From 875568eadfe78cd14ab87461f0013a8fb97165bc Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sun, 6 Dec 2020 00:33:16 +0100 Subject: [PATCH 1/7] MarkDown syntax highlighting, whitespace cleanup As I mentioned in PR #8704 (**Format of resolution for "The TPM is locked out."**), "ps" does not identify as a syntax highlighting code keyword for PowerShell. The keywords "powershell" or "PowerShell" should be used in the current implementation of GitHub Flavored MarkDown (GFM). The syntax highlighting added in PR PR #8704, "ps" translates to PostScript via one of its filename extensions (.ps, .eps, .epsi, .pfa), whereas PowerShell can only be identified via its filename extensions .ps1, .psd1, .psm1 when not using its dedicated keyword PowerShell/powershell. Secondary IDs like filename extensions are discouraged as long as known keywords exist and are valid. The Linguist project here on GitHub (https://github.com/github/linguist) for a complete list of syntax highlighting keywords: - https://github.com/github/linguist/blob/master/lib/linguist/languages.yml ("Defines all Languages known to GitHub.") Proposed changes: - correct the MarkDown code block syntax highlighting keyword "ps" to "powershell" Whitespace changes: - remove redundant end-of-line blanks - reduce the spacing between metadata and page title from 2 to 1 blank line - add missing NewLine at end-of-file (last line) Ticket closure or reference: ref. #8704 --- .../ts-bitlocker-cannot-encrypt-tpm-issues.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index 7d66ced22c..121d7cd8a1 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -1,5 +1,5 @@ --- -title: BitLocker cannot encrypt a drive known TPM issues +title: BitLocker cannot encrypt a drive known TPM issues description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM ms.reviewer: kaushika ms.technology: windows @@ -16,7 +16,6 @@ ms.date: 10/18/2019 ms.custom: bitlocker --- - # BitLocker cannot encrypt a drive: known TPM issues This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. @@ -38,7 +37,7 @@ To resolve this issue, follow these steps: 1. Open an elevated PowerShell window and run the following script: - ```ps + ```powershell $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} @@ -69,7 +68,7 @@ To resolve this issue, disable and re-enable the TPM. To do this, follow these s If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). > [!WARNING] -> Clearing the TPM can cause data loss. +> Clearing the TPM can cause data loss. ## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005 @@ -81,7 +80,7 @@ The TPM did not have sufficient permissions on the TPM Devices container in Acti This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. -### Resolution +### Resolution To verify that you have correctly identified this issue, use one of the following methods: @@ -90,7 +89,7 @@ To verify that you have correctly identified this issue, use one of the followin 1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: - ```ps + ```powershell Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer ``` @@ -100,7 +99,7 @@ To verify that you have correctly identified this issue, use one of the followin ## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server" -Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. +Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following: @@ -121,10 +120,10 @@ To resolve this issue, follow these steps: 1. In the script, modify the value of **strPathToDomain** to your domain name. 1. Open an elevated PowerShell window, and run the following command: - ```ps + ```powershell cscript Add-TPMSelfWriteACE.vbs ``` - + In this command \<*Path*> is the path to the script file. For more information, see the following articles: From db84674324f84163081a89c3c1287ac77e7ee1c0 Mon Sep 17 00:00:00 2001 From: Sunayana Singh Date: Tue, 8 Dec 2020 15:32:24 +0530 Subject: [PATCH 2/7] Adding VPN configuration details --- .../images/ios-vpn-config.png | Bin 0 -> 67699 bytes .../ios-configure-features.md | 26 ++++++++++++++---- 2 files changed, 21 insertions(+), 5 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png b/windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png new file mode 100644 index 0000000000000000000000000000000000000000..6b809309ba166d83442edb38584ce1790ceed6b3 GIT binary patch literal 67699 zcmeFZby!th*EhQ9?