2#dNwUvyTvVFxA8)|r|8`*NGdNOdFqK@t#`BeW+)?r;|3vJN; ziz5CnGrxcFtCB;r5q7wHeGj(1x6-Rxv0oO@#BPfxc}IcgY6ma-crgQ0Ni!nP!zI3D zu)Eh>Oj#+2#9@7{3R8Eqn{$m8t_0_29*Q|l)1FCiO4& zpL_c)aAE%=mrb+urfuf@& zr_841vZgQSjL)dy-XmR*C9CF2K`2Pqk6Jyv)u&x#4@l(T;aL+;qS)hzV1ez|V1Zn? zh@T5|@^H|%J23qCUVLv)T+H*`%PixF@WaC5NVE|9wJIA`-mhMg8ju53i;n?wq# zFk%xeDt}^pgr^A?)M?~Z4n@~!e4#MERfn_Qt80}w;NH@VZ&>IJ-96yHW9S^~Pnt{Q z*C`(S$s!tLyLuafFe`0%nD%W`y~HQ5K$s-F^aHB`obTsvf91R`vL1Z!O=aFfL}>E5 z7yjpA@?~zPeKdRA-`@GZ)b4v-cmtLUpp6hJ!_+kYuTx7zSAp&Sm9I$Em2)2X|H{Zx jUU&Re8)&kbcu8_u&o9lQ(+`Hq;6De*D#^g5-ueB1uhbA7 literal 0 HcmV?d00001 diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md index 537d6c55a9..d05ed24b2a 100644 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ b/devices/surface-hub/surfacehub-whats-new-1703.md @@ -13,16 +13,42 @@ localizationpriority: medium Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub: +## New settings -- Settings have been added to mobile device management (MDM) and configuration service providers (CSPs) to expand the Surface Hub management capabilities. [Learn more about the new settings.](manage-settings-with-mdm-for-surface-hub.md) +Settings have been added to mobile device management (MDM) and configuration service providers (CSPs) to expand the Surface Hub management capabilities. [New settings include](manage-settings-with-mdm-for-surface-hub.md): -- An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md) +- InBoxApps/SkypeForBusiness/DomainName +- InBoxApps/Connect/AutoLaunch +- Properties/DefaultVolume +- Properties/ScreenTimeout +- Properties/SessionTimeout +- Properties/SleepTimeout +- Properties/AllowSessionResume +- Properties/AllowAutoProxyAuth +- Properties/DisableSigninSuggestions +- Properties/DoNotShowMyMeetingsAndFiles +
-- When you reset a Surface Hub device, you now have the ability to download and install a factory build of the operating system from the cloud. [Learn more about cloud recovery.](device-reset-surface-hub.md#cloud-recovery) - >[!NOTE] - >Cloud recovery doesn't work if you use proxy servers. +## Provizioning wizard + +An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices, and includes bulk join to Azure Active Directory. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md) + +![steps in the provision Surface Hub devices wizard](images/wcd-wizard.png) -- **I'm done** is now **End session**. [Learn how to use End session.](i-am-done-finishing-your-surface-hub-meeting.md) +## Cloud recovery + +When you reset a Surface Hub device, you now have the ability to download and install a factory build of the operating system from the cloud. [Learn more about cloud recovery.](device-reset-surface-hub.md#cloud-recovery) + +>[!NOTE] +>Cloud recovery doesn't work if you use proxy servers. + +![Reinstall](images/reinstall.png) + +## End session + +**I'm done** is now **End session**. [Learn how to use End session.](i-am-done-finishing-your-surface-hub-meeting.md) + +![end session](images/end-session.png) diff --git a/windows/manage/new-policies-for-windows-10.md b/windows/manage/new-policies-for-windows-10.md index 873c393efd..311f3f125f 100644 --- a/windows/manage/new-policies-for-windows-10.md +++ b/windows/manage/new-policies-for-windows-10.md @@ -74,6 +74,8 @@ Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Wind - Consumer experiences, such as suggested apps in Start and app tiles from Microsoft dynamically inserted in the default Start menu +Windows 10, version 1703, adds a number of [ADMX-backed policies to MDM](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). + If you use Microsoft Intune for MDM, you can [configure custom policies](https://go.microsoft.com/fwlink/p/?LinkId=616316) to deploy Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings that can be used to control features on Windows 10. For a list of OMA-URI settings, see [Custom URI settings for Windows 10 devices](https://go.microsoft.com/fwlink/p/?LinkId=616317). No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId=613264). For more information, see the [ActiveSync configuration service provider](https://go.microsoft.com/fwlink/p/?LinkId=618944) technical reference. From 1224d5ed0d108a93f71a7444f5e081cf282addf4 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 13:34:34 -0700 Subject: [PATCH 113/165] update vdi in prep for feedback --- ...e-exclusions-windows-defender-antivirus.md | 14 +++---- ...e-exclusions-windows-defender-antivirus.md | 21 ---------- ...ployment-vdi-windows-defender-antivirus.md | 38 ++++++++++++------- ...hell-cmdlets-windows-defender-antivirus.md | 4 ++ .../use-wmi-windows-defender-antivirus.md | 2 + 5 files changed, 38 insertions(+), 41 deletions(-) diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md index ebc0cbd396..3010dbe37d 100644 --- a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Configure and validate exclusions based on file name, extension, and folder location +# Configure and validate exclusions based on file extension and folder location **Applies to:** @@ -41,12 +41,10 @@ Exclusion | Examples | Exclusion list ---|---|--- Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions -Any file with a specific file name | The file "sample.test", anywhere on the machine | File and folder exclusions A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions A specific process | The executable file c:\test\process.exe | File and folder exclusions list This means the exclusion lists have the following characteristics: -- If you exclude a file, the exclusion will apply to all versions of that file, regardless of where the file is located. - Folder exclusions will apply to all files and folders under that folder. - File extensions will apply to any file name with the defined extension, regardless of where the file is located. @@ -63,20 +61,22 @@ You can add, remove, and review the lists for exclusions in [Group Policy](#gp), You can also [use PowerShell cmdlets and WMI to configure the exclusion lists](#ps), including [reviewing](#review) and [validating](#validate) your lists. -By default, local changes made to the lists (by users with administrator privileges) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, Intune, PowerShell, or WMI. The Group Policy lists will take precedence in the case of conflicts. You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to disable this setting. +By default, local changes made to the lists (by users with administrator privileges; this includes changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. + +You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-windows-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. -## Configure the list of exclusions based on file or folder name or file extension +## Configure the list of exclusions based on folder name or file extension -**Use Group Policy to configure file name, folder, or file extension exclusions:** +**Use Group Policy to configure folder or file extension exclusions:** >[!NOTE] ->The exclusion will apply to any file with the defined file name - regardless of its location. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded. +>If you include a fully qualified path to a file, then only that file will be excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder will be excluded. 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 4e972c4578..86d980313c 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -201,28 +201,7 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use - - ## Related topics diff --git a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md index 11bd032d6e..54535d3ef1 100644 --- a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md +++ b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md @@ -31,7 +31,20 @@ author: iaanw In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus (Windows Defender AV) in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. -Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware. For more details on the best configuration options to ensure a good balance between performance and protection, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section. +Boot storms can be a problem in large-scale VDIs; this guide will help reduce the overall network bandwidth and performance impact on your hardware. + +We recommend setting the following when deploying Windows Defender AV in a VDI environment: + +Location | Setting | Suggested configuration +---|---|--- +Client interface | Enable headless UI mode | Enabled +Client interface | Suppress all notifications | Enabled +Scan | Specify the scan type to use for a scheduled scan | Enabled - Quick +Root | Randomize scheduled task times | Enabled +Signature updates | Turn on scan after signature update | Enabled +Scan | Turn on catch up quick scan | Enabled + +For more details on the best configuration options to ensure a good balance between performance and protection, including detailed instructions for Group Policy and System Center Configuration Manager, see the [Configure endpoints for optimal performance](#configure-endpoints-for-optimal-performance) section. See the [Microsoft Desktop virtualization site](https://www.microsoft.com/en-us/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support. @@ -54,8 +67,6 @@ There are three main steps in this guide to help roll out Windows Defender AV pr >[!NOTE] >When you manage Windows with System Center Configuration Manager, Windows Defender AV protection will be referred to as Endpoint Protection or System Center Endpoint Protection. See the [Endpoint Protection section at the Configuration Manager library]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-protection) for more information. -The following table lists the configuration settings that we recommend when deploying Windows Defender AV in a VDI environment: - ## Create and deploy the base image @@ -75,7 +86,9 @@ After creating the image, you should ensure it is fully updated. See [Configure ### Seal the base image When the base image is fully updated, you should run a quick scan on the image. This “sealing” or “locking” of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted. + >[!NOTE] >Quick scan versus full scan @@ -102,7 +115,7 @@ The following references provide ways you can create and deploy the base image a ## Manage your VMs and base image How you manage your VDI will affect the performance impact of Windows Defender AV on your VMs and infrastructure. -Because Windows Defender AV downloads protection updates every day, [or based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. +Because Windows Defender AV downloads protection updates every day, or based on your protection update settings, network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. Following the guidelines in this means the VMs will only need to download “delta” updates, which are the differences between an existing definition set and the next one. Delta updates are typically much smaller (a few kilobytes) than a full definition download (which can average around 150 mb). @@ -112,9 +125,9 @@ Following the guidelines in this means the VMs will only need to download “del If you are using a persistent VDI, you should update the base image monthly, and set up protection updates to be delivered daily via a file share, as follows: 1. Create a dedicated file share location on your network that can be accessed by your VMs and your VM host (or other, persistent machine, such as a dedicated admin console that you use to manage your VMs). 2. Set up a scheduled task on your VM host to automatically download updates from the MMPC website or Microsoft Update and save them to the file share (the [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) can help with this). -3. [Configure the VMs to pull protection updates from the file share](manage-protection-updates-windows-defender-antivirus.md). +3. Configure the VMs to pull protection updates from the file share. 4. Disable or delay automatic Microsoft updates on your VMs. See [Update Windows 10 in the enterprise](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-update-windows-10) for information on managing operating system updates with WSUS, SCCM, and others. -5. On or just after each Patch Tuesday (the second Tuesday of each month), update your base image with [the latest protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md). Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/). +5. On or just after each Patch Tuesday (the second Tuesday of each month), update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update. Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/). 5. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them. @@ -125,8 +138,8 @@ A benefit to aligning your image update to the monthly Microsoft Update is that If you are using a non-persistent VDI, you can update the base image daily (or nightly) and directly apply the latest updates to the image. An example: -1. Every night or other time when you can safely take your VMs offline, update your base image with t[the latest protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md). -2. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. +1. Every night or other time when you can safely take your VMs offline, update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update. +2. Run a quick scan on your base image before deploying it to your VMs. @@ -148,7 +161,7 @@ These settings can be configured as part of creating your base image, or as a da Windows Defender AV supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjuction with [Disable scans from occuring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline). -Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-windows-defender-antivirus.md). +Scheduled scans run in addition to real-time protection and scanning. The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. @@ -170,7 +183,7 @@ The start time of the scan itself is still based on the scheduled scan policy See [How to create and deploy antimalware policies: Advanced settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#advanced-settings) for details on configuring System Center Configuration Manager (current branch). -See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for other configuration options available for scheduled scans. + ### Use quick scans @@ -267,9 +280,6 @@ This setting will prevent a scan from occurring after receiving an update. You c This setting will help ensure protection for a VM that has been offline for some time or has otherwise missed a scheduled scan. -DisableCatchupQuickScan, is the setting that I use (set to OFF) to ensure that a quick scan is performed on a VM which has been offline and has missed a schedule scan. - - **Use Group Policy to enable a catch-up scan:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -283,6 +293,8 @@ DisableCatchupQuickScan, is the setting that I use (set to OFF) to ensure that a 1. Double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. Click **OK**. This forces a scan if the VM has missed two or more consecutive scheduled scans. + + **Use Configuration Manager to disable scans after an update:** 1. On your System Center Configuration Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) diff --git a/windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md b/windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md index 4fde6f96c2..d3d65aa3ad 100644 --- a/windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md +++ b/windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md @@ -27,6 +27,10 @@ PowerShell cmdlets are most useful in Windows Server environments that don't rel > [!NOTE] > PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [System Center Configuration Manager](https://technet.microsoft.com/en-us/library/gg682129.aspx), [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), or [Windows Defender Group Policy ADMX templates](https://support.microsoft.com/en-us/kb/927367). +Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that dployments of policy with Group Policy, System Center Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell. + +You can [configure which settings can be overriden locally with local policy overrides](configure-local-policy-overrides-windows-defender-antivirus.md). + PowerShell is typically installed under the folder _%SystemRoot%\system32\WindowsPowerShell_. diff --git a/windows/keep-secure/use-wmi-windows-defender-antivirus.md b/windows/keep-secure/use-wmi-windows-defender-antivirus.md index 83c19a8f4f..cc74e07307 100644 --- a/windows/keep-secure/use-wmi-windows-defender-antivirus.md +++ b/windows/keep-secure/use-wmi-windows-defender-antivirus.md @@ -26,7 +26,9 @@ Windows Defender AV has a number of specific WMI classes that can be used to per The [MSDN Windows Defender WMIv2 Provider reference library](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) lists the available WMI classes for Windows Defender AV, and includes example scripts. +Changes made with WMI will affect local settings on the endpoint where the changes are deployed or made. This means that dployments of policy with Group Policy, System Center Configuration Manager, or Microsoft Intune can overwrite changes made with WMI. +You can [configure which settings can be overriden locally with local policy overrides](configure-local-policy-overrides-windows-defender-antivirus.md). ## Related topics From 4eda4488ab4f1419a72bd91f7db36e0d00f90031 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 30 Mar 2017 13:48:17 -0700 Subject: [PATCH 114/165] bug# 11420882 --- ...system-components-to-microsoft-services.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index ac398c6a26..64217c2478 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -286,7 +286,7 @@ You can prevent Windows from setting the time automatically. -or- -- Disable the Group Policy: **System\\Windows Time Service\\Time Providers!!Enable Windows NTP Client** +- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Enable Windows NTP Client** - or - @@ -356,7 +356,7 @@ To turn off Insider Preview builds for Windows 10: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**. - - or - + -or - - Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\PreviewBuilds!AllowBuildPreview** to 0 (zero) @@ -402,12 +402,12 @@ Alternatively, you could use the registry to set the Group Policies. | Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Explorer\\AutoComplete!AutoSuggest
REG_SZ: **No** | | Disable Periodic Check for Internet Explorer software updates| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Infodelivery\\Restrictions!NoUpdateCheck
REG_DWORD: 1 | | Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation!PolicyDisableGeolocation
REG_DWORD: 1 | -| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | +| Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\ Internet Explorer\\PhishingFilter!EnabledV9
REG_DWORD: 0 | -There are two more Group Policy objects that are used by Internet Explorer: +There are three more Group Policy objects that are used by Internet Explorer: -| Path | Policy | Description | -| - | - | - | +| Path | Description | +| - | - | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Disabled | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | @@ -417,10 +417,10 @@ You can also use registry entries to set these Group Policies. | Policy | Registry path | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| -| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds!BackgroundSyncStatus
REG_DWORD: 0| +| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation!MSCompatibilityMode
REG_DWORD: 0| | Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead!Enabled
REG_DWORD: 0| +| Turn off background synchronization for feeds and Web Slices | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds!BackgroundSyncStatus
DWORD:0 | -AllowServicePoweredQSA ### 8.1 ActiveX control blocking @@ -430,7 +430,7 @@ You can turn this off by: - Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** - - or - + -or - - Changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero). @@ -554,7 +554,7 @@ You can turn off NCSI by doing one of the following: > [!NOTE] > After you apply this policy, you must restart the device for the policy setting to take effect. - -or- +-or- - Create a REG\_DWORD registry setting called **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator!NoActiveProbe**, with a value of 0 (zero). @@ -1327,7 +1327,7 @@ To turn off **Let apps run in the background**: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in background** - - Set the **Select a setting** box to **Force Deny**. + - Set the **Select a setting** box to **Force Deny**. ### 17.17 Motion From d1bec68ad9a8f92d8107cd2fd47c7c80b79c1c39 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 30 Mar 2017 13:51:07 -0700 Subject: [PATCH 115/165] bug# 11421096 --- ...s-operating-system-components-to-microsoft-services.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 64217c2478..febf96fe74 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1689,11 +1689,17 @@ You can turn off Windows Update by setting the following registry entries: - Add a REG\_DWORD value called **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1. + -or- + - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**. + -and- + - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Intenet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features**. -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** and set the **Set the alternate download server** to **,**. + -and- + +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** and set the **Set the alternate download server** to "". You can turn off automatic updates by doing one of the following. This is not recommended. From 49e53a3c4c99ed2a030f9bbef1be0917332ea1be Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 30 Mar 2017 13:53:13 -0700 Subject: [PATCH 116/165] bug# 10980772 --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index febf96fe74..c8e141096b 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1325,7 +1325,7 @@ To turn off **Let apps run in the background**: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in background** +- Apply the Group Policy (only applicable for Windows 10, version 1703): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background** - Set the **Select a setting** box to **Force Deny**. From 20cad0ad6888a0e8030931a546b350587b6d2221 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 30 Mar 2017 13:54:00 -0700 Subject: [PATCH 117/165] bug# 10980704 --- ...windows-operating-system-components-to-microsoft-services.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index c8e141096b..31882157e2 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1357,6 +1357,8 @@ To turn this off: - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks** + - Set the **Select a setting** box to **Force Deny**. + ### 17.19 App Diagnostics In the **App diagnostics** area, you can choose which apps have access to your diagnostic information. From 7bb3ab0ca2b65b2ed3657694552538f204e5601f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 30 Mar 2017 14:01:33 -0700 Subject: [PATCH 118/165] bug# 11394447 --- ...indows-operating-system-components-to-microsoft-services.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 31882157e2..8f62d23a67 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -883,6 +883,7 @@ To turn off **Let apps on my other devices use Bluetooth to open apps and contin - Turn off the feature in the UI. + ### 17.2 Location In the **Location** area, you choose whether devices have access to location-specific sensors and which apps have access to the device's location. @@ -1618,6 +1619,8 @@ You can turn off the ability to launch apps from the Windows Store that were pre - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!AutoDownload**, with a value of 2 (two). +Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy* > **Configure web-to-app linking with URI handlers** + ### 26. Windows Update Delivery Optimization Windows Update Delivery Optimization lets you get Windows updates and Windows Store apps from sources in addition to Microsoft, which not only helps when you have a limited or unreliable Internet connection, but can also help you reduce the amount of bandwidth needed to keep all of your organization's PCs up-to-date. If you have Delivery Optimization turned on, PCs on your network may send and receive updates and apps to other PCs on your local network, if you choose, or to PCs on the Internet. From ffc75cbeaf0e8a84033cb27932f87ae812a8125d Mon Sep 17 00:00:00 2001 From: John Tobin Date: Thu, 30 Mar 2017 14:11:08 -0700 Subject: [PATCH 119/165] Credential Guard text and heading changes --- .../credential-guard-considerations.md | 13 +++---------- .../keep-secure/credential-guard-how-it-works.md | 16 ++++++---------- windows/keep-secure/credential-guard-manage.md | 9 ++------- .../credential-guard-not-protected-scenarios.md | 13 +++---------- .../keep-secure/credential-guard-requirements.md | 12 +++--------- windows/keep-secure/credential-guard.md | 8 +++----- 6 files changed, 20 insertions(+), 51 deletions(-) diff --git a/windows/keep-secure/credential-guard-considerations.md b/windows/keep-secure/credential-guard-considerations.md index bf97ca9299..c2bc39226d 100644 --- a/windows/keep-secure/credential-guard-considerations.md +++ b/windows/keep-secure/credential-guard-considerations.md @@ -15,7 +15,8 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See [Credentials Protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) +in the Deep Dive into Credential Guard video series. - If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. - You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: @@ -49,14 +50,6 @@ When you enable Credential Guard, you can no longer use Kerberos unconstrained d ## See also -Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. - -### Credentials Protected by Credential Guard - -[![Credentials Protected by Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) - - - -**Related videos in this series** +**Deep Dive into Credential Guard: Related videos** [Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) diff --git a/windows/keep-secure/credential-guard-how-it-works.md b/windows/keep-secure/credential-guard-how-it-works.md index 62b860bcb2..da731369ea 100644 --- a/windows/keep-secure/credential-guard-how-it-works.md +++ b/windows/keep-secure/credential-guard-how-it-works.md @@ -16,7 +16,8 @@ author: brianlic-msft - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See [Credential Guard Design](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) in the Deep Dive into Credential Guard video series. + Kerberos, NTLM, and Credential manager isolate secrets by using virtualization-based security. Previous versions of Windows stored secrets in the Local Security Authority (LSA). Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. @@ -34,15 +35,10 @@ Here's a high-level overview on how the LSA is isolated by using virtualization- ## See also -Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. +**Deep Dive into Credential Guard: Related videos** -### Credential Guard Overview: Credential Theft and Lateral Traversal - -[![Credential theft and lateral traversal](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) - - -**Related videos in this series:** - -[Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) +[Credential Theft and Lateral Traversal](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) [Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) + +[Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) \ No newline at end of file diff --git a/windows/keep-secure/credential-guard-manage.md b/windows/keep-secure/credential-guard-manage.md index 88acb2d41a..a70d85eb17 100644 --- a/windows/keep-secure/credential-guard-manage.md +++ b/windows/keep-secure/credential-guard-manage.md @@ -15,7 +15,8 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See [Protecting privileged users with Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) +in the Deep Dive into Credential Guard video series. ## Enable Credential Guard Credential Guard can be enabled by using [Group Policy](#turn-on-credential-guard-by-using-group-policy), the [registry](#turn-on-credential-guard-by-using-the-registry), or the Device Guard and Credential Guard [hardware readiness tool](#hardware-readiness-tool). @@ -186,12 +187,6 @@ You can also disable Credential Guard by using the [Device Guard and Credential ``` DG_Readiness_Tool_v3.0.ps1 -Disable -AutoReboot ``` -  -## See also -Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. -
-### Deploying Credential Guard -[![Deploying Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) \ No newline at end of file diff --git a/windows/keep-secure/credential-guard-not-protected-scenarios.md b/windows/keep-secure/credential-guard-not-protected-scenarios.md index f656c9038e..5f7dba289d 100644 --- a/windows/keep-secure/credential-guard-not-protected-scenarios.md +++ b/windows/keep-secure/credential-guard-not-protected-scenarios.md @@ -15,7 +15,8 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See [Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) +in the Deep Dive into Credential Guard video series. Some ways to store credentials are not protected by Credential Guard, including: @@ -153,14 +154,6 @@ To learn more about authentication policy events, see [Authentication Policies a ## See also -Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. - -### Credentials protected by Credential Guard - -[![Credentials protected by Credential Guard](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) - - - -**Related videos in this series:** +**Deep Dive into Credential Guard: Related videos** [Protecting privileged users with Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) diff --git a/windows/keep-secure/credential-guard-requirements.md b/windows/keep-secure/credential-guard-requirements.md index 59e3915359..c2f3f0fc73 100644 --- a/windows/keep-secure/credential-guard-requirements.md +++ b/windows/keep-secure/credential-guard-requirements.md @@ -15,7 +15,9 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See +[Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) +in the Deep Dive into Credential Guard video series. For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). @@ -116,11 +118,3 @@ The following table lists qualifications for Windows 10, version 1703, which are |---------------------------------------------|----------------------------------------------------| | Firmware: **VBS enablement of NX protection for UEFI runtime services** | **Requirements**:
• VBS will enable No-Execute (NX) protection on UEFI runtime service code and data memory regions. UEFI runtime service code must support read-only page protections, and UEFI runtime service data must not be executable.
• UEFI runtime service must meet these requirements:
    - Implement UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. All UEFI runtime service memory (code and data) must be described by this table.
    - PE sections need to be page-aligned in memory (not required for in non-volatile storage).
    - The Memory Attributes Table needs to correctly mark code and data as RO/NX for configuration by the OS:
        - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both
        - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory must be either readable and executable or writeable and non-executable.

Notes:
• This only applies to UEFI runtime service memory, and not UEFI boot service memory.
• This protection is applied by VBS on OS page tables.


Please also note the following:
• Do not use sections that are both writeable and executable
• Do not attempt to directly modify executable system memory
• Do not use dynamic code

**Security benefits**:
• Vulnerabilities in UEFI runtime, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware. | | Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
• Protects against potential vulnerabilities in UEFI runtime services, if any, will be blocked from compromising VBS (such as in functions like UpdateCapsule and SetVariable)
• Reduces the attack surface to VBS from system firmware.
• Blocks additional security attacks against SMM. | - -## See also - -Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. - - ### Credential Guard Deployment Requirements - -[![Credential Guard Deployment Requirements](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) \ No newline at end of file diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index d0fba3ca1d..b36d3a7301 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -16,7 +16,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Prefer video? See the **Deep Dive into Credential Guard** video series in the **See also** section of this article. +Prefer video? See [Credential Theft and Lateral Traversal](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) in the Deep Dive into Credential Guard video series. Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials. @@ -42,8 +42,6 @@ By enabling Credential Guard, the following features and solutions are provided: ## See also -Prefer video? Microsoft has created a new **Deep Dive into Credential Guard** video series that explores the main features of Credential Guard and how it works. +**Deep Dive into Credential Guard: Related videos** -### Credential Guard: Credential Theft and Lateral Traversal - -[![Credential theft and lateral traversal](images/mva_videos.png)](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) +[Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) \ No newline at end of file From b3efd97c7ba111a0243fc8f6589577ed41c61ce3 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 14:12:15 -0700 Subject: [PATCH 120/165] extension updates --- ...e-exclusions-windows-defender-antivirus.md | 21 ++++++----- ...e-exclusions-windows-defender-antivirus.md | 36 +++++++++++-------- 2 files changed, 33 insertions(+), 24 deletions(-) diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md index 3010dbe37d..d4baacf3ec 100644 --- a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -91,7 +91,7 @@ You can [configure how locally and globally defined exclusions lists are merged] 1. Set the option to **Enabled**. 2. Under the **Options** section, click **Show...** - 3. Enter each path or file on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column for all processes. + 3. Enter each folder on its own line under the **Value name** column. If you are entering a file, ensure you enter a fully qualified path to the file, including the drive letter, folder path, filename, and extension. Enter **0** in the **Value** column for all processes. 7. Click **OK**. @@ -117,7 +117,7 @@ Using PowerShell to add or remove exclusions for files based on the extension, l The format for the cmdlets is: ```PowerShell - - ", , " + - "" ``` The following are allowed as the \: @@ -126,24 +126,24 @@ Configuration action | PowerShell cmdlet ---|--- Create or overwrite the list | `Set-MpPreference` Add to the list | `Add-MpPreference` -Remove items from the list | `Remove-MpPreference` +Remove item from the list | `Remove-MpPreference` The following are allowed as the \: Exclusion type | PowerShell parameter ---|--- All files with a specified file extension | `-ExclusionExtension` -All files under a folder (including files in subdirectories) | `-ExclusionPath` +All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` >[!IMPORTANT] >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test**, **.sample**, or **.ignore** file extension: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the **.test** file extension: ```PowerShell -Add-MpPreference -ExclusionExtension ".test, .sample, .ignore" +Add-MpPreference -ExclusionExtension ".test" ``` See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. @@ -184,7 +184,10 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende ## Use wildcards in the file name and folder path or extension exclusion lists -You can use the asterisk **\***, question mark **?**, or environment variables (such as %APPDATA%) as wildcards when defining items in the file name or folder path exclusion list. +You can use the asterisk **\***, question mark **?**, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. + +>[!IMPORTANT] +>Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. You cannot use a wildcard in place of a drive letter. @@ -193,9 +196,9 @@ The following table describes how the wildcards can be used and provides some ex Wildcard | Use | Example use | Example matches ---|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
|
  • C:\MyData\my-archived-files-43.zip
  • Any file in C:\somepath\folder1\folder2\Data
+***** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
|
  • C:\MyData\my-archived-files-43.zip
  • Any file in C:\somepath\folder1\folder2\Data
**?** (question mark) | Replaces a single character |
  • C:\MyData\my\?.zip
  • C:\somepath\\\?\Data
|
  • C:\MyData\my1.zip
  • Any file in C:\somepath\P\Data
-Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
  • %APPDATA%\Data\file.png
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
  • C:\Users\username\AppData\Roaming\Data\file.png
+Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 86d980313c..d9be336928 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -34,11 +34,19 @@ author: iaanw You can exclude files that have been opened by specific processes from being scanned by Windows Defender AV. -For example, you may need to exclude any file that is opened by the process *c:\internal\test.exe*. -You achieve this by adding the location and name of the process to the process exclusion list. When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). +This topic describes how to configure exclusion lists for the following: -The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). + **Use Group Policy to exclude files that have been used or modified by specified processes from scans:** ->[!NOTE] ->You can exclude files that are opened by specified processes from being scanned. The specified process won't be excluded - but any files that are opened by that process (regardless of where they are or what they are named) will be excluded. If you need to exclude the process itself, [exclude it as a file](#exclude-paths-files). ->You can only exclude files modified by processes if the process is an executable. - - 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration**. @@ -73,7 +79,7 @@ By default, local changes made to the lists (by users with administrator privile 1. Set the option to **Enabled**. 2. Under the **Options** section, click **Show...** - 3. Enter each process on its own line under the **Value name** column. Ensure you enter a fully qualified path to the process, including the drive letter, folder path, filename, and extension. The process must be an executable. Enter **0** in the **Value** column for all processes. + 3. Enter each process on its own line under the **Value name** column. See the [example table](#examples) for the different types of process exclusions. Enter **0** in the **Value** column for all processes. 7. Click **OK**. @@ -104,10 +110,10 @@ Remove items from the list | `Remove-MpPreference` >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the defined processes. This exclusion will apply to any file that is opened by the processes that are in the specified folder: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the defined process: ```PowerShell -Add-MpPreference -ExclusionProcess "c:\internal\test.exe, d:\org\ui\compile43-h.exe" +Add-MpPreference -ExclusionProcess "c:\internal\test.exe" ``` For example, files opened by the process *c:\outside\test.exe* will not be excluded. This is the because the opening process is located in a different folder ("outside" instead of "internal"), even though the process's file name is the same. @@ -151,15 +157,15 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende The use of wildcards in the process exclusion list is different from their use in other exclusion lists. -In particular, you cannot use the question mark **?** wilcard, and the asterisk **\*** wildcard can only be used at the end of a complete path. You can still use environment variables (such as %APPDATA%) as wildcards when defining items in the process exclusion list. +In particular, you cannot use the question mark **?** wilcard, and the asterisk **\*** wildcard can only be used at the end of a complete path. You can still use environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list. The following table describes how the wildcards can be used in the process exclusion list: Wildcard | Use | Example use | Example matches ---|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\*
|
  • Any file opened by C:\MyData\file.exe
+**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\\*
|
  • Any file opened by *C:\MyData\file.exe*
**?** (question mark) | Not available | \- | \- -Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
  • %APPDATA%\Data\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
  • Any file opened by C:\Users\username\AppData\Roaming\Data\file.exe
+Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
From 113750b8e36a7ffa1b71474ca8594cebe16bea70 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Thu, 30 Mar 2017 14:36:10 -0700 Subject: [PATCH 121/165] adding content for auto assign subscriptions --- .../windows/images/mcee-auto-assign-bd.png | Bin 0 -> 62346 bytes .../images/mcee-auto-assign-legacy.png | Bin 0 -> 34151 bytes education/windows/school-get-minecraft.md | 32 ++++++++++++++++-- 3 files changed, 29 insertions(+), 3 deletions(-) create mode 100644 education/windows/images/mcee-auto-assign-bd.png create mode 100644 education/windows/images/mcee-auto-assign-legacy.png diff --git a/education/windows/images/mcee-auto-assign-bd.png b/education/windows/images/mcee-auto-assign-bd.png new file mode 100644 index 0000000000000000000000000000000000000000..b14990583f53d67dfcfe6c8da3543330becaa190 GIT binary patch literal 62346 zcmX`SV|ZlE*Ty^X#1l?zTN8GYiEU?MO~UoLH8C==IYF7^>Uso?ug#B7@B&Ck>+9Oy?Y&LP|tzD4wwRlOeNNAtZL?fyme6k7cH@@{5mip`DNahd<$vRHME zI$g=)slobx4c9F*W9oA=)69RQSpMsV+md~UsQq69XKp0(%8J>!hu__ z3OPGM{JkfSI3^yiHLGSEZY@C6^|o!~xz^(2rZ=JP>&l|=X5+HOj=F(AW&Xspt!R~U zp<>V58-OJCyQr8L;h+46|AO)LzXg6oie69hTyCXrz7^Fd07B;@G9#Ky$yRyUoh*(< z_v^M2CCO_q{ui(O=wh(5zi>E(!nZ9~L9fL5E30HC>;@9Ya~LW{?;yM9V;3y} z_qeR)f2$Tg+jgz}5TVZ=UUJKQ0VVl~C*t)%lo}WMq?qCQHa7B+_cLPFoZcS*tBv;3 z!Ivjj@MzDj8`>^Ej!h4x{i7a^91Ba!?IHdT<}A+#jcbE=JtnHGVpcw>$Kjx;Yv<0c zaF-@O;ap$XE{w%y$rfD0zD2<$RloZ_Z@z`Hdwz_1z9eHXqhvIil={or||P%_6QhuP!EsQsuJzo?6A-8}_AAU)n@eOPFR~ z194=?a16saF`JiuGJ=iP$oWX^Up;th%xhN2ct|{E^Ik>0kX#YIg_cQfA6Z^d1V?Ricu*X3Q$%~vZD93RV{Z=Zb~69`({ux}Gx_ltU~ zEy1+udlLJYwyy`CMqy`Mb)PNX(@P8pg##!3f#Flzv&$&$uiJ;ihd0ABV2O-0$RoHt zL6h4yM5)qgI1J@|fvi)VAzfFM)g;1oY8$Tv8(nW)iMxU%iK4A}?FK;p`-h;RuhuR& z=U-v`uBS?S@au>HlvsnGA6-vVHfO^M{Y~swAIP6r*4mxEY0K;N$|%+Rez%lUc}ePh zf5U0D5k3DmGvXoT`n}H=y%4)z|81Ar4l+18QlQ_}^q^}yUqA@q_Zo$|K8Xz(CSlubH7x4tGy;UDEvKg~#}{8aIRCk! z>oM=^RZdr<1e_y1nVpAc=HKzYW8OD}SDPP;pK@=(ggT1~fE581&r@x=@ouB@XKML$TL6}yv)a^26q`~X3jPr?Of{i|>%~e|qZs=Cgv+P>@ z$#Y=o>(JRT`8O?{NR-EUH$q?vSwM4|^tu0=`6hQ~Gqr{2{-v-Vd-|{fQizM}v@M)w zeU~0dgZy2c{LzzU_q&X5g_m2Y)$O7C(Hp%(YSp{L$M#PrjO|g6A7>B=Bmb_+E^-C! z{!V3xwkr3Yyuj(WzB?+%D`>gbMAp_~w^Wedq?on1pF%@ZL~r+xQxUAaAcX&e((*V! zU2A~#Vu|4xUd2h{3)&shQkPM;^|1Rv`1$nu^s$;8JKlhM(gEO3?~4p)>r%K;QmSdAXCU!yV|n@s8EhO(lzuEn2H3%F+}Rn1`$Td9pa|;sTXjU0`eEmN9B$ zXnxG_@$_|X%}66sPIZQTKB;v@&Q2b-WMAuBnV~L-A{K%u_}Z?&b-n!b!p@Qe_kIfY z_K~xquaOGwdRFt!j7U>E8+xYA-d%&VOR?GPRWl#SdCSLB zVW@mBT0Tws9i57I%dL&Z?7TYLKg!b~qJ2TEe`O8+x+emVIG_iMw(dD=)5r5-CUXxS z4Ex1&aL%5NqdyTgU$Ad=s1;8>1 z`M1v;9dJ911bu>I=SX=>~`?Kc(%Vj^FF~8|G>c#pza83{_MN# z@xH^}Q@z;Ul{;j{y3UszG`D2+mCS5sO8Z?=#h_Z^vVda~1LOVy!aHx~oFDeBVHDO$fhm>N(%MYV$nY&xCg-BP(C&(OPSg&7 z8D6!BfeA+4@O*u3@i0eWwg1cXiz`gjBo*Nk1}lRXNp3yNj@UQ5^Ha%UKoX1KYWL%O zbq|FvCp6qO{ePf>hi+j#nZf0+`+2Xc#^rVeFSA7aM@I*963e?x?4M~&WQIjG(mrT^ zq7v2XjwqTIm;CK|9e^1R^SUSE?{#m0*Q|QW$-)Ke?u2%2fPo0F5|6-SoibpS-?K_7 zyX~rl1d?=RLBL1|C$}XP=S20Lx)dSC7;wMz^a1_~(0y;z9lYxg;Y=KPCeaCILcqBH z2zToch}`{AjBYtgr^mmgXE?~G^wKo5vSDCjfu9XJSJ9A}OChR42= zp@}_UfmG-b8WDlPN;$Q?){5Ql>|9fqq}*6$DY&Xr#lA)HzAYXCkYZ^Ggu4kP!6r1F z{Vl7~s@%Wu!g8^p`#Y$qR+1oR?6}XyCCr`Qa_1swY_7m&oU~|_ExF84<&`O;k zMWs4cqKLbQqoPdjBt4Ne$a*+M+-XNh==DTUwZ7S3{kGs87Ct0)^?Z2C>3U55w$r?s zBWuhDcJe=D!LgwtSXXR|TFyaqO2^R6bTs7E=<(39KBHsXa$Dp-JDO2YVFIv(2=e&{ zK9dWR2&}bvL8O*J&0AnP;q2wp-U6p{xLMfYyom&%0}#+>PDXJIQlTk^D2F`}Nq@i* ziEd!fAuZ9XB!p>LoLTh!#Ll&ZH8dfK7TyVk zj_U~05%fL0U^X>1DNyX5<^YJha7UhSP=E1@j+Eo#;pMy;uVw4{3|aNP98lzqM3neP zM%>@sv9*6NVgEvA;R#RKq|xKV>-m8#UOgA(LI*|JXq>N^yDX28YC*8<;5$mI&(juV zQHn&^xcqX!aI=py{}&?^vQeTBE_+cV9_c2)aIZ-b-=c{-u9OUupepCHuH`G&>@wM= z5Ul5F<-g8vE_Y{I-h8J)e9~6!xBEpFb}qCzz5faJEcf9U{EvbDdrY$sDb-DDT!}-e zx=-J3VB*Pq&9Z(e<_H>uNfaJseu5B9DurCJpB4k-g&BfK5EI)ELE>~_x>#aQ6a*wl z6jIV;>BB8@QVte$0S4^iJF*I=pLh?@cF%CoK|v!+pnlUXgVuG@^;4Y8K%522J7mT6 zo28WvfzXptx5`FT#Z(gL;NWeN-5RvWJZXaXRecfSOu>mA;efqfBaq^?cG(|EfQ5BE z*VcWDLjF0!?3$iS0z&&(6y!+3a6G*GIu-iOaB@PZe`5Q3Y%Oy@DgNy;dY(d=P$mU* zAL*5QW`kTkTPzhR8`JmVM#&&PS=pSxl|@O>S;<#kv5gEBmr++5CSjee-@~*g{jW}X zHX(o`gdI>*t}pS8H11NN<;aCC2k?J<;??tTP*XL7AC~LBn_aaN-*~ZTx|EOG{)Qa; z{-o=C7nWsmW_0l1ha{2E9U;GcS0x*{=IX_KP8B^cwci84$ zj(ia=p{K|5mGC-k_*nD{n#(+B_gl7==j>(c+5d?ERyX|UM>YqK$NelINUv1wp-5Ca zgJ<8qdPSRg@M@Qg;V{Se8lTTYc8RW1PA)1-S@&2e`{iyR&Z&YB`k@`$7zq4cUth0n zE&3e!x%-L8amlA_n5jQynVS_3pWm|)yLhUiM6_c8IUtom$Qoh%c)i~ne@5#G;N7wf zwPrio9Sio4Xtl8Jd_T9|CH&~~F8N}!Awy43{L9YQi~LQ;-k+D{c)SmWM@W}A__(zlCI6FyDBbbbe7rg@8vWa@4$W4j zwg0P=L;gTEnoii|pc0{ zmKvIswRL#){NuGtceQ&)Mh1E{;4RNKCFtTxR{Mb%0Z-RqpONHNVEHT5cmyx;Lww`i z92^&cow+>1Kt}Ayq1_JNr2h#agsj5HFO7C(Z+f(}zdu(WEqT^h3!_Gp=m21MVX4Ng z)na6g`)`z&^Y^w)0FlL`Ct`tLR03rixjvC_*}GHwb`=@?+fGzl;mv0QwYi3~e5dt4 zpW;#12HzTkbb4L|R)4PXX+DLsq@2I|U2Z7))9k$vKt`u^MQ0;kNqIcq>U#nRJg}>0 zuB9@wy+58A`zEL`UET#EA`toxorqG0d#%b1Jk4Po%aGM##umzGP6YI?R}Wi;R)0zr zZEuN|sQt+IFOol)TBB-fuxzjqQs_8oEThUM9xZk#gMD|QzefJ5ZSO79dJ_ z{RYpNhoal-pGXyz$rmo@_EU|&i#$TxohLK|6*E0Yng$1vJtAx-;r9GzXRL%YLVyC} ze#~Tn0?l5G3jg==qlS>FmzGS`Gtp-Ga{Do6Th9cC^W93j^>qDoG=VOddBxmki9B{L zWB;@_J}>s#*49vAlH9=;PKzr}Hg@&}4hIt#BOx)jp`z$*P$(CAyaL(mTTch<$@IS# zTSI~#Uwwpt_hIrlASds4$oCTYm75jr*#S=-`1%zTgqC3@qZ(W}lFW%Oy&rbDYFtO| z;;FMlhsX&Ifd%(e)6^ak)Q4!EALc?s+bM5ViJ?$7dp2|_!X7WE^?r3MVDm$W!}%EF z?eKHp6G`Zp=cyi znt%21!9&rcL(zE&>pjJU-U#7+(W%R%KxI4iqBiynFFbxbNS)-&_H*roksnCN$i&&w zVeRbAKjVc^j11F<=L1~H{9EB^?*n^62ur0^JyiHQ@dr*`iWE!vyeN92F|V-Zza|YX zrG}c5&pzL>y!nDujJ_Xld^?qc7`ak zh(sy}_aQBnM$HSN>?1iEeE0b{a%uQi=`bi7?B-kn#IUN@}3)8EW0enS-td{E~)Jb?u>x(jgKF@3TqUT z!xgAsChnWThYQg888^cA2H{_lBuR#N!$}8>+0M-1@*C0Tcl8(HJeLjdkXx8IY&(qq zqaK2}9gPrkC^fir-ZMV_y)hOl%jUZ*Oig2BpkQB={Zxh!(T;z3d)9R=*wZi*cjnnL zG|I!Y)5Ty-A_;`obiEfF%JA&RHe=`F$oFMS)jiGKoYvSQhhmO>V;r3@5dJXIr9*cC|@gGAH?4))rA|NJd{yJ!f7xHI!CVe{iA zVkq6vaA&Ak*yavz{>%K?gm-p?kbMu%ux9E$9o(I%e%2LR;hkrLb%jRBP4QxnFy2=% zOUug&hA?2Rifm6ZGBQ0Hw0ic25F^rI2oeOfnN&B0IK8<Lklm^s*CIj zRTr0RqJ@G4;m+Us@^{&$-A9O)m;lTWgs!fkMt%rpe(jBbY3^!l5_u zT-yk4$mr$~Ms4({@I-49h#3vSPi$*&1)faMvjWc!GdOW~+?d0I9}jBV8+=}of7Z0u z`Kkl_wMe20VUTNT8Uir#@L9lD|Jd4=S>JC%09Q3Nr0pDSr~Iw5PMaRNMS z2><-E(0V|wlFLGn2Vjy~S4d`A#lFa9P|!&1&0;5*8Lh3cm-XT7T$5P9oEE{n(HOtII(AUH5WjJ zK}ujLl!4%N4&O#x{8dCbwQ4%J-0rA4?<=iK@pzv){VdqS2L?o>rKLk~U!D-Kqf5^w zMjpzFm6FAx@KA~uxUt*%T25z8>cb^x*Rmoi?E1hkN-9cck;>Ww+kKZ)HPClfmxvex z_8)kd!qXLiH4}&Rqmc}IkxQmqmLO9fiu~o0MZMgc3S~luOx!su%EuA~wBqrWEW{hW zB_92$KuSmvoTWxpP+GmxAMBphaUN6tVunf(rYs3V_$dvJ?^vUHX%%~|j7Mdqfa9T? z`co558SM$?cqV5!N7uaydh^9@W_Ek<{CWj&)vh%lZsFoJU{+NtOOf#3It_q_f+2f# z+^RlDOW{JYQPUJvAd3J8kXzO*5ubrpk7o4Uc^F>0Mlg=jQ1&$#Q7!Uj314=!cnwe3 zOk`7!7ind~tdQhEN##t=QS3h=(>1$Vs$DFV>f|~;Z{Fm~Fn5saoxTTW$flJuJm}=* zLR_Kq$=2nusIl^@ii#xMELt6V-Ej%Nqj^2539-|%`gvmHAgMf+R)eEUx5T*;@|53h zf%iZ9@v=f(pF^_ZXLkzwDXt?M{O~{NbCl16G&kKS=m}tP8M1+>Uj%X3{SOW0U>?{U z&NBZ;iT|Y=4A1EQ&xR#;X*2goxs(m;}x8AvY@8~MFyW9G@ zQX!Ug$Nj?pOL6O)@7fAmb3W-D);n*{w`LXi8I!C1Q&qf3Hm`|h#(O8^38%B9KjPj` z0m?Ljn9HhZ%QCD4LRY4_MU4FF-Dh6{Us#B>xfOxR zq4aaMmm~_0XXTdtWGunJGI6=wNwQ5=Qh4Py)tsctRq*Fs*{jb{iN&R&3)aq0Vua`j z8)^MAP7wD)$h*@sCIT07RSBy!Zh<{5Z%SA2E~Q*4Gt^DZrxE21W(L1AX4iA}+mM-7 zG^N$i3(yyrUtwIYK25kyYucH*G@9+%ub5)^Sg~b!0*wuY8toT^chZKRsYK?0aS~HfC!>^Zs*S;q z$@VYe`soa%^6liMW~Oo-Ya+l2wr8f6$1FC-Vp!iocKCE)@5%>f&X7OoBK%R#J4wJ( zaAO&eWW!0S9P0S-NHlra9g(Fr`$O75W5^Jr=|4}nBibhDGiVaOso zcQi(*m3XA!G}=(pHcOlm+5VsLgxYO%bBJLT4|9i?iC8NyGcz0x(I_1kEHaZ3kZE9~ zK=JrF?!ZSsim_9Mmj)vNJdT?PQmDGaamvUe^uU_w^W*G{ifCmz zL*}V8Z9Ty6ZxioYj!cPuZQK){#poBKf~K345LlqS%)56mD*q`cHQ_o6s3}nES35+y z+?OzwoV8R^RCI)DHWxdcLY+VNccR@VE^z~o;X=z&{Lqx+_GBbz3NXyX4%z4n|5!nt z^_+jn0(ZD+TRk>|XwS(JKi~{PIS2_ePEkZ1GNC4^C@_-j2HPcAMiUzxPA=W_#3Vy7 zV&_C|o4R1wRKZgdmpY6)VP0}RNydhxx?fIa9-IaipQNN>KE$V2i4+_?za&p}mlidR zASg+Sv3R&)hrSa$j22s2yiT(wRd<^sc|7^XZdlyCmo7dQQW~|y!gGEvWCh0!Qvr9^ zMgk;Jmdxx)Sa8HlDrt<8G~?CgkczGmh@KT9pT({?7Z`FkH!@5n_UIS03xI1pDW=qH z7%(Lc@eU3YVs;on^;XGYZHRXLcmsHBtZ3l;l4HCsgN-VGGilRM_fIG)l9MB`qx!M=#H&EC(V(_vw6~3va@6hPak5yz%j4&Q97##y8iDgfM zlW0Gponh9F>&GZmKjioOqZ}WJmm%O!$;`TFk4XQFkDJV<%TLj?&X0htZHOv9I#y4r z@{|t2EUKfC69)c4hTz5K-iWbkxmo_}(oz?i7HWQ@=LnTOu~{q+#qW7Jq^_-z%LGr; z>j4oV$|9}o$wmB2+djP^lPZ>F35A)=YjtbfU3%AitEDL^RDaKrG{|?TkS%laTDGm~3TFx&#hp%2x@GMT5HXx) z24>V??Yg6tvm7Y7xG9FQ$;F3q?~=x*%BFJfZHGA~#Li{WnfiB*&y^Ve;2yzl&d+qo zGZ@_DS9tFA5x<{qq>k6%BVqn#T5y17Bu&aP#uzWFO5I$k{opfW#UtE=@r z?P0)hncNRh83?j_6UVaiF7SJsJD(jR5Q3Ctbdji>wM_=JlT#%H_E9w}>DokaK@PD+ ztIp`#E#qkViHt%U$9SMT(awzK)Plobh~U+1UTCQK^ygc^rtm7?@z)F#hY%nbe%k?i zJtvI=b(2+FNgX)K*`k(MF=Bl6pNhy_G$Q~30PnkQ2U=4cM zb1-s{CR=W_#8HZ#@RVO%iGI2?(X341gTjV@faib(%lrx@jdE-iTJ;d5G2Y^+C%C2E zH((>Y+jVf%%y=y23V zaDj|DxOhk{t=zGun~JXO9W1|y4`+Hsc};95NY5atD>bU<7#+mPh+whi2z}YCi#3o9 z%(mIZpIa0f+eI53Qjbt9^W(tM+KE)0Q(X98f&6H#jVc>NnY9UZFyhIH`Jr-~Ker~EcW()+ynL-(V&m!)SAj!p8Oge~} z9q(7xhC=|Kpn@r2TNee!xSD_<*gD*22;3Zpl7Ad$1RKjl?sn=|eTD~XF{UE<_08t@ zNb7RMJtU*@qT_|-+A9SvaO{>WNaSwsY_B~*PU7x89y`Q=~H&z?aYz>AQid{GA zzDRM}->}IN{PSTQikfjl@;+vKH;zDzCXF|oy86+4C*fD#p*Bz5asDmg)?u`IKmNv< ztQBFQ_?WEhMacUo)F`EpKkTC8NI|ct8qITt3A7(m2D<&l?Zqld=q{v{ zPitJOp;R@~n28Zzoy=TNvQ%t&bCQ+|Uyi~`&^LUEW6cmj3n%WUDF3@Za{N7SKHkx@ ztr)55`!5mqQ6Yo%GP*y6q{4hcso;Zvu;kJl?QC%j3p6ekXi0G?1w$E9fnyS&swk}t z9eE##6nu$7CMHV4ewrXORRlYGUxI525QE542gU)@MQi?Sp>cfF1C)PASY%3>*QwePwGfcldG)85p$NK;EpQKOrt;dB?B%XUbwyEETmz>{GVvKsnG{vfD+E zc~$Aa1vzaA1#)Tl)Go>yL9t3Ug(lJdIEf^s5KJ@m$vJq3{gUT2SL%(}C!j*_Bqik!RwZ#JU~gYXz))j>Rt)D>Ioe)6_s`H8i8F4l%WoFRiNnraUh8BmRmvT zfob?m%tNyw+4zBVv;oL?M`BH3_+K5s{N z(zKEN(oeH8dJyao;wE0k_$rWmnae{T)27L=eDn^5FO?!Ee01~YP zeW$3*Uw@Oo4OVb=Q?a|RIYk#8A!C^P_RDb8um^6&vk1W^03=}?vaD(96#Se~Ed8Wl zjsfMLhl_V?&B@S1CR#}K8Ff~J)Fr`5RdGHzIV$OtLo*cNFvcpyQC&aTwmV87+QJ%9 z(etlch}HIpK!_$c(ULghvnvv-U6$um;rNh2Zxbv=oe7ijCq%4;{bIl6f~um$0`$e4 z&g5D4T#DIPv31P*nMRpLL?sbvi+2*h8YB|PO0bIqi7+%l-4}3iN_VyzK{pY?y)ObS z93j^_c~x6?6vu(-+?;gcyclx^4dQ{sD*;=jp=mmig_R=ehDX1p@w=#HXzA$&ps49O zP?T4+WEX=mcA7Y3<^=Sc9%5saQ^@ZHEsxTcPFUSzWM#zi0;9%_vP|*@z)ma884Xfr z1c;hDN*NlZWkjcm^Q@0LiH7k@VRt9bjsK3Z;4Op@5A8?E{SXaWB%xDpa{!~al3qk2 z%k&vt4NtqlVJoNoqf0_u4Jq=cbX%vSRU4;I9VT*5+V4)F)srp1BDi1v_82jIytol= zq0~Q#;RNKzRPI+@sd-ES+B2UP#8HcEh6LrLnNZ1Xm-eXs1`|vFO2%5{U9h|?5AqFD zcAB0-#JmrsXRvwh9fS}KMNGL1*F^Dy9F(zY{+McWX)K~C*GM5>sJoJTZm}zyyoKOhS-)4_*zw&WI92k zgOx0p(<8f0gYi~!b|;wg*Yy|AZwm>SZ3$P z;ZAl`2hKlVCp*fgG@foZ-{fDFnf%=hHCz>WB(@*p)ADX5z!_r&= z0j5tet}MdF^Gv=lIJPTM;0DvCRuO`dZD~cu1$RZhO2!eu8xS3ik%pILf)k<+bv7m$ z;~10hT8@~%YNRSl)(C)9}CY$26R zc~k^sW=0H-m;mRRFlr3K{e=z(Re)xTegg$6k!MgcvJ7e=!81{uDIrDM95~rQRcs|G zyKh^{Y?MR^Jx4q{>n}Y&rAicc=9b+FW0=Xx$Sjc^gFY@*rJ>rp87^WiDHCZ7A%CVN z`bAdSex!;Xs2F&sg0d;2|JVNKvISDB7WA<+=CfjBs#tjwj(IQEqEIQJzYv`1*ag35 z)cbpzK=rfD@t6;#&fg0nmd2i8HVj2Q5b2PyTg1_^?=`7d6cPH1U5D0lxZgwflM{WV zcd0!ZXl*ca#gVc+w8)jLC}U%#(637fdPir?Z`qeSX-5@whA8cJ+S>wYiAgq+g8+q7 zq6Cm&+cPCft?#}72WP{OjIqT-05R=ASQIcNhvb^r_Z~j>QFOo-%Qjj6G7(BZSP#wR zcA7QH8Ky#P9Uu33}T)V*&-bOh8R zwH)wi_B{_k#C4^~4ogQ^M9Figj*NiQXmCj~u|Vqn3$p{-L(){LO`&LIvV>?Bv*UpK zw+f@%&1m9`$Rat@2(=gHgb>iNv=P>4=4j{w3bv>c-l&sl_W@wY^rL0}Q$idM#mW<|*A+2G6@5X=A*q8eyKhyIor@g(Ys z@nur@YZtTldela7WB0)|Zcbkjogv{WhN6@7<(DMg49}erv#`Ncj|EMvlX(zuv?Hxp z^ZZ#Vl_ycL z>P;qpjPAGr4tjSnDOW~Q26i|f<@=9*m)Fh4`(B3d#og;mOWp2Yt8zvJSk<%W4eEIs z_A16$G2^p2ag~nmCYdO2$87_dELI}rRQFd7eO5(5um67S@qo7B1&SxTJyKm5v0SBD zB5c7zsf(LM>3W(Ki*FUD{^ScVOJpeqREShs4cLK12ZseWAm!=Q6^KrMtdsl4)$|_c zR_wuc{SaP)%sHlxXfdEgX>#Y{xLLQ82TGiuMt zUQw|cQ(QAATW18aBd5h?qFpE<(BexzCE9%^lH9<>=0J|zz9zvIVi_dugbvDRU{1K) zW}i2o3%bXPsZ`{i|MZ#-gR5*-LN9uI1oDiMO-56>co5ud&?xga`peHhfvPLB$gP_L z3<4>>8R4;%qL1#O%%2*s>8cMsoZuv>HP<$32V^_MSo$T>m==rD@5R}?fMa22_a7ZG z`QbGlK>v{g4mtNlnc8e;|Q%3gGE zj#89m%%123X+-W6?*Dc$O{y2Bnzd>TUR*E$2#|ZXZ5F2zKhv`>c95-1VhR!QV0pH4 zQ=QP1qiNwa-kud<^VvF_6aWf2EI`ths1bl`3|sd#qX_FNT;+NKe^QwqkEU>)x=^0D zzm^Xjo27H?V5xRm?#+FGU7*Q{k)AnQ{JT-B57qv&L$lzyg}|_>P#}^8UyCa~BYQxP z1&CgmFPmv+&ZR%UMeLK{L=4}1z~6deyLQ_45vLrm`j z`!`4Z0QEDA#Q**o6I=eK7q1}reVO~XX2#1TU$xjND(3Krk~Epzt5BLnx!b49x3V2d zzYN#ADs*#3g)x4+@MVuWyG|R_{1%3??~3dm2h#56R3*i(!WG%he>vQE(nu9q)oQV>pGl;x)~M(qQl$7)z)xp)o|hGSOv;YN7vR0u%JV& z$fi|joY#QDhcUto{$*MrPbgW`)G!m1o;bxfi!EgRjXw)ix#3C^Mwc&7&?je9$6}aO zqFz)OEd*-&Bx?P&n|3L0>58>g)q|ttm9+wQuRaJp`Tr?JmVWdX2L}PQr;zNb9wQW6jXeVpi2)96eo#09{5sWJ;~@~PIJV0v^O=}*7D>#Q zd5E@iL{bn0_zN!2DTJ)VxTqs=ozA?WB$h|8UHC&{T3CcOdS3M*g%0?|K&F3k^{!4h zS{`LVO}&!&SD2BqeO4@ag>6h$7Ho0||A2br`J$rs7BDfS~-f^gT9qo3YD%WcnJ? z?_BL`e~*|w?GK%5mC{LU7G;K~ z4x@|^>Z;{Z%ij8F=zGs=0ZGYv`S2PTl{|S($&MTSwMCJ-Zwyyr$GEuDpm zC`id-Tu?$U17fHpR$Q~?38#XYFPeP@!SSP8$)$@+-Q2((0gUa_5+^vGk}5>_(;QFf zwg!J)jZ%Hn(n`*01T&%_*(Qj#VghIaZ&*22mrueHD5Tb9P2K==5cawfVoab!#}k2e zvQqNu>gtYm@=pe>Be#XWC5g&|D~)GKtCIv!Q9)51%SwsVjLzmY|nF-F9YRnUum^Yz!B&=?+Ek; zW1H{#!xvj*X=wf@F{b@|g(;Ul(o}OTMi%WGJYhGwW%5@kRXoQL*eTUtk5JR3iRq&W zF&?k|=@x%ts+N+M{^6AQTImU&dGZ%DSDq2nvG-Vh`4_GsHrV*+0T13ypiPifg&P>; zhxBgx8^-k@S>o zD-*|l(9mJG_>%8&3z+ZH!vB+BF zpXf=)??@sVV@J;EJVpUx)y9hH=VP#lg-co&1S@Ua)6~md?^)o|%nAW;R8@v4`xg;9 z`)+;PX0NTn$TCZ)ra#%8-rp}#M1+)(VYsPHX)P|N?f?qWRccq6PD2!HSVW{loIHmE zXIE2Ev8S+^PB&S+;uuG1x{`Z2vPmQWzY%~;5n8oG18~=om^Ec26_q~CD9P&^Di9jM z1H%LmssA;;m3E!&#(;<+I`{^cG;pqJ!83tTTkLbXPBT+*R8%*RGHYtmlzx^K<4GPZ|`XWFP|sgeJ^6;mqWW3&UoXq$*%hLyR12A2a8aW?|+r(4={wd~Jto z_)$=k_QOQB*Ld zIGDoK(9Uun_RxNw!5B8~bxtp7%pY+@<9A0IVBu0X`K1+b+Rh3an8QKAphJ5P<~ms7Gn^;4CGq?3 zGUmCbw0ZAA%&ob;v5TcZl;gsJ4jR6gFdJzF45cZEb`P*Vj9_Aiu|{o z-;55&KWS zBb0~C`BrsyI6|AM5vnWsUyc$I_M1}@4ld6w(IVK2h4yM=Q4X1_g?ZfIT!=9?9*|TM zEAUqw@olK4MoAHlL|4&Pr-YxzjerD9;_^z!q)|frZCFi!i83Nq97a&Wf^;(EuTCP( zqaFIV$aoZJ1%VaCA#`hZeF|jUO5Z-Zg5RO1bH*o#9a4PMXDZ(Go?Q;=oYLB_Ljp~} zuA7eStHuY!bweK}r-u9p(cHOc-D@(PTjA&Nh*0r4FN)&{!t3XGRX|l}tqet3a#lh% z)xT6Z@<>LqhU|o7Oc>HxL($-8^EtWwQOD$F{pyy%xn7d0530P~@D{-giQ(a{q#Q{* zeViG=W{R(Lt&|59%M@b9rx6))o0A&|WxJ`|i<3?GL(QRK2e5<{j7wfsa4#4ZR2;~b zQpk*tZqkM%h`{T_1hy$#n*M zzg~WRe^hIFQt>F-;*fcq!9JfTLgIg!F(uq;XY2k2GhZ}#;6qCi9ac0;a4eBqX+fO_ z6*+yaE=&HaY;4G!&#mE(f{J0x0lXMiasS^)8Pfv_IfMNKGM_y|zP3N=Tva|+c~OCB z!Fz-UD@!tu7L_BfM@KZqAVuu46u2iL7ZJhj!=uqrziBeV)5&6IkXjZ$mg>RhU}a6_`S~0yplU8_I3- z<@QA;hO(qcf0Jr00r|3lgootUPJR)J_@DawQZosGH>y-x?kfo9$rNWzasxK`h%FU{ zj4WS{VBk_Tv_Pt{s2u8qooOv2YU?BP7_7!GqEp~*qdK?2uqzv1yc4~2z%M>}qt2pL zgfbnGej~qL7Vt`f{D2kr7zM$gRM@%Xywp~wqe65y9HK=-{`*;@$Am)@54`{R$%4E& zhYv(|B*j@^o9W}z^pQ2$L+}qCi~GaF-%U(R`g!`fefOK3otT-}{aM9|x3|=?zJr*( z9|?9+S#;b!z^ghwFqOv#pfhR?=9aY9yQfFOZ9sKP5_>i`OPo%o=Lk_d;|YYx zoB#aWAK7h=6Q!^S9*7bd4U=!BBX$P&&A&&=8JdkpSGqtC$!7g_bw&(T$Jq|mhzMw} z;atbU!5xU_1{)jX)|e#GoJ#3BjmvFvnfe#%7JtM9-f_7`@sM69)0yt4gA__&`$L7- zGM&tbqKh#rH%_J%Q#U~RXX&<+*iRwrG2g$U@CGnoa`#u?NsX`o+Xc+@fec0wI zkBBJ(DbNS<_yWWX7?mw;?jTEa`}p{>R^*d?3?%h zFsIM!rRrlEj9jA4%!xRzjMcs#iXiQe|07(n14mkHTf#?>k2$_Irt$Jy*j_YXr#DHAF0&;#q4{9!?)2h4A%;LchIWnlE{O zPbi8duH?$r?xd$XwN)$BQ zP9V-k2gr;_AI=FYOW=oQhiY-;iNu$T!Q-d#Q9Kv#nm#wSyv!M;6^xel6IJzcNT5xN zd=F~*xS}8>FT8x5UK~}8(52;wCiRdYN?n5T#_ynE;2B<-sIJ6z^`ICQZn-4Xv3VgBydSSrC`B48WHH(xMS_kc@gX@!*c{#_Gzn zl;q4!Bbbe%#{UAZ4cG(So2^Kb#`W|Zz=z~AQ8wM!{7Z{O@mn3>W{!|(=F{|Q1J;jw zyQi5*1ian15mtgjGpSS;oNV9jY@a&bphi6XR(hlzr*hhgcWjk$R0Bw37e3DYnzT0| zT%_q0K9`EvM~&)iI1?BFe@u4>a$&s#Uc}S=b4buOdv8o|^3jw+o-D*E&_I>o-(fs0 zgQ2{&`Gj8cWIX|>a7~5IeWZ$m_SE`_k(L`D{A`r9l z8RTGapIpIqTdwe+m8&IMR`<7}A!wD0cwdvFCK-hFtfiq?&>vh{xXsY@-paGE?_)ra ztJAU$l{@tTQz=nx%ceuyY7?xA@uHi#+rw;OZy7J$67+nzd>;bs`$0SD(`dIw0REe+ z4u*+wY5PCIcP!@vj_aLfZ&)S68%OZcaW@QSMsJ^2T2sJhq_tkRM(>0izgQnn*iRik z#tR|S#N0h|ZENF{tA{o#G5I}XE>G^h{|BW&TE9G}0*)_!{t-UCv4DwVCvjwU0-;b? zco9Cop9Tv3$sS{VMx$EB-5Xc%(~quVkOpmSSGav4oH%nH$4RGY#(E7)cW>jvPafb~ zfALL>42I12!yZsn_m;6#!s&9;KuA;HdKp(fco)gC8!x=_GD5!nO^3Bowasg* zh017<$GWj}3va#mDeQJPJX|)x>Gt91nF}~JGbuh_W`?cB8~EVbCeA6tUAluI;DmuPYopoyCWg=`YnKl>OJ*9cyH;ZjHAX$GBS@7a2T)(*;QpCCiW z*XV}38@hMic?Xv+U3&b6u8$TT$=FCvkH53=F5XStR%0rJQK|Dv2cdUAhK|4n zvu;$>0g8SRY=h8414EBZAUd+#nVX=xG@fzk}D`xCEz|_3JC2kFDeT|NNihUebrZ@}K`T%nUkcU|Xe;EQqmR}=hJB<$Z6_Q&8wF*=4{~OKmB85?P0v|`l|?g9Y}3F#La~mrjMV- z?3jGKH#O@}uN3g{hd;sRcUJKie(@KY*XV6_2mIvS2E6X}OblV@?vSCoPloQB7#Z0A z*kY!(8}i9be12mQ6SK!LJ3~g9CMe4f?;}@r(0)1suZz6=USYEDWXQ>lS`~})SMcYb zJjC-CFJWv@*;bp)4j;9V-|JB(Y$n)RXc@YhK^qnq7T^w#LE5A2lJsgyILa(wgZ$uLwpE3`+t5{!J z!EP)==_H`ZG1V(rnSY3_jVOl3lv$_K>&M)gGdRLVPUzz@l{!?*MdUJR6ia2|sCALR z*RAro9P;@*YV2*xWf5_nYPE!1HjP}qASMNTO-d_+AFU}D3*t1E%q!$F$mO!AQdr|R z$k4LBS&G5fDmdBt=Ln;YB6Yo# zfRc=y&_few+O|w8Ev^TO?PrBrL1qPLJeg0t8hJBWYR6oTwpE-0U_Sk+J@}d#5F{rL?JGN zCsFJn=0&^aXrI)S^k!ux;x?c(k1v3+@o}k*#t`(8kyF!!Zf>JIwNW}FuFWw|X+p~H z5992GXK`eDOiUCq$pluH*JvM7TT-3aQ$2d(434vrlXUX_FXppIr&3D4E}KC%$9<0{iIjd=q?ScqRWsZZQC_8gKRWsz-65mfHM#>~kNvETCEf79u}2rb zrN&wi-cxJ$3y67tSEcP0QU;XXI;2qDLBG($)MMxFs6fTzL64T)21~E{C1!TEo`j1FS7=;QIAj z@Ogc3heq+r*I&oj2ww^yLqvUP{`0H2cJ&s9$0w*>^EmzN%Xt3fXRtYc71^>Cv5hTk zZSCOPi?8C$*;9x1@hP0cCop^b7>2`c-L9*b^Z4ZB4{(1iiQoE9ew_>^?F(u* zS%wGE#P&LQem}+1`i?kFXLkoM5E(!`R>Cj-%D3RF$8lqR4dX{nVRm9z&DS80<}OyE z6`VM80s~=>FmQLTeS$03Zqad8M~RHV^vU!1+Sk4UTPcOBmp{avhs&@#oHUMs+UG?) zci|*f?_9(8|NS4}?)t8{E_UktdA$DSchQL5L4o$gsS7W`OZ7_A{`~0Ocd$Tm?3LE2 z4zs5&;q_NvK+x+#Ccce(ckiNP@guQz7aKcCswXf!brN6u#_JdidPUvk{?s7PapB$- zynkm0Z@%$5rbi-biXPd-7PS$zxa?MxYZe?m^DJI^ z;UXDXH!9g}d~)Ls8Px`|(RJ)3^J0Q9dEy-2_{wV-40uG}dwh@@ssjQ(A0~!})R-Ro zIdy6Ky96~Xz#XhgvjlbvcXxN;qk_WWFkG$!TrmDQ1RIYM4JtX5QKnA*$l!jaQ3veR z6|ZNOv0T_uV=b5&r@akbJ51Dcgizfpc>f`S!=rR;@u2w-pI*KWi#v!*FFuRO z$x&=9K13o@L}X+XE^8TA-}y0a-`~KAXPzhTX#z)&AH~q_1LoAR{8J`>@qs(`#w$LE2W@DXnri!?5_KcdQ>_ic!MJ~C6 zk3V=HMT?IH?B{UubUamTe!WjiIe2noI86Ob8~aTGYSX1D5PSDW-8Rar*Z1!ahj0Sv9hoPUt|d5 zVkiQ=Poet?^cG0Yu5g-aLD(;yti`Z9U-sWMI;oo=>Ivz=%>NbYW6Wj9CO z*c3wS>8fochy;u29lZDU+t|%n@$3sP;`Avp>_I2yZ(qkovVl{lsm*M8eE!J|3v);uP`b;$1}3 z72$PTXiRwf?H}RJLL6t#UBEf&Co^PR7w_FhzG|g@G!FY7r$G0Hw5@H_9bB@@=@7=w z4D6Kg*^i~AC5(-Y!Q=4=JH@Z9WFse!4gFJ>UncN=lS##%UB<)`nHjmC6*TQuH<+cH z@T}w=Op|e{CpNLZxhrP*j8Zm*?X`9I$7eAz7!W)~0nMdJL~GqTO&VPu7tX)<40#f# zafAl?bI)DENYH`ptr(@3aQl-_VRiX%k-WxZG($g5-qhE=@d9?&*Tw0v)q6MbU|}7n zU;R3sdGr!hTugz{a$*^3u&;^a|`Pfe4Ta2iLC%?Z!)==o>x?6Vi( za~tl)l*&u@BJSBtx7+7>m6(-vqEg`{!L`+4qSZxMPZzd9zRaT_*pWH zN5!K@qMgJU0X{{@5mhk}_fdskr#84ohJF>tpM3+*J#zuajvc4%q4u1a6wmNRMkesm zi_hc2`7>1aV^rshWVkKZh$Z0-4dMiC`{d*ljvYUV6EsO+gQMstsuu8Y{vI|{4Sef6 z-@Uw%Ot?Q@r&!O7`y>^_)Bk|qSA z2dMo>3)gAlyYb)_zW;~+LA)XA-~8);h4261Eo??(+(B^f+GmI+i+K5K-@pahhsVe$ zU3~5(TsSoczvf@4ZNV>o9~>UT-0TrD;FDya&XWhlqn=r@poaPDS5PKH_`)l% z;ViY&QEIRA&peA~E}q5i(mb|f38AxEAg_4tC`~x1pU^g+x%52FpPaz%PLw7v1!Wt) zAUaI+4c%jd*{D~g0CFS~8G8RWPQKW%;l4hNf5zw+RC~R|iFf@5gJR54~ zQz@j|?e!o$>_@3mL^-vEWzypa50f#mir3ebD;2oIg9tS;*m(E=3u{qW{ew7nViFFq zf0TA)FO}QU<@I7>b`HS+&wP2HqaSUrQ=G!Fi0eKZE6Z3T4=U+{i7j+n6i-kID{&@1ZF_$uimHda%~R8G(mob>Xrav9t>Sd0$4yp&uU{p0u}ZW2 zXd;Vvwj{3O37rzOIIj!ol-QpmGpEQn`b0g2ZkrvWM^0jd3~6R<6=kxyA@UH9o;VG! z+bLvhb|+0N+z5KJ$QF28xGZ(e^=HFF_4CrigRf)G&dw0cVq#*H>gzJ@WDLgH%@Oa%QB(boSgC{ah9&(VjN8#IS4h)Qp zAriEap-YP#{^3zf&rTuW;q9S5MaRg{;0WwA8LH%p%C zUl0>VXJN^1h`0K%q1ak@0PpZPhDL^(1GuPX6AI5lql}FV1+NtzEy?)U9AtDUT1Y3z z8@Pdg_dow*{5OB+zrug5(%=8T{ykiOxPcn!tQYGvuny1w-#T0sO-k!KoDKvB0^-IJ zjbAP0ap&Wo;CKGXKgK`$AN~>Edh1=>y!#LZ^1$?a&q$r2Y>`T|u<)QvlZX-W0$+ON zCA{?ND|qqMmvQ#oDFl5^pqfJ>K@$wSpNyqupq0Uo?>gi=VL7ZTS1UkUQBtj3M75HK z-{*zL(bA(4U*k;fuH%n>?|;F6`FH+L_E)Mk>HJyoJY2PyL!|&XT_e;cQbr;+w8~>1EnXXG$8wYS@v0PRwko`&Uo@AN zMwM~V1TpAzqmao_);iT&nH)B^he%8oY2S1{;`c|b_TGbdTa0u_XdO9ye5t_)l#Xa2 z4q7q8>_bDdeT+m4Baat?Pey8VY68JX7`Lz9MIjZ%@^S*BWOE{vVIgunh@{h#sw{wM!P(BJ>ZME~Ufga7+K_4`}Jflr6t|NJ9-c5fT6{Nk_Szx;pvU+~xdv%fBGsu+%hggonMKCUMQISm}% zo5bKn17)FD6oZI%V~|E-`)F;mk{eW4?hG{Q(0-!cVmxP^5@|+?3@U$7ze?U(bCTAi zy0{Mb!H<3jYvefon}6^>;vf8X|1Ey;yKmyP7ufS+8KLhC09V#^2HBIZ#hj`%Ojw#j(qa`PY8D?pFkfPr_jj27|7(W1M;DJaZ zGjvIF`XiW}7(y|&j30mh9a#NAjLuGpQ%xe1mRHU%hdaO%8HKZEMP?_4lKOTLI_hab zEkOevzt)alk(W%ykjR&qEA%S+N7=Y44Q8^ZULg-?XJs8zM~-1)VptiVYgM@IHKcNR z(&r+vhVV{WbyRdI*UKoZ>XP-g6X5l@)w>+|7JD)X8gaVSgTY}7@}(qldF6I_=GUub z#CJE5%;&|}?jo0|S|>R&n!L?yytux*B$LgiNxvHbrw7?s0y`O&QOXwj=$}o+v6i)C z?${A=cO<8WLm_OhZlai@34&6rkXN=%jjQnb{O||e*xq=E5qZ{NA$G9~*fa<7* z7>Z#gL+1@+m`_>nMv>uD?Zg%}r?$;!lSpJzhzz#BU8N%wwfiSimB5MHaR-b6Y&`F^C(d#5Pk7y7*2~Fg*wd^Wt3{L?3UozF2TB8L_MRVH*#gzc9>5y z+l@Rd>oh1viMLr0VMkQSgE$SiyMl4zE z-R&S3qm7>Ud9j(3N8z`Z@!pT`VsLT>Bg1@7ixX8j4Q*kGp#^CzX8GVs~p38#GY!ICb*GG@PXbK6vXg9cxJx$UtOLNu)Cw8ZX%+A+LZ>BTB_M zJuYD!lZh1axhxIhtGIo89)&^{Wilu{I4d{GsJFxuoa9~B@>yhdcf{Rnd@VOg$L{ua zwE2oJJ?P+}!84mqA{md1XsK92jE?nOHcxRIj-EV&RBV^F?LN}9ZG~(G8!L;re(eSs zs5I51As(fO&`7kqx`Lf}T5SL3$^+cFzk)=T#tfSiXU-ghyOG2P?|+C`Txo+ew?Ufr zyVU_V_3=23Lm4WA+h+N}JXUv-;uT*Eeq5khqdaMe+$BUV~BK{2d6I_ zr*@3u)@|Az>L=V@vF#1qyK@%}|0E`dBhCJztXRKB1Y)-H4}*GvB72wy?@%5u_|cDk zgexC^g0-z33`|TS#BW4UaqI34{P3+G;`Yr&xcxqI*OgmB`FSFK8FPU;W+J{rJ0p#B zGL2L!L!Huw0v()5+UYf#{be&r#OR4Ui6(df|V6P#!O+Ab(ho7xW0V&zjt-*aii;K}PhVEBU z`0+!`ZM$(M9l_MP9n%{QOm8}2{e<#e-4*M$~r$)sM42(v-LVY@ghBJWi(IE_s z43nW-#e;hf#o)I~M(Nhot4NXk=0_TaM#m8LT5MUS@=i|n)Kak>Y_6?gmkdXSjMaTIH15a9ixe86gKiGM#hHW;8Tt? zc&;uzL^Qfh9vXR@UMD_#=g)EV_6nws9)sVbY;SY$p}wBj*`j*i$JXW+ZeG8Rt5>dI zeQlFGG%Lo(N5mUa%Gq7qxpSY6?JRb9JMTY$D@5BhIELfLX2>h_!DXxBKJmAsal}dI zy$8$WX$3GjJ%_33ag2)R=D{b}a-DNK(>;Bq>#v%ZG)jV*DkySxEZvOBQ4{j_h6Qe6h%Xq55U<&UtNqA@8J z#hn}1u$8LfrLVq;7?K9byVRd;44Ju!qpcz|>!aqHF{#1cuQcDHfo z)=li>t$6v>m&L0Z8|56Li8LZZ<07ts-+`JbG%(7KWdu5p`-ct_o5uUiPabzCWNA{g zv9TeZq3iZ|frSiPQ#}Xe2gdK+yNBW7VR4sGxAUOldvt57sL{-dZ)u($&~CQ|Zp`1o z(&{=KH0ubD4`F*{g=VQW1gNtNhl0qZb68ovNj^MPtm;6mV8zKx$7x1Oonj}0sSz@c zbbRqMHv^#%k~Ayvg~HV7@)(+V1}{B(mOPOST&06-ej$mo$Hw5EK8KUjW0?Q=hq$%0 zh|s_+&2T;N*y3nZ!dSd}8z){ki+qy23No6z=@Q(*QG{rp77M$`J3}~r{v|v!ZT=mk zZcrW=&tdnl9vD9a{L8g>@RK;TF`-ebBX~89UvgZ;+}Jce`Q&4K@8h>%KQV~shEL*+ z6VHp8{^bup5_iy@IeQi#U%o81i!Y?}n>+sWogcvK_2SLfzkyUdflojA1kXMHJf^0m zu*QQcO_2B$)CwKU{1uAVzw#B)VV9SeX;P6AGwOAcJ9+vvUU}tJ@;Yc%N|T>KI_S5z zw(;SIKgGpMmkCpxeUO)ae}0|@X0LeA znV+wUP{)sxm+|?{Yq&n1K<>FPE)5^YUzvD=44(YZZs!?ek-QH+Ey!Qi;HyrID!*}` zvN-5~(hj34&DM)F*tont*sTqkq>-0Qo^-(H65dm(T&KFxL_(c7@!L1V8%$sqr~X(^ zwNylOeM7vN#6pI6VrGWgBSHpN+@T;)Aa7)CX_W@s90CJFWCW(f8%X%g7Z$qL%h(+7+jX0z~n@(Vj#*jF* zL2!VK_Vgrzq@z|TVQYOA>onPR2L~`me115+1{+N{qd zi_vjXEVj<9a2t7OOdX_&IqwU8RoHHH3v1K|sumZfY5xxdz0`N8U%B0ISjcmxF_ibS zpZXQ+&C$MDTibxe=@XL*8*NRU`jn6Q1n((+drLCDi!~a5)7cV+#wY0*9fyy+eXb>6 z7tGN1@Tp;LBMp4&yI87`x9^6NZ<;y`bUw_wB0z04Ix?ol^k9cfknbmg%W&4^F!_$|8#jGq#>zpf-`F!WexM}=q>9fKz{C1!+Mi+8cG zv_j_Jg&55U&%XRsGI-Ot{{9b;qTN4BJNL$&B{HPjG%KCP^1Zt__S{Lt*0-r4hcH2n zv~qhD8xNQ9+Skt_LG^YFox+Q=<}VZNhL)krJyAnvIJ|WD7whlfT{3js`766woL}(a z>){LJ{YK~@Sj7*2_(KfRjP}hpzbQVS#75)hjq7;j)z=UqnYZ75oBF{JEX`X}$aLv{IF97C*slR7;Qn*Zrv{i}HGwb!ZN-Ne89^oOYZB6%?9CU7w{hu@gu zH=~fD+wXyAlz-GXLF_Y`uihQf&R16QKGxkoLNML`B-7-}x+Q3O+W6{PL8~yCZ_Hy_ zPj%f%hY`)RmiWPO7&;yWqWnj!#238{d*bm{(C-f%ilJ+T9sxWMSsX6$l2Wg;HPc}P zBZIi`+)Mb%YcGhW_iI!nzv=wMk#X_>y$HDcm>C~OI6R0Tx!Yly#SV>3inpoH(yZ?2 z$&2E3K>^Yo2}Nk;MLKAfW3$lgE34e{%MZtTJboHzgYX3gP^Ot`wNgcZ^3_T?Y(-NT z9vZ^f=!6)!$7nVe4pKS8V;CA5rWv6hk--pVj*Vj{Mn*dtqXVwn;n*Ws#nV6%Y_T$i z${yPOkeJwTdwk=~H_0%(A>LZg6CL)t*!|~@!!uPrzt0{Ncb=uiMR973y(Tt9C2_q6 zqI0ol@EjSWU;Fj{2!G`_eiP5X@S-rB+~N3IQjI)-2F-YxYK@vOhK$j%F`PVgiuNJR z%&C0V$)|uvM#;-2FP=LuKN!ur_??Nld`?_XdYL@Tzw(>Eh2QwC-@|&~A*$Zmh9^o~u110Cw^k8XezcqFtkN zI+g1SW?*k`h&(@@^?MA4j!&nAe139)?c$s>KY%(oJU|0c4rN;qCr=#1#OM&h17vVQ zWRV9Vhzt#i(-sz+L!3Vz85}|=7{(A8t}t16alM4x?a7%V7#s-E02qM79vmR`M)HKFuW-vH7g0YEl437{Ek5auy#6TK}gy3+LaDQP1R`(Fj zoH&Z0@of-2pm~kXQhB1+=op;_iffrAagDA)6NJcC0~ak*G-(KnQ;dA`1Mj2gPLzxl zzZwhTE$RH-tm7w7Vu!r-_4RceJ$g*E>-+D$CuEKtKPC(qzkY{3w^L-OxXr$E^_%{QW`JU0mM#R<40KFozCaN_6*;zyRR`6D)`2s8r<3{hQNge68ZNC6HvshOa}1=N5R zmqgmaGRbJh)kIN_AR469I7ek@BBoHXnULP-wo%7?2cbR6lIbwZZR(=HQ;xQ}cc4cB z+Y7(1bty~+kF~vCqdOFjjukr`4v3e!8sO%Oi5}$~x83Q%%+aHmoEpc_;5g2oJ&Dob zknqU7|#vP6CsZ@<)PtG#HyFw=1m z>J?^ryO9iI{Gd1#L$`m}geNsR_{D#uRfa!2EZ%W9J~kjOUOy_d9rw6MgBec;I&Rn~ zIkOFnRD3i;@{tF(BMjX4{^U<^?eovXb4Tnov3FJ@kDfhrHc;%<^C?NDOeQVji3DF* zFEu@XzR`q@5Pzxp+rRJ&_-lXtZ{TnKt-pf850C3NMqb=tm5i!-`?WyFhB^RbT}Hhemq~+}oEap(ra~u5k#2Dj zRvAscB)~yUrfEFQ!YbMgPzx-k4JKN44NBb1fVE`X<(c%x&zwk(RJHPa$%z&knG3X& zoTnEu)A2+|2V-Aok-UEu-lOACPF?oVLi5xmDyTf>Qsl7R z#S$v1g1BMi*3Fy3An-GWg9C%&R3P76!go&c`z7PCxR5L4bHe!XvrxBg^5=e(Pu$1I zSl+#J2mBo?{+3#FYfJf#7a1b<(iX_OWACe6Dv_>T@h!4KCW}lwg|+2n@+RZpZ*Z+r z_`&`ABv%yj_wU`q?(U8#b9-|W4<0-~kqmH&yvOCGMRBTv4*<@;Y)_*8%}MxPo^kTnNn}VD~5oz0^jBK@537(fFps3lp@li6LaA z1TAVtGPHObpBPOep^^+OF7u6HBPj!v7B;4}AoJxkGhR2y^4&YtFW?H8pk6KD z?)AHfXMxw=xP;j15*8L?7#tf!U~m|t&94=xAU*mvmlRWwZ-`pFa}Tj}4aYB>K``Kj zrCP$$-MhH{`9sW|JBJy5v98Yr7r!i6&Bw^aqew?Lkhh1(tM+4hLit`Bqgf`kRdi#Q zy!0$ipP$3>F6|#@LwsW`PG0=vumv7+x5_l{ie(zGyDb=TEBW>HR$%1uUGdA5Z^%nU zRV^rzH$5G+kOwDirvy1a&2bQ?!yxDZ{QArHO}PfuYd+Qhf6i^(XTe&cfls3Vbq!3o zfb9$r_5m&`?rt2I90Hylp^TX|?4&Xno;ZPO&5p|}R9D*0i{#iJ51G`BScw9#l>?3p z0B*yb^VH>$s{s5YgM%vfAO>97B{}Namqvl3A=PVTJ+xi?v`9dm|MT7LxMuu^M>al{7YY?YT9VKJDiIvp^UisPu zn!H$%6OXl#N1G=@M@DHW*+7H_Upw)+SB{YZ;Xyh}1NI^rk`lFrliJWj{0TBP8>t4h zJ8*V{_6f;c-EH6u8JKc~_jv>S3d<-N4K{xK-UT7-~W1E#a%zZL=G}d8`jLg0D21;Z| z_&NR2Fzxd6J*-A!m^t|(4P*{1^UGPNoKnexfWLtv=?#(W8X2MEw99L>;n&G3GIBB6rfD{$MBBt;9m8bkHb@80E0`=Jm zZv)k`1$Sv;!DW(4Oi{hLT!yZzb?A3{q33J|)W0_#n_^Q?bHjH?hHlSOmwax= zjjv3=@#+-pV>H^3K@}ffb%({NOXaT1&S+H2WMFCLzgvJOyNZ&H3{QqUO!AWEZ{0zF z+>_(yjw7?PCcM=&)iXGE8u{fL*jiYGcj_3b@im$(R4{q`C>g#4hDL^Q^xR2|j*Vhu zath%P>C9#D@mrTswns1!h>&sSQ!!Dv><#Ra5nI@@VsIc#1A7U(yA>>7zmDO#2^z!$ zxbw~@sL+0xJ%0`ZWa!h0G?J+jrsqb*R}LP=EFec%Jmk&m=^?(}3gl^^CNY#~1m`1q zD@DeMx+!}%JdD}c@NJS2qxBXI`W6xzBKL*|dNz!)oCPanP+Sh0tdNCDq#L+TX)*GC zm$rcsGI$O$f=kM?=r}?12 z#YuhXHg(+u?GJM3g-6#Q12sk6(^A+K@9qo@OrTb`;l>t~LvlXq5@g>&_E;GFY0|T` zV*%M}43J@JkW7L2WOvES2G+^2o}%(jkWu2d{SVMK3{d^Dd_sci#@oc(@HrV{ep_CJ zj6J_OZPHJkF}3e)YQqOf3*4l0OKsaoz=9KGjQLev+R@pG7-oEPYCmm2 zGoEtll3%sg4(-$>Uut28?6Kc<*@qs+9rol%`zi5Gu+Tv0Aj9IE48t)RfK_|7lgkdr z2=ha5y)q4J*aL5PLcDahl+PeZo?eUw)Lx-oWkq4{2a-z!MsWo!kfepcfY7xhFDcHmb9O>dyvF^Yrv+wU(Ho z%W;Wsp%HFk#EsPMCUN*0reBCRs#J@LozE7EFAwl*y_|GV@wFUhFoc=2Cs9pCaqGb* z%_=D;-&x9rmSt$o6G?uiutA>g$m|JxD3iBcGdiS7 zl*jK8EfVo5OWr=J1`!()CB!^_;mahKg0zw=Z_>h>NM`ll`r8GPz8 zElyqLztB^cGJbpc&y`b`68IHF%B)9aXrSIuBTtlPOXb^1j1}L&K;%3cGzfFoQw~lg zzjBarzhMq7NSUIJ8FDvO;;M*y97S|x3(G4>y!y5C;=PqTILBxZCubO&aq>E14a^OZS4Fm;2k%w#jQCXDEO{Mu zGD1EY$jQctQ+aFvma_aFS>UB{+K*(AK3s2z({>TE98&=@0POKmlaRwslN$bt0Wi*n zlJu}KWe;$Tyt-3l@M!E8`)-iDDfW`syIUsjlE2OR8X2u2%JU(4OCzBMj*?;Bp}K## zVG$l4*)v4T7R*H&7$iA1Xk+BfF?QGQVI>;F^obY9usM+=4|IgQ#yZuXJu5y%zCqg= zty*w)m|x8X+)G(Nb2|)@*L<72-VoJk%tZz(L-i-Vjru~3y7npRBI`-u6Y?fm{t~ra zj`Uw6?{AvglvvoLIG^@p?{SE>e~jNpNpbe*sQJWc*`w4}rs%+y(SwMJ-X*^jkT%Eb z=f}bN*XW))JWYm<2N%ZwN`~&Oo$G2$K}SPJ(7HtN&JG$M6yVASX^;-m08%ERQA9w? zsCFMo5r;Y*dWKvkAmiB~k!RawO9r(IG@!mb3M+Y_nrW56UKD=>Q#N*XGSqD7eyayV zr$e_iuB#eq!YD7tO>~)UYg4D1CgQrVAro!y&L+PZKZjH2W@uZL16|rGX6V>B@XaV}=;S`c*Q`1jx+ZAq zpM84;wR;7Ux1$lG={|V`4w}__i&eP9equq^OhYI4pDI&ba2yUUgVR+IlV8%ypA=yO zWhak}Pw&Yn*=@+V9jH=A)xg`JtsA2jc)mIT8%?3P{>sEB9^Y^Lt&nJ1eKG6jW*3neXQ9(!@!3nfUxw7_U<{%MGE2i#EP!LAOOD zU}lsUd&X7LAi|Q2E=}ckEK6N8T4{PiFNbBc_?;&)8rpSm2Ifi`_t4Q12hGh4R)p_KS&FjT?o4`J|WF?82&+{WnSBt{3+a|#l6cB9zb;%BuS;%)0gk#-p) z^4SdRE`D=1pY+hsKrx?##o>mlM}zrA;At~-1bwhl1Be5Y>QXJ`k;xU2&!pK|Lx>LGI`QJM6#OB6 zRh<(de(fC}2U6YTme9hyZZj?vZ>6^qH94IgU0%ho$>|JZT-L8uuuX;_csl)h$aU+8 z9z^!UzH~f#fh`RNU5BwPI%rcw!lCPaOfb~*sWNoi4{sr74`GT786Vs-Zr-2A=FT=s z8&M2Rj3F{ONP`q#WT$dUIe2KgoTEXMU&3sq0fs*(Qp#pwqhmNvv*`d0mi&2)Qq=)B zN`NPTaz2Yfp^C^*1c_7<R>jSm{`R2CzAy-W)j)3Hh@5bHs7_QL_Ui7Dp}P_exRoDJXvd)$ zI)-$Bu~)jfUBg><8n_w-F3wo+?Nemz0>IjK9e+;zJ4xV$ISal?{81n9V7-nX5PvZX zynf7rub;3Y;sS0h6aOw5LFx+MJV|LstO&cwQ%)oh-Hf7Aw_;>+4B>E4d_$2d5?x-x z#!eDD>ksIF_2Ag4GvX6AOUqG=j11ER!GoixPhc<{Fc^z=533m`8C^?>cx$6&*> z(ktmPu8k0UX&;!$>3D7Bnn4ljRHi^rdOD$V=7XuFTnDYsKJuB1_MqUPb$dc!LpLyN zZs>Td;a3qJ+T#WM=6KHB2^&;cJY6DLpSTN6#@6;a7WtNIcL0rI6d!;386K|3#W(7* z**J=cU2Md6sjO`zqA^shPOLm!MIy0*+Y2jXwsUxR_b!&BS=5s2SW6XXMx90_wt}s6 z4%hE*U^lu=1IH%TSC_GwsEKbb$={25lF%M6D2O+sD5vPY=-?hDFD4SOVld={huoY>p++8G9bPhYVZV(g9d?Y3xG_ZO z{A^Y^TOp5xCo)xCbCO9>kv{*Pl&5}6pfY*W}^%9Pj3vg3P9+<*kC68`~_?O15;uPi%d4%shY>1mP=Ef|zI6)HvI{u2eEE)P; z6lpT&4@cnld1<0X1(OH9zOe%f9S0*r{IYVdFx-4l7i-kM6RpKhFVlpS&Bho9AX}P`8USJuA(+y9T z#|!w|mc2Y)(37F#Po;D-bPpF7uoX>;Q&&NnnL5SHRKfP{4r0j^E?j&LK3fsdR0)G) z)8a+IGc%JIqRNFv1~E1|fT8d(oE|@RXf_)T(_ln1d8f@mRyu$}sx0nkD>!`O!;wQ? zGALFT8m>W1L_Dz8^5iWJp;oS8a(tA$jPB1$JuVmx-4_XMH-9FcqdS4M50ehaU(JKIl5j9-N?v@uu+fn3b5(vX<_U-VRPjHKKbA>ijDwYee>&> z9%xl8o=&4gv-0u50h+}ou(lb4(;FaTT84+8L89{N+D!{IW35{pNF_3q2IR>L;JSL; zG^0czGlF`*-C!8AD42wPF?yw+jUtP$woP;QfLOop$OnX5mwpC6)Wd zK-&jdB@vd^$CGTUU11Q(H+6)DyYj-VjM|9Hq7qVG=E1pJ}CNey9SBed|$WqQc+>I8ZP65fCLquE0*v!u%(1QR#|2so`d&cHmR- z%%wJ_h&b|iL3#MiFap%}i+As#SSrI(sw1AtBQz92BcH-fEQj!LggnA3hL4=Y*kFkE zhO&*uX3*kdEsEg6Bsry6f#zBfY00Q)lM_o-m|>Dngauz2%w#mOKkhTM#tY4W1}%X zKHk;P@n_&;+gm8ZhRE;;8Kjm+X9Vl#4d81lrn7N^G62+3qX55{mtQ)}-ko+mhCjYZ z92y*28^U*F^7S5B?u)?FXy|@>l?|QYIXbZqsQnE4KGE{?u4l-<3)M%tHlEI4YlIOmW7di$9o#bgd#T|-#J+D9pk+03g z$slskL!&MX47-GPS18tSXQ7Cz4@+312}_aW9pts_zIFr~FHFALL)3ZJGF zeM{OjHgp#QWauW86AO-t*pqSpt-qH9khBh(+DlOmJu?OW9ZUJKp&UT%&Toj3nHx6 zsS{`*QbQUzSG$osFgljMN5y)EqQ_L*K8q0IZF%;ogmHi@PY;yJdwiju4IN*jV>`uO zozc)4hK_^5VzXmtVv3C7cvmCG;0oBtKy@;53^7JgC3%+1mF3U4$i|CLd&)+R!Ow*m z<-Q2;;LE#6y5H#wf!qpg)Y`#3^R|-fF3zTrSGPrm=Lf3={Qk`y{K<^~(m*Z0HAM3n zSX~XIvlT2Z=CQIwhK*$Tl;zN{8foQXUn>5k7L7vcZ%_<(or2s)JoU_ zPauRrnlO$`j1rBA599K6youQf;tvQT=XUY6aNe_ume!AAw2%)kU6{&hlFHYTwS0m& z-XtxL0&T59(WQ}`Pm(n-`Be~8OTglqIU4UG9v|MIz*eu zr1CpKq-(NGYHtlAwZTm2i4(O=FJ#i5oPEDgCco`C6hqfX3tETdQ%bu1{RD}3svOrk zPOoT9LK<+8mt3XL4tZ7!K@SR^5)#E7{J|#=@Z;O-C|GK+kT(`flyUEF20J??*zFeK zr45fe5R6!n%T%zkkj3_T0aY?!E|(p{V;;<&2*62tuPvAHy{k$5hnt)DX>>8Rfs+^q0gHOvKNOGE>78gOKuQNnkVJcxW zqD3ojix?tI3x%{gYea2B3nsJtdg6NP^O_PZOo`GMyw=nHe{EW{l}7Cn=0w6e65JNr z`6jaZqHsx%ex2B!bqH8BH{jE4WAv-E{V0kfzb@Kd5#k#mzWpvbs*<%69=S3mcz#4ge zt0a@kRx!U-#Rp{MK8fb=;l?%|rs61Di}3kt@P|B@3J+n}?H8va_l-8As2+4Q`00-@ z6WSAP%9{|`d(t5lNo_3u1XnxK1!>FHnxTl$c1hdBD|w=$@U(4j@!N`WRhV_YZ12ztz{VwcOX+xLQ9__*DD#JPd6F- zX<;mDZ}2`>xARenv}x21?(0ffPa0gGdX1;q`-jo9>l?a0_C&5+!M)u$P7My=7mghf zJ&>=RjukC(bIL&sCsV$hRF$Y~^` zT7!oYSJr}5hUsjc7EOH`PbOL@B;>_?ve~>HV+9-dLxK<4_@^KsPU;()K=fu-caxou$L?I=>e{}8#g3~D|X zN@P?YJj~RAGR~vYHV-Pn}N06zEi@FS0Y>1HI43MF7l~p55#@1TphsjGQ z@(U-aPFydU7{={l;_tBV4K(`gQXZL5ww#xbLR!$sXVOETs{K^7iwmA{kdq zG}r1+h%ieLRXA!~2QeViN+ls9h}u>R)UA3jgh*3H<0&$-(bK4TEscreDsi|;l&GVw zKcjJ#^q7$vP{O>et?fB5(V|Js_UWLPWsGE$A=27~PyOyi=0BsJeGp|dQn$LAld&BX z;wfj7sO@#-P` zh^WdlBI9;>&_gFLjEAXM8(2=PO-Kh~ zG>wuueWR`88B%{fv zg+gX!$|U9Km1xmM#5aQZhXGSV#}KE0)LC;MPd~Unn33E1h_6B;CH#gHeq`W{F(1Hs`TgwCCXWio<>hkG$!+2hxJZBQ_YqT7ms zpI>Q3Mzj)!%N0V^>Oz?e;9<|Vc(Z%%*^;1^&y0*P<29isn&nr*tszqW$q=cu&~sb7 zCaD5i+z44tN!Q9!s2S$JvT7qaA_a+*L6RZ!HORbHnzFO?JX%wrjhNp?>W>7>h!(Px z_-RI2@D1`x9#y%z>WOHq!u2*y$ zhw9Z5wl`L>u)2vt>0q~tb^?FuB$LUa%I{oys&H7lXKy@GXXw#@@XaXEat&*h1RBW= z*y3r7hsqc{Z$t9Z02;#uoH(+M@$n37?gp$!Z1{XQja#KOIcXN<1p!V6tXol7$|+d< zHZpEC^5oWFuir%3T|jEsi^fC{4l<%?`w;FG2l24zLVlmmiFd>S8mYlQz8*+FeRh4T zn++EpGN*=&;8R)~c(}NXd@hfT#XGop?*ZbeG-5m3w9cSh zE+U;yBSjS7jUtiGQZCL~Mw5V4=wg zpQ5zZ%dqBhaHgGb`h&1W0_5L$u$6XWJ{QJr&4-x7jf~TY2Fpu#RcgeLZ%)yOH-W$J zro4rxMdFmH$@ZC}fl?-c2RH9xV{KR5xmhaY5vA?eSXo0NktUwff(-tYR5BJrlKM1% zB8ZDA7jlU2>>{5pQoZyotA%y7F{>K! zh~pYbd`5GvGG$r8S5~b&YFa1il)hI!L24Q8r0ikSJWOr!9f%e!QVpn?oJ_RPlbY`! zWTu~q7Cp=EMYJ#_GuZ=@2D7wYsT;)c-UGURyz7~buw(*%UIk>AV~uUzb|unZ3q0ltwuSEg**4q zu-UP^xPqAzg(_j)8FV$VUw}NWLid-R!)vZ;mY;Gf)XYX+dNns$9SXx;^F0%`_ ze-K``OAK_68+;Q_xmH2ZQbqMKex}E~OPJH=>BY9M7jXCJrIXmGt!JzJMFJ~a?joi( z5~$v3V5K;O8x1#dmW22;PuS_F?RFqbM@oLEfjgsNMC&1(Adh}9Q$%qihkCq#wc#+z zWH^TkaSS(#7<4#cchrz+RI!z(zLToKL3PeJJ*fL?2>2SXjr)P7S>MLJTMuF7uNBz& zt?C}}nz}}%hi+&oXiB;9&hOLsq-J5r?zP^KaG!9=VNXL+i%2Y}fOIpZv;II}q z<2QK}u%M3hhY!U>FE}^=yDPvI$$*CMPj2pUi3YZ{cWe$C*pS-MuP8EHRb zT>B|JEw!CYnHseM?U3ap5(7Mwc`_0GM8Bi3L?Tgw#%fXfuO}%{789j1Nz!eQ6J^>H z9fW1Jk@g8?YueTHM6|Fu-Eew3f4v}^&0=|ZS$w^q+h=-u_UO6|ie;K{XA8jA!&T%9 z@{5cun3$Z!xl^-PxP6BVP#$iYq4Sr*eS^cWB+0m~E+a>VHIay6c{PeM&5UXI5}#=) z77|!mx{pt8&tqjHN_DWnAB>2Pw?={k@Q_TD4BQUsfjfZBWCEYxxelkZ0S66qJU}I5 zJJ=wZ62G>ik4J#gY50)@-!SdFu}KsIR@{qinpK03&M+43M|c z?6mYNIqe7)b2wU#;+Qvwkw^{YKo&dIT~r)NI06ks$P{ZLZNoEs4RY8F)P|Y>?-A|MmlU?$Jh zgf5~a)1r;Ev_~e@P)N+4%b`UZN$GmDb4(#CFj7Z!P3(fb^Y!|4z@ePFtY(wsxosj@ z%qypDny4eO8^yyr3)o7PP`0{I$fQunXL0MwhuEP3%{MfFaAW`>zZZpU3}wpibU9F| zRLLvLiSO41oS=NcZGe=5c2^C1+Dz(TX@fX9o4drNrmV1*9u zEMl8c#A0c2L&cXFa(~({9SSr>G*;Ut2Ql@`2xg{iICBKJc)WySZ3k;RYe*L}7#a-V z`I-gaSlPz-ZU!}K`-I1iD0yZ>K|5w#4b&~PZ>_sXyVG!t)-f;=z|rwRjD<}eg*dd0 zU{&qPw03Hd6@H(a3`Y^$yIFXHK{9j>nmFaLy}F18cbA1R5)a-J;@dIuc%7I&I){Ow zVbpU8M3Z$mf)kjYnGm1ZiIYL%FRNR~%TI1CWB%bfa>Xjv?#^TW=1nZzzm0o$9$+UL zqhlt9+gGmQ7I}#e?%l)ZpWng8z1w)_dq2SZgLUf5HR{*fsFcd^y2*Q{{vJ=~vHaj6 zZeG2G2RE+c_KiE3zkLs%esT?oolV@QavnZh#OEJ!;#q;Ob!oXc5Ddj>=XhtaCNBup+a}+vQg9Rw?`p;r`aEwow{W7a_Z7rZD2f8 zgttm~$t%L^YDo=-L zB149Sx2Xy9`imh!Cr8^sjVM068k|+XFy8t#8%iQ~Ab?=dgNN6yV>@2J=+qd7hr+a7 zgQ#V<@o-_23}6I7zZ)A%%P3VEn56z#vkGZ{c4o&KxfspvBvJ9uoL$lmL3`T;YBB4-F&=Adh2f`sT zqyczcPGL|7hK9&c2E_Fgo85u%K!l85kOsjp1_y^|Q1Oco>jnMf!I2jj9ta~62?@TJ zyugspi^-Yec=?U5;~U@j8jj6QiWzo*yu~MQdG2QteA8o;2Jy&N8YedR>jQSw^F^d~ zONeEuQK@0;G`QYP3}HSth(?0sZzb>tzkdfmy}U;I)q>dxnk@Nj*k0Pk+RZgscJuHR zY^dePYbx8w;FeIx-9a+7EZ%~`{nOPbV*~M;j z8*Vaev&WC(#HDA*@KjOEB!#KoH5s?*QnbiqN}RLiHxi=!5-mEj9`sHs## z%^RprG8%jxm-t7|J%i~1H?ESWb^FdT9CW}AjE-XN;#aD$C1zE zFnQ`YeEtx5!4|BnY#^7;;rMijrmuE{28J35MK#|muQJF5? z1bZZF39^_O>CjA|MOz(O)bU4oWa_NL1Zt9&Z9k+_-77r?9EzcPn!pA!5D1c&slO@a z=Nas|nGttH<$aNSrzGFBp@g*?IQW}@4T|3-Z}{H^gLo?w#=311<;gIr4l-1%o9J%p zG%gRm2;X;K!sz)UsL{Z`SuW#~JKI=VPm0%h?d&A6v=c+zUP0APxhyvFNM=yNtoVv| zz0TK}%BWL${`w9k9m}wu^&tM$ITR*>WDu0Ea?8Xp9>Cp6Wa$BQGUQRL++RYL3`)LK zhn31JWYS2)5?H-;4JG2$YZgSwvkHxkBAv_Q_La}Ey|M`J$P8wOT`0sBaqHFsHdl5r zF~B#ja2;%9Y`jRUEn)5cUEIEY51Y{f=`JENGKL|VycLTi$FD3al@JJq;Ii{)d6aFi zl7WpUGsu!hJw4=ugN*9%qG(HLtq=45RpPRoEZd3KMp97J+3?c|>f#2{3X{nI z=JZ6gXsR&Lql1t!BU-fa^kl+n5iOcT@%_R~$9}07nC07(Xd&0>Fz_>H=$;m6JLzd4 zvT9@)^u#>&Fj_`UGjMzxzCt!8{vH%rqFwR?{)D`Ve=dE}wHJ8T@hlA2-aI`lH zNQcYVIvd39x8{&|ehRg)hZDsMsEvk>Hi7i;DGDPg`rAlpjW!tDi)se9%Z|j>I&NIM zj}tGygt_B$NNud*oj?9lEG6uC@$0W+WY9}qR0f`*DLnuD85H8%)F@-PaPb7rzwtUw zpPE5*brsX+&SR3=jZdHQqZNY_v$%L>66-5ln7Q;kUV7y$D!Bx%etHvD{~+G@?$_{@ zH(!CXl)z_KZlFpHI52fYoUSJ~64_)N6DN<-ZXr*S_L&$9pSg&csR%E}JD)rRqQ`5Rblj=ZCWh&{? zC8)_wQdm0L6K0wAAYGY8GKe1tkCa&t3(f4CJ(`330^DM;D9(M}xpN0YLqnLEnGx6N zct`fp9sGIsOgWFFr669W{50U7E&n-wv~yjJDd0WHhONCLNes4!RWd61GHU4}YP4=t zYH(8@Ih!lt1@d-|2Gdxm%;Ar!qX^!;hSS$p;kMRL@-{H@@*qYhgGle%aQ}7`n>5f? zY7ImRd`rFy4+iH@KU2bZa0SJv2g!O6u@fW6%|yWO7qgJpX!SZ^@jGF4lQrb?;!^cA zBW;8j@(kN$BLj0OFo)lq{EE0%*9-XW#6qzQyTb*SQ~3a-cDM+mr2{t>ktkY8W5=SQR1p)HmeC;# z@1IU!J-XEH#R_!O*9jeS?5Ro;*iW(h(M#Bm>V2b|a@qlWea;h^R2h2kSj*SvE?>Tk zGiT0VU|@ib34V;ntv)x~8XMY2i9QYye5f2IG0gaT(IbFQnUQy6^SfXRxM1}-P;xo& zS^ch7DZ1k>fP_u{Wuh zB=J+$N?aq2uT(~%W{L=NOpVh|lqWb03j&b{&R#kvj2uhutSsX8jl1IXWgtMFbrY0Z zQ6=P*IBVn(k1omxqlySL!z`zgP$KfR!nA0T;HxniW^p4=hFN;&JW8pZ$P{LRMA~*L z#Br496#wK#!m*6F9u(4vm1Mn)SX=AN<=jIw)>u3b8iF3)~o%&XBMqi^WG zRCo+Mpc|+-9ssQ5U0Hoj*n)1@!!%nW<708#kszb@?yw&}o^&EoP2r@gj=-Qt7$z&3 zIJfmKT-H@mqrUo0tv;WMEBWnkhI6P5+pzWGQ6w*pp-Q^hz**VAg{Yh$89DOktakO> z=V8Ejggyc_2gpwQMPhT%D8*{z1Tz^uxFq%TtSUKn^c24HtG|r1C#T`ySFH&yOX>|- zOLuDu-JaGCV_Lgx=Q}Gkn8l4G!;Hu1B;O7Dk=2!;?qeo-KR177ag``)N+PKv@j{iA zps@teLPvtnKP@Z~E%b8xA^p!x!brLw6{;t*9C~U4F*~Lm0DVLEa{=mXhM(wty@18Y zo8r@mHZp9&%OZovWc54IAfvVxaFekMWA2e3zj(b-?G|l);r>a)tJ8?SIECU^02VJ9QejM4KYMb@=}L>8bg(z~l)+ddj?2`9LC`4ETuX9d z|L90twu5CAv!~>eVV+0PsYtihGR*U}^EG4I4efb4gVW@6EpE>5?bo}c{A-oT#1LUx z$b+^9Ev}K~*E1Q@x{;QLySsJ*qbt!usgM3ANhqWVnx%E57R*xjNA#mWJHJKEZI^hh zz@vlpc7=9#TOVIiP)Ffe6~FsYN8v0aMAN`e*6|cdpre+Y=NtBFD;!WUta2^Y~Rc1dh=+UCe;MI;!#dfO> zr!~{Hh)PGFT}xR5wNg_;79*pSs6!FXh2{x{8f} z4;$yEuzqPA@#6#HG^Mx}Ckz~Uhn$}bCL6ehjfYXC4h5>GDvc~u$ zLo2is=_7kX7S|Ci1huC%lb8(2?HnRixOqCz;p`Q)_zAMtrH>xPt?*vh}P6ls>jNi4fAbt|@ zAXJ|o_JhXVE>NhoYfR@}vOi9}R@33$vhK@g9vbDM*9%MBlo!r5vm*2xX zKfQ`r$ItofjdGzN-tpH*7l?kL^|r(7B&JY{;M18FhjRLny*f5rc5xGl6J?@}AupC^ zLr9PL0UsGS;#tXq69!JbixXrpjgJm|>F|W>-l;g5-wbm=eTbV$UFl)s?6%2ucZd&$ zwu-dSC8F?7XZ3B^JY z+tDP-71v);~4>H*x#cbzJ`VD%Q6W zNbGFj%4b(GPcrMPOSt;cNBF@X{V{&>(G{e0Uq^VFp>>ESK)N3M1%QhuZ_Mf>gGb&P zpNbTBO_Jf`yEVbaO&B=7wx=36id*>Ev@fZF(^^|!b(yP>`0)U#?IS@-GOuKaxN1yP zkv16_B3-p#0#aTX-E@dl_0%T+6lo)=FiVn1-bAx>Q<7ka9vJ58+c^gUsZjPOuiL3v zOs~`lrZVjrWHFK2Cep^x$!pXVrh+olg!bJy`v+g5(4K4E3q2dUZmzq{>3}~l0Bf$O zyxXq{D+VGFG%9(lu5Dob;azO5tzctw1D{>Hh0Wb0*}@DyyE~6N50+u6CP?ls-uw7I zDw!g3yX&}m^A-~690r3S@m@=Qi+mp{4&Fx|5BTm(yG=Y^AWlb;v11ZOkBE&N8$LeW z+5Up&FAw&rcBgb@cS+a7)PTY#7>`+<;ZmfupMdExzQ=*z+qfWM-x^Yw52Hi(N zQ=yKGKQkE}@oFz<;sV_>2vJ%zH&Z}xyOP<@Oitf^O#49BYzNS{4;+d|H#s&4w+E>C z-86vNRIY;Xz%X8Z^%azNx3IA|k9;AAbUKL)88U~t?ta`u zd4s*=SsOVmF+EA!C`wrxre}kbcB`qhlbg0DR@X8jLR&G8gj_az$92|DZgv9QW0E#R zq^&wVnw_(up^7f33uz6L1_Fw-kO3{8? z{mIYBzl81G3_^Yno_=>9_aALxFw%{5d=a01zl>1t1-x;k8`I0PNOgsAY4R+F1_#kS z)QzRZRU}hKzt8ugILfJNc;01q1jJK_7URTgkhKLH3rG9``#HCI8efsrxDA11FdiyR?J8>*6FXP(H z+vw}*=0b@t-gkMt`axlM6=l26FP$d%`)gVL)}^O_e3e&se);_G%fG>IcfM173S5bJ zMx-BH31M`MYGL4T?D?G7oqJBhE*Y+4);u^qf1l3p^V^ikCJ{nOzdp=P?(6d6&E6^e z7n6U2@t}QOw$DXDE|UFGFwnx~Z$rw67p>{PDILjg$kiFQo{rfs$CtM~lD?L%60QVj zx?+^8>&kix=6noAO~<5b`IWJgvCt~F)g$bxogs3H)e6$icLYm%$4S10xQ0rL8R=?G zVz!u^iKE16230^`s0V@G2~}W**G%PaUEaHQ4|nd|Ir(p0Y8KcDFE50rhI`Zk++W5vEc8*w{GUfA4+tvyo#Z?)3Nz`n<`0mD6tITwGd0zl5l|c6ys;9f}@qRkZlo z>y(xnW&}Ga8fY5LHC0UMH^ycxBjPIJR#UNZ)Od|J<^7XQ@oY-D?6Wg*=kv5%hh}jsSY>p}a)8%cK zo1Bg4SWcjC91GXboeg7RM1iqLP}a^Wnc{uNl4n zRu%M))&l7%QlrBce*Pmi6uC`ILxs>{8>tvrWp+9OH9-z{)KL-PHj2&Sy>#S*))Yxu z+idFSkMdu*mT*usiM0fe;!YVIxku+>pxvWOd5XxNlJ)5R&DMQuEX z*a-D>d2uy5jz1sy5e5T2B&mzpGS<@B?7AY8vXFI*dv2OsdfHMAW52AY>BxHWN0sIK zX_}7mOYx+13_WGTtg9fWrD1GKWhI=pHLNm|-x6qe>+7YAQyPup90yKUI)qIyYu3eW zJt3kkWd$ip^Vp=(LKf|nqOAfnMY%^euKLXIJ-Y4fZT#_%e{6b>t|dcv@#00X@TyC5 zOopyzc^HL{^hveG2C%^`R+~SWx0>Ccd*um9bV;21z_H;z1L?KBGKXr9AA$_wxBQ71raYctfF}K6rArHzJlgR2dLORG)EHIv#DLYf|MpAq?G^Dlp?3x|hi7Zs<<7lX$sk z4Pj=xhX3W`G9GX6dxA&bXMSyvCm#Xow@b(POl!0Jha$j#{iX;1;Y|;^{mNxOp4lY# zlh{q{idhlM^mL?sGN-K^0a<3RSMQgxi|>S1kVn26koCfz_{L5i0@qO%UuHvsg8bg01Akx%mR<7fr)ua2gOFT8>LNsU7b$S3o~>hBO{ocoOBIci@eT;&bf0q*>2_mpOH z|I=?v_->s#(KZ|D%V0PP{C7Y0;6J%dhAv})5*r9bTqQG-{0#b52WekbKK zYSuNd`t4{n4jZRfcQ+=+M-gH}M~eA;0rzLtQ60FBU)?>2h%qT^iO0(c{N}5t_)p&* z#z0gto_4gdAMNo1Dvg?jeNGJnZNv_WPPC~mI7$|DVmf8$j4hXr!j0#3bM`ogylOPx z*VB&r5QpBWIPZxo%451kAjaz_2IDgAd2$nj^@nA z$ywgMdqGH9)#oagr{2}K+BP{tly+!TH;#&H=uQBBChTZq(9=cZJ$Uu^Po`6Q?`QmdA+v9f|s zKm8JmYnv!n_(?_zFw}MZbYdHe^9#rnD<~Y~u(q;_%t33H=uNvuY1$k-$7b3bjpaxr4_`D zadq1`W3QfTK397ku-h-$wU1`#?v4cT)$ZTKKy5I^x$nW zY(G06!j<8GV(89>Fw%W|LuYFebfK|t%Irnqu*#3{*U;15jh+1r=9f2-&7{RDBOBZM zNbYBmN$sOlETE9t#iOsk#q#ntlDi2!Us^#jm&N+>625&rhxl$1%PWgmTV0~x6@2&P zIg;4}B_GM@kjH9NWt7(kRF6u0a}6JV`UO(i48D2zCBA$77&}|*c<}kBNaqTwmYSEI zxHe~#odqc$OO`L0V^#_qjGDl%d24Ux>amx$M<>!yaA$NK#`L7mE9`!VSoi&CogKfg z2Tb$^@$N(rXS#j(52nKS)x{9@auuY?RV=2eNK=1&X)s8}E`o@UW_c9JM+3?ickHEk z63v=Y$vu4kXd3x+8m0X>cDLi$Aw%|bejQ6ovsl_l(afzvBW@r1A~jSi8EozBAr$mt zZJF1Y+(lpb5G%`zm|s}L-gW{jv$NQZuVHN?jy%m0Wptl<(8Wwj6$leV9yW5ks53tx zCo?=cf%o2d8@=5^g^Q=v-VZ6v}*m=XgzxuY#n> zFzjb5*vgghbia%bE<`XH;`>e>+@1^~k>LrW>hbgSSokRA zfR|>gZ~h3E&YeMsr>fR+X@68X|7aH)#dfVG-kD>ACBuWsP*8bYz)$(}yLJ3Bc|d(F zL8Dq#u+%o4r1uaB$k&~u}#LTzkd+r zt_XNt{~$lb7>c61ZwzNfhjHW1B@B&@;rzr9O4WUQKD~w>eiv?N5EJJo;fn@w|GTHy zO=XSzc|$6U?iCw~Px(j1@_G=BM&To4b`;nEMk7%gNSL3xRB~w(il7#+g#?V_ZlbL? z4rw^hFzJ`VG0WcJ9ct-4x^w5wiT4v+nxnl(m-ZG>I3?@RwL;@+*?OgYHBp*?))1a- z)$l)x_vn-t#@j_)t)X8LmH()IM)jJ|ve5P0M0tqRjQ$v5Bsi>KZGHhe*+WcSxrl!CT{NxB&~&w5mg+J(2)Z6^8|hk516YUe z5l)PciTCLE7;;;hUQZz#IftKK8$-CwhcBORrSZx43;6eLL=X!r#?r1Fj%91YQRB6b zavU4cP@{Qt6-lw>I0p7nny1+)D_^J^ftdRqol6IJaSgT!To9{!1>ydk4J7|^Bi8(y zOxu=a>>9TCmY@S>bKI=Sn*EAT7-u#}vh(``1xDcP0N#)B#rL<=Fm=QFJx@K{0mXPJ&Q4JiYmdqB=e;V`s`xz$+7&8OUbHRBpn4hJ z*4$C)L>fBQ)5XVMJqN<+=fir>QFce+2=SUmk;~Mc!`Ov`d$nSM1WIJ)Ns) zjMfnH4}#Wp$9V?*b7hL z)`f8dea&(+v$~VS{L(W1qc;ciOP7o(6`LgO%GU|_PNDVaH-gQWtgj3;cmU8wf!eHh zM?%d*`JumLM?7K_#O0IGHvY2e@?U((%7_=^DD$F$`VlH86B1%uza! zBQ%zFNf!>qhn?Uop(mak=kT%;+t7yscuh^FIu`8}3 zGn7m^4spe{9%kQNi3?Jij{0kthHkVZ9aDOuX&ZScdh|!tXH4lDU4cLkGmA;C2uyiN zILS4v;ifXk#*E5SD%Vi;M#w@O?K5D_%Hq;t=$v^fIfQ+O;v1!^Q2lL=r3!Y;(3yuh zE}ey2*(q}JW&XyF{+zV4&$u;bm)?;bH7?c3$%|(#sCCpiEsU%NkFE{Bv(wYFar9p_ zLd8*f!bx&XPyN-x)S@eX-ewP>_Y<@s^wht?2_61boObVxok`E?vO z8g7cC<=KKW#Z%E_!k*eGxV*Ml#!wx{HFPJ4P5XW+u65eeex0x$GplpLR;R^A+brEy zamvnawkPY>#S_;EX=H85yvrisc-FXfG7UwpX_%cbq7s@Op52Z>-!+0JzU*U-I&*wq!+IlES9S>K^ix06@Pw2+`)9Cbs9qDCZ{ZEi z+dGJ7st5-H$YrxA7HM{u&tq>ti9F5pcpblkTu$Vhqu*32g(BszP!r`yQ~oJYE`HS` zkAs5)^p1>UXm}9SYDGNdUZ%3-3kOIgQZF1zEWPv z#5%tD<|}-^uub75QN|28Uc;|gDvJFs(te30mxNqR-~}PFv&pmdVl=J??ajs`oFX6D5#Q_`ev}ZvKyL(d3#-WIvJ~#Y?5kXu&8^h|xzL?UCoxh3? z-n!QCd>kKsz2Ly|dVzsnL+q=HjtHiD>KCsUj0l+(9(e5R?6|KNyiB+doAlENyZ*o`Yt(1dhba<6t`>xxJdd+YQx%%RD2kYf*~buY zh~}(lGEc?chPL~fXX`D--Gj)r_d7#BVFmk)QxvA(j7)({t3ddA&icW zA(L1lL%E0T%{UpghS)EXc?&b)@U{<8%O~h&ml`mu4p;wS+Ud8WO|sS zWT($xP6>n}xOV3j&2*yJN@OuXvz1@{lfS^9{_fWAnMQ4!OA0Bsv+DzPKG*)2pP=LGnaAW_B;4z|M5S=Pu_hCZGJ`Vr6A6E zOV+S;y#GC+ZVUMGWu;OP*RT_b1bTXUgyZR;OLKU!$TC&DlBb5s;Sm=#v%u&3-kB$Rx!she2w;62~&_mWUPJ-U0?3$Ng#h@nVs6FnovZFo}q7G z7e_+`nZhZ)5LnVse+6vW`_>_fxv!zEYQ;oOBt=<3S|aO$KTdeUT6b28Yla z@?d={j;=@_#s>SzkPIN!*H5#sUYhYlF+wxIvqL@D+KIy-8^xW==P}S7#o4nLaPGoI z^wCUcar!9=@MCm%2tH4jSO>4KFNPsXFV-K!=*SR4o)TsjwsCRlDy~hPMTFAsi}j#? zfbtv~L^u*dPc#Zot$^hI9^&yNLOp}He(efID4lMa$?-Boy+b1yAOkznJBUk{E+AMf zAeYWyV)7!cPLZLlR#EASqCX0(t**io9Kc{-H>%|V7Ut&3Km&Jg-k_N!4Kk>&K67po z8>Ck{^y9tv?jqLHE$#yj#KK5zEn+=!K>jg=$v~epUA40K6rFPEP&&JGE-h8Xgk6}| zAAmPV2f+ru&BpgUH#RoJWy^3lOaqRf7@%<8a=mYQk8WaO0^>9-ckj`)2H&I09rGTY zwc(#EFE+Q+gHr7qH9Q%oqhyj(V)l9zU>kO*8!~G;8qGh;rQUBd#ZiBi9|b8LlfET= z+w|05A+*Y^(dz}~a;R8kb~;=(zDEbXN7v*NV0t&khF#gRMbonye@1*0l;bxV2~d1C zz8?NeO#>>$3|7|TKwtnD&-6D=Q$;SDvdwYo%WK^S_VcDHw$WA6YNZUvN4`g=e6v*K zul#q!HjISIJ-T64V8*>icM9MtbyWA_c(J*iHX1d&MmU};611A85?@YCApri>+WD}%DQZ{Am%4#Qbf;(~HRKF9No*iA5S%57R-pt4`zF-fg zrY^N?!Ztukd>k=g6EuwN$%8E&PB^-e|FR8UWTJ9VHDuAw_otY`JKxgRpr z0krY&SjVk}*6OIj9hBy5^0qCFy{f<*)LJ*vOv?ywAw9JKtl3Q4VHaK@sOG#>1M~8b z&ut5}qE4rk`q2(889HsM?9wV~Yj*iTpq*{&S$C4R!cpSbVYJ-lDeAg5&0P^`Y1F49 zhw}jfG5yZPPtBR*uye*HTbEZ5_2RcUpT;@0)&p`h&9kc~?Uj?dXd0SR!-bdrC?XxFKBdtEavX)9$yA=pB&Ysp zNSk$NVU2WLPAg6|LWNGM<9QYJPuc7guAw_2v~%UU)9H>v)3`14$c@v`LS<)zLr{Yl zCPXnCC>y(>DXEHfahmS4sz5&`L&@7#XM=;-<(0rve;7KUTo0Vit5x2q^Y0qE9~^S! z`yslMr=6ViNnXon5wv@UDs84?+ksI0){{{+X$O=S#+{%*DYJ$h7X=Dqs5zI{2K}_E z)y59vlyjZYE@^fK*U-8AAko@eJ5I(<)(pEeWVAHfO}9OaT#hn+NKkhl&Z1=32RWss2gpvqsaTx~>F}t(@hs8hRY5wl3hL>$oOK-`KY{b_ z8oCpN&(-O2qWjYwBl}OQW8~kXIlE@n0+wi6dNSsG%-G4=LrU4^0TC&*HB8Da$0AMb zpYWKlJ~daTV8Kpbm#Mv+bqze1SBrW>rk-2*Tw9zWCyv-$op24^D}bmpG}Pv$M%cAq z2c!xlVU=*Y{I!8pDvL_BrU*NLD8I64qFl^VUKte1jrT|^XZ;?S$!9ZS`4awctvS!e z>9uRG@EMkN z4}|VYueDU!g#j++F3v)>9DMru!m>kD7#?Yd_`qL(|bE3I!y+lI^u?yE`VzzPB z0By3UxyION>7oW*lN3$XlEgZVIyheWyId-YwbpnoIUfAA&0$rn5m#yHbN+`SpK1pO zf3G|GQ574?^%T1!ZIbCqmf4*H?Y!UJ)X@D<-|Rn4>@3b>H<`ik`Sa+FdU5}^zr)9W zcz{Bs^9@hT9N7@HUWb}cLn)s}E?W?FI8Fv=YikE(Dmr&qoR_(_9}P~6duy-9Lupo# z&*hZCfRwh@bdKs|oa9Y8azqU&qFq{c>DtLG=!Z#8Q;Vl=>pBj{RFTUP+1W`Hq~y%V zN)qY4ZG8UwzsGO?;kWqg%P+99xs7t0Mkv3(gir2$hR3TZRpLx3pTj2~e}!2ZtT~p| z#UAx!i-DB7&G2!oJC+n?EAIgAjP4bHui*5Lj^gsIoA~iZKgG{KyoIjvK6cV2(ZS~r za@gJ3!NEZR2l>*z)*VQmK zdc3IQ?)DCL6Z>R1C_gof;dxmhPk9~`g`8(=#X?^1bSmW%5H%u()-HsOsbc6#qp3D+qjO@?%PC(=@{28;iegBks2skf|@32fe%YN11KlmJk_x(bzL8R z^bu}O_G9+>92VBNj_%MPDvrJV6rG#dcDIqv=8(;%5szDk-c6HD}TcXzwX^t6b!Oi$TULzQP49bk8L3Aw5Vqm$OkN2O9I2= zqsS$9G5h2RD&7eCVi6=(=Mmq{kP%2=gF2$FY98Nw{v{Hb0s`R(LWcz`QM$Q81)2Cd zRwydQ25T}{%L9v42GiR_dOXcuK z(Gv+_ZE*q5DemUlCX$qQB-V$+LK2I!&#}0$j7>T|nOvFVF%hdafH&+l(Y-4$09_!nCSligd?#2=xJ${OdPvIP_IV{dbj>i9C%`#mydc|82=V|@GcnHY2}KcB_sPLk^QJ|-s5 zV05Iv+3x+|>7xFR2blbkY=JOVeAE(Spya~`zy5Q)``#VwuFPX) zaS7{7i|z#F%wu=3fp0v=)QmS9P@Kz z9H?|)J zzE?2zT{vDo3YfTf1@C_JK4Jl2{^_i^|0e5cRB0xe+}@%Q`2jW;X7Tu&r-+W6$J;-7 z4{yAA9X%lr8K-C1%~WvvopBwv5?lG@zhPba8GKzMf&c`?HU5ZX|-m=Swt* z*u?tkD!O9hbUc5KYgf*LMg>%kXEX>2;YT#nzH{pmlAFs|rDIIH-vGJPva`cRN7`g8 zp#nQuQ`%DI&PdM161grdRY!C_W~X&~?L!@1I!&D#RgP*AW9P5oox7Le_wtOrN&~Y3 z@}3?n&Ca1*sbOM#1h;S9!sOXA*rwSV-;>VKKxLE$jBmejLo8l8x1K_!=7*PN?B}_khgeQ;Zk=somv%f>LwIq5*&*R+L5riUPj7?5r zaCiV~G_$HzYv><8kI8eBi1kD@G$7pb~k437#zHmRn-Yx{9F`T8gaqi48 zB7q8?vZ1V1#Vp;W6}0-%LR}$Yy=;HFWMJ%j2M(=%Y9Zj~63n&*3eaS^en4 z5Afsn-oof$j5_lQilr*5m8!TO#*4m=(yVECco<#^3s8gZqERTP=H(^+sS_{di<}@e z@(7*VfRbC6R~REUJZvDCav@Ix-ZHwV;g>1xO3i~w>O3w@jVlT&(SZ>%9Az;hO6=xv z@%#{ax;>bEG6R1&gr0!`>)x0Mk)aKeAr@uy`e|4F!Vt?8QVC3d_dQluw^1sV#Jv(x zO#P4MEbv1qCHnCMmHi_TyIQG0v&=o35q8mRZ61sB%XEAvFm>$$8DTHNbZq>pA?8ab z{GPc#*p0Inr!dkV!0Pj-c=YXK?Chpc%$Mm{^AmhjE;7i2hzoj^g^;Z{hu4{2V|1)t}(QUwnkAOXmvll*KguOO828* zQ`$fO0F#qrrakipBA6HqBAZ;tPBns&Gm}&~z4-i(j}Q#_XcQe$HJxaFoOV_gv9`L2 z(aYEI_WM7=9T+#f@v{5nozHfd&I(+$r9E8$Y9C^iw)U z?|=9X&7z0Z#W__ctb^)=OvSP(yH25J&D%nt3N1P568d9ETR@8_el!m`En_WE!?EMi zbQRa=@$z7#8&lWs;O!s%mQJUhNC!l=_+nrzlwpLFoK~lM#o0TfDK?|d>s8W zc9~r^W;1GuTW0;(xcsFm*Af^X>gJZaU`wbe8#9Mc7 z<0`eOp6;+(0+(iJr}Sdto0!01b{il6!yj<}voCS))31;%c`$W>I&+%Yl`}i|_Wl>R z_lHkO=M%DQ{kU}X5`1df;l5FvqY?7T_g~|)KitEYAAgF6Uw@CxK}FTj=)&2lN$e(4 z@C5=G7#l~_Lq?U1fWK!1As-nIp{2NJPY5gXbC{tS-$8+M$>0Bmj4vIdFTcT7rVE!Yjv>AHZd+bcfUKztEhu5)pGC!5Kb%r9p(NJ?O-WX48p$3xDK!bXyRrm1 z!hMo(s-MwhZDWaNPDjm03U_IMX0gZ_=arA0;&=cf1~EL9Q=KuWQJj`UC+Q-qsHe%B z)oPVSss&^+8O+Sg;Nr!L==5wv-HRI3!QytIKR z%>svL#+XfPVP`Lgp^0JL_afz~v`f};9T8dYr zFg6Tq?8J$upr!l2!|H(t*WdmC0}<+wNiH786;X`5L=rWQPib@BtYcFKMm&7MVdO*_ zmjQ-Ws$0ZfNNLtZTb=haV#l>>5k7^zqK`Wz%mXB5jQ63?u@@dCG?5h$_ zq$wU6p?@S3=}BpbxT>BSL);_u^L;yUEJQIxy8Nyl3$(|Y6@4Y#1ShEc5$NHD$P$P0 zmclf28SflnmygNtn9?AR>Nmv`GHqW~Oz{Y7epJcCwbx6Ba%NQ}5-3HIjsb*yXfi zoH(Tiuv7($z!XM^2UNI%HmVzK;u^Zwgho}u8a90KCazq+j_#mxd94-f^|Tr*yVhtm zUn^QX{%zNBWw(>J>KOS~+h(jfiV19l7DIM+IP2I+b-xrS{2fC|*cK^VSX0f3Kyxhi z=#KtaogV1&Dq`0gs22nr5y5I#(nPf_Ttjz4bn+y1n(m=7jE;^WWVzSY9;bN^Pd9d5 zcq5sH$#2>)g-B@TRt?iP)eYUCC@8i?lNoX=&LNGli>Kw(ZkWsIMYU6ANML8=Od{Ke z&8bwZ56IQy-lOX<`aL>d6{QZ{qx&Ing!+AQ)U`eXr%u;a?$ENWy23A14Skc2Dpq8Q z$A}|A`L&d`H6Dl6rKSAQ)04y1ZBt%)IBm$f8g??mNW-GQUfLh!9$g6jcYm(PT}~zC z2cIe%bj}VdMfG76Wgu-jv#Q5h9jr}7cxk}J?=VJt2ZYQDFDbUYy^Sxw{1Vr$U2`8s zd6B$mL#LfH?lSm+3y;SOpXDZSyNK@#(tqt`^G+hyXYrs5{mK=R{rqqTS8}_1b*;k3 zg`M_5Ov}gx6c~a=>DY#u(qa#3ahVi>j_^yma=5t9X-Y>5=kr9E(j$@KS0hUCl`s-W zvU)%13BM$i!)e=;C!>cu#F0_u<}}R89LDF5Ki#DnI=wS>IaT<7{E@Apm0PaZ$T>efD0 zltX0GNo;Lwp;W1oA*^6$YYWMA))dzceu8s!>tSZUV>Vuc{>X_>2E>Y{wJG ztE&WXjn8FsG@vqn?yE+Fg#Bbnd|jS9I$j+icTf;vydNB=O#9S~3Jo~2G*}ZIPMOnRC}5$Ix*T#_1_HZ%-uz)|D5oJN$M zL#;Q`J9F0aZ0%uWKW|&ZkBV#PP899L9>W#W_}l;MU*UiLAO2VT-M{?}=9f09^Z1qw^`q}*u}|sqW5HtK%t8U>VgUC8H2ry^#N zJOeIL+#>CBjf}a?QJ0+Y&t9thlfx8uG}?}7iJ*BUdupht8?sz?^v7fjCBJZzU!Vr4 zKSsEaHTtLOlhZI{c3SLQULBMkK{FIf_udJaf)PufQw|Ly&4z9-jU(Z zb|QsbDk=6e7z(z1nY2xHi$448J9Oo*f*~=S*{5LVccM|4jIL*mAo;~+qXaojb25^g z4Wq4&inxsJ@xl8q{!i5Y+rQ!t3i(_HTbrB8x^gsl@dtwNAMtWM50ZAbH?f;cBY%)Z zd?$%uBr57yBY1$sg%;&M0@X?x2ictR+KzOItzGyd20T~|P?=k)!i8BsSNuy10t<ItzE0usU1}^LGKd+(<2z#U)@-4QY9WWj9xtq_ z4oH;N)iHSAH78@0)#=fO9L|`+O=ux@p=P;xOLh``p6uiTB}~&e8b-`!Y1oJJK)g)t zV2SGWH`wQ^8^^fBUZ6TL_vA4)SC*(w&0%I~t8P(WD|`=Xd3_5TyBSr|KD-Y+fUD4e z?>OwQFJX+;HLu9C^oc#H$BF(V)@?w=ne%$b@l!3<^fH&Y1GrFFL zU+hOAox~0`XoLr-K6aB~Od((OVRUQ|-LV*ao*F{2e)RUz?2;N-kvczasC-YaOa_p@ z?KyUKf+mhdv6!aE7eIIaD0(A@$d5PHWZFnRehE?>KbJ2%c#W6Gd^bONIjXD~c6DBh>zPh0UN3ojXgp1wW|kB;Ka zx8K5HA%%ON+y|n=n3_6=Au3BO)=l}5Vd;s&Yul@t;m!)o}_7ab;CMV#)eLqk|$oSK?S-KL&=_Nc+e*b|D%i<4Hz7Kn;&S!&RaY zYngsMUZ41a{m|$LrFDpn%MGXm?w>XCJL+sU<#v$kd`sktR<_jAamc9F?fk=fnG z^89nLeqkz=Cd0RZAYba=TBkwd1~oBWK|U<%Ux4ZachD88M;q&_RQLaguOEIxMrI9( zodg-tO)PKjQQZyUkY+`jlo!=D6q7rY#|-$J=gPxh8~FOmdwBTWBRrdaf|Zq38la`g z*i6%GaEAtrd2BB8%I1q$Pvj8nDq?kIjmox;M5csNdKVjHr1NFIRGY;-8Pm-~3We-0 zR;bKd@dQ>EsZLW}_febWj(lTb1~aqMc>Hvl3?Lc(r6nAYp^Zc$*rDUIv9(PzNHX*r zyr$wNwvt84w}Oq0IP%4sXkWSg1lAYlFgL%2V(AdcL;_E~{u=9>+eqwZvAea3-CSNA zd3%h8#9K!;a)dSPIJmDDbQtCJ0-8B=>h%IjV{<(LFL&C*ePVXBv$2WPK?&Yk7kc|* zWDIF0j1bkjH7KdawyJ;r1i8PHwc?Q`R^&^?gA;PoB!vdunpiy!U&8SRYRjlK% zRv{x=L6?_|3k?Jd`66``e(Frh)LC%7qY)~NGV) z(ukQC-Q)*ixQvmWZpxo3GR5V4eQd;Q9zP;vFuA30dPV9ec%_6uFiagd%mjujA?LBHsGZn|S`seI&^scq<-UzBGY2 z&3dY_^Z4M#IJP#|Fg?GH)cOLo=NiI;Q@A|QO#{Ld){->9>W)ym3!$gHhq237kz1d` zCbf-se(|Ts@2ujiWt3g z1Iy38!_fH)lr0&hB9Km&aOdV_>cc1T@SE>ZpmuY0atQYyEg=%6fnsn3?_LPv39kmi z3(gK-L}Yh?_I(T0=viF3bQanDI93*xFf@4)UA&A}X$!rV-@=t~jgD&DU`2} zm|icSb6!_n)L(7GE<8m2Ubn;R1$^aklln9FJ-U}b#|<4J&Jgtm+#!gQMFQ=l=_7nC zP}S4mbIM(&KJilHig;2SlU&0pm-QtqURyX?Lz<+k#n*};u!&k7w7YpQ7WivV-#@eV9CVLCoyt*HegvXprcyiba!`S2hs{$8dFO0@*y@RtUjI z<%*uUipe1wV5?Z)qpR_IbTmjcJ!C`YysojAWNj%=D|Z8bYMoMKcb*Y{;+Z_yR#O^RJf5;+|85pX#ESQYhdB zzj~9)W`&_uKIGjcUP(FhcoF2wn|w8(QWNpGzXatIC1VowQLa=j5x1&55z0@CRj6NO zgLhaiQNI90LW;bQ&thvkj>P&hilIT=zVikKqLd#h6z5RfpE{&;a=DDSXBQ4f#FLZ! zY7DQU5ex=UIygY(kY;3DPCAKv*-~7FrLrARm~!hNAZ|1GX{N=7a$$8D8#zDTyEaL) zyC}SLT=?BpHV}Nel~Au>PZYG>&9sa1Z6%&ySPS1V@X4x%9>rOtV>VUQ@anjOm&!Ks>e=G zg45%q+0fK{fjUF?y1);gtZ(o_!XXTgj-fBs+G_&Gfo}z5aygW0ehl?SRO!)iG<0NW zY^#GLl*6sMhh$ho!LV!SP9tVRcf3c38GZ`5#LwctaGdkhLU@G83%s6iyF8sphsS>Z z?G1#Tu8>KsU)E8=#3pS^nG&+`QsR(6*Of8kj2@=Tj6laQ^+zs`f;rrTt;|knAny~a zzV3#O`&^|9rokdvIP-ZsIc#oJ9GONlI?hHqrS(;!VK_fw+ZjV=Y`L6DxUPi#T`$-* z&NHGq{+`{7YM7@D-fzvx*vai=8j7s0`L~8$qMFPUMjQNJbvnGQIpfEIqM-c~ev_gq zBWKZaaEUVn!~NShX44uhR(&p5j))< z5S?gx<|eH8w13LB6iyq$Kq-IJe+I_35-v+LEGb&hQgn)|{jtYBmIIoyQv_?cy3a1J z7IwXeNk$&oZ`HSpe;nLPmmNmFbXn@arOVSsrz_x#<@lx7yId(Lr*61jZbTAc4bqUG zZj{5!_u7;(uYEd-(C*%xoVJcC;`n@7OHaqDYVj-SOG2x@MnidhpeP54`J?3gx`?|> z&*?_Hbjcru=PxPoLoeE;OCeW&bWDEoSi>2vh5XcIPj8DPcJe>nXS9 zulQXDK7x0zJza~>)4db z6pzA9`h*@X!VGjhi=45`)2u@sx};)4q*ouG5ot()^NLc#&+ino!RWV zbQrFI$8)=hJ*3lV3=9p{xh#KaJd-o@saElev^-ehk4sl8%F5&IxmN&g39>tlSjuHR zy3PFc0u?8@iZxjAJ4aHaTDYO3Z|M(%7_RR55UXFuR@hK1yVj`JY(f)vRrwsWTw zyOJK=@w``aR(T_TQ+H@1Gr7*;8oCpsGbf5iCH&#yzW)9?$6qv%zbD75b3f!oSZ5Xy z-%es>HGZrmOim@Q;O-o&COAb_<&Dy=4>L>b<2t9vAxfyKV^P(@?VKG=b(|t<=;1~x zicvp4$4aGR1F#kov8c71eIs4FFuU|y%}+nBQUp1!X)4L(VEOrTeEOT;He7oc)lrSFi&IWehw0l0?l6-TZoyd4|i1y_SuUD`kNE7H7J=@hYH}l{zVHKq7Zq zYN(F9-41d()-;*AbTuVW4#O$sqfHaS6siBr!J1#z;C})m&;ki;(}DJiG#1Nvye* zD;&bp+E2^(1thjsMXPBCr5|6eY92}@xt;1jR=oDO@M)3PU{G?4IoE}rPBHk@(LMv%?@?*=*_WvYk z^?0>PqvPrnrj>y|Y1T=a?HfONd{mm%LpzRhtgXkcmHMl3)O`7gx6?|e`khwVTr0<~ z6`fA?Ij8x&bec#cf?O^qp1Qny_pbibWiS|Q?ezjSbo?DfHgp_$ZEa1}Fp#3T909J_ z?Q}@ZXtiT*)>vBUq+4lljW|tpr<3PE<0R5-#&HbuQO>7aPuktzeOcw>d{4Taw_Bf1 zvMro6CsFTDx^A4*@jhy~t#y+9Y|Qwo85_8pH*bpfz1h$O0s#>w=VdZ<4DTQtwR}D= zW_3J$=U*Pxum$G^dD4x*<#fX5|3$5R=koevtxxQ?c2F)Z8d`nf`oYfc_lwyZU#jLy zmVApX91aUP*CUxaL&t`U6V!|y&+OR9@htCEp3%8<4z2@kXXMf;VC&tdjr4e#H(F~s*j)qP{3w8~i zixXPia62ZKP9XO+Zk=*zglyy*(bUknxVX5uxV*}^*PC2iTwGjUYg|L;;^N}s@)`sD Y|B&P=1ZM0Tv;Y7A07*qoM6N<$g1L*ibN~PV literal 0 HcmV?d00001 diff --git a/education/windows/images/mcee-auto-assign-legacy.png b/education/windows/images/mcee-auto-assign-legacy.png new file mode 100644 index 0000000000000000000000000000000000000000..866b37395e4d2fe19bf7cebe919dfffc5b6e3fd1 GIT binary patch literal 34151 zcmYhi18`(**M=KAnb@{%+nOX3+qP}n#w6+3wr$(CC!Eab_dEZoI$hP(ySw*pJiOPn z?iHo1D1``z3kL!Mf+!;`t^xuAY6ZNr!GHl@@kKC;1U`Ves7Q%|)Xw5x0G~iuh$x7F zfHWk)e;GjnpTjyzYq@}cAPxO@2OV=LHw6I+{gM$EQS;Ql>48qwlkwj3c#`|e3+>9~ zjBN;l!0bikVqwuyLTydqOtG<;lyK}~ngy`D(!{L5kl45yav{&A%t$qxk|%XjN0*Q@ z)?}o)y`5IvlmUU_VaKgN;XAt@jQd`xiHV4qwPas({d+beu~S*s`*B(I@!fX$$M5yx zC%P3J@a6$S_O2l!B66Tu*e)g_Vnm_5T~t_Dk2>wrCwA&sjs6Q2&IZ4;)}4xJJCj{aZ}dAf=d};+|_;0@2_`T&aK78Wb|!0 z2$95+Tb6U}WNjM!F&UMr=q@f>Om)2jQRz|@8S59vgwvtQ&*9b^@|H@^H>!{`FK8tE zx34py06dR*1V=rr+w!U^oi=+t-aN%gbaeDp{{4vC+uQtn!giBCJt~?+`ay!y8B=Ci z6@`U`Am--g+#kI^B(_Hhoaad4lj$KLA;Y#nB?5J}L7k-Qp9>4sXel87`{Ta?N&D@# zNfI6u5h$u>SIh#%5_W5%ig+|4w*C~#)EZkXFmk>4=29FgU9`5b!Ee$?ATOgFcDVsnj zF!@s(*oODQ_0G5FGamj9Pk0)wJ+9_gRS~=f)(uyGv=5ucDzBJXVe0XM1+A^E4Uwt) z8>{6hhw>v!$4;g)ion$|tGV~#El)02s>sKKh^2D{{cz2Lh~o+PphD`^Lya|1akL`U+E>$V$KXeSPoLP9k+0y=?5Y1j)SQzL8 zm(*;tC)gfX4XKYnLKs?awo(-n1LwI~t5YgfNt`;J$w|V&!C7!402uxPTWD@+v0JYn zcDJjShgB`l@_?Myr z(tsr^YbQ7-VRp3)b82d8e&kGp&&@T{Xom1@vvD`jAlhPdxJ0lfM`!-8C4DCYw#8>} zzAu{&kET+#Y)tFU(vw%K86jJ2bIzPF$n5NFP40T%KqPKXF0Ll`{Ydjw0+7S~RLlt@ z7Ev1OtIJEmfUgI;tyU4P#3^8}CyHdgz=s!A_Vx;LiUWsC>MPy8?;X=aYqEIqAr1$i$&|Hb_Vw?W3bs~{yp=3vT%bkvxbXD=pG}1~Z66)`PS-g1Oz94_4zaN5U z>UJF44)WE|SX*D$bnXRFrs#84kzwcL{N1fgJ$wRJ_2bJoLBC%I(W{M*r-NV`F*@Bv z@26)VaM^sk`w?TZ*X#H0E6CFk)pdw8_vC+o<$rL0Ff{Q#7}z#1`MbC{WEeP`VdGg< zjaCMJ2R_Iu-r{6p#Q2f~+JtoS^H1-iDk4x)#T*v=dkX0FdA&V8ro4^j(`@vAsWSNc zc9f9vbP{w$GP#0rkssW1V7%v}Pr*z?>tfDGjP$a;D;6WM8td|4)Az^b^Yu&n{N99{UdNrJ%Y?rwfA9d)%)^xqKJGC2j&f?e0p#dUL1e3J zbHRc+Q`VW88T^x!>kV7?wOYNUr6u4DRr7rq!Qzo9^NmB^R90j_pX_W7Hfr=4Upnk` zyQ+_n*Dgu74WpDM3pw8H@v*8ZE(ZTCg5bkFLRje%ExIhpVp-eJkko3sB^j|kSGpMj!+DU6#s>2M~36(#hLBtB}X8hHw_QLQxSvvM9W5dnc&Q2)8JY%v-d z+Pc_9)0`l@)AP%VSN>}$lOHTNu=^re0JxxYG`54?C9YSiHS6-`EKoOsFUzVBJgr6` z0?Ac`=FFq92?@Y08YWmmszPn>t)YR160T)@ug!rd1)-`u%-mCill&d5%@A96D3%=B zuw#0=!-YzUeR_I&7)giGk>IotO|P>_!ic_w6=~y(Eg?f`SV5pn}Pgxs4ti24v{T!`X0H)mYrmrATgA zRbpWT$%8<6V&Ti!qlxOHCx-5g@JcLy4ipmd_QJ%+)`3;4eX=tgoK31C#1PRH-&c079JiZC80p&!+L*z zc?Cy!y&2vX;P_w1+1Zrh2BMWke?keRCI&;2Q@vWR6QEw=zcwCvPV# z0H+}lHg@4p?H~nZ>HfmRh0@70p?_Y(hRD}MgoKhLY)}-eDM+e$o%E?N*K!$*6Qr05 zYGq|=10c4e{xFd6B=E;sj_jcn*E#k0fPT?Igp+0C$_4ljQ5S6Ri$XNSsjpRG$YtXd zNidaS5AL`Lg{!v+oN08b>BIpcm}$I%7)R)3$pmFlrhV1v@S=P0Nvp_sW(-F#DJW4S ziW$4zZXEDJZG;d+Ct{2P_33`MsLQPe7>|7&-C<(XhV~f61qfjhiRD35ub)Lnsm{Z; zn}Z12Woy#Lcss*tyvgPIQ01ax%Mww!de4!qnHc9~60%t)i)U}4_`VWXY6rA12drF{ z>_6K$>&ZQ;edmJHm&%mT;zCt5G_aZw8L9G5&RNMJER>WIx+~`iC8jla-XjCbMP?0U z%?`6H@`DV<%iuOM?V1Mzdp>Wwlu;2`n$L~)JMdBFs7+~^kHz^ge#&W>IT#7E@{o@9 zr%)z4Y`2TJaVJ@gS(!yIK>!Ga{Bt|0MLHk`HAkwAag9jwNDXUsJAxnPDbQkMB(V!4 z@TU!V58cB+~k>F1$OosRI}&Y$i4)94dT;?Z$BkdC2g% z2CsuKtjt0L@P(07GpfOnQHYo*QuZVZ(hazlw=~hT^&kn z!E6Ap)uwUaz7011T2VAvAxX3)?vo{o35@e5DVj;SG=sJjEMa^LBUW=f-a@Q)>QM51 zaQFH+#Sbv~pC7YzyX4NrxcJjx&*^Rq{w7>fvMnFl;%#5ZL^O zXuu_pIlL&y_Y}=ayTpyr%r!{c)R-#W1gdh}2vY@xV%dz=u>?+!SW5pVC=cuP0)mAR z-gA(^u?f^ig*0UkfNz>Mete1V5*3@ZGKnh4Uz62+-8qPYx<~>6U~oS6!!_d6lx90( z>jKh$pW5bENT;~8vol|PuBV}+*`66)rfgD)C@O0NKt>F3&lmsq@7_PZW0d~VMkyF# znyP8A_hhZ)Ct5=xeu=I(I2Of+vgr~yDIQ+a8GQQPMTIfX(RF!Wm( zBu`2-hw*$yFn0Q3f^%`5QVA<4E7aUcUts`!SOy6?|Fk?sfjk0n5c!4XA0%R(3_DQN zV_~@Vm|wKt#~%ZvFum!eYDxOPrDr3;e7|ufesiP40{1r*KL}8 zRhh1|UlY!OU!vQfm`)myX}b%&B63T~thDcRquZ+oFxmUg5`b=qWRR6))MK@RS`_*T z0*|hksy8)H0YwcWx=47)N+q*Suq?JVOZ9m9xyjVTEMlHIQMYe;P%Vhle05aRv}XC? zu(p-#G_SJEw%Tb3=X9!$SL|jAhhX{w?)1>>k?Ll7HDWo?H80C5)H#`3y+Z8-`6cm@ z(qvLIUdHa45v?*f)Jvqq!66u&eqx?JuJ*MLp{@Vp3e>mC%F69*<9+=9JJN*3JVJUO zqx~;T?@+$}FT6(mzc=g!o>523{W)!cs)B=SFYIT~Rj1Iai;%~Df6(z)Z+{GtB2cJ8 zOFWVk9Dh-cw;hhjr#x|hj5(>_3uJdeJe6%ugozrRA{ht*L-xo?Xy?~`gTGY)Ee?CV zK;e4aWMnay@AqfJ;x3cVckkcL-nShs)!8dNP#O^s5KK(m6jI~$u>gO5ltiU3C8);f z?a7tP=}5H&;bL zMPmR~JBoxWI~X4itHAo;T`&U<{9+4> zz_`L0Z;vwZotVc!U|22pOLxAz(2@klXnrTFx$$z5kh!gMI#s&Sc$!yFu$;3BFs-Gs zqYLV+85aHGnH=;>CO%YN1LD+LlME(!{^{rk?E8b*+RNEr=6#tK$a)A5`eB(LLU2KE z7{6doUrXgOK0ZFo6`p}$Yt0QB8XBn8(@kqoH8K6Z9>(@QR@;>GO?TpnVSu3H&n(|v zH&E9Akx%|hEkiX08;=$WP@XuK2?62|*JA|&!^$*Xbe^gue-QF}0^=z>mgMa>NVH6C zh7NfIjKP$U-FFnBcCU=sC~q_VbDSrp_>baJ$h$m+)MC1$wmqAtVz!X)SH`rxPBlTc zbFU!IBT1=`ZZ4*Dp?2+j`iLR6gRYFJy$tfjqG-YhWlH4-|hhcKnim4eBH947Yss%{(8G3 zmwld`wGya1n=i1ny4nhi24Ak$=Da5+kB>{ffLv|_$ij-GQM2Sv6%DFb1OyNxjDG-$ zjh>sEIl>?Gm=QIEX}*AO{?s6Z+O8#d`GqB<*Ut1>qPy2o*$G|p{e;&p{Dah@toM$P z3t#K`9NN9?)eyD=q5=j)tf4r!QvffU%@rim$Gx`KBzzltrX9}`>oeYx$Un9Ejse?A z>^lRuIiyd&rGX$kn^Xa8+EKdjLX-y`VF!0I3g_fbPQ#1Sg^anFnDwl5F2~}@6@HDA`{1vpr!^QtDl?8%jA2WlCvEyXE1W;s9CxzbO^zq&IF);^?H4?+(5S@W`>4_ z*rO3MqgnnVg+*c!)S`VT|E~F3=4rb6X;u~{(lLe->(;?7lT@xj-Q3*N%FusFAJWBE z=(<=w^ap_-FWFr9MxXCoER|_ZHb|2|56vr$UCdS+wDq!Jq=MV&#ZBnm;L3`&2k;sy z{48J@mHRnSh1*RVi#60+Q8+3?$sm`;CPwJnP&%t?U{hPimg52-lE@efapNg&T0K6> z^j?UuEG{11R<>w7>tjD%D?_x+)bwCBvPxQMC4C8vLB=EdR6Yn64Iwb7XL?Az2xC}wjZ1KbE~EA{Lq(?g?O-?xja>oh zILvf08lZ>&WKGZ`SmSX#17GYv5N8;a@6^X(u?#?9@hLgKLC(pBZP2lrq)b^wEWSb; z*j4W;UY+LUC098*r%|2b`Dlp>q(IOKAuRm=UuWOHBD39L+Giz$*u2#}qBID?Ckvn^DzeY~SlHU&O(sn=-3H50 z2Dth7@VRK~+ir9=DeQy6mr36ei)!9CE$`JEful%IBmbE858YTs9@6!R0%a$zw_2iP zjj{+vqv+5@Vri$znL+)h=3r+>5dhrWrQKa!>**@$>KtrsQ`xCR#!(VO@u3nWg-CXA z!0nzxT92V13_0ycLQa4HCWp%*{mva=L$6PcQtuatXcZHNFgVPR3JsndG9%8!57t#w z0sxpFjmD{v*iBFd>UM)zgMPsOooFSeIH0cnZNrV0mpVvL4_q^Okin z67Dc-iep+d6wN9Wx*>b+jLuhFcL0VNr9t)@^l?ERNexUIZN+evsCz-i*BIeJ9^<#o z*=*iDJe2K5V;Cd~e<09H}Xo~SAYQ!WO9|(9uX3XDcaEVn2 zov?XH;N`!pzzU&#K>P*>--0hQ5w*s-X2}pN!xRUaxIwE7g|Ellq+45BjIghWz2Q3M z*=L8fyEE8PB=rj$NQrl{IkKB1=Q8ImL*5*w7~Dh5Eh%%|i}hyQ!wd>ZFi}WJD-CgR z>5{lwOQd2BF)#LG*U<*lBR;o_{TStPc4{!~%|?5Nw^4!zHx@N3Brf; z6QgDh1LJZM)|204G%*9qR0g+CJjPI8kEXFq{tq!gNGbttL}Nn|)lH5>9sXD7VaOTW zyeL&ZO7r1b6*kxxC`JBbGjbs1ahDh;sH|}~fdHOCOH<>V`O>RvRmB291qQI3x73zO z5h0T8RUQXKXasQaBYJHy4-I__sxpaE~AEhg&Cx1XcC&`(2{k}adpMw z(amFrg-7fF^nMmiBhmZMg?rf?bnwv~!uZh_)hxJ+ZRWOmlY!Ej#={8CHeU>SHWN4o z+u5`0l56!+CR^FpM1J&7X*(NOT-@~Xq4nr`a)uNvXeFb6uQLtU2#?1GHyg_BNh@<; zT}r8sE-#1=lT9pxFvBFvXP#2Po9aKdQD)mg*CH!WQ5YA8*uIeqtOP+dKm|?XF@p!J z0`ARc3lm|(0Yd{g4^by6&D0Xtt28a5t(9V7)HHcf;pV>wf+c5_Md+wrpH3k)L~Em= ze-Nf-jFG=m(xQl}rATH%@~r7AW_^g`qCnm`Dx9h)m1}&b4^U(i8`%UhUp?tKp@Pc< zCz6u(@ha01qX{$*0;0k|CO6)cWAHI4o#iMTbgsAB5?a93DD3uwf9M!tbp7Z6^drzt z8bZ0EIg3zLk+9dxk~S^Q$Qm;;N3~#h7gEt%oQxnb(!}T_?Ia0EFeG0;o>Njbs0`84 z@L=6bjIM4}jxXiS{7Ieig!0);MwCOh)+gp9^ChPVoM0uxx3vk?Nx?VF+5AKKlw$!e za3uJd5sVjyIT(!fG6zvjvrU}+K-wU?;C4=G5;YP(pAF7zjJtGj2J`)MMr>_%bEy!B>flPmTFs!VFi zO|mEL6TU|2tVZ6r0Dz(gfocS0hO7rflVvs#B=DZz3Km*S$cE#{*y4~_F6|-tDoOPR zw3CWKQ>;eQyM+G|0i;sK2wsON%w!Q&ycj=8Gr$wU_yP_KBsWCn@g>$n$oYuh%L;aP z^{tI^VjW@N^KA87?Y6?Pts6jXes%$KYG8!m>n=q^cFSQknxIBPGYfo*MLe4n&=mCu zybVE=n(hlIu8Wx7^*Azzy4l0+OPKh>t%{APDW-Shg3&H>EXWP{BS&C-eQf(Z{+>s1ey+wt{>oO*VSS`I`VeCFIwW^dq zPrS3dY=`*dy<&`Woudtm8dNne$xJl5qX))=`8|DtAb|JzqEM&;uaiahL)U94{|k@= zzoxphX@gf_`@EQ<5%H&XkHx#eLG^Fv4FjI^wf$yr+=u6TMNJozzxUj7oWr5g=I-{kQ(Gr8dlB)}Zd)W5Sxp>l$LR00ZUz^9B)++jz)318Y9xs~KXRPu zA!zNFBXy8C5||3qFZ3iax4|fgW#L@p6l$q_e9 zu~vus$+cuDO-0;T7hp^BnkC}dlkqR)H%HWHgk4O3>tZf6V_x%ip)1 zPHR^qi`1UsJE4UtNco}%n7$02f0)ken>oyRb0%uR9L4{ zu#((1N^>i!OaVVUK+2S66kCNOtvSB1lB%1re6LQQvfNNJ)d}sM)t-xVaJ_dZ&j~Vr z%Wm)q$u~&l!~7J4*WmH0$%JGyQpr^Ot zz#!mg4SGz9lhfmCr|*4FHf50d<9UCeEZ+-oH;Nd%BEzG>WZ-|1rZMMMaC3EqhmXze zd_3*~{H%=LuamY;A)eMMOWX1tW3GQwJppY34E6%jh2b4!Wk2+46{UY93IiIc6M4vq zW#g3tt5NaD)nsI7)F-IW4x&-BgvBJPRp6y(SQWNOiPI9xVdTJR%g9X?Ptd&w8rR?%LdQQ}c2HygQ(pSB)HY(4_F7u#GPT@*`= z{zOlEf%vJnQK>9X(Te?dNknh5Tww>j60GqJgh@FZRZvCj#5LWYXfqD$l9 zlODFaerIZJvm-xWPS?Ylm4g`)h`wUN;0}^zPBk4eq9qt*k6jdwoM+M+Dk^w#rZ!s5 zw9SuB|Frh#H%F^&*Su03MUWkP|wKILQ zz)NDML17ZpB~~6E)!;OoOMEHHlFLg#ttxPoB`_yCG4fE4U1-gYty)Ya3RTeMD6IA~ zH*Yb!D00LZDOOmfRr)!T6RO33lg$PHmMw=nZrl(FKM7wZ<4{wyxZ-NALBuS$oaP9o zes1pPAYEJBZa!Hl`8w_HZCF{K|J|}2o|~O*F>H&l$9R#yW&Wf$NFAnNA1*LQMHJxt zc7Fix#NX6S@`rMCEXqByu&nHCc_IZ3?a1WlNLP(=gDA!)=qSv%NY}k6bF5A9&#{S* z&C+{Cg-kleb$^I3f4v$#CQ7%Hp6^5G2uh3On4}QD%Xy~%P|d>U$LG2Om(9kr+KQRn zfsw>2rcd0lDNZ1gI^AMXY-cJ`M>UVQc7tYSRu(-bU}^-XPYq7Cv|e{IQ(vm7se^25 z!FI)BDE350+fZDN&vNC~1K|yALAs)7ET^62`5}TRzss?-=U+F zBrEs4uJQcIiDSlR-BrY@^Um~?%8DAIA~mjVVpn!PG=L=ZsHSS1(#$jB51US}6UhPq zo=J-8nh$h4yTNV8aoUu`%vHd2z5b5!Ee_*L?CBGSBBk3bqQFt;{N4Cc(Q#0%Iz$y#%Z|zjvBpP$j=HLrOvIjEU$wG8{MxL;|y8h zjD)hV{8IEKBlNO3KL-%G;YmaCFk82N_ES7Y??+2!b$FI7Y}G~n%h6Lhg_ zdp8RDnuO?Q5dJGpIrXUJXyJgKW0$IPn8#zwsRq>DeegL-8y5r*W zh>Crs$?+TE;+prj@@s5qF3k_urb!Ikn|k_<2bi?=)cSKysqfusa@=yOw+GWK#8$n| ziZAJ>vRudW`Yp!+vO_qt2Gb3g?AH`KU`c)c^T&B} zb5nccK%-wURsplB36Nvptg7s}zc1_iwm5v=TnE{U5@wE`d3ci>G=Vh2&awJr3vGS% z==QG671R4ivq_(iN)YIWaQj2Qhs(cwr%;c&Vy8OAXYR6UU&CUpQZhoctS8 z-~S^5{&rs8t9>7Frd@2Q^dMNtyZu}#ZKtT>a6gud`3OldgDUz2h2%noUF*+i^zOL4 zRr&c3`HV3?yH5Undm0=C8Yi(>0(xIDx*4rM^M~r0wQG1AMArU|r>FU5&d!fO#s-v9 z_am=;|NdTFSba!9pS;o+%B>nEf+>nDI^k#jMi#180NWifAOd=Q&dl(0Wtfp$}*q{zWHF~UoJlI8E=Nzz{U8mVl; z(YB;m=HKj(zI#u4b1pCCxk?vt9GnaM@KZZYz#z0#@OyBDp1%FI9ahysgk`6?-( zJhf-l9!ir|MyfhvSOfRvxWfxY`9A4Q>Nv8Gdo1$M;Vwq#uS5_dVcQz%Q0~M_SONS? zwvNCM8brV~Op(oMC%DSnDOcYHkQLgj)sjiYA3wdT(T@BELDg-u-+6yJyP&uFo#)@6 z5=h2rza2?851TSbNu`)896k&*f5all8j@c20=Xnm7K)Qh8bKdVSjdp3Ex~Qhhom@d z0_|RWe0)|C+NFh#LI+`+T|1lo(`AZzq?HdyPP5SQ^n)m;*m4P&pz+uyoJnsp=Uf(GA)|OI_JwY&b_HD*kLlmf)E26*{6{i;vi53i zZ4r?P;djGs z5gi=|K|sZo&h_a(o4WuFui8}QGF1qM0i|iQE!QFdAiM{*VMZl*9dJjFKR$ipOnxqy z1mrBFZ(#0)k*bUH5MY+;K=zis5RMwX4^J~>9ID++(I)g@vJIqv=cWT-OEOhJPaV~I zQ};^VWnO*c$QvpXI1yCjzaFm%EJK1in}8df8WY85mm)LSy2m}O^dW*S{=2&bg;Pqu zF@)6?z#@%{_h!#3TUcxStn1{0IiSZT0|3W%8?LaSwmDzy=vvOdZD4CHhxoCoQ#zfr z)|zq2YTV;QwGB$Ule&*i@SM@Cj49+2g+tD5Rw^8rMI1^)%9tRG&I@*hYmMmz>sPsz6^~LOX z>!!Wy$6hyIZ{x+d0-U%{uLxrADw3nDedsh#%15(a`FcgrMm0hdfEr~YO0@mAKp0uo zk1Qsa%3r@wf8#)gML>08;$&NhAJ(-_E2=Jy7}#*kqz43Pp}$&jj@eS~p1b^P+9k~M z`rJNwo!iCEq}w?T z%6?@G-M|G+<0$(yeD%dn_2-4>-26uInopUer0mH6Nt-5&^`oMn7;Q=m)#%Qy(cQ7| z`w+YdQ9ceYmmp?Iw{Gu3y~;DD9eaO#Ay@-RFw>DuFGxkHf4Cwr>nGYBoBHDBTb4?8 z1+N$v`B$jm@~XtslT?N=)~D$fc^VVXmuZ+(7-{x}K0jxAs~vFvN)0Vmv!Zs`Z>gnivep$c8ah}(w%fBM z^WAyXYZg8Wuqp=FzKL-2u-$f@WK!H>`e76;fr5 zf0OUpVT2xHbU`xFzLVzsi_vGN@mD=aH>F@<+7@P404IZdm>f=~@~&5AqTN_wCCwv; zlwL||Fs`QhHl(TJzG3I*JgCFyPPj{AFb?QEh6A!-C3zql5|UI zAX(hBQ<%fDE3>r2&Z~S85E1o=k8*zdOLv*{i(DI7&$S0M&*3qKLp!vG9>z@=R+E<>KYBWP&*RZWm`FTiJ&;O+{>gGJ#^ItJ zMOTe`Fn&Au<wNaUFC!;=dDt|_xhKqt{GZ9Ew_*?X@v0KXs!He?yE63Sv#jV${Z zJi`2vm;WeZOC4Shr9jkqfHVuSOcAkYgEj!Iv7;J7SUNt(DQ#2}JU;=58|CH8Fj^y$ zIJ9v*1h0sc`^=q7)|{~zN=7p}v0X*giBz_6-I?K%bZ57^slc@Xq~;NJEdsb+(jT+3 zDwz0t?DcHeSKyI6YZvXvM#Pp=r4xJyQb#t z55cK-l)eB;PZJw!lO7pzF=zpkfqped_jO?MsmYK};5^04F1eg;t@I_mTINHuZ$C9C zYo4fxODZHKkU?yG!H;BaYDnxtOgp-X)1v*)$0lPv7KCZ^Pii?K7RdufV0vx?=ALsg zGqi4MZG5|`8QZ)(6Y}1d;Yt5=`L%($kw%v~nSaPJXX@cy6T*)l9`5e7vz=t8(bnYe zsA;O4Dj7M>M<)kaVi~wL;5R4nH+J??HY6*?_)1EIE>xm(97=hsJvhAR=!}r@XLfds zWjP60T=_4T=JIl^y1x}&`QO#JXjIx}AvBA;4kH*xE@dSYW|#h$CR7v z)pyKV&*JLfRgdA?$#uKQ22@XYJM}DOqwS$rDqP`R)f|uxn>DXS67_Cun7SR$1c}b4 za_H;dIVK6QU9XG?X{p7iL7^i1PMi6Hvl)XUa1mCPSn{L4=vBuZjXy-!) zG&)$8!Vfg3G2*4ab!;i~`x0_F!Luioh->GLx>KyHS+t(TDftN09xF9(AP;|Nr#SZT z-gXtWcCFMZ;gvE^^GW)|d2%rRdZg)5=nmBA4sR2r81%2iH?_;tZl|}gfoLMK1cUBna*m%jhv7Slp3FRLMJp|xmjop)w{ z2AC8E)Hbk2lltitk8GNHR6+91-y(G?TQpF}=xFQ24d_p>Jm)g#qfD38jLO5ZwP@C` ziyPI1L>X$un{B0+mf4PRbsecQf`7YgB^ zt$lS-G-|SOc>3oN+GgWSCamsR+R3cw+E1j80{%88)hd)VE#-5nVbejW?>cY83JKtx z?&$iJ38XMIrp#@<#PxPnD0TzX9T#&cY2$W3ko=9iO`_XL6LA+wz41oiTSnwMU0Qn? z9qcRGvL(842)r7e%Vl6CLRp@FlG&JrI+~0cuFdDSJ;v{9*)(Ers5t-~xtI>}kUF^X z&cHCuB;aSx;@X;abAAjOJM>iZu{bzUJU*O`Lm9AuL+9u${@MI0=0?sHIH}ix%QfxTO^fM|I<MKW-yi?E_fs~Wr}+N;>0GYCflBnFEjgx7i~->kux zoj@zlj6=s%aT-vdic-l+$7y6N^0ym|K;Mt#_TdD3(2SNI4-dpHs_Y9HR~ZKBimgKX z4u9j?{sfE&z{7xn8p&^?2%o)YB(Mty2UO)`l&LfYiy~V~*>jUY#@Gay0mP??RwwEC z!G>Ho{;-m!SOIJTtO{1s6T&J%c!2S^yPKQ9zptkzvin_7lQ9mza& $G`bp9KTo@ zK1Jtw%G;Fwc%OBB#2HfNEyk1{s{OOHZr9DXUmk(yfTG$7RzEA-`fY48>SFEymkui` z{iVehFN_l*?%;+5n^e%wj+q#h1NNvYqp@aI+|ab4AITkLrLom?Pjs@}H6?UqaBvu*MF-HGcX;__T@PbVnz9hS!!8i=R9}%4z&o)h2)Tx?sSNT5Lr(%~8{RZsj_Hpu{0C9L`*sR_V7;XaYe{KYl)z5l z;Htn5Wg)_iA~U{*3#7To;t;t*QHAmuYORbX87vMNLiE!?IR%T}V2dCICB3E|Po?yU z+*E(qK1p)^y+Le=SmnVQ%W16DXrEU-?^G_Rtgu-(#4+Dx8AR|#iwa2BYrLiK-L}HTtzn0=+I@5 zz&A{57sFP6LAj>fs{6Pvu)CzunOYawysUBB)y?S3&at|7%$?;O%a_N|czKg*7aPL9 znug{Z>Mi4n6WqAvG%GhQv2$vh52iQqYZ8fpwJ!yl+bT))UyH5M-&(7s?@99QLp0;D zA1q|(DM{IDNR=&c5B&_ZbmrELR%uMHzi~hBTLD7_dx8(^r&+;AAKD$Q{%;cuSi9?- zopmF2wNZ~&WLNhKZ1F}p4^^>e#sAsmBt({x1%?wxFt?DqYy}^RKw#Njf z8Utx;b!>;E;Xn3^&G5OdVmVCf>@B$)YMy#@rxrH1S1dS@?(T9oxA(a$T5=5$A0{*< zqZM;rm-K-JN7#m;a5j;lUyc&JF9#otn6EJOQJ;7*$%6Dtj@3E{$t`jm6}^D3iI4Ex z_>ZKUnNqiR>H=0xOPE!|HscG$?nC9_qC!V3q z(u!Iz2QzoY{P+v76IuW$gUAFDdk7}$p8tx7kR@ubKJ+n4|KY^F>u5(k0M}j&@#!PSNUkMhrwH$Vki#8i` z26Gy?8wA$v*=@H2llSWB>L#}y2marK0sI=*T`Rk}5(&PSp(?2!Qv;`yXD z8?8<`$y+C9Oa1>QqH5c6UW9sX>e%_7ub3@|k15k2pK=nwec*Z3et`D7o1t z-th&0pYu$J{=J8(66tck-j4_Tt~4p2P)0A8$y-@EB@nerMR z@Ne#i@9V3e-<1%d*Q*j^9=|dnUZdaIqg+_hw{t_Hnl4B*AFwDGu3M#unPb)CWN<;L zch93}idHFWE`!;{?~d+WUB*LCs%;u5MpgQ z+*$ErT<)p)#sq|sk$ELMhe>EQ%B9Ez{8X(DV<`OgFalAn#Sm~2x@Fl9E-K2$^V1s| z(ts=d$weJ?7p9q>(lC>Xf-6$~nN8vURDqw)Kcn}E^W#4=t_}E4O=^Vr_-A>A9~nK1 z@*U-6xtpt_AFUtqev(Qy6`N|cBq?^%TV7OKx+V-S{!0J52rLQk4y?6v?K@NW%+^5I zX*{^#A=^ouWbY?+@7$GH*-+m_P)$lgyL*+lW(4_vFX?PQ`WYSkyB4}4Hl;$&r&VVj z;JX#V?W~|xHM+c*eJY-R(`EjJ79ArBGy@N2gQzK|%pBV^Zs-Df8*1JB1;|LD_jL{jtSfuIc7NCS9yn6Q?lXz^AZngix^rb)qI*OFHV*gqM!dPw9>~;_uE7C z%@9DGO0K^S6TyCK>Sg7`dUA>I>_8IdIHR)zdXy8W4Z*lzM%M29gzo>2uemW{U|u^; z!dM{GSVBVT`Ifd;Tbb$6jTx}$pj+?!*EJv*=#tSXTmVX+GQcMso8L&3jp|ZQSjE+n zD*1;wz`G0{yfmwK(DdK3=f6;c-Wxs}mm*;Ox{+O=nYfk`B#oUUJSA8FDGb$+C2cgI z*pPN#Y>-yRtGIQva-!54L2Ty^XhV-Y;CAQCX<%SGSx=nX%58n>{8fClF+P29!K*VTF3E{t%T+(stM$iC zsdvE@v(h2>KM%Vm-h7L)uS~1yaf@q8ip|t=vpFu;@`?7+d#kOUkHXN$hph{*>}S%E zjeGsE5B+~G>}rhAYCQQJ$Ljv*->Ij(LHSEBt|g_-YH=pKfIMf`tZEaT_?nADjZ&|-$-mmqS6_}JL_!*0$HV1D}?n3_pFb?y)?nqOIwP`a1` zCL+$ffW@G$UKm6XUCt+PyufPY23xX8fNGmLb|&fq+@6SrAz5FyE{q+5`dl6bfG{rsPI zJ!?H5-q(+;<(|E-nSI519>3!Nm~$2*8#}QAp^4ik*XU*4@b>^UEGR525Nl8=j{Dh# zT&k!#Sp_wWS|Gn0kO1kGMinLjDoZDBGK~ zc^C7P<_B{hq#7c#;N#(q2lBxldcPJF6oBLEb8h{l1s=M^-M4=iBP@NHHe*1MN>WN? zx#6sUhIqy3%LkV;-i@bqPU(fE`F94Lah{(OuXDHo{M>5OrF9Ig`D!agdbP=ZY;kcB z5bT0;d=3}*QYdYel5cFZQW-c@bmF@j^7Rv~uK+TaRe`s*(QR1>3ri9YR=PSfBO5Ln z8H^IA;^gLLPf~;M&A0ph zUK&iI&ZVDc#$b|1o=;O%uIdQ5Z~&!6V}Z4f7)h0^x%lD)brlp7d;A?l-<8MaDtpaC zmSz&`tCO>diVU>;)cB&I3v!MiV(v>?r9L?h$lzt>muQLL?)BDIAtqfdxj?#gJ9ACN zdl?i}Q=8ryp7$`Mr*v)h2}W%%9aikTie`ftdpmiW5rB-W8n`d|>y7z+#^k5x(IQ`B zf1&$BwSMKh*Tp{n(~P#aX>3Ce~`Vi1UoNXK6FX)_0=>DYS>{z zz+8oAFo?wyIRYlI#=(foV;+l~Ads zuh+@ySN{mXK-jzJeXLPF0Ben6@BOwteLRxRN~|PM%2El*otMML&hIN5(7KOCDrd7X zl1auYB8T#s-H{g|_kmfs>~_t+_@6~lSQc%09!<+Dx6y4`@;m39!PSbgu;b_k(fg)- zhp>`{KYfw8XF>KxUQuQ=BjZlA#vSgn<3~8CLxc0bS#1v3)HENbMkIaT7qSi2K41-& zJ-YjIn209uR>eBhgZW!7b4$3g7J%)&O|`4wH}Ldy|0tVgv)E{hDQX@chn$bq5W|d7 z8m_feevE)BtDs^;_?JS;hXo3A_VF-+5cBREz36S&592-tHiU-z{G@O^<&tY zx|{kYUWs{cQ-))cKJozliilAJ2W1BY^ip_FV%1}l~1Tc)Zy>c$rM$3>PIyh$J= z9wcFMHYMQ0nNd=h;VJjWE7T#TPA#@D9rE$c4d7xGJSV~&A4o;WlU`Es4Wg@q11}kr zuK98%^&;g;&{3Ie>7?G|Sn5Z9#2TxX>t;~(fm`M!F<<6EmU>?s6f6Fa6)d86IY9S9 zD%`?JZW&`z5a0)1&wbv0*=x!`G^YZre%EbEio8CDqoG^Dn5aZrZqFa3koPb`LnrIW zhSm~MrfSHJC?wRY%xs;&vkeE%p=r(0j3S<^Xdp{6MM{uA%R8?Z#nS+i6IF|)t)S#z z48o{NOA z=UDf8>yv19kNbo{E zAoNPmXM0uzlaR+1m2jiRUkzfbiySX~Okj_ai*(MeK|2Q(r_(rKQ?Mzicp?jg3U(Vr z(@0)MkztO`bW5bV%}^|53JvFKvd<}2G|HZ1eQV5pGhU%+r!#h6>LQZ*5>EZt?+Plx zM;^|wUhE3#I+E&B8j8boV8zj8Mvs-jE5dD2B-O$DraBE-=vDSM4@^YE*zz*ip#0(Y z!zClNPo^lQ4pE_d53Tn}Os264?V~g~+AfJlRF!7}ZUK3^w!x+8M(zv|2}1MmVjA4R zf_9CZA-dOzw@A|(K3_(Q=481lp>1-3aU3_w$)NJtTs%y#&^kt$jw(4+!*_4aRo~A= z(s(4wS_YEw9hLDmy#=FI#Xc~>NGMx$i4EHbC~S~u8Dms$K2HS^h&xlUuH$P&O`f7| z;iArxi_+{A*}^K)232H$)|=Z5(W3%tQko25b8PU8pVo|w*SH4L8QpKS2;w3r)4HY_ zam9WzvGc&l?Dn*`O^cwU9$RAOPt~bHf(X?!o$4tMeymEA4@H#BbQ_~~TA#aR#s?4x8e544CFc@N37{7r?C{j`G_Y)SzR1@!cHhDeXS zbUg6b4HKS6m9)Xni8x-w)Mdz6s3172GR9lzZgDC{i{ibPp)9yBbuTY;0uN8o9CM#a zR*S+ekx@qKx$b*`Jtk!$=@#`9SZJeNMM*pwd9RBGl~~lyc2SlLBwesMQg9}U(jfa> zkI}MZOoJZ;k#Zf;XJ6@I%2ySHbI|q#^B6hFLfM&_L)4F2}%2MXbeZtZHR%>xq?F7cYj^lZ+A8&J$YTDAvZV8FmZHRB3 z?j~ln7D_I$$de(7O2jSS*2g7Gcj%|o&o`&^IA?TuVT1b3Bv+5NB&-t46-`HR&Z#dc zC&{o%5xW3#HJ$jQto+CDIw{&IA#Ek27*8&`3o};Mn(OE?+*a2#o!_*SX zTxPO4Bc88XCL`>>d%IUy>FnC=nW2L~$dO5fZF(%}YfBC+pxWlh?c0bIQ~D}J&-81t zpz`%1L}k|az)`imP6$Kr2V2qTM!GjUna|yczny?OPl7IY-$rEDQ|}CWKl=(+8t6Xv z7T>nb>&%*UQ*IW~q)w)M5pp&b^6|r0X!RRXZ+ki3{UI25;aM%l4th}E151eLWAh{{9=wrID1*KAe>6XUm0eHoOArq~ui znNghrs52Va`MkWW1ye=9E>F*df>NtoP7tX-i|S$BigG#*{&M4m&dXVK4XN{*u(HcEkWyyt81df`#xRTn z{8_!OmcoE;Hi52@Vu&(3uXhqlBYp#1T#EX$16y3qY6Y=G%)Ev5=hXgTsSjv`G84wm$1ZiuEv z6U2U6(>tFnD`JOaL% z$Y%QZL<>>P`NoC~(ddfAFH1I0Z{nM3nHh~fbi)EoSAO!#a^ELbH=8PG+lwG!Cl>B# zydSQ)rVT4L?{VTmtEEbM3Kkq|?Ld2%G57ZoX^t}iHvm2U#4P%#%7%o`ZLuSgugm`( z^&Qq&Jg!a8>+^rue8ycxFEnwiczj+KvQ6uV|*Y zk@liMi$Fu?Bb|O$T7UbO+#P^W~K)X%P;dDyb2`=ZG4s z%o#&S^++TWpSgL&8_sH>IX!=|p7Co~1^NB7M{*fLHcjuv$R$9RZo_Qea+O%rDq@p+ z;%sA~I9IyjLPa4Fuq7S2>Ws<*&gXRvS^Xo!KQV7QuOCi=Do+NV8Bs};d`cq!OQ}{d4UE|H81bAJ8be9c!f8)e%db9t`qaz| zC)wh65U@NvIZ@^&P!!PA!KoT%#|C*SkTBnXtiJb$IQ*THe$bC@ZEd}p5ME;o zkRbDrOefqKm-g0E8`6;z@yIN4=HOQuCfZIcaoq&i!y~CwQBvvevG{=csn>u@nao3l z%FS2~#kK+M)0@*COd3QbQc4N%9wzLQe3Qms(g`Nbgy}p>@ zxi-J-3r+E7uEw&>g4h(Hw~wF?Vf|s7m&czJEbY3tefl%{Il?JF8?-a8p#=wy|G{Hf z+&UNnyZbYx{*lPGrbOyDi1E5Q9`m)ixrh_6Gfli#oEQtHKG77vv(DcU*1~BvFBK_; z?gqYyMzR_PewIiB2=7fI@)AJ#j&UI;^7IYrMRgZJod)SL7_?c`s?c3v5!F!-c+y$w zrp3B;Ix0g4{QRL|0C~VN=#DNBF$R_V1;7EGEA2iS9(giKcQ`1$60_qUc6S|)?jNta z)|QskNXKFMGThq-#AL)!`~eyEzVzwkRqN zdl+80%;@2Rq4x0|)#lbUhFtPKK6i7wxKC>BrLFPmisB$Rmi zFjU{8#U349wWAGliR3XD$`n5;QQ z6L>ps0DBOD+%mrHQZ&9@{JxP;gu@_%2C)F)g9fhP91jDg4ly#5t_lU%G$U2pbkv=R z)TJ?3qkWt`NMR4CUk}^tB5r!dW^tZ%yA$X(jBwrgdq!#Hn zeiPG>rEkO$lX<5!qs=*P%rJC!Hbft?l_b247VUO`z6%s$w06)cBJ|#A1oqRU!mlwk zvbd<@Fa*A*)md4Yt>x|+&t-i$taV$RpKs_))*h><$l~VKeEasr@xOup=n3g>dGTRL4OHkvgv)Ah+3U;-%sc2(P8F;OGXk4I}p9#fshtpGX5SPD+q zlimW1zXx)U>rpWz9SHy@NyZ6TMggC+19Y42X-~U$SP}yls5jI*=2li-0YqWABo|FN zn4g|a+b(m+l=Fg#Nn9qwo75JDI*nsd3Xx=H!V1m^Irb_nwW=B*IqETZKZXRI@E&s2 zSo!EeF-QC)akXgcP4tRXUBgdsolOJ&5S6fxl0fk@SrX(iT4arfri=zh#g<6qxa}s< zEQ)!fD%^&0VQrZ_yCEn`&lka`Naj4h2~mlJzAWPr#VSe~k)PfqSBlXWgS1;%X|o&g zx#N+q7U|Bm;J%s_r{SbehQy$072$-95>K$nhGO@TQ9GtZI2xy|oBdR&+-Jv@P~vnd z!o8$&WQPnFAj+S#(Qo4(D#=a=QpISF_t!m3aD?g?3 zp|sB%H1Iqn%VS=f(cC3mQ3z0cSFI8*D$^n8O-~fL8kT;NIC)v=LTg0sJE*beChlTl z(x-B$r1ptFOSRYLPmdbY-E58Y0{>ozy9n|g%-G+vXHWc;wmFQFLA|C2Mg$&F#mj)% zdk`fnVGF3%u@A>UhZR^+r&I*uGx+2Aheu+hz>G}T7^cb?4uA)b~HKKq=$uUb~G!m!PVZNiIPFhBsK3S~nBu^5RuctsoQB1BH`f*Wp z+!~yg6DBv?5{{YEmN82~RRSH>r(njKCg*1&T8~A55OEy9Q4m;wnHJ!pb*0W?u?1ia zKcZ5e7YIiEWb`yJgJd*@5>EQGh98rx7fyk$;$SEZyMb;&#Q{rE7L62e_(;MB%R9!& zJ2TQ1;i$nv1vN{}Im+TSU=`yuzQW%51Gr@Da@b#O6?9^&k?>oh64tTyGiA!fB-7Gk zD%dw;!Pu^);&`d~jylmIM}~1y64_NZtd(^s}w(;JdZs z)iZD4!~mvZd&h}0HgfwJwNgHHY!B!S{6$?%SH!d%x(lx^+@8clp(~M1bk}S;M&swf z;t05-3|&uNyU*39Ajpdz84ROolQVyza$pJ?q#!)YHm?fB+oA~B^}9OqSDUYuixMY) zErfTcp$C|o;bN~WF9vwq~wZt z+xOn5zI|hY1$QN2QO4- zn=EGaxE1-8fuh}HHf?r`8KsHIS3TW#b>y(q^sSRCe9LEe`mSm)u49zRQnT^rUobo5 zI4i=ckE!eLccP9n`NiM|pE!Pc++7~job^#9(w9Q|P`lRefCf_RU^1O#{1UMH6BHl; zfc?^pfJE3wr|ihfd4O4wx>=6^`V6%S+#hq8Mf_mF?{1|?#AU35vX z{Ga3Fm*J?$JQ*F3vMiSxFylF~4+2zCP-66uFa{rktqzkm-- z3X_kouiDrF?eAHap9^-B8VU{8cxF>944 z1=!%cln%ZZu_!9JA46Hn0jDMNMaSotplLB;*695G=MftnN>su9C7yB~BFmmD7>~F6 z_2Fu{jg~U62va67KzuyuWUn)f}!7nBTQLPR}>go zir)jqwDHCXUi-9J(_&fEM3N=(Up|g7$wouYbra@b!B+Q#Od>Y?~Mt59; zxF?ahZRL--@w6}3x#af;gz)1XtvhD2C8ggm%)0wj$~wPpAO&wWgr-LViWxO73gVCO zpzn;Jij^@}BH&LHdof~{e7x8g(F0XuXU0_LvFg;&fHO6#Jyxf&zXnXe74B$KKF}y@!E|V~-R#dWRLs-lS~j@8!KjQroLC zCx@tkCS@6~@fcTGO6ad)TQarnwGSS+iHT;g&|l*iYBOs5mq^Fwlq*El2yv&#KMZtN7$HEY=h-w5RJMz z=!(}3+xGjtG=OHzjdd(?_m%n~TU8$aCX$=xg2~#(-i&MZ^lN$(_n7w>PsX`?{nN+K zC!8O4lkL87$U3IYPt-GVks8>kT%D|?kmhRBIEQLP=ZE!t)_C>?t7xnUVwF)>~AM;-O_&V!6YQx16mQn`5@;_u1=fClnXr3jKLF-Lz(O zp={6ROZCSeg||$9$3QmZa8X^Rl>{d2rCub1pqq`DMODWG7Q=mUr8IeYk+6WZ)zwa~ zJuN2ZC@57G#Em5>>fer9Gqvw$CV?{9s&x~b`i)wi4_ckI!<@J`By_Gy4y`2eU5QB= zgP~J_#-$GK^Eu^!_(h;B9rfUiNjY9hj&tzLve)$uq$89L5~CLwc4+5H^hqR3kcCl$ z>~fk7XGVM6{fxn1#Qw&eSP4$|(J6ruT9_=eb4t~xaN?8ziEK<~9Q;XYaXbn1e!#U2KY>S)`b$p_fEO!a2 zB4NQJ>@AK{beBbTz;QqWDR0nPa2k!)j&guuR&%?&11y_7yYwx5Q6+)a=u2k8wTWws zH}w67iSk)r@U0ChZUCGlWPRy(uV3A?x@FzaZj&2=L0mkLT$-8V`+Lk`W#ERM!INw-JOo$DN`XP|*@?<3BP1&nnNOjCXUq z06ZLAv+4##TavR+@d%hORRhCVclgs68gq~J(fjBUtjb~yYfz+5rKHY{){6X9?IkGs zg*QX(e^uB=>Z<7b_`qL-L(rw~W?iILm%c0t99;Z7vF>ezm0ozieH@;B0lW9O_=M!g zuYAD$u`0O|4BN%2%n1)lU0aD zQ;UIj`K!vNHa|ikTL1kV&sG#E1M~|M^8uHGj+(_LGV%hu;KaC+zzSkUo!G&ejG(`9 zUJIfK&w<3ZXy|rR;z|umL}2-TejelyP{2U?yWto1D<73ec8iI!hFci{Dn^v)fLc zVM}9ECPT@eg*YpPwWi8O%tt!}YAUv<(!-IiY>{~6r1KgnZ8EF{6!A#Y{E?oQlD_p2 z2`pPil!5qO=%P7g@OatHvt?$DVJ8~apto(6_PzQ;XcfU?{3Zt@0auoO8mnh&Cb4TV z3VA?I^t6ON@PRYIOWBi`3f7ElPsHdV(H;if@8bG^L5fn(%vys6f(xolo>1mcdd@QK zUDJ6d?dCv6ZuvtIZSWC}S_-g~!!1s`yrP4U=1=YCY!WgVqfu6mA3_4Z9NH?q3&QE| zQPRK9m#az;CX5%4W2sS=#;agWct`y>R`|5S>N|NcDVz1l^@6_SI+}RuI!pw~E~KzD zs&0kY11UgJO^Y0(7P+gwR(!sFist=k5#uYr{*Z8fHvvmeh0QSUKEmD`1oo?V&83zb zGm?@_!vQ(t0(Y`&iZ@&mxqN3?QxqJoi~15;aiTorQ*Y5V_jIBUFxq$-~tgSHF)x$M(c$6_-MNZstq{e zv+>h7DYnjS^mFhD(bz~jOCcBtQaySQoMdWLP# zYB}FiM9uNXk)kFEz-7O!FccIWt%Px>ti~+7W7m|M2WTyGwTL2v@58}%i?a>8L~9Jb z#{R>BxNx5~DBed(UNPa#YpuH-q|VbJ_02u5ls_E}arQ4xhci72ZAYGO7Z;scBeBMI zsqVbMTOkVJ!bdX!*NO<@kE&GaXW1Wa)~h>ka6d}q8JHm@cnqZpt8;|X`U;v#+ICXB zaC^3^AR4K552Ip_MwfmunP*$x!1H0x)yGjwb^}@Vd(#hZP0b}$vv$VL)n3-e)lA~G zErvOwl$%>u0y!a(%~zii;Bh`f{0F7%wi3%5Ep|!xKD(VluV0svL^^A(YQG^J8rrDEp|HFt5n@@d4&eHK<-@Xb5=ZW<|d5-Ii7 zV)FvYu~rNh?Swz_%X8Wv#p~VFzP2%bto*k6!&UO@WN_qSRtB5Wqn;cula)*vg3a|ZZaOhtVtF^rYUNWwYcW}56oAPiW(~F!SCp%KjYmHs zQ^m{Z9$nNnp`1{WHb9`}iVHX(W5HK?S{1$^^d-~>2GM*&=@}6I#f+Bk;c+Ku#>4KD zkIdC3=yp|{bAWf@zqAnP#drNKlkl!o@*##V>=n-rseLQN{D?$<>X%uvHnyYh7WR*-Fx=<;l2|lRj{8p#rptSy~`Ux`Hza$NQWb40KWfO zY2PgGRgAp=n?fEnWv2sryKD)FYG;}&#A&~jpyOUTq9>w@Q)$5}_~J-|qe(B?u&{p2(UW~;(zJTXHHla$ zc!bQV#sc);$GlW&USZp!I_TDjsvveMPcusnDXFFD3J}lq42R*|cdM3r-7ekyrc03h zkLWe5l-gu&JjaNqVD$U;i>+*AWrV+o#T(Yi7VkOlh@zvvil4r0i+>^CCRk(xm|ZrB zyJ;Wp>SqW9w3Fuu`tNjr){gUOWY$+=iYS_b!ZpkVy{c*dxq|7 zJ|K7r$?whYnx~5)`Y)K8WpmEtU_{-NhGsx{2_S{9fKT*n_S;WEf@h`gKRlfd;d%@K z_7nda?aXbZot>6|8XvF$&RnAx^?x7;?z&pF@k@9(>6)E4Dg~sz8$zIjsKTeug^!Qo zYXaWnRGX~4CIS9+hnYBeH_vR&1cF-K%JrNZIc8ewpYFPruP?n+civX*CVz|L6OL8u zyn?+M4Kq$)b^yMwpV7ljnk!7!D`{pNSqZ`291#WTOqLQ=Z?g{EIUaX6xq}Edd&~=W zQmiKxeOR3PBkj_F6e9r0cm)Q%!o`i4=Iq#kvtOc)wfM*rvd=%0#vAK=&XKL&X?Cf$ zdCfvGfVxhgQrtZGVzk!_J8oEEaDiH&!k($}gQ%BF>4R}Xx)10zApXVZFLZ=L`MFk_ zG{%Iuu$Tp*6ALH;=Sf9C0M~A&PnX?|dgsv%vODINhMI2xulCBtvsGBsUBU6g$HrBb zho5(s?O#3?Pg+{BsuliH33(}B!4u>tz5BkX2*%r=2aOHE;<2xsbM6xy>!i*p&Jrrg zsBpv+a4``z8>7;loZkKGQvT*Jr9Z;h&&kwc)O8#jveEd{#f*QdZtBYy(F;_wCZeIk z<)+t5deRNg{tjLp-H9dGtEexu(2sYj$!;`bSY3~qj(i&nJ9r&UZQO}i(DX$ziAc$9 z*7K?MmS?fZR{d6v--?v588*ONLnw^(baQzLu%Y(9WI;ZJ9edGVXXH}70B0g!<=@=V z`oL;uwr~1=azvfYa)nCw{3=CTG571|^jeAZWAiF(C|K}?edX!;kv5Ba_no+vTxKr-% zC&}*|n917fKb(iu#I>Re5}|e5<`J>uq*K9ajWF&+s%h-3&_nSX9c<~Myw~Z%|_$)`12hVl60AW7v4z$^&XNw8uNV- zI<}&{uGhSgv|UY7rAJOC9GN=?wDe;ACyhDL70Ru)V(iPRqMLDg`rj{8p?1h$Q`c=x zH?z&tUf^2u9UC__0oxELs)Ydl8HrwmPmJ?ot8<)HXhI1r7QzCq$8Tc6pL}Ya^@Zjy$Aie1z$w`S@B24Db z?>D!3pXNe7`Rz3WZ@qEQ@##Q{iX_NSuvq^OS8jN(c{i=q(?tEdBPl1UaHw?*ym%io z?1m)2t{J?MqZYSZ2|w6q?>e6fes!H(nf@Qp1$QvlZCUjNWdq&>-=CO`(pX^Pwrl`> z($^AuD?~Gff8Vs1n`~%i_1x?^=PEo;i}bvfNkW@T%s7JS8+kMi5J&b5`3n6^JqQI0 z66|QqW^{12Yw2oQGCYm%OXtdtBDKl+N&SfFKNtWp)_W`ljKa()UP}ol@M)wOPr9Q? z1@vWJ9^VIryvGKqbReM4y%3o!w(G;M%>%ug2xbg*LSMGJy{3Na^b%?@dTtzidBE_` zGG5|87sPHrwSl78bQ2-`pM%v29tqd+7*-{XIRfbNOH8r~JoUnz$Oqs9>Le+^Z>AL0 zgMQvmk~{cWwf%DRh!k_?#5Z@l(vl%*f}wb5=4fiVfhidGF{$;#2RFcI7vQIwTBy99 zlxj{XWdgpZtE$;hsuW0OmC+H$?uiFq)C{#tkz5NvCR+P>6o1Mj^{3Nj{oY61n2?L~ zcPL4r>mMhlXr=xzqS@p*e7S6h4W1&E z4zRl2`IWI1*}jW@{B+iJKlx?K&%7)6Ye&cH#ytQA0!f+0_WPX z!ADQKKxZ(%^c{|;VNNrTA}i)s!VLn^5fg#J>~NGcF|a;YI4^BB!p;J%DFyQ0#rH3B z(Fp=mjnR3Dvv3|q%tgr0s&%D{N2>n$`T5h+)0>;N!**{~i6Ii!Gwp?RCI*rrIGUv8!1i#5@tZL(P;_0-(=Owy+()4h~vk%2D<*kjH{2fd7FP|Tvhv_ zHd&-kH(v)rS_{S;Ts(gmv@fWZZ_#I&<6U2!aLHCBW%uFst?GpRHcS)6ZLj-Q@rM?W zzb|;d?-Wn533=QL3BJEMTUc0_3VFN$z=l&S&2*wQ6g;#DPla>hOO5#xeU2Rc>9|z7fJJ@Z+DA(L{$h!o5(NO2V8C# zuq~N-`}XknQaL@#-O>8Yy}0_uVb?=*q^=5oc1FnY*^O4>g=};~20(aOz{a`>A zd0W?ASBUM@e^EDjfu8`FVA$zmcjA&52o%GnkP&Mdc$RE(2GhlP zYIC`hrlCA6V2isRokY$UJB=f58J}{Se7Y`l`S}h0d=5t77%q4Dtqf%)0soq&GYb{} z1M40iTF(%uFn^7}0QoakHV!chCNr)DAuP^Tu~;Ir7uPVCB4vNgDP+el_)6iLwISlB z&g>q8!8~kkAk%P8Z2+R&+rulWyZ&_kJ=o>i_CjLKL;6wawNLL;h%{x;UhnwF>Z*FD zKiNkng^b_p#`Y{jzTEzp@cBOYuqFZv{Id4J@}U>>yx!8nk2EPM=@ea@Vn39QfPmoY z&mX?Myti+Ok55j9=sitk-b_hcj1MGG&LqbOP8-HDxdlq<7PJ9KoRLr`zeq6OCMblOLJ;ub=W{a zl4QSqD9vD_Cpugycu#z7BTxpGo>B&~-Wu5nLrZxutRP*Ihk-h9uUdCmd*`wPqT9T8?$+)xL?HMWPrp2lL5 zB#}I4=fNZG*A{mtUGw)_e}5HP7E*IYpInc-zW00Qs_ns^t_F*!A^%GZW=tPx*j&d! zRp$TJ>iPpR^tvw^-wyuk@=|c2sRHkI=v1Mw=hD#j-LX+QwV%4~n26b{S zG(ArbE(_WZks1PTy8K*!E$=ywB0f%^er*$dBD8eAy}w%Go;WBKj?W(YGUYbxJHKiw z(v2P|Od8h+rlpN)GnoSPBU!|e`=2>r8mCf^(tgMJOau#`0V6bPHX9ma)H+e1TSS_6 z36L~7`39`>x|2G3Q7+a%2<7d*W2~rs2hP?sq{xRyh^-PQJlUnRVCx%yaHxSYDu)j61w zIJVX4cd^SOX?fiKo~5m|`wtL+d0ImLFWwPCN3JrK-S%bt@kZy)X% z5Bm$cdNw|DcNYjs8$naN0mL$ns{Ag9T819xN=g5)5|E0hvFk5 zs)^KoW=;{fH`P%enJiYi7f00|G?_UdqNcXjT;k}U{1Ov(0ZnM4Kl{|{{1MscE?kTK z-l7r$#!^7!E2SrIa-fEC<95}O(zM|MNC!GY5QJ1h+Y5bUL`l|`{9^#bd`elztaSMG zVVNhpBR9VQQb2%=)-W{@IZ6;?w*gDxK@-4-dFrTe4y*U$)=$mz|9P2e!#w6`yRmUt zcs_;KPN8&9`mlq5Z!cEp|KTi3gMxV%f`|kohF_pOk^Zh#FqY#dx_x7*2I)Hw+hDn& z)ZrJ6H=(H){!G#&QAVDCweU8Pg_M?ZFz+n$HPHeA5i%7JbqSN4?q>fzOWrrZ{+#%T z(LqPW%Tvtb8$uH{qymk`;L*x2F}mDtMzJtY#^(*DODujyX?_-C42}0bD~lNlUTfjT zB=C?F?(F&4pZsX~+r-JQ1x)+pI62!SJoeknS}E6u>ZsP#V1fma2&t(w1I9oPI= z{x$r)z-An1-sNbFgB>uE;CShH%M9uy=H$bBOW}NplA_xJvLhLXhS7!k6)fd#@jGml zpg)(FKpRisbG5n@*-n4v2Q07ebPgZ-c$5AP-F@}!)|sFaxuwh}P)a~H%Y5}NS8T~F zuzltBY~^!>Yg4i8b*;C9uqrX2jF9KF*- z&9S}+R!qJ{G^IYz7YJ3v{y2?9$?Ggaf}p*@ZZZ*+sfGoH{!J@aVtEHMU$IOf4O9p0 zUbfReykD=LFXt`Wui(UjMDoD>jn}6qT#C|n1yF&m#{)r%@`2oFm5H3Clw*yMKi`&o zo{enxHJk*UycUe)!;@$Y-oUl8?zxQ#xrxz0>6XeG12kQFbq;N)TPAPPtmC_BYq_@H z-;7y3@_#RpzD<|5nT1g=PILl!lU(+?lP$Ip6J&AKeY1YRB3k%#zqdi`+?Ur|+eK>* z{?m0e*&p-WT$t#SG&wRw{bc?bq1EKmH%Uqd`?L-uQ zCraN+Z~U_KKA$FZT?r_6NFnCw>-qcXTQ{F02V}87LLpdaPEqGp4{O1%j$d(UXlXUk zAN~3j2;|%yGx`u=)!NONnMkn9ZxM2O<1Mz4elQ zs%_Hb73{L^QbHEPU!5xXNsF%srjg*Y;3^Gix|nW4?D+EnZH=YswA@=w;+ zo*%bSH@xU(YVEA$GWKXN4iyKMbheXBILDXJk6iR@_5$ICwd~etxl@z5`Vx?nzLDiW z2L0l$(Pt>u13m03W!&Ukg5KHB%akcn;1UvS{|2t6>%yy&mxjfHCwtVMqAr`4E$UB! zff~=Jfe8bT6NA5Z(tlSzcl~ZLKVA=%dd09Je4K-ug>fEDj)t&fuO$Kbanb*KiqTh3 zbLo2o&IlGu$^9lb>>uT^m6C#I_5{mKK7H$Y6YWr(k5>1rPrhe=X;T(A^SK8BSv;8s zP}f1?VjbO#8r;M!54`7+cDeArXMN$ZEFb(=;?cp4!)I9-dw0O}=OPeNtC_ReNT7c| zV<917FM2k&-#wiKiyu8pzmdIP)?(riPm5|`@atApRRi2tW-#9n^K#vLkB;m#wHE^x z#AjPv#rN1E77~ZV>X|D|dzq?C&nUXXuf@g0#g~_t>0AHO;#?CPZKP-P@}IJ;p4<$q z-5fwGr5Jw2c^g9tNX*D@`Y(cpTIX^FU6KzD4j8aBwzNLhI*2f?sF~PL>WmC+~8V03~nvIOY`CMk37lb07d}3 zS@W`DKvrVHMm(D5oeV|2cvdVr9+xbfx*)&uzKO zCF${Q<*ZDMW z!Hu?&XD1SI^fqyYe~7G7($%r$-*ho!g*#q%>1Dr4tXb{d-roM`^1Z#IBfIVS`+sHw z6LOvX3_xP@i({SFb%_r zz+H?@`VJGy|5^s@xATNJp)9!5?6HQNvjPdqS7zwh|Fxb#cOL>s{C|?`QOVS2`;NTz-*u{I<=Z7o%rRkLA-^~Fj&=+1q zOZOhof5Rj1@vkxVKN)n!sp9;(%&SyoK&dRNc;R0!gtG_!vv?}NB{dxQ7is$63;e6t z{~rVTzjN*W=Su%8&2Idu!yU-<1HNFFprEh!gU4JMV>=xI_OZZ+_N8dB2wY>=13zm3 zbOEO1^M8@z*nT&iDR!Psfiin(Yik3hMV-4fr@2F(y~qqok!uMA}RZRZ$?}q=6oIOw7AWnJUtNnkU@&B5$_y75U{td6r|BmPT|NGzQ zl#a1ZdQv9CI__!5U)yB@KlXSaTl`ks6Np80aER`I@jzo>WmS0CJ~9#yJK^00902M> z9uo#OyStIZg4Vj!mw{3WbsOg~z&`;o;3+`zobToSOggJJ0U;qPx?c>?0072wdwUW& z%A(!d+0HJ~`;Yb>aNbzBkjU-S*U-=ah!MJl{gaa}-`{z6GZInH5=QH{SIPW{;%i0P zSk#G3Ye)=Q-PU&M4Q;V&Wy3Q8r76vj$(i;eJf)WBJMF(mCco!CL2t?|RR39;1h+ zqL%F|s1cs1En%k*d3cElM;V@^X4*V+)nNmPxFaY%{-OizDucqs0%*Ar0F^L@cT=Y-(`|>*B}b=~FVQs;f8rcgJ&=+aeT*(EjtT{%Cdtaurp_N(}q^ z`xVkmC2Mcu>i;Ij*U)<|wicAVcjwK2lYL<<^(aiCj`6Di{*5erho}dq;n(-L&*{ix z%|DLZej;znr$@zopr0AL **Note**: If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 Education subscription when you request Minecraft: Education Edition. For more information see [Office 365 Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). +>[!Note] +>If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 Education subscription when you request Minecraft: Education Edition. For more information see [Office 365 Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). ## Add Minecraft to your Windows Store for Business @@ -103,7 +104,7 @@ After you've finished the purchase, you can find your invoice by checking **Mine The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. -## Distribute Minecraft +## Distribute Minecraft After Minecraft: Education Edition is added to your Windows Store for Business inventory, you have three options: @@ -113,6 +114,7 @@ After Minecraft: Education Edition is added to your Windows Store for Business i Admins can also add Minecraft: Education Edition to the private store. This allows people in your organization to install the app from the private store. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store). + + +### Configure automatic subscription assignment from private store + +When you add an app to your private store, that app is available for anyone in your organization to install. For Minecraft: Education Edition you can decide whether or not you assign a subscription when a person installs the app from the private store, or if they will continue to use the trial version. This allows you to control which people in your organization use the trial version, and which people are assigned a full subscription. You can reassign subscriptions later. Planning how to manage your subscriptions will reduce time spent managing apps and subscriptions. By default, automatic subscription assignment is turned on. + + +**How to turn off automatic subscription assignment from private store** + +>[!Note] +>The version of the Minecraft: Education Edition page in the Store for Business will be different depending on which Store for Business flight you are using. + +1. Sign in to Microsoft Store for Business +2. Click Manage. + + You'll see Minecraft: Education Edition product page. + + ![Minecraft Education Edition product page with auto assign control highlighted.](images/mcee-auto-assign-legacy.png) + + -Or- + + ![Minecraft Education Edition product page with auto assign control highlighted.](images/mcee-auto-assign-bd.png) + +3. Slide the **Auto assign subscription** or click **Turn off auto assign subscription**. ### Install for me You can install the app on your PC. This gives you a chance to test the app and know how you might help others in your organization use the app. -1. Sign in to Windows Store for Business. +1. Sign in to Microsoft Store for Business. 2. Click **Manage**, and then click **Install**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) From 59dfd0f092d8997636047c6cd4777ff523fbb892 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 14:43:51 -0700 Subject: [PATCH 122/165] exclusion fixes --- ...e-exclusions-windows-defender-antivirus.md | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index d9be336928..c8456fa9cf 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -34,15 +34,15 @@ author: iaanw You can exclude files that have been opened by specific processes from being scanned by Windows Defender AV. - This topic describes how to configure exclusion lists for the following: - + +Exclusion | Example +---|--- +Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would excude files opened by:
  • *c:\sample\test.exe*
  • *d:\internal\files\test.exe*
+Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\*" would exclude files opened by:
  • *c:\test\sample\test.exe*
  • *c:\test\sample\test2.exe*
  • *c:\test\sample\utility.exe*
+Any file on the machine that is opened by a specific process in a specific folder | Specifying "*c:\test\process.exe*" would exclude files only opened by *c:\test\process.exe* When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). @@ -64,7 +64,7 @@ You can [configure how locally and globally defined exclusions lists are merged] -**Use Group Policy to exclude files that have been used or modified by specified processes from scans:** +**Use Group Policy to exclude files that have been opened by specified processes from scans:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -87,14 +87,14 @@ You can [configure how locally and globally defined exclusions lists are merged] -**Use PowerShell cmdlets to configure file name, folder, or file extension exclusions:** +**Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:** Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). The format for the cmdlets is: ```PowerShell - -ExclusionProcess ", , " + -ExclusionProcess "" ``` The following are allowed as the \: @@ -110,18 +110,17 @@ Remove items from the list | `Remove-MpPreference` >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the defined process: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by process: ```PowerShell Add-MpPreference -ExclusionProcess "c:\internal\test.exe" ``` -For example, files opened by the process *c:\outside\test.exe* will not be excluded. This is the because the opening process is located in a different folder ("outside" instead of "internal"), even though the process's file name is the same. See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use-powershell-cmdlets-windows-defender-antivirus.md) and [Defender cmdlets](https://technet.microsoft.com/itpro/powershell/windows/defender/index) for more information on how to use PowerShell with Windows Defender Antivirus. -**Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions:** +**Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans:** Use the [ **Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](https://msdn.microsoft.com/en-us/library/dn455323(v=vs.85).aspx) class for the following properties: @@ -135,25 +134,25 @@ See the following for more information and allowed parameters: - [Windows Defender WMIv2 APIs](https://msdn.microsoft.com/en-us/library/dn439477(v=vs.85).aspx) -**Use Configuration Manager to configure file name, folder, or file extension exclusions:** +**Use Configuration Manager to exclude files that have been opened by specified processes from scans:** See [How to create and deploy antimalware policies: Exclusion settings](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring System Center Configuration Manager (current branch). -**Use Microsoft Intune to configure file name, folder, or file extension exclusions:** +**Use Microsoft Intune to exclude files that have been opened by specified processes from scans:** See [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) and [Windows Defender policy settings in Windows 10](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#windows-defender-1) for more details. -**Use the Windows Defender Security Center app to configure file name, folder, or file extension exclusions:** +**Use the Windows Defender Security Center app to exclude files that have been opened by specified processes from scans:** See [Add exclusions in the Windows Defender Security Center app](windows-defender-security-center-antivirus.md#exclusions) for instructions. -## Use wildcards in the file name and folder path or extension exclusion lists +## Use wildcards in the process exclusion list The use of wildcards in the process exclusion list is different from their use in other exclusion lists. From 3a56a8b57b4a3df8d72d68258f00d9776b178f58 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 15:24:15 -0700 Subject: [PATCH 123/165] waas-wipfb added topic --- windows/update/images/waas-wipfb-accounts.png | Bin 0 -> 75298 bytes .../update/images/waas-wipfb-change-user.png | Bin 0 -> 74115 bytes .../waas-windows-insider-for-business.md | 166 ++++++++++++++++++ 3 files changed, 166 insertions(+) create mode 100644 windows/update/images/waas-wipfb-accounts.png create mode 100644 windows/update/images/waas-wipfb-change-user.png create mode 100644 windows/update/waas-windows-insider-for-business.md diff --git a/windows/update/images/waas-wipfb-accounts.png b/windows/update/images/waas-wipfb-accounts.png new file mode 100644 index 0000000000000000000000000000000000000000..27387e3e7bac46c9ab621d8581f10f545d4af566 GIT binary patch literal 75298 zcmYJaXIK+ov^_i_5I{--C{k0TOK;Lb?;S;{(nUl>K!S7#H6SG*9qC0tkR~7^(wnGs z5CQ2ZAT3C*|9F4*zVC-5Gs$G0IcN4+d(T>HM;jSv(p+J=0ssJwwwBr*002c2xBDm{ z#P^M24SnJV$n%b-3Q#$~wnp3`byC(>27nqo)tMa`ai7v%%iI$H*m3_}Ap8o!5dbcW zwbhjG`dDvdlVx4goajEZjQ;p>yXRJ|2hY})&kPo}xJAi`R6?tvRvTHjM8b5jO77lH z8v(!P+-~}2L?}H^`uSwnFUY&;V^hl0+ zMn+ZxJf{&I-x9!5s08)@JMZPDYiA_Q9P|0S?5U*7#9gbOdyM*AWMUMt9Ufl4wEy=! zZj|ZphasWwtJUG)OJrypHz&!LyMss+<-Y@VTRGY%@lr>Lg1bynefkT(s^`o!{^ysM z370g{QU_t~21madR+&|`u=2Acr|TJcUk2yUz2-_v?*0$jE;qwzNOZb{qGQ|G)V-kehq6bRw)ueZP{vAjq2~8+pxx zz9Y!l?sskQq3Lb?H<$NXTex-|4!iqzvN`{ow5kW?@qZK*Mb+AV2VWCiNHFA@u)O8& z_QUU9rB!~v*O$8=f<8Dprc}InIj-0#>K~5zWb=DQD#5$B|E6wWV}EUhj)_`r%d_Ic za={Hss_*ahChiGU>4f>GS)?AJ@7rtzeDB_iY@ypr{&%^$Pg+CY%2r-(bhQ=hP~^|d zVi~G-2o^Zu{fOcKu&Cz?9bG@?&eedo2-Bi{htuQ6T%E+*T9^6=%~SW8L(TXfz4219 zETy%SOLsrG*Y}&IIeV;;=-ZeUtnpLrZ@vf!{8*dzx?iYd3(~pOCPb zyOU8XX2W25?eR$eg+bx_!FLkA_ZkL0IWn4RwLHJanyy9Ch=r+fUgNv@UoZucS$f^S zG>;B3vZ?pF@2tXG-)p;_S34tZRwmiE>u53cDe2))W8=9Q-(qe>pTZX3`RCsnFB!iz zZEJjMI((ge7TY_gu)Jp}U$R@JS^DJLv#>p2pXsu0>Y8<>_g|q=IbYK^Uc-)$fBdzm zzuBm~`M2`U>Dia@hMhb0f{kBKZ}K5GPM6*<#amvpDoFh#w0|!3M!$Xh@$|dM*)89Y z(N9Kh*Q{5YEALK}n%4X5KVbO9GI2db-a+Som&oO=3H$fp=k~mRFY9lbmZi&@Z?@6& zw7uvH<9(%Q8e@5DJk~h=dtDOk_?~$D$omrbTbU9>zONJfJ{RuEuk`a&_QCo9%cUxo z(bbzN27RVKBF!@!D?ZMy1xK(1w`AvRHW%icJtmjjYDr<)pEQa4=vu>|n-0R#~hI<@F zX}4JxJX$b%FnadxpyK7H#e>UP0{Y9|U+CCmq-iOrQk>7;xr2H4*m(l+s{6<%G&(3?) zjmVVvKY_*PQM)uZbLG^(ShiL;a)%f5Y?l?6Y`k45fmd`pv6ZSjZI-AzZIyJV1|O!& z*X~rDOMdKG$lS3NOo?ZITU%c)>1-aNz+|BtC%2j3`*FKSGpXTT*q-8_kgtks`LT-S z9#fZV3w4U+c2fCihk}#Y3FJ8=Zapxox~wBl6X-|%ui=+C#c!wmPD9=_!k*eW|D|31!Pb@09L zr?-^Pb_KcX{#@>dxI>6{Qb%XQE^G1DqaVJ1UpBmpb|g>gGGIpVLXRgqNs}?@3hZathZS&!H7;u$tK0<_SI}vV3&C>#&#M=R4yosYPY52jxX0fg z?Hu`7-cW2fH_M7EuBoZE@rxOBbLbs+beQg`?4ElkYB&8-eT;tE%_+vszacl9Y1N>( zg_c=*fAv`9gK+Y_)bfDO)Pg>T*YxFoi|AL?ynk(D8*@>iS~m%_>?YroIj;W3=8p(w z)86pu{(R3PuzCG%?x|0^xu#1$_lM7^C1$4Sa zF~L2zASa3}lZlGGfWp4;y;{OjkHXXR3r+b4RfV_L4Y*S_H@wc;cT0FTBM(^MYc=l` z8hS+n^`qtaPK_t@n}s?)j69S<+s}scuAhOuV%$ar~01-rBE* z?ohQL+>y^MWiPLc5X`!qq2Hz5|7n)BPQR5uJLWoEpl;FZ<8jxN@j^u<%YCq?;Yi~B z-COs1s$DmxesMlwrK*B6<|_7%4|Wpp+FEHx%9^OR$nduo_3IyxqBq~S4o?s^_2(vM z4uoM~MjW)C?bn`6C9k*UeQC>>=@z*B6Kl*wODec-2lM(R?a)i{gVXnpgtgNk@8-R) z=h<69nVz$#%(J0=?ns53R#K)6sovvqox-M_Pp8$|X8YhBVDsRiK=a^X@BtIcD;Qk= zyj2TcK6Tl6rVK5)RE9cUw*UVG_bNZiPBgSjj*1k#2 zjWv2K-GHrJBp3wbjN^Z(Os47t_%3eap-}qZxt<5c1d757J4Lry^#0nYrf|zq0gKer ziuZFtmUBU;u2<9iB3BloFC8rR(YI2)8ykuj!n@NXwf23+BaTp?j$9qSOFf5oEDn~> zA%X>yW85(sbCiKXMcI=<2+LIlyF%!br>CF0+FVWoT5Y9J2eBz=ou9+MzD>L^aeH*E z9Xvi|d@$N%OgpxoL_4-9emFAY>3x2@9oqgE2~DQmHreRef{z7>o#oTgjn%`p=|Hjvf)BaO*p9Q8;@yc;G}_CzmTM`u({waPf`soZK}^5)p&uF;8!-%!yIudk{6tb?X} zYTetaABB@D&X2@=cwOZrb$+NqOEyY1^(f->nc~tPzIgreV6-=Edn9(e@GUD;cJFp^ zuZUUA7;p;+`t$bv#Alw|ib2Io^zIFkQk*iofLwEorQ4@_a$AiKqzSn}C(fkdfPHJw z`3*d1JM5HcBjmn{Eb7unsVYcNYhPrG(z%Amwg2j(#(DlaoU<$1kUxmZ?tT>}ctz z78fYZZIHfxg}##GKGe4d=eB`P_H; z^)jC5POfsinhp{ZZM2k)7p#Bb1yTOEM=SW(_s62M#mE-dH~A%4*g+0t`&0dL9k^}- z^E&vTjQ(}l8^pW0ucD(`B@7MtRM{ua62)~@pCUUYjzgyJ-fB`SE;kK2jLld6&OXNJ z^=g$_IV@H&gDoJdHY`VLY6=cE)`RTVF|A6SwTtd{E)j-TT9cD9KSaZ8kRjPs~yItA66LIJ-X;l7Gs2O zv=wf#PODfGoN?&#KO9=TmI241ckwadE=AXKAMV#hGfd_CSr86kJQo%T35NUbBQc7z zW|p3FFRt+?r=%2j(#q-KKI)_>4U54KULA_QgUMeakoXuiCD z)b20*X#E4Z%fq;zl7G)WN&emd*UwYuh@bh_uI{CG4d|m&)l+}`hL>qW$0S6rPCJ-A zwbvp7b7g#vsD$=;lJXh;al$b%MI&g|gNKto*Eo@*jflC+=}YdL2gbb=9+w5UB=1^s zJ2wu$BevHsFN(OeKbCeTSY+1wrT6ojzG7-YbWz`72~n1N_?5}Z`=^)e!K8y%2PMyH z?H8dKr34p3SgvOdpDnv8wb_84qSxBUiky9$-^0fM$pRYC1xT7{Uf)k}YdPk=fmFI` zUTqul@LT4!?oJjS;T&I)pRiqL(^CUT#aexTHjrQ0Aho9X+6U8NiMiQhq#9VZJP= zpDiodghzKU?ozK5S&xy+yF(q-5aA5u%5H>xyZ#6a$(A`5_0bm}W{2L#0>M2^x>6`jtM?rD2?@Fwq`Zceh6_BUfa*vB+)j zSzk>Y+q0;xPlvO8^Ld}N!qAIejKaix`|h5b@yYP7hFm>rID8oG_e7ieQG05%eB^Go zaed=?Os3ZaDl>Q>$HHe|*21R;1R(_5FlNW^w8@0CKeCrLdN(MiVx#EevhlX4UXQDI z(xFi!uF17r)7WQV=Xz2HV$Zh6W=zCO4tL%iZl|kA6D^;0apA-8@*+4@u_p@Ui(9p% z*lHhr)FvLeY*ij**SKGM>*NYL$en}wS0aa|2BYwucMtWmpHDga9scy@aOVjECed71gh+S}#ue_Lqk8CFjuCtVS(Mr$eay8-j3*jqgf|ED=07^0UV1e!|Figaia)n=^yYmJoBk z*gC%DYg4f5i{&K4f`f-Q6QsvNoW*uEf>#rdRzuLvNlGjfe!fJEDQK8)8M;U&H2)ol z(YpGwd8dP_upv}0*MI9nDccOy?IFXVr2)C^3ijudsFBOtn(Wu=$yXjwoeM9=a5l^h zn0(S-^ZXBdr%mX2tBa>DJ@OuE#U74sjrV3l;>cGG^Dk+G(?X8jswx~&ISDa_Qs~QWvbq##BYCn?O@ss zFCbfq^RE`k4LtbK_wHz?6IytL_5VGPU07EQ16_&_qK!ZKAI7sV!+=;{Zjc%1Dh=zc zu_e4><>}T(LmC!|D7Xcf394{pOL_;rU265QAtzw>b02F6)5+mBB18mGwSZ|9YQ)_r zkRcW(90`BM%S}nGVSQhOTiH?=j2>hz=HuWa?A|kU^1M(+%=72ZNe!^WG*UCLkiAZ* zA{$+wXfGRsFF6=O9VK8zL06vIh?VY&5SprUE-c9nk|i-yqE$gQyG}PGriIWhdJW`= z{rde|b1j=Vp4&hAu4f~HjuwVh11o$MQDAb~*tQHbFV6!Vb5tUupoQA8kp`9pixWZO zcyfGh^e^T3Z{60=&>%hV!RcLt2cHq>$_hL&(K(NFr%D`p;}dyQe&hyU_*%KQlbvk5 z8!Tv`_5vEqZv;;9!GwKBt9HbqbU!NFGO>-ACj@F{-z*0vI{wc!B0=oCt0cN9zyUT2#IzV){_-PTjEgiJFbEMliF92Amw(GoG zZt`~Z!^hb2+SuP(SH-rNXmXV2~|4<(Ou5 z1F5OGtoz9)NI4tHJ5q86Lpm0-&BO$OZ{rb)3RiesD{pJ;o*ymYIYz?T{PtGq))HmG z6Nd8p$gX)5 z33EEWm$$rn-eGr;ZhdiSa9*k7YO+uF6b+uV#>E}Px{Z>Gp7lp9G)zB@nWeQG5(|#! zqT-EZk-Yg>0Kz|dMe_03(bG&aJm}9=Amh|45(E>EJVm^4i zjscurCj;(EthU8$uxGrQS{%tK4i(;giO!N!pieNo^h{U|Wyx8B!sgZf&ytHO1}lpuZN)sD`_?w#|2VTppLeWC<86UCkt$p zetJ(@vjyv1Cs&1EP1ASn6z=|I0K?mc@>L6uZ3ImFLX^J(kokxAdoS%i>JEmNk~K=VjTZR5lvA|&G@blEDES%}cCu{Q&*&KCgfsIc{e z%k0ji8IqhGJ6J9rh> zZZk&3`j?VBHW4e}!o8vEYHAk5=^F7&Fmh75YV}tDw|1>Bsrg{W({QutPo@1ET6Wbj zy(-af^y}~uyFnS_03Ydun}dQK^+(dnl*1yIcul3_4+D~WeWFdjSaO(iptCw?QPLaA zjSxy@`{Y~+;Q8wYiZC+@Drb%a_;R-=-4;&znWtyrvn5fb`}yp=-jga;Z*V*fm*@Y& z%J^jIR|7G$O3zNa+HyjeazsVk1|+C~xqMaJqc*X(;7Ktj+BR|Fuh^cKWU;+yF^zcBX*{)e1R%nnU{UZ+zkmbxj^59LB1Soh!HT^xVv=NUX5f!l+1e;7^&n_!p zjO9vHH!o50Z-nI_VSO+CBFO)QlUqGAkoED#N|9cF{c;sr=hSzdy_W&(O7=sU8b*}^ z5TaT8wb}a+1>A;HAQDuo5_J*7E=ALlbht;(WRM)|CiC3uy1%~~<{+Z6tS99tNWLdO zmHY@mVGH!xv4ffHEXc4RSY_kli$`xLbeRnSUDo-|OfpVXq(}xY_``%lh)ehAPh-%mb3f;mi|HbVnG19cYd=7z+mMZ!;;hg zM&?ytWHjZ&0U79v4?L@2P}UC9&aE&z8d8fzKA9tImI zuYieSqi8*!Ju8r%FC(0A&wrMnfz!@K?Py#x7HoG=>XTXp>^nQb38({icGRG|p5H26 z71o)*pSdz$Tnoo1y{M#D$6z}U<`5+?7ISbz2qC7TQOD{Sf}|`w^N~eu8bQ|EVn~Yg z5jO(SkoDd#6m~bG(Ub2YPM5g;Wr1~9ooTnHr>?|I@YR9Bj~Xll@FSyo+gL^JgYSau zbFKsSW|4YMN)%WMI9QE@VqVl8+6F|aP*Wcz+#0>E*9wD{r!|6X6O`1NUBMJ~6p_L*z=F6#w)KHm8q=s{~lzM_LDbS~Fy#9E+>tCkU>ueR*>50I$Y(2kdmnGkG9RQj*H*ktem+x(K9s4Z!_5fb=8u*{^+lbXYZ-0;$c6y3&mI zu~*^|c%y02927H)6u_|Vv5{tr>~}WHt95+5SPc_-{cz~Ff!yX*d4KG3AM4Pv40st^ zqWXy-lwPSi*rl3=26s>?&((1>;l_>{!o_aGr*Pz7mpd_Zvs4V>byAt(KF9~@gz(P70Diw$1?g!dzzx5b$-DU(x`CsiS-$?*W1R14#QRpYH z^{^6yl7N33zERH*q@_m%QZVaJrs}Z0^5W#SP>vgt4Y$UI6;BR(w#aOxk>g0pUH}EI z-dOnK6cy&{t;G%8FNJnUT!W5)Ec=VBK1#sNGAKqh>Z3IKbh zsI+fXloPg|Nl}na;kg6S;R8KH)OL8+gJnX}gZb-n2pJWV*a}!0&_gppw5rW&(lZ8s zg$Y!Q10+QtUr`#8BN7$hhLVPCQM;yZ^LxYl0Qq2K8MKXIo+giKQVe0}2V>?`@y$4e zpix4vqpPh!TIdvDV+`cNEDU~@*Gy<5pMOaUhpsrxvfn`=wxIjULmXY7$peTW7}XmY z#LHoarc%xwiM^OS+b|HHrB>6rsJSeRTxbV!5=f1q{Ck)@#PVZpE5pz74D4{4v< zZ3kF1Vc@(Aw?6MK>=~AcR#J4PwAKTxM@^+qT~X<0yr(L!f2To8bcZ1)_%@iaNB3uY zTZ^k2V?}I}`l3H;=2e!5MCHi9uG@t3fZzRW#tB?9C+#fEplZd?Ssh2O3d3F*0#k&s z;z{!y*F&9e41@u2?346clwpYSMCTllbCr_?xDv1p8fjbPHXK>8UQB|IqOlOWeCi@y z3pNLJRcpN!+jejZRx9dDPGi6%na>g^@p_&%yolY#dmw}Lx1GSs4cC6aIeaflGjo-M z{kCE}B~=^F_WYS!DXYigUzJiS=Nrp0-#gxcN7V6Vmp&Btsn&3^`TP_KN68FUk+O97 z-2y6%%10R9FJF8yfp#;}NRcAFwm>r$yc=5uCHzQ|S|&bdk$Z6ntra-*8=yzJ%Q*%1 zDA(CW3TaA(4CluG&R>RFE#rEo-sQxoiXQm^5+GZKP_Z0*PPM(VXl7^w?vagF$2}zhM;(E zfdS)bW$!<;Pf!2kkNq6yb-pgC9SUn0?ffiPdV6=^@dNicUdktGEEaGvQFH=<9Pzgh zJ-s?y^fv3)E$$badqzYdX>17=D1G$wo0)i@pSj~FGZgFXh1B&ACk-`?1n0Z04Ikc~ z$P?DWcaE0yU5Tnv@K=-btj*qzf3lK(#5*|#1)v3EC9qmF4A?w=TZ{6qWHd2P+#d4ZYSWr0ug@n>e7 z#lhwA%2%+&cX(%)hG`i_C8vL4V5m#|__5R~{AWrXzMYL^QUlN9R@`fRQOZ4R?>lX& zM}I)tpti#V?>}?c<9CnSklb04FY2ypCA^}BX0WmBOZRoTmprW4bTKe%(YDw6Um>;U zpO8vtUp=}l4Fh`?IS$Lf)w&DHEC>gGE&SF&7C}Am;XyYcnQukzCn2ol2f@aSmcO!k z#Uoko-D;@npZGdn6!F8)+g<->QuAB*SJ8B*OJ)4jRPfi4E|NyYtc&02>AY}*Q{(X< zhD9G5@k>LRtbxu91O9WU-^^|)UdF8rf55p}MjQ6$(LrX*M6ZsxQz+AaHh`ReA}L9i zk-0kc*}NxTvXMG9cU1RiUENRJ%-~-ri{}$L7S9i6EgtV!`%Qo>c6IxHkWV>C-yt$u zCH)$DMn85XGsUX#vj}(GmhO~j?Jk0}tq?Im$eFX7&j|Yz6$v>{KP%Je@Cax;EDI*c zTUu@esE^T&;3<-)5OudtYA(-|38bxrfKcH-u>JRraVwo z2=4A2gX-Sb5GNX{mf^GKRgXqwg2%Hw4~CoH9gc;HAB=PuAJ((&#Pn6XyL>|loy{K^ zcDUE@toZc+{|N5<&!3PjxwZCK#kKZ5MUDAcUNWo{s%T^5FT23KJjA9xiJ~;^shLk< z^5(ufUS80@?Doi01ER8!+>kPQk;KADq+zU}qrcC$zc=6O)TjPa9))WE&-!B1`|s9* z?B@sX!t}Y+TU4)!J~3J=U_LqMG-2`i?9AdlJe-Lc&d&_EXwM9qrOWghm=d=Hh-MR5p z#ai8zCyUaKQj*$Jx_ECzBm8qkHT<5m9+U_1pks2-`4z9F#Sa`DW1vJzoBp_raLHO*=ITJW^}Lxc z8vm|rNiZ>&CD?&Jw@3KXy}{qtk&siW1I8Qko)R58`7iouZdx`Ny)*WI^k@kuah!jW zc{2Yk^QU;q1_~y3`xTVVcK3 z-&Iasoh`eiUO)c&`?trVe@%4tb+ZMNryiSPVrIQ8HeWpTl=a#(sXBT5qrB2WCVL{{ z{d%XhH-GS%W#-4{rTf)JD=98-Fjq&psz8yZVsry^)@93H8rF)-_d0f(9wor={#r!h ze!tEq@TL1=BHWH}7>-eq>7$|~{J>SmrKFguEZID_j#$Qmg4;- z^u_*!5iUXD^k^x;Bmm8s#jz@Qp}^T9kem_(n~FZV4|OcsAh=qcvnIHgV^$QoV1}plnvttANM_!JPG&`pL7+L&0^2V)LQv8xEqyEQ|&VzFde^3qo9}Pj9%4^q*>s~)gHZhHV z|F!OGyS0N3LQu|TQ^nG=sICY-Aexh#q)E%M6}D=M-!0=T6Iq`yd6RCQaJ zuC<&0ig#fzI1>S2EmrfEWC|8b?4GjF){-{=6+6BM7z7YwpkuZla!r<*^>_2=poLO% z8hnusch=#Xkf7Nd9-@*H@JQ1lfT~??7ZaouvdwIE0J_0peKwyTK(W7|5bq1kbz?0R z_Jy#A@4kbA6Zcd;OyZ=M**iW9CyOt~g!`+=bkxHPd{vo_!yPJXJPevZMyj%79B@(! z{PlHugkpH2(6PHg(}wD?iiNVu#eJ$noX-MVKD#!DLY60nz8||~4iA$|UbRV%_DK$L zSbR3%(QGhDQF5`T-4Ze{M>mxt+;7ep;W>hWABLZ}8(4kNxLkR~$SLriZtol8;ya;h zUkbvjS~|}uJhWdq9OO4=k?+u~yl!6pEIERN&tZ46Ar3Fx(2coA%F%yOI_hE%c_KEv|MMd-4)Xspn-rc=$#4^`xu;jH=h^gEKsS4kzHpc1%Y7Vc z0>4?^0Q-+OmTvONgv3`~s-2@00n1$$vH|R0+zxlg`LZLRaZH?;${}Y}p2DO^kct_T z$bBmI7oHFirLRhq#}N`LvJ27_&UC^TEZG@#ybQK&DuER=YE1#{U(()Vp6}9xNiM6G zI4Mg_crF$SOgz4!fN;4jRmqSB(zBjnjSou@a*mMYKxHi%T^{|h zkR~dv{?d41a1U8)ORvSfI=b&shOZ)hmX(=U?H1VBl@|rh^;sx-AT|;2Vj&2Ymk4KA z?z2eGgMizEclf$i_yZY@9)J`Til}8#@N;ZS`}gBL@sUM~QmOp{Jv#w+;gtu2l8YSo zsceoM`gUq~bQ5>3$$tr`=A>{5yDdCIdw2&DE;2Bz&&%q+OVevNn6^^kbuINhPb{A0 zxQT5ypISgy#d@X_7c1b_8CW5L6=K@nJ3p%&*HY`7q+H?N>JG);r*|dp8}Ni=U<4ee;MQ%<)NpBh~a#$d`8m5pV9d zs-?t0N}s8}xS3Wo>GJvA-b==1otS_YX>E(C@eyCD6@FdKFV|Cr-rUdJz>MDgFzGD# z%p&IHCTc~x)sBuX<;N=v7kezHs#DQu^;c3|nd)Q^Bg2;mqczoNz)s*UkPaHSUKQZ` z1>0$12eb3VRoQ3@*D=t1ZNvI#fkilIvD9tdAN#3!M+(C32vx9Gu*#y171@kacZwx- zr9|dIG(l^z%59=~%II~?CTi;nwTgSG7+ZH(F4?wOVv2B34d>^u#xbfJ9PGOf^623s z1(o+pgcknXZwv9nguzSs!LObze#?`>DEr;#q0Tmv3U7J|+1IcEt}Y}X9eLO(G9}Db z<0aqn%6)Idi6wA5YT~<84ME|5NmHs-8@grx)ZczX7*NaJxm{!6=bdce zB6W+~wfx|+pP=}eDf@ei8jalH_cocB`ZqJF!@I*4B74mGgVLHYBLhP(mZ|D*tX&b* zZBf%5dHkrx(XPkbBEh$b@nH_*=g`J;MT8ujAU-gD7W-F1m_ep@!Rb-7qlX5KVBZIA zevRhJ{*ROG$Rd5PuaGM{9T#ZaI00|s);ItU7%K+f?Oor8^cXrr#x<^|aud#`uM?^*Sb%i7IE z)OU3V0GlKWLy@tndm#oH>`Enjx)d+>NKoNK11Oar)wHk*b#cqq^TjTYpPxDGC-XA6 zBd?zhj<>rRjwx3ej)L3<$7r_=CWPD!N8zpy&(22tB55Cso7cCplqK>@J-WAcGezj; z(5|vq9n#r5<@HA1?$eKE2X~wgep=8-xN*YHuTVAWs{b`#b%6?4E#31$?5;S~l$+$qabRdl-S zsuv|eOjrbAm;sCfg?A6+sUrZM6_UnM9xxl0+#Nu-feMP71=2M$%@V>zv)i#wAas!8 zD{1P7Q88pIfEeQ&RURy=h&&N8M2;M?91;h#KLU)@K1zug;Km*^HNe>H@CK{|;zSzl z=`gR7#|mS5#6en!f_94@kvzd8eX2gF5$TiaS@TI~L8vq@57nRB5BoKkhsgm-ZNPpt z#(!8aFg8flfB0!pOeNh`iH+^Pst}gh*Il?N?g!>^T0xUm{ahDU?`_1`jX#-W-)>=!&gh@q5@tzd8Cm z{@|&MrGLY#^3A#IlI*E(-z(jOkJKNuHi&z9_I_rmtGiqNCAHjM`NafH(>LpmoHwgA z^*2Ad75BrZ%hAsMDO|3mT+`(e&b@*!#dLi+zNaPWdJ8<0=e=VXLqGem`N!urCyH;&xf@KK{ zse5!EA{nlVdoU!Lpp7RAH>1ud2sUnj766WXXf~MByFx0WdX=E92qhVi0ybR)n^`M5 zzq$jWfI%1(VQQIOC^Sw~U!lX~&Uc^{Za}o3@>jD|80m=}P$=FO8UoEH`$8wL8ng

q2YRjQy47r zDbi%iuA)E+8(#-tFotpkJE^RthY-y4qYU%YBjLXcY?j ziV|&0SI{{r(zaaGS4v;Sxpa}w4@;he>LJCO4V4&{C}MIIR6iOI+Ln!OgN1HCow{;9 ztkCu0caHy!pLBSFiemA`ShOfaG!IJgqDAW%@JiJ!831G*?N@9nlb#Pj{gBX;TZj4l z)YqfJ{WI1>lab<6vS>>?>O7Zb1V;HohidSMQd+)2-+vFuCn-^DVlGg}%| z3=eH8KTQb@<-B!r!9Vw`bNHw}RlIp)bL#oRpfH{2*NM37hozS<#opdLR5Bm3Dh9ia zW^SD_H+m=dJy{C8hMMfC(wge&2s#x^-n_eZMA5tQ+0ys&`n~7V!;6256sN-`zZ3bU z=#V*D+ndf-YShYU7}5$drI3M`;)r@GCWmZs_qDr#DAu54g&0m7AoU8gENd5bXl<<& zW3LoX%M=B2e*hb?V_wFh*|Qrl7R?N=(S6t3I%-40d0D~f%4*Dg*ZJecZZlR$tz%bk zW8!rJ0ckA0>^hd#XhD!c>D95r zq8PGfsHOnqx31$$$q`)f5JOf9P@Bb#aecK+V)Ru71j=aIj5O9Y1NJD4Nbw=HWJ*`8 z5vdAm%A{ty37lQZ=H??T37tB)gz6{StO-z8<=nhxEP1$QHqsl-hWRWBz(0XnVEjtD z{y@W6;+e{iYI~5H5`rTvU>M{(nzIL9SBKXj{HOzyBp$u9O&)613Tv{DTO#@lTn*VO z9Qw(kztRD@P5&fiwC{Y~6^Rh07(GE$jAg#2ZF}XnzY3-9C)qOGO$wHT@w3hGz zim*M(!a=&8^O=~OD8m*Q^#kR(!fYhT$b)92@*#*LXzi_^!m0<6ti2Jr-F>M~eG<>K zXTud4G)Jc@#nAbdJMvsghdPBjl4;1THKJD3ep2T}6v%KnH#+~SeQDGuSLLNqIwlIU zSJd1Uwm^nKUk+_N8Fd1%gL(F=nVA!VQR33e5a|P%3A7Il1L6=NFyap-(r(^XQdDW} z3^dPlAM-#UsEr&;iUB}vbcUhM$Tl#RVuH`kM}|6}4cAU18m_En)rpqQ!y8Fqlb(SW ziN2cX6^M~Bv}5t@v-^RIcbpbQOKY@Hicz6{D%M3{ko`BiPlcB2+D)r;FaU!j!DyKS zNDQ5wD`%iv1BW2AWkdZ5I<PI4K;w=nJL_^$E51c; z(d%u%NTk-9VTi!3i1&)W{}G9~T_UTky40*UTQ8ZSAhrMr(#(*W;sDDO_QGILQi&O` z4WgfibX9+iQtj=$Nt-Q#rSjtm6p(<(JBzq8$6_H^wq2ApFBKyndpbyi4WO^idshoR zOrRz7F~B-?im9nt)?s~okAq8eFED=nO0vmG=td2=*_|0(bLJiDtBZFk^Y|B&c!2i2 z?l+6+9W7sHF(J#u@$Az!z6AcjaPS|{p9%tr%GZJzR$8xLHfIzZV9*A!V;wR zd0f|(EXH!(NAife?7@O`Q4G=HrRAURUx{l`&E^$u)1FEWYar>ORPCb*%;WDL+_$w# zLO2^6ps_~Rw-#8MO71hUEb9`TWot=_fsp~Kh!uFh78A*uQXN**5fx{o*suIU6`num zp(le>?N>h@y5?Bo28*v;!!H}c_n@!+9tn3u8~P6M9}mIxI`7DkkS1 zI2z8@fmB+Ulzl{!1x6W)&t^9i}x; zn?C;KFZJ$hmE6rEA8^>Km!dhCsk5y+H0N%yf%5zldG3p@p0T z+LdUcbDW{IiB|Qewp12_@EHpmqaf0dtuo?BtMAomW9}}Q7!tmKs&cn!4(j-{F?>5f znjXrFdV3`14)3R-3%^kP8AkhIKw(+;{=kQLAr-SmoI?lEq$e@UG%6pmsyd4@nDj(^ zkLvVjhVdkeCr67c8Vl{xc3)$Wi}L@VT(Xnr^mYOh3<%a;DWL-!Yp<--7+jNuvZDag zRbDm@Hivp!{dtw8fyEZw_dS(f+R&Cxg=M-a!TVHTS)z?NXrt3sNyQfyubOp4ix`Q+ zBl-=QelIik!?xZkh{(`7Qh|Ak*jssiCKytvN<-;waPHYl2~Let*n4N#6JpKpnRQeaoiV9LQhao?V$o(o3D3;)hk$a5|q9}#quJ6~Qd4N6| zH?mqJk$jfDvZCH0k3zG(gL+8+noV$v3JaIT)&0Q9!tnAQi`$e$78(^;>G9PI(-8>c zgKL%A@XDRq_;KKm0(htYsrgS#f@DQWbD|y{@*+B_)elnUYqAWbcG9znO!HW?&O~l4k4&m`F#qHNpX=$-0odru>aPQ z1*}6Ajxs=tMEGk{Q6A%52!}QJR>olY@TBL`(3J-);bm|%Fwhw|9D*U57DwmN$)Z`NX)x<^ zzq4~TTwq_YG2urqqSuDlN>V*{mzmP3wakBMo3eKyN57l$H(`PBKNLlNGtp6t>uL*f zAg$&*HjP@ym4nc`d4vyKg{q*?ErqT+QLG1cJK=)iIBCM~_E6gIljJ*8zhB95w+b>> zck#H!cPhYC&jL~M;X6vQS^>?-aMVJMlEU~>HJ%4Xk$!}Vl_nhj)Pt_!$bYH*R(Q8=fO&`Snb&TJ z-f&>R@#0dKZon+DugcR6S?g}_Q@SLUZB(kG4s6#&Nmv?vE0kR0XLfc@Xrc_IEwc$g z6D1Hts~>ZR?|x(S=69kAo?*(FxM-7^ZXM+LIuOmsC9Rb#5W_R1Jxq)XD-z6t#Y%(N zU@Y+>KsXEzbUK}@qfC^W@dHIyI&T}ueo;$Qw; z?;hJ#LPx~KqatMsl)=7)6!$`ok?=r9KZ<5nVc`{d&Nrh=qXVO@yrlKD8t8E?xlhI^ z4fGn_)^8TKYr`6PrvyE6zS&y!TCHCvj*tzaqRFdIZBeEV{E*VB*1#!ULmB<$oUip}?vu zEXXRsE6GqnL|XFiiH(^B*3{HjGh0et1wC@5SGf_t3#me(hoDU=h=8lT*UPiWmA{Ao zO}J(lbLQhE3DeRdrYnbo@oBEEA7=jD+k6}ZBwydFZ8aohwr^qjigkp#W>>Mn_+NFE zYznFc)Eo>RA66+%TXhtw*CHspomu6GJ-68TSI&mq%d0o$vX0RAuQ8LE*6m9*{fxi z&kFz0GK`ewMjp_@cIdcUMb{o1cmDFmDHlLy`hM{ zrWE5|>8WTV$Uxg@|LJcW#Fs1&X+?qcON6-X?>LGWbB@um8}Y2uZ53WDcl!T=A=e66 z;eCIV*<8+dZeLy7+2=znCkm}B=kp#q5Zk)B4hvNKu-?CiL5$LNA*EV4vRN~6z61%c z<#D@Iz4WZb{~u3h9o1yq{{I0AA|n(PkOt|Jk{lr-(nvSb4bojA zB`q!8J-P-1X<;;s(I6o)8b*xz?RlQ>`Te(ZcFxY{oO}0mU+?$zzFxQVN=L8i!c2Y=wqH>=jS#uozYV9o61zfGMR28gIfMoVJmDxkmBVXp(V0m=|v5> zv7u08a<({~T8~ZPu`^F&b{Jyt^?&Kiu zD`tU^n$q#vDox`!CRItp3$&1rd7$B~eSnyW4pziGKa|P1i;AHS3?uY9+O}7ya;BFvG+gjfBt+EPwmkcKp)_B z#~X>rr|+H$nhGaKx^_@cXutbsI+aZak$v^IalidfbUgw%@UVdf%|3bL!9F zq9#mdDDI<6oE*#;l+~|{)=@@pg7W)EkxAZg>@71}yw3PM)rpIlBp&O@Zc><$=p8$(FYA<+EVf5W?K&)kP0{yqX|$soDfA zx8LC#fM2>!K>t~9tnUne|n3(4ACN4d;dQmSQv2IPU5Nd#-e`=d1?m8~?yzW~R9-Z_LZ`@6+GVHv+fh9v_ z{B(~+0N;aor&WUKO#yGef206tEdcPp<2+#?p@6JQJPBoE7Ju~TIRQoO<2hT(^8vvH zlC{Tg@gp9w2_Ys-bT=Xe*jPS<3KHkJ5?!rVt66u@PX)i2q<+(1PvQNRoKzRByFC+H z&RvqZBd2>jlku)(9B|)A8-NeM+m|P}+wgFeMB+>1t7xVxv=bK66KnK-~rDKb?&Y{sCe zyu%`#bR31`u=1yz$|W{EJ(l|$A>T#c3+Vp-{#mHXQYv{D7>Pyq#u-3{y+Nh+y_OD> zHVah(cuHm6uu_T^au-ql$v6f4(CtqqrGAfHg$nfmdaHZ&M8eK#UCMa2iXBhrSP4uU z$;RWKY>R%6M2%@;I!59z{bv9NTaJ!53(*~)2;LXn&LpBWBqBr3v5%kAN|naa2`r@D z_hScchV-lY@iu*z*fm)qwq3jXk9wh*q2>!uF5{;$*eOhS9DrM22)$aT7>{tL`?8S9 zrnr#ihy9m9GMp*uK(bxSIeL|a_ZC4bAp=~MBzeS&^`y!dSK^h(7vR-nBw;k4u46FO zEX`S$?z*m30v=r~YQO`R|4W!w#LIDY%phgTdJRWSDW4?QmMl1wjo^2@>)R`Ox~a$e zZM3y`wSUN>$&jRP&0jwPY#8r#4_73oiGHR1jl+5h48FxK1N7)_0tB}3bMUm;g5xf+ zzdrsgL-+9yv3)wk6pDk1vRY#AurXQ=`Z58Dv9r}A_oUkBr{AI;Q{b5eXJJ&%XO*fi z!7r)#2nUYz61aC|Qb{;a+v(>3oAYQVEV&C3Q9Ar*>T*&PcT>ijQT=0XgbUezWs-gi zkJV*`68MVbt}!-fdaV=?AU4j8ouAJ?RdjIty^Pi)`~@qcZGq%eoJu9*Jid4v8vB z@AyZcB&MP0Ur~74C&dUb2I}H+zhc38$q|beqr~{O761y4lzy7N&h!XiL4q?EESgFk zO0JIemJUapSSrE&2@AFO(-NL1<|L$XTZF$Oc3%ZkIWtn>yw+Xrw#RC%wP2&nlkEgN z9txkE{&+sil(b|~sHH+iD=~IHk#2SJ zGgX}5eUwry37i}Q>Q2ElAk)umwZegAWCeBxODhW-s2h$ zo<=2#&6z~v^i}Sel z(HksHPMP14-F^Izai6*M1>77gJ0fIerFFLS$>Zs~IVo{&I|3fxW zq;%poN`+$+Olb^w)Ypjf`&-MmFbb(h-3xCpq2ypT7AgE-te-m}ZzCTok{KlkJp%l8 zRmvVBmMY>V;jsj;%1dsBO)w|tqWM8M-sX-;MCgAK!#LjI2rc}=>`%D@C#S5$j!Ni8 zCdVgiQm&2kD=$ANFE(t4Jz5BJuREvzIT5alYJ9nyK(qCmF|X6G)Fj^zNO&m2Vmcgu zlg`XQb!WDW^Dp6vFEbIO;Ak>@2Y~a)>;qYHl)H>b8|`{=3<<8q=v||r%MLBo24N!e zhxdz&|Gy9rECl>lWhcZw`(3ih;tOG7?4d7>{784}Xw^;F9#?Z36L{3CMZMlor>YRmhS#03%bzq4dTiJy<;n zM3z9?B;4&j0t}F7Qllg8Nqmj7zsR#OnY*aoyYDWT9{a@S*+>24P`5Z4s$r7zL5bv) zjl9*bLH@6wT)Tmi6TOpJ8UrxOigU9cR5a+~9}w9q(sKu2fmq;x0i>G7D_6iyCl z{1Yv_Njlaxc1It`DrTC6nY=$4EK>FnCffS=e6a=-c&BMZ{A>O`SgVH-idbBFAQv=n zP_neI)F2=_o(!x*e8chT+Na^7Ylb~dY{A=xZ zb*s_oukwH4MT}w^L_Okt^FJ!q|A0_IG2{vXq5+O=IlR34MzX;6mdr|OC7{^DRNsWl zS)UqFnOsqAQ`p_Wr!VH%yd=5hMUISSWlHGiDAR~Y^5IU#@OC9&Z*?^0XaB>D3N-o; z8|gZ#`=J2&Ql+(Eq$d;jQhz&-jX8Y#hHIj`x^wcdTKVZw)s*&8HQe)nY~C&XCi;)W zfz@7WO-bd$I$t%nNyU%;Wi8Rh5^ZVVvNCWPxcSKoaHpF3&~Ph)jpiaHl^-_IOhn5a zamlCB1pS0O^xt%q3HaD^DT=98Myzmg9h43~P0KffdW5ZWaGE~2QB7lKiV@u?Q#U*~ z(>lw~ZxOHUMO2Gd&5yqK>@oizsOV@=TM;w_u$7{(9cod?z7O>ul>nv2HZ zzL1Afhcb19zWA?ew%g=w>zZ?sziL}c&&rTijK zE%TTEsZ9*7>^CCP_GtkXfyD-k7F8~2Fe^q+>$h?n3#;$4xy1A^hf6}0FWNbxO&aO@ zjd6@WT~^o@9WL5s#9OmGC@V&Q@`f!z2Oqea?rjn#YV$t_asB7uhM>cmgY>(SxXQu1 zChCUO85dM**QSf`L*2&JRadI{g@NnHJ;Hw^P-76jaeu~}toH9AYo7DrP+_0_cqHh1 zCH;Wpe;GiA6#~3;Bp)ng!@N?S@%o#a*(^H$;|M#MF$b;=%+*3$w_pTK9as3HitSRBQ{yvxGa6jh zc9shn`Z`v`JHOoEet zj5SW0;5r!kVy(DIBG*Jezmq?8w>Q55?tA456&a@Ki*yyFG%jfgzvr9soWu2?Z7^O1 zm(M_kJt}l1rHdQdZI-Y8u|GgE*qNIf8&6yeQk3lq>xZ1n{ih6w?3?=4?>!V(&0R!a zZY)-qWnGf~s$54Rn(i|Zjb{2B)%wW=^;2xKL*bu<66^nWOzYI0jrm9#vll0KE_pFW zOrCeSE_d53xG*&P{Fjgy3L=;NTAj{+!(Ek4G%DEaIRv^Lc%7;RCi!;B5*3u+(JNgB zW>DD6SeAp*A6G2BRY|cAFLO1jYjkS7G%;Y#5SUX{+ggyH+H>aA*tn2%?HD*gC>_^b zR+i|t231YJ1`nffG>t{oinlhjwA{R^D;SBG<#Rh6vM3#aM^hcETD>ZB`;cC>JjO}H?Ru5`^mOKVV2+Eae3eg!hu ze9IimM0S{tF222{_E`LOm5Zs4fwtDrE1ERluI?K`H9OzxcUssZ{&1mZZ7krwCE4y4eJ&Uo%o||5xnbI@CeGgEI(aVkBSUI ztLc%H`jXV_K6%5W@^%(>Z(lvg^Z6oZdnK3MK>eQy z1SlDC`*heTt2{E0`ZVG>|3^ZlxR<^AUIW8l!`rd}RwV}4L9orf2-ycPdb`LdF&Pt#BpdsF&_+`M~Jc7|qwb+US;WzCyWLGo z4sY$Cec7Ri|G1{18x~h_r1Rn$5*~&(-IaCxPQ7?mTbY6vu3=jXjsz_KKB(n0;fUw- z4fV_b;Y(5DnMJ?x49b9p^Z8*FGY?EvbYv-MdKLBf$o90=oQyEdJe1Nr{Mx+Kk2guW zeQx>Sb$C~f302$|!;Wi)Rk?103TW(~ZJdY_@L+|6*0p>vw*VM6L@=dG5VyvDKd`0` zC&AsRURKNRujFX7(JFprkXi*)e}-=w?U2sX$f+BvY1jRWk4wMdo-8rU{+-RrFZEF` znoX!fTccS<0ccBqr`|P|k5kVGT%7Etm2pIHIk-6(FZAJ($6X>?I}LJAnf1|@v-;&G zBUe4AyAc_fEqOz{;VF+!TSPBL{b$VQa zvz=$W!kjdS`9N(mRxS>&zY2m*7rwC>MkOu{?`(QTJkY-XUMuI+RVZlNPsIp+7Dfz? za>Dy4iqXCU=ugaA2SNM7#!uqY_7I((66V%5vvVSqf|EYV*Ug5jO4Spawl9CZEgace z%1d-Z=*`;CWU1$-+3#}>ANmRhHnzk(ByQBL#OEA9k)Saj<*cSDpPKrr*u8gwR(db2 zXQ;OMol^!z^q%d0NB)nm={EFeV|XW{Qec?R_utdl?6wi%mOjKQ`^kEbNg&=a^=Q`B z9FPR$5IN}49F$0&muY9J;(r(JI;!7lEW#9>B4Sotub9eK;~n)hoJZ|%Z5w<2`G@dv zjmhI{c1~j(z4eV^cB;-dKMPDTPVAsokBhW>$ILEQ1E<#67qTM`;q?ROKTfGiUG2W1kO zhWX~KDMrle#SiDc?Ad2X3LED)npQFl(U=|6bZB0Orm}n09#PgS?DozIj|&dJb+O1u zaE%!K?0I4c^N&6Y2mVN7@BNZ(H=)v8gce`k{%-lJh|e&5B)^iA+plr;+$B7II=ouD z0{@%qKO&>NTY4vQ#jy$5VeniP^u$1?0%7zrPvT;m8|D~b^YU@>rE5;FSDb?a~ zHt-tS0JGi&ReN7Yumv59U8LIlK2HCBu=*xkiijkX!7N>(WrnU()3z7!ItxK=qr(P! zJmM+sri}e*jD*1N5p0=8>cVTiRqKZHr~x=r7qBlp{g*<8zjxL*E<|`$fz{pjnmNiL z)P3OCLxG>o5`#jb=$x}1zXU}S-f~d=^V?uz_@#^X#&3(99*-Ih79Qmi9^>@%`Jp4X zeeKQ098r)@kg^T2Bs8GdWq|i3{M~RsGFV5Rndf3!lQ;B|g`2Of&y+~kl>SYmJo{%s zE_6ayGHOEhOvXpxj`pTGhRifCG&hm_+t+&#??`%kcbI{Nlz@%CD`7|51@JVSoHb(Z z+hvX$IoBY9kz~Mr?)}hr`~c!NiPpzlUw=I=0?o{Ja$Pl=B9pO2<`h_*nqfbkp38F? zJG<&4{d8`OaT?FY`0M%}g@NCGp*(i{tC8b?<3IZ<3W|;31z`ug4m%xb81eG;2EvkQ z1QS41kt16}@q5G~!sGudBlCUURwE(gW%=tvi27TmTkU?mrjyAJ*Lk+Ah7T=~B}M35F;c>3URB||uc zR$l^X$c9V=%avW2Uf`Q?!PAsQ=S0aj`|Hy231b zb>Es1u$zvVpfqFO9fAq9XEK$yzPD9joVNJwhF{W>4*6E})Nzz-q2g$Z?-ijC+p(dU zO}Towi%GF>ax(kSE=vYoLBNm#ZB5*Pkn2*R1r*XwGt@hr{BGt08OZCaPgw*kSv+f- z+rAJ@rY{uM`%i8~Hg%lzf6eSq6E0q*hi=WE1h4hRl+LQuPS;Y<1xI{M<0b{~9&^As zgPJU>^l_r;zVvMw*AEc?S}j4{pbLiTKp5$kC)Wr`Z-Yd@~!M4mSzr^l{aU?wHa*D&~iW$CT+&23>0 zEO{M$wiL2W@(lC$=n{%5!G4JLAijPOg4OcQ>t+PTZYlk#G4MWwh?qqNm>tuygsYR; z$)C@XobA>1R5uHDs^nhilpeP=$MUs0rq<9`kyzx>7&&7~;Q%Y#-#Ki^ys)05zKC zhhycc)%e@eZYT5WyHZ#!(`lFb*!Nq=mX0zon5M?2gwUW+;NN95f}_01FqcTbQs0?y zGO)$J3}o*)HP+;7lLjeYs0^&QsLm}4Kx*L+qLP{(sM!|Uorn*-a$)kGnf-DcV}JciNq2;J&aq}`ls5MdA4v6=YC);By%$Zo9Xlj`n7MuVuUv% z56AM*Xf#la zU~_Y2ZVmOGg&j+%oyUBeN_cY@NLFlCB|6TlETzI|uNb-Z@mlnudJ@ubMg^KNZ+?Ao zrA^qbJb7mlGdaq2>fzk}-h-OYKtm_lE=)c+UQ|KIVFL2hHU}pB^+I0|mR0atwRmr$ zz1?QqcR9QBtURrl8o6y(3Q1iMG2m`;Rd#J#D7K1Yf(?RI9ZN0e=Pg$ov~`Sb&1jpB zn$&j-hm&6sqGLhAXh((f5}lM=%r+B!5p9Trma$%F7lzh%`+(srgu6O%s=R+*Z+o30 zVZQd)?QkNjIg*XaENyP{cj!j^&7!%DpyADIeVCJ~DH0;GP!Xu=Xdq;=h#0!F=9O}` zUt1m<6q|9Q%5~Nm{Nm?TLKM{T2@xQyM_fFH2wg6%_4!wmsx9+e(q^M&Y*M`(P_}^4=_#OzOaGY<(0}d1k1-tJ3GcnvSd%l( z2u=O?KBw#5L@eU7$Gq@<6v-pe=hn?9QF%;}!ptTh6Ko>1>DY=PfopSnuI zk;1aX9=TN!?eVi5Z6+L+!>^TfHS)J!rm$DCYRK-sPSJlxVATB0g#&eE&FGFUq`1(9 zh*eWLI+`t%I5{6^*0gw58k8B?TTw3YXIq!x+bh0-Sy;Nh<=t1SEN!mQ+Bst&)mL>i zYL{AE$^nDyE+=GpF0^iPoLVP~hdFSQ10`p_h~vKv>*ZsZ)Eo;U$s3YPz`oult68z> zcu4I-vL+K#V<7bOlFEU_eQ)g#^6Ql@x{=}LM+WP z;**kQld@q`v=Z=DQn#mvAz4!IJCA@vUnwA2*M!^wK^jMccQqgGiMBfM#R*mCCC!uQ z0O~Qh;K!55P692>jy|cnPd>d@MBn4DU&)!o%e2FjL@@e4 zqX{FH7LMH96RL_KtUCdy0u)JoRYWrQsG(5BZ=#jC#d#S`ZY7u8oLfj2o+ zIC}26z48$Oaai1bgU z>f9}Pz(3t3RuDqy!WHnoEo+-3^36x)ww-S`hMt}N@o@=S?YR zKi-IXQ6`jzq5lEjxwJX^r|`>D;QSM#6^H54VwPxiI>{Em6?Yx+ORDmqs=FbMJ=)dc?i}}u zg^PCcZ8B7D`eA)I*yWm4XTLqSj3(xp`-Xio(;mwV{Q2(4iJ5sYvDG9Q2fJp9B)g6h zCXPSq!ug)?AST<^h*O6y=Ri@+{*;`VS@i$IWXDpn6m8kD6OpHzr zg+Up-GV-LUb`vATuO-a$(JH@clGii#CW2CpNA>a)jdyE8_q^aaP1)L@ZRe@^dm_?A zP@<#KhsBw5pHcS%Lw+s4nY{{`qrHkC@vM?0O6$EHJieyY?D>WHH_e2`(vE)Q9=;+@ zA@Y4W??-PVNj$3v^Z)J&gAkVX9a)h1g=JLhPJf`C$)<`?{a9b^95v-z0f3(5WT*|X zfJDc}Mk@p9`-@7|JBah@yjhDw{)iV zBF)|2E4rUdAAzmUKKBQUxAblIUwr&X{sos?J%sB(93jb&zN6@k@VYXCrip(*(FVw* z!R_)|B*q&&I_IvhRzeasMM<-e_B=uj-k1f=w+j5zqA)7sfAy_2vn;4jE%(#7<8B}_ zSziS&y=%`fGH!MH`De3*XPbq?Bka$|PJA9&s4yZ-+hnerA1}{EQyn%_bf{5JE4uem z^XxQTQ0(bn#SWGJ$YMCI!iKRAu^DgMBdML1TjS>a=Z}Pg`7C1ZrWM9)A8P19+HCV*2k^a*4-k>|>g3li6;E|`W{_W8&DpAdX@~HIHfIlREQ5awC+5r)T00B=8RoNcxyn+l0TQK{G*+tTQob{)A~ z*ES-F3-N5%ztxakur>S~D&R4i`9;d$ORYXeoo!;?U2@|97?4U8GRyw)F^xS4v-H(F z4I()qSHJQ3;F5w^L@X+g>xAy&4)8XV-}3i+;?rwp9KQfv+D;Y^ zK=vqruV;$}%cYiE+rhC)lk$-*ZYyUJ?rQyn$h5MQuFo~&fuL2)3_ z!9KvmR@~S5=xxZunCJW}_Wlnkq7xrP{;UaqEq`iwbelMP6Nxd98Wu#q3D7HrHZEdg z@BQsiUuss$KaJtScHk5t)eadydCiCW+9ul*O-Bj~-rBQe@ZFBarapXgxhUX@Rzr1xP#hh zaIpgQCZyFt5A2nXOq}&A5w(h~?-m#;`eIgVnzFFEX$c)T{ed^O3h_VUb@)ksZ!k`N zA4R^TMj}(X;?nn3j`psqpC%TbiJWfJ8e_!z%L}nlk9& zSZ&LM%*}FkMK8^t3ET1W8KxQ(oC~9Z?r4FNF!`hz)4UL?DOXf3R9%LwN^58xwdWkx zxon*XwiDIGTS}?OR$>-wR}z~Uu9Gt_sNY|!XAqBB8AAldkWVQCfpjJB`50=tfs#Nn z?|k1EDp68@vp5bX>4Um72eW-b$2y9d$66cX?p^MyMK}9k=Ln4&jZwVSiPCZ=_P1Xe zm^D(n1(z)`dj#g(pn%^D#F{1A>Fg(KOp-@+Z*;lER{_u3599h28fcC)n4*FE$+3?g zfX|g4w`pvpto00k976f4v3?PvhZeGe4DB<8TSY9gOKd0|f^dYmEc_ zsEw4DEl7{@Q_I9|AzL<>nqfuT!#hs4dPLPhM;A7)FH#2n6YqkUJF$k;{{(NYV%^`ovjs-{-$q6(f+eZ zAv1#7{*s{rYpGx~06FFO`N>}hb;B~kRXKA0g1r8KcayF$b{a$a5 z++8MLTMP-&w6S-qx600&-T>~=tAu|Y(+sNp17SmH9aBnD8BPsUmyRVb<Ytt0+;n zjWEwMT!!i_mh4VtzTVp{$%Q=l+pl}vzoW64o=ese|9U@bsi7g?^(|uDKm~Zs9Hw;e znM11`p};?9{fpdH>B%)ZIs~PP^4pC^`N^G@`UarVAa{)^mYJgBq&wxy{zof-L!X+vXz2v{k~lK2KmLsmim96a#bdz>c7&`v|BoLg(95e#sX$nh8<1p z#Qb;{5wO{~)B~g3-1oqal;o{$vIewxp16%$1edy3()+?~$=Q23lZryscIlSY%X*70v%n=e$$`rx6(&0}METz8z`NE_k!V%*A#we-OP^@rB>G|MXEz}-RbwFRAG zP6UcZnfhM^V&@uMGyU%EOI}&NKRMs9c+A(RNO8XlAhu$;JPa+2P)%ElUX322J=*ps zoJraE-M{-8qJ5mA{nN6;X#MoIp@yr*j1DLIbgv?-5pVqjs0lpM7ca)-^mqA5aiRt8 z`FW)PxDupp5-ZWgd3^^qcPJ`HWcF92XnZ*>j-WHH6~%YG#Jt~-q7i@8>NJGIJvVQx ziaHh9D#9GY&|;nFA>FkrWR-!AFOI)5zRbjKA+%7Xe6h|eYul>A_^M6P^skI?<77yXnBt`b8nS3tQ8Vi452P*WrOV%2yEb?gNnf(@U~0zt zme;~I{#Wy+{mJtCk`Mto12_zkizM5P_ev+(yF97enB6#FqERE;RrNrp)A`zyB@G3( z1eNz9{a**Le0|V~K9`!ZGn)4N8I`Zr((<~%S}dSisFQti5%eQP%&Po{bqze(l2X7; ztNaz12jOaLyG6*1C@wIAvJY!ln)UJ_tW$btZ}iKx4dfN8Chk|cb)fH{jn)UM`_Ll0 zMKK@qA38=suX)$j%|WKh#eQ^Vu^641?`d*ACBF@yt+QS!!ppU-Df)IYOd+f>k7K1D zLBM&Ivf}*fS3p9(22XVjh)BeUFgIw>G$}>oYlVc$>oO}^tG%8_(?BdB=W z!1Hsas$0sETgURlyaKq9j(*vU*%p9VtCErbDpw7m z7urJ0nn+W}E+oC^VOHhLTEC}nfu&r4g=<){sQY21&?0krG%AzVCeAnBMN+VCYmO1k zXC7nhm{!EHa`jFZ>=5NOIgW4{W#c0o=($?N%;(w4Sen`A zg+UntSP%Qs4dWTR_;J`J{I<}6>7}ykD#i~3Ud>AT=IWt2eUfifD{_3# zNL#k758d?kJ`40e`lOE=a2Xpnzfo|HxoAA+o0Qb&r;E$ydIO&z1lAjl}AN-xhCy||JongBt>G=7Cbe!mrM^CLs95< z(0SG3O;`&A2^|Yah6nw6x@f*M?32W0kc|<;U)Wh$LGiaoDTc@N9{c(c3oXYc?L&5pAS0s zcX4y3w+D;aDX01Ah=!-93EMMEW9dtZIi5@MqC(l|}@u6c|giaE{tb z^;5p{KWIDtSnwMtua0YF<2vt+aO@$=roj`EV{M;>mhQ{+yE3b(NM&*pk;yAwsq#$9 zr6z%;G(NjBAp5+|&O?H@pd=OH%U8?p+Z(<&4epj?<8I4om2Q9Ezyn&#!PPhE3;sFw zfJ|_yfd_(@YzARkYIt-5o}6ScDlk`VLb#(XMNbORJVa-W;D-Wy-s2OAMd=m&u|__Fw(nn{hI3m}nl8Cu* zDFjy!SyJoWi6tRNwsIWoaT)ikD+z4x9Hc&&8`z*yYwQfZsa**Cxz{bS*!QJ}m(6{I znl$8usYSf1@YAB}ir{7D+$y4!`SjM*ZKlP-IEK8UDR%=jq`W_dKkNztaQRO96YsvdOhImbK1aoMDiz4sJr^2)7v_+#%h?kjpx zgoiSaJ?D<3VuQoL<-5YTIFYm0Fb_z{80n$h-OQq~8rTCR zoknkWypLDmauDjoxNca;4=$^`$+auJgq#Z|sU+W zr|m4>#)Kx`a@LTejwR-yO<3{_6{(V!(brz6@7W!zu z1Z9!;7|2UTk?*~*(J>~gp5{lNdM_^cyU)ss&Foq56hvSACCnGi_SnzPb{}J0cJH$N41P_1Ro;nqzHXSG?Quu_IBfBQ2RQJGmtNF zr&bD~qff&$9K%wS;1jk4g3d;5N_fnXuB3gqq#@(OIu-RZG@(OZ0({^+)G1CA{(i4% z|0z#)qa+X)D7S(?*ShrJxY<^ziOc%g@lq=$>KC#RKXn)1m46o}Y*gy^#n9Kyd^vEn zvUyWNV|)J@y4Ie@$a~pn;bHDIZoDYu?mjJh6$x2G)w{l~>|e*A-E~Lh%QvqBdnr7u>uipvZ_=RGuX} zD3iObJkbeyW(jZWDj#dDZN7L|q=2kdETU{Zqv}6$YL#~2L(XRhMDMdQ9TG2UTLcUo zMNyyc1{cdcdrK--k6+?k+C$FKz6%=@q#nONTepIjs|sz=0v-t=O^GVd)@E?cUHab2 zO$WI3(3sl)Dg&~)5RU$1slb(95FXz$!=!_lQt_iI>&kI&wtMIQ@lyOO6%>z6I{0K+ z_Y9xfZ3=~(W4NVvnc%1xI?|T5O09*&DS6M^5 z@-mNnhx>ezh$QaSmoI+9hW909?|?-|^O>UOS1`tJXa>IyC{ZN6H?ZSiBV-&W=rYWU z@OP2dUcVsW=6LzP(3+if%GW!`q~OMo<5r0SUQKAaS)YTywYl-fg8|nm8qUE zKyPGCjNBa=seOCkqBq0s9+ivvD!pkQAy~JONnrI@`@;s7M62i76^D-tm%uf9Pm(6Y zE@r&v#(Pa8>EXtwj+dZP5RsUX>b%B&zo6fr*n^>cj~zDV+QsFS%egN;#zM;{F)E#T z%@=n_JxKBW20QsxY^TEOBFsH%P@3gY+`M=o)zV*#>G(xRXBRJ|s>DhLp7$NA_8pt( zaqN~p?^Q`XutULT1qm7*N1YZn#^TWSp(>&qQ5HrwcB;#Zf!~df-YL_*9MzmU7Gb~g zt-~GHt(I3r*w5|};$Ena>YC)!D-Od;9^Qkp_!PaoGQl@VR##V)pd3E=ScvL0juF+x zmM+}hpe)nmPQeR$(k3xXRd(W*_OVY*ThA`6TKhV@_*K$3j>f5%2KuH`c`Mp86@ps| zLT_nT>6lI}yjSYXM>}lTVlXOCiC(s5nio%jktnO$%aP64cREz`_9_}BjgY{t#E2xH z*4+V`F)9h-1RY-~E|-YhLShICj=#NH7OGm7@0nY|S{WbpH&Lgl*C_~YOSS?oUEQ}q zdVk|Wv+ey98`j=5xcE3Wq3k7@|Btq~%;28fgYQ%4X*108KxV;nP{t#KtCM@T|Fy7P zv2QwnHn1){76-h6A;# znw<&pMO8PNy}AX=M@Qv<>r=6~_Soy3?b#o97;SMxj$@@ZH6NVKGOzx}$KAs52KRNg zwB2KKo=FX7_s=W8DTen%KB_`z6mF>eW58gan$D5ed7GW2DR#$qMT1gCfxR-KXj;Th zO7rev<=G7MYll-46C_P~yOYJBa@kr|!BvFcS4F#$c*+CrNZ5!BVac>v)zn_4V5fSg zQPXla{Av$hbSItQe9gT2+~-nyFH2O3*568XefZbH-P#7K0AHefT)^+m87jQ`^d`q& z@xW-sNkk?^U*NrJ=Y7b%@9>uBVMiuP>*6bE?-Dt0de)(xnb{w{)|c&=YWI;Cv#^9F zaz3+|bMxu4H-Y=?h%}+!>g|Hv;yV&?55%cm*0)6Wzr#?&2H9{}-(tSKq*0)`Ikoq> zY-0ai{t+@&NMQ)XvXiX>f_IDViuoo&gFDfSNqA(mo)A*YKc| zHKycU`*w_$BPG=hm9Y#0;ip|KG3GKar&+931XKFyN97;R-F{7Pc|l#HkQ2>sH^(|GvqtnYPFv({gv^U54FcKpr|Kx9~CZtKhCi2k7uVQ?iq8xfW7U&`r5G zoV!f3E2H?eq;>3UwNVY+{$1H+9~`n4Cb97Ah-dEtPQ(3hDA-_DQ{hxMSliQsCv9)$ zHj86jeo#6u`mpCaDWHJogRgBv~y?a@}=ZQos2)~N>3j%D%Xcv zmzfW|HF7gxyo3L~{?|S~*}L_x*(qM^2sb;>hYLqhULZSBC}H)$m}JztYXRHDwl1LYJtaJ-e^~VxCv^k{u2$rE zcm7n8$ZiNPcN?G!m=RHR6f4>R57gK^6pqi*4;tl-tD~Kh$z7LTiF9n6$O6k}?a^QS zI%KLEu%>53pk3;x;h8Z6Gw9wI(79Vuzu+|F@4~Uk!ts_SOOSj#bj~=4U(e9}P6qt& z$xr;O@W{gEq2TYCL%LFnzx_sj_QkaUA>8rY>e0D)-zbH^xD@{?B)w3A@m2bFK1c7F z9}7oN6=-3jYZZ_2mp>G54MrE4cUjXOYP(E!Iwwqq!ul(&*Z4)(lQ|ql&NaG^=i)uK zP8aHKbVvPirw;M%WX9(KA>^k@KtjxZ(a}cW?J{#Y z@bV(pF2k(Acfgj)nrFvlFtf@(aAP@LL#>B=aSmr;wf^>L>CgL@W@{9^PEDsCGcvM} z_FkJ}C1dbsMVNrKW7w-qpmufQtYgA#+Pte**lcPw28Cl+JzuNOSUNVNgWK2QI4OR) z1rWTiZK1hu&84|7!f?fTKgD~|mRnD=?2Rrt!@;ForC1F!{j4U#s zX@>rN1fA*#jrvR5%#f>T*X5id`4exIUx~BV-ElNrbib7V^-pZRIXP{otwjQ{BA1)L zK$xrZ{{Xx|L%&A9$<~c6+UR-0lIRVXPt%9!9~a)HLyx>zpV^?u?mIy(-s_^hk2p=Y z-u;w4CllA;*(!3s&+0Q-PdEM0c^lXow@_Etx6t6(C1jOI1By`Ma zmurVT{-%SDI?Ke+&%`k2pFIW>0}r2h<&}@eQU~#UhylQTBdzB|wRyk0>fisYuDiW~ zJ-#|R@$@UT`vJ#m-$PHqvwAc~{i>9{oUPH}0V8Ury0epAOP{S>u#6 zXsYtY&QsrSmum2W)f%yAohB{YplPd0HGOTFrmiX1s0HOJnzTxt4Loh~rt10b6V&+2 z(Yo*Bk-Fo(AqM{;y130yUHi@;z0hNj=B&0-UCD{dEA(jk!sy}iHg&RfK<)0@>z2+Y zhS+n4Eg^yq0V+iIT}b&@OtS&jiB$KcoeeG}YaXXwH!>qS#Z8GUBztxtOE`19}30momi z<1e^Dm*0A~>fZZ^F1_Mb9b!Oyu)71$DopGVIX%bn5=8>d`9~mdA1&V zwS%qJX;I&aeS|hwZ+wueW6r!q`yX|oPC5TJU32q;s(HsFI`@L>b@&PA>Yk^Ysc^(p z^)8;OH(GbpZhM`mD{p&JNxf_xmzZP+&eX@r{dL(b_vo+xxLD2J%TX^A&f~AWr(F)V zh5z`g2CQ#Au=vHn6%p9+o8e#BYdYofx;psKbM?^|g(ki65iuNe%-Op8k=G+)&l@yb zy+$lnrmfg#T70TK4mm~jnzYtexf9gAV4~_g_`0q58v2_(kMl0Asq5{@+;gHjx>!T!tk57C46Kqf3)rIn={^zFJzwHUBUd)|`~eZz17zbA2f z(oY};o-r&p=$jO50Y<+AJ#3CrdyZC<7usmA!%vGI41St2)Pv0~Ve|${>;ozqzOZD4 zzRDi2`=4xUtL!9QdFzA9>^a6B!)P^Z(o)ABf0f>7nQU-0G1$`UIdX+wdpA=jo?lZJ z-1wln zN|Cyz7wXAp-_YNVK2r^!eoraArW;r$sliLHYmXz3R-+eND$O24p)Iw%{;TXA%+f1u zx@zBJPK^L1#ny9r{zP4IT|*sr$_e-fG z*a|*Xbsuh~FVjb;+571__}Ghe=Eb#Lt}pa~E$Oal{nh59B!}JNYv<_G9=+6e#B9Cu zMZOL>;c^pcYkir`2X4IQ?}3ijFnFo^jtBY3wR-!jp*p!nEgf>?S$gK>_WG<#zCP)c zqfR|~+OxYwN1aeZjh=W-h5bj{L%UP^A8wE8$+wl=e}Q_kbchX-+{klSXs>Bi^qTRx z*F31do_w{MePlo$I@M&b$lk!ph)nn*zyH{!YGkkM&=W6Gjcf0ATTfCE-W5PJc(s9j zr9S&=fG)oB9_@ADDf+-(aB}WY)qm(k9rX7L^-jm0Dj34l)FOL=E0tO_O*htUs9pCz zMo+)`zIqO|H_tPM=iZOVzv=sKpV54%wj?5ke5c>!#SgU8J}2tAH@}RCAM8v>UQnvQ2 zpQXBQ7i-*{RVpuC7m-3m#VQlTdX-gda3Oh(bge6~!NgE*sf->B&vky2R#a-jD$CkR zl`O4P|9R!gnX*=$M=a5M{buR4tVw#j>%{0w=(_KZ(v5A4bycfjx~TauUC_K(=U2%E z&4-&1hUvm)Lv&G#Av*u95}n$7oX%@8Qgz$)Q{Rb;w5q&9b2n6~+r-s6ssXeOrPPPbF%tP$!te6I2b z&r-qQIR>A39@yXNwKm-yua>=wbM$(fuMAXEZHbRj!^d0c=o7EhD=oX)?dNM=es_Dm zKI}SB=UsEJjyUOZwd%mDiQ`mMGQ+?(T|J7%=#Iv(Yp31+YGSCRZfOIQl08~i-`qqe zpM9H}zn7|_!Bf?9&_t!?_R|9oKdJo>Jx-69)=b z2ibz`zgFoz=jhe8U9|U6Cq`czr}dhmq`YyuNCvgWe?QpHLle@ zho7PcpL$DuZRzIrpQNU3yO}so(^a=WY5a%|A7m9jCevJn#EQDA)S$Q#?&gO)h`4 z=W_5d=jhASe(E=Rp5Fc}M~9jm?|GuNzQ`<5F3$soE>xbqX+8*J`42u|Yw<}R?Q5(0 zh~v*!kF0^}Gjxi251FhlO$^7KdbvG>)AZ=G*2mCqbZ_HVb=WcI>f-C~Ri})h&U>y3 zZA|qVwm`j|Cck~2-DigCJ=j$H9C5DdH+t1=HB!Atn&^hkb6;ZmX@*H)R`lTi#2Po7 zye@TFa~K~ML!S6Y0fzn{Vb;!D&$t5|7;qxHaJ&9(bMr|Z?$U6tK;iu0bO zzV7oMm?+M<=w|J@&ry2z)psT*?-m8r69wKi0iYMCpr+<8C->ny8$KF`3s zpj4W@rc&b;l&SBO6-seO?_f){Ro-O1m^MKVcO0p^J|3pp?+ww-?FQSk~N_0;1Q97&TIGy#@c%9W^jLtFmpBItCP+jD5Kn^upjL>P#Cg|LzqjhV`eo7rO zOUs<^A}hA%tTj6KS=LF)()PEy4lJY>zgE&_h#}q9T9z9tww};JH`)?gv z`yP3r4nN@v)qU_)ecZX1E%=EB*@?C)2k4RK-_yzG-ll_&yuhH>MCnBnJRoP;Iv=M; zeeLLzuGSmvQ>(uGTxR!sLG*6=9gUi4&jU`?wY46xwcABm{U@k%&JaEFN_!o5?seL3 zx5HKAlG~J&IYjAsqjb$JO$;WNs=*U)t4H<-b;}r}r(SAp5WYgY?|+mYdG14H^_#7% z0h86_)mGZ|prh2}<#(0VbEb)5tqKOMS7x8NdgX11;UBu|u{TUe)6~Nr!-Y54V>s(( zz0|6+atD6ndiB*+w?3r5pMHg{+BaR_5i00E#n#{q<@Wj3Br{#_eqN~4Y#|?dWDQ&T z-IS7FY?2uo#ozCUQ=<9)2cK+Xkee0hqs9AaI?z_<-_N>9?|14M0aD(;Y3h<$Y%i;^ zJ%(%4^xbR~8gxHTEitIPsJ#w2T{qwLoLYU9X?>4Xj&;=PgC4s0x;wSY{-R`qdgFci z#K2uNWUAVKk*O+_5e%3;2IsDZcG;O#LK zEvsQ-X!XTF?SJ%z2J%z&-WM4L$ua6=a%uE*OYM8anUOs5Y#Wp7EVcPKLp83r!{m0B ziR@*Q5YI`bxUD9uy$R<1F9#~mb!cgQ9BM#6__zyQ*JjpBe|rUAM{l*Y{3t_Tqz{eW zW~*y2a<~0Y(Zx44aCoM=JB)|x?LIHi*_Yp`gO0gKH`IH|X-;!KlTD0YYS;bjz1`MC zEkDSJ`s~MD`l{yL&+DKgPS^Ik9${j5&m{J(+k3JaJ=Id&U4UL|}Snk1#J=@``mDGJBme#@Su9 zC(u4;vR>^rT917;R1ds2K(*WS*3GT@=-RjX>au3Nbb>W+RbWzj3y7-OWy5!Bi z4(qS;-WX)CAFgv+jxjlm)tN|(u{yiO=!hWBH6fhWY`BSGq|RvZwd0P_^-klH{I4~C z4NGKHYUq-6y0PUT1AdyeyEV`C>8%~A)=S!=w~``{f$0GrC>l&GEG3a^3$9bv7~OKu zD?0kL8$C!b(}`!_qH`|4OQ&62U&o(wn+`tyavlDUt98p=FX)rx!3Lw*cFX6eOU@`Y zc&eR_^tBgTB`KdJ9PCEt4P%*zMQZa&kgu$MZr2It-K2li zxX}amSY32=J#{q!`0)-!9Uj$6XmsS)6lOJ)L>+tvcb%%MCiGsKL`8m|W&Z z4{IC0+{PB+F>3P42TJK_k73BVh#1m(&DC>neWiVlK2`M}c|&P^zcsK-(gim>tRqjq zQP02CS?LCj`yPKwyB~6@cG&w^{o}kFY?+haojUW9dv)Q}59@))+w0@5{dM1?t+e;y z=jxc#uhT!yy-6ouaI4O^tfqB!g$_CXB0XTs5f2OD)yoU7e@Hv;{SO^$61wb`NAzmD z9_pB0tcy%chn#S=UT>czmJh+wfBW;^I`N#ECYc)g>p!m2DHqmq+I4m0Ntfy9Q?At2 z_B=YKk25J4aO{1&Vvl5B17Q6ot(AvGI|#3s2c!%2`0HOp4`1svc-8Gvq7Ej$zn^)% z_B`S&9dpKYE_Y3xc1azba&avkbeuhg<1g0d_AGjin5)*GTs6U_w%_lw;|ZKKy!a}Cfh z*^)o*>>G5z5ohSwvv1T{m*4Gj++l*QtH#fNuB^Uu?Cnjnm(x@S+Z#CG$g_1qjazhv z``#%R*NygX+OsMgJ}3J6`21@h(B60~r(7FdL-@$aj5!aDAYmumO@PS(?}exyFUj&2X2@$(T=~xT%`BS{w=b`>V8o2?570F&`|HZLhUnrJ!*p)5ViUqBlfxLDVGrW;mJ=d5+oZrxho0r*^IDA4 zHBI~L%`U?=b!kOJ3}aW8s=;UDwNKq7?Qnapy`Ek_i5Oy2Nh?hZEN@_P7_vBe5XfS1 zxr68H^OTW#ymJs{H$SS|AAHlGl&a5c<>uObFR-UkWVgJB zt-m+k%~Z_?-c*ZEdW)r=S;9K6c%7}LOzviB>x2s(W?TW%X6#+WT~lt=kK(Yv}z$y7Z=}^x#t;s$1SfeVH~&cN;J- zxUr!wa2>9${kWcP_Ng9xy0vOGculXgOL5592RXGvcj@N%|9-18jtB&6JJvAuTA(f_0rqjb;I2+ z=)CJ6)CD&+RGo*L>X{aubf3Zd2ItW^Z;U~3p*~3&uIuW(5G^s%t#GREU7}2Ykq?)O zS1N6w0n%1rx^@4K0r8GTZ`cEKnogH5!k>Ecb9)6Xb<^E1+FMI%)xc*TaASN|!O^&y?-cDT$sy!)}X z`ZT532)S1@t4R^j|@9{HzoHSIdZQ;+IxpzGZo{HinbQX?@K{-D zS!ms6>U`Jt?Js)UTg7{G+x3}lqojkbto@j3_}bNVo>Pb9QEnHWPizc4f6KBdV)!3> zD+wUo$^d$JgIqOD`$qHDmus25hLQ8u=(TP`bZhfW-O#d^u4>lLBrsH$HZ9f#uMg7& zO-C5~M;pM$>%6xn+5?zi8K)Zd0M2hdLg&9RP?xtDq*@=0)Z<@`(QC=$^lI`%J=1-> z8h09}n(c?!v#?d!Y)IrKoblE;o%+@!onkq&#TcF6a+JbqwdHy<>suXuZ?aeloL_AFDa4RD7*8R#h+gz#Gw#6IgAGu_mUC^Pl`pOn}=D<0T^~Bp6ta_S-RXKQG^uZ8c%XaHM%er4&a$WDPUpd&+<&q@u*I9^dol;}I<3jC|7wGp z0c`MGeVR2)U3yJc4(tAy0Kd$itd91;lKan$)(LvA`w(?7=yXUP=KO~0;~s%NGCe{&3={rN8 zrH|1^$tC*Idg+uq(e;|6?megJi`=i(z0d6E_Z#v@0JsY*^VBhSQnW_V2R(-Cqom>b zJbjeOWJ>hr4!@?BU&0dF3$63Hw%W%i$%K+IfIQb2#N78?=VXU{W`OO{`x^r~zYoBg zLDTg~`iN**h>wzoyPd`=W02d!fK7O^!IL&k?>}2#W{y`H({zItIShT;;1NKF}2@xeVH>xAKR$-D0!qh zq>a;8xzlV^%yC<>g6dM2X|9qD{KWgzb@tI8rQ;v1#w#u>LlH+nx)-DB;-DV^7 zsr%^r-G*9MW1`=X;9Aa*1@5PFRXEap-F=g#N504!r+2#!(T7PT`XX~&)RtY)w>`1s zp3|cT;jCHJwP>32c9_eZTf+An9up?-bQ5w)|EX^G5lVC2S;!IHWZNT7>OD;zSZp$* zL?64nNxf$~Joe&7_4R~)%Mv4o|F!QJHuB~34s~P8Y9DZKh93QNgr==2i>&f-3)ice zJKXhe=ID}U19i^p!&Rf{IGt}fui02z^5b=O^9eewsioOOon=5j*TisvN#T+=2kDkJ zL-bUSZ}gc5eZSeOHFnXO=#8ae3)U!q>MFJGHB8(D~)@gp3G=5!xU782SdgXgFVwxwkmUqV_})L zpi)dO$p(&;;x$TlI%z)VqqvmblS~fZsOOMr>NWHm<@IN-H(yuY_Mmp&{{%IB@g0}J z09@h$I?Q>x-T0jYmO93(;SDOC&$(;z{9c$S&$_4x24W>8>?=n^Whn0nbaUF6?_`#vrs-;=QE0k(IXM3OH zaK5LA?qkt8-^YVrR=#B_hqj_WClBB~d0XA&GpGJkVT8&IgNtR ze5h!>IW5*dipa(Hr}Ds>rL0}Qf)OjCUvA4Awmg#bf#gdc@!+=c5G`BHTQ>X(pvyrT zdA73C-L?QQq?ch3<`vuM3whU(=MiaG)~sx6ov|c1fJ+_ut&M__>ur%cf2T)2k)9kc z%howBMqsS4v;@Bu5~bl|yjvub#TI=%=Iy#|ZP}w=+JJr$EkPdjPtwHVr{7!e=$3RX znbv&)`O??jcldxa7H^5$$oKP&i|>h!N22qX4%1j1(Cv}wal>~Vu`ZZ{}*^vUOTw@SVQAOrP2cxWUA5Ve?|0)pWeQ zgQ+_2O@qIQp+@sDI=9(4orM^@&-FR+u4*w@b=wY9%j{_yFlU{nt!2@?O09Ask>!?! zrIpcl4QZq1>BSynbxW&0CZ9pkL+R6+kJZ`s7S3%x+{80l=aAQHLsh4pt!5A6nd>UF zu&i7;W9RCEXR@^CUD?{IHiYogi6QnQCaXR8d8a(KMm_sHgF(La#uQNW@XQTO=Lg96 z(G`AJhlSPnb*|{A5dk=^IgFoNO!IM?E#VXo4+S$cSd)aEG(>d>41{;e28mP!K z!vL3Qz{&7{@j~>KB1il|oi$IukoEJpH zp5GPVEv^iJ$@fI>_w!|P^g5@@>ib#V8ldOb<|17=jZE_5KGK6MNYgswgRyAPSkGy$ zPo{x{@aUTXU*j8+*kCj8S)$)$=65PwuZTRHC-ow3?5981#l)UNOeg4qc(j*+Fv^=L zM4wlMMS5{skR)Kp^4r;w6^w!4{O~M!UD;*CyF}kHS?zn-^YQ}5fXUkglmX~kchPSz zQ1(c7zK^K|*EL#|)q0Elq8qQjTCWDzsI8*(XfO1G-dslOF~{ezd3u&)iIpq1ZkN-v zu(SnU4cEw*_ReyDiQ2uYuSP!u>NG=N4HA`&x{|lkg`D^ehv>R>PCL?1(yi-sbZIiq zaC=9;D2RTBu5%yY*ZnBF^P&$9w{hY+^1B`UdSLV$9hB*JBEOxrlIrAWM-#)|b$jTd zCz3RH)*3B!S_{`!D0j>v-O?;a=eHPc&wweTDY~HPXkFZNgf47aVuBc{8qG$TBt}NB znqJwgziw;UTW={P@_tE)p z4mLTAwC6Fx#4yZW$*71J&Uw8=H?}EJi|i?yvZ74O%PTZ^+G5pwtB>}+J5yWLi4nq2 zA%@ud)iH_vmoO zop!m7KI3xz{md&&2si15yB^nT@20y`8E6giEEAn%uOQRbT0}A)+!<8^neQs1AE|eF zV*?Vv@}P{s8H*0UM+iq4F=%H*5=-wpknr_b$2PD7Y7sEU@{0+_8xsfxAwSX~ zzm4l9ULqZNz#tir7*Z_`{WcN<3-7_le)E`LD60Y?gHNo!&J$u7>UK3y#o_>jRiqGK z&rJz+@py?nBsD-*k-nb5|=wx#wwkCCqXahjIsxDnWOe19r6qH3~d;sDm=bi zKS*cu@_pJrL89_;9O_z?KcpUsNiR-fanSh&3wrl)q;r#oJ*b%Oi4&_6Ao+WdEtyLC zA6YBO9s@s^UpGakHt4EUyTtrJ&Z@FX4V$q_bzA4DMvGxOx#<|4-D12hXCw+eXrFu2 z^_QPa3|NH#ejF)O3DZj9n9upckM;laAl|sdIs+i=0cFcSy##lBzCOzup++yguS;%e zsI#uDud_`OSJiq%4?X*K^onF^|5*m(7}%v-Qid$@y~~v10hek?k3c9!3|O=ga5=A- za11bE^#`c}Dh9mklJ0@}Juv`ou2YZ*fT|?w;4x7Ao)|VJaranaU;(&nTrcqwy~1Zn z52O$g!w=&yZ4*E-`eAw3fnOH`WTUzne4=`~ym)x{9=2RIp5BiMWeVjA zbqx|Dhkp{{59Rl*AqFInaW!Iaonyw=_qzS<%dc=M>0coRen5Y_I{Dhg0DAO&J=8ku z8!al6>@XOF*Q&wCeO067P@UQWVi;vo7-&)$sEbSt=bIR67`$sVA0B;wa9xW&dMRmw z2G3llRe>2x*SPTOU5yRiuX90tZmFzbA-+m2F#+|Nwn|MtFV zT{XdZjnYG(j@01ktF+$t&04xa%`?Bzfe&Ts&yd?sA_m@U`MxpfxZivr{hN*+)i;U6gS}yW1Xj+I43c)eGvcjHBumEEc^DJT# zbPyBLjpembiSmw*4}fh<51W>#JO&R4Dw6o?E_0;+c;Ppd!FQ^I8wnX|2cUoR%fgn?x5k8)z~p zj=nqK`-8Jvj`aCZUDdLmTKAr>iECod6QZ(}tujHZkEW3D7*q){tTr+5Rdt0{8sx_> zFIBVb$J};{=$uAPI`fIhR^YS zzR!6`38;GDdVt2j&FOqM4HK(3^^fU-H0azhmpJ;p>L{PM{C*%I{`cgtB@zRqV0p)r zRP0&|T` zrZ4oyb05C-Nk{NlHl~Zv9zQ5I5{wM`RLHlw*Ac>zSll04@LM21NMmzC9jp37WaY>D z1*95#IPJcHxNd>;BK^1xq6hsZg-9Y#4x;3l(|k+NJp>u+AHN^@UnGW&y_IA_*#1tA z^R@dO8M^fOOpRM2t#NvD*OuwM{xfxcn;|;=?eRM6tr5Dkd4FBhe6Y@KQDQ>iTLXI% zEk_y5hv}MD1Jr)dVofyuGaXeydCS+C1lFk{no9cKYlyjsAMQMdHC#=y0O$TecJF=o*a*KY= z?K@(~*EV&jU$*uzFTZLd|?@9G~Xz8(V&&LLe0*md%G>=^*Z=s!Nbb;-j}3xh4%8*n2cjq-N6en1QWut_)) z;<#LqM?qS#c8j%H+%awRUHfq!^N>P0V#g*@=fN8}(Zg)oAtHr^k+3`lZv@54L>Xfe zmBD2S5|P3ngEntZMZ^#ckfrV;JXc~`Ea)H>2V#tfA?i!M*Jb|Rli--RP6P6a_6Xsz zbYm|K{IkSgi?suN!u`P#y;I3pnDpqMq!YqoY4CPc7E?Kl ziK?{1J>REYU8>?nWr&?eWsjzWLfHfGZ%#Hv4F6+mCGAuvOFPzOo<39C-I=cwAInqE zZ!5KOon?KQGR7{{kI*h|I#d^$7|!S6aC06K^YFPu7d0EC8(a0(ht6w) zv7aCDj~+U2DD?q9*SR7h1V!Y)a;+Pp=_J0g<~JEW={r%^wJ6kCO$X_mRy=@aEv2E( zXJqth?0GH5=-So;)gpbQ=Bz8%GAp?6w6(gg!)WbRr;ELw9BpgQVLRTkiuU{-biV7F ztvzc)4E;?EtCTUK%z*Df;YJVh^4Yco>C`>?PS@wzX zrT6my8ni50W1b&O=Zz4)g5~=M$R*1l0U$*dy$5;PV1tS~8jG%dp82)fb{wpvqUkDh z$Keaze0L&N#mpQ;=VuxOOP47Tp92g|Bl;qn*GUJ@vqxb7H;8=HeT3faJS6&E->>q< zDs#YegU@Vz&~<>?d{(H;{@;o(gZa_+JS=gZj|?`*m^d;A%~DdYDdHE?-s>_*?K%!n z*Zj#UbY8Iq-CPF`EXv5DcUkU7vA2}?@puziR6YZr>&x0ffHNO}MZZt&y7QBfnFdkz z=p%aN)RN(H=Q=D3cmIe0HS&UZJIA0@;xO8QH+#H~zD9T4v_bqVr#%XE>bQIxkz?Y^ zw$N5g(Zyb^1mI(O%NpcC?!L}yqyRP`k-;mOCFnN}2)GW=xc%6NaN3mDbfYvzEZ0~0 z-{_5x3e}?zzoWb$dSfip`FHI#Rd0RXTVLgV?RMnDJB!oF;sZGM6JC9ez16lUKGXGd>mEuQIMeks(Yfxi?-@*R?i115LQc0}1aDl~m?&Ov zqrh$9K8U{ZM_4z}k4d3t2*PM$f|Yc9HVyJYgp zv2`99OwJqq@*)Cc0@(3dH&Rft&h@m;Av@QRevnO{D_P()=IFg1L-gjy`3^Iwy3J#6 zJh}h4Zjf{Is&~}xZch_Q^t}Y*$>9(`%i;5!FP+!2-S>FID)u%UuK+JqdjEOu=PMk~ zb#Z;kpFaNL+nIX5JHO+NfkfN7FFF4_>pOlQBrm$peb(W;VoX@pAU+K3uMd+(D!Fg$ z8l|`z146LrYbDebUQn$OdHaTo{XHOm4AYY%l!51vu zp!K%Q2TWb6Ti+k5Gg^-~F-$N4lvEJ|Q#~V8quJ=_?IfN%+|;s29}b?Y$tH%CE)$im zC@Xg*d7iLdr6z<@mzkgHRArgHi5M{~G%iTer=#Z>qwPhE z)m5#B=&8;_HFEx%=v#~NOUv|D&TJh}ucL_}+X5jlt%T%9%YE!rMGTji7}}W_(nplX zrfL8I28S(Y2F91UKWbOYT2*z2mQT z=Y(iX6vcd$#!9Yy$mP!Da`iL-^FuAYJaBq>Ky=HUtWKHZ)uZTZJ=eOE0lufwdQZ?( zZ+;pr{FgIuy84Y-rk(~h1~yX?IrM`;^Y!-Ug?g=hvdb||PdDqR2cLdVpYb)V%T#2^ z1Hc_`xEru&gb8BgLiHJIa5Au_nHUQUOnJjssc6(n^&*eafPHKrF|c@-pSq(9KK$!D zezoH+i-dSgb79H%BYZT=R~tA-crcCt_?doiI!=@CF$m8cxkLqy*K3?XafHh<+G&q4 zf%l%GN8aqDPKA85XP`BR^NVV{=ih7eYV{ktCR)U>@0c}?4*`478}y3YUeUS10HWN9Fh)V94xuTpaF8T!O+$4`)E4V>*Thr8~dq?V}OBdx6efsV`X zZY2@qCt8=T zn@Oj@ZQpCedhhvSo<3plH`(MzAMdSKT3?KXRVp;_^Mn5d)?K078uBh2X`=<5mMl@x zID@wPA|E*R9Pj=G2=iUXDBtgV_@1KBaak6g(2eh_ZOJl22R8qo~@@_bkvRazND@_C%J9icSc$-qe_+1 zZ;8hogya0jEV1y7iLcW~oL52dg2=Gx_5ba?2Y6oBbtU>`GLBinb z&E(BYk{3^6Te2lfRv?gM9?ai^Rb)=TcAdq;pv}r_R$_?L*OPwXL+YU-h_I3}Jgq_7x2hZS#wA@WEBxj9Q)@z>AW-P-`ozCKUdJ=EB<-s}Q3eFI) z6@7J7^EI=8>YCa`>7fe98K&zhS%DtI7>2q3R{sdxvaaAomt6eFwFWx0xQ$qDZT(F#pe@NPJzy@ZjsDIa%hT`nOotznC3s zUL_sQxsSv;&Bs76nzVA02!x4cEpP}(BPs00W|uG=49dizkX#&3s4B;BR9bHSQfUrL}BN_7&!Zr*6j34wbcy^X>Kq!isW(?zb_?T3xd!8o2+%f`w| zULu0(AwjglmFF(o?t=}EAqYu1i(&$IEcLM8CmHMQL$U8jB7a{)WY#5Ya0tE+l2_>BUr1uOYxL?FT*l{6kF>I0 z^C~hRrp}DsPAzXlOx_iGqs8?6Ztz)L#yZC^EF$4=_lTkK)57bo!-bw?c;+QoiW}h< zSBYbmQ|9-6-&7hG32>!u6e>lp<}~Wu-Zz~Vc_Sh+E}6-q!stbx;PdbfFULui?HE1i zO%5^CK_Fa@=CW=y(NMWU-DhE^$4Tt>j>Xb#p7^ERMwYdS9#Z-~Z{ zq6Hj^EWmo_<9v=s;1-f+jEV5n({MSOiamTzj{fXhog&zlh!ekDigy<6!^CY0>vOV64C;<6Vu-=>y9;qRm)2$7ps_HGt4|%tjkK_0@AXQ+OEcE9as(qj?-DEf zHCEC(Gn>^Ok640nF&3{sf(2_2W5H?*6%xELTbM?ZwKCB!(Xu04ex!h*Gz1$ z(X`g?lB^9;Ml8?rsjb4b! zzJ%$^_G9|ez3>jr!B&EXt8a=4Xt#Pt0CpdY#1CGWjaO%`g)@m^!D@T_=;yOB_d^G~ zzj!a^ukl25P6Ms9egZ-}y@f)&Hfs}p@UuDC?-_%o8$IyC+bi*w-4@JRwh!;l-;Tq_ zGZAX3!Y`(;!Q9mc@cy!$%!?;I3{6qW%3j=IKy~%*qii_NcxUkrHo&6<%^TR|9?Se5 zAXxaZq58r9WGU9{ImUDLFpWc4xy#>#v0k{r12dO9VDY9y)YU%tMwJjq;<1c+jvzsV zs$1`_030B>9E&SwLtlcoN!TlQ`7vLs;dwk2Yxn!(zdiFl7BFu|334g4iuH==P-p?( zrN{Ty-0fygfmdg2rar?-4t02a&JGi=Y4x5!0&fNLbQm+1Ibh+sL)^dJfd3BHXnIk; zh)TbR{RELk>pgk?QOsHCNTR4A=_fPKyLl~1b%99M4*vAmoPFXkn>w6B-OpL>2v@&U z9FMEQ#=Xb*T%53EqZ@wu>H;iScNodE{!KV`TFik7RrsracnQ;&?1+* z9r4zJ9VEG2_?;}l+Y5KWgWjUN%r(r@Mgpr_U?!e^Z5iJFz@EgLNUue6W8bAwQik`I z9)MqT8430ze){?{?DdSsF1JY27F>^J(FpNnp1fGcJn$y#zF!mxG&l$EFWJlATWBPm zpyA+wpTD;pjwJJG%j{`1q$4ct8ZC5r$8GSAEW)g{4zSzch+od%h*_(h5lDkz=fQBi zIPF8sUg69#XB%Tl9&||B1rpw2Ok28}1bQ5Pk;U*KA-?~?0oGM#tRPVz4$i|r{cM(r zv!#iao_}YRse_T}=djx&+SJd*tTQv%uI8?GrD0cN_Df%jSTEn4x82l3)!n(PU9fuB zQG_I)BN6=SH-_Ji7`{}!l1L1*k|;6w#@sag5rOnOb5rn+eLhMqb(*mZ4Si!cRNRJ_ z+$->m>uEgWSVI!1G#IbTjXfaIGJUkDtOX4i@4UhsyE1TPc3#T7sWD6yQb8&)}-j&=={U zRO4NbJb0y?!kuyJ2kuiXLzv-OhHuSIwnmE8mKm4iSEj8oku<$Svhm)cT?9uT^Li@7xclv_$YFSQ;Z9ooWqA6Pxdg6_I1-wL83cp{ z>zxUPrwJfCE= zi6r5L(1bGXcf>32tbkWg1{`Q%|NNbGI2K!L-j(Ykb4=D%EZ=k(Z_n9^khlsn+0N^< zc(>XI!qF=R&%M4Fn-BQoz@Z2{_3|8Ax&fHCW*_gr60y8iVXaf?EyQJCrNUlZ#9||Y&S_o>3;NX`?puNd5 zHqooOP0&)%zBO35#tC7T3Io)dP|1tl-;ZBeOainwvzQ$wV2a4SL-P!P%WK+n-~@q? z;IU*M4)OVZKmd_!aXNuF=Wb>inIsMEbECDHk1dXYB>5%qI&Q(jRr@e=(N=7;KZZrC zoUoZ>xt3+JBZztU$0H=65brP8#B06yjPKG2&?H181`^-j{qPOe4|+b)IV4;!EZcMt zyIjLCbLl>#=jB_yG5bSj1VmLMv+NEE>w3693BR1Zo+K@=$A=*12#=s_y!h@qf@Lm( z<139$*N{w|=vit`3|D`8TO!?UUZ&peKNN%i{`C7;z9$IBQ_mA8WSO^;tg7+;()}!V zFqUp|ry)TCUUdMgwz^~W_Cwh291gn`F7OE}zCz+&!E>TAPO&V9 z@ej|wgI8y-!-uSEigzW$N0S64mo{R9Lm=K=x{cm+K0HEF3HWHxMhf`M@Wf&oRE7b*~mbdS$)|?x;zL=B%*C zG`2?%wu#v*)Q$rX7+XftkKyy*!gd}=f^#K#a6jwl8hXjImhZ;_uQ=B0eOONtl}9WO z&wO8@q{(}rO#OaXti+)2GhZfR__bb1dexGIZ_bFtH|J;KkLTpzyYn;f{FV&Fl{Vwf z&^VeXA$51~)}d0oa8TbAG_g*F`Nr@xJqQuQzqnpEagLrQaKGwNjHQ7^NWOFzx2c3K z=F1Fpo6sz9T_lBeOpM;8w=h79Um>(d;gr*e>4)>NEVu?+<1S)R@F~3IU4~a3vha$1 zAzpMjO=7r&r<`i>rbiL>(pqR{S$jwfS9$%$kW2Uu%keFJQ=oiviWulMSbHUj81hLB zok%*}YeG4gUM}T)$ZTxc)zZ&x#N}S1MXE})j}>G$8(=gWwEPr&JiX`Xb8dWnOEmy?XE*O znO=4WAyBo{Ve!){uzE1i*)dj;!v zD@yBb_=V*lDy0g~zp)srw!72f-HE^Z=NAZii}B-M%)(Q@Sb*5f%Vy%0OuF;o$!7?p z9t7YO_#Z!giuXOMsH(1!6ppRndh*N9@9(` zk*3DXBB?kMkk%0#j-D*WTzUr^Xdt{w?{T|xD4cxbNer7<9t$mGds8Pe%CC|P)9Gcc zg;!v#nM3-YpMC=`ys;23y|Dya_V^i6n9t`HlUjz-x|@7Hj`(1`hne(7QwUY?Pj1aEwwXitPygd*_?MSv!He}GwWJZb1juxjAtviGE%$?1u)&`7 z^D^ZsmTd7b^Ju7T{9@Wt8eDn2rkMswC!cKx+eRaHxQF9~_m*MNI!7GzPsE4xMBV&T zkXUfZ)VZ|M>-fnp7ZU7Q#|tmhxH*Bh=WjLj?#+3dNf4<#?T9SnfRv)XC134rRD?lGaAF-as@wh zy+$E$yPm?&Tnh1~dloiERw4HMU0muJMd$DY6*9uY_F;6q9|L28)JCkDSinMdu={3(Uva_I~t|7@B*= za4@wIe`%MD@6Jibw`Qi195V5>8T20J=8+iE@O_2*ATfB67?NpmsjH?w_^MlBO6eW* zVKyrB5`5_rhY*~W(K>o<&N^09e?tswb{`=LcwyF(-3UBc1mDnXg6dAJpqFqoG9S|k z$WGpINXom6`2?1Q>)g#f6i-Nj)poec3)n%AfqEkVuiNd7_}tUj>~suoFWQ1&0&~tO zHcWaAC$lcm3JkoE477TX}WnMtUzK?}Do&|17*qOY&$;DNc}J*OC-=xkr((u40F4gb69W zklxJE=n|9WFJ`R8k?f4?xZvISd8uw;XinISDYy$Xkq zC)3hjX~J|LK9NIWZZrDN)BAaX_jZ!s^Y1KT`F7G`&Zg&6VdlIzN>4H(vC8Ol3qjkP zhR(FPTbZ{YdXwqQ#||vpa1hR{uRncl30xFDn{CZfejC}R?-J0O;6#t^<>_k;G3@mS zA+fB+^aUGP@6+i`We_|aj80{xYX&{dm?vQf=ll(Rt4P7Nhs|`vXV}XQ5tS>cOZUVxL3?56Ytu!;|;% z`4h%5e0z2ZzB4Bo-yk7;)vf>vU;THB6R?d|`}H1$xt>5-%K)~;o;QQr^eRbHZ~n}w z6hC#S#xu?ewS5UcB}x3$iB|q0vaxRo=6K~|&51Jj7tvCFVA(`)#X>1iZ}e0mPtZw9y(7-C4NQ};T04C)_E zk3sJb)kV)exBv_35zM5;@HzoaAJ3d=^~!SJ;T8rb0@e&xmYEbgg4m01uOKmaA&}rP zpBB8wQG!(Ab*!K@wRH0l6Ja!iBxEUT#l9oSn6ui27Gj05us73m0GOD)~=1U9C< zyzT%#+~y5G63*&fzUCF0fMnH9AA}}WW5HTiFi zYBMWXa9lZFd2bE;2|^jA4J1To*dK}|sZ_AR@50xE2v8^TG*H9*>n&j zJB;U+&Gs!Y{I5TLm0)*>UeIaQjT^M2J(!Q(Ec*exJ8wHlzmP^l9oFsg$7?e;;C+_k zd6M4h?LMr}33%OZ8{8vG30!xG7p=&wQ>TnJ6GHtLvo|wsKLpacUMlN;wLKyUo>A$i z&G!wvRV*6~i+30ABDhz=odh(Go}O1Iy}R-TY^1mLCPCSo9`)<l#Z{wpN4PHWB3M1;(N0b@Vo}N<&yOk zYJx>7oW*_RQPeg;l-mro?B7e*@^RGIk@o>JNhkKkfj zx)vM`E~Ir^X?iQAmNc1ev3n1tATsj?D`X!uiM{$~tEbI@!zr{-b7^Ik!i(2Mq+MVm zx(PRW0zq-r+`a(^?<9INC$Rp&QFtYKtw-ef+AZn6)dHxxmyBGv3mDZWXa71BaG z!8Bs9?{GXpqz0*_jpoDu$;^v9uNj`lvPlXxCcln8>Dc9&h`_`%BnE{Fr#|?6UY@az zR;&}YvQh6lY%x7+EJZhI$!41nBpH=$Y!4kc6k3G!_F>rM$b7Ku>PeP+>K=7okKKn7 zNecD!BwG-Xev#!#M^ed61R5ZT!8Upx+v({z9Eqcsae-E7E$qGGvBfczbt2N_F|DML zo=pKgFZE&zrH2s)udpIMcY+M9V0EF5&AGvJVoVR5&5q&NcPN4BT|-`tUfI>rE80YG zOQ8PgP13W~9LgGFlFoW|EUpay?di91@Hq8aaf|J{jpSBE-G&<7ZgYu58ub^KbA{IQ zDf3+P9CjXzhX2Vj^WoLrHx0+rFJWrrb7~FqMv~B+5POfLm^mgAiyPn-lF#Q;V8+O# zl{dpHya+o;xa;`59Qh1W%bSd+>%nImnR&tBj~|KFnFdZm;Wg~_PKNW*e0t^j9;9xq zU5KOCaD-muIugMqdK{WGDvk9!Fs2M1fobNOm?8wIdu(QPFJkg;V%MQ~tUC}yg0~H=OhE6B5CXTCN#)_~y94&1| zb;}^`4YM5M8r#s1k?~E(E+CZYQy1vp21l{Wua{Y`{95Ae~ANA+wz6 z789gcp%wo}0q_zD_!`6&SKMTJq9hY+lIRs^fS3k;CD01j;GK`+{j>6Ej)&MH1=Z7F zq1z-4o1J$xM$f=O`VFgXD=|x>s2cz>3k=PS+FycV`SC#@EG-|>u9BGz?Hg;X4Pt- z9Cb|+k0z)|KPd#sRDw%Nc?*BvGiw;+LZDU({CuJwc7?HsQ5tz*s}D zcbZqAY9kt~sIH|Jda@ems4lh|2&dPhu_RL6Ltd_R6gqXxHe{wjmEL&1h3Th|u#(Hz zwhCC^%G49EkHYe>?x$C`BBtO9)4FET)+l_vVoPB=%wSteGlS`@ai%QPRRZf)9QB^W z<7uqBnHogOXBE%(8O!qN-igYq(qI`id6w#u#%ZX%>G}kgKaS_>xb$N5VA5s1W4Tl( zGf!!*5j|JdE!G$7C~W3Mq(J%AUPup%h{5`?`pZoWvr>(G(|oKgqLp1_KIA^TB^BWW zCH4Mk85~E#nY);IxD-#joWcKeyNG{rJ!ia!mk$)-1Mf0~urgjD8ECx1eP*V6bQB!} zV>sJL3#YaTAw^elIP)^xGOxok_ZGsK$Kv{XxYa#?zL8;!(pykh)?cOkYsOa+6VZ7mf3V$&(9N(WEi*L?IB*|sq zPiNj-v$7Ff6BYiVmO>Cps@AAb0s)h&Hd^&=x{GWQK{hLafK#ujEZmM)yd$QcAdp}~GoyobzJQGB znjn4E{geTuof_eKh$Nv%ql&detAqDf0~J`A(ZZ~BSv4AgEbBxhBCADR=eo^U1C3j- zj!I^ExG$NOR!ZF<;(1<@elwqnv!nr1#uYBp_Xh#heO}LcQ>73cy~sYLfo!slG--_* zb3YsDFiB&S4YilQSq55|nvzo!#AtqNeaz3+U?<*N-!(KCNc?Sqnax|d!J^}}tIS)+F~;@0S&>FBrCnY?cr0aDX=YUHgZxJhDTG_k2jOhHK( zu-7XYf$^t!E{TBm$}k?2M&+^`8nLeOa@!huf_c?%eNa?6`OMO&Gc$LB^u_$73&^Ec zJ~z#^pwZkKoTdqYBuU&>p3Qt2^gh!y!yI*?d+6FU>4Vo=t#Mt;GP16i51711<|#gZ z>R;cyG)^Rg*9JtNrR5(-OE#OwKsl3nR^8Af zNYbMw?6Hnowr(zD7ZUGmxR8K@VJ<_}3#B-S!(phLAQ6JowflPOWZN}pv< zXL?4XK%cqB%(EfgD*qz)PUNr-XOvT4dREMjnHY-YkcY1PNDn5Y4EL$Ls%PoU zUk2N{buuG`9MLmW-C;Q<>zlQ0Dh;Kn_C+13-Z4M_c8THFMm|px!^{*bG1wL1&*qnK zUlRW3Y6}i!Tthq4Rs__-YrR-~Cp6j&QZp6}( zPh~?>g_ISqd4FT_NN5@Lh{)~75@0jHTTh3Dy;MFxRBk(Nd#Fm=>lHPhhgf zuwgn9-ZxQ=fB>9QJxHsKUQG2c^QD==`dN|KaB8`&$|bjy_plIHt)RyI$dWRl1@u~s zjjxOqo@rVuu^KMRM(|8#I!Oecc%G;FV4dwuWWfB<+Da}{W8pbvOt*|_l?l`o&~MlP zrl#98BeJVUXx$F6j3cc0Y@{MTmd7+krXw;jLGP3Yp0Cl-$t0Z&rXk&kxHNhV%v#Th&q%*@o%yYq_EgTgVZ;>4dnDkno+MB|sU#ESQxgJ7 z1f~hHW=Yn{s{zwVeaiz?T4^M$1U?hxUHdH5fhH-+INgUhTD}UGqP!`_Z0+3$x45$m; zNBI^h$_UXqgWj_0lXR&tBBp*x?LhhWmBD$_bGy~>OpDn znXrC~oTns_WwmZg-xQ{0Z9}ZjWvuTN!(5B3tpYevY*A%t9 zCb@!Zg>_LK5Wxwsd0cftqxvmsBh0t*l*+VJRz)dJ;5tcdS7oGVpV5giy4d#FrgAR~ zne%l#k?CaCsZLp+vk2TwU^GbvzZ)_90b?b7DlrfUKP^_$pL6>=GZW26+CQ07fUnu* zD6FZR-feafK}KX9zYkLfX}>*_4;Dg?11Hs2q`_{0dt z6(EoKGliA{2=p4^tblq7vpqnPQP^yw5E1~!1}K`Nft~`(G06QRx^8Tg1!9_mqiCTg z;%2#mUpg1#8P{q&?^=ZAC(2ON(2cHvbT%5j{xOxFI<}OmqSN9g=vWA}$pqIVg)kuKYu;y75G#o2x!j|0Th=Tq zYa*XhGOtTu!xpdz&{IT8YzRpNEb~2t_Ygo@XU-yU$=e_p2rLaT=pFM>AJa~wCzHs=oJvwirFWAk zFynO+18lMYxnDq?&U>Y@JhJ8$;zNXBh@qsDphlgP5D?j*^-4kHBa$-rXQMLVs#PxL zS)`XDy-=oRqcic4q^A;D>H=Zrg~t-~eE6)Sw^TkC=}6#Y1#4cbvM6l>V$vgZ#(g?3 zodj(5izJwi$|I1{vowM0ly~Y&;F-YlEz-Y^iI^vKWP;n7=OkSzugbp_B$aRJLiHuX z46bAv%$J$yhGG$ch`39s2O0^fB)oL$(rRJ%Awkc$idH+z7hgipu9hS%B4M5t;89?2 z>R*Y{q28HRCZA!f3H(SPBMDhOHF|ff?=lSJ8JRpz)=7b)$j&(dQ;xZ)OYGk^;GpOhGdp`n$JjtG^u;l84KG{D%*r6Q%WKUDh=sa z*Qs5_vz&U~0$vltiu>gqrSM!4r{+a5UZ1Hi%$u%PJ*9r7cWeEjh#(9w>v^!A^VpP! zCFe?~06Ha8dlZUJRpD!rgY{N>Deyu7U( zzL^975<@~&I}%6?NwO}~=;czbeH_f7?o{CfPN{5^No=f1wC0n!Z3QZ8qqcsd zkVT*d#`6jEYES}sSvl#|qoxtaf;3hOtt0auw^ozy+@&Qi&xMVS7Le7dnFJR$U|BS( zoEBQ%vBmAQ5L?V|Sv&&Mq@q?N<~Jj$P~#s2!faf$G?NTyupx>Vn8$dZb>X8}OO-O}g-bddnqB0wBGMDST+XP`*nj!?2R{+Kasm3fo)Y=e) zK$VR&QTJAiAH5o*K5_{V=>!{z2{x#FGL0PSBcI@vsq&P{o8`H+eJD6Ph-}_VM3KQX z1dPc{+e#1uN)dwyx*u^QZUJH{b#CD~i2_lsRp%|bjykXcleLj6KhkRk?_>1K-?2sQ zh%UIzwA#$^ERux0C=r>WYbKQuTm_cYR{{yuyqaUWsWKQy_{yKWA8UX?#VX?c^h%7+ zRU*sQ8g!BMhrkz}*+{~s0m8Bf@TEg}fqMOvB)tmkn3k1HWTZ?QBPu`3Cg3+-0e=gS z6ZpKX&xO`6$x;L(D>YqY!TiMKw;(dT-h9(h?4}$(Z!>2!bs|tSfU0`S-xgzCD^J>Q zJ*KsEWxjjKfRT4->VWE@)nk=Gq$7E&82D`eK*TU5`uzwV1Lfgw z3?CCig6Z%76}vq1PF~*_{JD6Ux6j~bh-K{ZeTp@2~lKzWP+pfDTp1X(kw ziyD-`iH$g+Snqe)0Bbr4KrM9f3Gk;B<+2^IWqeK~2ulU6wQ_}V?jRuOqZk_~f6Ky8 zEN#Q#$V#{b6(Kgi2_flM5m(TJWaih=I}I*=*#uk#J|h_rY}CL^;5>nq0MP(MGkhW{ z;T(_y|EMZh3L25F50E9d;T=|n6+4f^$v@M?gi`#Q^#{UW@0$hJ<0ZV8J}xp15s_X` zP%jE9mPs91zrW};78?=oC7_hWt5+Y#lP=+KcsV>mN)VH)h_9U{aG)Z%2AotZpj;e_ ztuufXmwO8VF{j|bd-_J#;bb=Rr@T|FA<_xt=65%VuGNJ3(EDV)*VcskdIxSumB6ir zsP9L5?V(BW^-Vy!6zMC{Yh*S_koid{zHRin^`HeoN#~hwk^u9jkJ|cfqL0odtT~@s z8by&`_0CzqE(cg*sA1b_rKJIIOOl}j&_a^oo$%cRY zIi@WmL?qC~Ygiuy+9FX|?|OB_vSo?9c%DGgQf$?GCd+B8R_Y;BF^8xZS;u;vr+8Rd zb$X3ytw(y*x!pA$OExQ1L?NOxubLQ8Dwm#}2uYGa&q8Tt&;ya4O}Gc8OX5gjx{6h# zkHu;W>ft8f)@#5d>OuF_bILn6gkuTkvEL^PVZ2W)>!;#ZsV?id09JW3U}?xjUV-&q z`o^LQX>At%t-v>idZCE z7^XKcfxEq9$hy*nHxJWdcdEoQF0~|vQ&r5vqCs)T!8t& zOF);WVL*iqP9M{(VS)AWRj+Ckidzj&-D6wW5O320>>v@y`fsNvLD1r}Q7;e!Li!L# zQJ2cp3iUkVb*0S&*kX8w6ymt04i5eq1e;Tc&$@zHOYE_BS0Lim1I6^RAlS&loysFC zWIRb=&!HqNSnCD5mG1ap!w~{S5zE*HOWt*C*cXhq=I_G(!|^!a6>s9ptlH@hN8eO9 z24o?rnE9UU!I8tpt_YTr43;ZXAE2vPMwVS3K}xAUL=&6{WcI$9_<*2fx5k}>lwrD_ zW>>ethhkabZqT&)kZG z$8(u)0wBwwwvt-fN)JXK*7c2r<)@@^TRmqKHeAMp0nmz06rApb-^ofW-r#M5uw_*f ze9La}+S>?CK7-}k0^lF5{{L6`9Fk2?HtAEk%R5WYfCR66=G5`o=|eN`uii9@{;9g7 z?^szZSB^SJ@VLA^vu4>9E<%GdwXI%B(v1QJ=8=@5(l3}k{_ii^OXDHc1o=CedD+xO z5oDq~2NJqo+ZfM{K%d68pitJDV?+C79Lb~0)3*tFlh%EADOS%qmEzThKB2I;X6$7jput%pkL$(rb9mwHj+; zZy>*E0)2W1G%?J)XtuToiDBfoAcj#AgFayQks^jLz;qOvBlL7PX8E7SGkfyzwo3_i zg`GiF!+;rUapukl94$BT_lqs~=A1PAJG(Ue@q#pZ3>FeY0$$!;Nn&6HpCktJfsEFP ztQ5UI+2Iz47v5QqSs&OVG^x%+H1#}@hqe1pV5esS8?>UJwi!_+mSyO3vVsjk4gEHb zC)VL`SRoP$uj6QJ1-7|H5(r`um8t7)!aFh_>m83{=b>m?Rp)6@u_2I1V(I4l(pnCP zsbGU^#1X~v3C(4ryNST~N`hpmiS&9fC<7ZEPT-Z98%kjUj5cj zB%L)4U*R~iNjfn(*SJ3l^H#ZGmuoEC{IalNPcW8}9F7F%o1lCOr1$(=%dvisAKqKE z760(#H?Y<57@YkR;pCUXN={EI?JV|tTd>(F4DQFXk&u54C)79IIUGCPqe-ggO*c#R z63JwJOQ03(9a;kWBS~1J5!TE0QKyx(TI;ZS=Mk*h;SC4xcpN)fg7lJ`*zXyOH)e0c zUe9=Vg%p?|b~yx=bdsY8FNL0!NKv6hHampEt9ScjJAb>9z~Xc3 zNt(Cm)s(SLgwyH{~@dDzq~M?$I}pzat`|rSxle$)Kbq8y_#bZdp^;HyJc<-~D-L>6V?0vnO{>#@K=sQiR${PvMPJ%pNgoqKl9?9sPbZ1t zo3oSgtr;=+s|B%G8*&!SM0riXU)R=;mEmXbyi>6m7(Rs<^jb(C_|ilSxsBN37=@p_x)jsqZa3itoc$7E zx7x`};Q#L8Jy^EQ&x9XNuOR3Ww1NnXi#K_h0Z8%rR|%X6n6_jOK|Kd6clwxMYkNE+ z2y!)W3rgbk?pVFY2X8OhVFpOWj4C%iv|e(j_37c?mM{Zsx3XARq-pArCSux(VpL&{&G-%qs|_9=E%MVEU3B zJYIw&A*uNJTMO~_+;y<~aF2;fnpfRqVop8%@1Ay{7()+aKi2N`$E*+c zWBK;OI24@8{MzGhfAC9|Bg}+y_{X13$1i7ZFeA2Ko3#;+^qL})PhkPeyL9tGK1WwG z`duTR=d5zVFYUI|;|S&R5s0>!!Dt5#$Kk&}^{xqcxXn2T`L#_r7E^$Q>zwfa{^%XJ z5+r@Y3o(C(R znO`h4K>_7`T1d3=R3q~mOube_(N((wSpVvAG^U(7a^^h_v+j8Ceg}<_q$sKyDZO@2 zAZ9LegnM8X0sk6_;-o2q0#Gj6;7+}qBguvtov)#>v0{f0j)WIrlYOu$&xhN5%)JiN z*wOP-_?S%&!SD*rGhU^PE`8VevdX^^Vo-P06e}^zrpKUHNt*R+b_%{V+k*eNAQA7n zw|F4fVU z?u3ON!%lY#UY@=lKH)id>eU4Vh($OUn1V&?U1?=SVC4=kHZotcZ^1feY;_7kWO6y) znY|X%=52=eiA;j?3B35;dYni(4GkR9s7}|TX#^lgxCNx3pr!-GwOvRrYQ(}-2eEX$ zCl1omeV;_M)&3}=QYx@=n=38%l?28TEZ*QqaW=7W6!XabNGw7UE8u@JpFrtuLVGOU z;DWiU?D68Xl>|3=7hPtO8r8Ss@uzs+VS>mWtlH^`n9M5db_>E!elZJ6H#!o)Trqp; zF2tnQ!9P3~+nN8>1d&(XU(0*NQ_mWSERUfPy9gk!&)o+9$U+lIa~TO@9)We$EyykIlP^ERsnoE$Hx!3)Jxef@>%OV~gRyyenpo;`t~X$-mH&4o$8yLDT;AMLPoY zVG{&Sp~sgI+;;F;zVP;P>ci9M;Ad|xHZh-mNe@k-!Xwho(W7fdw!%o1HyQ8e+1EcH z$T_mSJ7~#QnpjFRm+i*WuP!2S#Nr5n@AcW6;TKVWMby)6h2{jc*kxd_K=*8 zhGv-h;Y8ykFe(?*7Hl^$q9W*t=#^&z$vcGP{SJ+gC7a!F@K_>=;XHP^htZ>&PA}>R zW-$NHz4ZZsJsUrNXPJ4HiY>K*gtmBthlxU~yeL}kl1(10_dD5kit*BWD`{v2u`J~# ze2M1&P`>rd6qo9k^mb4X@yAqlXOYQiJ3)Uy8 zordLHj~P#3W@V%NDluqFUc)0U(v7?ir8mk#jgf5VF^qAaMn|8y-HVdz9XQ|7ipVeKp5=R~+2J@km`YFGMw9*bX*m5jf z>uwsKZ$vJZ6BIT(1|s{E-b+_t2CXF5fGj@r+eShXYe^RSXmy5@7_MTYeGr~~b2+W_ zLIdK8e!0alfQ=`aR@VXiHT<(4R;L+k zO|<@8u!i2sA%ecb1&V7@631Tma9DEBVH@-N?t%?SFTKS3 z+Z*8bIG%=g=uxPV=hifn=+44!}ClY3A$vRLP=VWr#6TmswaT`VQJ z&SzT3V)9Htwzuc4$Fb-<>N}gB!zKhoJ^rqJq@{qF4>|Y(`JHlHFcGJSnMQX`40{JOgyPL3=1i!~K z3eUW;#JuX+?-gUhio5tHvV4_TPOojw(*0OMFYCuI&c*b_+wuMfJMhA^#)N$7_(RGF~Jw-@>#16y*7Iz?7iYlh;N0s@CwN> z;lS7I@+Yx0AxmKy($5lf_nW|giumeq#6lvl2LH>iZ8O&^CY5_&x*-B>3s_I4pJ9F3 z%KL_+pso$EwASAuVXvhj5uvc-OLoHdL^?^o8uNHvP+TRFNoZ-+cZm<3h|0e~@5hhc z;9io0BaX%8@_9Mq@BZ~A%;mnf7p})^b5^kqSXggY(JMGY@V-S4D3$eO7YWJV1W(j+ z6WP5rkK`RyV8~VkkzRJ)oUi)#gXd6Y$jqR$}-MW*kE$yt6(g26eAAUG8Y* z3Y?Ebl+j9)H6DUUTCs~Zy5WN@9`q_2;7E&T+6VS*Ace@*F#6IKL}grJgL0?4eaO6H zm({AkcXF>I*1AeG^I#+OJz0oj303B!s2PYwt0*kB-lX+1t*R}K zA#C)%v})(lO^>35Rz;7&hvaa~xZjI6deAzzATjqmrZ3!v6vM}k5H0I1 z$g62$xm=hhCwfU)c#GDyLRx3>*&k0RH`d{c@2$orTHk(=dGL)aKy=m>);r#}^bQh> zTXb%)0gZ*5Uuz?0*59n(!31{g`HG*on(6oZ_eL=6+8VA zpMQ;{tlnZbvB^0SznHZJak-Zfm39`(w|JABTuG!y30`~Pb}XAjNI;>rsqh*hsTc6} z;sa1Dr(~Av2)&FKrmdj|m4e+KCuzkmF(KCX6L6nZw%L#x~WCqI374sI4!)w}#}HhRyWmenO8=uLRwW zr5Lbx2}mWu=drvZhCIw$eUPN1yE}o`x6S|A3y^aV**5gnxSOEw~hF6B)J$b z&s=80#OKwvn{ONMEZB?Z-(JVM;Eha@n>sA~a`qN_l*QEVVmSFFnfju64iut9lTxkR z;m3MfLeeNDnbabkq;V{^oJQ0xwiQ?NdTN(v65dI|SP3f&`PNWR#CMZxFrv=hAsr!u^MxEx_* z`R-wXIP=1cd`t}L!aBgMM<)hrS*=ck2FIC#jay$)iFBmQVU}B?qemydLrjcyQ;~yc z?jD10b}RmRUOc`!D;8g!pJ*ipdJHdaulkr6DmzS-+kA<7OV7Jy4^J#$} zw^W(;>msR{%N)#m>?NBH6L>4kREzW1d79}IXONuTj^~*V&ZY+q!Pkr4+?+Ls=y4q+ zA-G}sQU~L`ZFk`_`p^Yl;bo@Bi@Ink=8>iNHa0j$5j+oI!FmspqXPl&h?x~np3Of# zYe&+EGCFk$X3yY!l6n!r-JalGN5aUVXW>F! zxbvC#!jad{V!72*OGZa{+Iei)ABySpQuRD!G;DMTA;A@4!+{X$ibllrjV3zl-a~O_ z);8&GF3(%U^a5gQsPEHE&yyB>8K3iIdc*XFSPwLfr-&i@Oh1BBE?}o;r19#Wer*BV zkEfcTe6P>jfJK|!uws`NpS3z(&;X$;GDtdvTW;7lHnFUgBTRh5K(?rCUsO$ zeVxv7f3W$m`5xjy&vhY*P|suewj(Bxsx(O#0*I3fs4|9wRUzB=>dClJE`iD8g>xq~D#7)|36SS8P>dq%nkI1}+9UjyVW%uC}Gksw& ztyM>Vf|hF>0XLJte%-t_@(jtx7T1&5;&u`~(N(5#nsC^(iqwbuc+z?7F}+r zYgav>TpW$A;QnSrW?#cT{~SaY^4Zf1NmC3M zdPea@>P=H=zGG}AsO@DwLy|7APIMx<=Ug$ zEm#U~(b_FGJzjRYCzx_27Tsc*st7tf*V6)zkYdCzEfX7xc~sn*Xr|{Er}-$*ya|4t<-xEiC^<*pUl339rTtI zS=2wKisec(aj+8TQTaz!!7sc5iTStSdAxv@ZUXZfNixYbLH~SCR#P+wwnlENt0xJV zIu1=E;gC$iGcORtn&5VVmNrRH^I0D}uKAR&u?}1z@D`dNf(j}qJ#Tl5rME%gO+3fv zP)wjKX4_S_%{E%;1Z|H5qjQ&|*(UsRXzDo=3u=>7B#jb_=?D?S`l9Z(TUaNyF|8x9 zXH5B{^P0@Fjmfz|kFptusi)nnr~WZ@%opoNO)v9%0}lS_Ow+>j;z(py_`GkJD5=}r zqM5&F)6-6~uetLcn)f-KI?k%<;xn&>qo2Hqiw0Yc#?+Dk)GO~6)47U$Y%|ikNHaR8 z-o&rc+}c}MC)D-&WY$#@dNDnO1hzQ~{8*2V)2Olc%SCjqdM8_?qdFr0sNkWv)U> zBa$x_#cpKK|>*JnoJ>kAU` z4Lb||Vy5K*k3qyhk3kQNjUz*S-qp{V4N~ETEd(k}ahR%p{$(wQBp}2RT+O!#>e9Hh zeDI1*lw3waArQwaVkwD2YmH}!FI2?S7Fa0Rv}9#jCYQD%hJc_bkcz6R(V-eus)2F} z0g+Uuh@rHSb!_r{(>0dqX|2ed*|n@}JV#M7lSpK;E|b~l)sI|*^x{es&`mL5cux&F zlT}M#O`;_om*0e_tm`IUsXSLvJ=GUo{nOJ~H}o1vq^IA>B}|V*kw_vENGZ~3q9Rx_ z|4F6Iyk3zo+f3BaIEo^uYNW458K5aABR7n z|L}(4001TiNklYL7=tnrF-g_L{V$a7>N?jc`6U| zYDjDVSj3a4DmpZ0;q5X*@8>JVOL;bKm zDeQ-(lmyB8DSc}^PBP0DN3zfWJ`FlEv5Kgx1RmG5@igvqUo+-F^@ZogQ-8`+hCF0$ zYn*|C+a;H1@SdXSs$Qr})^QC=N9TT2-*X$xKBcF8s*A5x=c+^P<{4O@O}p7|eKyjU zHE&-oPhm7z6Y@~AT9aSZd9u4E~#e^X`UG2LsF8>5DdNI|0` zhPX;^4d7je9DH|rFupxc<1-TReU|C@ofYuPrU#`UdaV4438Pps0y2#%6(DJ*Grd+a zp)vR{4L}*vunuUlj>@!>!<4IQg2b_*X;6+eVBF+B>72*Ss9u--?(?#u{N zooB{VXh52_339UNl%J{VxRxk#=|{&j&}ee4o)Ah;pr{eTCe#A+qkL(t{Ad80$ioaC z;_sBn&<_#?yPL|tEMaSWBaNuFTJ0vkx{vNRnHLlGVX{0LF>H;NNh?~Tk2L^HqrnM= z(w)xNIVRvBb)smY3bHp$xjkh3qh~dU!t> z3>qY6tZ?dLN;f8bUTB*YjrHwSQ_`<(aGlCaNuUYSsN@ewm)~G!?;C z&qw=pPo1mL$<`Q9*3rqTqse@h8jLBODX-GM@;!CjfEn{(HGFh$?w39%#r)RuF!|J= zJ6_BCXsvyw9&x`ln54B1ORq-nllnFJXE|g%nL2KCMB#pstr?if-_~cLdrj%qn%6Iv zd`t{~z*tFB`#vUyo3}@pDaBG}WuRn{7&0sRNEE{eEF2&))ZjnP2*vjanBSaEZ()|= zBhkX1oo#w2eRo!z8TtHm62qU&DW><3gCA}#gjeP*+~Z9KMu%|YZVyT>x1#(?E9yIX z(bh{)rsd8uo4lC+3@H%eMGDHRc7F~r;6Ev!bo?VRRb6#hTTQdaiaWFfDQ?9B6etp) zK#)R#3Q*jOy9F&CG#ZeXJ&poJ3BiwyBl0Y z$R4=ZJohTdO#bvl^XFT**ZH#t8@F(rru(0Io6ML(JM#>a*`VmqQ%9z&;Zwy#xDn)P z5v$^n`8wa)Pwcv0T;uwnnhvxreVu>i_fyON?q|7Qf|t0*NayDDhBHWyRvDqb@v|Hv zaz85Srvw^pcz+5Rts6-A1)BNYxhr1(=r|aNxYpZ*&(2^r}_+Wx1MXjgmbx&pqd3mED?kq=aU ze$(aT25A|gkEceMZeTqrPL=c3KP2bT(W}dS^(hi6j*%FBTMGgL*5Uo)pA@C@GFfi8 zflscrh8kc-I^l&suIi=Z<|$oq{lp~ERv3WZKGEji-gNzJQpA7NqQC;|OME=lluDcH zVpYxbJ^&_bD$Tcm}oR4BksgkalWrk*`s^HJB6bSYH0_D>;_o zjmUYB=9t1hmQ)(k9L)xLlCCqNoc+E=1?Kay#2ebx7GcBHYgt;2yu4#dd}ZF2F_B?Q z`Vc+Vhh&bXzc5zl_}RoUEF4k|Lv9Q?u`wn~o7->-li}HCP22Uxi~po`6xQQz-o1J&@OCXYqx+;^UH6J%GV!e*gYCa)4v;Yfx4T+{_7o4 zfjeO5u_FjVX|5jg5pJ%Ihq_@-@}#g%6lV_~K7}dF23`t@Ztaoq=sLY_P6T&98~Bh#D&fQck23J-vor zAv$yhf(3&pD!Fq}jk;5T#T1risXN`5QSC^s`_~iME~#Z?7KqipxR^qV-Ef`B2J^z|!!@gS1|nUihbN2mQ801LGD^{%CC(j|T4InRWu zJ5y6FI;2Qjk~COeXkWWLs@n0^q+e`$#My)3EV1{3&360kfPLLk2#u%W6W93}d@BS= zrXSX-+5LH(R>*`=P!$&rvphlb_<3BdzT#g%XR0^3dnRuNXK1TKNEmd%)E z=d@gj84B=+pm|W2re&tC4-CNQXc2eh%lrYswDmzUSCzm)0(zB7(xr)C`9-|Kt#8QI zW*m7xmD@B_Im$}V_<6qt7^d+y`q@kCsF9k72aD=;ldt__I9z!lTc7vxnmQyB;>lGB z+TTe;2EEVYTHq6OY;|o^+3W}7|HD_EczajO2WN_;RN4Tax(hLMJ?dapKIawJ-XPgp+XYn;bOd8%ANnY9-c&qd>kv1ns_ zja}mV67@QOaY(H;3|8^ zxU9^eK@LB!{6R_laRveRe=Q_F8l7~0nO?p&rUP4alKl)yz@+yHwIzNC2 zQdI0zH&@$N{xyX4EU|zDH5Hkf)R3x3=L^CzE19<{0_97z9#DWF>l<{4WY78cO?SqS z7q7>(`31!T3NL9*Ki1LL+?123tRrscW^T^xtnc%YSz=9br7$`_R~V+==Rc-V>X184j6C-BP9Xw{G6@jXR}gO{Igf8O8!dMtEk>_RNq|ty}o^I z4XigZ9J1609m!BynJ>_KMQsKdCjUMlfcQRSk|)Ep$QNwArHM5REEEtIv^nLImN1U& zIAaqu44GA^dk^97AdgILR!1nwTmAg&k_8X4@npHIYKyJac`#U#GsME7e(e!z?4thu*LCD974y!>BH6S$N+3$h)vLJq=OEBshwsEfa=Q1}T|{fRDc9NLBP1)vjxLue>5YBSAbUD}w>c z+$q5jRJ<>XKk@XK!8qAabbY;L%a?2-@u+>BDUeZe_ZWmgoKQM=srAa%BO+-9zw}@q z3n)5 zK$%7XmoXY4>KlC&?7JR*Gb%ES6Gwjz6;t$gGS!`m{P&A1qpu@R^z%&6!1_!jx?g&H zFk>uz(qd_u7^!kElet#yjy`*KHX~wAU!SnTKS^uPs>|XI)uF!k|1ptH8gPg)8jn3C zkKa~YI>S%NNY*!q#bAgFeKN!-x*6IpAhFx+*;3EhM0r?C5gQ<7r&S4Ao=!47@7kH2sC%wQda~!nH-Sv(=X;(htYnq{;1v50 zP9*59j@{x*Tn@YJJ!R@f5AQFYv(^nS(0=}( zqRoXN&+3)JRYcWGXj+^!`BL$*UDtzo* z^m%ckA`N9;6>Vqr4{ZR1PH_#?lH-B^^=*K-fn;exN@AN^WfF;9T`&T3Hvm_dH%Q7?hbz8ujxgfW;Lwjuc z>GqQy2rEvR=*$O(YjOO%C!<|DQ@~$`dCl;RfU&@>V}lP`O%%FFrUz~><4EVN*2}OJ zs($r+{w|mEfuY*DXA7sMJVfg^CM=lzC@^(wG*&6HG6PQF7#a)Eg>AI2=_%Z?Y(!L(%muhbdUMqNs%Zl?+}sgy?Vs% zG-`=iqd}g&-?d5TNmG{B_kBlJ+lZ5cXL0+OBtaLjA#udeaz|UdA3CO>Cb7g96j>$2 zv~Bsqz=ldr-In5XAk}eKiK1Pr!WX*`f#vY9#+}~cM9nRcXTj>2pxfNJe`{d|qnD_A zO4)78{%x=4_db(Fy@0auerI>ux&<{ry1PL?yyT6*oE?fSjmPJ{e@M<9 zT;G~f`t5I@xC4m|AkplnuNT&{9ZR$cb^Y-qUtc_m1nSByG6d#mmZ z!O)T5F{;zV6TGluagEiV^w00G6YMBJ- z;d$g~s?Kzkzim&#ei5u(JxgbEl%-e+Zrx<%GUM(mZHQ&0_$uLDUIi1vhT=}OcH)*&-e;CQ zT6VFme@Hq#_vsPbz&|D^?VFen1)@=&Ps-ThkWOa$f?;ouma$3-lre z8uWRk+Z7G6nutoud*N(}&G1Q?X#=yv+3p?1g-Ft3$hou3+=dU17utNRlQ{~-4XfG` zKXmR+0|RUzCsCKE*+NRKUW7_5@OSKW{T+MjY?y^bqj>Z?Cdzc;^7UR_&GVLfRQ?4g zqQ-csj#1C9o*%_mzvFR-F_o3m0jq5!jMIJ$Bc8pT!H2i?dy2d}wIiS}FDK9s+jgi# z9&xUG%OA!nSVV1?6D|pYUXDAusN%zywOS$5>Mowdv6P1n63fuU+wh&2=j&>+=&vU& zUy+$sOz8BL(?}U^sBCDi^c-d~Oik)Qk+Bmh#Cz-k+d%hI0-MY4uSqAJU`?2_@n4B` zrbAw%orN7}99&l9usLIWO$~MYip=*=FFmIzsPQ4vCn+LPv1fxC?o#=YJnSAi;5UX; zS$B%aI7RRr^tv5$bdh#tM6WPsBi0$uHl-NFQ>Q}LsD0*~MCd4AE?Ml;78db^)9(GU zG>k-%{E}Skc2)4wa6MMwL}^!QYtv37I7?b?o!IU?67FImDIQn?r`C%Q;Jz0b^~%h1 zCnsKk_N8k~o#{7hd#zIGs&=%5$}AqIO@#^Qk@aQQ!D&3PlIBU4^GKGNcT#7Jf}WkX zfs$o^i$Kv=zpkduM@(j{*Gn%^Ebnwx<~y^0YYHu2b-d`#^~olhZYd_7!8O*giLiyN zC51ZP1If@~BmlMq_AO8YRRG~m-qhOBB_oQ*TyL%xF=(`2L$*{ z*j^Pab!KKSXnF0hc3{t60%zeeL~AxgVe1_dG|>{O?MVRqOzwsE0L+-%U%+k}wq$SkjgIJ}hH_KNl1Zde`n@6fL=O6#3|i2C(v`PZ<=!x$Zu?WpdeyrE zc5-B+5>4UV@}~*qv^5clolt@mJrxVEBJnDx=*2s3172}(dyyI)W2|vvRc>o>=W>d| zWg`|PuX*;4q7D7VEYZ%NlULz4ML)~AyP+4w+Knw0 z@SIDNDVn)1Z|ewSg7*^M7RK5&8!K`~MG~h2qn`TY(v5PN^{oh`K*Rhi&oZN4Hm>!h zkbgMq@bQxI(SjH#M4IYJ-cZdiV2UG&kns=h+RZRs+MbKvH~2PJGmh980byQuONzT| z`cafIED~VrI23X>!m#UV<%+0PmwW6}RriUAdUQ?g$;$3d5gGw#*)lh@nEpyuud6ar zL$_HhH7|k?mZ7f!3nJ>w#)OtbJiP69L>dUM`zt}93i z_{W9d=oXB76}txL57Rd*YAgf4s!d{(8_>vG4Cv8BG(-!5bu7D@Xhg&IO%%)EwXrK5pgZ2+lo;HHxJstH;zDj^oYYa_{18lGj@qzXof4Q$L zQ7GMIu@s~)hLfg(70sXCpL_D;=H_6@zs(F*{eW(jhB>A{lymAy5r;=L?x9IHKFz7T zWdBmjKIY;}NPsQU`~FWKD&dQFv@(Q)MBE*)!u*+Yj*3kdC*PEuYTweYRoSN^#(J45 z7&(qG`QO+vRitLq`4aq6zo<4$Tcup~Fa3#*J<=SoF+nI819(fa7&oasCLN)%PCtcS zv}G(Au=6CSTdy~22GxZKmbxrBP2mam&JU;U=r=qZpiYS$XA2 zqiSJ3uP3q~%gfS4Q7&K6_PF7CAm%-ASKjn00G^-rtw}tb!4r^|x88$m|4TCH$CQr4 zt9k6>J~x_^)*wF5mtVC*iBr52J@d7wViXuvn&wbfs`r_@(i~tV@@CuYalCGw8Jh^k zoL79us|CZ~ii97q1Jg?tE@T!!k z)qKmJ)*azz9|%rzGzG-HkE$Q%4-lyC!+T?&_oYjHMWG}!Ur?Em2Jl?!HiLnjd?}Dk zx+!wT1M6wFJ-z0qq~>DGI3@IA9=F_B#1X59ev3qSz@D3@=rDVZrfZEEO_{{Hh~H15 zGUo0-zVG&-J#X;yz6N>t-#T+N#;DJPEvCAqTOV}aj{~Px8Uq8WtcSL_r|K^AGW4gq zlNgpOqPA<+gcN_KSSIQ0E)))Q9)p zn22PMM9zq#t`$Jg(|#8q_wvkh&zR|mfBmwJkyO++A5vG@xT{rM#u!A)z=C-rujY5nql8<&x^~^PLk9<%g9BRxJLa@!UQ`zEFpUG9bz5s@ zTCU!7RF`S)HeeWdMW+rG6Ewh{lBZ$u4JtAvcNGQPgZh(WP1$2*h5AZ?M01sIQAZb0%pTTT8N zi%M?QzEi&P1?Z}~em+slYxU|0;F%}b-e=<#V7!)OAL2Rvve2QRR+IDJRgo!jRb<xW}Fed1fUv_OSBU%S`rIy9QnKQHP*=t+BDLwBk4SDR-*&FG_-%d zD15!@9!Jw7$%qNT!s@bx_xvgRRqL+!Um6j%*Al$QH3Jh#;KTch)b9~0MAWWzmE1F%>L`!x z&c2h7|9rtqpSH`rf14Gv%yqmI=QlFRkIei1N@rB|yFz^CMpmZ&lRcQ*SjkkTyp5A* z4f#$cFaLC;J+%$mA+_+A-M_RZcsed$=w@lF_S@@!d89jV5j_8)pzex-d=%y0%9g)2 G4EP^?x9`0G literal 0 HcmV?d00001 diff --git a/windows/update/images/waas-wipfb-change-user.png b/windows/update/images/waas-wipfb-change-user.png new file mode 100644 index 0000000000000000000000000000000000000000..bf6fe39bebae24a09b3845af92ede68337406962 GIT binary patch literal 74115 zcmZsCWl$Vlv@HY}9D)W02qCxycMCQ^u;A_%+}#p1c+lYP?(T!TySuyFyvg_Ky&t!3 zS3%cQS9hO2=WJVR?U3(s66h#E6c`v7bSX(OMHrZOl`t@{fk*)8e+S}=9OwmDM@0z{ znDQ~=L+B59Ghta_7?`Rk)E5H;=x<~@NexFB7!2^gKiGcTLSq;hNS>6Ku(F%($tz-< zPH)|px1)&T=e5S|_RF!R`?qlc!JpQw07Nu`lvKwtK&+!2RZ=PfwxkG+H2kjt9z-lL zjL-X@9PouDKLaa|%k-T8*4Eaw)U|lJTDrP=3s{t{($5sDl+3Bs?4@#)jE}!9k5e&L zcD^Gkc*+;N9^J-uWZieOQq35mJHprTHM+ZZq&h z5T?)zvsGmmVDqGAJo33fHUjs@27Gf^%r<=y{b5aOlcdWc1AtXb~?S9oY#rO6PehQt74Y`^Xb=GVsV;I)% zx^_k$igDk=uwN#&lNEY1ETkXNxP!{^ETx*{^CH&ncR-TPjLp)mOA z>9_(cLFzr@RclS7HYD_R8Fev4UlG96@xm&T%ud_-ay4wQ)e{o!xcRuBfvM+xtFn@D zG0L?b0DTzkiu-=rCUj8dYg#0`q26ar`=6P%H_1eUMra^~3OU_pE$1Jvn|ETQyLt9g zaiU(|?mIBK*4&Kv3vvdOC!`J%@Ros$9LBw4Y~%c+LVTF(z7X$~e0j)e!+In?8eMNe z7|L(;yPQwiGt=@yBo+1;bY$t?FPHt7&8&3vF7Ya=$n(0M)^0bG65F=w&a*1ugUOuj zbH1}i@)bKU`sP7S6vp#ei|vXUrgGVWWqA`78WAT0zUk3SQ8c;A?^iV)XBGZ}HaF-K z!8r2#ljX{&$|qqNUZlE7{H{uW8`Mcu*4w?oqL>1>h$!G-OiaX&Zu$$*Zw5nWjTC?m z#I0YlD7k3pcx4PH=3!0seS5V3^u46B!Z29q$%Nq6O$m6tb3@qC!s_ha>mnW|i`OzC zg4*kCl>S1OdOtI7khKn>J<~g`cn*d`)FI(q*&Z-lcgR|2WD3M#@@2p2xQ(yuw1p4^ z3B71=@2B5)x0~qz<(i&CH0Vm_lU2-BgQOr{9L5;6>%V6lr5Z`a|8Df6q zzZxLlZU>1p8REQreC@emzDef-H#KzNf&`y52rf7JH&3K(Fki^Xg zVs!@87Q*M07NmR7X;M$UQFvh0Tv)_>!wv`F=z3lDUTjARaY8;A>YhW51kL_9@PjUr zG((lxv=G8nQ$5r)>|W4?UM@t57b!1K-=5E-$a|C%?lNcbk4-;l+X>l~vT)+Tn>fclo3Qx0W@02 zlC~|U_1tswLleW7{iLLFJiBpr7hQ-A+*ecIJLkX33!lrp#P(ZOv~fxwpVKtA8b%4+ zEi|fVP@rbyqU6C}{sd`fc;9JwT?{jI@Y7k+7^H5q-FF{VbyB}*thZM_6Jj>*!fF`TWL7o-^?npW089YTOnBo9?M z5!aWGkmq&CN1oJ}{IzVo*-%;j1;Pobjah#T-a;^@zawqU@Q(xhl%Qe{Qz=`GijPXY z9uFRQb963Cpbn(|l{M;@i)k(e(;yPp75gA_UgvNMl#9}Grj+vKurCFEW1uEOCXch} zi%~xRu(Vs89E)BCJU%_lk_ADdf&e?M43W1ds--qv=*}xFZ{1J#%=U%Dig=gihPbn> zWz$5d?R`6|a6WR8WV~LVZ4oA$(f!f$1j_`(HKo*WPi69cag6u4w2*_1;uc0ZBsb7? z&7C^cZ7W2#urMEu3ASX91WQ^=PJ^-w%f z&5XUDuyD!ubC|oKY3+-Cn-6>`ycIsLPrY3jmq$?Vg;vq==5dnSukN z-Gn-uZVZ3GtS-0kwU4^yTB&nGoiIWs&{Rl4@Qcm_jp zv{g8}gkWO-&l7M>OU{gW9x9~{DpaBFa47y^7X6gF!O(Rnnh!@&svsfxn95#h(Yvv7 z1sUuuoSR9)(~>UMtP*-|$ml0!lD7dao_OlSy4m+S%I3#?v+_2dc1o$w9PicZ!$o;y zRS8lp6n`qyFY>F^Tz1lBEFvq~=y-)B)77&nl(8Nq0rL!t*m0TzP>NMRZ8!o!(niLDs9{fwbyGhOfpQ= zOYC**ol6wS5M-oEGmxg$UG6=I2|bM%z+0C39oY|mld36C)7xnxH`r9~U5vmoP_$j7 z|Mot@8hPb2PZm})Td`=E%#T47EPBqIw|_SsVBuNPXfQI1s^!z_c?pJbxs@*T6uds) zW16MAo7P^><3Pi(-ib=n3o&$4ZwBDVB`P3&Ifm{>69%|-z?`zGa_pmiMcW;UKO$yi zM?@h3PprR|h~o07bzIv(i%Qt;sSbLRA>Y3x^&Zp5fQ=K!z0{-YA|oWG594Ia+N8%n z-{jZyN-b2nXkjeGm-X+!{|+w=qBdc6=G&jsvW?&m3u`*737g&emQ0tBu~<^k4)g^Z zMG4^R9R(5D5VZ9^N?kClTh)wi^+d~Zt+J>8H4SvdO+w*C{`XoP-Krl5;s>*`Lf@Q( z<%i5d3wK@Jm!cgLm19T-d46O8IpXN=Tsxk1RzkNaC*UZ#&w(uZBX1hU(c+&+-_y#T zS3n&xgH2vifxVga&CiEW*|sT;wlW&|SX=2WQ7u$utGZ4!oh04oo9A-dDy#DqYBeqE zy2e>UG+ehwWPpKb)_{}iy0>d8lYVo|hZ8r(?^Wi2`l6d%!bP2Uko-&aF@3$JWhrG{ zUav>vb%xE=H$A6G@f1=Q3w4t)9dKvM8cItVE0vY=MUg>ZL_Owkd5a47VW1xt778f{6rShD)pACA`u@U%)bn%r9Akg& zPMbS#y_4{PFxZeA-`q8<8gLsVYs7 zds$X5zVuk@ae2#@a_(4Sz@&y`JZ65vm)48!QHV2Rb1F&@1_{vGoNLud=_R8)ej#3y zGEWA`fOJ69-LD`)f~WN*Fx*Xh&owEmWnA#N$6lzdYS4D)l$|UOn=Taz@doFxtL{5C z;;I;mq&B9LdoRkx*Qrm=KNsotKISGQtdQcUP*9?i7s#(Q)tfq%&|v()r3NXxaYxMU zahjH>ce}kiZBN?ZMaQ&CkDHqwpi$~t5rgJ38H{zA_!1a%VcT|$i+>iWZG4*?Em5Iy zC&8b4hFm3EyK3*4D)YT=2vxx!-Z@RnvWMHUw!5VoakX+p(~^a9Bm_zdmi;h{tdp$J4Ro7={^5b0%^Tn+=)4k`OJ(d$uHssvmW+jwSF#{DESUjhVl9;H{VZB*t%}y4o?1k15s;htU zMW$%=x&D$_j($L_Q7N4m+O2BE_{l7vQf^;C`yTeWMt#Di-N^Sip>ncYgsG$LXI}2mUsNc_8^KE&3Q#Da&pGdA7 zR55!PalX#!xUO=`lv6`L7Z;VDaVK+M1}rbReflq4@RgebD44%`Bz#l8_Lh9JL>`fH zBCtj#;?U|*o{!|%K%eaQ)-7)8)|<(!c4}q?cXYN#5nrsUC}7D_A{m2{x;Y;+T&1US z6uGCz9aOg|!J!61z1+e4Wh{G>--_o5>+o)RcM0HQSSQ*iQJ0@Ou83)~hUs07oc9Bt z_0CB@COWyi=p8eu$w(-fsaTcK8q|k+Z^ly5@5?gDViv3^>2jawZIX`uf>|OO>GSVb zR}V@OFS+edr7@2#a`2kkwboJ;psW9QU>D}SajNmEr6pPyTIhPjg13yXT=Lt4x~zlv zA&WKMpTkLYYV)s3@@l@J^AFm$uO_Tz?Mpu9HiW8i(=<)Bv2m>Iz;?p)MguwUNtt@!c zoyRYQx4su&tH)@U_uCboZ`-#F3)sI8FJ(1jyb7L!O)Obc8^06|j+FfC!gC2B<-s65 z)Y=?<8wP&~%|(LPKjMA>VH5w;)54-I&6VOwrM7uqYup_GAN^8KuXFj z14iqts+Rbo>+9`&)cEjMDM4qeae@2ree2fCzDrFDfvrhB$kTjdhNF~(LRnWnp`aMf z=a7*36su~fm4en*+qi}ojQGH;*%k%NH`nwlhuS^6G7O!4Vqt+!Lx(FX+?g4D6#{Q{ z@`8~{*{?M58`2BdXd*4(qi|%6AZt70Xnob22Y}^HIT6>i+(Lwkss^P6dM8AL8g-X! zE!~Yl|E3}=my((9yb}&HyqHqSztrr9@woh8LSYtm#Eo;#)%z_aG#Dv%PJE*0cz@K^ z?Pi1N&-(!@`ex!`=yMh%gpQ<)9O|FnE6~V-Z-wGhuBTf$I>>lJ4&DaKrM#-6jJOt6 z9CQ~?Yq2H`{nKpQq2)}_z(=aypTF=(^fiHDUdE3Mjw}aXOib-WhDgav!kk9hJ;*o~HltKA1?N*@zIqCz8z}kD z!f>cVh-M4=;$uR@4pWDW%rh*9`=>b$i6I5oM}Y~z6JUzfhX^FqD0TZXbm{*5pmr`n z(y^xfRlBF#@m_Co($~+a-u=g$H$>^^qNESpC(Do+=8Z9~?#z~TWNMvDb?)6_>h479 z4!SpAK3zWj7cGN}fcr4-Y4AXQegK=T4{fT;DjQ41bcHWxs{6FGfn@afZwa9&GA^^V z7DuHLbWY4>AlxjlwD0y<55il#p{i+~M<8997nC!pvaBa}RZ`zEsaS$u&w!l>qcEB- z7c9XgtyZ9gYatf&h6wjz3zjEjOlhhPxWjzxfkjxB!x6o)RnURy(pnk_ zmsC2+wz69$Iefg?L>X;Pr96DK)Dpph3AT73%OlwM^c|V|&Bt9BRb``Wnj`U;ebrEV z`BCRlj`^N)tsFKFGY+G)cX&*u14ktl9}BLk#1`{Ebn}=(i@)Cq4Wtl_)w1%2tb72y zSe^~Pa4E%}`sVaMFo!@=Ri?nfZ8-et6N^=zre#(jzQx;YZK5b4?Pu&*M)fkdAC_LF zl^cGjpxXq(&ub>3zI6{jo5_;f7 z#3w6kf4dGi)IU^2knn_&+wsZ^zzsZndQsrHLG!*v|@+c@G zccA0>i;OSLa%}j;R3maZdkSSI6n3zgoj$b>q17VX!U#PMqEu8>y_xmPO}uZ$4IC_qraXStoRkc@8&r zPI3y5Z(WAp!i{@Y+cza7#&u|_Q|2D4&d`pbV$zL^7qSZ z=a`jQ6=D}R_(V51*2}Hv#VQ2QPwMMM9LK8sP}xL8rNj#-IdwQ@y#rX@D4f%$MT7qm zdCa9gI|#%WMNe>n)s~>jJDGo`B-KdZ8U{~DX|;@~lAFpJEs}$m#$D%b?~cXId2ezf zb=)=st0pH_f!eN=78aGnDkCyw2y|RIJ_Db-N}&Ow{bovf!A+o7byF{2bT?^a#c3&Zd(1L=N;7SI=DHGEJZ zywiiA>7BM(Jy;Z&bSK@95k1L2sE~m<8KbvyGUu|*$^o}5)J{FD^NRzlR{lB7k{1;h zQL!#)5N`WmyRO*d;3|1*Wn$Y^->ibne1PSX1kV}$@psLbxl%?f##Y+wLr~rhi?)OW-VAFY=b`uS5MNAg}63#)VZT}hFy$AsA zB2$@7J=kWd`ueN0Xnvk2I}g?kjZE@FpnrWA*4~vbil}jC{L6b7E&Dsbh>?CTSxe3U zx{K;ePbKXqF~9Q9j|r-xS0y6{+z$R}cpMz+@gS)c)!#bITwOU<9$kgg9oFC0yi8X2$!e4zsIJ6nZTz_VH%h?& zz#Bj;2I~)SY)xe4TDGdW_}lS9nSR_Gf-h-iXoiNY=)LyweT^HwAqqbkWY(n;WZj)X7P$av>92F=L&}TXT2_@%tU-h5 zWNm&NXmbEI7YZ2fc%;>aY~9!$jAjHleti0z3h9YsKIo#|3^x6BJb2%M%BTHkK=5|( zVKYH3KbYJmjX3?eP)hINab74eI*NnQ+;QJhFIXW;9{H~z8{>&mY6d>?8BObjV@3*o zkbn>)8g2c0n;?Z3m$`a$(8wG!kb^_f-x~hLD>@UAqIsNaO@GS-XrtwE+4~_osezi} z$*@hQPT1R~GVM=czZ+K_WfHRftabGMzGr6x@ zQ7mwPMKJAy5gIN!r+8T0K?LPA7~O(yGG}5_+7NpEoN`&$Tr%`2 zrp$Qx4Fz`x<1OSKV*aBC0t4urIa*oc<34va4bWul?T?b&t>ous$kvCBLalF)`H<(| zHVvKcPt0&+Kg0AQ0HU+#>-n9Hh+{K*987ZGWy}>!g!MWN4rekDYMFma%K* z+Cs9*!k`{NKW#CgFB_~+cb$S5H191z0WuND&)OXTkK!C2rT6&Y-W3#hdk-o4iNdhR^s)KJCsPL|&bS#SU42f07)r0th&iE$+cOl7kaX zWpEPkciXcN7v0pn5+k%xmRc1cByBG-?S}`nCI4Jz_ai?akfItqIq{RaV1CLtA_fw!cLs%< z=f%HLB9@f0$P&=uIXD)=pJ4f@@XPVy(Uw!9iJ)nSO(om^J1Z#p<9Tbw9f0IM=y};Y zntOhPI)ad7pq2ZtmD);C%fgXT`U%aRAO2|pxSi$NAbT0%#4OhOMbi|QGG)divKhgfN z`I-gjDkkeFy|G(MXVvrs1W#xSQnBxrEGq~+25i+$lS~XNbt_kYLPpd5Rng?WcOpQw%E; zZq3pn<_P8_5N5u=i~d#p?an~QL-A72w&V4V5S12HHQ~>dGV`E&TuU0Uo+)W}V}>K*M9ldx=Z@`3(iiA9>;tS7FxK<|o)X0NV&Sp9 zdOwebFEuBk0a}lSEqos0{&`i*nsQHb@DZFvZsB)D9pRfzBiptbskv4JF zD+%K?ANbII%I>Mo?;srQweZefy9HHRtPmHwhV&aI1uE4rTP({L7F7` zI*}E<9&Jh67N$=zAJOp6Wbfn%;JG%vuDrUgq*P&Ei9HF=risg4Wp4OwIRuA#jGJ1A zJkODyaK7oV!E$Kc*~OpadS~8XQXD@-V7(ia5x0-u1TQ_`$ZVB`7Oe>aX1=egAE3 zU+#{3%^H=b2pF0d4A~-I=ih||y&`IV1bjeuaGIQO;W2Pqa2wA7XL_!oBciu+zSx(I zg3adzNuV_0pj}tZdSEZ4)8-KB(v4ij?*9x?OA(7Umo8lMh)K z>l^;u(#*N2Rc-+d2S#l1|2MWggD4+D8?VC><`;$Pqmfr&T5eT3%hl8Z%s7Ey`48ia z;9pQQI%xG-mEf{7*x;be_CwJh6I)L~w6^^+=8Gf5&}*i!eZKkg8m2b#R3-K!wtj6L z_N$`JT1QY2nQN=^N`dp-S?SES$wKcYhLCMWp#3o7MBNSlJY zin_{ZdG(V~8DZ?yd2Sk~x6aohlZmWQ+NMdmN`|!QzqvS8m0qHJTpCed-ofm$lm@@k zM2n9Fx+Mz_GsBp#DTUVc;tccCI=0D}!kd}{kT>GCwxu5ZS(}1c;|rb^5CL^tKC5qE zr;P_#86LNduwqNF4+Hb97Y`A9-mWtwuA5&6NvhFUI&UN+r9~95WQQigMvAD5xGZcc z3o?8>t}Cbrc9$iHzM_6DQ%Sc^RuK9@6ThYjWpP~yxNNjvtm}_6-fjvWh$>qk2nBq5 ziAGz3dwXT|OLS-J|JZw5pX-!^Z-aV&Q7OyDZGE4YE5R6iJ?Xvf9%xG>A)tQ5=U|~1 zvZqixlNt52>G;B?uKY7r11NnRsmIlCw#vxIzb93r$aWMAEm0UtK^bXt#YgA|c&sP? zxK7gVSAM-Rg#b3#Awif!V4>;GgtwY1aqe^Oy0vgJP*1lmIR0|W(#HC&0{QpnUF$Ge zoGG^V3NLfF)Kv)dLs3YEzA<&L_3NKzdB$9=a~^x{LIIYaj4F+#@r^n!6sIynCc&s| zy@71CAHl>BsQ7}1lmFv0+UL*U1F4;DuBJ6qc^x)+CN_c}Fat$nWI6AGiQt%5%V@cp zE$$uUKT%s!089YTG>(35S_ggJ-B+T%*Zb@Z|!03FkR4$I-y$aFO(k)e!^ z(GiMsv^h#>rO?k`;>lejkp^b&2JBcGmG+8eMJu^!nUtC0cIPvAVSQU3OUNhE`^n9= zpF@v}M#|e>+Z!tya`pfvVMpcC4!~Ip?HIrSq8}W_A6pJIohDGvv(yx0GRr1+(%v<|(AvA?bq#(HM;AZ5uTh%=G7;yV%cM0_vMxQp}3-j-*s>6D85i11AoW_2O z^nS!(;psT@1R6-qZ-bS)MEB(|C~ldpHc;8D#-zh_0?rmSJ*lMBJ1V9fi{ERZ3eI^lrhAU;WQ^nwF*A@k2Qnk;}6 zImCSS>z^NBdx>!5kl#ipRZty^I98;sIC)M#*Ftq~A(lcIC2bfy8#Ke^=;qq^ar0LX zy=Ww{C-V=2^h*)0lBLbB#n?~=u7&z6)1bU;Ru4IS7xt$;7_hC zqAm+!-PSWja)V+kcqlf)IkTc4Q9K+;_O)!cdnjz5(=$G+E1#9q@Uzi4bg(D2b#L;C z^^;89i1Oj6{i~DIFRyd?^Cq2?@3IiY(7JQ4Jg>*RD6SZuQMe`C={yylr#Yk;xw$6) z^PR=$E^QgXhbfE%f^J9Ec3TgEn+w^KRBrAgqcbj@9w33g`G-WQgm#35$lYBJq z^&Fmt{iJPK;0Bd!5OM7 zjozPj%}<$TGarD%Js%v^siCk@b;#GPj2&`!S%7f-KV54ed;%s*?)#J8rH9p4}!kF1zv53xLpCjR7sWc{$lK&=`vv7czvFB-~z3Agh z>1Tfn3!dd+DcM%t9{cR(v?r+*8 zL9~&(D|99KyqDL5DqM6qy>3?OvLFF^f$jGr(_XpA0NvR?podkwwjhIubmx{GmAO<3 zdBsO|-eQi01T;k5+{-|_yIOeKY}Cc%L}3vAcQE_Mxk`A9yB;D-pFBy9h~Es@PH@VW zmFuJ}&JX=kd_m)S9n|687CHZrE>6t{m~kp`=t5nlB$m);dql0(Z5rWtYN|fu+G&Z=30Vzny{=1FoqfR`c!ERr9?{0qLuU-(JUBV>+ZP`4 zNsrv^H7t7?XUG~$Ox9v19t%?xsK*|kxw?YKmRSD>W2(Gm_AlOaL#xTYL_sm4EjUTo zo1?&FAj2yqUZmd`G96t`J9NmN^#7*$57CLtO(-D6m`w{4m6)p&(#$C-9qv#ey(O>t zBk}f&3U&!DMH$>cN@@ivyQrwE^jQhjhkCrGt}(HSAC)a9)zWbpgBqW!C@gUwlV`(1 z5)R|>(Ad?{<>5Ho<=<#SB}$4GPe1oF!dqczNv`1NzniE43XM0hN2Yt9fGbDhWY-#1*cx+Ac}`_8 zL{H>x2KKMAbG{dIb{fxdoSV1-Kz$Lt`~k*AHF|o!@3W55Q!xRO_p7(ebOD!m${EIB z=lPlh5xE0}ql;Prt4A#w5zz_axmZfe&0$YU&Z>^bDcIA zu6hP5ETSu^EBQ~N2S&VU1Z=1?91B(hp~TLn2WlKaVbd3m*1P<(1^p(Ke3R$d43C=l zsW(j}!nXFVWaOb{qvqgfL29eZ0`6axN52ikTeH%64>J7?;Y?PyTid!(=zD$y*S_=8 z<sI%UwfZDocpFkjbI zS4L^gn}eU*TwjLN_YGu)1}tLasala#>`tG(b2SPZ1KiVTKK<`_H)SczMS>@2A%t+-UitE{HVrgdvuSbq<+Put+=chzv1xS^0x&y zVRC6iY!vV32h9r|uONrju`djCk7}Wlzb0_sveazfJ+5jLMFUS(K(gp} zJuS(akH5IaQvKT(d(VU8L9IA8p0_1-JJzw_8CzczoOKAN_UlV+B^Zx1sO*cokT%5d zQl#UVw)J7~e)EO89j##fTElJQv;y37-yT8F26-6w4Q#7;rXjWi_iu(j3o;3Y`Uahb zS=##SmM}kLB}KHfO(Y7wI(QJM#z}cNUYTvSNP!KXj>5P~I3qzaz!QO{E)aAQAws_A zye78=dK_h`it-dLCug**Cr0BOLMrEdz4vX{>z3mrPAcXwtBhE}G6wEY$QQ-^`H_>l zxFtP$E!=;@0*lnq-#T-LXJ8uOHw&P2{HALsFEtZ3*is(8qR&SbDCnI%*Al?}oR&Li8ZFdRgPG*JJZCjfDS>+jj-^g4ZK_ zw$~jsel-m^76@4Wd}i-lK`b)_*{sk5NN6Z_HP`EIYBu{$l%5V|BStr*kUX&g!Eg6| z?7l_y0_y`rjCE1;SD=d9Vcy@Z07MpH+?4=JtXq0D=>h0bh=}A$I~xkk?`eTfjLa(F zo_Y(fIl3-WW9U&!nxxMLeG4!0|8_3^i5Ssi*X3sEd@$6h$8+1B%Xk5lJT;OVfM3=x zbh4yx@ww=^@Y~<<-fV?Rv7lJgUCvzI4!sdsIH^#(={$eAx9WOTu{?Q~#EyUR&DxIL zeThz!_{z+{pz7+Yo;cJx^QMMDNex%FK$9raSs?% zh<}(fN3c?v0Lu8S*!PQLZ?SSY>ZORrsO?zX2PY{C`+4gv0n9(0-Vo(l_>jp~V%dM3+!}*E78S2o;4} zFWC2!7-4JAc=MS4HJ}xOPeQ_7{47HASI_-X?w^8g)Ki2TTAXIr+9ZA5&^y%)CiQXC z9>S=izS4DFb>2>3-e}Si{j5IzU8<57nS{{HN$zmyygj6mME;qzneBsC0}Dp&JATC5o8@{Gn`3#%o9?wlJC<0-H#2n9wOTGdy;mZ#MUHN z&q3Zfat}uer+Z2GgkW^QNJilatY!Mdttz^T%t@XT{j(LTMB`Ul;2aWXjw?Bi6$peF zjm()tY3w&TaPWz>%d|G28H=IB9@H=V;V;8I;VK-|!Zbw+uox=dopBHN&1%5GgF>oJ z8m!(+@8>e+_!IF4D|{6!`Z<=QWY7Xfp#6tVjeKKl65mgSdS!d)`}tAgmiHj#-*8nc z$uoIXka4A=@7XxpPcjMe_k&Pu>&x#1XS;BYbdJ}nVWy~OeW-#wOl$6r@4S_5Zxl7) zR~Tiw7VZj^UtsgmVvV~zY(6dzg9zQuC|&vtI@sn(=+bEC%>-Yu$hkwpWe?N&ss1&4 z92h`561c?X%bJjPO9S-~?kO9&Zrrjh0l zVOGjo;VHU9Pe6k2H`4vYIQa36=Tt$+g3$~m4J!`PH?lWmRh_(J-bk=^EOf!B$B`Eb zRh2ax1);X|UELreYutvTcxkK#>RZH>I>ogC)J7@Tuofez$lC0NcjCSJZI^^`2gu-^ z@D-cv!?51l)QjaFV#8jtW#3Ec_)^Cx=W@?$>63PUtI@8b)jxf6!qZMUBGd+SR~%qP zlaKzX<$vGy)S+}apes?$xt(^uCg}M*x~;DGvDU`xH_edP_h1?9#;Zl9rCR<{S-R>R zBo}-BfFe)wpqc>Hkh`Vjihi@h_}ltVY5?tx5wy>ciK!RdZhGS5aB`sp*N2eo&~t zFkT-Pi)#KOiNe#ylo%?6`fn3FIb69@$fxPs?=I&{P-T6xFGtfnWwm2l)UqqwT>*b% z2rTVV09sEv2v?G1=ze=i^-k8s`*Wm|PoK<8gnrxiv3ee7eo8zk(EV4fe|t5{1|G_} zY5mX5DpR>itV;mK9RF#-%iNb4a5XI30qxjX|8YKk6p~%PaCn%2}Rjkm~QR^h#?`Ny(r!TWWggyXgRPa zQ1@r=BY4clmC25&x7Nz5ox+d)r{<;6_7WfK@!R_kb{`e@CO;)&f>DlZEY&LsCE{XT ze^yg7A@oVJVE=U13WqtV;tXHE93waEJSrE(zZ-vp1(<;lRUgXT2*zNjW9n{7U z#=05BOF>@lw-Mf>2(C5mwSRikDsoMz7T@TG4}REt_>s5epHOWtc9Qo9R0%}Q1$_tc zEJd$XCRe2X(JSgN!^_1YbwAqmByVNLmavr^^e&v7!1o(H(E0J9Ym95%YZNjj7P?++ zCd*cbcKat|Gi)={$m2U{Xp#^u6_pOLnPn^zjJ*T9YeYI9!oi&5k(5LP5HHwM8$5!> zIufgf;y<6V0j4UlTRT4-bW}Y~-RB&Ff8LRf?Y@xcK+E|!Uer)9iPM4RZ{wLIfPLc2 z0ns9v4JS&AC{I0@kSwH72g|b+%Gl=_vCk@JT0SY0hY;DevK+CeNkEDnbHMCIk|a|p zPqGr0KMr-K^mxZvc;$GPq3&LA@05R#K>(7HPcIZi^Q@GrVp8KAiLu~*<&=&w1L4(q znt}>sIb0f54J5}YP5efS`0_B`Tg`QGqR=7ZyMLzJ8Eh2yHFF|!5Nb<;SpXp*-9drX zuxWW&OHen`BD?H!G?5Xue;oh8$)AsY&Z)l!nsMmkPY&H5XI=krimFF+RffU*lRBL$&0>=Ed~3 z`|k0W=h5-SwH_n(So7&@C3w;wJpMtQfuUy3bhC6>FU5YWoH`QC|ICB0v}$y1Q~ubR zq@M5U#O{R>Gf1i2hn1N9VdZ#4`aniQgL;n%|`HtuVNRXHE#Wb)^WSuA-^*PB>QhNb$fiKw6`9U0z;IEbC-%7x zr137r-#hF}^AGhOT?ob6(0-Ry84*!bTF1^b+W^NiZzdZkh;ALn1QKB(WXc}`LoVgmNgGnD57&^LK5C&}suA}Z- z92E(kI{R55Zw>80kPr*wH!xHjNwc?D0d@VW_kH`@EW1S7?++8VT%l7E)t`F4K-kNZ zgM!?&URHs7|HQvnLTt8v=`rFfW)IQGXfVrd#%5^v19@AAcoM(8HbCyyi+L*?5$)m5 zDD?-_51l)Iiz_DK!1up@mFOC-bTgFB^c@)}Ss4PXDj)vz4D-QLfALBM32l7a-`qPKD?Fxm zye)#>Pd$0b*264%!*;2<5kB8%K7nvQ!rVFP&o3~v7JR?)yAn>WPhFqx_KYMm0wh5j z`TA-BRC-g5Ddn+*II3jSs0=^NMHFeX1Co(`*%a$V{HxuQ*&Wi^6Ku8RNVU7%ki(ZM)aG; z^`Gxu54o!)?8AMU%Lw8CdaE8Iz>hi<9+Gdpn(%dj+^WWJSAWYRdLuK(N4HtD{+u@qVcs? zB%J<=mE)!T*8ykGLpU7tg96!0?_VY3eC~84LE@~eJ%t!^85F6lJG9AtizTEcsn8zh zuMqo17Y1Lj)kh0wghjA=NTS2Wrj_UZQ|9nHREGCD;}09jxY60y{ya}-yG>#UIqRNTv{jLg`-r5Bda392y4&P4spv;}=bcN}S?v7oc z01VPM{r4M3{u^%UpSanY-Q?B5BTw?W%sClGokgUV){UD%(b~}i-{{M5Lwb0Bly75g zz0}4bTQ-=Fn(83O(x@XlfL4%A16epfy8HCvu;jfs2p=d`lutcm=r6bCn-w8oT zV4%!qh3PKA^Nz#>nlqUC+x?LAS$+uuhBp&Lm zE$PUYA=0wLJ_^IHKSgk#8mCdl+j-WBV5ys!lZVidSY=Csu6Xh#3cd$R;**gpzKgZ& z{0-tqcHZFQe5#aRoEqu^iC;;wT@|_%#)mh0&;eD&zhWlnw6iwDVRx}QjE3k-{WR}J zeZ7J|VZM$ACQ)?fM>tG5I}i^9b6~A0qml z{==VacrO50gr2e#ss~fJiZKgK6u*~t-XYGU=J?e!2anzSy^jvStB6C6<6Tq@?8~nv zsHTJK{w&O*+eE#}FgRk1o#_b_i0&r13@`jTVZPgd8QzFiHtU~N&TBmKt*a`2l#K?b zTG)>G1{4eW|8bQ0rN?T)7S3;1O97juM`Uf z5!`=gLTj$i(hCbRTqM{F$5GVQerbP2J_Lf*=LfWmzTE=?KKVXA{Xy4CJN9=@ zi{c{8*x471^yHKr4}@9K6THGrqd#QC%5vcCXS0|YyfD&ZRn0qGJc~X;h~slcIy+9} z=TE6_D)9Up0lFIwj#O^4ZGG;Nv!A{)@Sr+>HztkBy7g#5aDIS(R(@%}v6@DriJx#b8k!1$B@W1G$h~DuxGR#^D#%IYrRS+=X}ven zBC3y7>sZP96Eag3IX)#THwXfq56Fk;fyQzF?(6)s%=~{Sd+VsE-mv{wLOO>=ngOJw zQy3bCmXPj7kVZNj8mR$6I;2yiI|S)&0coV9k&d(H`@X;P*E#E~!&)wu)XeO?=h^pj z-PiTG=M{2DsrhG^N`1^L#>1P!*W1u`Z=r@=iz>cW=0y;06`_kQg?CMdK{vdRGeUvC z%#%#yr043}*h&_>s6viHf6?X10_$K7jKWvz(t;kl6W*DW!O=YrpT96Ix%yCiWnpB& z%+elX8s>vDY}?l31eUd-@mqCN%upzDc9Eqhp?n{XXA8SU$s7*0Ea3`#MS>g>Bg)Wh z47_P3$(h2d-ttl9V<{%q`W4~J|JKYCyZ>9h-mjJb$dN4jYSkCoq{h?NY=sPJ>!bmj zG7BL8-nE{}&u$6Ql)O49u-#ZXMIYB>NL&G%WWriNfp)mV@I1>PN7k3eMpYjMRp`~L zoTNaO0tZKG_Am4TO>U6ATaQ3#-?-1Td&HAc*7{O`_Cfj^Du(^TJCfTstWt}jDMMKh zO2ciR>onaO)C?XJPe#2evJ3kZ(-aNmiD5poCi=ZFE9rfDo`g6k_r-f~mQ|Nz8Sz~V zbKvU;!Z2;=X7v`jw1h?97X&chgf_7j-YE+v@(=HxM>T-Lr?%HW^r@716=b|crAQuN zgV8+8O3!P{<2Ewgj({XrUUoxa8gcYvF|1lPrQ?YvS$WR&vpS#dq+*^|OEN|N z>k76juV-ya$JQ)-F5Insl1+>!6*5?~r@^;MLB7h)Rn$}ulZP5nWS0@i0S7t<0Q zxYM0aO`joHPi&8iuq`qp_Rm5$7dkS(xPnZF$?4JhR#eRx-r zX7=g4sPgKZJD~P?##GUH1b%i42UU=54$uQH^7u;~@B?3BRJ1$%MCyx~on}#us z!heV>usonES&e}7E)YNpC_Gs+%E)uK`2L92i0y(5bJVKv`--gE**-m7#mjTu_%ip7 zs*c-f=X$K*G>C%bd1)Ap&M@RGy0ID%yam0Yt=st}xF@hvpq9x9aWzH3de%I$Bd%e3H2~x=&h1uxKi3hT`Zg09UDL>Hd1v_X8ok7eu`36no>3R z?GIa2m~%?caXxz-IudC=hibi{LQ^TQhRfF;Qt|o4tM+QUyU=iRhj>??DY<%-qF;}Q zs+(;5W`IgLq5eS9Snw_p14PtG=x734Huom0ee%9^_T{iLgZb-z0sjx9&t!T1gA{)b zRaIOTa>K=O4;l0vu&k}D`15pNhdA6g*vQ#4&+DHx7Z#d)7Uz_i)`@IMNhujDiEB}; zwuuH~5YB6^k=)4@p&N=dlOVkx**MHJ+!D?3^7(^npA>vPS< z2ub561}0(~QS9r|(ePj)%rJL!q!dXeacGEclxG24AgW4N zSjZin4BWqcmwZ-bmUdARCX;}xSlqhbG0o?1MFaYQwMI3Pl;PDj zM@^e?Jl>Hn4SrBz+5PyZe6I=Z$%!Edsg3-^b{*YRX%<~*zQ~;62#TUt6gJvSut_w7 zN)(xvnWDb;hO#NKlal`!{1U{6%$qg!Mm^h}A;fDvuws%jlAeV@u$Or2C;yvmz3`q`>m-0W8V(dh9vi-mH@IrGQ z!+@P*UA);&TJg;)P=EQ_+bgqK7v!Qr!(;gC)Isx^CLZ#Kz$G*ZszF^sk#v6Vt=b5+ zecz-WF^H6z)KUVCOi@DXrnJyPio7yVEl!;joKdO%>GM9zF4xk?I{EF_z%P6fwn0S7 z6(t7&zF+ zuo~|BsHdu~uIxVjsTR&HJk2#-o55;BnmV>1PRN-N;otP8nF};-_X4>46_m!rtb`h1 z&Na^Nw3X(K%Z=LqojK_;R1bG?$RTiYP!k$ILeH2C(9ng=PVZ4$>*0ofH+#kBMHe^D zu~;$f`$k8vrN?tlpC#LNrFMmK3Km{5>T5nOeXU}rG5F@+1;RbJjU-v-91 zX~;r(@(3-zKI_dz%LV1KLFrkO`cdog{~?il9K;-y3F&{nmjeFlyU)1eQVD*}a_!XI zQt0mQ&P?(~{1j9(_re)lF%WE8#$Olz3PJDYTz`L4&n_ue|0&}heZh5nMBL{rGV z?XNV8^Ho24wvBW-Ej$|(qR3+~l~!b+q%Aq4V_{z}Zl(47B~Rs>I_ae^Q*K z{R896sEYE%_TupNXuQiq5FYT*r5LB_-`u5A%SG4?v?9!wZ8$>sfUzMp$N)msD^!@o z_fxPk#hiIQlhRR_4rl=>4}cu;pBZZ#lt76jZ6e1Rj2F#oP|PlETj zK@zGORpl`ydyPDIe-bbv*WJggvf|Hk8`-@n`kZbvw7_FGk?T!mq`sqOiYJQFEx+|% zA|(9otaIk&;nk9dPV9JX3k%RV@j`aT{;#EEj5#-vuo193kvHnc%j*mIpWYLQBmP;U zvObG$c$&sK~_x6m^|V@ztM#;HDlTLlQmFkMv6L-N>fg?W8!3*(YDhl3d;$6?a_J}IxH7L zLjY&g=&^7zz;Y&y&MTy66aT8u7CsUGPl ziJ$M;qoH&w#)oXjt@MLbsp{iS>LSA(djRf|Huo5RvS%q2&ggtV6xVENb9;9f@S~h| zMf`M^&R}yegNT!%4_?$5##gr>rMOe!T$#!bMlwJqm{5y(VP6s=pYu;` z(X{@7b#%|Wo#@OF^Vh(vDo==+gg1){kYYv! zBC=QU5Mv7Pll*ZwzD^3uzwgPAOu%QvVx!6@kdllcNEqsS;Y{^-5+TuhPCo8URQ;&+ zJ9XSC?*2b5VgVz}H`2Ci;}aK6`-_o*P0a=%=F(51>H~`Wy`PQa8F?EYbZ^Ol?~Hn6 zVFPZSD=R^?C$t%pb4tq*PrO8^Ta%iyIi22yA<0ZozPin_VcBii4m|s+6r1y*b5j1r z&jp+@+em>LQq#N@)J$L_^VI~^Ati>>K3Q8a!15EA@aq#(f7SuHG-G|yxt5abPUvCoH$n_5hc8Rp{UfjY$>2M5jL%zc#INjvJFEa{) z-;C(m>dBT_NEf6TMH+U%PPlDa@I#97s0D%#1emW#GLTEZ49{k1{_i`$*z&qLzUT17ODR@n)fHaY&ptznTVwg6Y9KH5Z=yK@0lGJ(*Ik-oyZO42YeoXunMEJ_j z=3P_XfOEV91nVI4%8C5p`pbG|1SG!ylIy5_Xri$vP%h1ruCaZJpV8ha-vl*7s~(0$2$eqIVpNJsR(1-Dph1S*Z`RJz{`;HY6t%698ciI42C-%tOrJ#GhHi>`z z+@}xDmOpkQ&&wHBSyu%KA75()MlNm4oi_3=U%L_6L-dyKN|u<(eE756?;K3Sb|8*dq2}E?f(bXP zCF@=WHer2AU}CVcy6TSOP*a|{ZUHfwU~!*POz$F^I+<&YL)taaagj>EZ1_ifdy&RI z=m#fo(q+0jKm9Y~9i?QZ_U0`)i=ype-zDot@f?zl(XM<#OE@UYF7 z`AVe<5Yza4QUA|R{*kSwniv(_Wata1SQM!*0_qqJ{!_R2zl9FToJ0IFA0EBLZErl< z42Dpb_yD=$zsH}U>`p(mjOLc!oOTEhmKq+t{^c>PYDwq3qtCW9=V2-}H0s1x*_io7 zo4q^T(@Kwk^R1p&1RAnC-0h z)(nd&XJyG|Og^8!Cj@>uPCGJOG3{u`e%vKP9 zFl5DI@R$H@fbA0?m-tf-;t=+hs|)mR*83IcZ!e1ti{6$f0(far!q3u#Btv0=z(-n~ zU@4hR{^F#5AEv3%%^H>@#ff;F6-f`+1#~rFzV6Rzrdb&BP6(6vyD-1?A@bI*SPb1Y zV{dytadj-*JB&$IU`0NBZ&{I)f|puN~>I@nfEmX;c8{d1tg;4SNlu#z4Dn1=)`V=gbpOTCH#rxK(gqG5z!7}%L=AkoH` zCP7M^J096oGH$J}H_pf1_bc~m$2W9dU+Bz^36FAzrh#y;=^6#end9&T{!}AA14wO6rteNJPr^}3QJqdRZ3?h>p&{4qQ zCx%~tW)7yx8%#qFvbhE>r{g!h^d1Ebf#c%vD?~AgSwMU9cuyEGw%DR(A&g2E+PqBw z%+sPP6Hw449#<(5z@$H>hv<9nfgbwkQ+-T^Q;U5=wtxG-Ifq99TSuU&z;nBJx#Udy zW!Vn(+C}WCj;lEId;BcTHDkW*CJ-MFzgqESR7vAyQu;1H^q1)E50Vuiq0{{cfZdog z18?_udX&U~Jd>;8;cd*N6to`!@qAnXXbwG2t%syREK_Y8(d-+Sc@Z>N54Zn59gr{~ zNSrY=;-U!N>giLdR&h9h_T(`_&^MkCDa6VXI0h<@!2uLZXY~lM8h>uCT{pRITKI4* ze*i$B^G1X=3ob84W^I{+Od+coHbNJKr;tm)=Yh9$b@QMDJ~9cdyle?L>Au?|!& zI9Drv&W>8(T|^Wog|YiQ+ha;`9l^1DI`FOn9AyhPdMJAfmhoAHSm!B*PM9HRxY0Wu zfD!JLLTo;Bt%s1werP8r44d|S^i>-CqZv#4t!4~CNx%#Uqnxe#_5|S`N`EGo27on<6FN7)YvM;(M_%Jl33KC6i}D{$4+IcU)Q4!JBZ_l9zr*^?V*v8V;{*^_ zH=B$<{IcF`2zq*iMZzn0dlj*MZUorm#VBy~SbHT7*Hy}(v58G<| zgd7%Zrsz?`S?*m(=)J3@CkmwrmIDG+#d<&StlcXHLOLEOPD$Zgsr(+$*#L&6vy#71= z3qwcWgQ|4;rOa<#B3a%Rbj>@YcjZcS3-cy{^nHVK5K-A`GGh-7$B6d}4Wa9XokRT#h7k^#Bbon@sQsLu zG3QE9alUuo#0|@^V6j)$X)aHx!_8tH6GeL<&`@3Z#Bd_bw2%DQqLgLGhkN<)km$Qa z)KOd5zBYP1CLiaeY91r@>~|}>o98{}jmc(Z{-eEWB-$X|Xn(Ca7j#o{akfhF=$9;3 zB9X(2m~johLuAX>0k`m{r{X(`JbH=Tv2@@R=N#d)LQ-{ zo)w}}O)>kQK#2$3wKZ@NOa6W^;)@eVjJnw`6X0;*yZMxW)(_V}2X5pg;efNzi~0!i z#rT818nsIO$j-PO$Nzi-u(NBGPONk(YF4(1ZNk#$=9N+!H_+jWru3rIZNt&!pT98xU^C&?3-^nL1PW z+vNUUKo9hNwTNV>zr!O?^jm8WA6+bBt&!huOg0U0HBCd?df;d&vqFW>_M=e=4L%!CLo<|^+w>e`wEk62P$dcnH z!wDY1-2J8ZN}~w@RTSQo^U>0-!=(H#7|bHKd%|Ai~AI>EfNc}SbnI>Fk^4WC?l*` zV}!XC&@nK)pX9-^-YG0VON4N@D1>o;o3Do$++exd`4+OmA-wa91!o=uM_A(yEB=ep zhL|71NOU3%K^1%D$c^3-f36tY+$N|#DiBn~y#uJ)u{(uLNEk+isau&q5CkZlmQCGaPT4~#I1|-_@#k=kB=+SnCzM_KkpyPH?^{rROrcF{47=(>? zzE7ffl0|-hzblAU85cfm;9VQzr3p8_Ved{+z}(=+$lZKFh}~Vw_zejKZ6uNwX@Bv_ z(7E07J}BdTLsZr$);5NM(x9xoIFQPd_+|{BMW_Ih3vdtk($snX*lSOK)9(kWHVze# za-S)_Dx_{kzu)Exiekhd_#)MM`tb4WmKnIO9qY-j+VrV-q@x}@zm9AdJNFDQ!vJ+t zqA}>vCdSJIlfQWe&S1bTbcvuOpCSoHVZC!PR-oKJI*9>~y5+_7rB8=97 zCzKtc?8@Ze1=+8GAqhc|{Dc(_KWR@Oq4D7NzMa;JYMY*wUqHVBamd4LeG$o6@BSqf<=+mK&O=ERd@vbuILH= zq5qCH2xx*>LXL{7%(T4i5=0Ila<3fllfkAQnh@!+9y0wC|H-3ja9_>9X1QW(&Whj^o zcrof@)32DW_@4P2_=Z6zk>@Sp;M?{h@2=bDyU(T`mX~g#UW$dR zD$=p7GUkt=I=ti(4NyB&hg1=dapm9T>cHOPLoa6d1}d4Fg0PwwXeMH@qq8+k0rTy@ z;PAt691%|r9}0@!*nsX$@te$(aRE@QWBy;)-2cag7}$2AOa6Vfrfq_WcQeb(_iP+L z2|KeVPwbFgrUGd#yq~@ul)TfbYhYX}c8;AnY|48Rn9hot>_g=~!ow4(k}hh5Id-|$ zGUSk#UfXJ`GVGUe-8I>{Sbr!7hyd?^4V#RaZ=t>>>?_^kwAyRVv943i(QP5>Uz#gL z;xK&)U_Yjm`O01}p2E-u6*JQUEx~@&0^PCk_lHye0()fCGv2JUO;KLCBZta*olGc(3?&lhs@U_+HQS`?FVDwv_j%k(y_Zk0czk|s3+)o?tHA-}^;sJm!a zf+7}a`W4`dxxfBS?Kz_XPe6S-Sugf{fWJ-0^FzcMEJ(bc+tcgKV=eqxUoIfjV#Eh3 zE$@y#^JtdRX%#T&+b_u?m1u%(v3`-B;;}0L!W=1!jv)Z&+Hh}wMvoCM%hn*3Sf|B8 zM}WgR$FH*eA^RG$$W7@{NTjFD_Y`YNMf&_fJifGNs20F>%el!{H!w)~pi#@E_bq7v zdiIdDQrQlPJN;<7(zG#=f8-F;YUo*inoWSuaS>g}0+j`3fy2}dEA7%*ZIRee|5S6r zN`(L4BvkiPwJ8ybN+4E%|1q9q%8%!pI9wrp)5(DW<+_^iB{FY2Pk`e9=}5%Y_E|ZR0|-_UV52F9SFsk*u5});}Nnu=ez` zj`P*$wXDGc$Ww3ec1jq1(g+ywQ0-g%SL2?o&q!B`lA@}M3jLs~Kk!IsSHqYy@jE29 zTtj3Avhp>05v3%`%1d_poS9AljUEb=GhTf-lGLB@WMl9MhuXd%yfXLe_(73ZB*k5J zC^KPkDz-af`B+;OmdO!NBT>F%N!y0AA@+#3y2b)!F{p-`eHV|s1_;F&@8jpR!n8$9 z9dxOmQf2ZN@~GOZ@*qVo&S-KAxi(Q|jq1>_nHzdN)OVkQjS#SOZ`?OTgSy4C)|SMZ zlv`|OG45Iw$Qs`erEbYrsa#QoGA8Oom#BgC#h-z_@h7ohDze`GD=x5w`~jk`s(}ui zC&_3*Q5RL-Eha@;|Ijn(<&{jUi;v$~Smb7W~q@Ua^FVE$Ucdtes~!N9*3VC(}AK zQ5ajSTz6oXV}7S9tQ_J<@NZ?FZi%IGeu8WixLD zu>c z!+>)pQ+38?MYyO=?1ien`Wd5D2&sE&@Lzbrxs&W?%*&G(tC;z;PrNZhrSrv)S3!g; z-rGOph&WEz!O2rB^cq%C7=)}O&v>n*n4++VRo-zbR}XxV#i~;1fEw_7CVmR2@}k{3 zFqq=JqQg&EhWoxSV9-OuEJbAflxr#{CAYsDB*w+L7A*1%zOGvCk7#T&rPQtAdv@Z z)e0BMszB-NHDSpn$4pA$cZr(~ zwvZ@vkNvnbD)>-lw(<}lVtFY6r|YlWgm4LS_gO~Ww&@@Rb(B8dl2Y5C>uLq(r$6+H zuONw6(caX2*0WYfjQDZ)kuO-?_;@uwwuD1|`>MsAW)#>q+R+HnmnWq|gClR=o;C6# zuk(J6T#Sq`1d%a3X6tY>wYOy7C7ch9&*o!%*qCuy(K7Ad@|tyb+n+;tJ|&sD6O9x@ zZQS5yoc)gbA)FD zs2?zKB#IqA3mH&3XPXt2;dDb(&D-D9La zu()mNW;XGBN@Pskr={^}c&A7kl2QfVN)9ZxeQ7#Rgwe1%$`$sUELEaUFL!QApR-}X z;%A3xm{yg4#l8TBPuG9=B0q^t*UfXd@OaDSKbJA_$u+-ETBin3_{Ou#oV+}h*vKt(jCDQU@S(tp@ z%uzGI0Dm(KX)hXm1qhbrA8&%*W(u`>crSXYM;yjc5j>6uJ=D;Z+V(&mxGq|Zx9Sb%*P-mab-V)scM?4tN-rCZxDcq z`|o<1!vU`=FlnWigZ9PK$#YV@T)Ne;p2vs2u@ApX=OH9`Qd?5Kp!kq-x5;0it zdgTghcJ4nwn1XeA~i!#E06r*?LD(SUeNV4)CA?z zX84~1HJM9ze4qx-xG5)wqk(WOo#uQJX(_I}ID{!vE1}Ns(C0SHd{00S(~#PK5yw8U zW6mWTEV}=lt0zHPw6I_NE^gkkBP4qLq4~K6KKYZ5m_#Xc2`6~FAaH{4I!N|ZLLf{m zdHQ@Hf-?WULY#Fr%WRrz_doLm(?TbW?>jxa^{^iZDJ|9)o!a9KKj^I5jLxVj!KrcO zX@TN)*Z{QmjRr&~qs#PtXXd-M5R63DBHQN==F=(d6XAbR>GPZ?F&hKS9{pI2622td zP~&pcPwt#+IcY@$%&EbE=c7A-LY0?yKh^*<<-%(!iiO{F_CmaXAhEjp_8@HfTcF#e zLq-%Ap_xF|b|kvQtAai*n7=SgnNr*=d38lkriImqBQKtn zg2*%FSIt&2zNVP#GyH6jBqI-kioNO|4QWopotk!nqO9~&ZLn}S(MtSWQpx^hs~78A`HMA^V2;~d>dDJ10MQdoqPEM)xa1_+{Q@?M2!vAdb_qH|TOyIUc6*Gr@070H0)s z*s9MUXz);Ve)U3|-2Z&~^a>b;1c0X>zn7Q@I{?_Qu5GUfsd)$$rf;uIPACG_m14f| zJLyMPIdgA7$hNW3>%S|FKf2hDKZQ!1l-*fmV;ImB9My8!w|v5?&4r;6*F?t zr%LJ)h`mc5qTX4PKQ4R$T8p*ilO|7p@4PD(1>h4^fpj=c7SbxvixK#j@X4Rmj}@Ps za35YZy+W|KU2YT3GYXbA?x)e>@hr0+UtLfO3WCmdSyb&(N!28-+OF?LCUxa`sa$>; zn~(6VMgZ6{k}+~mYx46MAsz|T=-%<>$5RSa_J6G>Eii7=SKy^_#=RWB{^8N>CXqj% zg3*od-jHj5c3o(9j>x-eqqrsUQP4b=+hVKFFjGuPmh{&~(MDzc5y-S__xy&*`0QyD z$N3Nb$-HbXhVCQr6ReNUT#J(=Q8t}pFiN|*mCh{gAoH(c+guLAo|{Lp8~5vhc9l`t zlgNfehL02!hf;Z$(?9CDh(QkYs&RHvMupO%V)aiVs+xb(P&PZJBTNV) zj)8>BtBcOvBHNKRB=&9CfA^kN`~WM@}zl?b0qn$Uq&Dtr~9zBws| z^OxdIJp#**jwqyAvD1LyI%YGTc%Ha7J+AoSl%VZdkcAV0qgrgvei@K`*{wwM66-%B9F%x3iT;`k zwNcB9i8A4g19d1Lvwt>bL-AL39WN;M`ajY-{wTC=-UhYD>wK3o3u1<6bnc$*b{vT6gl;P)0bXS)nlyycQ{LKHnRbIn& zpTg{qD9=7vG&`q={q%v$H#OEM7A1+LsWxhLs6N&q-P$if3M*=d>hY(^84y!_ZHbm8 zFw;~af@aa2UVx+{#Qh89_VVz>Lo`v-FOl(H&>F-R1ce3vqEjLUZF&7|r0}2H6WV;m zDgGXYad9xuRVD1GIS|E?O+GxpWuT(By>{C;qpAEeimfYPoG+0o9spzR7JV^$i#u*5 zrLvY7@eG*y*If;adl=J0UP2|=!Pv%Fe!Mnx-$NO%7%A0CWa)H-EDe>?h{gN9^(xMG zLl_z;fZaaIS|L5w7F}xn+N{|&GB>$l)%LY|_WFTf?j2^&fHb*na1%u~>iAE# zjvluL(|>#d!*c!s-7Zr2wg>6JRh^dF7{X}|^sF)d8vwvQTM!M*JYzg!oJAU(;^mA> zI!hq_id10DN>Ok%z!={Ms=-56eElcQ180cA^oop}sq}fB6!?>{fLW5VX3X2H zPiU%Pr-;^Y4HN4Hg2ESb{sGWWn~dMr&oVS8DZ!bu%96>&UT>)9#+~9^Y6v7)5eh11 z$Oh~WvdpPeix$*rhKjw$n(8D;XE(?4-6t24DohfpTIR*E&08 z{z>aT)3^?9vNyiAI{;iOK;YJ>oz9cl4441A8K=%KP~hFts=PoPVf4cHf&kHN)G{hr zrJtue5>Fy=pc#}6A?fe&sA~Vr`M(1Q`u?^O8R*u<4Ag{QG>d%CWR1x)l3Z>$U;6vv zx3lT1)*ZKDPBOt?R!J{o8ST4!V<8~1B>R(~`%T)-mr|f_vf=~d;=XMAO4VRyUqN|f zO=*FImpI!{G8|%GH8cWWNzG4aQZVkA>ERb9AO3;XC@9_o;-fO#CDOwmq0Y2z%lwq; z94kBHns>Q9oKHtuiC_ z;tf{h9;;8c-=3mj1fJnF433f|fN{Y4UX^JxNV&S42$>8*_nSGS@<11{nB1F1U^Z!+xp?FJ5)T&Y|^dI>Kcssk>@jjl>OF*rKJk#X&bOVs_7bj}JH zV2BxmlxM*a3Yye(#;Ca2=sve<&oz)yRsVg>jFj_u&Bm~tfD?16QC}i-wO3m5x_jv5 zjfD;hI|p^8{2EiK*_>{VVtd*H!#fIj@-eXT2YGqMd>xnoEFX)zw?S5fB=-2{$tnaj zL)z2EBgiAzEF%Ux3$xug3z*carwf@olQaj64mpo{;f z)==SBmp1!nKA!|D56GfwH4!#kBA-W6SKjnJQ-soIT}NmVCL8^=4-<}Ql7P7Jmx{s4 zyuZZ;K7rd$SF1rm%PCjmdo+V~vr|5m#@}2U1zWxnsp#CI-VVDxfae?EtyNv__TY!P zs`KN1H$)Cea?|lUB9`r-ESXLu$<7uCr~nRSO7U~#LautxWoOAXX$ffQ@98Cm5SuDsO8rB=t^MrBWWdW2_V`-t|v>T>xk z29}Q@CuA{hYJ9N0IwtFzBlwhCAD7EC@rC!z$}Pxy?Gj`9^W@nF01Ri+G^ z%);1aIx}r}N?m5cx$!r=8BCP8IJqnal9P&|9y!cq1>0>APa8`vVF{y0m81(@=UwiZ z&Z|gApMCH7{gH@rEp5^hj@-?EucRWrV5D?%fk6UOioInhp;kun`=SbF;AtI|cPD{- z-3|Zc@W2EGyE4TY`O3_l&GEvDPCE(J?qxK1pI_oZpxZ)e7#M&UkRzuv^}pD z2rkRsB>~r&d*!-!OQS==%Ni}UowSdIRD<|JimeG?*{dt6p`YDZ;C%z1CR$CYm0)3b zwI96{bUcw6+dJ?^_-N%!al9(<^RIt^2IiR*J}S!mwB#%Af?I;(`S@!~{YNCGDiP&A z?!RY4J6>!detum0RG%kBhAKOzAyA(J+q3&BuWYd?AN%r^S<|8MyNi)W^}8*&1~s6S zv19}F+GHS|7_A+0qQiJZbTH8*_$>9s3CEG?uxtnb(gHLgDn(ItMhcFhk`E?{fs3Es z%_q?ve$xpbgZUw2R)Q|;XLgf%S3!vvSfUX?rz9CsvUKgz->gl)SvW~ki#6d>9aOm$ z?XhGfjN4?ehNDh%XUhH&A{T6ZrN1`KE!v$xfx|vMkx3&+p^wuDXG?w-;dQI;D-KO8 zuOW{s;vG_UM3K+%FcsCpoe?R`qg=VA)ok8l#5~`GMK2j*Kszdw5Ud!a^ zE3iUie0g!aAObNhs=kgb>Q@2BzZ-i>?hYjW3FrGUAasm&MrpGNf)U0W5#E=FK+FDg z(<|m9tUJ70dO(^hLx7U!7!a#ZfhgKn2OeMUvg($kjixK^qQU-0-fq!9V)FE)z6GIg zwEXAXMs!mAbq@JMBESEHlb zj=dwX{207KA&z~>tjAYnfIP_bb97|a-`fYekLZG=JY0YXX_duM$c0`!ei=vwN5}?; z4)AggpnqX?(mS(sk?vjg(p$WFy~yAO-Vz1(3~|w`hDL4?RQeV9ar3)Amr=tYon-nX zklI=Gw*VSCWEZxO@MTAdo}f9Ep7;IuO|V%qZ5prJ;OdRVh}*_IA-Itj^{~yYmm`~0 zj3VZl2lR|t#G%J%oIo&y#v%oJd*-G-&qQnPq<-W#1CNN9yb_Yz1;$OZqB;x|U0r=F z5=ODUe#SqQ;$c`&S&%aw%x<2#Kq>tDO1@w{P`^f{M_{Y3 zM`_2l(|u21y1I>p9!N_F0G5Vxm8!mvWDyet<$7NS-b~%Rsi!lbPADxjvofQBD7OW~ zNZLDzZWa)t@(Qr5mVBI4gvh4AH+uO>nPb!pgQMg6)mQ}lQk^7 zC$>Xpnpm}YhJGbiAkVv8kRZs=C|7};P~FA2ogMza{n~t|HH$FlYs=Vg@(Mt0Coat- zKc3ab`0nG_r`V5Jv7e~k8l6QC*cl=0t|ce{exm_3um>aQl~Kf&K|Y$OTdt;}tN-EV z(Mw8l{1Z%uq@O_Ph(-hUWFH;fdTjwyCwaMSu4Vk`Xkx^?+RxfZ zioB%h&%bQkY4T0DPnVzL7i(Ru8*F}>5AWIrje?+ z3Gk_AFEfsgYz}98{H1uWphI}^>_UEZ)ff53gSZ}HR|2v=G=LL{S_as+j{Wx^pyLDi zncL08X31<&(*k(GcR7GY`=0;H9@e2zQqXtSdkSiZ?4U1v}0wwX&+iKD&d#uk!Xu5>2n2pp`eqT(!9v5i12+z!bf1`gT zA*QwvZ1g-}ER_UEw(xi`bw3`I+pn8yF@Kq|T`v#vrz{G3I*qv)#aHd_a**@0@fh8c zDYh8e6&B59NX;_CUBy-Y>9Vb*i)-(j`y!1U-+m#dVH+*~jY&fQYji+g1r)VB&h4Ec ztm-1<;WDPZr!F>-hcTe`*VnvNnNOjcN4tEC#ur<@qqagH$2scLl4(`m5S)&*cQu;R zk{G08qOl4$9e}1>_Zur4S43$d+~`g(aL-!9+-RzFZCP`)(HI$4Yu$-H5)^1=w^IPG zcufA5j@KqEO{z%j&rHWmBKHI-T~a#G1bQ^TwZR^Pt~%Ds3g4|W{fOGU8-Z?Suaw;U zWhQTq5;xOHNi!W#PAmO2at$*5bzHYr7=;r`xZen9yWk^3%UA&b8+q`pGmwfiy_5+# z!yQBRg=4i;W_KZ^S5Hs|XSp90t+rD|jk|r$nTTJ-<(KznY|oT37xgAMRoJ|4&jjHT zuIst@Ff%%k44=%HOhZ*p4(}bgmNrVU{Hm+~`%8>5eO&kT7$Jcduhi%l(EY_32m&Sp z^dLAC-QIh;j&h7g<(_=>JK_Jx2-F0R(zoIuKj=AW6F@G_R04kGnji`qA5D9(5KdT z_bqx>g|he+pbn*=@RY1XeZ8Jly8d+sk_CSS%r!W9Kqm`zUZLh?43M}f`cuo-@)}_z zpFsj_YagzHsDUK2oBVCg7ZS}C6zp&p+nlt$LEQB5?5KB_=(G-rVumtjtX~v#ahHDA z8l>e3?b-1CpWim6eTi|I2s6r5k3{Lyky zAd!~;%=6Xn%JX~YN`V$#G#;yA89Lm5xQBcC+w2nHy|k(Q35=wSg35#KoxmB~Aw~)7 z-2B3p+-MibzmKW)W0rLJ7H>?yMhp%=i6?vf&l3R5I0Kma^kB$FWUND)qBtqO_3}oU ztvxL*w`MEAo!o53F>6Bybq{R_`l6ZxPbD^$hl%VT_JPz%MeFQr{U zX~Uk{pKJ96QQNi2S;h@Uh(Zdn^NVP?raTU6kv z-CmFSMI=Q5!dic5>c&rIjK#|P%Rzih28F4YZfHqCQ!&bk++TI@jDkJ3*@HB>r{ro1 zY`5!ccoN~?3jFWAl1*96P1R*n{_}SlU^c8srbptlHaw5i_Ce}){r--f;H6?3B}2aG zK3n(xe=ROkM-iH#g<;MmQ9q7*L?z`OE`Lvn5cVRMcO8bQ<`}U}cCYwDuQ= zc+W$`20rnR?oZw78=3K!f*;M{2fOwO+-}b5@k?6fP#Yd``KT>y%pXKLA-)$s%B5KB zZQ?0p-mqpxGEQocTTC4%7rW}nxFtGcYre=ND%-o?eTD1((TQ8p8xuyr^YSeU?Cld* z=e4x3*S*82AD{1Qpq?RKzhDLH4ta7P8kym7i0BRxAeU-2Y4;7X zL2o8igWPPT0-mCt%{!i05R#unkq(TWnVQZLSfKzbk)%-tmz=yz$z1f=Q8&M;&*Ub( zBVSl%c}OyTK8D*{d0)BHux%u1i=kB?QR~z9+nW^5Eqg^J%5}G8Z{H@1{9mNKWmJ_> z7sp9l8lL(0Y45mA!|b8CJ>5 zBDN|$*u9P`dF6RqRtp7%Z=uc9I8{xwsh;H5ftjT-rs1-?h(9>UcAkF!l=gX3;r41f zOa`xas>dBL6ubBeFRoF2T}1988LqChZQ{^YSD%=?5QslMrp1y9fw-m#i17hfcW#JQ zn8j!#XM2ClXVO$uGRs{$#E->5k94bc{mgScj!Q%3$SyXQ|8$Y(hr3<;i@1c#@H*Mv z@|thO-tnyCiOSFn4N1lQH&=4`--HCPBuYEYdS8;p*WT_b0EekCl0XNXuehI;;8@*l z6HN==#U^_Xgo&t=y>+9dZ{5fk$@(i5|P>?OZC2f8q#rGHGaqGx zahY*rj%Z2kiqjvY7x(2Grsfm>!psr7pt4Pr^q1~NUb(5)fh#dBg1>vM*op5sXG2SAw&9JMH^;hoJ_SlIV%xeqIoI61AsruiB+Lu z`+Ts*u@d}Pw1(PdPv|gZN9ZB)V^VJiIGGI5X^AYOK6P|5k?{M-DqAI@Qy$sG9jWnf zlHA&5YS89oAd||7Qp>%pRNKdp-sRKQ8`jfRY22B66W&@enGO6|-)~n>>pB14en=Yq zM<7`K#8X7_76hB-c&t1zP1i}MuA89yF8Zvm^-pvC4{Cjp(YqAaFVP7fu7w2|ai3cz zriITM15>h?b!(PN3}#~4Q{^Hhnn|ZiuImooY=(#r|1R3UmGidq-Bzf7M)g|c*;;X9 zSc$X*)47`mK!ttahcIt0e;^b^V2XV4D zg57uym(cN3=FV6VU#`zgJ&v{*@wnD^SI3SRXH{lRHIN3M=OK`n)Kp0JyQqURh*p?% z-LJz0$NZ4zrKB3sex{`pE>Nr%5ZmvBph_SZL1d!dPpbNbYr_Ca@i5Dd*(S>& znHUuK7`&z2Lo8YPWZ@;OvBGIK4EaK_##f3&gm68NEs}xW+rf&NNkmTWWw$5wN-`{z zOc6eboxD~$-|drPKg|B*Bf0p?M|`|qCS;n^|JHm%6XmQ=7G;k_e|n0qPCu$auF`ScJJEiizUrRMpr^zV=ERP)y?rKZ{`A`P_|P+<>fV z4Fwkhh$Ai@`b0zJ7jJqZU3TU~LpiQzaYPzEnBA;qZC05FRVPopr;}Txn)O!u`2B)b z9xvCPF_Wb?DrPoZi9|o*gKXyz(wIeBZvg7pl>29ys1YdDAIsdlnXSS@9nZ0jFf&Sqj>`<0#q<6*;c^>cZ(F1!0i-A-6qA{{?yW4jMQyt6gvjY}waH_8?I0Cey+W1}8O=%J97;uYC z!V$INGdoiPzmSmAZOt&ecW3pq{7P!t8*&_ z%Ho9AfhTJTBTIL6lXZT;-J3 za{PjPg;3`0=(M1*8B7 zh&g9pU(aX1^9ez}^cv>|2BW8Gc z+5+M$aR|6j2Uj}jd>I;sd(t7qzIX}^I)>$*$jZ1nsW))Bp4{AALb4~EWB?sXf z1O;B<^o2cnq8gFr3J~E^%@qDhfehOhdW;@O!W7orCSfy>O*#xnr)`hU+n_Gg*Ku*9 z1pm&(l~GG+6QQ9JPZN=I-7J_xyWrZ^Dx*z2GDQ;mM+>`&#|L^#g*-c*K zUK5s36R`i67qGl*4YNmIEu#xhibq3}Liv0fC1gXwg%!gRW33>dGp^4PQ?O3LJ!Ewq z!Kh>FpI4|*S(R6XI>p*%b*r8>emo?@mU9oe^-w=Mj;s&XM!g7dHPc4dxv>f}?dbhj zGWg?Jwabn0BL)4O1f~pT>PM6#ScTsQNlba&Opfg{hIoPX2P5vCfULQvdI|W0WA95{ z^hDnBF<`4)rWBhpQOX_8A$o{PYridiZ6YK*k@Tf4{Xj}OG*|y>iD##7$x`=l0&lmRrgxik zBEo2=78YSt0wKJFNlpP@DR&&|6edT$R6MMEwG&33DbNsbP}k|kGE%7~$bMZ4hpgZ^ zlC8dy;y2J}vR^a(1eRLhmiolf7S5dYFKuapMWtuWZd<>Rv;s;@iD#6Q!A?bC0cmr;$54{1*KjCxfNUYa^7R7|lB2-q5HCZIk7{|2%o3^-(d;ahz z(Bv}}b84JWtSEL|G0Xf0egu?7eeqttLe9FGv1o2?E`;r*8x}2~&XrKo&+HDBiu*Zg0o8BkEINgZi*|@i{_fEvl`Q z*xjP*9-VrUPkV5wxT0j+Jw94QWBX+mc5`$Zi$x7!o9KW{qunQx{FBLP^7&_OO*vjrKF7N;_3VEhj zWfXWN&<2}Y1WrJ4Fm|yejl$3WJ{iP(RfUgr@4ZlC?wFx-w}bHyJP%74YFW(f@q}1K zG6kXAE;*5JG3CM&#L%u)ac8WU%Bx(l-Vg>SQ@7riJ4cz6kA5Aii8Q{TrQM=abBdBm z>z^P8G><=k5P=90T=L@$`J0_S)x?rlqRKEsZ_g@o90{_%IFX8Vf3EJXkZNR(!YjO=%bTABwl4RFjSDz0yc;aZPoXek$dkI` zwWHl4Mb#rN0qk=+t@R$G*JB^{8RKY#)R^DE|7CS&UjO8ROK17?Wr7h8hlH#EfoR9| z``_`<@hRb0oC*X3lycWWk;^9aXGW2q?9>U)%~^xsA`NICPaIr2GH=R3qI=e$iCu6EihB zcE822D_MyrY$dnz$PK+rU$-PaOtHOLn&Q7;6fXVSKmB&D(0S~>f7*Q-D9}I!MXoZY z=@j@*&>x1iWBcMRUaeC8_BQV}MrvQY>DNSR_XU)fi#3@-6vIbHzQd2~oz@}i-gj4h z#;NW0q0SU{G7IFStvd{oCv=i!^KAG|kY|TZN;Q)MyQu_+ zPWkc9cf*Pp_lJ+H^Vc`iD?e6e^X#*qxz+D>R;~eeDAyrx-bnU~&W~%NSUn5ZmVh)9 z(^*&48kyg^Z%PS`$hzUw(-9hv4QoXm!1foMKiNH7ZR#^#ZCrv@9Xtw^YOa5Gjx(hF zk_8lY|9CJ~U&-1Z&VZd1nE|WFE`oZ?J@fpXfBxhXqymJnHvqR<#Z=Wl8oTfYMpDL;y#?|_g zUNHAwx74DL4&fr@R17VpdcqlJ9qszP3AqUjnTU!J0i0?zhL3mpN=hpe-G4RPi~J0}hwNV2Yv8iQQYU4CZ!o~kEuQhFcG9htNT@V3lLj41ma z>8I%7Y+rWsT-;x&kNX;2pHZ${$FyP?KAmnBJr4_FYK~(a}7q6O%^@jcDU6wu``jasb+!p#?s@EO8hq|efdTwDHXYunWkqSQ)aGV@ycHSPgkVn<|45{z^ox(x;$+I;ZIrI;lgPN2K z(X4e}^b~BU{it@)fidhZyV`m;rE9-2!LjqZj^~|_B$R7G5Z{IuoX#(~zM80E_V{z- zW0F@~<#i>5nvj$`lh;`Kew5Rj9-Q!EV%NADMhDy1#4U9%^Yjl{)eDUXLR2i7f(5SCcG85cbsgKC>iP|^w2alpdOur z>xBqzL62k-3a`dKx|!iAx8KiCf5N^H9_?$+#B!)lF901%9sqptQ@H@DC2p?aM zqzx$qtBEkY{J~82Lq*bmF*TD} zRoi(55_`3SQ9S9TjITcQ#yWt`=Wf?bsIJh(jL90$XHVH0oKmO!0{K#528n#6o4s1Q z#Ja|*&rbH%@!FNjck@=Bvj4^U{O`O74XP9C2&CA^?b@XvFsG*;B;uY(5`0ZoR|;_n zA6O?k$j*^}lS={#eUQ{4tVkwOt8L;&n|&W0PLN9JG9q@IvQ#EJ_5XO?%Xw#Iy&A$) zZQF@YHH4#rdzGCu^#*`gYz&%0BUqN?wzB>G^cZHxR$*uT4Rs#HGC^elqmNc|?8l@R z?zO5kIRU*c%NKMd12#%9s}D;s%pkvJnBgy)Le=oPS_#X8Y9+~xi}W3uMDsJ?R|Ufju4(HsrbEQJ*{B0(nf1F$YAWe+QJw z9ws7H{Y4Xz%5OT*{s>;mPNYQS3xvK?cAcB6%E15roWry~ag$4@2NQmZE?CC|7igwY zR$6WkBE(tSN8c2jfq0oGd-5fYQnvrY^%aMilNQ%vBq}h|Gx%icAc}32>0>=33ie(r zzPQ>MDA2{( zqNdeYuvmxO#^y004^Y|1T?!zIQ^$(-dE0s>xuI2}ap!XvoV!s|LGYvL*~8yv6<&F% zun)cr`ua(uc&9sl9`rb$GA%!+WP6!&4xld|r*Z9?uS!E;a4p!8f~KPyWUNL}C?Tt5 z51&*jEtO{haZ2@$Te6B96`*T-C1Bx*)(n|ut^8;E2fn*A%rgu4S1=$J?8w`q#sKxd z{~inI+5!K2k)K=Q}VHyk^#P}9~sl!!BF7F^Vx$UQTp3MR!{HF zshT4%s4aC9mTzoF`F$<<4=)+Rh?ed+ghY3mj|NK)p+yFMjWYJ&Zcu9G7QXMFi^E>L zK1$#?A7IaWEuTW)%kbMq_~u7x;O|}wB#{QhCwx?xWUop+hZW}iAMat)8wRECnd)g4 zL(}muGB9_#p(=~syLfEpgmr-IBhjTRWU9cx`8Q7|xb2pj%nt&O{*iRRQt;hVxyJ!m z7>4-W-_*!i&`L#y58G>Rd#wT_(vy<%1}iPF)9V20a`Hn*FhM&|*!b(fe3EN)3iS7{4$)SCoEQ~GQM%e-_a_;GVPTpT zsg7VR)W@`CL=1{)K+NyHaMXdp&V6VpD)6ma;x$b70rRat%^K=Sd1=xCW(G}n_zNJq zL4~>IKJCX}^t;_ZDiXbChGDD#nzWjP{K)}h6DPjkb@!I>YJ`0#2IW29zhPGu04I3x zpxK#T(TXPm$XQ3g@HxzKyioF?t+u+7d_Q7#Pds2^7!=YSU@6z!R^VNjoAmKl$M?Kw zf#*UGS8Kn`Ya?N1YZ-2{mcJiEQW%YiuM~U$8fyjUlOrGhauk1YHMn~&bhqA@u;%x= z^tpL|BJ-cF6jgT%b?)d{w;=fWKokn%no8&#m~UPl6uH6_{T=Gc!UT_(wlF5xF(UG8 zGptVmy{;t?hF4+*pYuQ7jDbm?UpauZVB}KQ(!)h9QV!4UhnO!7gH#NmZ1{pDSXzwdSdwHCq7@8<o0@xRA zpF?sgECq5)Qwr=Dio`q4f9RyIxONbJp`Y?mkY7{=(WemOE1DbNr`h zY!^<^>U_!0IJoC%FwzrffPd(~1g6yza; zum$tGNspBCJc)S*Zb%=$@zHYo_XP1a0r}Rr!`?VrldUy)%a(OU`%EPGbC7z8+MEYh zfqf6G7Aybg2Zhl(=5*|z6XR5sg}@b6CH7d4lU@z0gSig+zK*45f|rK`(gecE<6Oh| zK#xPP_PEtUND@Xz_^bWfSwLzuNA*L4sF~UIpvgeyK@vIVdRqa<4b`h98zxmjca>QM zYhbiEj&n070(_#%rd|))YY1(Jw)Izrwimz$ZUr<;Mn5v*jQPaCEKa4>@2`&6*6#bM zTwpw{msHTKo4H8VbiFfoc3S1??e|6pBxeWxLL2hG2Znm#(0Wj|4{8l}S zSg>-+c?K-XyZUYKhtE$mKNs-juDl!s0auuo0SL3%Hwya|%@!4KCFJ-A6|E09y<0cv z!9uZyrYIT@ORr(Bk?F@zScbtuvn{lY+tlfcbtX(?;9>mCWjd&w$jEx6Z47gS^#1