(Qz>?vQR!N>YhUNNl=ON(4bdx=U#Uq`Nx>q`RcM;ahmeb3f;M z&U?Q1y3Y6Ci{QmtYs@j{9CPGvtWB7@svH_JF)|1QLQ{~JehC6WrGr2){)q6v9b|F5 zArJ`H$W!x`^GjnlN_$6$xs?r=(%HivObK?kG6#X&XD5?&9ccvPWgfqM(1YGI79=De z^hEf6Cp4|VL@Q%vp{4&AmxxWI>V|L>BHTJLBmTHm?{}mjxyP0;wflAQG**t>;Uw#J zdc^$!J|m;0OzPqRx0%AtAU0hsTI%NPCINDKPEOx5P=+GbjktU3Fuk|CzF9S9?bt<$m=iltGhleYTo%L4-0*Bx8`L|S2eeul>FJw$S`?? ztikIUE!Qrpp7*Me(hoO31fw7sG&4=;O%{?8&8&xO3%6xZH~8z?OG>vy_akcJ?b{jmBo0w05}23mLS`y8(32pEE{<{TGWF4KL>nzZ?y=(5iZUo84a%T3#_ zQm^mS6`#Dl!xyXB;&pcszo*~mfwZ{qb4b!MPY08#Ca%DHExP?w=9CNncuDA{Jn}7F zk2G3D++!8b&c-S?R!DGu%s`PeGQ$aJq;`!65<1+=VE-0%UfJq#AmMhY`A*H~V6g-f zZt1l{Hd~^OW@}Oi*O!)58Oe5^tr8Ka2lu9l!8d~eF|JT|E(ZjBlyE6zR9Y>;VkTQ3(( zm}0HxKKzkx>TAavoG`|Md|5l$WLoAe$@{ALf-K#aeR*+udOM{NT-Jqk@p{%p&~-B} z2TH1D^>%HmW;8~c&Sv!wea-||<=?y^a;X~YA#{@EC$e-b>${GnVJ@vYc~(?feM4+* z*Ke_9=(=EgDS9DtoC~9z>N&e(k!saOByT+PLCbo|_GjadSrz^z$6ec+C5J7GsrCk2 zzvhR);$XL_)mWyqX|c-g7t^yntnZd{87<6MHYK`KxFnv-Z46$1a?;$4;})k@c|je^ z(*IHTIT20pj3f)c_vV4l=0izi-S}fkV^_;Ss>ZJeajq@-g+q^9si{bJJ8>c}mn@TC zI16r4U;|_>$3+oWi43CCa)X=R&WXdV5kuC`V34UOUA_Y>gGGq;K(p5@{ORgNB#-?j z(>3(Vo>y}8Z1nWvrg5=D@AJNXN$KjtEt<62sCGc+wsXn&7GJk^C@|1%RmsX&>k1Ez zp=5aHHUd8Ro@aj(`7N@~pQKrqmPLL34%yq{irblI-^{ql$izVE+pfv`qO-Ohle;%|w8CRSZe>3T@ZWw6 z3z~PUS+9dbN>qLyPZg)@lr{vZ2yGg(_u|m)>Qorsu3p`n@ag8AD$DoV;*Hz*akjNc`GN4*(+h$hb7an{k$~SEijAq&YiK zRg_VRGpE}L=iyDgxQXWoW1@kRsVQ2h9R{V#Fghmg@b{42Vp`XA@2 z>~VLzfk$9ZM`np`hxJ^D^E0!=fCLwBeP3c?kkb^vvP&nq}S}n2c%*marO%&+{O`;W3ha@3{w1ZX5Pc?@KtejTk@d^Sx1AQu?J3 z5PNjTw__D07?H;yctiV;Rzk=PkFD!0hGP7wzC8P#oUY1iz7HUW3Is>TQgD zHlzJo(C}oO80zH%R6q5RYQL!-QCzsR-tv^Ab(Xr3A(QO15uvK&(RPu#*mt^zGi5eB zQwUCAeoOa46DKi$z%Zb3nUol#kaau7!%8R%3mZ<4;{6!0)nVPM&dkUSZw>?}%u@MV z)lJKVZ;3HMg>T8I5!sp5c6{94AJ1L;Io!NAD~ad5>b@j>miGpsnjgyNQ#S0)bInoS zwzY6=;VTJhq*D>1RH)g&G16ylS$<=Iy=b|#g`ewTT{1g#1qGDO+NYX5o8KdM*RGO% z*dx`#BMY3BvUDKkqNl_Xx}W0kkJG0LsW>RdZh{hCQJBz`KKtQ{dh{CQEGzgTKhN~I^ zQS6c4g#BRPC*MH^3Rc!JHgb_RV*GqnQ;_{9=xVx5r!al|B~#pGTSSX0U$T4AX!k-f zyNv>I&A>ub{{yw-0!k+F_%d8?;X2BdH>ogFE7Lb`K^|ESFQv7Oy?Rj>WD&w9IQVLl zp50$M+*;UMQYa`9%7(p3lH$+)1)q=c^=EW^DB~E00CcO!m}x70@F?UW6rG&WCK*a6 z{+QfrobB0pkl5;;47JNx8eEhdrLOu_Z!QMZe#|z~q|6jS8SjVwW8CaRS3@$(_kukV zJTOv&CEb~;XH*{&xqd~x@H7jYIr+})s?t&fRpkxVT<** z9lN9vuArdF6uS_cgUGRo!I8KahI8c(xZmj=sBlm;d5_TOg@18q2ZR*9SBjwdDwHa= zW>j7Fvu16KBQU77da46f1_R6PDi^t9AOCyoPZXz;EB9Xl??SyZnotA~KM}$!ohV`I zC+hfzm=EhAPL(AnD}GCT%YYxW$Lv2EUS{;(cv$Q`>ggHB6baA!O_W+cqvKGN@`r&* zusZRAUw%}tR4$efDr!