;`PYbCW|qSjBW%SYM_rJ)*fnEbrO^vVG2YAq#>34_KQ5=>-2sagcdca zq8Ly>%@e>DOc>ji^`*rD36JiG0e+reHlP~=BGn;Jf?SqG0uP(lj!AqDk!v8&`l?jC0YCnZVYTs>(dC6%@ zkOH%V5T>oMcd4&6yv^?XK}6WyaI|RoeIK?GkgC{KhLZUFM8YZ#MB+VHsm>dW6nInE z0vrLWt|R#oNxT9et^4vLxCLt)&I4Q5na^K`yye0L5+ICOI@>=$AtgN5#U}m-7DE2v zwiM70lE#y^j2${y`JPSwU>`>Z`d9;tmEF1gSdRB*F% z7S=R!>^AAz@Cx-bnK>9|lvNT9NqS*1T=e;u1L5r3;?B2Hv+q1l7v5Dsl@D-`iJ@8} z(RCRkDvZlKwq1U~UgxjF4ZwJ#9S*wneB5waGd|C^LEBBS?wrRnsyAV(+PaLK&4Ql; zggTPB>`SSD8f8JwFLH=nm&c$@F}`7pV)Fwv2-mjxfRAW_Hh1}F(m(t;14uI;d6ZT` zD7{VGPibdO>BvS|=PV!xK|3ETA)SqPFEeGv_L=+SC1lO!nK-;MrOJ%ME0EYKj9|ml z`?r28D*}=3Q*5aRc)sVh6a1^NQCL*|75hr&5v=DQbu?!!()3z>a{nU7ZP-HIWrhW2 zXFebP6aAT#)Ban6ZN>f@*lh~@3+hG*|6dPC#;B};{(J4-ZTst}NM^s@9;m!!-yKhyL@9vq7N* zM&km9BqYvc8qp149cokvs6oge$o9b?hZp-&uzX!6hU5N{JMJ}oY52yi1m=F=-}S?5 z8#LDQ*FR>fYxO>>yc#I{xsj<0_@P_bF=F*KBw~*xY#+ldx*30y-fPGGi%WlgnM11- zaA&FDvny#6h~jshD9@WLo5l-#&fuCPGi~2xO+ZVKGV1%~H|`*X|J`w2q*Z~@C;>vL zX%ten=z8p%)!Dry#h*W7Cxdl@dG^?%(vo=DI@5s6&Bq~K)acwegmJ$fuivCkv_r@H zOH)$Gd6X_zU;IxE_>!knb2?@SMU%w>;u;&)Xjw2TTfJWm8q4rL(1_Ac3=AxG-=Lmw zNrk^;Nw{(z{xY}qD~paMxoiCb^DD*m7lYtZDd<+!bN!7UW9OmvX$ezeLYiYjiCUA;1OC64nzEvKm;N#%_5LD+AlWtpgO5<_tQcIdhRc=oYs zfXoO#296!G_y*O;cKEuArwP8b4jA<+?HxjN60l9GHa|$3Cd|KKdxKy zD-2jAP2&%z2vTKuiCV&~FIYeHvan|9H}8@VjGO9+<*}d1 zp?r1Xd$kDZC!+Ho`6A|s^#F*HEb&2yzfP(ybi=YLBZXN1Snc~>ax*b?@*4BMB`0ie ztB1IERe{9{3Y+Sa=9*D3iE*9)RR7gr|CcAvs;a-;G9j*LqF7uji{}WHIkQvV>ife2 zacK%qIvWtj$6@Q0_#}-YA;N7Hz%yUH%Jc`}{4bx0Qy43AVBa${8$vd{h9I;;zJfTM zXE#ClzD9wieMzli7bZA}LMVL{P8Vt>vn{L5T|_9g*KS_Bm#YhVmBhV1G-+3@D37G> zk^y2zM^EjMSFFxEY5naQK_@q6`hOeQSl%6>i3wnFqeUj|>`zx1+E^Fw|G8N@W$a~V zBj4l8smMt7oz=Zrs^V+a;U_=E%<8u9Tdwf&?@3g??ebjw=(giO9Pa*{Kq_nc!Kps5 z0ExYR3xq3VY=Wk}f(xR}&ciF$cSF4vSPM#sEL@rAAWFtZlA^>?&&GxtMKJjs4Y~`= zfW}IGgRM6|1QhWUgi?k+!$styGKrX}AP0RrUv=H|)2&EW`DT+9II^arLU`*laUyH_ z^zcYM8Gx5X|zfo|8CZ_l^lRgQ#ikc8sC4Q_t=!lda7v0U~EhSWTPn z|BJ+2!Z>ck^tTsjJB)FQo&eE8r0Ey~TOfmX>6&0b$w4O|w`lq;h(XlU@hY1JyT*Vs z`Ema=KS2q7?N^j_%kwV#_pSFA5vB|d2f%jqJ1bOzlyE8H5v^i!xltRaYI8@nycK3& zx|U)_BO3dC?>m2qFv4@)|4}1!LtJbvG>g+{BK0<#h@-A>MBF^{JYBRHvrc`;T9Bl7xltuQ3$@?fnt)_9i zgcHQlA4Y1cU`0x##2b#fMqtlrLXLMMT=lb50qSJRG1G0iJ8)_F#rCx(vhlpHP|V!~ zS+we~_hGa9APa3Cy^A3HR9Ha{qp^BmTx?9r&x9}Ejv$(}+LUEOu^c5;%H+_$mcgj; zB0lRI#$t@J3F*~ECv>G_s{+H@8qzz#wdcpT+p(XAWVPp&L%s=3U)A|uW&QSzvobA8 z9d#X%rLjN!poG;_g`_pIiK-`nFHV>vUzA^^-U4eceNgsrrijW@8eRsnA0J8`5@dY= zKC0I*34-qSlEbXy+ls3=k7(NPKe^J(Rx2s?NYKhTe>H)(^#$hTksT~KBf>u35L0qz z9%9Vh%J@wdG4cUTX{;>8RF@NOWA2=mcPg4EGXU3UhAAUl;&p1%;*JooMRSKYas0{s zMJu3sGHxEuJ%B)zGP@qH#qr!0ZslP&_@|c0ZjW~^8e`M$AQmBNWwk;b96PSsWcE<1 zk%Wh881&u7(cof9gL;^($8Ootfxw%9b2~iLhzrl;S@tYHSdNnrhteXrIEJaSmYs6H zIfHV095tyAv)tDX)MLN1{iUr|_eB{<_mjA#rm|K?RsqACvFTcAL3t^k4eu%bne9Q| z@0mgqfWfljxg=O3j|hGB_YUlFejVzz_6M!%$`T8@**uG7E;;<;`h~Th2efz2xPMDH zIV}*G4Vbt@xM{F5rDenq}TyR_FaBzhZ?s$~6AhDmdVLM5+;R{@wHgH-gJESZZrqZ$dX< z|M|!n-hqXBeM;pM9CQ}O;3)*xwk~A{`q$sW$`KS_ls%`;ZtMGzpy$QONs5cb*ha%% z=)D;M<_emkj7_iAp6+`ni!8{BZGCA(hb7OPQNV-#CB4o>{sm8YZ2wK2{nC^E7hTN; z{WmK%==%TV0l)M@m2{~NpJJ$8kw+MB_ijP9&>PreF51N5fJM6@W`~_vtd-cj?i-$< zBY$bxJj`K@p<#PRTBL$(e4JF3*Osyd4$be*Cp_64S}v(k8;QSke5)alscg=HZ#Hz4 z+IpIV=IQ;SeWjcDd=IU^l;ZhX)GNFRuzLoXJ}XJsFH*SoqB`H+IykL+v+==chY_bEF*RA!b_i+5@bSH z9JP^TXlC%P?ldS6GC|V`$bb;vaxQcVoM>#~GA*7Xlr|=tzGBf#RU=$EVU4pamhHif z;Y%#1X4PT-$M3!_m~2FKdLXh>CfCO5J=dtgi(Ty3T-EN^CF%Oi0KwbK*t#yO`(TVK zUilZIKy1`roEmFNH;3s#p<7A zO(X>D2Q3T?d*h=n`jv>UNOzcN!@YY_!hyC0tHyY+AI>zoXF3fm`R-TE7ZD^1ah<$- z(SCzesfhyBvwcIh!&E0haxj4c&OB+NT{Mp#q{DZ16}pLE6* zViVP!a>LUpllgG1=qhi)aEFh&A#G8u(LxYXy7!^aV8EzwgBPu4w_TVONujM4QYM7< zm?fz{Fz2}&SeX`!%nP+eL>t)ELHmePaWE!WAa=?6P-~Uwbv$U)wxVA=46Eprt4vzR zYrBWSl?Yoo%UZuksyZALw1qIGyBA{7dlWHS5^b0)U@aD3{*gf}h|CIx-8bB*7KUig zAs7ty2q-J@UnEdX4;Vf0j8NSnDQAwm+o&qBQ#|g?1=RW|Lj^oFPwC-%_^ZPpENP+$ zpE(1R!f?zasV?)d3MTW>=vYUuM#FX7;$zKtXs7~4%=)umB{>uh;_W*KV58cf&~lX5 zOzEi7GBant3r~Evb_E)W&o4{g{Ey$=E$GR!;v4 ziupJKXs!?)QbW&1djw9Gs3ttrUl*Rr(fB_;kNTnw?TR&j^H+I=h<-RFsKIa;^Gj2h z!~%y?IHDZ|Pl?I}D5H~(NzYwD9Z@Q9uuyUTr$8_^l(=2h@uAn zFg8HGvM7p8^l(1tLfamG>a__#uVk*YRsMMjqyKPxZFvp2iI z+~il`MlS7fc3Kuw1xC%PLjZUDm0#Ee3AZKf$r&p$-^27nfB7rq$l1)Ti$!1g*^jp# zA{*|}clZ7ocma7Z>nm`uLY%v3dmj=(ajPc8!5%59Jp%FoN!i$pMIFu$Q!@KusZ z9msM^8AoDQ`9)$p!4mq-3m>n{OP%B(t3K2a7h9cQT?5ti8|E&6Du^tZ;&7rZR2Nro zl(KNwL8VBYNiSfz;iSxq6te^e`Kp1Ma8u|{H*iH_(ylZOeQWr)3Y*XxvPP=_FuQrQ z;SC&P_>TY&3QuOnl?=&tXYUssCFTqx4U4|Q`1_ofL>-(tfrROVDX&+aA-+o@y$11a z7MI>fPELU!3i`I2UO}Cia_A45zXxwOVHKdE*XC%jB~ch3EQt-wOO$>hMrQ-;k;PKR z&ot}aGU?K4bJ=AkE8y?Iw~4d}F-yeyq;SWYl03V+J|_k&QxlP5h?8rXP{4>@YVyg< zmKNSOa%F<&*sY3m4$7uH=objjHNy!%LQ#S_Fs^9RRN3Q$c6rNt{lHn<9 z-~+czggxbYQm}~0U0DDVqug>lBarLKI$H0VLeg6Ae%2oM47C!XV}`?kE+T;L0dAr0 zr9pP6{*%*Z1Hw@2-)Uw;#&|2e?ASwlchRU{p*ok;d~^;ayS9{KQVE z6<8RheUuI}<`o%?Ip43UB8!)Lrvxg5Z$y}m1#q5*sWA^~Fnr(;e#u-v{!yQF(P zed4a37IRF8f0tpJvP`|+Z-Knk?I`CEg=lfyG9WhBnmc*3j#PK_}-jF&I&}QFD*p}sGtJFJRczh ziy8<$*VMz|<#cy2sub7CTo zd-hueNwxajukLMFO&6~FZxO#v8#G1;>tkies$h}?HTf0k&jWLix?)4QDF`l}^TS)LiA(iV~8t!7IYYuhF$ zLzWf1ATqjc6Paq4)gxz9$jd7dHT<=gk^m=flpDwUH^ntb5X;ym({<`2S5CLl(-gx! zNrZA7ekjKl#?G5%9N-x?r3bMvkP^JLPGdo^F_!{q(CujO8Cgaz(C*)y z%E{2GjG>O@JGoPPfWM9KgX032_OQe>7a=dw-u9q%L9`GGKE{Zz_hvUns0bWTFVa#c z!b#WBmZFKRKNH!2NE`dk4|qc5#2J!_sr^uYKuk?F?LgF1T6gV`oHMGxqFPWXc0xNp zR*lE8u~sjHu@bNHr`CRn*niwp{3d_04|OUlZdndhgBPMbEQx5{j$|j>+k474eHsog zS4qSf9wM#pfqYKof2&yeHmu*;i7}bsk_rxgS$C|<41Bt6ba=P3uHuy@##Z#aPx}Fa z1{jP6H?Oa5Q*=9ziI#|l8um9hP5^B)rKsh_P`bwXO}UIoR?5`dU(b8KF$_N)5OPhr zf1o_=I@7+G1eri)-U)O z&%8-6UpHp?%~#>Mzi)0s*`Dw*+juVbtyD;3Vcy&Ox`w_cA5Le>W)Q1) zGBkb2i&*o{_EhEjuzl_*+U~ts#gnVQQMz7%8GG*J z-h5uL$SwhvRUd`>Dv8MQIi&TZrGE{=Tj(ZE92i}x(NgH+=c(&i>eJ+-v~le$AX0SC z{BAShqUNlz#$?BRqov>ELAki#^joI7$f8<5g3a6r2?8s;>4?64Xie=b^WbBNVOO+8 zy6uA+k3_C}cf)s3st=PS(xzkOcx3O~C9@?*oqKIz30(F{qyqE*FN6D4P z2GU_`FFZN!dVDZKJEa#%qg&T=D!0d2LQOy2J{nI(bs)5AGh{d)dK)i2Btw@fn*6TD zy>!DwD;|>_bX12XYZti&8;|geQ)^yf`?oG1`~wy1D^n0CHQkL?o>TjFKJlk~`h>zq zamHq8trNMCf+D0zKbn$|P~U9hsAn}zSgDaJ!?!2DvY)Uqls=+K_)sqW;3=}Qhv=SD z#}S92Dz-I2&=ot;t?!IW_F5-AVg=^o#p9j%)%9IO$bJmz(`XVwYF6!uPPGzSz4dxI z$Kml#0Dq3@xc%|hhD2k|Dn=`*Q)&_K^im;$wdTF5{~I&Z3}j+|(Z_?M^wmZA@*iR| z)l4Ovwki|XfV|9pXIF6Ep(aUw(R_UEu>7UOq`CY@x1I3=ebSQ>g5lQ1p|DUx)|*C; zVcZxW!jRds7fx1tiLgQj^6N4%kuI>nrqr*saDtn~6&-(STPZa3oP#Tmf-s;VggQ(w z&iiepdNi=O9|00hXRneFMiL$gIt?p$XnN1LpT@ZPHHyA1%WZ$$I17mg8ztM@_RjxU zw2bhHz}7CuUVC52QH}V_%C>XIsL3JLfPJOy)jqm)So4hmUxb4~z`}V~oGKN$%kVJMW1Ac-q^pNn%vOI4*VqQwnHd8 zUlJ{l4KLI_)`@?aXG-!dG6|DV+>0|g2p6Y}I%vXR!yS4KxxvV~ei7;W5T+G+=lwx^~RlSt%Nf95taA~#khq48`t9r`;$C`{zYQEMHWrK^eEZ>I=G z4-ZB1YqWW4b;);rca*-74qd^2;a!Ilkc=sv>26+%IDAsl{fMK~V)g#ce;bifvfb}- z^$)wx1LgN;bCf((=xxw>c>}DK;lH-{Q!{22OkMacVNa)@ajxHJ6~eo>;6^uI1y&x# z4}_>!cz!Dklmq=b|Ct<);;xUN@9}5Zin8LGl&Mbyt=@vhQMyK8bB6;|1N2l}x z;jq5r8hM8?tsUAM$~!*R)|H>e$@pPmWl#8pOY8ccti*)GN~&uUrlCgPX1Z!Wtsbhs zT&UblYLw)92pPVoO*`YAJ^d=K(k!%jyLDcRm44{2#&^BT*zta#^jUPvQI^AA_hraZ zS)J0;WsN^R)0H;V5>M(6J004-l%VH0>{sqJ=!VqPihg0*k_Qt_H0s>lex!%8>CD67 z7W6ak96x%Q?lTX$D_zxt$=W}Hd)laf-rJ2mJ#?J)H2x@Fr{^>og)ZhT@ldctUMY%%feMg57Fs&12e ztD~xSW5=(#Faq9%mr30L0d1}8-^fA>re^5wjB6A>-8Au^HC}IM4Ra4cu0%_J7*p?6 z7z&NYjheoXKva6ts_nS{wb;P9(KpxZa>STdDo5Y%1+~l>#Z1E!LeLE z!YJG<)rkn0(B=+wH%E5ZHJIff5uuVD);&fFu^e()TU}HsFdRH@&08|1-a9cA-pX>% z{pmCitQ55a7OHTN2^!|PlS+sXJ7NAD_V>CpT1h0=k9VnuXXo*U!(Q#*F)r@U=9{N{ z**GFc2eo<29so-(5y(kyFHn@Be0tx%!Mv{?o!X<$pEi_vtnk|v7paHF{`UF6pX!R8 zCKvr#-Zj6^J?4p)AZw+x@s(A*G@|g-X_umy8cB;+9hECt5$_KuhON=zam6ZT8Lj3l zSoA?AG^hr3C`Rr#lbA=EyCZB_c8^bB;=u-lb3!A4ub*?6iM8&eiFiS%q3`;c_*1le z*xhwo8fHCkmJ9o=p~HN^#lWufHT3m>nuYiZo;<6nUaQ5-;~+*J$J>38%y?8?WtWBf zG{{D3hn;u)i5WFVQMnuza~loLG289g4*obuFg)@Oi9B?(`@J+-g7I8_J39yA@OCVC zP?b2Kv3x-0OmUoV^?%&Pi#4yhQ|7V>zwTPLwDN_a*1yNbmf&SQ{qeMame`kN00I7pNJ-aAW*%L;9_No#Ll8 z#EJ&?4Ci~3Zu_*h;+#iG-Vgx!7J9?C=f85kGB0TGqF)0wQrUMQF~0C6dRz$3)da8c zO!Fa>OG=MaO60`yd+Us*q(`A*WJ`3$yPMR%(|>&x%#8h*--*ng`nbiNm<#jzS{xJoKKmB0L5ypv7q?Qu5T?K+O`kTT5*BWc>y7ZNvVPvw89o%>}XL%;YBcBr` zaYoyKEj$sKUW%aFSQ&^uS6>L08bwgKic|+#G0_Hrjx18TFw0$xgSa>$bMQ=Z2OVxu z8OQo1tj@cpRbIcD<_L_nyg^p~*L-MnVHSdo94$KaMgLY|7GWc%V%9^9!ver{ z_nL9tXW-@7%|P8dEfK>)RxX=~LcWfNWl$=S2{l|jE^ut8g>|InRbbLm-0+KC7BHh%x~ZP?zt*OlFnE`Lo8ouJ++KWk5k`7Q!8SJ z4Jb`au5#n~^~ht;-_ACgL*vUP0;L^MCUm<_hNcC&Is#Ktuj#)l3Z4W(r(gb3M2LJd z*LRZUyZv!|Y=DRXf4etufL_G2)VSn1Efwh2)tTMZgwo|Cf;&X)r>a`68Nu0%H{dg* zs2mEPyhI*yvJwI}=RPyTaW%D-i}UC06!Y=*5ZguH;hy{+0K7ch!g`&43PY?qX#=9lrb8! zSsI~L{PXO5R1mhsZLqMi6hsmz3Zz?SYrQ*B)ygMPZ0}uA9+ali!#hFE>%Rr9Cn3No zghmgnimD@YsQvOr9%*{h_8{kZO!}P%Nz^;rcK! z!XP!2Gz=xuNGdt>&>`JQNlSMOpn}xU(%~Q=-Cfe4#L!4dNJxj2;BWJu?|j$!17@zh z_u6}{=eeIdtkh}r!?ukmSB$~$S11N@`67C_K0P*ip1mc7UEvQk_xUv_>)U=D<(obJ z!Y+o2vi@7pdkcvdp*#^=KZygW9=!Par;9n;2%L6u5YkQPrZZQ()&?BWkKSJA`>1~y zqdN5Hlhm$?U07T5!!^H!O*xS@EwMkW>T6iJn(em}hEW-Vn?TdS3g&VyA=Qv6MnXIC zO}g_r%46yguY?z4a6+!G$NWo^8E9Y9S63YkxDo2aAh1CCKS?U4neYW*6t>dmk>$$x z=D>jHtMye=4eM#Zuwa5Kx&dG!H~zf6Sjlxe1o?U3Y5hFm3_m)cxxk+Ne8XA!I~g}? zodK}Kif;w|oT|5PDBsexHMZbLxzCIKL^3{)<@7u@`5|VCx3_Hu>4kxKXL%G(!Ya)Y z_QRLFcNSp1MG)(P>caQhhxsYqDKOF1FL>H>EOmsfhqtm-?VslU`6V^fKND>s6LQqU ztGpdprm8GbFT^bL+p_>?flRlayuX=z{f99?jw$caMT^@ja`N|!$2wE1?zDOBY-L1k zyLVkdh}844XjiU-3nQw)$w}>=UGwTJp!h+Jed=%6xoec?VgK&XxyDded%UdhTuI{6 zjr`jfO~8xEhG(<&5vE^@1ez}*-?I<2jWYN+a!V5me=k4DHUlqWR|fG*McX~rnrt9N z;gZ|%!=BX^n+$-fc4PYefJBL24{+yj*4w$9G#c~&kpyhhZ>wO60HoSoz-A}tf3yJp zltBFoC{w00{-cfoS^&uZf;~X9`k!t ziNH_K|D3sZKOkHF`#7fMcj3|X2;cpH)XJqx=~oXIpKA%(KOp$`)q9|>$W{)x=L^O} zYD>+~zg)|Q(~z-iI4vhlB;^s}3mX1D`C0ObgiXPk()qRkpAT$DC=Ph^o+Tey<#=QO zdEj5)PX-fMvA5Bgj{uj}zZkCN@D;^IcOSI+?{DruGAo?$Z8F*VC^PP|3||0sB4Oi{ z)?#$_dx<~6vB9ouQXl^u?<*+o#0&4wNG)lF9O3(U1)rp*t{v6o?Z+`vnNiQ4S zgBSW7O!S&p^DRo(jK*T@-G^tLr^8orVxJF&ZK^9ed`Ala@gnY;7=GggkjD%#Kf@#> z{$=G6>^vX#yV*BfD3W-k9j$7%zm%F=y5M$$J{_+88>rRc)11>4x(85;<6qw9owTD) zivDdnGj{7ukppoKC(1v^*ER4BBt_dHmUiVm01&?%3)G?>uEf-@ zWd2C@eq2CBIsd_{Lp|EoaN}#@ciHMF9yK}6j;EN{04F^(JjWy730fC*ws}- z0Jo0%w^ln~$-ne7PW%AORoUil`dS{|N+`O>-*2H$jKh3l;BqLRo=jZw7_z}#Rs*Cb z^h?my7Dx8!aO=K8uC;iKJ}esqS(x5`>_r?* zCbjpPbMTB=fVac<5E@Z1HD5&WGqE8W_7aoeYca(!p@_tEW>aHPw$#McsvQ*hKP4zk^39+}(y>H!9~w-U0GfZX8G1=#`E z*xvpZXv6L&aRv2m((12tyl)_dtx`(-bO`f(em4KB-pEVtKSe%P2_#sVeVX9(WwQ^{ zrZ}}Nr(pD;{uSN_yj_hYR0~!(E>^3Zik706I*b)ULtY$mC_^vLbW}IF_8}rgD=p#_ zSWkhw!yw3?>E`LXMT_Oc2Ib3(tO!Fc5PHvneSjgriTqhgGr?6YC&Yy;c|__^<<1_@ z8LKSNOG=-gHPr5&^!iEoesB3C1CvwMnocNE;CS5wE)cr|m3ERq6CbC9$`qeqw$8YB zgZREOcau5+)3Wm?o|jEzrgBK=6SCfqXL#)}Xaa8j$8nie<~)ufo0yao#S~~!Tf=C+ zG7EwJ%}h#ozh;j9Cl-F-ND4ZpV&d3T&f{u*lq^&H3A0dGJ@2V*Fjmf1@1?aLy#G?@D^a2|vuh0U>)_xU47DfhX zyBUwf%5?Ma=Wqe>A-^rES0Q*Ci<;4pP-?n5!3mI^tN`vF`~NjLqfx&EEvSkN<*Gq*VX>}x4(p!Y_6BWchok!RGPL_nR~lz;#v~wI^PaT=}&zC z78!>^u@chZ5N0b7xr`Q$3{FZnCZ>$F$_Nr-4WX99!AU2D!>O#3sS*6|kWtj5t(|fj zO@Zfng`9dN*B!%mm0n*u0uGz)S}t-GzK_B{?H=R`W_XObxkUX0dfO3>Cgvu(7ZI9w7i+q7IYim5JbU^3VNUzu(8f4X zT*nm~8|H8b5P!W9Rd(2IT_dIan|%%16|Eobgd{cvfbzW|nP&&5&8^3Di*UNW@pxp=XgBH{R-`$t$cq^25TN z>NUlPz}*+Q!(R2VO+#TqYLT(g4Ny@`nN$)zGAloAe5Pr3>c&LaSB?D#@b7)1S3*1d z$4~WND9PwvpWHqN^B}tsDB;aRp$8AAaE=LM|zME zIPg-MzL6Pil_Gf|S}I@@R$>0Qb3svTlTM(b0_~&jCqZoU#D4+tM^;tUlCVNbUNub& zG!i0-h@WsTO3$RsI+HEremfy7)bk#le;FE7h7uJM$qs{wt%XlMk$S9}Dn-*td;S9p z;f+;eiQ)PlFEeg%)v)7-4aGGVD!*b(jB54DpLkl;qSRs&_s^dIM&+%=KZ~R!hS*do z5g}J;Aw#`qwYj%WsfLu(sn@H&M1^Vn`_?Mz&?@OiiJm?Nqz~7aJN5au&l2|%jj?4# zz4zwI1Zsa}ING{j|2-Ysa`b}g>dL}V3Ec&`u~W=}y05nLllqftXqt9vSi(@J3YyeW zo;kzcrEe#tHv?kddTys+b2O-6^h>Xo)n%WSC+H_diYqa$TwY#{g-FE*Sx#dqH-0#B z{rAW9YQChldign-l|PzwWw_W(*;}0)MfeP{4yb9KlPwnLhw(cqt#>HDw|gm|h08L? z7x)vOF>#l93+%DOUY7Au&6haqB1@9EO_pvmff&y%uYJ4*q%Q-f=01P=<*56ai%`e* zLn*MTZt7@YUFtalKrU?C_`)*oH|}aBq=kAehEe;fR(fL!w+S$3*(8P>pLYwAK2199 zcI4iPrUiqr5NthYXcfUBlGy=ka1yYbYJ>B&QG3_6d9j#$_OztXS z_KUE{ky})dt__uqjwDkbw{@Mc=7~xp$ex_XroUuSf#a>NLKq-zc zeTZ+(Zc*+I`O1o^-Nt#}dYZ`b(b_r9 zlcji20^?WCOi&w>xq`o(1*BxA!SY!``gf?#drzFy8cr@V&#_*Q@yDn(g_dY4G7ajj z`|TPq4%mDQLVbITKdOxD^Cni;n4YSTv(kq!!6&3PN7#*UIC(&@YI-%qNK@gXo(bOt&o1V6hU@`QISX3&F>jB0tSU_ zQ(tFvsSq=LA_|Roh{J3y0_UNX!Llo9+wM&bKpJuRsj8l6zEUohm3;zjI%hk%!$E%+ z$0;ed@zF7`hC*Ho*GVAssI1-X$Ku3Ft!oSQYRyo317!EBvHYnLj~hA4ln3S*BZ+(x z#lECo>XG_GnN<0g$dczIw>@h~?ZZZZQpTOQD7Nwg!4CnS@m!~L@d7+-`(0Td5d>@% z+t6F+X~73HnQ*!-RHk}ioGjaoi{5kj5$+^NR^M$Z5i=4qC*{Xs_Hz_LRE7`hRdc*fcBl#TA!6DmYEuf^8fD~7seE2* zp*(pI;29O$)HX|yjzpidjf8$S#gW7&H=9fhX+EH_VpLs>iEhEan54Fm*2Z13ao!cT zGMHd=u*<;@e~h*{4B{#$H`Y6k!A7w4VZbe=kEW@>pyl_7*nG^eK{oyBONG$lig7`~ zRc3;-$?foF#rJVyYD|7OZwqE^yEu<|RIj@dtU5Gy8kiU!5HJvWmMt2odAM0`%J~5? z9p5BlC`;zISy6q^cM~8pk&EBYwzm@8nPeg>tSX|A)MC!4S7oU(TVa0%`jMa8%AK^9 z^118^!@J*#Jn1k^5a4Z{DmBN2$*bHw2EmhUv?9zq7UXF;xZEGdH4*3`$vG8lQXi|g zt}?|7V;gC5G}6z~>Og;mdwhV*$X0AJ$i8lFnHTN?@}S&j*aK??fO6^zeZm-uPM|dl z6CNZMxApJswt~FN=yKwHUI31B-8WHL8LWP@ft|~ey;{vd;>*N`#3>jpMJIemL~y0+ z9Bu9CN!LsBl!?ZuOO@H$M;4u{&jW~)HRtQop1o}+EG1gg**rB%b!CTa zb6lqZZ*3rz_ya6;ODIetL8ku^4oz>eOvGreHg?Sh-TFho9w99)@XdQiG(_%w$R7?%QP2{MU}Z_FCKz{ZC%LzVoKO z)jefvh%KRM0rToi4Zkka8z%{GtkDpKjoz0$uJE(VHZb3!3-8F0fw=e9MxUNvj9Pbl z?Qn9*t~aM_xvWwNUN3s?Dchm&4}*p4M-*{#ilQyYFE-Cy1$$=*4^NtZ~b#NXMe@mo$uI1w|wMH?0(^RQ>M1~zS~gGF|4yFRdV9OiX3 zI*>-HQ9cO>>U&$a;!~#f7F3#c61BB-dXQOmd3UCSJ}LvgTZNI|T{u`HSny1UAuBjR z0J(jc07hZ>u_efG!)vnSDv&(#r3Y9z%`nSsuGs`yQYbbB>0}dkd??i$2)iGq4l7?c zZ$a2cnm4FIrwSIu0~_k{Z#WLtxH58)L4OD7u^g)&QQ9+;aKjW+$VvqAu3fw2ycboC z-*z!KqM<*hGziR-_3ZTW%1#W-!$pT4y<#&9A`VyE51mp@+b~*&KXJzZV-0x+z2PC1 zBf~=BlfarD8j1R{(C4IyOp36!MCLm#5NMC*KdOmr;-E$MqfL$Q;f~ZFR7}#R@u`tS z1#uY72Ij-4Ac+^(S%dEallx9#wvz151!i7*aPBo#F$dDs^eIFnbo*pBhczfNN)Kz_ zwP4kVxo|Ma(`cCG&)Ub=N23L8qfCpzEPUsf3KBb9t#$=c%O+cOTbFJIMf*NK#Iq%i z^Vw3n{)j>h4|5Px0hO^Ia&5-25$7(xxDxpPBux(A4;9<(o8a!R&57>>o!zR;itC|1 zcaW8mo}8JhjNM>H*8Rc#w`q}f);iW2${Mf*F*r>7x2%-Jd6;VV(|qS9POWXDXz`j5 z^r-t!Q0j?)XQB4>!≀!y>WQWQW*m6DElyh9VP(pg(cYDg?|jG*ma~70sK>Zj4y| z)XmGn2jR^_V651=gpW)^4+gQqn#u_Gc1xX+Pe?nB_&Ps+mOkYA*H627h*AxywG9Ci%AN3i0yK|U zW;8avUFrzIX5ZEu&yo5zDdO}lePJ!YXC**Q4mLXr=cE-O2DjI>mo z<4U|&j1pj>Q*AP9*G%B{?JsJ~LI`}4%fv;V%H;y;IZX+7nV$0}tUeENQ zZ9CWBCC7rPY;FE_Ku|ZtW<1zaC)x*(AMZG3dxBFsTigHh!iR2}B}1D$T<)CH-B*uZf%pO#>~Y5v&FNlC6*jd;P}$`N808AM=c?@@B9ZAi@0}nLgJIvn|4qCn}n=E_w$qKFbk5f41NJFMlV^ zVCjd5*!{x}85aSinkRqVF$^%tgXK+!8bT#dxsmcup#n`TMP3F{U@AP?g3wi_w~Hi9 zMd&$)(sBV3m=KjARG=@G6s?WxZdBG^h@fII&1zv`1G8W=Y|3~RM*Bj;2s|K7E%Ic_ zvR_p1V&ovQo4PLY)kHXKkt{V4A1P+Fu?EQ|WSOJ+M*ID@%bIFrITILUvc1d)DZ?Aq zYKjuN91Ps1u$yIzk+6P_!OYV^eI~04Z1+9U@JG&ZF^{0JF-VA-GneGJkG;h{0c+ku zUoB|I@x}R38{ExL9hv~zXoO4EQ<#}WXy3eMS2QDd-G%BoB?FSt64reycNOb`Sz6A5 zopU)Q$I7>V32=ILN;Kc;c(YO`PXrVYs$t}*F;I~>guF9bAe7PXz`}|CT~@2H{HX(F z&;?fxUO;Nk@`&DYEZxj~L*9Q_L{u19KRl$Xa0KZ~HO$z*yx7waL&=Hxs_Ng>Hpxc> zVD)~*FzwXbQlY7Cs)IB1{&t8Gg7SVe^ZSu@b|LvV zchH#5ZAzmAu^%Ss9yQV>wXGe9)38aD`=ItU4#M&U+<0BwD!_z1Ip&>i*Yp(~K7H&p z8$6s}v1-KCcpboA^6?4RSKg|OG+g%&e}~BuE?kaKFAMTD`s|8*_fcN1ry5}HC=*rg~K9WFcd;%3j26YCbry#t7r;u>zIc1;&<2GFyOOP zz@X!pJf*U*7R##`OdL{`3~TC%lk~!-16ieQDIG}g>7_F3TPP;99Ak$f3bRJV;bnR> zt6cElm+p5$Z&^WCtWmIcombyoZKDWxK6spchu9_>9Fu5y!QlIG)>k_IGzLA!ytPxm z7)Z&XZXDvx$PHk-?y^*3s`~jB3ITiK@+etG_ma=+f_tl6swQ4Qt5W;7`?OhLFlCPf zeNg@OJ0mR5WgXgfX;u5+Nv671$Pk~Ih_#+ru!;WZ3YxB@icOf*G*M4A<3wIjS!>@m ztm#Xdm{FLVEl-;L8*9Diw?6UiCXYSiZ6>-_-x8O1c&a`Ky~~d$X(L`1SFOaksIXj9 zqHIumx4ZrQy_#s6#w)Y;HG-FMfw&zu+s?RHvG$(q>bugqkLz6X&VQ!kAP7NNOA4wg zmJ}Fx^5C0SNBAIPdR=3+k7^&b=`t`Th~*vBtKc`~q#w!eRRDfF^Sx1^m52}8gp!)_ zA4w>@C`$2k-xL>)GYT^a*w-*0)mH}bSbU;kp(hi6CkFm9LI-)ybGBt`w74dP=|JmKPtAi$Y=wB;u%J(4-`b*a`y^2-!QRPEs7Xm5F4sYSPm2b2azJHn|F zeq>LwV^5eG?)_dhXs76(^DGmVx$rOQNTDc)Ub2miAYf%Mz|HnjZAs4?8v618!9 zoI+Gb^xxs10|h%l$C;11nXDDmF^=VU5xU6{lOg?)IR3|G7l;-`y*^yEm6pYIxO1^kn5|+ITSgBDH5U}Ov=!W$ z($}%Sxs0`=lT8ADt*qNO`<$W)ms)Xr6X>%vhFg)yAB%}wA-`TdkUbG(P=AQs(U}|iXGjGjis)=p*GJx7~w;G^k+X2nH^}l{^nHRRL ztkWOuJBRMV7o1Y` z^oREI%sqdWoX>q%Pq!+d-gZ6XLYTdLyE%ErHa7@tMBk1OS95TB7I~`Tyjn&$HzAg) zPXHkF9#sqp#bCCWQYo%MeqeU?tW9`k&ea5CZRUY0DE!*i{lWZEhUL;W;e|D^Z%jTr zZ|uE_x%7aaS^g3tV**u;cKey(Sdl)NK$#e8iuSvpqw*kPl#;L@gB#PcWT6v8F5=)K zqH$i+RM#sfZn^YV+rX&&x5XIeGuYC*97$QC1z*5jEfQ5X@1=gt09^dC99O)vIIhu`KeOd}^GNFnap|c>eEhChmZ7&!q zuUKF0xoHpO{(>LLv{NiFjxBoh!34)7Q5UU)Hn!1r*?4g?s6<_tRI@-(1h<@?9`zU< z(rm$T)3Mr_@S-%3q+^*s(RFDpq)3ZBAW>>xjHc6yLN+?0-Qw%iK#*VKPl?Y&WpPCy zRF;=>@JIq8;C8~@vTPiB?VvC7jA-un1p*Bau*2a{EiqNGN^<{BAnXLR#))|_OXdHz zjXD7+R8j7H5LP&0G)q+sx0A@~t&(X_F##91Pgo&bkvx@<$3VlZ_;XK~ zMc_(;V_&_lc}fsA4uBy6IpJe zn)0?X*?rIk!y(tMshp^gG8B`&Y3 z)7vO{cek}*jj{v->r`TCQnQ;L%6l5hd?&;9oN^Pqw#h{1&DEe)`%pRFENdh-GdEwr z40fsRfiYx%t%DV^O#mzrq6;k#nF9{{IH1OB^`$qY=X~{g{srP8Wc=RYOZ_AN%b)2L zGVUJ&!-kK826*t;$2=bveo9};$0ebAZEjRsO0kTRW$BsuO`nwg=x0VvkH)*%xR<4xg%5i4HO9U*L2n&ShIb;P72HWEU4#O0VWE>iD(Ad4(?_Q32G1cle@NxPLX(}DQu9>#sL{aH$7 zAe(yTBXNHmV=ds@2M(1HhJ}|Jy*U8V3Vj>v31{ z*UGa8uWZQhL3+(Tz?oCVi90Cht{OX9FAJ7nw5ENkv^t&r9k0M-^`kl*^CWH$Ypo6N z+T3ah+)=d{&UEP39g(01euF*k^FicFpU3c`YpRAMnS0?326|t#s>1~ z5pU~WVqsKhS#txxm9n#EQRW(A)f2H4l_7P6*jBn7_fc-0cAZlzbK!Aw@F=sIkX}v4 zp4L%Tii4TagO=&#gOMaG0>|=j5{>>`RLkg7umVkCbZBBCXQ$i3bCb=)Ue2_WJ0NG> zNFKaVP5`fzP*y8>@$CI;PJCrSdw%5#D=!%bWxY)$^qvt{S^!FcQyr^}XzEL`!E5o( z1lOc6Hob5#0q^~83e>xypT_W<{Q260?)cCqxK63dV%C{)KUd2qTi+9E@<|Fk%?>%# z*oi6m{kisY`3h5(h}XX7cMGB&-TM_IAo%~Ez$|E{seV!&AC2_bLUoFFT3u#7^+5k? zTdnu}O(v+*a#hO_`!6&3@!y~U{)5gUp`g;_mj7D2JEi-tANa3l*I8ZqF9$NW3_yQU zgf{-p)AxLw-(d{t%ww*a{^)sH#8o54S{Ma5?Q^QF1XhD)62;ml`~2uI-swoJ84e%f z8`^F~XK`X56^+7Uo=#a}Q9RhC+HHIW6`W$~^@?9XbicjdaDkKlO`RYjTh!HjM%3nf zEbUp?@RJhXM=$L)aVbhrJs%7gtU*j3#6IzDc;iuUut%~Ab=A|;E z?3HtaIdj)>oM8)et-NOTbE^^6)QPIN1`K`QSF_WW1BO1X3>=&5L}A}W>z{RcIXc>g*X-sD zb@|zwR9+m!pLqA}9i7R*UW&GhzZ=^UZqPFeFr(ynL}mk7<>K!p{5o7h4n*F z)cC(!{QKGf%LLBo=)Vz3{DxIk5-BE6>ZZf~FM&7p989MZRh-zXf;;c=JtXyV0Xs_m zvME^OZ43cCDp|7omV6(SxLQKPrf9Vk&H~<%2b)%=_6`^S}K@A^S}*?DTIJ z^KUR}1#rrH%^NaA2`@;HwZ?*|S1h2)T@GgT`^3XUtdbuS2hUDZJXgF?tac*{FIG~^>k!+Tly3`)sFP;T(VpH`P|-d3z82D$jimsd&u

j}d>dyXjY zFQ16-NdJ@F0=>2LA2_<@q?1^WJ-aOH{CqYyF%7Q|Q6av~v+~Uo`*&8HyzG21Yw}!K zoiH_z0h|Ea{gBM$JV;^B>|Pv+G;@BfqqWR9n{2d% z^dx(*HHG-{-aVR+?`p6o2=NEjscP9;o5DSq%tctMt4ffH{cWv@9Vp}gd{NedY|b0g z-Zr6(*;^IAPg39P2^#J@X zx6&Ixi=RGHlmUZ)ovY(2;pITpO6Tzg^3Jm}X#L3qJW&OruSd9;pq*zBr~ z8!EpIf=F8T)nxgk*Yy%f+PvbhxVG|Mu2y?bmkxf^F0L9r%;7BNG+Yrlywg-|rERO4 zS-5x7C}e!%(OHxDX!?|k)#&|Z#^2u{RsUU0b`8@V=2snZ**V^Bd*-(q0K#7Q9ltK^ z(2&-_&dVd-T{O{ac9SV+Of6GI^KRArN}RnSO2)|l&yVLpc~OmlG7LFM7jjExrH!A2 z+69LvpV+VK<_3R00UwYlWo$Nzc$JNMiuU2owuO(*ztg3DX!-(oOj+y<{JhHmCk$L_ zhn}v;iS^c(_IuKK{e`Q^!h~Artons(ZejyfhvW5m@B11JM_>ykuS0=mM10}-G0v?@ zZ(%PV?rkHGyhI0$(UJS7$nU_2ob|BW>8RSm1A*xU@ajggxv?BzGaPBoCr@fehiUJP!amDVLcwMz)qhMAhr}L0&4ErC7$p?(^`zmbo9dAzI zHCLJs#<7T-;+X_j(m?`?(l74`%Hc)~j;YiIgCDbA^dr4=+(xQD1P$zvac%cbzl#<- z7gW8_@?C=E=bOAB{iQPF=CM{8j6CP_glnfm4s7P|=o4S*-gCO?v54Zk3Y8IYmlMkx zkHg$Ujo*YzBJ=?}F>jyVj~{~SSP>6cHQAL;N-S}dvWvQl;J%M=d#Cb@IP>JDnv)!; z_z665Bq$1PLs2wZPm03>z0O#1arDBYF^BUMKZG5L&Ac2Luyhztj;q^bat*iTs14i& zK_M82LC*T;vKwRuE-9@53cil$>R1>>!~ z3e)evkMP+Z&rhdP&lKUg$DFQO<+6}?io^{;XK_Ccs^RjO)CwO0XB!amU*HKOJP~9G zGD3aYQs*bmrO}7AU7}HK*Dg~em~uMmR7>&lOxvu3Vr)B)qF?t8xh83? z|G8~7c&?n{<$a*=8M9kyQJEn@g(5+cK_>R#0-&GWA&LaxV0CP^^cZ>_Y6gLA`iiy)a&$ zC39iQBPotY>D+DswtQ{UJAI0lIv}Im;ZDM~;oq6~H7J2T$nu$KEprC5PR+KTOeyXb zRlH~L-+sR^6Y))aEvNzQeV$@~;_0k5f!}vmxOLnJ9^~^iqr(j>gbiUwxGm$W=d<(Y zw%f{!2L z_5Oxc3{Nlp{d@RD-Hhz)3e{HGA;7hC+_k=w^~09P_#RKKvVQG%4-ElRsd!n-1Osd& z;rqq?xq#dgMhYER1{|A!$4OD!Fsa;$cw=!b!XQDd> z;5#*lnn@%=_&AGXz>y_8-uO1=I1XvBVsOI0CkW-xc{52cDv2wfx2{VSPO0a;z07 zss;XtmvucK-?vApz6BgGy3~gcu0B zxAfj~Oyx~$ALcJ(6Bw{1_=^P!&dN^$5xyB!0_3Twjxl8TS$0Bu(ro~rwVC+IJI{`N z;Tb~~T8>?D-{L3z0}p})1yVH;Z8T%{9yUJe{MEeX%&4D@eTq$PAWD?VfNZ z3*ca>V&`Mig6l8{o}nric@w_Wq;3tD82+FoZwj%J9CgINuEfl72Z|9}D^X4%w$_xYjl1ciKGr z7K4wjd|a6o_wgAky>N-urMAMW0ifed1Eq>Stl0Gi=*HZrpMHpeEWqiSHzdA8nt`D# zkDRgjG4gSGAoBFlPlja}#9aQ8cI8qrr|#ZYW}Yl!nky_ZHwogzxACOPy} zXHV=Rs3EjngzGWvkcX{yo~b_n%Xdt3NC>(n{SWzp@~;A;Z0R5c%UF|7 zj9Hm~IyVbFkCM~GBf`JD+1{_6wBnOYSoYh9Jo|OKqUkynv?r3>qdpf{cbPr<+r`F_)ZI?OHct# zlFOZ^3fVi9P_;6Z#oL|CqN%r_N6EQNWGrRO^k#GfO_D~o>_&y3jMFN3c?QGD>me9p zg~5vkmU*^muzmfN&B`wEpFvN&`tkSnK67K^Z5~PNzUD6dO>ofb^}YJvs`QY5h{QQwOq9}cDZ-aWn47l9h&?afS}`Q@Diqh_mN%;`GU*fr_R|IW!gxnf ztkQ3bi+E+%DVeUeEhPk%4>{y?ck%_@Uu7wDPV0Yb1BW^iR8zT8q+pu-PUQ)Y#akP< zsTb1RB7e?_y zmaE_7`t%>K!Jezc%B_NSH&W-)+skQh?l|{J=^5Me>PDDxzo#3FuHQpqU~V}*xcV&F z!YDcAg7SK3u%%{=EuXz@Pk&_~-vnOE_H~{`4xxTsCqpwJBfH);T$46S( zvutqd1XV>omCi0xY2O>}7F%3i6JxQDqY>ux5fkGfwco6Y7uyWp#0O3?Z^c$p!yu8; zTjq}#pt0wmk{H}U2JCXc@n3}2lPSOA6f5j+3sEGQ6{nTiF{D5;Mtd;5di^B3(pYC55og%umD%?g5w-KhOE&!=2NhE3yOKJQxUoyxEU$yXGSv zt4n@5?g7+u=P)A^|8Xf1QeDRO`0w1BVM~~*8majYY%2!y=NAG0+srZbtY=SE6^!(B zUTD2UCE+8*5Hk?RuFmtXR+A^AKcIpyT37auFqy~Lb9`ULt@rS_BqDXPv3)qv z6Y0uUMcLlNj7dh+K3ujZXkji<)v04>gBbQ!;IqOk08bdNxc_crO~jWBN#;Dvl|xJt zru&apl*TmvS?&E5x;l1HYq9UUh}wd_8!fj*ex zYk_&$T>`B&lKhdqf3a2)Zz;riThB4o}f9&G9Kiw*Nim(mN_A%gT_8UYvHqyS@@ z`N+ZsGK=6{gU6VI<;M&U?b90U3}ADGLDOW%DXGE)-%P|7@KGd0HABQU{ zyXD<%`(OnqiGsP6S)+>Ly9O-o0_;hoE95eG{Di(nYg@dkp89F{V5F>QyExPXT&Q^D zmi)mHGz;*BnRWI%1tPav1QHiTQb)WPv*PQdtZ?YF;#BC4ehv%Y@RQU*99^S)amFJAruO<8QGUR9Y;>`s@}PLOEl+i%w3`p5q_l3>68F#-R! z0gwx#KM$)8O)2N$h<+N5Sei-nET?wiC)keapgCy)Du7=BX^%H*&u2{RJ|*YCfP9S> zmp1LL%Lo}3{9oNz+059GG2tVr|1%%OvOIT)_jnhySndRLkbae?fL2jDB$R;azI~Hc z<8?Buq}lUpT1^RaTL*HK&i5pHaQA3jX@LZp!HOB*npMe9mnxqBTw3>2m5&($_7XZ( zabj4M;=b8fPQ5(zs@Mxv5Ugb2j@dswU~t)>@#2G)x3< zg_EJvhzWI5WKwS12XV%kmf;GQlXW7^Oeb)-^Y^&*5p-SA0xgH`D8!}R0No^jH5 zmsuUxj&}WN7FWXtXglefc~kQX(EmJ-d<(oi_Yt1isa#_y1fFill-lQ0MNG2uQx=DV zn|Glp{AcH!WjqE&qW!AU$KEY=stHaVW9tvno3c91IUK7FIL{TcHVi*fFv3T$Kmt-0IQJr*mmBtS6dbmSg zkeVw^DbGJdnjXXJoZXp2v?%vSR3jy(KlwhK_`E>!fp`niaP7kO|Gjhov=x223WFZK zJR)nFF?KBE3%MGJ_O@e6_}j}amC*6;_He74{*rEEY;M5*1wn8Of;?#o8SXAcA-eGT zQyVs2N$!mSklCZA!(-+Ogc7AAnO;S*$i}EKWgf^8C_lY&G_^_5t2xuVgF79Y0mhOh zyzYO@U~gdy;IhCHGV(O9VRe<54W<&f@cX^dc?w)3MKp>270Wmp*;vD}Z~zeh)oVPd zWgZVH7+-nI$7Sw2$kAH?61~yAdaKSK$~g#x;N(tD{>1s8^=8rqV<8^N*2b3~ zXRW(e%mdn*F0hQCr&oDgztGa;bkKQ?m%h|LFaEd5a#oA7wi(^R7qb(-A@ppWwr(oM z=Z-*#uDKNKBvV=aw++wE<;q73D+VUSEylv9I;(pSz3SQj7L_aj6#=r1XPnw)99H|c z;paQrUz-vmC;~=q3UA6nIo&9>^2i%uxLsmi1yuUlgGTUv`jY*>zcR)e$%{B(xDYel zes+MDV2#p_(Io%sp8a7$7$sWt>aUf+Twa>NN~)gJTGfKBo~h|&Bzu#_m?jHmkc|Bg z(Tp(_dk2Yr-WV5H;7&@pm2jQMpx9Cmdc4+dY}BSMJ4dMZ<>gw3PVmmfpKjm?hn3zp zboZB=(N&{m3+)aK>pQ$xK9#58+ndr+83i6kTYP);ZILh=a4Vl5#2S)^8$GpfA7Yz7 zdcdJ)WQoz^|FIjNbVMipDLxCCqA-Da6NE<6-;<_77!`YZf1YWxm? zn=OX>n-_TAz`j>Vhe?V+V-%9WAMTQ_Ue{yI z_F>zn{RUn_jD*b%Q-*VaNIvu1juVsg-7DM$d>Km?`PU4jhE>)b_BT%)bqH z?JU~1z-k4=8pcl6RbZNi##q|de4fy%Q%Y3xm~`f^95>yJn@LIZ;`*Om2|7W6@8ZX} zJDa$!nzIs@JwmqEsrGv@&f*7N$l>OwPsjnEs z@Xt7+i??`iTu}3K^UAG5hPda|f9e+uD*CVx}x}ZPj#0hWxpRkgrpE8!zVQCH8KKE`9&b4yj(D74b#nA(hEyS^o5@CeOz5k`CHV3r*QvhB~t-JL@v7fH_1K5F1T1;tm|z+q{8t z`!LIM9@ajE;q4})Hd`4}+Q!T8H>AS-{m;TV02xl9ED+yC-7vb^1YD+djya_6MM67Ipo3JrN%)bhx0vephO7 z>%aisDJBMzHh#C3N@Fv(Mz}3)Wu5E}Qt6}L7L8SuiK)r!6%AFr2ucahXS)ai*O+x7 z1I0tife-+r&R}5R`~4i5R_;da`>3Y9>>W_!92C%l%TAsS&S>&qiul=$$0jqQ_TJ3Z zK5J-YOc`=p@3*mfvvv0L8jQ1ejr(rH8|E4ByB57==zn5eYlYk8Zr*8sbC?6!LOgVq zv7``!80t?rfKnqMZt~_qXYhi3eQFM7l$cC^%-Ps`LfX_J=um!u7ZI2vKo`huZ`1W*XHJo_#7%~=4B=$rV z=CwRLh>-|Nb7K#OdyRJtzaPx;L@PH-nU2o4P&EHC+VIG|F=c>ws=-SUSlYkV;^Lb9 zhbgbxfHAbk-3i6Ud3AgccalqXAsz;_b+DujlS$uoV@9MIh{W)t5q8iuc5Od*9~fSb z6so%dg1K^rDpm@e)A}Gl(P>sEhM2xc7y51C0?6hA_u2$9w@+Z!vZWSsZ_fW;Q`a5V zRMNdId=eIwrt(QAqDYgf)PMqkfHaX1m%d6dD4b6yZT`B?eQxf|Gk4C+Iq#hJymIFTV#)Q_#>hUmPEdH>ja1@? z<`PV*{nul5j!2^lm5vPteqt@p4Ub zz1jIf`7`sa?`&+69yWGfOv*}Qty5LiBvtHYSi20_RmL#Mp*>;hflyz&-0_>fZ zEc+teA?56=em-7HQQ}^rmz(~dIZq6)cDTG2$;zy0kHPQ;Nbz0c6eaH-RcZfNS$d0^ z%%7sAJ(E$B_{NIb`&ddoa&5z-v=BN^UV1gaRrpY8&a!ZH)_(o$&ILKAbA3B#{9K-) zH+nI#Uu=EG9N|>y3@AX&=%e6TH>y1fqwnmCgSk?ntMWp+*X-HdPy$R9a zm*K*vMJIlaO*d>|&&TJ*H=otFYT@y0dhmaDo|L(?qWj{n7n_mI9Ti2j@F=Z1cpf3T zNj4I<9&j>(5Nu%A8-09X;?PaB)Fb@7NL0Oq18vb;YXY7#R1#%Pfh~$dOLTmoL`h^0 zZrafO>b+4-+NV`2W!VnDt5`oaU8U^Ab(V)cKhvxbToD3A0%aOPTnmxGeto6Io#w`0 z$|V+khv%^gd4!k|?{Gwz&yFyoN7Wg%%$lBIjMOqMmPbo11;>XO1RRgqnsc3E*J3mG z!PVPOGPQ-Qt!5JSMI$VFFIpSR{wKQalfe_`{q(VoN%xt(PahMHCf)-2UfG|A5JNK z@+F8-d{JWo(|lvAI=+RJqaumE)5*_5b0$SD9u`iOcpKesG)w(qZZBMuFIXR@85`an z`+EA+K~u}Wi#axZbaz(P#{%EWvsl>)BxTi_)(YIqAcS%%?l7*`;hL=ynLiM$YjvEEZjp475`sFc8ARP9U7g4m^Y7fV z4RUqJRJ&6EyQ=<=tIt13ErKnKE#iZB+Qt*!a4#)nG-Ro>2G&c3olSY_z8lr-?N>9t zn<&0X|Hd@)+-<+JOcIIkw?Cf$AOTx<}YTdfg@nVI- za2JBY;F5nAcOWjFH@Q&7O#e3DWtv&CIluWzi-A*4 z-mNP)lUx~+aj^4@T%G69Q~ggJIHk<(l?AyjyfZV6n@z4VjX6;%(jojYu<*;0K%!j~ zMuZ{p_p?;wX9TyK|8Xql$o6B73bp~{lJ^P#1SfS|GpN(TV|3s2Ty`aUqujr_S+LK~ zZ)_~9ytazHP46pNBUT0tpw3y|7?2HRV6zb-uS_TiZ+eCVF)wd=)j%kG~X+>zL zr+i^pQqz`l+hx0nVwprS+;*2g9^KRDjmzCcU!L zR2`wKCorIAi%rN zW@>kHK4O&OZF3x(w>wztWFFKLiWsryo4J}_Lv%z4x8BOfh2w?`;|8fOot(Z~)YR1k zj*s}!mhbaz99E_wy-un>N-${3Q%#vr zSgOKP{wQ`{UI>cXKlTIXw(L#j*vu9jL&cbfN;*36ou68*kQQ`JeqfCh3Rha%E?Yj? z2Z&&^xGhEoFM%U6K9gsRk0$$jMD1R@G8L-+*#tTH~JG7PfrJ_ z;_JIOc`=po7PZOK+j^N!MX}Re35qD3P4jv?=eIZS*&3>j>ob@>Iqp#lYHoW-Ao3Mo zPeH+IlZkqdsa`JZI}Zh~dyM+^rCL7xskY;m*|`*ZB9rdlbcWlvF7n!S5Av~|5O^3h zF5G|MxK#I8{ayDRbn52357oZB#SiO=tov=j(a(4POu^=rrEyZ68M^{L?qOCG`<*1X zR*gORHgG@IM3Lmxszaa@%~h=pdZ;ky-8csoRe^DV{C8O@!M63%y-5xAPJDv^Y)H`! z{}pM~lh+vR7&W)Uet*w9V|_M7#(e*#>7;COTyx+lN*-*16xX2Z=UB;gHwt$6B((8G zWc@h}Tlk_r+U08UVa^KXiX9vz_x1YiXXGT09Q3VfsSfXoLJRc~gB8M7p0~=WXef3S ztm+F%qo?NojC3+;Hvsv9htf^7;iGR@;9kM|{b=FlnFOwNnH1-bt{Zr3 znrxRMaohD=gcN0-u<0670w0f6{y3+L-n-B9e)+3NVt z#c=PCpbryG z+UOU0K28~`%SCD)`?VvmWt*w;YR*U)pPh`_nG#Dh$7W4j!#?K6%Jk68#U~fGz+%3U zwnrWsKH9ES4tFOdVn+4UyX<(Kj;5U|yU1WF`h@1e|5PM{s%RGwJFA)8#YaLOxpQ37 zkAe}dx)k$3(Qn3q2!u~IM_``7VEEn`5j8KSDd`owZXvEE;>OnT`zmUpD+gJ{+hUdhIrkLq3iQuQH~ve)m0OeDqR zb1j#Cj{m*BSz~yHBQSb8-BR^UtI?4NH$f=moYj#i(J_{ItMlu3*a!ROGvUEXtnIAY zf|bc4q8z8ZqFGTp4YPnXVkn#=v zQmx|^fEZE`Rp0v=9GQg0{L_=(VXHP#xT^^ZXn=gQXAC)25}G#X&cs$uemXcpcz$I$ zK&k(lRS!@nu9HcEfR3_LkcD!CtN?u<140As7(vC&v<8TG&;UK>%cpTr-^(m$G}vQb z7r0;$)OvpIeC`Yozk~7!ZXbrcgi~8sio7{N>tecx2`T`B&%^#T#A(kP;Et%Fzm3HST*5cM zv4LW42B_{j;NK=0LxSYUj{%~GW7x(3V{0MH}p z77~zZego;Jh=RD7F{8&0wgcEZjX@@6ZGtjn>rLYOO00FVo;f5qUIWz1eVw}6ZFs^= zTw2hTlh3p-ECTV#__-ROj6UTzw%r{>GZOZC-mSCNSq4D*Hy{p{1EYjzGz(ao>4DIi z1~CWx0aTomZ4mQDwOiwiz&@ns&A^TAI#Gtz0dH=7-kDuv%<(=7%$Cc$5JFeN3nu^i zC3%?$EE0QWbi<+R)I%g}v3P_hx0X)x-C3E@;&I^F2?xV^G(W7pPWf z`P%6Bb|VxDkUvC{fHZf^AEz4Q`{Aun;Mdw@v5U~L7gtdrkRtN(6?VMeauV9iuRvVxA2!xI zTtecoJ)dl4P5=9~F&QeQB|wAp_3YcuU@(pWXp5d|pp~T|?hN5yBzOcR)o+P9`zrq3 zbN;si;(4_|dt5~s0t#bP{7-@6C%?=U;M-Ss$Jn~`YukxScPQ28T34JkJHn;#jZs{h zTaFW3i@F=Owi`p zbu_?a^uG^jCO+$aq5N7VVwyAXhy6ic0Qavi(EpJTl=r!Uv?z3!JcM$I{!kHJ*d=5- zG6&!;iJ$Z@dBCZFy+0QHMS(l}R~Dz=4>S5{ya3Oxmv{?SsaPw0XhLuNoX`Ly@cEk! zmLJ317~r@5B#{Ad7L;$1`w1&US=wbkw`k~+V+bNvKo0=y*z5mutD)qg3h1>z?nYd; zhq?qk0FJMUpoV^2O7z-79fIycua}3Hh=bYFcQ)N28O&{pKgj5rR&r~94)rFM7p!ow z@_V4JB^dxSIiT>Kwja5GQX}i=*L4vKMjt!T`~*uQnef%XhGqe?!W=9t-b3|`Ks!ET z7&>7UZG=`epo>m`#EzI;3( **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +For many IT pros, gaining visibility into feature updates early—before they’re available to the CB servicing branch—can be both intriguing and valuable for future end user communications as well as provide additional prestaging for CB machines. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to CB, organizations can test their deployment on test devices for compatibility validation. + +The Windows Insider Program for Business gives you the opportunity to: +* Get early access to Windows Insider Preview Builds +* Provide feedback to Microsoft in real-time via the Feedback Hub app. +* Sign-in with coproate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. + + +Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app. + +The Windows Insider Program isn’t intended to replace CB deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. + +## Getting started with Windows Insider Program for Business + +To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: + +1. Navigate to [insider.windows.com](insider.windows.com) and go to **Get Started**. +2. Sign-in with you desired account. It can be either a Microsoft Account or your organizational Azure Active Directory Account. + +![Account Types](images/waas-wipfb-accounts.png) + +3. Enroll your device by going to **Start > Settings > Update & security > Windows Insider Program** and selecting **Get Started**. Sign-in using the account you used to register for the Windows Insider Program. +4. After reading the privacy statement and clicking **Next**, **Confirm** and schedule a restart. + +## Install your first preview build from the Windows Insider Program + +After enrolling your devices, you are ready to install your first preview build. To do so, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Insider level. The device receives the most recent Windows Insider build for the Insider level you select. + +>[!TIP] +>Flighting rings are used to evaluate the quality of our software as it is released to progressively larger audiences. We will flight a Feature Update, application, etc. to the first ring if it passes all required automated testing in the lab. The flight will continue to be evaluated against a set of criteria to ensure it is ready to progress to the next ring. + +The options for Insider level are: + +### Release Preview + +Best for Insiders who enjoy getting early access to updates for the Current Branch, Microsoft applications, and drivers, with minimal risk to their devices, and still want to provide feedback to make Windows devices great. + +Insiders on this level receive builds of Windows just before Microsoft releases them for CB. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. + +* The Release Preview Ring will only be visible when your Windows build version is the same as the Current Branch +* The easiest way to go between the Development Branch to the Current Branch is to use the Media Creation Tool (for PC) or Windows Device Recovery Tool (for Mobile) to reinstall Windows +Ring + +### Slow + +The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. + +* Builds are sent to the Slow Ring after feedback has been received from Insiders within the Fast Ring and analyzed by our Engineering teams. +* These builds will include updates to fix key issues that would prevent many Windows Insiders from being able to use the build on a daily basis. +* These builds are still may have issues that would be addressed in a future flight. + +### Fast + +Best for Insiders who enjoy being the first to get access to builds and feature upgrades, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great + +* Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. +* Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. +* Windows Insiders should be ready to reinstall Windows using the Media Creation Tool or Windows Device Recovery Tool when you are significantly blocked. • Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community Forum + +>[!NOTE] +>Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. + +## How to switch between flight rings + +During your time in the Windows Insider Program, you may want to change between flight rings for any number of reasons. Changing rings is a simple process that requires only a few clicks: + +1. Go to **Settings > Updates & Security > Windows Insider Program** +2. Under **Choose your level**, select between the following rings - + * [Windows Insider Fast](#fast) + * [Windows Insider Slow](#slow) + * [Release Preview](#release-preview) + +## How to switch between you MSA and your Corporate AAD account + +The Windows Insider Program for Business now gives users the option to register and enroll devices using a corporate account in [Azure Active Directory](https://azure.microsoft.com/services/active-directory/) (AAD) as well as their Microsoft Account (MSA). + +To switch between accounts, go to **Settings > Updates & Security > Windows Insider Program**, and under **Windows Insider account** select **Change**. +![Change Windows Insider account](images/waas-wipfb-change-user.png) + +>[!NOTE] +>If you would like to use your corporate account, your device must be connected to your corporate account in AAD for the account to appear in the account list. + +## Sharing Feedback Via the Feedback Hub +As you know a key benefit to being a Windows Insider is Feedback. It’s definitely a benefit to us, and we hope it’s a benefit to you. Feedback is vital for making changes and improvements in Windows 10. Receiving quality and actionable feedback is key in achieving these goals. + +When providing feedback, please consider the following: +1. Please use the **Feedback Hub** app to submit your feedback to Microsoft. +2. Check for existing feedback on the topic you are preparing to log. Another user may have already shared the same feedback. If they have, please “upvote” the existing feedback to help prevent duplicate submissions. Adding additional comments to existing feedback can help others by providing clarity to existing information or additional scenarios to review. +3. Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. + +### How to use your corporate AAD account for additional Feedback Hub benefits +Get even more out of the Feedback Hub by signing in to the Feedback Hub using the same corporate account in AAD that are using to flight builds. One of the benefits of submitting feedback using your AAD account is the addition of a page to the Feedback Hub for your organization. Simply click the **My Company** page in the feedback hub to see and upvote all feedback submitted by other Insiders in your organization. + +>[!NOTE] +>If you signed into the Feedback Hub previously with your MSA, your feedback and badges will not be transferred to your AAD sing-in. However, you can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. + +## Not receiving Windows 10 Insider Preview build updates? + +In some cases, your PC may not update to the latest Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: + +### Perform a manual check for updates +Go to **Settings > Updates & Security**. Review available updates or select **Check for updates**. + +>[!NOTE] +>If you have set Active Hours, ensure your device is left turned on and signed in during the off-hours so the install process can complete. + +### Make sure Windows is activated +Go to **Settings > Updates & Security > Activation** to verify Windows is activated. + +### Make sure your coporate account in AAD is connected to your device +Open **Settings \ Accounts \ Access work or school**. If your PC is not listed as connected to your account in AAD, click Connect and enter your AAD account. + +### Make sure you have selected a flight ring +Open **Settings > Update & Security > Windows Insider Program** and select your flight ring. + +### Have you recently done a roll-back? +If so, please double-check your flight settings under **Settings > Update & Security > Windows Insider Program**. + +### Did you do a clean install? +After a clean-install and initial setup of a Microsoft or coporate account (even one that has been used previously for flighting) the appropriate targeting needs to take place for your PC. This background process is known as Compatibility Checker and will run during idle time on your PC. This process may take up to 24 hours. Please leave your PC turned on to ensure this occurs in timely manner. + +### Are there known issues for your current build? +On rare occasion, there may be an issue with a build that could lead to issues with updates being received. Please check the most recent Blog Post or reach out to the Windows Insider team on Twitter for verification (*@WindowsInsider*). You can also check the **Feedback Hub** for announcments and known issues. + +## Exiting flighting + +After you’ve tried the latest Insider Preview builds, you may want to opt out. In order to do that, go to **Settings > Update & Security > Windows Insider Program** and select **Stop Insider Preview Builds**. Follow the on-screen instructions to stop flighting to your device. + +## Additional help resources + +* [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders may encounter while using the build. +* [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between PC, Office, Edge, and many others. + +## Learn More +- [AAD Stub]() +- [WIPfB FAQ Stub]() + + +## Related Topics +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Manage Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) \ No newline at end of file From 7c27d00539b7cb739a045787f41ddd2563a2b102 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 15:26:54 -0700 Subject: [PATCH 124/165] update-TOC added WIPfB --- windows/update/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/update/TOC.md b/windows/update/TOC.md index cb2e9787f8..8858588f2b 100644 --- a/windows/update/TOC.md +++ b/windows/update/TOC.md @@ -19,5 +19,6 @@ ## [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) ## [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) ## [Manage device restarts after updates](waas-restart.md) +## [Windows Insider Program for Business](waas-windows-insider-for-business.md) ## [Change history for Update Windows 10](change-history-for-update-windows-10.md) From 7711df8eabf2a2261d993124923dd915a984a2d9 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 15:32:45 -0700 Subject: [PATCH 125/165] exclusion fixes --- ...e-exclusions-windows-defender-antivirus.md | 8 +++---- ...e-exclusions-windows-defender-antivirus.md | 14 ++++++------ ...e-exclusions-windows-defender-antivirus.md | 20 +++++++++--------- ...dav-powershell-get-exclusions-variable.png | Bin 9714 -> 9323 bytes ...troubleshoot-windows-defender-antivirus.md | 3 ++- ...indows-defender-antivirus-in-windows-10.md | 3 ++- 6 files changed, 25 insertions(+), 23 deletions(-) diff --git a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md index bed4fbf9c1..874d94951f 100644 --- a/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-exclusions-windows-defender-antivirus.md @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Configure and validate file and folder exclusions in Windows Defender AV scans +# Configure and validate file, folder, and process-opened file exclusions in Windows Defender AV scans **Applies to:** @@ -33,9 +33,9 @@ author: iaanw - Microsoft Intune - Windows Defender Security Center -You can exclude certain files, folders, processes, and process-modified files from being scanned by Windows Defender Antivirus. +You can exclude certain files, folders, processes, and process-opened files from being scanned by Windows Defender Antivirus. -The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). +The exclusions apply to [scheduled scans](scheduled-catch-up-scans-windows-defender-antivirus.md), [on-demand scans](run-scan-windows-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-windows-defender-antivirus.md). Exclusions for process-opened files only aply to real-time protection. Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. @@ -48,5 +48,5 @@ Topic | Description ---|--- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) | Exclude files from Windows Defender AV scans based on their file extension, file name, or location [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) | You can exclude files from scans that have been opened by a specific process -[Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions +[Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) | Windows Server 2016 includes automatic exclusions, based on the defined Server Role. You can also add custom exclusions diff --git a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md index d4baacf3ec..3d78deccde 100644 --- a/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md @@ -42,7 +42,7 @@ Exclusion | Examples | Exclusion list Any file with a specific extension | All files with the .test extension, anywhere on the machine | Extension exclusions Any file under a specific folder | All files under the c:\test\sample folder | File and folder exclusions A specific file in a specific folder | The file c:\sample\sample.test only | File and folder exclusions -A specific process | The executable file c:\test\process.exe | File and folder exclusions list +A specific process | The executable file c:\test\process.exe | File and folder exclusions This means the exclusion lists have the following characteristics: - Folder exclusions will apply to all files and folders under that folder. @@ -95,7 +95,7 @@ You can [configure how locally and globally defined exclusions lists are merged] 7. Click **OK**. -![The Group Policy setting for file and folder exclusions](images/defender/wdav-extension-exclusions.png) +![The Group Policy setting for file and folder exclusions](images/defender/wdav-path-exclusions.png) 8. Double-click the **Extension Exclusions** setting and add the exclusions: @@ -106,7 +106,7 @@ You can [configure how locally and globally defined exclusions lists are merged] 9. Click **OK**. -![The Group Policy setting for extension exclusions](images/defender/wdav-path-exclusions.png) +![The Group Policy setting for extension exclusions](images/defender/wdav-extension-exclusions.png) @@ -184,7 +184,7 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende ## Use wildcards in the file name and folder path or extension exclusion lists -You can use the asterisk **\***, question mark **?**, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. +You can use the asterisk \*, question mark ?, or environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the file name or folder path exclusion list. >[!IMPORTANT] >Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. @@ -196,8 +196,8 @@ The following table describes how the wildcards can be used and provides some ex Wildcard | Use | Example use | Example matches ---|---|---|--- -***** (asterisk) | Replaces any number of chararacters |