-oi2P3Gjx(IGbbi{m=zwfjWnwHmHFBgky!);45cQ}5#%8YB z9-Dlb(XzDn=1R~!b9u4sn!$=JZm~?CLQk+XPF=|4kt&jqy&shuuveb(a*X;cL!`~J z_j?kO`PY@5d4UQ->% z^7aTDQlDZrMSSs1xmiW6uu`Mca*VHlYmYLBHVIXP)1Ea5S`}Gc{R37K7ubzZEtxn@ zW0SLYrE~9%29lJG_raT^ZD{c*7pcp2f2BU;fG;<`5sU;xcz4Ee!!8n+&!hIfm9wL; zWPfpBE6<$g(|c1$$mm**);F)KRcX|dXGk?PMC8xyF5Ta7F>0xs8$m~$7tJoRA!V?> z{D#mnCX_w?oVvll{skt=Fucl(Hg#NmNG|4QontwoFUCfRrMU*v?89F8w+mV^e=H5(ap*?OkcZ*oON1Im%<8t)U-WoxnPgmD zv2;{5&m%%ajGH})Ot$Q8Un~(>-OjHWj}`3iD@8I9yUgJoU`mpW`aZfJbO(3Em0Dsv zRi`sSK2b34J4@N)J!;!~xKWd5disqYO z8wDuS)bJ3Nyb|7=g#yc?<@VQ+gh<~|iK%NduF= zha8kI5fl{Wb$m!%X_IZB+$A73JNonmAERnp-*hr^nJ!DO2+WYp`l}5hvka3Y#zJ-W zPIVDowlNX+e!{e1h}u&jtAn$t_bD2??vfoK@HLrvuYo9aeDWrU1+F5%SokFt(IR=Q zgcRE`Y<;mZ{#tyHj(fz1=$0Ndc3XlgAz>?39~Ca8ZwK$#LjoulnF74Al z>t_j@Uq;DQD5#`zKd1M+iRW8IW0r@Ivh<~^E6dNKeHs7attbwa|9QKYI!q`81WJ0? zn?q5DVj4uXjb<=`vW;P|m;4;CnP>0;No%f3lyE+#>8H}IV_MG7uh7H+NR-k$%<$Ro z?mp#vm-lNvo-to2S(bd%O#RVZs=@uje{xpH(Tj+a>^m>>w|7IkN3&8QpPnVf#!Kq1 z^OW<~_A8?q%hd!*O&cOZ@|oV`1oKSU#qf=OA%`c0C8-^p!$bm$psKvVJ`UZ^$)qk! z?WeCuQ)Xjz*<3(NmO+S7#)?cw5jA>$i)%-C_H|=ixLVr!r3}6msdF_dOHtwrL#5l@ zF~)XJ(b_$_;n;P=^f0AF*^T@XOB&D#DT7jP$p*`2F@k;q6C4o}A!n^Hb1y}alYPf zRO+CGV--%HQa_vCF`fxi#!ZtobNt%vHc4Q^x2|{+OFk5x;W#|T_E=c}iqA|xi^~r{ z(k|bvB^2dsW!^(w3*3Z>AUQ!!T&sIcz_&l+_$xt5V=j&G>iiYcJeDF-fHeYWLrh&) z_nr>Dodz4d^hJt$XM~`9&Lt8wrM{w`DS8>D2Z_!YAU0iX zUJjl18w=qf^Ci}8%b%rZ>ATk1$(zvin2=QwJvN3PD6k2Mu0PMVp=X~9oniUov`t8d z4wxy$P{&l=_Ih|l+xGDur6HLz#OQs&q^n?(Nng(zU15WUPvtvAj3N(%h`wv7xkH4r zPd<+XX}b{lA$y6Pqk%8wI-}q34(IJ%gQ)@sD&JO7x<|-XgXL*A z%0g6(ki2{(HSJe;QKFvyoWtc^qi5j?|3LahE97rUiAxf=EUD=Aj`s5cawYS?6!C4)kLb~G%ZWXF{F zYxYzaZ@PMJ9G8+LODVcv)r#7=gf}s*ors*)4y~Trn9vlC>9@wEzrgiJZ|Z(!e>qu7 zA6nW#_Wa@Q5Q?N`(`{w9$iXFH>lm5*cv`~Kp!)-yS|Zk4iUbvF?L%32^4-Vg9M|(t z7%UG20vM(BDBEv;0nlTxm6Vjaf|S%>NF#tRrusyS%6CW*hAibPhHH}UQI1ndxnQDX zQ%An+qJG6_8>~&H%yu70kEZY;JZD+Y{>b9nujSR^qQD|b#0P%?K_RAk`LHFrV0_L+ zhxrb#rCY~KGD@BzWnM3OkXB`cGd0`hNs-Ai9u=%rBo#HMhMGBkUNlC78y=n+(snKKcG z#8)gX-{!lDZN7F+biR<8WPIIQS8TtyTCBZW?4$P3uKrxV&pu5X7Kw!