  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
|
  • C:\MyData\my-archived-files-43.zip
  • Any file in C:\somepath\folder1\folder2\Data
-**?** (question mark) | Replaces a single character |
  • C:\MyData\my\?.zip
  • C:\somepath\\\?\Data
|
  • C:\MyData\my1.zip
  • Any file in C:\somepath\P\Data
+\* (asterisk) | Replaces any number of characters |
  • C:\MyData\my\*.zip
  • C:\somepath\\\*\Data
|
  • C:\MyData\my-archived-files-43.zip
  • Any file in C:\somepath\folder1\folder2\Data
+? (question mark) | Replaces a single character |
  • C:\MyData\my\?.zip
  • C:\somepath\\\?\Data
|
  • C:\MyData\my1.zip
  • Any file in C:\somepath\P\Data
Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles
|
  • C:\ProgramData\CustomLogFiles\Folder1\file1.txt
@@ -276,6 +276,6 @@ $client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt" - [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) - [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index c8456fa9cf..48dcf3df40 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Configure and validate exclusions for files opened by specific processes +title: Configure exclusions for files opened by specific processes description: You can exclude files from scans if they have been opened by a specific process. keywords: process, exclusion, files, scans search.product: eADQiWindows 10XVcnh @@ -12,7 +12,7 @@ localizationpriority: medium author: iaanw --- -# Configure and validate exclusions for files opened by processes +# Configure exclusions for files opened by processes **Applies to:** @@ -40,8 +40,8 @@ This topic describes how to configure exclusion lists for the following: Exclusion | Example ---|--- -Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would excude files opened by:
  • *c:\sample\test.exe*
  • *d:\internal\files\test.exe*
-Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\*" would exclude files opened by:
  • *c:\test\sample\test.exe*
  • *c:\test\sample\test2.exe*
  • *c:\test\sample\utility.exe*
+Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would exclude files opened by:
  • *c:\sample\test.exe*
  • *d:\internal\files\test.exe*
+Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\**" would exclude files opened by:
  • *c:\test\sample\test.exe*
  • *c:\test\sample\test2.exe*
  • *c:\test\sample\utility.exe*
Any file on the machine that is opened by a specific process in a specific folder | Specifying "*c:\test\process.exe*" would exclude files only opened by *c:\test\process.exe* When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). @@ -89,7 +89,7 @@ You can [configure how locally and globally defined exclusions lists are merged] **Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans:** -Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). +Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess' parameter. The cmdlets are all in the [Defender module](https://technet.microsoft.com/en-us/itpro/powershell/windows/defender/defender). The format for the cmdlets is: @@ -110,7 +110,7 @@ Remove items from the list | `Remove-MpPreference` >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by process: +For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process: ```PowerShell Add-MpPreference -ExclusionProcess "c:\internal\test.exe" @@ -156,14 +156,14 @@ See [Add exclusions in the Windows Defender Security Center app](windows-defende The use of wildcards in the process exclusion list is different from their use in other exclusion lists. -In particular, you cannot use the question mark **?** wilcard, and the asterisk **\*** wildcard can only be used at the end of a complete path. You can still use environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list. +In particular, you cannot use the question mark ? wildcard, and the asterisk \* wildcard can only be used at the end of a complete path. You can still use environment variables (such as %ALLUSERSPROFILE%) as wildcards when defining items in the process exclusion list. The following table describes how the wildcards can be used in the process exclusion list: Wildcard | Use | Example use | Example matches ---|---|---|--- -**\*** (asterisk) | Replaces any number of chararacters |
  • C:\MyData\\*
|
  • Any file opened by *C:\MyData\file.exe*
-**?** (question mark) | Not available | \- | \- +\* (asterisk) | Replaces any number of characters |
  • C:\MyData\\*
|
  • Any file opened by *C:\MyData\file.exe*
+? (question mark) | Not available | \- | \- Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
@@ -212,6 +212,6 @@ See [Use PowerShell cmdlets to configure and run Windows Defender Antivirus](use - [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-windows-defender-antivirus.md) - [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-windows-defender-antivirus.md) -- [Configure exclusions in Windows Defender AV on Windows Servery](configure-server-exclusions-windows-defender-antivirus.md) +- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) - [Customize, initiate, and review the results of Windows Defender AV scans and remediation](customize-run-review-remediate-scans-windows-defender-antivirus.md) - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/keep-secure/images/defender/wdav-powershell-get-exclusions-variable.png b/windows/keep-secure/images/defender/wdav-powershell-get-exclusions-variable.png index adf6c2b6613bff859cb30361d7fd0be1c08c2a5a..68b455b5a3d6e45bde77d3ea2d3073e370597343 100644 GIT binary patch literal 9323 zcmbVyWmsEXvvw%Otw6Ctfx-h6DPCNP6k5DEZLtP|dvI;BqQN0(6-o)3;$9pAv=18G zDI~#NPk`rrzaQT@=Q`KBugK2qwO7`fxo75Hvv!n@mMR(XJz@X=K=%BZvMvCC3&NiJ z5aMG$q4V?av0p^4&rCc30P^;$H%=-qIU`m`0Di9dlwcm0nHGn23Vcv@EqZDUR`3Md zy0`-hOAybnB2q9`q-^a0bhmQ_+qpOcsEHo1W97tGawQj6Uw1njTQC4dfsn#V$*-mE z)|OXIS;2Nr)_}){6hzo7L|0ezTtHxNOLuF4sq5ucbCT=M?L2^vme{85fa;bX5UiN+ zN^E55?ri65188AfiNwkXZtnMV2U-L6FGErPYNq7k@EH8zpTwRQ8i{63OS2)RL_3Cc!?={~`M|sg9u-qE_Mvuv8bW04c!&R( z`Y2*R1XYXwkSn`+~TeadSNddP{`z>PQsUv*2XAI&?wAi0f9$y&7+!*PT3r z${Mdz5UQ34ZZ%(WZ0F!a;Ly`Y?AwGQHibx6g4akIPF$LG*FWC$i6G*jKwO;8HE%)k zc|sS*HW`a~+jDKZ3OE1ME!!#>`zcpM z6W-1az1Jp4&%|W4zdmBJNkK;T!pKORcah(Ydl54m+$sOsAD}@!sAe0yp>W|I-gSd&P^^;l~>vEgZH3Tl6A^4;kd4% zAyhYS*-BM>OPU3^ha*X~;*q!ktL_!}Nez>pp0wjV1rPSPj*RXbd4vAJdVM zlkXH)qUi74%LKdF+P-%wHtm|5n}Y=yKF5WN{0?6DC=i6_apo~|%o0539V~c!IEYw` zdKyKFtVw;4b+nqQ&5xLMbCma22{=+YNLfiYQsrfVvix4pSo0V<$MZi37V>u4p_H+Y zLA+U|pTFDqF$42Ap@X4BOkOau_@jvZIfdi|k<+U~4^<#^JZMyoq$}w%lFGETR`Jr1 z^~!?YaU(@WyW6T(Z zE=}{V>qWbcCU7u*zt7wQdzRpbF3sgS0zTg5ed;O}4}2wz%0Nr6d0eBy{R%PYF!=8! z8pX!BeZ;XXAFnE^=tyhdUG-8*dC=XypE!F>;n#XoXr92;U^v8uBzT|d;B$~82F%#l zsl6_GS;jq2*r48yJx#Gz#irl9cgzj?X_T{d&IeqnMBAiy*pX zbm2>TCOv3y(_xN30&1N~T@hM-4s#;6@y(OGRJ0QRJeWH!2Uix_FPYBT%CQGJlnjH0 zFPtly;o#Y;sR|n*L*cr&t#y93pbs|X7sZX@Vk?0L<~dz4j45>8>6FuGV1Klo!9Na@k&z~oeHO8G*fH^Wtvx#z`BV_BvyCzM^iPg-TxieU& z&VP=DJ-3kqel#W%loICy$mGu$I_M#26gVsb+IAO#s%fmD?^E4pBWHoOyaFr2W3=<9j z-`*_hK@=2cSA08!cJtiBAE9(9Y>zv!)EEex&0=6N`hx=407TT#D_lk)6o%X}pG`9K5sH z*)#cu%QZqemw>3t8sA5nvnFaoC#Apla=z*d1ZH48maP)9JlQIbn5ojsw)e=t;Ala5 z5$i7dSTETwvkxtqR?(XKrI-6ErwlyiUsa+hh-2Sfo*4z;umSbnTKReCa1SAHzv(B@vL8o^L<`%xI`$K zpAiR}K?{bk$a0X10-ZTL!46F!J_1LTtg>L@8ON`K&7Pca9!gb|s9T2GU& zGN1Bh;p?1H9rZWy78o^#AJ$=L_hO+?Wu3n};Z9M}jaIX*ViUTkzI@i%(*bD^?+~)y zlY-rhf}F{xft_jEe>9Cu6D*Q?DETTc$JV^8U9e%+Q0pH1us@IXsE~&vkNH(3hn~7S z?Y)SegIT>bIb$hqK^wJIkMEerd$0zi3hfO)%@wWnR(T}^djl< zpqj4G7tQNCmL3klHxZeq^G4BOtnz>?@n+e9j|tM8fXUpbY1CvpXXCC~t`PqI}A$Adg`GMi+MsEFjM31EP}YxdKF zN7(q|4yk1vYabaIS)TgC&XA2g>F>2+07Vh&;0Et9=l|c> zMa2A8<}!1;#t4ScHH6jEl&()U#XlM;@g6CZb|N>m(XngBK=9X9kHV^PsuUiJopE;6 z&0PQDDejqe7GByZ!lM{M!J5w%R_9rm(2PnBR1*x*serI`IVmciVy}~j#)ZbJ`sG&>T67>;Jd>ECk55|N+j=k&$Th#1+y-Fb z(mwm3&`H3>YJTsMu(I|Sfp(+T2oBdX(T3L$A>n!CVzp)48A1$zF(Z9N^udHNyh)@G z#aTV)L%*O66cy-4!?R)?;60hMT)z?|)7=GYpRR5T7FRV3cBE)!zFsljqaJuX42Qp$ zG#<=rk=+vArP|!@*f6UrGA#EBO@_qSIW*g%Z0ho*2(FY2^#^4N`MZKx^2jq`A-!!5 zee7uF;-!7rqCYM>+n;|g_>0I2xJ@@F9pcKZD|S?i)O2s;wf%}$^8P`1tG!C5>yn4U{Jw=Yuk;Lt(2nSWN}`?^Kp|j2hd2&iIW}geYIZkL}Of`zEvy z78=DGtDI(ks_1hp^sQN$#}v6uWsOyIF*dY0;#iNW+8p#S6$L4Xf>FT3i!u-fllL zLvM7%=C<@3ygW@hB=9YtBald$P!p%_5_cvSee*dH24BIWWb8TFxaY@mRT5 zO;fXCnpMCZs*~o0TuEpE^;^bn=yNXuPVGIa)gd1CdFc*8s}nBE&NjS7h>?OTmW`M~ z#grsafxJI^XMDCBMmdXk;$YB;6XXAUqW<4%CJ?WWPhy3xo~xA;rO{x3_FKVTQ=zY8; zxs2)Fz3Ld7H)s3MPt5&2JQOmaxbN?S7tuBS`F^g$kqp)S4-75Hk)tq5^NtC!C{}c% zb(pl)ulv|vls=C?@4q={&Ng-ts|eFMBV`_ZG@;T$9MSnlOKwcZh2%CJ)(pg?agKO|KT zjFUjG+O+>1(_!6!js@{P{GoPFJ4E(j|3~-KP^aLF@aJQtmwCJ3oMWW{uYyk`mi3h@ zC=7O1T3iBNhZTJX2>n4Fk+O;x(p;~_pQp_}TK)r&=t^^q=3D+wt*o~x)!6A+afWKo z_a}dS;8k64>>Iu+wO@YaiO=|{MXYPz!IK=*T^1H9V=G#JIt;*c+bxZ&AG!2c4m<`C z71S$c2d{9iJC4CLOcGH0O8PYc`ZdG^)|}PuE{XEOEZ+y7jIg%^%vD=C%G+%gxZPQ& zQySAPirxMoZNU6~$SGBXbM)v-FN3sJOGslZC2RRS;giLO`j7ZCKC17JQCai6a>=Z$ z)*WQLzyHfDC$M<>Hr-(R5lYF1D{z^l7vSR}dAbM$vp{x=`8*_~02^sNhoE%~NZ_$a zsHVd-eS-02Rfb20m6Aus2Gfdez3#>1h^cLv_kp2g}52c?Z5RVOymN4+OO#P05PTehM=H0!W zfrym2ljkB!*Gy~xLB2HCM7I<6+`q?AiznYmBp}dz7E3|fR$Xf0#aDK#{KEcQvmKs0 z1FcfbqoL6aO&9_12c(lz2a9ZSP?g02idea=s;Q{eB=gZ}s~?3EBg`%6uI89xXD93u zKWiG6;j{T6D>EK1DrEllbYSBT&dyBf&jzp#iC2CM+6^ezdhgD9{*|mY@PwrFjwp{p zJ+|#oZYb8A-RJxaDV|^Z93q{)ZjtzTsyQ!O7VAFELYP&rMwU-a1fN|9dqit zaph+ozki5;IQjk9Cyia2eRl5in3Y%6iKmMT4lfRj!^$#t+c>Lv8#tOh4JSNe<>Yrg z{uVxMB>hdjMzU>CW=X^(PbOefawuHu=#|1za0hhcF!-#EZ%?cqBU|(Kp_c*zzUAQ^AzQ zvkE(h%iH92Z(k6Oe0@hJk~>~EbD<8#IKAg07tlht+s6JCT4tu<*a}^(zN5{;pEHr; zR*%tuFRdPq>Al1oc#>72jSQZ}r$5}Cx{BpioS@Paw>`Z9`0YsCXvu0vwq!N4U`vi| zrMC@}>#H(de0%CAdA{-aM1zAh2%*ViQ(#PS`LK%6XIw)lu%C=ROMdMIu$_p2T7f=_ zZ{#3+YX_(k%-zTl*d-n!^elxcbLyRoK-eKn36DoN>iMxiU<+6^kDUka|ueA`b z3_vsm7E=+Kfx(J*#KxBk@L0y!S_=tm?`tcJ5RC_k?D~NpNVu4^(i^pUkYtNL$Xt{u z_@nr(&I!*lF5SX{A(pS4Jl$C%Ufzu!%og(bfVdqKsbL;Y+p-oOVW4vvuPpF& z6X_W_kL!K%1ofTzR}BCdN|&t-%z3e*$>f*Qy~7dOHN20|MXU+VoD!*=+D+X*9XC3? zog;tF`QVjT&)7MBF_U$%hsZ9Kc`idhevg#dbWqd^-#G(&^M}q_hPGp+gD$QgMd!@F zG zlVLggbuVT&5?wlBNs?ayvF7hLy@GGFNLz~|$0?iPmgjVH7_R2pV>6XMk9c0o(bnE- zHzRa^wDb2D$5Al-=fL6GfWk^g21TXpSz$?sD>eRH&TEIo+Qy*t~yGX&p0fT|o0Kj_<7x8>_~QLs`|H zxJq{6V>{0D;?VNyNTJV-cgU1z40WL1GwPPCiO=EIv(do8Gb@lm>|xN)iO^pYhxoY^ zQhEx|9x1UArK1*sBcJHJG=Fj~NvW;7(^Y(WFYMFi-(TKu>~U{T)C*gH=;|d0%;{ls zKmBU0db{vF?ZA!Wzh+~Ar;M?xSai*Ps3guFuxdtj>E>Res#^mgD98vZ=u-{9dgXb_ zLR+7D$+OJ0gs1xKfCl&}>j5Z~=`nL}AM4KHS4x z%r)xV7a-Y4e_vAAUrYtQ&j-vi{u+xp4y_gSU$OBRh?8O(fzTjl_Zp`i<18`b-kUmW zrgkgL&f162QuBIgdGG6WQPjUO^xU_tOp&6yZuFy0eObSIYdiVo!A9?Q2W6h-U|vqg zhop`av8dfnY-&J_!z8DA8=qcu2Yi#lHGlwi-_9nLpMPo0>s0t=PHL)NEZiBop&t@< zouS|5>PrHAq?gMZS!0}jX9wPkKhQlm!8Be4$cXh`)xIg& zz?*7xb?@;@C!?R3EZ;O13$G{eA)avms&fHBX>#hHFE8&pUOeE9Z*Eonty$<*9(r8e zS$!-0KKSr{e(I2@I8z6*n$OLfY*S_S8J_*<=sp)o{0#ju-oSx%MwMjPq&Qve(8AtI zt|Vm1xY!d^I}-yBmFX4w2LpC_K(Tb}(q4Awp?}^c&{gaN#T>R$N5lY=wy7Fqye?BD zA|Er$B1(hLQFhh;V?uA-%ticD@|b$wo1vK)71NdoD1DUI=rx4Vy9y)9w>R2a&|2kQ z@3M2?lh=}^8N&)whD{?+>05g)CW>cEg4^yCD%Y1bh&f0QNjPdrf%O5{R3*Pqz~Nhk zyskYYo#z%8ulYuyE>e?A7e9$FJfM|mQ)$lPVGVlt#5BF~X;W>(+mFmBDXvIg`9X;o zr*zcJ)q;X{M_+O@JV=I7n@NCF2rTA zj4QA-T#%9L$73v+STe`1eNYph@&&a|FsQn;Upu#c)CBMmlj>D2OJ-65*D!7#atXHL z02C%vmRTcEs~kgozd5LRTz3a zc_g*afAdnN?-&^WRo_%X$$aO-+V7z~bK`gHp3xgLKsgVW(jH=!oV``K{1cQ_cZ3nJC?!0xuuVl=~AWu6&iFu{8EZW!l#R zNnA*M2t2q;z;*#nXcLq+O&s>#Y@)I_rj$RY^j?1{{5kE^jHL)yy>^EB3y0hJc?g6h zE-77TLbdOs!QN@;>s_TYos2^h>uGju_+&mw4$LL>n0uEMn3&$OZ@A&*dy-uP?QVLO z5Qw#z`2N_#Yh`=KapeWLPdJga%|EtroQ5yBiuS-iZ4*MGZ-$7^B% zT3B#x4+4PKPJdLb1V`l~PoLdPCW#j*3G&u;=W0Ldncr*u`=)2_s3dgn_#P-B5XEVB zA5?&P+*Jcaq_0lc64RVMLT9CncxN8I`!WK%9jW)&6^PngX(yJ&xJvf=qjQQ(df0Pj!kjsZe(Nlxq~QmoU{0WZYK5S+C=t+1|d{ zY@Fg2nMnQpdZxwV8kkS3%PZcLU4-MWbM6~K>#+IT=7mMZ_fmnZo;z10QdxPWfx+p* z(y3}bpGOsGxe{^TSL_n75P1tGcabu}l03PD+C_(vDJ8jEFJHG;1`TP5Uq0+9iT%eC z$xwU{hx9*2P>%lm|5rUtdTxnO(?zo5n7sI_k!+8KfmDpO zZjXa%(wNAg0$kW^%|BAM<6!MmwGGYrTS2!|i!}L;&aTK~lbwY1Uw1a;H$dqHcSY!K z{QfT0#_ews*z*oHBQ~i=w5ymRqDcU9#_u~=d_Io=avRX`dx&|?Qfiuw-Vg;q+Pn|b0EGM1 z&91daTkL2Cw2zTKyG#XkhnE*0WuDQ16It6J?CDh2H~6VV(7@c>@I!OV*&kmP8h(_+ z3%v}9HZ+){_r9w35Ox_cJNv@!@fHkp9xmt)za4&K>}8#bSd;I3(UDIKRye!bGfiw_#|Etw|@{*1@A&ElacP%I5GO_xS~$c7-E+#w>sWumx-&k>%EuR zS7Gvf_iNEMQ-&dhWEve`A1B|i>CdSRO<2rm$~p9%ut9UvYc|Y#PH|W~^~MKgu!Wvr zawTb=HSRk{|7_|%h8y)toN%w2ylcbhQOYi0^VI>L>9C?&hYDBSb8=|^U9~k>xrt*Q z)Bmn#c1yV+7;6;OwG$i?S+Q^hTi|)DcIBsUtAYBPIHP0rJF+S13So_r zX&Swm968MOx1Nm91}B=xT#qF2Z{8lSV@`gvKEin7Qc1WPWu)bFRRcqDwgZAn%R5}+ z5}`MYEWz$&7@IVnd{n-()>j{Y6CIbdGXEpiHc|ZIdiX1xHz0Xa_5a9C*;MGwu>5Cy z_5{V9r!u@wlTw7!vQi(v>cDZ@d2o#n@3;QKz#F%4=i>g?S^EF_fX9EnpYtDY4k0fI a-n20&x_^amV4tZ0Jb$XCT%u_4?!N%;mia#b literal 9714 zcmb_?2UJtRx-J$#q}k|I6p&s*uOdj1B7)L;Oag`u(u;snq>1z*0Vx&;2nYzFmqZ{0 z5d=anl7MtVuQ$PS&O7V9ch|c2zPDEhd;K$ec4p@L|M~uJCdSY}i}o_>Wim1{S{-c- zBQmlJVB)>sB?{tq=FChq@gJ4Dwz(G>8C?hI?_8=79UIX|>8+!GpK|5``$anT);j_& zXQumR-fGXi9o;<1K9!-hi6$CvqDcef1@v@s_jYn~CA&^_^A^#5nPgXYbNBajf;f7U zmC~aXh*r8Yt0%~wRF&J?$pu6vy-QC;ETJNm7`uVJeeFF#WY+Gdr0UdXjXQY(o$ZNL zJ;`cYz9tgQmq=z)drwy7Uiq-CSHiuHIxj=(J{{ zje=C|v6Htmi0tF)Pku5oZZaJWwa0!rD-)s4gS+qW8~Ajo-Wuw{wk^i+rPJfJ9_g%Ga*V6T}4jDatcXLl(X=K+6^>u1#jD#RELFYxqxP@L?lVy9T_m|uk1n}y0~pK`X_ZJ0Kr*-m$$ot#-` zk9`j}+-g~Fra!qJy4yJrRB{a+Ben;t2t^*vdhzj{kbBKiqs2}-PY8IupbdFk2R>-A zqBE~WkM#22VRp=#YJHi-=D(Bl67893=;$h4C+g#Nqaq_e!r||dJ(#LfHYVLv@NRC( z=Zj<9XumeC^Pad@w{~>kO$=o=oc??e~0 zCC*0eWV+x*eYdcS`}jG?Pd15f=^e(;1`sp_xR&4bMG`(_8WTd7#D`+eioT7Knb?pU zL*oN)5Qia?tJn#5WD!k4Nx8p+)Tg1P)vuG4lIp0Hb#-uecQ;Te`51)paH9VC(dJy0ad?%6;Z9FtAGo(z-}KRis^*x}3yDex zih6oMn328a^*Pn%p7&Z!XqZ&UyVvDno=CZV%hzx8!Wi8*=p%%VP zx%*6p#@2vBv|z^O868KsZbb(}TjTVu$eyF{t>GrwOF2s*n^T1jQ4iPlXXBsLzVs<3 z!o*0>x-Tm)C!}deai0z?YRxZl-3N43%Ptp^J$3x<{!teuv{UtTZsjr69FvLrPLbHD zsPsdXw*|wG$!0e9^JQ~#d0CXvnuxE?b2B{&Y(9*FZ|mKjthnf3ze|MDh+IUV!Ma6Sujkx5YHT zRR_ymD+9VWlGjEN@hx?XK44uJWX>8NK~Z;Ggw$8+RKVZ9(x6w5ab6+M2ed5}O*Xdg zH#Bq#8aGJ!L`((w03XN~Ac6#%56u!1wA#03QFsTVFXyi0cTL>u)hYS9e5vu}PgYpL zJQ=%$K05i_y*{?(-_cJZeI#4z(jv@5bX2r@id^bovFwFKxTlqxHDgOfV@f*Qk6edW z^mn8i4lWgAf?_7~ryYodv_t2Tpx7}2gC=V}{^bDV&{e;Fleq%C002=yAuUCz7sN8joINo)r zf$6{G^A!t0=>1fpqI@ehwqMrhoh@HwIJNx!&z?V!7)#2PlF zrtw6yzjh-i+N&#Fc@ZBK8_dNYt_pFN*d%B;jWOPiQY%KPnT`1uNXjVcwY|9ISiAm|4hteY2Z6dUVUT#yty0dzZWV zQ`92b54_~drA6nWJ!QvR;hB=)%su72uKDFCe?Jf70pt zj_u}dY*Sb5vs~O%Fn*~k&l#WgVY4K&D1 z8Km(R+I&CgxW4DU61+Ctlo-P?+TxBIv{b<3t`^t_^nsSXzGhvP53d#ieNVdT*si*kn@F7MXEHr>c5Xjm?xJ0e?j@onN{JN58s}Y%)!<>@7 znlZeHL>#+MN^-)rRpshsSuP zXv{_t%uJ!U@lX&X%!BebSxsY|9KoM&aHiH9?P%{hWQ}rcbzx>!6nm76&d_(o7mbOg z0%$I@PsFO4*hSun-!2=OM$-_Tk*u;ztcRD_Gi7jkA3fg4Tp_)$&)rcjwYq0d<%2{S zHmGKTQwuCZ=qrD%8}nA9U0=6XM+KvZIe*AV^f>>P@kHqCGbpsmbt~x-hIoVjT}4x+ zP5!Y}^)w}P58t6{bCKdjSkhjVy&dzS$Bgf3@9 z^ABp*o{I7|>9NYY`W*=#c+5MN+EDI)vKFH(7rULiDUw60w36Ry8yt_b;Sm|q_m`Rq z(UEFsGq*n_`GdCtAsrtIdT+ttD710VZyHYr|0GX1@Q1WG4V}@ReW*JZ;B2~p=if&TN;D=AEgGPC<&!S ztnsd0&+L{A89anWiz?6jdPEa-*Ak!a%;Sr*eGXD^y|t?BuTZb9tSNp&m`b{lcwJAv z@zovqleQa13QnF8$rTU3S=pja&g1NqLn+o;s)Q@2mU<={y-iC&bBwah!i8|c`vO>I z*6P`he>#)tf?U?EI^28w<0<)LmC4eC%>!+DHx4u1P~Z!$#2b^@i(~C8HPShB6d!4s zCNa~j<)=3ychUv`=}Tw})v(>hmP;?8$*r+0%~Vfb5YiX20& zqj#avVo`9}>Go7+;npKZ`Q@gBt_L)D{O)k?M3AIKmP+C^Z3@r^#QZA=v^g5-01}w% zVSytsJ*BrhXltGbL%vQUQ>E&l{`5-_wxz?D30bLLR}4kw--b())`F;^@l?r#pl$|} zY0q<|ZQFxeS=lLsAzf%R7j31omLb?=7{E;HvBdH4Ab!1XA#|0Tm0wwPNfOl^Xj~pI zQj0XY-X2G521cc86Wr`(u1b5qe(QR#iB0P2b8Cj~5A9%PU56 zIg@x$_SF0k0y`$(Em*ZJKtg+!tZ!JR8%K7Xwj2$`qoY=jtiXHYuOsDfLWLKEG7yq7 zRdJ>~(47b!wGlfATkpkh47B>HccHfQ3=q3r$l@?iw>5b9GV&W$6Jq*=#z9wd_qyd} zhTT%`(isJs((oCED-X#XD1_`^JSEfWmFqAqs)UTc1h=e29aJ0c#sDYAm^;cotja&v zn!Y6#IY#eVE)9$1Wwtz;4q^Owv6icS1?4_w-lVaf(U5ENI#Yk&g6Y&B^+&)qa9Aa+ zYJy@HBL3y|Zsj<=x7K>_Z&1=$;>?ccw^^DQ3cvEM#F>z^OFi;dYmlU|J|4yF)Q4`N zypwR*OU}n}?tY$kgOh`MzYMIPKHBy;PVjf#70_>g-tgFyXWtdMkYJ71cyFC6pW|%S zb|MlZ|M=%`1N6-&KQmlb0s9S)6;VePLLMueIuuo5tCtSVdXT@(jOGjL4oSQ{$;!gQ z!gCTvL@TSp`S)KWgh zp%~&AgWj3!ESq@WSA$NpbdP@NOvFw=Q*Sk`bvo8Yly?WVK*SB5j{ThltVHe3TcYxs z884J>-bdtIeR1-@v9_B98+h)3NTYjZ7;1mH`jK~tnVp;Y5?ns{C)r+B%3MUx^)81Y zQ|tK3LU%CJ_iGvs)>#b-9VqR&%6NW;M6T{x$k4U3IlmPg!Wk1jqAA`J5 zkbOg$xF^uee@^aryQWZ$bpAZP)Bz5lv%>l8g7^IQ@e0Qkq$EmPCK&+2hF86JPIsG~ z>HS*SdIZIk8g;~eaWcicZ7+qQo$-q8R{pNa)d^6OV&RUJ`kUQK=em{lBP5d%*xK)0 zHZ%-Od9xmN66?^PH8Ag;0r5-Ed-A=Co*?&{WX(CF$DpZzQE1TH`M4E`U5h#LlAW8} z`5)rv8F~odg}2Ajs0_?dHn?}){im-GGHG#mLfBnpfQ$XGccByY_p}Owq6iQg#^8&5|M? zQK1KluR>>l@T2`mILD{8hm-_Lb{*ZdrCw^2ojdk#^Wk!x+R5Q=hP zozu9)w02*l#8|pnm{}ej%}pW5Mw`TpP4HM5D<+RE9ohthNv(FJP{ z+?gOfAzvoddl;cPTqvXJHwD0aP3fO^czs&jBUhVjcCf(S+qJ~yA! zZ4~_KRSuU-we^X}KD_Fujot4~EG#)~a*a0nosM;M`705j=|O)#-r&acE?Vf=kx1;o zSWC*vpWZCyEo*HX**d7pkE;(=0qEZp-p1?l4uI^bakw=A+tD>*)8J&4_WX^rkpn zYvD8A;&)wIA#uDlqfz<7`1D@0CI0m$Cgw1A7fC;fxt*bHjO}~qs@k|p!^mVzKeNF_ z`^F5paKKdg&0Ga5g*wGKS5ziArf;ph;M-5qEr&~ zSy8;kue$*Gg>AAnLVQ{H*J{yvce0_cay4)8U*15a|KH;c7L>Yu)-eUxb#*=m)FpnL zDIr)CrLdqK#QAW*L-0xELXZp;=FGFaT!1^YN;rO#zH&I_y7GMlwr#c3rxW-50ipvh zT{y~QbU6dMD(1`89=FojbA5S9HwgTU&UjLHw>TVGX^0~MWK+D(bG|#S87C@EfCB+c zR8es2tH=MZ48a`Z^;+cB>p+t$L+%_DCavq2m)sX4JN8!E^H#_bvOJ;{=`)+CdS8su zZ$tA}ucPW~C8Dh#PI&!EXwjM+3>#vA#^M#`RRf-& ztRwXOgiX}l-LXBDgCuFj-9$O7is7qzAkLn9SqM@*zX47Q!x9OA$@+7I3%PatCutjE zv?E6BH2?6prW>;+-hC;~Lwd}&f(HZ6cU3z(wW(WSC8VJ;BUsH$e(@Eu-WEDLiscIh zmTSeXCX-d+6=4q)OKNV2GW}Q_l31wiX4=1#s&iqvy=X;vbdvhVnw4b@yN!os*y#G@ z=&^J5vo?*@Ma>e+24y;cI(v?|M#XTJrB`Mb1;2!M=MZeDF8J{ECIt({0SL*tPb5^1 zsMw~Wf`i@W4i^k1?+|^pMj_h!n7la$_W=ZJH#eXu{V)mE?NnP>qL#NIK6!(#sg#w6-~jo#sFE+; zEN*wLd4KmX^8&p6hhnM~ByC+)H3QSoxe@(Om3v0`O$30@RXfqn%zbR`^8z~4`DF4P zS+6x|bKr>FPNTnIqY!5N7W|Wn*Y=XssTUK8onY^D`|R^^PU=x7Y?jMcJ-8~?R%|T~ zurMFaz+!wO>o&&&o^cF6+ogb)+DyFR(4g=v16JYOWe*wm+hg-*&p%e86Q&5!AKgjD zgs@WNyUKf)eeGtR+U2`&d)%fZr=Kq1@A7Q-t56-jLaRl_s+s5DKS^U<*^FZzzy=JI z)@27xI+jNab$_k)*$<&GKXlo<$rXw(A6ZzvZImw9RVAr3?Q)_rm1~li&_oQmO)lTw zdig0}hsDNrEsK0#UDQY~2Uu)~9L2zbdntk#V4kEEyKDoL87K+}7Nd4Ko2R!^!oDCh zrn(^BQqgD%Mu(%1j9W(tv%!hkE7m8c42i~miwnLoKP?vCfLj6vj$H1pzw`)~IXNmF z!J82nC~-ZTXUHCuOP1Vug>p6)j-QpyZ`+S8w?4RZ+sEWRuJ zLHrp0+cl>N4B_ZX6-U;%iNH7k9{K_s5+^=%@WF5((Jc6ni%NovZVg+o>h92<$#iA< zY7=mIPD!8W;k)q4HP>nF<&~#-U>EC9nYD%ZndX*>`pW|nQQAv8=Y1`5u;T;xB<7N8 zjPO{XM{TmYz*%7AsgjuULNiKUr*A~Trl(_rX)yOgCnA14RuqVk4#gcbNDzTSlvoP%?!U_ZW}N~D)bCBvXenwvn2Qi19SX7 zQ4(GN1fs(1HZQ$Ah7A9Z=oLA-Pa+PC;qP72Z4t8CrwI&QYwyP9Nty75OxATs_PgU3 zm8J!mYx1L6P0Hi0mVj*q&VT|H%?PHEQC!h^VzO*B=H!y(M$DE6f!6rt`v!PsNd8LY z1lzK6LFqtK^QRvoI0)W8c$i{%!GpckebIDoef;`hTh21_EXkC#eeKh-1yw|1-5`>D zTni0^cQQ36ZQb6&go}#-&zMj_p8|U|Mif55&8_!IVX$b>`5g0#UlxO zeJz7Ug9>J?t|iq0*C_(=aRy}*!w6gL`@VH(;>U>uqOK6=Bym0mp`N1_x{luIP zr++S6bs2l376aN{Wdm+K(Oj@Zfkm$wTojtg|LTn1PkO>$HGD@Npdmjtzv!j1Xw6^g zhsb-Oj{ZB!@873N?liFGMRjDASUZ8BZ){xCD?gjHcYWWd4mRg89t5b)M|myUhYXv@ z7oVvVSL>R41%V_fB16E~*xCSojBmxrlsK=jnQ+^I{Okz2+g*@ro)f?=ij5CLMzA{{ zN^JUuJ|I~*dI8`2**eT4`b4KJn}=mT-N5umL5r#r1Z)uv!8q{2j=K=+gR~orgPLm! zKv;~CKKU8wJXM8^kj~21{WXJPlU7fg`Lm8zzn7?ePORjOZ??o#j;Lc8It^6}k}4TK#?UB*mJAZHlVD!fEqY?DB4dE`5x8 z*qCETchmEo3*9!=HGZ&$i6DpU{h;7`e}2rWdRYlY8ug0h`?$S1!HYUt`jH|+61hVS zLXy!15kw3fkGKlrjcZ@J1@U*#hk)J{rCxHdQl*`y4_t^ZyOqQHrTZ5@+SV@3O}I15 z_D`m@;a9Kzv%Ws9Uq!5J0yreLM@PdBbGrl1%gChbt*3 z-O0lgieqMs4ceWuCcWV3PffvrMCHc=EgLUG?HHmsZ1 z6EB?5z*>0V$9DY4ZF7IGpL@vw{y}I|^Zw?a`#XW}{SO$~uz+tFlrpc+Uno?8!woo=K1xk2xS#fe=H&dY5&bkS-T zMu@A36V3!`|7ZqY;Lx5y^jN>OGnl+rIY!SwFcxHl$wqOoaHHhyO^`y*#XMHcPE?e) zc1nv>nQyML>um?rs60s%T=W< z&EPm0gNa-f4>M15ytLxn08+yCM(9X8DUhx?6*TgV63;$dtRS5QfQ$yOhTFXu)>^{; zX_&Fl>HNiJ^}yyEQ7Rd+FsHLZxZzO7HiuSU2mPHovtWP0U+ymkk^*p~k#J;8DXgXL zopZJjU==-g7RS^nxy%rvX@0>^Byf-`AVlz$=PQ%k$NkFFG?=pi``u(xDGeq@hZ@L8 zQ_~sF9-R1GRb?%#0R-Yug*ml078f4EXH2|JHv_b!w4Vdn$`dEKPX-^DL^R@_F_e9n z?l$wN((#gR?!v(8?*^ePK9_`D&C~chzDad}5@|5_xpGAEkl{QK6i*C-v3Kj5Iw_&XTF&i{tt>PK2Ov_`=Vy*2<)3{fdw9So>{ z@ACL|xeYN`S{TBxD3ADI+aoelsYe!mNyoX^H8VLFLD7h~b|ntG${LsgpJDzr%3SU4 z`@Kf=4mTaoK;2%<_7~LtdjHyG$iqlv3qT2P{uSN|FW$&FN6ZzVT3Tn&PP%rd``iEl zP7Efk9XO`H4eVyJK!|~EOVhUk>)-Dolb%^)|ElN>eC9( zqmn!@BKohgaiuxnOgN>wJzQBtMehMZ4VGd_x@qo<^MB8vn7;wDWLOjD>TV|KLzqER z4Er5-a$B1YPxoZXBS>Chh40!nG@u}^VAc}6&@}fDXZ9DbIb6uW8)x9wcwK&nNRj;f z03veT%{a8+{f0}~KJ#ctkTnpjIK_hN_FDS%+^S@P?Q3Pgb9J99EZ^%ANRowy##0rB zl^0IK2{NuL+QFd;8LG^ZZEKazUx~U3WXz+U6#$u&-1$FLE-i#KX_GMed)rfH(Pr~M zYG~>IMK99=#Lwn@vn4y4V-E995#VZ@VuUoRssuw9fAVpi6?$^{{X3Ne{GGSMoPTa% n{TC13{NFau{=e?Tov4P{DXR`^FYXYJHj(MvH_#}%XBYk-9mV60 diff --git a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md index eabca9e983..ebca8b01c8 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md +++ b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md @@ -2,7 +2,8 @@ title: Windows Defender AV event IDs and error codes description: Look up the causes and solutions for Windows Defender Antivirus event IDs and errors keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding -ms.assetid: EE488CC1-E340-4D47-B50B-35BD23CB4D70 +search.product: eADQiWindows 10XVcnh +ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md index 243eb9a1c3..a9cdcf6735 100644 --- a/windows/keep-secure/windows-defender-antivirus-in-windows-10.md +++ b/windows/keep-secure/windows-defender-antivirus-in-windows-10.md @@ -2,7 +2,8 @@ title: Windows Defender Antivirus description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10. keywords: windows defender antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security -ms.assetid: 6A9EB85E-1F3A-40AC-9A47-F44C4A2B55E2 +search.product: eADQiWindows 10XVcnh +ms.pagetype: security ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library From b4c59be5f24119834933a0a2ad41ff796f0a6bb4 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 15:53:59 -0700 Subject: [PATCH 126/165] waas-wipfb-aad added and toc changed --- windows/update/TOC.md | 1 + .../update/images/waas-wipfb-work-account.jpg | Bin 0 -> 57317 bytes .../waas-windows-insider-for-business-aad.md | 71 ++++++++++++++++++ .../waas-windows-insider-for-business.md | 8 +- 4 files changed, 76 insertions(+), 4 deletions(-) create mode 100644 windows/update/images/waas-wipfb-work-account.jpg create mode 100644 windows/update/waas-windows-insider-for-business-aad.md diff --git a/windows/update/TOC.md b/windows/update/TOC.md index 8858588f2b..41a0c401db 100644 --- a/windows/update/TOC.md +++ b/windows/update/TOC.md @@ -20,5 +20,6 @@ ## [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) ## [Manage device restarts after updates](waas-restart.md) ## [Windows Insider Program for Business](waas-windows-insider-for-business.md) +### [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) ## [Change history for Update Windows 10](change-history-for-update-windows-10.md) diff --git a/windows/update/images/waas-wipfb-work-account.jpg b/windows/update/images/waas-wipfb-work-account.jpg new file mode 100644 index 0000000000000000000000000000000000000000..4b34385b188003f5705353f280241af0281b5c83 GIT binary patch literal 57317 zcmeFZ1yozzn>QNV-JJq0P^@^75@?H+Qlz*RDHehi2~KHohXO4W_hQ8zid&($1WhPz z2}J?~xOwLrS^sy|x^ri~`PRDkt~tqGixW=Hex7IVJoft~cMEsx0Lm9C>M8&%EG)n> z<^i}{0z3oYU}OLF#2mPoCmtal9xg5(F#!QSAt^B_DG4zN2^l#xB^fytISC0RJtY+l zEgc;lDFp)~JuM?OEgkJ&H^IWeyayML2oH~lmW+gq_CI~x{QyuAVy)nC;b3tAu&J$ zPgDt?M#qYP%biy2eNrAF_tTngI^9VGkGQo*C=oF|10xgj{Rg~!{0}80rKBIr$Ub|n ztfH!>{^GTszJZ~Uv5AfCTRVFPN2hn5UfwWjWBA+9!-L@I1&-2r+CV8K`Po|b6(?mIx=}s* zFeSJH(3r193JJN`wRW1@s5>%lIv;?KxBzb0xekhq>?ORc$$smGW{;YU%dh$F0P6zi zcy)MEmF4q%HLY0T8Qocpb4G%4~C~IJh<0VW&Ho8s@!zd^*8^M+f6Z&(;HLX~B( zjBjK(?U@GP`0mO0nn5i6jyhvbPjgx;+2~_zgEo8O=0?iKi>pp%_h+;1|J@v_Xi?W6 zu2($lWSF@mIMAA}CxT?|05+yeJG)@`FD8(7du7>RsbfuX-WzJQ)ciC#wdc;LPqJX` z1jc0^nWvZO9Bl2jjSOOIyBP*q4jHOZ)tjx;RqUY1_$=?l=Qirxgz98}@L>sKC-1+b zBkFU!1B2@#P6~o=8JpInZ>TBoG3LskxP6d-vR(^WJ5`fsxdVhc08trpjvGd_7s~cT7TD?1JU1w)wPodk-h`qP6Q(* z4{3D{c~>I-61D#h0E-F237+IcxZV=wVs@az9Uxo?g|XQ458Yj;2OsVLQPmFl362T} zPrd?E*+u?iEBhs-`8x8WpA=qyKX<#;gLM6m-T!Ta|Bv1O`IG)X`~83X%>VeAe~L{1U-a+x zrZZbpp64weUbfBt)&(@wh(?iX>1@dg6I{=J$%A~mHtM{7G8pES#r~wIb2?zISUv%E zvwXA&eCa;-uQBu8e|yXnh(+w}nVija@U(8861kR*f=M3@0`%haAIU_f%$)I7{!55_ zT>T#g;93;0%1PlKB5q~8%zJ)bd%txydVD8xKp^nd9-$IpuB|Gyu=}`}FV8&qKN%bA z0+d~Sz4DhU!;2;S`$>3w;;2U=bv{@>ckN)Y0fp!{)`2~pWwZY!nwR`Ny8gSgX$AET zNqqsgsN>0mPgd41aQk|0x{8_J0VGXFTU0!CotHqDx~2FAs^hMGBaGRIt5eSVm_7Y|(y3l7e{G z(1$usW%Jqa{jV>#u@&*v<*}kqT~XFKA3071$L;_h7y==)w0C6+~;Kzo9xTW^E=t8 zGU#h?FD;t$4v=T(ie_2~Mvees(Lt2K6Lr$Jq(@z-O_%01!RXqLhr1lNYW)ZmdtM)1 zhO_iL02hP+O;d8Knm~UCSdazYuvos^Yt_tdu@XwXX*D+)4xLmJBf@jI<@4TGQWPYCi*v*g3_aHXN{=ZUI?h1eSfR4KnCrzR~G0b|iw zo;Jg#ZGt0bqm2Pir_lwiHkR`L2ZotT9wJ?FMpAC{Jkz2f`@~ZA?RO-5fg_CqK#(ii zOPPmnoYubDoIcF(<@HWBHZe9YO!~5zq0Sa%tu6>M ziRJ@*lbwsPfeT5Q19h8B+xTC6;Y^X^A?^Zzjr&uf)}f{rcKXREG3zVy{KHh5j{f@NfkhQyI0 zgY8~YVLWZJ@e6U4sJfrlFZdM+Ai*1RmE<+H*$<`!ttVV?&wo`qh-;KR1AAdLsnXO_ zwJNd3NyHYb>L&G=Xcnewfve*yC6;ocn18pbBuG{@m4WEzG~C_UGpI?(DXoyAI1|HqsZ9W6ziEq(Pu&);p;K!`RMHg4H#LdoU1FSU{?UGuM40B}C}=Qucz_ zXM#9Uf~X!%l|c5Zt<}8^?YMgX$DHl%@{!3E;{9TmF7HNKLv3D$1e#5AC6bi#7Hf3^ zv-pxsy_sH3fB5wRwQkUqZSF( z{uJ{`6`Gr=Aas)*pjw=X3J{0oh&*qfL`y&ivg{BpbHYMZM;T|V>Rc65pOWd{i7q`d zkNrvXgJ6EI`;%DWh>8*$nUL?VAHkSvxrb`qS1@f2*(CXTt&K30AQ7Rw!XxZ{-4~tRg z9e{qfFxF-w18{k}1iy%$KF^OB)ZJ&WM3f!3D+7B8>l=Nf$~}^ZXtasRC&mKV`ioCw z>6mscbs?BmgLL>UJ<40tr(d?7S>bc7AeZqoaSZ`h9-aKq6Scv7PCTqtHxf0T3R|Gd(zE#_drD61LXXpfrCM_n7;d=3(Z zBt9!fy*m2!I{akIr$0NTYK)ZXd2Jmjzd`&hp7#&Zg`pKij^`-p4a2Z@FnNto`CjV_ zN6N~vV>FN7{iB4*l-fXl_5*`l(7K>X;C^Vh~H$RK_xrsbE`c5G{vj?%oZsg=?ny# zraQK+ubHVA{2i(k881WLh+E|31?V9RqwB|n0;J(9#HhWA?^6YJU14zp+#->mq>R3m zSp$ZMJ@Cl@9;=);CL zYw#s=h6Dvkloo7k?#tV6=Bukt8DCwWq^0NWrkfP~Mm~^!@!e#Q`_jf^bBH7v-$OYd z;rhvgCW?b?*Idg07ldj!xPH_>OS-R>z75v=a!y)Bo&H3w?*5)_d$@}5NWLO0q?h=# z5oK8dp|AbK1^qxenFRKS_37U0wZ@QaPUJo8$jfZ}uq6W`ubhmVQC68hQ< zXLu%xL7%G*j|puHqK@tk;%5`HIfOk%NHN>J9^kW8tz?@8cy z0;CH7rmwe^bQ2aQJ9Y{?WJqOPP~F3ZpD@v{S+vL_j_tWd{F3z(%5o_x&`Q_OAq>5; zBH>;vW3P@>k&@q59j@NSr+fL7u09{CZV`mVZT&DX@5?1gWTDGj2gU_api+zX8T`o0 zc&hUo$6ocEjQh(i(L;@hDodWH$%m*d=Sq=_TNoGZGjsHIEs^xQqwe@t~ z3`?q>tG33#5~4gSfpES*?T#BlT;p0~kXoDDxWM9~RtY~n0MeBQM{wfzW#JbeQ65f$ zMg0x&pal-%JaMg?F8>EHq+4^A)X(xQhw}$H!G%)!-&x*Ztv7wC_mP|qn#fRSfQy8z zQPo$I3s%EPj>-4vp?*Kyxy_!`$1uKLNaG}4M~fqS*U!2R=HCXiuEsd7Uz<}o^GrQR z!c7c|7?l!o4sw-vGx+;(Sqs2ALEw+%-spONOTD_2md!ucRaZQh-<+kC z2?|lQ`@O~2dR?7$ZSg(lfg(>af7LbzwpnNIF68FDsGngmk@J%#{bX_Z!m zAnA+O`%OrR^H$-6;^jS`lfDvsC08(OGA;qPuXYRLIB0u~2~sPv82_g~TND+%p-Iu7 z%{(iwvjqymYEF}>PS*=kf#mr8w0(2v`cQr3@oRR-K@dAC^C`mePzRaO+i#e5 z1&nMMoI3Ud#l7%~a;+~tD2N$t5>z>Uxakt}?SwQpY1{#aWrMeWjbu4M!=Jxy7-SRC$9ZNwk^i7;t#N&rvnHE-`)f(0om6E5_u_v*>vO;@BK zc+hJGHJN3UaeZh&74J_!FHd%QLr;b=u|Ed&ngE}LRU7HK@keV<83BLe4+_( zfux)lpuAvlt_D-ZGYy(AHdKQ}^wXbBNRqu;d*y6f*>^sn&iYcW{E@&i@!pwMi~`wY zCwq1L5n8=OdHo_(?(^jZckq6av2}#!c#9amY)_Wb`Q5$!GnxMlHqnL)fg(j&JKMDigk@lruO6{kv{hEL zpI-B%KQ19sLg0`~V`t`V#@eCV;P#tCdlJc*q`bpV>_Tb@?; z3K6Jye-ImTE)P-Oo6Rxf9H0bm33ywuPp|FRL?qvMo_0YZv@-3?Yinsoqhf}5ndd8r z=MsQ(2T1O|eipp2f=RfGHDyDd^!ztw`F~Xm|K&{IuhQ4>0E681lZ)+a#agf z9f|UG%Zn`3d77jI92rA>l46F&KSTRJr&+7=B>PrkDn5c91uVp1@3jnAUIaGA+v{E1 zczJKi*}6g1Rkx-T_r$3x22s}?#4=wpFOfj#AZyU15U}!M^kq297x8(|=)CyAF)vze z0-*}D0Kzb`U5UP<90F9DIU8!c^vl}%f;-P2|2g&3_dypYOZor_L`1@ahRnWIx=DFu z$?B^pNw6$Sam-hAxU!t@X;pGGV7pxtaom$FF%7OirbOAO&eva?`O;@(eKe#}4go;p z3q=5)Y+;~XKl8MRl5VRK<8CV(m$rM24N*4HlBfFG0QR0r9YtC%FvTk*Uc0taMqpJD z?rYU|tcGqC-;xKqHxlu2@eQy(c;RC6H+8a4H3%8LniW1Bm8;ay6k}l-&Q;Br8EWGZ zm0{8xJ;^Gxbpt((1`HupKb&%~>_%uJ>7z44=Pt zd2JOjGO#A%I@-iI$k?x1iUKOlNi4Bpu+`_&)t=WxTp3eS@F^LtCP>$;go6rYG5!>Q zyHUUzv&8AaVVxu?{m=TwU}SjhYAkMZEH6K<;_PpO*K!70qxrDo<|2yMoYG{o#&baK zr3*y#Qzu6H#ZA-z9;y~5#cn-Ts;{J{eGb2SPeES&jn=| zZ<+XC_o{?6{Rm=0-hA>7;zb;#z~$7I{7m=eM9ozy_vn>5nOE{dL=OYla*c(P8?V?i zv3FVGzjD>bDW`2dTzy4wbW-@Ci3vBl$vuDf!mlX1=t*2XG!E0lX!xC2u8BR|^i$76 zEU)o_qWq!RDV=vTU=#fe(bOFzJSTJp_UVx&Z}_&f{w%Q6G4YqY(QdnvlCb)AdE1pn_9Z*quc(~xeg~YXJ&+)x9u%iA zC0;CfJ?iWHhx&P*R9sc_9tF(E@*ledjXAd(pMdAWz}wXO0MpxF$h8~%QxP=1#vNdA z=WnN|O89;?F6z0Hfd|xdWd7VB9Dd0J3wzKK&ye&wAXKvTMbT4T? zNhkqo0%q=uEX3bYB*qb_;rx!L@-9>rC6ux8LEXvy zxO%X$WNHUJNq)V1;5T(r3peQVY>PEMhGjDV?T2u94q|&CJ)0L%RZ{LmKc#%Xv#8Xx zvbGPmoK>2d>z=lnFrDIK`3yk%HE=Nalx3m|VT=K^IST&qv|ND*c@q(zH$zrIv$$;Z z@?LXeGbAf9m6UuZYvMQiSfUaxj&WKSgT($Aty7YtUy8}{$oJh6XSoKcH@|(ke_jR| zEhc1crUKFi$N@tCsK?*ciqB!pzBZc{JnbTN%J{_KE!`w0?_pZdD_K8Gn@H!YM{np% zk6UF-oTmG;zJ4v9l7nIa)Y_R@>X8#fh!cRdP%O~~*}q0NrU*_;%2p^EPoD%8)DrJ(B}YI_u%>*w$gv93C_&mBOi z1CtWqCEo#%SHQo&aKM*K4*W+m|IO-EJ<))TJHX%H`2X)ajmcg_*8^E0_G+`3JaI|W zXgOS}(c}5<=5w<*Ul={yml`Y@ko4u}Y`iAP@Kuc`DiG`2u@hnq%GA&h7WdI&kM&q9 zj<9|`WC=ReG6HzK$8n{l$aeEjzQ-^nXo_8K4$T3xB;UWQRXOy2}ov7sT1=m)apkmTOqX;d6*zP7Ve>O0GD}>C>&3KjL{;teyzw<$7 zSE$jf^ssK_NL6uhl|#mRdfaWIdVnkT=*xL{#9>?^io3scHKJhAk-4vvqZZS? zGLS8a%$+KHn*o%1EVz-R-u$&cqL*>wa)aH@C~Vad%7t-yCVhUcJ-gKAe zy`H?j7Mp?!H2+MSz^8h7=!T5DmcrA2Xx#mVkf2e=f(kJY*Xqlmyq(OU3J|YwxRO_( znJoD3z$~Pb4PSg4?QK9PWcbsOSoq8lkie*mPT}pVj^d#57MMmN=k(qzoa(i4-zVTXw5+26y6v9thxAy5zg{XHDCtl#P*5|#}GM|{@&yoW|8FU z4)THH&FZ+?MiXVQ#0&|dYimsl3cl749hCko4bomsLE6K$&=1!LO;Jhp7*LE&(u;+~ zbeo28tf8U*r`wZXE8rfWgp7rPzD-gz;IOnhr(NmVZ1;-20r^4m4)8I^w+JEBP@hKb zf?d@i-#dC@B}d-VB*fO@nn}L=K9-H`^?3+VXe$rCg$V9FM!l$aC0J$=vP10cgC#E1 zsYl)MK0bJG{Y<5*K&+m4+`H^C55PZ+>$}%TV($zyGKK@nywSf#*)9WH!$-MGjoC%D^QD00QdM5}vC(UN7BOActKjvlEqD~?6MluS<>wX9aQzfgKFGj9>dA6U2Vq}Q zYiUFdh6xKEc!C|hh+GoRJ6awkBcGP>-7`FM!`|d(2~P^BwB?s}mU2`I44ut_u#6S9 zs-N(1DeD@Wb1t(FyfT-h4VnX;4&aQai4x|AS z^O=K@P(X?v3dD9CX*UmU;IC-VYE< zu3vp>qFmvLdQ059HBei85#eaeHszygGmIs5$XDnX+#|A)aK$bZj8Mrzdnf!&&k4Lt ziirIZC+7PHvhUUFcU&s7Y#O2;Z$N~1um3A?SyPQK%Y~O{QR~BO!1x)Z+b|s$U~ZeVIlqp6E5qR0smuj`_LLv{C&lN zFb3q{4F!D{id*YePLZvjt``Fj{ofjsz+Ktx|8*i6U#*0Vmsx|s)s|X+7>Vp6gZ_-( zaz+3J*fU!&dkNR$KbE+o5GAfOam1aYHF;1e%&i$Cq0N`V2tY3k^I)ZX{YpA7xuJFW zu!}r+Z3cLnjam7B+|8=?>tx=p^bQ$wb#O?7QV~6DHim<>y9}Ovb9(O1Pnf587n;aE3iG zd3WbyB!1>MhhR#yR|%w~m*L85Ak*Edc!y(gYK5of(s^ohd-y|r(^XMI+ApQ(k;x!z zNb%lrk5sk<@&r}V8${h2eyv#_qkesVWu=c#mq^6^&*vAfz0s`$w9%`&J&B&7=3oxC0e;~|8 zGf*0;FqZQ@us|#P7mLsBAJ>$wZ`UChlv?;%ui_P;48q$2J1-BP;dY57?3WLf3-{KTRx#5I@6evi#2FVIsls!u= z>MSo7^u;F(9DZ#WbCMHF4CDW1J=7YV|sc2&<|+qC~H?IU|tf zno}x|mVu^zda>VkE6m6^TbU)#Ue6=%gf_tf6|oNDh+LxxP=>LbOzvLIWhrC|@UF($ z#ujg0Fb!Q`x4z)R+0Nuxq$h--tX<_bCC}!=j$A|}%d!_l&QGT;220x>kzMDVqpZJD zdGL43Y*DK)rmftx%v!BDVJT(mwKVol0!hU6M?oW!bcxzcU7*ECES2b3 zLYp8fzyPJ=zESyC#GhzLMQq2mi%T3A@4Ys;sltzj^!d>L>FtmnfZ4dF&VG3Q@liKH zO6IwH$6S4f$F?Q%1t#{*OUAM2bGEsBRf zhIgCn_sBk;$`6N+|6X3QkkAxd_39bnzQ6L_K+?L@CQ!KV|Acwv7@(kL;u+3Oz7jhI2Gf?1OV3Z1m2!NJVLb} zOaaH+oUKZCtuh^T3Dxxq#J<)vru^y>S7jBeCL1{A7riUeP|hay=T$>nYy9fAPF7_l zmv^rgSKrAeOI_}0l`H;Sl7C|g>D8M%4fdIsHx?C}tNL4cWZOzpel3hy_^_;v2j$BT zA^z7})DxVjl2GlMsI}@YADRGwJq3(&eAo8+x;n6bGYPz=L^);P!an!&&LB@x8X1 zq@JT?tv5s!YXp#AuaI+@KEXv_Oh~{_|GZ2Y*DM)tY))P^qtHZ3QMi9lWcfEmFw`f* zCooLjk=qayweGsY*&V>pPDOpH@C#R zsGAFzwOo19Fg>1F+vK5H|J9rEESEg~pU{(s@iA3KkOa*H?P+0nXKi9@A)@iOb%oA% zf7qvlo)8foWo0jqH19ey^&DXyM;07jfb9fsy@Bcnw2sY20^v?J_cUo-@jm?{C;DQ2 z=oY_?F^$`S_xGX7|9bNOUrX@kzs;xqy`Oq4Zw?;=cFW?8*L;(Yvd2CpNafIQ5)QyLkyDjt@yJ8!|2Hd(RWwe##Bpbhi0z ztcD2c=)aj2Jjyq=Y72E(L^nWw8{l=d5pxT}#NFh%-V`TR_L?$awKuMOIKE)qsKWQtzcw8b$u+Jlj)&7<*FJ}Rx*^OZ zD*aE^Oai|;Wg%Mn$cPYwwdY~3k}PC~nseMWzR#^sO)Ppn=B_h0Uvu^7(O>#dCF84| zG7lglV(Nckqr8tz=Xf0ig&M<8;EuLFc7#a-(Ij$hwcqkXjXwj3B(VNy^$p!V3eZmJ zLpaC=N7v_&m^*r(s2A+JIVLt|iBy_^OkdN!|NTcu_t11Kebg?IFG*?W!!s0pnsheq zoNxf0RL$EG$T(=j>RsNVNu1QG=0hW#B~!sFu8%8(Ja2KOzqD$8b*T=R2;!Fs?igDbf$kAZwdn2X}dvqa1`0;u5BR<{n-lfSJTRfj;(KVx2&y!6gpFtf<-Mc z26l3KV;+kQ`Xn?__jK;bHMZ7%YlmK7@^30lFXRiV_0hIpkr`!}1PaE2oOndr(3Ccu zHut!SSxKn)*V%m?)nmrtaPmWo-Le29#H%>TPtv!KCY;}Ps_`^v#Jyk~>-nh`R)E)O zbTot*1iFH+jaK{1FNGsJOB z0I!4zc?X;*ZxTLT?M3D{HM6=qA@uc!x|LrO>D-?quPFHC?84DV>`-8NABHCu(aS-& z)DDe^_vEbEGq`%$!}gS)tfOy=R{4`az}NC*Q%0&5py%AzE(Wwf!S2*5>O-F&`Fj^( zm%M1xN((C1DBOH$a9;?a;QRD%^u)fo2M6U+P>k zTRB$$;*W*tz)>7O7+Htzv>RKZrOM$%Sax5^3l*W5do5AQQgyH=B5GaJ$EPHwa?+7b zx6b%-TTNoPnLnf0C34ad61}4s6H3s^NSkg2Dh=s*d8^!=eSaKtlZM+OQZ9(%aFX<+ z<&byH?qd$9lmQch56)H{^Jg8v=XGDu%~g^lg`v`JaStZO6?v`YY$lCP@k8XL`#DGg z%*%s@gJ=+Tm2`7ua3fcFxtlyz!%CiETG`64bsyZD#p|`Xw-h~AjjfVFnawDsZ$<&0 zX+{z;ZDhpLMpG{Ga=rz-X;m3PS-1v0rq8oVR2w3P>4uVd63EjDSVk$kp6>+Hw6np% z>Jm2`{eBP1gU(}u8XHYw#b3HRw5=BmNIHXv{X zDty6oRRwAJ@TW~Dgg1H0J2m?9hnm!op6gBk$9gag8i+hkh3{M9?UlnMn&&G$e~~Om z;BTlmv?aV0<&PcVj+f5v*;9<{QxPt}<)o-vlLW@B;!T1NN@nEkVb_czdC~AW(=1)W zDM%5IDi`&_TX1FQ1`=oeXFO4aTiRM4r@cRG$xUfoE*fyj z(HmU%E4I3w;+xh@%!8DTObioWAt86wY#9$Eq;G0SQ{f>%#X6EM%Jmpl?pc8c*34JJV`1uqQk8#x|@u!mb@u5-}sPVGu3 z?_YfqhAI@$sNRN^kiFFKEy5M!i#Pq;)H>Soywjc$D2y=^gw8SX7;Ol*eP%2AsIb^{FEX8Sqopb4{wenrjc!Sh#?9vZi9Y z6To`hJDbdZyH_OoN~^D$e5duJ2wm818A#~2iCz=&JT~K|s6?jfeV;cj17bf6D((Q3 zXdw`Ms9i)l$}_TE<6(G$ivLd7MrhG{%A?gFZLL=!*)v$k>M#Wg)Tx=4TQ3_SZaD8GCLl4#hvXq*A;m?f_!w!tE{gdaOTP zQSD^#(dvY>TV4hFj_=8APM5A;rUG(&hi|8XYmc}?M&C8BytH^tBklkdybzJNFktr{UKik@8uB4XN-|R4 zzb9Gyh*ZI9h6>vHiv}{?drMRodfX?wnw7g`CKJ!!AW(WZrAjzOhc|@#QPtUx|4Ath zJOTBZU4C9-#nR`4mnQWe)5%d`w1IcRi^Jp8yhUt7DhG!?UOdRx8APOeSUXr z7|bMp??Gn8Xd$Ga7utWDRiscg=e|!Va`iY?t+wq*!R$G$f+LHfn;-M!i~=77sEWkv zd|!$xfBt>G zzI;lMs6ye1ynDgtIhbuSgYn=``6>N@^IsF};8+2Y&LVd`CCer+Nr`!&_gE+&!ad>-rrg8n2c4JeAp_) zK(j0xs=dE4sMz5~4p|&gmBLW#m)YEF(M*?PLG>=jz%HrfZPwFr*^+)&JcoBC&&nWO zO4FNd@l4?4ecf4XC3TOeAleXd=zh=OqkVFB?t6l{=e z?ufsKTT%Kn`KR1asg~lUWji7B`5Ik2oo|I>hGtjHDgT+KE^bRrO@eM%ack5}t2#CQ z^4=rhK-yzpv2V{C=c#*6#J>W%T7*(2*!^C+ zbc#ZV2Yb_kI9rg_5tXMb!zL_XU2|Q$#tdaaChDix#^G~A1aT!#$N-R%gG?BZE`S^1 zl2Qoi>hVh}f`6%~&ouVB_6|#O?r&T;{3;RB)A-gxDoz?-_<{MDM4m!sm8A}r@B^U|NT(bSuK*=vxFHJHAgLON^<$rB_x!Gkyz56m_< z_Ij-OO(Ri?$p=i9{CM0Kn6cu3t_D^Z63&f&ZSEUUFxyVh zQDje7c8l0h{pgwX$Q+f>x5|My+CAouH3vO%_H1gAI)aU2B`)EJ=-DqUM^7Uu`bF?j zDkrPcW=Ok;f)z7Gmplx-t`p9XOi3j6unt=f5M(t-Fcl&jEkHdu$j&;0*6@WbJqdo< zI)5-d)-sjX9(R;$nZ5;izg)0op>})!jIQZF#i9DI^P}d&y}IZi35xL}4$cxQkH-S< zkM(hRC2zQ{Qx{j2{)KN#-y?7*pdDJE46?oNEN-OE7QuNDj zE$&H_q>3cr4nT4*A&o(Lzs9!QAB|kchAoelhiPw(at?Y}F>HMU8S&T-)4= zaAvLEz!$%in`&kQp123I{R+35vX`P+A_A|{NRNJD#cAQuH*KZ{WTa^Rr z;x%jxpW8U3t_QK|sB){AZaSuM*-$54G_sYH4l2z|{->7dpJ;LJ9E|NG{z!sumEM;v zq4S1yGlE|J1Z`x$CC7?p3`Kd`d`}khiTi9r`a;zDz0b6a<^<)R6q)b&Ri1Tb7DJy; zn^{=AsCh=}BsPB3ho>!@?5@ZTgjX`a4f{yQ*e|pZO%bPU$7K5k(2lA^d8PYfot2IJ z8_6bNnZXg{j^VO*S+<-pG z`5p7Ix2X)<0v=#Q&lTsLUo_eY6$F(x`HpOgxC7MwZUf=9-%dr0NOL{-)Z6Bb8!BPH zH1CuWs|W4s4<_CPlDW1ANM@Qp>uF5$uw;AMW1Ask^YS-0PD8wsw)jPJE(KsJ*p7qN zG(Zg58TO7n^+Cb6fX5L%vi`nBY5bE7*feqqMjvbd*{?<1e9WyCA}jK^8gK$ zzyAgs2FjQIIe0{BhE#*cGf< z*0Q2aXNY38I}*CJ#k+)#Sf{vkKctF(EQz0keBDbkmbZHm#67V-?*&qGIXvC*;=_Ef zlt=1~p;Pzng?3K1v69bVt!F>FN%cCWh6wjQ{hqElX?F`n#?AIG^B$S*)MGKJPdL9et}@!poI661 zt-w%sIICo>T?9$fv--HX^FwbZ_f*4Tg&Kp-Zd1+p#P9DcJv6bO+{9Omyd^L-4CGI5 z5Y3F|5*f&H+B5S|9o;4XTB?uMNLwzCoQ)LvBP+tTqN>Y>v$Yl;T>C2$EeZ>??lo+h zvTtif*cHGQSPnhR50f`^I-3dKrux*csFV*ru5S&GOsFH>094l82Pd=zL_#7*zODKc=1F`L(@mACE;}j$e$s4 zlhJIL{0<<)&58b*t(O_HTT?eNPf{H;&5k!!jTUPR;+Z(p6xW~S&}^MqpS60lK;`(( zE&hOrz_(HKeNyr=O{_KngGksR+WcC_Y0gjiRN8{Q!PJrpG-;~76_{xnO(b|Y_39hj z`Xh~|@Ml&eRM-8IV@{TJhH+?PMB8(O@@7tiCk2M7!0(@H?3Ct{ta(!;kyh?XBkTLn z>ftRy)%?bB#hn<9bGS5oHw zlnwjd9kgugAJkg!ZoXu%37JyEFQ^MNBq9EyrTI62lK8a;@Cx=u+pYZ*m0q&SIzY z0VDa|^0JAWQN#s1U|?V^WyDcAeqE810rPBsPO3Y59&?}I_9xZzALtL%X#_sc_7&NU zi-X1$1Q16B4;sMqF=b{B3Ow=rv)lS5^y8;N~hK z=SL;D^O0lclll4^uH}x~^0Ll!uxPWnl<}dU5Z6gof#%V$y}(enA(0M_ zJ)C5Psb16P>8xkvQZ`Ly25u;!Mv!BZR_hU^|s) z^?XZ*j7)PL=!{9BrG0~gjjFyN5pLJ#To3W2*sTy5%SHe7;HXXl$(zOsXD=g3h;kqF z{nw7!Pm?uzbx-y18=wQvaaeeKYgv9Sv-lwF`=>3P*g3ArW28R#Zh%}FFdPic`x`e6 zx&k|{^5IP?&5xwC9-0_CPCMLwKpVvy0tKp4!oi$Et+=-AgvlDpjc}2nf=p3DS$w142MrfItwX zHvs`f0qN2^p#+fLq&EpQROtx_gcg72oAsNy_bapRcfYx_)~q%22a83*A?NJ#a^Ah4 z{XEYmS|l@Qb^fTuBUajT=Zk#)=lC5XKy=FXs|Fg+Hss6fFbaDNMmN`jd5GrcgR)%3 zM}D}ttDW5E>Hqw;22icwtXiojvYWCju<8*~B`^K?>Pibu)aZ!fA5iYK`}PqPKeh8E zqcS0e&}>a8<#PZrZ0U z&W7qzx^N4DLd0D@Dl~KPZF8?`Xq@8K*e}Br4#&m3Ts=$MVBwTF>MIk5N47E`u@bn~ zR5V+Lu6xWMz@Ce0Gjf0x)d`Mf@1p>AV7+x)KPMpv^s5H;?6f5P^ymu1DK`gK}Q$ z^(jHG!fsHSYJ1V_g^=!9JzbO>bsNX7PmAPQ$o=vj%$WFg=)QiBWGJZ=DQ}Dm{wz(>3_p9$%-|@0jYK{ggb}C44+ir! z;WQo4Wn%37QBho{M18eh*lF@E++4?(l0w-5vfU$WWQAa`g1?i#XdI&FB+SX*pBdhRh-R z8>Tt$n|gLzl&hkZNO!7QD7+Ayj4(2%BA4l8T=V153(dH^NxNkIFzX@uZ+2o9YoI2= zX6D6KfYE>ex+MfYWnv@WJwHq=f7Zm>MApTe*}9uA;#`7_DaRUXd|sK}3hL}f39CHC zsjmd7oEVG;v%468eXY4CY6C^@|%CCe|w*bf{z4*+zW;v|!pesBSu|{Q*6lsH0%Ne8k_>P2?x; z#MP*Y9}Gd4J#~a7&3%UA8H;yK#?4V zJJCSCM}cx*i~we_;qE)5P{<0Ot)myISN3|Ov@$f$-X*h6MCoEf1Ea$R=liVa zQCgs!JC$bSt?U3eN>gV}^th@0QRxN`adJeWPEI%5SqRAh9lpXfVDT;1?>k-)nLeS8 z4UZ^VP;r6ehtKFot80744k*2P$Cf5K>TY?=V4;ay#T;1IPKnhXutR;%XS5O8&1ZYZ z8XR(_mhY3a+AE{ybeWfLc`Ds1Prwx5N0u2YmiG*G5!2#g<635x|@Tqx0Sh3m8!&jvPX}*%BV~oZ^gN>Rj<9fYgS(wjWb79!R`3o#j}5X&pYsaZvg$ilF#qjBQHJN1O}k4BPKVifHLIZE+n_{*T(nUysxZ}beiLZ!4>I&(0zWt4@Fr6hBbkiPm~1jlZ9OO zYT9g9q=BY#Mm>Dj6#U7d1e#?uD$V9_blLOHj7-f3e2vlo{UMvMh&Xm8e-Y+`^C~E- zvBDj6rj~dSndsM|@&tLqjeX)(`5KL#=WlGKD5O-$cIn-m!&Os}4X)_$E7I!9s^&@W z+HSQ!TcvTIe_cE@kyG^xz*K=ng?payOa;_vsEDPnZNiuLFR+i z#)ZRhk1mX%kX4hoirOpMqfVXt4zbpLAzbJkAMLPE8_@z8mx#fz${*zp!{hJ10oz;^ z=Jb28Fs86O$akB$>~{jeBHK=p)bwO9Y64iqw_?0VoEi2yspR`vQj!D9yO|v!Hl>`T zI3Vkmug_fVG{=9gnET$&`&p++`<=3y5+CWU_{_SN|5WMyuOcMJ=7$x34SiVY#kKO7 zLHRd2hHCfp%qI_$!03tE7*8qu6ASsRNRh9%{S)5~Yx+DV@45-v5iGw3iP7_NwF~+R zmFrRv8LQaiZmFH}PPXUDyhHtv;i%j$_??fzbn`h#u#^*k#dR=o8*d>+EVfoISKfo* zDM{MlvF4n&qaqePVw#g*buhI4< z%Ia7(TptS;J0Am~&79co{1cfz?pF;fDzV&vT4l|1Cefg`*uqj(cutRfHcmDrT-7d= zQf}FanB^;(x3Mmua@R4`o7hZD>ex6G%wv?L>zYs-{@mp>==t4(a!5km%6ds{3{2fD!Gt z4fe1Q+vb|^9x6}MOmQqL&P3hfH1PgZ`JS7fjinUL26#1+Vj$j+j_YPa=e_5AkLN-1 zwvf*Ri>2laudwm2YW&iJZfsTYt_e853nQonKqa88g)l+m_d7d` z&nIbJ7#Y1R`*}OMjb$W%u=4(-*2=V_7~^)h+OcN^wa>H?UfEgx#2Qrsef8 zc+Q)T$z`i8yD0{OknZ58g0Om~y9l!PD&*{6zwG%fGsTO}bu-~P-4vF(StBCFd~^i5 zXm$+Ewew5sW%M0Z84vjeYE$!&v=p(7k{LgRe-lT_JLEuZp6J*ZPJXSQ$a5aQbA;3y zr{*#3SZlt=L-1HY-XvpNv3BXLcN-(v*KivJ#o+U^waYAA!Co!)G(UK}Ns4tD{A%ih zmEs!6X+hEoJUGR!nbzAFy{K9e?-meq5>Q-bbv`TkyAAlViFOcw(6sMNq}8(~u1FG3@!QJTih8#f9sQ6}wG zd;*A8SdbK7w;7F1@OLIe_r-4`8s4$A+X(sHf$-cN$kAFZmZZKFN}p^_2YZ59lc}0- zt$?icf78xa8%!1Vqj|4M02IugD|Op{-$PR#ddzd+#Yz@;2ca@8hc`eEi9=5hDm6*NChJHNToY)iBU7HCqY zL2P%3f>lV-n+ALE=3jk%B%*Kw|1WYn-0r$SM%xqDI@AsICz74P5+Q$@t{jf~l zYUe)pesJ_$8u11RSt-UQAQZpq@zhi1zk2gsB<4%UGGz8=UJK9luA?_2-}QHd zpH+h%Srzu$fR@0r4^!HrUpWB0BW6xl*^kyQKQh?$oF3iKawCQkm3x{siT9Qf8ezjr z@--jTvcA&aqAGAv28i}3z2F)t&0B$9UsMu9Uy}+DXnrLRl0=)tcvHQ}6vVV97omPa z<1dV-0fo~?C+L`6)09B-lOtuus93{SV#QkbM4Ibk&*lN1MuNz1IIR`Ql-OM`dshDlE_17MM@<=wX&)@^@BS1Ui_&P}Fcyp_Pkq zkDLiq<}vTRYGep|UhPi&cfy9)@?FmGw%UkLfc$V{t_xDJ6=2t!J?Gk#k4%fH(F->{ zm6VF5m*5eJw7=yZ_okf)MAG^YCO8u;0A*60_&sFKCQkixzC`A0^H-~63vDOgUm)93 z?#54J@YbqO&tyxn#b>5S&)^Cho@Tg&)Q#%yHz-~(zwlrB|0D*R1FSy z<2lqJ&$Cu%Ixnmg$Yx=NcDE$wwZW|SAW|c=#7UgOY+ccL_mpK{yp3gTL374(kYZ2r z>N(i3YM;s$9(`?#d*x0P>Iy6VWcRWwl4VN!4!1VQLsyWn>+<=97%rmQ{4|DnJ0K`N zqf8*`cD$-M&l733Acgxe>b2JhQ9rCy$ita=t9pZ+01_!Qw>R?|mMO{`LiMY&lmF}q zt9vfrK5WM!%8G2RyLJ=W>+ncdgQGI#eMa6|i^c_Wp};cdPfh|VqJHZ!Y(c!fX|vV* z`~z~hQTxGPwDRr*8!gZ@+EFunn}R9)K0;%9X*z+lD1tkb-g7;#uf%l94PeQd*_>(g zKhE$Ue|+@l99DB|P=%3)L(y?EGtcW+TAbHH<96R z{SWAs2qOEbpngwZUPko|jx#i8xPlmvN_T&h{>)kZi-Rql&&`G8*i0TXRm^E?X4 z?Ut_=_c-Z}hIix*V=?mJ8C4K$rwm6U?|-4?V%!w850iy}ZRarm z-PNsOxafOT#s<1CAZc)w0drUtk6;WYpC*p@Z4pG)eu`(BsAGS)0Y)8a?me63OX8vR zzem8@H+Cag6tQu&Xt9M7BphgEgKGEOyL^VViA9<@i)SqFFOlOz+{i6gL5Q&s0q4Gth7Jh^6Twc@2 z1Ffqsc;22x^6DvRHg>f^6(nX4wZI;H{EWHuWvxYwca;(Kz@CWY0D_iwO^c4KPV34F zxFLlrBeNAo^|(9eGTN0tAl>ntQF->Vt$>Vfq{MK6_Qw_5L0bMT{aRfsCGy#2TGx!^ zjzwO;rO0RH%6eLqR?tlli#Vz2Dxa~;v%T-skFQL z{CmNoJBz_*&wOzjsP33zy~|uC_)j_(YCl`tR-u+@fNs8wjlKJzpDWOTp5TZ$w#{jY z?NSGmU;nwx6le1!Ssl|d627}UzQ3N1x)@3N(cDx^y7r{R{vP#_ggxio!*)0r*NkR? zIV}5o59$c9KU;Sf-RBBBHmj|V)>t>uv}=fBU-cGZ@o3=l%_J>H0Xq)uV7nrn7}5tI z*ICAqbuDsDA_;Q0SPSZke~jiiYR6eUjpjkjdDdCFTUADIalV&f$_3Pg4s#b&EH>?a z8#}?bnx?)^+fF%Rb&gwxO2;g^5>u;esFz4W>uer=(hxtf&y&H~R(rSz}BsNkbCTsPHfA}p?!2F#`UCikf*prPb zo3V>gD^A#3X(!mO=}NIofvZ`_-5(s&DmBi}BDe=%Qh8k{!hixR%nqYAr=F}_Gmg~p zaTP!Lti&T>`BZyPLaT96=>-Ar9y1}xwk19qglks4O1pgShRN#on1|Z_zzrdJ&>4zq z4gO_|&f=wR)c519y4374=)(cX_`NPc`S{LqL32Lzt^SPOJGbLK1x3zz*Mn?T(dyQ0 z=kwR?mN>v(e zQ6*w@Z+HfC0w7&)M*v|a;kI#joLD(glOU@YpzlPPS2iJuHiZ^Xr$ zVmHX$6`vX?aY|SO54Q4PMgX{${!)IdPL%(mQ$cj>)$bs6<4IPHicUZ&MS;bb^vK}(#&-Air6kdhBzwG|Wny{ha716S$R1x~jN|t~(auDH zk1B$Mwpkx9*69g0mndOmCAdIz{>Z!Ih-%}w^0G4bT?hXs^@oxl*Szhml3rr;89BvN zzAXD^rd>RO7C^2;V{|9iN6}N_c(yql2XS3Ps%h6~OxMw;bOwjGE=-j^>2*`soQmui zu)v3{xd4MVy}MYq;dJlLvh9HL?Q`AA^p>Hp;rD6@4t5(w@k~d$7iMHie?ZNNEPk^3 zk5u$xdKB*9{8ud4N)piv!8Y|IxAw;G#pPTb=BCuMQ+Qt~N_lvoNaY#CgjZ z&M1`-Ib+Q?A+NHc{YdiZczN9At3;dIyopOXb^4J4a#Oj91bwt>?Z!_l#y{v2XF=!M zS%-_ToShu}<8iT-v*7g91b>LXTt|m6qBeOrwiMF%e)i3J#@8s)MVaL@#i%w1H?J;h zVhl&5bd2zwOIb9V6{~u<*_dNXJ#s=Umpk|84w+2mFDo;913@84o2O$+95l-bAx-fy ztKt;Uq?O^`r;Rm}fH**zb8l|J(JbA9d5`C%mv{7jyDcd0+qIAzx|&7HHgAIO;e2v0 z<=uo19)C8$Al@CjQM67@1Z7&3l(amwhY8)d7gm$ziLUMsd987N^S@r)|Bnm<{I^%2kAs@$q;Mj6U3A>W3pc0&eepT zC+it7;%Jtg-Xf_p7_T<<+7oc=|7&SrEzAZJztd$c1*ZpdJj61+tz+@VdC!H7p(obk zp*cxr)Rj$jAHyl+zZ9_$Ipu?(2?=<4pfrSCUxCo#G;85B?dU79O(SH()FsuoU#W?u zG*Stqfib{Tfcy@Ly?B9}ovyWxt<@DQSexC`a_C&gd2fVIRxJKO^SE^2gW8KZPp9m{ zPekAB68*%|Szec_JtlH`YdxgIaqmL;(zzLDPzvSfVE5|eV6L0lFaO#w4KrrjtzQu& zFTTMavtcW9xNvR=X>*~X#JQD=`p5;Dm^`#h4=N}ua}Kc6E{r@K9H?DeP)RDaNpHG4fw!dw;x?{pJF& zIk*EeB=wVZCTp{5lo2wtdD{1mw6$)dY?EZ4Rm-4nhxPX{o7mLebXkuyF*sS)LT=zMi>*`a^w7h3AG>3|sL>yAb7PBO@ zqZ7R??2|q)Foojt3Tt?5TXw69y7g7DL8p;5)m7@AJWmi>`vaC}MnK7m-N1ZOJmZ8y zVY}b!$P;PB^vFY>66mI-ouuQ|OD@?En8}AC<_0a(g_$Ir#%B3ug&LhI;9L5a8=4>A znJ5Y+4r>c4G&^)TLC9WD9*rJ!quJUL&%SLjFEM$ehz8;6RUu58?+ft-j}?CEGq9fD zc{`8IsY{Qx$b|1vpS_j}H0Pqcx-k0kK&PT^2{V39(LJ3~Xo`b(HKn$FQ~jnPrEPKj z!idUFipH{6W|NfdPD5I8o$8?cA)CtRLC2~@pMVL;JKQrqMaREkjM#k zTbYZg6!~U<`O2~sM(lyp*}D*qItW%)bF%f8Ic`P^sJKnX%gb^b5uxK#VL#sV5j=&| z=3et?KiTbc7otxb_zBoZaZJ}<-Kh-{HlMD`P}BaoI{M0O)wK`bD;T|%XU7%xOcpu= z|5O(nRauXIw!;akof~-@px(KoqxRA*zu(D|VKM)jRZL^qrrD{L>Y+#pZ}ih>87I#< zM64|?@Witj<8xe4l?`p#gQ=4@eRM7Q{d288b@6=V&icFWr45IR^oO4;-9X`#q(p@I zNE{Z>uem1hg_nDaUU$S#V{f7oD$V-o)y!`5B0lkaW7GQ(pFP~+7n+lBDdqUaNy2=G zRi+KSpsNiioE|9})flC#wl*?OABoL4+}ZeYccJCpkw;`oD`1@Vu3%sM z1~k-laIi&G1bv}wWm&>vEgX6`YV$z@*?KB1;2D>8(G<~TQ!_LZml~wf6)ci;(S?=C zM7ig?74{Ozs10BtxB1zJko_XyP1v%;HIdh;yUqldkdg<7AeTq@2t8)zPVn$}%z&^|>`)A+h6!T! zrqdu^^hG|<(=v$DE74bFpQawiPtQyG-*fPLHNPa;I5K3_{cjT&{`=&G|NlF~n^m2F z&CVt*EAvtak5<)+zD7II3C}oUCmxp%j4qkCIX-MVC(|dE1mppRrhh=0j5eoxKyaEA z(Jro>M;(LstF}KNCQBb%mrQ;u@vd{mShpW>#blxU6mK{`L@(SM_R}XWfOkwzD{h9R zU0uNOVoi#KxPgnV^miC5b@!-S7QIQOl&^_>73$V~=3s(S5e4hZdc|U&@k_q6`wbASfv|_TNyc6hVAB!i7_9O%` z%zO5S%(3L!625r*_UGHhhBg$FcIJ^PCSy1K`E(2Vil@sMm5RtWo2&a#gX+DN&GJIu z9Kw$-D<^khi46G*p3;A*f=eufE^^*n{HeLpYyo^1^D2*-RBMGQi0A-%Ik?-EUs zgSV?IEoH9BtSBk;e_LyaW{ToXq}gywEV+Aq4*ZJBFw8DNNzVm0TPGep;c6|`Fd;2! zJJai1wgT9T*FKCrnb8kxU=2{N?ml4-0bGod9?*v;+X<&SeV}NgbH>w7mn+b@nj5uI zLw?8c^pKyIEoRFg#kh{VU2!S1_P14U_}0hO3qF^qX3w6drYil<3Y`B})2V+gUHadU zKMMcVzlDjNrC+!B86$v#Rips^kLDrrp?H+`;GO00eODHHV6u*i($WQ*Y*NKkv3V;l~C02{inkF?Syvybr3f?$_6`bMy3pc!}0ZSkCPq zIzro_2y&Te9v&|8)iRJF;GkZ{fzl{HZocxFJteIpLYO=bkx95MIKzHMbTr)}fL6Z@ zF9%TFr9U7?^A*>6oWUOucS+m%DX{IPhCI^xFE(8Mi|O(|`}HrIGy7Q!VavmoV>HBk z7L4bf#;+I3=l5M-|g5zUKV34HB#n!=0f4CUlzWSei0^v}K|U^7OnXCfAh~%yb@y zNaiv^G^xktmKMmO?4vC282b>tT|3w7HJb4GB(+3>>X%&DYGs>{8eF0s^zrl}pD{^~ zr4_~clgT|kaUynre&xD_}U`wbuBkb%o zqVrb>-n-}-Z*{!a<8@?`eR&txFCK#w&eJRfo4hq|Xlj{ow;%s~5micbf=D*kz`Kw0 zs6ko2`}P^L2$X>WG8hh})Akrvtz^+*J#{(YMUMLMOKHr6F1C9if6`B)UjYjnH-EC| zu1{ax(RVSBJkT0!!%JR1#yZ7I9T06TVdB83AD%l=-(1pU{OIQ7Q<)g=<+hW2VskCq z{86A%l@h)&d*tyjtrsAj<+dwQ!>pv59$=;roo;enJe|*Gf56B2@e`WYta$snS@w+f zQL^gmVI=LJzAN~Ov|f)DdSsd#x4yZX#d*gNPhfSM&<^YNrRcnt}<`d zYt?my-_PYH`(%zVtfCR0ARdrc=63E0@=5e}Bs#ud zmQ+O_cJhLPBvm~WZ@@f#R@=xIEnQgS%J79w0n=#)kMk_Io|$XVaQ3I8&hb*!B1y0<0-_CW;(XK8Zn#_~0%TuBa3B79bn02ehi2@7hj}zX3p`TlOE& z2r2wv$0QWq+1N@C`~;^49P7N{mo5P1K(-_6>|llSk}}~BD9$)@4)E1cFu@Z8UC%G@ zStO8Rs0d}@0L8^Z0_{@rIpoIuEdhx9-pp6(Cm)NWf#c)jg!&Ix!{ z{#{HS)yv{x6_x(QBtNkwXvIGu zUxmD!R-lynyLbVrv%kKaIXn2~01(YTpbLHc5IXCe#R$0RaQtqNrYa2a55lGRH`i0& z11thyb9@81pk-fu?o|9OQ3PcCe?V71&y%9hAb%IHzh5|RaeqKr!azI$8zz+t*>LzT z2VmKf0;g03Sd1Pn{cXtp!FBz=b?|@RIw)S+Wy)Rctm*)sd0BH)3!I;<`0Z+jmGWg4aM#-->? zmY3DMuIhW)r%s|Y;#FuvB+&Z!OEN>}4R%ienpIo%~ z?r9F}e!c7GKB+wwt7Nle>kHMmsM`AaX4iZ6=8L!Y2S0l}|FkfR(q#TpPn_!<%rOCz zF02brb7F}5toNutoF+_SNO(y2%3PB@p_z3oC*%P=PJ8*+Z;L%{n4E2s+evIDXJb9- zp?2Zd4}4Xe^Vj?<6}NJY)1r}dUvaDII^x#jWp&ylYi4%QXvuYrHlNXBHTF*$Jda#o zM}rQnyiQy&?#(N3ax0zOtwHo2nbxG#FK^X4GLDO)JqNJLHJPm6eiS`6!>=;G{yyJq zZzIGd46sIo{hkX;&~am7>LbbNE3&CUd&pO^gjmNkR>h|8{`yL(wTc#h>yCWUD)hP2 z+&hz-GU=-2E62-3CR?pQ7KUK`HFv@grIid|+as9=%cNUoa#jZ^jJc2Mf)Pta1-~h<*z!#f*1N6LAfcgjL)~t$3Uuv<=CW6}+uv00 z|6`8gzk3~4hZ(^Gd+5sP)fylrRW3F}oI&XYJ=UISngfCYOLs|CcM|k_iRJ79Zd_FX32x-EtO- z%_8pIh+pAn@fyt&IiJJJeioZI0OU&f^}=MxXB&R=4`}W4rSkdK()oj(BiWCuK^f|M zn|b_rfpN+Oy}DJALh+8Z`{|Q+G4IBWU1)Ry2OU#}NARpXE1Xy4z^Q}E+Hea2y}O%O z^=<&xR?7#MZx`Sf*%YPecCqT=i@6V;5NAstQ3Mw50?7wYebpb(i=#iFT-sLGa7kD% z&6k&3#$Ce(5TkYe%!FL0!#LJtA6mDpr_i*nbG^6T+GTc@lcK*{Bz_W#PEEX19lUOk zJXu5il~R)nq%)oEz3APILhpWelRs)N z_gW2qQ{v(qOf&U6gYQy#k!@yqT1-kKQ!444A>3Ib;fGMT2Fg2w5D+K}_TA@+!zC13 z!L%Ye0y1XaTxtg{e`eQ$?3LX-?6g1C0!$Qy&C{0T?+y6J77fySl+y8>JD-dM_T}xZ)^wiPTfXe#UsR*I$gg)W5MZeYd`*gUYgaB@K%OJH+M(O=I^& zOiA~7R+vv4o$Eu6BEDWhqnOB!GKDm9CySXm+ZbwW3^Q`RsJta>2DeXPm zPMyX|L~{$Gu3=I@X4+FnsKio>$N#BkXs{zqxA3x8z04zmiug9P(dDxy!177DuKOfo z^#$spy%@FS=HB$qux#L`I{(+1*fQD(#J!%X8)0ZA<&Yl>){U5@&WG)|mnGmV67k*N z2UNJyd6)V$)KeW_V;!Nx`2nLEsh^EWBd|}eKG3?q_#8q!Sr_BF$}V=)lb#l4`{}dU z#P16$-4#xeFjFz!hIoF8(WL1ba!R$a%$!!`zZf7yYv$k(qHx#Mv7Bw=nKa`jSF;Rj zu)Xm!=^HIRDFa1^EC%u+7kWv=Y1Sne&JG!rdd~=(>qE{r$Kuy<<`hX$-J2)rM#a6)fzQOoq)j^1NyEnta}LM)d^uATawn=CA6c8@WsCF?jJqywh=07eRC%!g3MWp4#rKC?vD z??Hn2)5mL+tgd&2nEg=qqRoU1PC*mUtrft4)FZS7yZhqVrMCNYoIfqNZ4T~CQyMB9 zq{f$GzRzoNvr8LaDZKxkKSUue=}EY3lA2N6V@JpPAj-V-?--_pTB;~K)%c|$I!;yE zir6q_xDNTmp0ZKsbvfZ3BI@TMT%ja4kcbt=m{ltJ;31UkJE=b)s*3PS)fH`R9Y*}{ zqKb5D3{j-Q>?i80$uNgFGrc8eOyJB%XiW$H4kkWgRq@7-0?FI1lcwnkNXf7B_{6U* z_^jMIR9{+>Xib!&KbZ?c@K`f4+N zpMNs9sW$0cdyfn(Ot0^cWr`R%baYOc3FzgT<3AAnuFzV3gEN7Hr~wlZ12eeM#y%W{ zmK!Xga9mj=wU84>4gQJ~h(>JtzV zo$P4M0xvg`x5FPh-NR;FYLag$U1M^e!nV;|(&64<=DsW3#Z0wkKvo{fS!164-0VE5 zj$$*YzF8#FJ{vRSMPEvWO?C-6R0Rb+T2_qBq{Af!`Mk`vUg#~FQ{zw5nW`NulfXRD zCCVZDwwjnb!q$;8!ZN}zXOaLGFS^tP$YWUys^}Jr&UAr@-#a*p>AIV9mezx>UtHsj z@O-b9L;J&$-&7UhOUlvt*IEc6CdsP#ohuZklU$S;CZzfZ?0urqxI!90gvCmO%;5Dya8Y&0YabF#QicjMP)~>mi zFwEYL4S>tfE#Y3v-B0!XY#2xWG$L37nlZEfQ~TOuP|+{f@gn2Ssm|u-aiQ_IQ@O1_ zl+zoTnA|g)8}#(N-ASZjpQK62Ku?~e_u{&G!M03OYnEG(gS?-ypMl8e2%WnoO^DDy zU?_=nSVn~##aYT;khYY8DtFj_oA~ma-OI8XvzXvt>|z+>N~ZB+;>Y**(GR~6q<`z~ z|JH3)rKNReK)0U>K+6;V+Yt;Z$}_KE+WDQ|wh-602W;E<^p)gHij{Fy};KTa<7 zx=q@b(UF}x9iAQf;6lf&>iD88Ao=W=Zvx;Fr;aQfZ^WhWv;rA!7O9HPVquFT?!@w5 z`w_YKyKhxflIIFTJQVAhnQ~+m2;ap5ZKt+)e5&HPgw_>t*V8Pq!3Mp1-7oKA!ZZw% zpBZQtuI<95Jj7`?%_?YLU`#I^v}y~5wIsfLF|P?I*gby4bYVP!4_hDxh9d!4URZ#5 zyIh|b>@lng9N-qk*eLGc{J!dJCRE*E&)N_u>p1ahqAGY`F0D_+(ZpM?SHV1r9pfd> z8ya0&pW-Kns(&!tqA>sPt6Nia+-k&evQGFBM~}te#W#^xXqKdvjmNi~C1X>03HrZD z+0cNk`RW48cnoW%+!BAdNq^XqAO_Lq74h8XTAeqM#olC0c!sIZm(DwFvd;P@b!srz zF(GB&dAnOY^=r*_Uv>f>?zRXX#V*vE`AK0e{>VI{Q+@B=!k`_+RBiY&Ni6rLYkfRI zfP1{HfyQsn&d|dZ!&CE=x?|O!6ex)4u7eg*%@s31t#%&) zxvQYdOqVJo?3&IVUxmK9xxsR2=zD_7i0jFjNnXkuD-tP3OUP6TBvKPVxdb;t9@Uq~ z-EugzJ^k=gJ=2Y9J5N&oxxkHL&1ma}!NcN(E|yc_<}gYP*!$oOBf^=+9O6MX%rGw^t@C5Yzlq zIZe~7XqW**wUT2>8NOph%5!b=<>SV=V2L~rH9%fLVJ3}9}H)NN5nImimQ-od2gH-o6n*3z++=u9Tz9$iU9yEsHUq~>AAVGm{3@Z=wd#WG>wOcaH zLHTpmR%{f~izj4*b3yO-6ksp<8y${P7~Oe|uO|?cSZmhF%&_VyT5<4L`P*9f9N{~! zvNl6>=l!n-52Y>!!zE)k$&@%MRQ-pmiquP><#nePbSRUa~laH%{D-J{<1>AcsYId~Iv z93b574X4G0I&s-ww9tsZak;5yss`1*aSN=9;{^kX>ryp=T+ zqM3=4SR4eC4YT+raw}QzR1HJFQat>NC;ZvO2|y@FbX|d5C8THJ-&_x3vUwQX&3Pya z)A<9cIs#ziQLc)Ih>I!Ci@-zmpX+Uhw|@jV{{d}1Q;5ll79LZ${~tAA{%7z1Gc9XQ zJn0-Ta@Gt}f^P>(gnZf=ht)XIi4|CS31AQm^e>Xzua{?MTWEU_g@On35{u>C@Ai4# z&TM3spH|Pv`H#C=d;q~SVm1l+KN{YOW z*83^Vw#K#{Z~qeV?U!2O4 zcueyFLMT)@s_~6yMt%pZ>+bE=)ST!q#-b~B%qT$XzvCXoH&JD3dAsw0)@hS=3F^uM zQsFfMbTNvzTNxrcQPOF15b41WHHr4V@eBx1zv5>u`Q5j8s{OIF4aQF%wQkPJK*k2C!o<;avgX*$52L`ub|18ku66?Lj?6RZx@=_l%8ap->@^1`V_QFUByk*m zC?xwWL5Sq<7KU0cvF8q)>)TBM<;~~Yb|Q#R3xjRyGh@H!CREyMMOBQFdpIbY14X^_ zPNp#mG15I>+h)I#N2fCQG8Ej`6c*~372d!cn z*vpYWIeF~KkLkn|=J^tVmOvc_P84Htv7jhJ>G6)wsa(Ku%WUCE(AGnDh)H1CL$j-G ze1@n!?9|B%=!hCO6~-!}1*-B%r)E<5D5n5&((}t(kJrNSCCclPX_}-JVUSef&^X z+V0O;#I04iKOp~BWZ|=9tK@c*gs<8wtEFw>V#A1&4di^gsr44;#$E!Mj@-FbWYq==^D>E~ff`AJ5F^b%d4Ti7FtGmS+a_$5w^T z!>dVtbQVkpaB@HK81`m}M8_xvE1@+jm@2L27}EW)WGN zQW)b+M4b4n47V3vEys90A#j(KBmi)DhE3ZlaoUwVS7CU2aM0z5I$5}>17G0668_rZ z-WpH>da`H#gU$x=pba^I$^HT1#o<3`M}QH>vnFG~A{a-&Nm0~$FQDU*TE7DwiMI#?%w6jW)=gC64#Q4A8i%K#Vk{pbjXalrcR%Pin{Hys%oIaEQAuNDRIzF4hk2z z9exr3r*Gk0|A1iD08)&tghn^q(H%{Kje{#>_ME(a@1BabZ;o{u#fv3~SLTwcz4k+b zyEUZ;rhokw$2kK2(QUu)px{gWa9r`sD4r50+i86I9-L0j_g0r^=+pL0{gP ztr2l|g#T9W=0j9BYG_m<23VcRi_;O?GbbP_hl53Th3?UuQ<6sIr zWTd@LOpYzAVPm^lm{OQHP=H6m4+?;G@8}qeCl?oh-k2!0t4o=&lSl=$7Y`Js&~QL! zS*LhKtibvQw8WGJw7+-Zs4V>3EDHER4Df`sd8AI9_HtXO)?gf|uc`XKca#XX?@W2cG|rOe0+t?P69qidmpgzeGM;3`~&)W z&WU3KZkt}NV8s_;hx?lg<@~#|Dpx!^7H`Ir{2z3*u-p^ORYF8|rkvoKO|6zwx@KV# znD_OyeJ5WL-6?$u=uOb_O^n`u5SrZo5gE?yHTW-u2>gvdpnoo^|C2)(-H?*Gvr9qs zOPW=oM|`bg?A0Ql9`w)O@bACe(QWm@_g?)4hIxRQ!Q+5&Ppd|Mx9}7i0ItMj>j91% zU#^aS`wPAd0kRW?*qr}&@c$J7`+Lal+25^^ZMY-VyG1^nDw>nV3|D^e6ghPq6ufE* zmP$*^zGk{Y1pAf8-Z%dOqb{9Ln*!5$ASjh`YPB06(J?x3_{xFBwrDa#U3Y-i?V=3P zWHn+3WU(`f^8W}O`e$BKOdt81q34``g9d`G@P8+-tXuz^A?Gc||87Rpzu{B=%o+Tj z^gI7jG_tX|-F~es6PI%2tUrR8D*wOszB;O{x6cz=T8b5lJG8jFTMI=~pin$WDNYE1 z770#EaVuV+K#LTI0tqgqxVr@p?g<+7x0%`5bKaeuJ-hqPJLk;VGymN@xhMDL$<4jr z@AI)KPrHdT(kB|&hqa3U-f+cFL&uaQ6J)5_>w!i)2GgkGk$*j(qnOOqmbzGfJL{mz z^4jv%TgA!SG}XrN!RUjSODR!4JBt)5Ls3PGapp2%T$PoP$ch`)LQEXN8Ro{=A%FLv zaCWbc(HW8pgfgWgI7}?Yoj5}?I1C5b--`ZX4!2Z5>Jot3h?{i_omq(eWq!7VRk{5F z$*P#QWaSDI4|qf}3Kp%qnz9p0;Zl2pY0v3#)?1(YzpO)%w5CS?TmofuS9+f_iD^tU zS1C*`0sEK5V~V1xde~~3aPF<8@)pK7-sX$P6RQ;WtSK<)p#lpFhpZV>y}`stlOrzS z7vlOa_v13hpU*u_8(^>GYl0x_KAz=}SwW3E1L^!Ikh;WHn%-bgiChoJhw+yt-l%*; z*_fRzaW$U5I4FfR!JI21kQ{T=<5USvGK=m&1VwRJa0&>i)wE{#N#|C#0jJ5A#2;<^ zbcZE8B;#F?8Gep+y(b79wWLII#Y!9zn>!=y(@SS}`+k}rv;(sPzccqU)P6yI_iVb90joXB51_`xW z1ihZ{H=C$U0~LW5m1VI!n$;!O+h4&8DIzeNUq1egA}ZLbwLM3sK^pLT&^g4_O{`A<@Wk z7HsZi-u`^YzU)N<}?dW;+}| z$#Qh&Z&|9iOrIj?OvkyGZ%XBS*`fX9s>z{1tJQLzYkRa{$RIvsxcQhD&=%eL=ogwD zOYuOvMnfvpJ*kp*#+TJ<@{e=n^(eWXX4xu#zdh)n8^Q)6@82Si@KuqNsM@U6o;oxn zoOR5TPr<>ssX<%NAoW~5RfhSY-|Xxzc~zV)Yhn(RKv4(sr;X5GuN0(2BTw?P{ijlx z9a=3G>{ID%tlv|_Zqz6lV~UJ@XO}*!9%}Q<$JMmeAN-xvZR}1F3cPzV2ZvBNBdk8# z(05nncQ$7KV0>q7?I!_C{4@`J#v;Z(hpm{>;l0-yExQDrLJYA(7<@~Ud8oFp60 z(Yf?AEI^_e5R|7@dvOJu8U2-k;NthvD&}|j%JDkvQV~)hFZLaQ0e1KrMcdFM*!@JP zI^bE_XjV&)K8qa$Na8RiB`pPuV-bY^BNLP_1AWn1NqECI_QnJq9^tV}yrciBcEG2^ zyzB{`iHHGlCrKwCqaXbaXe(!)8Em;UvvQL`Ql54GtBuU#1OzEEZ)s_cKL<7ACt#C( z{XRnqaQs+42C_rnAj4u1bs;yJ1<;&Vro=+t`Ag~_=rwRSXn#n*eIzY^tl$h`fKF&( zb;C_r-e&38kewy&^+f4`FXLKOT>UcF!+Ge+c+yT?N(`4SrX4w19j$?>DZ}KwL{0zr zzT@5_?`!L_^8h|6B-g_4l9D2-B$ooPUcEy`GlPIGa7y01pis zwK;}d%bWC1;C;#Ksn!)<9jmi5squ_fq7j(cUqxb>%o_D*Cp1fB*`cfWR!vP*KM(ta z>n5qKbtLCS(@OT6~0M?*j2N-dzmHabqMvR!`5F$?wfiKBt-RknO%4A$Nc3 z02ygjLT5x-b189@r~eL89gU6VZsqsa7!wbQK!k_DTJT?tAGz2}cwEbTTO6#jO{a(2 z4q7$5`i|(SDeA@E5IZ1ImSVTL5=wYZ?wHoK-vFtOA+B!v&lyzkyoF^8EAiqg#VO+c zFE7EfUugL4pKIJF#yzv3!X795#uE+cQhIQzpucQB?YVu>Y*=Z62{%Rs#D<@jrFzZO zy#`8@(Ga4NZx{ShRQe4_3gR@ctX3VO#E(l&3 zXQzIcGXVJ@R;7{Km>+^?`;je%G0xX$iW0XQTDr3QsoA}F*ZT_lTkxNOu$d7S%ohh* z7J^`ED+xA_;pur!Qtb0{j7U@ z#tN2!l+$b-!%Lk>LI5ZZc(wY7@?uKK)ZAWd{*s8FTU#B5f5-T#Xa2#aXIe5ZiHA)f z05WA#*b3p;J~Z{^^2at}sWpL&Q#0=SpQZxwFhpjk*6`K&91^pN_#Z>(*euA!rTZXG zS~0fn{tmZdD3V_%v$Q_L0N6{&OSWA>DFK@Emdf> za=+&Lb{oMd3o)j8dg)rPy0LB27W~*Rnh46-(vXORvL0tK^uA$@;d2|H-%x+C-}pG> zCkCimHFoO95Fn;i6)JGxa$xhMi`ZGXs6-kEH-@kc8{zslY|H=1?Z20K(cfl!bSaS& z5_Hb#xO}BT;tJhsufptg(p!Yp1U*5Ox%F{$hjDNtlGlr3?QvpJyqD<_8y4x__bBl0 z*Ty++;&tz_GBV}U2SA0oh31fIsMtP?936H2%xXextXE zE=Kk|F^zWHZ7lo(r_)t_$!MKI;wuGs)_L|Azwe~kN5imVva)uY{)N$*>gWv_BJ>lj4Diu(m{-_7T!NUv7sz#^PY`|x@&=wr6jOOeFyC-rfT_seseo%hbaj#og$ zfl8#?7lBV3rw_z;PNzN@MB1mG%SEn*ruRP5UmEvWAK{IvH*zqPYGy&7&v!0K*P#N2 z!#xY2A2}xlDi79E*a4>HHZ_^JGm+F9mERLgY;eA`n^56k0W)kV+=k$}TWG7xj4(cG*1`OiReEPHI^8Okc&NeXq&j14k+$_%u*$F*k;JyVUQdJN}%L z7CYA^Exk-5a;;tR$!0LWOj5>ul1>>^){o;=g~ME@>fh&iZLNzGV76X4V9=O^ms-40 z`Gmx+1TF!~D}MN#yQi0%PC4k8m8Cx=;tP3(@ zbjYXO>y4LvN?xlXnmBg;wopz7H>Xnxb~f_KcDnpVZ^dts{6wc_;wTWTwgdvX z0|?7mYor6T4vuq6pEToW;5X@+2GUM#%-kpy?ur3>oCGHMc)}Qx>t7@!)EZn`XsiqG zKH4!${y$i`zGtC2l8A=f+m*ayi87TKdM=pb!2Y7moqdpvLImf)q=QBv?%p)4xDn2# zEoU*?U#_b4twh3)FY94=rPC7UIC9b>bJmlA0PyHgU_n;Ih&8$t7Kj^1(Dzb zns(OFyX=8IGBu9ZMe;wsS65<>fc9?9NUV_UFms}qvI|!G#DQ629n}`I&J6w{5<`7q zgH&OgwD}r|&*$QJ2#XesOtns>%L~jjtt*^G;c3z3Hw2zYI`*$U)IZMq44kI-aNY6_ zI7#-nPaoKj1dCW6om)r^uPI0Y6^9XWGNygxmzT=kl_`r)zP1%FV{@lFY1FAHsllO!PDQu<1br zEY;nTt^APr+)M3tOVL^lk9t>wOQwuO|IdYyUxYlbzXg8SR{hw!2GDd{)T+H~OrYOO zR}tQixHfD;1EX6{OG)=J{bg%(b3D?^{W}&{%R1+NOe_fUSZ=M?P44=ab4@}35Muj^ zGwK9u;Y6Ky$a2roOMmy*4xr>xD&E0cIBmbw#zV4C7<>(QG+E`c5%$Q1{&FedmvBo1C-GPWC|nVNb699XM9BFSpaWi}3MQP>VuW z29G=cg)^W143I7%l^ zA|`juiazX@1i_|MtSuOSo?61lW}Q)K?oY&V`^Qt?y4344wh`2PA+)X%T)wM3SV{PP z9aA||1JJo%9=)=Ry4=znvqdeXuRcY-S!2k0wx$RQ`fHcdKq(tN@i8e32qG4}E{65J|q*_pB z8j4#2=lwwCiQr0|RmN`Z{GHvKBM@R{0#KV6*b)z!kl>c^qlE}Gk36$(ke|)w>~`<3 zCsul*mR9_t%<251wp#@vi?1um75OVb@3);|=Y1_r-60XC5Sp5&EFqI!8N0 zK^fPv+sAt$J?%o!D<@l~fsZ~o@NGFj-NH_urLYJ2^~UCW1fy0SmT>!3sJW~4_9DaX z*jKy09m}s5T>9pd0;?`6WG}3_Y%v>i@&g*@!VwLhKWIu&uQpx^P)zNCmQ_nzlB!Op z3@1FfB|v%~z?(k6C8ec5Xi3AUy8abLJDtbE>TIkbmUOov$dnw@X-NLGP8%4>^jJD| zdUM6>YdSwUs)tODS*&#nOFeIwrz(+U3G>882U!eIm))_2Eh&hZB`OK-Zq8$s--slJ z4-Ish*3{!snhaiF9^I!aYs}#iD`^bck(#jZ<=dH2G5$KawPBEBb<2y`DKrNAItS3G z`ok+hvi;ldEumj9*)yHT%Z}K^B%GG0A%W$6Wy654pDB16h^ue9qGAI2Pvc|i&Zn2; zP~!B-i2m&p^&*BM@i*@+&Dnuc0(D1pFBHN91I;G~_>&zTomgdN+TB#?Pgr=@X{$31 zi+A-EebjOj4#B%wgZ5wQ09;L zQHP3xQs>!u#d8+wWv_Na-Ipa}GGsg#H5%@t)B)pPn0oY*u zAy1wmUtd@cn~xnE-e4ZrY5WbF_W8=psw@66_GyKlg?j(-^+3(`Uc@R47y8K9oTpby zi|}83r?%&xss1LY2yw#p9u%ui7l z=kBoan|ojh`vA7iH2Tv!4!|P$`qB8IiMSE^_hEslHH-%wrW{u?_e#cW$!hLIH4MPF zXW?L8ji!{ESRO&raz!7cRqHak>u?ULiB>WS|D1~TdSr8a4yHY$$GTi9(%d{oUHp*? zO?#R1Iz8>>uTlK@LahBx9zxTT{bknoG|pp-LCs;B;1?Y7PADa1Ol)QJ5v7IIp09_K zX#0-^aexzU#x%e*T}!Qo2{pu<;zVdS@PHVXIZ_qJ2j0`p09N_qO;4SN93gjho|s!e zSXnGQpOF*-iH^9AB|I|bd&VOm+B*`=F398B`oM9f@$@Pm@w5DCCa@Y!WS0K!xOEYH z?|JoKIHijxJ&e{fUdvyo2mub`+}}xAr`oWj0Ft0TxIdx344^E_W!3RBCdJ|I^NU_U zep5t#q3cFiyLXLOT+o*c=DXD3y{3Bc z4j@c>zs1Rz0-dDWIHkzE44f;NA34vI!JoA`;W7jiWo6Oe^OqDjd?%K$&9Z85^NieJ$F@Fc!``zrGw?}`T zQV?X#6$uA5*)>||T)e5frs^90=0#UFbDvJ^rNQ~8g2n*Q<-oEF72)=IT^wEA~1 zAf;A|i&mCH%rmOctr!@fp_Q-wJEDe3th0OBsI9|R^_)ESRlH`~Xdc^-M}OgHt&MbK zL5xt7M%1#3KMJAUV6oS5GPLr$Gpyv65w1h32Re=rj9R%B7xo7_`n)?YEOq(TumoR z!%RR+y#eu}cQ$t5o-`d^48_uo28vNCL-&)og4`>wv2ux~AjRorH;n@$x{!zM*Xg{E zu4+ZwUhW>15xHTHyG%Iq-lHM}rM-vszp?+_zu|RZXv0%=}TYAa`Ma zXbztIN*&QP@hBwqKC@PXP3js)ahT6!w&rDm3xp zepBOTe(_{Z^s!r!9FyW6<7cm`;uyRnokx!rkEJrV4wXeW4W+Fwoaqc@>I;BD9E%(? z!$Cxl%FMjF%>DVD4ZEdV(xRfubWf%5JD$cMTHW_T^OlKBcHY39%DXJQ1fAL{ zh8*cqR?^3_e_V~83(MFjMYcX!m^Z-`z*?xUN5cQqrkO!fkCSeH(XaWJo_uf*4H3Bb z^?Za&>^4(*M|RIjNW2mLv#!k=D<(3oaSoXn>1&PLD=1&M(kb1g53NnIQP|i=BM{HS zH0{$r<#O+8Dm=gfo*!1Mo-9C@vA~&B;Tx&6@fQlU8T*{ojs;}OuKowvCi>AEE{mIj z2W{OS1n@?1!jY%OY-s}0o z<8&%?GgXBH>@^vj?{ACxPN(?% zg%f=WsfAkodF^QC^2H43eC6NgT)Qa-xu-$EDT@0#uSmMf#}6ab>Ao$QGfQuomxsCH z;~T5kGuF|U>oXg-GuHyTWFDH)vGqJD`B1~~n9|LlRQa%wuW9*gMrYB}iHWKz#c{Yl zN3?qWbi(ph{MD6mLn`LuPZsLB@VDWwn_FX3<Gw+pge@Yvw7yY%6WyYt z+H4~#6K`UP@pj+NU^)-6m6syY1w&&Qe1_cS?Dcy#pK1u**l9kf%IJoKjLl*?UQh2g zOO9d1U4MK)AFy_AwMSL70)rKg1GmyQ*RM8f!ybNi)}pe%qnwU(zTUeOBUmf#|K^}Y zgml_nimuH`KfGf=KgfxKF)&%_+WYbKejcqU);BoqRp8TVHHCyL@-&Ry$btMG=h+b} zGS`Oag1{1o_P<)mwd`y=(Gi^O!I9?RKPw5J7$$D+e_z;9qV(KLo^WV@H`C~Amo6ik zX+&hQw1AhPQ425Ckf8=XAX@!E=WlBFVmWw}%MSts<}T*%2&+u|1DxYTviK|!%Z&$Z zH~1f>wsWIUBX0jY()hn;{Qrh$tr2W&E;4P0!bNGoB8`nn7E)334Tx!q^ zehDV3l}*IiLX_+29PknLUtp;{Uk0zONOw|wyRea_IpD{IzC~$Lk!0k9MZ!Na=~y3s zf^p{-_YD~J>FJHJ=0@>q{WBZrcRh+UtfKj4<0;}{reJMZg#Yw_j2mi?S>2J}qzqgh8Uo*u1y|A1;wn{c)rW&`Kg!7p3naojKxXV`z?mu~= zhih+dkHh;(^BJr(8+{fdn-&TYs1OIllXX1Ro~BOBe{E*ce_3CJ#&LX-y}~NEM_G-o$cOA+`*4|Y(yxE zX=SzfN^3KA#(Z~fopul0$+twmci_obcQC#U@L}|e(m4E{UaKztUQ!BdgtsO=vK_>W z9-+WMI=z|MCi%;ol@z+NW};!`F3te?XH<2OVCq-J0oRkimjxG|^vbMYIpPof`8d{~ zVtQ4my7M=)OUnyZdtEc!gh+QiGY_ZV6vIk0U_hd^abgCe2o*>Bj zo1V$@-KhLq&pX>DFYneRhtXJhr)O&8yuFu*&@dg@6@67tynQ2?yo9Q(lHcEKWA5JG z86tz8G*ci+$^3O-lg~z%90fc{o&mL$r{!2nAx!-WBU$Vr2e`o}!UZj2uwhmofvp0eFf(_hlO&qd25^5%?}H>zk)(7tx!5_q%$ zF*2S3$qr}a?q_2$Tv0Qpt)Q2FKwbL&D)A_ew^~1}lj7%39GDlpCL zbJba1&_Z2X;811F)OM3+&FB?wWqF#r)Dw~)>8p__2-n=rv5>( z9b|XyfavzR1WFxti#{Hg?hYvJ-@hYkmNFASj|%*S1GDPN=vvBiLrQx8$~roK$bQ1W z|0{4m$dBVg#uRG#qbu8OmL2Nb5(9uqM}ex$wkF{%-v^Ih4^Cbf@p?<+iCNdhX?sJsxe6hi4J8(8$E&zk8t?GsU5 z{GeT5`z2jCs{>u{2rJq1X~5U~FWrfG(!+)(?luiJ44|2=hCeY52GoP6fr8)>=$~Lv8dADTphB7(GnIa+F=S-ucr=~6`q&S z6~L|OUenr^Q0vc2Z*kFyqiM|*r27kG)AnJwY1Kf$@-OjtI>KB4p6ZGne z>_|T2*~YXH+z6oKl6+R14&JDP0lE{XSilNHOQsDbVm=z3d$X8TdwO&!UJ*cAxTj}n#y|1&m%W!2CsN}A zwSjwS8b*K<_n{XbpB0$8OH0e2q|Wf<3tcd~`^c`6EJ}#i+P6Qbrom4F9NOB10+hI zN!nu&*u30c??HtpPX>|3vP{Ypy)u4be~iy*kNyKoU_^Sp-ZSd>qay2+qmcr)APRr( ztK|s!CncN_8T~tE-x772o;k6_9{h|o_xXH}S}igHUx}NQ{DF^p_#M%%(G_^#Y%{ZR z!TDY{0N8hWI`PDl#%JyQY9EQB7ERah?(yBY9B<4QTzCg4DPHhjhzHD=)yN43H~h_-?=;Z800JefC`M6a{j z&{8E9lZp(%v)PeX}v5B$=14Vn2F=teTSRS%u{5i%Y2=3B4FB%@V zd_b@%n_~aKScbJk%+^ca&p2Z{5VxTj?fn^2h#I_dP0N2#+=<#nMD3D?=j_ij%4t4j z{haK%#`KYD7^=Gxh_wguEM?dO$bq%i{`k7ag5CK_Kc{kUndb2~@P_;HuoWqwEldBb z(!clQzjm6|_V(i#JoC%e>UuY!XK>iGH_meoth39VJ+pX&G>UX8G+UZo0`9%mEk^9v z!LC0itFuq=Kd-`%p~j1=r}AsRg;5Sb|m^aF?qux=P<3s98%y3m_?k?X_3@!Xu(mUVb7wU?1_4u<(qw%||PhRSR9 zk}Yp<{_P~jfZv#C7(4gjSXS8RH#@#Ob8?CGuc`vd!Xp{>vz8>YgSMs z5`l67uk6g-%DJqmwpf1!&%%~d*~3hUL@id(*TXf(X_Yae`@u_7Sw3jKm+(oL2KDih zpMViVWbR~My^3q@v*3-BxL3i%-c(z@BOL+WT}!NW(*>y8ipYD5I|PDhTU}36?g)Gh;AQG``S3x>hG8ge?a#u6yO z8U0370-CuVJyH&eNg9xMG?3Tpu2ME;B`YhkBYfVTUQZ{ng%E0Ia%BnkJ^c-3`)o@18Tx$b9$L8HJaVoHTN z7_uaJAc8ik>8t6;en~eKN_Ly75-T!!g%YbpD8QilSG?(6S2HN`w2#ANu>D{?LYDf{ z`$rO+`~3$E!(tnHH*{!o5uk;p?O5JGX@_7^!6E`l+1TuqkWv`>rTY!xEa5Cs`-Vz~ zwc8XAmwv8x>)tg2xDKBOy7KGrQRtK!?9?XiW36V(?;zTztvzk#&}i+tnvC^jGnk$h zc)({H|J&nbKK2#GLt$OBa>yD9$MIOe9;n#O86{7he^Aejp zC~y55G!gK5t3%jYH4QpaP^H(?u;!YK;oIY%gByz<5sJ==#i1Ln60WBKGy{Q|Z4LO-X!AZ_@b0a#vucV^7J`K{kVdyF5TAA>be5=QWrmD$6ym(8D4(qP?u&g@vi=( z#YW`e8VUW6j#Rw$2dtlTUm1V9p~5(nU=)v+!0-5A4HKvE@kHaMS}4cse$B{dp$x8X zSo^(6I^V8mge|X1>^XZG)6g5{XZmA7TdkvwD#-)N0fy^ZGey}LQmu4rx2jU<#yWs~ zIo6wfX0QlZrC&h6YXtE)`nf#Qzf}Z49uU%=Ub0VnVAduzs9()!Jm{1D9kaEyE9+3M zAg`O(R}w2C0py&F+c%B=EXLI4w>}I#>Y+Nhh`M`%S-Sp1j}>{ptub3vEhXX>ILfUv zvCB9{8aU~U4~9vFJG0@?nMmV=SuUNdX8*KL-9`MF6T&Xfmqo|+GVHG!5^Ys@9a^-w zX&jm9J_wDv6ZLL0JceBD{P^ZxU#zqO2YCc|1FrUpcc=q-$2=b$WzQJ@Y5Fzl&fF&6K9QsLaX7d_Zcmyl9+k zR$)pBuB)EV-+?nJCaUNa2TDA`C*L70a8wOIUqKeE)H1$|@o`#mdvO5q`TUwB=n1aQ=W@$VF1b zSP1!?*0i)7fH&+4f!hHDAJzo!4bBtALUe)`${_gZp7fU`>!10OP9CzZF}XRRF_kYf z`p=IQ-nAd_ny-nx8Z3?Iu zx6w=K-ssqc${k-r1{(juQTn~S_jTZdtWu7{omJ#snx!=AAQnbLLw}zBprtd=MYPX{ zK0oqHQ*zQL(dWH~PPKtDqn@Nx%TVWKgW5Fn>PXJ)AzOwiD=+CowS@$1^2ib4i4xHb zTO)i1?0N+I!SQ3vlbc;z*@P>>RnRr@67bdddO&i_=3KF!Gq>+K2H@;sT&=Ax2m*UC!r z-M$XWtV>DX_0Us=7FPeGVZVR+yuTOvJHEfFbVL2-jw~nbdFPsvtzi`s9i_q?`@plWTF8}qY-hb`& zFZ1(XGx0yJl>ZzvA*wO%ILEH);Y#?cSK`v*UtOpFInMDP_$&kCUzwK{_{_Fj}nXLbspa0LV z4@I2YvY_>yR?(o@tun0XmB*wp589^33I$W-g${IES>Ivlte>OJny2o%HZR*8u3sJr WrL{R9&bKkt#;i#*VQE)?&HXnxXZT_O literal 0 HcmV?d00001 diff --git a/windows/update/waas-windows-insider-for-business-aad.md b/windows/update/waas-windows-insider-for-business-aad.md new file mode 100644 index 0000000000..04755feeaf --- /dev/null +++ b/windows/update/waas-windows-insider-for-business-aad.md @@ -0,0 +1,71 @@ +--- +title: Windows Insider Program for Business using Azure Active Directory +description: Benefits and configuration of corporate accounts in the Windows Insider Program +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: DaniHalfin +localizationpriority: high +--- + +# Windows Insider Program for Business using Azure Active Directory + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +We recently added features and benefits to better support the IT Professionals and business users in our Insider community. This includes the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. + +>[!NOTE] +>At this point, the Windows Insider Program for Business only supports Azure Active Directory (and not Active Directory on premises) as a corporate authentication method. + +>[!TIP] +>New to Azure Active Directory? Go here for [an introduction to AAD](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect), including guidance for [adding users](https://docs.microsoft.com/azure/active-directory/active-directory-users-create-azure-portal), [device registration](https://docs.microsoft.com/azure/active-directory/active-directory-device-registration-overview) and [integrating your on-premises directories with Azure AD](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect). +> +>If your company is currently not using AAD – but has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. + +In order to get the most benefit out of the Windows Insider Program for Business, organizations should not use a test tenant of AAD. There will be no modifications to the AAD tenant to support the Windows Insider Program as it will only be used as an authentication method. + +## Check if a device is connected to your company’s Azure Active Directory subscription +Simply go to **Settings > Accounts > Access work or school**. If a corporate account is on Azure Active Directory and it is connected to the device, you will see the account listed as highlighted in the image below. + +![Device connected to Work Account](images/waas-wipfb-work-account.jpg) + +## Enroll a device with an Azure Active Directory account +1. Visit [insider.windows.com](insider.windows.com). Sign-in with your corporate account in AAD and follow the on-screen registration directions. +2. On your Windows 10 device, go to **Settings > Updates & Security > Windows Insider Program**. + +>[!NOTE] +>Make sure that you have administrator rights to the machine and that it has latest Windows updates. + +3. Enter the AAD account that you used to register and follow the on-screen directions. + +## Switch device enrollment from your Microsoft account to your AAD account +1. Visit [insider.windows.com](insider.windows.com) to register your AAD account. If you are signed in with your Microsoft account, sign out, then sign back in with your corporate AAD account. +2. Click **Get started**, read and accept the privacy statement and program terms and click **Submit**. +3. On your Windows 10 PC, go to **Settings > Updates & Security > Windows Insider Program**. +4. Under Windows Insider account, click your Microsoft account, then **Change** to open a Sign In box. +5. Select your corporate account and click Continue to change your account. + +![Change Windows Insider account](images/waas-wipfb-change-user.png) + +>[!NOTE] +>Your device must be connected to your corporate account in AAD for the account to appear in the account list. + +## Frequently Asked Questions + +### Will my test machines be affected by automatic registration? +All devices enrolled in the Windows Insider Program (physical or virtual) will receive Windows 10 Insider Preview builds (regardless of registration with MSA or AAD). + +### Once I register with my corporate account in AAD, do I need to keep my Microsoft account for the Windows Insider Program? +No, once you set up your device using AAD credentials – all feedback and flighting on that machine will be under your AAD account. You may need MSA for other machines that aren’t being used on your corporate network or to get Windows store app updates. + +### How do I stop receiving updates? +You can simply “unlink” your account by going to **Settings > Updates & Security > Windows Insider Program**, select Windows Insider Account and click **Unlink**. + + +## Related Topics +- [Windows Insider Program for Business](waas-windows-insider-for-business.md) diff --git a/windows/update/waas-windows-insider-for-business.md b/windows/update/waas-windows-insider-for-business.md index df57384134..feef083952 100644 --- a/windows/update/waas-windows-insider-for-business.md +++ b/windows/update/waas-windows-insider-for-business.md @@ -1,6 +1,6 @@ --- title: Windows Insider Program for Business -description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. +description: Overview of the Windows Insider Program for Business ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -57,7 +57,7 @@ Best for Insiders who enjoy getting early access to updates for the Current Bran Insiders on this level receive builds of Windows just before Microsoft releases them for CB. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. * The Release Preview Ring will only be visible when your Windows build version is the same as the Current Branch -* The easiest way to go between the Development Branch to the Current Branch is to use the Media Creation Tool (for PC) or Windows Device Recovery Tool (for Mobile) to reinstall Windows +* The easiest way to go between the Development Branch to the Current Branch is to use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows Ring ### Slow @@ -74,7 +74,7 @@ Best for Insiders who enjoy being the first to get access to builds and feature * Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. * Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. -* Windows Insiders should be ready to reinstall Windows using the Media Creation Tool or Windows Device Recovery Tool when you are significantly blocked. • Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community Forum +* Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. • Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community Forum >[!NOTE] >Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. @@ -151,7 +151,7 @@ After you’ve tried the latest Insider Preview builds, you may want to opt out. * [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between PC, Office, Edge, and many others. ## Learn More -- [AAD Stub]() +- [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) - [WIPfB FAQ Stub]() From b902571245873bbfd6c71c4685b2f14a40cff5d6 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 16:24:29 -0700 Subject: [PATCH 127/165] added waas-wipfb-faq and updated toc again --- windows/update/TOC.md | 1 + .../waas-windows-insider-for-business-aad.md | 5 +- .../waas-windows-insider-for-business-faq.md | 90 +++++++++++++++++++ .../waas-windows-insider-for-business.md | 4 +- 4 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 windows/update/waas-windows-insider-for-business-faq.md diff --git a/windows/update/TOC.md b/windows/update/TOC.md index 41a0c401db..b16ed8c89e 100644 --- a/windows/update/TOC.md +++ b/windows/update/TOC.md @@ -21,5 +21,6 @@ ## [Manage device restarts after updates](waas-restart.md) ## [Windows Insider Program for Business](waas-windows-insider-for-business.md) ### [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) +### [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) ## [Change history for Update Windows 10](change-history-for-update-windows-10.md) diff --git a/windows/update/waas-windows-insider-for-business-aad.md b/windows/update/waas-windows-insider-for-business-aad.md index 04755feeaf..f749ef1c36 100644 --- a/windows/update/waas-windows-insider-for-business-aad.md +++ b/windows/update/waas-windows-insider-for-business-aad.md @@ -35,7 +35,7 @@ Simply go to **Settings > Accounts > Access work or school**. If a corporate acc ![Device connected to Work Account](images/waas-wipfb-work-account.jpg) ## Enroll a device with an Azure Active Directory account -1. Visit [insider.windows.com](insider.windows.com). Sign-in with your corporate account in AAD and follow the on-screen registration directions. +1. Visit [insider.windows.com](https://insider.windows.com). Sign-in with your corporate account in AAD and follow the on-screen registration directions. 2. On your Windows 10 device, go to **Settings > Updates & Security > Windows Insider Program**. >[!NOTE] @@ -44,7 +44,7 @@ Simply go to **Settings > Accounts > Access work or school**. If a corporate acc 3. Enter the AAD account that you used to register and follow the on-screen directions. ## Switch device enrollment from your Microsoft account to your AAD account -1. Visit [insider.windows.com](insider.windows.com) to register your AAD account. If you are signed in with your Microsoft account, sign out, then sign back in with your corporate AAD account. +1. Visit [insider.windows.com](https://insider.windows.com) to register your AAD account. If you are signed in with your Microsoft account, sign out, then sign back in with your corporate AAD account. 2. Click **Get started**, read and accept the privacy statement and program terms and click **Submit**. 3. On your Windows 10 PC, go to **Settings > Updates & Security > Windows Insider Program**. 4. Under Windows Insider account, click your Microsoft account, then **Change** to open a Sign In box. @@ -69,3 +69,4 @@ You can simply “unlink” your account by going to **Settings > Updates & Secu ## Related Topics - [Windows Insider Program for Business](waas-windows-insider-for-business.md) +- [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) diff --git a/windows/update/waas-windows-insider-for-business-faq.md b/windows/update/waas-windows-insider-for-business-faq.md new file mode 100644 index 0000000000..653d6d5c93 --- /dev/null +++ b/windows/update/waas-windows-insider-for-business-faq.md @@ -0,0 +1,90 @@ +--- +title: Windows Insider Program for Business Frequently Asked Questions +description: Frequently Asked Questions and answers about the Windows Insider Program +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: DaniHalfin +localizationpriority: high +--- + +# Windows Insider Program for Business Frequently Asked Questions + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +### Are the Windows Insider Program and Windows Insider Program for Business separate programs? +No, in fact just the opposite. The Windows Insider Program was created in 2014 to help Microsoft engage with Windows Fans worldwide. Windows Insiders are the first to be able to try new Windows features that we introduce through Windows 10 Insider Preview Builds. At the same time, they can provide feedback through the Feedback Hub App which helps create even better versions of Windows for all users. The Windows Insider Program for Business enables you to incorporate Insider Preview builds into your deployment plans using your corporate credentials, deepen connections with the IT Pro community, collect feedback within your organization, and increase the visibility of your organization’s feedback – especially on features that support productivity and business needs. Together we can resolve blocking or critical issues to better support your organization’s needs sooner. Incorporating the Windows Insider Program for Business into your deployment plans enables you to prepare your organization for the next update of Windows 10, to deploy new services and tools more quickly, to help secure your applications, and to increase productivity and confidence in the stability of your environment. Windows Insider Program for Business participants collaborate with the Windows team to build and document features, infuse innovation, and plan for what’s around the bend. We’ve architected some great features together, received amazing feedback, and we’re not done. + +### What Languages are available? +Insider Preview builds are available in the following languages: English (United States), English (United Kingdom), Chinese (Simplified), Chinese (Traditional), Portuguese (Brazilian), Japanese,Russian, German, French, French (Canada), Korean, Italian, Spanish, Spanish (Latin America), Swedish, Finnish, Turkish, Arabic, Dutch, Czech, Polish, Thai, Catalan, Hindi, and Vietnamese. + +If your Windows build is not in one of the available base languages, you will not receive Insider Preview builds. + +Hindi, Catalan, and Vietnamese can only be installed as a language pack over [supported base languages](https://support.microsoft.com/help/14236/language-packs). + +>[!NOTE] +> To learn how to install a language pack, see [How to add an input language to your PC Additional](https://support.microsoft.com/instantanswers/60f32ff8-8697-4452-af7d-647439c38433/how-to-add-and-switch-input-languages-on-your-pc). + +### How do I register for the Windows Insider Program for Business? +To register for the Windows Insider Program for Business, follow the steps below using your corporate account in Azure Active Directory (AAD). This account is the same account \that you use for Office 365 and other Microsoft services. + +1. Visit https://insider.windows.com and click **Get Started**. +2. Sign-in with your corporate account in AAD (username/password) and follow the on-screen registration directions. +3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds. Go to **Settings > Updates & Security > Windows Insider Program**. Click **Get Started**, enter your corporate credentials that you used to register, then follow the on-screen directions. +>[!NOTE] +>Make sure that you have administrator rights to your machine and that it has latest Windows updates. + +### How can I find out if my corporate account is on Azure Active Directory? +On your PC, go to **Settings > Accounts > Access work or school**. If your organization has set up your corporate account in Azure Active Directory and it is connected to your PC, you will see the account listed. + +### I have more than one Azure Active Directory account. Which should I use? +Register for Windows Insider Program for Business with the same active account that you use to access your corporate email in Office 365 and other Microsoft services. To ensure you get the most benefit out of the Windows Insider Program for Business and that your company is fully represented, do not set up a separate tenant for testing activities. There will be no modifications to the AAD tenant to support Windows Insider Program for Business, and it will only be used as an authentication method. + +### My account is listed in Active Directory but not Azure Active Directory. Can I still register using my Active Directory credentials? +No. At this point, we are only supporting Azure Active Directory as a corporate authentication method. If you’d like to suggest or upvote another authentication method, please visit this [forum](https://answers.microsoft.com/en-us/insider/forum/insider_wintp). + +### I just want to participate as a Windows Insider. Do I still need to register with my corporate account in Azure Active Directory? +No. You can join using your Microsoft account (MSA) by following the steps below. However, please note that if you want to access the benefits of the Windows Insider Program for Business, you will need to sign-up using your corporate account in Azure Active Directory. + +1. Visit https://insider.windows.com and click Get Started. +2. Register with your Microsoft account and follow the on-screen registration directions. +3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds by going to **Settings > Updates & Security > Windows Insider Program** and entering your Microsoft account that you used to register. Now follow the on-screen directions. + +>[!NOTE] +>Make sure that you have administrator rights to your machine and that it has latest Windows updates. + +### I am already a Windows Insider. I want to switch my account from my Microsoft account to my corporate account in Azure Active Directory. How do I do this? +In just a few steps, you can switch your existing program registration from your Microsoft account to your corporate account in Azure Active Directory. + +1. Visit https://insider.windows.com. If you are signed in with your Microsoft account, sign out then sign back in to register with your corporate account in AAD. +2. On your Windows 10 PC, go to **Settings > Updates & Security > Windows Insider Program**. +3. In your account Under Windows Insider account, click **Change** to open a pop-up box. +4. Select your corporate account and click Continue to change your account. + +>[!NOTE] +>Your corporate account must be connected to the device for it to appear in the account list. + +### How do I sign into the Feedback Hub with my corporate credentials? +Sign in to the Feedback Hub using the same AAD account you are using to flight builds. + +### Am I going to lose all the feedback I submitted and badges I earned with my MSA? +No. However, your feedback will not be transferred from your MSA to your AAD account. You can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badge you’ve earned. + +### How is licensing handled for Windows 10 Insider builds? +All PCs need to have a valid Windows 10 license. This requirement applies whether the device is joined to the Windows Insider Program using a Microsoft account or an Azure Active Directory account. + +### Can I use the Software in a live operating environment? +The software is a pre-release version, and we do not recommend that organizations run Windows Insider Preview builds outside of their test environments. This software may not work the way a final version of the software will. We may change it for the final, commercial version. We also may not release a commercial version. + +### Can a single MSA or AAD account be used to register more than one PC in the program? +Yes. If each PC has a valid Windows 10 or Windows 10 Mobile license you can use your MSA on as many devices as you’d like. However, the main concern would be that within the feedback it all looks like it comes from a single user. If multiple devices are experiencing problems with a build, you’d want the ability to submit the same feedback from multiple people (or upvote the same piece of feedback). + + +## Related Topics +- [Windows Insider Program for Business](waas-windows-insider-for-business.md) +- [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) \ No newline at end of file diff --git a/windows/update/waas-windows-insider-for-business.md b/windows/update/waas-windows-insider-for-business.md index feef083952..b25fa5f18b 100644 --- a/windows/update/waas-windows-insider-for-business.md +++ b/windows/update/waas-windows-insider-for-business.md @@ -33,7 +33,7 @@ The Windows Insider Program isn’t intended to replace CB deployments in an org To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: -1. Navigate to [insider.windows.com](insider.windows.com) and go to **Get Started**. +1. Navigate to [insider.windows.com](https://insider.windows.com) and go to **Get Started**. 2. Sign-in with you desired account. It can be either a Microsoft Account or your organizational Azure Active Directory Account. ![Account Types](images/waas-wipfb-accounts.png) @@ -152,7 +152,7 @@ After you’ve tried the latest Insider Preview builds, you may want to opt out. ## Learn More - [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) -- [WIPfB FAQ Stub]() +- [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) ## Related Topics From a050d85e5e89ef1ab250f1fc0d0af26b8ba8a5b5 Mon Sep 17 00:00:00 2001 From: jamiejdt Date: Thu, 30 Mar 2017 16:30:55 -0700 Subject: [PATCH 128/165] Update link from MDOP web page to newly released MDOP ADMX templates --- ...to-download-and-deploy-mdop-group-policy--admx--templates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md index fa6a813093..5c94f5c77b 100644 --- a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md +++ b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md @@ -20,7 +20,7 @@ You can manage the feature settings of certain Microsoft Desktop Optimization Pa **How to download and deploy the MDOP Group Policy templates** -1. Download the MDOP Group Policy templates from . +1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=54957) 2. Run the downloaded file to extract the template folders. From 5f5fb833694b8dce8de943351810ef3b4457e114 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 16:40:20 -0700 Subject: [PATCH 129/165] what's new - added wipfb --- windows/whats-new/whats-new-windows-10-version-1703.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 1467a5bff1..ed03eaead1 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -164,6 +164,10 @@ The pause feature has been changed, and now requires a start date to set up. Use Windows Update for Business managed devices are now able to defer feature update installation by up to 365 days (it used to be 180 days). In settings, users are able to select their branch readiness level and update deferal periods. See [Configure devices for Current Branch (CB) or Current Branch for Business (CBB)](../update/waas-configure-wufb.md#configure-devices-for-current-branch-or-current-branch-for-business), [Configure when devices receive Feature Updates](../update/waas-configure-wufb.md#configure-when-devices-receive-feature-updates) and [Configure when devices receive Quality Updates](../update/waas-configure-wufb.md#configure-when-devices-receive-quality-updates) for details. +### Windows Insider for Business + +We recently the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](waas-windows-insider-for-business.md). + ### Optimize update delivery [Express updates](../update/waas-optimize-windows-10-updates.md#express-update-delivery) are now supported on System Center Configuration Manager, starting with version 1702 of Configuration Manager, in addition to current Express support on Windows Update, Windows Update for Business and WSUS. From d20fe8e45e02b5a5f18158aa99049b3c66443afb Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Thu, 30 Mar 2017 16:46:27 -0700 Subject: [PATCH 130/165] Added mention of GPO equivalent MDM CSPs --- windows/whats-new/whats-new-windows-10-version-1703.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 1467a5bff1..3cb7875601 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -187,7 +187,9 @@ When upgrading to Windows 10, version 1703, in-box apps that were uninstalled by ### New MDM capabilities -Windows 10, version 1703 adds several new [configuration service providers (CSPs)](../configure/how-it-pros-can-use-configuration-service-providers.md) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Some of the new CSPs are: +Windows 10, version 1703 adds many new [configuration service providers (CSPs)](../configure/how-it-pros-can-use-configuration-service-providers.md) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Among other things, these CSPs enable you to configure a few hundred of the most useful Group Policy settings via MDM - see [Policy CSP - ADMX-backed policies](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). + +Some of the other new CSPs are: - The [DynamicManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dynamicmanagement-csp) allows you to manage devices differently depending on location, network, or time. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country to avoid roaming charges, or the wireless network can be disabled when the device is not within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. @@ -201,6 +203,7 @@ Windows 10, version 1703 adds several new [configuration service providers (CSPs - The [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) is used to manage virtual applications in Windows 10 PCs (Enterprise and Education editions) and enables App-V sequenced apps to be streamed to PCs even when managed by MDM. + [Learn more about new MDM capabilities.](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/new-in-windows-mdm-enrollment-management#whatsnew10) ### Mobile application management support for Windows 10 From 2430b71d39b8d972322b447ae180096e6f5e6805 Mon Sep 17 00:00:00 2001 From: John Tobin Date: Thu, 30 Mar 2017 16:52:26 -0700 Subject: [PATCH 131/165] Fix TOC hierarchy in cred guard not-protected topic --- .../keep-secure/credential-guard-not-protected-scenarios.md | 6 +++--- windows/keep-secure/credential-guard-requirements.md | 2 +- windows/keep-secure/credential-guard-scripts.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/credential-guard-not-protected-scenarios.md b/windows/keep-secure/credential-guard-not-protected-scenarios.md index 5f7dba289d..6206dbe532 100644 --- a/windows/keep-secure/credential-guard-not-protected-scenarios.md +++ b/windows/keep-secure/credential-guard-not-protected-scenarios.md @@ -41,7 +41,7 @@ Credential Guard can provide mitigations against attacks on derived credentials Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. -#### Kerberos armoring +### Kerberos armoring Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. @@ -51,7 +51,7 @@ Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, - All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. - All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. -#### Protecting domain-joined device secrets +### Protecting domain-joined device secrets Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. @@ -117,7 +117,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` -#### Restricting user sign on +### Restricting user sign on So we now have completed the following: diff --git a/windows/keep-secure/credential-guard-requirements.md b/windows/keep-secure/credential-guard-requirements.md index c2f3f0fc73..e87463063e 100644 --- a/windows/keep-secure/credential-guard-requirements.md +++ b/windows/keep-secure/credential-guard-requirements.md @@ -9,7 +9,7 @@ localizationpriority: high author: brianlic-msft --- -# Requirements +# Credential Guard: Requirements **Applies to** - Windows 10 diff --git a/windows/keep-secure/credential-guard-scripts.md b/windows/keep-secure/credential-guard-scripts.md index 1eca33e2e6..991d0010f2 100644 --- a/windows/keep-secure/credential-guard-scripts.md +++ b/windows/keep-secure/credential-guard-scripts.md @@ -205,7 +205,7 @@ write-host "There are no issuance policies which are not mapped to groups" > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   -### Link an issuance policy to a group +## Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. From 2605c2c8d7605a9eb086d777666237b963ea8f0d Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 17:08:25 -0700 Subject: [PATCH 132/165] vdi --- ...le-exclusions-windows-defender-antivirus.md | 8 ++++---- ...eployment-vdi-windows-defender-antivirus.md | 18 +++++++----------- 2 files changed, 11 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md index 48dcf3df40..e1043e17fc 100644 --- a/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md +++ b/windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md @@ -40,9 +40,9 @@ This topic describes how to configure exclusion lists for the following: Exclusion | Example ---|--- -Any file on the machine that is opened by any process with a specific file name | Specifying "*test.exe*" would exclude files opened by:
  • *c:\sample\test.exe*
  • *d:\internal\files\test.exe*
-Any file on the machine that is opened by any process under a specific folder | Specifying "*c:\test\sample\\**" would exclude files opened by:
  • *c:\test\sample\test.exe*
  • *c:\test\sample\test2.exe*
  • *c:\test\sample\utility.exe*
-Any file on the machine that is opened by a specific process in a specific folder | Specifying "*c:\test\process.exe*" would exclude files only opened by *c:\test\process.exe* +Any file on the machine that is opened by any process with a specific file name | Specifying "test.exe" would exclude files opened by:
  • c:\sample\test.exe
  • d:\internal\files\test.exe
+Any file on the machine that is opened by any process under a specific folder | Specifying "c:\test\sample\\*" would exclude files opened by:
  • c:\test\sample\test.exe
  • c:\test\sample\test2.exe
  • c:\test\sample\utility.exe
+Any file on the machine that is opened by a specific process in a specific folder | Specifying "c:\test\process.exe" would exclude files only opened by c:\test\process.exe When you add a process to the process exclusion list, Windows Defender AV will not scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-windows-defender-antivirus.md). @@ -162,7 +162,7 @@ The following table describes how the wildcards can be used in the process exclu Wildcard | Use | Example use | Example matches ---|---|---|--- -\* (asterisk) | Replaces any number of characters |
  • C:\MyData\\*
|
  • Any file opened by *C:\MyData\file.exe*
+\* (asterisk) | Replaces any number of characters |
  • C:\MyData\\*
|
  • Any file opened by C:\MyData\file.exe
? (question mark) | Not available | \- | \- Environment variables | The defined variable will be populated as a path when the exclusion is evaluated |
  • %ALLUSERSPROFILE%\CustomLogFiles\file.exe
|
  • Any file opened by C:\ProgramData\CustomLogFiles\file.exe
diff --git a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md index 54535d3ef1..7af1a0688c 100644 --- a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md +++ b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md @@ -86,9 +86,7 @@ After creating the image, you should ensure it is fully updated. See [Configure ### Seal the base image When the base image is fully updated, you should run a quick scan on the image. This “sealing” or “locking” of the image helps Windows Defender AV build a cache of known-good files and avoid scanning them again on your VMs. In turn, this can help ensure performance on the VM is not impacted. - >[!NOTE] >Quick scan versus full scan @@ -115,7 +113,7 @@ The following references provide ways you can create and deploy the base image a ## Manage your VMs and base image How you manage your VDI will affect the performance impact of Windows Defender AV on your VMs and infrastructure. -Because Windows Defender AV downloads protection updates every day, or based on your protection update settings, network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. +Because Windows Defender AV downloads protection updates every day, or [based on your protection update settings](manage-protection-updates-windows-defender-antivirus.md), network bandwidth can be a problem if multiple VMs attempt to download updates at the same time. Following the guidelines in this means the VMs will only need to download “delta” updates, which are the differences between an existing definition set and the next one. Delta updates are typically much smaller (a few kilobytes) than a full definition download (which can average around 150 mb). @@ -125,9 +123,9 @@ Following the guidelines in this means the VMs will only need to download “del If you are using a persistent VDI, you should update the base image monthly, and set up protection updates to be delivered daily via a file share, as follows: 1. Create a dedicated file share location on your network that can be accessed by your VMs and your VM host (or other, persistent machine, such as a dedicated admin console that you use to manage your VMs). 2. Set up a scheduled task on your VM host to automatically download updates from the MMPC website or Microsoft Update and save them to the file share (the [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4/DisplayScript) can help with this). -3. Configure the VMs to pull protection updates from the file share. +3. [Configure the VMs to pull protection updates from the file share](manage-protection-updates-windows-defender-antivirus.md). 4. Disable or delay automatic Microsoft updates on your VMs. See [Update Windows 10 in the enterprise](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-update-windows-10) for information on managing operating system updates with WSUS, SCCM, and others. -5. On or just after each Patch Tuesday (the second Tuesday of each month), update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update. Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/). +5. On or just after each Patch Tuesday (the second Tuesday of each month), [update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md) Also apply all other Windows patches and fixes that were delivered on the Patch Tuesday. You can automate this by following the instructions in [Orchestrated offline VM Patching using Service Management Automation](https://blogs.technet.microsoft.com/privatecloud/2013/12/06/orchestrated-offline-vm-patching-using-service-management-automation/). 5. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. A benefit to aligning your image update to the monthly Microsoft Update is that you ensure your VMs will have the latest Windows security patches and other important Microsoft updates without each VM needing to individually download them. @@ -138,8 +136,8 @@ A benefit to aligning your image update to the monthly Microsoft Update is that If you are using a non-persistent VDI, you can update the base image daily (or nightly) and directly apply the latest updates to the image. An example: -1. Every night or other time when you can safely take your VMs offline, update your base image with the latest protection updates from the MMPC website, WSUS, or Microsoft Update. -2. Run a quick scan on your base image before deploying it to your VMs. +1. Every night or other time when you can safely take your VMs offline, update your base image with the latest [protection updates from the MMPC website, WSUS, or Microsoft Update](manage-protection-updates-windows-defender-antivirus.md). +2. [Run a quick scan](run-scan-windows-defender-antivirus.md) on your base image before deploying it to your VMs. @@ -161,7 +159,7 @@ These settings can be configured as part of creating your base image, or as a da Windows Defender AV supports the randomization of scheduled scans and signature updates. This can be extremely helpful in reducing boot storms (especially when used in conjuction with [Disable scans from occuring after every update](#disable-scans-after-an-update) and [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline). -Scheduled scans run in addition to real-time protection and scanning. +Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-windows-defender-antivirus.md). The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. @@ -183,7 +181,7 @@ The start time of the scan itself is still based on the scheduled scan policy See [How to create and deploy antimalware policies: Advanced settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#advanced-settings) for details on configuring System Center Configuration Manager (current branch). - +See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for other configuration options available for scheduled scans. ### Use quick scans @@ -205,9 +203,7 @@ Quick scans are the preferred approach as they are designed to look in all place See [How to create and deploy antimalware policies: Scheduled scans settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scheduled-scans-settings) for details on configuring System Center Configuration Manager (current branch). - ### Prevent notifications From 4a046e799b42147f3ccde838930fe3a72c5c2c53 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 17:35:37 -0700 Subject: [PATCH 133/165] whfb-pin added forgot pin content --- .../hello-why-pin-is-better-than-password.md | 32 ++++++++++++++++-- .../images/whfb-intune-reset-pin.jpg | Bin 0 -> 75162 bytes .../whfb-pin-reset-phone-notification.png | Bin 0 -> 131278 bytes .../images/whfb-reset-pin-prompt.jpg | Bin 0 -> 51065 bytes .../images/whfb-reset-pin-settings.jpg | Bin 0 -> 83276 bytes 5 files changed, 29 insertions(+), 3 deletions(-) create mode 100644 windows/keep-secure/images/whfb-intune-reset-pin.jpg create mode 100644 windows/keep-secure/images/whfb-pin-reset-phone-notification.png create mode 100644 windows/keep-secure/images/whfb-reset-pin-prompt.jpg create mode 100644 windows/keep-secure/images/whfb-reset-pin-settings.jpg diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md index 9c24738397..9166df5000 100644 --- a/windows/keep-secure/hello-why-pin-is-better-than-password.md +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -54,17 +54,43 @@ You can provide additional protection for laptops that don't have TPM by enablng **Configure BitLocker without TPM** 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** + **Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup** 2. In the policy option, select **Allow BitLocker without a compatible TPM**, and then click **OK.** -3. Go to Control Panel > **System and Security** > **BitLocker Drive Encryption** and select the operating system drive to protect. +3. Go to Control Panel > **System and Security > BitLocker Drive Encryption** and select the operating system drive to protect. **Set account lockout threshold** 1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - **Computer Configuration** >**Windows Settings** ?**Security Settings** >**Account Policies** > **Account Lockout Policy** > **Account lockout threshold** + **Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy > Account lockout threshold** 2. Set the number of invalid logon attempts to allow, and then click OK. +## What if I forget my PIN? + +Starting with Windows 10, version 1703, devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune), are be able to reset a forgotten PIN without deleting company managed data or apps. + +### Reset forgotten PIN on Windows Phone + +To reset a forgotten pin on a Windows Phone, you will need to locate the device in the Intune portal. Once you've selected the device, click on **More > New passcode** to generate a new PIN. + +![Intune reset PIN drop-down menu](images/whfb-intune-reset-pin.jpg) + +Once you've done that, the device will receive a notification to unlock the device and you will have to provide them with the generated PIN in order to unlock the device. With the device unlocked, they user can now reset the PIN. + +![Phone unlock notification](images/whfb-pin-reset-phone-notification.png) + +### Reset forgotten PIN on desktop + +Users can reset a forgotten PIN from any Intune managed desktop device. They will need to unlock the device by other means (Password \ Smart Card \ Biometric). + +Once the device is unlocked, go to **Settings > Accounts > Sign-in options** and under **PIN** select **I forgot my PIN**. + +![Forgot my PIN in settings](images/whfb-reset-pin-settings.jpg) + +After signing-in, you will be prompted to change your PIN. + +![Reset PIN prompt](images/whfb-reset-pin-prompt.jpg) + ## Why do you need a PIN to use biometrics? Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. diff --git a/windows/keep-secure/images/whfb-intune-reset-pin.jpg b/windows/keep-secure/images/whfb-intune-reset-pin.jpg new file mode 100644 index 0000000000000000000000000000000000000000..0eae3a4546cf180dfac656eee5b7c713db723e3f GIT binary patch literal 75162 zcmeFa2UJwq)-JjUl9S|I2nZ@UNh&B20TBrbihznp&RH^rAcEu|83`g_A}BfMEICTf z8OcyUg}br4&pF+F#(3@j?z>~WaVe-`*JiFTzxl1X)?RDvxiKS{X@KIEqOu}@g@pw? z0e=9@%tZ|aS922pP*nx4002M${tyG$;1L)2#T|DDcmu zgaw7fr36K!L8E00sy=SoIge`=dVTJ{_9vPD)Q$sj*vJ2 zL`D7kI1TIHBcOkeVhBY~O?5Vk`M;8|XG)(TaE8Dc0%r)EA@DB*{up@(OR@=xfx`|d zF$v(modWF{z4i}te!tw(D58$3ZM|nX=4v*@N0Y1Auwea)E zbOMg+U+QS?_HJ>CJazCTB%-CGXJEX@#eM1W6;ZLP;u4Zl@;4L|m2N8E($u5@h&qf`~8QHUkeJ0ic3n% z%Ig~%o0?l%+uHm32L^|RN4}5F%+Ad(EG{jttZwh@?(H8OB94wv^*Yt_kJoRC{Y9_y zpkCOxxH!1@r+Q&wyMS+;^SI|O2;ou6-N84or(zd=PC$JzZCnoUZVgB4i;!Uobvz-IB4$K^SQ=&&u2P0$p`}w<=JML z9a1nvtK^U3xfaQf$y66&k=#eKyyhR{6L*9Y6v-n$sOI`|=#V8C7ruY0nuttGc5Hcg zkcJ=3LXdwaYlM!UI{Q1FUE6eI*qbZE2Y4|U;94gP17O|tAzvruK|fD~qp>p~BaGT8 z98nB_Ja-Eq^Uvfb?AzOIg>0{;&M3?JX9PBjeu7lj?EFZbWE}v;ayXQV3uEEy!8l)3 zp49rmGVhlZ^kx#9QCp=d#xM19p#|*Iml1^aq6D22%!;%;vRRPonRHF_fa!h{pjXhpr_y^tm9h6ag{+4WLo0s&)GmHs4*bb72G}F~f&pqz4GZKs zr<>!cI59qo3Wy^Oc4A<9aO^>p1)6}&^JH&?%FtS}n03;x+6;@czmoTMq)bd+M=9(F z(A?iG@jms&)<>wB(@3!7G=byT$~6Y}A4zXl#Mdaz?WoP!aX!fNm0yn06-$v=sUtur1_zHPt zD03U~sCWM6X5poDVQg*TC?XRS&%V7XGIpPi~l6;YT;}r(D z1h1c}#sFy#A%|OF3Y^)EtuE0d`xN!fKS^cJ?jt0mw0;v}LsWU<;l=_G*at$b3Lu$Dl>Q9z{m~mr(pfsZX+C$Bw z{?^Q5e_vQVX36P-{h$wO@%la;{9-G;q!GvK~{%_wL9K58l9wS$0GVf_EjUA)Z z-}v+1Fe~>=N~jr0;a;6&xo=&eB38mZwT7mKKXr{LHQ5?v`FIU`3@6#a%iTMx@VJ@j zsP%w8b)E$kKKtl926$n@U)J*7>&u#|7kOi!GF3@{(vM*?{eooHH*Nn`@7# z8fPztR?1Xfc`-h8^b}7TO+Az0`dZ}t%=;s5Kg(pz)2e`?@CYk+NZ_n6%~oIW;l%FP zlC2v4!f}5_Z>1^~kHE`*o)9YQWydw8A;GCGqL&xFd@mQOQ@M!)2+woTj)vdiK_iQt16SVwR$V+QYTo7zR|?Uo$0ndf36vZ|Gbn%u%}k zIfE-=e~>sNIIq@+d?CnTm4E(R8E(q>y%ULq6L&xKus!Hg)aPOK;YH){Zp|a|t&H!D z`VZp0a_7+QsjYB-h-E1TNXg!T%qSHEdObBN9;TA1=ec<+y0!LGKL+>&*~~+~;9-nZ zUUt?@h-f5g zGR-9o|9$B$bpcn`G(0s^_1ZbmD+pkKgYM%V9NQ=6b3|#ZZi@w)N|zo4?mT?*!{IyR zRZjXHg$E0tu4~5hG^8u)xfKVNz=YPiADe5+-+V`@WKCHri3@CR`u*utxP{+pAE$5MgC*@Jg5=P_wxd9JbHUgH zz6F$y^YvZte<;doD08P;yc-R^gu61F%^5}~Lq3!?;1t)*T&+K1Gya3)lCaQP@?ga? zs@kadg>bvBHeq@%1wc9918oxOH?=DYSg~S&gp4PL$WDL>zh=>FLEZH8eDqa8j3LEl`%BJzmhF}t zK>gyly$BCpd$OHKqNX$BKIt&TsRt)5!8Gt@+Vf?_E4ruN>Jtqf21o|Ev45C`KR(`K zZqwgU@pMjFQJotyRFJXFl`0@FcqH#gMfT3adC^DU`=o*wl``4J$0oG}j>!9$fVVzG zmw@-#7~no^N*_g_f&B>2@)@Ccl&h=>R&BS8*C#RFyfK$iXNm@Ho9;NA;SdkB_xCjX zM`Mp4J|uiP5IZSoN29nty_aes7wlMWle@*d^(?V~q}XkC7;D?b>>ViA*5x&19yj5ZdSa?W=UbnOyJ zo=ZMhxkmegg|sl<7|Oa&v#}qVR9h0I7|P+j>AD#qveAYkJL|)H)N5nBOXuJ^`YMx#RJ3qK`4a6b$7q#C9~OWw8)E)M#nQzxUUcRD)5=)Rl$(dp9p%k?trgK5 z3&^ZOVbMUHh;$M~@-NL6w>p2=(mC6`ji?U-q_qV}GlbjtUpeW>?MsaLjqe`Tq-Fw& z_nWK?oO^TM+KKbSUcB!jImeFWKgsC~6!HMSXdG>qSYNMLs91(g1m@CXU+D zjjt7n$|l!!ui@+tkYj**s+L(}I;}?jf=iOzQw(S=pArRtS_4Z1-hly71?WO79twQ6 z-DQz`Pm6u&bua2%{kjgjywY7#mTj-67c<|N^G@N~;msiB`T~+And3v$C3Jh?_-Dpt zn!RUB+4_%tBRV01?l9Dj*)Bdf)SBY*A^-DNY6)(7+a}fjK=)$5u%0x>+w)yZ5;)r* zudQakJK%KRuu+2UAKPCewi%7;rY}qBjqrWQ#&)=J6x8?o@F57`;lDcYP0qh52|Mk> z{L=PZh+z>R?Ttu7|= zxP}x+y?f%L69%-^e(d~mU>$LO3Y=>;SdPBo^9w~McUc48S{DC<<2T=WKLj{1QlUE7{heP3l zG!^Gd>1#~dku7pTK$PwJ{bJSSW;)*01;T}b=rxf1-Bt2$q(%s;$6N*N#Ob&tp{z$~ zgm3jOzYCMtRwsGBStu2Av!@v^E3KEs))P7zzoSyU%A8I}p7n9X*jGiuF{BQt@6S zi@FBt%4b16;Z5Jkp4_WHu1UE&r4eSlkVk(c(1cCQ9cv}ToqPZWA_jlL()Bk=B zG#sXsXpA1Mc!GCPy;$AmyC`rwaXs>56W?3P21hF>$-xqGF|o%o)jZPw8#}M}x*_wA zwuzSX7W{nK!rDQfoB8iwN6meZ=w7*d_cxdR)`x+AiZ3Sql0it~x4ymQy)j8^{}E@; z>E|WpGU~c6eT}6PS(GDf7oL=V4$QhXV<%D91rt(N(YdQ&__4h`m&u&C6(_=VQ%*79 z4FtKT-xV$eJ6f)J!$$twUsfmhZZBL4!2J^Kv#NZU)s6oAvujPmSEcMeAG%vOC-IRu zqq%g<#TDSd>5{4Nehp;b3~AjsNJ?WUvDUG}YEm_STI|-i+ZGu<*;c`fg}Q`2@so|z zfVM>Q1YM`Fg|M|EN&3J>?G;y6pQW8NT$jRKn#R%RIuF*rvyIw`8sLtUtudu?e`^elYp{-H3qEgb%d8)V@n;dK|?6qnp^8>m%BmrW(D3;{NBr zOIjn=Y-_+=i7l2h(lJ1zL3Z!>v{MZNNVQ)onP=UXByvqNT2*H5>$xD^*MkKz8NAwA zZ8-s{nojf|!zM7r<&@j9|`_Ng(yp{=!mtAU+>5Wk=R0EM~Q8GtL2PHaz& zP0ej&xHl_mxY^8&WVp4(R0UP-yT=-o?_-!3b1%xCe zB?Sb91%!q9KnXraHybAdS3Vm@j^8u5VeDw=U~cDRZfnDKnxVl{TW2R3c4udEBPkOD z6S1d8Mq+$V4MdFigoKO?_za9hg!qg^M2y76gd~Jbgr2hhUc8avze=}rcCh+cwvnNL zv6Zp4v5k`>h=z~=yTEUi{@+z52+_X^{jczYI)XA%@(#uZPR2LDx9sU8EuWwWpRlCX z9}~CWlCwBe;4gCjPG{?&Wov6C`;S(n|0A29@ z@LTbk#`gd3SYu@_`yUJKzbOfx`|SYC9i%WgZ44Fo&w~Gs#LqJzgTZwF;yajz5Gt zCE+u6ox$}>2>g=p8N1Hl`XvN@N%)LiXK?)z0>31D#;!BCehGnJ5^g(%mk{_R;WKuf!SzcB{F3k)yUyVHB?Nv+_>5g= zaQzYjza)Idt~0oP34vb{K4aGzT)%|CFA1Nq>kO`6Lg1H#&)D^U9Ik)gGh=K6-YDY& z-VyUNnhg#%_USM9!UccN5uC<_IY)$#k4Hd4L_$JLL`+OdMoB?RcAkuwn1Yt#JQXz! z4Gjr79X%~IJtZ}G-_L0@8yqkV?m5D9=Lo4uiAkw{`SmlJ4c28GMI0>lvuHLz(f{wG z*_<$;Sr$&fXfr*&@Ga-}@Erxn)}{a$r2+kd3Iq7%$YX#gp5@VuoK@I&Mg{P;-MGcz z2dr=bX&39eH@j!l*6%BUH~MaE!oDAsyAopn9^C*8z2a+S}3%il@V7Q3Zy+{7x;QhD( zZr)(M_SjO9EEW)Cq!LoP;{Xoc^oEN8rq{q2B=bQB2bJ5{#jvkV^>%7_?@%=x0acPV zmDfPkU)_&uLEU%<3c2&ww{C4BT;jl>4;bJ&AqJ=$O2+_g)bNJNnm?)MaH13lTc*hb zvu{^ND`gce1=30OIZYe}^e@_V1z?_eMYMkcxvxI0h0088hQkl zZ{xtf@!SS63<0a7au7}d@8MAazn<1kVMK?O>2IbE|2yR+OZYGFEc{syrN3l* zYIoazWcRYaD)Q%y|Mvm}L2#$8qX{5eK41e`1se!x2eMsMYB#d=UoB6&_>JDZ;sMbU zj|tf>`aCYdSA2Po74M&~Om%9^puaA4e1B(e191m5e^=_?km3<&f^4Zz`MASh?(3C8 z@xRVa_UUB6H-dNW#nAhGLl5qgK6M>K-#~ewE5QBc)bg=H|+jZXXd;)J zW;nH|0Jep@aaayCQpHnkNUQyA81a|AE_?>rk+##U*iPF6`v1X`>~At5@Ag1(Of4Nh zJdCB|#Z|V!`Eu7zpW!4!2F^RIY3s-`Sm~%ZmJuoc$&dlp2+|I=VOiI|HMRfZqz*%Q znsl$0@kW}L=ftM-8Va!F)Zc0q35j?Y!K41n4D^{x>VIz|e|JxBk#%FKYD%J^?0J&N z_ovD9|536-r`Ec?cjnjUc23cF1OF$$zA_(_;|{w2n%@=b;1!Sqwg6A?cH_S|@&DGc z_mtxWCXd|r58jLO z<+>85pG^EO9ok)SB-QYN_v31;-}|%busmtR!nSY!bhh8@u+3+q0nfEHOM;Cd0}27& z=kg-SGg>x=KI$wI5}-D_ptHxHI%TZUN!f$PL3RN73Y-kGH0pyKzPl84YxN zVj*3e9;xO`3wh&)Znd_}PdH=);#)Gn#5YqD7d^G{i0yJjj@Ie0C zPf5AfG+s)VsU$0X<$AJFx>btL{k+rZ?d{|zXsz6TYNOZ$ZRif(P3F{&9D#U|5XztQ z|7Se*oZmkL!`rCq+DCY#rgffja^;_KQa!npb3y6D3feVu7mSfI*!>GFA&BZSa3CYI z(q32olS1&nxyj4qNUH7wZ+y@Zm;63Z%5Z!vb8-XSQ(S|+?nLb2g}2+3a%r1oYQ)Kl zs9la~yj7^QAmZ730mf**j$B1yx%WEEaY$*9Q4`^aYijmUu;P7^aAbU@{wXPtVAOzm z?9-7Q2G~&$@T;*1_44LfM&lr&xB7Nxy0Y_>IF=7pKPtS}nIBx{V z<)!616MIPwc?6fm4vpdpcZjaja9k7q_RSRllx2JtLlx3@H~&%3R^+Na3-gD1kTzD+ zZ*xV@-pu)a*R)UIZN+(7-1m-5EM>r)jD3?6tJ&d3k7>2^ooCYj)IC+!wU8d&-DKcM z4!1aM>iz$usn-ay2Ef!TK3USLeBes9nRz5PW9eVSkDGPz$>$TP4U%?|5aZw67U~~T zB&Bl6SK{N^r|-%it|pgg6sJYxH0Zkdbv_u0$kmi2x|NSl-yS)7>h!?~d4CyS{THWy z%%|rtkBwj2Bz2m^;U6Wr8g#0E$3M}3^wOzEg&#tJ{WG<6_p0XtDU zttse$UfQBkYnCU`Z15?ma13y<7Xy$?oxtF|Rmf{#R1s$gS|zXK`wQ1L4w$ZOBCy<$ z-_0P=by}fW0fY$#_A15I_IC+IR1(~Du@$U~2jY2a^RrbLGEUz%fV6fV1;!z&czJW}bf}T)-m+e^l{j}d zQ580A8k$yUWu?q9phAY{h>q|$85BSm=e^Y5yHRP10ldNM7nuHA>40jl%i?72+sUUT zFTs(*!wmw*?2kpjpe(0u7?Oczu$+lQoflvLL%Ez@IE4={hfUjIb@xTP&L{gwEwO_j z!KA@1A-0+U-b=ZiiaH*EAy60d);qSI?^lrWAI{j+WIUX5OOYGos(!Bj^oJFd{fLJP z%`ul`9uX?7-=#79B^Xn2o>O-1stAdp1jPSzcu9{6l_e8bCwPXBz8+Vd00v+isM%_U zzww?O$@-AXUO4N!4-yAHx9bWU`5;S3oUmdJUckKNXJ1gZE_^ z;5pHu{VA#vFeFvOG>%}m&)4{qoX@MI-MOUAuviD2a-fw%`)Qq=$$EzLt2zmMAcg$0 z;Z~}0%>;awI$U>~WSw>H-Xg=D=d%(FYRga6uBTZYKK-T>k2QJjB@3jfnyaU<&BZMC zvN^Ba%kfyp){DYpY2B^QY4HhrJtqYP@$FhHlEbPB5Q8k_a$mM4Q(|?EKhr*YuYCS` zg&gPnmmd%IdEGdpEY_4t4eeTvFaRU4GsWuarybWaRE{<5Opdow68llKQ@6eOaz;fJ z*X;(*XpXlVTKBc;>BjAlPvgK#;KH~UP?cG_zQVE;v=B|>2RLa{UPL_&*EQ`f%4RGQ zoDN0~!wW$XYWpqqBhIP{Swlq|dXM^>zQx5JtFG1aZDc-07@N&1GqXJ-_$qzwNKKqw zcmZA?8Kiy=>$hoNN$V=vVjN zrj4DQ&N_-$V&q@Y8c72_W&?Ita+9{6cB}U)1|FkxJkm11X$zT`aE-JOgiWh`!J`N; z;-{wg=J1hj;5F7(K#R-drT(c~L%hx^`V{8HvC;aWWkd zo`wS+Ig-2lFvwGZT9M;ONfPIVzEYnj zk9Ef5wUUTV-V*nw?ok`A_zzcZs8F&`lSkg80}gqWIinvw4&QRPvDNKMX>GB4eH#+s z)V)45AgY`Zp~}ShRLeMpR+(m$6P_SU(8|GmiAcArYSuO&g|lZ*t9%e?Bj)yPN8RmQ zh^nzA0qVp?9y`V8#ZJv7K3`?6bZ>s;*`}?=a^tM*nNI#=mjSK;=Rl5EM*UB&@3d04 z>d++Dv94gxtCTqqh?RWwgcJ|v(wciJA;F|U66kFy5PpGn|i4cAGgvj z5uJ0oDofN4Mk%G>$^$No>N>eUq@51uBDmK<;m6S7=`%lfUdcz+x|YG422nO6z+`cp z_2#W*;%U?MWv?_q{(MWa-AF!b_=k*T7*05R(a zqq^pb1iM})#c`BX^C7k6e(cQ}7c{6ZTThw{t`~&|Y+2}<_p!aPDpdJYmg_8S)*u@9 ziK8%_A)@#W!^jVM$%knpm70Y$#FOK$?Q@M%4Y~=|b5R{CB_$>iayWvfF$pnn53Z3N zp#B9BL)lZTL4`wn>59cv)yLGPkms4>GG=k?pc>Z{~r=e0i#kq1JlGF($N`tzLmWSKrC;qS6Vwy+&T?yQ^PEC>J!)-$P$ zW+kl9ujP8mY?{V=y+P-fz3ZfAJFoZBZ%-uKm0eL9D` z`F@1n8m;}L5{a)_!~T8zG}(Z3mL{tfoBZZ4%{1o~2k+4XSkIdP*CBte56iNUJ^>qO zaMB1;n!{|3narp4{G+)T;tFY>$jHKwa6v;Kiyv{bd=@7vubyu6g^qT^t*zpQv;`k4 zQ`oIe$CLyKsts~1a9@00+vHvs;FC6^#H6)>v-3{RD}(73_b1kxCCGdaexmMLHCyr3 z{_3~Kc?oXsM=oZ_F@8?DncRGIZ=y2ZH<^NLvm!E@B|K2<(JcnW@L8PP3BFh5rNQkl zyrO1U7!0H}7k2UE{f*AOoM_j^9e(d-nrr7(0Z)NT;j-~dtdf_oPQ1ryFM=~!4AWkf ziiynxgLEHfetS8&v#M2mbNXiO?VCOAX{}@9HkvWb^e)SrMLCMywO0>!9_fkof9A1& zuM;jy9s1^8wx$m~?#09Ng$_4s*(+%L<8XYipx6#>b6f#F`D+`=yJ+v%SW9%1oI#S- zhG4MTg`C0+Ti)I^y_|;+zvapW*2FEm@p}`51JU%;`TclhBqhy7L9qv9{rM;3q<^=tHC_sQn_`IG&fyRB3Bg z4<+3yOKv^Zju)7}l+k5sIDftn5LYD5XCcH%DH=I4O;LKdojROi3A@qrGL*V@Le&Gh zlaN(jMz{#(cDf;*0p6Suu>q5SKIkoUw< zYW5r8sPjCi`kE%=lv|rjV2cgB+agli#;r@u3~O+)rjV|VMf$)O;R1Uh_UQWN?ZU)a zo@lZ7yGNlVSTE;5r*LcUqb2sZeYiVt1aFWf+KOA}nO2$5Ym|izZdQuh629zKEWN2E z+T|h7G`2E5r#ZT5l5BXdo6L2%S(dHu-PU@w{ya&&88pxmOx;!;YXW?DkwX zy{!05%_viodp7bSU7~*A?9g7BXrQyDt(2w8Ne=DRsvybGdOh81k*d^G(64$0U0RJb z5)1+dLjHcFnb)WNT4a5|*zzm#*LCdF5>ORNcTHMW;cd|HtzH3 zwvX;^Fsd|oxS_+gM`C@yYdcju+qj;0@}=+tx2UzZuxl`y;sm9ngaCai;p1E=$486u zuH=Jf!5DyGVekGL=jGx{F=_1gopy3VLS_i@4{cLFA!EnM)(x}Wp|N#L)u~Iv$36Jn z$Jwu-rZX&$8yX4_Z#Q)-w_|cj4rDVNjjd7*5{xI_8&GoIzflsQ!q`z3{(3q}*s=r> z>XqBJO;uaY8khIb?3woLvBywhv9Gxi#pl}}v&_Z?cxxjFuXKjlDQQfe3$kTan6(VO zb-e1~p~Gjjo+*S%?Ehvg-0H*Tu(6QVQDOb4?kb+$1l0|_@Vv+F2VlteR&NSK+cxpz z{B6>O%|>$EXCKv@ablr@E| zLU;90!>z>_XG_ne#z~Pu(J?GHmvgnD272$;`T4l65eo;#unfB3o#UiAz>oHC#+rl7 zDMe{tv?IIfD{%}@F~g~oJ+I7H)4U1c%A4IU8xpYMbtYezFe$pa$xs|9^9@q2lX7WX z^wvW0O!JnWrFL~oXc^>jJnC{V;r&P1fN4kyy!+w)+S*3yGW^h>Mj^& zFz;LVnBzhG5R~cUk(qV2xvpm)Qidsq_Q)to`W1gpMr1<$*A$#wLHCdYnq!BKX#Gpb zXBfcO9br0`*EpfxT#~{)P#8R+a6xBdVw!4OnVP_w67>-8 zORj4(;2MXsHU5o~vMuMMs)C@-i=kYmLa{mw6Q!(o=jbK4YVLb;JbI%teHg@#ZS4_C zw1BK+RnaTP$LEgLzu1BSa1*wCzxg8_bD%m*gVyPH8)QVftq$_ato9J=>uE)|{pm#H^$WjHi9w~+TXrg#>BbYBc zdFSTFq9VohdXAGO>nTD+M~mzgzj`SxeM%><>r?lKf8>x=&3x*RF|jRB%1#JTzf|xN z>r#v|30tjFh;Yfp>SR}!b7Rj-vRNcrSX0sE(2VX0$+Z?p+!4wG&oeU%sfGxBi-0K) z!AtZS6JHk0@M&wP(Dq+=V9jqeUwm`kpIwf_M){oplZcHS^b5W0qq_+I+2C+mSN!Jt z<=Rb>NYfc<9vRr3)W%4K?EJ#lkI@ITi9Gf;cb+P|PS+QfNlz%gdCtpuK6TSRIgyc~ zMWSw1D2zN$-SH?9IC5y2%?@@J2#Fo#WtH7p?wu~r_iZ1(Ka_JJ^>P1v@$>nrpmX_L zi^|ZppsLDkg@_Lep<(*ji0`wc`t@*%cY~tV9dP^?KiazwOp?}DNBtAquGTdine{1$ zI2I&_EKN}g2m2^`r=mYv)N7|bcHe>tEOqz!$Qs%PGiHWJy^s=be7(*6+;Bj2gdghN zqtk|ZeQ~$x8~X!xy}J}G=DSeS_7nZ?Qmg{;Mpg+gy4ja+_+#b_;WHj!?C@2?Ll9 ze@LyAO`UnHvqg@!5J!dShNJt_NcF>1pUJXLWcs7JVqC-)Q*BC$9q1PVW!5j<`KH`dhF1DS6ZTq0g^MGkaVuOZ)B` z*0S#Y0^7s(Dnq-CaYqw-8$&DG)@t_F=TOa=k^tu%i_QC0ebzq&HhGy;$`TGCSHH(o zF+7}0CQsTV!Ab;Xt-PgGNfhTAWf{wQ*6+H6S$?NomAD?r8FLGjHH!DtGy6W%wTJ2B zW2F-ak8OTimWOZEbkz@D8BiFSwQ&*Zxuh{u)D9jX)Mr)-B?~>? z=k4=JnHwae4>;>pyvFV23>^6IdN|&? z=!B-mz`oIm^?G8{WTs89oAg+A0!RFKZKJ~C3x|qgN@;N%y1gl1G;Qx(4DXWxzJ!g8 zuasGN9*ZqDAuQ}+>e5bTpEHPF0K!7PW;pCqvxDD8<6drb=KAtFyGGU&#pyo#5_|vk z+cDj7Vy_Y^1Ld8u4!+d5XG2%yw+-*5)^EAKg34Hf zdr8}M(5f^3Ms~|!T`k?gIz#qJgs6~P65Es2&pDJI?g|r#Vm;?>vVJUc2Pw_{azj06 z@`v<;4Ju8;r^`Ks&GL2zBgIGJAM>;ug8izI1O+P%+>xxoA7asMtex+DC_qv!6hr`DV zCu^(gv-2kT%4oFi!v|I4gd)0=iiU}l?Sx8qu}H{qDI{s8Aw@-lnc=UhS=GH}$q@?H z+9z^)4|dtY*XKV2j#5y#_;|x*ZaBTz-o4PbBRUOMp&Uv?yk^GFA`g6k@o&n8Eu1?Z z$HM{Wo&*@BH-o=~l|?+%FPw|rt#w@n>>Z)7*-g4Nx>yCVSNiMjVqF=`R}btnEH+pM zB6TZ%TyHN>e7~TH8;48tDHYq(I2Tc@5<7s@d~2C6_S#YGP1q-z!NKH!_hwO}I7DH1 z--+{Ec*nK#?Ccb^lV{Wj_88V`SNcmbSrdpRT5IcMt0dA$1<2k^vh{W648YVYrC9fW z)K_vhR3iLtbIzka@*Y+)TBn;Xnvu>%wpNpRj(S|dt0b2$d0gu+vZ7yK3YW2Ndr&dfbyntfj* z#L#FIrVgJeMU#Wuh+1H1;#?SFf*UCgsV76TC&S03<}g5D-Zzm8qe>jxAFOh0oQX@V zbJ!DC7flGM1wXh%hAU{`Da-mLe&4box`O;MvDedSA7;Q+W&lxjhN;1R&$;RMoFQA| za01w}A-E^#+%N=bQ%!ICU4OQ&A6`iAXImMXba2$`mgJ7=JShmX4?#n<<1J|E7$2=4 zxZLTqcELGv82gsVsn|Wi7Dno*G2>Z4d1N-^U|FD~U~{=s@Zg~Ewe9@6cj8Y_*g#N% zeg{P#VFLrNJobdZ=^x*PxYt~EP==$^`5F6zAui0+(F`? zoLby?>*@+Ag7T?aBCVH}$FgKsT?M59=1Fg$+Yp zb{bJKe=peSuNFbpk9(0XDb6j!rQrV)%cmokPcu+DPI``Z^TzregU!E@I|Ec^8r%#> z;`oO)!;7@1rHY?g@$YnR`bqbif3tn|H?~h9_`x-*KasuWf504g*K3ih;GPzb?KQNQ z8Hk%5tQ+(YkA$W`;5YvQd>~l)=s#Ivc#(BS%9j-D)w;d<@5V2iOC3>Kne!e`C7=Oy zB&1$K&m2OK3N8?Gw4|%)?8|W3Pcxqq#E9u_7zY>3ba`*mJP47%&&ZSAKO(nhqllhj zEjom(6JCg(Mi;81@E0LR0=D|nDRw^~y!9s*cdaKNN|E-o+#*d^#GXbK$d-dMlpke# zN>;$G#~}$W%gImrNU0-kWq|9Ie8=!m$X1LJ===1* z1q#L`atJzaczX@er-85h?_x60l;E=PQm}XG+`|cKtiFHg02`!=vt|@%LAJ-S385r7GyZUgBg8 zU`_77wg-uYu?}E$fy1X+uvMWbzkm;*W2ph>0hN&a0$@kk%L75&0T)BJX+R883N`RS z7fT%60(K6!TF}(s6b2I9L|a-3#{f4z!)KIiF+iiXk^HqW099S<$ zH^Zr*)-%!@@^vdSV|<*Cj-uK=DmdjWHq+tT5P?s=V%)zXC>6650vavLem{-u8bbRH zG`5(VJ8C0^41enwO9{!I7;u;a-z>%evzB?_L%1%bkx8j&Z+Qw^9w+BFWtq!w4Bu5` zX>X$EZv-lnahkLO4weuwc3-H1EI9}IBG_*$sBeE!LSC+6rNo2hi(w^`gpA#k$m`&f zHHl7f9M18|BcCtz?4yd&5$)H5kT*&Waq}c|C|>E5L8%YqA#BKB@YX2>W^(6}hO8lb z+h?hGV&m|;Y##j{RQcN=o?XAap0`2Z z(@TE+jg_6RKyUeB9BuY4CG>0|o=eGjXzHAv) z%T$!8z;M1e<4>Q{GCvvxHtohx?-E-eh z6`GD{w&=nSZo8X6>J{)u<@a|*!jk+c1Ewt>3YC#`L}Ii9$l_k1GyJr2Wll zUT+yVwKOI(b>i@Q5~uo+_<2nyHu{M4!ld+>rM^avy96Y+(YGy2B)S~ldDFZ)aYsJv zFRTHwpIaO2h3egpm9*i&g>VtXOYn8$w!X*Dw@EhLU9YC$h&PBmKT()x^X7-Qf4ti3 zuSk`qPdpX+TVIaQokcFpru%$h@yEy7Sr$_SP8;G4+J{5O`vb?BFM|zoAL?~x@;qfZ}FbwIosO3OGDG|HMyy1)3!He;oCWvBp) zUDx7j#77$~^Q(bI-`*qYu1s&VHhGuCtI%{Z7({=a+Jdpw@rqPh?n75kYSA41+G^t7 zkbw=nceBzEsowsL+asf2<~`@eZkUO-As0el-E&A1 zrjAg&*{lU_sIY((lD(c34%aCvA83B#{9e_~IkWEVgAo-QladtL82%YsVKvIxQ*+r%}`Lc8_ zw59D)4-y09z*qxr=f_iTY}9ZBsS{X!eWWv*75qVFa3<0^XQ)q}bAcgNHMoSY@DpB( zYPLk(hxskKS8ogYe@r!$e;u{B`;Jx|ul)|ocz7xwyLIU^D`vngPiv^gOoh~;qba)M z-8ff?J#_AGiBgZyjgh$D&8qw{@T#x$>VwS@yi- zoE<7&rdTIGJYV9<4z*cOoM};WchojQSk5jN1&YRP6&IGj+fI1<)mqj-G*Bd#KwE+y zdZKM`A~D%%zdhG594FE(x^eMaw~+PD55ZeH9TaM_%91i;$%j3C=nDvL)uMi!Ya zL}%VS!>({2Pc=F%TZEEWX!+f^0rHWHO=*NRhuOA2&<{&GL$EqYry*2|PHB@YgK;Mh zOw}fgFP)fZ3GP(ur!KH!Jyw6|NyJ$_6y$4};^g zHF0die_Vlj07ryu?8@7I_13%v53@deu$0Pr$uTPa?CtGnq?*MB2~m1bzE@(Y1Y&Rl<%uwDRDL~DhE zPne>8iWjMcryxT8v*)eBoVk~y$72enQJ42$d~vhhm@pJ5O7bVUd2c?%1~SPo20oW6 zxRN8w{F(0U!sj(sPW3ADo+!zCD7usC@#nL!Cmlz@n{%3*&F1$B|YwA~@ZXZ~P*5ISyad$N9 zr}wJ#n^?ubr5^7p@Z;FB^X)2ex`;Jn>UaJ1vT-f+A(QJ9?Yzf$=H&t}_G>8RoUcY^ ztTKMS|B-cO-P$PmdbR}r9krfkCEVe!kD1-YU&#vTSw6-t$S)`_?Jwf&<#WZ&kz;igVAm{wR`< z-{@T;2jRqWvK zRX@OJo3>z9+AvoPUB#bz(0SEt_Jl7=j#s$V(2#?nRnRJgI^5#s_|ix6@cZzw``VwK z{Ybo}VHY|(AF*m$Ps7jan|-yU z9VN@Qf2TzC?fAvByH(}QnSPQHr0H@>kG>z>lnr3i)+gB?3$=FYq*5J#$_uX?i1(4o zwk?bgY+>(y5IW>J%->`3pzB5?#(B;cZ zlUScV0tZ!uNZrVY)Y@R0sV~8LH7Xk$lzZr~uQCf{A@~e95BPWB^t~rOju0 zqj?7fN0f(P;*vi<>IAij0kmrCc5Z!HI-DXvY8uYylUafr2(>l8TXyx1a?nAI)Jbq7TNd zmk%=CtsMBw@9esi;I!rt-QcM&PR!KW8g;?JGb)Fnjj3YDYq&|3_Ln(X$nZOQ+9`xvMKuk}p31hfe8%4nH6OHC zas?B;FAckt9B1!bZ(@8@96ODyBRAa^TYs z?u6ux)A~BF&tV|bmF|H`Nn!o+#nm*WZ6gB6o%(5Ues z*Mmwb@t3|5IuwtfpX+=k>YuQUOSYrFVTEvnd^2V>RoWGIg%ZUH6eGiB29Y?kw&W|H z-dj|&3>J3a+0&O-evP6JPM&f3>Z2w{-=)l~xrt^*6x^yTD6HOUE;4rUs9Dc{Xui|J zd4i|^^sDa(E>&0pYtbfz8hsI*J|Rb6b`9H^*!MEjE=^JvUMac2o*yP{Qc~L9$}+0> z?E>BWHQ)cm-g|~cwQOsnjU+{a1j$iQKtLpC8bp!^EjfddgXA0=L2?EG$s#$6(BzzR zPLgSIlqT6=)86S`XP(miWd)u^gjqsDm0Te|YYUgA3;{(PRs z9g@ruXOJd@T)Bf_!y}l}!)saExTm#Ql(Pb7*~9KaSOZMvW65poNB8^iJg;Mtxwlz4)PbATP5)klIwe3{ z`SYH<#zti+D+5BSXILxf&R>%Vx2(k?Ong|AAE!joG+`5 zdcB!EvJg^Rk~(SM-di0BR%O68Rn7jG;M~y&#Yav~^{tYKE0)=iizdx=eLvKBFf;41 zz%{u-xx$oWmy_jVS9E8{D+WhMK)uiO_14&nK?xtUSm^W@W%*>-;;yF$>cMr#>@QGN zNRr=8RiJ;zrN`L`sSn-9(OanQOCxU=J@84nxbe*w{%oYIz}S%~(E@hprRxebDZ?vW zaK~Ow$aRd)wgxE%XGcjRCSW6K`eED6LF&!*KDT_kxy+r1A7EwXkp>T}1&D6f9Qw0* zJ|2>p;-?5zZB%|d=y?bmk(YxtrO|{}y#HGKHQAIH!g+s4gem;>4uOSLz#dwD4L*FR-JoeWY@*iSi?dt|C&;EjmJqas|`xIY{#<;el z3k|HRn5r7ANO;&9V%DBweLfD$&AmMrpdxE14-b9s@C5c~xr__lWa?&J<{2^si5Y}z zc`+ul3YI!g^e=ugiwlh$R$LSj;Q|}dzonF_j&(zO zYfc6IqA8V+u!hH!cW{=9JH{kRet`neWC#Ajrp{@8C{gMTH$EHqz$Q#9ke74XpHRzsu5;_Le7o#+;(Xgy>xf&LRAIo+8VSPuaJ{gYRLBr3un%Ll86@_hX~Q!9Il9E|RHF za;?oBd~z$^nN@+~ssad3>oencab6Ae-a5ykt;9j8OrgX~*J<=W!X7Nx^_E`_9A+}d zGq==5V6b2%{_Ms(#(ZsmXN=X($G0>8zQA2Y#l4DIUROug1L1}h!Q(pNBboKph>hvC zubU^mHEB8FmgIJYFBAFS_GosS3)wB7Zeou3MgGKG9I`%1F%I-xpn@arcRR~%;72jm zVG+*<68N40dwx@?abGH-keVN}FdEqj0kPYa6`vJYc$Ww6@LZW_f5XcYM;$d}#*7nk z>~hazRr@l`-OU{KmF8j1f=(O(>d)ALF?YAX!EC#b9{CJ|VHdyEfS2O7yW)5zPf1v*y1;f3R zbv`{`f$I9kIfw5glk11=XKOI4O=~*JFALvfm6wAO=dipy4(ER2BW=6PNbTtUg$GZff&BCdhC{roK=^?OtI5N`B z;nDmi%4*_y%$l7|P|2raD>4{46oP$nj04D$n@1+M7`Lved%} zcZ$1Nwse2)#Sch{b-cBZ;OXmUC(OeeTa+S_KA2~&s^34_A8#=aQe1wRY`(iLCep0# za(Sb7`cwNfHwNB23~Pa*#*3Go_=yw9Utty8cbwYj<77uJfi>(4eLp#0+UhnoJ4{0n7X#q|Uh9 zN*F;~kI3)?&#Cgg5ZW)QkoH+ZKFZIO>1Bu`gx_eVX(YcPQz@arHg;}2ODGc_xT`a_ zO83?^lR~d$8YNM(N8$baMAoCwMqAIXCZZa@=kef=XUp+n=9DS!Ta51_>JUQhE;em= zZR-@{ObL&o51DEe9_lQxeQtaguI2I$_Ug+H(wn-JwSCdLAXXK6-}VSD+xpWHfqC~) zV}GEM6GgIJbbXXOOJvP65tDCY+Mh^}4jUnf8w5(vzK++Ft7|4|OqtH;<_Nay={H9c zdk{S3#g3=aX@3aXNT9kaoA2v31E#aM?s^q48` zOZFf~%}$)uTPTKWUhPSF8Ln0!_ifIC~0TPA(t<2WU|a%M9hjMMzc z%iXRl0wa*u%I+2&Ml&}x)HW%53{^*LujsqE1<#n)>14c5))`BsNtVM?xi7_kYqlH_ z?;4)9jADXwqz~y67wx;(4q1IKXxHsbg)9j6cgr*1UgK@005FC0P&jTMt+h)m-nab} z)h@q+g#kE+C!;MJz1Pu@oNw<+-(ae=c~nU%8Q(2RZkZBaT0=GYRFol{!>6>AxX{LB zQKHPQxV_+6;9LD8?OVEJig>;AremOpg~E12j#pWGjB^6z-13c$wawWw)oD!DoL_Et zzxC*y#0X;=EDaVTl+&r=zqgEg8F~^M*7^Y2Nn;95hhC;0nx;M}r!vdJiZ77H8@4B7 zi!ff{=b-v_T8;B;C37!}BmU$^SI)Yh_wgA7L0FNd+%r69_vr;!)`0nk6nBEnt2HXh zfx6KJ%8VyZVRQb4fZZIt6A>RwrmAo&;`hO_e@%qk8xE-WZ2DiIdB6wp3#7Qx#!*u% zCO_Gx;V%d{B&ZPIZvwah!)WHgY2C}8xqHSXj^;O+hTfI^sKRKwBX;Wvv_%4s<<4Y; z0{ZG&)mSDK+T0d@rt9#t@hZEHOjXvO%>NSj1NuLccuN1kXt(`=(O$CYLVP_w@o&n? zex3abBnzWA0W*@iU94$3}fuR{}XgONx64f0V>UH5tkGinq8Hy|HkaEUIu zSW8_!ro0+h7|;r(fk}wFD~aCGbbSUAwn|qrR?}b^~{vtjRCJ&4;UA`tL}iJ zHi9A+!0QqIgwXMVRV05iu=|7M)em6`*AHft-GGO~PVC>1=TpZkdsVM%-jw-sJxRZ0 zK)yWIqYHexeOr7D)ayHvKJa7IcJRBv-SQXLK8r))PmU`no6kmnZYDKueLRIy-$(+U z9(E*Px_*`pU7G~fr5K>q`06Jv=wP7hI`VgZf#@pq#8s2tEGE&4MfxR(+MKl78M4ik z0*DTszJSxw}xKkPB`) z6aobqs%U|J%ynqn=eVFiQx>l6+~C;(d=pAzXfb&d52R!4nhdb8qCH_w1B$-jtL*;z5dE+$Y1+`;jeOp9u(X~`waoMil>0fhG%t*p&Qlo z)($w$J0pYEk8SzqmmE#0^IkBu8f-AT`84D${79&j4o!`hi7zU+8a5kNs=Y zw6FI77xaHfqWKR=gh-EKpk%QU=lxCoeMeXW&S5eAZ~q~Ue^x;J8uNn8l(G0{VWl`j z=f8gn;BGN|s@+zdvW_U`E8(2q|D`pQe>fw>a4#1nuq>P=s`dVwld@+|?z zI~@fj{mgavf0^&Oe`~JNjdO>sjk7l3l>0qU?7Mr%Y zmo!?gzvbLE{U3uiTpSvf54aY9A(l!>UG|A|Nd zGlSt%Z~tRG?|;nNKWe~b&$so3?%L7S|wMl|;V$C$%~GNLvVcq$)+#Cp2;_!JywXT5+hFKCIc2R(oV8Lt2Kf z^Cz{c^=k3?HzGnf@33}V*_76<&XP!%dmllp$~id|tK&XI^}y&o88lHIbMCD2-TV#y z*>cykze)7(j}{`UAE@2M3)C*=m=KZbRm49&&L!H6N27rhAb#d}p}x=i)Gr1K;5OQ! zpxtkU(c6f2yFv+*vM=J`w#tbL(y7d>5K*EY{2T3S|6);q3V0O26Rg0-+D)+(Mg8 zvs>;0GN|MFI2B5j)_K}#>$QQe?JWMbj8}w~bbKzz6LKknl=Zr8E&j+QW+7>Z;flI- zjA?Xt>uGjv^zm2(96ymbT_Y&h>~rkMR-%PIR^`hWtIBEen{a<3A>7Uk?@YPf>{)eL z?~hpzyG$O7W<()QGWa5L6`!eTOKj&fHtOr^TAEwvOgCumJM#4?X~1Imo7%27f#|Qf z9S&{N^9D(sTHvkN=>{xkk`&n=fNRTKG-;{B)d{eU_Zy=Ootxy~5+X-(quCr#z$ayM z(OL>=I0d3>VA{{!j88K4p<}^2=x2au6)-uy-(N)ga)VDPet{?qieg39Vv7L4vD$05 zeK4M6F$4hdz#bn@%>1tcukHd?`M(z^Z{W1F@$OpfwKuIFE>iVEA@nles81Vkt z&aod)bfmXB=m!1s?|<)$f{8s;(eEq_8eveIS+x4U7LQ;oWJ~UMmg_v3pIUXNnZ|z+ zA9!7~7FgNuj-i5ofqLfHYrLV4e`k@OdBCs$Yx}Sd*h>F=2cW9`sp}e)e~a*Uo_`A6 zx)9k&Acx?Zo!oxpyPkKaE&yU7nbgo&&p-$aLW{*1NrxM(Id9Q9Y;T*4vRGSeBb_jj zms(V1+%)V!H-nA-Ge-O3uQWXdH|k;wjaCq>N|b6N#f_&l5DYn6TRRI5gl;O2Lk~KM zZpdLUsotXs%Wh**afWpQiz$UUU(L_E3*`%?`tz&%#M1m7*(PLiuk~GSrkztY zmOyUwzCtQprhPO(u6C{vg&cHw>sa~9Q}P;Px3*y0%`bJ{5AZcB`^d{WG#}ve8f z)=p5z+L?S>o1nr&^|W5@yf4 zl1`7`7a7o!V+@)g6E|Wbj<-)XMZr<7t9W}r+?PkAAD{#aC=qbMB17xbghm~KI-+vve=exsfR*G?n`>`G?!*VV*U!#7G|EI)@F_o;#6`G#_QGo?4K~vXqUP!Ws zm8-_tX{yDO)}IZL>zQ=H?yK)uOSGXVF5JlJt`$i9b|Q|2m$G>_i7qKAD7cf&%w7@R z%7BtU?LX2eq;GjlpRimlC5@_3!&Vr|5Zw#uGZcGJ1^rX{DmDMco9 z^}O2i=buupC@$Q;wV#STIHE+Z`@Lq$14G5yuDG>cK^cgc2Iknxy{pM%%7MLC zOFS`xZqb?XcR8IlJm^9^#{iLe!jTZTWNU6O@UlDlj7;XG@9HFZNtjXFa#Yce)qE_N zDEbRj@;V2T&4CBwNM<{KQ5Q|unyo&5SaDo)Rg<0y*JY`ye{A+HY(Q>dxB);OOn$;S z%C!@X0NF1HP8I#%{15(!C-jqmIr1*}TV3|W`RX;^YykiRq9@SJ!T{cS<~uijLg>H` zULmzr6Z`|D*dCgkj=bI%!Z$=)24gYJG9^}e&r=p2X4aNV)So?qdExb&(pDK@CProW zs3J($k7Bzssp*7N>l^92+&N!2yH7Ti=3K!? zon5yK4Gh{J@N|%hFt;#svIIZexkoM&m_SHG7I6NC?d?W_ zn3*5D_?B>=@9PcB?6d2Lvj+YYV^SM;5ND(L*MZXHenta@Xoh6@PY-nYrb(K!=IQB9 zjt+LUQoJog)dsaE$X6`u6R2+*8s4@AO5+rh(yTZ_~RlFXC@16VM9MARf0k1IAJg4FG z3T}Jm;K8S|uaZwWQg1=O?t?n|Ua?^o&iJaE=k7Ne2KUD)74elhg9INf`JFIy!MX8}kw()OrA@Z!5)vwbO=7Ke3OY8#+JH$E|car*WGZ5M@2l=MgEVp*f?{86S2YlC-|5~TaSrolFBGw6BWV=63GyVJVqAJf`ssYm zVpu!T*on_u$1Al}V(xaAvdR>t~x#c!nLMy8OT)5 zI0`_+-p-Zhk9BJ5hdia!A#PKdW`tH7;)a1YF#(lst~vYq zP6f2RZD0FlK~y&+RDUszeMA;Sf1#weqtx^ZQ~^On8otZc@_nrC1!8C!+~YlgkgPPVP{heDG%}QXW1B43ZB|Q$#eAH_D=%X-fHL&XKB;7$ z-bUER=OOE4rckT`=X%{gV(Q@g!rivKb_P#)=MM%jBd&#%2Yi~Ap&gRcN#-wXvu(j` zIY9`_XNVs`zCuoALg7hAT(wtO${S5Q7I?RUDAfbKc4k|4TqJcHB(A-+-+4C4&NM5n z|7_vyTjxrSbaR{tZVR!x`-ud{v=gTT6m$k97Wi%>`I2HB|F*qvSm(nW2!@B&Mm%#FXo&g~jx?v~N zElCmjVuopk>r>#F@(lOGucw>uTL*H}ge^w5oXeuJJM*6Ih$rWtaA-GIP1V}W+CqyA zmRZB|o+k)bysg+)tY8Yp5U>0Y&t#ezwHe=#ROQhcf{3X7Dj~YsXGGmN$91mbE0Z@= zX7IeatFX_H)IgDj-OVjZ5S}mndcK2phjxk|%78TOPB4(kLnbOrZw6vGiMxAL4Nv6Y z4IUSD2Y2C&J-f~Ppm|3D$>);~CduTQ(qqjJulI6DWtxAHIoFm{YLvw1&iLJ)@W2pWis!BteT)ejY3cp; z_t2)}ZR@7Hwb%YRW&7SgLJwWpEMkNOq|16I;!gS=dzC%QGf$Q^*R;T_QSgd10PVc+BZ>zwi=--%s%WkPR6{%!HSaxt3znc5*W{XpsB-e6N=up^K zy1Xa5h90V`p0_WL8z3!hS7>)*Kh3Zgv)x~<9tI|&c?Qm^?8MgOX6+28>9jpJ!_n#oEE9xg4_Axhmc?*joFh&az`t<}Fa>zWbqr zqaHNIJgphAElGp42R1}#(!fRS~xb=6pJ9ZeSX>e;J?b`}iCEw@s0^E!CCL6sc z-oD|Yea~-K=*_)G z*SMPqlITY{531<(F6b5ecJu(~++RpeG3u1fmcE_u>8$?s`@eC9j^k8*@WgbW8+p(^ zG*Q2gyDRb?IcxkkO47eEonjPjf}P7mug!vbJ-=V8H^)eTZ~VO7et}4J|25MpP}nzs z$PafKpT2>0AHrXH#|Q^Bh9So@mv46SH&WKWa+yj|Z%YO^HVkz97(0-PigJlxt(!Y5 zi>>htLch~9M&tj3dRKA+PIQfJ4gG`VcNfz_;Bh_cqfDLbe=H6aTN033fCTElyo6j`<73I5c*B?Qnzrn9g~}_$Q{N(iG285wO7apO1w&xL!-_ zH3iam`OnYmSnyT|vWl=ZUu-Z$gWS$%)u-JGRi$p1*1UEtXe95m@gu`{v8q^8^HVfpia>LL zN9A(_i0w~l6hUe?F7Uwnt~C)_)E2WndtVL!0?#zS-?5^Yy(>SIO!_6iDjC+We6uel zj4F*fkyvRRk42_fAG%-Iy?~&3r064tarHRp?8T+C(^aOVE~wv!o}XfqVZby5Vy|!v zW6O7T;wAKG z-x&Qk7AbRHd9@{k##REX8rr27Tk}_Q9|n!BHiQ8Oo8Rq`2WxCpn2XF2N8oj$$+n#j ztH}F+xA49^is@P#b(;PQbPEWCf|nTaa_Qzk%~WQ$RYdp zU|9H92>}Y^d+-Y&7)2errqPDdWH5|94gKBtkN@+w^!?EmCoe!yWM)7~+SY%s%HMiv z&J>k%lL+1xZvNeJ-rpwUn!i`%uYGh-g?@z|$UgfYc8Ti6{4Wq2)NJhPe=Omm>%%{K zu}@@un_*FKm3N1$cRjn&N84M%_Q_P2mY~pG{=1JGe}TN=a&)(Mbz&}xupQ@0N(T62 zjd4Sh>7Q`Llo``N`?D*dbMJvjO|DXa%L}mOKKKnhHX{AKxR(*G|DD~d=LCWZZzTGs zJ*)^+0X0AdtwZtmu!=V49t>j8AEI@Xr$Ya zGErX|$~!r@hbeoH~L#3sethb=^y3imqShZ94+_uHDO+F8bN3%vFMr2B<; z<-IHYN_DLx?=&}tOhb4Vdv=74dF6yP3@%K(F-CmnJ|Q8!3;qr3Bc!?r!t#7+bL#>b z+snIja>rD!9^CzyW4yJK=ML2=-7yLZZEe&Hgz>oTl$ zdFyJ`d_{bf+kN?`OJ>7{aF6m1VMlt@iLkh3x$j1?wIut=Y)kn!!PMe?t!wvS^31~h z+5^{KC68vQgjBA<{?jfR9?uQ)1ljj-+MWX1$`dHlVo$A&kru=oKOv=A%PI5sM&Aa+ z4<6G9y2h_qis?r5@$ooyaoDwU;!bh#Rw%9!7ET?gXf5#>OL`8;Ayk6Ri>=dCa^bk+ zb6PdY@JrXWY5Uo4M|mV4n~M|H`xdaU$_Vj&R<{3)mIe<;=^PEPBv@n2{5Oi}f2XYe=XbsF+Cg)ZRs0O}o(?_Q+T;t5 zS_*7Q7onArkmd;Y&f9r6Hut7ANLbRVj})aR~Y0FopZd z?IFzh?uZVB9S=;}NvhBs*24RMK77d#b`dQJIjv+-;DF+ z8$u8#Zj;T*qe*_s1!X1mnyC$)6$_u@Nk(QlS&t#&(^7?itey{U4=PiWToPlP#;$%; zrdI&446;l~_yHuSI~HGyddXY1XTCx7y<ONO4jm+WOFC9Qtkm;(muqtVBgp@h- zF%xG*fg;he?7&tGA+8ZozQzgVV!;Yw+aB;9`IPTj*X@A0tXox^W=y)TN1sw={R1&{ zIdo8r_FQH)H?wfZdu|E3uY4?pQDro-#&CsW1f82AY(QhRqi`8Q#kb>Ve$0(q*H#-W zzxcA)8KTHyACX%u(4&O#9x-i8qr0o$2&?A#Ua#=r`RiXGw-4eG-A-8YrCvIS^DVm~3(FGpDJ0dY`lVE$sP$S2T z*OW3s|AtA^3oDLi@?)&!xUZ5aTuCcyRBqT|OBugNO^2oZAsx}fSF9NxD(} z-j0D8G;t+vG<_JC^4i;dg#Ps!NU_%`VvW=HO$CHL#cOlksH4Pd$e~bS$Ow+@{jb!+yc_%ln>;7~;MxnOHfk$GW+UneU(C z=3nK;5E4OtfwZpAAekNLi-OO=>G@Yxr$m z2K%zmt8}R>p@X_cW++BHNj^(bC%e&1%yC)j6Oo=4J};pxm*p;nkVl$C+1zEDX^Sh4 zl@P~U`_MRrAN$@H0y+O_Z~C+C>7UnBXhy(pO_&QTWT(*GM-6~}1@ILZ|FHdpz(obP zFi&cO(Q+FYS3+^i5u4?keI12#aSBM`in> zjSIasyMqn&Yn=(5C0a^1pb-qjtuw!^NI%dlh>FVfSc(Ot^WE&bdyV$R67Mn@ly&Lh zY|L&y<*!v6C3wS>Q#*7UEiLd?}I1!bNC~I`WrLZs8IuhnpZkjgT9ztaT zle_CquMSRS<~Uq9Xb}G-LwtA*juGdB+bO9}o%FW*wY>fD}G+^mCn^=~mvAbv%ewjrF!G)2fq!$S;(xmIonl(LCvU{H+X?rg^*dQ?| zYAzBzNotIQbf;NV=2E?x7S}BtTZ`wFug_mP<o`sba*Kw++G3hYQ$dvM+-QF z&YCFsF|60oTjsVX1Mp&S@HMn}uO_fs!imMOEoOo`7M!tPe$w{@{& z;bnUhM=t_$eM@`a9A5+rvq!oTnXY^i666CQfx+feWx2d#g1ydRVnil z^bSeBS$lDPxYd($aL9rn>@_D$5guhMkiS&!xL^KrQt#nXnJxpXcNN}qFcr$Mz&4Gc zI|tr&9|-p0h@o-H@pPWkNV{!WWou=arzBvPVlxSwOJ&aeILnJE$4p50s^QWyL-=3} za&irTZ+v?;vYP$tE0dbN;FZiei13u2YglaefwBdquh@D$%=(k!kxVBO@qF=Vg-INh z_%}V)Z;b|D!`>NuC-Z%V&<;Q;7L7eBE;iU*C4hw=UldVqEyHLeUc7ocGelyhlVO#gB4+3N5rj*!bu60EJePR(phlZ4!;vEb-2Rzt|Md=I%nDt)Y5!pxN_7uE%u2U+!NmRH*S z?i_G%Xc~DaQSe2%|K*t)($=Y1iJ)gXrB!p7$fQ)DrHPbQCEP{wLHI2m4QxWtQ)Fq6 zR+i zj<}Q}ITl)KOYl|*GP=kXApUodWZD&d)KIFNCruGr`NaMr+I`0_N=S&p$>>F$xp~5@ zppx0rZr*cxd8v>67u?^vUNttI)K>GOnJ3+jxGoe4(*TP!3jzcS9g3JJ8 z;w~R^qtiITy82l@l&}evk@b(jus=&`Vj9ja`B|`n7sFL6)^&HB z?#A_~(A`lFeCp`=J;JUnieG62bWnQ@i|!43kYHLY;~e{z`Q>*PHnC?FvqPlsf)b4- zI*N=AjEHB9J17LRz==I+8_USFjdt(+s367Q^3T!bM=QGPgvW7xR3AT>7%5&dzm56Y zN~++icmnAF6XlE_yNVf_>P(aGPeNHt6>6Ik^aI6HUNf7VEYOGYWq^Rga`<*fgy7om zVcGW-KkcC(O?*;pS-xStr)&KHZ? z7>hNJ<;T1AGjU;*vqLW%9$5OJt#$jvb7=} zfPynOa96MjcbmQjI8j4BSlo|b_>U7cgzdse2l7^WT&of@aCoXPg~3T)g&mrc&7=+p zD`^MY{M|<5@B+8G>TuJD+on@x;kP5l*=X4=F=1{DSm$23C(fRsYSHT5k`LWxVUL8D z${)u*zU6%sK}^dmkvqnc@M<($7Xg3`n?=g48|BL31l&q9ut#^y-+1|usV`N%{v;RG zk+JzM7&j4u(2nsHSrenI^i`^~Zl$kImd5v>E?;t=Xns#ZtlN+MC2!58PjZ%D<8F(d312u@bK!$|8U`K0-T zbj4u?{nRFldYb<`slf={#l=hwkN)aitPp*L=tCl+lud*0w=o8i<T5G_P@=y{8nW_13SrsnCj2#y-VrYu$qjA;ioT}9AS2?DzVdiDvFSk6G%{z86M zO5XF5)72FN7A-{SJq&BgU{C^%%XF-&v4HK0aBX%6nj8TQ^JgAdiw%E;bUxXeT{W)_ zv)SVe8&n(JW{qEvgVmYhv%C-rUi%`j>g(G)^Q6tvqov_%41wL^i`2usq?~BhpXN>c z=Is`m1Q~IZ0S%zFSA64dB{`5Bn&a@uZ6!{7J>F1jE7cNEZkLsfYq3(<^k7TmQFQpVYWCMN@=zF|Xn|Ac;bg3s%kX+qC zT^6%rq*okJy9X5x`IW5d?alIl9yT zcd5^6(nLF)N^?_V^hK#6rHL@jIO!Q)WRE1>7ldW#1s9EGu)XWZGk{j`bt1M|^mHkq zCoRKSk8f|aXPqLFYs2CGNGa6Dvt$Jg#vdqQ`EHM}b{FcLg|GE9Cw+E@zzoET-dCIq z77j_jBr2u2o9z;Xk%hXv=(VAVq_I;r;gcnUvujxmhgHI+PY&Wc=)x`pPVrkG)dzKW zq(%C^JjwO6;W8broBWK-bYorMv3Q=Gz4$iViN-6Kl{oWThhcx{-3#bD7^Ofg&aTJh z_^SS*p-zYRtNphlZq)oXgVp2~ri@rP55rkV6QyYAbvNq1u+DzuS`@FNPrdPPd+8=1 zK^8DD_xV=O+2E<*<$`x0q5PgM8uMYzVy7bOk@DP4ce%uWv3av$>g!F|!EPksy{9}} zWqVcAH_o?z;9}8t<7?k_J6Y@wp)(pJBGn%x-OFrDa6E^I{Xr?YREa)jfbgi| zc?tWw(DmFT=@_r{vMwVg#Wl`H@C2XCDn}^Z%?%6TsvjKFllRA zhj`4%K0zUXL~ho+zk>y_ls5M{j*1uwQHX)>ue+AsuWyu#fos+&PjUEdna0R?;07tj zc8c=rIm}ZiO!dS;`StH=5Igi@+V%2%pRKj}gg2=p%^BZ+(#H~C`arDcp=MPQE-mJ} zE4QJ=st()fuEAA>`q%y7s{V4!h1c&p96SuPeP*U6CZs@lYQ@P5Z$W8Un?8F z$hi5*urP^E{*3~fXdB{3k(FMaki0%Wf+WdHXQ4)nkC*6;p4NRW|E9^C?gfu_J+5&BeR0@K>veaoQITU%0+HUxn6C}4dT{7ce ze+E2^0$T%TB(F`*>b&Hs9tUj+=#duBtol!95d&vmtTWuR5%eC-G>3DkD6`1BSd~6W z7x%YJdol+-PUgFN%y15#+<+(5~_kd zP=i&~d?eDhM1(i8?E5YazD)UQ+Io;z3#^8|nW+$P$+b~>xS1f)o6Z&8DKI=)6ZO?A zP^QU)DO7H7#|r#apgd^=R$C5lQP(=T$-g+dfn|^y=ooSgVUdsHGzPl5pO(WDI8V$- zYme8Xaf^4o0iHWCI1u5@Xz5gNq)IrCd4sM z`Q(BTUcNF2Ozjg`Ww5{ux-WsvjZROiT3^YUr6y+URcwvd$ms}mLj2cb){I+SV~=i< z9X_8V?h0l-uBwMMPUcK-ug&p;>lVjs9azdOhNv=MK=2ewo0~W&XCln-Z9N$-og{IP zg&y#J2VXFhU{Wtf$e(_+_;wH^VnT~%LXugF2luhb+hg-Fk-O4a^OQmllG93IPAYl- zY83wEw?EF*`MF)=DOg?Z{4a3I*oy>77`X?^6Y)Br@5x%%j{aTV6Y+8tN( zcSP!aOU(@sjc>P`;zKQ~t=JcmVL0>}%!i04jBisRM+Ka`rL$X94bHiyt((W z?Ck@*Db4`6?A0>4xLFFwA|F`pWj^;lM^nt@HP(F@&T9uxf9$s zK$vrheP3>DM=u=0(qgg;eAVk?Xe<&t;~T24^Z`5wu|cd*;^7Q^4Ug6c!9oW z^6B>EF&)RVMnTejH6@!kC9eiD{R+#a7(Gpze4TO3`g-HE0I|#9bgV3w`S|M}M{_|j zA3hTl2ZL2S0iw9VzG#ZxNh^d^qkVqSND;&ZKX9hJAZG0FJIUbbU?OFzd^XiE)iIWV%TIvDoUAfyOiWzHMpvlZWOYkdZD`mRz5fiK2vJk+{gZ57F&iK|RTM+;6Tw zg;7O0Pev6sw=%;mOcWo611tMxqTV@BzAEV5`2Y*xH#*=z6H9>6Bo+uzo$-;26{r9B z=rB13Q=&<+m^P;e35cb{EUpA+h75yLriqq)r~Vg6qyW}n-tl@l<}f~1W(?2?Fi4*p zy#BF?>W;cL1%AhCM_2{`Lxf89ZORYPo-cJK12>7~D|>};7)y5fv7YAyabhNoFW4~o zWX4~gpp)zh^%dQ?TI%N$jE$7N__$ejk}W)3#AA-~_{)qEmmhJEOp;d6Ja`m;h%C8?LuAfpv}M z=J4Iv)%RBq%mS`hMX1JPvP2kmXfMhDWK+I4#k!%Ao)z`c;rf&0{zW}47B<7BBkWY^ zw~mCi;nU4d@Yqln{V_NqZ+})uD}|3VM|TJ-`LqLbiC-r{`%H$#IRLOhc0E9~f$@nn zG#+}s&4?m}$S&|085aAG>oJ5JIY8@NN7SD+*9jio&&t2FVrf)dkR}W3b>Nad&Gty! z)rfkkHb_uOfO4JmHK{$y*`qEfO3+tw5!BW ztc!thS!y(e7S-#@TO4u9-)}6^mo73|o&P3_PhLC1KXLVyLj^LlS@k%0J~mY&phHT6 z$QTHWCodZV0Z;|rGjuE9>Xv@7eL)m4tCv-iCea#ODp5Xi(VL3%g*o!jc}beKQuG$f z8BP~gk)o7P4k&FE>3O{1pGW;PqOR;-2tk8y{iw6V07EdNXmY$}fVkypLD}v;z@DCm zi0DMjg&m<7)+J008q#Py%Q!bP^XlCc(3%gWP5W3uE-1r;v#GV%E^v@BHJaGaa|m7+ z!?}e_uY|aP7cPj1BYj%HZ!6-i98)P`KM3RJIX?x#)3oo8P3GAhWDsBEM1oi0nw||Jkp^WCCo_YCm@W7EAybtPb7xU7>9U^p)ct-CgU^MI}Qvi zQCzEp`p9rsvE&&}2Sch2pJnpXl?Ambud?_hMZ6y7_xL@Ukp!{vry0)43^gesDESRQ zS*GTyg%#~x-{kiUi+;75Lo7x|-^$Sv{7El(Hfp{?EcgU6%7!_YRQE*wg&Qxp(X&tT zW8vh#BO}BFcQc$~OhXS=AOP?Tyk>mCfj)Aj|L@KDR+yDGY&L8d)(J1-ddHX_KZr^; z4PZb2xWkVDjI%p}iHqvhU?sr0O>K-+-Ryos5m4!2r*GPNJ9b<)Z3k3n3MK z^sM)l?%aP|G0^1q6F+txOV#Gfeo&9zaASFG_D#CEAB(%3t<~35rq+?4o$eXo9z`qN z*sKp=ZS8>fWzuA-X2eow^0lq@)OYL;ajc7W3)T-$mnapYI3SW!pr}ttfp!?~t>7^4 ztQ?<5sn*z~HheaT-}IZ`bvwzB1X?%}8pKGx(%^a1zd7xQJbP7Fo5?iY42BcP0q5k{ z$tCv+Z=^=rlM?YhE6Jg%7rD~Gh#!0T1!i*eu(*eI@h;n0Pi@Ox4+dP%IugXA-LvU|(;dc3P;58s=-vO}v8r}9xGzt~`jyDctok~{|Rcm;3jtyH?< zWYTqu+NV3QaAAMo{hAyj{+#ZEom8u-$g5A7Q9EEcB+RO|)=^*Q!24okn$(D0hmpii z5%1|+Ud9ee`dr$?v;zvA?Cvb8y6GCRFuRc@c79$XDGTK?z7ScrG2EZ4nU6nu*BlL( zyXbj^(3ej?bgz?R4fiMATX{6iz3peL`Q^(DmUW4>Rzf#dW#?-X<%#NwO;s8%l~mP; z(h3ySl&@mB@&0vkd9i^F-(q=7O@Hl#WLBgogdsug-pE&-iNsM}Q+!de<4WL2AiX?) zikex0Y6ri|tLT>e|VI+x-0lc=R55N4wG8)UgDpI)DBzKxJ*)TA=$-XNpy z8>>2H#Q4B7Z$ZX4Oo251*}_RYYKtvr{~%snXXQ{##{3PW~`N2!*+RJ1@4gtNHnk zO#6ASW@vIK{{12II&xaSNxqgUL6Vqr;L9gx@cbkCZFkud~Qh z)^n4d{-5w{Sa?RtR3QWtJ@Rc{am_?;%2DN*NSRA`Vcqiy6u~mn&bBqi*_^JCP!nlZ zDnUlRN>pl`I^UVyelKgi^L!#@m{?9XjFH0ckV05IbD6s*+DGT4uxrG}VBGF=^YrbPD@P3LpH@kifoZ9IUDBFNWrs`-Cw@2!L4Xxnw)L4r$=-~@su!Gk*q zK?Z^*!7cbO!QGwU8X!oJ;DLbzcXxur5C$JCID-!Qp8nRZb?SRpt#6;b_C8go_O9~> zHAB-iPd_wtKYicV^}D3$3{=o#Qle*hq6@2S zMN>o0zDOQNO}K$71m+%-!E--tYqqk}E)?U1X^>B_*!eGnepVoxR}unpt;g zrT6J?r_>YN-9=Lw67V7FYn%PiOcea978n60O{ex)7m?8eJy4`91purnk^2c>0Z;9( zdubz1F7#l=x*XPx3!7I_Esjjj4~OU8GYu?>NJ?v(pgm2eg%{}e46%>zW^}eLb`4W; zR)(KR%GYaTJ9tw*iC4S9+=_b*(Z6L^W{cm|Am0;h{=N(TE>a*nA6u-@a3eArgBPWh z&#uSvOq`pbLD+g=jU)xQ`qZa9S~@k{HPD-4_jFtS5z%P&F0AvzMH!Bh65)W+@iHxX z&;9Ywbf>&fIiP(F<$t+ zvV*7$4%{{|SVHVN_rffMYoAFfv9iTinBbl!ed8^{vJ4TB8w*%p3yie)^AUdLNVU?P zmVW8;wLMdq!lhb6$VG8rSY)#HL+r_5SMe7dvG?@V(iEKpJsLB#Majl0F;ja5s-!{E5gN-vwWm~_jWc@?A=s3CcWM5N#a&u7s zGcU9m4K6dDg;dp^vqx})ZG>x2$BCz84vpC|XmzoOABu~w zPi9IrG_;Ak#{1m7Yw&bQAf67i?x^-t1XfPX2e*tBCQC*JE4$Qm31K>hYo3%^1=2-x z2rR>Lp_kp&!&(_XoSapmH&S~Z*Cu5QCeNn1d5b%y&lzQ=-%M_YD*sGFtd9MvS491= zW{Z+4VaY5wC$rtLa}M7xPm~mcOyTe{iu+j2H<{ zCTO5J8-9wBRNU9^;xql{TjIaVPX5*F|AZVxdFg2$E}(|Ppht~5O?x$HnMS1}2(Dg@ z@h}|>F1R2y1Z{D1zDRR5`>gU+98~z(!*=-*L(iY=~RyJ8wOizuRX7plob43H=6% zji{s=Qwl?UdSjWxy6WW>^_>Q*-)lQsqgGLw z{?ji}Qs=$f4gpgRJ4ECwQW0D;%>6xBDiReE~0=gE0G(H`pEmCnRtVmYnxgt zTczF1NJeY%dR-gNU290|=uThyksC>yjNDa-7NW)4vSubxK2ocP!w&0!;%@wo1CL*a zKv8Wfi)6pzkp3%hkofP>hIXzkQ+hvf6kkj$Jxa!2=cdmG5I}?{PMg=K-DpJb!%}P0 z$>nVrqG^}kxo)mS*S`bxU5XBnq1#o76=jJQ(bYZOe7*(cYR(_ZmrMrC?Ae#K+0*E^ z9Bb(vh5GlN$8BEv?P@Z;t?klf7WBYSbVcNl_~?%4IH423?P!0g=8hOC2c4Hpzp24< zXL6Bq8+YFzgc40rAXAnrfJVe%w`{i9?^wEa^VJo-l{f%Y{{L@9=6|N()ZvWl*wC2k z*y|3wqnd5_kEL8qOf={H>m}U#R^Tyj5}@YA{9PcWiKQpvRcUh5Ik9WPF(WLQ28JEg z_Dx&WS?=aU!c^BT)%3wrjcYZ?iX^s0qXsm%5=s1L#S zfk$7<8eWFD4DfEGMVCd*-g2u{f1gc=NFyhziiLNr%s?%yT{jZ@ppW<7J24=!;%-r zC~UsG!)S2`FfCSt7<+}PRX5Z(HnxS}@fx#+fY~&wTN24Mw~6!;L9}CDdh!=uR$GhrLdkZ7_8Rv>U9*$H>F&D(dX}F4wp-+>;|&d{Ac@%-0AH! zzhdrb8LRu^)-Q1>7wJ7s3BaU&ZQg<}#wsS|!~RHCuPgw%YdZ7P<+;bCDQa<>qC1W$ zj>&|gY^ekm6TC*YnDxAtpCw1%TH z!IeAB8xOx$s}?T}xRh$hsZfN@RpsZAU=1*Vkf;biWYtw(ne_mkUJP+Iyo&{I@O(Wr z#vyJ46XB_~S~%=CsF+gu5jV}XzOV2~?lFx~gY)v%j*L*JXiy9|vX^8RsH?|+`?>)5|qdyVWS<$O* zZfmLu*`=+7>FXeAHgvpHc{i6ahBsUUXBZ}(q@wp$p=f)VC&mz;_^+I|?4)#k7UdA@ z-LWy^DXHVuSC)d@$r>&z-U3^}ArG+{Zlt`}Ze@>&5TXe4CbC^>^6z9iR zd=V)2=p-@>zv^y&|8S?*|%j`q^?rfDR^Kqo?wi?_San=7f`U#wJSygYFHApIT# zfL$;a>|ZzB-s=ahvI4FugjDbB(E7Cf^l&d3Dd(NZ43>ksy0ipA?E@SCTpa*lGs1U^ z9S9)&=Fc6kZmWUwrv$JIYl%8osQO8s!D!cU8^tdEfs}01zL9|eZ_-TBctBo`M?%f+ z%ITFAKr04HQ3JM^?L}*bj22o`d{rMPj3I*3quE)D-rB8d6e1X1^lZ)%V=wT!K=Ayq z2DWWn*3-w!vl@Rp%zvA~X8Jv*EHHyS!km|j5*AhJf#c}6Y7I=?oi-TFr$_fbv!;I^ z_3wui#OsZ1<|xGw8k}?=SOsK$+pSma0o6#G*^cd#k-tC~O#eV8Uicf{2Xc2DlL7V0 z0}w<@zvKVppWCMO(S8@XxDHw58h3@Vd3EU>WYC}T+MR6hN!wyT{~K=ef3_5fQGtK0 z`*}|nyjm4y@&qmnW7VGdcy27Qyxf1IKD9j~RTSHi^>GhVu%GZnyB_w(yZx%iRhgYA z&$w2}RYRI{QgUds&8Pjs&o3GKVcw4_G&pF&NuPk~u^6zjpNZv>;xtU$IY|QXRjFXmZ-`wF z4=1CspZ?9NSxp-;BX6Uk`O;}459u+>-kz*4y0s~e>rLAW6B2&m`{k;J35(u z?aVp&789J!kdhpyh)S&~(kUXjd`p$3N6ni(eZ;`GMe-8mR&gXlGrfTe-Lx=L z`GV^RVb6WVD`Qg@s(To;@rqLm;&>VOLC+Gg?SJ+8kH4Sc5z3;^+S@_a*3?Cn z8MI0l$9m5|L@5WV*ir6u5-&z5qiOiX6&V=fn`kZv_TG@@y0uC6XPU&>yB0uw;LYx; z8E5_tnGQwPLTf@=-kvhX8`W>LIips7**K!nR=5O@>`mm$fA7XvAURO6?WAh2uCSZ+ zJCYB+YGc?YNZv2Yh>%$K!g|92xKF7E?PaFiZgZLMeH zC;Kw%8Y_2S~8>8MV3j=W>z6lR(b=5OHeoD6Iv>Vj04F1w% zeH=y}kTL52TE>t6?7Jv}vFIY-#$UMA#d!YcMhXU(Ud0)hA$p5h6>=-d6z0cM{0GIj z2YCqK{8k()R$|Bl=>})`sMS#CztTnKMjc&C47(WM7ca&iqqsK?pT<&ys+Pqt%70SA zjYnHRNz>7C-c~VC44A?Ec^HagA+(fmMRwof(%~J)U!cX{EgC0H8wVekXAXv*pX|TY z0i~m0UbYOX>)mr<+Q+zLP26Sl1^m32sZk-A^BYgAv`)tT$gZ@#KlW5gdkbM~7zBK+ z_`YKhmb4pcWKWL7v&<;LYk02M_t~;^kTpXF#rPYj7Z9zrDzreqD&FtEQ24^to zsKu%9N=%pjtIq9z+Oc&+2Y?-|jiS{4(+W(Qa{onomr_|qV z%CP2tV~||`JA)*Mx=Z$i6!;>7eqG^P`-J4D)r8_-%D*OwDXCUY)a>O2{ z^b1>}I{!54;}=K2_uuty<>69FmC!VqCzDcGCCkJz#IFo}eT`MrWd4jli57X!*Gkgy zJQW+%Wzb%Ja&PXMawg?E4rEYTdFA#Td-Zf*SB86XM?uQw)vN?xcY>>5KUGP_8^hnl z8+Z8jg^6e9p1vvN6dLH%}Oq=k+D}i*d5fISeuefouv1Q6KzUdzXO=k_vDyZ113!bG$PVn zb|g3&zUxB`h{It^DSH7TZ4GG~ZNK6z8|v=1FVaLLh5-Wp>-U6po^+I9GU|I)J4m?%*uyz-`jmBQN6(9&K^#5}QK4+^cHtr__6G@$*BBK9_sb zx7P%Uv6Y~00A2BOeZu)(jT&nx(0ZYKNxsKtf1uY#DYDjMmh{4T%1?_gvM&?w+bOf} zyakxyX!*v}S&P|d_37iz0?Z78@HZri;M-jlx&M(?(Le9w#8eAfIu-A;%j$wV=p~Z}=nQFt#n^I9t4!6ieKdRX z#F>-vyTr!V7GNO1U`L#kf?Kgk;eN(*f!%U3>HUHy=*G&oi&E$sA>-euwn1LSHb%TCqBiJH&Z23inXT{H|VM6}X zY1ZuA3hPf}4G8aZBPXwZyrU~0-DeeE$}55oTNaXOLTAp8`n|^_HZtX0baEf_S=B|T zCJ^G4xaoMo{{ngGuqM(E(+*Vr1O7n>U%wB}z0Lj$bl_eFv_X+`GyIv`GWg86XVV0D$yRnAY*_<0Ph=4Iq-0 z^Ol+Q-uwPD27v$gr_TqVvFAYNH6M_LaLV2o+XZ$5&zreBO1I2d|Nq|qhy6~nJE(2u z><>T2hryTK)E=WeTWGOu=pVSZq5WCbD z6i@>{-3uz@;UQeL5pL*3;>;bbu0;axVIUzb@-{u-1X7F84c@DU#?r5~AeWcvE-M*Y z#Id>am-tXI>_c`3gT=V~$bRS8xis0%@kkk#xpNJwJv!ntxNw#v;hlzR@)Z$<8crd* z1jOC-Bu39%t=HS?dYdPLbq7isy-YYOWP9!_OZCUo;9WYGW%|UfrWCPLFLs!if3YIl z2iKIG)O_!CHC**(UnmT!QQrjC#)*KIPQsNG-Ch-jHYL%9oIe5o5i}L`I$b^NKn0rS zzMHvy=*CE)JtHLPyF`9+IJ2l>4;AiNG#c4ZnRH4~q6_y(Aq(xNe0$ar7Wfc}df&1~ zwXTz(hSEuOruxY~V|etD2Ue1Bp#8+`by znDl<2a5C&mcRcH_<8xg?lz9)>_03aB6?L`cv37}#swC0)YyPTTro{F_JSJTq>j=5Z z^MxjdtCjqYBnK~JLO)Xo)@G3qP;UD zE3Z%{+x~=A&07mJIyYrvJ$;bsTL1FWe@ss7OCaP3XUWt~(||r^peAlZ-jTgx)QQS= z?Foy1Y^kR*e>JyN5WBn%PQ=~f-l`U?#UsWg%51))T?XtqqlF3RlY z;JV-uGcF5vJN?@yAp>enQw1oTN(4pn1cYrN5~h*OakmiZw}^ucI_!ax#RKqZw1N!` zs=Yh0i^xeW1AAYr)akb>B;IA%XHbIagJ5(g&W#MIACjNfV))^%AEDJ9>pbfTnvIWy(n9L#M(M`&*`qAiW7Aj7b;qC8 z*b%C08LUv%$Rd2U(n2O)ZR)L8!?AK*i=nucmN=uRT!p&h&G>3~b6DD3rr-5v=K+G& z_IKJn6qxx}_S5+wn;_TFApJr=vxeF85r5u5;=Rn*)yDN-+2(c}Hw~BY44etSY?=3c z(_Bk@;kPS_BWVZg=!_GH&%J9;hIB23jZ_p^5X544T z@|gHD;^&MBG@+JJOE`d0op%ImTAlpya1vd^(dyXy8tYodPnF(wc-E{n`~1lHWAK2FQ@zi5E%0aZeu9XOL?V`O_SjiuQ{_3Og+ zKi?z^SMFg-uU_t)wDY2$^~kUV%9wlcm@!2~!0UJ< zMS5a`V}e)HWr+ium9pb1{{N*YAlH?L!sWTdXg<@~{a)+C9`(lNus1~od<-A=8ZirF zOV^!NbD*DQ?>X!O3C^ET$5*+PkBT7sp^d^k98;=l$*)lbuTWs2(5=$~#7+0Mli8OC zZKQn?M30{y-{UKu6n3P zccTrzzs)#W1+&*CjDlrd68jibx|P>m`tU8taTY0g_+OmyA!NHVZ>e3s8yPA=9?VSD zs6w5xU{kbgacm(FvK7leiv7%MbCOA)ji&?n(joSWNo9Kyz3DZ5BqVQ zsRkJ>f~n`}%T2r>jnA1A?Px3eN__~`^;Xk&Xfgy5VyC%ebeAJeZ#$5D|3<5z_ocXY zlVmfhSCZXSd z@RU-l-smRPF^TwE1Nx4 z$$=a@z#wK(uqT>RS(kbd^CiPy@igJ{+{-*a8AswhYF!j+0uZu;^%f4$zHcU)%c&I~$>xx{B>-f7@Mt?#PkFKT#KUMMe%XbW75 zwA^fWXvr~b$IHA>D?vNZSCQ;c8$=X&TR?mrl9i}_Pi<+@2}b1b_knMM`@u~7v}QMf z33MDumBzL*tfYWZLWJ1gn-y#~?AJKC!Gh<&ksV#G;?xg?y zFyP|_>>uQP_1xlxWkO<=?E@+u-ATiR?l@MSnH_9p3@6be_rWoNiA?IXsFWLlqgyrD z?xloZb>t!6gFNs2WMME*;k-lnW__opnGCq+7xk`k^NMR(P-E?7u^H)}Dtq!SG5P7DV7#HHRsqEMPo`R0E@5ku zL3bkS@Jo+(nt9nE!QkK8m z-U^%iF52-1cqr}m)|js)(83!o3p85@95)=lB?jCA(FHd+3->|A?rwhySxiXa>}d4=|KO0l#q-p6r>s6TOgq~cx zn}=|rg|AY^-T@!NMktgzAj~47Hn_C?l5@Fsfi-av`AA0H_xH0&GE4a~X*{p7hNBM- z`f5xuax6vm81(kbf&$DTK_g6YX%haGWo33LcBd=yC4YeY91Fz4tH~i(52oReajaj- zV1|81;S1gw$wXYA8PoVzE4>DspLqR9kujzZ?Iw*hsIvDgM;SC*3E7fW8Wfou8x^s| z$7sEsC^x}3lFhK&i{&R&i1LL$-TmhuDPs)3iW{-ThND=N8B+^}6N^HAm^1n?;;yx~ zF~tjYP~rqJh;@R((B~@leUaTSGJS^!2zx)&FTs-#89#=j%V*tLT20eC!UH{@wFpz2;FVwU1e11 z!pG_Mr4L(_?kBf9h^0)u-`?je&MANgQ0M1z$m`THJc#q`B4-CX2{b`iy zDZ?H=r)L{cR`J_T8N!a_$>BX#&$8iO+x)3Jviy$dpFlkYUB%{&Tqi+kmJ$MwFk zu|X;AMn2_Nb)(;h9Ey|^@)sC9!NF<$8cfc|1%}6mZ8AlxvSfN*KJ`w8v2hb>lPpBk2nEPl;P zc6#Bwm@*{iHlwA${9kF~l9lF{<~;zaF&ME`IAZIknHV&&Rh>}ZT$>GtJ5%2^BG^m`RO(apy>`yu*?Alc)sA9Xjq zHjIt^8XxBZNMgBWHnS#9PPrA{@G>E^bv=Kc%XSAwlA^e}JP`YcH`i>_U^Yh!smbBV zYJs<>oY>B}Ms)ixNByRcEqYBPk4>X_qzKD?qpf|PZk!%EaJw5{s#HI(M*a?d&h!<0 zN~Vahos?T-antI?pv$B1NTlHBlEUyi?1iPVn{{q?hj`#;7#B~LFBscM&%4kknyxl`RZ;;O|B4l5;{}$5vG$r6sh7LA?aeV?mmXYVD`=`)cVuxGT zQahfaJ$z4O%YlqH_Y<%6Tuoz^(F1M%sfN#Nww6&zv0pqCh~xD(Y0s6uxHJ{Z*b0F?0$JW5xRE zp~+wb<2@02bDfFW;14wzT4-npT!BpY=)TA3bL3b+Jtl;JOaA`PbWoz|@WX6UeisrQ z);|f-8gG)aEr}9N`=kw>#_+D^Vr~i1;Xo^aiLA^ktH&9FcwA82Qwl+ZFY+!hm~W8?6R22t`ZscO~lhOaH4 z`r+B_#{IIJS@;AmHtzOGvbD^lITqg5wKg_|5Jnc~%=UVc^{-`8Kd0de@{-h7C$+|H z)7Zk8i@sX#@kx(%Go@aEHXo*xBjgaLFU#U&y0>f(UqPHZ8}KP@4U`RRt4oL*yl`p6 zbS7@~E4|$81WmlEd$jAPgx0b7$E6%z zZ$%ZJI-Gp7!Pr=cJ;2^rXO&6i%WfQ_XSg^M6F$9Y%3A~&kGb~W`C=-iq>Fbif3nYp zrC*9dKVD1W@id6c5!raz8-Y}@FtFm<}N-h7bL6uT!3T`wS zN^KT7eeT_^o5*zVjOE9oBFQyCAP%wOmfQTKiN}#sL1W2~V6fH>REIr$cs4HzoWGBj zF0U91MU^eRSz|TKc>PLj@gUCc$Cu{?PF+J|&?ckcanldV|G4b_s}}Zu+>S{&@<-@K zztX`|E7{6`>nICmQ(7L{w{es(>_hcZAI9!0eC)P>+X*kmcS#*00P z9Xt^T?<9yO6c_`6C{j$`q5$&Yc(mIM#E;Vk8N(TY*j0rVPPyA!CLg@Edcw~t2a*iM zcfjg9;U`!Dq+4FCvphn3I?c_E@$h+>+v&#FCeA}*17b{X-^|pN6Vt1uYt8W4?+c;d z`ZajI<#twVbs19!ZC66KI~Z(z5+do5IG=xd#puSX>N_A?z;%*h2e)PB^N>ePEYIR+ zt;svVevjN~mpJp#*Gur}PJ_1k+%h`^PI@5Y>}ZyunzI+>!Vm*Rt2)t?khX;6v%6JR z4^d`H41{ff*zsjlf$rq_sN{P^qW2Y*>t95s@_*JPyc#CG>4De#bsfqQpd4u+2PjVc zn77key$Jud%Ft50%w?`o4(ld9d^wk&gWeB9)}ds{uwbJNE%c2hYO*<3cc!-d?8H>P z+L%H!tsBW|T{yrN^#U=F@unqq(mQ&I-l3C*>D73d!GZ=h`8b2?B9)%G4aVjZ)rSS* z=9Cn{3xMvZLf`g6&}3yv-pY#LFl`H|5dXB_InCVZf!}7S;a++U_3`ZZCwo6**+^uD zH9Sk7+T4v}OiLE1q2|0ATqt^X67=bpKs>cA5IEFF{g^GKQ{r;~!_VxUn399(BgFOP z&4+BW536Zp%pW7LYg-buUpOn1>b?lhAvLmSb2Z5AW5W5gK9nh9FLfX$*hE1k&*r_ z)lM`|2_*Q)Aq}p6y2tOQ49D4PMGT@fBozBtxp^)QKXj*r#%FZpkqoHM?$`N>9qv2i zx7MXdas>Ajm>r0*#^)uJ3R{esNN$%n%paXq<;bovp*&z~mu*cQDC6Q1NU>gwdqWOV za9jFrc&uM0Su9MEzcZ*vU1o=HotU-H$4CpJGlw{POj`%%O*)K~$SHC8AadLa%7RR7 zt}jm$cm2lvjwdz|2c*MrFbHzTE%G!)09{l(0Ab$_IQQ2-2igH0R+h{A>ra4)^{rap zl7Lv5?c|8wEyDx=o&&u75-}OVaOL&16YvOa>ZAAad`nEuq{GxDP2(;xwPe|+nLsWs z&}Ge2IJ!G0{R_lUaHF$+A57hGIU{@PlE`jl`39kud+|9l1R>XO(p!IGjMtfp)czGY zI#X)nLYa-Z@0+7XMl>(0)5$%*yZi8-nd_;dPbRI4a_&$QQg=zJs^iwK5eXoff&6)s> zSM2LT)&hyD4zhp9fYzVCJfKB>`uBO}5q-5-s|vq;S-cEElti5QYpAz2-dOd0-Hg@l zlkOzIuB<2&ye-&b&cQ9VJ4{(!qJGIQl2r(~c1wIc@fz+?Mm4x}JD`BTnYFnZj)x6x zXV(1d34*N9j=*4kwEn*SYd~1@pKJDmBT-!m_gI~iMTTUleuW23Y^TO7mCIKZKxf@B z;TjuAy<5=)l-k3xf1d@GO7!U8XY#i*79>MyYi3fwG=kS;iJ zvHK&w6-4#FER7wDdBj7B!Ib8; z9eZFr8r<)blT#;5i9wwFi zylge~4Y}_k#BDOgiL@1?O}TfNpAL%?pCl#e9JM;H!9;uE0rYJsk`ySCe&&?tEThUI ze%D>H{|}Oo-HvRPT`Ta^nM*CpEXVqjj!OSzaXgGpJ--u{l0rr4 z>Ocqk3RoZJhZXKW9{@2V4T8=pj>!Ftjzxpd*`@(}jV$ROx|n_rRW-wRAqewWWzuRT z;*gi1b;cIm@qnijZZPPD8M*+b^ufZt*vJ%0mm5*ZRplyV^tytd=DNdI@{CGFrQ0)tA9tK=E`rK7{?PCG%a9*-RF|5g z7DB30o&tkJ8nnh;p=VsR8)W@l6q@MNHDa#rivYGZlzI$wZK3+xica!9TWxlB>iiS? zsziDaMYgknPea7nS66Vl3P2CwkylB4-j+H;HiU(3HcY_J9Q5w7&qD!I88j2pI^lSF zm9z(67+>g%u>ULS`suAXhxOWq1{c~wZ}!AZITHeoZSz;bwP~89-t(V~PzP2tX87S?ZI~`z9*#UA5 z^=60OdBoy?65EAl&H|~u_Ih)qj*nub_;YBc*d{pbHMD1`7@0I@U`1_wgvPw*x@1O% zx4R7Gh5CvJ5VpVM+W13A0LSFPIS-R&-K^VQ?3XHTYjA!FcF6mQM5mXu=QvF*vhjf= z?mU8;Gxk#cYcb`-;#yS>`EdIjF3kY~E2kSxiq0Y0Dq8gWa)SYOcn6ZvW4&hw_)pqx zu8gu+yW)h>-vsWX)4VYRto3@7oTXeI#Y*xgVUXk<+~T7+a=-1q^>XZaEb&+h?fnfM z@Vlq1VcrOmKriHs$cnK|qQ88KuSERZez7--60=9zw>yyhmUaE8KCoK=>Ce=gYw_D5 zu$u2%^NHu-e8-4Ig9p6dXBGMF2O758rrSH^^iG-UG>PB%OQKr+ZtnCh8&>#wJ^b@Kol)ALPE;5xp1Z0Ahv8NtvC0@PxQDd z^48tcoigoOIw8U>Au_YFx;b-MmHq5Q!PhwwPWnuTS=DT4TjZ_N{3l>#$0?8EO+ngA z^PTytOzZr#@q+L6yJxce=`;3x#`?T7L?Q%l-_D-iaQarExUUqV3%^bcTWD=52kYpq zV3+kgV_pprJFALor|N-u>2~^E` zj%Zaxa>_x|Nl6HH`Ca5@CAhGTHFK=zwhzb?HBZ&of5{M?&v|`>CI>Q(-g^h^060j4 zCdK}0BN#z1-^VG3H>(UejRSjtk{uS9cVCNIE=-~(p1#sPpwyngw5PPEtkuL)f51uG zFRS9|tfg`P-M~!NWt;JOz3us0^INu?YJa7(629fYsx!(Uk4eQzRRs{o|MQEe<1~|s zrU(ky`_cdRy%EsBtL=qrxcbjEHA$1!DF;Wh)559BxXqFy25whxM;e#B0~ac#{#7|P zvJebd=2J|L*i^9rqua&H@hi#*a_3WqAi0g;+bf_22i)wjn0f-Je;fw{TYUR-?4Pb) z9Vt)5!zzxDZT+PxAgxLcW=ly{gIobYJPE(<>wpCYb+XqO-qFx)Le?3 z`n~HvlISYzmm1fb?!623>We3+ZU3}d>`WDX3u3k;%e(12gc`Mv&;y58@=hpZhm|5%%}e*3=Qoa42Va?Z4!NzOsLI8Qs+#o8V? s4g=1?%L^B3yRYTbpjC{6=v2THR|kY||0^T!KW|t37V#}e_OJQ>3y>X44*&oF literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/whfb-pin-reset-phone-notification.png b/windows/keep-secure/images/whfb-pin-reset-phone-notification.png new file mode 100644 index 0000000000000000000000000000000000000000..f86101b1e81d1abf217d86e2b5be5097be0db077 GIT binary patch literal 131278 zcmV(^K-IsAP)1^@s6`v;oW00001b5ch_0Itp) z=>Px#1ZP1_K>z@;j|==^1poj532;bRa{vGxh5!H^h5=oo6M+B#03mcmSad^jWnpw_ zZ*Cw|X>DZyGB7bWIxsUjGcX`AF*-3hIx#TZ`rqmR0RMPNL_t(|UhKUGxOGdqm9_tK zy6?pRiXxdC0O5j)3c@9M36jKs88M@xhzU%Om{5ZH2r34U2SF5!m=&{_MKNc^gb6WV zM8(^E{&O7f7~iN_bMCeO(6?LYe&*PF&Z_!yeO0q&t-01-`_-#&`CUKxOyn92rc{#kan|64k8Bufs3B$6X-J@5MQiUAB4C1 zwJ>_fgy0I)D|WR{Y;)=<0_?9aK9SD&^$8`6i%uynBxC6uK*DU<#21-VcIP}8n>7Po z)#&v3>0=Cx3@65?2Hd8y1z>+-Xe?n;pz;YKqffu=W(D#H2z+o7fdZhl9&EX?VI7YY zf%=mC9awpMfaFft#wOWNAJP=4HLB;)oe?9Apc>$8Pjr$tJ~Mu4EV+yF^;-Mn<1()} zJb_mqRBoFKN(%G-lNtX=B#HpZlf%FUbej2tbZw@->y@)hfOGqmCXwfl>nT0G7B-s< z<{IA!XWkcw?3$M+gr8W^4VJ#yGlxgwknK6;p@j@|CK0X8sYKittLVfauDNzF*BWHO zXF)%Q?QP{?k7|uEIh*=p90uA4aO#KP+2IR*2w)EvRq+tHkc@`f(IU&CVOJV3cY6;& z3?CqH^}8XL6+MaPT*;f!IDL$rx2d)7$F&qxgnNfMbu)G-HZu;@@wC4~38sz$a8->V z`#SOZdX52P-e8h!M#f_W#=PV3^@Fj{cC6f{5gC;$R5k2-8{mo=HoaQHCO?I59s2oT z%|$u~Q&jjhEW8qraF;ChC1bQiZ#8Jrwy4I0x_(@m`SiMVa}F~fT<;k=_IXOn5>=uk ztPUS-9iMpZh%G$OpO5w9u^2wIMgb~sl#DoauNgyfyCNa_+EFfN{53t z)#V4%OGtS2^ew(?WDiZln<^8pWzb}11AQnnoz6J(-PvW16Ln}Lci@Z(mx~~?yUOyj zn=YKN;{rYS=%Pc+p%{{>yDLhznXyH2X6zM8e5hnFR7SoEQ?|JwLnKDKD2KV}kNDW6 z{G|3&Uz{o0AA-y0z*s$K+jw|UZGTR7RjNr}nVyS0BE5#r zI)FAnF|`hNQ3-=2tyth_OxJaF*f{&I&gki=*imcFYU_&f1>2ls3io*viO`849Pq0{(erDg8LFOVCL)sI*fu?TpR$=oYxsmgm9p5w>TpYDo7#&^n~^$RHp>I< zsjkVcvWgdwn|*`jIHtKmlLT~V%*XP0;}MZJ8EwN_GVQ%tly7i{DW=tS#iMY zP_R-7Q{Xl3zNd8mNzNLhlNFo}PrvF%H(SK-jhKGiW+UQ$2F{C`AG0~}q{ob8G-GOc;z42H`t+-@Amgg~&S*F;462CN$hHnT zex;q}FBs9K0h@*n_Eh$5rb_#!9(zvTz6Pk`&8c%;nenH7IuEs#iZH!XGaJcpazCK1 z(gL#W9I5AwLxe1A0af7JCv(F*h?5U^gyWm}^3Ew(nl4o9a+TA;S=p%jW? zkwbrX4QMa%RwhK7qfhdqObuU5^Ci)ZYzJG6ZT{D#ByA}+tVwOZEd}dly1}&8%Ug1A z>hI=Dc3V+(>7~jueA88IVNmW2fSls9;lEL_j&n(xd^Kj?ED&0{kkTQD~lYqcJ>ZSOg_#$ z#=X}ZsD&NJ+_1Z;cx)l~hA6vb+RtLn+N63X`DyVkt(XM?V{4+Iik*((@I28}G&b=q zH#$dN4jJI>24wRwqq1!1=DB5zwYu{#RD7Zp!mN5mLI;I!cvI)NfZXpJkZx#wX{&9^ zbbaz%FZc#acibEp0tF)OcE+aT-Hp(mgNg%Ej)~J{xe1hE^nF^q1Y3pUW` zbsnw_sD3_ZvL}wiwvN^XnmvQqr#*txKldA3KNbS?rE9{mA&HR?Yu+Bo7}ApP;>80a>H`2^J`KP*t}+K8J`w~CZ6o_V;}kVtao9Ehe8@ZFMCPvd=a*-L@ zBq6xaWX7*lq&H){AwG686kr-^ZV571xhxh0pNS=Are64lWO{5K%Euhv&8M{)>3mtj zw5Q=ZW%#a|vBBnYon~>YA!_@2^-NP7c!#_pG2CT&QA2q?S5b1m8?UKIO zwL$63*yV;Lw7-;|?}uJ%-9R6>+74zLk%o{bOKs?Ip8`iZCSBL5;L6X zP!O!}9^M8{Lfj<-R#HWQdzO_m4dfj&F48)7Wf*ih-129OEG>G3Yny>_xw6;xOjsnCWf_w{zhM$ci-7 zBW|EN>csmR86WD4)$QtWa zMBAK(Mq?&~apH}_n{;3FOM)iW z_Sv>5Z4V^t?!tCc2DM#U+n~Cu=wQ&0&(j9ptgTH<<$Gag*+haf@t|Plsy#+@Q#*hT zSTrVx{CSb3p9oY4#MJ@kBGqn;Uy5V-;zC@T2_z2(OJ>TWwmW@{=enZNm<_a38FBy* zf`s~n+Nc5ABa^qFl#}Yf@O)8THDRjq&X6H*sF-8*L!2_6Yr4q?W~O?=jA=tDVkVfn zo5(#dldkP^X;*$Up1TZC8^b5t&{TM?tHL#HKEx?IASS8e{>KOzAfCm3hEU;O9A}KM zg?-Ow^&x`MGAU!uxE}q+4tWQM&1W&p*m)jjsL zf~%uSo#X6PlqL=|JT8K5KB5Ocm<=00dwi>|U*~0ygF43m@=l^%8l`hK7w{+Y#}(HX z5esUvLCdC%di0T6`mEWz6ZeTesPJHE41FPtFJx>-eZwyHZA)#hX^DaU)m*P5;5szh z=j8xI|5~>90)sZk4lzs4#+g!mk}cj<_eVZ-I2XKY>0crwzO=10c0frJ`t&cf^a2oY ziXxohtH6(|>PR>1jzeT}75~IXJ$j5BGH6yGI9|7>kM2up0UY{H4PX-Ap<%B`|DmTA zq)myU=rIt9R85ESF%2tVhbSo3#sa!lpuLysyQ?I2=%%T}wl~BaBS)#v9Tv~|gv|-|GuUW+O?BC8eKCso(gymwTscCN_d!?~(o$;0bTvHlr{2lb00_u| zZL`a;P;5AzWrCBG*c4Nby3eVLe!TUe!f~Cn)l%CewH*`H zSu|<~wk4~Z#j361OsghkI{8dT4Z9I%<>g3Suqz;I`NQU0u{O{(WCLo(`4JQ6w%%@g ztO!R|Y;DG4wLt~C(TbRnxA@g&o*?KZr^x25ROQEuhG6;Vyb;TRWL3{5EF`Nl#;M3t z8O2LJ5|eF~o$!K}>Ki(vlC@oc_JhH^?Uzjx&aV>Ru!2;K0>FZY0PLVZ-qP z_uQWa+(G70y(#a#3$v!H=yGRU&bN-?=QM4Ow; z&UkIskz;r$H?vgNk}iHn&=7rNT_V7tiv6Zh+npyfw>^*Kgs~t89d<)%&Mo{)Y@4&O zcV>gD3N2{a$fh)P)&y^GMDk{qYQxu&s%j^L2&1Qhx$cKjideMVDF8b3O|bKW#%42{ z#4>Z9FjlGn>6&o1Ip74XeA(;NJ1V)KVUtY`O)rjY~CjhPR?HfBsBGzv>3l}bdUF_l)~$`*&6 zYIqJt%M{{tE*3TDXQZ>~t~`V}Ag!jf+pgrYsT`BuWI95<&-rFWo07z+&S5!7Dz*2^ z$2%b7Co+~W-!;(~b9g%Y8pJzfo#z#KdJ%*x!0OQBWZBc9PFc!zDhNY+^ciS$q3Lk2 zR7b|~P#4{yyA$#{H-0l(itb6|m{Ei*!q|$88n!XS#S`3#jbKBgzubhs{A}Xx|Hyg> zv9<95BF@DQ*)qo6NC{;Kwmkw(64>oqMg;Sd3vfuQ=KdcOHq+reftS4OxDP7NPnKo4 zeLyiL!rNosVEZ-^>%PE+rucJ19Y69req78`2Z?w-jc6n`l(04=7p(bVYbjlI?+$c) zuJq-g^tK0XiYL8Dkgeku(TnI9GjURNX}WKMqYcj;u7FDFVar^S@4STaZdiF}ol-`| zwEa4LwK}m1rr_5%^Po}z%R>UfGY(#KsrL)MQr=Co(0q2sn9c-(Z%tH+DM{`^l zYn=-a+wRY!!)#OF&%Y`e1F zl&L(2?aMY}!Q7A-bNbldRK6tK+;8I6qLhxuY=S-R;5*r2# zNe>%vEk!E=z8UF6*~3gYwx4l z6G!#Cfi^nNW+=h>$~-V)==R)k^4u3ZzLv{1&FAB3rx&{FysihH4Vc&Auw20x`LPkl zXZI55MjBiAQQzZ%FFbRxUh{T zG~dQ>v}47Y!?LccWi!JBantS&rhnE`Ne-}SBTzCA_&v`T1j0WMxiP2THl|JD+7O*w ztggae^vVgU`)6$CppAlL`B9azgOwMo@d+(^V8w|LGR{Bk`1WSlHdKm$MJvgE-*K}p zGVow^^NcDFIibm=O}Q(fTSRg#hm$S_@pFB0lvRMkBPG&pE?A`DM@4$t!Hl#<${9GmnF z_BHf?s+~)s z;me9~8|9FWNQ>X%CRFnzU=XZf^=Ee{dWY0u9T$0}I?Zk%GIcFtg^M>&#JP|27bFGQk;4cobz0noOPDgw@tg7gm51oHK^s5YXyZ|G!F zTHOq@Mti=DrzwazeH}pG1F&+cMO0^ejMn0}%|tEbu2qvC54dDvS~6Zt1|BnUD5(zr z*ocYD*rI7yq7SQ2+v8@ud!9*FHuHo!!5x>d548HB3p+$a4}7v`F?zyWcs@A0$dTbO@#feP9M9A!Nkt0(mMb?H*q?Vs3N6a7FON1aO$ zv>nuZc!Arp*^3jL`UBeilcE~48#610%yP~E&C5-9H}O93MD8C|dQ3J;ZQCz(6?OS2 zjfhhCq{FMIgt%zP!?Fb(oa-IKY^aOSUPkqI?13c)Te-Sb=~x$I*P9MnPIa$nYG`bn z7DQ-@_s&nCo!iXylk5e)v~f2fWQIea9z53%)PwY|*J02;XWkq}_FU}9LM`4DHl`q5m>?31y5_9?Am>id z-hI3P*|#o!re4^d&ct@udLHX>4IJ0SLP7~7wwhc1y!7pI288Q+IYMCt&-8+&htJs% zb>o#NYXA{$tV7%ESz7x0lg!|u!%dGXAdU58SH7S9ap4PnDC>yu&Dc$)HSmQgP&oHT zF8ha%t~2iQW71(PV0f`{cI0MeU6lNh4;ThC@rc1hu7iWiTyu^}nz`Z4Ynq-D%#D6i z2RP4%v_U_HvpBMU-9#VXX2d!uE1eG`M~iT{6cUHVZRJLE&x46OsuE;;v(CC%Lj%@a z)=*rTH*yFqv8j+fHmdX;!Fw! z**~rWR;WU0S0J;??OE6XZTgB-Os=v7}_{KdotoK7SbrCLBh#7opxlVaWNbp@J4Uf1#Me$%%p%bcY4@rG6*kn^7L@=2>?3wuVtbUKi7MOu z!!$r`#lFdpxnS%50qHmf9Wj!_CTdUcVsscoYx-MiQ;>yfZ8;tx?mrb1Iu2C4TYlem_ybda~L88^!*meMaA_Ml59H;{hG<08yV&c zqROZUuYFzegqlKEo9cX~+UP|U>qefgi!~zqQ{_kSQ}jsyDz%jBow8SoqdNh4_h!W* z;NQ*wbfQZ-Bd{SS$T34daRIX8lk&S<*DK)&?J@q z!DvbHjj1zHSZhtez$PP}Unrw%5_W{yH)h{5G$H!a=(<2#^4_bOj<2uyUY5023y$78 z>Cms~bYyjaKVKa~mVu55nOhy(_+T|v!Iui(1i%WuC8z>`PP;S|I|0hOmXY;YBzN?* zsojCjF`Rw?O3X!>RwjP^Rl<;-7k8Cxq9cclq$Y38b^1bG zCFvlCj&1lZ)ZY8-v@!6SOiW7VjTxL%8|^n^@3Ym?$i{;z{McJJt2LR`E>DNMlV(cy z<=`Re{%aAbn0>qx5>skpc;Rg2EC;UsI7^05+z#^O1BwoKh}4A8#lORbP;wG02U$wG zkgY$Yg)N`U&D}O*mMfbx#jl4dUrgq>-Hl$lv(IpPx9Plsv;+K z%!twTb>WH*RVcvL?_dUE3B=PVyYxIWVm;jIZ7_ptRJ@KgVN4vcGI|96mYd{4$N5nS z;(&^NXKoJ*^o3l;`5iF26lk2ZXp~VOs~aUyt2fcO5mjc(OUsPfk>^A6ptsyN(4agO zu~oY#S)5Wwh~sR-aG0FNKVp!{r*kd(lqWwm%^Xx&@*`CAj4@c)ui9hNEYYqT=*Hss zxE}T6kGjlG(Rt|_|G)*=3~3w~6CF)eceU2hJN0516qJ!EObry*sSl>5$bLCC^O@?y zLhF$G-zSmITB?~oaUy`Ia}g2KNdfBybORYzJ<2|8d#(}l^|Ng9;|-O3Sx+@&bfQUb z(8nq54w?6MQ!*BO)C0wjUw`uS(Fh{zr|Rlg`|oi{fG3Q(1tbm{+M?JOM>vU>dU!j0 zHN|B>FlxKM=B8f_#eEcxb#LrWl~z(5dN#@f_1%2V{+-e?aHw-4h^fmKPus~w_6UyH zJT}n&+_c*H<3MYP$2b$W2sQ%G3K$z(+M}X}ih0q`8mWU$*tX!#Lrc@JqA=GS_Y=hX z&WPiC`ik%2B8q#KMMDreRTUP|nYvpcq;MxB_wi>{g{NaFO^}tTK_QRChrb{iqLzsc z*l%R`upR0;sF8H?;0V`6q!t2mMI6?ySPq4&ROy2I70>C8YQy%RLF9OL!`y5%AExbe zfqtbE9%ww-jm~+i(N&y9)pdl2mWqx-^^z!k;iTdX^d{Pi8SWXS)Ch&@ZCY(ArGqV3 zY0{=bOO>utVA&B`x17+rCh$Jy&#~D%VK*K$uQ5H=OsKQSfZ+x-|^>hE?2sQ4x? z-ZB_DTlC37Lr~rEMCK*iJB})CQa|1-tno!mI*?9%Nr35l>L9wQL#0|v zmKsrSQUrHr1X6_HINa3vdQI;bR^)3TLXB}X64 zyI{s`OC%D&QYJO8)WWsAur59OJ-ird=6j!2Dp|zEkLw;Le4~fG*bQnF5$LQ%7$fFk zj1CW%{4^Q1B~@BI_C{K=*pfDSi#G27*9KJ^La6x(TvuPP&xp~Nu8>E!J71Z*u6Uyb z`=hX)UaJMoAN%0P0nEcDFium9GJr5Sw_WE#(YV7Q17aB|_jNS{uOsBf3Bq^A1iLO0 z43h4v;k^Ox8qnvEY*gfiLw{V>nUn3`lpd#)p-(yfR+}HonBuu@TYhJVO|t0tQrUO! zJ#U<3wUJkb&8Mwac%y?2a)6G3t_lyJV0~9~C}6tdxsZOjfTi?dB69_Xa`W`A_I>byb&>CY=Xp`4rPP!DtV4tmGWPDR+Yhol1DsTZ^3t zU0~KQUCiuF>({N*rba(10DX8(X+;BCwMKmtTI4oVI=(3ZeMv3(qGfTFw5eZF1+bZ3 zu^04v!T}N62q)AKh_RaWb-%NK+T{n9jNn5Thh&U#OmVRZOmf}^i-C|1vzSwIW}XO( zr~011mevuxu_H(>@I&YriJ}UnM{jR+jd5}9H^kvT&xy6?c#gvdQE?;LjlqXT{4tz` zT(o5lS@Ei}2hGVhg6F<-En}1QO!dxFwU;l;Jl8dOhsAedeD>1J!amoTZ({MgRP6iW zhwEj=e61;+C#~;&vwZ4De~!L@^al-ke=HVRPh3Ul^m@b^hzflcFij&Qq|o3HxASwF zD}=Z|jK2WlmyH>Q;#C@^$GsJtv1kIAqO#mdW1cDYC%;`wdo($ z>ob}iezeuruiL(v=x}G~?9?4R#-Kw}0pBGje5)kH4usvrm*H53Zkw8f!?HUt?MEo9 zqJ_;(37(rGk=!8F=MFfqqE60Dw07J3&CNEZwp#{!%cH@nHLAWjYuxCk^>Kez4?IxB zA}Pm;G=h(WgCib5Ymaw>lH1Q?0#9rObb2u%P>apP;BbaW(?Eb@4~zE6b>`H{m{TqV z_o;XxR_lfr{c)r!>k(<%Le9Kt+jEKwM!un$UY|5h!c#6mr+%>qm5ToeoHtx1Ii|>l zcdf2*-|agu67tOh;i~}LJs(yW$p6&hS5U=qoK1`$Va=&4b|23p2)6Nj0PBlw8SYpM z=rjoy5X3iW<83iUo3n+LW92922Z`71b=rI~kX0ucb#FkN+@+fFT!~X4y;k7wf(C(> z4_$aRAqURG1D<`U4|9WUUYP|iVl(TQr&h2tqDyBH6Aw-wIIFp?K@pk8QlQk~IekRW{9T*Z@!KcT6}K4!8$eeO^Kri~l$Ye$ zmggj73fsUo6*o4X=tH8$FAR}SV9mTZb7ZJPYn{STVmRCy- z{b^_A72gwzpj@XS+4Lbg_@y2Jcq+VP}1n`?VP!gbr@0Cbg8 z+bUZPCg<3h3gdSLJX4W#9%v^E)=|IhcVJspTFQfITSg$}!d0C@N>C6qkX zruAS0{T!$sgJaaP13e?V_z|G+g)^$|5WlpjsBC6A=%_bf)G1z%i|{cQUX}rOdN!}& z=}cm|ICLJ30}m!tDYmy^mwe2_zVhM`xY|vOUHA`uB5J;&rk-IFZv-jUt06-a7RuVQ z&&~MNeZeTh#Fl>%uK$;TRPYx02jl-d7lP#y2W)HYrYFo3u6)<)kA~{Z9gpb)pU;5q zRaP{c6ivx@Y>ow)@cbe{G}1r90)iB2cTBIFQR~+f^gisNH*x5>KFRJ~Ik)5?00cRtIS5nq=sS<)! zIO(vd#zmWaFy69L^GDciHJ@+Fs}32+jWt1K+#z?R)EN^1S^4!-)Xn7X5yVpH;05m+ zY5}Oe+n?}rr#YTDQ#wY)-ly~i&L@C9F5Vah$1Madf}5hpPu$Uml?_%1jiEri(-JGT zWE;9tC=KZ{CjkqqH@mTEyNFRBW_lsRW5Vn1$T7W;u?@zewgqU*zog1ZDCA2ltq+b{ zEj}L57n?pKr%LRHW^*e0(E-bij9n}6l!^yBZLdK|_)MqB=%CmEn}=|eY@pc~zNW4F z8Xj5FVuCRz|LWyt#QvHC33`1~d;b!G#!`@(=;7ND3_Z2J1GZaOa^m?C*FhYy;bt%u z3iGBx$*uZmyXJmk$7LAy6*-lztF`m>lPCA8xtNb{Aj2H<4P1vEQfFS#MocF<08e1f z@taP;=j7TPlLZ$#QJNJyub#f*d#Y)T1J)Zw1A?c{i>NdmZc-Q3+yk zeHi6TSWD36us-#ncVbwcgNb2^uqq3lc>4-H;el3nt&RQ6T6hfQOL;*gmah0Os74MP%87*bIc{Uc>c*7QUc9+z zLk&(1VK)tLH)#`8h-V1iG-cCwj%}}l>P;13%c}s5)E%EyeNqt{q{}iEo_Qu(UhKi+ z1QA3hP`zqLB^Voq>Ul+6Lg4Gaz6ql0h=PgpWUCEd$(QS8V<utNctpmFeJx_Z8XbF6&omd zz#-^pxsXQ2u!{PX-HLro0-(`oshD`jz~8<#_R zapZ}Zsx-A;E8Xq^SPblzujF>-P6T_kr(7QAQc?) zzCicbipHG;3#ucw(fh(+i4>Nb5^VLFFv|DbZ2T2we3?&-d)m*+?QW8>R$q7v-|^`e zUdWLHt+#DLeGBeih4yljx#F1^l_~7!1>NRQU9<+W9CW#`zPKJE9gfdewW#E1=o`Fn zc5FOfG*=puMECBQ{4Bgp;9@&ULvu_)YKOen0b#v0F0#k{w27s<)xmbNUl_f8vlxxo zis(>Q2SMb`7s;XEYfTJ+cq)#hbf5X@co3TSd@Uhh&Mm%4HB|jD8XuMywmvgfX(5ly z!JD8>ULW_8n6C?H%a?#!)mv`t##weN5!)KehAPz21G}vaYaTB9C?7b#n8W0Z*_ubG z(h4P4J@D7j$!0SY9Fos5a@!dDiR;YO&XyBUx#X$Su&DP(DS%hmNx`66a8-9FDL3OI z;*CCQzkZ1~AAM0KHBX3rkGr|5^+z!sSPtx?Pr5;@9(DoKa@{wn>u@}iKdkval|eb7 z^MIem-C@Z1Ng)OXY9Iqmu-#(hym1`)U6qoyLr^7t$eYgE_(DH?!+|Hl$l;V1cJBYk z(brYyq&B%Io%l>Apz_p|8Dk2!>C*@E7J*|F*qZUl0W^GQGy#cBcyEt4SVgl5-Y+RI<^fagM`ra}ZB{bufqX z;(-{f%Q0CIQ zeEDna3S`i!Qo5pQ6fKCZn*<$rVhIiqrpq|6P59Wwj>%{ae;m@HUYmx9y=Rr~#Z5kv zR&=3`K2&VcLF&vjcV(=~BR9A@t}B++bj7i0V8DA#kOnBnQr8 zEQG3lNzV1triNd5(4ztTIUZWFIo8iW7Z5}JVnpquk4I=L)D(kp8a2na1Pfy3#$H39 zazpcltSY%a0XDRqPS|R9E*ngQ1vVN{@C8GB11=`(k}qpBA0}zFXH^=aqv|wqI^-4( z(*g_xY(SX&8k-_^mu#?VsyHQd&cs6|I?`?K7NApX@ljS}*oJjg_F@+z#GdDGEA8v7VE;+c!ukiv&YTC-}Y0dI^ z396R5edvet4$nK(Ne3*{ZBCUn&|8PG0eP<4d-MD4%EkE z1N|n@qjBhPsOZoDroZG7h+?a{x)0PAHmYX@(E{J@*t z@D9YsVMy(5!rSg#4-1}K0Y03?wT`FQuZ<~I zbZvu-@|$q@GWNV;$N^4Ua84DkH@f2WkN$w~C3A16YD>`k?dLEvHv30L9zwER&%0LR ze)nNE`Mcz_b72}=H#a)4(W!Kt1lyk+aBuLH<6zWh6`AM4s9=$*^KXVE6*L>=`YsJ! zx5o(-I!JD9PIOrAD{23Ldysy7A;b@$%-7;!zw0WRwwRQtx#Trgeeo8V){%)FQc3M& z;#QqMM(h)64m2`deUeR$vaV70Q?_kUCy$qfRac3$KLSPxo!D?RvQez<W^wpV^9ynBWc7Bk}pnDq6YQQ{MW|leRT}gfN zpX|(HAdIIsU?eDxE9L;PaG}nI{aOdMusf<5+w|`tQ@P6ULSfk%g(U>`n8M#B+)p(; z>{I9D3mrP@6{f6Q6(3^v31$G~#BX=4ivbJJT%BPCAJGly*lU49*uQj{`r!IzxsP2G+qYq=4^ z26fxUM>-S<&PDoPj0IOtewJ+=)P3E>{@iX=J15O+f=(1ZX%2@Im@Z1J?66|0JLI?5 z!6U>5H--G^QY;T@l0#wUsnEnu^(YMY1UV7*_+lb0(!jcQ`lGR3k%pC3ANGn1IojRL z2#t3#w!qCl+nD@-$f&MW-;2K)tHeb@&M$*YDZw0Zb5H zsxNuI;DICB6z#;-nA*;T_}+NJFY26f^vgar&z&b~cbuqdOs_8_9&V;!F;rq=d`#>yPn;_^cjC_}Q%R8>zOj<$Fe(BUnHs$*It zt|!%%8#cqP>%6`~FU++0MM+q)y9uN2eju-scx;kWW}(+k`-HM@prIkL*Wo4)ff%{z5-jaez~I3CX{uar$=TZ& zr0P+aHo;G|zNntC2PgRL(KTQ*C6`kgRMTMt774Ro>UCm#^(+<8I)8}-lQ6!11fmr zrkwZ3OZioQF{(Uz3dtpMZ}h`>>W68bh-e+L!fidE{mB2`!=3~aX-MA1F;R~^bZ)4v z>ZEo+UyxT+Gd~hjqO6;@qT@PaoAVXS18#s@09)vOC{{%i<`72AW!DtiRmltsCGqP_ z(w99tuEsv05Wm6>bnHB}GdCgUdiVWfWcUoIH%hce-zJzR6F{#3+FJyJ@IbnT#B-@l zEbI~C-oW+ZHI6XU@7zr3a)nZWrsbH!LCeRe0ZBE7E{J$=TFV8o`o!4klJ{nJ1z@S@ zZ05-od5Q|Tjy!$J)nmsC-s}kWvqJ_N5)z(YBT{$NYzlPm>`ErW>@gZWq;UE_S348#F^NJq|iILp#8EACuB|OS_ z)d8FtDRk3O$0Ohc1bGddDWkj1>0DUU5jA1jG2ymjkTer|sxydHJ_d);_QZx)8^sKC z26W(HHvJPMOCa=%iQu~IIdZ)DYbOEhwMiEX|Ij#wY^?fDObbzP<{b0` zq9i$zRjJ>+08llFRGU61zG=rOGB4%fO?W|1K2Mub@`5bBh>v_gnh=bdB9*0AraV^! zWMrQ{dh(WT;oa!PMa7E66odJtxUM44@sbhfmt2UH1yl4zmoaC3dDozjt$y;Uez}%m{CpSRtR)sYOtWQP# z6D{pw4vy$Xwv;`m)U9^by<%3-1DJr+5?t!NT*1}_qhh;KW}G`CNW<}AgtlP%;4ttU z_RWo;;ZUzS4@C1Dkk(|S5hBdyV$&G=~? zg!a1|X#22ZbP^5{b_b1mL=8`23E3A48xJ_Hp(C1;nnws5;@3_ACgr$&rszFz2P(T; zuGzkj@|=M=`oK0-($8A+JQ#t>QCQzC^+W_V)Xs$_faOHw{@^tS8h%`ljz#q2r`2k) z2k~5jtyB2PhiL+KSDlmnF)dY*KVQRCRcO1&-f?{gHMEY2_dA35hsQh^>+S>fX^-9% zff`;9kSk+Ks}7jXCR;25-NO+tIUyWq-9YyRj$Z_foaHSjNsiffaNq0ar0vUfO6AiZ z=XkB|K={Z!`kpwTG3Ny(2nz5BZ1H1k!V$Sopmok$Qp2o7%`n=U+`b^FhI)dNG(9sP zd)VQZ9+-dDbPKwLD4|eE>BUD)%aMQ?37hlFB?3}swQ&yzh&~%Su6h-6M88bgc+47-C^m`rk2FpHpbWW!8x)aS~x0^aM@aIfXDcutLKJoyLeZ@YZOSR2qvUeCbr%ne%Z=Hz8xsHxOXO<8P7I2QNIw#Fb=yD#dq z?>*$qxXrkJuYK}(to+DU%?;^f@U1{;kB7Dl5W8<;ikWf?iNzBF=YZO7LpYdcY<3LV zrp0Dw4tdC1f%4-RpoVAJl>=zZcw*IW!(cqtV~Dd{a?AmSk3IKUWyh}b(qqQ)62`x4 zo(KwU%LnE>f2nVD$Ef3>X@ob~6Apg>pL=_UyI_``55WNqT|rFW&+lYZE^R|i6OcDF zT2hJZ*?%O)hHL229Niali`?k>_iQ)$m0yp)3Bg_$Y(c7!qcOB8uUH!|qXQ$nq;w8z zA-M>c%X_=k{mCcO#OB3oYNl`$oRZ_<>=x=yv4(J#vRI9dArGPEWMg#698eJabOQ~~ zn?X<;Q?7TUG=>+C8zf_AD&0ZalAh`+2mLq%*vFXf%zlJ!R6)&A^W~=b%*M%2oI7W| zW+0azV7}mSL2uli;^G9cJR!L`5lnM7+{G|_uNCrcb!J3Drd{O?*zwvWu8RE$?gBE? zu9d|$Z^kla#MAv;0@zw|LirsMCZeA}hwA>JN9bN>#BdxsSmUyHnen$0{nr^jg2-b# z29L{KDR+JR+OCC(dyf%C^+SZ_F&<<>O*YfeU-Q6IZRTx8lXmpbNCpM$P>N^TYO{vs z=MWym?G|gsFfAbl+#zmN)VoopASTy2bmDX0{_OV<;hK(~8ZPmn!%wGuol$2)4P8Q% zYWuU%A9n){8D5@9$3yG@`Zm=>uG8YZ`gULI8Yd4bQ6VwOsA2>-N+?X!F?1A?ePPP# zV%+s4Tp@0}RS{ZOXJ(TJ1=KVh$o0XAWT-f)tD&QMh8q4*zsgP~gNdhpk;7xAg4i%@ zlK@dbuD_<0L!z&)V-35sHH;n<1|U2iHV&|7#xi}zbrx1SnhO}W0S1>z?5ZO%#P>pO zIcD&tjX~VNYh8MkIOXPqC49#6G3_f*1Mpi1m|~KjVpIDx1}LzzJZLudLc2#TY(j^n+nPELbA_SGY$+};( z`h673fjwXC+ck#({~;&F$ciwWY*AM<0LsW@%Gr#Ivx#ogE71mYkz%ho;xHQ48a8@?foW0Zw(=`6sNU809#JrdD z5qDZtLT^eN(THq#nR5bSpkf$SW8bin*ZryOUYgDNJi)9rS!jQD9F)fAD`PB)wyu%b zC~f)I{P1U&qw2POABIIf=M&T#wQO#OH?d;iv`L@xG+u|1!{4F4N=RH$d)SSXhE=6LwTo=?q zdOaZ;vkaIHP3a1c{)p%hlyk(qe-Y7jc!=ph0a??ik4JL#=qcL6s>!`jI)xv1{r4q0SH_XSfkQwSJq(3Vdl(MwWIkZRRf|H6yLk z;>-sf&_(R`WfL!D;$+**#v1wb!=(t>pYbAr4K({QKB6l_;<2I5M|QPorqe7cbc*W* zJ^b2B>|!Tj`xIc~=_|8=M#_`KRT&}yV<>R9rmPXQ5t$J~e2G!5m|)VPTS;zG29x*` zHe<%#W>7LL0kztq&XGa1*3K?W(}^p?qQo%$Hmab~{Ar)qhf#OMeNu@H4=$w+=pLkL z`{Gn#pRtkNsD79f(y*vt(=K)PtmBXkoXhU|OIv^+#?h0(9SDYOo9?n}OYbCm0&)*{ z`045qQ?egf-@I8NcQsgcrV4%N9AF{?+lryg$tZX#(iiKPEivXTjhPF+fG;tMQE^~7 z$2U~xX&IdI+Ag3&yXHYO#kFqoK5wWGmk_AypzgLn=+rm!X^QZmTXBMo<4WM1W%+`z zth4m+>9dP1^rkzmB8bw#QQ}TbAQc2Fv==w zANc9XTpx@|kwsr^jtL_Y%nX%^zb~kqkugtoK{Vz8q_XSTCgF>D?M1Ltp^cBT@EJ=i zn?JzD^E_h1Uu(453WgLMG5Hkc6m>hPI9ZHa&PAo)1z41P)lnTM#7Wr=bm4CtfhXC1 z)WiBUQ&IR+4dCvP18Z!+v7L$|o@_Cnyb**oKWiR@=$x(33}0Y7`ZZVL)Ma$p1N(Tj zZosD5K2^UEFCrBL*#se)^-)~K*LlE3$g$c#1w3@Q;(E6lTM-!9%qvK__lnF~xvn#` zgSGw$Ru=>7cI#_L5+m%?)`Vcq@e7?Qv}Icrix1Jd$a+zuB&N{aYsqjMu^)^KFX~(i z#AEUt>WA+;$(ZwFKVw%kPUb;xz{)FYk~5t*X`JndW(M-e*=uOiMFaiJEW@up7sj}d zBJo?_#%Sdjv7xD@-&Co~=E|KWy=Nsfe2uJ55g{+JL6cg}X@?LhgySY05^!ERcFtAk zF`!fXKjU(+TPv(EU=S#Ea>oV)-5Wi8vs7^mR(JtN&R1@vLf`4>x)8-Wzwm;n!m-<# z(fQ#R3hY%xbhBjZxX7VYVG}ftClrUAC}x*KIdpzK$A-81q;@(15rW5u`>D~m0qm8Q zv1_yhqMH?a>5Kf@M`C6%si98o16>=Np4yIm{CEQ(`yFG%yoc4YRGgsEU z5#h*7z|AuLTed!e&XLNo@eEwY=-4K8TG$Y*deG=YH+=5TtXb$~1IJBKv{47429T=} zG$0n0F&OyM;Njcb z3vY}jpNL2vx?{s3aX8lKXa0;VzQ&%{4NnY|)Ax%4ThV}rWRh%DIVP{xj9 zpfNVq^`JU`L>eapHJjg+0~1kHuS$aEgLCvbLvah0$)i2xls zjV0VN7yL03QzS(^cu<4mwWLg&wo6rb5{<@dZ>D8Sho4}7{E^a%FV*Q7b^Atn`jlV8 zeRTt`Jb_lri!wTs6kixB`5kHD7!Uxt`6#@JGt%)Z|BBi;^z3j-imh(pR85u(`b#`~ z20FwPuGuh!PwA5ruR3-tBusx++x?XQ^r@z#qC$1+FO1?8#+tReAaxzgUi$#*0DUlt z#qA@R(HJxzyh1`idYLZR5Z{xA*7Svz3E?lmZ2y4TYlBzWr5DsPh|kRcG0p@?nhseL zHaoxqi_8;h zIuXMfTgrXm-yj|4=|PK5Wx;VhU0}2Hsd1|xzMBX`4{eLrqT+4i03BAK>&7yi@SM^s z{GLnqbqq|dPIFCTx#pDRRQ5tZoH;T9}JQ< z{8bo5J23Gv9`MM}(U0-E2ctS$7t)>4h-^*Obx>=E&9kv9cHUd~b+kKFy&KGU)eqw= z?3+5q(Dg|p63u9&gVy(KAAD@M5LD|xGS;SNOgv{SE51n7{ZS7Iu_;Lyg{vdlEThba})e)phSswts5vf*0bS54!1#mo#4?!XM%M}?bV+j*828H|2 zb->Ri3VJz(G{ymR{Saq2oy*R|mOQDg!ngL2)y}m#YPr4ykBsL5G-j@5G7S?{sN}yT z)+VP&AHcVlLFzhsiEZ6Yf5u)qIPnoXJY;0YB??0P3L}qS_fI64BtQVAWREVJ$5Rt>r3+P*p>qcNd0Zm{MM+emb9o3VXD^biVd-Y`&tOoRBrj*WT4SDukn0iq^fCHyg!HvtC->|H-`mBDA z5f|=+D~fj*#`7_WIbw*M#{@CC^2aoY+1Ej6M$Jq(&KJDpOH`_(Hl{JI(=~=GHXF-G zXq}_9O9|96p%UuPsJX4UA`e7ypQuBnO(}wfcg%bq#$n^R=*}}rknh}wZxDywaIDq|0( z+d6PVvAYmqG=kv~{UJteSL#F)=6YI2cCpeD+CvcUJlm7iW1R!-3!A>WDYB7^G*Xn| zA6Yt3&C(9(L;DK)IC2%)OE7iEIrV+>x#0P%e(s%6IVzb7Tl)>^5=OZ5&KD9Swawam z%rNaw%1;~U$`zP(Me?${E<>mt1N2n7&z%MlQZW_aSR#il`&#zfq-A3v>=>4->T5qA z9kKK$P$}8i%{eKEvhR7G@WZ2D=BEw4mOK-&C4y<(cU_6CKA>}b4iF!%iDu*G;Q@PT zsDc?8udFw*HW`{l;oA;vSyLtQ88GS@8@SVk?GrQ|GtU+eACTg}wCK+DW}##xJrzVF zWN1D(DFmXRzkI`o$5uZRna-{l?za%D@kv1YSWtwHP5Pv&?ON2ZwoaaEmy#vGJRSWi zzZ_n*pI(c|`pD;`Uuz>x+A5!1I@Djts?86xh&DHFIrprK&F+<%S*~@dUo0 zEIvB4PpJz%z1L|ZXoiJDQD<2PHHZCEYkR&|EqXe8VvFv?4L4ERt6MDU@^r>8)Yh#l) zcW(l3YKPF3S%AV#Zx?+NRxGO6r5l`v)6KIXnqQD2temLYK4hjQvByRUS)JD%Gjgd{ z5dq{bWkDNkv{acR;#r>GV~l*OP-nXC^t11E-8hHsYOW<$)_Jry(NPdqe;3aBs|l`R zhneSXA+|%LzHh?VPy^GXyQaOs)1~zfKu7@s+ZugXsnctD$Q~%~0p7qe;1`uE%`bG> zfQq1B_jfk`z)Qt6+Q&D!d%SLs*34DI^GOY-FLKRg#TSl*IiKXdUx9}|N9)FvU~H_9 ztUQ42>^^G-rfSK;5OF*l7bIh1e`bH?@R3CjJ6_7wcS23-StCY%65V`QL4e8}Hy0Zw z%7!XDsG}X1*i{?biZ}9#LKSRUe%8>HDrmG<7YIt;u#c_k;eV6q!xB#${Ar@V$5uYt zKut6e@r8{JzhyDQ*?uUH!x8xmFAq!8@6`t#_)Oa;)zfG4>TkM`PwtEScSJ0B15C+} z=>BRyjy0y@dSGaYW`5)yx9aPKR%KlWSeAYKs>*JNHa+Cp!2{b%zlRTh>W)vxN3_N8 zCYn+Q8))yVT=GO3|5zp{?5nNG<97m0{mSo?NUxYd+WR@#O*AH+u~Teu@2Io<2z4-U z^+7yhR4Ux(GL<0t0d49k)%k4LX_ls9hevGcW9u230|Vg`;R2jpar6Ut%G#$+Vq_>r z!VA9+(M$%+u3?)f1%IcZV@EcxsLW&%EM-n=lZOy=9z!m6qX({853+z7lUG;mZ{Vvy zQk2Wa29t?kv*n1!7OIoljORJeUI1ldS(eCLhi5b-^A1nTk8^S?P`NPFaPGNq9vLkT zdn*{{9(_~e-*mSE+8i#tR2+nd*p+uMIy0J^h%L##=lV5#(H7r?9iq4&TP$k~1;)3V zlM`a8PdGgPGLa9+Zr&N9o+5z+hcq>eNM1GwC!{RqJED_w=4pg8Uy_?*tiBltJ<3bR zkc0Y?IOYxTNHzx{82L641Ro5Dao5{{=`)(CeI*v_!%HD`+ z807k^MEeSUkUtBuO zO1}0SS8b)5I##A&|hxNj<~B4fic-84F+IQ#^3 zkonvkAM1_VI>n{ppI|I5QDT1TEdK@ED@WHQv3Mzc>2okYx*-ZyF@^YNVzjY zHQIgzWOmEQ>S%&ZQg*!1brd$8UDdiGEHRiPcp>eijM>vQ9$OSz!Mq1Z1zK$bnG zk@2FeU)vRY5ezq=whicpXd@li76Soh1RRW|CwLB;rC6N@{pyJ3$=HU8X9pw<@2u(CE?VEo{lVzWTDdi9 z^buB&uKKBglG0SYhz!k4rOklrQEaQoEWA<$H>D$%r;n<$mJLR}o9BW1N&pnNM9iW( zF&Mfwy-=6@3{Y$HkOf(y;hlYgol?6e+9DFiaISNTIbw(?k&1ad)tP;b2gf*H4GErm zy3x!v@a)Ct825D~T4i0@E+LGLe!AkgK5K=sRZp0%Fa}r*j+qFK+&)W$4h)a+Lp}A4 zWr)_dn6GGG`b3fTwLhSIHqc!gq4}P|rbRp?d6HyVsW%N2@Y=g0iff-hY1j4xU=DWE zQN)dM`?$}~ApOd&r)~*Yti~Z%8LSgl2&$YfwQ@iL9Fu}-vQ?kWWjF_o(ogo8*tLzR zF^jzdc04>_3U7KUeFCA4uU=mumSIjTn|<4cE*#fjW{yqR;9)GP>Yp6+UBJ{gheGu^ z>dtL7%$rbv+d5$acM54SmyBp!=4EkEC#ilh=p4;Bc`?3>PiR49t3G{ zzo6?>8Dh4WeEJDAe9@4vECTrQ0S#GLlU%z{wfr2%JPnRjg^Hg5vsp!Q7#<;l6xKr) ztck>*y&hvZetq8jpgL+4WDj%R$csW9Y349booT<840S(+hR^0&0p%$)Pp8>TvuBzI zlK$m{0h~}`{j0wZLlWi*gfdZGQ0i6VU62k2N1cn5+Qi}Nc%dGl7l9~!Ty-k8v6VnV zOsVu$$K0$IdehqIuVunimDbj3xQZ4f;G8-0)?G`#C3x;J@v=@WA1xN5}EmhZ8* z1O_G#4`bunAr0Ma%s{j{r|^Q2X%m)#yok=@K{6cH5`2!XTK0*Jk<}v5(RcbPMq5~Q zPHS}_w{Xy${4Z1{y3tcXxmZJ7C7{0Jp!Zt=p3BZ+I`HBlcmwC!h8YVp#+1`AQ^weh zO)d!B^Iqi|j}t@`Kl#A)7%$x1qd8;&@`r9TE4^7+ydCZ?wu!G2r7aBa`Wa|I-?nQZ zTAZOZ0UIX2NnCWZVC!%UV|wb~*g(@DmlvBt#;rD}PmZj#VMvzJ=^Qy!4$wgr-K_Bgy|f`EYnHem^y6GybNhn6$s3QV z(~=FNH~g%{u&bUfEV=X~b$)4fv$5m(MbllIiNlN?04fP)OsKhO22o(@mi}l;wtvLN_ zs*#vdD}1R8{86jXcYEYKhqy<(nFt&;716Na&18L%D;UmQ`Ztz5XHBx8=xV~VO`Tvv zn8H}4D%lodRo>J_2j5;7py{Vi)TbMwiZ404MMsBOI^h>B>@bJjcgse|Hr&C~p^u2f z8NbjG!-)0dBq7jWH!Vb=X<|?^XLwP~cBJz)Y}M?9oXet}m5)sk;8S-Q+hbZ4q-b&N ziL0vrcu-Q_B&+;L*Q1|6Yghk~c(i%?{8`ERyQBF-LqC<~L8CI{z;pQX(em-?>8tn% zhtsNKpejLyf=~t}L8jb!sU2tdu19nvV#5{`P&zLV6m@3^sBXQsH!uoUx@A+Pe#9-z zh+y6{lJ4Oassl_%dGg?Psw>Wx@LGQnR!miB)(+4L<#+6;W|oK!G5lswORUWH*09tZTwO)0vqeV~mzq}m%7C)-{;%MdJg zv^P#Q4lG&uQ{CY$hk|T}3lLCYdC`|VJYiHK7ny?wM8D>0DGTVFZTF!$@97Xt>B`*PY3nEUts$I)Klr;$ zbf4n|zQ}&!&RAiO_z|tiDfcJ9mKnG`W7&AfPi0js_=Q9UFg8`)*skNUSUlO|bF1Th zt$N1+dq|Z|Y2Aq#Zr&A(ob5<=-J5_&FK(cVIs%weJ)hAn5y)>CCKCt0 zj(5cqJZseyDw$HMpd1=DZG&B&?=k!Yu#vS3`_~+!&TUdZnU|S$lQu+LVG}3`>-s=c zsOy}Npq~EmQ@d`%)DfH77Mdmr#uPjFx4~}XBWrQ=q8J|v+O^36&+GbPtuZ2v9k(gX z)NcyQAG{oVraOJ76qY+t(D+&ad87aYJ6e3`g*$Z{U`=YVR`4_T`H zNds`P#K!M7XLg+8ppWhUMZPV|Gp1Q}la^jD+&r#slIYkQXEBX0e#76@GH*K`I$-W4 zT5KYzE>r+ub@aWIJ*RiEiY;x4GWyz_}Yj0r_P??RyMh1I*Lq)?HAs5X~6)7oDh|Ky<>0xcD zeQzYUcuFKY$^-PR_ocpFUlrfr_G=h1!c8;d<#FW~>Ik^R7PDk*`wWjGbLVIm)qe@% z6Yp%0EgthrjhOqikbe3e&_2km`>JO1a*WE@9N3N~qis;vPv>UA?Q>H(hRcZx(A-2K zKYGM+@@YnJijO%WIL>jBE1EO+j4d!#Yo{A&_d!2vV?F+j6-%0DNXPuqLry>0R7Sy3 zs2?3s_ZDNY6Gn=LICI8plIuA})M~j#CSq01gP|JtBd-YB3AAP0KBkFP z&fYjq{`m>gF5iFL<{l--Zp--x1g`k2wX|hAACZ{R@kxA@kwIWqO!`4!f(uwpGxDp> z{R5f$V~vmv$A^G_qtlLCFw&eo`eMPQhs;}VSp9>{I1`X3ueC)xVfu7JB-po*A+Cqm z_9j{mKdbVyqPgVr(JDXl5vBb4;z3t-bmD0?e|-4r)mMFgVm$mIkqAbqL*%ME&U~}n z;Q9&=IZw7}wu0jY(aKL+9wXk75&R19NS<+}xn0ZE9^Y=15@hn%M<--jGNf}RK%^=s zAA=6242JV2`^jCt+2Y6#)Ael8*fO?k|z>{$O65G;LIrGS)${+&wD6SO-v$OuLa|9wqN{LoaPEpvD}HZyEfGK zHCE&t;Qvt!@L%ASk|>XBz}HN#EzG;~iDGTiM%m*l^gmEq4t?at1hf@z%p9O?s3M!x&c!}4)H|*A+G)asv{fQI%b@TEK6c8IT4m#g(neJt}Lj0+n;BUvyS4C zKe6N|6q#um16rqgx}v}f^CvG5taW6q3$)uxqu!*ci%P%BQN3Q+m$ z3j%ny*R&&hc4-{T{uw}8Fj&#MQC-BweiMUKnH> z=!)$#;jQK%SaVdV4U}k7A0+kIIM!SA5kz-wf^ARzvyZW%6Q%u8i7U~FUB4s8-f(Sh zMIc9(r*6BUSKn5N1v5-Hqh$HvzrUgzy){S0s7>6A~JUx zk)_^=h^TqZjukSYKrifYLwg7o@zJTfDF#E(sgpI_v(yM}IC$-QF1*rr`P56X+!8w` zbZO^sAr8S+otDA{QgrwTO2#<{qm$3AhBU_J*r9y6KjK?tCM;x?iCuh)Fe6j~e2bQ` zxZ0#W{wT`Fa79h$qyw5abj$~N)CA?i@|b(vEgYG2c#vE!iUTio=$t;7&e(1e;#7&} zBBa4?e;ANr@(g0L0dg@0*WB39hFF#I3H|-W+z6iM*P9?d9oh3bAdd%4^T4K{$u@ah z8(nfbHg;J5LVJkGDWTA8cg8FRMmEs6TAUKJGuua z=fh4~FQYQYjRDH8;kHf=hXcQ&CT`~J#lD(NAM@DPO5P_darHTXk*6KlJDl$_!agnp zwQZn{d2tJtiIJn&v0kLZSi)*Dc2hUseHGo}60V--jw(yvgF)p$oz`IErwxzeqVguR z7soYzZBy@=S(efpM90kUY#bm+G#lG9A22>4#UAy7n_|9g#4Y`#LzzK|CDDMik&4D{ z>3uNyt=XdPiVNTUpSkAmt<_q!=dF1HUUOCLhC0M4)$Zj8ViD#pNWBVMti9F?HP@4N zH)o7!j@SchYS0=vCaR%XDO=q@J55lx>&t&6x?gYhKXv3~&l_Xf>mpCFUa$!48Jx2O zW2rSWCbWI80?iK$v16x*NC>%+v78VsUd)7=bSOA%m=`~}RZXa>S;?0Xxf< zOH5QuW+_{BY<%e0^@}|_@oB;9uYSAFf;dj4GFQRv+2lC=;V?y%H(q!vSR7j zKmuv0ZGu|xO)O{1(aWMiT_rbZ!Hbd)E(3TfyV>%SY&*B?VJ}5uRYT>taNV!;rPIYQ zm;^*=6{~y*j7hIo_6gI5MY_^ba|i}?a5y@~`7PMZoTSmOy`3&$a@w0o^Sa+$7SLM(yJza*}rJ9g9PPTpQrnSQ!!#J&Tfyt^dZF zM=fWyH7D1&0Z6pBap_!H*v-VmG{dm1$^i0IAEGyJ_2IMUe3blR7~(;hd;f@VT{HWgNPk8`Kc6cEX1%IqX{N!x6%?nbf3IVJ13KmS9@RxYf_Q+@b5TX1dM?FZHt1>m)OVHv>N+S8 zR@`rM+eJT0s}VRSI=0P|p`4vIe#l(rSvVZXS?W2M7dCUz9o04DW!sES&N)?tsEmM# zj4f>)&SjOSge{+?0;>t3RcDugTB)LP7x^}U%h7WoLV0d8xA#2ifWMc>G}rAKFfYi* zSX>(woh`?y3Ilk6vQIz(+*z~5__`4~icr+#G^mXIu_(+C2(zflm zjm@!#{N_6SE&(A?)}*2y@@{tr?QXDl-gMyv=X_)M{%KWlAdijR&I!aZEUKv!(;`Pi z#(Zs!{UYy1lz@hGox^I2BKDDU8vN>K<@&&`37z_+!f*&W$dA9%S?Cyy>9ku{c#d$| z(N#rY`X9P8zG>*tib8$(CIeMsPqTXbyBzzT?P^29p256=Z@MaSy4&W2P1}G5v2|6J zy`47w0-;3)yU_C@H-1&g2?4-<0SZP`$@M;0sl|9AA7`;`vE?7o=FE#|wjTWJZ$1P4 z89o!Oq+=8Re5B(yuz`N{)nAttA(|>wanjojn{(Nli$%tvgRpKAlDkR_TE;XL+*C%% zA`sD$Z2tAIn#gL=b2)l*N_(z)YGLVY`p5u!4GBPY$U_j%UEo!@eoP%!HkGl*k1eKS zp;NUlVaSH+eU+utkj6HUPm6bExz&BI@-Kz5x^@~#{@*2;m{cLHYP z;$B${+946Zldj|3FgcE=o(3YWTs3|-mbCI6N6CT}Qqm@8*dH0gtg-5PHqrbc1Rvb@ z1u>;ns3Ryl86GszcSEKmh2Zc;iBsShu%Vnr#YjH6`5v-;%f5b=IjiH9uM^~gW$Pi1 zbH}gxCuDI--9Xv41jIQl_9h3oE&$GTpjLHa^|coZMl!f0=9oM~;&ceRPG}}MZVLtD zdPhxE(dnv+jey-w>WPbHVs4Cwl-d@BV#!S+@`v;R{~_y%9A79i-Gf*<5c@mU*p2QI zcfENIk$IWT8VB>#Walxokz40Pp0=>(*$EV^%RtaiL8nY{=_0c>*bt{4)4|kTsDx~F z5ugFDSEDeaF@QGht>{znSDu6N8P%g4bZlN6BmG?Qa06Z6c z%JmO6fIF>2x?U!y(#tP4Q^Lv;M5B>&166%u2t_}lJ#b-QdK(qXN0jp@EmUjA9>Fe; zRWP)4C}?$cXxh-H?l=@QKkftVsTbyAm*AJ4=$xFJ!xfs2!Q;TXOio6^aU=s-Ly?1K zQlReibI6TlB@LJ^73V%!nZ)K?1ITcG_9VK9zyX=?Jh3f}uh;Wze;jk23B-k6&oTXY z4c8hU-3k(DB#RHY4|I|VT_YOG<{~uT69~g2AevtEsSVE*Ge=g}pT`kd428(abe9!I z%_Q;FPxD28~gT5Q|?~r9UtS`FdP$g3?#XwI2A37k2 z#Gt}D)RHq~l3&?Op*t#lM$1u)K6a61E)b(_fb=PG*|>gE11TjFwc(zGkoiaqf1LUCAJLC*|8>+o(ALJF1FH$a7t7QIzvyh63A9ImF4*LOFHZgD z`-c%f3wQ&mI~}pOeKC_Zr$xc&vRjOrkXn)y*f%5NzLK~LPdJ|B9lkiHebBJsSW(+9 z=))S){yVR$WIFiqSC#$FTIx@u#KhCdQQse*nfrpzh) zP2Xp{3`oQ!h4o|}JC>nAyVcRReF(#+qcx{v!g362lS$v5XqC+exCT+W0aJus9$M`f)Tb@Eu+-;F zh{41)^&>z)eqt**Y%a|j)6yS%ksWJMQ&W{$V3HSs?{Y?nL!{ICBO2zifeq1{Nz9n8 z%08E%Q^K2e2roebBz`ji)>CFMHgY45U}g$qtsKmlR?ekJZE{Rc$IUJXcIQZL%0P9y zfL4`aR~@X_B)bo7=`$h^;g1+dFHhjqyUr80IOPVKhA=$q73dRKOsp7*CpYEHoKba` z(f@F+_sk1%CEpETUqq(|X05K*bK4+V2io^Db&GkS{FcbXa-uHk?c!-~PLPLh)!iRN z)K3j)H=fSlbQ_+pp@>?pYn4eu_vV(mWL=bLUCJs5xS_7&n65LH@@pS)zT~Kn+eIpT zeJo+n9*Q#eu!FLpYVv1~qwZx(Hqi-b>h#624Q2G#zM*YP1nK%=*cR2#*s!=y)ae_4 zz{dA*7nUIwNIESJi;zue{eejRU`kGnaRAwe`RXfiOx`0SdD}8&^{dy1fsWddP)WtP zD5ZMP;D??Kv{q&(wKl27iEWw{TT$CL!_|Sy9H~4!=IrRILkBN3DyG?z@mP$k3hp%)osdyn6Z$KOh;fB!-gk&_>M$Hxq|`utrBfto3I=QB2Dm z_M9s6PS0e^7rK2*Hlw5iTH7=?C!2^duW*zKpM%+KktqrbAAG*kFG{sL{N@0dwVe2e zOEHW`B}aXzu9(f4KBWa`ACLn`fzZZIiG$VLyIS-HA9qtSk&^GwL}dKnJ+iSm%w(g- zOc^GX${7bsRUf~?al_x>hV&MXKsLvYM>f}3r%s5*+O(91zKy!f^kA%+$KoO1G4%ho zm#sC2IK{uaF=WuiWsk%2a^??c->XPgjOs3IhAk6&=zCMmm9F1f32NhN>p(4a105Xl znVlW0%@6VtTO0eTE+oEfTE^^Q`T@`xL$2a?t`D25a^#ZIM0c1CFEy^=b6~wrR(~i_ zfrhBrV{?q!O{$UY&8_G^Ljeeu4Y_sGcSihq>e=35WBKA_e$_?U=1wHkW)2cV~X+I+`KjVAFe}=^>%+nH!sEwh`?MrC*o@SCKUN&oN)QFpT&&Mrx ztj(N~+6_hZceL-6MRfr_{IQPKyUxfKPX`?Vt|4n};IHp7wf|9G!8*y$=E`tCBySTs zW_h@ZoxqGOsC5L-I%z=<7o>DwhI8PEH6Wr`H+p?9yPK}6z7NTS*Saxf+06~T%;sYV zVq>;_uSXh`R%K2h)G@Yz0FyOO6*eKCkaH%>DB6eW%a<^$qY{xtsAT(S*Hm|+gOW#m zIoR7AYIyEVJxm=_1#V8GBJQXd-N21bFQ9<>*jlA%4ES7FkssbQMxB=38O$_NtO|Op z+A3pL2PAk_qk~u)qKhL25c|c*(Z`)^+D_O2naS*2rrqw$e4(aaF{!t0(4enQs%oA} z=la+<7UJRKPrx;(MPnLym5#v1^}JI?6r?Bgnz^c5%mJ!MY|gC%P_v?zi9E05iOo+6 zO(QV%$(w4``GR!%VtPZRGA#}YLupj#y%5s)L>Aix`6Sw^<_Sq$2m#YSy@7%TU4V$a7NkdQpImAe6bE-i^U9KM9yfv7~b@j8Fd>Q7aVD|Qpt zVLaCsobchCgQGu@pKC?zHQ(SZKWdS?m-175~R=T z9gxQ8;8Q#UI{4c*H#B?gB@coM%hhBtZBjH-X!KP~nZAb!&G~fBC^<&PPNw}1Xu7)b z${b9|Z=WJxH_^-gII5j1YOh$i5Y}g+1wXY%j<#I2TdwmXU%l>X&+En5>&ASykDNF8 z>Vxgc)_P%}AAV1m?u?t&rs*mvn0O6ha~BS;_Ni8{>L4?rb^tmtM%nrfXk(*FD-gGW z;q{LdiR4(H6i3(jky}${Xr3w-zZwRmp|r)PYBn*0QNyo&&YW2ozI9Y@?h&z7+d_Be zjRDn*j`7uYn|abMg7+fNvFC=lZcP=(y2St!$LOyRRFQ~dn|^aX9^A}<|K3Q2e9tm6 z8GEa{z=Ik~o%sSyX9-{e7HdD&d_NH*apI%8sw2-2lhaDW+Tx{c-O(ZJ<`-Mo0NKz+ z%%ZM`X&%*K5((g2I6^{_*fjIu%P$`l>N`})l_RpGzkQ>!rs>eh;_#70pRhG%sGBct z(>}%0fk0mzal&563z_fm14FLn0%V9S5407do7GiSrK(`nhmh#htej3J=~R2|nKwUF zkhRc(r9TH*JBg{WYzJP{M+ub!B$rZj>G+l2QbcmcqKb*iWA%yF>1zwX|Aup ziV2tIP9F@)>Qe8^>r)-Aj$jDP*GviklWSeno;D9pj`S^!ocPA9EHaAQa zKlWnIv3S(jdK3mB^T%^z`u7+c6aD?gz=~?G1IZcAL@+lQ=VFK*2as_>KFsv)xYe$) zs%__q_-V^d#0QP%T5f;@cCr&E_(et;Q?^S5WV3c3SJcMUS$esssyICmIA$&a_s`cD z2ZU+~Hs@2~Gk?m$b58`%+vF^$V9MtEjTjpXZc`!us(ba0y=$C(m!K|>j{zxg%$zPV zp`pN5eOacTxJzMVg+qddN*Kt23IQ8P)ws4VNEc+=^Q_m4iK$Qjmv6y*{rcZZPYip? zUc%moWn*&U7m9GnFZn>0nB<@9Y2R$Gc_8H4z-kCjC2j?gUW$hwY&?n{1Ig@WT(}nv!`tYgyp~Tu) zD{zg0O~ZpmeIfk_N5GE8h4FSOIYBNhE#+kF4+VG)=Lf;VoI&&TB{u4QVJU`W9+9GG)3dyECVFa5O$3!{; zQ9|wyMdGq~){NDs$(NgXSq2=g%J|TMsU*nuIJHX_I1172JZ%RZIm-%;k&=_`P8}KZ zCT0$PT#phT1qmG*{h$&z(E4Hy&^Ax=4?f3-Idu>#J@D$ zDtO=lpNz%03dY7UKqK1k_=9TW0W3M?jvAc79P2(y)Wcs@u9F!VGD{1t-)eF@(401R_Uo^xd3e2DGf6H%<`B0E%MN)|1Vv4}i+Z9Y84) z;<&+AL7+d|LS+yOu#Xy(%-*+cLCdK=Rx>DpnRO@#6#z_^W5c!AZC5`T-_dalYR`XX zdxTjI#+_`f;D9OC^Chaz#*lqdP?)<)u#@8j~F<%)o>+Jd5!YB{d?)$>WMH z3lsmQsC??SH+_gDlom)Wx7+Xrvw@zdq=6l<$r#W>nrAh|gl&o3deuA*o2fvpt{ruYz*#7OwxjZchJJKG@r~_nK z6K7i-PI!2h*)ii_s7_4#h7`;ac3NgK=OSkF_*LUDzdN&pjz<9ilvS+$K7dtq;vNMy z)7^A7KNP-gbu;7f4I(FyBkuErCb39XN>DXf+-SmN*0I{JB`oYNo}M62s2&e|rD=`M zktCN=$0X5m!zRvsQ|6D(Xngv8%VM9>h6yV}9QulHfbZrZy0LY>ZwGmyB6;$xdgm!& zQ(@W3J1c_MAR#J}ln?sO&(Q@G#xZfkWqd-` z+Dt?HXk8^+Ye*oae5t~V5kA_Hx<=P}kL&K zR_IgGF4V^KN)=dkJZw~^1Y%4M7EnfBv70VTvJF`R!1S!e810QYBT65yws+XK)FkDjng zWU+*D$Za?q3o7XOpCWTamCCzpe=b0D#4|S~x9Tva|IBCMxDkcVJ4gBWQDl$2fzn&H zK1JgMo}0>#9pF=KIGXFYq28S1VT`o@Q(cJY0otW) zbmw2-n$L^hbiscdrM_imFb~4x2H($VQfE^{J?vv$N-AR0J|ySWM{PEpha~C<99WxM z^|>2Vm-=BtWSQx#KaK(2I~EZRvkUeMWBA^rD9?@`qG+i31p{W0Ye;dkko76iI}&Zk zJ0d0m>5i*I-{ZHsH5;tmJQ}p(JlQI(ut#IrKk+X(gi;5zRnLY}4dQ^Ts$T#ywxiRp z5v1*$&03E9)vImTFqN@E-ECcG>g@V#yna}Ff#*-EhQ}V1hDnn!6u+5IC$(WiQ54fR zVy2zGC7YXBHxiOs`8Clm#40Fwj)Vy}a|c}$9g%-YJ_9I}0 zT3Uh#!wQppSztEHkkno>_{N@V(A6eJ>Ks-O4?6K_JdUT|k+BWwK*O%Z81tb+^tWeu zy^9PET+*Jy|MbOlR@ST^OesFkjOGX4Ad92&Q_wiXa4zMKHs9qOY4zN7o3t(dRX2HM zZXWO65vMR6b+{^RTji&9`gHx-SAg`Zr|*;vv<(Ot2gl$Hp-}VSsD?rV0P>nAvrt-6 zq@H03Cy0%0xJ(q(HDJU*KabTk2@^B%*vmw`w##h)jNj#yj@T z;~*fXD&u4+Z!Dr_R~AEiFT=J-a;w71snNxyB!aPdhmVV|T?E zc{D10!fwtnjwBmcN_=bnSl4qgGAn|~(R6pgRBje4UkG?`X0GbwYfAN)*y>|UYKa1( zXyYq#Ffp{FnZww|ZrAY(x!q*(T;qDZ$M`(kewWqMI{?;ZI?VA*uX?f$nyuJL#U#58i<(TdslsF%j!IDFj< z4aEGB@@YG-({MlK$S+i&s!10&)2ge#ZivCJ`>}%-2k~P$S}#NFz4tquQTI0*(ISE% zA%ct&B%-&`iJB&pL=bhfAbRg+2vMRFy%SyZ-UWl`y&HA(GDaDu9nbT=-*evc7o1|Wg}=FMku^`HbksL zBFxR$pX6Z3?lSchb*kmBMD?-F6|D)bugDo3H4&l6WD$2!tFAv~M( z)$+Z?*8TKAHt*9h%nK<;j*mSIOaA$dYnlu7%+jAn&-1v!h3a7u$-e2|HAFz(3S1aK zNo@1!^Sn9!YHCkOx6%aKwYoQW#W6Re3+pQMnlrOS_#(C9f>8?%Y53>1IoH_XeeJx3 z=>{PmIj&a@_nhoad*E|UW7!x?Wg072e`NHeIVh17U!&T>+*7O-o&+SzF%=0?xvF$W zk*9OKWaNw182tYETB=J}>Scae7M(jZ8(4q3zLDHoLe1z$zO83L`tW_h9nJ&DyS6ep z_Pt*iu9Z_W7VlX}%DzD$g&5Ub#WRT9ze#!F@W2_!3}brW;kS0HebaRNS}IxlowE1E zwg8&I;PcsG0?{MPier%YHp6qLrh1s-kNt1S)CE)*zS7G{kg*V1WQ@RGdnIh7yfl#X zMZ<4VEE8|$m&w2>JQTa#IQ8wK_o4tZQMfbe4 z2SJx+SpInaKqj?uiPdSbfJ{YgI-Lx^nBQ-zY8}s`dSkPAe;lV9`1kcou@QHYdNZvp zbH&ETMZS z%~Mojlhx-%w9M0=!{RWGL%KhOjCcDL@2bv6q(1NZSbFMB#AWW?pEyV_oNB@HYN=#3 zTX}})Y;mg zj)&!PR}^K|ZzI+GI-=KSr+dDr?VUs7Gy6WD}A2Bl5 z%A#6e;@lTbuw=bpovwQOx^?{6E?0U(%q~fbu4sl~?~KTncbP4Y-a-CJKx61jtlOm4 z@_r<)WaR}IYp*?-G^_cufHRXMyc7W=!^E2OX;rGU2E83(m?}rk3$ezu-E zm38DWIJFWIvHy7(KKst>+9~Q`n~MO$@2H))a_~Qme4~H2D^oa_y!3v}KP{Bj-s&h| zlVQ-A<1V@*oE&M`ycK^R@kTXW0Nq^qX|t7GDH$;zbjr7zGHGM>TDe(UXF8XYrgFB` zGSRJ`wRVY&tN5x#kh6(Y7#91-zUzE1+V0Mrr9A8|eo zujW|RtDhxVrLunKB=}bMpvjHuVU?eccH#Q#8Ev81OLei|`=jKOiEDy|@G+HD?@gBh z+1{-*@i`&XJZ0;B?c*O1)3WmbD&gNN6!VM3$4IRSTM}D;h5X>-E7MctPXW2Jhm`k3 zZK!rSqFeLyQWfr#G@ z%Ibf~IO7lQME-EsE>+3atUH*-Kk`h7W3_9D);5+qxF?nRtC-)AN?(e6q<&;>%e_bK z+R!2U+$QKRowC_1c=K#JV{BY_)%tsS=|8iY=f9VvA-+eEao7^uk#TY8X5`vS&h3b+ zIaK^%F7JhK*DVl(Fmrd5#)j)>1|3q6>JFH$?3vj5&WdOW4Z5Igd1 zlf1C*zI2mz`4f9X<8TAON_Z`i0PoqitaUct>JE1%@$XFf;vKa}u@G}PM%O7Gt!dO5 zB~y%d;qXKB?%~5tne>{OmOmR})2=vaP_9!(jDo#m=&kTN_AhD*OjKVq0cjxw+iYRE z?wD`+A~uhnYoyl;vr5}p)8yq9P0x3QWW8Ef@Ddq3KSwg9bR&cr*TXO7bt)%gNcm^u zty6z(jPm{=Mz$gPqgDG__l1v}$fOcI&X+x})oIK)CX!$Ics#xebbrNUVdtymbzfNl zH?L`^fc!-#37Ry@-wN7A{kv)`RUg!I44smBb)A1V)+zL0&7*CVzJ!i?o0Cz6)H&)R z*Hb=B4e;AoK+I-$TSzaz-{8Z%qibT>HYG{g9jY%gL_A8@G=OF^+F?*huUf9J*^J<= z3Yorm#|W6YU$IH#TooK%~AUl^b%<<<0HP)6H~agxivlMadQTCSG%`_&cJ21z;1|Yn!hxDAdX{E z`weLHXKr4*suOZt-zTh$4HoGAg8aukH4rq;xCdr z>L)YH9|N{(a-9od8WBZ?u5)sWBa`XC!LX+@;0ySIyd-=B^ zE@#V1ElofZ*m5^;tugsmvOtdkar5n$NLl!VSh|iPH9N17b1r1t<<}6gQ(xJ%kd}|O z)8Og5p;piSc;yaP`*${(Ku%-NUn6x?sT0&KS~J1>4}M#Ji;N$5Lg;&4UhG#J6g@1mir~H>-+BZ4Kx)34?namt#MZjoz#(wqo9D|7Z~C4;{#rn)hbjA?VdZ^l=lnoJ z$Jr$kv%fKo+qcfC*SMPl1u_IUy9!jmfV`Z%LYrM{F_*r!3ce9RQ}eUt0U0$RENe@d zuJ!x1xH%d-lO7DY#p0>?)w${I&`xg(IUWrWZZ4J}ULBmZUG@A&e1m`FvbYU- zXQ%rQ-_tHSnpe&4t=XyPch3KndAZk~wOW|(&`O1IQud))@vUtt0zH-k5?uL8Vey${UQhORLm}U~KihsIJ)xzsb zmbzMv_*Y&&AH8)e4d8d0gTgUMUB8l7h zWYxsmw_NO5!@X3&LAVH3rYdNT@O1CWh-QV!Dp6*d&~r_>o2(8ehMmO+eWkmxmeoZk z-^u%=9{zySvSXJQVglQ$27a()31@GVgbMZfo~O5T3ak01D4Qc*!R<_6P?>DI@AW^k z>R9ikw&H0HZKHS*@-u|DUWgwv@R*X;FV_y{GIdOOWb6LMAE2N4MyWz2>CxV5?D!fj zrY@T4^V<_CYeAYxb+ErC2tZG%gNjHUGvcL@hCX{~GpA#9@lrKB?71~CvV7;{bHU>h zMVi=|x0mW4fCs=m^3C{$A`MjJ(av#WvS(nCL>gZMQD$_e)5JXLTW8%kBd0K(&RIV5 zzQya_jpS7TQqBSVQJwkGBLc6!UW&Zf?Ve3=?|lh5u?1r%z)@rCCDLuhs4bxg!lqSJ&R+LzYZ1 zNL;iBl(SZDBOiAFX@^8(TaW_Qfpi}l_=imCoW4+jGR)GV-d)=Au)*;~#$~2WuUcPH zMYNg_7iT)=3RU1cGF0Y+wX_;W$@$1=&_i-PoSm=cRA#AR16TGv-9 z3>O1;7Z^Z??HUY_^C z3}}84YuvuxO)Kd0*#w;<41LYdi{14fHg%j(T!>`*6TjtsP`ApIC~f)tRaJMoe<3}FMJs7M zdUzy-lV(a&aZvnjfKh6ZwTQ7Hs^sL>S)CMojivuq89$(1B4d+tkd5I1aP3juYm)Fs zEC`N*i{`BLaLD_`>X^^2a{0Y|bksGDFJ;H81;qcF^NR?xR8yYLo_?<0y2%i#naa&0 zdmSNcwmSm)9JA>8GfVdB^%_Z7$P6b}lT)lyP!uP<@!RI}FYOi+gD)PsW&pL2;eyw} zLO%ul(J(Ec>!Kc@dk8|26s74wATMZwhenj4Q@H!o>eId&r}cw;hW@=f2R@16mxvkO zu%{sm+EY=CwT|Chz??A)DL!~G;D@N}4)=Z5PR5h(U&^m@93jdIjES0RKjLc7c(Tm? z+q)4$jdJ}2wtW$Q_DlKF&Q=Vbc%EHU-u|b#E*kHdZL$MQt|$Gv*j`*b^2iEuP8xxd z@qRH&TskTxOg10Y{j#d*fvP)(qier2BHHUV($f2Blv#-ti|e0-K#YjVt7*TP^|j$* zbe8tfTz~az1cmcnZt?dhLSD|B751+igX&MPPKqh#eSFWR-ToCsKDydymfaqtQ8t%Q zvOZC~3m((?8LHtcaXg%NXbN)8eA0pVfU6TInB5~~w(vFSH`H8&+FE7ts+v1&VVFCg zyk8VrPhv46KA6oA)+lxV6J&KIB=aOnnWNI$LSk%6sJy!Q2kFDjpZ+R+w_bk{Ea#S%>ipPrn;CZb1r>uB9FV#H%Lx58MTXkEY8cG_jzTy6mWmI_*z+)9dykB|tSgj`rWfTp@`J#dd0yv@80EcPJ`WObKv=>vq%G z#3%7DpPPRNPSA5TISR88b_2QgZBG;Eul&VD#IkRqJe$dsBiU3cYz_mlHCc%XpBV%8 zi82{~uCby7HvHQ|sJw9L>`}vO5u~&OOd5JyT`va(LYx()zqDBa()Juo!1h#w{|rBz(0HZlE%r!Hslw} z28m4QoYmPSda;jmaZ`t9diJKm+I9#$CX~^KJ;z!~g6KNOZ>}(5!tRArq;ovU3CGvh z8R?>sFr8CFo=X9BNv%PV`fJ@;YV&J2msU6+?kb&vvWcx-OQ}+7_;C3?VA5NLg7zON2^49A}caz3anEv*WbL#DclNT)w z-`fP*NuDedMjvJIrW0%7s%T!(H@Nsu&HY9FlM8Ws9;>h!!4K8Xzgyh$i)YvA?a2OH zWXNHrsmoM6eCl#Ze8yZ>%RfeL;s%7%eT!mc%*Xf*A^Jm!~sF~0G~ zPV238K$x#C>MQ>N0^cS7i_xo9Cxy|+%XA15Xpx1`JT`k*ZN_Zy=jHHqi_ zepO#)52_MMlsiPW;LT^i5R0-aHQ856YmZ6p ziTTYX&DUT!eoSI)IBlj;eMkS8NXWepUO0ZQ1w>pM3j_FKsO9j?NFKT@RQv zNLrXN$*`_wZ7lzw{hC+vHC4dZ*C7vo=T0mKB}R&o6MoLR4aN~CWYSkz`i11u89EpM znNmAljII+k4qhJI*YSO-G}zJ!>sJ@^m!It+p^k;k?V6@ZV-ZeFxjVhJU|D|&Zp(6G zAC7oEEA_O5ck!&!EPaM@x7&adDDt*LMGUhSfrG>+W5|?12P^7lm&3XpU%O`yPL^k)%@~(mygo=@ z$t>%HtK&a9&=rF}`}7(pwik{b#%l@l0$by!fO9712^ ztXaNqsYgyA?Qx^>>25kLLe}!6=;I)j_C9tlhM(NS*lEvf{3g{5TssugugvSMGG7Go z>(9eD9EhbPs~~d%eJ_oUKR3RD7sri8OLFF&$9>II7%~$b+J?-tp=y(P239)t^xb%^ ziTiRL6+X#7Qg)qxgc3^$xQSYdY;{csr+5|2^{X3U!`K)=0bU;+{A}O2H)o3gj#mL; zY(s8=SoH;@vz;j=#+T!&##ca>`%3xcXo6Ic42kWY%1>+-k(LFgH5qk8`SX#c7^DoE zjV_K!rngEx@ME!PXy3lhVyP0ofLCV8L#Mn4HT5Y>a<)@=3BDCFPtR?WNO8^KI92+J zD&0JeiZt&@nN;P`@84bPrXezX%BmtH4e{ob8t-cjvnK5M#GXy!T@S(>?lJEkO3EG) z?^205I@2%}gpZyFqyrzz^jACkQ;?~Wa%J{{I?s13HjOlc-zge%;;W?bZ#JJ{SsbIF7HqJ7 zL#y8B9k0*x(!FeyY{c4YUDmSpro%k4uWO&&@2D{aEsLO3K#@Ig}A_l@p?H{Z2? zpe4^!?`7;eZN8I12h;ETjEZ%pGtM_ZLeQu_Af-G#$y1Wi;4PH5pT5;)vu^uz`myu7 z0brBDUpEFmn85|5e+k{}Klatu`8qy3F4^1m$6gZiQZADxEC#2VcUNu+J?U{zfl~JC zFuqf8k7M`y%hvOv@r{N(_L=zdc1>K{s>8Lo1+GTRV*Zr<6ymxC#QYn{N7^j93(>LO%^FSF-GJHR9 ztY4LBFwV*^Jfu4aj(fwbDYm%tg{Hj{ntr=>B{JjNO#-|k$I=}gF|x|u#>!ruvPUrR zOfYA?Y2?B>?+vM_76h>`bzZ0baCZ%=rR zsisHPNeB&2?craiirhnapCZXHGiFZQK%v@9uxnz6n`nUwnS}Q@NriY!MDLy5OVJv6 zWKmF?gZ!ti_!--G^G~5~+;)6}lk_=^BYgR#+^;^=*+?#1x?pt=6OsQcLk2_v8I_tp z!VFtYH)=}!o)W#PzZEWdzKCn=>woHnQAsmNG5K?@@GRCP^C|Sg3?bRx&#b-~{ps{9 zpy;#n?vKZ<^?vG-onfZl_38^xE32v|6Yc0@Ws*;%sa5$|A86brsA$l5apSV}bRSB^LJkipuji{l|GdmW5 zB!gO*9w+}>QUpR`*GfN4z_RnR%ntvJ{Z$&(`ZBY08eAr7RQXx^@)ndytIzfJ*$b-g z=UVlgWYxu*Vt^cwU!>62l5&}bNr(7_0?3(1583YdBS-$mdZ6rn^kZSuGn8#-nyiPC zkQ|ar0@1nYI@!l^IEg21-?^uMnKIW;MQrjB_A4MxMml(1+W(+B;e|l`%I$Tlthhtt zI;RaKyWWBCoqvD*Si9vrc$Y8xNzFHX?dC$pR*tGJy)1HO?G-ikhsPn&6dU&__kJ5R zy}2XJHS-ISgSfu)=+1ksggGt?+U1G~k^{iswU&X`(xO3jEh=BP)a|~wXbSTQ&WW9_ zrxbk2S8pGg}{^N&Gxx)52sHfiOY=A;Ib;}66T}0l&XfXfIqJq*H{uW z%?xcGRm!%#Us*kDG9v0Ao*10F0YsCd`L}?*!YYv2U7Y0Q-gmN=w_AIR{$n4~gjlT( zmoFZWD$AA!-U5GPcXT@WixuK+mthu5dQom~Ivv%a5<7#=^6COa{Ha)EU9^uS7gI$M zlYTS{P*%Z=acj9EG6^61Ljc!le5d3-S97WoRnT8q2BEblD%^B{~`=KsR zu?^qlg)aERUu49=&&|8Sr*)sigxd$X`)Kn3LRF_g{n)AIDh_2`asDW;UhqEA`B&(p z*yJrM{>|Ke6Z?qu4Fk81@+3Q$6fk)$Iඬmpqi*w~fRK1dz=B{hxGgEH!U)}eP zRi_Gn%{Fh?T#OAw^0p={rsmtSHn>qdX}oMRdzY-9;iS1-FZbb-P_$;^ogv;P;Rdyl^?v-+bG}zUSf1|d6pDEL zMIF4BTfSJ5p$q0meXM)=t%MB*W2vb254HNvb?dFvbq9~I#ySo0v|5D&g)=b7{8 zvp-A2Xhp19tdC557Ve6Q^UIi0PSGpt4W&;mXe_JggOFu>Rv=;8((j6{x@j!V$=p6> zz0C=TNgKoseP|e4{^0w(l>$-Ies%Ga2CKmU#;+A-%44U<5$y4;y>b?(qte+ZVe+(d z%OD)>9pTmhSV&)*_)nfm*8I8nVmG@=)=j-rGQITZ-{>3}i*J)-IitR1e{E{4Y~vI# zvA#DaV!c@hCh>tw8%Yp)k5sMc_$bx$Qlli}w?om;XWK9mCSKOSsMv0rj(B3OnA*?y+bVKife2Q>iYI+XsF}5) zaSO{0+(=bLYuBG>T!d5U zM00W6p{!r!LnL|5cXR5sy!OevR(_xIOZFMY*ED#xcA8wVYn%YT1ut>_{2{>OoBvj4 zw`N6dOK)1JXyZlGh^<|hfkKqp-kS+&Hc)Ds+tXD{`n+0ehl#urs7j|GXp$K1t?%8nyHu$kC3@2EyyKBM#p&=BD3^Xmy!UUGz|A`f?Ft z&Ic=6uPLu|UJiOkl<2pOQFME`aYC=c{~7E0UZ0XapL0=|DKNvQUKmC7vriQwBi`i0 zZO0YyyHD0`ar^e?OU%5|Vk4Ra?Uo!W+ObIZ!HI~^ZF5>}z?!vz_QzIxslS049;JSB zeRBX6qNx1VB5JUsLdGi}T{zZrOAic?DLTrol76_UssKZDH`dcKe>6Dn{gj%P(RJ#w zHcqznu!SEooD@AdX{}Q7NyKi@!ECc?)vHE5!q=I z24?B;t7M{s5=3U~@UxFjO^6q>p5E9^4Ux2YK{IL_{3$ZrfH=i)u7?3+|2!-ecU$?$ z;pZ5QO9|%A9!uEI{TJsWZUpv>KSFu87#gEum9hc{7~z28;RYR9KlIw9`U1@Dc8%cATIUJ9n1JW;5)Vrrh8y;(oaSeGco=Hn6}~X< zcrznz7gUN&=`myq`tQEdikM*}Ha89&liZ#sbtBy!_>%H6h%E6_hjufpkVKZ~X&1?- zUSAM;%;>vDH{yebO#>yTxK+KbML9`M(5=0&Prb!59?}<7XC=x!E3s9gZ-kNjRpRDyQtPNWgOJ_8-kd?tX~gc>bLEFmv%GRX zBFmG%n%L{jxk2svQJuN9yCEnxd?W1rdF5>R_qhd%>o%k8ztvRD=82kI`hZ6@GD>W(MBkS$#+f{f0#Q-S_6w;($ zyKg$paw`bXp)7I*6}u2n;blUJvPNJ7G+_$N(>H-|jSD6XyZ!uXt4@s!D^rF(uN#Ib z+V5#kRa7A*COb-z|J_SB)1gP{u<^M5xM1z5_B~&Ch=Qe{#@pS_thkz+bGPa&^k4Yj zdTrEv8olco_Q9Zq=?fv?bk4Tw*`wtcHyMfICI_WH$TvyB4gCN~${uAq=E3(GmCz^B zf~#Dm=B&(-oCQWnA>CDS&V7^aqMzW4KlXRSs`?~;YPE1+MfW<+*Htv@Yyh}`J{mtc zueX0cIGfnuZz|5M|Be&^Eiz3gY?lkRzQzr9fljwcv^@ZO`5aLUHsuflf zQ4M^|>kj|3-plx%+0%^<>_$zWZ?LYYt}I^nPH-H}gEsy;yAH`M?{S*!iikzmZ{eKR zD}Wp;d2d9sp>AqDP~z|J3BJi52JZXyWBp|P^O4SpHWY0;YL4`oA72bNm%A-_wAB{r zjyNS0xTNltVtFZc`-Gp6ni@v?W45r~`C4+qTbVzpfc%$xyE1-+Z+d4$#tH~8HiNw& z&|dlbji0e^#U=PDC01_Rg%?+&-dF47v(nX;6(&Dt+!B3<_^f-vjaem~Zzz`QDW8(` zz$n(Lwx7JmJt$Jzd$>o+H(gUf`J{trmyM}~Uj*HJy0f41k61SnIrxU0=0NS)?8-RfLgwIF9# z`y)Q)yVK3)Nv4$0Hh??pp3Tb9hehEJ z%Rj<3AoKTq4R`(Bt2H*(^RV#;5A*a}9F&#~a0eP_JALghcC-t#ma?oZ8NhX_@1|~% zU?G0bMCY}S$pufGBogJ!qY)dHf4f}k76z(-T z3(hhy>G}kp;1|Sg2-;s@^4k}(WGA1i8FX!ZryCA!y%RO6u00;VbuFQJW+$l{QqR#X z%`38pfA5lxbmY!@iO6HHjheszR*#uOV$gSsS)WrvVW74)>`&q7&%scN@l)CTy?-~k(*@H^-PoPAfFQaIK<%}YFCO!x_ zAni<<{a)c29l$-~d#vzSzJlgfHnoTngCjNNLMEgt!_eUVrR&GYy(oe#2}a_63cWm}}ae;T`a5BH~2<-MSBgE9%T z)vvbM9|# zMZCP>O}b02Pl|)(w0-2V81gH4*I}N#jgC=pm$0>%j=c_Tgm2JW$^5a112dBRR)loC2 zn($Z_jc&cz@MUF4uY6;DWDyyowmI$GU>EVHabZ_Og}M1}AIos{WOfldx@Ot1^WaLM z!)E8ZHY#(yz-mW(rn;Q0t^MzDdzOsz-Fo+(dfQJVbBWEC=Jr=}7&q80LwjzSzP1zx z?elV(6#yV`ie#1gugIddJZYZLPPVu?afi&nFCOXZSt4_K^{>Cyy!Zs;8eZm9))EYl zYSp_SrVZFDwQKsw+o5SC$0csObD!$8knNlLE>E*{&Fg{@?s#JHhrt?F-J2ep)5hI* z)9I!1Y6Wv{s!G^0f1-!+23PK85yy;o2^@dlobTkpV_hWvnRjQBnkHSKqr@4X16H#= zmTn)&O@w8=aBvv-8T8&yzewVlU~SEEo_eo(@D5Z zoz|R8pOkxx<{HUl4b2*0q*%z=?T%yyfAWN^wX-@*J|~3JUWz|y9c)D#AgDcG(|CUa z54r3ZI*!(ivSOCd2B+wz9fh=LWweG@X0ro)EbQXP9-9-cAiWhHvlqnSu68jW-VgvmN-|ZU+=S?sb%HwgT?#ECq}l&dh8-(2wl- zzrVV9V30@IWVIh)@Xb7U<>9ITd;%DEwzr}P|4%Rf>qF$dtjYlV0{D>X3=a(b-vj*j zl_%v9)!F~i+i`#ovETnRyJ_#U`v30eNh5IV|7hPz{{J`sU*d{n{{NTm|54umFVqI; z<%>o3fdGDIvC*>?V48DSq@aM1hfH+JBzOqD84uD1OIksTSB)I(edVi03k5Is@i3-K zvTK;bgmKr^S>cV1>EjbSwk92r`d9`~$GpQu+A^??8SH92BI1$KJ@gfE#<)NHYgnWY zh=;+^yFkJ))Fmn3uWIAJeRla?R|{f9M!Bf>F1fGYl2^1J^?jShoJ~$zLbh}i+ODe| z#5V=yv2emAp^Y0s4)9$axNcVj$n*lQ)!_Z%yOD5D^mzw>m~_A_;_L0fmc?8A}La#n#Wu2Ef#@RIHED-jXfFa<|!Xe{=-q#BiIK2kw zRs}Wzq;S!PpDTo4H{ky)wrJ3Y@p{ibLmjYRIJ&>)!@q%_IG)3zq8KHEU`>b z*d*Xw9rqDL=p!JZ_b!(^5h={X;oBf=m;!Q_hp?H2JzH*H^zgYpuuRBj?)Zo#U=;|X zQ`KzCH?s-#J34Z?4yT-@ZkLw$ z6ewb{0pkuoYLn<7%o5I_a=6#fiL6Z?8t4+>vQG|Y0-Xa~oH^k12{V%+0Ei^r|3H?Y zgfBugt4TrHX#*7{7)B)qm_>&Z);m1)y1@7(!WM|INVw?G*dJc~Yg#i5YeMTP>|0)i zi2=x){x_KVBKg*N%lGZN5=^x z_15mL$CV)@sqh%h+OZ)c_XEL!*;T+5f?lAT6fU=~X0-^M(L*_=qf|XeK_5 zfavhLW+uQo#(jeRgUP5c!IZvITX!$()(yiukKb4UZ?qoCRTF?W$WlV}1w+TdXN(#z80X>G8#Tsz7yOUk zVFVmep&|vv+JDQhV%kADR}rFM9uzs22-UJBm$FaCzncxjQ_$-Ekm@87xQ`RU#ZhG4Lb7Q7Gd{Qrix;8GN~)iT{tL z_+Hm_T+GVjXb9belQRVzh%h-xxbDDL;H7_i;BGEhY15#QxH$e^LAb5}OB4R1u+-;L z=+usXhhB;yl3_{5GB~P^HQ>E%+(!(H4|ZyR_F{la${KQVNp-bNDQmL2sELkRMr55b zo2FsM$ZhF(BrcOLkC~y&7s&aJ$E8lksNgt8Z->WyKq9$z=Wtn|#UA{Anoi8*#kS%0 zU0m77;wj8i>q6sn==p*Bk-Jf>GVIU~cIQM`0DFkKleS3%h*-wlgpvcjdi2~3Ev4Jx zG5dGq&Z=s_dFU>{tib*f@BwCNEgR%;`^ti)!fYaW#Vv9vfV#b6c6r;3-sa%Q!UUS7$A;1`P!eZrOmn+5DF>*@w_3bP0(XnWta27$y30I-dx zxgL~ZKEY2ZoP+$XagYx9@vgpK=|(DM7GDQF+)cv9fltqF`XlsDHlP{c>lrJgCITYx z0U~f)KP3#NdV~+WndOPXA(|W?0PSp-R);eVeM3m2(i{7G74Xr74Ttm>oAF*Rp;xjT zsBkBU*pmomAg}!UUfEn4=r9;HE9sF?SYi95F-k_Q1Lr_ktgxYE9-=wDq=a+{p45#Y zeMmOvlTSycv(P;FFnkCTeD|ghcY??1<&8TbTuuIG4ZGXzW1vY*XLk%7%E)^t(M9v4 z_<03Pq)Vt&Ut}8e(_gq%<%*Et-F3_*0SASfVctS_1^uq=AZc*K{5gT!ao7dR4($i5 z+w8UYCLOPP!0#faE6@)+)_4EwsR{{u9oH4DkXx{Tbb6w!Nmm83!$>Vb$oY9l`@5%UHC=%>@Z9`b-m}y#L?P)ON ziO}Dsl7OOV2y2BtT~I85(AR#{_&#~GOlS5S!F(G1`Np7xT!_37M1996GFWPxmC1%1 zq{ey3Z8Hg8Urfk;9Wj`-mI#g*2V95XbK1+3$^D%W0O$$%#f>k)fh(Z+m-4!!Ulv1g zKEBb%RqMSY3fIy2JP>pme6FK=q_M9&zJGsSVLcknDGT@7nZ`RoF*gDr%xsJ-46+z! z8etkMnp%a};m{!fs_)+Az@;fd>%4L_iS(fMcGhN^)L{Bma|NbZoIEsX|0oN~Ll`LR zSaU!#rza)NFc}#O=|KBwuGsDWV=)ScJ`BS`#SGX+C5*!$=h!j@I zJ=2o`XIm~;>2g+cM+%mGwmTVo?4hvXdRh(=cR59Tl+3zR4LSu zLAH}JKw%Aprk~-^sT`}Kcm~-6;fg^w3r3jriATzHY+tficiu+bpa*n|*r#;5Eq9?z0|1l&CtT8O4FIVTyLlQ0dl}sM3Ud>FL}Kej0iXKHNVuJi*}GJ1QJnqwQZUk)$+Wfr>_+tyEZX!i^RYmiG(r z?VfNdF`$tIt*ztA`Jz95=SD*=fRa zY=i{)ni6B6lhS0KCVv4VP5{p{)2n9f8hKGmPsg(YuWnf8IW5yQ>V~aBO93ox6cI9l ztt++c<^oQ3*xIa%$(3Dc5?duGHkyEp`kLi1D}HHs5(qt^xsdZ~P<}V0U;a^|$bneU zsvnbQbEUy-WhB;VW+>1&avig-aZ?8Lh<5cqhQdyuZ*(}-Xb)QiwmYKZFrXlv6W$0N zGntD~CDc!pjBm(srNpQ|Wi`R#lFKomdKE`WxM2&nsG-Qza4T^7U3)ULTbMYk0>{P$eKG2Sfx zCe~Fotogew%YT?3M6vSA<3Kp^h9q4%$S=y$zYunzZ~LwxC-}2+ICzux0%`IRL9yP_ zGdzdYfKI|UnFrsp*-IpE9(lX;A)sdfociS5#(C_2*xq3ip&VsHo@SIeak$!xcx$GX z<@vXLBLr6oxG1Y2ZCba`HpuE3gZ~$lv+OdxctVAnFBly)*I?+PjtG8`eFgAvL=$lm zH9Fg8yh1wk&`6P%;D*9}^7Ur~Y~H~ojSY)}UI1=did^qV;|w}s(UINlUKXfcN-o$% z^U8h3{Y^L2(teD%JNZ5(7<4glt^r;{(o~hFSxRUa@SHWU75vvUSuVGkv-Tgq<7<^% zD?T6TUJ-|!h=Wn$kiG<|llo|$TN0jUO=*?~a?OdJk9yAsaN+P!IM`H*a?*=%Pe=Q1Uczdb0+NETiv*|qzEUIaJJ>U1q9hYnzN{Zq3az;1%HKZ zjl&{;gnB%+t}y7dw~MDd^Dq_~wog5F`8n z5X2=7uCQ8y!r_;fR9wa=mGrsIT^hlA7Y@lp(Cr(7biJH(Ns4dGIRtLOQI}Xb0OH}v zuh`bZ)m@o0^;JZTLfD$!!G8SSN_Icci!cJelEJ*@HdBFmb@jx8kW&$ZgCP&0e@@nFHHo;fGDcK9W#xjK;1c4$jZzPvOG8xK8wMPlpf z8H=1~tPE(AKR12vf{X8fZ(m;d*=9u>R6Sp%kn@By&X&0hIc3%|L@dri4ri}l_PXUM z-)miN2b16I7LX3Ieig^(ZRs?orkq#H?Ta2Ve^}1~hlRabzI%-{9?_^(4sid_ke#J) z`4tTnkCs*4v^y7ky5dHK$m|wx-Hr*7#E#3@C~sJ1Ru??59r7#;9!4(u+s$y#(3SHz z&)bAaH3UX~u7Xt}ZX=!{*+*M9ujk<}Z%3Caj4?VBdK8eL^e4Bl{~==gNDJK8p zpUqnvUW%d5ol|!0`)?2pY@Uh?(u4kU5;SJ^$P3-palSAuY zDiy0gs$4XGGY;4+7~&X3WUnInhL5h@*WWtTD583{9|Qf^Gry09p1ONcGN6*0nC!Q~$;y8WnW zy`WnoQ3~uBzm7s>08jqA)Aqo7Eqs?l?437b{DR`to4N2UZDk^rRcE zbHPbcUp&%T|4L1dT3pfdqc}dLr9M@R^7^NxXeJuq0K0e$@CtxQ*92-j1T@WU>Bi4> z9tnzg>J3n`n^y>aIT;>ife$4hQm@qb1pR`D70zrr$ifna1=G^~4u~!)I~*dsya&8H zlMhaZ_%l^%OxBuTl$#Av-jOiEv_c2CtDM@LGjM~1(+=6GRn$3c)TLoy*sk}eiA&#& zZ(q4^d#qa?4nUbfB7kM2`+`l&m}{#)78z@z3!7g%GCh9|s{>LBb+Eh8>#QT6XH~9I zwB%;pu*8t3y>7O*ZY-MmHz0w?_VfH0DmGo+CCCONc=Z+^H<|ixyQ!(X`G{TpiBvyQ zKGSw+0Eb_X^qNHjdVBQx!XF=z&)(>Ly~3YuPJx~qst-S-rB;+}P0j_}fRHZS9V*l4 zaXMCk%{q&R#8s%4|6vAu`VK&Yh=rPx`!SkU3;=;4+@H7hY)g&s+LTq(H5V<+`rq7t zRDq)`hpzq(0#*!+4B4y(vJO5!u6~e&-vx1b-5phZColOW=2G>F`7VQ${n6%j^ZiQy zs-n|h5U6xlZfgVhHpp4G72sE&f_I9abAUx)&h3O56zqjCh?HUeEUi|1drFB%w#^sA zOvYw?N@$6b86Kw^Vc!QpAV2~`3Y_x@OOsNw#UPksJTlX(W4AbYNug*|)6h%b1JM4! z3#8-5QWs?;u9W>sd3=4mg{ao+yVl9?FsbTM=F@I{OzVDUynsDJbh!+IL`24us7hgA z8?itox60k(Kyr7%fc~UWtsFZFOjd?oWZ^7tA|A_-2KcaFJ|TMjrcU0Ia)$s^P#Nfe z$gBt93zx0gU5}odv%T>_w_3__Fo-KVW4`ew`%Eud|LA?#ol37|AVd~zoM9f>_)k>O zb8jHnfn0Ft;wB{xKF#fAp1~2dPq`vUvhtM*;ySt}Z3zL-ep|PcC**?9!e{y(5JBk! zGa3RIAKE%rm<_f5Uxa;USW`jQExk*E2mwK=0ut#;?}$i|BGROTfJm3#LI)>*S=_7=R|r1C$G;rnPsu}_+_ zccnJ*g^Vi9;u#Hou9r$|w@m<%vu% z#@uPCVT0>wL1jJix;9`PbY)F_D-EO681p<*KZhU>%${AgW=kn`-x^r~>GzHI=G$+E|*acWZAN&Rj%-)Mv$wcZ^+6s}~@a(sp!u-8vC=v_uB z(JjEl2F<&uB^^7Q@S|k>A*8)y(}}?ud*_?(F=$ha-kr`C+DCh_E1@1!u9HpMQ779; zI=Y1+6*Hsu$E1=9oK&dq-Td(BdUXZo?6lq%8GQR(_= z`B_zvAL7-z4?addP^_-=1v)C=n9sxLYzK>F*RmKk$R8Q^Z3)#tc69)M<<{Sl@QPP(D9q8hB;`5m3Az2bKq8G(Co zp7l$A`;J5&I2ndiUNB}Cx-Lq>jc7+tG3?2R5KdcKhdx_u1XRwcEN_N1@218aD?hAnX0U2EZFWU^pK~ ziwYjPms7+<7$AwNV9?~P!H_aKX}I+GA~=r82_1o^+vKs8alX^t+EqL2>l70D6w7ru zE|#l2P?5#gE5>(C;hYUZM?Yq1IjsI+;xvrAcDDE!EanI*o{?t4@Noj$2%S zM)(reg)PqXolV8RM9HvVoiywsD`b>jSblaQ_kdvyzQ6VOYV?Iud-6E7&c;R2pWeZ( z0&?lQn{C1_X`AYSO&sIw>v+TL;hIHmw+Z0s)gYu8U)rR~Ty;)&(QSviu7-X6JgwfK#}BJWA4QRc!rbv3gBVbs z&z%XE$)jE8Hmep3C(NQ@@DKx1tX=v@OJG&#|UoLMoE4ZA9A(59O+VC4nAOMOj7bZMelhFNOQfy|@}uCwJ`Q-hQe zyGqILaj2kT*q&=|F8o@>zw$^>U18=zu;`sWweP8cQL@gz6(8 zG>OEZAB6sv5YLbF{&!h%LWQJqwR0b&3E@1x!{kgq7kP6K0vgmiHjIY42EJlK z86h`5(Qkh_)l(N}&KVzSChoH2q#oJ{?kX^Sy6$H@54{iFgqAVyCdxGucljj*eNiT0 zEt{)Q_k^2l9$fP)U-%_`mkQk9vFY664#V6yFxKrXl1!?(oeNXRUj7*8enxcVV@9N3 zZmk2rt>4xw7po!s$zreDoDvitKH2-|5${yfv|IYtD>Hdj3ZUVDf;!Z;i~dps=pcMcnKaGd7#bt&5| zCJy|ZE^o#WnOP?99u)c)ScXZJvAR8FdwMT}|Lu&~*Hm>&E^&KpN=PAXlm*qbG z&QO;;?OOdHfgY;L3Ef(AOBrZW57H@m!x`RTqM^j}#j}{WYHNm-nb|9D8|*qijgeXLkyI1=rA_t?Z!|*o8h5kGFe+Md3nVj_O7UE{{xnAK z*w3mziFA?&0|#bj=hk4{4-(ExDonc%5s$mkLv>2q(~=r8@*_iJ@=|^@app*9{0BURRPlkzS#z08`$$*YpN{<&>wS- zLOHkn>m_y=NDN4PB;O51Qu|759r-+M$YTl3+P(cVi}XVbsi(G@&T<$yAVzM^oB-x0 zHV6XGOONjnCUh3$l;=&*MaLptsh+BxN1bm*Fz@&)C6*@Io=xmMu*3(|osySfh#dT< z8|EfTiY)g3#;`!~_`tI|k;H*^qlgD5u*)Ig;^3%@_aAea(0~M&iBW%KCd zMvZv~1GITYQMrJ=}6g_p3_rHE1<1nxi&!h&iqcsHe9aRUfch$QqT%xd`?)47BoIQrC)2 z#6YNPK1TUxHX0VtHC{)M8f+Ig zN>sc51m(^jbXjDJ)n>x!?-&EeCj;hiyn^mLG(*v33YtT^w~gJsHgj zeXk=$4dE+3NsdJ}G~45OI?rV+b%Ii&7#g zApIu7*~<6jA-LtHwpOysXL3IlHFpkjBDXw5j&mG=Ce1PWN1p?9Kan%_?}eF9jV*?y za~afI&vbxty?^NPk>Fx-0V%@rP5yT~ayaRxRgQQLam22vqh8YrfYm>WJtiSInx>A= z=xjXRH%2RA2JGenmQrN?!aI91%7vrZeZA#i3Xzg?zn8Pj*0y51xLMQPjul6krW&TB z=B+f7G3Cw#R7{f#2Nt0^n!LG9bdm}0On1!Nc9`EwXXK5e0j~tGiE4QSA!n7x1fk$ja14`c3=mC2^S|Jou+OUMJlwdQNl%@s(yGGt&aIe&7?x$HXA&qGhf9y7m2=B!93u{=0G%(XrbNBosA=*m+^smyUa!X#6` zy_Pw==K!pA5rUO8w7kMzTb_%G2B>p6GrT>$gs+}iz!BsEq;-J1!SLH-q<>DRcKtPl zyUW=csIw`J0{%AGtSW2L1pE&3=xK-O+{KgOBe4l@bqUq%>)%C=-UEk%4b+mpO^+tF z;?V$wM4;3%gkU3$eEv2DUlKNN`nV#bL(~afp9@{(#8exjG~MdQR5ws?AsBDtO5IL=z9S(+R973Sp(}W_< z-ywx8w9c2GfL}k+&EFaZyQwCgKeMw-{pE4#p%9QaD0Y=4WSWRQff24KhpuRVg>idE zpra)FRSsS`YjxO5!(=?QY$KwFd|6*=3rEkK%kf-0-?_h)&WmlU+NI1CYyamK6ob#- z3!h(99VQiBq^u4bKxua|CK=KfAP{Gs~EHeIe zix_QNNUFHB@y<`4w~iQYiV)r%3&PardWJ8xP=1>D7xq+UPNsbJ`?M#jt$*>K!*~>R zdxFRltbF6s3a=~a-g*#%E6=LMF4HPGPPAxs#dmBrsPcl9BS;VFC%nQ#RjxO6jJmzTSwhQl!G7tY$Hwf~BAoUCVZ(v)hv-iU+%08ao zCdKlamTyh}%u_|C5_nBG0H~khv*U|DO8eUGcvxjI8?fjgqZI-~JiKHS2w~jeWZnp> z*;(yk4{fyq#~0lv(i~1P9GA*GwI&ah+O1;>m7iQWknJMl1_=~NEK*ddF`a&8GLIlu z`xpg%7w%{ zVg|1Z;dOF{?~>ZHr^jC+K0lqcx++>IPHCBZntIa=WRpD6xHP({DgTMm;WIooB6d0c zNf6o&Idmlb6^&1b433g)z&$^%y2wH)GW;ypmibM6uGl`4LXr|wl86hgkAs{QWGKrs ztimOMneU zlWI@M-GWQm^IzeqwM`^*cH0G`8Hz|x4hPQDYpvRgg%5<=S!z|T+t3sfpPlZl=j0Wa z&GkkhK3!&`JrI&_dligSk-*7K^n;-Gd`u~4f`o5@SB_(~`j^xY@`(MmSsdfaD^yj+JHd4+;-XL#?7w{=H(?v~Kz;jCpIX0jAks=zE)OO+W#s zx#H2MS}VEfFxhnI=&a%aqPT>*_eL^jIIj5`AsVQ)0w?@E0>-KCuq(fMIxkg1hnhn) z?1M>TaZ33Hs8{u_m&bF`XHevd^TwMYZFWl?{?wYJpX3)tgVDKIEr zD55&#ddJk1=xk93WFOr~Vu{)7jC@$Rqoi2gpRj3Bgz=E@5F(mZS7!d(*CrIvAe%P2 z#mFnFU%xP<@>hMcOS)ZxCoXHF5zfX;oF*fyiY|bBj63ZJo*XVcx}hm{{nX0P?Fg9Q z%QJ(R59R|LN&~k1#47>EYs1n7^= zlb-#8QPj&Qoxs<&QeB z@Bex8i7`L!`@9NMq2|}0QShM9-+yB%Z>CBSA{9L85wC%I_Z_n9#F+qe?@O4ee=oZ* z63V$7t}|{UeVUfuMw%gx3==1KN~EiM1KcFB$(q#59Cp+G*;F7kDLvQuhM`m#rh5-g z5G-9b?e`(n@1T(9fM6=r?B&8nOpPV@KE^VsO1ZUQTp8bXi{=|NvpT?4$MiANNtkm8 zGl%;1=cFfAqajI>XFW)hg$ldV-wb$+x34+f7gI>VYf$y-?!Jh3#c}R)b$m&v$pzH-C@+;FAJ~)UBC7!@ z5`y;3sf}G(b=teQLQC`5*c!l64*mIysccD^+SZ&ZsFf?)zgJa~5EKL@syP`}F?RsH zpYb3GnQ@d3dlSGSx!Y>?B!$1p?iE7?dFA36!X0WCw^!USkxyzm{Wr5E|E3g*U43OA zjz$e<_9Q3k*e;DpeqliUIjocPNM9~>g)1$NE;<=CaF?I8MKEQHWk1B#s@|cg~ zMLgx2KIT80w|L!J5LfFSU8ie+=MXNfv}|dW)1<#rBB|XF?P4@ZjY@&+q?DRgwwkR{ za)3~Y=u&SVO8=?=ulOYA;U5}hV)%@$KB8_Z@t(0t48D_31a=i$ML%Cjh2uvQl^wfM ziCc8#wkEu4BjX?^`k?DKXZNb8J9=C{1n-fH2sPj8uT^?F@B&$a+w5bNoAVYvF_BS8aW!n=A6Oct0&8ZAqe$# zws!ydb%2gLoZN5^i{N-!lid=m9{@QceOSgM-dy}VLq-Y0d6}kWm;Wpm^1c0eSuQ>B zL7u4uGz^lmpWUo3Xd{Vhn4fh|n&)tDr+)1@Gp0UF`kHzND*d}CL9k4?86o{fY|5jw zU7J_ur$7BDr^AB7l)AFS@!8q=i=rt-3{WqJ_gzd_+08^(z&X`ax3_7y|9g*Vr$)-Z$x&mAi5dTSr*o|c$sK2Cy#_QLSMhr`c)G4yp^{AkmmtdHbe7Qq z{h6Qjd9VnJX?pxKnAizkebjbWh2wzzgU&VFJc$Z`-*OM-%r?zmq9jiL03KAXZh*fNIz_COKh2O9wN(eu z=Eh*_wp3?ta|rcRsqIYDGdy9DK4jzLZQU1a4|d~pLh{=XkxyDr7+i>h|J`n5?~(Z} zrERET48$=rJ2tHnJw4kZODbY;YO7A$2gE*-5dMkm{YpLN z7VxX_D<-|)l?u*n1v%UPWo;2HhQQu`^bHQd4|2XXXD=)^l);t`2F3tCW8YRhy_PTh zmskIF#6=7+=E!f)aQXd?&)r49-6|{yAFVEnMD#-5tT&T5obh@#N5T7B+Yzlu2JFi+ zRt$f8c$D1Orih%StIc+O6?ofuhwfZ`vAPBIcS&jrY9!ROWVFhO!cJUKVkOZQ<{YdgCpn zNyx7#lgBc5$IN#EM&5suX!FO!-th6~kawSEV%Q`>(F%PKW8@*CtJzs;&3-lAuHu)A z49SG7Pd1iFq#y<`F*t6*q z*p{KNhAGNPux+@oM*H5MyW_86hZPdm+v{2;y!EYSC1n+=E4Ik#>*&BM3NIq2rq{3zb3 z=Kp)QK0e6tQ6BSkp3l#f&fC4tab?_e8jsLr8_9KgahrNfg7i*;ZiRfU`??(#^CRZ@ zC6B*qFgm)I8P*HAYHwxEWlaRW3-ovR8)`4Xs%Qs`o3m)fb>b*3(^|K~r>uC#jFN-$WRtCSZbJp8rd}d`l z>E*srzvw;CF^ES+=B(GWnZ1$*$FzPe>xSL^G(UrYvs&jl-@AJVnrEtTC6rFTfzJ#j zPPCZ_f4%s?;@_*|@Tu|mpy6&mx#OOeUfDrKdGJ}*LCq4ul(sFjq0W}+;yd?Y!c*{# zj-fYawHie$B)8o?h#Wi=F{h7Isd)c3b@_s>0!Qg&N_V$c2rFY zR13KsjJp|JotD8&yWfVHUWR?z9;x8k*_PA~f?+BSuPc1UsCPXYTNf`;l%Xgcy@EOR zTp^ZKN1DHsn|c^YMrBTGV8{HJ<4+oQ@eN`>7;!Osf-q6*8{G-|w%0ON@}kU_LCm5H zSL2?4%r2eoP)?CH(t+9b2F^2(J{rA`@m5J8Hz)kWE&+oPeqYvZW&<#@$Eb&zdZGS@ zzRSLsU*axF+EHJLWxOrPoXGW)ZT7j?Pl6ey)Y?M3%9RhqHM1-Ik#;(Nevb*Jl8{6+ z95WprGYx|)Gue>X&~jIC4ZHKO#md(o^IfzqV-od<_Vn6!bxI>TI-aioyCB(jZTTQS z)=#SiT zt&qb`nSJ2} z!)MBEOQ3|ac>5Q5`V>{ad8WF~O_JbK=%9VL2YY1uB(4cLl6vzk;QDWCC%U!l-c<57 zXEZoE==VrzM+@`7d`Cg2 zO(`r2G-&bq8|z4O*%0))|4v<)CH0wl-D1032Jdp*jOR{xc)@%LBaXF_U)1C*+r4}z zYv?_sY9i?OR}b=I{HZCyC-|dykk_Bu>>up@>p%GXcZRDQh7V#r+X~?PWK!q79(0@7 z1>oA<7*TqBT>+<}O$wK1{TZ#jnbfn@#7u6=qg+~*O1zx|&MQY*=~1;Hf>i7tAJadr zZ-Ok{)d`CJb*~nu_n4iDkl$rQKodv2n45?A`8xC6Wp&7yInGsNonU<+3p2etHw7?XxG;-I9=OCYWMiqgL1=^=QV3gJgh<=!JwuLw zH4cD=&s4(mV&3(uiGU6!Nh`c<&KWD)%h;r=83fa5dsi`CH7P#xo@F zx<}@w=V93<3siDfEAD%S73iMYHZ!`KSwiwOZ6dMi#g?n|mg@uJ#-HZd{W_YIMqIeJ z&0pm8^@*%Bm~R5^4)1mt8|$rNZ`gs8$=m1=S^W?8=54&IKj-4spE+a-#EH^bZcc7V zpKHswU;bjoXvF{$*&VExW}A=l#vwNY0e<^iQYog8=4&ond46{0Xfd5vo~?+*y6q|o z0-NsgTh*+|Wjek2b@H;4whXaQa@^q!TMb|Mlwe+#^cqzhoypzxtdp-mLyB{rY-?Hb z7h*zN@%~8Zt zazNQ8@&5wmUa!w*jPPzPe$flxyv}3n9z1+p>YgqCrL7ozipqV1KR8r$^k%>fpP+9u zJlU`xwK(^#u#qKOobsLzO>ZmpC-=e#b$m4@H8xkd=koTc79d2Fs=E(FqPE<^;QGalB}b_aLf}z6bD~>j`JR>0(Yq zh|w^0-?Ng>5};>$P%~`ee6juyCecWD6IfyShuggxU#x9u%>R0Dkmx1w$AKY z0j2RIx`n`xu{%8isx&=iP?j=3MNy@Gr97p&M1wzpIu^et$uZfoze&wrRE;M89>~!b8RwSOfr-GP5L~mX%Y29 z%*aOYFf}!VXW z+-Mqg-OwR&FoYQkT4fg2nJy+}<-F=YHO*ReCA|QN6#m89tN(L@V_8lxGaFy^0b)rE1wsSaQcXn-@_zR+<;kHOxORn)9SuqLTe|o`@Rs z>QmI~DrNe6{%>FDFg|#M5ShwP4!>txHtX(U4qJ?fyWNiall6EX__~AvzV&l*scDX< z$@!=8cwRuwcY~Wr04DzA^(_z&cv}Y5-(GQKL2j#dY^eV3Y(9FbAExwiy?gDQOU?Q- zcjtMll$h=($VmPs+1yIk#;-?IJL>l71vRLbK2s!TL?f5tlEi%%-u8nKEeYkGk4eNl&7k13*!*!&G+)c}*kU@^3t5DZbnc4ECvF23xE+wTUK{p7G!kfLlFv+7XW5y;Ixzc$c?i|#z zFCXRi&QNisG^$|OwA^nkM_@H;`6_EBd63=vuezK}gWur=JUx*5y z1DPV4O@oVI^gpynQxzHSw%sz1GwxiYLBFtW)!xBFa=OqrriJbN95|lGuP=<~ek|?M zv-UHD9wJdphck@wQq$Ih_}*Q7=F=VIyg&6~_KJe9xSxBTz4kR0o$1(aVc{xv+HK(l z8Vs%kCtZct635kpD6Gic)aks;IFC` zB&2vo;!8q!I<7!$*!bTj{qHUbScyXNMZC~9@}+ZrEvhUMDh(X>ONx`6nzx&h z*0Jg`>oZ&E!O_8&scH|t1oO!H45^k=3eK}dSKzItDSKs`5DB9OQ_Lc8rU7$x{?%3IK9YT`vcC{@~%3 z@|Joa0+NF!RS_K0D-|T3BR;G2srCk8gt}~0kGIZ8Bk4eFgn%F4Y#!jbc9pKSRpd7K zPf~i|A5Y%~3J3AWYHG1e=6UH;TrT+ht({<=c;hT5*O}SV$8Zi)@Q^jl^Fw0?cN06f z2R=0QN?y{pnxJU%5rX1j5I7}}<;}vWw2HyZqsJ@Vi9SU!XP(t0MU~XoY?dkxRu<1p z8fwIC_%?wZ4@MVMZ=|4^LO-WP0+aS1W@r!>rU|Z4k~n)NNTd+DD`szMay(;uV85y_ zygUivKOBjR%9u`5a@`f>B>X4~EJh?yEVy~)vRaBn;KuY%MB*Cx?EFY~){`5skumS$ z`30$htJ3Mu=ZG*@dEh-tiU6gYO@=UK76 zfAOtG9>0u3n#jd*20!={9}C_w%RARq7&k{*z@@oPrcUa8ve`EqMs2?iHu1T))c8Y5 zLk(A1_!FyeB)4bDFG#5C^9Oizm}Ct(tI9*9(taZtck@vPxaa&i`<~j;g|(=l&&NG` zd8yA0TryJbOk~kzI*(lj8afsY8$#gUKa_WWetVq!HhcbmA7lgj1wCcyXDyf}!|nV8Y(%!8IAbh>8z#Z`b1M;FTvN{s=)wBR zh9dD617?O*@GA9Oae6Nn2TuG&!R_t(7HthWr-2e~@=@J;ZS7+2b!wM=P^Q55dVeSe z_lUgqxfwaK?q3EvS6e!NcoBhovfxpKtXe~TSh{W++rU-BDPxRM{RPu>d9%c@qwG8^wC;3PX;SGdL9~4pVtjHZY=VY#Rj)rXk5Dp_eoh)gzfakEd^(P!_tX zn8mB98EC5hHy}tm>LbMfeNY1NDhRIsz2Vba{I9&TpH=9Q%c%)?R@$x7It+|haP zr1g=_kdT$BLr8>0^PmwSCbK0&Vex#O7m@j~b!0cYrebEj)YnX{xK+PCUdvrRb3cY? z*CEMS^q&hI991=X8JN&j?gdFTxW6+|2PMjNt`HfGvb^In9L$qM3y<71Rdkd^@3D4i zKLw{wkBEU~@$m`tjtPB6ljR~R4cB2f^@}Urg+|nqCHp`Ls=4G}8b4t;EeW`%YAJn! ztIc!D2GCQ}XCr`}S6&}&p&4CTUl6!L%ZMyT*(tCeI-CzsGDJG>l6^k{z{$=~>KmCfSIZPTZ&Hxg}EX>`H5uZ{+uXRQfg6eb`IK~k5r2Biq zpQ{nKwb4GOB<4q&I!Oq|YbHZe;UBs+#}iA&X5CA?%dKMo7Nf)}BIsMTDlNx4go@H# zE?hF;_gKsGGf->bopzt&fWg#n@~A|#$KRIGY~j|7mcvFmehz-&2S#&~%v2<{BkmV8 zxIUcg114jv5>{C(KHPcFc4=~CuYM~oGoI*z_o|E;h~T<0e4G+8>6jid9$AHeA5D%w zLcabCxV#tSEJ2s3!eaX3a$N7o=g&NnaHFKcCuk-qtJk}9c+IWan5p{EDJvyjE}Q

Va%k29$Be>mQ^wk`~i+eAoX4Au(G|zrrws?c>C)2HYSh}2-#OlXNvH6p{yK4FV zaxEs<>KK{YBus@H0AzDR_95SJ)P3qn-0^UK<$Z#qIpK(&5ZwJEhKxmAELa(EP>iFQ z02VdyIOi6XYMrn~_9~Uv9eZpaIFaig2xzaxJQY7JO8`3VifeqQs5!c>p1sHPLoO8xFx1H;|xi5dZSlMDL`a~f}htd#r%?~bB=p*3sPf(Dc( zXJL6I^=_1e^d2_1d!xTuHmIKn)x$TUP&wBr6Yy%&P4*G$ZxAF&Q*G%Jn03EU?V3Dt zvCdp{203RxjuloPJ|N15FdujT2&Y)DXYiIVO;Af{dYgd6j2^zP4oN-z7U;(UN|l$fxkzZ+<0f{$uUk);-n)9SO53%Nb(a z%IwR{)f^qqx9T*$I?{E@x?La98&pBfo$kZgb0#o2Phn6CVZ&$5tvxv5RT&TSIquhg zSo&ziO6o&DAqhx1R0@>;wbqn$%fqRC0Fq=uNP+tm5_JbRomiT?|1(9-L`JKB zj+(6*SBxmdL>1kyh~3-sYP*gZa>!!A^);Zi!83_^DV@?4I*QzA;Tcj8D0G+BvK$Xd zz?j7{jH;i@zPjFh@qwgJt)Wffp}z5&j$u)&-$lOPwMT>uhl_3{Rk|G*CqV|R$?2Ps zaI&*pFq&{!*02=MOOOOF7^O`b?s2@H5CpQ#bB-Gd;B+;GZcA78A_B7F8|~s9ITmyx zhdOp~@Ag&syzaqEY5WP&JC+ZK8vg!Hp$L+oB5@!D=%4#qD?7DMJZkEhB4>A{i{J_g zZZLJPUGAU1pYLsR(Q+IiEZvE~-6&%U3~ymcoAsB35s1LJYE%;`%|{8{$!)1;~`O7 zNTN<`b6~d^H8;NGzK%gAX)2>W?w(UEt}W-``I?_urwfvBU+~TRQRRgp5Bw$^3DAR98I?~U!b9%sYF2> z%H+uOxa$X!M=#UOu=t%G+IITB<=UBC{&~XA9+s4?R#RaqZG3*@OauOd6=n5?#dn9j z?o&l5edM|1rvgu%o_+sw4ICem^_d61KSaEmQ{*CA3R0IkLlXJtyqcN}h%Sj}=re}HTWB&wPBN{smRRgx0c>0HXI>* z4DLJuiz@}b3M6ETHmq;-q-jOs|9<3v^U>z_d5up$Gf1m5h7f~DJFWV{; zNn>M2KPcL~5{1ql!2WTde3DudX2S|veg9^epiF+vZ7TIW@>fOor@BGeDzfG;uKrO9 zNg#0!{D=6$34jEivH-X1cJ3%4!X2wS=E@J2`K)6U*KN|}OMp>u$Dl+AUE~A@Xn*2K z++~kUBl~>oNaUgsi3ANl?w_8}eW!9ADP23&6`8C|`>U1Y*}3D$7rVFtby9E^he~P3 zo|nUqB~5h@iTBxd*8wCZZEI1tvaRKH>{UmfU_Kg>4#6`G@Bc11+!+vpm`F6wD;yd+ zS+)~m)BOy}Hx<|k%P?)NDIH1%1zt(?$1KsOn%1NoXG&-19H54eN8@HU&T`5vq!I0V z69KoUI<%bRmWmEy7C&;@p)du++?ZV8o{XEKIIyj(^7|_|iBrn<0PW2g!1SQVCE4%o z9pQO5nIIIWW}O<7G^e}0;(Pk-6; z-Fj_(u^dWS%}s8!=;}*|TVNJwAzza8oZ|rpPltS%h2~%FHjExZ{mH(JLe*1qx~}h1 zX>F}(jU4>*C%aFWUa#(^blFu7uc^UUdPA`~)R%oPyIK0o-l1{mFVl*5OWX(mp^ZKu z{sh`GL$%=-0;j9w1V{IE)t^8YW?Jj_zB&;>Xe2iR?w|rfNF8pXD|%LcsxR+<%(Os{SOAS`9^#`^wQn znf@*406K9&?Mf9mICp2tFXi6hF@syw&M@U_1dRidn*!vGx6SQF?){G^xbbhz46=0K zjR=#Vz^^7>(d2#e8iY0Yf~;CQ-YPQsL0Xp-1VI#60=?zdb!J0>Knw zd9$b-1pth*@{w3>wB8AFURicJo&yMohaUx%f+Wp4V`>w@=U;OTKriZWhuiv@3FP4K zrP`XGsh{+!ya)~;g+^18jBeETQyf^ZB$jjAjG||o950SmT2L(rX&505Xz&bqE46nf zwcCt+b9jCf?^ga>kmziJ|L952Vk~*9Ip_K_?~VLSVMGe4Z`xDp21^`E2JdzCshXDj zd(K-8IhIr{PlezQKn(U#r4mm$5$a=0E-P{=y&oSTPX_;9&`~lj-8@P}KjIij7v0I+ zBZy!^S-Gf2&fKe5N{jwD3N2+xHP^7w_k1x?PPbOu_H(sSwMmKtl6VTpsiXka?22Bdy+IY*&`VgZQTGgEH?N$zv6PPfsh~Mc zU=Ue=(Ut37wi~PL%q|U>pW=w3H}Tv^6L0v7DBUI1yJ87l68+!m~#m-QCh6ns(B~Y(9-jbsmyP06ToCW2M`-cDFZX z<|fIxq>{Alffl>OuJoxqbh*Im6%RTW+jddZdt@LfTmvarrexS~mMBnAgj|pMy7ch9mihOOYmr{$nX6#!{+|eD`4&X;9>K zzNzk_Hg9NSg?%wrxOJrA4Yg=RkzoPR_Qgh6OJ3~9sL`iMpoNJo;Po?Wd(*YOx@bj2 zeNloHr{z#4H}!Cwuv*$miiC<0-DJbyKnpoeckceqz?n|}Q#jC+A9|G}+>wI(y&p@h zwDg=20>ftBS|%XaP6!Jh3mjyL$)=2bFY%I@eI+(GP<|qOPDM^@~3ICGP zG5Afi?4DD%B%r8(`OK2!Sktk$IitakdpHAeLh_X)Vxil*QxM}+6yIM8Dt2?6+PW6Z zw;w+fRejIpIrjz3fcB7%luDOR(R=tCS=**0zV7$m4+_!GSn)9tz(=Zc)zLAt(|aDV2W*DGOb z=0KM24&m(YO8l!1poNZ*%A4UzBXm`sKoK>Z+t*;;a3t$~1MN)8xmOm*S0_eb(`W#% zPRzz^f<7|_Tra8F6Db5(Kk}*ZaRMK5RkR29?-K*lsS@W;M-f!JszDn5yV~cFPnFUP zmX2gtsnr$%NvhgDEPJ%}&6iiNITi^IsjUFdo$k*aAc6gv>YENpjrfu$-{O9^miia< zV%0TW0IGCXA`^5E(#nLP&n{qG*egcMn4rqvvQ>|n-u357z45{eTsT)H^8NYymzL3D zdPjz$|B;1Z)mxomJ^$5v8C(26lwYYry%|eq93?(1PMxqGXp*q>er?K8w(AmWjJ#8{ zfDJoV3O3JqMEgx=7b}8btZ3eR*lzWKMk$Wz(PBZ)G@?M5DjMi<)bnfq9+pYO3YUIl zpA~XqwO9{VuWDt`wF7m>;W6#^^QlrRTmKJxXBE|E_eS{^4enMPic68=4#mB=Ln&6= zp*RF7P@u(&yF0}_xI>}11b6oWoj2b%cKx4OGi%M78*W0f@}84p&;IRwPFkR?9fz%9 zFkbf41Pp=u_v4YN(w||<&lxEo?HJ5N8DHf>!~OTd!vIEWBDt&k@MMRI?2@Mm21g}H zuAxn}i6}*`}eD#~1@C;cnvmDz#$cCkj&_PVSN(1apWSDXWigK6wzR>9dp;=ThytLmtJZ+x$Az~13P%Mz3wUYBWW%ZBBJ;M3OSZFU2M zOJ!4nj5{xrYQ(%Wdf)X3z~NLC@N}5$e>G^|M_jj71JG}xn-*_;7S3n^s0gC^G^2_k z258{|!ne&63WWj)Ky~x;H6&qLy7#&?tta|bBUG6p&pFNy0lDdsvtHWM*>j4 zx{14y&c_j`PsgrLy%F5YO~5A7f5wz`!2}8S9So0#V{Pm@_3Zp(v;CQ`ZG)g{@?5B6 zQ^;+3Wa(;T{r6J{<)i8T!ic>?3&2Y?lK2CCU=mqne_?Y*0c+TWE}*!O#qTWnN0<)> zTek#)-oK#RJl~9+H zWEf35$>9cbq{74aI?lgB2y_ff7;!E31S zb>4ao$mb5pyX}d0Q_4EXa;?%LM+-I8_VYH<8>Lp}xyj)r zLDo(@bXbZ6U|E!LftNpqz;hDk`M2B2CY63}%gkFC$N*0Ax8TWBSWXLG6z?V8FWG=A zS*!`4)yu2JLYM}goTbxok@(pmW)*S+za0NxOuVIHdNSX0< zDHPC@Zt?qJ`Vq$IedcNN)iKIacfQ2p-@Vvp>pK7-IZKpuYo=ubP`<2IX@0tsrIiy8 z2#~d4mk5E8EiADKSl*BIs(lx5^(VMwu98vg;{a$R7TU5$SYjLvk=4aLHc|0(rv>Y$B zcl{ft!`Lr#4epu2kKTBSHP+AEcI z^35>4x8Odor`KIv!c^`b*2(wgs_gNv;&)ZFyPMDg)rQUi+_mh$dR7{7zZ1asczt^q ze1k7~KaLFZB~V?y`FruEl&I%N$ihDe5-_I)6r<%EbG(~Cr679W*!gtqPU@X{Hq~ly zV;R*kIwAJ=5emaW!W|z99X~Y;6~e80Q031^>1^39kfM8_29p!1Ao^66T($?-cMSNn zg+D-G7BjwIW=+2`PF}mR^D+f2N+seQM?|r*A9XyAbQ;=|Jls5x!hAUHr z0nk-fIdUvSScYUA0tBE3rBYDN8H~`u&1Fg!TDu?r7Z-x-hT&SwnZ{kZh(12R@DI@Z zjNmz3F=Yibn!V0u&ct6l$- z-M7`W;xxK7F2PQ&09+v-fduB#)@Vu`M2I*G42@E<7{kK%4 z7A&2a;-Zf4i%@s9@QRFfP`Ri&-%fgXLwzS>86B)e=x%kJ}E)N0A=9j9Z?B-7Y+ z&xIGxniV1T7aOq5K{p@&Mj~$!P~g$R6Ks#6J_&yjL{gTNf=6`yPiXXm*7NF?J7OQ?#kk)!k>Rrhr;Ep3ChK}YGzSUoPl_V zKz-jyWWUMGinC(`dUg8COn*dVk$4}Ji7w^|m_6Hr*E$rnyWZqDe|d1g@#(kYe){Z4 z2B>%j*+z06fn8x|i68rgE_vQjputQ&P5@|~@>-pe?h=NICOO4&OzwUW+@jfoZBNsN zIACn*cI9o(34TMqQ;tll#Ibf0UB*#H;Yy85OlE~Fh#zFuRVwIHp=ycvsu&9_sy!Oy z^3n0iw{_Yfhn+FXm;(}h$;|M8;yzx=xD@mP8toym_#mp}-yCQzU3>SV>i&m@apPgO zk^i5@fYt}Sf<$3wonTKdBD=hK`L#6w%X=AEQ=J|Ael^?iJvihi+W{p*}4V&mz(7>)cAsoS&ETl^ON}A}*0}&;HPv5$rtL_ID`XkaJk5)DliRlF1g*9yp^ipAYqrG( zC*$~rGnEIB1kPYl3(VWjzfYcRwLZ-2-5=S1?{1>{#ftnz^cnY@zP&AFB_?W?f?p;u zYgJkCHs}|ALfnK(Q9ewbs~~Q&{CU#r=Iu{OW8MY77<*@em0A5YIPr(FsVbXKJWkI- z<6s)kJWDh-M9QW7!VdZQkJco`C=Nf=4RxX`(jKKO(5W|nyp#)%Hu&7vk!O1-M5yaG z{%~N?`flV?>Jx<{cqRj6RQ|dhIG2#?lzYd^pfnoVsU;oxAWR$gz?;=^8ByudP`-#&VDZI1k3DC>rYR$^r#|!sRTCO9eId}68&n!K*r8&PSYTA zg;_JU)3LL0UMLQ3tQ40aELb@Cq#Iq90oW6+m`IlXgJDlC=Sho!3V_nCC)wYB{p$Jw@EmD%{qJ1r0zyJkH5_&pTA(i^0{z&&GKwV zFs}$DvCdll;(cTeT)L=DM0wjZz}6;sra3*wMwGU6ZFZ!Wv4(ZzzP1)sONHKGL|}-1 z?1BCP4dqN<{sdhQIJ~D2FD;#y7ZNS=;%s0q&WDU>?00D+Iw)T>U}_7d_Ih0+VAZCN zRp$+O1y0g%W&*Mr&Du1%@p$B(Vqnsxa7qH$FF^cn$Cb3%g&O zg^L+l9#zpF6VL-?&eFy*+oMCRuxf*s9~h1b#79Cg9OI!uqQ)Zq$DZtj^UoSYctvms z*28Vu+}_m*UaAA3vL=l}dL-iU~QNU zJlhxh9TscFQBWMPKD6SscePd;dM+m2;5KAZF~$#kEzI;io4Uz@5@*r& zp{2lH`;P&l`^Y6qAN_V+)*%H@@CD^{{*mMd1b@fXVt_HEqS*`!wKgAB&Hz?Vnf3Lb zpSl$2eSXZLXm@?=IUGan=)OMrL%9nS;@Nz1hC#!P9p z;IXCKKg1@o7(PELTLUb-jYp=LxmT!Y{tX;%7V6s=H%( zcEt>Q!BV?_#jaiPA7BH1GdY*cvA=ZLxN?L~h}%Tk9m?f27pcRTiAnvr)p;2>BjW?} zgvc6ZS6TW&1(9n?gaYUo+3M=D`;|mG^78m=&|BdnWZ}`eqw5dzbE~r!RC41w#W)@~ z`L^#7Ze%o&l-lelUt9?Xbsqe*OrZ0jMREK!6!WFS*a{hRcrD1Y`bH>#*zF{fFY?TE zrFQ8T$oFV=s{*0xPdv_5PN(>bRcDd4T@~Z`fR;+b39Y7TDET@a)w$^A3aZIS_T#R7 zs7Jq1bZ}Kbt)r)2T5e?%$A&U>*TJ4jV?#QId#8>?ca3q*P{!Ma!is}|t7P{j;XTEp zFT0x}f!Jf=!A%C9%zD4IUvRUN5&L`+<^%kZLju&|$z3|ZJ1{HPAsZ&l1j92}y8-5i zuI^J{Gcho)-E&mF#6h5kU#51db%A7xIhbV14=w@K8k+s)_VF}aY`YYGb*1uh?B9o_ zJ8?ueUYF}6_eH`SkT<*6#yWR^aRRNvpY!~N@@O4zqC8mZUeo)%f75P8uP}a-9i1b2 zITB5M-2;{#`MNU6q?oYodS>F~gCXzdn{NcC_sdnDUZYYzWKg)zxipW&; zmmIH&jKC7B^S3H1bFIaWpC*kD99{s)cF_#*?mE6(vi|vtnA?VqK{+be;8M0TZF2Tp z>ow4+R^y$NZaJFeL7eLOFIA781+`lrEy5Yn;||j|+^0DMM%U*3@cr?z_bIVch=+pI zKU_Z0r2zz2hz|SB=ALo2kwFPsI?QkO03tMxg$;uJ9bm2vLg@^U0d&{2a>}Ou8iQb@;M}j}m2F%T}qdZS!8K`}G~nY;kNi$1o zu0*x0Vv*=XQZ9U{XV$S3EnAS(K16h1JJ9FK`bl&-jTt!CY*5mc5y3nwJo zv&CY4)VX}j=6|8%xLNF}8c(Rbit~DBJrgG#NZSYvy@5jp4fi^ z=5s1u0qwe#j+2ekq$Ui~{qs>TLn31=9(Nf&JO#C((w}gs!e77K*b#Wb1;ji5Cdji!Uoq*CMf=(VS1I-0b` zB4=A_`$d-I7YbG%?63TkBq(? z)15KD)Nh}NIXxTWIe?;Eu`D6x*#y6M2XQPY#Q9rIOygCY$~2?_)UVc)A9Da#l+7+6 z>%?G3NO@pee%K$B(EvGKM7`go$@CbKHD+v#w?PAJ*mx>r-oKpgURK3O9FXB>qanG| zGsd7lE1@e%KD}EBF`yTs$3ptBJPTw63BZe)jWX~*YTk{|Pkt~W7DD{1#Jq(f0*&j( z1=wuXsE|9BfIGn1XU4TO)GIX)mRJrn!6%|&;C5E`0PS5mB%QvgVfK@wQUV0nPCEgdN+vzS9xC{N!QWMoWy(_tCAeEC!-X!)EH$IhFR7v#mwdV(mm!o2mO^OR<}?--{ini+Rh(Kefr1QUWA4=xl^m3|Exd;!{BCe{RQbmB70mFSj>0OQ_6ybEtyi+ENGMjD#slITub|b}|G4Yx z*3PBCJM}$y*KJ`@I{Va0m)BCpMWJf{1P;`hz+Q~*wynE+&2Qqfnb8WGCd`Dz1-SB> z0gvHgq@w$Znrfr*ZG{9m$tPnvHSb&L{^&P4CxIT8~o6g6J zI_-#mUn2pH-?pFnu>naIz-#FyH?_$bcyRT%|3R|F|Fw=y;U4{h#}H;d5L2N!PilVi zZvaUOH>l@42p%~sZRN-k5=vy;ByHq2B@F>$1%%qR*&In$0X;xI7MPa=T*84yK zD8p!z*Ub5y?o`I+0Rh2(V{a-C0=VE!$j6!y-9H1ya9gkG_{P&w&f}`zLN?hjpXva-8(UDO?C0)~0Jp zVNfVmKofY%BAC(Ooo>z!8ztqH1Z6%OWz%24->23Ng>TjJsm6&u4;R|lPWPJ=Zo8`i zYWonFnH~$~iw=i`V`1qSxochiB%AiQp4Ayyc{&A>P=Kw}{28pU4S7286iYo<%jdL0 zTZM;>ke93QekWXO@MAS=@a?GJDOuqS90*X7W;l5KqUyVG_AuA!-%aUo@_DWmbL|Xc zjbr)wrqQu5s_lNvkpgBdN7pg-E389k7Fsu(#TItzKp}&U6a!ol*Rg#FMT*-*P^k z+)v2uqP=J_I_Kd5bYnfZ@9`9J)1|2!eHSG(*k89phmkt>jYjC z{x@~uZ~oN2AqDb5I%ICnqOF9b{(Sq>J}z?CdAAW24nx}Xk7264cRMGTjT+H_>uk-D z&df)q6Yd$17M~!n8a~E^_qglprn=zg@5ycNJV4OX3-;3uAvVi3^MBwB0W>HE*%QP^ z_@izxOIefM2;=-^v=4}dxfA3{J;Jbt<$+Eidj|1*#?Abg%Ns7#D-$iJBFhJsjwC>Z3}u zhhGA8hZxXsH?GO16OlJXev3u&SU@;JXK}r$NhELP@YUa9T!G zPqXT)X)unG{lh)IkV82EZ_iOYJBL9MlKBnVKVd~Fb=U}&qQ^$nf}=utdQ*TbK?SZw zjgD(YeQeuTcKl=&(%@abi2OCM1HH$j!7-JUTcZ@jwE!eSqaV_%7GYlvDH z^vRm(lJHq}{>$hHjI6Vfw(&Jn;BU>k703nxnIg}Q`#GY2+fk2BfWh{&PGU*mM!}1Y z?b>)35bQHQ+af#uomT;>qJPN$iEA3wgInVM=WTagSdU%*NNl6nYOt&eJ*?H2SOm{Q zS&v_?)L2@|)_=N{qr;yj8sBz73#)0yf8(x8y(xF7T3U+cIBlQUvHLeWsxH=ajmz=p z9)ZbiD=?>DiBnNZK_RaL#fKrDN8XjkxaF(0a7Ja5Sblp_KLx*HuQ*PKPiV(Z+(l1J z3Z(`m9^LP@sUm@$J9Ks99Hx0paCRS$9Rpf7=-GfUqyIV>>tfe`I#NDEDMf|%B(SED z<@o(!GN`Eb1)zur+{IztV>e3``_Drt3JG@alfn&FFOnef0Bz*KyH^%au74@ufZ&W^ z6?50Q^<8mm2PSTY!5(?4^xRlNx5{^$C0qyKSOft9;Z)3b*VDgfl?uQs+NA$93DAsQ zz9d-H`+ByF_RxPM3p)*47fk8I82ZOTyP!fm=D3GgxFZ&`yo{a z`lU;N8B(RBGu!r_^*7V5Tm#f|`K-MYZvY4?Pc*xcA+oDmj{^HTv<94EL2p9e_~u-Z z-TU&Le$5OKALqqgh2!!J2TE))*d~t1FA=t3N$HCLE1gVRXq{(h7ISH-uJG)|#=th_ zcwc&Pf2;Q!A4WLk*}-1DaS$xF>juMaZI7Vm+I`N54+a1YoB?yoM=xMmEfg68bnVWc z#}JRBFaDdPYsKx;K$3+wH~Ce}9&YA>%K503sH@ioURIN|SD0}`1=deicu%`GLCr!} z!oqhEvcezkVBD1D4}Y&%_r7z!fJ;7zIprVS?WLZ&g;Os?AW3W-t_{x5L8`qL*^2~} z4N3rw*v*+7?eRq?*=ecMTQ_h&kaKk;+Nv6eze zECXfBHMq*JB1p|L>Z$BHp%{*nIv||8^Twn2&7I|SL;awC_jN!b*_iQU=Qdo>qf*7y z&3fQ_3)@Mr(Fhbphyl+JRM3vX)C749Gclw%7(IwKy^| z=Fq1#i4Dwr?FRviMvVuKhRaq~QCB>=S5jBWL93FjIre0rvE~lsPeuXGe>qys6kBbO zuHL9)?wRCRdw%k%L*f@&f$JuV5_b)=)%05O=1r?9cpuUc-6}|~x3kN-!K(U9c%$L3 z(%`cZpcj9by6bsT*?0=U15G&dJKcsG{@8i+piYla-xdGLwOyC76SRhxp_N|r&A)K{ z!tOHIiP_mr(wiZ43##wB%{Akzku19p;x> zi|pAWyWS5JG|7(sp;OQhs=gopH&rMOM}=eWf+vy0jiToq=K{4t=?~+uKdNtZ!!ldG7zUT{{$@aQ)Mfpll0JIW zZWNCor)L^#81F-5$aKRfdz`Y+m~f(Bp))yiGU1gZAJ(p@9)#7(+uC{AX`YX^e`_D~vmmh^6bXvmqEFpi5#L(x+ML5Z% zu|@q2a~Mg^L%RIL8A$fdCvio)r=$6sm)Isq**mB{4Cn=>mBpZ=IwFiDd8HRPe0a;^ zNuaxz#-8Gv^mm9oH7!;-dvBV$#Y^Vn@8KGi5C!eiw@Qo7m@!=GUp|$UFl5)R9B`40 z?O;Z7=y;B=PZtX#+cfMot0G#JX?$aC$;xmozEhx-UGUgv+;#oTAbsjKU8MLR{pmvd zu=w0tsG&ZTj`7ZE4wE)AXM>17{H3ghG6(v;v4qkZxwTHPZY&UP&#oZQQ> z&$;BToq^trwkd0=&wiJkYF=@+Gq{*3O68e;7Vf%dHQ@XzpZ4p0MtrTD0g=DT55@Nl zy&!F3&v(Mxau``>W}G6yZztf$RvJ`d)07;GITZg~yxVjC-G_FiupqfmU^}Z0_C8(0 zg!F}Dq3f)0pf|Se^`8AG3xi(kVBwaY`^VK&fI4#~eBV)lT}^X*io7@9SyV+chJ;Y7 zrKe06mG_l^ZU<*8SYeJvIW;W?vQVDD>{A?eWRq(g)0@y}S9vH8gP&Z~6I{~$fO0^LpW-h~j`zs9 zF$`Q<7VlL!2fh9%<>gj_xQ?dRKBRBUfG1O@c`Zq>Iy0gye-&iL!znUyFIv5eY2BRi z!kS(sB~jV(9u?0t|K$r_3xVh2iof#C;TIE&*_EYic^ZqsY7`cO(1O6r0r#EQxm7}( zhUAi0U(ES12V%%$Swj)YRdBfnoXUC8o%6?Jy|#9wPW+)xy9Q+FX2QSRujV=0cpr{` ze)PEF+VOq+BVGX2)7<|H@|;b)Xi=@MY#(*jwjW7;8H>pj68bOzA4%#g2PsKaC@3y$ zmfWV;my9-LcPBFLew~iF5qH~;F|T9Y>_h7)Y1^G#b$vY?`0(74{>gwm{#IT!LAk0h zxFeibTH*uyJ_d-Cko>Sb+HJIE9owAODuq*q`^35Sbs2wZe*&+M9JlAnXtuSnz` z_g{yB1ec0@CfMXtNy)-RhPKNfg5!unX(49MEBOt<$x%>peWD*O4h4FwADlBsW>Hww zBOG;#TJB*)CCbtxfh7pA42%hdaF-spKs|TxnhwfI$G8XxWA_#@b@aIa>bI`o@9q0aPfe&UP ztdPMfc|W>;IRmSuWY)2N^VUy3HOG>+_Oh<1$3pEvaaTJw!-V1nhqWrq}RT76a8hZLRoml6KA?%UHuJLo=Q3^S;_6%Qf;BntGQA7_WkE^0ne!fiu zG64Az_L9O#H_sj#!(UV^2)A1?%xs?~oW>~8{cz%}LYvNZ8y(dVCyRq77Uo^lBOzeF zS9sqbSY^l>_Dyv0TNV;TK}AtORGkpjF)8a}I*om&VBAUZ-aK;?s{1kD09WCsP|Bm3 zO4*PH@iV>bx6EN3>{L;lAm&um5>L<=(&prNRD33f452d|RnES@U;`~g$-AY{*C9b~5sFl|c~0y1Sd8$IcVXbKTQt5i zD+j|BS?a6T4P--cZ?8HMMqY4FFLf<>aor{oZoA?v;{^ORYY`M}V?(fJf4lv2x_3(q z>Bq@y$Ktp&b=;RSpYUHa_rAVjV5C!VmJ26?w;dGLOpaHgKuJ%xH2Pp~{-6Cp38>C}sYt_BvYteC%I3%J+z7XK zwCNis5xn9eX5)#X4&OPTuP^AiU%8m%kh_G*)O`q(c9G)>4rc$f^`iArQHPxEiFQvb zz@`{io8oN1F)3pMMJq?^$vmXvxsYE2`bk0YA!yKn`-_P(8939DIi$L%svwT%Nh099 zK^!rbJ6&n2f_`~JILab49C1@gDyMShdkDAY=?A?O(8Qg=5ibbWIh$fL!gv?ao?h7b zT#RYdVkma+NuE-cuIeqBA`jzSc`MC?2H&ii3OWh4eTwrsKdMHw7V#d$UXk)zN#94a zXsr0X|Av>caK_Saxwq({1iYZ;I})Q0Z=_T5>Fnwk)4y$o?G=$p3zwku_`TzgdXHdI+-Ux=s~ zl*fc9_oEgaOU;tU^Q}`bM;cs(zgt}DRf@9n`#C1za6dFuq8|Z2C^kdX&v^v5bVJt4 z=jg2zOTPAcf5k2SO*R#(5U$^5>RZLp6X`T#s5bUA^NVd1EmqN;2}r!j2ka zPfofzSjF1~8AUzzLem+_K*ph6W=J!|s(^z8wIt4oZ;giU`-*Zn)m>aq>0eZ_z78!>SuQ>vb}_YkxuTfJS2mc26-czLdg2 zzBhf$nW^{7`zkSzyS7T~El!T&{&oh#8R~6x)qNOK&_Z8nRV5$@Y=plXD>Ez8nJcK;`%$a|7g4BSL`PIHfn&)6Q>>n~Ri`a4jIjUm&x1({q#UviE~OMjkFB{|_wCVeb?zbPMINM&TXT;K>!;usJ%)iM^c${p95GN?#&{PZ@ryHckw zzY4Tb3?2x=%&v{RVx+`K@1@+|bYza5WZLvn;k%f-aphv#5Ub>i5)RZ zQ_Uu<+zQHJoDM&mn3v)F1of@se5b-WH;H9j zUa1)?y>O4IPOwNfqt$3|NH1-Mmt?Oado$u+b422dW5tEI$Bn%_qBle5ph=-%vRJg8 zKE!&Mc|%}1rdXhAsjRb4>wq}sol-ZPF}|66Rix4>h!(35AI+7%-}XK@_UP-pGw%+X zrUb?)X**uVx*nqOuCj7vQr_G50eRsFjwwIS5#VT2)lQP9ih&d_m3k8NK#qIu+Q` zOOEWMG=Ik{0=P4+V(hRr4?olaM=9}+9F*~~6?f{_CPdHJ^#sOvJqv|7Ub&d^U*6+6 z4|Gmvmu?^+=EryP4;UAW7(IfJpZ40CC;FCzb#znqh5d{949iB{BemUe_4l1e*IZ_3 zWS!^;UcO6)%68t=06g z;fl7Pf{L(5rM*FRa$yinMCh4?b>Wg|N5PZK=d$qICuF7kX+-)s`u$w^fKgLrvBpd( zhUrAL{GZQfdFBI=^Kf>ximV*J&BRI8%R{5G;{;IPNA)vw+RGU89*G4xetBSmY*DVu zKvwTUZDU+H6cU?DguAU}mdPxVn1u%LsmyH_R2_aH>cyRr{oTS68F0aJALS}KvZ;f@ zMd{r#%^+ zj+C5)R3I=I$BmFWdJz}4PdEvECH7x0X$R^?p_)3Q&|6yFM=f!W>s0e0760S(2J5qioawS`EaJKOZ!!-jZ78coXd!>_rvTJK zL^{vu#s{>K1f*#R0X9x>tLgOkG#r@c;l01)*Ozboq#TAwnO`;c&>^~z+AtCzQqPX( zy~4+Lcr6^>k?>&Hr=!2@5$S959L+Igk>tt@)+s3z6PpeVj5dva?wO>-e1cZDt_y?L z`Duv5vwiC(UE4rV-5wV*Jw2Jw=V1QAYH~O(s7_m=%u~G#-u?$xE6WWtL+#kucXY-9 zN7>o|dLlC79S?giOB&a@>O_>qF>`b!xq_Yd^rU6tI<(;~@cXAgr`B%c=2KHY15)Sn z0wzuB{)X#WH-VBy@piud`r(alHh!G4iCn-Tsg6VKYio#J@Lc6mwM>_IT8gI^rZelA zqQ3UY6U@*YCg+?i+cR}ndR8`8*b{J|p|g&Q2xi1D)UcG_n<0@i023UCi(Tlfci`82d-a$%;i|$Re@W3Z z%^9p?g@yd8Sl?$tp6MAvQSkvP>_(6jO}h8zlG)(?D`iF>R?#-)5BDGOF?VJ4-{$PN zOLoPyz}aEgvg0U3c{7$GoGts&H*wJ0&JxAxSr^w&f#yv9@>u2|JdKK8EEIr`gUnhBZw7a=a_!4ZkFlzj&vI zSwN3u7MPSiESVrmzD>+CVcwiN%Cy9)@!+g&RiF{+)~~Ki9isA)L@Z}=Sed(WO+Wz` zI{1omJBBt=(1iUR%NL_2ZwlES+VZ3mm+vL0Qe>c|3##wJ}SIrTa4glv*?kM>v=Oq@b`*snq4TT%tH z_~zpCUju9~k%_TrsP64$$rx=AUNKy=N{1r*y;n5ZRZvU^k0$FyiKiCz+kGHu8nXWKO$A}R z_Hz%W^qR(BTQlpLSf^=5$dE>fGl2kC0Lbs-iJDwRY1P@tO^j5Ew1H55qB+7ceBK7s zW%ak)RF1FhFKJw`Dma_0hYQXHFXjy>pqXyd^dXAhyZWYWkSdtVLWb+22S+;IqT|=* zi_hBY)+yxe=eME%6D>@Id}Ga;05;qI*v}|CH63ADRxX1 zip0YY?6`$oXFo>mJU!_SPJ|uO%|~6vuRP}v--IQa8NURIgQ}|*VoYg?Fm_2nip1(WBr}Y%^zbC7$=Gb6TF^_-FDRp6g=AK1gJ1sXX=tadjOp`=#b2QFrGE zJB?oTDWp4yE=2dsFs__b1OmZZ{JGz;pMUr)f7IVA zDd8XaoR+{lSC5c%ma{IklsnW+$K^(YAYy2$@|NsRo7~#yAoBATyFc@aLUPa0^f+yc zzzq8S*Lpl{MwELqedta@v>L$)aR7L2^vV#yIb1s3@)bWrppy7qEPrjyAo+Qr>4<_8 zs1c_>N6jwYbX(hOomaE)o1l~_UAoJ}r_(Rk);JMM4Urt?bo_{Gc={3@3s5z(2`PR{ z0)ZHN#MBBRQ2%>sj5%Y=9`?i@(eq!Oc?2>K>cVm1>yb{;rerQv4cdlt;Ey-2Xdid{ zH?bq7UUZxj3k3Q$Ka%@{yy3eNg7iV>?^zx5R}%h@^id8dQ#)#iP1S^!rkXD7-2w1Sn!hRW6I8?@Ell5y^LWVw;;m^>(63Vg0NdK zjc#X?pW`^;zPu>vM)}x>6}qsD<9*4*l3o}u&5>L;Zm+sU?}&AooV3|X;wS49QQSpIaeOG;7A zxytmpbYG7&ynaWm)fGiJTo`?gmz1EmS9Dox2!7l~lwmxein;inG@a1c?D&B6k%ZH1 z&&`Ecc36((4>}bz@Ik%RT8}zhzYoJtvt%RD?@>!kvg%^&m)mP=B*pN*5$mP7YRX0PdZWe&^0dPuoZHOKCCiL!k(fQi9*&8J>!p(xx{W zsG3psC0;XqKR&rsab8>P?1eoD+o?iKv$|8bzr)SJT4GlsLF28|g0N?L!3#!`a(>M{-fXT>;n9&Ly$V;9S>x(YF!Aw(87>hG! z?9t+vz>j5p?T_t=kgw}RmLO!4JFbA%!sr+z@2_}x6-5!csfJq?!4UJw5iY85XFaSM zg6HRXHErD;wm}pwADX|VmgAyU7&JYvpoqb%VnI%z{7q3BwK6}o#hR-T#zrzLwZT+q1n0Cmxsp7pxpKn27*Y^3p08sLA2XK4?<>8? z92*A07^27o7{dnfw*_43TPd2qu37B3rymrM3xG>s>dG90wqgWzmI;_j z(KiBYqitjaw5`4pQWVzHA}x|d6kXUkQAn6&KL3()Up=~rpw}1u++2`e=l@Wz`N;fG z{i_*HZpIUC6o(mKn_oMFXOidi*otM$w&_sHR{DgC+WBTdbEPLsv{G;Xzt%;A%vrTDw|#8E#(5 zM#m#Jbk_yWun*zdsGWM8^NM>I0}1e(3ZG~6GnNYjiTh{xVk8T^7onn0ToeT~nbq=Q zO=#`?%(-7(F~O-Z(<;wS{5t$Gw9=JVG6Iufbnm|Pb4Uf!ttpiCeBqzu3mu4l<4=>$ z$^Iz&!Y)?4N|@y@Sb4@QEbMYGEs{mW^(XIjsz<*$!m%2d=mbleq;^=CNjobX`#To; zZurh)aXuvHN;@*5vq5b+8u`*P68V;WYd)bt7fix32rg+31jlJ}5!z5859Cg&@r7lI z^z7Lprp|7X_8dK6N8`A7@5NN$mE*ep7XV^Foxi;5`V+&IAsk;B!Z9iZ?+DEd?UwlH5?Z=bS3i7K|+YR1qF`3-G7*8hWV^ z@`(fR*F!X!f(gtpkyB1+2VFc_;~ms{D2;8=FLMkGSfL+FJ5=Zq zW+^oK4{?lcFvbsHhN>`hz{7MdyOtjLuXqB|hx^JnD5^*^*BKgc!+k}URalYXx1+Zz zeXjzo{I);E+1xG)3>_6-PYX*-K`dmASVoVOeJgVscvVgX!*OhU0zH0ZgF*aK&zRx2 z6{f5srWhQ`zuHF)7IP}0jmZhArL8bm9I=yneiXxOWJgS z)asx)&orm&q)sTS$O|z|VJ0#Qd*xegr5acZhaZ(!J0D3ip)}!)pJpb1)MA>UtqT*X z4X0G{DD)65?n0#yo#`FZj9Dnv32lu3Fq9BY-KF*DP6jxwV;l;MvX-`jyOtC|@<;<< z#>86sbVFuBPg>%LLa+dYC=H5DrT+@6VwfnqEf6TqD`E0VMDZJXsW`=Vg`gE%;&0_6 z!kvWYIpqn6BeNt37u40lKT#t@t9Hnj^l8V$MCEA(55qp(0QU=oGqs66N#RCq0K2f# zmJ+4EwNZ3&Kw)2QQMGco0O?jjO5vv5O(o8ewokoOxEPYpg;2{wB_b3~m0rx_XUt|C zt1Y0Xx6AR!@-{e`b%6#IRG#)e(TAZL`*QFy`WLuwf_R@`1r=pZQbS)tA5O?)q4Ei; ztTKqj7?gK}lCYQaa5P;6W!a-rK#sCt{MC6=VU}}pm`jCwImlyWH{Hru0kYzk1CIXF zuDKtToKm}siZM(JP~}h_ImD3+MP&F5r?{5A#w7BJ(>RxqnI}3OYhUHc(l`4+5w51jms#OB@Zsl8^KtAm0!I?zIwjPYiF@8!OtXaY)ct zUOxX>ZR zwIG|rFbyRkTJ0;&D*&S77Zs8VsDlPM6~ zWH70q%y2_~np+Ant2&PhWWF;D6=t}L^q0FTuoT=|Se2eQWWJ_IX;{;FV|Kbgiyr|F z2zy!l8W`eFO+p19XSj_&4J4!`oT4SnF|U}1s?^IsgkJu`RalPs!a6D?{f7nRpRRE! zeS!(0jv3Ht#mli6S5mvEQRP+;R8YPa%P`9|!B3?nMUK?rzVyA%(pSh3CUHtRSG^Jg zlfKeKxrFiPk8&YowZ+jwZUKMt-{q6K$bO*W45Nd?``+%va9#||SI5A3o5Kf(*Svig z-gpg9S4X<3^YAaBOyOiYh*QxAI#-YpGgcbV!a(gIQl;mmLw?IoS;c(>7Rix z6B!2a)AE;O_)KQ`S6*8H3*_J@>7YqFlmmttr4l4JDB>o>=7cOai?mS?iY9*4utT-{ z$)^VJqCBrbPU1(2LLaJm(~5}5P+zN5#>Z3r${e#H`w4izo{@t%orLDe4v0>JK4HXplL0#o zv~eVKB_j7_m0>h*{8CQEy>XEhBsX^4A=3b6dzJKacqcxxzX4`atJjGAWSkYb)X3U!|ry`aL0>72#Gikg?Y#+ z!|UF5Tmp}pQ8-HhBz#6-T6H6VL5|Y|+YCmsjCyjFZgN+`c9MNqwxOwq)v{di*IJE? zBmGep%ZhahgS?`d%v8?A(~{o{__(5El#Ni$YaDSzrO0zoHjpDWE}A!i%UpR4rAV5- z90bxuXKM4;lZ45D* zegnuY%>E3eVF#4@Csj5(+91 z+?D$}S1V}e*kxp4MCKw@(J z^1L3xRmC@_N`q>v>4_&Qr_4wj!WM(J{6tixMJcSxmy(gDd4$l1hcw}cE}+q4r5`+! zmu9E9RVo2yVV_3nmNZbt9NQnHP$+GJaimT5q!9(-1}jwfNQ2HJZ6=%M1YQ-r{*uZ6 z1a*=&0UoMsdWb*jf$Gd8g~8bVLaU@qAx|-Ol#!17G!>(t0XQ$A{vsodh1yb}iKfI~F67+XOr8-8mb8$;Lv zZ4z@rB8|{u82y3FI8}6E6MDuXyl`NeLgZoJy`0p@9b^$qVXb8xZ<_x)2g;W|)ne0N z9M%kSInXUq>2IQ#^g5K&&Zs9>#L`)*Ea?oTSD^L~4mA0pI9Hx!+f+DEpoA6<)aNk6 zO&oN@9rl}$bs;J$QHC5d-B^v~(9svM+^3gCsO(Y!){08*79Cd-R4#FnWf6a5w{uE+ z;{sU%tg^ir4%B$MNOKnl>FP)EjJ7%wFTtzsWEm#7iysLpV}ddsep3u+^`!GShC8Y* zRkXeEpW%et^pxk+vj&TBPxxV`hnsPe&f+}%>ZB4wZX;DW>$G6ozB= z_p;>xfgWK~_JlF2X#0#wq4a>^sG=(IM;cq$Et}z=FtTrH8)xL{P#B*l74hMedW(Ki zE6Id$Nb10FUL6AX1vEsF7Z!J?*qIOCE5{zbb^eB^3Tpa!ehhqTX~KN>v>iRBsN7 zKh6|qgp&^nhEjV?6fFswjJAMPsYTM1(r8IcFvcK`XX2 zrxnOjunZ-ytu&;^t{waHK*bpU5;#{u=@38KXszR088}EAKbdSP1eGfm=$WB7Vita?yp>MeRN|IF@D;@xXL7Wp&x|od*(hGpfQ5drNhlVKh^mf2kyb5C zW?@n%Gsu7bwJ0Dobf?UF&*Irq@I-|)&j<$+db+=KhGl5Fh{( zsmou=Cq1ANY^d`E8v?E|kxW&ctRO@0Xl`@($XE*nr69X7IS@!3Gb~CespBdL3jw0s zX;^FFs{MqG+K?PXt7r~!Ar*Gndqagj&BI*;TtTI~9OHA#MYttisl~L)ZD_ctR$4+K zaAK|@xm38J3zPN~z%u}iHS&{2Qc6UqaGZC=@>~~gO=)E_l!UMFOzP6q4@)q3uvSZi?ov_3pW=Qly**IBn`JZ4_9%B&|6sHPG4m1^yC%$Y>`QmKxD!Z zH3k;P$z>x9NJ^$F^*BWV=B2P(jbd6udZw-@i}5e&F;lFhjB0^O5Q=m}-nsaooaDGN zjKYjU=@n*B?gK8SMsuJ6FQs|tAjLUrHdS%ZzZM8X3T-jybkxVK6ODwS%AylsGH_J< zlv3`|mxF+yWuK=-38EDENbjcCcLhd=%1)I>c^`ua&FGK8g+Y&4Ff5BW;%`oyI3#pd zq2VRsmj5ss<7?C{dJRmGcL}HQuVU!IEc{|T6~)|9xyirj%5X8xiOvwM0&fccG04@x zNPbA0Ca=*=g4bU0)7J?)ia!}sCv&B?)#E}gNzesIV1eL|t7%bszrTgD>rjsHFxALb%2ykV!YM(bs`~qAp^nh&d+^IdkY!jQqT)C5n|+3f zFY?e)18dRi7og0Pz)+#5F4JeaCs*p5xa)!#-N=9ZSLfq^yHY!#!our9du~*aErvKr z7im_e>AR?GK}b4!aH>rkX26>~wvjnZG(D;UP)P% ze*TJ)T%L5^R7=Qo9w?4DvT~ehS)szY-e3`F(1UcLuMc~iAD(j+`G8iC^@fU2HxGdr zB_a863d!R!>{&&=c_`j=!F!YS9^_DZ$8v;E+VncQP}%m5hj7XpEK)E&5{iAt`Dtk$ zu;UAQ2Xa4gShD|^2l03~?+WcfKBhg$S4dzEAvpwNJ{c;W!jR zai*sIQO}|D8n#FSi$W>FhiY{rcaaa21mq}1T^OqkpwID9W2Agymvus|pd*|S*@a1S zqKhMrq0m*^DnYc&Inp**PsD~}dY#4$(yX94&d}Hr9`IB4rC0VtpW(rh0Qz|J8|e%k zdG7znaZ5&1lfNzCFcfWAEBF=d@YrvM>qc~e+vr1RP%T51dF zDGoFuj;%hF-q2IFY0%7Y6iOax!~tHEuh3A}ScNLVzRsnB@;xcS45xJ7rG%w=XGUNC z0sVN+Pgw+|&12O#jhz@LfmVYB;YPmF6(`}2ytjc$3MxWWfcpwr;57~vL#`O{*E|%; zNM{y7sF}u*Vy~i9+6bdL*D)Gfnx{WpQSV{HiSmKyc$HhT*&r zWVL!60`d8w=b^g%avl%aq1aQ zV7`tOhFz#~U;a~3E2-l*FW|yWgd<(^NL?y@aW27}8YC>anG|M_ z;RT_QRhUc3g4$0wDmhEgg#rGXJz=*lzK|c4%M@eBlsCnrvohnae5J@tu9k(eKm`l zbAW!H<^^}np%Q~tc?{6D(=6_wvt9*Z=qkLCtAZ#_LMiE?;mG+&bsbc5EPtybRk}KB z#T_%GgkT1)_`{7RQT`&Vj3Z;nm|8<^W+=ceiw<2ENq`?3Pd+J}CQ{{j1hZyHB;+}Q zs#H)?%^;bIZLBw}s;JPD6Xhw6s~Ct<1C-%F;EiXw4Z22opKD7F%W3zr{Oy*6GIc~GACwHW* zrA}t@w*bD13T;v4q)s2HkS3@XvVdA>DOGn_38P*QUPUD?xDBVoQ5UY2P~6BJ#+kXK zGSZ@0h1$##H|4d0D{!kMkYCc8#xpQY8?se#DF0)CTgz!R6<);G!s49vrkZKz^-IWo zJ5LtR86!%SNx9MQl+Z?oFUo0WG>7SP9)eJGElwOn2GnoHx}!|{icDk{MwvhCQHv;9 z@q?1S8R|hQ{6@62EeR~xhnf0}RJC7(-%w$uF<+tNYN?2@st(kA6;S*~U6@ zCV`NgW*4#tIgYFxBLv_4@WJ8Y!$SzmY`F-bIrI{yLrCV07rX}t9n;r zUvIH!tH{@ekgU&5M_BA>=2ddF7a2VQxss%Mpk7eXFT$MRG)`6SSzmD?ck~+sH1ZHX zkxxDqjh@%k;g+%|TsbEQa@)@1pkow$x>ew`4eAuz3}XT_T!)UdC~eVJT3K==Z8fLL zZzw`U(GcadX!c`bnjHs>3f@%IQ+C;+(^IB8?3$(W)51(6e#ew-q2f$ev{rQFwG=Kg z@6&MxUWiZ5<0Sr5wxEt;ev1Or)(-t`O%0~RvIXj5Rt5=XL>Ncn%CjKm9K|21=Hg6G z{KT0G4TFyKxQrG+BqEwc8VRxm{I;+-kfwH;fyNIljzbfWBrMQa;#{k{J@}a!^;Dzc zNBL-O>o$5R+-(Vlbci}axmv7Lr85Fau>@E7$3JG+^M{^4?3m~^*|&HIS)s}0N!@TCUM zA9h(Dt!CsdqsOF@k)c)`qiH0hE{f83k~%UKx^$YJY1lfZUe@tL`O^V4>7kmJDaber zcX`p3Y2g=ZIf?Qvr)e9Y2{om8QIAip><4-lo~b~Bv7H3 zz`Ynr3%5~$5nYS2tSRq0%djVp851f!*AdE9+V{Tle37jtG9t?h9v9tZxWpIv%xG5- zxrl(WRFh0AHW5J=hbF=Hmj)5K%CU<8_XL*Ju?3PzRiV(+7OOqNyezQk&47F};7>GH z1gL>O>N-woms#e^3Sf1i>Gd5*7Dr?$ui*_pR)Z{OYCTNY7H|()RVWO7GiQ)<} zu@jQ~n;zsgRPSs|LqhVlW~(_;Sk+gi)Kb?PqrghS2okc8nIcs?2C98CX^U z{+V;aOxjRb(;gSxl?oRqT;zHD#gPD%RH6vQ{5;lc28d%BYT*f|agM^Dgl2^ir5y&C z$vgtceaG4M7{d>RZ-iEaS5|g;?=fG$WD!;L3~ z>v`ZVj@KSJK3s#)8|tbMg5SoTV^)t@Io9g&ac!?)6}eWMujcdAJg7%_5$+8!_US_; zQAWJ#4T0=fONUmKQDGj*$+ks9iLxYZ5{8v-jv>fNQ5_i$?#FSKvTrsh7OV=&Kz9|X zn24{&SSndUE|ndQFw2E5+Ew-|+C(8Cz6*CE{1Cqa)sN6QaS~=|@u|JhSO!x_k9lo%F?&NXi_$Eh?N4XZE>N zQy+|SZRM?g(-h=yxQK#J|C7p}@I}FrvF4{BTUq9W+swk#fdlXHkkKjjA`FytJT+4i z%>W=n{bGYY3tfZ0MxFq7gqj{QK_K&R)0|DI3TWK4sOFFO5nd+2OHEhDbRVi|7xaOG zXmQYqfM^&jS%K4bgD|e7;38c`6_8OJV?b{hX#vVSwawF%#>xvccj^=b8GmD$R=JG+ zGsrAY@|j1PMA=A75=c_j;Ame*D7y%!8D|KKZnBJGG;Qd@BCIt*RiQNJr6v7zeATr~ z2vyBUXFd4gH=1+&P9apF<-ST7S7RCJyxc=12(1p4hWz7S7XUa@S%;%I!7d*n#X%ff z8)W4G{}nu5I4!cwGrqAYM0uYVX7{-rD>^(xG7Pu8U>II~C9kpLmM0V4aSh(=+v8>P z_$kKH!KlSsMxdN1?d7iW*iiaZ@v8bM=1)3C*A-__H9VQhjUvcAp=8#1q_2bOD&SoDN<@R~$wiovx9W>&gkjp%aSXS$ z^Km>Va0kr~&hj+F#X8d-e!~sUq*wYlD-*mkCWbGCMJvE*Nbp0{R#cR9lNvS%t&& z8)Xy*==tbHt-eyK2!yvhJPhx2bIu7T+=atezV-O<#<%CEi%%RsIvfkBjIoMIkx?k) zBPG$wJ#_JSG5)Ph_PxK4<#9F$WwF{G)^TRY8o;vW^~n5KQ3Ga~<6zGxT9VuRx#g zFXnU686G*KeQ<*caJJ0t(A*K6#+5kf`*)5l;V2`PB3~p~3tlqMLx!1km0&Q{#bjQ`fCA(+ z?3D62Rbm1bUdT%gZJkwvfKk&tvuK}wNUP##$JXo8h(0xX%KVQJj^}x{HS`Q?am*yf ziApnhn;_6Ijf0A>_liEu71NlEDa`(BgQ|lTlsusiTb(ML^jEKxlvGB3Ikr5$_4@FR zKis#tGa;eLfj>;g82P~ko=J#Yk7N@@69FjDcCK^~PWYoCS9puwgRqcUS|~jIXCtD^ zkbHHW&M)V^u!7qhlv0iDPBeGrJdUMJXGGWxOL$g-yFk!l-#oI4OS;Cg3MDUOSEuoZ zLGP!u&23gt8jv6SWEEkG%Suc8;a_^d4X(?8^9)UcM=&~-4$ol`^+Bi4K``F;`W<^MmH$~RUjP#T{l{pYR+7?abCr&tTb+rY|M)$y^F*&6CvkoRQ-kBk3qP)Yg zTBP!u=oTY_z|@h0aI3Ma52yTK9{FFhvIDAW;??-ohu!R&K7->Y!|G#%ie<4ign0%o zrFIo;b-AXOG}Tbd?Oef1(^R0GQ)UV?9gKC?!b@%Z;->~Y`OH94H=UP9 z(!+=|wHEBdrN(n=E9yLq7($eGd1G~#Eeed6>2BOVjN=Sck)p-^5MiO$dC2rA!U#Vo z@~5#k9N`AL`o#2k2M^^+@_7e!yx_ciiv_Q3%e}{`rngv}kh+B)-otGA1T`NC;o-h~ z=r0uMXzAofxrvHG-k@Iik{)lAI2!eX(wFq~fZm`7^tAu@=)txJnf=EnhAUV>j^kTV z*9~DdXk{72TP)rl?pcApF4WPuAR=7iOW~RtXnle|&KXQqEn%+y67DckS))Q92mHi; zWFzt+f7D5osm4b#NgWVIXw^na;XmDnPX2RsIfX=YlShsUuj%m+ z>B;wuN0^vn8pdczL&l>staQxPXUt1=lxHF-L9uzqPmNK^QqWuk%@KrQh1!`;V2NRK z#0VQHl8)#n`Lr5S5&ALRVYegF{TTjuEK?MJQ9l$QWfli1+;r*8hJr;HG=V?L1^*2C44f|8vEE1i*~Axj5qR)8K>$o z%?an_Jrrrss!Lc@QE@CdKM{kL{EoDjrg~l4`m}P(%F}9f8kw}pH);8s0<~k^Q|GK zS-nxC$T7SOa8W)}kio6WWDGDh64ZoBFttn2)Bd4q4j`O-+P~F^G~?L}dM;s4;inG4 zB6O9wP}OcSoy6Ilhf3k3IhRq6eYnkfnBtcZg%PTq)ArME#5J#)7Pb#ru%avkzGh=CQqkBikzurK+$Hkd^jGpvIL@ z95q%&9{Za6+%bu=Hwdus^DZ@vDwgks)c!OEN7V!>96 z(CbxjsG|o$Najm=>^nZLw`1H8@f{6yW1O=h%L+96pn3l?+dWz;RS!&^)W3#0sT|u_ z_((+=tL8?3nLQj;#U!Jk6fO(A&zvb<&7*>2>G3ynyn=Mq{Kh|VkZ#&+jn8sa!L^L= zJ3)HGtsE~?MITU@s{rya#S>`{1DQ3W+RC8%50&{2i^k}+sRgiH0E0AC91%%|)rVPb z(%o`e=L*tW??49_l zS(bM*%zd%h@w=dxBL`iAh#ZZKbTVb8#X+c=9MxOWYD9_9&mz%zD9oDNl(H6l7IXTU zQp^#Bc`44Dr_fT4%)8MoL*<}{MRTzp`Hg&3iQ)-`dHj_Td5>{YiY%k(_E{)$tYYZA zrtc!}ORSZ1{Hgp}^h*i5a=SnVmV;xnYDQ{1=_`H-J`_eWF2_?r zuBLgyN7Ys-tOx={_!vghm!=iR3h=!eg&jW#{-bJ>EMpRu#K+(~qJ~MDlz<5Z)>P4Aw=lyae#fpDC%Ni}X%LN7=JAu+&)*z_ zBaSfF3LehoupLzp@t=*Z1H*C{Fd()tm(#gbe!@$%Cq2ZaF*H?v^dr)Pxym?yD_MFU zGJg@bl-x#ng*khV5texsTdKBiILhGyKKj8ba1)Z*TYO<#HP$LJ59ozZoC0!FJjkb4 zyd4k0I6pPb9%RC_6rW7J9`StHHe6ID}qa?Ut{1 zOU1`QQXwD@T4jFw_!bKu(qk3+goN!QQGTJ#hx9_veq-$`CjKZRRXqb&nDa*oA{3Wk z%)VjW=|s_1q73t%K;QaWxi^*M8NnCyqp__8lK>6WASwu>v}3G^@TWk9uEPXz_hHbs zP>bLl7iEjm2b`KY3cZSfla>_OH4lt)N=6vSZ8%<3SSBg#%azVkkD|OX9?{Y*TYfkX zm4bAZm7JFQpwn(dt?rW~j(vKQEe3-4ut7EN3wn+THIZs8Kow$~*C~$s04p;}Sflh5 zNZI2NJyvRmGTcg-D_@;G!D(13vl=*Qykn~P4+kV)E;&ereKh##JQUE7@j8aONOlP{ z3N%q^#g7u$j-g18lFt9N~9iK*ntsiTnj&G1Lw;c65!FihDkfDyiLmLW{w5R+t&g>`^SseK<^ZXB5EI5;ae4`Q4$zNEG z#?eXRyabCmWm3m#6Rp&nIm0ypavpIitrKc1IWyv93oX?n_|C8iD-~t24pobyRYOUr zwlJe@RNW~3YO7^8Ip0bJN(xcv!z|iT+T;msoh_g}f&7_FF>^W9j7zwQ|Age+2=MX_oR%y22Kj4gVsbi6T z8Vg>c&oQ~SC??@~5sY&TOZ`0mkY-o=GsTAAP$6$gDJI1ijvDAv(Z>;8(j8@& zghv%Z)-sAn${*oXkSTbC`;nYfxs9GBAAjK(VUMPK;e3jLv`^to}4F>j#y2lFmu1v%732)yV+_`L`f zmMDbcTZTDru0Y*_Bd>i!C=TKI!ch9SNE5tyra})1hFPVWQb0HzAJB^<0&;yIM2f8y zd>{m&_h@dhxblXBAt1MvW42XDI1XVsj#nNzo?9zI=|dq1#~~>5p%LDx%nEX@Qb&nI z8_1Q*ET3B9$YPHk$k-5x7fq;Rp&)* z-QdDTTR0d`Dv&zWIM&+kQV2P6NTOSw6U?`gZ70)Sij<|kr9KYCUHv+{Rm6cKoWxPF zM7nvaOZsmLe=-SY8F)Zi1U*j%OBw? zxY2+pc!&^#$as3sUx`TS5&TD?$Wz#LanOy%2?xTBR%XMjgcwm7ggD|awP{HFwYQFV z*(W6bI#0KSCOHZQuMsY{X9)*)8dymKl_>{=Azv*NrfhVTi4+6JbdIDOU8O~XRz9Pp zD=p!*^ts21f82+8OIL;#reR$1&%sBQdju&B`UqEXX8JUrkQbFl3nhNiTuyY7H5dM{ zlsWki2)4rFB+{*vhi4_V0&VF)wUj8t45gK;XyGc940G|J%QD3UX06OPuLR4IaPmCe zrkgCU7MD)aT&W2yZL8`SJB3O7&57K!c31Ioke~9FrezzX4)1AOE`msdUSSp5!(n`% z+cRMvAFhjuiH8XP^UCAH8?MO}C))3^2t})kT^OXJ(lVu8r#mCuOa5ku+96%RNjoLaRcYWMF6<)KSd?)08v2N21A(z`sf9k0p z%vGMD(dv3wYFs7FEie6K-g4b(BJ38p#{5=UWj3eMv^1cKB*3)JviyLyKIM_TD2b>x z;iM3}7>)=H#$9YWA)T0I_{=GpcEZJ+cFn3S3lFynq4JIww>ahF#PG^1hT%yOH%1!%`x?F)7eT~% z#*%ph@}TJBm(oyHL*WiR$2yl;{Df>AM)7xuvZIA5_Rb&aBP;@gD&y)=L8OmVw5E~f z(GQeG6n4Enek4qX((14L9G9?*P?qP|XPoHu6N)jCh-8*VnVNJu5n)W`%P{aOd4XdX^yQpo9fl;nyf&@c zUc`?d$i9So6tsln8g1&rUCZwlnxiTYff?u2A?YE`Ok0r`j9ezhK^Z{P>??7-`%qLJ zbjFJ)q4bd`B^pOdbB-OPC^T}DWtb_%Dt{+9FSbS|zcVlWDar4Ps|_DPw3_VTJ7N~a zn5s0(Kxq$HsGSn8EXikUH<6GEgF0xM@D=`au@bhpjl-B^+DGS)a%1c|6z(<8M=*Mb z5X;3$p8#8+N^Y}bq!>fTG|kl+_pl*-~S2)HTYDW^b?lu@Kn@z8Q`3gs=pOKRmI z@Q@8HfJlHC(EGf;dk%@k8eezchpNj=Qqw$T=R+^V7n^ z4dJ2b-S_&S(*~TCXoAE1l^2zF*l-kSj~`6xcBmSz46xEqJ1xUdDg)ew!YF@&#hQ{& z+_tmPSv#uiA`U4PPMQPSNvZUt#zqGusU6A`eVdjeOyX>gux)9f2{RD(e?WRb0&lCs zvV+tw=CQygch46?&yP+Y&lrlsKhYBZUwKjIpfT>eyD&H14(xX8KZ9 z+>{Heycm%8OdXmG4-5X#a;)@KUh{V~**5Z*#Tmw3wp*~hLR&84=YsRtkDQA48*3l( z`MlmOU+I?bLPi}NZhrp3;bw8v3Ul~79LK|9e>n0{VM=A8L^d*od_j*?un(9o=&|=$ z59r-^Vz`divmIjvc+ge})Kxd+r=)p6?`>_rF%RioaV?W~m|@S}EeO303Ll&U6_634Oh@l*Xm{YfPrDkc(+YCqu?C5KXx zan$h|S=)KoW!(`z`IK{hIU~?G zVx+-7X{L*M<-7SUr*V`W#tI{kWJ;2MfJipRgh%Yds)EpD6UT8?5^&T06uQ20Ola(49?lV4x9e*78SJZeH<~j8Hz) zT^tp5T7%+cI1$4|UlmP@yApsQonQXYPvtJ}RixEs!-II?#qr_I*M!}n@DdXhxuL7j z87Y;qyaToMNSB&&%X`*zrKTd@ikc1@m1EYvPDAN#%gkGaTka+zg^H%jbNI!mOh`Au zDQv0C2~q302>A~Mp;t36Gmadp4K}JAsGFuyo32w?hn{e{sua353$qL!57bE*pzYFu zzKq7`WgjQ}hhBXSM(^oxeDHV0IHwjLbysN{`&9g=&xClVY=wXNEhmwQ^2YH60 zvkcXGnqS;!+*?T(id^~@u=HhDW?RX8Wm+?c3}-wIg(k;7PMTT#s2-X_S%qG9nCmpd z29DWs!aN*hzesc;8ihbu61GFnn=RPhaEFVc|EhrKF9(MIxbnpC`l}CwV0mmfcH@mv zlyMAOZ52QYBrF1^AGExTE6~v~AAFY!hTC3zFvkq;ZAU!3TbNZ_J`c_Kq!r{a$9J~1 zta;@>lnxOf$1JG=6MmabILehi>NZ=KRQxcuV}&3~^Erll1l;h8IsQliLN4wxOMlE+ zaT0cfsVw7IQLA*xMV<=G(w|m)!!5-ky=;0g!Efa_Azn_&f%Ke4p5&sODWd`BL{RND z+?Su0lt#t1V3?HqK-v~mmS94;_u~ku!M2hkngNH!SSZ|Pg1v%`Fv>G^)%0BS=uVOH zlZMJ^{Ln1>6y@Bt9h70DR!+0b>W&&_w5y66{YYh?6|?fx%%(cY<05##LO#;1=Gio= z*Rny~5hI`$ajRl)#$Dz_3ddv|fBv8mQ%!ns~90iv4rwK?7Qsp3&m9D+U9Qg}9VQ`c_ z(xDabaDvKMAne*eiD~Ad!3l9RL5)9kBK_x4m4H@x~=c&;d0S zKAShCM#pU6fXnjP!Xf`EoK~LHP5f2cfgFHP8Atl1C30-;I8;I!q(DZ>V}@COB|K9E zC?E*5s1~Y@mHLs+q3S~?%}?`8lc-Z3EEF!yw(`eXI)1a;ie`}h7J7N42sb#h8?%L8dZ*v%S80MC_VzHXOqu;2qB`4v3gVxfJ- z*Yg?a)_90(;B3F=aI3YVe6oR{}lg)ynAZnsd5BA6-e@{@l#3MHK9ago}lwMZ)j*`+=HawRl$6ej;NBneT&t(^!C zU9inrlwX$FPN6>VIc{MJr8-iaEj9v%DXT(u0Y#6#ihem*l#k9GMiD8eRTA})7vQ(l zj_DkuC5no<;>~;)6+_FQ+R}o98MA^2@I96~UU5aK`0^?%s#rTo_BY{4Azct&*4-EGBR(A7$9JlWfiev>22cUK|xq*)2L5sW237 zDBMdRY<37i62P{ELmXiqUdeb(Hd1LV4TDML3?;h;T@h0zHa$IEw)l(MR*_(|=t<`J zP(m{c`pF}8kpK>%@?wCrMlMicm6IWwb_BdIfsyCPNHY~FkhhaS6 znB1IkWyE#yhRnNq-Gw#&|N zB#p9$DxV5PKWRf8{H3c2%s}~!KhDYw(ibhQnUTy0f>1KQnQmo~wu!}TQtZP^kD;0o zr|7jpod4=u>JuZ8GK9f)2AQtuZz{iVt#EMP0t^ELloTSWEVB1Vn2WfHKhq!&>5p_# z-{Gc&J`PxcvVn1^yyKRZ*i!-=X&ahwo9dFefZTRUPD4YLXF5W~iPA_php`Ad+>YsJ zew3UrP`cG9Ii^ECs)FLfD5a;r=mESaXYSmf=OH}K^*|ndBor&Zd_hkS=E+<^HaICA zb(ZahcAm$yUKp{$v+5~Nl(F!c#YDkDWGLiisoa8)iU;)c7Ko@LR;N=q&eyx45Ni3D z%hkN9?a0C5D&Bw0mI@xu3-y0ZKxS(N5A9)oMF__{#D^b*>T3z-*ntqX4-VJI#gByJ zr~?V(am;2FDUPxr-PMHDo}yeCXR_Djh^>{dP}yE6uQ+c7Lpf$yHhYQ%OC6iSek$;c zD^xESR$HX~;9g(cgNmT~79NZAvV`V#9W9BwVQZAFFa+t11L>4eE0anR#$l%q!9=|r zkNQ!4U>@}`fu6b`>)YoiFO&&m(vQOj=FMFl7ogtbKs31Jg!A$rzfECUED5OsY2adM zd>ws=$ySrzY#wHoPm6Z6n1`|8qa7D1Q;wB`rD>-a!b0U7g@fQrAu(p*K7VuEmnt_M z3~N|c6KBY1!KNxrB`WmMFJgd`X@EspmKg_99_A#10gP(R1U15*b9L|-7!eFq^@K$V zDxJL^A_xgU%4GbJ1N;ykgRF8Cw4ij`p3yl@G`NIW9pyCqp{LK+Kq@;Ts)*Ad(n_xJ zfL(^Ed`L60FK46sJ)jOd#V!oVd;k9;;MsrMVvy8sKC?0XKzB)qgwfsCa1UO`A@dUUYg^ z)2KK0J*vt`1NP|SNS#p+gqy;47&kSBqaznX^aq)UT;&UYA$+KOn!e0*@zDONZ`Pjz zC2gsbn{3>ep$~1O0h6ky@=MZayICh;hoex{x8;TmWN-pA!d07(Kde@gk;*H1)TG@- z#lTA*mCm3=F@XVzgceRXS3QsprMrPMWm^*xd24kaaWeiD)J^^6oEb;_5w4D5LwUvt zDWfkdnr1E`M}8uX2p&al@&Y=;BABs$$t#L5^fRTow7H*nqSq7G*1s%=Y?BDI95YVE zt0QKia83Ja_S7tUuGQwkaQr|B-kN9pHakLxv*Zlmlgtfdp#mF!GssiZDY% z7oslm!9mmnMrqs{oa&YEsqZLF>a%wCKHRpx++)Qu#rzKnQUPa!r1*O}Z+{w1rYS zHl_DNeN^H~MLi){hOU9G(%qA0z3Ds;73AcoPMU$*VQQCwE3BLAk!E0OC@E#wd(DX1+G#=clqvA*& zLqq2YD$ptLGy|E3KOO1Zk&?1OH+D)4m8NDJJw|q%rqe0S5yt2(j>Met=HQdH6JQh$ zvzVr%;%H8AlV1TMtd`FBLomZkPMI)>95?B!vaW(HR8}~m0q7rngorU|ryP`?E}#M< zoU78CK5dd_UWO7Ls}PD7eV;$YRc1jZG4ey608T)$zZ=SL{9%Nt8cq1g{G>i@IB%9S zvK(4DrB>ypaAg?{Sz$(7YUbmGP#2sUAMrBcx2QNIExcAwGHGQ>;2O~5IIcd+T+Xum z^B}gQS0<$o%5gdz)0`(6CvA<}yYGKH1cT$l(PMnbfVXfQ7~XI-fsAQbKSriCfq04AuOzq-{L&YPr&{9U#wt5(jGQ_Q9_QDT-qp)zL)wDQ<(E^#W z3NPavC$K1I*~jUEw{{|@p;R5@Bm8AL!-hoA{_-r_V|k47q0Nn};;nrU(il%UohLXf zGJg>66&+>N+AgPA@fielk&Z$&A)q1*W9^;Kv$PBHd`wiPU%JR$gq8JC5JuWaKLaOWSQ zrPIPQtXD-Jd+pm#Xb<#_H-=Ojb;$l<`huP#(D)tkG3k>i#!GzTIU;xvZ{fH_oJWNa zE)ViubwjQ$BS=$Eys8cN$Kt5TGs>RgCl^^wtv(feri)WuKw%u2l6{=ju_(8xOVU?T zc9cu+j|3e{Low+nXP~Z9hp+OP^LQvS6#p`pK3yps&H?*yzuihIL8{&fq9*q869vSo zw8oY(9MXn|77wT(7lj&+6e-K;Z!yBNKt|L~~vX zL^&)gX`_v`!j^F>1ImuYD(;ryirEUC-ok;l6J-68DvV{L1gBn6 z@e>NSG9*%>ia!MvD$6hQxWO(?)X<5%!sA?#5LlW?g+1vku#)>RKcQq;xt&va%cu&> znC?ht7E7EFKl=Eqvc*XHhU#4*ktYg1!p2+6kJ?E0$4Zv+rDV>+scu>bemyf(h+-25C_X&E^*Sv=}+IgHbCsX)3X@}6@J``!03->)lO|~>= z>KGc@P3V>V_#=!(@;uX>wy7eWti%%)3Ny-$k(|1S1MWCcKONH)rlFO8xyUfphN-Iv zLwAaBTISSK_)$Nq#D=PsXeBKIS(95pM1StPdNAWeKBkE0ZRBmHc-&^C)hX`b&X&UY5; zy~n6X5AQ$b>v_Dn;^I)Zx&So{w?2FzR2(lHhTCvFd}6re1t*4E>2uTg&-Wm+jYCif zV@c$1PFqzUWG3A9iys){J-sv{y)q!j;Ues*tE)p8*XN~KIoAH;dSEYeOC_2&=agK`qGdBzOGE3(Pnx^9apz@qb z?N_->eNTDks4W&sN4Sn7;{gxGsg7|$#ELid{BeOi9}nuBqtd4^Wt2z!L;+}A2>6vB z`6~};mxP&&!%PL%L1S)ZsN~~BDn^2)vUeuEzGtg>ggb{cgu?Cgr>Ipls#DxG~Wtag7aR*ugoXfIrbGn9ibg5)iK~|6HS#dPBV@< z*&1;-S`!=wp&0urxG^wk>ZJ6eWl-me6@xfSeQ%mJ6WMff92=`V^ok$z@h_00taa5j zhWLr2`Xz26!x|T9<8i8CCL+l*g(4LGL9IXs%@>O+I>FKD@m|}DiKe@jxOsEf72%kVOPd8Gbr3^R{4{aj_FYIs^kpCzI4MO3D zYOjYqw0fk9$?#N;Eoc#^+OAQ=c~(u-TWE-zNmUShOCr%1nMdft5qLe%s{jJrfRY;2)9x)g(X1LJ zvWBh7oH%hAvA0P26cM9b^Ha1Wj*!GjE4n0#3<<&}PIQjH(3Bs+3Hc38AOj&t0mF8;Gj%3K$&ah_X?*nWW!!Liv#e7Ff&S}V$wjl!1u zI4D$pG0*zJ4MJt6T_>T*50nr_K4`@ZaBz6lRm1SQt4<78Uw`9pA_UwUkMk&9YC0;WP@sD>UG3^w#G(jBGy2YbR zLgp!LQFusC=^oVLWm>)_=!;W3tLQSMI;(R^GV7)fsimm7*2ohlp*X~O^_vknY^jkO zP9qgmVo>re-CyM#ep7Jlh!cWT`KZlc76#HR0e1}ky$qm;@RRYj!b-xK^55dAHqy|9JuJf|) z)fWIHy8&KIN`CN=O;VI4ze{?vOqu`xK_oze0O2v@ApvM~qtRVer#!zo*NlkFb4~$+ z_VCKwJ65cFthnsRefG)Zr=dCc1w4ypyc#6r+eAWTuXBd-Nc4#c5S9TFoNPgKX$*7X z5te(J&5_<*gXm-2%|1kk89K}|-D?H?H6oNb=wtdneNFEWN5*8JI`(}wO=rsBIfxA} zc>yWw1%8jvQwD^&l322Cu;z@0#!~VVy{vzSwo%E8>A%7V$;}wSl#!WIiE;jn>%b^F zUOz;@5IhFv2_2{pfa5~RxqevYLx6_E@DUqi*&mD{0v>2Oyin|%oPZr)+Y-&}rLj2q zcmR6i0ax1@c0x<;PG4zZkMxurd64Xb_$vdD^Ze6e4yV(uu^m~DTa_HAM~P&?S(N7vir4~xuE4pxfJ!5obsdF1Rq_xu-5q2zHe zCcPI_Zg?Ei!$UU6ch(8LaVU85^w0m({b&WAFetFG(aW7TTAq+-;R6}f(*(%Z@)>+_ z2*yD}9JmLtD{k&G8f{~tRSrNqliCBdYNP6n05O>m8W-Qsd)OP35R}5&I*)d^Ud9WXeVb@)1M2E^O+~Iiu5*ZD$y!4!Sy)gh# zjPAm9czhv4EcCm^4YZZ_xG_LVn+hV_LVW<(*NdU#E(IyWXGN-@*>L>Z@AJ(8`6ncP zs`u}Had-LYmrwnCG&26C0NeJ-CRo@UqQ_Gj&#ORAkjp&L!D0y=Tjra(<@ECSgRXk# z9&&Wc70{H)H_$Yvg$Lt+jK!TZ`xTrq--8(dokxDAdF2rs@$>-;S71A%&Kd{oDV))G z&JjE$%Yl1-Fo*;TqcC?5AUYqIcHE*lsnla-ilbi(Ck|_Drz!}4toVGTGwTar-_uU0 zZu=6Qmg$r}a4qUV4XyfMOb8)Il-_)cj*d%YbYhRrM%N#9CwRIIy52gZCxj6JK;y(% zU-6l*L+$tFOi3hSuXMt>^PB6_)Ab$5%wg@Dop1172ANZT^09~>`y}Ma<%hp`fBDB> zJ-K}SO@4{+-JMF=_J7)so_!J%v2nsK4bj0b5q|caCyGOJS9CV+fB(z7%Qx?IaYSBr zyy6OH>X9o3o7XCc7=v#|cn${K#}adO0^m9`K7vl41mCR(z*56fEnL^GIf2Xx+8%p5 z-rBp4381dS@5pq_1H?)S0j`Sxa~iyJo4&J-*jQV@Uk?s~t#-h=pKjw95C=LV20S1o zF`^xT-wJ2@1HOJh^E{Ua*!G(?2B#E{0H$q(Oi4W-o})-K&Gs!MKVT2>@weBWg6o=$ zy!h*Dn-@aD= zKD2?(ut;aQV{C>X#^FTcP0d8pKg$EY0E-6O^F|PE25)edtpt*g#?Tl?rrjRDV+eHO zGCi)2@lT^7%iS{%bY;SpG$5%OM+ClPsS^o{JAA<7RCqRHB}!I;Q&TCd$_H!>*}r14 zSR-z4dLh;BNE~f*pqCLqw(w8872NvAjp4etZOKdjc)0cs)Lwn14LT^G>Ybd3r+l$l zZa+aY9brLBAohY7mtHp&PmWM zA2>wZ9&8GF7bd2N(O!h!U0!Jx{ktDPR-fp2{o+m=X#RBKatF)gDZ^f(KEW~?RiD}M6XBVyYiEH+M{~Gjv)&}|}pbWB2%(f33qTw7?NWleOY$*@j?r-3f z+rf+as1EMt47Z)CnzN?nyG6pO+Ag=(HOROE#CY55vZOtXpoO}<2wx}aHBgPf($gZ` zIPmX?sUN~f?sm1k73c+25;jB2ho{2wy(k#sH?lfq#-xv>>wjPr$u`>`Ob7|MjcHuy z1N8`}x$(t?4X<&G>#fO4`?^`X2a>tUzv>YqC#oKsTQg*ri=4e2_O3S5z_epby4kMj zjjOd0*Q*=o%39R58)K_3h^ZhV``>;}f6A(2c=cQx=$~J- zfzC6~+1{nMd+7ydgW(3psc9t07ykroUY^;CcHm$NPmHpw_ufF`F}TI6vIyH++Y}(a zB`le=D^P6P*dWOoTtI(Mdqy>R%PaK_7AZk&eDiWOoo%h$v6pSJGRCpCb7bpQi*_$! z<_V9fi9mFuj0;*8v%Uf=-E|K2dq%^|TYLc64;G!Nn5|=vZ+vb^zH1n3v1L)?>y9rc z$`qdN$V2Dx5H`uCi9o#1Ddmjc-9yITqm2Amwmls#?9^m~3+hwQud{@Um(3-c;nK4a z=7&78N#?8BLQ@M>8qe??d5$;~8YnW!X1@8^YK>=rV;mXxt*4b> z!s`!8-j=e=@)t*^3vloIB$L1XONOx^S-#Tp$&)|lr@XgH79v7n5uM0QvME=<`)73w zTN}GVEMWozbwe(xBP+o2=BFts0XV|PphL1Bx>T=~eHx|4oH5ww=^Ku@f(AMI6dtWO zKqf7QU5x-W`Bl$?tqZC3g923Bh1am7u`d>PI||7qb#%RPus5B86OSKRn4Tue^YIF2 z7MbdxM*nyM+VB8dkV10g@52_7-iZy{5p;8AlVNX=A#b1=?Z~J|+wI)6q6TDqfeFdu z0ULVtkqkI9J}twCvU8!bP2sr{JwiGlTg-6Q#@GQKw>C$M$F9KLg6`yhBGiio^`Z^) z)64(%19DAW8|Y`;fxh?=4!(LTuHq}(kDT2ey>hW3wh4F&z+~mdcmAf&Gf@*ka|9Tl z_BsE9Q;gYV7Z~n9HiEZOGpcnYZh*e(hZVrm?e80acT4q@qSVRl6HqsdJ8y<8guW~Y zNB;Cm#^EDId?`(GKXzP>3+HdmPqzn|>*y*Qh)sXsTQGj;4;@(^>=Ekl+_8pw3teyd z3vF!c$OrG)YzXCNq$#PJBLtk`$A;Q6((xk}@{L7I^ef=N85x9?=0TMof*pv@gbA5( z><@{mgOeRLmfai^EnSiy5@EBf(Wa7bp`c{?_R$MUItw}sY!S=p)7J;R9Baq|3prNq zj$@1sH1p~AUp=|}sW!W5TaLf`<>m6@U*285){gz%x7tAC2@`U>$EXO9xjUpc*57OM zOfo;Tfp(j85GCi?ul&w{Rx|^C-d8@e4!TnWqAmQN3y<0Oux+A<3^CDuu^4;T zkX&6uVl8MHxmJ5XB{?RZ2=<3ZYG*}fK2+saF|Q{8bet}3>j2FGvc6K+SiKbz+{=?- zRIebBWZgv|Dmsf%96j(`djh?sH!}|!J?ZBg@%?Eq%6WrvuTOF z@s4YTAd4vx(C~9YMgqv$a;^ebPCjBD^=Cq zK0qaQC$zT2$wJR%VEsAMDshS#WNHm;Pim;6;G=ZGq-}I_23TiaK=NBX(GGjqt{H%_aJ3PEXO;A0^9;p*g4JY0Kl6=~ z2Injqegwp{aoCR5fxUik0@~YKUW~?h=%m_~6{IZ|F*p`e0=_`Q*NZ#Q|IQm|Vt#UY zrSbf?YXeQYX;U{&k@FOp`nC$pMQQqzn%m$%5t)=+p~69clV~pvoeLh5Lswx@9h9L0 zP*R#V)ov=Y*leef!C3NAL(xkIdV{zf*mCj|I2UI>10Hh%oerDca0swxGISxRuI9^e zK3J$SbvW@UP!&CDvu;DG3juACMdXG8oH&(LAEfnDE^SDBEjCI5Sll~Lf9z3(WHT% zyUFEEsqs#qg99nYhj3pbFg$!U&h}T3i@u3vL7E{f8ox-G5tE_J{}J3>e(x2JaF8E( zfgk?-?(*X=_!U5Hpt%E0^s?o3%Ik;ftQnMcfNv*J$HRA^d4%IP-9YP=aL@UA3viNS z`rRYXb7afMD{??&1AF`-!-=lsuv=(1(41~75I9b|kATNRtmYj5o|6#Z>lL2tVG@U< zleP+w2Zo+KL7>-SQ*_E>bCO#kLfqj(yH*LjxddqfZlU_ijsP(Z>9XGMYv8$VrA4(E zb@+vA&Ndnf*ydbiXMvk<0@YAn~dBr0B4op zt1W>qzg7Lo|MI_gym(X6e!_m|z#i*}BH&>_bA4t}i}9S%_99++qms2DThsx7Q>e+) z`gI3RNyHu#Hw&uh5`pc_j->)IJ-%Sr<=EkM+7NgV9^A@+s_>Crcl($OK~)S*g8)2} zxp@GvH_lCOca#nY7rNT&e1s3h{`FeE^m5FHdh-Lm=mW4Y>Gn=eYuTV+<3X94!Q~6l zReouIq)3g$Xly8!h3<_ErUBR_0z_}iIheuqLX=>D>+VPrl-N za&t$qJst;%EbXsl>Xb;Pj#d&ny6z*vRM9jf_~f6`wZM`YyX6sg7Wl}lyY|2`vb8~p z7g!g`Bc8{6lB)tT-tYeY<`CB5MI-3G=_=G1c%1};81Br5FDL_das zJTKw)YknMJJwQD*$8IG336C*zrxl%jBkVp_0iTWX8-B@d@Z3G-@e1ikhVL-O7)u+i zfM*wqp}DX#(?E5yA1er-JeSXrzy@G&M2@B*;x);+ROUorzVt=}(Y_G=`>!vTfB795 zlVC?V&p`7C$JgJyy}WyyM>xE$Vb2?AO4;{G8qFo;vuBt8_-7wqzW>RczrUGBV7`6J z*Vx@%zG6%%hrOuNglGczK1*^_XpXL7w>aQS$4M|~HrSBbCnMG&?gd!pC@luuKZ0qR z;8te?dD(xh0(Kif&8Z4~N@W{9z$=ru$}u*lG2I|i&vWYG+d>;mzzzCL0=o4DAN)bz zg7Q<5ZdRto5g-=Ub&aKt%LAr$DzgS63s48njc+0A<+YE5l2~YKf%)#bdEs}YL<&od zg7`D8-4d&9KghcVvdwM4&-m_N!d(;1Ymm@$%r(_3g@Vx@(?s%sn<+tZvjTKc4c9tx zxFwXosZcnVYlj`pv&OMgn%MGxSGTfDD4eNA3J^vfHsKnYI}4~qxu7hoj3K-?77F^d z*$PFy%Q~ul^Izb!=stP&=l_RQG6^KC_M+lpU~8)R9b+lsNz}H>nVthi&2ZRQ^u-s# zf~wb=pq|uX(@?QpS~hCH;pqTb@dg1U-g-@v*0ZAEdfnTEPH7ZfV(KETm*bnkzG&^_ z>Kg$Xo!U{-g2@$a#g3in&}gqH0RHqR5k zd5RzjF)4XV|0IsX1c+#kS+ADB!jZ88vm0C|DPqxcY-~nGIHABCGIW2iLT@%HY_1Ha zOykuH-wQw`2RolmB{6!i#*!=0spAUXN6)l@{#-QrPPCUY@^^egz?b=93I5T*&!kJ% z3$&ETCAx`$169ccwH?S#>j9nu4l)@WF$3jU2deH&>dp9S>VV3-eTO1(IkpjS-^*`g z$(;au;yX_wIMz`Ks6V)n2rF&#EGiqEbx3Z_J@lLi)p_W^ZvjQ`m^D_G@aef$wzr3XXqulbpE{iBp)0_P zUDgHQ>yAhJwY!=Yl9o$l0>0iri`NMWoHj--6JQt~Fb58_{y~tfG3QJCa+KC)cI;NS zw_3m5FnbR$uUo*@bq3K@wkO`sZTt4R0mT0`kXt;WH*K9-`i^7kxE5wAXK2)OT6Bv{ zEW?pYVj5b-sgBN;wsvX~M5i`R?652tBZ8A!db#*bt1@<+WyXjgnY^(KGRoxv%JphcQ{51UfHcU{nObx)^2g#<1vJQH9!f zYN97Uz|kbz2g+L<3RsHIui+;YjPq7DC`BvX)^u_otWe^6PfAhHVMIwNIkF~_J_Fe3 zA_a`~)SV_y!kJiJXd`#E7*i4l<*>2iM>nXS`3FX?f4MM@yp04WU@sOb+XscZqdC)D z6QI#fzGCaIK2w{dN0={k{O!;0w1MWQyhT$x_zp?S>$M};KwS3SfeN#}MsT{za?Lv% zB>xw)WRiab{GR-Wmx9d-5}6$wz<3OZXgi3>c0X*nVS=1fjz~)CLX1yosFN#54wCPY z9Ua@DWW($R(@#3AcQh);jVCeA`hL- z9lYn%b$F93r2gzdmD7L9MiQWAaE^;+_K=gc8D{L5-e-?DkBuTz1l*hHkz@b(4p$hH zC)?DK_NqoD1Q+2*R~6!3;LY+7ET3^h#p4foH`+{)g{5q(d6hOcUCG$WoD(Km`k76% z5Y?aQ!|4k-`GeOy!m&Sy65HSEL+Veof&TTk%EN4+$sG-GJ9V*3m~BTL2=xZ~BWO6!qo=a*g%C>DLHqH2FZ4md zHo&JvFZ61U(_^w6I_5;SWY0hf&I5{A4P-GNJViDXRd1jG0>a64A``#|$R~Qn5!8_+ zjs7e%oG@=$$yg+|nnPbiN6nTLWA0EzryEfg*0aq^L8Ujnyrz%Jblf7j4NjuS4!v@a z4x0jOF-D+WebdJ@853xDBFQGtQ+Zep^sZOoU`1DLL!_Hr&e-~x4fN+4>!bft$A9_7 z-Q_1d18ox1&C=G(3`$Ny*saK4ARtAyU^?ws@nJLIJAb14;)(5%q3-cj*X?f;2HgdL zx-!i(Gz@nof|Y>?qQ$~Ef+&_3fffTX#wUDCBsb_>e#O#4fs)7a&W7q%*nNIcN;T?`QT!V2t_V zOsNCjJM|eY;Z6p3Ik+?2JIdK4=b!i9&LbDL!C||x;R}T@^Bn^%b|s~O$~jAjX;4AB zO@xRoNK?ghV>$3L39z-;^pGM)P-s8dm6(?q>jql}74c7K^oi9%Aj7l!^FFH{da|Mi{`}zy+C*`*S zO+X|4a;&X7pk%b(2P9`EKMJ*d4e~TjXx6^_4Dn$NpmF`Kt+S7t@Y1G~SF9Q@WI_%; zr|Y1@c31mk^3gpvaC(a!&Yu6R2rAW-P#;!6m9WO=Bgr_uod7+Wfi|g5%7gAh-WH8R z6~-q#)?3dXuf?n*V(9JR?{beNXs`{E_2yf&H)6cfe&BmAHOij<#eZTcLn4C0NpqGP z0S?8^B6<)2cUYuNpTZMFxF^d@$f~p8dErxqx&f2cuU8r-I|OV_hx}MUUOd=vvjL=S zv?P-CQE-=w;O|c!iUE^32~fb|v>y=?tJ7+-5!n{c(zJ(?U}QVl+c7oziQKSsQw^wt z(q8POZl^I5m|nI=I>hYU?OhHaqw0&|*jRuN{O~B;uaYHB8^Es$$4?a;rO}1xiyPry=WgoH%B^!NQ^E=&&x8&2DxIb2{? zhvZO4WvQV{Ij;~oiBB8Nk1Xaome2uu5uz2*PU*Qllnfods!d?J3)^w&13k3{rhsSC zO_!ca)$_f`_(CsV{pLyW*9MkB!o2!8uMc|$fhHo%`%&9 z`i`Lvjq!(UG8~|Hk~f_U$n5wW1wj}~{%(QzBj;+AM`w2|Y#OM%)SeS~=%MJ`-hjr5 z$CcD=LjvakqatsJo*KN`OjA0I(Yg)%pR-1ZEoNgr@ zsJ16w;fRy_@ng1d)~RlKuQtGvr%M;a-D;~F+o0vd=D{W4yd#Knj%9O<+;8j#LX|iY zjuBdY3b1fg7tn|MiuEu&rkfntqnf3)W(Icp^D&!Zj^uY68ipVXw*l{27-}v+jKHa_x)|b6nN@J7NF_T522eUsN4QlXYHfX^oL6!qJ=6wbU+Qr z^T(6C@sWz&qZ-Yvmphy~NM0y8Af>Ra!TfgQ9wZ3CQ|mkcW4G-E9FI^oe9PBB|IA+V z84RYtHaIi}=F~@Y104^c@fcMJiapT5z1WMu#Atjcw2ycpiwN;s7CX|dJxp3amP?&HPre*E%s`K#ZTp6IyX&-;J-b1v?=Yq_3*rgVd(ivc;O&E3S` zF5IXX^XGl+`dcip0Z%7>O^%W_v2o^Z zGDdw@*|~^~lz83kN7Q#51e4Z)@GR79epOYIsbzC39gRUY#=d(Y8h101%U$F-)OV)g zO$b?5)i&ay&SC?qLUOn%(QUEdi4gd z#Wiy-bZ{9kFcW>2GvhVpiA4vFwi%rKUV0`!^*X;&cJpPIB?|(Jl!Xc^L z&^b5IK`!sFO*!eK*ku{cf9dv-)oO$+$ zlWItteq`q!{I*D(TX)XDgyyE)03`a}i;aa$aLIbLbXo$+(e1d1QebUJRY1*$UsE`F z{PlAj?Ib5@l_C*px@?#y9n*&Hjj{PUX;5IB@kb76W_d2nqnx@9PFOWaaD`^~S+kz# z!~2t`&;7_9cc6d&p$+uLIl@}ga!9EN6>h^2pid8)PN@?ECXDIz zCw%$h)qIMFc49)_@Pu(?9O7jP>}n^L;*Q>c|v_E@Cf z(+2u_WTYRQyJJl3_m@w#WB&8c*s$T_X*STmcz^lnm)ZchSGf=>4#iZ@IgfAo$Oj9| zPrM5fkIxcGUme;yvA8%!2(~5qjQ=q^ph}G}2tkJ&le=v|KMa+!E_xGz`&G0NGoT)M z+8Tms5~3WEeRhm<26ej}tu8q0tI`OP*_59&z>_va`fHkTnFTN|WR>Ilz zDlg<2oHm7~QV7oTr+~=`` zsNzEff6(2x)8;_^>{)aT>AlB*kqS71479Olbb)dE9x?DSJZjEEziu+3ipU7#RGuW{ zE)xxMKHx}7G=C4ai17J~!AmyKuisz&lsEI~N4^97{_^E--YWOnJgbx5@o@)7Bng`; zm>}Lvn>qo8|yG^ICfP7ua$qpuwo)f=%tA5AqKIzE0n! z$k=&pxCa)fX5U++ZC<#1+{1(B29kO1Go6Z2e067!VQv8GD$ zu;nTk-$RFX=41FCaQjWc}O0IHL0Rhu{*ODbX=c5lEg<_L_QD2{i~>s*xDX?IYjix8~_#BL5!$3 zpU_n76akpd?mZWj2&GNJ-CMh1=QFL9U*D`zu&x?Jf<*7o+Y*VD3onk%k!+>9QC4b4 zH})2Qa!huyd%8DNeCW%&={iXv3lR|E%6P#VeTO*4J5Ct^OLf3;PF^<9_D#fo?i}9? z3->K`@)^2gv2RxegVeENa%_5q#A1p3{n)Mnz0rtE1BG?PgWgSoWtU79#8b1}|K<#D zSF~nLd@^FP`wv~woswjx?F?XJjF^_~47Rzj17RcQs{5UbJF=g?czXF)pX-{ei}+Jr zoVn}FucZCti`*?m*!lOsnT?XbHeFFPZj;8OZ3c1!4IRXm@D(_^wu7Mbwv>!J-Kw-{ zW{#}etaf>*mF*eiVtCM*Woai#;!Xo{bH7Y@!|uy;@%kXAw(6u zx$~H>b&Cl;tT>Mp9GngaJsA!r%7nlMfrXR<9x`wFsyESDJhLgz#@OFxfsTaVsLsOd zO*B00Leqf{Sjv9(_Uvr&4LHmu4EYN^eggf11~WHO{rwl0%Rli;gx|bXf4;rk%?8>=xLVp_eA81NGmQBU zY@pZoKu5*%FDu41-0tJ3=OWrx21Icf9LNBt-YuLmxBpc5kUmXy{;q5?5151X9~&8+ zyH5+qB6E1sp|L9QGzTXtjE|J-(8*^=(6||f=hFwG0OA040mob>fNAP2f#NlIoA@2% z5~H2GCenydD?xC!HnIov0XRdr2V(AZ6n}%uq<^6GgTzisGyT?Ssy>l`lkPfny{#yJ3foZ#NfXq2 zLj0F41@Kn#pJ>7Q-fQ*k^S}7(vGfSQO-2K9(r-Fg12Vp@!~zXM@+@|$?@wD3FsBuP z0;ECeSfpk=8IMAwQjQD^bzE8ARNG$sG91|~o04oC{stO2rbwpi8AzunxYcb=wQ;&O zasuMHT8zbLjBeL4$lTPqzyhIfTR?rDw3AA>fXxW^Sjb2iKn@`ZR82z8^XN9;yxo5C z=_Iy9Bm=vj43JN}Bj>tJJOH5~!q_n8=f&)qRyjD06YdCFfaq8p=uNuiKj zcn((NSvZU@!8ry7J@u$iN2l#DjESUAJYu5)V`O@Fuqu;g%lD42H#*o>n}{D8|A0qs zz{!i{RMH(B$Z|&+TIAWoC|^PtHuM`~v-UD*BOf5Qfh_77Q;g;|fw>IN&m4=y9c9x_9Uwp`ey+C?672;+v1_4u7t&vexl2X}yc z$B(yY8IPiioei{BXUV^m%5x1UZ=gTLNH@?=^da@h?`9cd-rNCv5{72K5iN4}sg5Wh#$+iE+j>k8X9VSKFt3=T&e&50Aj<--(vBGcg0V zVKS?cV*Z{z2z|$w;CHSbhPLAt7F`|Vb%J^bBFXQq(v_h}L?NLF6dN+CuWgCi&G@=* z$zz~Cu%F1r)Zt4!?=8ge7=v~g-Kc!JF|4)wrjkjRJ9GfM#Q-~g#&qt8>LML)ab zN>*VlaMEn zauVM7x1+#Sz6Nb8b0;3dp;WKhnC3Vkp~X-xN=6M#=m}l0ZM)>nKxBaEg-2wVuwa;R zITuVXoY0KV=n@=Fvo>v}6Sv<13v5W(G7T9gg)IKu1-8V@4;Dx09Ly_vfyK3Vhk0K7tz;>^F&5s(F4*L8 z-L)Jh6!t>7qg=Vm~acNteT&I7A zaf0K`t6Vqd0a0Z00q?#o`??1clz_IylT45O^%xSthwW};Uu+PK{|V^$iQf1Y&IX!c z%?GjPqP^7M`TV2H<&QtbKs;jmM_)X-{Pb5(dedx9x;xpD5k>uIz)s1*%pK=`b#2mXQPC3dUTO z&YXBYENk~fmp|a#low9^eZclZ643YnuXE6uMjD4oSY{~@rs)wt9^uubrlKLLu!IN1}}F+i!(RIg*ENCvUm!Jl&G4Ybyl z@8uDWY@oTQ>}Pxe33uQ?vk(v1hjiUqDr)XTaCWIbDY}E=Yk^ST8pnn$?UHvNtVbgr z1`FG?fH-PBx-8PRE52~X5gW*V{NkzaKtFpn^MMmQ&}q8~ zW3O#JVKsBe6lptoa?MnSEevpbRxMzkI@}ABLvS!3IwfxMpbG)G=#*??;QP@E5!eVX zzAo0zg9y~=I!eIZC?0+{NKq8xb$f^JZ?4e6=jJS~$~v1+;e6d2iz#0*malxv(9Gsp zIugo;StZ`BgVp4vnT~60CU>TTJ7O=x!pRDl0A2bVy@FZMFPS)@?LW24wrIN^u+$1B z;jr!*_t*;bj&3U9*{$IGOAEO}fS2PL9ojrB%NuUz82GWaAjQSnTg98W3&`xSQX_`_ z|0|IJ+?rDXP@S>aO#wXEsVXM;dU5?&8))I&fqtPu_}K#+Xnu*%-@@^R=bzvB&!_Jh z46w=V`51@lPyEP>`WTwp?+x^)y6B1U*d6G!FB=-0dIT)HQ+f~R)}|cUo&H*GVgl{D z6H246!B2Yt^=#x~ZI9C02SOtsw;Mj-)^5fXy44SC`{M(`=$*FDc2^6i?T%Xj->!19 zs7~%I!TnGl1k^gwJh#Whnjfa;0Q{{{Vs-{*B^XdZz0u~mF*22?4eF2PbIJlbj7IK| z`mb)LHYyfjT%=94nUUqj5cyD!==Z4J={oiP@~IZA?`h#$zeIQjWDpfa zTLy+@87Do2EZ{6y(Qe}?J=jD9U$#)67lB&NJxuH~Kw~<9z6%;t0{+rScmdTN!ze&m zcESr5JK4-Hf$c{pC!HR1kxgWi8q+#k7@QNGyyG^@c;vQk;hfs3=0P~&FmemSiuzP; zfDN=^7KL759fQyTS1_p0gpd6Lr)$yNK>}Zzivt@&Ktfw$s{Lx z*+6T`Scx}-Grpq}IK3>e{Dyid&2@YnQfX@H{Edji4h$#`;8|3J+aqcF%2ez=Uw;*GRd=P^dzcAddYg4SMH_0klRH@%-LzCx? z`2zaT*-XEa5pSGDgGb2$U<+%MWN_t9Ff6!^2VaRwGzGqMraUa1i$c~GPg5!RyWLeb zuh^<|G4en|ErIRfdvpmU2jm$l<2qs@u0Do0V?d6*1|o#wh+t@qd&Z{9j6(U47`jl` z###W)E-)ioj-YD_No%Ya7=ThhcW-z$j7ft_2*@SLhLQlt516t2EEyp2+&pmS+TU8E zP9P0zpkIjok`1)x*q?kPtG%cxA8eriX*SUB-oDisdFQ*(o~4aPDTMXpxS+~9T`gh}nAfUV}0F}-t)Wey-~fx~fZ|f;LMmqxrUCC{!KlwbEqD34&gGMjRufWz|gO9 zDqsFzGxQ$-=js^era? ztbO1x*%Zsfs&g{l@@$9e5uR|8ANfgp)do3N%|7}=L0N5_L4>gEGRETs%+K5>q=^ymW*T3Odvf6V5*wNc9P)sF05KoqQ;^mbq~(E_8ekVy7Y<5@f!euM zfHL_y&BGhQvc*WBtn3T??rp62u@?C}O##s#I%;~Q-3JUaeJ;CdAmvbn58X2`V`-Xj z4^~@Rx{p-xJ4&`rJ6xr&wmqwfx9nJbN4&|j87#bB-2e0wXqezTY%iDp`s>T(r(Y#@ zr&cd?8J(U!zJer|<0`?7qxuU-R|F<>Bv*dSc1X@ zhUiGD*#pEG`E{{VfjPi?0=?3hky8gIyb7f-(7Aed%r(ZWFU-y2N0f+2j`hMW9Dv?b z6f4p`M{UJR4v6FG0z6H$__Qaj4=u<>BT<|gx1<|JWSHx6#A6-r`AY^b#o;jvQDryK zFO-ANK7N1s6VEXP9JlMcBTZbH$?%Dr4dFCU{rDq zfP9sAqf__UnKZ(nNWu?^V%QP2MXuqHG9#K5Oi=}WI6;F5FP)vaUU#15=>Svcr| z+awomgDZ^9y+MhtB8-2XT&U`yp#!%bPS63->apek>j^4n7ZRj?Mi@RG$<70@3%plQ z>BGJyH)9%WthZig+)gw+J3#8dHQKO1^!ur53pOLy(g5mRw|m|7nuZT0hjDCoI(e;@ z0T;sc6VZ%8Z|dK@s02DLn<%+;y=4@ zQLX~80=1=afPiNZq_ipnp}aY6VS+b+A97LK3t?A?1b?|$&A#TqI^>_!d=K&#m1FQ-<_6Ni7fOP}SsbjjC0ZV=Wb4yXl zavMe{+nKm7FOG&A7bq%(H=ImTu|_<5HW-$ynCv2D@>b8^jgD8#0U zV**!+Nzq&gMt$i|N*5&6(M1Q$x@xbfs#M4H0oxco+rP2P6o*iH#}#$P+DpycKh%Z& z4?a?~ccSnCPQiTn_Q~aEU%tP5t=%DdtTy=;hxqCzcwjEquF{4qE7md%3N?nG`eq7Nl--A{qcrYwH$QpqzeiH;AA{MR#^T!sd1VIk~h zm`#ZPNe>?Q==FP%v4@`TJRmf!7TG7}l6?+zZn-d6NPReQ58Ggw*fh)q)NQQ3J8t-! zs3V3>-*r*Al`bS-_!ugRLep}f{x(?T+K6>17L1zLAbUwU#(7Ib^%bbIXY9NX`hQ8b z$nu2%ec*`1HcozpF4z)U%hxnJb#ItQ7F3q${``1 zvf!5piQ}0*96p!)OYLs?CBi@XRMPE7$^7saPqcy79Q#(|PaEirOKl0Tqe|M}HAEQ` z&Etp3qD^$}K*D{P1t_`)13Ddl`AfN+UiXZ|+0qdE= zsF_Xo5*8G1S$yo=gR#4s1(a5u+6E-YQoKlq%;^FX9zmWcuw&Hmi-e6(0u2+O-1DJ; zo_YsAC! z$2K;zY0j7;6#G?4if9nI$tIb4lww~vLeprob>uEFIKC}q2K7WUgj>Le70I#kXM?fP z3v6$MSa5Yze8m394|VM|shcbsXVj0*hL@Xh5TvOIN)$Y5$maRGucY_lU;njo5rb?D zW7p=4EnG%I;jHdsan#GfV4ogp@Pk{D6UWJu3TkHP-RU0aVmO|aIP&8p5T9bDWUQSo z$DpAb=5;qkyyB-n$B$jt1R|ePVYClyeBi70&==afo*5=W5Lsf<^yIh?W?wbLs-{1X5;hqxSi&FiaBw#cp5DSG zOLsz7!z|+oJo54Z&_a~_Pi-)u*{S$cg(Jz=p)t+jbwdpPRy;qiW}4cBoM_o3hsNT{ zhXV9nXDtw|_Vjiipy$y8K|qm>X5ym8BI`PDp^kq5j9fv_X$XMotPJiSL-pbzbXzc1 ziuod0S~jW`IBV6la|lOSkS7NSUO!ZHRP7`ePLn|Es3{-Wq?jW}{UKoVEhl<=Y?oAk zrKXpJUCdE3=Ewze=n)s!uoJt0Y%>Z`r#~p^s&$hBaGv7;lIgP34K(rbLn{7SL*dUw zfBEe0^7+S4E`R)y^nACP*`W>e&!1d=`sL;F>u*(irwz39-pwtw{E}(>_Agtjowoh# z^6&pl8|Y7F11&XvNae?0Y6HzP(5UO=%_k;_Pe*{pYh_@NANl zX_W|G=has1ffEhabGkozX5}Wd$p63qqb2U6K`# z(!T2DWRC=#3;PO6#im-+_1h8v?->`ifla+VP)B$*1Y8avCxPITgeJ-j6xDW+A#w(e z6 zW>0PQH1QyC|fsv@s>*73C110j^G^G^m!{ z1Vgj$cqg2finMi02{GVS~gOd34C zeNk{FdXH_^-2_-yZ2E<@3`lTw(z1=`Rd6rEr-vP~IQs38y z)Ia2Vpl35o5P$b`o`HUH`RZF;?BBhai}^d3S@RO$zFVqT7ufPIET4qP9iBa>oB{-QI;<4mBF;#!e4DMk?( zj*5!Aa1!x2vN}9eTuZ&V@(mE`RCGcPJWbSW(HJft9a>?0^dhBAwCd=Xs<(A1rQ}zH z2V&z22yQOMozJ)f*}Dy^3w4i!R{1Ib>KQ%k3b9QyCj7!&jb0hPo$1MWIP< z^`+?RgNlR_<@kc;x?qqLWQilv9a`A%*S}dxT;VuPjW)$T&3`Sz>lc^HN4m=M=`;OP zi6BpdMp00KHL`8ULf3-+HO!Sz{JQvAhXp zg1=?su2qf=aA^4sWcngs`6hWOs8}27Z1go^R50$iU=j;<9lwG?qJRz|ks&Yo^phE! zz@UK>8^pGX9J6h?0UQY!YRRK#gxfgPWdU$*Zou=UAU0csJwtBfMTU2-El7Y)DAt7L za*&Lj0HpG7q4Yh1PJj!X^v5iH0BQzUszg5x0+3O)d2EVWXI%3E#vjNR?MA=0o0x+Q z&6_ppY|-?1Zd$}=?go=R@~63?ywlf=1p5{4?^BnZZlGWBSDufb=!lQZFdpG}>PI+! z{muK!o40SIF9RB*+CuxUF8LKfi)Ma1Fwtq3AK`ep|A|nna|4YYce8tg!m2s~)MV#o z1D#FJhCL3iwSQ-bo2BX;g3$Z}n1g3m0W06a9X)RmEEZx)k^?Y_frCfOS;J@9GMpP| z(IZb;{u}2RtSf2VUDW3UCg>_x%VV zJZ@*c7?H`f!uuo$svuik4#xem?b9xut6epa60#Lf$$QQLM6Gj{2pq!>sQeWS(}e^g zqZn{{H2{!U1J(0?e}EAk7F8YmuN=|3Ei~Rn2}pn}5JzgK6hw0Cgho#!78H*KSfns@*=sxe}Ws$yCbckC?1A^2k96?JSZL4n&e`T{sL7f4zNp?;hnz1$(q4Rm8b zF=lP3%UI zi@x3>z~mi%V&F7#A|~%bV?gBE1{8zp{?Ar}1r5=GGHpjBE- zEfi2N_lt94vI^o+X#?;xVr#20aWP*s$#J30GsjOZFIDFmXnyE{1qnIKdD?0Lq@+dt zMLUlU#lU|o=f(HUiYaHv`73!aAn-^)PcJT7c?<*`eQk(UlFB?vfgX1gQqP^^e3ONF z*pt3D*_f3*r($%kAv&}-K%P*-y9qJvcDf@_lRUt4T9C@kqk23gys zHoCD%y{EvM6BszkE3mD+xJcZ}bbY{=KbXzSVllt+b3;x)YTj6$`dIIJcMDnnctz^8 zmY$&o{ULz=u-(9icxTiD69VbHS`NfOa(^gRn=Et0b!+anE+7-lL)dCPh`@KIh5K7A zDAo7K`_89SxHAkR8)w!l=Gs$jpx<9!YXklHM^F8~2IMUHy1V>H8|a_T2KwFI8y#wl zCI`Ugw$4(ag zq3ecxt>t^bZByB<^13rYq3S6{tU9loQUc$_6gb8+&X8$v+D)lkB4?a%Mx0ny`_UV^ z{T?yiLTy-IW$gi;lRD0^S6X7&!o>HO8~a#|5u8p0x!EByTsv3?(j5hi1^0LfLinR=M4>*-t1Dz8Jx5*2%ytaDnsmDK8}Y2hPC z={Z3eU2=-3KPS*NdS^CqXz^2-g)jo^Q%gdIQGC`)b` zK);vQQ5{$^j+;tK``FD;i7&hlgPNGBhnDYr#IG5)aoVTS#SRN*fm=w~P+@FJo;UU* z6*`as=Vzu#FZGv9I^oHr>=T9vy<}m-D^{%fO&I)UK6j=r zwR$ed-&A1-jUZOR)6>B>WcH7$YVno`sRzqt_A#jTLvRH4+n_EGSN>g9hwNDP`i@;GPaXNSQ8o>sL|dx;SGY`SLRs%`(rKTC5gjWVZtK8fG~imd znJ?UEQe_bPVmIJHtw;&ZV-nt2UmIZ6l_02|zaXw4FT#jlt11@s%T}Hon?IpyjA-HN zBOKp-{p|94`w@-|Apa?+DU$`JCb@$WCJz@P^!oj`0XdNcGwLdGNcGucaI~?cJ~pv4K6E zsN|$Gw$ifZW8E3965LU{^_!}4$R=EBu?onJ$Q4gNCkxFJT=-!0xhc#3O#XC&>C~H3 zgekzU`bpr8h!Jptn8k)uO9^-@F}%XUg%pqPMy$9z=%s6>-#V!+Od43KI!;}fNsaaC zJH&LlUU0FO{#=KsIr8Db;!?x{cE}ZSl*W;h2pegBB;|!Coh@4jznPUxD$&*$P$5H( z%N6R9k~$k=ev0_(cTX?hXan%|oA;OByuDn$Q5)GvbC;Tnyni4>Z$>n>4bXxtlmhPh z6Sf#&jAvf7W7g6%&I+{IgxGYfynx}{aqnD~lB7{XhMY#SF<=&fHQh*)gArIURoamd zqUboyNnU}_(gvWiz)5>ZZhBPKVy`lV$^y5#KsVailz^iHAEw?i3!cB`1P=yC1HM8a zirE8P!I>WL>SqL7OUFadw%!Dcc59yh%KA&y>6{*puj)O;-?rN0A7LgIvc3ITDFOpKXV`FW)Q9~GP#&=(6!RD^w3ABK9-$*k71sIZbh|f^=mO1C zAvbtH{0=}OzL=0N6X1wO%sPmrEwzo<$yH%PZCD~A!j&iCRGBFqOQhFy4k>x;$&sg) z>itJ<-++_=`jJs4DXC*fXX2#N`V9HR0uTEtS*|mhCT`nSq4qOpZGnV=5(kv)CVFiH z&fx-Jbu8FAV&$K_TiPvzo+txbDtj~#c_0Z_#zZ4|78vU;D7Q81kk47)*J2HwW56Fg zOwJ2iHmC976_4C`^~#N|e2tyRxdTmr*c~S*PGT`~wa`1mDp`2->hLY@j+3tKAPUcs zbVv>nfPMqL3(g$|78(Ym>%zRm$(YrgD16&^@(4_*kqSRc<2X}c5!zfGLo}|pf1z&E zHvC{Tg6%$= zS`R=$7WBk2sG*;x(>|=UUC241GiKEvLXPfDyd&EPvM$Nb;R8nhdeOzrVruMC7Z}%x zIE<)Z^X9)~lrMdcv#=LEA6TGUYSTG%^5Oc(S)00IfTt>BjtU&UL;00<(%d2Au5`bR z!oEF$qivu~LcQ@#A`Mfxge=b&z6Y7j^EYpw__@sA=wq!n*TT6=_Kj>)@;FBpUuJ+U z7$;VjXa5tEq~7zjdhpdju(~+VY0!a5zmTnN;6n-&>15OboaNujqDk56&Y!@>gi)zo zKy`CCadf~eA!~0C*_Lf8yz%7vi5Jc&i&qXt+Tzq`Cp zJU{q2UuEYtP%ql`5Bw70SC`9|{1f3@eYn#HJZ1u8-*-rHq*Ed%Hs*wyLY&$_|NCA|CNYhVEKW(PY(mmT-UNSi3!f|(1(jHnGBhXG@( zJF~8EI2}R|XBXfKdLmd=V~#!qTxDJ{576*_Cg>H6jx*cT%b>^I$Zj>Ahe%JkI_4qM zf8^8avl#H))i)&;I3Q7{8T|3kcHm>va_Ltp&;gGL%2aehc;tk3PiTS;vX^}Z&1(a( zsJVeG^ezfO%%y~{m&Z8u102SvRRuWJi>$h!_(?nAmY%v|fa>w2aU*hMkG^Hr?uPSeJ&HntOyUQmppI@H5;2CHe zY|=0@mIos^HV(Fk5zK6T+b%1&hxKziklyZO&CLAQ~{xOpMA}r=Z)0=-@$BM$Z?!p%uo=*dyN9 zFWBCpH0DjuA~!J%4LtFs;(m4T1?7TK3z)A$C%c$B(6W$frW1Z+A?J#&F(i8XH8tf| z388gdnA0ooy@7u5?CIt6kF}B3h2CN5&_34^u_kTV^-p07u;N8kRVXxV+_+rxLIoC( zz*wh4tIF+F-wXpUt&4#BUVSZ?x(AjRNz=+JDAYoT71YC*D}6CGiVDG0utk zq8Lr%1emGH2zC~jeD4QS0)!WAAZ>76<3?6D#^P;5e2q_|&TyGfvHsB1Mm=+FL34%x)vFCOzWo%T zbvd5uL+J}GcKn~g>*p6g|NMI|iMJVM1ATY-=~quKU%lZGj<-6*^IVw?hEDio#v#vU zgNXJ9`uHAb$$YDe-}x;Z#GE_cz-|ky&>n|#+yUp9IXBb5;~Qwk!szP&%UDPZ)EYsoaH z@?O&q9z)l|t);xd?wCZjvD&sVVrhm`Hw=QLZ-5LCKmCdiu0f6)n&~McqY>#3<-&da zzz1B7O$#y3BFtEwx20IeamnV^JR6~mg-x2i#Lmztxx2dlqEK1A&Yq!eYkGTgIV@sj z%&xJEK5+Dl8%VvSfbeW$RJNyq+Nqz7J_=O6Mhlks! z)r2-CT_?x8m*@p-A{QIc959VC(gq=w@&@m=gAG}dMo5r6c9UG3G0v~$_1R-$B_BM# z@#(9lmyfi0e)I0><@aClt7&(a|MvBh%Qv``e#R=_CZLNnA<(yS$hQl;(7{)9y^tV0 zp8I5iI+O{(cQ2F}FQoFzH)|Lqh=?B{^jP$;s0{1DKzLYFx*T;EVwda7I*GA+wiuWGoc0QYbz7EkvW< zfir@w107koU|69>-D3=~Ijd^aesqeAN+Hc1>u#^{5tk2*pIF>5L&~}?IbpM*Ws!>@ zV|A(TJXoZ3^(t+#>{m98)pueKareW=P4wE*#5tip}X9vv#(|E91exrY6+Bo z*!d6;;i(>+YhNl}i`Dj+t0c?^0wVs(4C*yyhwzY3!vC`21%r3Y;u2yz|Mx$W_bIB@9WqS zZ^1s3)B)*8z&{#exeNy9x2uL}vg+Op1s3AII8kpqFycO;5*lso1rl}3kDvbccVNfr zKBY@h;O?BM?gf?61x%MtH@%z-+xE06j??~oK-{vYhD`_yw#{j)DWx`+*sLxkZShj? z5)HB?4OO!6>0-=olTsCUTxbc8JIdT0V-w9Ll|TD_|D*T*@7w?S8=hlMoVq4o-j59; z;M+9Vh&K?@!nb&khu5mJp?(dn^2PJ_I-Z!%CL7r`mK3yO#fWTS&Uc)ZM11=5qlkQM z-8*f%nb_KAC{}(Dg=a>2zM4%n8wlum#u~dhVw1j5&2^7^*W4VT4#*|65L@hdmPnyf z=Wy1iEs>!mwwnQE$^ve`7;pwmoiQDAyDZO8z8IYloIHjUA2a}!ng%4|xh>*(@d46$ z#7~8QZ4!UQ5f#o2g|tf~^-u2z`8%jBo)=(QULy}=>W(qNtcJz|G~kdY4%d_U73-+s z))xTvEipK~&W{-u1)4T45LirqK|gZ$0Z6XU0}q8cp0yw&z+tGy^Mrlg7uqvzp!xA2 zzUAfr5nt8xl zzI+GzJDLkhuqfU@|ARK=JT3*~$0SgTU$mVnm^aXz+}>UOe+%&%a2o~^0~EDK@q20t z9(GOC09t4C(Jyv#ssVMf;q#8BuqBaA&ooQXVMK$YNvvhL;M6)}kp?&zou*O4w(CYy zfL9Nx1se_bOM%!=CdJqdP8s?B*V*?&? z;I^rn8;_%Ej~$0t-WVE+E99nmm^q7P=lMAX@dMo-d`0rwGvJN!%oFBh*RI4H9C!Xv zB0#u(Y!mUt1@Q<;E|=~C>KtS0v;iOr`yn_@2SjnKIuxtF(p6xYD??{Mh^kd;r`tPi zHHdw6Ltz-x8?KiI&|OZi5PyB04D>Jb+^qWiHIHy;1O581{zg8fYF{xxhXAcR5R6UI zJQk3TZ?%(!Q37SOO$VHT8XsMN4s)N2<~uR?1DrfL^@NKB$2sI%=zywetQ>9(3~T6# zeUfRL4A7xtUvj+&(!NNeX_6oTjQ9d@hPfAtNd&g`W_WiVK*}|PP}dX1=yT6 z0=0sTl1+0^(^(_s_KdxyhYw_>%!G0V%p7A5F40;{h;{U$6_FArjW}Y516`7(wZo8$ zCs5B3z;)~lBR+N~PwK*(eknla;8fg))V)y#SBVYQ7%rH;vn!l-=jXR2B*-UC?j}bb zH~e@C|K!J?Za#f^@qgd?p8&lf&1RX6YQ9Qv@`ZiTvFk+{qQH+|IB_D%7e6ojk@C-t zH+`VJyw(Qdwdmk4UvOv>FCOvmPmQShZngBi87B6&Lx%B*KfcvNWXJtZTLrJFW@EsU}>OjdLx_Q=I9)-o&h z+=z$K>mZ@vpkZsn9iYah%n=|Hb%8mXRvU$3-@=Y)8M=m&Wed5rMgopcBJ|I(cGTXj zP0!0A!DFq6Ifyq#2dGsEDo2`f*s{3nfsileP0a}yo5ynEc>7`Mci%`m;$?PRPEc$h z6p@&v^H-RbPqlI8(!^hPJ`v%MKE1nq^ny#3M~*n!K>zA;`Mp>U54-GDo8dl1oV(!x6tu=IRwZjF46RGVR&UCc?S*9^ ze}*;{3S`T z-jHW6nl&U`=L{1X`^FD&yY;f{!NNzr96)?u;PPRg_2wPVK!5x`cc5SWuYV(v>(;s> zP8x=Z1$&^=aanq1@npm>F$#&@a5mMrqPtp@g~oh%J6Sr$3 zo~ubp5ha3G?uZZ%Is+I{!u;IJB2)mJT1t8KD-fG)Uu`-yr+op@(LY{X#5=9qww0(i zzh;abDuFCm)fOK$szb7*+Ja1CJz-)!a@;#aUMvJGxDF*@KG>Gn;S7Wsob#?1!v@f} zx4B#tA?)#&S=l@#fD{1jM}pX)LH40j=;3o>Gs9e@?z;%^M+RWp;fEYR;b2jHOPn$0 zyT$yl3V%9gBg#JmX5*?-#;}1+PVo>(p9&!`{7uq{iA9{pGx&*YCz9Q(Gw{TZfbb0k zFSUDqu3hx&=X_(q6K}9zh{g|4JXala9@~l)7kH!#xqHASpXJ1hzL>sa%^^1_v!Nz( z|7w-_xk#)J8nQ?(oKNaWS(>AAwU78!189ZE1qT7oRHK$2@R02*ev`{MbUx7^ z`!Q#rzq0K^KjUt1163oT0Ho1f?16Sc!JALfEb6hurYm;93vTb&is_tdK4B+9-wZY_ zhPfU+M|K|J_(-1+KYf0={L#mEmzR7}lpes!_cLvvfA(u_puc&q&9BBX|0MAKT^{35 z>0E1|W^SV)AKHxLp1hzTIxGIRCcF8}}lvPnciRGTD#acIQ#jZa)6fR(q)=w)Nf${eAt z{ZwFCKGng4P@-R>9%Ga`5w*R-zk%>n(pI&ZwYMp#cw2qe@z=YYv*$gGQI2#wQAK0L z7kF>_8AcEK$#YF{F|QYoo<)A*1owPLeq>7rys5?>p8`%?)X>%d2nYy( zo8Sk)BSje0{hjOqKvx$y0{{Ri_@MxffuU32MIZqkKnR8jzz;wm@ke|Xf#fe?29Tzm zK;f4#B^VxwbOMNep$ACk)1Q4$1+V}Bt@AQFKmz^_(g1GYbr}0H7$ODFqvHsHBLt2R zI6~kEfg=R|uSCGe$<5Z?&zno%(cQYCwN#F=W!;AJvf-^M9ql9u@isfg=Qt5I92M2!THk_^ak2E-(Fy=J9WF z0B{ZP1#AEpzz*;NxBw%-3j7ahCZKLYK=_-kaU8U^oCJu$IM9MZ+e^UqNBAp&;BPdb zjpi7^@75ODsbj}}53>pVmZ_V+rvGl|0SNG4@uPqmKzjT*$#G&*5)u+JGE#C%1}aJl z3QATwdKw0flMqghlkDtVe4+weJi@%}?1JY`3yVugOG`rpqGFNcX6Kgt=>y*g(2@dgLCuPQ8#qQwKuAk~Zv`M=E{Q?Q)OX|5ZwJ9KLL%bh zB&1~I6d*yx39!V3gvW>oiHV6oGZR5D_&Y#EOH9Wtp?aL&z>0*&lR@%s;&W2o^QBFU zSNc$VQr2E!WaLcDEUYK_PYDQ~J|iu2_MEJoyxIkI4NWcWi&w81UN^d7Y+_?;XYb(X z$hd)6_r)*s%x5CTHD$? zI^TcjANc%baOmss2y%L6c5Z%QacLR7xwXBs`wg?V|Giw_%lZ59Yr+0jE?Tf$$B2js ziAcVei{O|acoNbQ5pzo%r&Bc`vGSznk-SUFa6a*QX%iW*)D;w?wO1cG6Q4AaAN{>( zzm)7hSFo`EPbK@KV1Jft1fV1&03RM9EdT|!>sj4=MI=OvH;RM4C8HCqD6pdrc0Th>6f(KBi z@jyF#6%Xu({LV`5@f{7wFdo=GgyDg^dN}DHIDKpx5y$o5f&AaHlJi$a3HF?Qk$)}8 z4}84EcjJD{=MRk1BFn9Q%;#S@v42#`q4^=7KeGB?rpSh$vr>9=tE=ztAAF3FT&Y1u zb?$zW5h{IExvHBTS`(lT9Gmt4pHp$kb+NVhxqG|F5h)%<>U<)INt)ZGDhKH&qE(PI zc}0lhUdB25?sm@W(cxY?Vr16J=^XldO@3>1Jo#uJjKJm^L`-;x=4vem{ zH&vgDFNN<|U=lF%25=bLzm|GkK5o8w#un-vsqp?*R!>%kWgwv2z`dFJSh43pV%^P~ z*p__H$%^X-0#SVSPo^E!_+EFOn7VgNQp0mB@=%b_Mk{IARgS;*R_!K2bTTzdb}ik3 zqb#Ogg_r>__?NFMoT@X*p9$bEj4e#ZH{NxfSKZWa2)er%98zE7Qy{;94c$Pj#KO*a zj=jWcnL}`jrnm+HJkVESw3vc~Mv(!w>A{Y!?K!n3yeK&ijAonL8`{c2JfS%G%??HuX{4eS{Um)_mi zJ%0iI@nKgQ+q~HZYmZ4;z_h}FScS1tE6nl!Z2Q}&RO*HsAzmu%>7G}#7K7AZkCCpo zsJtO5zkW|ZWIkfNr_%qWWt$P2_?cbU?IgLe;cP7WAytIH(A{(#13_)h#Kgp?S?as6 zTLg1Dv?NK?sz71~PB>H&Vv87o6V5Xm<*7Yk9hPjXNXcAxZ2zIVdct-Uobr>-?7u&fB=#TjjlRIsQN3!eJLij}Ccz{y`4_MOUfyJSMZ5@x)*5;TC5&tgOe@fr=kZL@@ zrLeI-J^3Ns?+lcVSrZSyneaeKG}vUid>OieetZ9nRwHi(-55VwDw%ntEtflOHtF_Q zX~&!d-9y(b`abWl;h7DZi&fMG!2!V>b=)(CzS`zlyd(=_$2AnF1HH8pM-uX2$8&_w zF3+X1@tjC1eD^;1>*^hcs(OQ(AsIHIuiS~ViK7bHrmzMg^>2g;wf7}5#svx9xX5om z=-|Dea@~Aoj(+~wly4)BJ|jGj9uuw~Z72ARa><=`v*Ck(Vre?Zv*Q6PLnEPFu{VYY z`P$_&oNSEF&eJhMeHOyu8-m#7?Z6iWf{(H#6~%KplVlnO&W=AOvWZKv>h;MYlc~RI zTwYgqz`*}Jg6qs#U(t^oW#QjcNPv@hrw|1lB88V!-aUkjMNtoO8sBV+Vo#EQyFCQ< zcGj*;BXLa(8ER&Q2A!^7gCd?2O(l#@mgHBcAJ!K~R7;(=q3xNA(2CX4xIszvcoqoE zs8j0C$UJ<~J~h4z~usk>s0R?_4n?o+Mc#Y}D1zrFtyN3H+Chid^&3ER!9BIM94vobWWK)GspgvV8(nXYH)>oq zWGzfrtEmZQU3V3CvMAt%&b3~8nk zrp*JbE!kVNn^WEiMHqbo(TbOc+0(*`2Bw#+Q|7EE-xH^jOZu~^&R|~GcSQO6+<0z! z``{|GHF2#gDYtOGY=@{s+(HH5&a;^7WOd3p`w%g?{ucE)OpTl9dNvH_tCXsdxuEdVbI}XqZ>+rM5f@X9>yq{Q#N4^bZNr!n z)qFZxvrX?coC+|)iUhmhf{S1q$)M)aJU9qj7#YCrL1(lQVMrGj%dIsRJP?$LF1dv2 z&Ocj*>{2@KYnWnZ-4y823cGlMjdr*$vGD#|#Cmq2e)IK3hAVvk=qM<1@IXf_Y^W8~EoGKz7+{?RukpZ8Vdg&BFHg!} zG%Eg7wRJ3|RN19ab%|!E65B}CsqzO-fh~Bz-s!nb{WS-wt+uVh&pQ^A7cZn)oQlpu zGtRoZy54F^6(419M+h#u3Cv^FnTWtV3RavF7%q7ET#SdATw9l3|UA~byLwNVAjr2Vo zJDHA==l88!1Ngtuwm5JEcgVc@r@BLMcN(%s<_O!_62L_#y?C*EdNmB}LH@3saM#f9 zJ-Oixe-h9`!h7hlt+WjN8yHm%J%eteO5 zB`6+Aj0No7xK=gJTg@BS&-ea|Ls`w|`6ta}Tou-5)p<9B8aF1>hpI3XxC_BjhaGsJ zcO+Dvv9?BQP|A+&o+3nnb$d+@*I$PRvVvgW4)8$Hwbk*iprSF$HHDr%6dd<`?6C6^ zHvm#(l7gc9{n{j!`_A*je1GbYCdlFUh?OgNz}W&1^u)oweZMYJe*hA^x`PLlCBS+D zjy5VFBdLh3ncv6_Y&jQUKP1rH&D+3Y!2E%Oi~Y~WBsD+M|Hz9;bv^P2`X71y|90+eMci=pY1iEY0q1z_osCjM}oe-j7;bpMMaRvCT8RO#)WH8WSawHq0SY_2vl zR!EN)1eyi9u>d}Zdei17!R^V&ST?r2V~&R55psmWdOKNE+>8g zjt7)nVH=~c_`imkfK3^iy%n%U4H?Bc{x$rDB=IGz$JFv*cXCGa&!Bp!V!RqIa0HZ< zN^sQr!-X)xtTSY5a0qu;h3WfC@aBJ55CS%tF=nPEsm3lL#yy5G@!b6b!`I(6*s`6T zJ%UNt5EJg&Otk^#K@Ak^Uv(IyhX-;jO8P{aE$PWm(=l*9B;feCX$smQrszK8MRoUH zrU)T?5>WvWbr<2&P6gKag7##aXI`;nk#D>nmyP1dy%ST)oB8nm%*rONd|@!()Kffy zg*L;qUuj`)I+Q=z;89_oZ+zX?{2OUDKuY&Od+?K&4bNZYt$KK9ja-zBdvGC=vx8ia z&`7J+WlhmcqI-#*TB6aKWbw?-_x|{M|M~lu0XQ0m7eMxxC-(`jJ^Vh{`bV?k1H+)* z_c58E5>s#aOOpyV!-84IqhDMb-u1aDdvFN5sCV`xge#V7*r%8F2s`3SUr&G7p`V2cX!4l0z(*T%TY!4G%1g!+sH4csZC-88j7uV*VKj zegWJ2W_hspJp*e}pm5iKa?pdT03c48xZoii4z~01zj_k_$_d}Lwle99vGgedA%U+r zGj^2zP1%wD3wn+Qzl(%EvEG`3$ZDpe%7;-cMep*PTjG4u-PU-{PyQ>V35j;2!#p<7dXOC|x93B~7k3tA&&=Jf_u5x`r%ba4P6t{K3)I)62U@=AP%t}AsKlM1(|Ui61$+Jt)+rVlndB+_ z@-b=DOS5NL%wsuU*DXK5oogvZ`6`*9G!{(9oCvM?)VLmmspykK3?As2h$@~%!aRvC zwNc*O7_IP2A$;E1w6vyKVIH}b?US%FICj63ML|l@@Iq8jq(Eq$a+5Yc}>_5i0 ze;f1uzi2UEx)>`SJ)DZ*`$aQ$P}uFt+*`*3&mgzJL1D(mUO%7mus7IJPHyF_r9!vH z!6q5_XH0a(b>pBHb*-7>lHPk)Q}rKp(=C<)>?A!T&$CDl-!9HR<(-DZ<9%SqFAK*l)1zP?}0`YH}kAbVBr|9JMNulIj_J3k?c7-KMxlv;=3hrw0RQudBMJ|6O7 zVs74|R<`cecA_@!u44XH9%2%r;$naz)ZfDjTvg=5Wo_r+7ec=?)5po@*1tpHS+id@lO-rv>3)y~I?%ir~uo435b63;K(<-zdx zXfYmTMK4=>`70MRexm@dlz4v2i=UsLsGpRmyO)EQgq)n5n7E{vq@)N)A>tk2=40hA z;^xi!8-ojW-ZoxN9zIU)Zd~6PT3NgM`Y7@E`a0Rl+gsVoSlimlh*(=m*@{R=*jkBL z*-A->*h)#+o|BP~m9&?z=K1aRwl;s<-NV=G)-U(AwGp$sW#?+==Hm^bAtA;i_G_m9 zyY2}>^v6yA6@IXcAdS45mz|Z5-39Pe{yxzvA}%E&C4Nofx5-ygaT!@fvA@y%naC;MA|8*k5n_Pb7Yc0VNnr_lLZLDY^a!97i|#DUgrgI)dw`5cnzL zBk4MV>!%R-DdHpPI)dw`5cnzLBk4MV>!%R-DdHpPI)dw`5cnzLBk4MV>!%R-DdHpP zI)dw`5cnzLBk4MV>!%R-DdHpPI)dw`5cnzLBk4MV>!%R-DdHpPI)dw`5cnzLBk4MV z>!%R-DdHpPI)dw`5cnzLBk4MV>!%R-DdHpPI)dw`5cnzLBk4MV>!%R-DdHpPI)dw` z5cnzLBk4MV>!%R-DdHpPI)dw`5cnzLBkB4d4%eUW%-FesFUt6VZ^ZoKk&f`#vG0H2 zK?MF0lYaN@ModmZa-5WsoRX4)oPvUin(hP@H7zv-#R;YpwDb&&jEs~t%q&a{EOZQv z48M4!BLveB5t9)UlQB?HP%-@U@ry?~0w_TjApy^kM>?S5e|wK~2fQs%WUv=@x@bBPXD9y}$G zBcicV(i^OC5H;l==6G~!=|i76vmS5Cfo2xdmOS zCH8I3kCz1_B?*e>vi3->qK~KM3!`Em$B)nIN8WqSeqO~qRA^q8+}7jdjdrhA0qQM_fh)Llvzm{d>OBLdU$cDv#F$@A=RPg1hj2)wR6g z;LiDmKC}%kk_Pnh@!JDb{(D3%62jr{K7Bk>^f}V~#FE9Sf$3*O7Au;|)!^D8*`?}W$3HUP@^`8Dr{TPm!mwT>5`yIyMeNyW{&;Dw%Wy~YkZZSpwPDt4(h*aN z2h<|(!B7uDZwPabAb*eWl{Pra^)lmr|!iaUQc#HoL877B_m=cd;z+bxK74n0?A zzwmsn5K(p#=JMxGUL6`36)JRFH}Yy`30r%w_!)Kxn=?j~O=6R4OAc7Ds-Sn%rz3sJ z&PKtXs;igYSCm;MMj#DG(ah7m+h`61E^T{crRVBSu_oyHYtsNHf(O2KxZ{Br!Dnk` zJ|8-}xI@(USdB0^18i7>4`w0nBOYJ`od!^<)9cuw&vuV$*Iuce*<5uCTIuYR8yWc8 z;}!aCGdQ#)dvSLy&IYnj!m8u}>~xdJp*LC(^e%x$_v=(&wfM;teY-o?*TA9aEA41j zC!f^eE9pk!txHr{H+9&r$;(?%fr&sL>$o>04HHz1wfj6V zN&RXeEqu83Y1P^p@<)?tY)kR2#|XF}YVfU$y>1Vs(@-8sHYXsyan^GHvM>NZn3nJW zgACgS{Za!T>Koh!lR9nc9%-_MP3c|QU4LReqnE4D`o@&c%j$+3Q$JI>E5WF+P)QZ$ zeQ;LC>lJx{HX4la#PMG1fgKJ@Q;8d0vpGF{eja3NBK^E?>8g}(7)Y|*pC3IFvmfg; zTwbaaxRoA9-y_$7@J^pkjcDw^Tw5bp(nJ!Uu}c_jL#h44&tvirq?gZ~+^sEok6alQ z8r3;;xqgSaM(et^jZ@b!ce!IXg@VnMxvjMwPD^*#muD`U~g0#v*vv+ zE=X=_FG$aMLIB3;ynj0zT&>=CY7RSy|bG z_R3uyUf#=n_tdR7S!TKv&Yne{4^v&d<_f?>9|GkDpzn|WhLaIKL$j)fQLnJXXe)!> zxJbVZ=N|a&ru3BUDd;^#z`Ek!bq8;?3t1OTI_=ivRaezl+}}Lbi8E|=H}4$nokBnI zVBu`L7I%UQ2a(KQ;3At)tu8sVhmUo-F?3de-%%J1iXo>D_=nuqeAw zM9^!ALu?jK4sYPJ$A=E%LbyP`&Y#wtV4!d3NA|cL*yiPR#HtON1ef9Nk_~Cvd**>- zK(r!GS^Hb!E}m;c9I$}iMz(ui44DLG7I`T%ayRe>S`N9WHHZ+G53u9%aE?{h;6^< zZ_d{(&O{nWXo(wg%0!b2BvxxApi+x8yo(;SD0 zw|J4VZ<28N9ZGf1R8T#VUFuf0f#>fm^^hc_0fIRhmszN*t>S2|E^Rz9&t<0#?_pVh zFO0r$BoNHCr}#WY+wR}o+>DM?zf2-Dp83xgjC2+{(A=yDR%$*%4eziB{4 zwtVvHYN@i;WAJZ)l2|Ma4HTX`sXMgM+SXhUO|DeULgYqCt$7jn79-TOQ!-Mkhw53A zfi$~XswI8+;Bv=`IXdLa0-5dz;?<5K7#K z0|)G>WM|so+BG)i_q(PV@47!lew?gwH*ELrxd?2Z5&Z66_rG>7LjJAC?FZe5fo;sE z!wfty`)nNcwPTv*P;p}D0yKO}9*I2-iw?Q81rH5eLqr!h@GjqevORIC@*SGNPDbac zm8*1?Q()k+)W)BE60^`s-X|XygG{dhRlzm zH|_Pg(^(-qg8U!`l>H-AI##-}4~rm{Nw2x%lvPrCZSF=IF-X*UTW0|9dKM1G&L1SY4&gz8(%Xl4v2e+6p1INvXS!a3F^`)h2N z%7gZGwU2Fl6cy|*$t9~h(b1qgKa<0R?cn3{yYo%L4QJG{hh<*mesj+^eNpgMIt&>q zxu-T~OrCyE?QXkrJ6dyf2DR00l9K##Igk(!I69@Aexd5?^wQi^YcTp7*Q1<=tU2u1 zBsUVzP9eu;JLyCK^((KSH`-Q1bR;#Xz_B`LC?>T8YS~=x<@AS!_`u$47Xy~<-Oqy~C z9VWlUg7MXaI0>&wJV;ZAw?O)#7xfCWdCF zUay0Bv-7>{sk8w1oJk839)+~dhsJL@=~%VI;vk4b6;5B|!7~>#4DZ2d49|d0<)Du) zOb?N9pj|h}*YCQ+Toqx$79fxyN8QYyWGQ6NClTt;=CTMM9zyEHDxbs*w4Ia0*l3~7 zg~|}(A$7NU%5oT?VmUn11f^DV&l`1d zP=8ZN_f`x2xP*~<&no4t(Rq$Zm*>};zBR6eaANsTh~_V#Kf-%nAErlKre91iZ{ntR zr*-pU?2TvrxPv;l9Dq`3g89jE#(XRnjJ|;ld!zF3Q^V7c3AQ0yVFG#AtwMvk$b(X| zJ*u^aOG62mTJtYr4XiNcw88Pr zl$ZUE-kM>+YfOG)>Lleh4aM@4%F^l4>!q<*Oqt~EpRzqj8q_4GJCV3DE9HplaZ-1NV$8|hl5OE#j-F7i)fVnx-7zRV}ys5 z@0jOn$G2~jH1wCwt{?p@Fe`3ltGfPLutP%6{?Wx$L3-3?py zXCzSJ=l5lo+JGR?pAtzl)GjmPw$AP89s^7tJI`jjSA4~eOXh?+&kP9>qg9U_htS3b zIR>hRQcjVcq;ae~$(i}C*5rn%utZrYf7&CJF>Su20KO#cQ`I8S-8&dq9>($lYON%4 za8jesw;atFk!y7IbyG;0bhEzSI`5s*udP{~ER7`>IDl=IEE+iWTs~H(;jj?u=vYTk z=x?b}3RBS9z&B8++fX*GS(R*9z4ff2 zx3`%)YSsQstqnnlA?tF$CxO@o$fB}*vTCqbqos1htCm71L_-oc@t6)zhrs%<-_477 zK*;WL00Y6+ivrY;7N-6{C&&*~{ElVV5@ULv)5n2s^ux)e>?gcf(FDd0SZaw)`yzsN zCzAo!p9v`P&PbB9x|1wF+0879U^g#tl4QHH%@I^Rvj;lI`#cqMK&Xde3eUw1-9WqM z#i~tHSxivqj3O1E=HBPPT_GATy}cLTsek#hm-zAPWhnQi2`^IZ=UFlJ2dqMCcx`j(*Hl