_3|G4MYtFl8 zES;9q@|@B6r?sJeKaaok(!~}*%SOWe$dq)vTlPC@s4;hVJFbG<6|hJ!_do~*-5^n9 zJh#+Sy&wd2H`4lf>UcW2b&p}^Vu4++Q4Gzs6;c=Vk+1Ah z90EKfpqaM@vhS2C2GadCd4gtdj~Efp=(Vu6(00&#uRn3HgyDzoSp0P@6$%8xw6Ox9 z-&ZQiLZ%Q~He)l037E~@)*gU{K_C%vcY9+~Yp^q=3E0BQPL%qvp@o{#%1o46hgXF| z#a;?*X(jLJ2-fga)im|AHWf6Z78gSnaTfv@*n*vnDcx;t?3{$$MX7)D6#{;Ly3I~a z`J2SqT9o>giaMnf#1Tx%!^XqL!7Af!<;q1ZhD<5qXl5?-Qd;&;7QmG#wWYJOy%0OQ zo0}V(8#f!o(Sn^*P*9MagNvPuixr??b@H%tHg;#VbE0`-@dpoSu#>5ymA$hS#E$Zb zr?Cmd#aWb^8hB3mCv)Jbsf;^t^Un#Mu79(4ayDaE04{id{Qv~)TpSz%tQ=gdT!QTX z91lEIQTcncoztIE1mwx?Zfwua$;QEMYx{2_oSbD`|25x#9O0x1An@!j!A=ktM^mtj zE7;DN=AV<=+qgLWb50j0@YAi|>$Wj7X9pJbd**+RkyB7n|9i}n7%i-9?SGGWqW&kP znd#qj_AZV#ziG@&*}*noTVNqh0B6pBqkrlY{5|5|_Ve`Qe_M#XCBzxxWC^kV&tv|6 z{J#wZ*7=`@{3Yn$oA`YoLedaZm#5V#NQ+WGZB)n%Vrpe3^!rzCb53(E9)4q16H{Xz zRvu1%Fsm^)pD8PtgO}5c&s5MDY$o^*Rtk1b&c=48;3rl9b2cl0kBJG`*c@zP%nBCZ zF=gf9GUj3x;56lDH8m3u;N#&I;1v|)`UeX&M=QXDjBWn8swY-v04rW@0b_n+Fb}J_ zIhcc$hlh`!)x=ByU}bL3&&|PUE+`28V>M3)DD+%iL6n+{jpH}--*?n)jGfIPj<$eZ zTG^RF+?@XPNYly|tl@0@BsNYy4t`*#9K0NYe4HFSy#FH720Jui{B6aJ{=)xV`s3GBN+G}a0y%-TpX+%f~?#enw(rh+#Euj z0>8il2x`A@`ub9xDQPbX(b4+XRT zn#uozPUH_gmIuZ{96kOqR0Hhr$JHM$&c^Dus3<9ayA>g0(EG$yEWuAY_oO$RT&x@dnw&gBPv0EW zf1Ea@2>X-A{%f})Pd-gWMd+XM5P9->LJCj%so`R8Z({{^{C7G1r8oaCbpIItr;h%A z4gV+EAETup_8x$7TRN+`+5MN({|CZ9I4E10g6*6j|JBm}jYQt3P@C7WrRHMA-k+ zOn;2{M_>hp{&5co*g*Ve|2qNrgXfbS|KI%jQ~UpKPC-feKa>2o`A<=_G+W0Js2eq9i8`dVKnq+4LnA zxPxRbuj>Q?kpT!YSqPM2HckL=6Tw+QMFwFV6%mmIIlf|J90Z~SDM&xpbf4Wzb4$gQ zxe3kqmEI`aAl$)5gsb*E+cOgzmNOgStN07)kzzOUY{x~WXYdjBo1F!T0wWqP)N#4Z zX$e)~;KH8KS8!K0#9GwvUdoM}4eqg(!>&zUuKAi--0l>X9u(ByMxk-Vrh)K6z=$X0d>W!;-W$s# z6r*YOoN#^l>7IB$QSc|Y{cP#G!|cBp)|Go@nwNT>t!W;;qw(kXW}-%Vndl|e^~}3h zitC~B6`l4}&o{ljUdsQyz#(gG4oS9ViA@%*VUfQ1$6(AUP7hVwAqJ*Dc7V5}Ob$hj zi6|e95iGTS=f*|wS)GTKR)*?B8@YU+!OGt&iJF!UyxMJV$rCl!JmLS4>LQs5?BI#X zUG)()A)=ym;F{BlgDVSPHm0P`D`L%)x<58)bgaMjJoCkB4m0}rFgpl4FFe@M*s&|) zPZ8oRk&-iw<;Eeh@?X;+<4EDkY6LHxT1*Eu8Oi@8McdWDw#=%`Ra=Y?^x>9AkJ)~k zf`9LDz#8uB%Cm_(ZA6(ORi$AKn;qOI*#awrkeA{4<~Zln%wHf(AvsAg>N*?H6y^W5 z>?sd9D&kV-S7tJ7Z%PC|*S*?XHKh%HW&1bhKI?0&mu)dGh=B%S@S8O0&GyRuZ!v%E zYOeJ$`{Y>OY)mi5b}f$yi&&psyd|)(|4SAy!2>~ON+MxMfK?)5R@N?Ya=xv`b%>Qo zGW~dN07~&X#mCJ%CD*iJU3?W7Djpt{N0-gDX!&2iesNU5gW4p@-8D4c(qJi1u*_Ul zJyQplL@Y>N=UZWiNn3s`ECeNM>-qZlh|VZimkSr>ztDXVHd=jngJzYPg%^_ej3N|R z;g#(=9p=ZWSOp8vcCC_}>rOe!$}Go{-=pY?I-&o`iDN3;wD~{+bW9j6Z^>KB>3UYX zGK88rjYJ)+E}9rtBC?|4KIa%S>aN-E)<4UQVaUr6=A8F}cBheXq~p(@>Ds=<5AE52 z#`(ZpfX9kFi<-g771UvDSNj0pe0w0QU234fNZN19$AA>tKJPMZD9^N?@x@}05<8L- z&5FR15dLMdD4-**xm5(2oJO>ihbTOhC7S2#vQFG*?SB0INEkMA#+CYpV` zpaVb!n#fVpQntDHElW|D@9YJX1xWJ?3qNQTX&(;@AKKp?_h`I$@thW$3KJ0%5f(AD zLpfa}iPN+jbad$Vm=aARw|eZJDD1`tgMdy;h-!0uLx&mOBmZUmYn6^lOB*OFZ@9aJ)dumM7{&z*CZ@wWjt2=$c&VF8H@K9;MiRR8kMLHbCxIE8kTDz6;ScMifvSr%p z4>g!Bn!;;6HCk#Y+(1<^!%|=BG}?y12|4htcitJa$nY_*WJ?Gi%aL>HA#*!AXgK7u z9HmStDJ%QZ*q9oKA(nW3x}~9o_hzB~J7^o7Y@*ywRw%7|$JwzJ3gM`)UCq8hYTz9$X zrCYVFq3!eSL-Mb;LN32L%Z)p>msgx}LQuw|f*m$=0qZ(%aGG_xY`FV1FP{5l{ zOqYxLj?u~V_5!3Lr-R%E_HD03j4%THCkt90ZgxSMSIp6gA2Tf0A!DCE6N^|{amiQH`GB!(z(U`kK$(kmx|S~DK+EU>>xE8L@X z(Bh&;zh_9~v7&ydn6H|qXW|Sxs9i(v@AvuBZv=R$`j?Wm%U3H=DTs5I= zb?!qly*w?p`#kxbuXva=G}Aiz)|!KSW%-FFC338ms~Fs_S@!5&9nx*;LM%@o3KJtc zv)n{g>Imc|36<{0CaLHQW0tsvZuZ?o794L{LE6Qy+E%;5_iJGM>zuY$9qT}0J^RLs zch?}mOhz2@H-149>B*x~ddR&3vZO-oF6bA0E*GZG6_5Wi81gb};vLOo3CdPLTY5fG zNy*d4o^8(rGMClH07f|LGx!0I`D&UbioX+UQ0`>)_~0n zhv1iM0}?E>yD0gf!TQ_>yaA}%y@~<(FB+DTJ!{95L79cw*eaHkwCJHY86$E&Rpd-` zGd3ZBjwJ#|_kqo@e);ki%5tWH4g`3m3Mm|3m93Ky@+^UjsO^7|lTN^0LKF`jgWUXv03C`Bdk++UZ+xx)0D69Z#^ z5o`FfdXHwzF`Z(Q#kd%Gf%eRL{rU~mZF{>b&`vlsqx9d6CsJk;zb4ZE1?sq?GL%^z&9eSL1o!fU^ zuo&?jA_w1J?SFX+#x>o-q(TqK;tLIKTR*XA_L?^~5?-5+=PJy*0B@u(!P)PBpQh#s zSbANZbV4Vrg7zyTp<^YJ4_kKPjI7=lQ$W#;D360vddv(9NM3?iY{EuajQ9|7N7y-_ zm90v;lEnSQZue^_${J6Q<;Yxc1KzZf_fJkuJ$cY?CSAy4S4UEfcKqjKj7iENKL={^+532I~wnvD#hboc-HqRLGydL$fHs*6Y)K~h2CB$t!@PM6TRewy-;f6 zc-1rlGL^j$Sz`X64?R}9P-($QT74`KV*sCuVLp^B6Gbix*r=;G_eGg$5{EIgVZHN8 zZmep*iVlyVpUQ-5?~pe3y=>O~iEY-dP?&pa-{pMZ^cs`Zw5{!91_uQOnl`&GMbax- zi-Y;Pr^sWG?h!&0B@*N4Cz#|6-@&7hr-3SHf_S;)Ck|=3=Sy-s`@L_C(1O`hk}pA}cwFS+fPp-@SA-WxS} z#`NbN-QJ^;3VaHHK^V6#Gs=BQ)X#j9ftIaPW@HvIXg+Xx?Opt^Y3+O2uoNv%TYGmh zaJ?Lektpay->_dzGHu|6#*pF76(EthJoQ%74{d@2@YcfXb~uuhql&X?$YG_s+x5fq z9;ZLceMQl~n1;^1#<|`%4`P()nnUhwgkyd;1Rr0j>m7)N5$|OS_%>8R4*!}Z-;`KY zp)kN&M@wymgtWX%q!)kUanj^tw+mo0pWc08{vvQVOh^W zn%g2$Yr|o4I3_WMxLH>p2DwNg3<8-vBWb=*gKMhWq6cW+c|zr?vAJYwX~$VFC(VIi z&9$Ls?Z&O@{wYO%#BJoE!