fHc7fbyy6v=erBE|Jum`wyq`Ef^)l|f8HcN z&{S&!iGpr#-7&HJx9)c_5*6ZL28|Fyi@krG!3-veN4w+N6<~)_P8EY0`737d2(V+$ z!J6WM(ge^|=%syE-;P)N{RK7KmWhlwnI%Z4V0KL7!tdI_iMTk=J%_!1bR2E+N+>LI zb4eZat`DABYjPYRxen=D3GddHl2^1F8#zdh#egpR|NBqsyP(f$oZ-_0B|Pw60kp7{ z!doHx0rf><|E5&?s9~T|#gOJyOzP}MCP7Afc9CaS!m@S@*M-|sRV1J_fTPfO_UMBr@qV6t)D+bt|+bf+Ma3bNd;R_*Y5S)1> zYa!RUkr@&gQn3}E+2PKCDZrgrp`sI`Hg=W=b#_Iy?E1CC!U0tm_xw*@+-cUvk8+cl zRvwKJ*yB!UC>c#h#{0sE{4Fo*icSm}pp}bY?m5PXS$o&tdrGwEa8cgSJb6F$ru*a9 zS)K?FU|qu$pn1I8qqpfjpd`4kEi9FoxN;a!@(jm?bw+PAo0D`@){J28w4R)RBL}8M z1oQ`17s@K$8E{2B&lq3l_fU&yDa;jr6kZ;f%QjU&p~xl)a&Vkk0~cZnu2GJqPG>JfPUWCd(IRQx$SAa~8%awBQPvPRW~&harnzRAu|$ zhS9>BEsHR23;G9SLN5G8&sHd6#k);tq}7<_#wLYo9AusQP#vv$Q4rKq|9&ddR!+(< zK>|o!xrF?J;&{(oO{OgUiAQ|! zdt{>%9j@INpHmZK{yew41?>Lt0ELX=h^&r`(n%oXKT-($^iI54|&GevS**6VgduOx}Y6f6O9qC!NVQCV;( z2i5QI-8wR}=;c(&G?4eDVM##Cfxdh-())aE_GW{nlmey=2xhCA=Q?%+M%oU`B&^g6 zNqerbI+GYT>$4!cP<0v87U0+3!|9*XY?9hC&f6TFbBJgiLHFmq8x)yKVsngm_Nn7B zEeFNha@OGo>_N53p1zxSfF-1F;%uL95ACqiNi~-%{#Uea6-yuJ5v`p2RAN>rq3t8G zo+U<{GWRf>@4huD@rN)fAXr6QmFvDmnpuWFMR*A^y8H@}`?5DlbWoAgk*{o-flabxn%|_PhG7Z)cJ^KN+uldMlgJ)W+RKNJsI7 zcGSV;#S^b#1!Es_2^Y&YAF$0SMS5RsaiRSjrb*b6D@4dlg0~^rXcdCYHoU57ccxW8S;4q9_0fYF6bD^jNEZ7 zSGwMzR#VNK$QOrx-Q1Q!qRs1=8D{XFpPHq>CyU1PpaWP)r-9+BE(dz+PKeW7+9nDO zbQr=u*?a3^8RZ9o1WCEL7Ww;P)dlVr+tv<>O5cerzlQ6LBoJ;JdTds}le`N@-fmYm z@I*L@omhcVV%Z8!mjjt2>vRiRe0M)7Nh_(fUe%VSW69eTUL8Iq9uPB^uW-*lUdu)R zfLu5nY&w+B&}t+h+DaH-oFSRN((;D4*fSw`Ylx%XWp12s+9;txAm|c?t=P$AJmGFO zCbhZd{wqJ^o^Y{)`O>KjehsKolmcA5@Cpka@IB~B(ZyKWqlXf9#ExUO8gIKYmS->z z6&Fi)6@(SqhpjgEkG!o(C!Ku%${Z zu`xP=^+-7EGHFlH)+mudmoanSo}=5ia`uGqgyETV`nU`Q&clM)$-6jNbje+1 z4$QHAt86oW9YeI?MAS&&NY7z*hVRaFhga$`^W44X-ZaVIC_=WNBEG#Ly(Wba)^ZVo z9T8qj)O^#nJ|?ck9jb7d zMs3l%KNSH&2Lu8EA1r)?aP&!dRQ1?Qfr*(0H+b zN7n5^yS>4|mq_s_Q?6PPqBSZsNqb3DFNV`SD$rJ$g_HiNMWpWAJ~7u*Nf?u}St%OG z;_EXX9PCA>`J;%gUolUkR#8swnCM{(MENhUC`XP&?BO;(1_tFQ;y6ls1{k-*;$Tkh zjK-jD?%XsrPM={ZO3_6Vcs%2G?Vr*s4cY>ED{Wh>(1yu79kFW{! zW+3$PmoA@K9=#~;=FhdO2ruC+mXARd^u$}78B{b3$ng)H)Y#mC&}$>dnXfd&7;_)% z|MKFqXuf*lrA8h0UcNInU0n8dM2VLVW{lz#IbM(XJD7!^|147rJ>ehHRzbn0?Yg#J zSiu&~{Fp1?S$5j(i@B_}B-RbbZ->%kk)SfN@PJ>Ed`R#ehdj}NMZJTp%$Bi3s5}Z5 zlgX*5J@rg&`dM+ZRla!-GMM+mXX&r&SJb7ARmw1IdfQZ`EFrikw0 zoD3DeQF5M|R7vv|dZS~jv8f~)VK+&!m^#6Mp?Kv_(tJ*tbFlnS!m_P_7p|76UDZ(T zD)(qA#fdlG{bQ=7!y{wG-V8PEYBJ(2VJzeorlk=Nl%>m4fm;t+#z-HEnSGWvjb@4J z-xNEY$Oqto*ALvH8*wB-R-w`a-z>TPPF%B*VfNO>FF&cI>7r5Id!^2l{&5y2ybg$d$R&AzpY z5q=HQM!CI07F{-t680r+_3E-m@&n@TkD|D|NZj>Q&8Zmgc6(TeVzil~>I@;#s>enxtJzhlg(n+D$YW8$M=_g%6LaRg|J0hOiC#B1o1w z!MU!9F2nx3Fqbr*cV~u9Lr0#couZR3j5F79XS>TPw{uaD@M93`fimV!V*%1Ce{zK$ zPQ5IjlJB&;QmUZCzjbkdEWLOS*m_Fh;l@xV(H)3@_|xlQ;*n|6<`-RR?TmTfRWy`7 z?W!q#7a!iDNUch~xXj{VSXvQ&+D?gsfnbh#vaB+>#2?mH$;pl8L`<7&wpI$|jjsfT zkK~PAk4<{h{6>|X^m*D?reK*Ab}lT-1P`#)$-LB?Rw8VbKb}0}ho&m3Z_D4U3Ky03 z^{upFV{w3Ad7#N9{QUE4x;*(TK4?k*b~m70y|JwPm~bbHCNqRBavP7IOTAaAF-_wzeRZJ* zm7gn2?{rbY^wAvU(R>1SU*_si7sajR)V069R17P4_vS+eO!e@ws}GFGnUks({VmqF zhum^x+|+C-Fml&xFW$4ROG=L_-Mc(*JiYosinWg0`x2+@P{lHx!%UyA6-Aaeh7|Rt z#h90$6yL{j*1Q|ct86i0vIqE1TzK7bC%*BRADvggD{0s;9#F5qwaB-Z75bMP2wbQ~ zEmPebwVrNY%97L+zfaooptAGs8)^!-F%QlBJ{3+oq~6`LA?$-b3M(57nAkRP3=Fm_ zl29#E+mbJ(Ip=;ofhfs=Hbs?hLuk!!@9nB?{kf@-@E88jW(&526$2LAm#8M?QlGh9r!&=Pp}a}m?A=bTqvWlE`8 zwT0eJp9gq}#BQoC$k2p&oQtgp_ESeYL}3MM#uD`koSrCFHV^Jzi&LM+?UM0@X+&Q+ zd&e(2DxO-ccx!Q6pCkh7aF}6>J{J*k>fHT`@sJNIZ6^(TMiixNeBG%M@?pDbl$Tfg z0!qtP@0w`}J02)|jHaLcw9u#nJ0X+sVuEW3EArB8@$3j^l~eXuW1=%tU%@o1P6w~X z`-RH|!ZhqLe7B(FMuXkP7n5!$hDpK>EuPh0DPywMyZSzhh6lcDhpG#qecFO>`x2kt zKnicv6?n#+wo9a;DyVFsh*b#sI@&YVt~!a1Y-ZDAu<(aneLGYEr}Ph3yKkza>!9TV zlPk(20}a^TYJ8Hs(gw;WrS7W>#cVic(MX^*o5+HUpT9^9KohpL=sjuIg9waw@4de}wh8;94lP`cD#JR<}s z8*I5*-`KjIS>~3UQyk?3&H<&Wrs`JImL|EduEkE6nwcGDYuQSw8~|SD>y*u6XePT! zcSZyWKWsyX7c@`}nW*(4^&y#hi8>lrk%;(KJ-1D>k&9MaMGKP@$BMb&r^MsV&KU=E zK^-^9S2Af88A-y+b$K=ec3f)hg99mE-h``5=rLr^&b1ba(#GkWgmym;j!}ac<)E$B z-*xs7#U)Tf^8gP{K8#eJ3k7nxJYG#7W&a9!pz&s)f`jP%TQ&Q|*SmQFF?1>xHx$e)*`O~_Zd#lpe;cS|70e46Z z)eY4x4R#s{)2Dp0LuE@qV-)$SGUF)buB(i>sY%U{uUes{g$sS*+xjk5%F8X*f`;zg zrq-b`+SjhBygYLw2okA|cAY57_0MTNsgW8S;;S%8ZPMlDbMQ2Ut8*bpL^{L@s8K(| z%hCF3;-DVfO=7D6diM!cYIu+WGPmxtZbD?CX3?mYE&O9Z|J?eq>P^(upg3{B_1#`s zlE=3DaH>XMMJAO64Lv4lv!zA8aHKdkXH3t1SBL45!}X|JcWo1a^fk%a&Zi7QFGV3= zLAjEv!Z1HK^*^V9`Y_?FYm>Lq(yITlzujJ{2wgwYag)>XDKGW$+bHT~bPqk2eh_P1 zq=PhvsG}?6kz_$vsmpiwEAw7((9v@2o9pqvHPz9)ky+GXf2z0W&65jE@KdH&WjZB>DD%+KsVozIL8c$B*Y^?gsS9&``S6+|Dmt34BpnIBqg&hI!)j z9ByFx)R<1k*k&_Z%VyI=`b_MJ^M1@mqI30^Jkcvx~&-)><`Km8QKlvbEI8Lj?+;~YS%Mr@?c!qr_BINj@ z#R+hZM9|p6`3kIAz$L)RX5nJwC!J>vR!>RK(U#k=!A@?QfHiUh>Hwwc0u6GQ<`#p& zawUhhKI%=Mt{;tzn4ShZb zbE(dEt4C|uZ8J^E{;?q9zobXC1VKoiwx3bS~e6h=tkT&5T56>$~fCN zS$?)rYdnH2mOXjN0i0cZg5^e~hmfF2TGyCFbgm8(S4B;WzzWS}K8>yKUr%4()Cx@c z=ntHUI}@P~Z0CThqntOu)lsyTGvC)4=(c2NXx@T@yReqb=~#l(z9{`{7}CcvM*xC? zx3ueFv1YqVOMBM^!0IB(%uo6H|UQ9P_?g?tq0C z0U@7Vl^?n)Kf)BhhOim&ZL^&t0# zrV;F@{B)y5JuLkYJZ!%Y0IlX^M3eh^uAt_LU1TV~wC~UHJ~7O5G%?+$6X%mNKkGn} z&)9?whN5khc{vg2%g)d{Nw7Y3;u}9pS+`bgVjR(SnEOF%}%pzkTh6YP^UxJD0PFj8tjR=yz#>>Y!@VR))Cyii`Nib z5&Q&459^aaMdC<{V3=_T>Jy9%vG^FH2F^)eM_}FH-Ux6OgGkQF59WmjBs&)NPC}ub zUtoXFnU*VA*bD9*Kjsw7xFza6zi|PFP z?4bDx9L>j-NK_taIIqHesxt(SGz-Q z<`UMXEFw%PO0O}43PUs1!@SraiW^63lR;pfbpyAUJYuUvs1=_uyQb^Onvg7xmfB*Y*Az;0rHd%0yr`V8oaXHMHMuPqZ(% z>kyUD+V#!ghq})FAI@@7O7NV)j!UU0YzyJYR`39yCD@LahPfXKRF?Eu zrF#z{^p-52Ls5E`dp!H#GC_LSl2XO#TTBgcyJGOk&GR^3*w?C;AnL*u8$4oE2OW+w*mBYT+^Xfw%blL# z4djbt{-?%z4oDF`l}k@k=4Hz68mHckFI3@8ce4nX8S+7}7@J{ymiO;HaAN8bE-f>^ z{5tlneJp*!|wvJ^fZszqjVi%v$~9F79E~ zz2}~N&fVwR;oJAq#@H)l<1Xf|;n>~M9!Cs@l%1zcV2J&=e<&e}UuV&;|9)+lbc?19 zV`D;S>EdavHx3VJcyxy^#fhv6O*e5~U*N{ZGxB5**ZYJ6B0Jp+iz-aLW+?UAJ<^2? zJ?}F|hO~Tcrr~X!b`QSmoZ-7d5jCSC)5gvrbL57mM5s%#*qd(i(mu!9kyE?c zU#)6vmqzt+VlVdCJ~QQIzcW<-kaMrw`@SmGLsv=JI5nL7`;6Gfa@iK8ZS(7czod%sg*8HB-5(6C??CYvZ~iBdf9eRG>n{OlT5u-TGazfCZCO8<5O5^ zzOZ~+xTd70&MZpixXtm>=AH?5Ul8g>~G!-0 z3qZ74^dOdug7zWG{8p!4YzNscf1ajxM$KMn6DJMb+$wej2{k}-QQ}XHuQJXX3J?cz z+C|n0`w&H|e3xC(MC)~x-E#GDiW531G2<<{oU5jO3!M%s%>(+h$;uDLeO+6m95BI< zEmR1clt4L-_Nk}B1wNUaDs)9@@6uo#V{57+^x|y{-DIvCOi>4;k#*efi+!a@L8quA zc=R<~5YSWK>`KpVJ|A>mvUxYqaS6=30Bb zlmdYLlN9po3U7Y^Bc%}2A&W+vmjSrV*z6}+LO`YMo*+&r?x`d^{VE1rZE-1Yjx8~6 zM&NI@uM~34UasMaL~=oX1U=Vh|47>W9AFj zdkbfjKJF=jWeoB>mrb~X?dU|MSym1kly4>MC92|NPd0}x6_7lpJt;#f&Q2Wz(&4Di zV&j|<6Xveh?fv#4r!YoDacwmGW6w6x4Czoc8Q^a8fw-X!FOO?9Tf~VrOq-Guxnsds zAE%Ycm$|WtXz*e5qbMVM$}qs=AIc7{>RK1_NJi5!W)g~5#G0sra-eB#7$mwm{y z833VKGXS=a!mG3p^v90c??W`&5Bfy>XP>?s=$O6vJcK2Ue+`$XD%NLpA9A+cupYg5 zacc89UKu`{g;(5%kXND!kFx>b7gU_vPLS#x3#RNP>TJD);w|m`(Hpl93=F@6@hB36 zsv3=UF4iA__~nBq$o*l2Klc_yJgqk&utzrr5d0=U@ZlOjG!`+xx6|cd42T}{CKZ@ z=j9`=%nQp#6_Ut8mII#(uQvz!8e%-<4S{jMhZByC_^yD*_7ETHQ@?mwN<>B}0Y(cv zXhwz(CYyJLMz+7=?1{uB=U)AzL(i!yD9KEHb;MZ5r=-4~spqxTQSMPrktGf!W)ly6 zQiDS3NpMW0hb^n_Vb(%lAWaMg1u$Gm)QIHE;xq#9Q5zIJ2&|3hK7^xZ246;eA|XJe z$^uGMcM;EX*SOeh9^QFnyO*D(Z+l}=$;F)W*FS=x84%svV3TbqA0vbqJkc1+VaCM5 z%=3*}_fdjYseyS; zd_hSZ1a(hU*(x|J3>E?J;-Xk8f2ZQFdMbDGzO)ZXRRxxVpCx*m;q}U)xjGF z{Z4RNi;^Y>M5d*c#o%SV)`6X*@Wol>$iQR9`s3)E;W1yPh5^^aoQ*Xk3O@N$_69c* zVGN&JlzFK45@|SBNB1}D|9{B?K&Nq+b>fEv<|E|qXtrqyV9z(kAomzPeR(v*+^`y+ zaq@_C9YSJ)$Zm|Md6%@lm*|9%;^3}uffXN~+Tg6_42G<&lDpoP$H)Ja>+1LZv{Uv| zyX<~DzVQ%^09(`2K$d6hcPA7ND@HPL`B0XM&+{tZ(tGC~SXeMW%HVaiaj@y7#sk~3p|;xkoQVK6m>ajjz?rY%?-N@FJE01@{1o87HGd3vLWwU3STf>SpJ-GjN{m=RHv^LBh7-HR*Cg>{lp84 z=;QqSaW_<0s%>p;g=*WmUq7=odHXoKQ~ycz)6TKDC>L|mPmZX=3%U%&=3dzavCqu2 zi{i-&tYI1cmrZ;WT#l0@Z7ko}0JL1^Anu@1%8*!zOD=r~ zl2ZYHb-N)t94?ZvgNco#^z*JELFoU+M;ttp-jwQT>RlWcXtxG1lXc zNhU`5E9*;ph+LS5aZrnXK+yW>%*WjtH<2+4rV~RYor?74M)jyBZ;E~xO|EjsIsf6G z2BKX!Z3P#W5r>w)NW6Gu4xtun2eA+uC+ZTflL(vPf)((;^mTH(#G6K;s8#CR7M2Yi7`Z-y;_ca{g{+PkH_U$NrZn z(uJ2L;*G%wJm~1#haAe+4u*VKhk;#O)&}h2WP*q_EjDui2lx))K$aa*xe!F|cs~M2Kvr%< zpz8q4fIDs}2OD)I*r(?_U`vfsv-@J;9)-42>qnkUO?@dtop@ z;@j|o-m9^aq%!-)m(c6x_sajHVCzD4z72m!?F?xwWapX5=~ymyCdsmL>NlHh3q~*k z8Qvq$wd}1lKhifGcPD>NfLv8%J=SNqwn4jpjl+>{;Iv>Tvnhz-_vQV&Cn}*si*xCMt}J!)0wK{ zgf|fqI(9j(ja|2J;XxC*Ce@-l?<+p_pX4ci9%6f+x(HK!-~1+o##@1RPJm)zz9-VSjY_YGe9_0tG5P}Xh#j3$jP#V};A=if_hKY$ zpjS`GbSC7(32`wJih}fj(DaUuKHvmtoeHF;zv!_38Msn_j^bSO9G~*_dJ62cxuNcl zjEf6n(l7QQQhU5pYK%9=F-XX0Wy$86r->S!OjXDEsXSgPP4+Z&sIJ=~_GAv8+fZ@l z0el+Z(lnx|z2SJh+x5YNM(8&wD=jy;9k;Z5KkGf=IuZUL%(<;PNAmE4%0tmw-+1?m z>gr&f0dcwa6bwAvZF0Y9)orXlWE@zttkUk*dwyb63Hzd`ieIn&(6zV4a&@=&lA98$ z#k)9}n?0cG5nc^D<}+QP3?VsRJRej>w3d8%Xm~O#h56W-LZ_qL9}Q(1V7^y66mhp3 zrJ=n}!Mf?<78IW7hEVRXI+hKPA?(56Kr=a^mIn z>DI;+PM?y`l^ju8()1J;VA}3+jzlLT1M81;zkz3YcW!A*=$|ma2Pun4loK_}Uk8*Y z$bIBYE{&&!*)MCiYTblDAfo=k!v;IfXjG);+iNtF^~tqH1Z2h=!O1Ye=F>ObQz9Mt zmolR6`X}DI+S7`AJ>erx!xH|8x>rH|;YM+|kQDb@XZR5tp}B!KEE8V3E$>{iHTo*b zpIH}k2YXDA748IT=9crGCj_kZ_=CEMtXzy zJqr0ZX5>P}AlpA?Mi##DVw{#o9Ju^{#f&^)NYdZUKccA>1Twk_xss+4&sxq z+LG;L%nJW(+u0YV+Kj#JIwMOy$U?$v)p)mEpk1u%9dud_SJov*u6Qqe2tCo-1$)vU zU57r~n~=xI^7yjsa!Q>;c>O-)c7L>r{0+$>ol?IkX6DPG*M-)I??G6>EoTcDP$|Q z#d&y5ipJWJ6RE7sqf~8U^n#w;*#U)ESSI9Hi;l7cd2a1Pq`$0Ly!0Vmx8;gh-b#YL zAj0)g#4565ft|o_-WW;}-ASHJiZoG?r%|tdFel#d%@D5oVuNXC+FqXSc6}^mT@k47 za`tbrn?L*apN;jH;6bSr_z$I04oadtmj0cYR<1mV;?NV}&k?})2Uwe6UJnfH|LNm@ zA%yQBeIA!h;H<)7ypYQ*lP7K0ou_6wnTEZ1vx)`r@gTCWh}ijNv`3Xsngqfjl(&g# zsO>AD7FN&C4aE1xAgMgWWei&Z{|clT4c!Za{&4PMui|pL#kxW6a%7c>lD4+w)5a31w}nT| z!YAosnHlarP+#C+&Cg{%%r+kGAj1aYM+f5jSz`Yl8T_H--RA<{XaS$Jz%aVUyJOl0 zl%7m1OWLJTZrFze0P9e_ivaM$lBF~tU3|Q~03~+mpMkibf0*6>12fHybnr!}%{376 zQ$7(n@M=vvGxZ^PuIci9P9b4|RMP7jffr|}->YX>Hze90K7L3o6{b!O;#~h=o*PbV z)v&rJA*2zi@jDtwGqxddVDNgwJiet;ZxI=?_pX70aHb%noBm^?=;%c$WXV@GeQ(!q zOJ3sS9gPu$2R7`}_FdBsUC^7SA*+aqhlqZGeaLzE?rHcB=j&mjcU}!xr@!f28Aq2z zOY-w&+~f2-Nj;z`%Y4|I-pogG6|al>MhVPOB(WL!!+G`T3#4Eh2*?E!h5kNK7Qbp) zJ$d=3FCHYGOD@}oK*3A=NQfF zC^rB~Z+%7YuxOKuxBlX__+FFXm-B-vCVUM+6Z!9jUNvMIJal&|$`#Uk65goNsyTN_ z`s<7KT+`+OJGo%gnQ{!^5xc`G8A|SbO;9b)Y)R*PomVa>{Dt^`r^6 z;+y?Ky9U~gUq5UPvtW30hMAX(Oleqi-sY$KZN)r~xP$Ba!lu?VM()Ws5vJNq?Cjl~ zoKg!*FFBo+?}9kUD(9%5uD>7ayYK zhftzaTfFzsoO^BrGJ7595yD0Lyb+_qn2~$~waxrQNh#H@!yjgWtyFkF#w5<3)Oka4 zP0p4aLfT1?!%6D*5xlaDEVg!5(o;o)&vx^lwPLy8=-Os)i%q*DGx$HVn)KfmyNdltwk;I!K0sv^CbwYt@_CsU(iu z`4$NmFDv$%Sv|?6GB_&{&{h$QRpMHos#=HTOka{V(;|CfeB<~;MHb#}qHRNRgzc83 zcf4E98O=!=2^qHWPJYVi%bZv9Dtmmc_(0x5ShEAp<7ki-h30qJc&d9g!UXTdsfEau zS5{j56g(iu8aOd366feIa!e^vD_XpPI}C3>g?g4Ega!$Az}9>9?Q?mu=6su%xnqK+ z<)eFNrW|jvW?_~5`BmoZ*JZ;*A@yaVO;DO!lV*d&c84SBTs>btRt^Vz6d4p`C;2I1 zgzJRzI9Zd#skQSrhIy!<69NGnRBldQ(w$$2C-}K)RkZqxyx)~opPgZ-H;*d9JiC-b z!Id-}EyD~gD<(vuX%4y2@*i0NT2d*xw~npMQ*@$3vQdJsGCBjZ7pGQvSe|;*tLA=7 zELX}6SjxA|?-@IPM}6dJJJ4y1)D5^CAq?VS26jnyDM?~o`aYyv-YD-h4Z&w)b!QVS zIazvdpMSolSR*!@@LVkfP!2I0APUP4%6P8#?^#7)^J4HJIEz!&U_Vf_>)LDhx$I}| z52&6u9w+JxlBPM(;d9F<^Ut(MyO>(|74goAMFU|_81Io07HFTZ7lFyJ57~=>{;K6t zu1-z{NG!#~m#A%^{Xc8`*wFEihx~Qua5Bi1ML&VcDrdHOiJ(yIrT!byTuc6Oz1n-k4jt?)SX2gspca+Inl~>{U1=b{iDw19 zt*2Oq=#yRI9`RZvbmj%mc%p*A<6m%<16rWAn5f+|O#mx1O%5bTX^kM(Dv=UKoDngA z1{CqvaRR*SVJYzNG$zuEt46a`6N&fq^|0Vgq*8HE> zHr*!pBKYjzby@o7S`ef(nq_M=`2LEcftB?E7=Pv!aBLB%H~iq|dc%z1y|02}pZ;BG z4H{t08+Xutgd?%1zc^dw-O7Ea>)$h^FNAH`%->$oVo(L=^bR(fh=58jQR!d^y%~xkAYDK}I!F^~QbUhOiS*uk zZw3-j2qc6T|L1@H=iKj}_ubETzjxpJ?qw&lGkdaT?^(aSW@fE5vuB@-pUeXn?x||1 z0z^baz!Sm;I9U+tRq?X31^_KBfFA&WbA%5CaE1`OMmX>xx&#mt;zWcGKqUHCdM1(B zA8}d&O*@hNA8|@Td@{riAo+tHIJcUb_A3{_2mlxDH(3EP!v6#sz>#qLigl9^J4Xno z+bII42%I8tiohuXrwIHXiGYEfqb0=Cl~czS;s)VVv9xo8xNwTz5WXQSdgF$usIaJ% zxQqnwAEOexAu26*LtIY$1}7mRCL<><2|RYUaIkXWG@r`68~Luxp?y}$zSou zu`z$diKWE>AU5_N@l2wBXh8qaV$Mtax>cuI%>R)Bd&=}F0;dR^B5;bpDFS~X@XwmZ z4LOM$a-uT8ze)pu$ACLv0XP6wfD6D07ywTRzXZ*Mpqmg8|EX)7C3sty0a8L5!Gm(K zpNQqJ_&5>YpELv?%^9MjQILqpvg?jS0{J;D>0MW_#$rNx0ICu6e*;&$a zWMpLL&z~cwq@|*yprB;BbeV>hjhTa;jhU5|lUtaV^Qs^hD=VM$b-^2=5)u*|yt0Zi zVhY0I5@NqjLUjK8c}faOMk*>su`8@s#D04_`2t)#2lNm$E21mFnTtfk7l}?<0S-bb zNeP~*U(TsNH=;AdB&27_&YdTxAP`htAaG1fe1?RWl$3{11>^B)xP+^w!zS zx=+cjI@5~1jLAC3b-S#Y?%@E6Tl|^JtMlaa42(?7JlA;nuJcPsN=eJe%H6rEqN=8@ zaqrP%J$(a1BV!9oD{C8DJ9}3*cMnf5Z=b-|LBSz!Lc?O?-o+;*zE4X2ke!p8m;bTg zQ+Y*YRW+=pw(e_7Yg;?wTSw>M(D2CU*!aZc!s62M%Iezs#wL1q@5j&m1I*#kFTQ^9 z`SA58qc+kIC`-8Lp7-O&gA93~Y9D0@d+=lyDlVzFQ~+8XqJMWss;H(L{vb>$#wb~B{7s|be5&8gLBz+eM-Cv->z4!= zW^nQ@EW4cjq|S>}f<=~Q*DtACXk}LKGtFDbZe-*s+V`Yq+xV~g#xBY>WLNF8A|;6I z|G`ipXu2`&T^xeqepmEcn_6OpGfr|SntMP#b^UWJN$lMoZrgRC@Sd6*&(3|_y%Cbp z$7&@6)yy#`v310&k?YM$tH{2&r(_M-Se!-V_xGQHzmdS?T6wpK=-tTfcuOm)%pViM z@kk#cX(CVQ`$3;6GWXEJ=Buz6!d8ZuEAA#OFIqo|uA+yf>xL1tAh*b#*f%cUoCsD? zGl#6I0m!qw_yqQUyiTe<_*^@t>(X}i!@o+1Wk??>%y;;GDr$c3;O@Sx;H(#Z=E5&p(N#K!0~-Rl)Fv9q(R zt+iBJsqV{ocR?wXNrB;&C>~z!t3e$&zBBjufDZxWf9x#F4$I!nZe%RpdBsP31t$x> z6jFBF^M(7cs9T$-L*e4^x7K6dV2(U5mzMjLm9Hc{rP`RxQWC5JZk}gTns4Vj)19o6 znkeElkRjTvf91{m$45s*DyuPeKEQjKRxP6O6;IXi&Qy>27yV~_GlGh*R41^6c*FXf z`F9_y^1SZ~Vw#VBXERl;1(H)KaB1mgi84J;&9NrZhdUp=7WIyZb&@Iq?d=%-`RnHk zth?cYHru!m=59Xb>;ne0orZG{yR$983 zd0r1`68$4{k?T50u>)YW2;R~a8p(;=71|P!^;ZmF?DY>%56RC3G#rG|7IZJ0LAz=k z(-0g7V>QZ=rdV3gT*e7-h685{{8Rj&qW|M$`)k3ZNzbU93?ouaHNN2R@R-c=&yA8h z#kvjmI%E~?n`M|XDQ&AlyXhIkOETDshuaiZ8m4m%7cYg_QiE2OxR{nCW-MB(k0e{v zoGHpx!v&-Ax7$6bzIe6(H1Bw9$9&-K{>L610q9Oi~5D3928u21Xpc2m@;K9WHEAmwl2`x1e?rYovWk1BHP4 zwj!DTo0jFAFlVfO=wi&pC2rhC4Qqr?SVW7DPoKR%asrO21GKO1G42)1S>P3;wYA}D z6FcG=aziHoQS=GGaPyo{No)F(gnlKdZLDaoqIgrr%G?Ri*8{^7!+!lwmgs*1C`-*@ zsONBI>}Dqb4magLFYk|b1H3&?fW1BN2@rrh0on%s-FydsWg`-*yhh>nrg||u_N@5B z{gTq(sKe0jdezZSvZIw^F&)k;Cq8b)JXdgjFQi`CtP3UeyCV~!Rb5PUA@mmO?HhepEmrHeY=(F(7h|Y zmd#hZ8J7xnhQ^P=fGEXBW|}XgYKAUqW??n2nRIg1=yv(a4ab>p0;APyefWR%o$wVTN$u_AX8oA^euhwoKKKrJ7Cwl{7VBjp~%_r8C^l;UAX zyza!nX;Dk!B>ROFOA($lf*+vosc9ZJP<+AhoC8BI7ihqDrfS(!to_xbUSwb}&r4b2 zROd}+jCGc+`_&ww)~7YioE#fJamTg5^UwAXodYwfIim9FON{ewYsvjg2t`{W+rN5r ze%VpA@aGS`9n}xZQYjG(J%tyz}hmFlgHD84g@xDr9#D|Ml{JO_1|sH8Lyb(3Z;2ShE_1Sw75vE4F5DQc-P?H*@v1P`Io2@XhWwfnZvD*g zLxh4R_d~&$&zb-F&M(?qWHp(WdTZFsErx*#oSGTGj zud!NuWCV_gQh(+|w@3|q;%jJ}%z-x90s-1&fRpPHr3Eb!cM}IJnOm*4p;Pr4bp@Tw zTFH&`hjlR-2#IPXj_RS+D0N5S=)?ibI46aR9bCLSK6@`y7Xz+_w@8&0eHt@}ElOCO z4z;8T(BS@oov`TG|4~pP!RRQQQ{zzIW=BN&(3FqF;$?)}&R7`mN}2LYWSl?r1Q4E< zFX-q@L#!<0GF^vKEw1H;w2Y!mG$=i#-@koj*cE%@9OJhyTN}d!?d`7y4k-Pm5gya1trzv)hN5RusKc4k>iyYpWnT?6D|9{_A} zM}xvymkl+%y11R&89zI}l3G*l3}CKnO7EygIz?E>#(1qcil@5E91UGIE{k>WN&qF# z*CEnZSnQ6yGRdk-^Z6?zzY{%vi||?^BU8S8eW$<>A%FA0DOBgoH&aWSeD)te$fGjK z7NpaP;dK@S$r>@b8CUSUN3OUE=u=&rEVya}$+Te%H#E|+RkK^w(j2n2aJv!6a?;!4aYPq0KT@nyE zf!kRb&R=v~12Zt^ai63|zF*XB8oNlXI#WdLa+7Q$mTXClJLBf#<)ceV**47WeeRcv z8rn6ZQ#Q7A(~P_6TQh^+-Bn*_aomRAqvdXX6t^xbDIj~pqBe5)m8XEE(@lk=fY&SdhR)=t_cCp>JXP~N9<43Q_C;CWEfbaRc`D%rRU3{UA7PAIU z568JJlrw2v?v2sd2$;91R^_usSKnrIJT&^Ee4P{J+g!l#sLVTouKsoB693EgMa7$h z^L}5hqhBxJ{G&CAQh%1h{_HH`_6yy8uZDz>E|AbmQs?GAW8meF!t(%)4F#Y{nW>Pv zjL+Z8r&8*6JM0u zoq%pSu0PFP;F_6KomlpK-6tae=Qi zxQ|`5SMBt_4iGekR${4r7BybRz7;ibYHv@Hq3=ti4<~uZxC1iXWtBgkjsA|kuOzg@ zg5PH-)jif;`-6&0i%a`%Bx%lFwF8%0t_Yj0uy{cs3+~(ohxkdSMzyT$r08_*k8|Ir zuBK2GskoSss*1VB{anVo!6)`#+&)fM%q$>=0D&=w9@*))`h-`K`PKh0A4G*D3vyAb zDIdFNmB7R21ygc%mmV7M#$|lbFP+paR_af3n>0BmrVSe{(XEh375u^X%an?l)G)jI zB;o3{C!!I%nNdq{_`M9Qakr_$*+-4y^~*8~p6=~({#=@|xA$EHU~ei{5@aG`cVfbb zmSviOxYQ`oDBtT{r5k-WUTg8bzsbpH>V8E{cT;VZ=AK{go&ARr>mSAcX59R7m;S|0 zz;Hq(e`9q2#`cY=*0O6$ag~&m!=VsLC-3u@&Xq;JUt)isH)SO&_3do@6CN?&ShjX$ z!N@=sU(vxL-}Fn}?c9P0ZX}a}#i6sxcxuWOGqE%bw`vh(roqpMfm{6Q-&NI?ZZaC14cf_}2B|W} z7i%K@`Yu>ac4vi)Ee#W;0=IyeJ?r?sH$}5*K?-OIWEJbq#gA|2e=>H)>_%_9ceDXA zb6)RT>g3NwB!S}Fl}uUF8(q#SWy`F_3iQz?AqO=Dpsa_>l>BdNiA`0+oC%|Bv9iN%}c8y;QUI^0DrPTMyDi~dX6 zia-HUl1M6Pe`4Snc~LJN3?O?*eb&cEhg5XYgrl5k&IS3<>~S!^nr`!QRI2|S?T}U< z=mu9|&F%*~Gb5*F0}@=Li?A+Q1%d75fe1+B8O5|3QQgOIVxnn zE3YSL_4Z6A%@h9^j-jkf@(fhm2BCUL6L;SzodY-IkN6z0)uD%3wazx$xw}$c*tU+< z4~LNmT*g2feOS@S!0_Li)zu`S1v^V_{-0kHc*lu4l)eUVMn5W#(WH1k#-@L#EOC?i z9L{dT*G7OJ;ZB@@&9Wp@z6X#VC-n-?%k(;PBF7GyK`>*#onwBES>fg5`NNQpKWTwE zB!#g5;QagsCvjHOq(ZEpoZ>9^2^i1TR6PPLO4 z;q`1owF{w7zMjdULN=SuM|mm4WtjW)lYV;^HG6I$)C0l%TJHz&gxvR^7=1XrEj$kc zmEBqG?m6&Si|~EyL#@6wm*qc|?JK!+rS;Rt?lb8*He7p*nUvLN-uSg7L7P~a3$?Ll z7-cAL@}DPJ)rk=rX6huQB8fS)HoBZ}WqfBZ}rDEs@8cJ|+IV{NA)1?16`2 zz|sylKaJ}my{VERndP_UZP~3}`Ne`e7R6jsh345Rj4iQAHp@SkhG>bdB~ceqC}qwU zkUf8@y0TVFOcvqiK5qLYTtiHB?*zDYllk4h@{$GJ;(U9ajV2dhBngaCyZ7&#e80*^ z?s=f37E9Sq;@P5EaYdEpp_jRH$C10l+dk!elb+gZ@5uP{7|Dp`y*6D$hf3{%9_o7$|eT-a~5H5(hU9{n?{&Z%O5S@WdBE_34~cTn*#A=kj8J z;KosR;$&n`L3skt%L&RN7Lo|(A*QvljpWfk4TYHZSH)QuR3DtRJyTVMV{m*ZB7MaZ ziWWm-Uh04ROS%6SZ8)Vx?w?MeM?AL#wV7n7b2Yx~{LG|mCYQkbK_eni@9Qk3xjhVL(T80=8eJqoKkwL1%3fGT$U4a6)td}gV z?V?j`;=OWv2J8P`5&qVozxr8nsn@3J7WaB?teA5{l*d}Nk4?2LvC{00KDJ`K;E6hA z5x{vx2|oK3`?HOwakPBwDNkkiHxg^DTutHtCuvqsM;xX5YQTlrEg@I(+}F>pSzZz^ z>x}YbR|b^D5r#H(Xi9OJs6nReYg#!}^*4K`Bd6C^er!xB0NO5-&*|d7* z{YFfzwqtro)H~3oT!W}dRbJX^B9RqkL-yr}B}Fpj_iM#~wuAS_4(P+hVV+tWJ*RvH zcJaRZ#C^~xG9L~9McyiFUn#y7!Ocw8d78Sp7nqtQ81zRb#U(R`;O#{jun;cS>1s^J z;Y&`N(xCC6KEXCuOpUN;zvI=iS zP=f)w_nxH2Dk??~23)H~i#Eh$zxpBnu}gURVy}GIdSyzeqtHyQZ#M_9G#McBr#14= zKHa~r_=iN_aVM&+_PPU}mRk%ET}I8nBjWz}g*77ojxNplslvjSfE6}JWiWt3`}{2n zj>P93%)8p18nUv>ad9T}^wyp9w-=oYMa)l#a;|mu)S}B@@Ssd`M8|cLfm*aIVd%jad7)= zj5_JvfVU4s5sS)lf-Uh0wmF=C_bmU5I!mZ9d776xQ$Tt1b8lohIs?RegRE9N_zb95 z@1)I894}$ehrV`THxm;h=&~3S&FnM30}_rkgWm6UNGk_Q80t8v(3;i?G;1a8r1?|X z9G+BgHuM=x+o>#u>sxFrYo&ZBgLzKmc`T4Q`l2n7~*0hA}T8@D{@0jL`+PGKq2Jn?dbN@OUTic z>(3M1wQ{v^v2${>gE(^jI^ol25O+7ltM2Z0mU7llttFpXT1pB%dn#@zBr0n8ROqRt zxTuh&xVWXXq^OLTwdk{}e_r0w;;*Yaxw}07z*dfKt^_nhMXrkct&_#=fN!GwH&$vYt@=l_E3^di3n@+n-WaQzkn zzeRj1U8ivU76QLTd@5b1aQzknzeRj1U8ivU76QLTd@5b1aQzknzeRj1U8ivU76QLT zd@5b1aQzknzeRj1U8ivU76QLTd@5b1aQzknzeRj1U8ivU76QLTd@5b1aQzknzeRj1 zU8ivU76QLTd@5b1aQzknzeRj1U8ivU76QLTd@5b1aQzknzeRj1U8ivU76QLTd@5b1 zaQzknzeRj1U8ivU76QLTd@5b1aQzknzeRj1UH{AB`o}XfR*r-RWjqN_#Qd?A9`Tto zzrKWxgzzOj_iI%;QgSk~v*#$uDJdz)DJZC@FI}LbzDP|$ae@BA#mlsGbaa$742<-& zjF)KXX#ZGCkC>2$g!DWq>3Lcz3M$&)-u_ri?~ETY8!^$<)3x+~s{it9>0t)L_(~`H zHi*1wEyo%#2K(+~U_9dq@D)_xCDO`%t$wsP$&HOyy{zUffB6Z3_}Lm$+F4ld=6t-t zvU&m-jCDa(P($rX6lGD^R`$zd5(2V3yRl0ThjL+&84gl2gZw4PPjezzA=8+)M+L%$ z-{$ipvh+=3V!BU&bEUVAGvLcjQ1KI>EK%zO82q@^2Y+pliSL`+1t}4hKpOALI{`Kx zyP-kbdm=1&qydh1yVG~%=uttzfx(8kG&*I`;0^T3VjsnNvUPE$m+FwA(HAsF*mLW; zve*q{$>3&a{Tq7OygjD)WbKqrE5nJVoh8KH#P?x?WCu7KRA3>^2Ygw#4xVCA6@7e7 zNJO=%0Tv7q=r-}F38s&`GiG4F39RwX|b4d9Pq+O-yD;e9*w0ZP#y8dQ}h;}-VAv(^W<%&%kJM@FL^ ziZy-nY#A1(zQ@t)HQ0_=VHH?DK$2~a=elZ}tY-Q#ar=QNksyWplV@{_dg!y++NyGj zsngsQE2SAI3rQ}Ss$IUr+Ow)UYa)d#u6LYE4p5W|TY_?-#c!iWa|D~ zn~z@9YhT$#sxlr8fwN^rs((HHEshUW)Mp8)r=i_j0v zzxpIuST+?u0+stAd1pYm-mrF#5Iip?W&vAFqmHJI&as`$O&w*%3; zHKSm4p(WUiLxDHCQa+Y(YBfr$90FOKGG;$_oUU+Zz6`Zx6Cu%6F@LPIbLZg^ZTNn% z9Hasa!e9>_8NPR6calt8{g4i`>zOp^l^GL{?fi(x6eLf8^J?!UMTjQ7xR9U;tcSON z3*3Hc6*|>4f-m(%9q%O9K*E$L$A%DF3p7;r%#^9{@0YV;c`2u`UGfJ4mmnr z4KMQAot~SNzvEWt9zTNf7!;W^;)aE(L?&Y5--CB%n%HaFt>^ zhlvVQel5uQ_dwSMy^SedfV{3YmPCZRzxm-Mnf8$CQoBKz2FX~Qt_>T$8qat&4})z5MW{BYLP0e64SUBAjfz-+L$ z_JcjWfV=CHF^^r7<4?WX!nU5*L1I#PdQe00O^)lPLOZQ?MNorJ)0?qgFq7(V{KYQi z5V_I}&wR;(SjBrP_Q6CIQlwbQI5I6OLw zP>bE&*V4Xk;-x=|RBG?+Vs3VOnU~nDcZ_v3>n!F~c7kP4&uOFl3cv*|i^Z2FMHjl} zf{$z_N`79e+v6V22Ei(;_n@O&t`f0Q$esgen|@pt2D~tWNm^t(yYsdDmc=~i{AReb zMUjS`CwoCbajSs4#|hwItzwnFsa2t}QVx4NmEy|ZPV|$?Ntva=#ve5|-xm!v%T*(p zOn8|I+8iC2$(9h)plXQa|MsbK%9C@Z>K%5>*BpYqjj_=~k9`4!va|Lhn`Vl(*qMhb zu>v|<9BB%pu03&ZCOPP`(lz@gN>p^9qywK2Pt9o6F^6WF&F#)Ib5jIu zM2eB0l@aw^;}E9c=m1GIuT1F`wxvGop7J`jcTrw*>ziABZRN3&H#stDb6+NTcIE`| z=I9a(Gw8lO=k3q~1!H+JYTAQPBG38KAUy2=PCEw^cNbpQH25P$Uh@rjp)PXUq*qTL z5@WKWKRt)k)4u3MgQ(`9@#BLEmZR?1RkDi?OBOtDFobznJb(p0N;WboS&Fr)+2h<> zHY;nnT8?1ou21O#esa+J4RKIIX%>YHR7a~01$TZF2#r0O%A4t;POadt6r0gv1+z5> zvK&7zDm&guS+Va&MI#`jUXxh;s-d5uR}=47YTcXP)Mua+3w;EU33GlmDk?Mx`BIA={Uu)D!6cZFQfIc!|MhgC)^Zxfi`#qU85J{`1c zzx2C;Nh-y>`r0W|Bq$jj3~OREIm}^y>=~=YqQ)9lyb7MGU)96b*DnSrs(r~|Y2ZMM z>!oP*yHmg#qedW0Av%L4MN}h&QX@4m>|NdC4{THZ-qb6H*@pzJX+3^#teGR^D+iMy zCeQ%mz9d5BFzJ`bQ#K4WSPHFL*UPhou0J0sEul&1A+ONjc7km$9r{^M{2(kN_&?Dl zxhh|DYt%Nz_%E7CtE7Cd>sd{5hgc{bH<=RviQfg#n$5}DU*S|Z?%L|; zX5~u_lGfEeh}S>)@LisgohLwXU8KpePv@78Rkiw^v0=IPVw>y@PoIP=cdGO>8wyiX zGgI}lHcI>YbXDsGy~mC{-u{S;S0?}!UdD^3RKbQV^@bfvawH=xGY!1$_8Bfcd8Ll* zz`owo7YU!uq)_H);x>XZVr=MP(jh`sSiKPmEa_0X-YXuv?d%}SzJ$5W$(!R-IK_e! zfVD}%?gTiy(Et6)ph$zk632yU$-JP2NP?XJS=O85a)czvEP;}8An_{D>_u%hO!T4} z?(&O;oi|Ve&uiHwGY*rtJA4()A1B7B73Vm08`Nu%tMFn?Ug|SVMJ=%M`p(%3oa^Ko|VTr)~3IguejG zX-T*0&Q0`4#Hq2UDRiBwsuu)vhu29(HZ;~Bh>d08pvQSaengo1h3y#cg?gm7f|>IR z`;3Va<`v#xHdGs{yuZ(odI$5i?TDwNb*b_R@ammcy?Q^~>R3&ESmbKB?&wdjFqPa) z%0ZlhPh{mF7^D&)qwZVK?x{uRQ zBAQZXxP(|tJD>gZARb}1uxRt8o+iw=swB&GagN2yw|HUqt`Y-UXf}y5LloS{ zD)_0Vk8o2@05%18nii2jKS?yWH-^3ul5Ho=Flgs`k4rN*N{nC~j84@bkCrejsUa0D zP$CP6mS}p=x|pe5)Af-ei2^V(@7cbFGemGITQ4%%8YE!f{;3}3PxaJqz@Hk~#Ds5y zGyF&~vjL59L1;F`eM?(?DkmeydT3_$@~pvdk(q-MgZJ87>B4;^{(#m-S}Z9Cmu)m%#RQ@pv0weEOLneQrhxFXu)4Y-dOLcV<@(A|?aiAk|9_Qn@ub-bn) zQjG00=J&HjxZF0g)m`^XlFe;hHkxS{*YGRheOREm_dt> zL#voj^~+)}Z5IO+cd&VZ8{*!iJZ{A{eG6u&&q2e#Vvs-QLP2E0INo_C8+FI3EjB-@d%mKU zPYQWv8k|cL*;iSTWx1zJY1$QUcP)V0w8y_;CiexbhKx@D?S{HK|C#W-!B{$Lf@PA| z4VUzpLpCq^^0xSwAGE5wE0#}h`RMhAmsi zN9?7%Fq^dm3fY&MTzk`Ck?-YR`QAOKA*#8=+IFeVs3B;!6D~DVcs$dxV~~I!FlTE* zl|*B&*d@n#C(41M+~g?=gTYhzCb9-Q{*~WGru?Q(fL$sK*9l-{(V~3xkf3+r%rS=y zEv1)in`j0Uq(5TT5J%r#Obxv}HDhJMrqm9$9eHD_Z;`_Y*7Y9Sr()Aw7*c$(^eiUv z)(~C@CldEX&br>4KJDoumApx`!Do|N<&hSbE>s%ia-0C9Bx4q1 z(7XLo&S+#2eIAuwBJUNXseLhweNVEw;B90P-4O@rhI^Y}j6ZtSG3FDRxtCA{y9*4_Uy>{Cb}Mc9mQ1+7QS|oOQ(`xg z`@ZjqmF}punO!GI`&w1Cy^=|_!{FDS&IJigUJLMJfhxoyeC9%)!BR}?8b`SXi=G=V zK)+qtGnQr6U{+4CM^x!0u9j+GY!G{|l7GuBxBW^pU=~_6bg#%vL`xnV3#ax0kCZh+Q{`96nyL0@sw12jb6T zQD;U`rU=yLNW6*9M8`*S4Xb*O9n4R=hKxphk1w4H;5;jV0WCzoVW$gh@!3vfYY&7d zR(0!3?P@s2R5gTiGwx1!e5!QVJ)TRbp_vSCg_BFnogcUJXZ#V|h)T#7keW~Sbi5JE~@O)mrZrYa()70)WNFBT)O;-2!{q^3AIw}1_ zGrhu31V7ap&ThVucaitCJBSkVY6yA6UTnW_P@QgpSpB+HHRd8#zIL3@W9b#LpdAF& zwONp7)4qq*f(J=bfVEX`Ig9xwES{T`u{<>NPSICoF>%@3Gk~Z7uI7p;_E5BP^CUc| zLCfMeD|7R6%8M>-IrWD1KD`+h0TCQ&q08W)0E;1bf#pgly#z?boWF;bs1t)-=nM9{ z?)7Y~Wmc%as6p+6DOk*Ku5I<&O7AGgj1_(tH`3z8yRU)KMeVd!r(YRpxW-{zVOH&# zoO?X_VL#(%3sOvD`2?6!torVzL)Mj1*%XqGN!iajPIgN(?wor#R9d2-330b^3+HxK zom6-kAK$b)_F{f+f@Xm?0IFfL$i~r3=y4s!DGmERg3Lfd(Z?@xTVn;4_j~jklL@OY z`dx#HqF`-1w?Y3m%P{MhoIUQzo&!s3^CY?rg4c(R(CCN+Hi@lke!vX1c=+t6 zv8F$Fp2_c_%-9>0Wmt`bPwMNJxGv0nZ$phOJZPHS2~iNOFx%}G_+&3VCKojAoY4@| zpT?H5tvH1wMFRe*;U3GxgH?cCk<+n!W2;*Rc``MhmAwmMZ8 z%>q(<~WX(lTy4nqWIup-A7JV!-8 zPC0kVwodV#pI%k`J55$y5iEaI)qj@L%5<$2a>(1ncLIDi8^ed%1MBOh>?oTrgwDl& zmZ~4J{R1Smx}^wPRNu=gMVP^kM2}n$WS2A-{ioh)|>!K?}*kb4buEul)T9B0m_H6 z&V)e#Lg7!#^S>QFC7SIg00mBTzK~%3nXlJ*j&J9n+1?59PV&ULY+Fz5iTk_T5>J2p zYuF&Uo6g0H7TDwujxU^W@OZZQb(><#nn(YIo&MeD{*{$ok@jEvbgIkKkIsoWdV13j zb{2Bi`=M1fhlz6kaszUq$PA>1nFE372$-Q~NKcV?g+35BL#} zJ=KdA1LKScoM>SyTBtf{zf{(+dUcO$vfh^X3NjT=p#knb= zoLwkfT!W*#OlpE&%IXAoX^`m^Zk}=n7K(HOtC=LIjaMH*;%lI_(>;PQnH(toc`%e? z39M#_5*>*OXG;t&Nj9>otVz}ofe%={v>YG!^tHwFsBzGDZ;uKt1#g9)-Sp#Y7~qDL z4gTy=>dC|EhZLK3P^I;*fP_`2Si^dl^e0PMMEdGitc-yTsK}xTh<=^Eu7N`0#{J?t z`Ji!BU4>u_40~@=uO3>}x4}VIR7FJ(b}ndMuiQHVFsX$w*5hrG8Wgs{_YTV^JZ#;)Nr4n5b$oI>I2CFlMLi z%n&T8$#KEX=W%kXoJWoj-YeeZU@AK)K3gA@$B=XS{YxAn5#bO{F%@ zuFk6(4y&r)P{J!yE(Tq?T;jf~huKrLFd_Xij4lr%NI@?b_8P~vz>;R7nexCSgQjHF zBUVb^j^$gl{qbDl>V`2K6^Th-GDBHc@B7@FweuL$XBaK~cyGYlRf3}-Oq^Nh) zymYpGXEF0!_NNMQCMo399<-}o`s**vPLX=A z<)N0VZHs2psIc`#d8>p?Z_98<*Fn6c*#x2gC}e0grk$h7VZTy4CP5{&B8ly)xBVG@ z0+gGWwm7qo2IX2ES{_P6Kh3!w7k3iPVWbiCc!?CFR{~Ub?$-^LBn)m--J&y89}vtC z9<@>yEZn1shrcdI+HVzhDv@`5+}!i(Yh?gKB#hfjVyCohYBOVHkWZpT)yMa^^z~KZ z><`n;k%e`Q=KmNx`1>HjzxrK+J}or0^O14jVm6yLy<^838-ZZaxQeK)U1Mq5K}(J7 zn9(_#U+IV7tO_*pH_5>YlFz@bSR@`KM`Q@_cIUe}7y5rmN-Qtk0WPqad_CHahA34z z7aQ9rUNZjN5KI@#aG~RdmF<#t;zcp!lR0lci0KIsk@2FLV_(AX1VG-~kccK|?w;`H zkGx$y$`0)$k<&05<|E$sJ+RCZzz!ZR*@Lsh&YmL-qkkZ10`@v&*?%8~FknGDe1W4X znwY#wzY2WR%1QIQUo+G+138%A%eI`^A^6%n^mhA@NV4`~@h^2`;dqKoPcj`;+a74s zkE1%U8>~Nfeiw-yEm3TTHdi0a6gS``x zYzvJq+6eC_!$I=AEDVMvlrJ{LOVqhrovO!CP9&3k3G;w2^v3xkm z=r7DgMykmax%(+j{aVlPnr7x=V&$JFt9KF2cz&BGB}w}efKJ(pBe3Pxh$I_L z8|bp65Q|Fe!TlOr;qNBhdy))Bbn%JyQ>MZTd(e>>tTgTl+B^_@-~NccBFmoHKLF3% zRn)T}KY>h^H;F4WRTJ~RB!-OZ2LBqpF8KL?8eN6 z>mv>`CdsSW-C+|Wc~iAd!Eg`d6zrT&-T+}<1P!_U5&ZQf5S3T`J=6&hUXoQl0M#wn zD5OsDcD=gFr`OOYYJ6umTjHrDp5E%P@EZXqveu*5CjgA78r56uqHrtMuFQ5yFc*SU zHDj`{s{V>UOwdkTnc0I@P2>C7FO2>KP3$d5CFQRB1kGmUV?tUkPa924YH%kEv?vI1 z)qUF5i+sEdS!e@%Xu|#NgalgrILLng>i;nfKESg~64Bj+njyUFKSoa=Nj^6J6 z_VmaA2GVK_|9*gWU2M#&od?l*MQfq`s?#|KewI?K@7hxcV-2r3Xe2BDq+)5=txPd+ zaGb7M@uR|6pjiwtB8xq?m}~n(ZOowd@KRR9f|&}mdRS+wgoV$HTmh7jDX`8g)9Gdt$-S%bn*y?iy&svn*84e_zEIlIeN`c_feLMe8K zb|P^5KC*Q}ErM#I#rFFQs|Fhs3ryD!CQVG*#};>4;N|c2CF30AHDHjQ10z4Alb<|V zwGgZ2kU>=mq4B!hmd;T*&|vU%(agjEZ5=9{#1`T4e9&9eJH^;22V92VaY5QC*|*nV zv==p$9Tc^{#@fOnQSe8jLU=Ay&~bcnr)CY(c%Ud*s~*}{i2%F9cA)j}$xIrLVI>8O zHR2J9G|QnNu|2_nxj259f+GfE19=X+Wcr|cPVj|gsGr%KL^%GZ1y1}pr^t`rKKZVX z@+$>9nvkkDv%b=826dLs8!+7PK|J7ij zM-wZ)upK1*vO%70q@H91tTds}BcWu|b+rS+p2ogYUnga({Zgt97DCYUv>#xsvTfbA1gFNv{S=qcy|3+yJcpJKi}D?qZQ6Dw;S16@et+f@;3@PO3bNm~&$Bb`UxCxM z+s~-sjsg{Ro7IMo3+Hesyk$oBUI%@=G^6D7P!L9JT5 z?O91tBa%Z-=3+#5!6l=70g;b zP9DRHD))7EkG|xU(VDFC&V$)Jp4fcTI2SRYuVLgVjVdw9iHSGBB-cboodC?0(P4yM z7=}m_6B0K>jlF45UYM%+sYPa9Z3qD;XnNXODw!yN2}5;NBT0Vxc%%!*MLg}6jxD^R zFTAvph8bk1#Dc1@ogB@WukWfCa?rLbE|%&pYvy)U|1^qZjVbNf6X~3?M}#V|*d`;s zp8)6~T@)x-iD$+u&KT8N_aw0$J}J!{{GpH)|5yq=E3Oq}$FVXA-%<_>kZuqmn5|%x zCcZ;!3?Efq(!RIfjT)~Wkp%NL<7Lp&fo>hkulCv|h2K`#4IFY84PLjSx66)(8M%u@CvFa{oz`q_}YDV%7-;C2<44R4}@)1WapG-bOeLjYR52Q4;)li{yo zGUol8+2j`<6rjS}>hdERq@PVHCfoT4OxsR2&2&+o0N@kg5vvQdm^ZnT;9E8Zj_O|!ny>5Q)>sBmQSB1eSjZp&!|b%Lc-+&Z+tS1M~v5`Iu*ek`@Diitl6J96Dy{(Ly;Xw8Kogw%YcJLb0 z{^+_N#(c!R@P$kqDdCMCbGW!)&ILFBmRlGKd?5Ugm*7`u-x{#Zq>&>y7XncX$7KGy z4+zeVNJ8&&TAcr_&@s)3B)EJn+F^Lg@&R{_YBRM(`RmEb6WRkVD`O-4Y8XVSF46E z-)%CJ+E~)JHiRT|RP^j3c#mpXwqd_Ito5P{>a7Gk&j3eBJL zwO*`JhI_o017Xe+U3m6Z!qKj|2AJ);rj0vKP6oIveYi3vt*B#-|1jnR@VGm};=5v< zN%e`ZC{5XT=%-1e>g144Regqb#&?)gi`=)-!S|!u!YZJ;DW1q`7^)72);U{6YanT} z!bOwUX%Uo2{x(i)v!bH@Z}98jdOv$$!?skm3WJ^p-&yF* zUFtIP7FOWN?@?fodo5L=#2suMeAjRU+71!*C>a6I3C~O=)b%i!2bwaxnw0-G*t>${ z##+7GZ_6>OPga&R=#E}Jw2XEG% zO(pgPyN?9V*`x$LFPTf(5dz#E|H~;Mrem+6PjfI^s`!!qQmXxQ$C6@&rOOEH){9V~ zRkNZ`bAoTb!I9ujTqV)q-zI}SQ(L64Q&2sUPV^C8sy3;9JFdMC5iB$Nump)6wDd2e zS|x1(Pd0xfcKl~vCu{eUAVNgLc+w2&oGAeWhUREnw>F0L&Y6lD0O5d!rYqxxR zH9-2~e^7kZj6)FG#2XnD?jmmvjCY&ok0tX=8dZ>a$6a^CO*$i~=fqt)i|ReLXMTC6 zUCggyqBAl22b$&ZhNMzSLq}mj@b_Zg2Er7hD|@+ChPu(@GWb2QPutdd^2y*``vj@6 zn9u~K0ZWydp!s*#S%TM>|1a*|Jeuu1{uegWnRdFUZWt8PR<&cDT4Jh}w#HUf-4eu- zX*ITpR9gfg(*;GtU@#c8wUbCKNlHjsYYDYSC6Y8zT1!YQ5fbVB&U3flJ?B2>-t*jZ z|9Q^goSd9Ue82fD@Aqr_fZ^dKhNt1cL8ZaNj`x8%k(4<-@VzB&&$6)PPPRu_b_`N? z`B?so%&3N1OoI~xI4k-2{-pnWpG_v9qf3!#924VTJ-jvK%0SC>00|CM*J)+L$IN?Q2{_m1jjwAgZ^gyU&fDPA%1vJIb-$4! z+FPCsZ64wT$J)02lc6(%GA^)$z^7{1*vTW`tfJnwxm}e~RoY9G(Uh*@)I^C?l&LBe=T$41#;ADedbyfUAW0Pt__(V0%Tx@)Ib<9alAKL=7 zVR$s#Wk9bG${&Y11+r>aJ)ij@bdHO|>3rONm>N0>fT*SPx;ZQ3TQ%@rK^J1jdX z5`)GfjXga?J*f#@mF~4L_qa&yR;F6Czt4cVMHVt^)*Zh%&;)da%IGIiDxzEuR#2Db zP9h;>i%^oXXv9*;JX_i_JQ`m&jzDKc9T9qeHaZ+_c-P=UAO)}$gs6!R1qo@DbDpud zfr=7Dh}{c&R^4pU_qaOvL43lUXY?4dqbATbJHq%ix}t~ZKzmg`X+FlXEaQ+rbo2;$`ca*$Tr(o-Gw840SQi6prjalzWIna^I}T<`FmFd>x~ zy)|xNbB*#2xeSG`R%C=W^qktbuYDg&3QDb`?M6>KNs}v-Oi4tQP@2jgR-C*WcVv*i zXuQ^>S$i4EU;Gi9NZTh3(jM~%t~ZhY>(ZoqXRJ=4azQ_1!|jLhXe1*cuxXvXZ%*fQ z(uj7zrH1j+CTjZD56gsHc#;6bIoeA-cL%bWlic6*jW|48BpKxAbsC?L+^dh#x-@P{ z*wy8NFI#%mNa92`)6*hnGxsk`h+mahbs3$|iKiIHT76)*+a2`O;+?6Td2i`}eo2+v zzLH7a*fg+{;Q;PNx`P(XNXo_8zjyPs!6C3iLx6V$0nJ*(ZgLllN38Otld{s3+&aAQBh`@LcAbvAGJWAu9J{OK&w+?p7p{BjitkcU8Jntzsj1mc!G478 z50z|j>Pq?BrdLT5djR0@ZDhdF+A1U%cX^(X0;;KzvuR*xEuWWEd_V+jto}Npx|HWo z_iv%D`wJ@_P)9NiT^L$Mq0NpV6-avYMgumcYR6}6ijFcyQO{~c}e6AkU~XNoXmF# z&%aY_d-zJy030sEGY-|w=b9$d)F`8CMb@UuAqPXYY$w=F3pYmv2fd~+(gIaB`K*1+ zseZcEvX*S@n~x#;Uwkyhv5-9}>$(RQxVqz(@779`7p$FA!=c=+tO3tO&EmpYqkHDA z+8yzw$j)a2vcXfKo!n);BJp&?cqX1My-C}b z++{`kxlvS+Rw-?m)6f&ER^*4bWUKj=(}pS0oOJ^Bdq5g2QhB^)uN>lbe6GdunVK36 z5sorA&9t22b+RFU*!?OZK5KR3^K>0h-%F|k%F!i!Nj=d4Q6=Rr_>AeTuqFwnWe=xU z!UEw1C=SbIsL|Zut5P+jE}M@WU}jV(-s|X(V4?-4M-Vjg)N}FoY~6fb(*OXs|pw5wHUzn0Xb=HZS znRyJbjO*(|Z<{gQfaLK#-YoCNoE%wOUM$+>ND&{6h0_Y-1$%8xv=D9Qoi$D7?p$l8 zScI~@3;wVRlp<0EOSf4v_OjrY2Qc`BqG_#x`w%AP;ue966ByffHu`;m;$FHp|Ae$H^AegI zOMC(2wD+;yV*2|R{5IawCkNYMyVl}01j7&F9lFS%k~?`_ZeIES07%weQ{{ z=hvVgx5w(V)r8<$x@9*bZsJy-|!Amhew5zXVm;6EvCM=JyNSubLBBGe}Qcc@{@a)>Dxx)+UX_3aQ z8;1rFdiShy>)Qu3$()I}e4iQi7y7G#DfN=ZsEmk^S`ZZhY9#jRRIu-(2?T!uHV2%5 zZCj}!4ve&&^O2tWXn!a;HV}tL>vqJ}WtLO&11h<5kkt#JJZ?J3ul}pj8^nvDH6LA- z4~4d-9;8vE&18_ww#;x}!ksL@DKP%y)cgK^UT6OR_YXUBnwXNJP?5rV%tAGj8so)! z(i>OB`%47BiH~koCP%tiWU&EGt#&E>z02iy-0SSkP{K+RW5ctn#lDjVPzJjbPA`NA zwBpSju*n5DPUU36@p=CfV|p~4>T^1|V4kZ+ff;||d?GUglSAta=a;{ipB6cHgb*u5 z$&Z^<_S#BDqgeX+-)FvN`JnP=YL?i|w2h5|sxS86DvqK(J(w0875-PH#3tl9X!7D# zd0k1VkAv!(!`+oxa7I|#>MyKG*}!?7lhf{jpCvxy79OfJszCS97Zx)y?p9<70io`h zH0_hFONLrpdpB^@*t#cLH}6o7&TJysa|Zg^#$8~lBiEoX7c0bpFRBm)rtJ$pGU3G) zNJ|oTlUV7~cK#werlGw^(TPq7ncPyB1F!aBP4z_Yvx;JvbylcZ=k1e&;@9qQeB~ZOiUu5J{`}ccQkHS+$!cZ^hFe z%6$l-*U^PHMl1l|*#W6Q;+W2al!Og)TqQ}s@}2Pc{UdHv5IRk7HZi<6gsi)2%;2}bY zMJYNJ9VD4LD+;;VT4EZMPnqFRqF72qnY}dmlGv)9W4(M)!E?7eSIhP=>{3TYS6$Gv zy6<3N)<5Dp8*|S|TpN>xsiK>E_VIQAbih}oAo?E(r$o!o))~tO=3}`9b-PP7HC?j?;cOB(>hn^~ z*415!a?1%D_c}DSy<`s&bD`F~N~-QXW@6(|wM}-o9|sSw-OkhQFQizp0%)ZCMr!n= zJ|u9n_P!)hq*Ek7W$1o;sof#izw4^jg*e*GPOc7l1oyqidtL!d|g^X5Q|*+tdhjXF0SOjWoAY9KV`2 zkF?gke7dgJ+WYh=WjC2Dm#nrfq z5pNTWhr%u0Z1;ML7rB}t>mC}u?^s#g6QI=|oz!{~{%Wm5^BvAn9u)%ToCx1amGMm< zS*mFGNNKBYS<1Xrq2zDU#F&l$}wr%&QoER!Hk@fUbAO^ zS?L~Z+em;8Q$z`mgZ3vL(Nrt?&iV&-S&w#EXv@7#eciRY>Kpddz>FF8N~0;~xk{Fu zx@#Tg`k38!!CMp0Y_7LNm46fheb&tkj|mfk9z9Eo@qJ=>!C5sVV>W&Uj%uZnn^Kty z9qD6l>Ej5|=o`D^;y~*D6bVrsYP()XjDS}m%tKG;4pS?Y5tfqcknt z<{F@L?r;;AEAoTltGJ}GYT%4|gN|7%fZSwIrOkoB-NfW|7ORsd>?{y;CCeXj)^rb| z>oJk{gNpS=G{-CQW)usdlCMfu+mXZy+Cj{jG=9+I?rh1RaPLB4iYbbCXc9S{CAb{E z^4uf$$D0Oa5i{iORD3@>zr}&ycC7Vsi!1~Z;OFBsI&o8Gyd>?yR4^M9DJU@Ch%3>o0Gi{5+qmX?qAZ zIvKWFUgF9$!h_ceb#&Y{HI`FbWB_d|W_g^b>2=3j)4hJ1!@jeL=|Y*<(%pTeRu@M3 z%$KC$2kc-{esTPjAMw+_(K06jdO_+N&-!Zc15^W&NeLgP>pW&R5l}Yi&DqYv3vx7Q*{PX0B>FZzHaigrMj9Y{cEQ52_uV_Sgf=r}&;Ul8gK#;Z&NX2RX$0 zNddB(8oj@cdl?%_3ZBG9T5Ra}D(ftpDq?Dl<8Resv_)#v7jv3+l^?PDL!npFG8U(-n(1>eCVu|l{~Ho zTh)L^u53nWCCroJeHA-IlcFL@(yrvS7yK$Ui)3fnK3D)Q03JMki%kN6C{ta-(_J2s zeC=;n!L+gP2e#Jn7q>=b)=Nu1E?l29*xyg@+y>Cge3}zrPJ6DRwq5Y4O*D}rclgLV z(jzd$K2?joQiQD{zYzG~qA$1M%3E+Kqq6)Bhgq9@n}2Rz6|z!m`fA2Iq#3`JyoCXD zO>l+=I$9RK+!gEm@WFO~TSJ}~y?_;0k>SO{AwI|4>uIrMYZ)4a`7rkMkFQZ4DKw>&^jUqCGaMACb3#pb63E$4$B_^IPf5lu%9o zeC5`SbA|U~vYcuLS1~-xD2xAKyuCVByku+lY0~Jr|7O_l-jh#|`nf zBE1!-%@_d7)P6EL8uU0wJ&P`u?Mn!7oyA6yr+O%|A=8c8QlNtS|htYM8Ft!!QPrKlcf;2H^e>%*Z`peBl5!nE!cj4 zw86YB2)5T16%n9Qsy&txCy6pF8OA zTIS5MkfrG5ZZkpYw!=-KuZYW54YjVT26ce0Ou1Gig#}-F%rClSOguE&dAJ7^s-Yfh zk=jrDodbvtIpf*4#MxJ9Z7J$b%oC$!<7LBzp1D6l#!Z-ki8mFi{qSfo(CWar291W{ z;Pw$aEonpdXggFdE98Wuh+9QD!#UYGaQ}YzOE6B;-ZU(%_V`z&!{KbXWjQcZdTs!< zpNj0TPz@UfJj#;G^k3~8_L-G`(6i4>`Pq1Qz{^lKIO_Oz zQGsVLK~B9-j@n*zjR2G|I!wQQLJO6*f5A$VQ`YDkqR!GA?wzruJ-=lZKaQMCbv=?% zDC3g4+&{KOyR5WcQzMNYME&#jk65;DV%gzjIE#07V~pD~>2ZE<~aR|o-`>+yoN5!!8Fa>Co3 z!P~_OZ7E2>>##dEfzhgVtif496YDJE9Uo0~4>4Lma7g;RdqWJe!O@Au2DB=7u^~t` zV|^hJV=qv)?_{?0TmK-!4EvC)E!T#3zeu+?38cV-@0;d-jtQ+kVQ!ksM#3;L3P!Rs zspL(95llTaCBmqQa5qB_67wxiJz(s?-&Jf@{M%t5jBw4-L7W7p|ItyKbAo{z zU=c6XBHzXwKewe*UEv;ZBrns~KfZ*)dey&hoX9HOEDhv*RWgzf=0)!oEdMZX{{vx> zc5*>sB7!B$VG)A4^};mRf%&gWlPo=fpeu~tINget51ug=9?J||!J>zHWh8I==(Laa zJEVEj6`A4_od;pTD?J4CSEUYC7jFHZEW5%8M5VU1YggHP=RV81DxeDNdu$) z+A)T4lwI`pMO$_ETz@6Tb_^go?0?VN8tfYl94k$l1$*fyZ{(>Fjy}ukjt0%Fd;+X+ zBqX|Ux@+(WCgz1SaD(5IcE@_D!eYSw1|{1qixv1`#D?qDCcD_4S!-^7@eE~Y2@aXH zGsb)?*3D>j6dOp|m)%oM4+U%L=LF{6ct<#z8$IE9sHrdjS;MdvvR^MLZ-mC%zon}h zE36m%&Bkobecbl%zSsiEe8AOjc@%GciA&IDV;5&3uXFPHvo}(;7>{h(0aI_ZqU@WJ zG5|p2GFeAw;<;$Hx(1Y1A#D#PbQi`&=fX^E+$D*S;7__|xNiriA_ zSM4`BaE8z;W7qg@h*x6pSE7B<@$$$n6Xz1 zm0JcQl%E0P^mQxGLfoNE&rgJ8Ifhu7jEB$;+#)0 zDT)p{>>8mwIJnXvd=o71LgnP-dqbNy6ZS6vzL9m69rO0e(<6~iLl0D>j!R7$2Vw4T z?QzNy_grF2x<-DW_lZr)Z``1NcxDaq4_TPqV%ndWbAoL%Z#6;!pWUTWII)cJMH1{`urdF;A0&MRJ1Sf~1J zuUW@Fb}4IMWwFRkGD?kR_(h_f+j&5feZ*#W48h;ugMW5LeCpZkge6)KSE05Q_rX!K zBfQJ=0mI@<-RxC@&MXVh_T+r|ze&vf|L47FSm}K+waf10xSj62_4A?fq1IS^+5YUx zw+5k5(>&zKo~@fWLnAhZsPA6iGc$0UIN-%ql}aKrj(pidZCOb_ z1?SEJX6H6>$EUjx3t@a;(ePSJs6QoVn>2_V^h0E-4$jasnaAx{UdrHo& zbfqs3l|f z(Ya8ibxlKDqm;l$Uex_=aA#$Uy{0njaD2fv$>5r2i((mwq`0qTwG7(k(Bo!mN|Y65 zXg9$iYerNg;*^COiTe+h)(PUTvrJ3}B4a3H*AAXRBOn5a*c&hSfi0o9{> zi~yxNspY0}u!sMJIdQ2akx*AgNkS9!Hp^B&!Sj9kabTZ*FuU3P9#EqIuDmz%Z5qVKqJE{igs!6XxtrFJ9tL_R1KlU@wv+LV4{Wx>qLkD zf#J0;7$1V)yynCQ_3L9=&Z6{c-47p;Z2cC}&0@Fj;gGLN8M(0adq4@hMJ}p_E@;M+ zgt$(tD9;G|kgrcm@6q~(BnU(|#yf6kXX1ZQ*8E46&HwVTYDv{Rq{Xh}eq4Nna(PY} z(qcn>e|^u9(DMBJ3=Y_T{nA1g>ttdsurLtjB+P<;UUl4xG#*1}k7Z-4)AfyI-Puxb z!iH#Qr%;u#z_k}mBnAePcn9Y+Ei&6F$~vX-NA}lSF!uB&p;|^(AT|*3^{S8kmaH+0ZNP9y=6Q+Mn@Q&-Lj8y60G0s4ek%?i2Z>)R7@ByVExo?Z(a`PcD6 zt^C3n@cek=f77S^FK5obSA1Jq>M>@CQl4j8+m*F|sw0Ce)C#gMe2&iw#O0oCZDY(L zkp#-UCH6)l^4fWwV-*PuoqeK2$wNFE)TgpnTI=4LgeW=Cb1-WIlH3m?ImVgHATn&D zF(c;4Kk0Jq-p3J5lcsNzm?NaI}tf018mp&AGDzj(gSate83EPIWO zUbV_w(?0Ueif0G!d-;_(prU2}HZI=*N(&GPT#eU@Zu?z%?-d^PWg_aAfsmv3ns9r~ zO_t9DWMV$hoVKT(7wsESk4Y#cxrRvbm;l|Ye0^+6gTQpm4$6cX>hn<)KXl}yGnq~s;`$`Y{xh}8S8wMkqFz!53B2T9r| z-dOpc9c{g3ODhkGtmHv2NZg(--fBd|kzN;oRD9#9fz^1P+?DExe;QQg~t*}Moz{5}wmpT#NgknWlI5+6a+m3s5B z`_R)}{=bYg*J3$nEP%Qn;*3|1dX!@89AQO;_&Ax1*Qr5{s8aP<$<$1 zG^X}L5OzO0&VdF_ha()bc2`91!&9N|SAZr&m?0zG7pQltq(I{-!rcP4injZ$N{l7l zdyTM188q;mnr>^*w-OiEte038{NY_6LCg90W)@~ZM#|tku%DCxG+I)ET8C)CZRil= zZN0nXuMt6WVT#?bNTmfG`;eO$%lqUf@Gd~0w&YYi5XpYQ?7 zItST&9B4n)p{ZC#aX1?QTPwys)!ay<={tz);?H$ApzWPR4|IPgjg;1tat&vZCR%fW zw2;ye8?sM14zl|g+^Y;Z&>Zzvl<-xl^Q+PU0_Nn$Hp6ap?)M`$_8*mZT+fQvVZBGN z=juvxZicrc1v7tSj?)(7^2=m>wWPLyE*@a8Z$;t#L!q<`n?@egxpMv&_Ixx%vi0l- zjezu}AIrU#9^s$Wel|oZcexQTN}?-``yXq0g=&Vev>(k`$Im7cU?G%<$tpjxFal+9 zuUB_zOqlt1xE~O7VWaM`{St$%2#(S$E{#T1d(?c<VkasF+arBA^H)XY@`p-8n)BDiiEPXIUi@bCS5$?zK zSw0<_Lfa(;us*)&%32EklNkKTYKzpB{vrZtF>zpVrQG{?roY+^P0G?_0;+J?{OV5A z#dSf4Abyu`(sUOw?G#-%~*+4V_OnTRpQhd6gn;KMC54*Slnrq~T4n=!A~WQpvJ1eCer+jFvvhY8wW zu*!=|ABTi>YHpK?;h5<7_y}xtS8%Z^wYE8Z91Pxs5Yf@?)*ep+$7eRLUbjE~WeY)&BsF0^6(4m{5n zZEKN4ho`&nZ^DGGYN}}u3iF@bb5#(R9#^+_M@1f#47gY*O32OcE{9{+x_4eu*K|A&;Sd%9T?n!Ub6yHATY$2my|wvui*?~fql`x}#!KatkW%*n(w!Ad zmsSQ(73Q^F+`6~!!pq;b5=tw`xXQW=c;w54ye;^MH;#(@RLl+jlnVfqVb1^`^ad{4 zUst3k-W*9J^I5|P3%WPq0-$xc>i6wR_xzIIYPRCZ7d6d@#OL>r? z<6a(uRmM;`T8@-a{HI4E=Ta!lU3n_&;)unSem15e-EmcKds@ZFdBIEph)DPAULIa+ zED!y;Y%VrT)5iKYYelK{Gs)dXi@UyTyuxoJ!|XDCL4PI?GDR8>h5aBuh4+%qzhAgy z#zs$S8pqoWn{AVz<3Q?G!t%z!n*Y8q4YC;Rpb6f$tqye|)=4k;3mnwdVWMdT>6iWq z`#H6t9jBEn<_wm#y+ zcGi5yu9v;eiH;v%@RWl;`l)x@skDhI2tkszJ@elnjrQtgW@;9L-r@0hswcv5C*+$( z_c1%2VCcjjOEwzStUg6}3#0vLm zjt+C7Ys5d8t6MLQDpYwE)&w3S9#5b5XkyiT$S@8l{t-i3J>gm!g_1-`V(H!64xOV? z9%NYVUKOG^f@^Bq(ZTxwg|`Wp%Bu%7IsHuT?Iw7E20sz%G1c9x2QcyD^Tm6mx_lL- zg^7aM?4THZQcNgW9hzQU;~%PS&Q1<=`II&5ts!XyS;dcUqM@}&nYG-0l&0}Px^wV6 zLS^pD>vo7%qYJZ`d%@VntG z%_~DkxstwE@PxY`EL0)&gO}`jXcN&}4klls6OCMw809LRl1;2I6;csz8d}TMe}Hd=AK{(>-u}<;&8(hHdyQF z_;1e!R+`d|KLvY7$#lDbZ5qK7WlOc*#_n&zoUuwVsY@8GbNKFt?_1?oo%@bqjfOp+ zUDydB2gd_k?flr@s5$yK81aejq0x^R&e5YC}8 zIJ20qN^!FUo(|^hkez<8D5UsUW7fP@++S^^V(u)$t=8wMVsU8dB16v%8R$3MKxY0c zLp-l*gQg0sI$^uI2vQKE+uIm&yXjL@4!*U zS0+JZA!%f;WCup0Oq#&^jWVL2`(F9BHii*XJHS zxl}`V0Mbzzv7oDkDvmcbt^gIeRvco1c&2b5eX93U9f$3SDmukEy0lrfV+M5;4ZBH^ z=E$zWdIj5o^Y86PRNd>TV^xZdZ~&E@C+vIq&jR}4 zdFWDkzynrNWjXdXEG_=}Ja;eKw$U`t;^4dbUW)KA(9ghE?I2Kkgs7(@+6t=LSrE9n zW_T8F@!9H7fl3VPHQZ|)kn9QmunVb|Ql{A%N^(OnHdPL;LwmkuRX(W^;Y#VHsazZrhC#X0m(efwO+I?w{{{5j6(-6 zBtwc%{vD!-yH#hL`x5y#I2ujkqM?{0Ek?Kw2w7FPNK8nzDU+@lNH!*RK?Q4{md&Z>j zglS$xXoErH@!q44XEG@U#HKIwMtaBgPS}A~e_f;#?7*COF1C|3zW%=4q&ysV?6=oh z0#{9U+Wop&2J!=y++EXB{JqqXPfXq^wzxAMP8YgS+jWzSU&A0 zt5Wn_MO_@-y?i7T%B&=!1AM*YTIy-?Q+$Mq0ZZcqRpuyc9t-q@2O11>ol)|0Pz{ir zXBo-ckCMa04p+x9feO%=1@3r9Cp0M!!FRW7fA0cBinL`h9h*arAu_BXNlx2S!!@;z zD`Y0;LooeY`9VJMn=iC|qfM$L(R*Cgg&MC(<9=TA>!go<&iX6t!mvKV>KWw?55~$E zT~sF5qgfPo9e~21p*J|ja?#}c#-Cms-Y8_VLU3}HS!GJ^#rq9 zS_qs1n3g7$9hO$eTbtrNFr>nLv% z_KpDBG3QI7!DOM`+ZS`7YB)S()~5L8Y3jA;bLJp>R@l(43;(Ay;{Va#pZqsl*R?3?|cV}cd>Jvi}hs>apKv(m87M zi$bTRUiK5Jb;R7?cQb9(lmo6&FCkTS7)Fj=U5L%6zRDPUJ<1m?l^f6dAUTr3Mq~Ov zOkk+ymBUUMmG(~o<<6*M4DlJwMr!^B8jn+ySNnV1in+te@|%OYFO`26m8y#CAAxop z@7T|r()+W9%-p0wdQOT&pVwy6^- zM*#RrAQnJlyN$zVwTc4T6(%G0^= zeY57L+K=Y-Xa@c9;O}*1@bb37SR4?=QSv}Qr)4nG`ntEKjbuav6TM9hHIN|+?)!gX~vr}1p4HjuLHJi_B-sn_2 z#=ztj$sO-7CrwjK=g4xFXHdDHXVuLoatF|`^0s2hhCJ7oK+DB1L}X4(psqDdwjxKsoPcY80|baZr+lay{oYcX1Twm!P-{FJ(Lwg+#P_|6#oEe4t-thGj}r0 zqpi@5`q*QvEF)^BsV(ayr5RZ>K-SQ@S8Fx{#wo=ns<)zPo{#V2qN# z)npGwe%k!y-TS_p1{W#?C`9sp(y4bur$3h6K;M>i!wx-gcVa+>@Nz9{JgZ!i6MytD zG4trNXv>xw@*D^dO@|~gGwwA^yhQ8vYv6GO+a_|s%r0w71JNv*@{tJ%I7YL-9qiO z0PRV_W|@_>c3T+_IZAV4@5|GPGrWwezjI?BHik}J_5J-*p(W1hbhE^^q(DhRv>Q@b zO6@y~kEc10l3ewv`4tD;PvSbGD9D4`0`^oBV&6{^Zqh4RF+wfivq&ws&9q4W? z5jc0Bl%m9^-nM9eFfB(wtp8fsi!e-MOzKk*9>zbVY6C$WBaH^#Jz;S)FofVu`xR|x zx+la=&+ob$;hbmY%lg!jK7n9q_P4-8PPz5nqvj?(Q&cMxCWjJIx%l~xusNZ-(g@C= zuWtc9&%4&T-KgE@R6hf5&vnztYL5s6>N|3_!|B%#quuvCo!8V*O#m1R!o!ig%hF!H zb|`aXzQ@z&?{HF##c9pccTi?xtE7x@F4u>=OeIB!vj^fzdC4JE)eHk;p_Rm@) zRG!#4m-;ZO%C2&JxE}fi1%6#K99DbPi_mZl2fv*0q{b|3fa4_Vn?1z4Uy5RGgJ!{VZs@2!#Jb|m^ThO;R5%-)mV$q!IK)M!HBWJACS1yLyHw3?0hf6#{Z8D&{JVNV&_O7!G(+%lwGV5cj@!eK8Q#fNp@ow9rjPAh#R!pF;&_ z_0x^dU2dWM>8!&ubMirdf`eBN8}Us04Ps6u_-MqP<>j)9l4qRl#y?wAdNRJ7v$A%l zhDNJTShxK-hW}~ALRPqGg7lD+aLDOE_-5nUW({IF-A<)(_<^!t z`h*pNa^K9SL(7$P6E{GanX*CxgG^o?2aJHh3v07^IPUr^>^sFNSFvXY5cf3@#vDR; zGC}vCr3SsIef^n@J8wsuWfTIWZwqObFu+j>Rt+%AROJ8^M_+)4rq0ECeZ>& z4CjaAQ30dNeirP?MTz?pXZovVZs29ymNq()Z_8?2&&u^*AUhUaD2(aYxs zqh|<-of2kUK;RQUcg@YaNpM+%tImu)?(|6YDMsJLj`6?#it%1}fiqc#&OT64J^A_J z+5q-u?%pGXSJJm;osfTav{*&~su6IEjEB2#jqMrye%{)yyr$^l%AkAwqjSyS>)Hk@ zeP@qlrgjfC4V(V+qr7%zY05ild#3-M`(ldZe(t-q){;wR@rDDprQ09#fDk?>;03> zQ+A_A4EJvmRw_4!Yn=hKH9thQr=+iMs}1!D8!^wz(ankB62#MQV=uSZnAW;Q-p6}s zd$>P#A6+uN(@NP)K$j+gg81WP;sE7-Kxq9ThPbvJCVCbEm8(z0<`!1hyIrUV$@9!R zWVW>W4JAoGCrTBLWURabHqKPrf4(aHl@V}b)BDTWjnV>fQIO;>k))(fs>W;|y~bQy zR@H0ls+wa(ewy2dIBX`bZ)X?Y69%skbh*D9T6O6*?G_Ovf2@SYM!l%;M>niGv}GxS z1ZR)A2rDyxS8QkIJ<*%XCdVt#?`Xk{xMU=eTt97AUQZ zi-vgB6~hkCZK-aP%R?fN5y;Q|Y5HI8tb9s$PuGYxm3iIr)B1PAmY;Ov&yK;>iP767 zlEnJg2+I~W^&R4c?w^fOD=c?*YMs?Ds&?J+DH2srkAE$_lixOq)CnB zKUqn~Tt3|ydr(`ecBYpaP&4JIWd>BXc_(J--aP2~?WJI`e@1;*h|2%Y8BT@|rJRod z9Gs%N6BEbR{#nQ$BW-{CRmqi{C7isK?n?NCgF1l&+0EU;njRK){`8J_OQZ~(I#Z|$ zoWqcu-Oh_WYZDpUhh4#W*;x)Jn95!2hnwO(+KYD&TYSM>D4nMO0oNw2t@+0r#|T7? zfW)TPIr)jS@u`K4mWeiiP>!Js_wtK8dtl!r=%MdBkY!Pgcr@br=pw-ZpYUK6$~YR* zoDYsRH|-xFw;fMa+SI)+y;M;72746k_V%li5|96$R6Pd~F^*A&geS)J0J1!=u_Zf- z#|6|e#C{%^cx{ZPJHLU|#rOyuN3;9@vF#g4i;-2J3()l5rFb@2oV!n58qf+y<;`wQ zG!CEFJ;ITnk^)}pJw5F@`{|a{-JC@5;pBUqek9ptZ;Zck$f z)R{nHBS6ZYm5TY;gJ?S6uB}XZ9c2pr`{Hnyq=F>78DewK1Nqr>;IR9iUX^^gUEtFA zDuLck{LvdN>ll?f@B=IPDo;cUke0gok7;S!CTDSrjs<%Oc0Y#eCH)9-OmZzNn4@3&-Fhn&S;NYesYbAzCI6xj;FLJDuZ6o$dn0lZ$PDOW@1vOxBZFh z9k{)g*5bICA019?sWp%}z5?<9K`Tq`tfkNHIh75~1>eUQ182>FfzuH|FR-$@3_pgaS-cvWP3^dx0ckKy^!9=(%u(M0*c)+o6p);Knax0DQD1IPd)A<%*xkDO zfT7I%5wka1fIHPyux3pnw^eW_+sUC4iDbn&w()XS!t$al=Y==LsgDZIL&OyUffk=T z==-Jg_5>}u)I0toV82?NTv~U`=w@2w-tHnSl@;@Yf(uZj_|gY#Z%h#_aCQ|WA5Y^C z?m@41`fE#lKDzt7xsMK1+3EkmH&o}iEb^ZM%-rvQ+2p&3{s~<={EB{(c70PJ4GuaY2iKm$EEgMwMgai}f45NmjQ;GI-Q?cuIlh$cGLDVb zX9CIhWlSIdki77*rxUkdTl)&JRyyk*-lx)Zo)$@$;MMm6mJ`p72;ej^E5`Qx);(al z5<3CdpD)hqM)^ z?B^7q5sXz0Tl#h#Rd4cwa)B&X?IOG|iho9=h?oIg4_rsjOrfB)8jk@4hOXdAL zA7U<8rJZaZIrJMP3rJ@{LdE&sISMZpN6j)b&)#5ZMEbKRVY-9jf1pvk>tX8!H3GkE zrJEEfm?T{$s`M-`fa*Uxgbgg!xObsw_M?@GxlKNKQZ_2@oeYq-mgw)+Ucn3 zktrq9q6dejb)2fhv>jB{=t&SIck38wq)LbinQ4oblEI)DRGr$!p$GPenp0)P6_iL}c*1h+>pJ)H!l^}jUB>DcX?{$4X?@uer@Y*E7_UbeD z&KgF3y~HQb+QYN#VDAr#75})YJ-Uh7lkRS-=tH^HRPk}vIbK+bthcH*u*~erCex$j`}Lpe3HiLiC#+3%&u1`%%EJ z#^$;D6W``?W}?^~qnnuXbCZcwR0rDNVHGK_xGRb?d7*2Y+7L8R={o zVn{f4I!DiQL1E@1!SD*i{K)1hHguWl-_8lrnNnTt1nXTGRZLn|t+5ir!dI za8cf(*4YJUR+Xx-V9{PcBIig^gtv?x_^YC46K@(Osqy~e>)ekj#dF~rwpuGriWao^_e zKF9C*YHoz-8~%Y~FerC;;SQ2>B))FuZYR%anhQBLpC8(0*5ljIwDgE!H^656Ug|QD znMgn49+<@c)^FIVF3h6t{`>3?P6p?T8fuWbu5s8@HJHbK{JXyRuEmA*2YAK>)$Zlu zl^0x*YQ-R{lWQ<0f-2!WTj9`FjK%q0Eb%+s6;#gJN{+MBC33?+r7lu8aKUiMH#N{V z<~f#%5 z7&q7Rs4+i1C!&)P8H30a!Z6JMeT3`b`R45!?s-sQ^^*v>o{<(+JhK{3iU`uBqaOMv zm1O+LG`~#Fe7~JRlX1OR!GXBJ<8HvT8 z1F9j^3qIP|$lwY?yrc9*bRGwree%Gn%As`Z960Gt*tneBGK<(IzZ^22d-tuiA$gM9 z@+0}3&l3Mljn^;R0xJVLw5 zah4PG1uoGeZ|Oqfhgh55Bur2Oi+Up_5bV-08HM7^2Y7VhN4&RafjBM^@5a3z^F}hu zA~HlQ`=!w$6_x%DeGt3_`J=6@tXyM(s6w4_X*a#~dEPLErTT|y6fq+2P=2f^;3o=VCJr?9yO7H|NBR(-6{#liY7k2^JOb?qf9 ztN3f#!UhdL1{pUWUNf4&`KEy7IK$Cg{=V_(Sl0q8d5o~{@WRK>`}7MRJq}R`Te7(! zEd+hkHiDXIJ|yV2^n&nAeS@e-0U0pOJv-aW=JXh>CF#_fIBpNA7;=4|Lr2;OyJ!PG zA|sJ>nR8IlLzJm2c46ijwNth$j3D3zt7lU&6y}Qg`lXVb^224Gt-oBJR4~d_lNAS$ z9DS+JgiEZ3uVNo%7w%L%~VI{pJIB+$k_)h?Fu%9S+*?MkIl1lG!UYw>Vq zNgzF(SO&<~^itBCEV!LF%D$q@zj4{lZ!js2s)#d7>V8sD~xca^8D^X&0zi+(My)S?u5MUiyA9q#FXyHxq0S zF4{C%97jQ=K!upK^a}|@TyhMCj?0~)@kRZ|v5W7F?ni1+%N`1#7k!M{%zW-NT8lIHg-7yD3OLj9Ebi zclO(t)293pFUSsYH&TOd7~%??h*0^X72 z^oi}i*Gd*+`2MWLYWffc3d|8hD-j3M>`flu4np$voIMEev25IneqsZIG`3bkxDTzs zxwKipUG9V5Mpar+K+eBdCw6+=e1ZRxJl2*xeL>cx2 zej1iZ9tgEEGKME4^%eoNK zgDV|#!F0wH?nv{G^dF=~7{1GnIX8}G+SRJs0n_}QK^f)Gkr`zINj($yDeXg?S)ja* zX`j_d1@7}E#ojvG3nzu{AMgv3Q!lScQm0<6AAR=p-G7;pTU7iXP^}mHfqeMivMluW zD%JkQ5xjEw|84~KcY~|HE5tS(E&iX`w*PSw2JY`pfFIp-Ebw2y`7fXR+aq^pBpm(M zAG-kmyJIO8{U^uz_x#-dc@C@7lB*lfR0T#N*(I^&w5^C}omYG~SK`+wgKfNOKD@!X zPFP|Evl-3a9}5H9P!mw89!CB^gTsF06cFFHy- zy4*{jHX{1{awLy!0q;LPy!s0x_Q*Z# zcG@57q#NlCaiDou{r$DhKPN~JOMkiT_Qx;3h83<)o@rfy~y5eP5$YSy{egA2jd0EDPdVoE;*M=Rbl&S}X>2`u%8oWNnJm?-)s z-{`bc1Ks@9lB|n(=#*9Zny1R)zD4RPykNw}5+DqQ%9cmTrz**sG_%3-@-X0ZIO`~I zPxmMUZRWAYXr5qWHs-?}*`XwjRHosw_ffe)n;C}b+02Y-8b?`MvM!B;3HKHaoO^+6 zh#qPQX{)M%?)ulJ->QMbYS!6dc4?c6`h|Y1vxA5DYxSx#<=usE8^Y6W*VJ}S!iH{a zaXfw)krVne%@cLP)io%lEo9oW;L7QiWx93X#Bk$~!Um@S-EPAOEjKI4-SM=+SAg}g zGC33We&3C3wa1Q{_|6zC0;F}#ZN37RV@25EM=yd1mL|J-hEC5SFaKqP=NA83MKq=o`y zG=(hjv9B>Ocjrspc*?dcatZ8hm{{K{?a&RceW5TQ9{E-xJ&tHwoL5M$mXl9Db- zy|5_jbIo^esjE8?P{9pe-9?7URA<9P1u>pIix@1HP& ztGIcKG9Fa~WlUF{i+X_+^_T{gdANF|XSs!%5MC#RJM4ydYm5_4f3 z?f@u>rhuYOPkg+*0ypJpq*sB)LUu`m)<>CqTMmn9T~&|Cs#z>UuhRV$T4Qd{a8YmX zmgI|Bt?P5lHA|a<0%XRkvB*T(XhDXc$g6;gCz%pVpkj?>$>zMH{1Vs6qhR0dW&7?* z>o1o+DH;eVyb&fL5&z9Zj}~HvzP(QDm-*-uwTY7bVPP0r)2&q&E>L-$eg30^?2p@h zYx#4!YlNoH-rM`JJ@)~^!pfxJO@Rx4ZJ7}-$&T)yUh-@`WIWcfbZE?R_mkD*+(wYW z1Y4tQAV)YgAd=;lEjjsx$H zk7wFip0KsFsj{7$RGe9<|DuF|E?UivClM2G;k73!Yoxo#1z4&VzkiZ0+~V5r=-^R~|u5W(^Cd zbVwvM*dOFGVwJEARWO)IO!8^##c8(Z?HB}93+AkPzDrGGUGhTvHTRLQeBVamWJ)@) zgs1zuu2I&b(D(`2ou*`>D8fN(DAXz`eu}F+%NW2O%fIQ-u~GQ-9Y-BtEDZMXl(ogu)?mj#GLGUZRsgcUgNGB&;cH#ZSs}CwnA=x@xTw~LOXhcQ>L5gzu<~rWASMC#lF89t2y<%xZjOPu!8!8%f&GoGf z+@I;2vUVqUtdm3)hCNli{j3o_A<5_uBPd$kJYrF zw(niban16`^2nTgs)~8m*ojHzd{31wVMK}Q_gfaHOFefVIx-4_npS4?&?5e1c}N7Z zm)#Aoj%>V?YoU0j1<|}=?XSgJJ+aGk2B=+ToSNwE<(fu+hSWqRHk^v_2Rz+GG+as2 zY0xg;B(q0)8;gs)cMgG&AdHgqWt2UmreE$FaKI?~yNUOKx^a#=;m%$45x}Su{t|Dn zQBsR|9Kz)U#vBlTt)ZQdjr4my$9w>L%NZi~l_v@IMpJ{O4ac`24*>NxH1~0Svtq%#xQ+h@bJu{u`zG68vEg;ivt&9edEKDXd3~dm+~gn zU-9Q6WJb8sGonn%<2++2gl}}g+TiW_pamo-zd53s@^QH%E5ejA|6Xms%`#z@HOU-W z?n$uHc_tN}tM9Y2D{`M(H|v5jP1#qNr*n{$>gt7LJ3ll4!3&R8J_*bJnBPK&&;bCj z=aGhYzG$kw9W{Z%d^ak!^TC;Om5a#9ykNTf2kc?@_IJm<|ekj z&VL-UW2gduHHtU)ybr(Y1&-N=HX|DU2(v?G26a$QKc8UsA9}~NkPS)9_HGhgVL~t3`D$z8VgW&k3kmmJ|Zl3xPtK~WIS?~?$ z23ZE&m!IMFC`%7n|FSrDO>C2PILo@bb*OUGha9(`@~$f`Qi~$k7$cbZ%C}0LDp80k zYO-88(htik5B1J$kzA@M#u(AsC8WgSICS|Ensw-}iGaZzIL|l{09~xSCR{!;JfuFQ z`2FG*ZF8#V(_K3OQDU0tw>9lRpa655mcjGHEDUSSbB|BDj&-f7$4%hyw#DuGwRap) z8kVn`w*VkjIWWcB{WCsp+iErj5JbQ~M#Os+JABQ|`0XiTcDRpS2vW9H8dLS(z3gN~ z{JbCweJ`yF2&qJ74CL6V2C1*^91XJk^CZdXMeY^s zW5bA`SGBTiJNGY2!*~F53;35@1@AqD^1DM=D0BDH+dCgUpuce(YtgpX9y6FF!)O7& zp)Njy*|)aaks7qXM%v2EKF)&exL%=jTzbKieRj^%Lr}i3=a)Vq6kYbI4*jYts3C5khniYjLfS*V z+5$r!^uJVAPD364$=W_)k!8y~@_Hou8%~WR*T1u$T|Uso5KR@MLT`_3@A`_x>I$y8 z9{ISO+F}1;V8%Uw2|67(HjGStgULTg^Cx&L#oaK#{_){P~Jqf+lV>O7!!R$IQLipWZLoAymM zPzC!$t9IJoe_$LghCZ7AMDLyG3zL=q;%xuDyz=Bzr@&AC%)|D6ZR50@g|^lZ{8m67 z;uummhx0U}Z!WdLD`RUDjm&|n(5aYQpJA3>NPO?-nrz*Fk>!Kn8>Bx~z4fdfdI0}( zZ;U4L(yYeDrwqW;sPl9}c{+Irk1tH!3^}0IOL8_5z|d7Bw5vb3s$YK(+fjoqFbFCAB$j+IR&*t*5}dhBA1`mq(=q2TloD-F&rx>##yxU>X0d^Z6}-14FT zG0JHgyJw#8t>ADh0Gzv68j%j5Y2icc1f}IpgV$D0vTHLM&?Nabv{Dlw6_u}G>*6Mw znGc7Ozyf1cccW%;n3r>FvF2!OPEhcgs|SgkKk@mut8ebQCF%_O)%UM>#?`z^?teSQ zmrU_I9{k?!cL05Rz+tk3ZVL^Ixt^0APEoSfPgr^wV~x`$Z0Y6~4`*BJYjWp14%SuI zC9Gj0(4MwcwKpdO+uze}EXvzBG*_z8ojl8p!rJK=jXCWfM7K!Tmq<7zz0@1oFqMn- z3qeUpT{xFqlyS4E-?Q9ob3dTH#&;h5k3qoy`9=M|Y@YtVC>Z{;WB=pAoX@Hcy*Ei? z#b-aCr;PyArXE@4kbm94inR$JR$hvL*Vy+lGDFbC4#p(I$7M7M6+7cv9q+>ZI2p<uFP)z4kww?>iurJ`_&m8(w}ARgRp zf8#0qmNUxgE}gx5G3HdlP+>jzKHN<3au8( zhu*h=(nm}gJGdUTcUOt|t^?R@y1$;&D^Kkvm=D%@bxk>MKMh6&jOGgTwuqR&!72g0}5RHv8Sn`MX-910b)_z{EfY&oG}|*8r*w z63^ldWG@cd4z^Ij6(=XR`%b-h`-VSH!A-f#2XBBtLjaOA(RI<5D~!cwnM)EsJRasH)06`B1b{vFe7%{LVg z8}rQtFFELFQDvLA=}@WIt0#_76^tbS&u?Gv!f`Zns*Lttc~5{c4{Tl<$1D%{gSbZ9wCL`=|P3dul5G6j(9U zGW-FmI28><KZ)jlO{6}7jyDX(hlhjQHUSW$aBWN%tK=NMw!bzF?_I!1X$;tioU*2+BMormBHQKa}d zL8u`~H9d<7(!EoTso6SE?!~$$9cW(bE z{g28YUTx%!i`Ww^TtJ(`Ktzq5YDCT8j}><#B|8E2-1)#AN3>pR;~jG$`;BQ3EvIX7 zdUGp?iq?{T<|UQ3RjMN)A|f>|458g&B*}UX@6lt=8&aH3I~aG8g1a> z%Dp#=$i#TU&h2XOilmp*!`YOqQbeG{Mr*J#;J4tCI5kw#6*ZaBpIx6L6EUVySuoq2 z)h=ou+2vQuEu?X-7S10faK42HQ9LhZcRT3D+`99w$^gV0N08lC4OY_|$f1fO8|h)- zDvgQ(eY~s4g4y*U#=~GMYh-9JNBN4q_os^)Kch?u(MW zC?dWQjl@hixzq%uo_jf?rr6(9pURpC6;C}|Cuo;|*y*7*s{USPSus5J{YU_d#5VNW)`}u?*8AXG+GP`cST6@V@?sJ>O&@RvB*9d4q;TrAn zct5`F*Ry>yCjzM>@NKoegJ_;@-4efnT1O0vDqwI!-NY{6E*+_(z}3HA9X!$WyK)&ABHj?e&cCoSzO!v&0B@5uzmus_OB^SCZ+yd&F!)x3A{HaYIh` zP4E4LaBg5)1R*`fuiW-G?H|O%$8?S9ykp|W4aQz`;c5+ksA(7#^_6FLeFvE8jwWl} zOVN{H|3h2y2@P$4%(veto%&~Rio@@_kvJBbc}nMzYhg-`BGN1nyJ`j?RjOWw0gi)pn8#9PxjQZU!46Oyhuv(&V+oI^`tg&uaT@W-6on8 zD>j&jXo22a$0U{G&mD;anNXuRovY&TL@-tKYmKEj-s~#_nM2)J6XS(Cs$Yt~7pv&6 z#Ugx8X36x%!IqlgAiC7bgP*&P7pMF!_B1Ih(`nJyv9Nv zPL==gyBQ^?0Vu`s4kwOwx*MjN zCVg#m;AD+MgME8;zlF^8la0#86Cu`K+>ax9ioYSolY7*-vsCSU)CMw21;(zxztgZ^ z%nlqH@?jqcwJ#%4?AD6Llo;x^NFxMKNPGa($V+=U9nLJtD)pY0eGGJ7^`yk+Yn1VW1U&&Rg!TCJ7rIpIO8Sv0Ax9Ov7M;Xl;G4-MWSEnWzs%I0+1>-y5Wf0v|LhM3TC=i^EjMSgF zP@%5>(;e!b(n;|aE})1d+8jfQrC2Lv9*rhi-#7VZ&kKZy`E0(&_ z?oilOYcW168u|0x&k)WeIG9@|aNji0pRVT>kH7P$D!S@(i#&A4x|Of%-Z@YAO>r=8 zo9_?y0s(#fm2WC{TmTomv`YzS_&|Hjmf^C6v2VR%npHA0wTED?fdvS@|5*1@7<1F7 zh|BVG0Gm4gMm+R6PG~cLA$4g?tGTIheRAd#>1s&-G=cIGz6P4M>aqadXEWLjie-;D% z@BaKys$ZOWs{OSj`ze2GeWF}9+il}(Pznjx!SbpN{3s~|*Dp$y9)xAJ%I}`4Vu24L z4g5!+=H_pJL8G`(vD?`|aW9;(xLnaIDCH8+gvmKkChiFlV-*ubOy09r>?k1F8#--lK;li{O{iG z6FWS@+lgR3m!-)uCP8pKWY0V{N?5H-i}UhUHcw&H5I`c=CQXFpyz5_1 zJXX0d*@myX2|%X|VY=xivK?NAogh9QMyPu7&02}EZCP50sNK?ihR1(-q4gYL(xK>+ zxnzvkAiAmZbVQb{iA9L^)HotIS%4!>=#~CDZ`vIcSh4Jc4jOhbG^zj2VQe;7^qWtz#ukx2YO>{Ew(TXNtX@(Ip^K(ZFlWLD>$o z-($~es&V_O0>h^Cs(L+ZWVJ)I@w-Gq_sk0;W|4vgqltv5HKXM@5-HmJnC7iJ-Y(nG zT19Ab@(k0AS;ob>58%;a*&BrFN>r1H#}L$J;Ko<%*(=C(=gH-}zT5X_ICU8DQct@A zns%wL*URqJYrR{G`@C=PiOfB(V^qY40ztUwX#yRY2ruped6uq2Rq9&QH<^b9)zU<#~o0h9H7bGq~q370c2 zj9*SH6^EDepI2HrmcT8T%QAaf;HR`(zgLd(k~|~2fWsMxh805BLOFuyUM1G%ekZ-h zy52h#$DC`fJ{LT4Ye2tNMbp9LY$qpxvt(WYZ1*S_=AqTG2?PYW4wZCMek*h?k;XM& z@pMvNt4J@1bMB}9+1oB_laU~qWH22q1IgLY7S;Q7UGa{p3F~vtbpw<4;W?mEdxY-( zG%QAV!fW%99nNgnhqGgR5L8X5O1k*mXZhbn%<7CK_K zXZ}8RJu=2&y&mMrWdyRqZgHbzT%+?0?b;kK^_B=YJ+VB{GA}*^gEo(iIADyp?ifOy z@7kKCoAPd;CK5$)X`+R*$*-jmlCa_0Co3+8+uza;+*@sBLLVON57P@281l%A`00^V zg9eu|YBxE;BzS`(AXSR5^4P6;r4tB^>p(~?l0(D?n+Aec5{ZYIrxP_F=`Jn+1I0v2 zk^8EF$?+**`f&Z#GD?*Qzc8CUmBUw2hl^sT5{p2t8RvNU0Yg&o`_8g*jBcV1zI?Gl zxUeD2Ambro7-;7GR(l$7|K_~+3^Chf7dQi+p3x&PSvuTq(LW^y7C4knsa{K5ln?Q< zy%VEkj<`bp_Ow~cgZK#w?B{+outcH4x&W5L%+(drGxI;#_?YHZ!O1SG*X9E zcUk|@Rbnj>g63<+TeaU`)2r zIndj9t4lFFT#*f0v%{ZVrEkgs*ExRGdlSlb9~&tsWaHk=n%|jLeln`Dvgd=$Cm50S zHxzbbA`*lKabbD!KuF^%#fnMI7M3=#(PcPiycUK>6nuN!s9h2TfBzxLvP1t}XD5pg zUTr?Pme~~51iIV8-(o_p(I26PmQ*%D-4gL?G{6r<;o!V>2qceqkIWHS>8 zc7{wwUzl*`Zi)eF7=4$oaiOi+o5fhc=Lb_QF-PmgjU(_~fj3ibG~8>g9L;bTW6)5p z?(z>j#8KntxO7u(dT^ud)w>7RYh@KUB+Db2) zeFQ3`FG}CwqTXDYGvFikc_aJg9z`Ox((hkK!Y(=L%>%)Waa&n+%%rYA0>q&~YYd>y zeWn}Q=(C=hny6!#ikP7=NpBh2isg#$FeheFULK#CC(Zl>Ig0wCR8u~cG~uER53<=N zj&D%~u7X?4VS*}-6Mguj{!FiXH|9Ajx`FLM=(``8(tg@B)VNw9aHR#xttV_BWRJAu znly7&{lyvSe9{x)at_Pu?C|$!UD?-ahyaG{=eZ*p48NqtcUSxuKVdTO#9|784>Q?n zj}PDWH-eU-{8X{jTgKN61Rgev!ZDi^ED94kbq@Qyts32sy>~GOH1i^J(iqY z8=3MOkp+R?kU!v~Ih9H{n%yAQAaeE0jpwr?Y6FHy+G>&pHJ_XwGmmJlhtbR8&kgWK zD$KC2C|>X=oWP&%?)Cxa6A(Cov{}-xO*O8xGqzYI0U{|{x<~YpDJ7jBGOLV_fr=E= zXEUj1HY)kh13l%Vy8V$T-SEpz%Yw;QFpTke9-0K{TDlRF`u|`C);&^)H1#@bdZpj2 zHsNJqWtX?f7o~5f%D*W6MC*}n4O&e&x*4o1yaPjwY4yl2O1}ymVEy01ph&S|ihPk)b>ZnSKUX%jTFh;SevLP29Q;9S)1>`7 z6PrXYzB^!dFnO56|2+T7(J+DL3P*P>S%_+Y6XKHU*=LQw3$6vc#3;xv?{g&Ql4jn! zjL&Y)1ed!0qT1imvks>MiO~&Z!#ijoOj=}3t-)(;Ao6Qqm2a7(p|{V@8u`SzIeVU? z4`>yp5i$=M4W6t`;CSM@>SN$ag69?6@hDL!?sDUKv-=yV4GhUPOm+9?XoevFrpzL( z2EYRPWKA>z6O_1qU9z90Tez+HBBFUsh@{{J!PmTCBMTQsrpp+9mhtHl*BruvoM931 z1m8qcfY_4n3}PA5H#{SYW*dW%1u_PDUR2(a(a_pK&Z2kg29+NYu z+YFc2Hr<@Ngg%Q3r=g;u=Nkv%oG}}&<-~lSqXf4atgK6Or8w5g%PG`{bZZ>st&M*4 z)~iFo2N~2N~ek@g?E~}mzoP-yy5X{2z)TOdwT!zbzAeHBo zM?Np6)w8>%vn%dLtB8}?PnSwOigpQ-ZLQrfshr@IKvoc0Davf$RLnOU1&v$95ZJ(S zkLoN{9k6y2!Cp2~!;4*{E}5GYrZSPw+!xH(`W6%f4(Y?tf{JMIOrPTasAvkjmBqNBLHnJ^Sxi16!pADS`Z;dv}Bv*H+Q}87Y!Bn zvx5}+o|xrR1>SbKh39DjNX_6GozC{}F*)xIyxZ-R_7V98bAls34OW_#n~`&`aF`zD zVUxKxEJF2bbZva_RSSPp55+zwgLFU?e6nbOT z2Wk}dkf|FA;}>FuGSxrsQQ=XTk{vj*niJvBC3Sd{XCNJwnFZMx)|2nU!~u`Zw6>sM zbwU0Z)`$k}j-*cp4X3PfXsu%`Mn47A{`6O3hX-K@t?3BMBM)m6wFvh0elq)y7Hdtwo2+?X|E4@GA?BG~S zRvY2$?JF<))L3`z-r{19Yo55=Pq{wB9Cpp0*+ub}ag9eRaa&szKZvhK>_&NiJA~hR zXxGbgW!@exy4_0{mc(Pqi?k?z-`Sn9=7#BJ0@w=lqtraAlG)=f8Y(QK@2<+`^0nsA z%Nomn3G{uHz|I6ubdMhMi_(A{``QTTQ8Re%)HnX3Yg`}2@JG6(44W^(e2f{DFlyIq zBAE0c>g1w4mmVRn1!jpzgq<|t4ILu774bz$M4Yw^e`uzh!D!S#{|VzF>j+JzIj#}! zKCWfagAEFvs{S5hC_gRD$lE66jU!a0yD>YVNtK@mmzzScPCpt>B%^R@=lwnOJTm+O zeOVOqB&x$-u#@Ogp6~${tv<1}H8*^*=iR^xE7x>p^^hIL`bLdANSvb{AGLr2cnu5` z?*kL7v2wrXI6n89G?JIU(_Pwk%SbRU54iDS^l*mThkR_s3#3)&l4qOll7++eROp`^ zCxc-2yE%x`g0A>;vT4swoN}A?iC+BWa?NS7mS+1NE9~Np$uuXePu#x&K!nNpvef82dl-9B01P6` z^}lu{Wcqe#>e3nMo?>$TN01w9kYwVKeXP*-Z%EU8;4z3=&2Iz=!qHsmzT5q5T&LDK zNswp3t{xEn8c z9v9Xcdb$^ZAtwA+^=86en~`h5a#v)I7Pc`wM9bILGhKBNfc56`P_r zX+;F8P&a(j`xNitTNCgnMHS5UHrt&>F^5r!SQCIe-S45bpYEaF(U4}b`{zGL%epo@O`*Y?eApNuHS1;M;Ym>Y@;F82 zIl0jTsy}tnNVR;2RFj7p<-R^4J^iMaedbwnh~C@wh}#3^Gn%3JZm*<@`z6Trr0xw$ zE)o-kRnVslupXeV7+Frr=o?pr!2xzax}~z zdE9(0wA-|^lfl_w;mhT&tL2fIZy@(e#|4#12Q}Iy_2MH5E4F(U%;_$piV%ZaWHkbWNLqdai%L*A@)mLbGmn^Hqch88GMKiaCn!Nh zq^;j#Oo!}A!Qv_gW3mAgaG@Mo?Iu1%)#hMe{yxxL6K=yXnyCm>AC`E3RXu!>uv3M^ z3Wh1>41!?@o?p@@I_5%N<+J~mi0c0uJN@@UtN*o+sWC%E3YS@=sHl#xnW?10dqlRS(t1Y1qKdlYUQOdLNMwbJG83#0U=xuQ%N{G!M(J3+I9tn~FRQd9ZO=mp zt!U}76q1}l`~7%wnt0-;VN*!#-4+-;l_|GhBviZdiD6ruwn0Y(kj6Dagfg@Xkay&^ zW=eOl``+U1rCCUk2&u*$&CYyeRt_I$&NQe!P9aaSUM{4h7pML>alY5YH1!>+FCy3v z_I8AB9;B@$8lqQll^Zd*n4Zwc=o{#L#Qc(W<#fymG83?cM*KV@va;-je6QDk;eFfc zWsb;jg>Fr6<7pmdFK+HqL$8tCrj?volD8@=^QHuBOTNY}21sv1TtlQIE+D zeeN7}z>VY2=D1`b_ZovhvZah)%*}-t0MD>RQ?#!c_y4yTX zwQ4IOE-V5HDhO5xRM}ctQnhR%QkMV$A+;DFgiBs!hmh0-5D+L>h`?w>RtX_x2@w(! zWfcRm2T33yARv3f5&{Y7T;Dl!&di)M@0snLIrCpmw%<+ey}#e{d!Fy}`EoqGL+riH zGL>hnJokW{C+nqvY$gC!Bx=8yUG=<+V%5ekl(w)^8W1URGrUl+EBef#N}rZ%mL$jD z9{PbKob*{2y-u#TW%>~w4zBJqSxEvjX@`%CRZ~N3Z7QN|TKHcNSc3fW)q?Ru!1>^> z4_!M|Kzo(X&V&s<3X8!|GuX>uweH#r#?bh#wyzkf<2rWR*iB#@{)lnzHqxq$8}Mr# zGsL3`bT&7?;kKKY=KzBRL@E|;q7gb4n4M^QDDg_YSfhw*j=J4mu$48MdSld(7w5Ah z&BMhY&k=_CzK&$g_i6@|B(cU#U=Iw*K_s^a_iYazzfqhLfu_>;8TQN*1GPM92-kxe znCsaQ6nZP&5pzs2pN~&?@-5P@^fg%fCfgz>bTanbh{m+&YJ;ZVHA5a%ijl-GeI3CF ziyMutFS^BTgYVSd^L*Rz~#(|UCV`sFam zk!*oJ+~=YzIIHs4p@J6?jkVhcgD7g^={Cv%DME5r1ifowtBxnlXiq(jkGfsfeBy<$ zAgedZY0B4;ciboOjImQat$lKlXK3Kg4Rb)h4c(Q9bpqq18=HBb#L|hkb&3vj&f^XQ zp3yQ{4jlhF+4r-CVU|Kw;Js;rbv+*b*DjRhMnkQuadT?g}>(M2@xq zOx}u>VD)>ebo#IM*)N#>(m-+FW`7e?cL)oRqVFwT8L(9;i{=A{IyP#xu9mOTgN9C# zjJW!V(L$JDvYKQ;gm(F|?z2#kgRR=sv|`15iu5A;dhg`WD%rJVAMXMNAE=ts@65c> zZ4g4TxYTjBjpwr{C;yH%sYtbkBLt>*;%gm^kJ|+3ZsTMiT^G50X#Yyk+ zsgrW*Gl!(mrPKM5AKsC`a1U?WUd?;9 zSN7(YN4vLVe#)BFh`kp5@@JZ&D}8pRFntHmzg3W3ly_3zno#HwUm-9CJ}29nEiXCCK3AYgCENJ@c35ii*EgURF za~snr4=f;I?Kwjl8fU4kio~3`9ckpLr5ZOQu3?HJzv?aTCR_`KL;AAmLuE=Y7%YY6 zrG40Q{S3>`zbwx{o4VDOTa4yDu$n{S!}i>H*Xu|!zeF#jJFgBQDk*SWSr!*jjsC<%E?=xzuk9=V8i927497E8B($doD4p-9Y1Rv{f{V}8 zXnhRGIOq!}J~ja2YUcrfv&flhbDn6ddxa`ZKjdc>u#x8uVbpQE8lc~99|@wItloNF ztGuKbG*y;!= zf4mv*)0k5XMpd!9!i%1@!MSuSN!ZM6g|o% z>?4h(zhV*Oxxb(U+`MP0rOknor^ht{V6qD?;Z-%}PA9#DpcM}!7i5-R@t6G=#6Qll zm~-Ft$$LGW915|J$lm>0L8_s&t^IGAz9@GV+aRVXJi@uXu!WXLzHcn%64v;@G6-EH}HY zIJ2N2QZuF_+GxzZWx+tM*0Yw(IAv=oYFY}3sEDC4 z0?!k&8TIyarh@!C8<1g?1Zo7Xq92NPPf@y%O0O<|CVYIDoM{L6iB z>tS2G7!sAat`~vEkF7W53w9{F^HiI=V&h^$7cBgX`EI3j3!q*LUKjwwj4x7W!RD?` z`~A|>V()Ia)J}tH4T{#JVJfW+UC6iy3vOljOvqSnVURkYSgvtsa9>NSb01B>=4}0r zy)aHul?q%3Ot9u-5Hr8(+F_yZPRWF4Ptm~5`t&hB%ZeUe`|g_aB!h1&4Lu_>b4ha- zPi}9s-zhiJRbmccjHJGzY2joiM|_?%%h?T+!3Y>IseH0SYL?&iF+2l{9+spFiP5{J85)>O0Yx>p`M!5Y!(4URNje3ws z7cQunnAnExtcgLAf;7{nO!~boJb0xUY_MK^r|*0U&&6cD6ln{BUJNfuuizx+0{x)`6dN>*Q;f#(hb zVC>cn_Y55c9qkjiqxp+sy0Qc*H6AD4hl-v$jQhq8wHSF077*N+kE)(l0P{e_nC$W- zLJ$)C$P_MU)rt~0oAcs+!SwqRn*w2Ew~H8nw1JZc`gfr zdPgk?6}_efA1Pe8hu6o+V` z_HeOk`;alck$XolKjaoCYQLU8&T7t3GvNTG(x@K>El96AGp0IDu)Pj(EqPSJmWCTI z7q`5%BwPdUm3O#f(W)&CNo}f0Ov|3*eT(D0kccB^6#Z8lvj&;n(UM2~=h=Jmi!$a} zv%KKCB?k4i5B8w+9#f@C>S-PwrBI(NDNr_hSlIX^xVzNpFEr(l5N7vevOO%JMCLTQ zHBF$eN34?7zG#vEBGQvX^b&B!q9?gPz+mk#nY{R9`fcv-8z7YF7FQtB7P%k7y;E3- z-RDPRI3Y#uudMi+ru3Ot`7(t-A%G>Q&kmkb36&=!Q>?t*>bBpGvI)5oN)2 zk?h|ej#mke-C5TAmXD4v=P1YbfJMs9IvEc%qUC`3>N>U%(Mk?$A%5l4(kDGHa1rf& z-rsFSh`4RCNt3%)0vZu%Yii!pCMEwj}Xg;h8qNgwhA{JvyHq-Fgx+3i1WisK)4p zV-TtXdg-fXvs}9Sz%7|Ue}^@@1&Au;xz$@+cNxhn^-}PG-D-TSkqG|)sDR?vI@c-RMW(XnCmSob@Y-s#jQFn zq_r;B|7CY@k9+x-HFrxHnEX&qo(n7z%$#5v{q~EEC7$A_3@V zZMHWMhZdCZXV-_WImMMaS(0m`R8$(8dPl5tx@h6QEnph!(P55M>D^*^q_o*zwAtTG z`!?TBd%%hnW5@b%%g4~G1eT&@-^1c3Fo<+T&C~|2^u@3C@Ih7pbl(hzxueJS^v&lp zGeTDt^UHro@9!nuMp1ZgLOtInJWmm@8xq~fvRp&2C}((~jYng@@I9+iO1MC0fjqtW zm-*M3Deni#9}~|79_h^FbsVn=3eA;h_eCyugArH6#ZB#X<#)mR2pV8;uM?3yePD2;Vw~KcYMTM{J zHL|AN&|AA&d*_C(R%FFo^{Fhdd*jtjc-2wo02*r3q1Iy09&r79r#LEA6vQ0q0GGrRzG;LIIaK$Vhtbu04$xh6z=OON4sATgd z{C+BAo3Ed~ka*bFt!&uIKi(qDX^(e8D+n0P>H5;S#zooOvCmY0gdVTjg!po)R`n3p znggstcSm1v7j31}c7Pn+h@geStYz1L)Q+uAwBcX^qeIJo1Y8{RgJs~vAoO;69e=)E zlH4GEJo15cpV2`jLB5ZQFM$NaMTbn~XLGBzo@vO)E0&!^GqJUuQ1348tTYf1+F^cp zd~T58Qdrj*7*i||xM7e{$g*HabOlWrW02XU_AzKO zHDiCY*C+2?_vJ>W$-4QNzzIE7zmb{EgzO@)Ws_qZcv$y_q=J2%%pmA`!J{lfI#%Mp zaZn1wfpg7+!ud_2`~+gy9xr)1^Z{DM=wki6;y%m}m=kT-yeVKKDi8?&9rU>PkILHr z3-8lvSWVMSEpvY4;ZT>E{rl<$x(zSX2L)5#fP$&JDt_#7vklEP#O4~|Po;CgqH?7k z@W3-ZOQwpa6<=EFi85yet7@MmQ;8LuA8lhMrbOha%)*(x8+p^o5ibpVp>FUTb)GgQ z*J9af$@I{==@cwrYrLFf4tn(BK{>rHDAzjY+AaSo82T^Abs%A{iZ$=8%4{+;qXS+0 z?FTF1D3EnrY1vxcZVrGZxsXC+kVO8DOC>FQbvt5RcPma?*5Hhu~kM?p_}z^ z;XuK_F*M3xl*Wdu*VTk>MD`ZSe-P0gGN3UOlxriL9y62?F^~&8fJ61AAanDr=F1b&`(2LrQggn>|N`h+#rgL2lQWU zL;<6+It(F-eOW}wV3itnR!S&$s|OOQ5p^Li>c)oN}Bq8x$U=4)TaLB4@%b=lFvfW#E5|50R#DL zg$_!f)$`mZoLLY~JHuVHSRYo(mDafA2qWC~jt||b;1yvEgE;OGoNwQm4ZJlUAk#G4 zIEtg9p-1+Hv)&#_;Sz54bQ0I?yvh*@*V4DQD{9Xv7Bg>$msVs&J{(q8H%eW#1Iunl zi1*fr`<%wZ>3wpiN)$n`4{L*ajNUxUbB_xpA*Z_xPB&{;peL*AJ`Dv^mh6E+4)&4= zM~avL`|dNNaWYtsqF4Cz>g+q^NX&xs!W3xTZYiT3Fge{WV~ul3a#w`22af*2N1A$( zc$uEHeA3iv5v@E^F^$NNVq2JiQYnSTbJbj102L<2vw67LST$|Mz$0UlH+5?9@#3N{|LK?@DNpZL#RwPH*v`e|de6#!V&+K}CxRDX=+s1% zmZ#J+a&Ux)TMG~WEE4)Z6mb6?O0r*GJzt~mbez=Ij5gj&byDnaG*;Zr!LJMPO|_q% z@9CC0u2MF4f>|Cx0_Y6{73zRZS6X1x6;4xbd^ts_6TGi6pp^YNlDH*BhzkF=KcDiQ zhnm*}%y|HSUFrMpFzo(Te&z4?+G7i)+N%MdjdY7Z6Wza>=l=DTOE)GhN|H9h% z_gr`X)_3o(Q^#db;kU`*<IEDX9-KUSCU^>i-qml7h`K1B! zH5S8XYUvqjQjE`F#L0!wfNYZ`$WmzKkpk3@A!2L7Su3Fq5F}YZ+PrM&euGh$wsqea zjBu%?L-(V#r;_7Nq*W|;pa9g(u*1*1J3)e<{>f}wOtAGCifFO2eg1^aDp>1LI2C>; z3v-Nbk*GP3OQp@M|1|blnVITg7 zmN;#{?q{z3i+?IX=U&plrZn$GsPu=AB36Q>9n6v(>85{$3cB>Ys?GT>RNKe5`i7&% zm@PDJDm56|wcQ-E*`s3okPu~tB8#IDihoBZ)9pSW)fva|}&(Ubc-j$U`khH=g5>``hI;3u2d zb$89|q2Gc2THY?|y;&8+r2!C~kygW|F;ZgGz0CML9blq=ap1e&sgzGY=IA~98f%AJ z$z*Pog;-F<+eW2kt-tw22Uyk*k-hnYyvx)edCRLnpTzVZk%Hx>J{K8nq!0)nLL9bG z)`1@JyU`kd*nWSaO+IxwJ8w$s=t^PMKJtq3p7KR*ls@E_=zQVc8j^LJV`7{dIGeH^ zlHC4SG4TKRwywX$8$(DKJ-#(6XuYwMCDbw7hYb=1Cf1H#0rM!#Y=3)73tjg0^*$1xC|X@OVi$4 z;oa$=-@d2DCx-TI8=J~_%LXzDQiA0qaUatlnk{UkwU73wgkPHlWkO{mR}M&wUt^C0x4xa+Q> zv)BslBbc=!H*q#2lJb); z7%LtB*G<{~;qgCPP<*zXI2dH-81#DepA9H3se&*3lYPa%HL3V_NJ#&m;`aaPW8MDe G@IL~NF9iJn literal 0 HcmV?d00001 From fd6eb7f5f0ba04bc13dfc087a7258a8b40e1a6b2 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 17:49:34 -0700 Subject: [PATCH 134/165] what's new - added PIN reset --- .../whats-new/whats-new-windows-10-version-1703.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index f24b26ca0b..e4cf782d35 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -156,6 +156,16 @@ The security setting [**Interactive logon: Display user information when the ses A new security policy setting [**Interactive logon: Don't display username at sign-in**](../keep-secure/interactive-logon-dont-display-username-at-sign-in.md) has been introduced in Windows 10 version 1703. This security policy setting determines whether the username is displayed during sign in. It works in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The setting only affects the **Other user** tile. +### Windows Hello for Business + +You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). + +For Windows Phone devices, an adminisrator is able to initiate a remote PIN reset through the Intune portal. + +For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. + +For more details, check out [What if I forget my PIN?](../keep-secure/hello-why-pin-is-better-than-password.md#what-if-i-forget-my-PIN?). + ## Update ### Windows Update for Business @@ -166,7 +176,7 @@ Windows Update for Business managed devices are now able to defer feature update ### Windows Insider for Business -We recently the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](waas-windows-insider-for-business.md). +We recently the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](../update/waas-windows-insider-for-business.md). ### Optimize update delivery From 442ffe86217df3cffc0fd71973e99c7295a321f4 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 18:02:11 -0700 Subject: [PATCH 135/165] fixed link to whfb pin reset heading --- windows/keep-secure/hello-why-pin-is-better-than-password.md | 1 + windows/whats-new/whats-new-windows-10-version-1703.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md index 9166df5000..516d264bef 100644 --- a/windows/keep-secure/hello-why-pin-is-better-than-password.md +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -65,6 +65,7 @@ You can provide additional protection for laptops that don't have TPM by enablng 2. Set the number of invalid logon attempts to allow, and then click OK. + ## What if I forget my PIN? Starting with Windows 10, version 1703, devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune), are be able to reset a forgotten PIN without deleting company managed data or apps. diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index e4cf782d35..4e5cfa56aa 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -164,7 +164,7 @@ For Windows Phone devices, an adminisrator is able to initiate a remote PIN rese For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. -For more details, check out [What if I forget my PIN?](../keep-secure/hello-why-pin-is-better-than-password.md#what-if-i-forget-my-PIN?). +For more details, check out [What if I forget my PIN?](../keep-secure/hello-why-pin-is-better-than-password.md#what-if-i-forget-my-pin). ## Update From 45026f81b3b8aedffdfca0b0c42caf4e5c910cf9 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 30 Mar 2017 22:54:08 -0700 Subject: [PATCH 136/165] fix link error --- .../keep-secure/deployment-vdi-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md index 7af1a0688c..6c2984299b 100644 --- a/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md +++ b/windows/keep-secure/deployment-vdi-windows-defender-antivirus.md @@ -203,7 +203,7 @@ Quick scans are the preferred approach as they are designed to look in all place See [How to create and deploy antimalware policies: Scheduled scans settings]( https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-antimalware-policies#scheduled-scans-settings) for details on configuring System Center Configuration Manager (current branch). -See [Schedule scans](schedule-scans-windows-defender-antivirus.md) for other configuration options available for scheduled scans. +See [Schedule scans](scheduled-catch-up-scans-windows-defender-antivirus.md) for other configuration options available for scheduled scans. ### Prevent notifications From 60e987650ecd150c5b5c370e0b58b8d29227e147 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 30 Mar 2017 23:26:11 -0700 Subject: [PATCH 137/165] waas-configure-wufb review changes --- windows/update/waas-configure-wufb.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/update/waas-configure-wufb.md b/windows/update/waas-configure-wufb.md index f6029dff92..0bfbe6c026 100644 --- a/windows/update/waas-configure-wufb.md +++ b/windows/update/waas-configure-wufb.md @@ -90,7 +90,7 @@ Starting with version 1703, when configuring pause through policy, a start date In cases where the pause policy is first applied after the configured start date has passed, administrators will be able to extend the pause period up to a total of 60 days by configuring a later start date. -With version 1703, pause will provide a more consistent experience: +With version 1703, pausing through the settings app will provide a more consistent experience: - Any active restart notification are cleared or closed - Any pending restarts are canceled - Any pending update installations are canceled @@ -235,11 +235,11 @@ In the Windows Update for Business policies in version 1511, all the deferral ru +Enabling allows user to set deferral periods for upgrades and updates. It also puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**Pause**: *enable/disable*
   Enabling will pause both upgrades and updates for a max of 35 days
Group Policy keys
Version 1511 GPO keysVersion 1607 GPO keys
**DeferUpgrade**: *enable/disable*
    -Enabling allows user to set deferral periods for upgrades and updates. It also puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**Pause**: *enable/disable*
   Enabling will pause both upgrades and updates for a max of 35 days		**DeferFeatureUpdates**: *enable/disable*