^8UwXxqyITs%Cy#C!!Au*{gn=S1DW4)0qk|i*7}bb!lD5E9wAgb#0?=e;9a7RM=ykDvM}MF+wGRBP-+`e5CP z=99mBsOe7`uUa}g^`&+hqnos)&C@IDWa z+r?r*AWi4^Wi1avJY{2)!;7IMDpVZNz6khsauvVgSzI{BvFJtYwy%SvU_ zlu=ir3T&hpdvoI%ME~_j$3IA!Zz6ZBZ(z+~&C#P;y_uFgDq1lw96zC+iTQM6Y8tnH z#B5wT=f$l+#&qc1nw9Il+u6-ief*g0ZXFbh!8RHsfgE5(7<`SHHIwH1z^yXD!ml-E zA!#|M=}R5my6>vLH5+o1GEVzh(KK1sZs~hTunOcFQ>F6Pfonra8oaB?tv(I8nZqj` zW2N^oC76y6TvmFJJK{I^`@)5P){EZUSFbh2$p5Gg?;sg&U%iR{sE)5PV%Q_x9aV*y zq>Zh2WuuYNyaT6@)&DL-*$x>a>#Ajy&`y}v%|p$sh;6;B;r^;JYl5e98BgZ$_N6pQ zi5Z*})WFB^If6^+xG(>ze$7vl|0pVflJ>FSY94yrze*>4Q)ecAT_bbb>}L<2jV={M z;9qsA{u=LRHK{)aKWd!(pO)tMGS|+GMD)PxQZj+wJb#t_kfcYX(__Xzv4V^>B|aq9 z>Q^uM=0h7eJbo~q=KnS85HM@hzh>22;aBAM9I*9!lUB}{V(?HatF7|aeo9UwC3y@2 zy^-sjEw~cAviiI+WdsTSmKJ*1hMYW{lB`v6braq@7wjaIk?J1BzZV2kcJkMHwEjAc z#{M3S_sZ(mw0|;rMiKSrx;EBc{E3x3d>QPa>7$-_K^xL9_f(<-d#W+COXfjgR+I7V zDqtM`@+qpDEs;4oY9$`qYWzL_5Nu}7Wm7M5PHZ>dv9MnAA1ogd`nF_6g!w4~2RozD zDOQfD_|Q`1*Bc=mINyghwZu?9e{YKQ01yBa(ooX zFN&B|;#(O6DM+~CHX#LV2W@A~+*Y>9{N*gei!2u6Yu zQv!Dj=9*|1l8hNX8QZu13m^4?c0-8?Nluco4SMUp7&mff!t+`d6M<`Ov7|Jn^5h3~ND!3apeQasrJXPdF3DKH+I^q44N7EBA23 zT2)mzj;0a1tVpsLiM>;U8QPIJ)%@A`f&gCBZIS*LkRlQ!AMRf zzPUV911gXt8+aP)WqTp}U&BN3uk~MtCh=M-qK5_osYmjU>beJP1zK#T68)A3&F^1t zUd*Xc0~M0U<(?BFmB3A6PC;SuvsxM7+*_SHQh4a#!`F6(`XNT0wXtZ{Vf>as=`AE->hZ9`_ZPiU^T zx3#fqLPQfhM1m*oAb2!lv!>`rFkRg+-;**pZ)xb8G4zR_t>f7Cwo4-fomVe$9zA zxjI^ruXMj$rr3H2?l68?5Vznu<-~*-ELm*SRNr^O`ViJ*5+rHdzA|ba<*}2Oz@Z%I z%yl2`@qpXnbB7L8xaQasD>PiqEAn56lRnar9?*LXZDem)`vq33N|)2f=j3{Gr{&wV zd^-vbxSli!LeHhTS_y~!LMmtftM7-1D|!GPJC=|G_1y~kpnLD?ZUDZPr4(eyN1O3A zvh|{Z(zGtcegCQPPrrczzsH9wZ!y#k#ubeMS{!-Nw)Z)U!@mEs|Wqx`J+&3uS> zs_Zp}1W0`+T&2M49KIY}JGj&rgyeV|n`-T6qvcalj~%<{t;DiuKYbvrDbAM-#R zJRDA2oVg0mV%vL(Rm8-B!;=kBrcX)fu`Qo1`+83|Ug$Pe=yrU{0B$z0cKrE?e#d#X zaLPP=NtsV+YdFoJ&cM|Hfx?@k&kWihk69al*Iu>wiUMc+ElRh>j%;_ji~$$j|y{MT(rrXP>{Qkj3xd&=gC3?D7`jN&$)TkN5F7mvxOgFKv2+My)eo zNZ?o9cT;nZWy=f0kP7vYHx;CNk+qj>#n->1slqiqp6DI1_+-d~w>Fjqo6(Rqo6}9r zEKG^En=KLz8!di^Rsz-;v>9i6-MdPrdHr#{gK-k5!|Ysg1;t`jD+kyb%5M+6;);o< zcs`m@_f4pYt0c7yib19Zv5|vEc|JB>EQa%y=wqRW7GL8qapo!TS-&BKFEER-7Z^Nf zxh3P}odiZ)Du(BL9d1y>o`s7#`jm-3Q!XYK9* z1uQJIR#3a~_>QyPiMELu8Y*{q^w3Lv0;<^Ia-Fg!%w*mVpJYZLLTU7*=o5utX1(uk zWoWU#8Nq%4%fzTtlrWGEPc{ss16U=n(me^Bj;e!