**BranchReadinessLevel**
   Set device on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdates**: *Enable/disable*

**DeferQualityUpdatesPeriodinDays**: *0 - 30 days*

**PauseQualityUpdates**: *enable/disable*
   Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDrivers**: *enable/disable*
**DeferFeatureUpdates**: *enable/disable*

**BranchReadinessLevel**
   Set device on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdates**: *Enable/disable*

**DeferQualityUpdatesPeriodinDays**: *0 - 35 days*

**PauseQualityUpdates**: *enable/disable*
   Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDrivers**: *enable/disable*
- +
MDM keys
Version 1511 MDM keysVersion 1607 MDM keys
**RequireDeferUpgade**: *bool*
   Puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**PauseDeferrals**: *bool*
   Enabling will pause both upgrades and updates for a max of 35 days		**BranchReadinessLevel**
   Set system on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdatesPeriodinDays**: *0 - 30 days*

**PauseQualityUpdates**: *enable/disable*
    Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDriversInQualityUpdate**: *enable/disable<*/td>
**RequireDeferUpgade**: *bool*
   Puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**PauseDeferrals**: *bool*
   Enabling will pause both upgrades and updates for a max of 35 days		**BranchReadinessLevel**
   Set system on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdatesPeriodinDays**: *0 - 35 days*

**PauseQualityUpdates**: *enable/disable*
    Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDriversInQualityUpdate**: *enable/disable<*/td>
### Comparing the version 1607 keys to the version 1703 keys From a293c29c2751614d3b1ab1d8af58f08bd647d596 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 07:56:16 -0700 Subject: [PATCH 138/165] Updated version --- windows/keep-secure/limitations-with-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/limitations-with-wip.md b/windows/keep-secure/limitations-with-wip.md index 39aaeb8dc5..1a0819c919 100644 --- a/windows/keep-secure/limitations-with-wip.md +++ b/windows/keep-secure/limitations-with-wip.md @@ -13,7 +13,7 @@ localizationpriority: high # Limitations while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile This table provides info about the most common problems you might encounter while running WIP in your organization. From af22f6adc7a548736c990203463a747b04e43df6 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Fri, 31 Mar 2017 08:20:13 -0700 Subject: [PATCH 139/165] Fixed typo --- windows/whats-new/whats-new-windows-10-version-1703.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 4e5cfa56aa..779b105a48 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -176,7 +176,7 @@ Windows Update for Business managed devices are now able to defer feature update ### Windows Insider for Business -We recently the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](../update/waas-windows-insider-for-business.md). +We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](../update/waas-windows-insider-for-business.md). ### Optimize update delivery From c7e4b0c3bc5e397cbf1fa032a3800bb8d1f9ada1 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 31 Mar 2017 08:29:21 -0700 Subject: [PATCH 140/165] updates from review --- education/windows/school-get-minecraft.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index d0585b4d00..c3e50700c6 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -124,12 +124,11 @@ Here's the page you'll see for Minecraft: Education Edition licenses purchased t ![App distribution options - individual copies](images/wsfb-minecraft-vl.png) ---> -### Configure automatic subscription assignment from private store +### Configure automatic subscription assignment -When you add an app to your private store, that app is available for anyone in your organization to install. For Minecraft: Education Edition you can decide whether or not you assign a subscription when a person installs the app from the private store, or if they will continue to use the trial version. This allows you to control which people in your organization use the trial version, and which people are assigned a full subscription. You can reassign subscriptions later. Planning how to manage your subscriptions will reduce time spent managing apps and subscriptions. By default, automatic subscription assignment is turned on. +For Minecraft: Education Edition, you can use auto assign subscription to control whether or not you assign a subscription when a member of your organization signs in to the app. When auto assign subscription is on, people from your organization who doesn’t have a subscription will automatically get one when they sign in to Minecraft: Education Edition. When auto assign subscription is off, people from your organization will get the trial version when they sign in to Minecraft: Education Edition. This allows you to control which people use the trial version, and which people are assigned a full subscription. You can always reassign subscriptions, but planning ahead will reduce time spent managing apps and subscriptions. By default, automatic subscription assignment is turned on. - -**How to turn off automatic subscription assignment from private store** +**How to turn off automatic subscription assignment** >[!Note] >The version of the Minecraft: Education Edition page in the Store for Business will be different depending on which Store for Business flight you are using. From a83950b53e415606fe6d1488f7d4221cd1b96db1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 08:30:36 -0700 Subject: [PATCH 141/165] Updated applies to --- windows/keep-secure/app-behavior-with-wip.md | 2 +- windows/keep-secure/create-and-verify-an-efs-dra-certificate.md | 2 +- windows/keep-secure/enlightened-microsoft-apps-and-wip.md | 2 +- windows/keep-secure/guidance-and-best-practices-wip.md | 2 +- windows/keep-secure/overview-create-wip-policy.md | 2 +- windows/keep-secure/protect-enterprise-data-using-wip.md | 2 +- windows/keep-secure/recommended-network-definitions-for-wip.md | 2 +- windows/keep-secure/testing-scenarios-for-wip.md | 2 +- windows/keep-secure/using-owa-with-wip.md | 2 +- windows/keep-secure/wip-app-enterprise-context.md | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index 1f83aad42f..cedd75618b 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -12,7 +12,7 @@ localizationpriority: high # Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 4bd92ff06f..849a9ff772 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -12,7 +12,7 @@ localizationpriority: high # Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md index f2e1b3c91c..5555cd3892 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md @@ -15,7 +15,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index ff64be6d0f..3294599cd2 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # General guidance and best practices for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). diff --git a/windows/keep-secure/overview-create-wip-policy.md b/windows/keep-secure/overview-create-wip-policy.md index c3ad6bf5a3..b2b23e5275 100644 --- a/windows/keep-secure/overview-create-wip-policy.md +++ b/windows/keep-secure/overview-create-wip-policy.md @@ -13,7 +13,7 @@ localizationpriority: high # Create a Windows Information Protection (WIP) policy **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. diff --git a/windows/keep-secure/protect-enterprise-data-using-wip.md b/windows/keep-secure/protect-enterprise-data-using-wip.md index a37553eb2c..f1ea14dd57 100644 --- a/windows/keep-secure/protect-enterprise-data-using-wip.md +++ b/windows/keep-secure/protect-enterprise-data-using-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Protect your enterprise data using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index bf9a7ac22a..299a85927b 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -13,7 +13,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/testing-scenarios-for-wip.md b/windows/keep-secure/testing-scenarios-for-wip.md index cca0a2fa52..81e9282bd3 100644 --- a/windows/keep-secure/testing-scenarios-for-wip.md +++ b/windows/keep-secure/testing-scenarios-for-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Testing scenarios for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index f99f10fb6f..2f19e746d1 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -12,7 +12,7 @@ localizationpriority: high # Using Outlook Web Access with Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/wip-app-enterprise-context.md b/windows/keep-secure/wip-app-enterprise-context.md index b4ebd4ced4..a4af8fcc31 100644 --- a/windows/keep-secure/wip-app-enterprise-context.md +++ b/windows/keep-secure/wip-app-enterprise-context.md @@ -12,7 +12,7 @@ localizationpriority: high # Determine the Enterprise Context of an app running in Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). From da74b16ceddcc8b5d68217f6013748447d0f4c74 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 31 Mar 2017 08:37:17 -0700 Subject: [PATCH 142/165] bug# 10215117 --- ...s-operating-system-components-to-microsoft-services.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 8f62d23a67..3919f82921 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -233,9 +233,9 @@ You can also apply the Group Policies using the following registry keys: |------------------------------------------------------|---------------------------------------------------------------------------------------| | Allow Cortana | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!AllowCortana
REG_DWORD: 0| | Allow search and Cortana to use location | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!AllowSearchToUseLocation
REG_DWORD: 0 | -| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchPrivacy
REG_DWORD: 3 | +| Do not allow web search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!DisableWebSearch
REG_DWORD: 1 | | Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchUseWeb
REG_DWORD: 0 | -| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!DisableWebSearch
REG_DWORD: 1 | +| Set what information is shared in Search | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search!ConnectedSearchPrivacy
REG_DWORD: 3 | In Windows 10, version 1507 and Windows 10, version 1511, when you enable the **Don't search the web or display web results in Search** Group Policy, you can control the behavior of whether Cortana searches the web to display web results. However, this policy only covers whether or not web search is performed. There could still be a small amount of network traffic to Bing.com to evaluate if certain Cortana components are up-to-date or not. In order to turn off that network activity completely, you can create a Windows Firewall rule to prevent outbound traffic. @@ -515,10 +515,10 @@ Alternatively, you can configure the Microsoft Group Policies using the followin | Policy | Registry path | | - | - | -| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords
REG_SZ: **about:blank** | +| Configure Autofill | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest
REG_SZ: **about:blank** | | Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!DoNotTrack
REG_DWORD: 1 | | Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!FormSuggest Passwords
REG_SZ: **no** | -| Configure search suggestions in Address bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main!Use FormSuggest
REG_SZ: **no**| +| Configure search suggestions in Address bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!ShowSearchSuggestionsGlobal
REG_DWORD: 0| | Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter!EnabledV9
REG_DWORD: 0 | | Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes!AllowWebContentOnNewTabPage
REG_DWORD: 0 | | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI!ProvisionedHomePages
REG_DWORD: 0| From 97a37f8487dcc5f1445e43e1a1da5ae009eec86b Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 31 Mar 2017 08:46:30 -0700 Subject: [PATCH 143/165] testing fix --- ...system-components-to-microsoft-services.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 3919f82921..2969b3256f 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -288,7 +288,7 @@ You can prevent Windows from setting the time automatically. - Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Enable Windows NTP Client** - - or - + -or - - Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient!Enabled** to 0 (zero). @@ -406,11 +406,10 @@ Alternatively, you could use the registry to set the Group Policies. There are three more Group Policy objects that are used by Internet Explorer: -| Path | Description | -| - | - | +| Path | Policy | Description | +| - | - | - | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Disabled | -| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether -an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | +| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page** | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website.
Default: Enabled | | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices.
Default: Enabled | You can also use registry entries to set these Group Policies. @@ -1584,12 +1583,12 @@ If you're not running Windows 10, version 1607 or later, you can use the other o > [!NOTE] > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. - -or- + > -or- - - Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one). - + > - Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one). + - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. + > - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. -or- @@ -1619,7 +1618,7 @@ You can turn off the ability to launch apps from the Windows Store that were pre - Create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore!AutoDownload**, with a value of 2 (two). -Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy* > **Configure web-to-app linking with URI handlers** +Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure web-to-app linking with URI handlers** ### 26. Windows Update Delivery Optimization From 85937ff2f26a65cba38fbcaf3b5c9d8ef7ecc1ae Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 08:47:21 -0700 Subject: [PATCH 144/165] Updated applies to and removed pre-release text --- browsers/edge/available-policies.md | 46 +++++++++---------- .../new-group-policy-settings-for-ie11.md | 2 +- ...p-command-line-options-and-return-codes.md | 2 +- windows/manage/cortana-at-work-crm.md | 7 +-- windows/manage/cortana-at-work-feedback.md | 7 +-- windows/manage/cortana-at-work-o365.md | 7 +-- windows/manage/cortana-at-work-overview.md | 11 ++--- .../manage/cortana-at-work-policy-settings.md | 7 +-- windows/manage/cortana-at-work-powerbi.md | 9 ++-- windows/manage/cortana-at-work-scenario-1.md | 7 +-- windows/manage/cortana-at-work-scenario-2.md | 7 +-- windows/manage/cortana-at-work-scenario-3.md | 7 +-- windows/manage/cortana-at-work-scenario-4.md | 7 +-- windows/manage/cortana-at-work-scenario-5.md | 7 +-- windows/manage/cortana-at-work-scenario-6.md | 7 +-- windows/manage/cortana-at-work-scenario-7.md | 7 +-- .../cortana-at-work-testing-scenarios.md | 7 +-- .../manage/cortana-at-work-voice-commands.md | 7 +-- 18 files changed, 58 insertions(+), 103 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index b22ded8a4f..82d03154eb 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -13,8 +13,8 @@ localizationpriority: high **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10 +- Windows 10 Mobile > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -30,7 +30,7 @@ By using Group Policy and Intune, you can set up a policy setting once, and then Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations: ### Allow Address bar drop-down list suggestions -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. @@ -51,7 +51,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, employees can't use Adobe Flash. ### Allow clearing browsing data on exit -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes. @@ -95,7 +95,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, the Microsoft Compatibility List isn’t used during browser navigation. ### Allow search engine customization -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether users can change their search engine. @@ -118,7 +118,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose how new tabs appears. ### Configure additional search engines -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting. @@ -225,7 +225,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), your default Start page is the webpage specified in App settings. ### Configure the Adobe Flash Click-to-Run setting -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether employees must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. @@ -261,7 +261,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose whether to use Windows Defender SmartScreen. ### Disable lockdown of Start pages -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you disable the lock down of Start pages, letting employees modify the Start pages when the "Configure Start pages" setting is in effect. @@ -273,7 +273,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), employees can't change any Start pages configured using the "Configure Start pages" setting, thereby locking down the Start pages. ### Keep favorites in sync between Internet Explorer and Microsoft Edge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge. @@ -309,7 +309,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), employees can ignore Windows Defender SmartScreen warnings and continue to the site. ### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. @@ -318,7 +318,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), Microsoft Edge gathers the Live Tile metadata, providing a fuller and more complete experience when a user pins a Live Tile to the Start menu. ### Prevent the First Run webpage from opening on Microsoft Edge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time. @@ -345,7 +345,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), all websites, including intranet sites, are automatically opened using Microsoft Edge. ### Set default search engine -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you configure the default search engine for your employees. Employees can change the default search engine at any time unless you disable the "Allow search engine customization" setting, which restricts any changes. @@ -382,7 +382,7 @@ If you manage your policies using Intune, you'll want to use these MDM policy se All devices must be enrolled with Intune if you want to use the Windows Custom URI Policy. ### AllowAddressBarDropdown -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop @@ -520,7 +520,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Allowed. Employees can use Adobe Flash. ### AllowFlashClickToRun -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop| @@ -554,7 +554,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Employees can use InPrivate browsing. ### AllowMicrosoftCompatibilityList -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -605,7 +605,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Pop-up Blocker, stopping pop-up windows. ### AllowSearchEngineCustomization -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -657,7 +657,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Windows Defender SmartScreen, providing warning messages to your employees about potential phishing scams and malicious software. ### ClearBrowsingDataOnExit -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -674,7 +674,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Browsing data is cleared on exit. ### ConfigureAdditionalSearchEngines -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -691,7 +691,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Additional search engines are allowed. ### DisableLockdownOfStartPages -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop @@ -807,7 +807,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees can't access the about:flags page in Microsoft Edge. ### PreventFirstRunPage -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -824,7 +824,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees don't see the First Run webpage. ### PreventLiveTileDataCollection -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -909,7 +909,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Automatically opens all intranet sites using Internet Explorer 11. ### SetDefaultSearchEngine -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -943,7 +943,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. ### SyncFavoritesBetweenIEAndMicrosoftEdge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index 149ef61a09..d672741b14 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -25,7 +25,7 @@ Internet Explorer 11 gives you some new Group Policy settings to help you manag |Always send Do Not Track header |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

**In Internet Explorer 9 and 10:**
If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

**In at least IE11:**
If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced* tab of the **Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | |Don't run antimalware programs against ActiveX controls
(Internet, Restricted Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
|IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | |Don't run antimalware programs against ActiveX controls
(Intranet, Trusted, Local Machine Zones) |

  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
  • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
|IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | -|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, Windows Insider Program |This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | +|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, version 1703 |This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | |Let users turn on and use Enterprise Mode from the **Tools** menu |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | |Limit Site Discovery output by Domain |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | |Limit Site Discovery output by Zone |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 0 – Local Intranet zone
  • 0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
  • 0 – Restricted Sites zone
  • 0 – Internet zone
  • 0 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
  • 1 – Restricted Sites zone
  • 0 – Internet zone
  • 1 – Trusted Sites zone
  • 1 – Local Intranet zone
  • 1 – Local Machine zone

**Note:**
You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md index 9bb18ee1b1..f1a75a85d0 100644 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md @@ -46,7 +46,7 @@ These command-line options work with IE Setup: ## Windows Setup return and status codes -Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged insider your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. +Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. |Subkey |Data type |Value | |---------|----------|---------------------------------------| diff --git a/windows/manage/cortana-at-work-crm.md b/windows/manage/cortana-at-work-crm.md index 834bde8a92..7d0df172b6 100644 --- a/windows/manage/cortana-at-work-crm.md +++ b/windows/manage/cortana-at-work-crm.md @@ -10,11 +10,8 @@ localizationpriority: high # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. diff --git a/windows/manage/cortana-at-work-feedback.md b/windows/manage/cortana-at-work-feedback.md index ca24c22703..0fc38d06c8 100644 --- a/windows/manage/cortana-at-work-feedback.md +++ b/windows/manage/cortana-at-work-feedback.md @@ -10,11 +10,8 @@ localizationpriority: high # Send feedback about Cortana at work back to Microsoft **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. diff --git a/windows/manage/cortana-at-work-o365.md b/windows/manage/cortana-at-work-o365.md index 764b5638e0..d1208f505d 100644 --- a/windows/manage/cortana-at-work-o365.md +++ b/windows/manage/cortana-at-work-o365.md @@ -10,11 +10,8 @@ localizationpriority: high # Set up and test Cortana with Office 365 in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. diff --git a/windows/manage/cortana-at-work-overview.md b/windows/manage/cortana-at-work-overview.md index 29a9ab3bba..6413fa1038 100644 --- a/windows/manage/cortana-at-work-overview.md +++ b/windows/manage/cortana-at-work-overview.md @@ -10,11 +10,8 @@ localizationpriority: high # Cortana integration in your business or enterprise **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile ## Who is Cortana? Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. @@ -27,7 +24,7 @@ Using Azure AD also means that you can remove an employee’s profile (for examp ## Where is Cortana available for use in my organization? You can use Cortana at work in all countries/regions where Cortana is supported for consumers. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, she will also become available to enterprise customers. -Cortana is available on Windows 10, Windows Insider Program and with limited functionality on Windows Phone 8.1, Windows Insider Program. +Cortana is available on Windows 10, version 1703 and with limited functionality on Windows Phone 8.1. ## Required hardware and software Cortana requires the following hardware and software to successfully run the included scenario in your organization. @@ -41,7 +38,7 @@ Cortana requires the following hardware and software to successfully run the inc |Software |Minimum version | |---------|------------| -|Client operating system |

  • **Desktop:** Windows 10, Windows Insider Program
  • **Mobile:** Windows 8.1, Windows Insider Program (with limited functionality)
    • | +|Client operating system |
    • **Desktop:** Windows 10, version 1703
    • **Mobile:** Windows 8.1 (with limited functionality)
      • | |Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

      For example:

      If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

      If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | |Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md)

      If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| diff --git a/windows/manage/cortana-at-work-policy-settings.md b/windows/manage/cortana-at-work-policy-settings.md index 83f10f7d3e..4534e3b0f3 100644 --- a/windows/manage/cortana-at-work-policy-settings.md +++ b/windows/manage/cortana-at-work-policy-settings.md @@ -10,11 +10,8 @@ localizationpriority: high # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!NOTE] >For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). diff --git a/windows/manage/cortana-at-work-powerbi.md b/windows/manage/cortana-at-work-powerbi.md index 979cde3b57..df2e6e3abb 100644 --- a/windows/manage/cortana-at-work-powerbi.md +++ b/windows/manage/cortana-at-work-powerbi.md @@ -10,11 +10,8 @@ localizationpriority: high # Set up and test Cortana for Power BI in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. @@ -24,7 +21,7 @@ Integration between Cortana and Power BI shows how Cortana can work with custom ## Before you begin To use this walkthrough, you’ll need: -- **Windows 10**. You’ll need to be running at least Windows 10 with the latest version from the Windows Insider Program. +- **Windows 10**. You’ll need to be running at least Windows 10, version 1703. - **Cortana**. You need to have Cortana turned on and be logged into your account. diff --git a/windows/manage/cortana-at-work-scenario-1.md b/windows/manage/cortana-at-work-scenario-1.md index 4a9714a455..37a9f30d6b 100644 --- a/windows/manage/cortana-at-work-scenario-1.md +++ b/windows/manage/cortana-at-work-scenario-1.md @@ -9,11 +9,8 @@ localizationpriority: high # Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-2.md b/windows/manage/cortana-at-work-scenario-2.md index fb7b00d578..edba19cade 100644 --- a/windows/manage/cortana-at-work-scenario-2.md +++ b/windows/manage/cortana-at-work-scenario-2.md @@ -9,11 +9,8 @@ localizationpriority: high # Test scenario 2 - Perform a quick search with Cortana at work -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-3.md b/windows/manage/cortana-at-work-scenario-3.md index 89610c7093..b05a07e218 100644 --- a/windows/manage/cortana-at-work-scenario-3.md +++ b/windows/manage/cortana-at-work-scenario-3.md @@ -9,11 +9,8 @@ localizationpriority: high # Test scenario 3 - Set a reminder for a specific location using Cortana at work -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-4.md b/windows/manage/cortana-at-work-scenario-4.md index 56f1f6af66..8c6b8b382c 100644 --- a/windows/manage/cortana-at-work-scenario-4.md +++ b/windows/manage/cortana-at-work-scenario-4.md @@ -9,11 +9,8 @@ localizationpriority: high # Test scenario 4 - Use Cortana at work to find your upcoming meetings -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-5.md b/windows/manage/cortana-at-work-scenario-5.md index 8373a4f4c2..ca191d7196 100644 --- a/windows/manage/cortana-at-work-scenario-5.md +++ b/windows/manage/cortana-at-work-scenario-5.md @@ -9,11 +9,8 @@ localizationpriority: high # Test scenario 5 - Use Cortana to send email to a co-worker -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-6.md b/windows/manage/cortana-at-work-scenario-6.md index 2ad1c7cb5c..7e3fe67103 100644 --- a/windows/manage/cortana-at-work-scenario-6.md +++ b/windows/manage/cortana-at-work-scenario-6.md @@ -10,11 +10,8 @@ localizationpriority: high # Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). diff --git a/windows/manage/cortana-at-work-scenario-7.md b/windows/manage/cortana-at-work-scenario-7.md index e8d6cfd3ff..533cf8b286 100644 --- a/windows/manage/cortana-at-work-scenario-7.md +++ b/windows/manage/cortana-at-work-scenario-7.md @@ -10,11 +10,8 @@ localizationpriority: high # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-testing-scenarios.md b/windows/manage/cortana-at-work-testing-scenarios.md index 9f97783bca..6150e23507 100644 --- a/windows/manage/cortana-at-work-testing-scenarios.md +++ b/windows/manage/cortana-at-work-testing-scenarios.md @@ -10,11 +10,8 @@ localizationpriority: high # Testing scenarios using Cortana in your business or organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: diff --git a/windows/manage/cortana-at-work-voice-commands.md b/windows/manage/cortana-at-work-voice-commands.md index 2e2743fa61..828d58e38d 100644 --- a/windows/manage/cortana-at-work-voice-commands.md +++ b/windows/manage/cortana-at-work-voice-commands.md @@ -10,11 +10,8 @@ localizationpriority: high # Set up and test custom voice commands in Cortana for your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program - ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +- Windows 10, version 1703 +- Windows 8.1 Mobile Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. From ec34f3739b94799f818c0fee182fdf1c1b26daea Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 31 Mar 2017 08:49:39 -0700 Subject: [PATCH 145/165] typo --- education/windows/school-get-minecraft.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index c3e50700c6..b065ab2c96 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -126,7 +126,7 @@ Here's the page you'll see for Minecraft: Education Edition licenses purchased t ### Configure automatic subscription assignment -For Minecraft: Education Edition, you can use auto assign subscription to control whether or not you assign a subscription when a member of your organization signs in to the app. When auto assign subscription is on, people from your organization who doesn’t have a subscription will automatically get one when they sign in to Minecraft: Education Edition. When auto assign subscription is off, people from your organization will get the trial version when they sign in to Minecraft: Education Edition. This allows you to control which people use the trial version, and which people are assigned a full subscription. You can always reassign subscriptions, but planning ahead will reduce time spent managing apps and subscriptions. By default, automatic subscription assignment is turned on. +For Minecraft: Education Edition, you can use auto assign subscription to control whether or not you assign a subscription when a member of your organization signs in to the app. When auto assign subscription is on, people from your organization who don’t have a subscription will automatically get one when they sign in to Minecraft: Education Edition. When auto assign subscription is off, people from your organization will get the trial version when they sign in to Minecraft: Education Edition. This allows you to control which people use the trial version, and which people are assigned a full subscription. You can always reassign subscriptions, but planning ahead will reduce time spent managing apps and subscriptions. By default, automatic subscription assignment is turned on. **How to turn off automatic subscription assignment** From 477c7510bf63f50ce8f722a4c75abb40cdbf429f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 31 Mar 2017 08:52:52 -0700 Subject: [PATCH 146/165] testing another fix --- ...s-operating-system-components-to-microsoft-services.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 2969b3256f..86503c42e8 100644 --- a/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1581,14 +1581,10 @@ If you're not running Windows 10, version 1607 or later, you can use the other o - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box. > [!NOTE] - > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. - - > -or- - - > - Create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one). + > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenImage**, with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization!LockScreenOverlaysDisabled**, with a value of 1 (one). - > - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. + - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**. -or- From af0ceb24ca5379fa9a6c4ef94b673dd5bd73ed41 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 09:07:45 -0700 Subject: [PATCH 147/165] Revert "Updated applies to and removed pre-release text" This reverts commit 85937ff2f26a65cba38fbcaf3b5c9d8ef7ecc1ae. --- browsers/edge/available-policies.md | 46 +++++++++---------- .../new-group-policy-settings-for-ie11.md | 2 +- ...p-command-line-options-and-return-codes.md | 2 +- windows/manage/cortana-at-work-crm.md | 7 ++- windows/manage/cortana-at-work-feedback.md | 7 ++- windows/manage/cortana-at-work-o365.md | 7 ++- windows/manage/cortana-at-work-overview.md | 11 +++-- .../manage/cortana-at-work-policy-settings.md | 7 ++- windows/manage/cortana-at-work-powerbi.md | 9 ++-- windows/manage/cortana-at-work-scenario-1.md | 7 ++- windows/manage/cortana-at-work-scenario-2.md | 7 ++- windows/manage/cortana-at-work-scenario-3.md | 7 ++- windows/manage/cortana-at-work-scenario-4.md | 7 ++- windows/manage/cortana-at-work-scenario-5.md | 7 ++- windows/manage/cortana-at-work-scenario-6.md | 7 ++- windows/manage/cortana-at-work-scenario-7.md | 7 ++- .../cortana-at-work-testing-scenarios.md | 7 ++- .../manage/cortana-at-work-voice-commands.md | 7 ++- 18 files changed, 103 insertions(+), 58 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 82d03154eb..b22ded8a4f 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -13,8 +13,8 @@ localizationpriority: high **Applies to:** -- Windows 10 -- Windows 10 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program > [!IMPORTANT] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -30,7 +30,7 @@ By using Group Policy and Intune, you can set up a policy setting once, and then Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations: ### Allow Address bar drop-down list suggestions -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. @@ -51,7 +51,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, employees can't use Adobe Flash. ### Allow clearing browsing data on exit -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes. @@ -95,7 +95,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, the Microsoft Compatibility List isn’t used during browser navigation. ### Allow search engine customization -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you decide whether users can change their search engine. @@ -118,7 +118,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose how new tabs appears. ### Configure additional search engines -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting. @@ -225,7 +225,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), your default Start page is the webpage specified in App settings. ### Configure the Adobe Flash Click-to-Run setting -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you decide whether employees must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. @@ -261,7 +261,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose whether to use Windows Defender SmartScreen. ### Disable lockdown of Start pages -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you disable the lock down of Start pages, letting employees modify the Start pages when the "Configure Start pages" setting is in effect. @@ -273,7 +273,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), employees can't change any Start pages configured using the "Configure Start pages" setting, thereby locking down the Start pages. ### Keep favorites in sync between Internet Explorer and Microsoft Edge -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge. @@ -309,7 +309,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), employees can ignore Windows Defender SmartScreen warnings and continue to the site. ### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. @@ -318,7 +318,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), Microsoft Edge gathers the Live Tile metadata, providing a fuller and more complete experience when a user pins a Live Tile to the Start menu. ### Prevent the First Run webpage from opening on Microsoft Edge -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time. @@ -345,7 +345,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), all websites, including intranet sites, are automatically opened using Microsoft Edge. ### Set default search engine -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Description:** This policy setting lets you configure the default search engine for your employees. Employees can change the default search engine at any time unless you disable the "Allow search engine customization" setting, which restricts any changes. @@ -382,7 +382,7 @@ If you manage your policies using Intune, you'll want to use these MDM policy se All devices must be enrolled with Intune if you want to use the Windows Custom URI Policy. ### AllowAddressBarDropdown -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Desktop @@ -520,7 +520,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Allowed. Employees can use Adobe Flash. ### AllowFlashClickToRun -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Desktop| @@ -554,7 +554,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Employees can use InPrivate browsing. ### AllowMicrosoftCompatibilityList -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -605,7 +605,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Pop-up Blocker, stopping pop-up windows. ### AllowSearchEngineCustomization -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -657,7 +657,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Windows Defender SmartScreen, providing warning messages to your employees about potential phishing scams and malicious software. ### ClearBrowsingDataOnExit -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -674,7 +674,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Browsing data is cleared on exit. ### ConfigureAdditionalSearchEngines -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -691,7 +691,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Additional search engines are allowed. ### DisableLockdownOfStartPages -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Desktop @@ -807,7 +807,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees can't access the about:flags page in Microsoft Edge. ### PreventFirstRunPage -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -824,7 +824,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees don't see the First Run webpage. ### PreventLiveTileDataCollection -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -909,7 +909,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Automatically opens all intranet sites using Internet Explorer 11. ### SetDefaultSearchEngine -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Both @@ -943,7 +943,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. ### SyncFavoritesBetweenIEAndMicrosoftEdge -- **Supported versions:** Windows 10, version 1703 +- **Supported versions:** Windows 10, Windows Insider Program - **Supported devices:** Desktop diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index d672741b14..149ef61a09 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -25,7 +25,7 @@ Internet Explorer 11 gives you some new Group Policy settings to help you manag |Always send Do Not Track header |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

      If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

      **In Internet Explorer 9 and 10:**
      If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

      **In at least IE11:**
      If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

      If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced* tab of the **Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | |Don't run antimalware programs against ActiveX controls
      (Internet, Restricted Zones) |

      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
      |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

      If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

      If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

      If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | |Don't run antimalware programs against ActiveX controls
      (Intranet, Trusted, Local Machine Zones) |

      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
      • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
      |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

      If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

      If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

      If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | -|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, version 1703 |This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

      If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

      If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

      If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | +|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, Windows Insider Program |This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

      If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

      If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

      If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | |Let users turn on and use Enterprise Mode from the **Tools** menu |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

      If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

      If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | |Limit Site Discovery output by Domain |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

      If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

      If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

      **Note:**
      You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | |Limit Site Discovery output by Zone |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

      If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

      If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

      To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

      • 0 – Restricted Sites zone
      • 0 – Internet zone
      • 0 – Trusted Sites zone
      • 0 – Local Intranet zone
      • 0 – Local Machine zone

      **Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
      • 0 – Restricted Sites zone
      • 0 – Internet zone
      • 0 – Trusted Sites zone
      • 1 – Local Intranet zone
      • 0 – Local Machine zone

      **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
      • 1 – Restricted Sites zone
      • 0 – Internet zone
      • 1 – Trusted Sites zone
      • 1 – Local Intranet zone
      • 1 – Local Machine zone

      **Note:**
      You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md index f1a75a85d0..9bb18ee1b1 100644 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md @@ -46,7 +46,7 @@ These command-line options work with IE Setup: ## Windows Setup return and status codes -Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. +Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged insider your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. |Subkey |Data type |Value | |---------|----------|---------------------------------------| diff --git a/windows/manage/cortana-at-work-crm.md b/windows/manage/cortana-at-work-crm.md index 7d0df172b6..834bde8a92 100644 --- a/windows/manage/cortana-at-work-crm.md +++ b/windows/manage/cortana-at-work-crm.md @@ -10,8 +10,11 @@ localizationpriority: high # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. diff --git a/windows/manage/cortana-at-work-feedback.md b/windows/manage/cortana-at-work-feedback.md index 0fc38d06c8..ca24c22703 100644 --- a/windows/manage/cortana-at-work-feedback.md +++ b/windows/manage/cortana-at-work-feedback.md @@ -10,8 +10,11 @@ localizationpriority: high # Send feedback about Cortana at work back to Microsoft **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. diff --git a/windows/manage/cortana-at-work-o365.md b/windows/manage/cortana-at-work-o365.md index d1208f505d..764b5638e0 100644 --- a/windows/manage/cortana-at-work-o365.md +++ b/windows/manage/cortana-at-work-o365.md @@ -10,8 +10,11 @@ localizationpriority: high # Set up and test Cortana with Office 365 in your organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. diff --git a/windows/manage/cortana-at-work-overview.md b/windows/manage/cortana-at-work-overview.md index 6413fa1038..29a9ab3bba 100644 --- a/windows/manage/cortana-at-work-overview.md +++ b/windows/manage/cortana-at-work-overview.md @@ -10,8 +10,11 @@ localizationpriority: high # Cortana integration in your business or enterprise **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ## Who is Cortana? Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. @@ -24,7 +27,7 @@ Using Azure AD also means that you can remove an employee’s profile (for examp ## Where is Cortana available for use in my organization? You can use Cortana at work in all countries/regions where Cortana is supported for consumers. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, she will also become available to enterprise customers. -Cortana is available on Windows 10, version 1703 and with limited functionality on Windows Phone 8.1. +Cortana is available on Windows 10, Windows Insider Program and with limited functionality on Windows Phone 8.1, Windows Insider Program. ## Required hardware and software Cortana requires the following hardware and software to successfully run the included scenario in your organization. @@ -38,7 +41,7 @@ Cortana requires the following hardware and software to successfully run the inc |Software |Minimum version | |---------|------------| -|Client operating system |

      • **Desktop:** Windows 10, version 1703
      • **Mobile:** Windows 8.1 (with limited functionality)
        • | +|Client operating system |
        • **Desktop:** Windows 10, Windows Insider Program
        • **Mobile:** Windows 8.1, Windows Insider Program (with limited functionality)
          • | |Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

          For example:

          If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

          If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | |Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md)

          If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| diff --git a/windows/manage/cortana-at-work-policy-settings.md b/windows/manage/cortana-at-work-policy-settings.md index 4534e3b0f3..83f10f7d3e 100644 --- a/windows/manage/cortana-at-work-policy-settings.md +++ b/windows/manage/cortana-at-work-policy-settings.md @@ -10,8 +10,11 @@ localizationpriority: high # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!NOTE] >For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). diff --git a/windows/manage/cortana-at-work-powerbi.md b/windows/manage/cortana-at-work-powerbi.md index df2e6e3abb..979cde3b57 100644 --- a/windows/manage/cortana-at-work-powerbi.md +++ b/windows/manage/cortana-at-work-powerbi.md @@ -10,8 +10,11 @@ localizationpriority: high # Set up and test Cortana for Power BI in your organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. @@ -21,7 +24,7 @@ Integration between Cortana and Power BI shows how Cortana can work with custom ## Before you begin To use this walkthrough, you’ll need: -- **Windows 10**. You’ll need to be running at least Windows 10, version 1703. +- **Windows 10**. You’ll need to be running at least Windows 10 with the latest version from the Windows Insider Program. - **Cortana**. You need to have Cortana turned on and be logged into your account. diff --git a/windows/manage/cortana-at-work-scenario-1.md b/windows/manage/cortana-at-work-scenario-1.md index 37a9f30d6b..4a9714a455 100644 --- a/windows/manage/cortana-at-work-scenario-1.md +++ b/windows/manage/cortana-at-work-scenario-1.md @@ -9,8 +9,11 @@ localizationpriority: high # Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-2.md b/windows/manage/cortana-at-work-scenario-2.md index edba19cade..fb7b00d578 100644 --- a/windows/manage/cortana-at-work-scenario-2.md +++ b/windows/manage/cortana-at-work-scenario-2.md @@ -9,8 +9,11 @@ localizationpriority: high # Test scenario 2 - Perform a quick search with Cortana at work -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-3.md b/windows/manage/cortana-at-work-scenario-3.md index b05a07e218..89610c7093 100644 --- a/windows/manage/cortana-at-work-scenario-3.md +++ b/windows/manage/cortana-at-work-scenario-3.md @@ -9,8 +9,11 @@ localizationpriority: high # Test scenario 3 - Set a reminder for a specific location using Cortana at work -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-4.md b/windows/manage/cortana-at-work-scenario-4.md index 8c6b8b382c..56f1f6af66 100644 --- a/windows/manage/cortana-at-work-scenario-4.md +++ b/windows/manage/cortana-at-work-scenario-4.md @@ -9,8 +9,11 @@ localizationpriority: high # Test scenario 4 - Use Cortana at work to find your upcoming meetings -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-5.md b/windows/manage/cortana-at-work-scenario-5.md index ca191d7196..8373a4f4c2 100644 --- a/windows/manage/cortana-at-work-scenario-5.md +++ b/windows/manage/cortana-at-work-scenario-5.md @@ -9,8 +9,11 @@ localizationpriority: high # Test scenario 5 - Use Cortana to send email to a co-worker -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-scenario-6.md b/windows/manage/cortana-at-work-scenario-6.md index 7e3fe67103..2ad1c7cb5c 100644 --- a/windows/manage/cortana-at-work-scenario-6.md +++ b/windows/manage/cortana-at-work-scenario-6.md @@ -10,8 +10,11 @@ localizationpriority: high # Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). diff --git a/windows/manage/cortana-at-work-scenario-7.md b/windows/manage/cortana-at-work-scenario-7.md index 533cf8b286..e8d6cfd3ff 100644 --- a/windows/manage/cortana-at-work-scenario-7.md +++ b/windows/manage/cortana-at-work-scenario-7.md @@ -10,8 +10,11 @@ localizationpriority: high # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/manage/cortana-at-work-testing-scenarios.md b/windows/manage/cortana-at-work-testing-scenarios.md index 6150e23507..9f97783bca 100644 --- a/windows/manage/cortana-at-work-testing-scenarios.md +++ b/windows/manage/cortana-at-work-testing-scenarios.md @@ -10,8 +10,11 @@ localizationpriority: high # Testing scenarios using Cortana in your business or organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: diff --git a/windows/manage/cortana-at-work-voice-commands.md b/windows/manage/cortana-at-work-voice-commands.md index 828d58e38d..2e2743fa61 100644 --- a/windows/manage/cortana-at-work-voice-commands.md +++ b/windows/manage/cortana-at-work-voice-commands.md @@ -10,8 +10,11 @@ localizationpriority: high # Set up and test custom voice commands in Cortana for your organization **Applies to:** -- Windows 10, version 1703 -- Windows 8.1 Mobile +- Windows 10, Windows Insider Program +- Windows 10 Mobile, Windows Insider Program + +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. From 9030c041926682f1078fef7ce1d84f129fc93bb1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 09:13:45 -0700 Subject: [PATCH 148/165] fix link --- windows/whats-new/whats-new-windows-10-version-1703.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 779b105a48..73a74e3409 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -147,7 +147,7 @@ You can read more about ransomware mitigations and detection capability in Windo ### Device Guard and Credential Guard Additional security qualifications for Device Guard and Credential Guard help protect vulnerabilities in UEFI runtime. -For more information, see [Device Guard Requirements](../keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md#device-guard-requirements-for-improved-security) and [Credential Guard Security Considerations](../keep-secure/credential-guard.md#security-considerations). +For more information, see [Device Guard Requirements](../keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md#device-guard-requirements-for-improved-security) and [Credential Guard Security Considerations](../keep-secure/credential-guard-requirements.md#security-considerations). ### Group Policy Security Options From 9fa967226496d1db57afa4eeb78ffe4faa7b5755 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 09:16:14 -0700 Subject: [PATCH 149/165] Revert "Updated applies to" This reverts commit a83950b53e415606fe6d1488f7d4221cd1b96db1. --- windows/keep-secure/app-behavior-with-wip.md | 2 +- windows/keep-secure/create-and-verify-an-efs-dra-certificate.md | 2 +- windows/keep-secure/enlightened-microsoft-apps-and-wip.md | 2 +- windows/keep-secure/guidance-and-best-practices-wip.md | 2 +- windows/keep-secure/overview-create-wip-policy.md | 2 +- windows/keep-secure/protect-enterprise-data-using-wip.md | 2 +- windows/keep-secure/recommended-network-definitions-for-wip.md | 2 +- windows/keep-secure/testing-scenarios-for-wip.md | 2 +- windows/keep-secure/using-owa-with-wip.md | 2 +- windows/keep-secure/wip-app-enterprise-context.md | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index cedd75618b..1f83aad42f 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -12,7 +12,7 @@ localizationpriority: high # Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 849a9ff772..4bd92ff06f 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -12,7 +12,7 @@ localizationpriority: high # Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md index 5555cd3892..f2e1b3c91c 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md @@ -15,7 +15,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index 3294599cd2..ff64be6d0f 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # General guidance and best practices for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). diff --git a/windows/keep-secure/overview-create-wip-policy.md b/windows/keep-secure/overview-create-wip-policy.md index b2b23e5275..c3ad6bf5a3 100644 --- a/windows/keep-secure/overview-create-wip-policy.md +++ b/windows/keep-secure/overview-create-wip-policy.md @@ -13,7 +13,7 @@ localizationpriority: high # Create a Windows Information Protection (WIP) policy **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. diff --git a/windows/keep-secure/protect-enterprise-data-using-wip.md b/windows/keep-secure/protect-enterprise-data-using-wip.md index f1ea14dd57..a37553eb2c 100644 --- a/windows/keep-secure/protect-enterprise-data-using-wip.md +++ b/windows/keep-secure/protect-enterprise-data-using-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Protect your enterprise data using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index 299a85927b..bf9a7ac22a 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -13,7 +13,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/testing-scenarios-for-wip.md b/windows/keep-secure/testing-scenarios-for-wip.md index 81e9282bd3..cca0a2fa52 100644 --- a/windows/keep-secure/testing-scenarios-for-wip.md +++ b/windows/keep-secure/testing-scenarios-for-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Testing scenarios for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index 2f19e746d1..f99f10fb6f 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -12,7 +12,7 @@ localizationpriority: high # Using Outlook Web Access with Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/wip-app-enterprise-context.md b/windows/keep-secure/wip-app-enterprise-context.md index a4af8fcc31..b4ebd4ced4 100644 --- a/windows/keep-secure/wip-app-enterprise-context.md +++ b/windows/keep-secure/wip-app-enterprise-context.md @@ -12,7 +12,7 @@ localizationpriority: high # Determine the Enterprise Context of an app running in Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later +- Windows 10, version 1607 - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). From 72a3309bdfe77a3bbeba2e95841635462861ab4a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 09:16:24 -0700 Subject: [PATCH 150/165] Squashed commit of the following: commit 13f1090ee65f4a6e80ebbded8a29a5b7cc18e0ec Merge: ff49098a b7022583 Author: jdeckerMS Date: Fri Mar 31 09:11:06 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit ff49098a8fc4e286ab2002c15fe410901afbc548 Merge: d30056bd 2a8a5861 Author: jdeckerMS Date: Fri Mar 31 08:54:32 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit d30056bdaa7c65fdd9292293fdd74d0067f6843c Merge: 061aa7ff 5c840fcd Author: jdeckerMS Date: Fri Mar 31 08:50:35 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit 061aa7ffa41809f11caab7c50abcfeeb66eaf765 Author: jdeckerMS Date: Fri Mar 31 08:49:21 2017 -0700 got rid of redundant text commit 28f92a6e71c7bb2c18297cbe9aa4f344b501167b Author: jdeckerMS Date: Fri Mar 31 08:38:10 2017 -0700 format commit 9f42b3c3f6b40c333aeb0dbe269037d76e8a6681 Author: jdeckerMS Date: Fri Mar 31 08:36:30 2017 -0700 numbering commit c825690f4158baeaaf899f33c362f49ab2e0d1da Author: jdeckerMS Date: Fri Mar 31 08:26:11 2017 -0700 sync commit d665b656bcc139af3d7a0b9c8b88c6fd4e70be0e Author: jdeckerMS Date: Fri Mar 31 08:25:39 2017 -0700 change escape procedure commit 42088746e72d410a4487c46122fcd24267d4bfe9 Author: jdeckerMS Date: Fri Mar 31 06:30:32 2017 -0700 fix typo commit 3658391492d70b9d1eb84cd57fe92f8a5c92698f Merge: ebd6e1c5 60e98765 Author: jdeckerMS Date: Fri Mar 31 06:27:07 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit ebd6e1c5b65328f7b70cea0c1daca1625620766f Merge: 11e51f8f a45661ff Author: jdeckerMS Date: Thu Mar 30 13:37:18 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit 11e51f8ff68689d8ee87cfd77eefc4595ce7617c Author: jdeckerMS Date: Thu Mar 30 11:12:43 2017 -0700 inner links commit 22050763c07cd92931e57cecd96f5de259e1f4fb Merge: bf9b2cbe 7db06064 Author: jdeckerMS Date: Thu Mar 30 11:06:28 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit bf9b2cbe5fcf618c3654dc8c94d3b7d28a0c4579 Merge: 7e06781a ebaa19a0 Author: jdeckerMS Date: Mon Mar 27 14:08:43 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit 7e06781a86193250b71582ea22647367131e5324 Author: jdeckerMS Date: Mon Mar 27 14:00:43 2017 -0700 fix link commit 265d164f59ef91e9485c69ce2ef76dc08e6d561c Author: jdeckerMS Date: Mon Mar 27 13:49:15 2017 -0700 secondary tiles ready for review commit 8e0f57b38fe967a6a1c6794a4b5d97522139304a Merge: ec1be358 3fa1f32e Author: jdeckerMS Date: Mon Mar 27 12:27:33 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit ec1be358670661446c5600d07f5cbec47bb4cc0e Merge: cb27a41b 0a2afbb1 Author: jdeckerMS Date: Mon Mar 27 07:57:10 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit cb27a41b907a51e5a76613143bb1c605c4fb1628 Author: jdeckerMS Date: Fri Mar 24 13:44:55 2017 -0700 sync commit 56206d7637064329783c711821c1a8f494c5a57e Merge: 7c6d6f3c 233b34ce Author: jdeckerMS Date: Fri Mar 24 11:15:49 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge commit 7c6d6f3c481aedb01ab25633660867cf1e38400a Author: jdeckerMS Date: Fri Mar 24 11:15:20 2017 -0700 sync notes commit 465871de30b4e9f470bfbe370438c35e36a9927d Author: jdeckerMS Date: Thu Mar 23 13:23:39 2017 -0700 notes for new secondary tile topic commit b102a01ee80e5d73052ae273cb371ef62d127429 Merge: 24c55704 8d2cf84e Author: jdeckerMS Date: Thu Mar 23 13:10:29 2017 -0700 Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2edge --- windows/configure/TOC.md | 1 + ...changes-to-start-policies-in-windows-10.md | 10 + .../configure/configure-windows-10-taskbar.md | 20 +- .../customize-and-export-start-layout.md | 24 ++- ...-10-start-screens-by-using-group-policy.md | 16 +- ...reens-by-using-mobile-device-management.md | 20 +- ...-by-using-provisioning-packages-and-icd.md | 55 +++--- .../images/customization-start-edge.PNG | Bin 0 -> 7962 bytes .../configure/images/customization-start.PNG | Bin 0 -> 5255 bytes windows/configure/images/edge-with-logo.png | Bin 0 -> 48962 bytes .../configure/images/edge-without-logo.png | Bin 0 -> 21161 bytes windows/configure/start-layout-xml-desktop.md | 11 +- windows/configure/start-secondary-tiles.md | 187 ++++++++++++++++++ ...ws-10-start-layout-options-and-policies.md | 11 +- 14 files changed, 277 insertions(+), 78 deletions(-) create mode 100644 windows/configure/images/customization-start-edge.PNG create mode 100644 windows/configure/images/customization-start.PNG create mode 100644 windows/configure/images/edge-with-logo.png create mode 100644 windows/configure/images/edge-without-logo.png create mode 100644 windows/configure/start-secondary-tiles.md diff --git a/windows/configure/TOC.md b/windows/configure/TOC.md index 7051cc29db..b284277953 100644 --- a/windows/configure/TOC.md +++ b/windows/configure/TOC.md @@ -23,6 +23,7 @@ ### [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) #### [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) #### [Customize and export Start layout](customize-and-export-start-layout.md) +#### [Add image for secondary tiles](start-secondary-tiles.md) #### [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) #### [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) #### [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) diff --git a/windows/configure/changes-to-start-policies-in-windows-10.md b/windows/configure/changes-to-start-policies-in-windows-10.md index f15c016802..f45dbd39c6 100644 --- a/windows/configure/changes-to-start-policies-in-windows-10.md +++ b/windows/configure/changes-to-start-policies-in-windows-10.md @@ -145,6 +145,16 @@ The Start policy settings listed below do not work on Windows 10. Most of them   +## Related topics + +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) diff --git a/windows/configure/configure-windows-10-taskbar.md b/windows/configure/configure-windows-10-taskbar.md index dd1108511b..9ba2624f45 100644 --- a/windows/configure/configure-windows-10-taskbar.md +++ b/windows/configure/configure-windows-10-taskbar.md @@ -291,17 +291,13 @@ The resulting taskbar for computers in any other country region: ## Related topics -[Manage Windows 10 Start and taskbar layout ](windows-10-start-layout-options-and-policies.md) - -[Customize and export Start layout](customize-and-export-start-layout.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - -[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md) - +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configure/customize-and-export-start-layout.md b/windows/configure/customize-and-export-start-layout.md index cbff20b284..a7c154e348 100644 --- a/windows/configure/customize-and-export-start-layout.md +++ b/windows/configure/customize-and-export-start-layout.md @@ -76,6 +76,9 @@ To prepare a Start layout for export, you simply customize the Start layout on a When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet in Windows PowerShell to export the Start layout to an .xml file. +>[!IMPORTANT] +>If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions. + **To export the Start layout to an .xml file** 1. From Start, open **Windows PowerShell**. @@ -148,19 +151,14 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed ## Related topics -[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md) - -[Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - -[Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md) - -  +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)   diff --git a/windows/configure/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configure/customize-windows-10-start-screens-by-using-group-policy.md index 5a2c3940fa..170d81d10d 100644 --- a/windows/configure/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configure/customize-windows-10-start-screens-by-using-group-policy.md @@ -119,14 +119,14 @@ After you use Group Policy to apply a customized Start and taskbar layout on a c ## Related topics -[Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - -[Customize and export Start layout](customize-and-export-start-layout.md) - -[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)     diff --git a/windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md index 16f95659b2..5bbbcc8808 100644 --- a/windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -129,18 +129,14 @@ This example uses Microsoft Intune to configure an MDM policy that applies a cus ## Related topics -[Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - -[Customize and export Start layout](customize-and-export-start-layout.md) - -[Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - -[Use Windows 10 custom policies to manage device settings with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=616316) - +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)     diff --git a/windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 8c7153b1ce..07d5c016a8 100644 --- a/windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -44,18 +44,12 @@ Three features enable Start and taskbar layout control: ## Prepare the Start layout XML file -Before you paste the contents of the .xml file in the **Policies/Start/StartLayout** setting, you must remove all line breaks and replace markup characters with escape characters. +The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. -1. In PowerShell, run the following script: - ``` - $path="layout.xml" - (Get-Content $path -Raw).Replace("'r'n","") | Set-Content $path -Force - ``` +1. Copy the contents of layout.xml into an online tool that escapes characters. -2. Copy the contents of layout.xml into an online tool that escapes characters. - -3. Copy the text with the escape characters and paste it in the **Polilcies/Start/StartLayout** setting in your provisioning package. +3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. ## Create a provisioning package that contains a customized Start layout @@ -69,18 +63,32 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. +3. Name your project, and click **Next**. -4. Choose **All Windows desktop editions** and click **Next**. +4. Choose **All Windows desktop editions** and click **Next**. -5. On **New project**, click **Finish**. The workspace for your package opens. +5. On **New project**, click **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. +6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. - >[!TIP] - >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. + >[!TIP] + >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. -7. Paste the text from the layout.xml file, [with line breaks removed and markup characters replaced with escape characters](#escape). +7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. + +7. Save your project and close Windows Configuration Designer. + +7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) + +7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: + + ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) + +7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). + +8. Save and close the customizations.xml file. + +8. Open Windows Configuration Designer and open your project. 8. On the **File** menu, select **Save.** @@ -118,13 +126,14 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Related topics -[Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - -[Customize and export Start layout](customize-and-export-start-layout.md) - -[Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - -[Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)   diff --git a/windows/configure/images/customization-start-edge.PNG b/windows/configure/images/customization-start-edge.PNG new file mode 100644 index 0000000000000000000000000000000000000000..333833d8c0993534a71d87a1b5732087efdee80d GIT binary patch literal 7962 zcma)>c{rO1+xBl-47JQqI$FiFN@>wjOKqv4tu3Kd)ULJFme|+Ws;$uuYA>O5qxRMw zTg<36B8pf;>=6+u5nDpubmlqUdEe)IzVG<{NOIpta@==v-)TMo z00fMU4DSK}#~}N-=?8B1v-cYR1p9>}=T-s z8~{-Hsv{yG-~mB0aT08P%aYN}w`eGtxFZ0#2xV{i>%GKI7e=9?qoTA2J9vSPu%UQb z?79yC3~|Pb0C9ppdadc?9?b*UXvSPvBGTAx)r#fQ#b_{%a_N1MZ>~m;_bO zuj@TLYaXkUy?9Xjy8U-T$WSb^I52i`hb|=L-3)w6d)9G11L0(TODat#nL)aZwuyMn z6G)$Kcg|4PpWO>{kA9~#+8%r*6w?|RNYGGIqsLsyeK8=X(%T-SR6gc1K0uOH{$bUx zGz&>54B*3T&@Fxyiaw%fkK(DV>anlIOz?E|3~GI^n5EGbqHWbP{ zFA2OEJ!it1W{A5?;jxyGJ@-I(x{)kqe9}nxz;N)JtPI#Ca#t{KRlV$7AS}qD)*qKUVEZXzBD=6DmDrDN*Y)Ger&NMz< zo0>6_i8;l(vfV>PdaTX6KXRtrC_l7}TFojAW+U)&Jo8Jy`B z+<|2*Y8T>ju8AK5o||x%Q0neliHJLuO<^5gYm_Nfy_!lPrM0{?l2z%|eM0vBr4anN z{gS9ebz!yJXE8O;z<1t@!iv88xRcaR-L_?nqk64&L#+LUMrrJ~{1SPpA&-PGJU_Wl_D5$Eo`TeIDs8s~GN zI2rr*35&H3y2)0gypPoEb!Yc|#5$bSpIS}QxprW&Sy-V03>mu%{PTogCwo1AwzXYH|Rp zaqNn^!E+n}09w-ioWRf@yIg~RhF9~e2m+ei1QE?3*Z0LE8LcY4n!wy#wDH{N;@c|k zOw))agvpPJfv)d&dKMSO-5hw1hL4W|ah8q5f2skwlqO4XleR&TpP7$GT(QA4A*DYg zj9~_jyXsOsR@$SKWYsk=8s1|t;>^HsO$qJLJ!}5mm-&0Qy09F894t0|M5j}tFA;*G zZ@7zJ-Iv8Kq57LjkBxUM{Sl05da-K2C9m8Bz8$#h^F~i-6dezrRg&Rrz2{j^v#)T@ zP1#r)KUW}?7?kTk46+lHq6c~nnu1LEfw?-$1%D-}!CKE()T-ji?9#Mn!cml_!_7+L z`el`@q{uMxn0+3!+#{x(Uat0qx?p{^^)j~6E6~Y$S&<9Kf3N$OR5jckk6y-F1$2)Z zz2M%u^hvp~zJ!jI+eMzf1k7Ed{Nlgk&U}4u{EOLJk80cctfz4Gu7yh9rXvUHT+bp2 ze;k;YIC>qh)3f#ZOQ5>A5fvY+rQ(tXZZn5KgNmtZVSl}VqR^MLzJ5Nq3;z+(_&=h&XQfs^l5~XY_`8v z{|d_dHRCNVfg-PBq_>mN&6HsK-TnsjF+lL^*D*~4RlN#R#)lx+1|bXC@+2p9C2S-o za3ky85BZS}6U}vwouIViPwQN!YZGuVop442dVDAWZJEIp2Md^s50cer3%)#A0!jE& z3=!1Am1_+~%HC;g6o5%H)X@n21=H-1KpHO7G+P&5SHB+gi@-$yUfC&-FMB0<>AaoM z@D+fu9&?U%xg|+3?^term#yW-xq}HmOQ=%8tAbV)b;at01taU_k%T!RzW8x|9qL$R z@k8$H`FFF*X?;aM-s1qGLSDv?j86EvL{@+FI>@yOoCIfAZ|MkK*f|G|h5Ou1qLj&p z?Wo{{Y&Fc})H8Ctq|ltt^smVtOogtUFW~PUpNJj`(KE6zH%SzFJ$tLN+y7?0N!#1(8Cb z#38&n0L>f!I1k6aHS@pK#~fm-O}kr~1jL2LxXd}2YZsS16cfvM^8sxUdzKP)2*e%k z{S1mZpKY>VSp66m`v+m{ERbhb5xxaj;$0+TiK^*gN+R z!<*y#hTOJ68xc^8FxB2jb!Dlg0j+Imnk-OE2#9aN9VDg-Ct8Y&Ht+&_F(qd-bA$qC z&-C4{>m`yi-{>d>FFZO^$46>*(5k+9^0(t@mupt=R#VDnnNCVJm{!?dQG{d3dD6_G zNsdOJ+K8`$-&nPP6g_M>Ki^%PZODX0nPVlTxJjL?F3+52#K2+j@;%|ALOb2g);MB&Whp`- zs%uXy4uTx$j(3K9@1iSO(g-Yd$)-*}xi;|dd6`#A@tZGC1r2~W>i9p-G%>-VPM(_R zXUXnx`G?QW&O+L{*&`tIr@wkvv7L(zv)C^0Ow0VlywT9T6Tpqz|EHh|NQM*8Ax@aq z+xMeN^|sSn2r3oM!UxENOqpkZSfMY&)N@eT`WY;;h)Wf62kOzv3Xp0qWb&qIApqj+GJ%!!~f7#+y1i8>%jK5HYzH(;Ke> z<+C!j7Q6EjY6C;Z$QjwZ9z2 zHZQ&_x5_8vZp+OPD)I$(aCZz*NS!UGHi=X%EvXYqo95lnjEu&%g&5KCtU@Z)zO1P= zf|}EnsewWrZH2gx=dEZ!oxODQ)W~52yQ81c>dQ0CHcYi2>;6u4dYk(2x%V8h43>`$ zOE)CGwu??|ph)>RZ)%D=6#Ag63qU22(Hp;|qnX%9}4vN}q#|?l}ee39V^wAaAok*E5iCrGei=pJOfXJH8_} z_pBee%4(gk4=1hcvOQFq=DQdf6SF^GXvC@fG!M$1=b6+_+3H#;D$ayv(GZOUlNVHk zXNYKo^Wi=JPScPmWv$1D<)c#QjAjIcD!DZ8A!8Y$v|OFBLPJ5wWZ2HR5rHv6G2EfB zBsv=Uq66u{?jS*ogG-Yqd^Ss+L|4)zN&3MTCG^e`w}7}4ygywzFYW>36VXpT{; z%{Lzx!jWa;&mhOVyiu@!z4=q>B`@f(c|cBs-aKx<-R}0Aj2jeYH$}r|DkgV-X|~;D z`R=&rR=wonktn^#T)59rR_kzP1ETY8hTfQ&*i!nW(HZCUj7*!T#yaZJWc;f>w{4BG z2J~V|Ggag)rDu_LpI%~>Jjce?tI1j;X}X&{D%UTKX^txQKi&12G*fT^p zn*N;L{vz&_=TVpzc5Waz=zfoE>9)CuJ4y(4qd5e&)4 z{<@5G5!ZuLjx7CUlUzNqxB3go^6C9ZO~d^8o7a5uBDeu-qo((YZX*N(r@iAhJ9m{xD#(Y z0JROOL8?T$Wr?UfrmM|+Gy>$gO;4lx*4}MD@|Dt%mm2rnXi_TxVTd;LooK6`l7K@e z+ueAldcrwfFFOaD#M1YPMOv0L-Al1$c?i(yV9ij!VQ}2Of}TWh%LH1_ zxN=OS<>Jj(oT~3E`A5g_3fsnB*X3Tip$FR?-8tggrX?)6YST|dqZo^FTHPBGCc~=< z#%>sTQlwUzTD(Y4e8+x}gvk{ilhqDmOU1tylK^;d^3soT0EiP@uPMkw<6l4Se>pz+ z>)#GPm|WqR%SwNuD%G3fp70;+6xguG3uP2o?c-gx<{@H z0>)MY3!kX`D-0)AyPxHeZ+^dKU7^HlDw8!y-^^_@yU_cragj-Q>Z;5#zdh&sOHTZ( z;Nt-)7wT6#0Uk!CHtL1%>GE=d`jx;VsuYnm@7mj@6>8RxzyF(iVP$5Dh*vT5%KiOK zG1{Vnhr#pQtEWb&P4hK&m8dJB?zv@@60&j%?Y=}!x#rk=)?xZD=+>=ZZM|7fcY_+- z@5T|U44b}WgEd&kYo22GL46)^2Ycaxl4C4xb2G(#23e7N*hjrgMCtPMXNS=mbU|Z- zu@d}eReAHR)&+b+K8G{)vx97UpCfO0LzRvmuAJL!M>slc)TVFBk;e$ZiysLwkr^MG zzu|^S;7-P`c1~fmkEj66`sGG^z!mZqbVs~xwjSZojK8|>d?704!}LXb9Y(K&YSSa9 zI5LH_3xG3SZ6jkmO;WPD_gQozNbuR;o{E+7m24d5-^&Qk9-LOgPfxkapTk!=ZVIrR+HfqJT0E3?B`pmvvNQ`c23w3)#UoyDA z?9(grtC{w@?XFtoZ-;5qxow#x=mjQgi^eL_a*p@RClB+lR`N@Q&~J|_8-%b{znPsw zhde5&fhRKtqzRu6*)IH;WZDecxs^8aaoVGU1(Ev{d$^flJfxkw0vn$8i8=;3b}QT` z!A5*A)`vyxfd>+f_8wAy$oDy*s0>A!4dc{pCzEsWAEzn|PXvuz%{W>tYJl;H^Iwq}@{ zu0nmb__x|(r9*PN8!N9L)xy7#h>R__GdBinx*a^ia(0keM3gmeQNEkh>*OoAKacwTm?nqjk zBdmYcJ`O1odClHshkp8NrFc}v1r%M#^Dd}ohH2TtrdkHU{5AZ*&=2{1;u{=*-{Ef^ zr7U&wdlh`fFOonzCW!~4>uY_`Ghi+n!4tBR5D|W9(l>))Zl?65#=?iaIus-%J+GoA z@w4aspiS3WhQV5JKhO1AL0zLd-Z)a2gA1(wXx=qX?cFCZ&~a+0AOVto_R+qKD&8Kd ztJvMi4XnqdcW6(=4XtKF_XB!D__$(aQ3zVBJSNG#g#>xg3lt&CMb+JTFI)5L%Kgd5b z!;T@%xHqDz63G@vhVcU-9qNUIzUoH_r#+VsME?Z@cCBD8Ku6AAn!yHX(7>&U2MDGc zB;wC^>H;o7pez1I>-@Vw9EI8O9lx&pM?f%ljnh*J^Z{Z>;TG_>Y{X|N)!Q7_K(%Ma z+G;3U?4jOYINnky>D0+**b|t&N>b)Zm9JEh*;rb1%GDEqrrqtIH0ezhxP*F8uOseT z#Mn1;nRv5h_Yx~@?N`k1gmPF5JlR1&0{CRgBdO^bIAYrKJi6@X%#i(q%d~F|i?1rX zR`5{$Vk=8%z<@ohX#YDb!2b&tpig;sBXRY`vZD&)g{ie7J!*T~sGLuU1^{WmZe{RbE<7#VfmZgYOfokUH4at5%V zO0ze)w8;*dlTB8BTko|KzeS9EEmO}%Lm$%oyPe*XQehYH4=k&U4aB<72$FL=ph>L- zDqu|4Nms?YdAYz$X3j}qsE_0OR`(r&YL%^oYh-3iApDukuDye?SdrNjLw)4H~QN90SVEy3ExTc;tDTG^{isWaLil z`-+rn@9i~$1K=kT@sJSu!Xqyw^$0dcPc* zZo@6l1HfC9dGjOjqicUmNi9K7_u^n0k0bKvGQWu-QMmQgo*q@B2wQ>EfWPpL#9zv! zJ1t7HT~XdIS0C^E9*e0oDC#73f-r+RHxM ze6>ZTw?d-tTj$iz_RUm3Jgr;lt*+x*iTIruoHGpV;2wF^xHD-m=g?0MLR1Wud4zpeY=!#4FIf>q;N-eT z(kMtpHpuM9_=YP~Q0rAv*5`GcUg1gX@L zAQ7Nw_9Tw9ZF=KAX1nKwjFPoqIczQ~D*Vljl+sm;DGnaz?Uc~hl@etTnWz9P} zV(|7mp(HW4K#n-e8dQhZd-;w9Hi{s6zgCUtJLENa9i#p#6d%xL9TljE@_UIRv&Z$6 znuzA{jkh(&?%HVINBs>V`qr*rWK-PjqoYHFgM-6Fqq9Mn>& zUbfu&t~QAz*bn($G{r2o+h09+_T3{l&wXd<|4y_LW{wZmFf(Me`@MmL#WPFz4`P?r z$8+{KD93>Qbs7Ibr{D!I*j_9C=StGHOtrQEAbZTT&myL0;d?FxvMTQ=?QyJ>tT@!) z2<#+&ur+`DD2-u{ISOy(tGNA#pf$@cp_Uy?q3wPIfLjK0`F+V}%ju;Lhj7c}+JVk# z+^Y&%vN2t=PWIF5Q|a2|Ga+ww+_{Z+^CD+&Vs+fyYyvX zu4lv*mu+WgES>%_@7-aMS^kqX?FYUD?|@goJ@JNQ-4y1!@Nd!7DcG^UlPOZnheC4A zdvpcGXR-a!!O#Cc+0?gA(kolL#cOJk47QY&+IrUA!$_^qSFpqK7fM`d@NOsVfbZn? zX`5SpnFVwv#?LCovE@wCm;K8ZwOU>f%ye7tfs{i(;EqalxBKrkABy$ZP!pfOrbk$D z%q7b6=9@-DLo@1axst!H!|tR8y(NO!?&P(~SG{g72;r9Cx3=*9ND|MMsa0W^-@d`QVIUglxp~N-?|eI57pd4#b95AtL&LdZ-}O?p3ai@ zWy|rZk3OFDYBlZ5Fc0U*gM-eRm0KcBB`RC$dM)CVCSzNk9#3SXcLv@ry3viLfF`&R z88$I+F!2qW@Uh%#IO6jA2lXXqkTQe-k2V9dH1hq0V*FOa;vFqzvxQ%Y(j&QD_6=p{ zO^>2tB8DNRAJ9=}q1FX%%t8ICAaH;}a6@TsAt8(&kx2lRv@$X5WE0c^cO;f~FHV

          <3_uCn74!M+5kE)@(yAh<98P%1$Z{)PKk~ wh%gJ^-~#q?*~b9DbXXBDi56go+(}HSdZzMu3eh~0oo55aHz9^qzq&mBFTw{pBLDyZ literal 0 HcmV?d00001 diff --git a/windows/configure/images/customization-start.PNG b/windows/configure/images/customization-start.PNG new file mode 100644 index 0000000000000000000000000000000000000000..494233818185a7835f93adfe342f6e8058107d54 GIT binary patch literal 5255 zcma)=c|25oyvGlcry)F;P~v%H$-We_PNXC|gR-U)S+g^iK_Oduh_Mf$tm7#()}fFP zBeIUn#4s4U#x`T-PWQfUuh+e=`^Wv`oby{>=XZXe^ZWkZpI@@2xzTCRSr7mKr;TqK zS_1$}3^QHv$4Tbh5t>uZe6R#r8yNtoVUZPP=7fj7nLYr#&ETZDu`~0h9^bqZ1OVJU zzb=++Iqq`+ARuCFs1FTyS^usbi2FRzwOv+#cYeX`iQGd0mQx#0IR0Fx&WLxKN-- z1fSu#L%qQ{YpINk`F4@mWF7j1s{>vscur6UL!VzloFrs($H66eG&EGhoiD>dM zq8-K7LM`l=%i?y^X|}q~k#DeR56_!&6YrS978JjO={nb5pWw{%gX|iImKlfU_9&Y3 zj`dkQ;QuB&t1-9seYE8%mhYuPtKC_}DX_ZgBim*Ds$aSGRf*>HPZW(h9v- zGxo4nS2`$WCF0E{Imj5jGIvJ7+~5>nm`#T(Iy#_o_|0RK@67EOTH@X`WmprOfnS{( z*f@IN4+u$~-#r&edu^1T{)6#e_ZU;>x;XiFhuLoGg_l#p9{D=?W&pQzM0?GCG60of?$f_Uw5ankjmIWv@=UGGr!%>1-#$(oD1!OC$T5bmx3c4mf45R&=7tEcQeirP9ZxwRG$gQdgPiJk#6 zra2R}ShRD8*dop&8wuat_QoN6T{R-+!lNC{yx4>|&+i(Ko&-eyHa-W0Kl`;({@!AX z_4tDZ5QJGFKzQQsBGiQ~9!$I-z}2_N#t@bbX8}ToMGrz;a;;A3CKcabT`Rw>}sxi;3=Vxh9fmh zWB{kKEDm~^Y&gZ*t>$60D;Ompdz(clg`b0dK`y+g_2WeHo&~!cFuB$f#}ELwn_Ifc zk-Cm;K7hKe7J8&HMnEoaQ2&mP(W~yV-@Q4^e~_LRHJMe0=4=Ur(I2Ti*4_3(=C}M4 zd00rvrKrDsI(Qgb6eH`oV9qO6k#t;BOpg-2Rk*gq0ub`8;y3{v19nAVi#JXT(78t7 z0I<9VEM1pQ!~k1dzl*qZwghct$rX-%QCWtl0LREeKkA%jXe6+Vy$GX~+H}YbrQ`Lw z@@w;9xMm%)6p%JVV1;AiCo$8LH{%T)78l(6m$=O_p=*0;mB7i8G8T4vCdj2uAn8df zd%xW^{e*kle&Vg_I2_2W*SBsK)!7YSjG)%@*8#s}`g1pkoL%jrwR;^r^JO zNo&a`VEFB$$n)Pw@3bLBJ$?=c^UBE!YnXBCFTgE!Wx&}fn&5BqVQ^?IZxA*8?&E}t z9RvZ({LvNsMeeYLOCm7vYC&l=rG|J*K)@AI!YUN|9;LH|t|DY3XTR64IDWg&t`ri( zz*H^3H7~B#3^B4bLK0iw_;oh_L=;92Kbl!>)bO7`aIu4}n8PfR;6c^Z}5|X>;cfCebR$Ur3}iAS&i11dO3JW0KFl z+1a%ohkg$|mHCs`jBHbI@pC<1v}|Zk5*aXTg+_Z7{h73SY}v#I+b{79JE zJLbiJPO*-lOC=v^f0nw%8j#hd`7UJDT0-kBTsZ4#U9N~i*2l~|PTI5o= zr16~Wp8xdmH|cV=SeVvQ2Byy+HXZ_QHyt2JD5N(R7Knx+b`rGgF$JKAy^7kNdl%m- z@ZOJcuU*7`s`X3y6DE!ImV;klKA$4HY(&z6b`wIs8N78%U&NeN-iBb3a z5IUrDXW`6sw8hjHqIbE8Qnix6F1;ZtjeB|9e#6yD_xMotWwT|HAi#Z{U6Ct8`|`Hy z@xT1sA47if{XcYs%w*edjaG@?a3c1;es33?JvtBhIvvUiSL3bm65aRtr_H+oV-Pz#RKH7&H>pew@Q|B&4O3RC|F zyw6xETBYy5;x$p4H>Bi&*lh;paMNeprX6<@ZkulBthZXOhxDyovv*DIUia|P&$FXW z;?x8psd^-Z}pY0@eYrpE}EzNkkRQ9x9O(1tnbUX zs||-`bbk5#0i$vD_Oll}@x<*UW<*Ia$9~5_q68mxaUwx01J1LIyfM63G?Z{*Yx1lW zd%d;7bI755*az!kTO1zVQH`CE)~fa)S`2OunE#Zp-y5vyU}>uVL>=si2$bSRs6xJu zi8bwqo!OfC@*|Leq|-OcSjFNx)8p*7yz18uRtGm_plu8({I}@N=vUVYqE#T?q+x$* zw&?SVT&H~CvgA2iW9qPd+?o~+O%BQV`Ene-HP&0VvVz6*@u7+g40Nm8I_>enk9|Pl zG8+tU4CB1%MrfJVi8f>9uzQ1w;H=BAw(q3SESu2Lht!ytNSX@S@yjxF-L>xV9NrZl zOoM9m+s24aYqbfWhn&llljWpvtJqGM^{6Sz7mdTyS8;EA_pLlV_WViatuuSMHX*3= z2)xK-(d>|v7`m^?Bs7Yo<bnqoXE661!)gGsB zk&Bgb-uRZr=I2L05?7GY#_g@j*B4qLm0byT12LHA{ZqKG=IkiP+75I(f<$b z6LuwF7vJFPi^tW%I*fNFn(K6jOCz>3zKa4g=bQ;x`;l7-QgE}@o*&jr=UHp}VG#o& z+Q8$7PdI5svYy$w%ysvog0|M=T_pKL`-d%NUJtQE4sOtbGg}`0NbQz* z-axf8*=86PM^CQvWfAL4{uBllf+=zMpU*O?N-E?@ZF7$m+aBg5K|;kBiQC2>MU&!9 z&ytk&lobr~H7^IAbx*8Lk;!)~fBM=$5Fih*!6D$r+5YddN{LJtf~P|DPEI3@A`x(W za9rJ!SC|=^YlMwQvq@j=8H(g`aRc}A`~N1LQqC=0HV2(9=c$JKj8w;~oo{cFo3z!Z z9B2#+BJS+8?4!G{_umk|^SRMSCkf;XsCEl2Y`%@R8(vElp2*XV3#2I5i>R*pi6b|I z|IVRyOW8>y7Zoja>HfY{62D6J-<*{r?0*>v-V@He@>0U`PakQfnaiAYbS#hnNt{|( zbC>DpkXW@YH{q?Ss|}{Ex31sIm~7N*N{*);t*gxVxb6s(L@1O>2aldo7zA2(B39z7 z3VaLP{FA5zZUjn-{)7@<#h(F!)wa4U*cE_fF9MTsN5H>9_csoGp|I26(Y6yBKS>C) z#dbS86Yw=9wwV(LNi^|(AwXn#Ew0m%z3wvkA+K*BcGW^uEGg?j8t68F`XbE6U;#Ip zP7EDcrz{PYR>$XXxAMsCx|dDr)~G{VVWKp|ExKT>NEqiDe>tlB&#`Dyb zxbH0D2a*Pw>)HITvDf`?XW<>ulx^ZQiJt0wR|pyGlMe|LLAeJYv47oSmj@<^#JJ83 zkVCeE?FeYGUlbk8P$N6qErS-EV`$Te9ln%b?@=%pIiOaSP^7X$OwFD3$%fQ7tY>0P zv;qi_ckwwgFXy=i8<`Ya*Uq+&jMPeIevl$b=RS?Yek8wt@}~X2`AeTZ;ay!uMR%*@ zJSmNE*}E*wQlwL~8~FyB80XK?C{kx8vc>4i?&!UF*!;MjTF{049ZhQH2sKU8X&6oZ zX>+Y$;1m%Bo9bL$!6Hg~60}-?$1;NTUDug2@ z?zhW(&FFH?fyZot8-2W%4BCd5M*BFFr8+q1CeRU8;j1Rr`dqyuSh22ugSlyQwj-+V z9s~)Rph7<^AdchNlzp_^uW1MHrAWx8NEfUXy)qM!;QKT!=guz~cfuIj6gOidaC6=- zv**X0%Dm-ydogXtHPX;_;eJ?Zg9Z6T#z#y7-F*1v2(($+n~aHNbMJ_Rzx1$Vr# zaCC+`iMd(L?D^LF@A-S=9K$oJ$=(%YGW|RYSHkndb=J;Pgv`p~$h{kRmz&qvw@2@~ zt8v8eA9!JW8dtFo^uKCeJ$thuNR@4xtk9f}?PPoRm zw1d;@4dkLAS<%k%x7pt*{d0ga6M;0iDTR&kc8+BGm6w_L)d~Z9M;L3U;yiR=G&s~M zEVriGU{e36ns;LUh&e+-8Hru+d60ub`J=osSkqEfiDFjC8`Q{RIJ`xpDPn(z8(i$! zny1tN)?F@*PI7XUea6x~!F!-&rSFYg@y(ZxSLf?Dcx_}W57AFh1kY}|Za!!bq}cD2 z#3&>ysv>p2miIZB*F;hsoPTvK`?^t8Y-2kzAiv)HbmRQw-ZSZ)AL`UGm9PFer|k<{ z4G^VIs5P_4o;HQoqu-ZDXOr;d`+M20zxrNa`rYD}#UfuUqBbl%&rB!lw-MiCrJj$4 zxbX=}g^fwyDy+CCuFBBdkD8Ts_%`piX_~tsrTM+zSzFV=36xc#M&9+c-!wYhyR%5b zM=|wr$4#0QYq;R;vSxrpgFafB++!Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>DzSl`aK~#8N?41Q% z8(H`FgL@5XxLa*&+x5EO!RiXd9+w%e{f|2LoC z-VNy_narH;J?C5{3^LTR?WJLDZeng>^`T77EIuYH6H{C!Hh)oRZfHHzTDN8d$OH(6rvraNJGqZsEqIeMc8|&H_b?;+rqHkjRp?VnG zd{o_y?2rr{{-V;rq`!fwS_DKXQ|WM+tukb{!pDxuT{1` z_qG|?DtM0cV{hB+oG4`{BLqhxD==)YEogPul^YJ~ji5jK493s>`&m1ujdI zzShR=GDI>m23Z=L0wJIIfSdi_m6@5T)n}-+?(g&=zb8}kjxuX~VrFRC_8|1KaWwm8 zgyU#WyD?Kfl*71bAC=wc>2{-Mekl7fv%ZRKN6q-CIvv(7n~~E$OZH>nqdp?rQPVyu z%b%uvR2Dx@{!o_RPj&ctw!_bJ@p87qFS8tenc*;Uio?jswm*5=kMwjHMYQ|H)$)f4 zeFy*8&3;H1^MQQ~huRqH+ZyY4xA?BR{iH7ad^P&bQgfWGF<_?FH#0N``f3gG*8B!Z z`cc(N;mB{@)W3CA8;)z3yV@|K+AuG*p+2~LRfm6EN<+L<27f4T&0#aNhR)I&3gtAd zVNrJzSM?zz-7@G=B+Z&UA3RH_CR;Nfo?q<#~Bz6 zFfy_;GO~G(5IyT5Cd0-Jai2fPJ#>JFLSdl(xCVLAI_euQ3X&&n5Rs0H*{S@-ll6@! zO56Z_x8$#p^@!$?c;tcg* z4J9&$fIMjf-AF?`$-{jq!@PqBOqyZ(-NdeTL$&%k81xzHXsqvGtZ!ucv+Zcwz?oZ3 zrtRtGy}i%Wt)??JT1;PKI(>ED=^J}a+iEavcb}l{Xhxgq3%cwNEst{jA_fT<|S$N*|E}k^2#OvK_tHj^4} z?qgv+zMt!Yp_C+ZYIe`i3{%PlYwB5B(osv&vA(4924Sf^!m@gWWt)bkT7)H=kuR81 z5D-4hB%d>)Uib{r5{+o*jA&<#JIIvUDl*<6bUl*jxzO*F-NBq z3nvD$@`{BcLAIW40DmAb$B)P}90;`aVt*(bPuABE$J#RrWa|NSN+eV$@TJzo7z@uh zQ};M@B@sF7!LFfZgD3Xr>(Iy8-rTB>LWVZuZQK_PVx*d~3-xKahKw{*W}+qIlsV&c zZ$@f&dR8}jem80!+^y!fGd(vm-_Ud*(Qsy8eBV}jRHda+ZWY*!y#y_v~< z8Lcv;zf)gYN}rDj&htaTdBRus{0wFEWaQw={lrqAnFVj`#Z2zSI^UalzBlV!FIG}d zR#I15QcrGb56T%6`YC(rk)hOmKajVYj-Rh%KKM5Yu^Q*!PKcd%WIG{dUI`#`Vmy*Z z49L;*0_edL$2pbPBd?{2b=ET^K64H)GD?YRe{zZ5qE5M>K{=;M zIjc=Rtw}kpK{=~VJx2&Tqd`kj4LaT>^jPoUy_Uf{90E6V{b`oA#qSc*&j*DE7H$k6 z1mYP}w+IWb7*o%96Jng12QGKOCfeLJ0%YYL^?7oOv2u(1Q~`vp9CJ68g&PaXHo+^c zf`4t58_UuasU4M0vUKBqR8}4wD-YI(f(qhmh;88>4zh9$w}S6-W5YK>wPNZX{V9a> z^jr)Ph#ED65Spq&Nz$U9?an&Wm3c;!ovy;lB`}MX=mqNJOfVW%N~#L=BT}QMe^g4; zbOP-&N&-E#vuH?4xH^3)oQyUtLx=hi0SO-p>{x}C55Gm3UhqjJBVU=GtHj7wW@LY2 zi9g9yVWg=rQq&k1K+4P%C1x6dmZHkZB9PB()6VxG9W^HHvkBR*{fob*<;n*msz{SAD!tEY- z_(XBRi2p(X4_`n?H?JkV7#CESIRsj^IyXx%DqW9rR+p2c9-gBVQ9=l>Ah63+=>=-= zubh0fk4crC_fe^E3zfNrAC}6T0wqqthb4hqKnMpFy(_sz@S-xe7`>NM3~z5Q)i{Of ztO8ADo)$CjQ%ZGakt(-bDZEmJTm5Nexk`AcQbdtTc*&=gNbp28yg)rX53U|aB_dBL z5`IgeMs%4nD@%uyX}~yd!Z=|=IiNc>RKs#OPKZONOudy5JWpktyV8LWNCQk&L(h637kp-t3sJpq)g3IW)~}QJ|Y6U=%Z3%!`n+gy(EMyRQ|5y zww35i%F!`xCA>wMQ3z7`p!}#$ATWyHhY;8m1XkrIm7FpHyM(|kM8D-zN)9}M^DKu8 z0>CSC@|3uFIP*n>h%(ifY62r)i=Ewre!+--+JbUeb2LfAa)g4A)`njE@g5=eL>3SN ziEKL|5M_ZN2?0VN2?0XjPJ`Z={$C+iNL>~vWaE)w;}M5MjIkj`S$jYVghG6f1ui&A z&~Kg6dy(Ed0pV?!y{}F|+MgCM0J3(Au!bDTor7L+k23R!`4mFB_$=$g&CmctWE2os zIclsl4ca+~5C|-|!C;P;39L&h^iqHXA}(B|ol903fmQNBS%&{BsJwFtmWmGOR8|l; z6$CDnmG71CBKlW&V+H>9jwSx>AC}ZY0yY1GvXHfODT^<|}NLVZaqP-W$6voo~mkd36O!fj?(5!hD=%qyz2 z3UwMlQbM4E%08`ZSNW%v6}rP61Bf&EzX(Q_TV7XZ zIh1sWer2$LPbiV7<)1Dk8d!D}f!QW_-Y(#Q z2A20u%2X&7B!B=C@F#ewc;(|I7%RkD`H+HtS_$D9GI22XPb33JDbW)+{*$Ey zCB1^cXcatvCmbP_4pKw7mJ_I8mk`q6ZUlul;9*J$;OKydkEjIfUWt*5w@`gbnUDJc z@CFEgKQ5tapaLG%DwImNP-@f?HEI#M2-I>_=0z>eRpqeaE|j9)q%6y@RJ)+lx<7Ux z#CQO0cX==30z`;=?7v4}M2P27Q%0&DMA9D+qDn`EsM3Iti*1A;Yxor5gp`6*$>_-D13J^SjKhcYLz1~^KCFU#REwi5_dM;|8 z_~3W_wg3ijZq+!zW$Kh7oDlSS2SN%FA*7T}gcutQFfqkP37c5{0U;gRvfA?y&gv(;2%C&sPm-bDgBYajXpVa<|`i>C8LB8p;0TRlVe9uA=!?a z)@Ou|@h|hNoar{iNH9J;wt0W(%0DUy6#sOT)y-#NA5M}67px&yg`KIzNzBI;T=4vYJ52g&o3>Kj#eo?L(Q;_AJp=8bY)C3{2#kz&DbX{O z>1iN*3`?3iJx!CArbSHwY2(rgOHvO$ry6il)$h2f-%<7XCpCi3X@sR{QnS^mxeC_- zY-mz)waMA=BJQKws{BrZ^G7PdyEWQ`UQt;8rwBghqlA=nB%}u|*_d|Lf^=B(7ZU0Z zG3(dM+@Uie`VOPp2w|AJP=F9?PauSA=@|nzwId!DM7))zGXQ@m91kLHC`3?eXP-j& zE9hTsJlKFJoI`*2kcHb0=Tu*GTLsVKt=tnp?f?2$2>&8fmB0`0L#*^M1xkTM!TXyzof)0Lv=i}K$)4R z!pu=;WU13K)oIzP)Ep&(lGWM8ns693oj}bXu=3O*iq#{^)WS+LC3p%-gVvbvJaTQZZ(0(a|;QS_-hbS6Zpk7L(69y-gw8Ec%#m~UasMGGZq@VGK?pN zI1tIkqo)5ni?uzu@U>7@FB0>mQVE7XfDeQSCI?!imPusi;TxdSvV`s9L^a~gfiB`Bf;Ebv4zJ%Yhr>mF;4N*EZre( zh_P^sMm?2nzxRuUI8pp|MZEy$fJX6nMWX@y#Bitx2Dk*7elwwmQRh6Qm&Xz-YPtcV zTm@q2h!R3no)RZbm6fSYE7GP^YEmwt7A>ey*${NK;-N`R*8)*8HOM)tltMyS5rI}k zU;-zXwIVKdiKyttF3^LNhLZ=u8%T{+pn{r)a#X=yS;Z=pTn%cWE~BIiv!V;5T#sG` zB_OI4oTyGs)Mci2Wu3|UTQSe$goFYi zJuK`y6GG@~uiI~=>DXBgUKAk2(wS`Q$pVA6aOI#;9<6PcND4d@761DH{Gp&KMZ?0u zP|Q6ejlE(Gz2p0OCxFbRF0`5&k0waDhT6IKkDnjD{7~ZM=XDJd8BZb-$)s{QPKHd1 ziGd7>gfA8gW#CD`x4hzGNu^hV;#NA2pKLjL7Cz-L%E2Y7KXK7O?-lkQOKgY>@zVy= zMBj`1!vs^0r2vT~A_VwH{!r2OpcqY~c;$}rXD@3 zJ2Sf*ExkJGajrswb%*eYOSqFYu zoH%yLIp>uZCU49N+Fu@#czb33>rGV++pjktc`7;o7RwW26&QBlfz)SPey@;S>Om(6 zlq}Rk!ns7?RI9SeHJL@ajN;Z7u=j-;%21o^`-J=nAM)QK#L9zXNn}CYX+n%L_KfN4 z6{nD?Z>*s^+s2D&gRC=*JhVyvNA z{I*5Xf?@R-cDnHL+^AI!6X#iuoo_pl=I9z};}m1>w!p!2vAHW^pc5hHI3X6Oj&C(+ z1tAKxzxZYP%7hTusVdA2Eoz|_xk7_{Q3d&jVtkZQdx-Up5M@fSD*G~lc?qv~E5HsQ zmH<4uQ`2;UFLWcLc}TsP*#@+oaW z!mi4&n;3Rgf?boNC&wS~r*6*Z6Szey@R$lE6WAa`-BOCYsT6(<&QP6QjrzIquI_ij z*+8ZYp;0R#s67hVG%EilLQIVZo0?ghnIioGA#JVuNah|1wM(uf#sNQ}i5-N%h>>dr863bdRs+n2HEOwpCMGOQVL4}=FwKROa36NtcvfJbTO zOP;=IddwE==+~E@ITsP?*1OLclMaIx##S4hI7|h1g>?Y zY#7enHZp#<^Qyy>H=miiGl_95DhrebE*6RU-&|fAz|2K3_E%KwfFK9-6k*X7JO8TmZcVPNh$gcA^HI!@*aVE zONnz`iH5p#-q*W6$~Hn20<(tlf0qyocP^SX*hYwvM=UCdkzl(6rbQc$oZioQ&YHtX zkDJ8Ja;#Y*146{O4?$5DN*|1EU@!l0QTBW2s(N9IKTsB=^oc^(Cw&vJzBmpAs>&jI4H`3OkI_c z1B7T&-w~q3s78d)t8^l+bPX@lCZ%Ww9Pbfu#9;QGzO!~3&Dm-0x7#6f?{}PI6BnKH zS)Dw2^_lrQQzB0nuFku*=hB1YcV3)({5JLZ+mgEG%PqpYGVCFSJ;4wUFEOm9Rni(v zREG%~Wc&tMOQRI2R#4B!#Lbwb0gjYoiPxUb{Pl#%tmQoe_Ue+8G*~6d;a3RU8wBo6 z0ta*r>=jup%A}F)wo{=f6>5JSCE1-A_zt5BofPIVmStq%4P6Cgdi;NQYM#3Ak;!mrb&jq6=JVMSdARJ z_(B-EXouA=Gp$Aj4segMca61mkLy2q2^f8Ql!Z>-Bi_P&v6cHmocUIR?nua2(%+JY zyhjLXJXNRWLK31xEk%UTs+5@*wK>%gVkyl#p%-}6hIMAr(sZvCX*1X72Jb52p186i z^WmQAnv=I0&)sdzdd4fS6W@U9Mvh>3j>AxgVPNZTG07{5;FYMkM$*!R2?dx~h>3(4 zPatdLNoqxsI*F`ajy1xq!!U?^g?tIGPAq;Y#x7icHh=92d%qP1v)1eR9ncI;QX%CK z$b|$-DS=k0%&G#DRWw_*wp_JR0T!$f0s}urA^fmT82paDfDjX-Z%j;467sj@A*lHa ze`B;MnsX9s;uQ-|EIcC|eZx)0%yFDBGh)rIyRX12U;+UTlLH+n$^tmhLk7M?frk_l z6RA|*+#;-N7CM8cO7og|9`zdbtGby;j7l7q>LY1bj>g9$W-? z$eMY=da<-oBB__k>M>aZCac4wwV3#gTv8(u)W~E!AOt`Gy3%jHoV9eXp*z#SE1~Pu zHM+BQYtB8QKL50OP_kxNrWQ3%jh3rIL!I=B;UsM~-AahUbtsHmp)V#xF}4@+T^5AY4|KGb9EZ04D~i}gZGB9+S}d`t#0RBImy0z@W3kVsL< zYi7r5S^eO_mOpRHoK`qoHr)m2i zag0n^SuH9TV>e{jeGElS00#I9NEqJW){I;LTv8e8eG*D#VhJwf$)Q97e=e0vWO9*Q z1`=X2xJ@m%nlLFYcmfVY*vym5Y9xrdtb28{m+a{`Eph~T!wAOi(ea5BR^|_jPSKyY zM|0{H?Rf{aD9NgnbX{(dZY02vN1)}aav(S?Ya2~mj)WUG_(o+afb;jjR*`#K#<@8+`zwy zk#CVnfDow+5h9Xf0$eiM4S{0O85iJ2n)n z3W3^8{0sG)gh1+L;uUG;!M69L4|EMS88Y$1{*cck1g&p?kNd#uV-!dLAr}>dXi*Eg zl2ahU84!`Uy1MC#7<(Y&J;g*XG097)_Azmt9C8L}i(Dp<0TP%*j7i}#i%^~iC5mlj zt%7J5mrO2|!Ce4OFew}%#H1iTDrG{rElm|U2^jo5F(MlUE*OvsE|4m0*_Wgz@LCn zebxpE;sj6J8)R7SrH5g0TLw%Fwi-)va7W8QAVLrx@FW6^)y6&A&J}gKTe`mILlh3= zZ}1_15g`Z?G?cIatf8F{bw;H&HLn{vvD>`8-$a~UUsZcsCVPR^yv3U8u$Fp^SC6$c z%lSOHNGKDDr4p$aJOq9z;evv921vkj;|U;AJ1UBRw+$Hlfmd4y8ms}55^zm&?2Z6C zTy{Tf%^~*I(>V`YZVR!e7H(i&U>>0RAEnvSM?VLeGmNp|pm6oB- zE>>lsA@u(mLjJZq#2wAs#tDg15CR_sc4Os4ws#KXtU7S*Su-D8yg+~nd6)=1I5?5_ z2*Fc#bPpAfpj*;*&(J?$a=51tYx$dwWc=XGF!|Zv&NbZ3nGL6khgk0s0zxZA{1ch_ zpCjbst-b65G~h}RXyJsQv8!MKv`PX)K}fkaHK#l2eD`^~2Zx{BRQdLyOj3irZNwUy zu*Mdwxdm$x$oV3+dH-k%t(gRrf9afRL}$+6#iWM1VQA5~3L5MT{_=5IV%0v21VZ<3?0% zHMj8PfQJNJHujr@bbtg^WB5IT+su(zuDUR*ARk|UBCm6v+*h8ZG`Aha`Z`Od(7K8jC*2h z#hYiS$*GBl@dOwo-vR|5Qn^Shen&_vBz(DC0G_&)2LywHhc+qz21SVryay5h)g%$V z7Rp{oQIfMS|7ytctsBpzKd9%w6$t8uygETslUxcR@e>i2_fi~q{GxsI39Y%Cx`gcS zK|j}(m8!$eLBnCt3Ms|P0Lec_$lx|Y%>E`q&?r}TG^PW055lI!{@CSt8_XzM1;zE$1fEa==B$-gu+#+g*0HN~U+gXfXO@EqgIf)9D z_eTjqkhCQp?eW#WnULR%vfd{I84%olw5Y;mAViZ*qcl&Veu^nY^o=dT2 zDY$8=DXS&?>bXp}2F2T07_Tjygz+|_qf$WOBqwk2JBB}UEZ%|bc4 zE5L$+5CjSSz$>r!2tkc12ok*ST_O_I^Mv(KpWS}h#QpWq0B4ffc#;jCgtSFjXn-x8 zhNEjV>MeO6k9JS;mGpPzA#H@`-Zb&vNX2jE(ps^s36h^0O!ff7&evhyy9y2F{n};j zS_rqgP)=ykE~rs6ROtmO^kRI)qkkq3`3DHGcSmbH!*eho1tF$reY)_TBZGdLyI^zD zrDr14VhhQ-6mFgnD8YL}a6<6^zefn(;3z^J?H~ypERsp;p^5@Ro-~LypDY+PE5>wm zkhMFfBO!ojJ0Wl;?NvUc?22XbK<^v+pVk)<(#va^H6ybJt3m}QL@6>yg_G7{^gAL% zg;}D)LKz6Kp_qB6=$Qs1Kn6jtAdrjInWd12=!c!}F>m|u@I%Olh_NOKhVnhA?b`?e zJUS7gkVL8=1l32V1sHXSAORaV9{djo;Y-D}K!`vt05?*HVJFKj2QU70p5q&0oZ8JVQo^P7A;Gak)y)ML!N|QfbalF z$i=FZVr1fY_u~6%pF8>GgrGGSds*0hgb=e1gxC`iA(m}~wBhj{Az%j`0Qh48As{r* zsf`e{IGuu!*$G?DS3Tw<9|B>L97?zmGDUx3J0Zx)Bei-D+=1YoBzOcMlFOTgtZG=)D%i9XQtI82FP+E-C`0G zcXarQb#3O}R!6j3|EDOnbruS|5uX49h?;x05(1@#JKKRs|HcIo(#^OtAqHNHO&O`W z+%f{IRGC|-#?4k|rm8d2Rak|}tV(6(MHNP+It`5>SEpsFG4quD%TK2~5{q8*Uh|u7V=Xr@(S3>ZO&unB3?Z>lbn?+#?wRr*BM%w+?J@{D z)q|3uMafiWWN3xwXoP1HXsOENENw#P!lN-Hfm9=}P5 z66+#?Q2{lG79|@9v7nzdnZHwaRIsMS@SbL9-QM>IQR-vg#c`zhm|2dV6nhUuh=V8U z5BVq|=4gS#NYDp1@p}R)pz;P;yP=%K!Y$U+HOAaE3Nq@Jk_F4RnA zQo0JeN`+gg$;edm+cS{6cU#r-rx@xSgqjF7R>{Fr2t^Q0$skSVi-dgC?tzE1bRW5?S^h?-8PyK852E4OL*<2#!xxJ0XxLD+sZ0i^d7z7>)`Ua7RK+y&_D!xyIhDgn(B8bO-z~AteNMu?ja|otyO)34ufb zMYEW^MJDD+1bhh(E*)RUL;eIDiwtWJW3^(eUWSgmFTfs(u?J%8E)RPkLcQ-b81_;k zu0dlH#Vt4B0r zEsuCu3*_;4@j&YihTX!jOBiBcpm5N78Tz+Q9s^0OwmH!X0%q4JUl zKbH`RObCQDNTqM3Snkc2Q#q@9eK*5&Jjothfm?))OE@?XM;Dgu1d{F80Q<4C=S2Rx zC%O3MYZ+8^jWT33w_am08xse@6>y=LI8jX8*x-E3oFdF8MOnFgUZC|A2~p0qMO*}ex}PTjTgU38*rP_#3m^o;?(wnY>u-)0aK$mv>u)uOQ==iJRr%J-`L=kav+a$z+g4Vl6T$`dAEQ>iY|;XRO>4omiUN zh)Afz1aJAT>V)+G&rJ!I@l1I7%9G-k{2S6%ND}KX`uR%(x%<_ptm#d;U=&%dLoFhN z{@J8NnV=s=8SA?-=#6L^O zb2$cqXp0<-S^^G4K?rgt$b7L^K!^mpA;7Yp@YbYO&);xn^6JEi3y%N9*)btzr$@q0 zkLYz#`%afUuYE4V-pC|PGJz0W5hAV;lR{wJf(U^-frdrMpGvSj1(#>6JH|R!mC460 z<6+fvxdgn&eHnK2Rz3S@$;^d&SDY$Hy7Rn}C%BDaS267P)0)VXtB$1IMuEqA%unu0 zF4SX|q9rUixhm0${2Lj4n_4+}M@t9&#|W`?jQ}Y!bt{jyWm6!9bt0RMnLCxWBBknX zBR+%#^1?qs2&6CyLf}r9-mjY%v#HPbQ%yz(4D^nH6x`04F_6fy8trd8dQL#hwhQGC z@7APEo#EsXrGAXPw>Rx)ScSdYmW>HigyTH+;`^EuHNyQPRu?&;pS7=eJ0Iu4_}sc z=jpRHLPXMLxwHWTiR&;48k!A+NPrc&?6F98u@d% z(TFKPOSq!}DXjyyaG^hOLRv@2caVaIznGA(6lFnt6=CZZ4urs;79R1Io^c>+&nVML z6w@(&E=|n97GmN;GVx%Td2rDJ_>hXY zeO`yjSB$d0A|X2~p1(mg0_x@y%Vk2D2q0;eqk)DmrPxC$8VrBxUR}VhB(ph@TJGfD zvl5KvuCNSPYd&Y0L%`C3^W#n3=DD)sldjx(A;)T@qGlNn5h7{AB=wlMUM_Bg3a$~2 z2$nTTCC?<->FX~%e?2oOeBbmVSHlwT#--m{ka~@EtaQqTl!2VXJ!Y>rn7X{HJJ)17 zhqz+vri!W(ArHbW@FeN4u{j&F`%YQg+wXumH&c(6NFbfmjL1@E=HWews57w@6|^No zxx!Z{0x$(0cub4>-W=i)~W*+?$rvweZVc0 z%2E5&r$2y@_B^CUh85g?IV=3vzTf#+jGJ#gA!M*O$8l1q@%K}l{h|-1RX=V)X(%8e z#e_{w4LqKJ$CL4;*zFgBxJ}1xCeAf=4lr@2nEP@qydu$Nj;_&mo(Ua)&L8SuN=W6? zw|I||1RrlDl8aI66V&_|_D~>sj$yfPC87H+*aXDu&y4O9xWX`a^|0_gt}D*CEj#YM zXs>(h#_#=^Qz90eF0XnmlQw`0k^&(-i3BKX1c^ncwY^>>fuz4lA_f|h?$Y-1^n|7mFIjm!;TM zDYmuvk#qdPK2sOzPW#m$^nd~DtPUedoq@XBakY-!YK5eo5F7>|L=9gN;sZijU-?%O zf)?ilLQpd?5Mt@IKtYJ9Gu?Q6z+i7m#Kt2RpVmP@jAE<~o#~(QfPhv5$2} zZ0nv9!N>A3$mpbE$V23k8VtMepuy?aq;7%RROap02-t5BxV!iK?Y-u0)%V}sHT0|= zBUO`~tjRiWz&)$$x2cPF%=GmaE{pi0dmkTUe5tF$622;>4~RwceJ7I1N^`aEy8%zbeG`B;(M=Kz~eWy2yvtT^amWw6Y~X_tXYmG zSo!5g`x1=XkcaHH&s zdvn59n~a`eIB~v_I~i=+!Z+H=Ck9Pa{M)0f-z4OHAMzd{jEjFjNX2snA!t~%RE!#V zAz7CpLSACn#TMDh^vc2HrTQ~tdIbDx9(6P%<7qY@wL#sGVAloMU7@_-?%mw07i-1M z0@S$XE+z!SQp zG!1q>ft^8!$<>a^>rPARGk@=(uw9J3`5BLzA*a7B<)6ECHS*}uX{-0TE zjfVfhZtRS%>?{pRnkF+(n_H&JDpg`4qgN0DQt+TgMZ;A-AmmR)SsxPeSNISGA@BtL zG$+O?2r>1Hw)6_OBGL`M_ZjEUO{%#4Muxo>h#>^RCx?9M0|Q_ldUj#@l&a;3stcQNN@A1R-JxUnmyvrDBM(-eOqZ(^}^KLn4*34Lqn!zMxFY(xGQ`C12PD<8c7wAP+ z5@?03gy8#Np}kFLXsZSlwEYkY!2V-|z#A2Wn0UpSctzVyjW=;3bsORH{WQwP(^%d4#|eQ9rk5%U8G6Q=;3$Fbo%Cib*U9^`h`|}#H=30yg^ghC{>?hdzg1Rv) zvkhs-^hrm1GSBId&gn6;x<-~0$T`M?#Nq}CN>K4h5mNMB8O3*|ge@`reyW8l z#l(Y!nq|GwiW8{c#yQHu3GEo#=|}yJzPz>fuOmc&kB0_ABx1f;#Dlz=CzrjJV7FSZ z)k$RzvtxQqi8Bh`+?%}DX-m9-S7sUQT(|0*G9H6TPt99k2I7;fdwwQ(nzjh*Ha9Dcg^5?C(ia|waOqCq5tyYjS2 zwDoxM&tCq=A3`7HjDoW9_Wy==@auYYBNR0|W0!NDFupflO8_Mr)m% zxb*aA$|?h|2+Ppz#^n8u;YVj|&sdguCGC~?240ar$K-FN{5mlj{GcF2F6S#ok%C_W zHzJVZgh=_|&UrE{^KPxnN<;{Onnz$>RAyDF(n{4rvekmKG)Tpo^h(rd8=S5cc3#hK zM}O+}b%l?gVA#WEalKdy;UC`GCa#xA-il?fWatD^ny_j6s|UV0wDTx&Pd-@%1$?TLabpx2NX3xrs>#o9Q>qB)7^I&}VBzoma|l=WJQTtGV^ zQc(+(LaC%tioKCz)pZziZ_a?AHP*pfOhWgXQ}$Q{uK6KiE9FT3p<8duTTrJs)abQR z9vbM5wP11xyISy-9MDVzfTWcWG^nKsz{|e-)@4;PPDlZPc^T|dl~%4EnyV3#t3@i& zV^nI9i!=i+XwTkl7QAWh_VX!E>s~;d%;z`q#e4xE0_TY)L^MdH4VdUPhE-wMlJdq8 z@h1%YHuMZT*n@UfJuFd;n$>}jY9(rQ8zK1SqyKe644mjTz7dX-nHCdg+m4?yg%NW! zrwHl{@#hm#FBCumbMsjZDRzb7pix#oxH`{e?@20o2{j&E_l8DDA2G->Tb{wKmBVcm z$wV^j=^OEeUCE<7sSaa1cYk9&NQPWEd4P80(0`uOQqd#|bH^1#YC}*@u zDOzasyP_EvcxcVnfejpw&nLvp{(~sX@b7QSLan_33CP?#)^19Sqc7LiJ=k=#??9Is zQJeNZXcU62;{)4)la8pM8Mp0ayP!^N5%cQ=e0bOO$My4Q3wzoAJaqi5u$Xm~4{M+E zQ5#pi2z*AJR9uIN>ZPJ4$VKWzXv|{af!(zLFK-K{bwhb&RlF9xB=Qcu6bYC+km z5M_m5gsg)=$wKp%NO}4}C5GgihQZ|;#ElLiYktiytrEO`Bz?ihngpU2xd^SzA!)|= z%~%T`O^t+Xq(Xvaim~~JOS?~Bs_(zI7v+Mgf1(b(7_1+Sb#Gl69)E%cWr03U$VX>T zbr}=-aYB@h`{}-)hx`ToA!vZDt!o4txrq7};w?N9&@$}A1XI_Tep41fiel+ZwwyTM z;5#p;koe?Fk0D;FZxQo^Xc4C-WY6GKWPDyDCKbrQ6-aq#B&kdQlE?*c%Xw&N0<1}j zWtTmi?!Tz7)x_~c%8sKMuldqiaib7x7Gw2IEic7_226@(Gc?FC2yJiH3RfITww*Ai z+b|z+aqy$eyb^#AGtUJUo(Yzoac~9fJt9F0wm(r{jSyBjPDn0JNCqMV?b3Fsoe({8 zIv}CK_y{3N?-MeN)sYaqrw^_q5CWb=0>Kg11dvG3awOHS#runHQ#YObp0v`)Z zHGRn^49Vy8{f-P~p5Y$7e7zA9qLrE6VlB6@rdyEIwMgYpg=l>f2#*^jGCn4#!J3|9 zqVsoN5SJwNnRi$-FiRD(jtIcJkU-7Qpk#CpLxl90f5|AUy8DcSj-i_urIlQj@@t?1 zlhr}pC=<&0^;mNqnu8*dqha~aB&hXy&!Z-{^@;kkR`m`((ubC=IzLr8C)RTDr3OdvT1%`t|n+ z3rN`VupX)=thQ17>TLsGAQ1|Md|op?S_0wGMhKEbjw(eFCT@|-p4Ur`oGu^jL^H8= z52mj#y!f<1EU6Q{6=H9sSdCCz13?9(ID8%kjs?8-iIS@mgCqL>GS%9HYCko;uWN)U zF~P)hA)u?+J^}omojVuwUm*ls%5M|${J9h=5eXkd-QEyr0UmM@4}u!V%9>i5>jk1l zs5qo(1?!UM4J*$V_%1tOAGE^6f1`QWK?A@21gC`qLbn~e(fk~(assa8wM_U7a)cJK z@TH)2ZWj0u1tCu{$=N%vz=!mncT^()2&u+>NFjlaHp=QkD(oIw+BKxSFTJ97z**C| z+x@p>=f03Zr1z|z*CLRL;Osa=dJG*cG7^Br4gD# z=u8N{Pn}{<(Ekb{Ah0l8@H`fcen(4zEHHClVC}WYXkxhGc!r&4#30{DOQ%qyUuIg3 znX+=%iAQgmd2;M^18Q!9O0K@X9wqR|`?d=2q=M*IBtdH}OPb`;JI@-HtvO*k(0kB` z*<1GJylz2}F%ZI&LylT2lGTgFLZA#n+m}MD@?}HlvJD2qCmD~PIb>Fxjc<&xN3@AY zyfJZsnFpL6S{&ZmJ>1rf11|2LB1D;8^tps+|284dq-abU_-7GZN|_i!ESwMsnOYhf z-ijo`7Mb*6ZQV<;9L)WWKz9D-Bhrpj4)d4vp0UD;aYARt*6veRGf&?rZANWh_5@QmMp+d*Nna4V>Jy@5#9>lAmKgd*FBLoKEVVxF)US#%{W?YO5SV` zw5w~-X`Rq?2(i%AT(EmZh@~K;ZSMY`CdAZuh^d)1E{i`P{Hw^NJhj8*l5%w44xZG0xBQC!e1@W+&#Aqs$uas0_8@LnVi@4zzY0;DOd( z#CvkZkc5C|sS`EBjlcfzEs6Q7k@a}5>9Kj`FX6pV1J#OZ8)dJBSY4B_hA$LAVk3YA zorkSCk^BvDj==~QM=z4SH`~yeVLx?=v3nfI6wVM$gp9Owgp4=5+db`c~Aj~!7QKDzP|nH`74PCAc4#z`{A>IO((7V zmpgDy8`Dnf&Dr6+vFP}7?1~&E22Gei2%JcH%>uqaifSwcA#bpj$C&)o-M22wQhNFw zSD&AOR_P9}R1l&>FVdh^Yf{l{do@xv(NUQcP3=@wTw$}zaZp8H?9feKjy!@ zC3txkYr2hzOEGN8xj`viKb#?)b8$|1=?gBFg#$LZny= z)DiM_LQvBYCKpPC%`LoozElW*yq1ce2>CBC=}Wl~FgSAU^_bWLCZYSg2OQFxy?f-E z!d(xsVhL*etwqy8p}OY_Ma_`$LygrWL9=t;V7!MIcJgkm^RhJLL;O?Ks70#W5&}C9 zqAW09b^1k+GNVwPp3{SpXB3=nG415{b5F!>zEXAztCyfYvA3A$Dc14?pRb$T{B~*e zwO=-z)u-<6LO#?tGFz9HtrC{6j@GY0jaRLNDDc47Mrt3Y_}3Ehb)qa{q?LD+g?G4x zSCpw|v&hVB@&}EXmd_{2TA6AwCiPT&cF>X7?LIwET8tP-McTCoiDF zYX(mumI%aPpW8@JBc!12@;_Q7EnoZ)EjiU|r ziUPZ_9y9+Nm%tI8vu%GKKf=W;e#5pa51%*V3-=4QH_X_U4=K2j%X0fZn5&%5+A{MY^cCeAb;JH>LsY+ILL zYhcnV!qzL!*fmno!iF~D!FP_g#=CJ8JvkkJ(eLYDOUO$xYScrkk>RnaSS$rdBofpw z^rE3@-GL+XV-{>pFDR_x=QqeMVb~Q6OL>jOCEp*;I$}6?ch5O{jpy(2+)#A-8JfcJ z0tgWa1yZPXB$xyZk!~YI{0bA@!wGR&cENDozAp1lbtR{CVI^xZ&#BVRYB18Z=%t#p zi-gdU9?@62P%^sC-ESSRV|efe>W0LU=dvdiJDCa$|jJ@l$n>>w-gA|OP82RM)pJaicqj;|5zA7_syt=|4jt*Tb%)&+z9GgQimUXSixH?{Ajhk z-`Xxd%XDV1*Yw}2OFyR0IIGM|QD&ex4N*a>CeZK=O;H|#@W2=OMh@in=Z6rO@Ro8l zMu~zDOU60VfL(f{Lp~m55eyx49N+6P{ObK7U?mn)VoWDTKrG&u7-8rU1%%*x?dGI#+;%F-eeV1*o<7SqY`SviUIU-s$U{wA zVz{X-LbSlF6yphzuXx@fTC#1=hzV}QSpgTaN>Q8*S-waLZU@}|i>8LRGSnQoC%O1X zUy|W>J`S$Iwr-&|?j$RBnw1;V(k z^-KG z0}k8^J?HG!^IU5_bGyyt)n4I;PFJASP3y%NPXxDs4{it&Lzx&2J;9_H8q0(75XlXx z?8uE*?u$>GOkdmGdyQG(PCLdfTawqlnEe16Dpj_v(YLjDRLV&)rV;u{Hs78Y(|zY3>gl`Q+V|ISA)8knD7ybf#ur0`CPcZ1 zxJ51&NknoHzA`Cr(#(UHR`?nd-;!fTu0Qu)e0*@gM(4P5emjb(CrW1QJU?df-fzNp zTZZk|pLJMo+Bp^XJ>94OI$`y}HP@>Ou)0c&S0Lpj*JIPS6!!GpsW;`MA+^#t>Sp(d zD=Lga0y7s01yo?@xB~$Xu&3vpM4Cz z_Zd1f+SZe0>W3F0WUgB%fJssxY~>L>)^4g}QNNd1oy^82m5pX)<_5D6Nb2L2U1 z3BFjbSPnh}ja!ppM@#R|U3KIK`daJxOAV&Qcb&ORYx+9vX&Vh^ZXPs$t9Rs~b;l~M zJZM366Zj1YJ_SwM42eGEGicuzv{0#}g%44d2nc~ZLOE7-6yx~lJWAL#O2g;!?(~tHE zE9*hItV6k~#ksD;tiaoIL5krdKnSQ3el<7{w1Wyg6W@#LD-iNtkKykV@>N=U;b3E8 zxUp9_5CVXiBGPa}@!;AzQMLQI+KrjRT6Hk9`U$WBRNQ~l^t7&}5p@8|-!?;Bg=Wpx zHPjcE7TvmY`@y4!_03HRJQ_t(xWSEbY;RK5s3~*20>X-}LJ*7b#LWU>lT-%LmaIuE zz4GwYvfU>~c!%`--rLkU$Z;xsI~QNi7o7&q0|>E!?;;IC4OvJY5teW%kp7MRA)iag z8wuoWiU<@4!Si&n81*&bt*Z}sSjOFkt%diw$4jQJJ2P(K!IANY$1gk{xHW6#`K#wE zUp}fwsaH%sIK_#klR5U}x@(Y!?gCV@=-woG=o`VMKs*_eF=MbEI? zeAHF{6q7!|uxny$clq=T@E-I`HBc)d@Oc+$`S^&4N>AdxkR#7$7&)i&|Z z<&^t|#`O8l({#L_!<6veP9*pV@LS--6h961pu5E*eL#pg+J598BjhVaS-Z-fyh2Na zi6khqmdG(MY=J~91W4Z0HP-ON4RX{)_)v~r=41IaSn@MT;uC)6OW~y!l$XB-FM)fX z+J@HxaXnvJ$CuX&v1WWJc#%j3w?r<0+6?V;BzcbUZ;FJw3#&p_9$ay>@Kzlf_S1w3 z-$-6Rle~Q@7hP|{avqD*9yFFWV%OxT(d;6Ir8Q%b>G!{nKW!3nsAtGIeM*)Nr9e5f zK#f_c8F_`kf(-i|A+7U3ko6a-;0{EMp58`Ci5j_5g@T5`|K)^yr6?;}K?s`m?Hy<3 zg~#_UEE`BazMJL}n6NLU@<|KY_xVi=uLWShWCFNx612=UJVZi%OLM&x&Hg|&A76m% zUWCbNcr9qOq6{m){a`93in3&VQb|REUBouxe;odI+5%dPxgq9J(ge(B-lf#_$4N;k&52(n`)ZsTKM3zd18#; zB5!WO8XK{uCJbUKv`vBtE!``Wq9F^?W=!x*-h3aE?kTJcSiF7ZfsAJ@__F0#eY5D{ zi>5ozT3)`Cpf366nEWXwyCcOa8nN>autlkFM#pC9cy2K!UFb#2)Cx;h4oT8r=W0e2 z;d5gk4^fOIK~WYy38Y*FGIGevY1ud)?+5`rlqr|~ON2m$jW)maj#DiQALT5D0M96Cpi&~nR>m+bv zC8D=2Xw#`0q402OrdKFu?a`#0Z|YhwIS*?R$!cWsIx@xd=>2o{pUhoJ4GQ8)iTOo%BXU6%tlvRs*4tj5h%N4q0rs4$C^ zn3YP5ODc?Nby~3&H4kpE7PUZ)Ri(tbtk@kvonD|#&()yi5lC4o>&Dg*-@i7zvU6Vf(~1Om1WgjgsD85Q>N z(eFTr-d{XF1cZ+FiUmCEeG=?FW9;C=Cz7ql`f=ACFMHGkLGWt`jKmT&$63N_<~7J< z5}|+xbrL?NL?mdc0l`1YqyoMG@(vleniuuJ19tWClgL$TXV7Dh<&>j&*ytWN@L@hK%IgX_(4OhP(zji60{O2YQ;jrJ44V|toD_y(E*C#jEdLsMXw9+7t54bRZ#n= zF-tY6*&zONzmzhoC4DgC`bY}J%>gzl| zF1g~~%{PtUKp=!_z?W}=>J6=&33;SqGaXdl;S2qs37^e!IT`{4=^zBebwbhW7GeIy z>jBJYQq0oZFB{8*0|wYPPDo^~VyDlJyR@O5KG9r@QYA{6GNlv+8+5dJEP;V0 zAriP(2vEhcOVw$aUC8Hvkb#jWH&)gHAD)0bEK#Go7U zGVGcVJNrZycDQsPWqaSb8+!&E>>7AVGdM|&lm-q#nE^sR0iq^Na*-CPT$6;7@>W7V zT_`YX?Q2JbpchL}$Lsrq7|-9`O2~(^aQ}ui7eS_OXb-f0-isVOVh4N1+l&seALSRh z`ta4~jW7A&<{_OB)QkB%xeUB~gHSA#OT`%4I8TNXf^L8e?g0<#HPlOmmJdMg;z_+= z=dtsib3(W7Kl!E^MPqfmI*A-j8i6;8D8AZkz1{P_A?n3Z0#Oy;>!6G=l@yy z`v{>SLR6?Aw165q9tdILTT;>t#^)Vc09N_(lWo zdc7F!u=51N5?^30E6;WHUeIIKW`m$(-NKR}gHj4hL%rsV?Dq*N(OJfK6#Z8S zvGIyFac0?i#0>ID7~mRd{N3Df@`9@T5QpTC)c^ z4&3|W!`&h2zz4abfEhALjK_x>46ARJ*R)^<&SZ`Am>0El%l*eSaGN2l5}-{%_##Pz zSSn}{N#U6F`%=GmB^!;HZ8M2s?Gd5yA)kBxpQSHs?fq0jSj7kidX+L-Ww4bHJpL|I z0SllOXfg}5sVO~3C%VtwIxPGMxoX%*@8gMub&YU~Fh1JJkSE7@ErJ@6T-Yp;Uw=@`TC~glr#VL7&9!kx zgV@1)*i26N&k*u^Q5Lw73Id}_nO=bi!JBK8s1SM;sSR;GuRcIT*GWpWlpo4cwi8vE$R!q+*FgB9n;G#-AWDzSBLFAYohC zF0{)Ve3k(1Oj3)I0@V*xIGXNp{Z&DQHw}|Qauz6;}69w5Ctu$QbQ{;NZ>}ite5UN zng$MJEYZK@(nH_~=n)E-li@SWM~2zCMp%LQdd1rM ze%@{epR2DKW&J)OsC%ReA}dJK(ToUuZ&)Q-zB;Q+iINKuiyq}d&(L>-JdmJ$KN?Y^ zhr)*-Ja9LF#=v2Lfz`v zk&2u1mh5A1ODlSY-4mdRyU*mj2NM33M*fkKN2DD^meeEN$Y=G)DZ12LHF6<=RIEfR zQ)ZPTvwn||e6+IG|283JPV_;OV{Dz6HsdMQKL@({ElnzV{8oti`{2ro(51!KWDvKA zL;{IKB$J{|)A6<}G@}p&04VfA$z?rXUMIkE%C6524Il7>GbMKQy%$aRcvZATC=kLI z)Hm{>qQV}$ZI1qR-*;{#_c!;Jd0~;-kzbAgX8qo3> z_zu#%W|6cJaC(jULvGAiv_Eun*3Qz}q(`!XI(h2L`V)6wuP?kmb6u9n?5)~<`@7Q9 zwJ6zypiDJ-g-+xRHO>_kF8n$~2n1Tnj7%Uzo%(-(5NmhNAm3=K2{hXYREr<{$4rYl zpZB0vvAU&1$P+gU(JF8FI!-thXf-EAOCsVz3{D=ZIy74pG7z!+=Chg&`;I&OFwSQ9 zm@UUrYS6F;@Iyi&uK^s1SjKM_@oI(A{3{PKJkM~%yg{CEj>I@~7c_pv(23dU z48N|vkdR&;ODrjA`gmtBfm28b&u%9~hgzjYMg1Y22m#Ykrsk}LR9Fj zgs4;gAwoV}bMdd)KZNT@F?ZzT@T7uAa9wNpG69-+BNk!JkV4>1SrUnq z4_8@&2F5j_o(;5~7@7#xfG_3$f+swYl{a?sObsK;u~X)rEv$k{5qyZarA5GR;t85s z@Y%N4pVlnfangR|Y{v=Y{w@)YuF+Obk!H?Z3-@r;ssF)AentItguLfN*dHeZL?Gp8 zamrLkS(>EOUi6eMbN2S*oQ=(RSx|#rZIpl~d4@M7fnMSZGStYidO6l0$9;=b-Yk{0 zh{aILw178|)+)r4)d}QvVtGAe`z^wkLdh$!?2T0ZS}c7j6h9a6p9or>OPgyjVH00m z(}?k&W7w(NFQ%?evY5S5o488fZyaJH&62oWm)4+7%~ z;Uk2!HfQ~d2>B~~2wD!yJJQjO+s}n%_T9V*GZT_ao&q5d4dbLTzC6}M`DcBSj6tt+NO5k&bx!4k-#x%6lv0y^*)P!uYQ+(OXOeV7$hJHE2~P zOv1;S8_|-C*wI@rJXa<6nz>bX&LO?fvpV#1YVXw8C;UDd3V_BPmMhb% zlmL%*LXc$xA*kO_K}hF5^-tG-g%ERR7G&y!JY(&hSSH{3Pn@;jY~KC1_=>uasSEKv zjUdAV4P3%)IU7Hgg({F;C)u>5kKTaT$xW|hx zKNF($j~kl=^(|=mcZeLWzix@ze606yPpk1^wv#w^uJLxR36{<=7S7>TZd^Oh*7Z^U zBK=K-puv0eYpz~FK@`bfBZ({x!cWY4}^s;u#5HB4L){Hf<2XDwK6o~umxXUx&<;t zxXyerubB^CUnb;<8tX)LZ{&?{FydG`(Ap!6X-FofzYg+d?dwSEe zx^oIO!*dC&bOJMvz^PJZKU85oz&mq_z=0^!E-DCtC`$>L$MX;+W+n*riYNvnQqc&j z_pJX@^yP&74Z9;KT6^t0qXu}zI=Y0L{4oD}PwwVpC9gzixceJEzgAE$#01EbNcoVh z3#E{5*P=CMFu@x^U9D6AM*oN>Ouc+7AYqmL1W$|6?%xpSn2mHFIS20YmA7~>{i;Ur zwgt7)+#W(e(es~=*c~qiM<$!J*lU=haBzdzpu;Oon2>dGnlij*PP9Ub2eKBY#%_{_Z|26xCIwn zmZi+xk{7tQIQ;DO6}iuLUurycPn_~pp7mT__)31U0lP0o8z9!=ftf-q(fJeH55Hxz1imt{#L&)C{Wq}|$Hk!n+BgXb4##oP~oBrT8adzyX6qIB`tq*Aj z549AEA@D_mAn+1i1fz%avFcIXssk6C{3FdrO*0=m$8tiTqdU#gDb(P{nS;F9%q?k& zm+D^dQP)c0%~#QzkBpxmZsjz$@96m!?p#yXSTonf=5EWZU6(@GW9Jg(;L5UfW&V#u zSvVoeOf>xa9U-(LG2oW)v5UaTs8G{YDe0QjbS-L{HtB+9 z;Au6#qg{hecL_KOrmQ!6PnVfHyU*HTFnd>zc{{b{ZO{qY+>^G;I_mJyC8tNNz2LGX z&1*+S=&90(v@2`M?(e$(;^@6M=bkiV)(A_Qu**E`h6uYR!ERvKB@Ekst9HWb>@IWm zX$B-}QgYQ;nFM+Yfs~{gmaZ98q!x&hZxvdRDy_Vg5Jt5svkGnA$xwt?Ku9`zj+Te} zUnc~PH**Q^=e@|*HLAaBl;Z@7G=^;H#B%hA8WpfEWcir`DOV0%sH7~~ zHpJb(pZol8rZX+wnfl|XCLW7S+?SiXF1K=9ZtK3l-YwG6m0|BfxA`l(ME*WP(1tr@ zXc#~x4dFl_0upH?0pyZV&Jwj}>krQsR3Hdof|yViX8eq&NSmM+28-4agPRMs=}lxFY+ z9a^q7Cr6E*rbJ3o3r*Dt%hx8As8i550LauK&{CyWsxT^5nUy#p`AQ5t%0dIQkYxiK z_|y)ZkWViG2F2)ioDe+zL@)l{==YCAS*`nr%$)ZJ@sIObFcXKSPL# zYow)T+`#F}%_fEq^o}1sIl*Ye%%QHKvsg>^Bxc`!)A)iXeAWnAhwLp6d-zsVeZS#c z!R`2sr`-MH`%Rc{HQL|anL5ZT($+0}$P5UXqRb|7zL~bv+=*-OL&y-{xRKMMi6KkB zpTaa7J=4-D5N${3Ot+h|*p#@?%zX*?5G(h^w(be`?#PGOxG?^sKIHxWkV5=^BjGmG zD)b7n4-meZ?Yl`7tq0@Bx4s31WN7_0)Qf@=Vp?vy)M@Fu>=Zrrd0o~y9p+gb#wl(3 zNge8O9m)~Su!CBm`_zMWs|W1R3fiR?wx>JwKwsLS!7=BCMW6mkemZJe;|5 z$NAWeC+EfP9UHLHY67X}cXJI#hS<7s`gz6Jd&by$L?LeBW8nf ztexrBE(|L-rj-W=E#c!CW$77%&b)PEE&5(~qmBFLZ3glu^w$yco)2NSna*D$@Jo8( zxm~zvUD&CBiY_x*n|VQpaY2ibq$oA1=hdm_G$`jZXy@UTu8c&TfCIXIdvyHw_aGfN zWM1gaO3@8FLzsI+o0@_Xg4n?8^7eq|GleYvb5){DLmeq?ga9`06B2gXf_@SwB=|Q8 z(FPwf+ONL{+uogRHHm@tlmYv5j(VRE6k_3oM3{RuSWc~FKs2Mw4QY%+$_dknSDSeltL*Ul@>!6yO0fag$lBE;M!90Va8 z$Q*!ii$u9Hm?<1a{A+s#e@p)xgg|7X!_C#au%ydm=nl>X%gOS>Wlcmee zg4eZJ>55l0X(`&&#BP++-NTOS1|QQ5JggaTTr2d99yPfuD-&`a@JMR!6Y^&u>1_R< zqW=sb@uv8axE%?xbB`G48R6hUw-_B{`qNy~A7@$oIMe#)nHD4G8IL9#Ph10pSkp#8O!=jUI>Q)Dj;~G@FWUCIzoatX%l>1tC`}2bUcl}O@C8s?_W&_y+D;7ygm1(HC3`!MBCY0**9E1=9>^>V_Q6Z_w%L@HjLOx6X5kk->pna!W)sYZO7p}Dn2W02Uac~cJbYlZBmJ{h#uHis} zy?4B$?*b4!0VE)rYR97;5{25otGyyuK+^vD->Lr=-6 zA`MnCl<0MOfexowiaQo{ zt3+8K^a*HHTqO8Fg}}tYEkK$9c5mw$>);jZ=p6?oWaI#YBE*6N22NWtVCrIk1bjtD zJUXh=*Zs5l--xn6D$FvFDx-6WY>rWiCZ#aT)R^U}ta2z-m?dcb7B!DR$|Hnj5kj&F zq-^-J9f?l*Hxr`BLvXe3j_{Wg(oRJup%vF%B8{9POxHNQ*8$`p zSL1=UaRWjWo}^vyukBLAR0@6Y)ql7CM+gB+qLdJ*r5{Qe&5tkZBxH`1Vgjo|gc-1Jsd_e;kr8C!~D_l~P0rAu6w(koWpS{suyjg_VDX7?rp> zy^h1v+UfC*6L|jFgnX8MhY&a`TB$0%P?Ma|jdaF}dD<*+XO}VW`a|A}vXqP*bsR@_ zB&4-JI6o+I(^+gtG|wrzuSlW8A7Vt zIKkEWPY4p^YTE1-%D)y5g>W9eJ|TaF4^h~6J09pW|34xBdO|t|QGY0$1VEyV5cIsA zkXA_AIZ>3IzwwU+Kl#)3WrUd8{;h}}g>;6goj}U^I zvlOAxrwKvQ5sZ#_DAYy>63S$dv3~HSzpIV_{Gq-IAy#PJ-oL)J7lb~iqdK<#ekeFV z(Tv+koxo_<2VeJ3>dRYu|22fXOB?=BD6eSsBnlYN6MP4ck4dq`^S_snVTcd}$v;QP z@2e9Sf2a?>?w{2E1|bL!)aaz>lRAO%PVar!Kdk?aC`$=9eMLw3CzVKGh-ed9FiJ()k&`ws6spF{KS4pm#0JUK@^2ypeL`E}@je)BRCq+#xuKC-3jG!&?ZZqusngf}v-(0p z^odI>X&L&AN>y5gI;T`UJWqv{s>)2)U=*s+D^%%dhaCd56d*x?O=}u}2RW?*J7`zO z*YR)&uk1U${(;bY;V`f&HEID`9Re6Y!UwM7!u^Iq@VxDx5G3eb?VJE1I3ynnx6oEn z9SCX9XK*QuyH#i;zv4)o5VXhx5}I6v)H=#bp?Ak1NYKYBesvom3dhockg#)B%(FNl z`23L8-4Q+@#B7Y8BM}i|>BIm$Y$1qpi9l^cXb%mv)um#inO5N&Yk(BP$iZ+GW`XQp zQ7T@6vhA4PBBT`$d=z6xfj?0k&`F)ZP{;xif<6=1J4;0;*~FG`6P`=SQ3N)_ynT!ebE z$+^nZd^8vYSi*;az@G$C4k0WT{#AusKnTuK4$D?0<2!QD3X#!J3kj40)E7=EAW(7% z)I23xz7j1@iIS^K%2f(3R412fGs-lXKvx!loJyc(DABXv00J$aKr2KgJ&ypd(9>|i zKjpx`B8#LKtI$hT85JswN@aQl2=$XNN?Q$`4sQe%BGHPGsHIByW)BJxsJOtCnYdUL z1a_H9c&QSnfWXW~^WAAF1X?N@Himv|i7E|kqJnpEqWMw;Rt~ych?dq^5$JtK2-;z% ztn(gJqrx=Jzw2q%uaBu?=R8EO|7gpJ^X)vC{k@}YiIL_m9CJ6Wg*(^Wjb-XVGjk_d zdC}~BIrctWYj=*VYeYZKSaWBVy-yTcN_`^3)+5HzXOXpQoVjzf*~CaY&xQTG7l8p; zICE@>k^OvQ9DU>LycYl)Hr|V@JQo-_hg*8aIruIxb>>2VWaky*;1g%=#0D(;`ND^= z;2i9TvG&9Skd0fcg;OL5VtPBz1duH;-o`WDnivN>K*nO>7L6+w?IT4@fKRscL|K!m z8`s#CW#JwUKg1H>?io%AH4TGfBr5g~iR>taaoc*v_M5!WWFptWdm-32JQ+S~HT*z3 zV)USC3oTu^{e2S#PFdJzEX8aR3ugwe0u)sS{t38u{Y^qlJ<&4wwr-sMZnQy@0u2X^ z)9P#6iIA?o%Z(U0U8vP+!Bu*s(jJsN9a5quJ(0l4CPbDHqAwAmuB(S%*5+IygqDJo z$fW>@8oK30P%kP|^T24pAdr=#=S71=$Wkx9oMTV^&Ae+F*ATYArGd1XC>eLFfwI`(lVFnnm@|4(kpv6G0 zdJYv#c3PNEr4pdnjvi?Vf(vv!TKaf>&dz_oA=2TSTdIbLy$Eiv5QC&AP?!e}A~ z@Gx_UwDXR4oV*Z{TCiH=1YEgB6X@_c4qmZ#o>5?q;K8h1qTvIfG@ld!vT#9Df&mW@ zzPU3JpaQb>O0f1=VCA_G@U!xY$0trj;^)r+JlX{`B1k;oU5cRbBZQbtVmrX8P6`JU z;oJL;W&ovTlQ?GMQAeuT1iFtg?`&U6ML@&m-vqAwI)V>6A4iW`T4TpDW(k`lzDwIRf zdZ(J4Je|lqt%y7|b`F6G3?MI|7}}`9%u!~f6X+L|SPG>8Fv_efWoC{FD_@0$??1@O zgL<97%tQ+Uu~G=EBmyfHO_Nl(2nKR8AQf5_K4-leO5E)z1jm#?RHnwQg0NGKQwWr* zvCs&7G(M71qCu%pr(9H_Tv8%mRHC5W>JW`g#T?A9M2N)%e>)F`f)F(0!Y$I=Bf`vs zY2(AN@uArIkZirk{d`yheIf=x6yd~yIKgZJ6`%SSW#!Dac0qFhLH)hr%qKDwlgQy; zt(=*5?%YAs626&+h8{uot>FT1`5T0o5Ye(P zaAhFMQV^nJWd9){#*8dIu$7PsJyJ0ugp#UFOGRNrcrk%nN#K-2P6CO$7VC;K?J^;( zl0Ys~WmaiLT-1)N)(kI4;Wz|8v|L>ID$F8vPPrDhQZKSfFT7lnT>>rww;OO5g}65; zQf3!}&}O12e9u>6ffbf%F{;7%AUso{WFm{?W@?3JX@qC1F>?V7@K^A5RYo2V0{^PY zPE%&5DzlSO`5qw<^8g<0grv0+!b~G@iV2)bh#QqyRm!X?_z7x^cY^RtrIiqb2LZv1 zI7bYV(g>s!Wm2jNDNB`9phd1wCtXq_T~#4pMH_rlt5I`vTSWIK2r=qA*vQDr*x1_G z#6m&HC?Levo&F&q=I&HmABux7#g0g_b)z`CF$WMM0TO$+2q47KGjhnZcxxAi>4Z>Q zcLsPNOJ|Cs7pK2ZxScy21YsMF5EBq`^o(}&i3QnvMMEfMI*DNiPh7xo!>!ySP@n~1 zxN-+fT?mnzl`9Yup$KnqNFu;$A;^IejsbqmoY_#qd(kmoaaL||DA00^LNg8BAgl_v z@rtnZjH&p~h8bfgtEFBv2v3fhx8@ zom~i};<-*_Mfdp2dQs&%5v5w(VhwhoI;%i&j0UF&o@j&@Ye$uV)FVq&!;3(g5oH?8 z3T+6_*dQb(H0_9Ny@*0BZXtwTkm{(@^VC^6Xf|SGo+>L_g`EvSmjVp% z9%z*b+()4&Ovn%vxwRt7${}#e37o1nLeMe}YPjIHKnZ_BgoZm1uyvHOL$aa8EYahX zbc-zR5mDHMor|_LCFi3(+`$}t*8 z>oqFWd;-%JPQ!@dTB78G7_G<**VRG9si4C0(1A4z^BUp@te2YPxRdS)GtXmEc@eQiV42q8{h6 z4!c4P^5&2w@H}l!wmL*UVTpu*Qw0ALgn-k8kn<|!lvYuaL8{agRa&YVJ&h22 zmOx5Url%@F`b$nEgr0{#At{F}AEGi1MlKviAe|zF9aE;9)L3Bn%xA(Kw^x8 zdt~2{fu`eve+gJHfwFYS47#m{zv;vo4qm~(1jczqZ1#!VJvLV@HK<1eXFx^q;m6Y}an`0y9?**feA>HXac+9$b5m zNCCAyO2P=$Y@p_LV&E-ZTtx|#f~ncLhJzhL-hzt@%)nc0y&%;FNFd<}2LUkfyTDT+ zNPrM$F8sO<@f8Zm(Bcp1>mq=VpM%zon716FNAP|Y5c|1s9DHI&hHmONIRTEh_l*Ot zY<%LayiiPK-nvdjys0NHeE5vD+rr<9vJ`|2^k58e2{9cysf%g9j}XF4*M-zMtXP{; z*p-&2&&=t{%tlj@Sdjigs-2`4bVzspL5;vvEpky;W?5HOu?{U;lai`QN!F$(_m0i& z%1u@ypHvP#rb;@YPC2C-c8U;mOp|g}i+T>%8Ex`uEz&7X(s7VR*f9+* z=~uzCsZo)@UfZQkzM@9Dj6}YqNq4%(v4$kahQxeR^1P`AUvE)S2 z=FH1eZ{eelW)R^!OixZAcSU)gm2(v0w}BYe4* zW9OTW@*g%edf~C^bq>Bp3q#N|51 zBo2ta(3_mxla|wyp4~MpNhkPJSJD~d$W;3!1y&2vdvi{9qaNzRJ=K3@-VfU@{~C=t@6rz`W3hli4RCw@*ZNFK$K;)&*U9nl__Ci+&BH zNxP~+y#n?M^|}W6GL%}R%UYx>T49$I(hNmy04nrSv|uC?g@US#9Cb#P23;ZWQCS*L zDKK&&8iY_#on5TWF6hQcGmpy|vc7uc-kYQLTpzNo#4IMg8}*z{Sc)zwSDRd_O{vtN zp?)NAQv@m`Azv>K0YWU@$WYz35rWUMzbB7b^C6H$@mbU1t78WjDQpfwUyx$P9WWSj}ROWP>-MH{}`|``9603j(i+x ztv3vNjDW(Gu0r?5>OgJxW&Zs4`7@Az|M6zOlu#Qg{n4$|7>>9K(~l%{yRDKW`Xz zym!cfA&WA7j@(`Q6bs6DqaU;hOE8+Vl*BV3@snc`R=_!QZgSM*+f-0n5 zNly(UPih72(w@K9GCE_**(OQ}HfrbHuB2nC{)Yf&rNC^${7g+!A(U!C*#?}8Dgl`) z0oi)w!Y<^JuH+KJ%w#qHEaS*)D*ow&pk!5A24UWbuH4){vBlcd3*9-H1aJ|4N7YE@ zwCJholoT~;8i1fuEqvP@(Fn74EQ2&LExhxR726-ZxEtkHUbDSG#~grA${$E5aV&P?7SG( zM7EhTOVQf^*@z7>(uTj16&cp@Az{a;)g47%O@s z4p_eF$9bVAF5OOj@Y=WxdW|U)^tf%qN6K9x6R^7Yp8)rawBM?*y{7XQVkAoEBl|#MU26xA07`pSrA% zbCjWLjHS>$$VQc~fRc z(mmI0MZ{fY8y;Zm?_pzBob5U_$|_`~|FMdrb=cO&nAgr6ttnA`LsruZYu3NSrX;@5 zg+MDfQ7QDKa>&8&cU31m!9q)#`Yk!HG;O)+v^Cb8vw;~cD;{9e&%QQc9n%Tir5koa zE%+p1=03vg{VINkftjw9v%T0UJ*ekZ=N%;YZ0SxqZ^%gN5_sBxl%ySSQZwYVX+mL7 zPI|BKl-`_V1IAgSh-AX-o!X&CG((SRky*H=(50l3P$L-F)b*TZZ0e&#+?j-*N;~!>rAL8v4 zy8Kwhi>d}J_bH#V{ph#T1LF>yxhlY-cArzV`?>32*IpwgYxi@tA0NQ}^~jl`dnXF+ z7T#+)oO|0fXhHWuF5~>;4;4Q@RQhU4)Gp((^DUjpRxVTK)g;{#Z%VuCOxtKQI?!lL2;Nm6X*P*t4T0Q5MxU`{gOMS9#)Uz`^Ud`5 z{*$92B5Kc!SZo>iE9Lz4Q%zWs2%B@TVA8KA*IsWq-Hc7% zk=ezItv@C5$Am+UjIBQ`IJ)kpBzrNC#aY{dQujZUhYBSgMTaYq-=jBn`FWN22(hWUAn73Cg_ylBD+O%{4 zX5fVHD04- zzY9<|KR#m~5rX6ek2Nv z-(mjCbREYD3-)K^Jr-ZMUUUA+%Y_G1?44%1lH-q8JSclDkJ**<(@eJcsA>8`+y}S> zL~lHKIP>a)9p|>3DY^6p+n!u)_M`VNGdbrk)f_B%G%a#lukWWgx>G>?iHxPEFP^^6 zUz2(xX!V(8XR0adlicX*wxr!VTJd(lf#TWGyVsn$T=^PXeyIFgBGW%+fB7@);#(|s zXD%q|N=x2DY<=Pt&bG9jxsS3QV+)Q}4)lrWHe$A;XY{b?Xd%-+qsjWegy{bgZ178< z;W!cmV1s8Qd^081&Vy;~Oc@up>R?4p@_i|N(}f9P%f^K)A#yiv%({E(Ha~dXIim@I zJxBSOxsvUDxDb>AVD`ST=5E}c<7nm{F-A_2y~lIjhb;Pf8z_uhG(Kx_nMbo zub+3ieCCnj@WNNiZ(wm%a^HPdt!ewZ&Ro$i@{s@e`wOpOOYUH-N~z1?yC%`eI-$q) zXo;HSM8cdsgBK^#av!gI0!(HRT;>uy=KCHm-Y3SqPTe!)o>!WC5D4iJQLM=nNd6PA6GPCr>@j*&APQd<;sTC zt69&nw5QS;3-)yV&ZpPNSq@%|0lwiTlfulLsHkPxC)U;*E!Se<7H#etWlKa&y?=W2 zd*7)m4H@SkKUQJo0wH>=f*y=w?cf}(kX%jwBpXgjbl%(SM(pgPnxoI8jKs@*r-%2Q z&S74-xaYBC$9>-ZXVOK*4|@1e9K)7wxYh*BB;-9Cop8u%{tEpmv1(4VNh?n6x`!>y zy+0vt`@C)Eci*Vpdg~EBY~y2D;Mof2HK)BdrT85zS$CDc^AYB;IoXcBYWmTfZErC~$z7Ly=ZOarH@;}u z@|rhx!)|*{d~Es66bxH+{aMiI-0csVFNm;hcX^a^)pPcio~*?Vyuf~pJ8T{ND?8)i z>YL)Z$1i&AEs41#U33R?KYG6p_Z$RoDuKrdz8f54jxE02yr%|p+HzWb3TedhJ<*qH zmOa2mZ7uCVI;uSPa1Ul~H%_T4HBX6>r_3l+W#KIW9SA|A2bg7_Oo-jb2|>Ni9%#oV zTaOqBdj@z>f1JhHopt$K2t~-%$GQ!*8&wnNhTYIAC$fOU3rRlgZAf(#}KYP!(z%>~wlOF9YZ#huKi#k*_CSg2+rmxo?rtEzZmXKoB& z>@=9R;Fkr*w%(F#yxicoJ3aht#pddljN=8XN*`^x*5JPGwAa@3?Juy9l>1sUSF6lD ztQK^>E9JE6+zsEazOb_vJ0rqYUwOT_ojFW3LT-efZ?es%Hd zvv08(o0HvF9^La$vg4l6cYE6K_`L}ic?ShpXnu=XWTKk?KK0;Z+Cc~VM;={N-MHs9 zHuGrixV1+TF2CCH3Y&M~j#b2Q&AEHj{Z8n!igY0n56M#^7pbu;@T>!EpAAu#3N0TE z6=Rm*yHS5OAwRbg;>l7BEcw=(a& z+>ufK<8*4k!aa$X8W!#;9^%e6{lTxtKyNk6aXJp;{Sr18J#RTycFl(#Hz#Us-rc6n zXG@HRyY?C4wBtf$@}-xDa&8>SyOmh=%!{?cIVmr(I9H-Z(FQm#)La?){w|$NELAKX)wm5fBm_y(_)Ce#x$!?>uRvriJfF zx|(^jWp3>D-rssp2wrrs=-JWA8dusz1tEr`N&S5njw5fIyCR9SIhV9K+c)mWcXO85 zx-+a?D7GF{J9n}RW6ja3SBEQJj169(IdHtzfbr(zrZYC5%y`U?-JfbcVV3@PUfsX- zG#WK)==2Dau|Yk5o@Y9qWHOQ3_1k&+KLuO4hFdsA+PQvw)X8TOlC2=57pGD$te|UX zk;d%PHuN*gir=2Q|0;OXR_e*@C6&+pkL8mSE0IC+jb_M5SI|p8s%R=1tedduMG=URCjio_w92 z@!;3H*u>2_1m9)4!RNF?leqpv{pnk;)f|6? zP1$<#=lHc7@7Bi^zi?n|GVx!k=ffHrzGcP5nuNlKzFW>M$iIK42AjJhqo*6qbLpvr zx3JZDbwh*J44Suyd%Wb>JyFcrity9Lr(VkT+->HhUSX!+*l-`)^bD;3nRRR;u%Q)v zv|H$5TgCxS_Oo*WY<~^5>{<;3Y$2&P9ik3&^WUa2V~2KNVt0CpT5tiuAAE1QDzl0} z#=Qq>=S96Mc-Knl7ZGCR$uMhb?8;qJUBB^i-S!(z+{CJH8LPf!u32989CDcLPqB!C zSB~sm27z0%3`OQ@F|3w_O+bu1PZTjq+KUwBxdDN#>hD z^H=wuoxnX>di1t{c_^2>H)H>u=4FKsCT~9Hvn_Shic|fg4qC7dn{vKV3YHxnl92ycAd93`$qbGQS707clLVv)(f*1?D1f%-JAF5 zWL3?={dsPoD;Dm}EqjVB+g~toPC~@G#Jt;*t>>=}oD}kd5Bpf*ld>0B@X~|5zncP4 zR_a|z(k-zIeUtH+Amg#5-oJzlnw((n%rY8JHl9E-8Apcr3NjENWS~#DqbEcEhiPL% zmO%!RdS5&veuv4JS-pPrwRH(td@L{jg?#pc?beh00N4E`|F6CC4r}Ym^S&sOPzMP~ zpk62v0*t`ej!Rqt(?svpGz03os&w1n8aqyLoVX@&oH(`vHeh=1xQv}iHpwQF*-dt4 zb~BTCXJ@DEJ5~F;lEY2}nIzAf=Y8gnoagiWIQQt@bI*~^_nzOm+;i@y`Hr)p$qmmA zeDKovC)xIk>Bza)mVa}y_eU_)5ht0$(>g-a(f2X9A8Hh3wFt7>P*g4dtB}+>p)!HC zN+FDbqg+cr0px+q`dO#Z1*CNY6l4^}?wGQxyr#jUA3Cr8%$afW)hP4veQ(XZ`CI4h zzc}~zE{7P7q@1~V>F3Ua4}P-Y;JFC%$#CREV7UXAtqIj1Kd|&O5Wwz3Zv+)I?K$*X z*UY~R{MPx#PybwdWr&hm`GoD%;kl1T|Acx?6_;lsG*1UtJx$qnnPuuD?|+$C^?b^u zyU+f_X)i=cq>5DORVehsd_#9@Yw#v|8D(}bLT5>`&6I7 z6rJ#?IqO?{f!8t=efmM@u|U2o(atZtdqIKnp$2iIKn1BHk;F@1J|l{*zS)FU|h=)rEiEtLYT)Dc-%m{pHzD4qTnzS$$ZrtFEx= z6f?O`_t?9e+})A z7?rcV>gcU^{_xhL-`{@c5B=}``MEnECG0=R+*qbEywLsV_a}Sajmj{GC+kkU_2}B& zUu9X&Lcunbc3fTlW$Ts26vG*LhFP4X3rj;HGHtF`2wB535cFU5U^5U|rdgh4fsuOf z&YGPKPhFV#*{e&RKUsS?a7!u3Mv~lE|J1FQ=l-Lh`Eq!w{#5UK*B||^u=y2bLCb}i z&wzr~*NWTU9Qerj;`qNu=d^NnY0(+Q>22YF>ovTgX@^46yQHc^!gSXhuXH3bL$6G& z0fo@Hs}*t>6hbslc_Xt#>of@&BO?O=_EB>43`W}vzjy2V&htM-Z{zazA1Qfb@#W8* zpo+{3V?i~YDK89M`IXZ;^XaZr-Ri;jyWakF>9wW3&-Yi{xOeJ;9s0?eC{l~xFD`O&8m8yXT8I;j`-HR;gK;Z`%5Qs?+;?zHA?w&jOrI7EH@o9zq|G;XYs3dBMi^iz4hSoe>mIkewK4-yzt7* z@qha5$q)Z;_N57-?qt`yzq|BHXV&FeOonOC^MhA^=WMzED^BfG(z??p@BjC!pEy+~ z2R1n_ch3Lf!l%xLz7Mw@@6UVVz2aN{w&9t(bi*xd-3?4l52o^UQRk%PL+3NUcP8HW zH%!$CSGedPO^XD|ILCWLPhUBqNZ+hSHAg=JVU@j_?!f#Csb=$qgZ?njHhN&P3-oLGKrp=YV{k*w+=A?SPH~l}ENU zDyK=21J$&IWSBx!X15K^M8Yzy;n|k(ESpqi+^u~s$#jOBpbpwy7gO8;JI59s%x`@i z>IhyL)G^!fYJ72LRBmgk;asZe{Q9Cp@ugjbt#3daN)?gS65^VW2nvy<9*9WklBFC8 zPdyfrc0`=k?pBB*Lm!j2wnA9>ojh|N8JY4i&4P#+xL^mrW=%!r=B=6)N=Pv1y|n-FQh)(&e|iK6ct3{zcJwi&*`1pypiC<%b9U*=c>?j5|I>slGr{ z-()nQOH*U&dN7)vxXT~cJaDG<{U3&{&u>4Bo3C?iBiT28X}s&)arQx==2BSO&62)P ztZ)C-^x)5yN6z*Sor$kJBGsN{8eiQv{-2h2oKKv+i^)48KQ?B4&zV2)8L{pxCcmqG z^xuzv?0n*>eoVS0#BoWt@bjmC;k3Q)bbRD2p89pj$vJ|h&%a}a(!PMv+-9~6mW=++ z^h4*?3m@R>u6XZzh17W6xB5!_^Y68MCSPFitW*#G2mrF+B7$JS1pm=?w#7Lm$8T5^0A9FWI<;LVN{L6xkLS zY)I0~@=Wy6J?KM1(jD%(xS^?b^pW+fCh$o(yXr)#>QI$VkgR5G-siu$Mwn=fE<6am zP2iLDaN%56bO?REFwM%_trP4ug{9jeJz!IHSf)KJ-5k7Uzc5KHNjISP#|oRFnUXga zli~^@3z}jITiCm5Sx;7R66$$->iJ39z%4cWB%>(F#M;paxrL#gi4Af?pC(MViT5I$ zJvy+E4mMy*HDfcJ#TuE@!rWdWNQat2I$T^7dF?9-feu8L+7+I9BsBGyH2sJ${eU>L4NfZ0e5??Ep6631 z?7U7P(nmE-;EdB0^EAacM$q+xqlL9hV{{`vx`D8xi`!1k$}MluD$en=-7?2Wh-HAa z{~Dv_s?>aEn!i&L-x_T zcR0c#f*M&b0J|9vJJ6LJ+zN56mnB01g%J3%fUu3i-PO=g!n4tfpX&i~*UQjUZLT}N?XHET z+rqLPuJ(jLOX4JILoytS{0=z8HTA+O%V~`&JSa#;{I}FHo~#$8T6jrDh=7eOH~=k@ zo1}yG7hQY+P83<#9#?S~njj>O&&L<+*LJkHobsP)J&PSZYUjN@rNg;gHnBlC;Bag^0ng%hE@u)$n4IXuK#7 zg>Z5^#il-g;{@I?O+`?J(2xl-GJ&(YCbDYA3Hm{{@vXr6*Eq(3fQH-niZ=j;x{r&D zGPQRI``)C~z7=E`f{&tX&24YPB&}(QXrIMs?qGCx&?n^e{bc(T z);x+n@!oJ7v%ePxxLCuKpAB99+1vgI-}cDIK94aBVRY!UC#-eG*D{YaFJMiJUb<;t z{Up&kNw5xkX}d8EZ(-_hVl}sYwYM?#JviMRie=0XaXnpM*X^YpptUW~+ZNGh@*DaC zJC=A|3qG3HF*O(c9k+rH4f>g0$JD)uX}E}~d&%2)jnpzg>6pZ|PGTHW82dEVF+(v8 z!Ds|i_6n(?hiw^WBIEwr5t?S0RDTCwbK9@(7P0;ow)#y>#T9(rb-M93)p*^j_9cJg zHR++rVEYK6@iw+$5Zf?`*Dv9;%Vga=t#O#u&?7V42&sNCVCVj|6++>L1ct2_?LptI z9F~JF-Qa$5(f#f}c`oW02vb`^v(Ob7_{nhTZH_MKf|djgC@iOilVkwGb6X<{IwTo( zNZ}=$pjE-AAz4lC-N1^{ZIMNXV#OW zyiwV^rWv9Q-8Es$E>zhC88!jzrm}*CxELy)w?0B=Y-=a|8oFuf?jY-gzhQ*f*iUHa zqv?kk$T(Ru;I;1twzemv^9K<3t?6c3CcUd}Vv4SK*Yy(2bM9N81pBg|Z2@{DOydB? zFy?KVAT})!9P=36I7UB3blfF6?qPJZSn~rPWEq{6j!b$XBj~%HO~Vj}eF(PuepV<6 z42>rJtg}SN6y7}SXBhUb@AZQorlAj0aUE36YF)zA+(MtKs_Vr->oh>eIO(H97e>Kb zW-#@={>`)euKV=nNle2HO!ZZ~zMI}OOfdENXu5q2eK7Q*wJ#HzmT-<`TH6D>c8G2s zry0k5YH#88_p@vZZ2K}+X;=!`?MLutQMOtat636iY9r>H-<*W;YMR zCP_QQZn^JWKaSVk#cGyF+BvsE!c8}&wJ&|8Li{;WW@xM^p-Pl#hjxJ8olJKKRq!hw z5UD!2$*q#i&X8=l__gy=&=(j0yi{~*9zWe8P+6rp&2S(m#l%Z9!{M^R4oP+sB#N`p z9YW#Co!=ImY~-d`BTJ4*v)dpNn%luovorS?!txHt3p<6XCP`K+B*J+i9li5|zB$AW zZ5@<={<}J>8GYh7)xzIvf+nskJsewh1X4gn=o%5(EkV1rVOcFwl>=HoAWF4@Jivx# zqRT|MdqqfxeIC#Fh1_5alK~=mj4;!IPFv4z=BsSd+*WkqJm@!aS|Gwrvp@u@pxk#1 zYRcHHb_<5Ss}ZUX@pTnPAi_@4LuDbtO4LE3YZ5%V=n0I}WvPb%*I@ksjMU*97H2?j zi7F&`eKJYlsgR)D!(vmvKeQpkEc#%taT2b4zWQm5@gBzVj+X;{0klu!Fv&0kgA??1 zwN}&;O#L|hZLIDVSctPbp#5DZB6s+Qml!P*{*F-}buY~^kJC?K>IQvvV*$;}Fv#)I z4&#mEzPb^zb%tu6BUxbNGfRVJXIa4NCP~IwtY*}!z7P5YBGOMXqc8Zx>j%KaqFEM+ zhB=>xQKE4Qlz=y&um8l?_XOLfgB`OVPS>=JL4tY!Uw?<98^x;!ag9UXb^Ts-{S?y- z%{=G5f0$}oqFe8i^>dhN*ljq-wis-kBh?S^9E-$;VNB5tOyN!Mno*K|5j-N_hH0#N zJh1t0VAFj#FQ#^wY+9t5@8i_7*v1*us;9i`$NY3tu!BG7zrGi19>y4YamauV^nP_c zP*i%;Ll~W-i$!Q%>&U3b84bN5rdy)AbF|&)YCvvI!9pE*A`vh@$4qTosp&2&V2Q2tqf+Qp&r#&+7fH(!6At*_;$+FNH zylxAuyuJqpSD+RsKeYZ8-0}b=u=g5+QxHfAE9i(Q=?pJC0P&z?v7p z8h|Q8O(Tjs6eR~j^Wchrx^3(vEi*wagdQo&f!@_sp+k{~)Q*VM1Frv&pjAU>-DDVK zS=z5s2s`(<&@=!FA?Q(s&Tyi%Ak92OHjVi-_R!2j zq=wr<5Mk9@n8GVO`+SgP#;3BIVVIz3M+glA{`yHeGUL|(-p(k^Fzu(FqUi3Ewf9My zdsOW*RlP)Qn4#27QEDf!Wdm&elED5bP`gNLoDVeqfN6T0q+Oy|m%Y(9_)OxE1%mY+ z*0}7WU&b2mf%R{B&qu$AX_z3|?t|}#sT&IDc<5!D#KaIT4<*& zJiCj(x0#y=SMh^V)d6mjU7~7NmK{eYe`i}InPzYpAQF~q56yue9+75Q-06^&qNr7* zGI925!g89xeG1xRgw7!>yFEC;1m2n~7X~D#vkob|y%yFkJ$#C;v4AdtWrubzNj8Z0 z>S2hF-kDWdBC_nt!uH6VCjK5Z01-vDgSWd;kf4bvXbVk)9aWd7)l@eze z0U!dKUj+;~@Wx3v3c4l_(8Ylavwp_8FK}(@paoA-b)!_>5LMq#G2EuWpxM|*G7Nw! zXyyePvP?BEQ7!0vajJEkW*LVefxl*$t{r3O#_4*L0Nn&lH$jB1rePF>fzmLJZ*pFC z5pj{xB+s(QvrQ2>aOFl6xn?(TxGc-K2AN1iRuj6C!z!Q+t%XgVfhaPJtBFt<*1{B( zX^qOXuSTJ=u14N8pbDOq`n!Z@qyJ!u%&wnC)bt=SZEMe}bp&p)?NS>jwk%LqWPh@B}E}qG;wY`Ue=}+up_p zewrC@TKu%5c-PDPSAb0bryW|05nnC3oZMqH(<=~7%S6*630WeW!M|D}nHP!30@*Z2 z)J~DLV`SYhS$BtM=ta@@5%j}&%@|HI1&)ocW)>pgv-#@K*-p?=kQ;_6jU&{?ad2Q< zOuC*1m?WvE2^tsb87Mq}*Ub54PDAh@o4oy}{LV2k6G& z7bPKgsmOewZiJ~G2+~cnbn|TeLXcq*fCy}U6@i9%IFMup7EzET$jXgZ!;E+1w2ykm zM?K}EnFPGmV?GVzG-SyiSwedZ%OrFWRNE-@6;#U%j6nPhi+=ihc;hle@TNIDGC_on zPB%%@O@RmHZlTE|821B*T&$f^h*|Ma4Q#w9Lcchl(I< z$4S;Ps(CB`8Dk*e=FOosGA>c{3sAy9!#GFZE3@^A>n~6e8i}EszEH?|fgnQ22a$wf z*dg)3@+V}wa^wlck$cOdlJ_YR_sRDFRr1|65qoO?mxO8;RS^l5;k!%R$o7=FktdV^ zilmA)k?pQ@vCqRQ5^EHR)vN8}Ja>CqMM8N*V)vO!3SUK~^_YFh~fp%m!Itv@p*?X4&RB*X9iRk#&M?8E2U%n5HQd zWSof%GtC14!#u<=kFu<@EXyLxvg~4>Wu0N!AkQ(jX_R9c3q~e6<|#M9kf9kIMQHSs zE~de6bQ6F~FzjOt$1u}A%(4#$TZcK;L7w#v-*QK2?g#kRUVvx2<%VzV7Fkdv=3653 zEeV2-A0)^f5pqYMzs=L%7U*yB4BY~KH_vcWV7SgTUT2$oSe71+rCVU`k(hd>V_Gy4S=J7mBcTD zW{4u+`AsbpK!IlKVIen01e&LZWhr(r6+2d2did6W@U5$DAmqOmblJ8wan<6R0_E{n zYz5Z3N0Y57q><+J>& z!8vy68D{x&%Py_}i=66n!BuD3Rp)8N=P4x@ zDJ3saO3%zYE2xEd`8j&USw{I8M#&jw$qTH~7ujVmu`A92 zf#v7F;3A{qBBT6rK*bkSo~Kowq3wIdzw#M+MbXrh+T3q~$u;dwW@zcVRlj4$-!qOAs zl4F9hqm1Itz>+R@aVNLK?1(CFi^$h=wy0>5 zn8ylXt>*`agF=L$5C&UHVF=mc2cB6)dS7 zY@jI8y~D~rY-t=2D2iE=FEa78t{m2RSQr}7CCUKl8a6;2<1dL>ZRwJA0n&Bf&;rcR zSoT`5LX>ObQJudJ6p0=h2e71Z!IC(xD2|V!EysKacm_u5$NwP~N%6Xo8UO1(FgdvDx_SznD=U*{E9?-f_)wZ7VGJz7+s z_(GrfV#pJ>p&Yld0>7!!cT+7*G8bsH@?hOo-)6< zGQagDE{gE+Mc54mzQD$OC^>us&g^x=k#idb|=~QI~H719o%%^PJhmS2KZYZN}D5A!uu{Z4H zZrJG`q6m~I++G%s9WUU>KprB#48!Mzh{bY$W-x^rL}dh%8NvR6d>TtYV+hC$F4;er z7{De6Fp2a)GM!Fj_><{WB7=^m`|~IPd{O`(ESWB#(gk2wQodyAuqTg1=THJT9+pby z!dX^Z0)vkaTmwI*U`?=e&YIu@d8;8Xcx0vkpagnaGJ{VF9xEQ99* zCko(^{dqJh&!5T#DE`5IG$t;9feQ>I1Tg}5ERL8X3H4M6PO8L2?7~R5V?x@b~UxDXGxU7O8j3SDniNY9y2n8ov=fjUi;l+6KQM?2( zUi?@uejHY~2`k);6Kuxuw-R_;N!+dEFR_`#+f3kZ@&jB|Ao1e?GH(Nkw+a0e_Tg+J zakmlJoBe_|6M~-b3*JZwiuVhSBLv6dxG`AqI$ueopD2PT2q*L8WS)Y=izaZDkfAqc z15We=UbNmfNJ`;}*hAv_j= zD_|b~{iXpV^ey1?x!(#NkMphYIQ%=u<8)sOm(TlFxW7{mg}4*HRS4A@b4UtE^!5qVywUy3f2TX)ir@m_B#oWorCYg zcNE;M-5vh16ynhkzZQ?fzjHiJ_qBKk;A?r@z`qawVBxXLPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>DQa(vUK~#8N?Y;Mx z9oKy)SUJ7iIRM=N8bl&MfFKEg1alHakqT6>J(e|N+3P*C$GdZO_nh6c|HAH^vuA&r z_1Uqf zc*$EEiL&5pqK}e3ej*@}JRyv&f)CS1$!~&4r2iPhwZI7JR27GKct_Ta)Vi4UMKj*C z8u4&$M3ju#dd=9b@=h5N22tDX?aR%Xu-SHERJ+>Rw+CRWD7$ zL`6|#L5UpJQZZ6Y0yiQ$J~l!$b`h~Hsa9l)7)k=2{)vH-^nEKJQOCK$M+CTw=y&Cve%NJ^|e zutE=F2!q3jqA(IdD(PH0U50b8C0U-szW6lqA-5~$L%{biQDUf}-I#2SJ5ZN<4{)eT zvbq)AIYZV86GG?;$fujw0rXi0F8eB|#xSL$nHfIgF$rv3#q_IQA0-#Cj3YRl=!c5ds=DjulO! zmE}$l3Hid=NbPPfY?AgW0OBKrss9tm;r1rsv^XsEr7AEW$*3j1V zWu%}dxCBK;t4h-6wOdf4yDCHte@iV{19*PA1SIJBVi;&L+<2r0wp5+f1rPgWrFokn zxxL4W#g6WQU7?^Y2W0doZmcY;{BHt;0rUrrNT?T!<93O_Vciy9-Z9Y0WNkI*x^cS_ zB<)3)KLkT?3CM9P<>pw|o@Gc1%nd>+TE_vTC3GCmLllLAD=59&tXC@w)$)Q@Yh@y< zN4bS#YSN+1$V0~9fpVzVJ>O87CI@olLkE083!ox`1~t*dKoY?lj|*y@v^O1vFd4NN z*vJtx>Ne=eWyFe3SWO9@Kqc!j_%(>R@N&0nUS1)FEZ0L=7AYFfHJ%Ll7D`2ADlV~( z37eHLNl_HU455&fH-H)`3Sq!BO$%MuQYC{0mK3Wzj+iwEtL^ez}3YJF~mR*noE<{>oa4T z92t5gKGTzqWDY)M?R~f`XPbVYORge%O5}lRwqSV?jHrtGFoYQR2rOx*k({h>zoHz}MpbEdx5T>eFqstsgC?iHqdZRCEEQHx0pV&yf7!uvzMe8KSCs_=%b*91ic$f2Z$0wkVi&FVJO26+BCYwU9kQ_m~<8I(VitPl$q0T0LcU8*Q^S zXe5Y}=+4>_uDR`YGQ(KoSfk7QvMVG3;-ggLSnbf>r$IatS@ez9-L#|#idwR@l3!Fr z?gf&NWhYLe)gs~}rmJdbw=6j_nVk{HhfG~~!=F57Mw>HawGT-d^3f4SY$HQ>7Wx4U zX+H4Zt3yZT5mWi0tRRmJ3^_s-u9QKP6-JuKLN#zHSRgZ;oV6O8&1VE)$OmZEnv%km zbwF>hnXj&92!K;GNk+L5ZL>tgoS|&Mo3G)(`;;R7fwAN@Kj6sa5};5HK7{TvQD6An zfE0yH(X_yBTC!jSElY6C(49R0I-7VW!;<56zIu(f>i)brg9> z2sY>u!U4f=A%OP45F{XoG%&z{Cq}-Aq&+!l4K|AvBdPryQGCM2?VKdojb@`KyhMCY z+D0=0JR80p_d^BYa$u@A*3-5OkrF5>WFke#(2!DnU>V>N40*--9kaTmE<^4xC7d1! zL%>Y5QCC#oX_!)E1}#%?jlh{c|8xK5FSD%9)4T@nFRvl~1H@w8ra(N!hX?#OMv<~= zQ3@g{V4@!g9*g`iBK5<9;g6&+l7mPIggaOmQ&`ldjCgvpu@ppPQyUghMRtk>Djr6+ zOKJ=gy-41;xJ=r(co8|lD2&38ZK=dxlEBLP2bHuULrNi&0|qflK7e`Y|`|!MWO{vf%3yy&*tSeD7F0sDk3$5VvY^d1$!cswu$^QABEN0?!R5;0Z>{u&&=mq#2yH5vO&{Y@z=8u@ei$z$UefWtz&wF$ zGB4vTv3|EHKOEu{*Op{8NMfr>TH)*QvpPt4AVX}SnLEBB!Rvu4w2L1=X8~js;HVR< zA07bXm#n4uRRH-tC;@Ijhsf)5dc<2WT3C-MBxB&yfm%i)sMRH3VphZ!he|B5c;j_` zBuEnPx(x)S{0uDkpW+?^28~Q(Y#rBt_9SIGaBHwiGRq|`T!wI=v@w<^+$rCkVATn$ z5W>gP+%hexpzjuV#JV2IzE#+`F%l_{s? zMl11Q#0mZpR3SNYBE;*fgc;G3TtqP;Wyrk;3{5h$oC!!TX^?4LDf7felo)AVrVL3C z8;&(gvXL=~gb4!BBM1p?V)u}2M;XQfr;64yB4xaIA zvAbZ1l;ct4E`{5_lp)I?gR*vkgGKlx(!-q)Bi#tWIyRC>Nys=R<_w<-rj1xOB4x-u z2MjAsRmHA^zeEx6`53;19}x-s4j9Ime@t;_SfleKVsx$_eP`Ri+3mO3l(X zfj?%q4lrZ!FmTXFY&=F{q83U9(K|Db5w;Jr`ude07Dc8$!iAOH}SfYohd#N zXvUBR2qgtYT)YyLo1SFgp>UGTCx5yXNuc^ zT)AiyhR|wE8?4d*;17uqOJcLAT<1Ul3?8G$4rm7*fuZ2{R8xFZPz)5CF#^dpo-J8r zjCd}Q-hH~au_h)BmU+rMT;ewf)Wn-i9FR;V@$Kg*C~x6x)qh%IlEqOL4Db#rC8O`8XiSSJnbsliexqCQ^pnEhLJ(7RkO8 zA0MO)x#z%NjpDBm@{b}9h4G2L=R~3fkmxyIdQXlYk|KFZ_alS9ov`+a>4YJxjT@w& z;-e!LBXpfV`c7pG{H15vm%m(N<1Gy)gq{$1G7BYo`%R&*4U9w<(a(q|LP)<1!{iX# zLzVy9TMB@G8!CUbHm1t^PC?Ok;4j~F!pCF^o-9r>G^;^xuEks91xSN|Z9zf+{$*?N zf(?)`eW?#GV`*diMv$+-cH|oT6!H}!eY+MDL#_q%Wj0EPGW8)VAZc!c;)>jjtO7A4 zt~VwfKBiMH+l$zNtoRVfnM_jh>3u+qpk>{NrDzBKLey<=x4k`hKWCKUSB}(L{mPLt zFhQ1qIta%>k*Qij|u(Cv>6NcN@J zZt(dgDO!FKm**kdGmVilB*m{0Xp)yyT53Pr8*}E)JWI-udl4%RXMOg9jjJ3{n%JxY z{dh#O8e^ND%BA}z>ja$!1NSa4QYkAo2PaAFM%vON-gsx~-KL_{GNt%fB6b>d<0<~; zI4s*>>)S9SMT(Cr;%|bDM7Di#5QSK&)3_Um1-lN(z7*SyRTI03(cjW@3tK?yLsI;D z;5J40&)036VsGs`HB#I;V!^IMvMd5$bVHY`AKzbl(#9={xtyj zAc!IV-D*GiIeL8D1W_2qFNMUJA%9hb5bs?FiGF)zZ3dYJ1NRCNd$vpu03)?(u+ni_ z3wn!&{}?QKlI}=EZG5ksPaIE{7;vNDBq88lVg8y zXX@R?hpZ-3iWDCYh|vl?=oMT_AGXKPw_!+%dk3kt+9LS(ky41YEeg$Ju82RFlKwiv zT|+G8bx8K5*lxt%Y$DyhkB+QldvrTx$UTiTC)_e%>{sZq@)qtksCUYcy9JsD*??qU zitWZKdJx$5y+oBVu&{E16oWrdK$zT|e+9Y!FAK=di@9e@rPXEmfT2Mv5l2sj_GQD>qWi69BKxU%d? zdUDPu9!%6AGX}#VN=#yr@3L`AoMl=5uSfoBA0SOF|6)myXjeQA~#kM2$At_S4AJX3sxm$<@yAH{|6dxa?KIG$!G&)|5__f>BCDc2* z{cP@vecJf6Zu}B&Tde$kh`3zoO6@7`Ijna?VUVn(Af;V?`F5p@7ycFqy$BL>BNCz@ z5Q30}egpwBdO{w%+dSpY5&wQjd;vv>WI>QcQB8KHxW}+2-QQ$HKdFEMw=E&3m?tq- zR+a&J@GnUr>a+u$z=&O_1%Ifn?VoZX>E4U|fe;uDWJn&rP9lKy_kT|*oZtwXXe z#r6Y{(#B;QkTN7iiuc2o7y^frE+4og!dgb`sn;Rdm*U<=;_*3BACe-)`ypk>y@x&SnLZl0kDF`|(w2lQE;{^xMLI=k+f0zhAR{AY29}UaR zYu`#G5}6NILLG|)B^0qpfrLfyb}G? zTYejxF$rZvkIE$bHXv!%1|+-hc_hvK*npnM*y19Hff$9$_8UDVdaQji1|*4}kiupO zWwQBR1g9=1@UM)-693}a&6drcwM-Ok1Cre-whz!^8U^}t=q;5vn7&Ln3So3P15nbq zP(7>1=i}izZex8GzYg)g`Z1mElNyY9x#ju+yx&OdK{d8%Q}_xXgK`{0qx>Z7Q(Gn+Iib5khkHL z(1PP}@G2x7NtR_r;0x)@Dn*U!S@v3SJ6D$Ef^;GDByPrXvk5CJ%Sh@6_=)s!4U*3> z{o@t<=a;2=BMCk6C4qj5LF8jcqXoh7tHy%h=V2pVDJkPE^glUfGhig*6=b;h5U+Er zZ|M7gpGMbRe^xA)+tT?kAW0+(mkM9v?RN=Gkpoc*pvkTvJA&p4M!-M~PY!%F2$Yb< z2t(nEhGJ=wCd2gxLgWWg;EN0%SWrX}3s&$k^1aCOu@^Nm#}PbV3POc371j|nK*kp$ z1Eewv{fMEWkn-#>6#S4mqR4br!h*xYFz`a=V;}z|4xA)WN%BP%*zPhBWkA(o8zmb2 zR)Zub{*z>f!=X#AAUFcL2S&lVk&Y}cp_D9fxGl(nBn#+@qzJMiYbrWMTFyKnv?Jyq z?ohB#ROCn%BP|LQR7pbv9i`tW;;kbEfR3!vuH^UBAt78M@qc6!_}d>Sd3zI3rjBmN zsuV^{QFTQ(oY41J5XsCBZ9i%StS(5lu7tYGQ6JaeS1pz&b^|EjSH&5k@372!LWriC%z- z?GIbM#G;cW$?1-_xFmZ3KrHQ#ks26lNE2qb43qV_<) z05kw%XJ{F;E?EB-6l$QULbA`2!f3uv2tp*mq;`;^E(?aP8HQz;cGGojKMa{HtEy_? zKPpGHR0*#fY5_SLmSq?jUDwfzc)E?+7=cKVEXx=aoJd0>Cz^pu@Db-}nh7=H^$8l) zqiZ@H2|3~zey)a(SRnzCb%H$wyK!BfpTtz5EG1shQ;#!*lLRF-1=xALcv-t#uZmJOx-XIRe_EMzT-ep64V+_6@8)!*jV+cK{$<J?dmbzS!zg*Kjm{~O2szr#M$2wM zlQLP$_ndmY9{4U)BJ|x>qvp6R42;Ut9|#wv?}v`#_+j9>E|eJq2}$`J&>oC552F%& z!V20JmpFH2fMxJ(d4TyYa&s8P*mA^Y^JUtowt%Em~kbK@8xDZ(k(io5(X4+vM8Uq^)1(KtX2R#sjX2HgR zEU@0xTTllK45J_nAzm8>OVdPEWfB4dL z5*rZ=B2frH{nX4zHM5$kgAbt(`wMT04#84n$mhV9&?|uPZ5b*lW?!q`9}YS;r~S|&nCO^?7*X=5=-KiFa@sCU1SxiXtY`m*HKz1#Y(cz+qu?8tTcdRymn8(QJfVa8^Fp1SbvokjS}Ai6q?ja(j2%NUg$c2g|W6 zcWN&883@Dp3I}aNdw7W}Cx_BWpf9W@Vhr2&ZO2C_;@~6kmv}_K&W5_+L(p6mdcisK zApu(qz&Zf&SW=@`YtIUNkJ3W)0CGla0v85=L8)c_8&XEY7I+*ksKzG^#CIE+FAX=>k4l@i5 z-2jJ46uyrG5D-FjunUdE=%5-nUW%qEmW2nV<$Zv9RzRx6k$hf8Y&TaF3w{ZgMu*9J zK=Y-@RD_HcnHqY9z(Rse0WDyrLO(#z>)0(w7+zHajX@YLa0IM|sUp-t&tubrv524f z!Y+QiU}!SvqrsSIs82*(jJQVDMBRX;03H0$w*?l!b{a5h3WW^lGg^x+WJFX$ig27E zMu@SoKm*8-BY2mXO6m)%#qXuk?NlrgxDCOsbRXTO9G6lE3>Ql5Aqnt}qzvGIU?_6V zG>Z9LM=qB&4I(@C@@4>J*{M!)t;9fzojxjLA=j;&SuGpMAGRKgCK%N@0gKuOae5ggyDR?D?&&9QM9Mo4g)bs1q~ ztUTv>fJ)j44?(NR1?ou3|qe6g`FD3{;v1f`mZQrJ(`mWy!W%&`4?niy(ed zO+hGED)4WP>rzAq4kIC!m4I@ic#Ls2RmQC`G?0F6lGjM_C`O9bDS*JCWET;`K~rEd z>}JJn)hyYjRxHEqKcyA=T|x737+G_8Hj1?9S3c2JyGik z7H;E_Fi<8*UFO5Yg-2sS?vh&u8dRJ>QiHz{B1?rYh2Lm8t-6OsBH{oGWeqw;mBX)b z0ivGU)Z+OkZR9)nUp@#CwMk;W68W$=%(b1RX;zui1tibpjt~lR?E%#ihU7)nfa;P< z#%OaVN|lKWQZsdJ=iuPZfk9o>;YsY4qw5A@(nhn2o(vBU^!0Z|BCNRUxDDM<`}_M2 z9yl;EvM*mKKwV*DdV4x{?&yU*Z#5f~+$mBJ`uNz}-LrFOxY=mnQf9_<;iF^;#Do3g zq5+`sWUR;$Qz#5oAg_Wyh>A(9)J$R$WuLT*yJ?t7uJ|zaF#)iXI!vR>>%n+YZWx1K zC%za@dxnRH^7$<60x^?Uoh#;thK5iLcmn&0YH=krhKm~uaS?+_;L#~sL0988HX$Nq zqSQvZGJ{b?0+BGp+{ln(zawaV7{UC4%OngKFIlBpm@fy864a56Ab*A^H5nauS-iwcm~@*G76xLFw->ELkuC_MxH}v zjI0AJEA7D80OVoNS{S@IMM1cM#NTmgA^}E_L;_AxpU`~-CXfL(a^|28E=j6Nj9ka= z=qP>WrI+^X8lIY(g6G6u>^^n+(bJDVj=ILj$G{FWg;OaW1b#C9VxUn4u0lB!uYZFN zSz$=*Lt2fB)1D!{j-aEflt(~o5ME+PWKGl5j4qclaX`Pc68cqNRuHFVqh_2$rLCB1cs`KoLU3KJ{9; zyQB2{vrj*9YRJ&LZr!{!J~0jlpUGvAaPJ-&`t5)6<$VWwuU@%!?fT_so_g|$r=CDN z|L%K#fBow9zWzZB@%eM_6>{2_KL5(;69bN?-?(voe0&^!VE69bU;5G)IyyRk^5Y** zPE8dHMcYC84pSsG8db+`I=18a4y71;x&>K>ZQDW!X>z+oArs{!G|L4pk;TKYK4owY z*g=abE8q}u116tRNo3mGDy`^tB0I>GP^(r42Ks*UD_`jA?|=(GT6`)Vy4T60Y=X4 zxw;DNVpcW_eQnLp7Yo+2j~;*Ok%M~%yT`^Rs*AIExbx6f1!s7m^T>hSuf2LKZ|2Xv z{e~1cCypI@?BNHGAKo!M(7ShdplF$f9G!gV$Y57tVS2Q_G@}dtp}j*dKK=N}@IdI) zCq}RPcJ0{V1CO72IG4>%PM47f3z26x7IzNzeENlFx;k<*Qh>QDfrPnv=3iVQqSoXkB8Br%spf`+0!L&EYT7@{CH32|`35ZH8_fr25zrpVLx zRaHlg&^ZJ$&_FVjf>5tkpbR^AWC#1ZdwaSvre?S5aC4_lJkn7TY8Ag(uOWYW_L--8 zySu*g?f?82-}sMz_uX&*>A(4Ze)^Li!p3wKbAjj9o5Jx2kM#F;!PUU(H0tGMqmGzz zpueZLyEHX9TCY_~g+isgIJ|T4@yAa;@#N_T9yoIR!K2{o_^q3}hlieh>dDW%{OQw= zo$BrGhEs+JkgWA|b{sjhzrU~R^kXNEA3I`b>d=mXXP$cE#TTCIC>C`^Eo5_0*=n^4 zBb>D|apJ41nq`=fgy-6DO^Bx`($%$$sn@Cvr_};cD@#k|#RXV3j8n5AG#fP*c{Hm` z>dpby2Nndo)d_$VF4{ z@3Icf9l38Hr+SjNqy!botM2GBk008#qf0OaXQ0D)`qTr@KmM>5wtn%0pS=E$ z-=7=3zA$x57ybQ1#p8#Ddh@zho6}iyPk+Y)_hs(eS&LfcbQOfq%I%_ z;(n03vyd6+mHRpirL5-E7QALz@|uN=w4+xT=*s5}L6@D#pHrkI!I^YwH)J*!1=GGW z+FA4qR>N-Gs!hKmMe_qavME=c+AUqG8Im(lGP}DAx@bpE#gctX_5?7&h-BsnzO723 zsY06r-)@D?n!xOX`-et$3v<(>7tZ|x4rkwpIhfoH!CEWRg6J z<93NlI~IGqW$PdtNT&fb7&IRIBSrgIr%*d&hNf7SwN#~}A2@utyR%^1^_l7M{rm45 z*|WRV5|G!GN}VXroxL#F-*aI9A>Z?=)e7RPAO7h3p4;p!6&L1a-+ud=(`tU|#pfS6 z{$RCIMt(_?!Y&Mq48G+uMrR@0tS%iou=m+#pZVgKzVOwr{`MdIx4%C!vIkMqsYg$~ z@Z7U6ed;lS zeenygeeJiu`Uk)N_4`IfW@n}l*JVws)oLv)EFh`}NtTwDrl+UtjjCZ79UVo})Nz$s zy@F=bQY$x_H4j0#5FlwOmzP?0!!k8=MAwk5d8#C$0lAD>pp2!7+Q3Xh(>%wasXs2! z507LlxbYGN*eoQ&QAiIoguVl_TgnLiMd8p$e@+jZtGZ_4hjf#Uw%3X=5l>?pj% z6DJ-V?h~$_fBXCY<*#4=(LcQR=Ib{upPie$$=qO|L+H$EtWmMVU{`NxXG!SJ3VB_W zgO;TV1D(07Dugyt9iP6|5m^)RZkb+$@LSdT!lV{?T4c*nOBWnX65Qs(!pzO)?DdS< zIQj6vr(Zqx{ELSkJvC6wRjPAu%51c&P&;}k_t3+Ar;c|Y+-qv$q#RBh-dlL)#G%2G zp$GM_Hd~#&S)Cg#n&JyjK62vNf#HEJkfd2%up4DD^uQAg&|r5V^6HB-!nKRLoneBfk$s>Qu@jxan2Af+pRDJ!lx5~o;<=lj z{miTX+yC;vBI~eB+0-Rf6LeigfOPTFg|lbR9y+w|v!8n#+>&p`&|`9vK`Tz4^{tXYN0+|98Lk+tA~;-+6OpX6nF!y{Ar{>g?=nHk)8O zoC)lGqtQTP&^0I>xn2%_KS1f}>dL{(WX-|Be$W_>=+vVpjvP67|H1nV9el1e8&xb} z;L?@Q?`KBj%wtByGOy;wp*!J|xIaq2v)7t;6-v=wgWB*_%zjS!K3hH--M* z++bg!RiAh5#l5@xb`SM~LXE1R$!vaReB#!1B=bETrLJPpuGcT0KQ}u$apl7K^Y6aX zs>3H_yGq&aj$A2k)hX>~y%7_^Y>h+adD zT$R~UXd|Nz-AY!E_Us#c^3=h{PwYGW$bC;fy6$p@Z2edOtr`(HeL{L!QPN}33!?;Gkmb!^|0ryh9m>0__H^wd+2 zKa9{$qbZFLqPFW5tT+vnLT526IE}0Cy?yiQWlI+<6ZVRP16hF)oDNW4@PkGc8zH?I zB-gEhD+PLwN^)JQl{IsD1aT3Ac|ye+4nT^F@GtajQ4I4r>)4UQ%=3_==QCO4#n*0L zg&KYKv#%g@nV6WctX#d`I&r+=GZpU{!^!pzx(#P-~7gZ`p$p(+e)SKUBh7%F&|_jEo@M>mDB7xpyzzaA5awOm%n)Z+`0D<78i0k zRZ{AWI`SM4PeY};M&rTfi+O@XnoYMbDN@47VBu2(?K1Usv%PHKF)`QK5>>i$5ri6Y zK}OHNV89Ud7ER&U{{E3(tG2W#o0%Yru3Wi<3=16}8s6DxIFxIN!neQuo$2YBg9nd3 z_~5R-zCA$@x~`9`u2!peb`%fnKZww=QLXIUF}QbR_u@hoy+9`>r)G33cj)lpa=CWq zoeR@*wjimNA%~Rh<;b4l2ag_l;f1GE zMgGZ;e>gEVsmXM=C~Fp*HTT@Rm;TRx`G5U~|M&kpcwpae{>E1h9N3e|YV}4fo68r9 zrMKRG=NsSn2K42{=bzhu-`=^|X}Cox@Pv$=2Zna-*g3qjySHn8aqiaGC~_t*@OSLo*>db} zf9LPco}1abZ}2m(eEy}+yfQF2R48_|oWKt#D&8@?tGBn`al9*6uFcNRtBRh<<%@+< zF0YrX^=nseKtYgv|y~Qj*=A8^t%uWou!T^ zA3go@OP?O>>%4sN>iFnbt6?h=-J_&?$Q~>aESHY4hK(Y6kT)P;g$wfz5Hlop>zo`h zIOQnKwQHBppFigY-r=JUoP6w2L6**4 zyf8jB*|gnS!yewf*Rb;6|G|&`zq2^Ih}~IBK_0(zaL2^WnbB*r8q0bO>AhcGnV+b4wfu0NykO+|@tyStB zd6?Iyo`3!YUD4lr=h82J_WI&n+4loQF<1yXg@Olz&Tr?_bH<5@Sz$;l(ye2S58+Wj zvK}K0qiVSZ&4zB7rU@&1`SQi_@zG-s?jPRSck|lSR=qAoqAKa=h@oV5@4Ro<4)~Zo z(B^;m-rrw5cXrp%pdUcX=`jY_wyvITXymuQ{q51QTL%vvxc|_8*RjLE-@9k`vrj(- zoqPMuGcb^c??1SEcoGtyazDvIvAs)2LO-@uVu!xW)N} z^5PN{y->(N7OqPVO~QK=3Wa<=9|Rs6kC;l=^|#)7>pS21&R_l2H~;oqe~rKiWQgau zG(}yULribubTk-_7zP3>nM_92B&6xBW*v@V@5u16qlY_+1u+VHyE~5_InvwHRmf(J zA3Hj-dl#bNVm_OQ??ZvR4vYj32IwR6nHxraAO-lZjtJPNHz@dW= zKl%`~V03b#*>YOG+u7YUS6;k1dJBnmwO;w=-~8pb{^l=zCOmd(e}8Y!{M^i~(Hmjt z_xJagx;h(nYi@Dj^5x4R^G`l}=-`3f3p2ChH*a*6iW1%Wpvl&(W#qC2=-bU(<3IW7 z>p%SQ>p%V38*jaRc6?$6E+_~BM8ZzJ330WmaHn)jqr6a-BB`^~qlg;3?A)x=Y`B_{ zkrmx`83G|nZ^_0(imZh+vDR$XTeGwCw{F}Vy*c(5fAP(K^{@W?AAj&8&kYLsqN!VO zso9QB(a4l-;q2x4zxlhL{Ks#7_s6flJ26vk*dD?vQAVtTid%xssT`Ab(3HFS3gQ?v6(jbHoXSN_HS_&;@Yb$|1(zBMs5 z`}9-K{mxha*=Jw8pto<(w6cC62AkEE}Gnv9`uYKirzy9AK*Q!?PU;EnEzWl{6 z?%cU^_pV*P_j|wh8(;ns=v1jJ#ny)88%Z*gWxAJ4_n7&;{$)V__yefx5Wo`B^gXPg zjNFN_!1k)L8HTzaB3_miTa~NKtTAhPu{t+DKeW56SQ2iIjU$V&J-4g7ljiV6HnMN` zeFt_)TI7X|y0b7dJ)K2F)GUjEGdneb6ll*#DOa$TD)SdFpOY0hC#SO{WEElR+7-dB zsR5sXHAG}e@Yte6kKs#ZNzgkYy{i>i)h6P;e6gfyYR-2h1Ub8Q^qx9-#C4WbCAk0a zeWs<_Zewm~PS5DR6b5Q&N3NKa)sj>VtAQ2;qT12D!)LnVDUoC^PhNlX^|vlvof2ls^_nkOoqhS9oq>|MKDqE0fBl_u#o0S@|JQ%_pFi^Ow zexO_rJx{hBVR2EIovSw*=z^uHLZivD*{)}vd--c$`-7KW{@k5os z7agXQn|=c{%m|?-FWJa!au|XN1`qaM6zHog)veW~|j-P(+Q!jq@wI^Qqv?HlMf9L$QnFYPG-|EQ- znT{o&l~HdemaeiN`MRYPIwMOQU#gwCc=g8gLig~%r@rvzlTSbQ>}Njr=rhlC4-LDK z(C}Pb1qq1DmH6W-~M;I9h>WxfSB10}mXAFMsUO2S5Mnqel)6XDxQ> zk;A|7+Udgw_bkqhH>wL+L#5lrblaYQ*oT+gMlJgd%Inuc7K(kEs%0`gF!G4^XhIDB zj6ZD7=xr-W)paE5x5mfcd+*%D^b7^tvWnw?#gRpdj$mFw3pUA_!|9fZL` zdFlLxi28vC*-~@zIHkm#$2VPtn^qL3HuT)v2kO>$gTx{oC)s#ZSRN`vJRh z{l?kz=c~=SB&)NF3un(=9Gjd#s{~oRe*M;^E0^Zy7QDby=!GA8Y!dkfi~@hFf}Uof zXQyboi6o}OiB~HVlQZWpUATPZhA7L0ViyaA`Gv}2xjH>Hw}hyrQb$K_-5U3TaC&n3 z(&a1TV-ri2^7z=~+4JX?78hao5j`N*K#ib;OwTF7XMrym68=3(Q9yH9k?+*2UbC(% zYv!`T{zsHTuN&!*11N>$gI?djut-V}GW4LBE&5G&Vr=5d^;s+16$yn~qviL`UY%cP z<_o>~!mb-PXD(eH?de5M(XShWef_&TI(JOZw|;r<+V!cWiWfPeE?Olm-#b3fe)i7A ziYt0jR?2iqnZB`k;mr9Pb}_5F!8F7Nb_s^|k3T>EgP*-47{#u^`&!JnaAS62Y*z2yS?Jw! zeX{o6(-HW_lJ5Se2B}5Bqxh4;|=Un)fHh$My{Gh8ekaV-{)QuAv>fhBFhR zm5Xn`t7=FTvbG%{xuV=X3du(^TW7W<2ZCF7%Tug2sYNa{Ukai40nZ#GQ5ia7TKSHF z{j$}eD{wa$z7T;1^oRoDAXH(x!l2fyAx+dwdbAZ@rCDu-0^MFHbd-F@onKnSxm~?I ztvc*jJEilJ&t)k^63-F@Atp>Ef;_(e(+9>=w{IW9OQc@dH8C@DZEDtsaAgtN zmNku`-9u>HrK^{rXHCaOe|q}|LoXa1pYUuiTk5X5lBnqsvh2{#WQO!on57T&Z<@B=NBe@--8Rq6^r>|7%?P)XV0GXDz$-q`yfLzV=XN$Rch6)Qg=3= z!`^1CZ0dB&91(BJZq#ZO5z_1F>F)2#7rSgP7@wXS9iKspo+)+vk?bwZ7YsS8NJttn zKuy@=mV=HXB1Nis-+g;$XJ@CUCwC4FVq~YLrgT#+mMl~_H#0vovyjP@z~E}t&v*2@ z^x!4k29<(_$(lt2+PScF?JaloOeU%;f~W_k5I+he2BNw1fMFK$I}gj54po6DDLRKX zK(Z0NY{xwjP4!0%$s$dp(T(K?KJ#0R8im-3>V+OG2rLe4 z4ZWU@R?4cXnX+zT1SHc`H6ietG+zsXL)Nm%?n07RawF)X0rKgHjkn7J$jiE0teunB}u>#`+athDI68@9gMp zHT_D>2Ct!Il4e4;H8GHbh90##pvCpY#T#$ix8B;w5E;og-R~;)3u*?QgHgf?c|v80 z7O>KuAHax#sf2{qqm3mQX&1}6sY?7ft>Y*BLvz5!`H8a<8eAi=$eH0CYLN~V^+lB_B_ zWx7pUu`r)3#H>?>?k(~yZ{*$_yApo zQ3MTOjj#@*2t}rxTUB8fVIbjE(2K>zMO+dU!FIw2!pUIli3bY38yI^^=1RTQ#B2&a6A_ax^L49 z?Jd}E5Q)EI%IhVGK%`hB?(;7?fLn-U7TEm3&5XQ;A%6cUrP${Px(_x`J0r(IT%d*# zWD6#kXc62cc<3X2RhXp9q9z4G;Dl}i)bbZ5v*cl1X%(5 zG$RA&1J`1Eex&J4H6XO64J8m&BL}DChj8LDJ*-coLJ!{Ssu=n$yD}G+r(%Z4Ash*3 zh`?kc*CA_$UV;xXp;Y`9B*u~^QLqL}43nU#^olI@lDmh{JO``^nXf3aWtp%ZFxj}A zX&T@WoDh9~06ipwaika0(J@ugVEI5A)C?<*Em%+$E|VWjYAD>N3m zg=<1lNqezxJvh4pbQS!JX^Dfe5jt*~2-T=Z+^RG5S_4CnJW?= z`L6AfQ-=Ip2l6y^HSiq->$(b?k7m$U4M~*7D2jxO=rG$bgBHEF9C)q`c?mwtnc2D7 zS-V>6?;n87>y=tQo5MIqAu}}$q8ZVBaY}?C7)dbb)prI@VJae0N_xi;R=c{?C}vBY zUA?Mm;##^&FQK5(s-@Q`UUyZDwUzZl!3~i~tMHlGLeYhWu~5tAYOSWzXqNg1U_><& z)(YIw^Q9iwWsP!O)H4iBhs}nDMQ91)aCk+>F3*OQsW?-Y*)l`W8ZFmN-7WSaCxa5v z14Z8+V4NV= zTD5`;Wf9kjVzp9cLD19H2~u(b&phA%*4( zdWU0CqN--I0Sy2LXe2e+b!=2Zob+KeWcqTT5aCWxDKDY-`CJy2V+9RvHS0RP*-ba4 zWN0lKKrF(7I330{6a}B&4`CjX0k_#$$B6I!7M3<)B{%5)nAZ4d+{kPVm`^i*K< zwNUiFK23q5C;UNqa#FaUM2}@4K!>(OBD}JQlu|QV$WoDDg(AXT5ta_28hr-}gn|&1 z;rRGVnXnxtC_rX32vwLfN;qghV{xH=SO7&aAy))>2r@w(XgefMuN#IGonqvzY@Tij zhD_H@vIppiAfrXth7}S7E=lR1PH!5LC4tIOoJKEbBaWwczcGCLJ|L8o&*q`|ju0XP z0>xNVAK)EjWaa8Z?sv$pj*TX`f2I zclj7v3Fw`b4IsM00Hc!ih*QZ8U@(&Oj?@N_gKGnlY}@+DU2Fi6hL;=B_IQjDA`qJW z-ZG$u7#WNtw1D67z$a2s#gJ{Ui9pg+MYmCzpBitKm%5ZSnY#VZ|E%`zt%iojgq$wI z-1%^tqSlnMu(t3Ql0aELV=ZU~sIek{AePT&Qi5*ZmJ;b#0_2Az4-Rs49Aqqgj6(e7 zh{$dDNFkjN@1!*yHY63tzuA-B<optkSuvdBe`xjZYeW`wE04e`qW8VLNN!1aUow#w%YqMvh#{gu3K&Qu zx$tAnjw{&+w8C5YMpJWargbclEEli%!|Ah zY?Uu4EjbrR7DOgTp%yd+KNRJnAR_W4w#S#C_>>gq_Lh}0keRD6n0k&C^`g(X5QdM7 zDp4}dHE0Mwn)?u5qHEZKoXgV zx{An^XBb*fLq2UDT-|$Z!R(rY7K-QTUDwDwjhvc-Wd#0 z5NV-)5v)c7RoABp3wU`s@^!J5RhipdSiEt*b>kg_wQv>1hOchWL?U`p+Ia+Vo}SC` zx4BUTHlu}T4|R!aFc1q4p!VPonzSN?cqJ}3vBAqsqp^!e@PkS&nssB0lE!Ys*rSvY zjPOBNSJM0I?Y2YBs6897N&C?OoU~P-Js2Kb2tEV@gRzeh(jCLVr(_+0JI$3M2??E6 z$y#&K)~=UxgZq4tA@q%~DY$iAQQ$)yDeFrHz39cGELf39$VZ~F+OL9xAryk&?Txpr zl(74*>T|VQrU#Xz<#CikZUo0sfDk`rt~kip$;s1qjUt-jLyvR85EGqS9x0*+xestN z#BK~VA8u}g_;(D)Ak&6Z(3k`w)EeF?fM}^TRFdvf6SxARjn zkXA;L>tv0A&fXC(2&{Yt*B~j8f280l_K(z60$PdIp+xghN?<6`TD~heCN4M0D`MY5 zC$1~`Rn~8(YmjK#Fkv%>K)7wUw=DrM1Q*)~bURsF3;uNuTLsaBCIbYb2S$_|Uetl@ zF7v<;bWv7d12OI%%$p|DE!Pz+xU6brWZ@Aq>L<-%a&>RvETvSgF#>CbaCEatzFl%jemUEtlm_g$6iHM%Z&>40$0Ge!X9(6@P9EcldCSbK#@WnqYq(lnc++_HCRWQ z7jIcp@)(Gpi;|?UQm(dtt4kOolpBEtCu?iLCt=&5t*+n_H1S2PO*peswq+ndz1rBX zO-eAq=RP?8VFNz)R118FA0g$1&`aQiQxDbA*OSa`%5(N#{b1 zDDNc+)6;7-E`0wARx<>mg)sSQ(taF{l3EN&pu{CfgX83Z?sTw7!xs9YdsuXy4bsRn zP(Y#^i;70kYv`0sg<0?&j-#7Ju#OlKxzKZJ0xq{}Xc)C~Q^G$}(*e{)no4Ute^QAf z$fsh3NqQ2m$A?k39 zd^|eqfWu>r+z1?v+HkFPCF*Ivot|BQ)mp<4SiSgfJQg@|rP*lKvRqT#MZ|_ChB!Pt zoUCpM36Zvl&BFT4u)1Yi!DgDeUAWWs(5-.xml + ``` + In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). + + Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=620879) cmdlet does not append the file name extension, and the policy settings require the extension. + +3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. + - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` + - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState` and replace those images with your customized images + >[!TIP] + >A quick method for getting appropriately sized images for each tile size is to upload your image at [BuildMyPinnedSite](http://www.buildmypinnedsite.com/) and then download the resized tile images. + + 4. In Windows PowerShell, enter the following command: + + ``` + export-StartLayoutEdgeAssets assets.xml + ``` + +## Configure policy settings + +You can apply the customized Start layout with images for secondary tiles by using [mobile device management](customize-windows-10-start-screens-by-using-mobile-device-management.md) or [a provisioning package](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md). However, because you are including the images for secondary tiles, you must configure an additional policy to import the Edge assets. + +### Using MDM + +Follow the instructions to [create a custom policy](customize-windows-10-start-screens-by-using-mobile-device-management.md#bkmk-domaingpodeployment). Replace the markup characters with escape characters in both the layout.xml and the assets.xml. + +In addition to the `./User/Vendor/MSFT/Policy/Config/Start/StartLayout` setting, you must also add the `ImportEdgeAssets` setting. + +| Item | Information | +|----|----| +| **Setting name** | Enter a unique name for the OMA-URI setting to help you identify it in the list of settings. | +| **Setting description** | Provide a description that gives an overview of the setting and other relevant information to help you locate it. | +| **Data type** | **String** | +| **OMA-URI (case sensitive)** | **./User/Vendor/MSFT/Policy/Config/Start/ImportEdgeAssets** +| **Value** | Paste the contents of the assets.xml file that you created. | + +### Using a provisioning package + + +#### Prepare the Start layout and Edge assets XML files + +The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. + + +1. Copy the contents of layout.xml into an online tool that escapes characters. + +2. Copy the contents of assets.xml into an online tool that escapes characters. + +3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. + +#### Create a provisioning package that contains a customized Start layout + + +Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-install-icd.md) + +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + +1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). + +2. Choose **Advanced provisioning**. + +3. Name your project, and click **Next**. + +4. Choose **All Windows desktop editions** and click **Next**. + +5. On **New project**, click **Finish**. The workspace for your package opens. + +6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. + + >[!TIP] + >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. + +7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. + +8. In the **Available customizations** pane, select **ImportEdgeAssets**. + +9. Enter **assets.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the assets.xml file in a later step. + +7. Save your project and close Windows Configuration Designer. + +7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) + +7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: + + ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) + +7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). + +8. Replace **assets.xml** with the text from the assets.xml file, [with markup characters replaced with escape characters](#escape). + +8. Save and close the customizations.xml file. + +8. Open Windows Configuration Designer and open your project. + +8. On the **File** menu, select **Save.** + +9. On the **Export** menu, select **Provisioning package**. + +10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** + +11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. + + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + +12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. + + Optionally, you can click **Browse** to change the default output location. + +13. Click **Next**. + +14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. + + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. + +15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. + + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + +16. Copy the provisioning package to the target device. + +17. Double-click the ppkg file and allow it to install. + + ## Related topics + +- [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) +- [Customize and export Start layout](customize-and-export-start-layout.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) +- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) + + + diff --git a/windows/configure/windows-10-start-layout-options-and-policies.md b/windows/configure/windows-10-start-layout-options-and-policies.md index 258d6c4418..b43919e728 100644 --- a/windows/configure/windows-10-start-layout-options-and-policies.md +++ b/windows/configure/windows-10-start-layout-options-and-policies.md @@ -102,13 +102,14 @@ The new taskbar layout for upgrades to Windows 10, version 1607 or later, will a ## Related topics +- [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - [Customize and export Start layout](customize-and-export-start-layout.md) +- [Add image for secondary tiles](start-secondary-tiles.md) +- [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) -- [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) -- [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Changes to Group Policy settings for Windows 10 Start](changes-to-start-policies-in-windows-10.md) - -  +- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) +- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)   From 049c002c0b68419036907aad1b29ae9117ed0caa Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 31 Mar 2017 09:30:04 -0700 Subject: [PATCH 151/165] added support statement --- windows/deploy/mbr-to-gpt.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deploy/mbr-to-gpt.md b/windows/deploy/mbr-to-gpt.md index e0c160b723..76aa003b02 100644 --- a/windows/deploy/mbr-to-gpt.md +++ b/windows/deploy/mbr-to-gpt.md @@ -29,7 +29,9 @@ You can use MBR2GPT to perform the following: You can use MBR2GPT to convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you will need to delete the existing protectors and recreate them. -The MBR2GPT tool can convert operating system disks that have earlier versions of Windows installed, such as Windows 10 versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. +The MBR2GPT tool can convert operating system disks that have earlier versions of Windows 10 installed, such as versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. + +Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 are not officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion. >[!IMPORTANT] >After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode.
          Make sure that your device supports UEFI before attempting to convert the disk. From 385c54c5af462546dcda9378340766318e1917ea Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 11:26:58 -0700 Subject: [PATCH 152/165] Removed prerelease text --- browsers/edge/available-policies.md | 3 --- windows/configure/cortana-at-work-crm.md | 3 --- windows/configure/cortana-at-work-feedback.md | 3 --- windows/configure/cortana-at-work-o365.md | 3 --- windows/configure/cortana-at-work-overview.md | 3 --- windows/configure/cortana-at-work-policy-settings.md | 3 --- windows/configure/cortana-at-work-powerbi.md | 3 --- windows/configure/cortana-at-work-scenario-1.md | 3 --- windows/configure/cortana-at-work-scenario-2.md | 3 --- windows/configure/cortana-at-work-scenario-3.md | 3 --- windows/configure/cortana-at-work-scenario-4.md | 3 --- windows/configure/cortana-at-work-scenario-5.md | 3 --- windows/configure/cortana-at-work-scenario-6.md | 3 --- windows/configure/cortana-at-work-scenario-7.md | 3 --- windows/configure/cortana-at-work-testing-scenarios.md | 3 --- windows/configure/cortana-at-work-voice-commands.md | 3 --- 16 files changed, 48 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 207acd7b9a..35594c3478 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -16,9 +16,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program -> [!IMPORTANT] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. diff --git a/windows/configure/cortana-at-work-crm.md b/windows/configure/cortana-at-work-crm.md index 914655aab2..c5ca8136b1 100644 --- a/windows/configure/cortana-at-work-crm.md +++ b/windows/configure/cortana-at-work-crm.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. >[!NOTE] diff --git a/windows/configure/cortana-at-work-feedback.md b/windows/configure/cortana-at-work-feedback.md index 6dac028eb7..ef13747c19 100644 --- a/windows/configure/cortana-at-work-feedback.md +++ b/windows/configure/cortana-at-work-feedback.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. ![Cortana at work, showing how to provide feedback to Microsoft](images/cortana-feedback.png) diff --git a/windows/configure/cortana-at-work-o365.md b/windows/configure/cortana-at-work-o365.md index aee4f7337d..8f98e7d41e 100644 --- a/windows/configure/cortana-at-work-o365.md +++ b/windows/configure/cortana-at-work-o365.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. But Cortana works even harder when she connects to Office 365, helping employees to be notified about unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late. diff --git a/windows/configure/cortana-at-work-overview.md b/windows/configure/cortana-at-work-overview.md index fb138a6d24..cd6a9f342c 100644 --- a/windows/configure/cortana-at-work-overview.md +++ b/windows/configure/cortana-at-work-overview.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - ## Who is Cortana? Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. Cortana has powerful configuration options, specifically optimized for your business. By signing in with an Azure Active Directory (Azure AD) account, your employees can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work. diff --git a/windows/configure/cortana-at-work-policy-settings.md b/windows/configure/cortana-at-work-policy-settings.md index 5a347b3245..c02459c857 100644 --- a/windows/configure/cortana-at-work-policy-settings.md +++ b/windows/configure/cortana-at-work-policy-settings.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!NOTE] >For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). diff --git a/windows/configure/cortana-at-work-powerbi.md b/windows/configure/cortana-at-work-powerbi.md index b69282afa7..c54ea6fbe1 100644 --- a/windows/configure/cortana-at-work-powerbi.md +++ b/windows/configure/cortana-at-work-powerbi.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. >[!Note] diff --git a/windows/configure/cortana-at-work-scenario-1.md b/windows/configure/cortana-at-work-scenario-1.md index f8c78aeb5c..4ffecba39a 100644 --- a/windows/configure/cortana-at-work-scenario-1.md +++ b/windows/configure/cortana-at-work-scenario-1.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-2.md b/windows/configure/cortana-at-work-scenario-2.md index 9afdab45ec..afb9bfadc3 100644 --- a/windows/configure/cortana-at-work-scenario-2.md +++ b/windows/configure/cortana-at-work-scenario-2.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-3.md b/windows/configure/cortana-at-work-scenario-3.md index 2e187eb725..b6762f8941 100644 --- a/windows/configure/cortana-at-work-scenario-3.md +++ b/windows/configure/cortana-at-work-scenario-3.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-4.md b/windows/configure/cortana-at-work-scenario-4.md index 203093cb15..f9486414bc 100644 --- a/windows/configure/cortana-at-work-scenario-4.md +++ b/windows/configure/cortana-at-work-scenario-4.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-5.md b/windows/configure/cortana-at-work-scenario-5.md index 820acedc37..3af494f8fd 100644 --- a/windows/configure/cortana-at-work-scenario-5.md +++ b/windows/configure/cortana-at-work-scenario-5.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-6.md b/windows/configure/cortana-at-work-scenario-6.md index 2ad1c7cb5c..50bbbd1e85 100644 --- a/windows/configure/cortana-at-work-scenario-6.md +++ b/windows/configure/cortana-at-work-scenario-6.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). diff --git a/windows/configure/cortana-at-work-scenario-7.md b/windows/configure/cortana-at-work-scenario-7.md index e8d6cfd3ff..f19d753b85 100644 --- a/windows/configure/cortana-at-work-scenario-7.md +++ b/windows/configure/cortana-at-work-scenario-7.md @@ -13,9 +13,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-testing-scenarios.md b/windows/configure/cortana-at-work-testing-scenarios.md index d58e3e41e7..fc7ca43d11 100644 --- a/windows/configure/cortana-at-work-testing-scenarios.md +++ b/windows/configure/cortana-at-work-testing-scenarios.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: - [Sign-in to Cortana using Azure AD, manage entries in the notebook, and search for content across your device, Bing, and the cloud, using Cortana](cortana-at-work-scenario-1.md) diff --git a/windows/configure/cortana-at-work-voice-commands.md b/windows/configure/cortana-at-work-voice-commands.md index 1f081e3222..7d68e5a58e 100644 --- a/windows/configure/cortana-at-work-voice-commands.md +++ b/windows/configure/cortana-at-work-voice-commands.md @@ -14,9 +14,6 @@ localizationpriority: high - Windows 10, Windows Insider Program - Windows 10 Mobile, Windows Insider Program ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. >[!NOTE] From 43fcfdc71e335644a5969cfc621b999b6f1cdbb2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 11:51:28 -0700 Subject: [PATCH 153/165] Updated applies to --- browsers/edge/available-policies.md | 46 +++++++++---------- .../new-group-policy-settings-for-ie11.md | 2 +- windows/configure/cortana-at-work-crm.md | 4 +- windows/configure/cortana-at-work-feedback.md | 4 +- windows/configure/cortana-at-work-o365.md | 4 +- windows/configure/cortana-at-work-overview.md | 6 +-- .../cortana-at-work-policy-settings.md | 4 +- windows/configure/cortana-at-work-powerbi.md | 4 +- .../configure/cortana-at-work-scenario-1.md | 4 +- .../configure/cortana-at-work-scenario-2.md | 4 +- .../configure/cortana-at-work-scenario-3.md | 4 +- .../configure/cortana-at-work-scenario-4.md | 4 +- .../configure/cortana-at-work-scenario-5.md | 4 +- .../configure/cortana-at-work-scenario-6.md | 4 +- .../configure/cortana-at-work-scenario-7.md | 4 +- .../cortana-at-work-testing-scenarios.md | 4 +- .../cortana-at-work-voice-commands.md | 4 +- 17 files changed, 55 insertions(+), 55 deletions(-) diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 35594c3478..c52a45bbad 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -13,8 +13,8 @@ localizationpriority: high **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10 +- Windows 10 Mobile Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. @@ -27,7 +27,7 @@ By using Group Policy and Intune, you can set up a policy setting once, and then Microsoft Edge works with these Group Policy settings (`Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\`) to help you manage your company's web browser configurations: ### Allow Address bar drop-down list suggestions -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. @@ -48,7 +48,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, employees can't use Adobe Flash. ### Allow clearing browsing data on exit -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting allows the automatic clearing of browsing data when Microsoft Edge closes. @@ -92,7 +92,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable this setting, the Microsoft Compatibility List isn’t used during browser navigation. ### Allow search engine customization -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether users can change their search engine. @@ -115,7 +115,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose how new tabs appears. ### Configure additional search engines -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you add up to 5 additional search engines, which can't be removed by your employees, but can be made a personal default engine. This setting doesn't set the default search engine. For that, you must use the "Set default search engine" setting. @@ -222,7 +222,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), your default Start page is the webpage specified in App settings. ### Configure the Adobe Flash Click-to-Run setting -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether employees must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. @@ -258,7 +258,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you don’t configure this setting (default), employees can choose whether to use Windows Defender SmartScreen. ### Disable lockdown of Start pages -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you disable the lock down of Start pages, letting employees modify the Start pages when the "Configure Start pages" setting is in effect. @@ -270,7 +270,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), employees can't change any Start pages configured using the "Configure Start pages" setting, thereby locking down the Start pages. ### Keep favorites in sync between Internet Explorer and Microsoft Edge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This setting lets you decide whether people can sync their favorites between Internet Explorer and Microsoft Edge. @@ -306,7 +306,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), employees can ignore Windows Defender SmartScreen warnings and continue to the site. ### Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. @@ -315,7 +315,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don't configure this setting (default), Microsoft Edge gathers the Live Tile metadata, providing a fuller and more complete experience when a user pins a Live Tile to the Start menu. ### Prevent the First Run webpage from opening on Microsoft Edge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you decide whether employees see Microsoft's First Run webpage when opening Microsoft Edge for the first time. @@ -342,7 +342,7 @@ Microsoft Edge works with these Group Policy settings (`Computer Configuration\A - If you disable or don’t configure this setting (default), all websites, including intranet sites, are automatically opened using Microsoft Edge. ### Set default search engine -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Description:** This policy setting lets you configure the default search engine for your employees. Employees can change the default search engine at any time unless you disable the "Allow search engine customization" setting, which restricts any changes. @@ -379,7 +379,7 @@ If you manage your policies using Intune, you'll want to use these MDM policy se All devices must be enrolled with Intune if you want to use the Windows Custom URI Policy. ### AllowAddressBarDropdown -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop @@ -517,7 +517,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Allowed. Employees can use Adobe Flash. ### AllowFlashClickToRun -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop| @@ -551,7 +551,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1 (default).** Employees can use InPrivate browsing. ### AllowMicrosoftCompatibilityList -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -602,7 +602,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Pop-up Blocker, stopping pop-up windows. ### AllowSearchEngineCustomization -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -654,7 +654,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Turns on Windows Defender SmartScreen, providing warning messages to your employees about potential phishing scams and malicious software. ### ClearBrowsingDataOnExit -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -671,7 +671,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Browsing data is cleared on exit. ### ConfigureAdditionalSearchEngines -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -688,7 +688,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Additional search engines are allowed. ### DisableLockdownOfStartPages -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop @@ -804,7 +804,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees can't access the about:flags page in Microsoft Edge. ### PreventFirstRunPage -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -821,7 +821,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Employees don't see the First Run webpage. ### PreventLiveTileDataCollection -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -906,7 +906,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Automatically opens all intranet sites using Internet Explorer 11. ### SetDefaultSearchEngine -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Both @@ -940,7 +940,7 @@ All devices must be enrolled with Intune if you want to use the Windows Custom U - **1.** Shows an additional page in Microsoft Edge, stating that a site has been opened using Internet Explorer 11. ### SyncFavoritesBetweenIEAndMicrosoftEdge -- **Supported versions:** Windows 10, Windows Insider Program +- **Supported versions:** Windows 10, version 1703 - **Supported devices:** Desktop diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md index 149ef61a09..54b1f1eb74 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md @@ -25,7 +25,7 @@ Internet Explorer 11 gives you some new Group Policy settings to help you manag |Always send Do Not Track header |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.

          If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.

          **In Internet Explorer 9 and 10:**
          If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.

          **In at least IE11:**
          If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.

          If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced* tab of the **Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. | |Don't run antimalware programs against ActiveX controls
          (Internet, Restricted Zones) |

          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
          |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

          If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

          If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

          If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. | |Don't run antimalware programs against ActiveX controls
          (Intranet, Trusted, Local Machine Zones) |

          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
          • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
          |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

          If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

          If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

          If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. | -|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, Windows Insider Program |This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

          If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

          If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

          If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | +|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, version 1703|This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.

          If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.

          If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.

          If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. | |Let users turn on and use Enterprise Mode from the **Tools** menu |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.

          If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.

          If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. | |Limit Site Discovery output by Domain |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

          If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.

          If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.

          **Note:**
          You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | |Limit Site Discovery output by Zone |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.

          If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.

          If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.

          To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

          • 0 – Restricted Sites zone
          • 0 – Internet zone
          • 0 – Trusted Sites zone
          • 0 – Local Intranet zone
          • 0 – Local Machine zone

          **Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
          • 0 – Restricted Sites zone
          • 0 – Internet zone
          • 0 – Trusted Sites zone
          • 1 – Local Intranet zone
          • 0 – Local Machine zone

          **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
          • 1 – Restricted Sites zone
          • 0 – Internet zone
          • 1 – Trusted Sites zone
          • 1 – Local Intranet zone
          • 1 – Local Machine zone

          **Note:**
          You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. | diff --git a/windows/configure/cortana-at-work-crm.md b/windows/configure/cortana-at-work-crm.md index c5ca8136b1..4bfca8e08c 100644 --- a/windows/configure/cortana-at-work-crm.md +++ b/windows/configure/cortana-at-work-crm.md @@ -11,8 +11,8 @@ localizationpriority: high # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company. diff --git a/windows/configure/cortana-at-work-feedback.md b/windows/configure/cortana-at-work-feedback.md index ef13747c19..38e531cdca 100644 --- a/windows/configure/cortana-at-work-feedback.md +++ b/windows/configure/cortana-at-work-feedback.md @@ -11,8 +11,8 @@ localizationpriority: high # Send feedback about Cortana at work back to Microsoft **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems. diff --git a/windows/configure/cortana-at-work-o365.md b/windows/configure/cortana-at-work-o365.md index 8f98e7d41e..be3a27e0f3 100644 --- a/windows/configure/cortana-at-work-o365.md +++ b/windows/configure/cortana-at-work-o365.md @@ -11,8 +11,8 @@ localizationpriority: high # Set up and test Cortana with Office 365 in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips. diff --git a/windows/configure/cortana-at-work-overview.md b/windows/configure/cortana-at-work-overview.md index cd6a9f342c..953acf4354 100644 --- a/windows/configure/cortana-at-work-overview.md +++ b/windows/configure/cortana-at-work-overview.md @@ -11,8 +11,8 @@ localizationpriority: high # Cortana integration in your business or enterprise **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 ## Who is Cortana? Cortana is Microsoft’s personal digital assistant, who helps busy people get things done, even while at work. @@ -39,7 +39,7 @@ Cortana requires the following hardware and software to successfully run the inc |Software |Minimum version | |---------|------------| -|Client operating system |

          • **Desktop:** Windows 10, Windows Insider Program
          • **Mobile:** Windows 8.1, Windows Insider Program (with limited functionality)
            • | +|Client operating system |
            • **Desktop:** Windows 10, Windows Insider Program
            • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
              • | |Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

              For example:

              If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

              If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | |Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md)

              If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| diff --git a/windows/configure/cortana-at-work-policy-settings.md b/windows/configure/cortana-at-work-policy-settings.md index c02459c857..fabe225293 100644 --- a/windows/configure/cortana-at-work-policy-settings.md +++ b/windows/configure/cortana-at-work-policy-settings.md @@ -11,8 +11,8 @@ localizationpriority: high # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!NOTE] >For specific info about how to set, manage, and use each of these MDM policies to configure Cortana in your enterprise, see the [Policy CSP](http://go.microsoft.com/fwlink/p/?LinkId=717380) topic, located in the configuration service provider reference topics. For specific info about how to set, manage, and use each of these Group Policies to configure Cortana in your enterprise, see the [Group Policy TechCenter](http://go.microsoft.com/fwlink/p/?LinkId=717381). diff --git a/windows/configure/cortana-at-work-powerbi.md b/windows/configure/cortana-at-work-powerbi.md index c54ea6fbe1..9160118179 100644 --- a/windows/configure/cortana-at-work-powerbi.md +++ b/windows/configure/cortana-at-work-powerbi.md @@ -11,8 +11,8 @@ localizationpriority: high # Set up and test Cortana for Power BI in your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 Integration between Cortana and Power BI shows how Cortana can work with custom business analytics solutions to enable you to get answers directly from your key business data, including introducing new features that let you create custom Cortana “answers” using the full capabilities of Power BI Desktop. diff --git a/windows/configure/cortana-at-work-scenario-1.md b/windows/configure/cortana-at-work-scenario-1.md index 4ffecba39a..869f6285f7 100644 --- a/windows/configure/cortana-at-work-scenario-1.md +++ b/windows/configure/cortana-at-work-scenario-1.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-2.md b/windows/configure/cortana-at-work-scenario-2.md index afb9bfadc3..0ae41c64a4 100644 --- a/windows/configure/cortana-at-work-scenario-2.md +++ b/windows/configure/cortana-at-work-scenario-2.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 2 - Perform a quick search with Cortana at work -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-3.md b/windows/configure/cortana-at-work-scenario-3.md index b6762f8941..2200f6b5f9 100644 --- a/windows/configure/cortana-at-work-scenario-3.md +++ b/windows/configure/cortana-at-work-scenario-3.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 3 - Set a reminder for a specific location using Cortana at work -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-4.md b/windows/configure/cortana-at-work-scenario-4.md index f9486414bc..736de5db9f 100644 --- a/windows/configure/cortana-at-work-scenario-4.md +++ b/windows/configure/cortana-at-work-scenario-4.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 4 - Use Cortana at work to find your upcoming meetings -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-5.md b/windows/configure/cortana-at-work-scenario-5.md index 3af494f8fd..a662de7d04 100644 --- a/windows/configure/cortana-at-work-scenario-5.md +++ b/windows/configure/cortana-at-work-scenario-5.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 5 - Use Cortana to send email to a co-worker -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-scenario-6.md b/windows/configure/cortana-at-work-scenario-6.md index 50bbbd1e85..8c7e307ed1 100644 --- a/windows/configure/cortana-at-work-scenario-6.md +++ b/windows/configure/cortana-at-work-scenario-6.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). diff --git a/windows/configure/cortana-at-work-scenario-7.md b/windows/configure/cortana-at-work-scenario-7.md index f19d753b85..4c2451c969 100644 --- a/windows/configure/cortana-at-work-scenario-7.md +++ b/windows/configure/cortana-at-work-scenario-7.md @@ -10,8 +10,8 @@ localizationpriority: high # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 >[!IMPORTANT] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configure/cortana-at-work-testing-scenarios.md b/windows/configure/cortana-at-work-testing-scenarios.md index fc7ca43d11..fa88b44c54 100644 --- a/windows/configure/cortana-at-work-testing-scenarios.md +++ b/windows/configure/cortana-at-work-testing-scenarios.md @@ -11,8 +11,8 @@ localizationpriority: high # Testing scenarios using Cortana in your business or organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: diff --git a/windows/configure/cortana-at-work-voice-commands.md b/windows/configure/cortana-at-work-voice-commands.md index 7d68e5a58e..e15752085d 100644 --- a/windows/configure/cortana-at-work-voice-commands.md +++ b/windows/configure/cortana-at-work-voice-commands.md @@ -11,8 +11,8 @@ localizationpriority: high # Set up and test custom voice commands in Cortana for your organization **Applies to:** -- Windows 10, Windows Insider Program -- Windows 10 Mobile, Windows Insider Program +- Windows 10, version 1703 +- Windows 10 Mobile, version 1703 Working with a developer, you can create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. These voice-enabled actions can reduce the time necessary to access your apps and to complete simple actions. From 003272f4293625b7cf6a9b465d73bd9cd5de63b4 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 12:04:55 -0700 Subject: [PATCH 154/165] Updating applies to --- .../ie-setup-command-line-options-and-return-codes.md | 2 +- windows/configure/cortana-at-work-overview.md | 4 ++-- windows/configure/cortana-at-work-powerbi.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md index 9bb18ee1b1..f1a75a85d0 100644 --- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md +++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md @@ -46,7 +46,7 @@ These command-line options work with IE Setup: ## Windows Setup return and status codes -Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged insider your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. +Windows Setup needs to tell you whether IE successfully installed. However, because IE11wzd.exe is packaged inside your IE11setup.exe file, the return codes can’t be sent directly back to you. Instead, Setup needs to return the information (both success and failure) to the `HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\InstallInfo` registry branch. |Subkey |Data type |Value | |---------|----------|---------------------------------------| diff --git a/windows/configure/cortana-at-work-overview.md b/windows/configure/cortana-at-work-overview.md index 953acf4354..9202776ada 100644 --- a/windows/configure/cortana-at-work-overview.md +++ b/windows/configure/cortana-at-work-overview.md @@ -25,7 +25,7 @@ Using Azure AD also means that you can remove an employee’s profile (for examp ## Where is Cortana available for use in my organization? You can use Cortana at work in all countries/regions where Cortana is supported for consumers. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, she will also become available to enterprise customers. -Cortana is available on Windows 10, Windows Insider Program and with limited functionality on Windows Phone 8.1, Windows Insider Program. +Cortana is available on Windows 10, version 1703 and with limited functionality on Windows 10 Mobile, version 1703. ## Required hardware and software Cortana requires the following hardware and software to successfully run the included scenario in your organization. @@ -39,7 +39,7 @@ Cortana requires the following hardware and software to successfully run the inc |Software |Minimum version | |---------|------------| -|Client operating system |

              • **Desktop:** Windows 10, Windows Insider Program
              • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
                • | +|Client operating system |
                • **Desktop:** Windows 10, version 1703
                • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
                  • | |Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

                  For example:

                  If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

                  If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | |Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](../keep-secure/protect-enterprise-data-using-wip.md)

                  If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| diff --git a/windows/configure/cortana-at-work-powerbi.md b/windows/configure/cortana-at-work-powerbi.md index 9160118179..a4245062b7 100644 --- a/windows/configure/cortana-at-work-powerbi.md +++ b/windows/configure/cortana-at-work-powerbi.md @@ -22,7 +22,7 @@ Integration between Cortana and Power BI shows how Cortana can work with custom ## Before you begin To use this walkthrough, you’ll need: -- **Windows 10**. You’ll need to be running at least Windows 10 with the latest version from the Windows Insider Program. +- **Windows 10**. You’ll need to be running at least Windows 10, version 1703. - **Cortana**. You need to have Cortana turned on and be logged into your account. From be0d7bbd1ed8eb6195711140411198bafa3d593f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 31 Mar 2017 12:10:49 -0700 Subject: [PATCH 155/165] Updated applies to --- .../add-apps-to-protected-list-using-custom-uri.md | 2 +- windows/keep-secure/app-behavior-with-wip.md | 2 +- windows/keep-secure/enlightened-microsoft-apps-and-wip.md | 2 +- windows/keep-secure/guidance-and-best-practices-wip.md | 2 +- windows/keep-secure/mandatory-settings-for-wip.md | 2 +- windows/keep-secure/overview-create-wip-policy.md | 2 +- windows/keep-secure/protect-enterprise-data-using-wip.md | 4 ++-- .../keep-secure/recommended-network-definitions-for-wip.md | 2 +- windows/keep-secure/testing-scenarios-for-wip.md | 2 +- windows/keep-secure/using-owa-with-wip.md | 2 +- windows/keep-secure/wip-app-enterprise-context.md | 2 +- 11 files changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index b0396cdfd0..ca83fa4210 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -14,7 +14,7 @@ localizationpriority: high # Add apps to your Windows Information Protection (WIP) policy by using the Microsoft Intune custom URI functionality **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile You can add apps to your Windows Information Protection (WIP) protected app list using the Microsoft Intune custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, [Windows 10 custom policy settings in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=691330). diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index edf4af5b1b..d436e1e7a7 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -13,7 +13,7 @@ localizationpriority: high # Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. diff --git a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md index f2e1b3c91c..5555cd3892 100644 --- a/windows/keep-secure/enlightened-microsoft-apps-and-wip.md +++ b/windows/keep-secure/enlightened-microsoft-apps-and-wip.md @@ -15,7 +15,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index ff64be6d0f..3294599cd2 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # General guidance and best practices for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 8ab1cccc68..856216aac1 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -13,7 +13,7 @@ localizationpriority: high # Mandatory tasks and settings required to turn on Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1703 +- Windows 10, version 1607 and later - Windows 10 Mobile This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. diff --git a/windows/keep-secure/overview-create-wip-policy.md b/windows/keep-secure/overview-create-wip-policy.md index c3ad6bf5a3..b2b23e5275 100644 --- a/windows/keep-secure/overview-create-wip-policy.md +++ b/windows/keep-secure/overview-create-wip-policy.md @@ -13,7 +13,7 @@ localizationpriority: high # Create a Windows Information Protection (WIP) policy **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. diff --git a/windows/keep-secure/protect-enterprise-data-using-wip.md b/windows/keep-secure/protect-enterprise-data-using-wip.md index 7f5e04babd..0a8a8d62ea 100644 --- a/windows/keep-secure/protect-enterprise-data-using-wip.md +++ b/windows/keep-secure/protect-enterprise-data-using-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Protect your enterprise data using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). @@ -28,7 +28,7 @@ You’ll need this software to run WIP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10, version 1607 | Microsoft Intune
                  -OR-
                  System Center Configuration Manager
                  -OR-
                  Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10, version 1607 or later | Microsoft Intune
                  -OR-
                  System Center Configuration Manager
                  -OR-
                  Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| ## What is enterprise data control? Effective collaboration means that you need to share data with others in your enterprise. This sharing can be from one extreme where everyone has access to everything without any security, all the way to the other extreme where people can’t share anything and it’s all highly secured. Most enterprises fall somewhere in between the two extremes, where success is balanced between providing the necessary access with the potential for improper data disclosure. diff --git a/windows/keep-secure/recommended-network-definitions-for-wip.md b/windows/keep-secure/recommended-network-definitions-for-wip.md index b7b8ab7a18..ca34c042a9 100644 --- a/windows/keep-secure/recommended-network-definitions-for-wip.md +++ b/windows/keep-secure/recommended-network-definitions-for-wip.md @@ -14,7 +14,7 @@ localizationpriority: high **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/testing-scenarios-for-wip.md b/windows/keep-secure/testing-scenarios-for-wip.md index cca0a2fa52..81e9282bd3 100644 --- a/windows/keep-secure/testing-scenarios-for-wip.md +++ b/windows/keep-secure/testing-scenarios-for-wip.md @@ -14,7 +14,7 @@ localizationpriority: high # Testing scenarios for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index 9ebb14e657..daa6be5167 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -13,7 +13,7 @@ localizationpriority: high # Using Outlook Web Access with Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). diff --git a/windows/keep-secure/wip-app-enterprise-context.md b/windows/keep-secure/wip-app-enterprise-context.md index e8d03a3768..107cfa5c1f 100644 --- a/windows/keep-secure/wip-app-enterprise-context.md +++ b/windows/keep-secure/wip-app-enterprise-context.md @@ -13,7 +13,7 @@ localizationpriority: high # Determine the Enterprise Context of an app running in Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 +- Windows 10, version 1607 and later - Windows 10 Mobile >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). From 18dacc1fa34a8488b2d806a8880e58bddf74e54c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 12:57:54 -0700 Subject: [PATCH 156/165] update change history --- windows/configure/change-history-for-configure-windows-10.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/configure/change-history-for-configure-windows-10.md b/windows/configure/change-history-for-configure-windows-10.md index 4706cf6049..8115141128 100644 --- a/windows/configure/change-history-for-configure-windows-10.md +++ b/windows/configure/change-history-for-configure-windows-10.md @@ -17,4 +17,7 @@ This topic lists new and updated topics in the [Configure Windows 10](index.md) ## RELEASE: Windows 10, version 1703 -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). \ No newline at end of file +The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). These topics were previously published in the [Deploy Windows 10](../deploy/index.md) or [Manage and update Windows 10](../manage/index.md) sections. The following new topics have been added: + +- [Use the Lockdown Designer app to create a Lockdown XML file](mobile-lockdown-designer.md) +- [Add image for secondary tiles](start-secondary-tiles.md) From cc119805d0e7bf34ae10582a142ba84be216590e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 12:58:45 -0700 Subject: [PATCH 157/165] +link --- windows/configure/change-history-for-configure-windows-10.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/configure/change-history-for-configure-windows-10.md b/windows/configure/change-history-for-configure-windows-10.md index 8115141128..aa5be0aab7 100644 --- a/windows/configure/change-history-for-configure-windows-10.md +++ b/windows/configure/change-history-for-configure-windows-10.md @@ -21,3 +21,4 @@ The topics in this library have been updated for Windows 10, version 1703 (also - [Use the Lockdown Designer app to create a Lockdown XML file](mobile-lockdown-designer.md) - [Add image for secondary tiles](start-secondary-tiles.md) +- [Provision PCs with apps](provision-pcs-with-apps.md) \ No newline at end of file From 01fe9c26a063a830d60c375300396b4b4e631d5c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 13:02:01 -0700 Subject: [PATCH 158/165] cmdlet correction --- windows/configure/start-secondary-tiles.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configure/start-secondary-tiles.md b/windows/configure/start-secondary-tiles.md index ab51c826f2..4e9328e91b 100644 --- a/windows/configure/start-secondary-tiles.md +++ b/windows/configure/start-secondary-tiles.md @@ -44,7 +44,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE 2. Open Windows PowerShell and enter the following command: ``` - export-startlayout -path .xml + Export-StartLayout -path .xml ``` In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). @@ -59,7 +59,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE 4. In Windows PowerShell, enter the following command: ``` - export-StartLayoutEdgeAssets assets.xml + Export-StartLayoutEdgeAssets assets.xml ``` ## Configure policy settings From 2550d45b6ca9fdc4ff32a38d5dfb856768f67de0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 13:08:27 -0700 Subject: [PATCH 159/165] missing link --- windows/configure/provisioning-script-to-install-app.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configure/provisioning-script-to-install-app.md b/windows/configure/provisioning-script-to-install-app.md index 639ca1ea2f..0e47014f47 100644 --- a/windows/configure/provisioning-script-to-install-app.md +++ b/windows/configure/provisioning-script-to-install-app.md @@ -16,7 +16,7 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -This walkthrough describes how to leverage the ability to include scripts in a Windows 10 provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed, however, some care is needed in order to avoid unintended behavior during script execution (see Remarks below). +This walkthrough describes how to leverage the ability to include scripts in a Windows 10 provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed, however, some care is needed in order to avoid unintended behavior during script execution (see [Remarks](#remarks) below). >**Prerequisite**: [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), version 1511 or higher From 310705b24115b32030f7e945d25b1afd40ff86d5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 31 Mar 2017 13:42:44 -0700 Subject: [PATCH 160/165] remove en-us --- windows/index.md | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/index.md b/windows/index.md index dad59e644a..50d0140341 100644 --- a/windows/index.md +++ b/windows/index.md @@ -12,30 +12,30 @@ author: brianlic-msft This library provides the core content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10 or Windows 10 Mobile.

                  - + -
                  - - Read what's new in Windows 10 + + Read what's new in Windows 10
                  What's New?                   		- + Plan your Windows 10 enterprise deployment
                  Plan                   		- + Deploy Windows 10 in your enterprise
                  Deploy                   		- + Manage Windows 10 in your enterprise
                  Manage @@ -44,47 +44,47 @@ This library provides the core content that IT pros need to evaluate, plan, depl

                  - + Keep Windows 10 secure
                  Keep Secure
                  - + Configure Windows 10 in your enterprise
                  Configure
                  - + Update Windows 10 in your enterprise
                  Update
                  - - Try Windows 10 + + Try Windows 10
                  Try it
                  + -## Get to know Windows as a Service (WaaS) - +## Get to know Windows as a Service (WaaS) +
                  - - +
                  The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. + The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. - These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - - Read more about Windows as a Service - - - Download the WaaS infographic + These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. + - [Read more about Windows as a Service](manage/waas-overview.md) + + - Download the WaaS infographic
                  Get to know Windows as a Service (WaaS)
                  Get to know Windows as a Service (WaaS)
                  From 5a7b64eefc3ca80bbb59e492b7ab3ecdfa856a21 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Sun, 2 Apr 2017 09:23:16 -0700 Subject: [PATCH 161/165] fixed typo in heading --- windows/keep-secure/bitlocker-group-policy-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/bitlocker-group-policy-settings.md b/windows/keep-secure/bitlocker-group-policy-settings.md index c16db3871b..8f5aa0a1af 100644 --- a/windows/keep-secure/bitlocker-group-policy-settings.md +++ b/windows/keep-secure/bitlocker-group-policy-settings.md @@ -32,7 +32,7 @@ The following sections provide a comprehensive list of BitLocker Group Policy se The following policy settings can be used to determine how a BitLocker-protected drive can be unlocked. -- [Allow devices with Secure Boot and protect DMA ports to opt out of preboot PIN](#bkmk-hstioptout) +- [Allow devices with Secure Boot and protected DMA ports to opt out of preboot PIN](#bkmk-hstioptout) - [Allow network unlock at startup](#bkmk-netunlock) - [Require additional authentication at startup](#bkmk-unlockpol1) - [Allow enhanced PINs for startup](#bkmk-unlockpol2) @@ -86,7 +86,7 @@ The following policies are used to support customized deployment scenarios in yo - [Allow access to BitLocker-protected fixed data drives from earlier versions of Windows](#bkmk-depopt4) - [Allow access to BitLocker-protected removable data drives from earlier versions of Windows](#bkmk-depopt5) -### Allow devices with Secure Boot and protect DMA ports to opt out of preboot PIN +### Allow devices with Secure Boot and protected DMA ports to opt out of preboot PIN This policy setting allows users on devices that are compliant with InstantGo or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. From 52fd405848591088dd2bcb1bd61c49a92bd343bc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 3 Apr 2017 07:27:13 -0700 Subject: [PATCH 162/165] Jordan feedback --- devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md | 1 + 1 file changed, 1 insertion(+) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 1954027d43..d09ae96714 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -97,6 +97,7 @@ The following tables include info on Windows 10 settings that have been validate | Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
                  | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | | Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
                  . | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | | Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
                  | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | +| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
                  [Use a custom policy.](#example-intune) | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. #### Browser settings From 6404a519b7382290564745d3e456021445b2e5ea Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 3 Apr 2017 08:03:34 -0700 Subject: [PATCH 163/165] remove en-us --- devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index d09ae96714..0dcd527405 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -97,7 +97,7 @@ The following tables include info on Windows 10 settings that have been validate | Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
                  | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | | Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
                  . | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | | Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
                  | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | -| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/en-us/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
                  [Use a custom policy.](#example-intune) | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | +| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
                  [Use a custom policy.](#example-intune) | Yes.
                  [Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. #### Browser settings From a9e04d3cba011dceeb34408f898a97cd4f2d5f65 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 3 Apr 2017 09:23:12 -0700 Subject: [PATCH 164/165] Bl 10743059 (#522) new content * checkpoint * test * checkin * checkpoint * testing * testing * adding census * checkpoint * checkin * checkpoint * testing new version * second upate * typos * fixed heading * more tpos * edits * added mon field * new draft * draft 03152017 * typo * added preupgradesettings and postupgradesettings * scrubbing descriptions * renaming file * updating text * update * updating applies to * updating locationsyncenabled description * removing old events --- windows/configure/TOC.md | 1 + ...el-windows-diagnostic-events-and-fields.md | 4231 +++++++++++++++++ 2 files changed, 4232 insertions(+) create mode 100644 windows/configure/basic-level-windows-diagnostic-events-and-fields.md diff --git a/windows/configure/TOC.md b/windows/configure/TOC.md index b284277953..31156eef01 100644 --- a/windows/configure/TOC.md +++ b/windows/configure/TOC.md @@ -1,5 +1,6 @@ # [Configure Windows 10](index.md) ## [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) +## [Basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) ## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) ## [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) ## [Configure kiosk and shared devices running Windows 10 desktop editions](kiosk-shared-pc.md) diff --git a/windows/configure/basic-level-windows-diagnostic-events-and-fields.md b/windows/configure/basic-level-windows-diagnostic-events-and-fields.md new file mode 100644 index 0000000000..b4ab6e6bbb --- /dev/null +++ b/windows/configure/basic-level-windows-diagnostic-events-and-fields.md @@ -0,0 +1,4231 @@ +--- +description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. +title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10) +keywords: privacy, telemetry +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +ms.author: brianlic +--- + + +# Windows 10, version 1703 basic level Windows diagnostic events and fields + + + **Applies to** + +- Windows 10, version 1703 + + +The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information. + +The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. + +Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. + +You can learn more about Windows functional and diagnostic data through these articles: + + +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) +- [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) + + + + +## Common data extensions + +### Common Data Extensions.App + + + +The following fields are available: + +- **expId** Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event. +- **userId** The userID as known by the application. +- **env** The environment from which the event was logged. +- **asId** An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session. + + +### Common Data Extensions.CS + + + +The following fields are available: + +- **sig** A common schema signature that identifies new and modified event schemas. + + +### Common Data Extensions.CUET + + + +The following fields are available: + +- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. +- **aId** Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW. +- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW. +- **op** Represents the ETW Op Code. +- **cat** Represents a bitmask of the ETW Keywords associated with the event. +- **flags** Represents the bitmap that captures various Windows specific flags. +- **cpId** The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer. +- **tickets** A list of strings that represent entries in the HTTP header of the web request that includes this event. +- **bseq** Upload buffer sequence number in the format \:\ +- **mon** Combined monitor and event sequence numbers in the format \:\ + + +### Common Data Extensions.Device + + + +The following fields are available: + +- **ver** Represents the major and minor version of the extension. +- **localId** Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId +- **deviceClass** Represents the classification of the device, the device “family”.  For example, Desktop, Server, or Mobile. + + +### Common Data Extensions.Envelope + + + +The following fields are available: + +- **ver** Represents the major and minor version of the extension. +- **name** Represents the uniquely qualified name for the event. +- **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. +- **popSample** Represents the effective sample rate for this event at the time it was generated by a client. +- **epoch** Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **seqNum** Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue.  The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server. +- **iKey** Represents an ID for applications or other logical groupings of events. +- **flags** Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency. +- **os** Represents the operating system name. +- **osVer** Represents the OS version, and its format is OS dependent. +- **appId** Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application. +- **appVer** Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app. +- **cV** Represents the Correlation Vector: A single field for tracking partial order of related telemetry events across component boundaries. + + +### Common Data Extensions.OS + + + +The following fields are available: + +- **ver** Represents the major and minor version of the extension. +- **expId** Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema. +- **locale** Represents the locale of the operating system. +- **bootId** An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot. + + +### Common Data Extensions.User + + + +The following fields are available: + +- **ver** Represents the major and minor version of the extension. +- **localId** Represents a unique user identity that is created locally and added by the client. This is not the user's account ID. + + +### Common Data Extensions.XBL + + + +The following fields are available: + +- **nbf** Not before time +- **expId** Expiration time +- **sbx** XBOX sandbox identifier +- **dty** XBOX device type +- **did** XBOX device ID +- **xid** A list of base10-encoded XBOX User IDs. +- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. + + +### Common Data Extensions.Consent UI Event + +This User Account Control (UAC) telemetry point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level (IL) requires higher (administrator) privileges, and therefore requests for elevation via UAC (consent.exe). By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path. + +The following fields are available: + +- **eventType** Represents the type of elevation: If it succeeded, was cancelled, or was auto-approved. +- **splitToken** Represents the flag used to distinguish between administrators and standard users. +- **friendlyName** Represents the name of the file requesting elevation from low IL. +- **elevationReason** Represents the distinction between various elevation requests sources (appcompat, installer, COM, MSI and so on). +- **exeName** Represents the name of the file requesting elevation from low IL. +- **signatureState** Represents the state of the signature, if it signed, unsigned, OS signed and so on. +- **publisherName** Represents the name of the publisher of the file requesting elevation from low IL. +- **cmdLine** Represents the full command line arguments being used to elevate. +- **Hash.Length** Represents the length of the hash of the file requesting elevation from low IL. +- **Hash** Represents the hash of the file requesting elevation from low IL. +- **HashAlgId** Represents the algorithm ID of the hash of the file requesting elevation from low IL. +- **telemetryFlags** Represents the details about the elevation prompt for CEIP data. +- **timeStamp** Represents the time stamp on the file requesting elevation. +- **fileVersionMS** Represents the major version of the file requesting elevation. +- **fileVersionLS** Represents the minor version of the file requesting elevation. + + +## Common data fields + +### Common Data Fields.MS.Device.DeviceInventory.Change + +These fields are added whenever Ms.Device.DeviceInventoryChange is included in the event. + +The following fields are available: + +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. +- **objectInstanceId** Object identity used within the device scope. This is commonly going to be ProgramId, FileId or DeviceInstancePathId but is typically something unique to the objectType and in some cases is artificially created. +- **objectType** Indicates the object type that the event applies to. +- **Action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing + + +### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PreUpgradeSettings + +These fields are added whenever PreUpgradeSettings is included in the event. + +The following fields are available: + +- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service before the feature update completed. +- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device. +- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on before the feature update completed. +- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user. +- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed. +- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device. +- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device before the feature update completed. +- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device. +- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user before the feature update completed. +- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user. +- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device before the feature update. +- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device. +- **HKLM_TIPC.Enabled** The state of TIPC for the device. +- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device. +- **HKCU_TIPC.Enabled** The state of TIPC for the current user. +- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user. +- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device before the feature update was completed? +- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device. +- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user before the feature update was completed? +- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user. +- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed? +- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user. +- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device? +- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device. +- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user? +- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user. + + +### Common Data Fields.TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate.PostUpgradeSettings + +These fields are added whenever PostUpgradeSettings is included in the event. + +The following fields are available: + +- **HKLM_SensorPermissionState.SensorPermissionState** The state of the Location service after the feature update has completed. +- **HKLM_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the device. +- **HKCU_SensorPermissionState.SensorPermissionState** The state of the Location service when a user signs on after a feature update has completed. +- **HKCU_SensorPermissionState.HRESULT** The error code returned when trying to query the Location service for the current user. +- **HKLM_LocationPlatform.Status** The state of the location platform after the feature update has completed. +- **HKLM_LocationPlatform.HRESULT** The error code returned when trying to query the location platform for the device. +- **HKLM_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the device after the feature update has completed. +- **HKLM_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the device. +- **HKCU_LocationSyncEnabled.AcceptedPrivacyPolicy** The speech recognition state for the current user after the feature update has completed. +- **HKCU_LocationSyncEnabled.HRESULT** The error code returned when trying to query the Find My Device service for the current user. +- **HKLM_AllowTelemetry.AllowTelemetry** The state of the Connected User Experiences and Telemetry component for the device after the feature update. +- **HKLM_AllowTelemetry.HRESULT** The error code returned when trying to query the Connected User Experiences and Telemetry conponent for the device. +- **HKLM_TIPC.Enabled** The state of TIPC for the device. +- **HKLM_TIPC.HRESULT** The error code returned when trying to query TIPC for the device. +- **HKCU_TIPC.Enabled** The state of TIPC for the current user. +- **HKCU_TIPC.HRESULT** The error code returned when trying to query TIPC for the current user. +- **HKLM_FlipAhead.FPEnabled** Is Flip Ahead enabled for the device after the feature update has completed? +- **HKLM_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the device. +- **HKCU_FlipAhead.FPEnabled** Is Flip Ahead enabled for the current user after the feature update has completed? +- **HKCU_FlipAhead.HRESULT** The error code returned when trying to query Flip Ahead for the current user. +- **HKLM_TailoredExperiences.TailoredExperiencesWithDiagnosticDataEnabled** Is Tailored Experiences with Diagnostics Data enabled for the current user after the feature update had completed? +- **HKCU_TailoredExperiences.HRESULT** The error code returned when trying to query Tailored Experiences with Diagnostics Data for the current user. +- **HKLM_AdvertisingID.Enabled** Is the adveristing ID enabled for the device? +- **HKLM_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the device. +- **HKCU_AdvertisingID.Enabled** Is the adveristing ID enabled for the current user? +- **HKCU_AdvertisingID.HRESULT** The error code returned when trying to query the state of the advertising ID for the user. + + +## Appraiser events + +### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount + +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. + +The following fields are available: + +- **PCFP** An ID for the system that is calculated by hashing hardware identifiers. +- **InventoryApplicationFile** The total InventoryApplicationFile objects that are present on this device. +- **InventoryMediaCenter** The total InventoryMediaCenter objects that are present on this device. +- **InventoryLanguagePack** The total InventoryLanguagePack objects that are present on this device. +- **InventoryUplevelDriverPackage** The total InventoryUplevelDriverPackage objects that are present on this device. +- **InventorySystemBios** The total InventorySystemBios objects that are present on this device. +- **SystemProcessorCompareExchange** The total SystemProcessorCompareExchange objects that are present on this device. +- **SystemProcessorLahfSahf** The total SystemProcessorLahfSahf objects that are present on this device. +- **SystemMemory** The total SystemMemory objects that are present on this device. +- **SystemProcessorPrefetchW** The total SystemProcessorPrefetchW objects that are present on this device. +- **SystemProcessorSse2** The total SystemProcessorSse2 objects that are present on this device. +- **SystemProcessorNx** The total SystemProcessorNx objects that are present on this device. +- **SystemWlan** The total SystemWlan objects that are present on this device. +- **SystemWim** The total SystemWim objects that are present on this device +- **SystemTouch** The total SystemTouch objects that are present on this device. +- **SystemWindowsActivationStatus** The total SystemWindowsActivationStatus objects that are present on this device. + + +### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureIdHashSha256 + +This event lists the types of objects and the hashed values of all the identifiers for each one. This allows for a more in-depth way to ensure that the records present on the server match what is present on the client. + +The following fields are available: + +- **PCFP** An ID for the system that is calculated by hashing hardware identifiers. +- **InventoryApplicationFile** The SHA256 hash of InventoryApplicationFile objects that are present on this device. +- **InventoryMediaCenter** The SHA256 hash of InventoryMediaCenter objects that are present on this device. +- **InventoryLanguagePack** The SHA256 hash of InventoryLanguagePack objects that are present on this device. +- **InventoryUplevelDriverPackage** The SHA256 hash of InventoryUplevelDriverPackage objects that are present on this device. +- **InventorySystemBios** The SHA256 hash of InventorySystemBios objects that are present on this device. +- **SystemProcessorCompareExchange** The SHA256 hash of SystemProcessorCompareExchange objects that are present on this device. +- **SystemProcessorLahfSahf** The SHA256 hash of SystemProcessorLahfSahf objects that are present on this device. +- **SystemMemory** The SHA256 hash of SystemMemory objects that are present on this device. +- **SystemProcessorPrefetchW** The SHA256 hash of SystemProcessorPrefetchW objects that are present on this device. +- **SystemProcessorSse2** The SHA256 hash of SystemProcessorSse2 objects that are present on this device. +- **SystemProcessorNx** The SHA256 hash of SystemProcessorNx objects that are present on this device. +- **SystemWlan** The SHA256 hash of SystemWlan objects that are present on this device. +- **SystemWim** The SHA256 hash of SystemWim objects that are present on this device. +- **SystemTouch** The SHA256 hash of SystemTouch objects that are present on this device. +- **SystemWindowsActivationStatus** The SHA256 hash of SystemWindowsActivationStatus objects that are present on this device. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd + +This event sends compatibility information about a file to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** A hash of the full file path including the file name. +- **AppraiserVersion** The version of the appraiser file that is generating the events. +- **AvDisplayName** If it is an anti-virus app, this is the the display name for the app. Example: System Center Endpoint Protection +- **CompatModelIndex** The compatibility prediction for this file. +- **HasCitData** Is the file present in CIT data? +- **HasUpgradeExe** Does the anti-virus app have an upgrade.exe file? +- **IsAv** Is the file an anti-virus reporting EXE? +- **ResolveAttempted** This will always be an empty string when sending telemetry. +- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file. +- **SdbEntries_item_MigShimCommand** The command line to be passed to the MigShim if one is applicable. +- **SdbEntries_item_MigShimName** Example: DevenvDotnetCacheRebuildShim +- **SdbEntries_item_MigXmlName** Example: MicrosoftForefrontEndpointProtection__4_6__PART +- **SdbEntries_item_MigXmlType** Example: MIG_XML_TYPE_REMOVED +- **SdbEntries_item_ReinstallUpgradeMessage** Example: Resource: 10022 +- **SdbEntries_item_SdbAppGuid** Example: {551f8360-14dd-4ea5-bd29-74b0c21abfde} +- **SdbEntries_item_SdbAppName** Example: Visual Studio +- **SdbEntries_item_SdbAppVendor** Example: Microsoft +- **SdbEntries_item_SdbBlockType** Example: ReinstallAfterUpgradeInfo +- **SdbEntries_item_SdbEntryGuid** Example: {84e92468-a463-4c02-93a6-20171694b8a8} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_MIG_FIXED + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove + +This event indicates that the DatasourceApplicationFile object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync + +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd + +This event sends compatibility data for a PNP device, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 +- **AppraiserVersion** The version of the appraiser file generating the events. +- **ActiveNetworkConnection** Is the device an active network device? +- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. +- **CosDeviceSolution** An enumeration that indicate how a driver on the target operating system is available. +- **CosDeviceSolutionUrl** Empty string +- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. +- **IsBootCritical** Is the device boot critical? +- **SdbEntries** An array of fields indicating the SDB entries that apply to this device. +- **SdbEntries_item_SdbAppGuid** Example: {0ba2f09d-5288-45fa-be32-001857cc020f} +- **SdbEntries_item_SdbAppName** Example: Virtual Machine Manager Self-Service Client +- **SdbEntries_item_SdbAppVendor** Example: Microsoft Corporation +- **SdbEntries_item_SdbBlockType** Example: ReinstallAfterUpgrade +- **SdbEntries_item_SdbEntryGuid** Example: {2a1cc617-9ee0-4dff-b3c0-a09cfc13543a} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_REINSTALL_BLOCK +- **UplevelInboxDriver** Is there a driver uplevel for this device? +- **WuDriverCoverage** Is there a driver uplevel for this device according to Windows Update? +- **WuDriverUpdateID** The Windows Update ID of the applicable uplevel driver. +- **WuPopulatedFromID** The expected uplevel driver matching ID based on driver coverage from Windows Update. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove + +This event indicates that the DatasourceDevicePnp object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync + +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd + +This event sends compatibility database data about driver packages to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** DriverPackageId that is used for uniquely identifying a driver package on a system. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **SdbEntries** An array of fields indicating the SDB entries that apply to this driver package. +- **SdbEntries_item_SdbAppGuid** Example: {5f29791d-ad69-40a4-9783-6edbdf66bd4b} +- **SdbEntries_item_SdbAppName** Example: Microsoft PDF/XPS Printer +- **SdbEntries_item_SdbAppVendor** Example: Microsoft +- **SdbEntries_item_SdbBlockType** Example: BlockDriver +- **SdbEntries_item_SdbEntryGuid** Example: {380213ca-97c8-4fdc-b194-b4f714006796} +- **SdbEntries_item_SdbUpgradeMode** Example: Service +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_NO_BLOCK + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove + +This event indicates that the DatasourceDriverPackage object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync + +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd + +This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be BlockingMatchingInfo. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **SdbEntries** An array of fields indicating the SDB entries that apply to this file. +- **SdbEntries_item_SdbAppGuid** Example: {4cca1f6c-74f8-4bfd-9fb4-3d4b65f23f98} +- **SdbEntries_item_SdbAppName** Example: Intel(R)DynamicPowerPerformanceManagement +- **SdbEntries_item_SdbAppVendor** Example: Intel +- **SdbEntries_item_SdbBlockType** Example: BlockUpgradeUntilUpdate +- **SdbEntries_item_SdbEntryGuid** Example: {4be49993-88ec-4003-b9a6-9f8812e94c50} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_UPGRADE_UNTIL_UPDATE_BLOCK + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync + +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd + +This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be PassiveMatchingInfo. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **SdbEntries** An array of fields indicating the SDB entries that apply to this file. +- **SdbEntries_item_MigShimCommand** The command line to be passed to the MigShim if one is applicable. +- **SdbEntries_item_MigShimName** Example: MigrateVCRuntimeShim +- **SdbEntries_item_MigXmlName** Example: Intel_Rapid_Storage_Technolgy_Enterprise_Filter_Driver__3__PART +- **SdbEntries_item_MigXmlType** Example: MIG_XML_TYPE_FIXED +- **SdbEntries_item_SdbAppGuid** Example: {03760bce-35d7-47a3-b83b-de673fdb6ab4} +- **SdbEntries_item_SdbAppName** Example: VC Runtime +- **SdbEntries_item_SdbAppVendor** Example: Microsoft +- **SdbEntries_item_SdbBlockType** Example: BlockUpgradeUntilUpdate +- **SdbEntries_item_SdbEntryGuid** Example: {00b0c9b2-3f04-4795-a8ac-5b7bd5ea2ea8} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_MIG_FIXED + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync + +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd + +This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be PostUpgradeMatchingInfo. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **SdbEntries** An array of fields indicating the SDB entries that apply to this file. +- **SdbEntries_item_ReinstallUpgradeMessage** Example: Resource: 10022 +- **SdbEntries_item_SdbAppGuid** Example: {0ba2f09d-5288-45fa-be32-001857cc020f} +- **SdbEntries_item_SdbAppName** Example: Virtual Machine Manager Self-Service Client +- **SdbEntries_item_SdbAppVendor** Example: Microsoft Corporation +- **SdbEntries_item_SdbBlockType** Example: ReinstallAfterUpgrade +- **SdbEntries_item_SdbEntryGuid** Example: {2a1cc617-9ee0-4dff-b3c0-a09cfc13543a} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap +- **SdbEntries_item_SdbUxBlocktypeOverride** Example: SDB_UX_BLOCKTYPE_OVERRIDE_REINSTALL_BLOCK + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd + +This event sends compatibility database information about the BIOS to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be BIOS. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **SdbEntries** An array of fields indicating the SDB entries that apply to this BIOS. +- **SdbEntries_item_SdbBlockType** Example: BiosBlock +- **SdbEntries_item_SdbEntryGuid** Example: {b77118fd-0d87-4f63-a836-d5c6bd8eed4c} +- **SdbEntries_item_SdbUpgradeMode** Example: Swap + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync + +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd + +This event sends compatibility decision data about a file to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** A hash of the full file path, including the file name. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **BlockAlreadyInbox** The uplevel runtime block on the file already existed on the current OS. Example: FALSE +- **BlockingApplication** Are there any application issues that interfere with upgrade due to the file in question? +- **DisplayGenericMessage** Will be a generic message be shown for this file? +- **HardBlock** This file is blocked in the SDB. +- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB? +- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode? +- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade? +- **NeedsDismissAction** Will the file cause an action that can be dimissed? +- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app. +- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade? +- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app. +- **NeedsUninstallAction** The file must be uninstalled to complete the upgrade. +- **SdbBlockUpgrade** The file is tagged as blocking upgrade in the SDB, +- **SdbBlockUpgradeCanReinstall** The file is tagged as blocking upgrade in the SDB. It can be reinstalled after upgrade. +- **SdbBlockUpgradeUntilUpdate** The file is tagged as blocking upgrade in the SDB. If the app is updated, the upgrade can proceed. +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the SDB. It does not block upgrade. +- **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +- **SoftBlock** The file is softblocked in the SDB and has a warning. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove + +This event indicates Indicates that the DecisionApplicationFile object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync + +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd + +This event sends compatibility decision data about a PNP device to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This uniquely identifies a device in the system. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **AssociatedDriverIsBlocked** Is the driver associated with this PNP device blocked? +- **BlockAssociatedDriver** Should the driver associated with this PNP device be blocked? +- **BlockUpgradeIfDriverBlocked** Is the PNP device both boot critical and does not have a driver included with the OS? +- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork** Is this PNP device the only active network device? +- **BlockingDevice** Is this PNP device blocking upgrade? +- **DisplayGenericMessage** Will a generic message be shown during Setup for this PNP device? +- **DriverAvailableInbox** Is a driver included with the operating system for this PNP device? +- **DriverAvailableOnline** Is there a driver for this PNP device on Windows Update? +- **DriverAvailableUplevel** Is there a driver on Windows Update or included with the operating system for this PNP device? +- **DriverBlockOverridden** Is there is a driver block on the device that has been overridden? +- **NeedsDismissAction** Will the user would need to dismiss something during Setup for this device? +- **NotRegressed** Does the device have a problem code on the source OS that is no better than the one it would have on the target OS? +- **SdbDeviceBlockUpgrade** Is there an SDB block on the PNP device that blocks upgrade? +- **SdbDriverBlockOverridden** Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove + +This event indicates that the DecisionDevicePnp object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync + +This event indicates that the DecisionDevicePnp object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd + +This event sends decision data about driver package compatibility to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** Used for uniquely identifying a driver package on a system. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? +- **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? +- **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? +- **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? +- **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove + +This event indicates that the DecisionDriverPackage object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync + +This event indicates that a new set of DecisionDriverPackageAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd + +This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be BlockingMatchingInfo. +- **AppraiserVersion** The version of the appraiser file generating the events. +- **BlockingApplication** Are there are any application issues that interfere with upgrade due to matching info blocks? +- **DisplayGenericMessage** Will a generic message be shown for this block? +- **NeedsUninstallAction** Does the user need to take an action in setup due to a matching info block? +- **SdbBlockUpgrade** Is a matching info block blocking upgrade? +- **SdbBlockUpgradeCanReinstall** Is a matching info block blocking upgrade, but has the can reinstall tag? +- **SdbBlockUpgradeUntilUpdate** Is a matching info block blocking upgrade but has the until update tag? + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync + +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd + +This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be PassiveMatchingInfo. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BlockingApplication** Are there any application issues that interfere with upgrade due to matching info blocks? +- **MigApplication** Is there a matching info block with a mig for the current mode of upgrade? + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove + +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync + +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd + +This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be PostUpgradeMatchingInfo. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **NeedsInstallPostUpgradeData** Will the file have a notification after upgrade to install a replacement for the app? +- **NeedsNotifyPostUpgradeData** Should a notification be shown for this file after upgrade? +- **NeedsReinstallPostUpgradeData** Will the file have a notification after upgrade to reinstall the app? +- **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync + +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd + +This event sends decision data about the presence of Windows Media Center, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be MediaCenter. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **BlockingApplication** Is there any application issues that interfere with upgrade due to Windows Media Center? +- **MediaCenterActivelyUsed** If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true? +- **MediaCenterInUse** Is Windows Media Center actively being used? +- **MediaCenterIndicators** Are any of the signals indicating that Windows Media Center is being used, such as default launcher, watched folders, extender accounts, etc...? +- **MediaCenterPaidOrActivelyUsed** Is Windows Media Center actively being used or is it running on a supported edition? +- **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync + +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd + +This event sends compatibility decision data about the BIOS to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be Bios. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device blocked from upgrade due to a BIOS block? +- **HasBiosBlock** Does the device have a BIOS block? + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove + +This event indicates that the DecisionSystemBios object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorAdd + +This event sends defunct data. It always reads false. + +The following fields are available: + +- **objectInstanceId** Will always be Processor. +- **AppraiserVersion** The version of the appraiser binary generating the events. Example: 10014361 +- **Blocking** Will always be FALSE +- **ProcessorRequirementViolated** Will always be FALSE + + +### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning + +The event that indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. + +The following fields are available: + +- **CensusId** An ID for the system calculated from the CEIP, WER, and RAC IDs. +- **Time** The client time of the event. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. + + +### Microsoft.Windows.Appraiser.General.GatedRegChange + +This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. + +The following fields are available: + +- **Time** The client time of the event. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **RegKey** The registry key name for which a result is being sent. +- **RegValue** The registry value for which a result is being sent. +- **OldData** The previous data in the registry value before the scan ran. +- **NewData** The data in the registry value after the scan completed. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd + +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or are part of an anti-virus program. + +The following fields are available: + +- **objectInstanceId** A hash of the full file path including the file name. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. +- **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. +- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 +- **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata. +- **CompanyName** The company name of the vendor who developed this file. +- **FileId** A hash that uniquely identifies a file. +- **FileVersion** The File version field from the file metadata under Properties -> Details. +- **LinkDate** The date and time that this file was linked on. +- **LowerCaseLongPath** The full file path to the file that was inventoried on the device. +- **Name** The name of the file that was inventoried. +- **ProductName** The Product name field from the file metadata under Properties -> Details. +- **ProductVersion** The Product version field from the file metadata under Properties -> Details. +- **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. +- **Size** The size of the file (in hexadecimal bytes). + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove + +This event indicates that the InventoryApplicationFile object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync + +This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd + +This event sends data about the number of language packs installed on the system, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be LanguagePack. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **HasLanguagePack** Does this device have 2 or more language packs? +- **LanguagePackCount** How many language packs are installed? + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove + +This event indicates that the InventoryLanguagePack object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync + +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd + +This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date. + +The following fields are available: + +- **objectInstanceId** This will always be MediaCenter. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **EverLaunched** Has Windows Media Center ever been launched? +- **HasConfiguredTv** Has the user configured a TV tuner through Windows Media Center? +- **HasExtendedUserAccounts** Are any Windows Media Center Extender user accounts configured? +- **HasWatchedFolders** Are any folders configured for Windows Media Center to watch? +- **IsDefaultLauncher** Is Windows Media Center the default app for opening music or video files? +- **IsPaid** Is the user running a Windows Media Center edition that implies they paid for Windows Media Center? +- **IsSupported** Does the running OS support Windows Media Center? + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove + +This event indicates that the InventoryMediaCenter object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync + +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd + +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. + +The following fields are available: + +- **objectInstanceId** This will always be Bios. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BiosDate** The release date of the BIOS in UTC format. +- **BiosName** The name field from Win32_BIOS. +- **Manufacturer** The manufacturer field from Win32_ComputerSystem. +- **Model** The model field from Win32_ComputerSystem. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove + +This event indicates that the InventorySystemBios object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync + +This event indicates that a new set of InventorySystemBiosAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd + +This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **BootCritical** Is the driver package marked as boot critical? +- **Build** The build value from the driver package. +- **CatalogFile** The name of the catalog file within the driver package. +- **ClassGuid** The device class GUID from the driver package. +- **Class** The device class from the driver package. +- **Date** The date from the driver package. +- **SignatureStatus** Indicates if the driver package is signed. Unknown:0, Unsigned:1, Signed: 2 +- **Inbox** Is the driver package of a driver that is included with Windows? +- **VersionMajor** The major version of the driver package. +- **VersionMinor** The minor version of the driver package. +- **OriginalName** The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU +- **Provider** The provider of the driver package. +- **PublishedName** The name of the INF file, post-rename. +- **Revision** The revision of the driver package. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove + +This event indicates that the InventoryUplevelDriverPackage object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync + +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.IsOnlineTelemetryOutputter + +This event indicates if Appraiser was able to connect successfully to Windows Update to get driver availability information. + +The following fields are available: + +- **Time** The client time of the event. +- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers. +- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information? +- **CensusId** An ID for the system calculated from the CEIP, WER, and RAC IDs. + + +### Microsoft.Windows.Appraiser.General.IsOnlineWuDriverDataSource + +This event indicates if Appraiser was able to connect to Windows Update to gather driver coverage information. + +The following fields are available: + +- **Time** The client time of the event. +- **PCFP** A unique hardware identifier that is calculated by hashing hardware identifiers. +- **IsOnlineRun** Was the device able to connect to Windows Update to get driver availability information? +- **TargetVersion** The abbreviated name for the OS version against which Windows Update was queried. +- **CensusId** An ID for the system calculated from the CEIP, WER, and RAC IDs. + + +### Microsoft.Windows.Appraiser.General.RunContext + +This event indicates what should be expected in the data payload. + +The following fields are available: + +- **AppraiserBranch** The source branch in which the currently running version of Appraiser was built. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Context** Indicates what mode Appraiser is running in. Example: Setup or Telemetry. +- **Time** The client time of the event. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. + + +### Microsoft.Windows.Appraiser.General.SetupAdlStatus + +This event indicates if Appraiser used data files from the setup image or more up-to-date data files downloaded from a Microsoft server. + +The following fields are available: + +- **Time** The client time of the event. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **Result** The last result of the operation to determine if there is a data file to download. +- **OneSettingsInitialized** Was the query to OneSettings, where the information is stored on if there is a data file to download, initialized? +- **Url** The URL of the data file to download. This will be an empty string if there is no data file to download. +- **UsingAlternateData** Is the client using alternate data file or using the data file in the setup image? + + +### Microsoft.Windows.Appraiser.General.SystemMemoryAdd + +This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be Memory. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the device from upgrade due to memory restrictions? +- **MemoryRequirementViolated** Was a memory requirement violated? +- **pageFile** The current committed memory limit for the system or the current process, whichever is smaller (in bytes). +- **ram** The amount of memory on the device. +- **ramKB** The amount of memory (in KB). +- **virtual** The size of the user-mode portion of the virtual address space of the calling process (in bytes). +- **virtualKB** The amount of virtual memory (in KB). + + +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync + +This event indicates that a new set of SystemMemoryAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd + +This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date. + +The following fields are available: + +- **objectInstanceId** This will always be CompareExchange128. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **CompareExchange128Support** Does the CPU support CompareExchange128? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync + +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd + +This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be LahfSahf. +- **AppraiserVersion** The version of the Appraiser file generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **LahfSahfSupport** Does the CPU support LAHF/SAHF? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync + +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd + +This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be NX. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **NXDriverResult** The result of the driver used to do a non-deterministic check for NX support. +- **NXProcessorSupport** Does the processor support NX? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync + +This event indicates that a new set of SystemProcessorNxAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd + +This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be PrefetchW. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **PrefetchWSupport** Does the processor support PrefetchW? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync + +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add + +This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be SSE2. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked due to the processor? +- **SSE2ProcessorSupport** Does the processor support SSE2? + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync + +This event indicates that a new set of SystemProcessorSse2Add events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchAdd + +This event sends data indicating whether the system supports touch, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be Touch. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IntegratedTouchDigitizerPresent** Is there an integrated touch digitizer? +- **MaximumTouches** The maximum number of touch points supported by the device hardware. + + +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemTouchStartSync + +This event indicates that a new set of SystemTouchAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWimAdd + +This event sends data indicating whether the operating system is running from a compressed WIM file, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be Wim. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **IsWimBoot** Is the current operating system running from a compressed WIM file? +- **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. + + +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWimStartSync + +This event indicates that a new set of SystemWimAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd + +This event sends data indicating whether the current operating system is activated, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be WindowsActivationStatus. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **WindowsIsLicensedApiValue** The result from the API that's used to indicate if operating system is activated. +- **WindowsNotActivatedDecision** Is the current operating system activated? + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove + +This event indicates that the SystemWindowsActivationStatus object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync + +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWlanAdd + +This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **objectInstanceId** This will always be Wlan. +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Is the upgrade blocked because of an emulated WLAN driver? +- **HasWlanBlock** Does the emulated WLAN driver have an upgrade block? +- **WlanEmulatedDriver** Does the device have an emulated WLAN driver? +- **WlanExists** Does the device support WLAN at all? +- **WlanModulePresent** Are any WLAN modules present? +- **WlanNativeDriver** Does the device have a non-emulated WLAN driver? + + +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.SystemWlanStartSync + +This event indicates that a new set of SystemWlanAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.TelemetryRunHealth + +A summary event indicating the parameters and result of a telemetry run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up-to-date. + +The following fields are available: + +- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal. +- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device. +- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability. +- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **Time** The client time of the event. +- **RunDate** The date that the telemetry run was stated, expressed as a filetime. +- **AppraiserProcess** The name of the process that launched Appraiser. +- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. +- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run. +- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. +- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built. +- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. +- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic. +- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row. +- **AuxFinal** Obsolete, always set to false +- **StoreHandleIsNotNull** Obsolete, always set to false +- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging. +- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run. +- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. +- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent. +- **PCFP** An ID for the system calculated by hashing hardware identifiers. +- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information. +- **TelementrySent** Indicates if telemetry was successfully sent. +- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated. +- **RunResult** The hresult of the Appraiser telemetry run. + + +### Microsoft.Windows.Appraiser.General.WmdrmAdd + +This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **WmdrmCdRipped** Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs. +- **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses. +- **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +- **WmdrmApiResult** Raw value of the API used to gather DRM state. +- **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed. +- **WmdrmIndicators** WmdrmCdRipped OR WmdrmPurchased +- **NeedsDismissAction** Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation. +- **BlockingApplication** Same as NeedsDismissAction + + +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.WmdrmStartSync + +This event indicates that a new set of WmdrmAdd events will be sent. + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +## Census events + +### Census.App + +This event sends version data about the Apps running on this device, to help keep Windows up to date. + +The following fields are available: + +- **IEVersion** Retrieves which version of Internet Explorer is running on this device. +- **CensusVersion** The version of Census that generated the current data for this device. + + +### Census.Battery + +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. + +The following fields are available: + +- **InternalBatteryCapablities** Represents information about what the battery is capable of doing. +- **InternalBatteryCapacityCurrent** Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity  to estimate the battery's wear. +- **InternalBatteryCapacityDesign** Represents the theoretical capacity of the battery when new, in mWh. +- **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. +- **InternalBatteryNumberOfCharges** Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance. + + +### Census.Camera + +This event sends data about the resolution of cameras on the device, to help keep Windows up to date. + +The following fields are available: + +- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. +- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. + + +### Census.Enterprise + +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. + +The following fields are available: + +- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false +- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **CommercialId** Represents the GUID for the commercial entity which the device is a member of.  Will be used to reflect insights back to customers. +- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs. +- **AzureOSIDPresent** Represents the field used to identify an Azure machine. +- **IsDomainJoined** Indicates whether a machine is joined to a domain. +- **HashedDomain** The hashed representation of the user domain used for login. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier +- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **CDJType** Represents the type of cloud domain joined for the machine. +- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption +- **IsDERequirementMet** Represents if the device can do device encryption. +- **IsEDPEnabled** Represents if Enterprise data protected on the device. +- **ContainerType** The type of container, such as process or virtual machine hosted. + + +### Census.Firmware + +This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. + +The following fields are available: + +- **FirmwareManufacturer** Represents the manufacturer of the device's firmware (BIOS). +- **FirmwareReleaseDate** Represents the date the current firmware was released. +- **FirmwareType** Represents the firmware type. The various types can be unknown, BIOS, UEFI. +- **FirmwareVersion** Represents the version of the current firmware. + + +### Census.Flighting + +This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up-to-date. + +The following fields are available: + +- **FlightIds** A list of the different Windows Insider builds on this device. +- **MSA_Accounts** Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device. +- **IsFlightsDisabled** Represents if the device is participating in the Windows Insider program. +- **FlightingBranchName** The name of the Windows Insider branch currently used by the device. +- **DeviceSampleRate** The telemetry sample rate assigned to the device. +- **EnablePreviewBuilds** Used to enable Windows Insider builds on a device. +- **SSRK** Retrieves the mobile targeting settings. + + +### Census.Hardware + +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up-to-date. + +The following fields are available: + +- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 24. +- **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields. +- **DeviceColor** Indicates a color of the device. +- **DeviceName** The device name that is set by the user. +- **OEMDigitalMarkerFileName** The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device. +- **OEMManufacturerName** The device manufacturer name. The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date. +- **OEMModelNumber** The device model number. +- **OEMModelName** The device model name. +- **OEMModelSKU** The device edition that is defined by the manufacturer. +- **OEMOptionalIdentifier** A Microsoft assigned value that represents a specific OEM subsidiary. +- **OEMSerialNumber** The serial number of the device that is set by the manufacturer. +- **PhoneManufacturer** The friendly name of the phone manufacturer. +- **SoCName** The firmware manufacturer of the device. +- **DUID** The device unique ID. +- **InventoryId** The device ID used for compatibility testing. +- **VoiceSupported** Does the device have a cellular radio capable of making voice calls? +- **PowerPlatformRole** The OEM preferred power management profile. It's used to help to identify the basic form factor of the device. +- **TPMVersion** The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0. +- **StudyID** Used to identify retail and non-retail device. +- **TelemetryLevel** The telemetry level the user has opted into, such as Basic or Enhanced. +- **TelemetrySettingAuthority** Determines who set the telemetry level, such as GP, MDM, or the user. +- **DeviceForm** Indicates the form as per the device classification. +- **DigitizerSupport** Is a digitizer supported? +- **OEMModelBaseBoard** The baseboard model used by the OEM. +- **OEMModelSystemFamily** The system family set on the device by an OEM. +- **OEMModelBaseBoardVersion** Differentiates between developer and retail devices. +- **ActiveMicCount** The number of active microphones attached to the device. +- **OEMModelSystemVersion** The system model version set on the device by the OEM. + + +### Census.Memory + +This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. + +The following fields are available: + +- **TotalPhysicalRAM** Represents the physical memory (in MB). +- **TotalVisibleMemory** Represents the memory that is not reserved by the system. + + +### Census.Network + +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. + +The following fields are available: + +- **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users. +- **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US. +- **NetworkCost** Represents the network cost associated with a connection. +- **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. +- **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. +- **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. +- **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **MCC1** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. +- **NetworkAdapterGUID** The GUID of the primary network adapter. + + +### Census.OS + +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. + +The following fields are available: + +- **GenuineState** Retrieves the ID Value specifying the OS Genuine check. +- **IsPortableOperatingSystem** Retrieves whether OS is running Windows-To-Go +- **IsSecureBootEnabled** Retrieves whether Boot chain is signed under UEFI. +- **InstallationType** Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update). +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc +- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). +- **OSSKU** Retrieves the Friendly Name of OS Edition. +- **OSTimeZoneBiasInMins** Retrieves the time zone set on machine. +- **OSUILocale** Retrieves the locale of the UI that is currently used by the OS. +- **RACw7Id** Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability. +- **CompactOS** Indicates if the Compact OS feature from Win10 is enabled. +- **Signature** Retrieves if it is a signature machine sold by Microsoft store. +- **IsDeviceRetailDemo** Retrieves if the device is running in demo mode. +- **ActivationChannel** Retrieves the retail license key or Volume license key for a machine. +- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. +- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. +- **ProductKeyID2** Retrieves the License key if the machine is updated with a new license key. +- **ServiceMachineIP** Retrieves the IP address of the KMS host used for anti-piracy. +- **ServiceProductKeyID** Retrieves the License key of the KMS +- **LanguagePacks** The list of language packages installed on the device. +- **InstallLanguage** The first language installed on the user machine. +- **IsEduData** Returns Boolean if the education data policy is enabled. +- **SharedPCMode** Returns Boolean for education devices used as shared cart +- **SLICVersion** Returns OS type/version from SLIC table. +- **SLICStatus** Whether a SLIC table exists on the device. +- **OSEdition** Retrieves the version of the current OS. +- **ProductActivationTime** Returns the OS Activation time for tracking piracy issues. +- **ProductActivationResult** Returns Boolean if the OS Activation was successful. +- **OSSubscriptionTypeId** Returns boolean for enterprise subscription feature for selected PRO machines. +- **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. +- **ServiceMachinePort** Retrieves the port of the KMS host used for anti-piracy. +- **DeviceTimeZone** The time zone that is set on the device. Example: Pacific Standard Time +- **DeveloperUnlockStatus** Represents if a device has been developer unlocked by the user or Group Policy. + + +### Census.Processor + +This event sends data about the processor (architecture, speed, number of cores, manufacturer, and model number), to help keep Windows up to date. + +The following fields are available: + +- **ProcessorCores** Retrieves the number of cores in the processor. +- **ProcessorPhysicalCores** Number of physical cores in the processor. +- **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture. +- **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz. +- **ProcessorManufacturer** Retrieves the name of the processor's manufacturer. +- **ProcessorModel** Retrieves the name of the processor model. +- **SocketCount** Number of physical CPU sockets of the machine. +- **ProcessorIdentifier** The processor identifier of a manufacturer. + + +### Census.Speech + +This event is used to gather basic speech settings on the device. + +The following fields are available: + +- **SpeechServicesEnabled** Windows setting that represents whether a user is opted-in for speech services on the device. +- **KWSEnabled** Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS). +- **SpeakerIdEnabled** Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice. +- **AboveLockEnabled** Cortana setting that represents if Cortana can be invoked when the device is locked. +- **GPAllowInputPersonalization** Indicates if a Group Policy setting has enabled speech functionalities. +- **HolographicSpeechInputDisabled** Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user. +- **HolographicSpeechInputDisabledRemote** Indicates if a remote policy has disabled speech functionalities for the HMD devices. +- **MDMAllowInputPersonalization** Indicates if an MDM policy has enabled speech functionalities. +- **RemotelyManaged** Indicates if the device is being controlled by a remote admininistrator (MDM or Group Policy) in the context of speech functionalities. + + +### Census.Storage + +This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. + +The following fields are available: + +- **PrimaryDiskTotalCapacity** Retrieves the amount of disk space on the primary disk of the device in MB. +- **SystemVolumeTotalCapacity** Retrieves the size of the partition that the System volume is installed on in MB. +- **PrimaryDiskType** Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any). + + +### Census.Userdefault + +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. + +The following fields are available: + +- **DefaultBrowserProgId** The ProgramId of the current user's default browser +- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html,.htm,.jpg,.jpeg,.png,.mp3,.mp4, .mov,.pdf + + +### Census.UserDisplay + +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. + +The following fields are available: + +- **InternalPrimaryDisplayLogicalDPIX** Retrieves the logical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayLogicalDPIY** Retrieves the logical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIX** Retrieves the physical DPI in the x-direction of the internal display. +- **InternalPrimaryDisplayPhysicalDPIY** Retrieves the physical DPI in the y-direction of the internal display. +- **InternalPrimaryDisplayResolutionHorizontal** Retrieves the number of pixels in the horizontal direction of the internal display. +- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display. +- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches . +- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches +- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine. +- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine +- **VRAMDedicated** Retrieves the video RAM in MB. +- **VRAMDedicatedSystem** Retrieves the amount of memory on the dedicated video card. +- **VRAMSharedSystem** Retrieves the amount of RAM memory that the video card can use. + + +### Census.UserNLS + +This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. + +The following fields are available: + +- **DefaultAppLanguage** The current user Default App Language. +- **HomeLocation** The current user location, which is populated using GetUserGeoId() function. +- **DisplayLanguage** The current user preferred Windows Display Language. +- **SpeechInputLanguages** The Speech Input languages installed on the device. +- **KeyboardInputLanguages** The Keyboard input languages installed on the device. + + +### Census.VM + +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. + +The following fields are available: + +- **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. +- **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. +- **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. +- **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **HyperVisor** Retrieves whether the current OS is running on top of a Hypervisor. + + +### Census.WU + +This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. + +The following fields are available: + +- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. +- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). +- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **OSWUAutoUpdateOptions** Retrieves the auto update settings on the device. +- **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled). +- **AppStoreAutoUpdatePolicy** Retrieves the Windows Store App Auto Update group policy setting +- **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured +- **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS). +- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades +- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates +- **WUPauseState** Retrieves WU setting to determine if updates are paused +- **OSUninstalled** A flag that represents when a feature update is uninstalled on a device . +- **OSRolledBack** A flag that represents when a feature update has rolled back during setup. +- **OSRollbackCount** The number of times feature updates have rolled back on the device. +- **UninstallActive** A flag that represents when a device has uninstalled a previous upgrade recently. +- **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading. + + +### Census.Xbox + +This event sends data about the Xbox Console, such as Serial Number and DeviceId, to help keep Windows up to date. + +The following fields are available: + +- **XboxLiveDeviceId** Retrieves the unique device id of the console. +- **XboxConsoleSerialNumber** Retrieves the serial number of the Xbox console. +- **XboxLiveSandboxId** Retrieves the developer sandbox id if the device is internal to MS. +- **XboxConsolePreferredLanguage** Retrieves the preferred language selected by the user on Xbox console. + + +## Diagnostic data events + +### TelClientSynthetic.AuthorizationInfo_RuntimeTransition + +This event sends data indicating that a device has undergone a change of telemetry opt-in level during the runtime of the device (not at UTC boot or offline), to help keep Windows up to date. + +The following fields are available: + +- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups. +- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism. +- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA. +- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats. +- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry). +- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations. +- **CanPerformScripting** True if UTC is allowed to perform scripting. +- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions. +- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events. +- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry. +- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry opt-in level was last changed. + + +### TelClientSynthetic.AuthorizationInfo_Startup + +This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. + +The following fields are available: + +- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry. +- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism. +- **CanCollectHeartbeats** True if UTC is allowed to collect heartbeats. +- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA. +- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry). +- **CanReportScenarios** True if UTC is allowed to load and report scenario completion, failure, and cancellation events. +- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups. +- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions. +- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations. +- **CanPerformScripting** True if UTC is allowed to perform scripting. +- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry client was last started. + + +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network. + +The following fields are available: + +- **CensusExitCode** Returns last execution codes from census client run. +- **CensusStartTime** Returns timestamp corresponding to last successful census run. +- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **LastConnectivityLossTime** Retrieves the last time the device lost free network. +- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. +- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. +- **LastConntectivityLossTime** Retrieves the last time the device lost free network. + + +### TelClientSynthetic.HeartBeat_5 + +This event sends data about the health and quality of the telemetry data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. + +The following fields are available: + +- **PreviousHeartBeatTime** The time of last heartbeat event. This allows chaining of events. +- **EtwDroppedCount** The number of events dropped by the ETW layer of the telemetry client. +- **ConsumerDroppedCount** The number of events dropped by the consumer layer of the telemetry client. +- **DecodingDroppedCount** The number of events dropped because of decoding failures. +- **ThrottledDroppedCount** The number of events dropped due to throttling of noisy providers. +- **DbDroppedCount** The number of events that were dropped because the database was full. +- **EventSubStoreResetCounter** The number of times the event database was reset. +- **EventSubStoreResetSizeSum** The total size of the event database across all resets reports in this instance. +- **CriticalOverflowEntersCounter** The number of times a critical overflow mode was entered into the event database. +- **EnteringCriticalOverflowDroppedCounter** The number of events that was dropped because a critical overflow mode was initiated. +- **UploaderDroppedCount** The number of events dropped by the uploader layer of the telemetry client. +- **InvalidHttpCodeCount** The number of invalid HTTP codes received from Vortex. +- **LastInvalidHttpCode** The last invalid HTTP code received from Vortex. +- **MaxInUseScenarioCounter** The soft maximum number of scenarios loaded by the Connected User Experience and Telemetry component. +- **LastEventSizeOffender** The name of the last event that exceeded the maximum event size. +- **SettingsHttpAttempts** The number of attempts to contact the OneSettings service. +- **SettingsHttpFailures** The number of failures from contacting the OneSettings service. +- **VortexHttpAttempts** The number of attempts to contact the Vortex service. +- **EventsUploaded** The number of events that have been uploaded. +- **DbCriticalDroppedCount** The total number of dropped critical events in the event database. +- **VortexHttpFailures4xx** The number of 400-499 error codes received from Vortex. +- **VortexHttpFailures5xx** The number of 500-599 error codes received from Vortex. +- **VortexFailuresTimeout** The number of timeout failures received from Vortex. +- **HeartBeatSequenceNumber** A monotonically increasing heartbeat counter. +- **EtwDroppedBufferCount** The number of buffers dropped in the CUET ETW session. +- **FullTriggerBufferDroppedCount** The number of events that were dropped because the trigger buffer was full. +- **CriticalDataThrottleDroppedCount** The number of critical data sampled events that were dropped because of throttling. +- **CriticalDataDbDroppedCount** The number of critical data sampled events that were dropped at the database layer. +- **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe. +- **AgentConnectionErrorsCount** The number of non-timeout errors associated with the host/agent channel. +- **LastAgentConnectionError** The last non-timeout error that happened in the host/agent channel. +- **Flags** Flags that indicate device state, such as network, battery, and opt-in state. +- **CensusTaskEnabled** Indicates whether Census is enabled. +- **CensusExitCode** The last exit code of the Census task. +- **CensusStartTime** The time of the last Census run. + + +### TelClientSynthetic.PrivacySettingsAfterCreatorsUpdate + +This event sends basic data on privacy settings before and after a feature update. This is used to ensure that customer privacy settings are correctly migrated across feature updates. + +The following fields are available: + +- **PostUpgradeSettings** The privacy settings after a feature update. +- **PreUpgradeSettings** The privacy settings before a feature update. + + +## DxgKernelTelemetry events + +### DxgKrnlTelemetry.GPUAdapterInventoryV2 + +This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. + +The following fields are available: + +- **version** The event version. +- **bootId** The system boot ID. +- **aiSeqId** The event sequence ID. +- **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES? +- **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY? +- **InterfaceId** The GPU interface ID. +- **GPUVendorID** The GPU vendor ID. +- **GPUDeviceID** The GPU device ID. +- **SubVendorID** The GPU sub vendor ID. +- **SubSystemID** The subsystem ID. +- **GPURevisionID** The GPU revision ID. +- **DriverVersion** The display driver version. +- **DriverDate** The date of the display driver. +- **DriverRank** The rank of the display driver. +- **IsMiracastSupported** Does the GPU support Miracast? +- **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution? +- **IsHybridDiscrete** Does the GPU have discrete GPU capabilities in a hybrid device? +- **IsHybridIntegrated** Does the GPU have integrated GPU capabilities in a hybrid device? +- **IsMPOSupported** Does the GPU support Multi-Plane Overlays? +- **IsLDA** Is the GPU comprised of Linked Display Adapters? +- **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor? +- **IsPostAdapter** Is this GPU the POST GPU in the device? +- **IsSoftwareDevice** Is this a software implementation of the GPU? +- **IsRenderDevice** Does the GPU have rendering capabilities? +- **IsDisplayDevice** Does the GPU have displaying capabilities? +- **WDDMVersion** The Windows Display Driver Model version. +- **DisplayAdapterLuid** The display adapter LUID. +- **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. +- **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. +- **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling) +- **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). +- **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **SharedSystemMemoryB** The amount of system memory shared by GPU and CPU (in bytes). +- **NumVidPnSources** The number of supported display output sources. +- **NumVidPnTargets** The number of supported display output targets. + + +## Fault Reporting events + +### Microsoft.Windows.FaultReporting.AppCrashEvent + +This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes" by a user DO NOT emit this event. + +The following fields are available: + +- **ProcessId** The ID of the process that has crashed. +- **ProcessCreateTime** The time of creation of the process that has crashed. +- **ExceptionCode** The exception code returned by the process that has crashed. +- **ExceptionOffset** The address where the exception had occurred. +- **AppName** The name of the app that has crashed. +- **AppVersion** The version of the app that has crashed. +- **AppTimeStamp** The date/time stamp of the app. +- **ModName** Exception module name (e.g. bar.dll). +- **ModVersion** The version of the module that has crashed. +- **ModTimeStamp** The date/time stamp of the module. +- **PackageFullName** Store application identity. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. +- **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported +- **TargetAsId** The sequence number for the hanging process. + + +## Hang Reporting events + +### Microsoft.Windows.HangReporting.AppHangEvent + +This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events. + +The following fields are available: + +- **AppName** The name of the app that has hung. +- **TypeCode** Bitmap describing the hang type. +- **ProcessId** The ID of the process that has hung. +- **UTCReplace_TargetAppId** The kernel reported AppId of the application being reported. +- **ProcessCreateTime** The time of creation of the process that has hung. +- **UTCReplace_TargetAppVer** The specific version of the application being reported. +- **WaitingOnAppName** If this is a cross process hang waiting for an application, this has the name of the application. +- **PackageRelativeAppId** Store application identity. +- **ProcessArchitecture** Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **WaitingOnPackageRelativeAppId** If this is a cross process hang waiting for a package, this has the relative application id of the package. +- **WaitingOnAppVersion** If this is a cross process hang, this has the version of the application for which it is waiting. +- **AppSessionGuid** GUID made up of process id used as a correlation vector for process instances in the telemetry backend. +- **WaitingOnPackageFullName** If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting. +- **PackageFullName** Store application identity. +- **AppVersion** The version of the app that has hung. +- **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargetAppId** The kernel reported AppId of the application being reported. +- **TargetAppVer** The specific version of the application being reported. +- **TargetAsId** The sequence number for the hanging process. + + +## Inventory events + +### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum + +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. + +The following fields are available: + +- **Device** A count of device objects in cache +- **DeviceCensus** A count of devicecensus objects in cache +- **DriverPackageExtended** A count of driverpackageextended objects in cache +- **File** A count of file objects in cache +- **Generic** A count of generic objects in cache +- **HwItem** A count of hwitem objects in cache +- **InventoryApplication** A count of application objects in cache +- **InventoryApplicationFile** A count of application file objects in cache +- **InventoryDeviceContainer** A count of device container objects in cache +- **InventoryDeviceMediaClass** A count of device media objects in cache +- **InventoryDevicePnp** A count of devicepnp objects in cache +- **InventoryDriverBinary** A count of driver binary objects in cache +- **InventoryDriverPackage** A count of device objects in cache +- **Metadata** A count of metadata objects in cache +- **Orphan** A count of orphan file objects in cache +- **Programs** A count of program objects in cache +- **FileSigningInfo** A count of file signing info objects in cache. +- **InventoryDeviceInterface** A count of inventory device interface objects in cache. + + +### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions + +This event sends inventory component versions for the Device Inventory data. + +The following fields are available: + +- **aeinv.dll** The version of the App inventory component. +- **devinv.dll** The file version of the Device inventory component. +- **aeinv** The version of the App inventory component. +- **devinv** The file version of the Device inventory component. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd + +This event sends basic metadata about an application on the system to help keep Windows up to date. + +The following fields are available: + +- **ProgramInstanceId** A hash of the file IDs in an app. +- **Name** The name of the application. Location pulled from depends on 'Source' field. Example: +- **Type** One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen. Example: Application +- **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field. Example: Neudesic +- **Version** The version number of the program. Example: 6.00.0003 +- **Language** The language code of the program. Language codes can be found at 221435 Example: 1033 +- **Source** Where the data for the application was found, such as Add/Remove Programs (ARP), MSI, AppxPackage, etc. Example: Msi +- **MsiProductCode** A GUID that describe the MSI Product. Example: {365812a8-44d6-422e-b737-d540451e5f4e} +- **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. Example: {1BCC5142-D98C-430B-B74A-484A0328A7CE} +- **HiddenArp** Indicates whether a program hides itself from showing up in ARP. Example: TRUE +- **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install. Example: +- **PackageFamilyName** The package family name for a Windows Store app. +- **RootDirPath** The path to the root directory where the program was installed. Example:  %ProgramFiles% (x86)\Neudesic\Azure Storage Explorer 6 +- **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics) Example: 4/12/2015 01:27:52 +- **InstallDateMsi** The install date if the application was installed via MSI. Passed as an array. Example: 4/11/2015 00:00:00 +- **InstallDateFromLinkFile** The estimated date of install based on the links to the files. Passed as an array. Example: 4/8/2015 01:06:11 +- **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00 +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **objectInstanceId** ProgramId (a hash of Name, Version, Publisher, and Language of an application used to identify it). Example: 00000144865763f3de24c2ae5a289fde6db300000904 +- **PackageFullName** The package full name for a Store application. Example: Microsoft.Hexic_1.2.0.36_x86__8wekyb3d8bbwe +- **InventoryVersion** The version of the inventory file generating the events. +- **StoreAppType** A sub-classification for the type of Windows Store app, such as UWP or Win8StoreApp. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync + +This event indicates that a new set of InventoryApplicationAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd + +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a PNP device) to help keep Windows up-to-date. + +The following fields are available: + +- **ModelName** The model name. +- **ModelId** A model GUID. +- **PrimaryCategory** The primary category for the device container. +- **Categories** A comma separated list of functional categories in which the container belongs. +- **Icon** The path or index to the icon file. +- **IsConnected** For physically a attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. +- **IsActive** Is the device connected, or has it been seen in the last 14 days? +- **IsPaired** Does the device container require pairing? +- **IsNetworked** Is this a networked device? +- **IsMachineContainer** Is the container the root device itself? +- **FriendlyName** The name of the device container. +- **DiscoveryMethod** The discovery method for the device container. +- **ModelNumber** The model number for the device container. +- **Manufacturer** The manufacturer name for the device container. +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **objectInstanceId** ContainerId. Example: {552dd320-0dae-2794-2b41-df42fee22488} +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove + +This event indicates that the InventoryDeviceContainer object is no longer present. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync + +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd + +This event retrieves information about what sensor interfaces are available on the device. + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. +- **Accelerometer3D** Indicates if an Accelerator3D sensor is found. +- **ActivityDetection** Indicates if an Activity Detection sensor is found. +- **AmbientLight** Indicates if an Ambient Light sensor is found. +- **Barometer** Indicates if a Barometer sensor is found. +- **Custom** Indicates if a Custom sensor is found. +- **FloorElevation** Indicates if a Floor Elevation sensor is found. +- **GeomagneticOrientation** Indicates if a Geo Magnetic Orientation sensor is found. +- **GravityVector** Indicates if a Gravity Detector sensor is found. +- **Gyrometer3D** Indicates if a Gyrometer3D sensor is found. +- **Humidity** Indicates if a Humidity sensor is found. +- **LinearAccelerometer** Indicates if a Linear Accelerometer sensor is found. +- **Magnetometer3D** Indicates if a Magnetometer3D sensor is found. +- **Orientation** Indicates if an Orientation sensor is found. +- **Pedometer** Indicates if a Pedometer sensor is found. +- **Proximity** Indicates if a Proximity sensor is found. +- **RelativeOrientation** Indicates if a Relative Orientation sensor is found. +- **SimpleDeviceOrientation** Indicates if a Simple Device Orientation sensor is found. +- **Temperature** Indicates if a Temperature sensor is found. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync + +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. + +The following fields are available: + +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd + +This event sends additional metadata about a PNP device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. + +The following fields are available: + +- **audio.captureDriver** Audio device capture driver. Example: hdaudio.inf:db04a16ce4e8d6ee:HdAudModel:10.0.14887.1000:hdaudio\func_01 +- **audio.renderDriver** Audio device render driver. Example: hdaudio.inf:db04a16ce4e8d6ee:HdAudModel:10.0.14889.1001:hdaudio\func_01 +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **objectInstanceId** Device Instance ID of the PNP device. Example: hdaudio/func_01&ven_10ec&dev_0262&subsys_103c1309&rev_1002/4&12f2dd06&0&0001 +- **InventoryVersion** The version of the inventory file generating the events. +- **Audio_CaptureDriver** The Audio device capture driver endpoint. +- **Audio_RenderDriver** The Audio device render driver endpoint. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove + +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync + +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event sends basic metadata about a PNP device and its associated driver to help keep Windows up-to-date. + +The following fields are available: + +- **HWID** A JSON array that provides the value and order of the HWID tree for the device. +- **COMPID** A JSON array the provides the value and order of the compatible ID tree for the device. +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **Enumerator** The bus that enumerated the device. +- **ContainerId** A system-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the device. +- **DeviceState** DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present. +- **ParentId** Device instance id of the parent of the device. +- **STACKID** A JSON array that provides the value and order of the STACKID tree for the device. +- **Description** The device description. +- **MatchingID** Represents the hardware ID or compatible ID that Windows uses to install a device instance. +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device setup class guid of the driver loaded for the device. +- **Manufacturer** The device manufacturer. +- **Model** The device model. +- **Inf** The INF file name. +- **DriverVerVersion** The version of the driver loaded for the device. +- **DriverVerDate** The date of the driver loaded for the device. +- **Provider** The device provider. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **Service** The device service name. +- **LowerClassFilters** Lower filter class drivers IDs installed for the device. +- **LowerFilters** Lower filter drivers IDs installed for the device. +- **UpperClassFilters** Upper filter class drivers IDs installed for the device. +- **UpperFilters** Upper filter drivers IDs installed for the device. +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **objectInstanceId** The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 +- **DriverId** A unique identifier for the installed device. +- **DriverName** The name of the driver image file. +- **InventoryVersion** The version of the inventory file generating the events. +- **ProblemCode** The current error code for the device. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove + +This event indicates that the InventoryDevicePnpRemove object is no longer present. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync + +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd + +This event sends basic metadata about driver files running on the system to help keep Windows up-to-date. + +The following fields are available: + +- **DriverName** The file name of the driver. +- **Inf** The name of the INF file. +- **DriverPackageStrongName** The strong name of the driver package. +- **DriverCompany** The company name that developed the driver. +- **DriverCheckSum** The checksum of the driver file. +- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file. +- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000. +- **DriverInBox** Is the driver included with the operating system? +- **DriverSigned** Is the driver signed? +- **DriverIsKernelMode** Is it a kernel mode driver? +- **DriverVersion** The version of the driver file. +- **ImageSize** The size of the driver file. +- **Product** The product name that is included in the driver file. +- **ProductVersion** The product version that is included in the driver file. +- **WdfVersion** The Windows Driver Framework version. +- **Service** The name of the service that is installed for the device. +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **objectInstanceId** Can be used to join with InventoryDevicePnp (on driverId, upperFilters, etc.). Example: 000038dbe54a022b6c73edbdb8bf5cba32a882d2df2a +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove + +This event indicates that the InventoryDriverBinary object is no longer present. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync + +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd + +This event sends basic metadata about drive packages installed on the system to help keep Windows up-to-date. + +The following fields are available: + +- **Inf** The INF name of the driver package. +- **ClassGuid** The class GUID for the device driver. +- **Class** The class name for the device driver. +- **Directory** The path to the driver package. +- **Date** The driver package date. +- **Version** The version of the driver package. +- **Provider** The provider for the driver package. +- **SubmissionId** The HLK submission ID for the driver package. +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove + +This event indicates that the InventoryDriverPackage object represented by the objectInstanceId is no longer present. No object attributes are transmitted other than the objectInstanceId + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync + +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **InventoryVersion** The version of the inventory file generating the events. + + +### Microsoft.Windows.Inventory.Indicators.Checksum + +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. + +The following fields are available: + +- **CensusId** A unique hardware identifier. +- **ChecksumDictionary** A count of each operating system indicator. +- **PCFP** Microsoft.Windows.Inventory.Indicators + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd + +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. +- **Value** Describes an operating system indicator that may be relevant for the device upgrade. +- **IndicatorValue** The indicator value + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd, indicating that the item has been removed. There are no additional unique fields in this event. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. + + +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync + +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. + +The following fields are available: + +- **PartB_Ms.Device.DeviceInventoryChange** This field is replaced with the following fields: syncId, objectInstanceId, objectType, Action, and InventoryId. + + +## OneDrive events + +### Microsoft.OneDrive.Sync.Setup.APIOperation + +This event includes basic data about install and uninstall OneDrive API operations. + +The following fields are available: + +- **APIName** The name of the API. +- **ScenarioName** The name of the scenario. +- **Duration** How long the operation took. +- **isSuccess** Was the operation successful? +- **ResultCode** The result code. + + +### Microsoft.OneDrive.Sync.Setup.EndExperience + +This event includes a success or failure summary of the installation. + +The following fields are available: + +- **APIName** The name of the API. +- **ScenarioName** The name of the scenario. +- **Hresult** The HResult of the operation. +- **isSuccess** Was the operation successful? + + +### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation + +This event is related to the OS version when the OS is upgraded with OneDrive installed. + +The following fields are available: + +- **HResult** The HResult of the operation. +- **SourceOSVersion** The source version of the operating system. +- **SourceOSBuildNumber** The source build number of the operating system. +- **SourceOSBuildBranch** The source branch of the operating system. +- **CurrentOSVersion** The current version of the operating system. +- **CurrentOSBuildNumber** The current build number of the operating system. +- **CurrentOSBuildBranch** The current branch of the operating system. +- **CurrentOneDriveVersion** The current version of OneDrive. + + +### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation + +This event is related to registering or unregistering the OneDrive update task. + +The following fields are available: + +- **APIName** The name of the API. +- **ScenarioName** The name of the scenario. +- **UnregisterOldTaskResult** The HResult of the UnregisterOldTask operation. +- **RegisterNewTaskResult** The HResult of the RegisterNewTask operation. +- **isSuccess** Was the operation successful? + + +### Microsoft.OneDrive.Sync.Setup.SetupCommonData + +This event contains basic OneDrive configuration data that helps to diagnose failures. + +The following fields are available: + +- **AppVersion** The version of the app. +- **OfficeVersion** The version of Office that is installed. +- **BuildArch** Is the architecture x86 or x64? +- **Market** Which market is this in? +- **OneDriveDeviceId** The OneDrive device ID. +- **MachineGuid** The CEIP machine ID. +- **IsMSFTInternal** Is this an internal Microsoft device? +- **OSDeviceName** Only if the device is internal to Microsoft, the device name. +- **OSUserName** Only if the device is internal to Microsoft, the user name. +- **Environment** Is the device on the production or int service? +- **OfficeVersionString** The version of Office that is installed. +- **BuildArchitecture** Is the architecture x86 or x64? +- **UserGuid** The CEIP user ID. +- **MSFTInternal** Is this an internal Microsoft device? + + +### Microsoft.OneDrive.Sync.Updater.CommonData + +This event contains basic OneDrive configuration data that helps to diagnose failures. + +The following fields are available: + +- **AppVersion** The version of the app. +- **OfficeVersion** The version of Office that is installed. +- **BuildArch** Is the architecture x86 or x64? +- **Market** Which market is this in? +- **OneDriveDeviceId** The OneDrive device ID. +- **MachineGuid** The CEIP machine ID. +- **IsMSFTInternal** Is this an internal Microsoft device? +- **OSDeviceName** Only if the device is internal to Microsoft, the device name. +- **OSUserName** Only if the device is internal to Microsoft, the user name. +- **Environment** Is the device on the production or int service? +- **UserGuid** A unique global user identifier. + + +### Microsoft.OneDrive.Sync.Updater.ComponentInstallState + +This event determines the installation state of dependent OneDrive components. + +The following fields are available: + +- **ComponentName** The name of the dependent component. +- **isInstalled** Is the dependent component installed? + + +### Microsoft.OneDrive.Sync.Updater.OfficeRegistration + +This event determines the status of the OneDrive integration with Microsoft Office. + +The following fields are available: + +- **isValid** Is the Microsoft Office registration valid? + + +### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus + +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken + +The following fields are available: + +- **32bit** The status of the OneDrive overlay icon on a 32-bit operating system. +- **64bit** The status of the OneDrive overlay icon on a 64-bit operating system. + + +### Microsoft.OneDrive.Sync.Updater.RepairResult + +The event determines the result of the installation repair. + +The following fields are available: + +- **hr** The HResult of the operation. + + +### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult + +This event indicates the status when downloading the OneDrive setup file. + +The following fields are available: + +- **hr** The HResult of the operation. + + +### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult + +This event determines the outcome of the operation. + +The following fields are available: + +- **UpdaterVersion** The version of the updater. +- **IsLoggingEnabled** Is logging enabled? +- **hr** The HResult of the operation. + + +### Microsoft.OneDrive.Sync.Updater.UpdateTierReg + +This event determines status of the update tier registry values. + +The following fields are available: + +- **regReadEnterpriseHr** The HResult of the enterprise reg read value. +- **regReadTeamHr** The HResult of the team reg read value. + + +### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult + +This event determines the status when downloading the OneDrive update configuration file. + +The following fields are available: + +- **hr** The HResult of the operation. + + +### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus + +This event determines the error code that was returned when verifying Internet connectivity. + +The following fields are available: + +- **winInetError** The HResult of the operation. + + +## Setup events + +### SetupPlatformTel.SetupPlatformTelActivityEvent + +This event sends a unique ID that can be used to bind Setup Platform events together, to help keep Windows up to date. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **Value** Retrieves the value associated with the corresponding event name. For example: For time-related events, this will include the system time. +- **ActivityId** Provides a unique Id to correlate events that occur between a activity start event, and a stop event +- **ActivityName** Provides a friendly name of the package type that belongs to the ActivityId (Setup, LanguagePack, GDR, Driver, etc.) + + +### SetupPlatformTel.SetupPlatformTelActivityStarted + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + +The following fields are available: + +- **Name** The name of the dynamic update type. Example: GDR driver + + +### SetupPlatformTel.SetupPlatformTelActivityStopped + +This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date. + + + +### SetupPlatformTel.SetupPlatformTelEvent + +This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios. + +The following fields are available: + +- **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. +- **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. +- **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. + + +## Shared PC events + +### Microsoft.Windows.SharedPC.AccountManager.DeleteUserAccount + +Activity for deletion of a user account for devices set up for Shared PC mode as part of the Transient Account Manager to help keep Windows up to date. Deleting unused user accounts on shared devices frees up disk space to improve Windows Update success rates. + +The following fields are available: + +- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. +- **userSid** The security identifier of the account. +- **accountType** The type of account that was deleted. Example: AD, AAD, or Local + + +### Microsoft.Windows.SharedPC.AccountManager.SinglePolicyEvaluation + +Activity for run of the Transient Account Manager that determines if any user accounts should be deleted for devices set up for Shared PC mode to help keep Windows up to date. Deleting unused user accounts on shared devices frees up disk space to improve Windows Update success rates + +The following fields are available: + +- **wilActivity** Windows Error Reporting data collected when there is a failure in evaluating accounts to be deleted with the Transient Account Manager. +- **totalAccountCount** The number of accounts on a device after running the Transient Account Manager policies. +- **evaluationTrigger** When was the Transient Account Manager policies ran? Example: At log off or during maintenance hours + + +## Software update events + +### SoftwareUpdateClientTelemetry.CheckForUpdates + +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date + +The following fields are available: + +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **EventInstanceID** A globally unique identifier for event instance. +- **DeviceModel** What is the device model. +- **BiosName** The name of the device BIOS. +- **BIOSVendor** The vendor of the BIOS. +- **BiosVersion** The version of the BIOS. +- **BiosReleaseDate** The release date of the device BIOS. +- **SystemBIOSMajorRelease** Major version of the BIOS. +- **SystemBIOSMinorRelease** Minor version of the BIOS. +- **BiosFamily** The family of the BIOS (Basic Input Output System). +- **BiosSKUNumber** The sku number of the device BIOS. +- **ClientVersion** The version number of the software distribution client. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.). +- **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult). +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds). +- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds). +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **ShippingMobileOperator** The mobile operator that a device shipped on. +- **CurrentMobileOperator** The mobile operator the device is currently connected to. +- **HomeMobileOperator** The mobile operator that the device was originally intended to work with. +- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced. +- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion. +- **SyncType** Describes the type of scan the event was +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6 +- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked +- **ScanDurationInSeconds** The number of seconds a scan took +- **ScanEnqueueTime** The number of seconds it took to initialize a scan +- **NumberOfLoop** The number of round trips the scan required +- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan +- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan +- **ServiceUrl** The environment URL a device is configured to scan with +- **Online** Indicates if this was an online scan. +- **AllowCachedResults** Indicates if the scan allowed using cached results. +- **MetadataIntegrityMode** The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce +- **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. +- **NumFailedMetadataSignatures** The number of metadata signatures checks which failed for new metadata synced down. +- **MSIError** The last error that was encountered during a scan for updates. +- **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered. +- **FailedUpdatesCount** The number of updates that failed to be evaluated during the scan. +- **FailedUpdateGuids** The GUIDs for the updates that failed to be evaluated during the scan. +- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated. +- **ExtendedMetadataCabUrl** Hostname that is used to download an update. +- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **CDNCountryCode** Two letter country abbreviation for the CDN's location. +- **NetworkConnectivityDetected** Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6 +- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable +- **WebServiceRetryMethods** Web service method requests that needed to be retried to complete operation. +- **DeferredUpdates** Update IDs which are currently being deferred until a later time +- **BranchReadinessLevel** The servicing branch configured on the device. +- **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000). +- **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days). +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **QualityUpdatePausePeriod** The pause duration configured for quality OS updates on the device (in days). +- **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days). +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days). +- **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. +- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. +- **SearchFilter** Contains information indicating filters applied while checking for content applicable to the device. For example, to filter out all content which may require a reboot. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **PausedUpdates** A list of UpdateIds which that currently being paused. +- **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **PauseFeatureUpdatesEndTime** If feature OS updates are paused on the device, this is the date and time for the end of the pause time window. +- **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown +- **DriverSyncPassPerformed** Were drivers scanned this time? + + +### SoftwareUpdateClientTelemetry.Commit + +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. + +The following fields are available: + +- **EventScenario** State of call +- **EventInstanceID** A globally unique identifier for event instance. +- **DeviceModel** What is the device model. +- **BiosName** The name of the device BIOS. +- **BIOSVendor** The vendor of the BIOS. +- **BiosVersion** The version of the BIOS. +- **BiosReleaseDate** The release date of the device BIOS. +- **SystemBIOSMajorRelease** Major version of the BIOS. +- **SystemBIOSMinorRelease** Minor version of the BIOS. +- **BiosFamily** The family of the BIOS (Basic Input Output System). +- **BiosSKUNumber** The sku number of the device BIOS. +- **ClientVersion** The version number of the software distribution client. +- **WUDeviceID** UniqueDeviceID +- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Windows Store. +- **EventType** Possible values are "Child", "Bundle", or "Driver". +- **UpdateId** Unique Update ID +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **RevisionNumber** Unique revision number of Update +- **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) +- **BundleRevisionNumber** Identifies the revision number of the content bundle +- **FlightId** The specific id of the flight the device is getting +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client + + +### SoftwareUpdateClientTelemetry.Download + +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed. +- **EventInstanceID** A globally unique identifier for event instance. +- **DeviceModel** What is the device model. +- **BiosName** The name of the device BIOS. +- **BIOSVendor** The vendor of the BIOS. +- **BiosVersion** The version of the BIOS. +- **BiosReleaseDate** The release date of the device BIOS. +- **SystemBIOSMajorRelease** Major version of the BIOS. +- **SystemBIOSMinorRelease** Minor version of the BIOS. +- **BiosFamily** The family of the BIOS (Basic Input Output System). +- **BiosSKUNumber** The sku number of the device BIOS. +- **ClientVersion** The version number of the software distribution client. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.). +- **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds). +- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds). +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **IsWUfBEnabled** Indicates if Windows Update for Business is enabled on the device. +- **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. +- **ShippingMobileOperator** The mobile operator that a device shipped on. +- **CurrentMobileOperator** The mobile operator the device is currently connected to. +- **HomeMobileOperator** The mobile operator that the device was originally intended to work with. +- **PhonePreviewEnabled** Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced. +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6. +- **NetworkCostBitMask** Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.) +- **NetworkRestrictionStatus** More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered." +- **TimeToEstablishConnection** Time (in ms) it took to establish the connection prior to beginning downloaded. +- **HostName** The hostname URL the content is downloading from. +- **CDNId** ID which defines which CDN the software distribution client downloaded the content from. +- **CDNCountryCode** Two letter country abbreviation for the CDN's location. +- **ActiveDownloadTime** How long the download took, in seconds, excluding time where the update wasn't actively being downloaded. +- **IsDependentSet** Indicates whether a driver is a part of a larger System Hardware/Firmware Update +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **HardwareId** If this download was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download. +- **BytesDownloaded** How many bytes were downloaded for an individual piece of content (not the entire bundle). +- **TotalExpectedBytes** The total count of bytes that the download is expected to be. +- **ThrottlingServiceHResult** Result code (success/failure) while contacting a web service to determine whether this device should download content yet. +- **EventType** Possible values are Child, Bundle, or Driver. +- **UpdateId** An identifier associated with the specific piece of content. +- **RevisionNumber** Identifies the revision number of this specific piece of content. +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **HandlerType** Indicates what kind of content is being downloaded (app, driver, windows patch, etc.). +- **DownloadPriority** Indicates whether a download happened at background, normal, or foreground priority. +- **FlightId** The specific id of the flight (pre-release build) the device is getting. +- **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway. +- **UsedDO** Whether the download used the delivery optimization service. +- **CbsDownloadMethod** Indicates whether the download was a full-file download or a partial/delta download. +- **UsedSystemVolume** Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive. +- **FlightBuildNumber** If this download was for a flight (pre-release build), this indicates the build number of that flight. +- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle. +- **BundleRepeatFailFlag** Indicates whether this particular update bundle had previously failed to download. +- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events. +- **PackageFullName** The package name of the content. +- **AppXBlockHashValidationFailureCount** A count of the number of blocks that have failed validation after being downloaded. +- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. +- **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. +- **DownloadType** Differentiates the download type of SIH downloads between Metadata and Payload downloads. +- **WUSetting** Indicates the users' current updating settings. +- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM). +- **PlatformRole** The PowerPlatformRole as defined on MSDN +- **IsAOACDevice** Is it Always On, Always Connected? +- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc. +- **Edition** Indicates the edition of Windows being used. +- **DeviceOEM** What OEM does this device belong to. +- **ClientManagedByWSUSServer** Indicates whether the client is managed by Windows Server Update Services (WSUS). +- **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. +- **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. +- **AppXDownloadScope** Indicates the scope of the download for application content. For streaming install scenarios, AllContent - non-streaming download, RequiredOnly - streaming download requested content required for launch, AutomaticOnly - streaming download requested automatic streams for the app, and Unknown - for events sent before download scope is determined by the Windows Update client. + + +### SoftwareUpdateClientTelemetry.Install + +This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date. + +The following fields are available: + +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **EventInstanceID** A globally unique identifier for event instance. +- **DeviceModel** What is the device model. +- **BiosName** The name of the device BIOS. +- **BIOSVendor** The vendor of the BIOS. +- **BiosVersion** The version of the BIOS. +- **BiosReleaseDate** The release date of the device BIOS. +- **SystemBIOSMajorRelease** Major version of the BIOS. +- **SystemBIOSMinorRelease** Minor version of the BIOS. +- **BiosFamily** The family of the BIOS (Basic Input Output System). +- **BiosSKUNumber** The sku number of the device BIOS. +- **ClientVersion** The version number of the software distribution client. +- **WUDeviceID** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue. +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.). +- **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult). +- **ExtendedStatusCode** Secondary error code for certain scenarios where StatusCode wasn't specific enough. +- **FlightRing** The ring that a device is on if participating in the Windows Insider Program. +- **FlightBranch** The branch that a device is on if participating in the Windows Insider Program. +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **IsWUfBEnabled** Is Windows Update for Business enabled on the device? +- **IsWUfBDualScanEnabled** Is Windows Update for Business dual scan enabled on the device? +- **ShippingMobileOperator** The mobile operator that a device shipped on. +- **CurrentMobileOperator** Mobile operator that device is currently connected to. +- **HomeMobileOperator** The mobile operator that the device was originally intended to work with. +- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting being introduced. +- **TargetGroupId** For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver. +- **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install. +- **EventType** Possible values are Child, Bundle, or Driver. +- **TargetingVersion** For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device. +- **UpdateImportance** Indicates whether a piece of content was marked as Important, Recommended, or Optional. +- **IsFirmware** Is this update a firmware update? +- **IsFinalOutcomeEvent** Does this event signal the end of the update/upgrade process? +- **IsDependentSet** Is the driver part of a larger System Hardware/Firmware update? +- **DriverPingBack** Contains information about the previous driver and system state. +- **ExtendedErrorCode** The extended error code. +- **CSIErrorType** The stage of CBS installation where it failed. +- **MsiAction** The stage of MSI installation where it failed. +- **MsiProductCode** The unique identifier of the MSI installer. +- **TransactionCode** The ID which represents a given MSI installation +- **HardwareId** If this install was for a driver targeted to a particular device model, this ID indicates the model of the device. +- **IsSuccessFailurePostReboot** Did it succeed and then fail after a restart? +- **UpdateId** Unique update ID +- **RevisionNumber** The revision number of this specific piece of content. +- **BundleId** Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found. +- **BundleRevisionNumber** Identifies the revision number of the content bundle. +- **HandlerType** Indicates what kind of content is being installed. Example: app, driver, Windows update +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway. +- **UsedSystemVolume** Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive. +- **FlightBuildNumber** If this installation was for a Windows Insider build, this is the build number of that build. +- **BundleRepeatFailFlag** Has this particular update bundle previously failed to install? +- **PackageFullName** The package name of the content being installed. +- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. +- **BundleBytesDownloaded** How many bytes were downloaded for the specific content bundle? +- **CbsDownloadMethod** Was the download a full download or a partial download? +- **ClientManagedByWSUSServer** Is the client managed by Windows Server Update Services (WSUS)? +- **DeviceOEM** What OEM does this device belong to. +- **DownloadPriority** The priority of the download activity. +- **DownloadScenarioId** A unique ID for a given download used to tie together WU and DO events. +- **Edition** Indicates the edition of Windows being used. +- **EventNamespaceID** Indicates whether the event succeeded or failed. Has the format EventType+Event where Event is Succeeded, Cancelled, Failed, etc. +- **IsAOACDevice** Is it Always On, Always Connected? (Mobile device usage model) +- **PlatformRole** The PowerPlatformRole as defined on MSDN. +- **ProcessorArchitecture** Processor architecture of the system (x86, AMD64, ARM). +- **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it. +- **WUSetting** Indicates the user's current updating settings. +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. +- **QualityUpdatePause** Are quality OS updates paused on the device? +- **FeatureUpdatePause** Are feature OS updates paused on the device? +- **MergedUpdate** Was the OS update and a BSP update merged for installation? + + +### SoftwareUpdateClientTelemetry.SLSDiscovery + +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. + +The following fields are available: + +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed +- **SusClientId** The unique device ID controlled by the software distribution client +- **WUAVersion** The version number of the software distribution client +- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.) +- **UrlPath** Path to the SLS cab that was downloaded +- **HResult** Indicates the result code of the event (success, cancellation, failure code HResult) +- **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background +- **NextExpirationTime** Indicates when the SLS cab expires + + +### SoftwareUpdateClientTelemetry.UpdateDetected + +This event sends data about an AppX app that has been updated from the Windows Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. + +The following fields are available: + +- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client +- **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable +- **NumberOfApplicableUpdates** The number of updates which were ultimately deemed applicable to the system after the detection process is complete +- **WUDeviceID** The unique device ID controlled by the software distribution client +- **RelatedCV** The previous Correlation Vector that was used before swapping with a new one +- **EventScenario** Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed +- **EventInstanceID** A globally unique identifier for event instance +- **DeviceModel** The device's model as defined in system bios +- **BiosName** The name of the device's system bios +- **BIOSVendor** The vendor of the device's system bios +- **BiosVersion** The version of the device's system bios +- **BiosReleaseDate** The release date of the device's system bios +- **SystemBIOSMajorRelease** The major release version of the device's system system +- **SystemBIOSMinorRelease** The minor release version of the device's system system +- **BiosFamily** The device's family as defined in system bios +- **BiosSKUNumber** The device's SKU as defined in system bios +- **ClientVersion** The version number of the software distribution client +- **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided +- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.) +- **StatusCode** Indicates the result code of the event (success, cancellation, failure code HResult) +- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode wasn't specific enough +- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds). +- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds). +- **ShippingMobileOperator** The mobile operator that a device shipped on. +- **CurrentMobileOperator** The mobile operator the device is currently connected to. +- **HomeMobileOperator** The mobile operator that the device was originally intended to work with +- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced. +- **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion +- **SyncType** Describes the type of scan the event was +- **IPVersion** Indicates whether the download took place over IPv4 or IPv6 +- **NumberOfApplicationsCategoryScanEvaluated** The number of categories (apps) for which an app update scan checked +- **ScanDurationInSeconds** The number of seconds a scan took +- **ScanEnqueueTime** The number of seconds it took to initialize a scan +- **NumberOfLoop** The number of round trips the scan required +- **NumberOfUpdatesEvaluated** The total number of updates which were evaluated as a part of the scan +- **NumberOfNewUpdatesFromServiceSync** The number of updates which were seen for the first time in this scan +- **ServiceUrl** The environment URL a device is configured to scan with +- **IntentPFNs** Intended application-set metadata for atomic update scenarios. + + +### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity + +This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. + +The following fields are available: + +- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed. +- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store +- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce +- **StatusCode** The status code of the event. +- **ExtendedStatusCode** The secondary status code of the event. +- **RevisionId** The revision ID for a specific piece of content. +- **UpdateId** The update ID for a specific piece of content. +- **RevisionNumber** The revision number for a specific piece of content. +- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed. +- **LeafCertId** Integral ID from the FragmentSigning data for certificate that failed. +- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. +- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). +- **SignatureAlgorithm** The hash algorithm for the metadata signature. +- **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob. +- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token. +- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable. +- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable. +- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate. +- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate. +- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. +- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast + + +## Update events + +### Update360Telemetry.UpdateAgent_DownloadRequest + +This event sends data during the download request phase of updating Windows. + +The following fields are available: + +- **ErrorCode** The error code returned for the current download request phase. +- **PackageCountTotal** Total number of packages needed. +- **PackageCountRequired** Number of required packages requested. +- **PackageCountOptional** Number of optional packages requested. +- **ObjectId** Unique value for each Update Agent mode. +- **SessionId** Unique value for each Update Agent mode attempt. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Result of the download request phase of update. +- **PackageSizeCanonical** Size of canonical packages in bytes +- **PackageSizeDiff** Size of diff packages in bytes +- **PackageSizeExpress** Size of express packages in bytes +- **FlightId** Unique ID for each flight. +- **UpdateId** Unique ID for each update. +- **PackageCountTotalCanonical** Total number of canonical packages. +- **PackageCountTotalDiff** Total number of diff packages. +- **PackageCountTotalExpress** Total number of express packages. +- **RangeRequestState** Represents the state of the download range request. +- **DeletedCorruptFiles** Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted. + + +### Update360Telemetry.UpdateAgent_Initialize + +This event sends data during the initialize phase of updating Windows. + +The following fields are available: + +- **ErrorCode** The error code returned for the current initialize phase. +- **SessionData** Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios). +- **UpdateId** Unique ID for each update. +- **FlightId** Unique ID for each flight. +- **FlightMetadata** Contains the FlightId and the build being flighted. +- **ObjectId** Unique value for each Update Agent mode. +- **SessionId** Unique value for each Update Agent mode attempt . +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** Result of the initialize phase of update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled + + +### Update360Telemetry.UpdateAgent_Install + +This event sends data during the install phase of updating Windows. + +The following fields are available: + +- **ErrorCode** The error code returned for the current install phase. +- **ObjectId** Unique value for each Update Agent mode. +- **SessionId** Unique value for each Update Agent mode attempt. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate +- **RelatedCV** Correlation vector value generated from the latest scan. +- **Result** Result of the install phase of update. 0 = Succeeded 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled +- **FlightId** Unique ID for each flight. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgent_ModeStart + +This event sends data for the start of each mode during the process of updating Windows. + +The following fields are available: + +- **Mode** Indicates that the Update Agent mode that has started. 1 = Initialize, 2 = DownloadRequest, 3 = Install, 4 = Commit +- **ObjectId** Unique value for each Update Agent mode. +- **SessionId** Unique value for each Update Agent mode attempt. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate +- **RelatedCV** The correlation vector value generated from the latest scan. +- **FlightId** Unique ID for each flight. +- **UpdateId** Unique ID for each update. + + +### Update360Telemetry.UpdateAgent_SetupBoxLaunch + +This event sends data during the launching of the setup box when updating Windows. + +The following fields are available: + +- **Quiet** Indicates whether setup is running in quiet mode. 0 = false 1 = true +- **ObjectId** Unique value for each Update Agent mode. +- **SessionId** Unique value for each Update Agent mode attempt. +- **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate +- **RelatedCV** Correlation vector value generated from the latest scan. +- **FlightId** Unique ID for each flight. +- **UpdateId** Unique ID for each update. +- **SetupMode** Setup mode 1 = predownload, 2 = install, 3 = finalize +- **SandboxSize** The size of the sandbox folder on the device. + + +## Upgrade events + +### Setup360Telemetry.Downlevel + +This event sends data indicating that the device has invoked the downlevel phase of the upgrade. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ClientId** If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId. +- **TestId** A string that uniquely identifies a group of events. +- **State** Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The operating system edition which is running Setup360 instance (downlevel OS). +- **HostOSBuildNumber** The build number of the downlevel OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. It's an HRESULT error code that can be used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). + + +### Setup360Telemetry.Finalize + +This event sends data indicating that the device has invoked the finalize phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.OsUninstall + +The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.OSUninstall indicates the outcome of an OS uninstall. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **WuId** Windows Update client ID. +- **TestId** A string to uniquely identify a group of events. +- **State** Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.PostRebootInstall + +This event sends data indicating that the device has invoked the postrebootinstall phase of the upgrade, to help keep Windows up-to-date. + +The following fields are available: + +- **ClientId** With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as ClientId. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that's used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.PreDownloadQuiet + +This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous operating system). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.PreDownloadUX + +The event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PredownloadUX indicates the outcome of the PredownloadUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** Unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **WuId** Windows Update client ID. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous operating system). +- **HostOSBuildNumber** The build number of the previous operating system. +- **Setup360Scenario** The Setup360 flow type. Examplle: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of the target OS). + + +### Setup360Telemetry.PreInstallQuiet + +This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** Setup360 flow type (Boot, Media, Update, MCT) +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback etc. +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.PreInstallUX + +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, the Setup360Telemetry.PreinstallUX indicates the outcome of the PreinstallUX portion of the update process. + +The following fields are available: + +- **ClientId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe. +- **ReportId** For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim. +- **WuId** Windows Update client ID. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running the Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type, Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that is used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +### Setup360Telemetry.Setup360 + +This event sends data about OS deployment scenarios, to help keep Windows up-to-date. + +The following fields are available: + +- **InstanceId** Retrieves a unique identifier for each instance of a setup session. +- **ReportId** Retrieves the report ID. +- **FlightData** Specifies a unique identifier for each group of Windows Insider builds. +- **ScenarioId** Retrieves the deployment scenario. +- **FieldName** Retrieves the data point. +- **Value** Retrieves the value associated with the corresponding FieldName. +- **ClientId** Retrieves the upgrade ID: Upgrades via Windows Update - specifies the WU clientID. All other deployment - static string. + + +### Setup360Telemetry.UnexpectedEvent + +This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date. + +The following fields are available: + +- **ClientId** With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **InstanceId** A unique GUID that identifies each instance of setuphost.exe +- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim. +- **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +- **TestId** A string to uniquely identify a group of events. +- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled +- **HostOsSkuName** The OS edition which is running Setup360 instance (previous OS). +- **HostOSBuildNumber** The build number of the previous OS. +- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT +- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback +- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors. +- **Setup360Extended** Extension of result - more granular information about phase/action when the potential failure happened +- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS). + + +## Windows Error Reporting events + +### Microsoft.Windows.WERVertical.OSCrash + +This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. + +The following fields are available: + +- **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). +- **BugCheckCode** Uint64 "bugcheck code" that identifies a proximate cause of the bug check. +- **BugCheckParameter1** Uint64 parameter providing additional information. +- **BootId** Uint32 identifying the boot number for this device. +- **BugCheckParameter2** Uint64 parameter providing additional information. +- **BugCheckParameter4** Uint64 parameter providing additional information. +- **BugCheckParameter3** Uint64 parameter providing additional information. +- **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise +- **DumpFileSize** Size of the dump file +- **DumpFileAttributes** Codes that identify the type of data contained in the dump file + + +## Windows Store events + +### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation + +This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure. + +The following fields are available: + +- **PFN** The product family name of the product being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed before this operation. +- **IsUpdate** Flag indicating if this is an update. +- **AttemptNumber** Number of retry attempts before it was canceled. +- **CategoryId** The Item Category ID. +- **ProductId** The identity of the package or packages being installed. +- **IsInteractive** Was this requested by a user? +- **IsRemediation** Was this a remediation install? +- **BundleId** The Item Bundle ID. +- **IsMandatory** Was this a mandatory update? +- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled. +- **UserAttemptNumber** The total number of user attempts at installation before it was canceled. +- **IsRestore** Is this automatically restoring a previously acquired product? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds + +This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure. + + + +### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare + +This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure. + + + +### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation + +This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **IsInteractive** Was this requested by a user? +- **AttemptNumber** Total number of installation attempts. +- **BundleId** The identity of the Windows Insider build that is associated with this product. +- **PreviousHResult** The previous HResult code. +- **ClientAppId** The identity of the app that initiated this operation. +- **CategoryId** The identity of the package or packages being installed. +- **PFN** The name of all packages to be downloaded and installed. +- **ProductId** The name of the package or packages requested for installation. +- **IsUpdate** Is this a product update? +- **IsRemediation** Is this repairing a previous installation? +- **RelatedCV** Correlation Vector of a previous performed action on this product. +- **PreviousInstallState** Previous installation state before it was canceled. +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** Total number of automatic attempts to install before it was canceled. +- **UserAttemptNumber** Total number of user attempts to install before it was canceled. +- **IsRestore** Is this an automatic restore of a previously acquired product? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The names of all package or packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest + +This event is sent after the app installations or updates. It's used to help keep Windows up-to-date and secure + +The following fields are available: + +- **IsBundle** Is this a bundle? +- **ProductId** The Store Product ID of the product being installed. +- **SkuId** Specific edition of the item being installed. +- **CatalogId** The Store Product ID of the app being installed. +- **PackageFamilyName** The name of the package being installed. +- **HResult** HResult code of the action being performed. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense + +This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **PFN** Product Family Name of the product being installed. +- **HResult** HResult code to show the result of the operation (success/failure). +- **ProductId** The Store Product ID for the product being installed. +- **IsInteractive** Did the user initiate the installation? +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **IsRemediation** Is this repairing a previous installation? +- **UpdateId** The update ID (if this is an update) +- **AttemptNumber** The total number of attempts to acquire this product. +- **IsUpdate** Is this an update? +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** The number of attempts by the system to acquire this product. +- **UserAttemptNumber** The number of attempts by the user to acquire this product +- **IsRestore** Is this happening after a device restore? +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **ParentBundledId** The product's parent bundle ID. +- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndDownload + +This event happens during the app update or installation when content is being downloaded at the end of the process to report success or failure. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **PFN** The Product Family Name of the app being download. +- **IsRemediation** Is this repairing a previous installation? +- **DownloadSize** The total size of the download. +- **ClientAppId** The identity of the app that initiated this operation. +- **CategoryId** The identity of the package or packages being installed. +- **IsUpdate** Is this an update? +- **HResult** The result code of the last action performed. +- **IsInteractive** Is this initiated by the user? +- **AttemptNumber** Number of retry attempts before it was canceled. +- **BundleId** The identity of the Windows Insider build associated with this product. +- **ProductId** The Store Product ID for the product being installed. +- **IsMandatory** Is this a mandatory installation? +- **SystemAttemptNumber** The number of attempts by the system to download. +- **UserAttemptNumber** The number of attempts by the user to download. +- **IsRestore** Is this a restore of a previously acquired product? +- **ParentBundleId** The parent bundle ID (if it's part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID. +- **ExtendedHResult** Any extended HResult error codes. +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate + +This event happens when an app update requires an updated Framework package and the process starts to download it. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed before this operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds + +This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed before this operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndInstall + +This event is sent after a product has been installed. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **BundleId** The identity of the build associated with this product. +- **PFN** Product Family Name of the product being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **CategoryId** The identity of the package or packages being installed. +- **ProductId** The Store Product ID for the product being installed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **HResult** The result code of the last action performed. +- **IsRemediation** Is this repairing a previous installation? +- **IsInteractive** Is this an interactive installation? +- **IsUpdate** Is this an update? +- **IsMandatory** Is this a mandatory installation? +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **IsRestore** Is this automatically restoring a previously acquired product? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **ExtendedHResult** The extended HResult error code. +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates + +This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed. +- **IsApplicability** Is this request to only check if there are any applicable packages to install? +- **IsInteractive** Is this user requested? +- **ClientAppId** The identity of the app that initiated this operation. +- **IsOnline** Is the request doing an online check? + + +### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages + +This event is sent after searching for update packages to install. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **IsRemediation** Is this repairing a previous installation? +- **IsUpdate** Is this an update? +- **ClientAppId** The identity of the app that initiated this operation. +- **HResult** The result code of the last action performed. +- **ProductId** The Store Product ID for the product being installed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **IsInteractive** Is this user requested? +- **PFN** The name of the package or packages requested for install. +- **BundleId** The identity of the build associated with this product. +- **CategoryId** The identity of the package or packages being installed. +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **IsRestore** Is this restoring previously acquired content? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData + +This event is sent between download and installation to see if there is app data that needs to be restored from the cloud. It's used to keep Windows up-to-date and secure. + +The following fields are available: + +- **IsInteractive** Is this user requested? +- **PFN** The name of the package or packages requested for install. +- **IsUpdate** Is this an update? +- **CategoryId** The identity of the package or packages being installed. +- **HResult** The result code of the last action performed. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **ProductId** The Store Product ID for the product being installed. +- **BundleId** The identity of the build associated with this product. +- **IsRemediation** Is this repairing a previous installation? +- **ClientAppId** The identity of the app that initiated this operation. +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of system attempts. +- **IsRestore** Is this restoring previously acquired content? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The name of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare + +This event happens after a scan for available app updates. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete + +This event is sent at the end of an app install or update and is used to track the very end of the install or update process. + +The following fields are available: + +- **ProductId** The product ID of the app that is being updated or installed. +- **PFN** The Package Family Name of the app that is being installed or updated. +- **FailedRetry** Was the installation or update retry successful? +- **HResult** The HResult code of the operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate + +This event is sent at the beginning of an app install or update and is used to track the very beginning of the install or update process. + +The following fields are available: + +- **ProductId** The product ID of the app that is being updated or installed. +- **PFN** The Package Family Name of the app that is being installed or updated. + + +### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest + +This event happens at the beginning of the install process when an app update or new app is installed. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **CatalogId** If this product is from a private catalog, the Store Product ID for the product being installed. +- **BundleId** The identity of the build associated with this product. +- **SkuId** Specific edition ID being installed. +- **ProductId** The Store Product ID for the product being installed. +- **VolumePath** The disk path of the installation. + + +### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation + +This event is sent when a product install or update is paused either by a user or the system. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **RelatedCV** Correlation Vector of a previous performed action on this product. +- **IsRemediation** Is this repairing a previous installation? +- **PreviousHResult** The result code of the last action performed before this operation. +- **ProductId** The Store Product ID for the product being installed. +- **IsUpdate** Is this an update? +- **PreviousInstallState** Previous state before the installation or update was paused. +- **CategoryId** The identity of the package or packages being installed. +- **ClientAppId** The identity of the app that initiated this operation. +- **AttemptNumber** The total number of retry attempts before it was canceled. +- **IsInteractive** Is this user requested? +- **BundleId** The identity of the build associated with this product. +- **PFN** The Product Full Name. +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **IsRestore** Is this restoring previously acquired content? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation + +This event happens when a product install or update is resumed either by a user or the system. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **RelatedCV** Correlation Vector for the original install before it was resumed. +- **AttemptNumber** The number of retry attempts before it was canceled. +- **BundleId** The identity of the build associated with this product. +- **PreviousHResult** The previous HResult error code. +- **ClientAppId** The identity of the app that initiated this operation. +- **CategoryId** The identity of the package or packages being installed. +- **PFN** The name of the package or packages requested for install. +- **IsUpdate** Is this an update? +- **PreviousInstallState** Previous state before the installation was paused. +- **IsRemediation** Is this repairing a previous installation? +- **IsInteractive** Is this user requested? +- **ProductId** The Store Product ID for the product being installed. +- **IsMandatory** Is this a mandatory update? +- **SystemAttemptNumber** The total number of system attempts. +- **UserAttemptNumber** The total number of user attempts. +- **IsRestore** Is this restoring previously acquired content? +- **ParentBundleId** The product ID of the parent (if this product is part of a bundle). +- **IsBundle** Is this a bundle? +- **WUContentId** The Windows Update content ID +- **AggregatedPackageFullNames** The names of all packages to be downloaded and installed. +- **IsUserRetry** Did the user initiate the retry? +- **HResult** The result code of the last action performed before this operation. + + +### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest + +This event happens when a product install or update is resumed by a user and on installation retries. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ProductId** The Store Product ID for the product being installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest + +This event is sent when searching for update packages to install. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **ProductId** The Store Product ID for the product being installed. +- **SkuId** Specfic edition of the app being updated. +- **CatalogId** The Store Product ID for the product being installed. + + +### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest + +This event happens an app for a user needs to be updated. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **PFamN** The name of the product that is requested for update. + + +## Windows Update Delivery Optimization events + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled + +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. + +The following fields are available: + +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same group. +- **fileID** The ID of the file being downloaded. +- **sessionID** The ID of the file download session. +- **scenarioID** The ID of the scenario. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **updateID** The ID of the update being downloaded. +- **background** Is the download being done in the background? +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **clientTelId** A random number used for device sampling. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same group. +- **errorCode** The error code that was returned. +- **doErrorCode** The Delivery Optimization error code that was returned. +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **experimentId** When running a test, this is used to correlate events that are part of the same test. +- **isVpn** Is the device connected to a Virtual Private Network? +- **usedMemoryStream** Did the download use memory streaming? + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted + +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. + +The following fields are available: + +- **sessionID** The ID of the download session. +- **scenarioID** The ID of the scenario. +- **bytesFromIntPeers** The number of bytes received from peers not in the same LAN or in the same domain group. +- **updateID** The ID of the update being downloaded. +- **fileSize** The size of the file being downloaded. +- **bytesFromCDN** The number of bytes received from a CDN source. +- **fileID** The ID of the file being downloaded. +- **background** Is the download a background download? +- **bytesFromPeers** The number of bytes received from a peer in the same LAN. +- **totalTime** How long did the download take (in seconds)? +- **restrictedUpload** Is the upload restricted? +- **clientTelId** A random number used for device sampling. +- **bytesFromGroupPeers** The number of bytes received from a peer in the same domain group. +- **downloadMode** The download mode used for this file download session. +- **doErrorCode** The Delivery Optimization error code that was returned. +- **numPeers** The total number of peers used for this download. +- **cdnConnectionCount** The total number of connections made to the CDN. +- **lanConnectionCount** The total number of connections made to peers in the same LAN. +- **groupConnectionCount** The total number of connections made to peers in the same group. +- **internetConnectionCount** The total number of connections made to peers not in the same LAN or the same group. +- **cdnIp** The IP address of the source CDN. +- **downlinkBps** The maximum measured available download bandwidth (in bytes per second). +- **uplinkBps** The maximum measured available upload bandwidth (in bytes per second). +- **downlinkUsageBps** The download speed (in bytes per second). +- **uplinkUsageBps** The upload speed (in bytes per second). +- **totalTimeMs** Duration of the download (in seconds). +- **cdnErrorCodes** A list of CDN connection errors since the last FailureCDNCommunication event. +- **cdnErrorCounts** The number of times each error in cdnErrorCodes was encountered. +- **bytesRequested** The total number of bytes requested for download. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **isVpn** Is the device connected to a Virtual Private Network? +- **usedMemoryStream** Did the download use memory streaming? + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused + +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. + +The following fields are available: + +- **updateID** The ID of the update being paused. +- **errorCode** The error code that was returned. +- **scenarioID** The ID of the scenario. +- **background** Is the download a background download? +- **sessionID** The ID of the download session. +- **clientTelId** A random number used for device sampling. +- **reasonCode** The reason for pausing the download. +- **fileID** The ID of the file being paused. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **isVpn** Is the device connected to a Virtual Private Network? + + +### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted + +This event describes the start of a new download with Delivery Optimization. It's used to understand and address problems regarding downloads. + +The following fields are available: + +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **errorCode** The error code that was returned. +- **doErrorCode** The Delivery Optimization error code that was returned. +- **peerID** The ID for this Delivery Optimization client. +- **doClientVersion** The version of the Delivery Optimization client. +- **jobID** The ID of the Windows Update job. +- **sessionID** The ID of the download session. +- **updateID** The ID of the update being downloaded. +- **scenarioID** The ID of the scenario. +- **fileID** The ID of the file being downloaded. +- **cdnUrl** The URL of the CDN. +- **filePath** The path where the file will be written. +- **groupID** ID for the group. +- **background** Is the download a background download? +- **downloadMode** The download mode used for this file download session. +- **minFileSizePolicy** The minimum content file size policy to allow the download using Peering. +- **diceRoll** The dice roll value used in sampling events. +- **deviceProfile** Identifies the usage or form factor. Example: Desktop or Xbox +- **isVpn** Is the device connected to a Virtual Private Network? +- **usedMemoryStream** Did the download use memory streaming? +- **minDiskSizePolicyEnforced** Is the minimum disk size enforced via policy? +- **minDiskSizeGB** The minimum disk size (in GB) required for Peering. +- **clientTelId** A random number used for device sampling. +- **costFlags** A set of flags representing network cost. + + +### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication + +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. + +The following fields are available: + +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. +- **fileID** The ID of the file being downloaded. +- **errorCode** The error code that was returned. +- **httpStatusCode** The HTTP status code returned by the CDN. +- **errorCount** The total number of times this error code was seen since the last FailureCdnCommunication event was encountered. +- **sessionID** The ID of the download session. +- **cdnUrl** The URL of the CDN. +- **cdnIp** The IP address of the CDN. +- **cdnHeaders** The HTTP headers returned by the CDN. +- **clientTelId** A random number used for device sampling. +- **isHeadRequest** The type of HTTP request that was sent to the CDN. Example: HEAD or GET +- **requestSize** The size of the range requested from the CDN. +- **responseSize** The size of the range response received from the CDN. + + +### Microsoft.OSG.DU.DeliveryOptClient.JobError + +This event represents a Windows Update job error. It allows for investigation of top errors. + +The following fields are available: + +- **jobID** The Windows Update job ID. +- **fileID** The ID of the file being downloaded. +- **errorCode** The error code returned. +- **clientTelId** A random number used for device sampling. +- **experimentId** When running a test, this is used to correlate with other events that are part of the same test. + + +## Windows Update events + +### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationCompleted + +This event sends data collected at the end of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date. + +The following fields are available: + +- **MigrationEndtime** A system timestamp of when the DMF migration completed. +- **UpdateIds** A collection of GUIDs for updates that are associated with the DMF session. +- **WuClientid** The GUID of the Windows Update client responsible for triggering the DMF migration. +- **MigrationDurationinmilliseconds** How long the DMF migration took (in milliseconds). +- **RevisionNumbers** A collection of revision numbers for the updates associated with the DMF session. + + +### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted + +This event sends data collected at the beginning of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date. + +The following fields are available: + +- **UpdateIds** A collection of GUIDs identifying the upgrades that are running. +- **MigrationStarttime** The timestamp representing the beginning of the DMF migration. +- **MigrationOEMphases** The number of OEM-authored migrators scheduled to be ran by DMF for this upgrade. +- **WuClientid** The GUID of the Windows Update client invoking DMF. +- **MigrationMicrosoftphases** The number of Microsoft-authored migrators scheduled to be ran by DMF for this upgrade. +- **RevisionNumbers** A collection of the revision numbers associated with the UpdateIds. + + +### Microsoft.Windows.Update.DataMigrationFramework.MigratorResult + +This event sends DMF migrator data to help keep Windows up to date. + +The following fields are available: + +- **MigratorGuid** A GUID identifying the migrator that just completed. +- **RunDurationInSeconds** The time it took for the migrator to complete. +- **CurrentStep** This is the last step the migrator reported before returning a result. This tells us how far through the individual migrator the device was before failure. +- **MigratorName** The name of the migrator that just completed. +- **MigratorId** A GUID identifying the migrator that just completed. +- **ErrorCode** The result (as an HRESULT) of the migrator that just completed. +- **TotalSteps** Migrators report progress in number of completed steps against the total steps. This is the total number of steps. + + +### Microsoft.Windows.Update.Orchestrator.CommitFailed + +This events tracks when a device needs to restart after an update but did not. + +The following fields are available: + +- **wuDeviceid** The Windows Update device GUID. +- **errorCode** The error code that was returned. + + +### Microsoft.Windows.Update.Orchestrator.Detection + +This event sends launch data for a Windows Update scan to help keep Windows up to date. + +The following fields are available: + +- **wuDeviceid** Unique device ID used by Windows Update. +- **revisionNumber** Update revision number. +- **eventScenario** End to end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **deferReason** Reason why the device could not check for updates. +- **detectionBlockreason** Reason for detection not completing. +- **interactive** Identifies if session is User Initiated. +- **updateId** Update ID. +- **detectionDeferreason** A log of deferral reasons for every update state. +- **flightID** A unique update ID. +- **updateScenarioType** The update session type. +- **errorCode** The returned error code. + + +### Microsoft.Windows.Update.Orchestrator.Download + +This event sends launch data for a Windows Update download to help keep Windows up to date. + +The following fields are available: + +- **detectionDeferreason** Reason for download not completing +- **wuDeviceid** Unique device ID used by Windows Update. +- **interactive** Identifies if session is user initiated. +- **revisionNumber** Update revision number. +- **deferReason** Reason for download not completing +- **updateId** Update ID. +- **eventScenario** End to end update session ID. +- **errorCode** An error code represented as a hexadecimal value +- **flightID** Unique update ID. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.FlightInapplicable + +This event sends data on whether the update was applicable to the device, to help keep Windows up to date. + +The following fields are available: + +- **updateId** Unique Update ID +- **revisionNumber** Revision Number of the Update +- **UpdateStatus** Integer that describes Update state +- **EventPublishedTime** time that the event was generated +- **wuDeviceid** Unique Device ID +- **flightID** Unique Update ID +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.InitiatingReboot + +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. + +The following fields are available: + +- **revisionNumber** Revision number of the update. +- **EventPublishedTime** Time of the event. +- **updateId** Update ID. +- **wuDeviceid** Unique device ID used by Windows Update. +- **flightID** Unique update ID +- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not. +- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.Install + +This event sends launch data for a Windows Update install to help keep Windows up to date. + +The following fields are available: + +- **eventScenario** End to end update session ID. +- **deferReason** Reason for install not completing. +- **interactive** Identifies if session is user initiated. +- **wuDeviceid** Unique device ID used by Windows Update. +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **installCommitfailedtime** The time it took for a reboot to happen but the upgrade failed to progress. +- **errorCode** The error code reppresented by a hexadecimal value. +- **updateId** Update ID. +- **revisionNumber** Update revision number. +- **flightID** Unique update ID +- **installRebootinitiatetime** The time it took for a reboot to be attempted. +- **flightUpdate** Flight update +- **minutesToCommit** The time it took to install updates. +- **ForcedRebootReminderSet** A boolean value that indicates if a forced reboot will happen for updates. +- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.PostInstall + +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. + +The following fields are available: + +- **wuDeviceid** Unique device ID used by Windows Update. +- **eventScenario** End to end update session ID. +- **sessionType** Interactive vs. Background. +- **bundleRevisionnumber** Bundle revision number. +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **bundleId** Update grouping ID. +- **errorCode** Hex code for the error message, to allow lookup of the specific error. +- **flightID** Unique update ID. + + +### Microsoft.Windows.Update.Orchestrator.RebootFailed + +This event sends information about whether an update required a reboot and reasons for failure to help keep Windows up to date. + +The following fields are available: + +- **updateId** Update ID. +- **batteryLevel** Current battery capacity in mWh or percentage left. +- **RebootResults** Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code. +- **installRebootDeferreason** Reason for reboot not occurring. +- **revisionNumber** Update revision number. +- **EventPublishedTime** The time that the reboot failure occurred. +- **deferReason** Reason for install not completing. +- **wuDeviceid** Unique device ID used by Windows Update. +- **flightID** Unique update ID. +- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask + +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. + +The following fields are available: + +- **RebootTaskRestoredTime** Time at which this reboot task was restored. +- **wuDeviceid** Device id on which the reboot is restored +- **revisionNumber** Update revision number. +- **updateId** Update ID. + + +### Microsoft.Windows.Update.Orchestrator.SystemNeeded + +This event sends data about why a device is unable to reboot, to help keep Windows up to date. + +The following fields are available: + +- **eventScenario** End to end update session ID. +- **wuDeviceid** Unique device ID used by Windows Update. +- **systemNeededReason** Reason ID +- **updateId** Update ID. +- **revisionNumber** Update revision number. +- **rebootOutsideOfActiveHours** Indicates the timing that the reboot was to occur to ensure the correct update process and experience is provided to keep Windows up to date. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh + +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. + +The following fields are available: + +- **wuDeviceid** Unique device ID used by Windows Update. +- **policyCacherefreshtime** Refresh time +- **policiesNamevaluesource** Policy Name +- **updateInstalluxsetting** This shows whether a user has set policies via UX option +- **configuredPoliciescount** Policy Count + + +### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired + +This event sends data about whether an update required a reboot to help keep Windows up to date. + +The following fields are available: + +- **updateId** Update ID. +- **revisionNumber** Update revision number. +- **wuDeviceid** Unique device ID used by Windows Update. +- **flightID** Unique update ID. +- **interactive** Indicates the reboot initiation stage of the update process was entered as a result of user action or not. +- **uxRebootstate** Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date. +- **updateScenarioType** The update session type. + + +### Microsoft.Windows.Update.UpdateStackServicing.CheckForUpdates + +This event sends data about the UpdateStackServicing check for updates, to help keep Windows up to date. + +The following fields are available: + +- **EventScenario** The scenario of the event. Example: Started, Failed, or Succeeded +- **StatusCode** The HRESULT code of the operation. +- **CallerApplicationName** The name of the USS scheduled task. Example UssScheduled or UssBoot +- **ClientVersion** The version of the client. +- **EventInstanceID** The USS session ID. +- **WUDeviceID** The Windows Update device ID. +- **ServiceGuid** The GUID of the service. +- **BspVersion** The version of the BSP. +- **OemName** The name of the manufacturer. +- **DeviceName** The name of the device. +- **CommercializationOperator** The name of the operator. +- **DetectionVersion** The string returned from the GetDetectionVersion export of the downloaded detection DLL. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded + +This event is sent when a security update has successfully completed. + +The following fields are available: + +- **UtcTime** The Coordinated Universal Time that the restart was no longer needed. + + +### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled + +This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. + +The following fields are available: + +- **updateId** Update ID of the update that is getting installed with this reboot. +- **ScheduledRebootTime** Time of the scheduled reboot. +- **wuDeviceid** Unique device ID used by Windows Update. +- **revisionNumber** Revision number of the update that is getting installed with this reboot. +- **forcedreboot** True, if a reboot is forced on the device. False, otherwise. +- **rebootArgument** Argument for the reboot task. It also represents specific reboot related action. +- **rebootScheduledByUser** True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically. +- **activeHoursApplicable** True, If Active Hours applicable on this device. False, otherwise. +- **rebootOutsideOfActiveHours** True, if a reboot is scheduled outside of active hours. False, otherwise. +- **rebootState** The state of the reboot. + + +### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot + +This event is sent when a toast notification is shown to the user about scheduling a device restart. + +The following fields are available: + +- **UtcTime** The Coordinated Universal Time when the toast notification was shown. + + +### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled + +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date. + +The following fields are available: + +- **ScheduledRebootTime** The time that the device was restarted. +- **updateId** The Windows Update device GUID. +- **revisionNumber** The revision number of the OS being updated. +- **wuDeviceid** The Windows Update device GUID. +- **forcedreboot** Is the restart that's being scheduled a forced restart? +- **rebootArgument** The arguments that are passed to the OS for the restarted. +- **rebootScheduledByUser** Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device. +- **activeHoursApplicable** Is the restart respecting Active Hours? +- **rebootOutsideOfActiveHours** Was the restart scheduled outside of Active Hours? +- **rebootState** The state of the restart. + + +## Winlogon events + +### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon + +This event signals the completion of the setup process. It happens only once during the first logon. + + + From a7c6b9e9332bfc41a211f9ea63d3a079d9b892b7 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Mon, 3 Apr 2017 09:36:23 -0700 Subject: [PATCH 165/165] diagnostic data for 1703 --- windows/configure/TOC.md | 1 + windows/configure/windows-diagnostic-data.md | 119 +++++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 windows/configure/windows-diagnostic-data.md diff --git a/windows/configure/TOC.md b/windows/configure/TOC.md index 31156eef01..bd73a150be 100644 --- a/windows/configure/TOC.md +++ b/windows/configure/TOC.md @@ -1,6 +1,7 @@ # [Configure Windows 10](index.md) ## [Configure Windows telemetry in your organization](configure-windows-telemetry-in-your-organization.md) ## [Basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) +## [Windows 10, version 1703 diagnostic data](windows-diagnostic-data.md) ## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) ## [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) ## [Configure kiosk and shared devices running Windows 10 desktop editions](kiosk-shared-pc.md) diff --git a/windows/configure/windows-diagnostic-data.md b/windows/configure/windows-diagnostic-data.md new file mode 100644 index 0000000000..9cc018cf4f --- /dev/null +++ b/windows/configure/windows-diagnostic-data.md @@ -0,0 +1,119 @@ +--- +title: Windows 10, version 1703 Diagnostic Data (Windows 10) +description: Use this article to learn about the types of that is collected the the Full telemetry level. +keywords: privacy,Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +localizationpriority: high +author: brianlic-msft +--- + +# Windows 10, version 1703 Diagnostic Data + +Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on tailored experiences, can be used to provide relevant tips and recommendations to tailor Microsoft products to the user's needs. In keeping with our efforts to be transparent about diagnostic data Windows collects, as described in Terry Myerson's [blog post](https://blogs.windows.com/windowsexperience/2017/01/10/continuing-commitment-privacy-windows-10/) in January 2017, this article includes descriptions of the diagnostic data that is collected by Windows at the Full telemetry level. A small subset of this data is collected at the [Basic level](https://go.microsoft.com/fwlink/?linkid=845809). + + +The data covered in this article is grouped into the following categories: + +- Device, Connectivity, and Configuration data +- Product and Service Usage data +- Product and Service Performance data +- Software Setup and Inventory data +- Content Consumption data +- Browsing History data +- Search Requests and Query data +- Inking, Typing, and Speech Utterance data +- Licensing and Purchase data + +> [!NOTE] +> The majority of diagnostic data falls into the first four categories. + +## Common data + +Most diagnostic events contain a header of common data: + +| Category Name | Examples | +| - | - | +| Common Data | Information that is added to most diagnostic events, if relevant and available:
                  • OS name, version, build, and [locale](https://msdn.microsoft.com/en-us/library/windows/desktop/dd318716.aspx)
                  • User ID -- a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic Diagnostic data; Xbox UserID
                  • Environment from which the event was logged -- Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
                  • The diagnostic event name, Event ID, [ETW](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968803.aspx) opcode, version, schema signature, keywords, and flags
                  • HTTP header information including
                  • IP address. This is not the IP address of the device but the source address in the network packet header received by the diagnostics ingestion service.
                  • Various IDs that are used to correlate and sequence related events together.
                  • Device ID. This is not the user provided device name, but an ID that is unique for that device.
                  • Device class -- Desktop, Server, or Mobile
                  • Event collection time
                  • Diagnostic level eg. Basic or Full, Sample level -- for sampled data, what sample level is this machine opted into
                  | + +## ​Device, Connectivity, and Configuration data + +This type of data includes details about the device, its configuration and connectivity capabilities, and status. + +| Category Name | Examples | +| - | - | +| Device properties | Information about the OS and device hardware, such as:
                  • OS - version name, Edition
                  • Installation type, subscription status, and genuine OS status
                  • Processor architecture, speed, number of cores, manufacturer, and model
                  • OEM details --manufacturer, model, and serial number
                  • Device identifier and Xbox serial number
                  • Firmware/BIOS -- type, manufacturer, model, and version
                  • Memory. total memory, video memory, speed, and how much memory is available after the device has reserved memory
                  • Storage -- total capacity and disk type
                  • Battery -- charge capacity and InstantOn support
                  • Hardware chassis type, color, and form factor
                  • Is this a virtual machine?
                  | +| Device capabilities | Information about the specific device capabilities such as:
                  • Camera -- whether the device has a front facing, a rear facing camera, or both.
                  • Touch screen -- does the device include a touch screen? If so, how many hardware touch points are supported?
                  • Processor capabilities -- CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
                  • Trusted Platform Module (TPM) – whether present and what version
                  • Virtualization hardware -- whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
                  • Voice – whether voice interaction is supported and the number of active microphones
                  • Number of displays, resolutions, DPI
                  • Wireless capabilities
                  • OEM or platform face detection
                  • OEM or platform video stabilization and quality level set
                  • Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
                  | +| Device preferences and settings | Information about the device settings and user preferences such as:
                  • User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
                  • Device Name
                  • Whether device is domain-joined, or cloud-domain joined (i.e. part of a company-managed network)
                  • Hashed representation of the domain name
                  • MDM (mobile device management) enrollment settings and status
                  • BitLocker, Secure Boot, encryption settings, and status
                  • Windows Update settings and status
                  • Developer Unlock settings and status
                  • Default app choices
                  • Default browser choice
                  • Default language settings for app, input, keyboard, speech, and display
                  • App store update settings
                  • Enterprise OrganizationID, Commercial ID
                  | +| Device peripherals | Information about the device peripherals such as:
                  • Peripheral name, device model, class, manufacturer and description
                  • Peripheral device state, install state, and checksum
                  • name, package name, version, and manufacturer
                  • HWID - A hardware vendor defined ID to match a device to a driver [INF file](https://msdn.microsoft.com/windows/hardware/drivers/install/hardware-ids)
                  • Driver state, problem code, and checksum
                  • Whether driver is kernel mode, signed, and image size
                  | +| Device network info | Information about the device network configuration such as:
                  • Network system capabilities
                  • Local or Internet connectivity status
                  • Proxy, gateway, DHCP, DNS details and addresses
                  • Paid or free network
                  • Wireless driver is emulated or not
                  • Access point mode capable
                  • Access point manufacturer, model, and MAC address
                  • WDI Version
                  • Name of networking driver service
                  • Wi-Fi Direct details
                  • Wi-Fi device hardware ID and manufacturer
                  • Wi-Fi scan attempt counts and item counts
                  • Mac randomization is supported/enabled or not
                  • Number of spatial streams and channel frequencies supported
                  • Manual or Auto Connect enabled
                  • Time and result of each connection attempt
                  • Airplane mode status and attempts
                  • Interface description provided by the manufacturer
                  • Data transfer rates
                  • Cipher algorithm
                  • Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
                  • Mobile operator and service provider name
                  • Available SSIDs and BSSIDs
                  • IP Address type -- IPv4 or IPv6
                  • Signal Quality percentage and changes
                  • Hotspot presence detection and success rate
                  • TCP connection performance
                  • Miracast device names
                  • Hashed IP address
                  + +## Product and Service Performance data + +This type of data includes details about the health of the device, operating system, apps and drivers. + +### Product and Service Performance + +| Category Name | Description and Examples | +| - | - | +| Device health and crash data | Information about the device and software health such as:
                  • Error codes and error messages, name and ID of the app, and process reporting the error
                  • DLL library predicted to be the source of the error e.g. xyz.dll
                  • System generated files -- app or product logs and trace files to help diagnose a crash or hang
                  • System settings such as registry keys
                  • User generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
                  • Details and counts of abnormal shutdowns, hangs, and crashes
                  • Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
                  • Crash and Hang dumps
                    • The recorded state of the working memory at the point of the crash.
                    • Memory in use by the kernel at the point of the crash.
                    • Memory in use by the application at the point of the crash.
                    • All the physical memory used by Windows at the point of the crash.
                    • Class and function name within the module that failed.
                    | +| Device performance and reliability data | Information about the device and software performance such as:
                    • User Interface interaction durations -- Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
                    • Device on/off performance -- Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
                    • In-app responsiveness -- time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Windows Store transaction.
                    • User input responsiveness – onscreen keyboard invocation times for different languages, time to show auto-complete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
                    • UI and media performance and glitches/smoothness -- video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
                    • Disk footprint -- Free disk space, out of memory conditions, and disk score.
                    • Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
                    • Background task performance -- download times, Windows Update scan duration, Windows Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
                    • Peripheral and devices -- USB device connection times, time to connect to a wireless display, printing times, network availability and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP etc.), smart card authentication times, automatic brightness environmental response times
                    • Device setup -- first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
                    • Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, auto-brightness details, time device is plugged into AC vs. battery, battery state transitions
                    • Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
                    • Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
                    + +## Software Setup and Inventory data + +| Category Name | Data Examples | +| - | - | +| Installed Applications and Install History | Information about apps, drivers, update packages, or OS components installed on the device such as:
                    • App, driver, update package, or component’s Name, ID, or Package Family Name
                    • Product, SKU, availability, catalog, content, and Bundle IDs
                    • OS component, app or driver publisher, language, version and type (Win32 or UWP)
                    • Install date, method, and install directory, count of install attempts
                    • MSI package code and product code
                    • Original OS version at install time
                    • User or administrator or mandatory installation/update
                    • Installation type – clean install, repair, restore, OEM, retail, upgrade, and update
                    | +| Device update information | Information about Windows Update such as:
                    • Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
                    • Number of applicable updates, importance, type
                    • Update download size and source -- CDN or LAN peers
                    • Delay upgrade status and configuration
                    • OS uninstall and rollback status and count
                    • Windows Update server and service URL
                    • Windows Update machine ID
                    • Windows Insider build details
                    + +## Content Consumption data + +This type of data includes diagnostic details about the applications and services that provide media consumption functionality, not the details of content consumed by users. + +### Content Consumption + +| Category Name | Examples | +| - | - | +| Movie Media Consumption | Information about movie consumption on the device such as:
                    • Video Width, height, color pallet, encoding (compression) type, and encryption type
                    • Instructions for how to stream content for the user eg the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
                    • URL for a specific two-second chunk of content if there is an error
                    • Full screen viewing mode details
                    | +| Music & TV Media Consumption | Information about music and TV consumption on the device such as:
                    • Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
                    • Content type (video, audio, surround audio)
                    • Local media library collection statistics -- number of purchased tracks, number of playlists
                    • Region mismatch -- User OS Region, and Xbox Live region
                    | +| Reading Media Consumption | Information about reading material consumption on the device such as:
                    • App accessing content and status and options used to open a Windows Store book
                    • Language of the book
                    • Time spent reading content
                    • Content type and size details
                    | +| Photos App Media Consumption | Information about photos usage on the device such as:
                    • File source data -- local, SD card, network device, and OneDrive
                    • Image & video resolution, video length, file sizes types and encoding
                    • Collection view or full screen viewer use and duration of view
                    • Data about item tags that are analyzed to identify subjects in them -- _dog_ or _outdoors_
                    + +## Browsing History data + +This type of data includes details about web browsing activity in Microsoft browsers on the device. + +### Browse History + +| Category Name | Description and Examples | +| - | - | +| Browse history | Information about browsing on the device such as:
                    • BrowserId - an anonymous random unique number collected in addition to the identifiers in Common Data. Allows us to only use BrowserID when other identifiers are not necessary for troubleshooting and product improvement purposes.
                    • URLs visited
                    • Page title
                    | + +## ​​​Search Requests and Query data + +This type of data includes diagnostic details about the web search activity in Edge and Cortana, and local file searches on the device. + +### Search performance diagnostics + +| Category Name | Description and Examples | +| - | - | +| Microsoft Edge queries | Information about Address bar and search box performance on the device such as:
                    • Text typed in address bar and search box
                    • Text selected for Ask Cortana search
                    • Service response time
                    • Auto-completed text if there was an auto-complete
                    • Navigation suggestions provided based on local history and favorites
                    | +| On-device file Query | Information about local search activity on the device such as:
                    • Kind of query issued and index type (ConstraintIndex, SystemIndex)
                    • Number of items requested and retrieved
                    • File extension of search result user interacted with
                    • Launched item kind, file extension, index of origin, and the App ID of the opening app.
                    • Name of process calling the indexer and time to service the query.
                    • A hash of the search scope (file, Outlook, OneNote, IE history )
                    • The state of the indices (fully optimized, partially optimized, being built)
                    | + +## Inking Typing and Speech Utterance data + +This type of data gathers details about the voice, inking, and typing input features on the device. + +| Category Name | Description and Examples | +| - | - | +| Voice, inking, and typing | Information about voice, inking and typing features such as:
                    • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
                    • Pen gestures (click, double click, pan, zoom, rotate)
                    • Palm Touch x,y coordinates
                    • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
                    • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as names, email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                    • Text of the Cortana recognition results and the text of what Cortana says to the user. This is critical diagnostics to improve service
                    • Speech recognition results, result codes, and recognized text
                    • Language and model of the recognizer, System Speech language
                    • App ID using speech features
                    • Whether user is known to be a child
                    • Confidence and Success/Failure of speech recognition
                    | + +## ​​​​​​​Licensing and Purchase data + +This type of data includes diagnostic details about the purchase and entitlement activity on the device. + +| Category Name | Data Examples | +| - | - | +| Purchase history | Information about purchases made on the device such as:
                    • Product ID, edition ID and product URI
                    • Offer details -- price
                    • Device location settings and IP address based location of purchase
                    • Order placed date/time and the charge date/time
                    • Store client type -- web or native client
                    • App ID and version for in-app purchases
                    • Purchaser ID and beneficiary ID
                    • Purchase quantity and price
                    • Paid amount before and after tax, in local currency
                    • Payment type -- credit card type and PayPal
                    | +| Entitlements | Information about entitlements on the device such as:
                    • Service subscription status and errors
                    • DRM and license rights details --Groove subscription or OS volume license
                    • Entitlement ID, lease ID, and package ID of the install package
                    • Entitlement revocation
                    • License type (trial, offline vs online) and duration
                    • License usage session
                    | \ No newline at end of file