_XkNtN4$3UK5%R|&n?v6SDAfd``A=!0*c1G*%L_S)HeoekiIQ||`fJ_-^ zM%TL?s!o?0?u=%^NFrvBd4lNG(v=Mj)A~bCnKyZjPxCr*+gpM*D*E-=srI+OV_zo2 zKtGmmI`f3Og*RdnLmxd}^7?My@|%sb#APTf-`rb{Qk}K|pLo+wagc$!U3f|3mQQ8cAH12kY^Rc_Za*P_l3uz+Bo>NCtnwov0FE*%qr_R{fSa%iNi3_DaEs_ z0B|TED6?$b-hnY;w7k1{0R{fxvi zM$)YjVWC;{sy+c~164j}*D%)PhqJ$xKy5f&Q{A1`!Ox!@pykJcs5GaX~Ovw zHUvn`FZN~xb?|d1m_4K71k4qIcj}UzZC9s)j>ex^y4;?_+CgEQQ zA3}$T2zAd|qCC^-EeD5(k6bPL*X|Lh z?Yi37P4NyA8y{II$>f}_EVaepYY4X9k!0an?t4+84TRd|PW-sI7cL!1kZL3k>L|@L z$8YZ#b9`+c$}oMJkF3QG`RIFipbmEu^o7$jIwm0U>dCRh=UW+gYm_qU(|m2A|!0Zx9lW`$?Y_$oq7N z-&K^~b{4TUoV^*bb#JE91856U@+0reR5E0#zqc-J3YmWGH6)gA5k>xET5hM_LTAx^ z4Gr{glF-6o(uo+){#td(*T>_0QYS2kCPK&o_fjPZx)ms)>W;ffI4j_#LQq!#F9)}L ztvhnsiKF(@)_%$7a;8OG)D)gsrxbR1ElPYfj3FIBA;epE?D^h4c305L-ajB~ml@e+ zSgiL(18S*C%KO3Vpbo*msI>k=%l$rtFr>|6E3M~z`gK&?(cNh!@#Ow-55>s$7eS(z z^RaL!`1YGg7AJ$;BkJ1P-8!#*WrWh&dGg2*Um6+?F_$%V0+oG_hMFi`t8pkKa3d25I?$EaHEFeR!WAi{+ z9vs?@P~RypZkf5rq)akDYsDN?Fyo!lXEzuID=>k$BbAdA3ovC_r1^*$?n9X9Gp1QfbS9knBgHXx&QljbR5F1rOi=r4icz zxcJF`0e~#BT@A?ukJVT<+_ZrYZz!3s0MN2x1YxN8Br4N)l&^GvfL0j1M!xb&l0|x! zTvU3h$7Yhq*{Bpq@;(iTd-4#0I4yWE~< zmJjYH6iBczq;7Y|)tsq(`%J1rJG6@)Tec$PBj$5uo$PcdY(Y`tH@ycDQ2Amf?4XPJ zO6F-pH!>g!G>Gce1CUqAjrfV>TK)ZTRH|ctAAmzY+>ZI}EVYPhd{G5=zQ+;)tOyiA z!XIfyZR`Xzi-4dK^3CR_#-%79<(7)4A#xD0qIn{ zNXthR?~bh&%OHGY-O^TdLNZ2dzQ5iD=-{Yb3E72m2TZfrBY3Ix^3w0~Qnj~8ov4T6 zV%4dgu(4kB!qD&*B_`YRp++VfQhRi~k<_sK9{URt3@dr|JAO|Otw@9l^=U9{X}_xc zP}mOJ7vHE3DnwR0aa;|5T{F*M9h!z^qkhi}rR|Zj7o1`Q(DH2?S1G-rV-in(@pX$Y z(1E}Tldjz)9vHfK>dgUm+kDnk8F1*(`-uuP|JVux(u6O<%wOKliGpw4ag1-Ac`_6M zL)E*D4InEBLH~~0-+`e|W}w9(0erN*dd_YwPD6F&^7d|#_`Z=VMFEGwVcwyK6Y$97 zUVEHI9_Ly>_vXWBX5q6pYMM(9J!zWS+S$88fLj89)(jvhW#mK(eEM z{&{A@LV7C7P&69-yvbzHF_Y01{RjN!fF}H&eMf!xayd72!Lv7?${i+Ty|TXp zCvNkz7V68y*!KK2-;K#6L8?PHk-Lu(0Oo!FK6OBjfKJ@m8HS@I`wYk|X$VpE4yvzD zi9|hlfaC&xIWrLbnbqkVl%gR37gv;xB-Ol|5U5J%J7tMXqG*@kFJ%R@2B3ksl zwPh9&pRVKaemEI(%#r=rPo%#KUdak2Uj@{_3}_Q>*GF0rPd$=|lvlWa_QDxC1-vmQ zD$MJosOHo^eOc4*U(%l3xXjI}-U9g~j`K^=J`-rl< zlkT@>Lh!0f_*diX4fYAKNq#h_!U#R&2r-5i=p?rvbAAO9M0=Kw%SiD}%)QfeaT_H~ z9H%W`*G=SxGM&KYaf72Br=t?7Z^1rZHsa`O6*;9D>}w)oH2TYmswSbJb)MU({+0N$BEp+Qhcn-f&DamA0=qZp}KJ1SERK(9~RnY^57D`a8(G(nzWuP)VDXh@F2C#YwQ zDq8;2kU3CjIjiX@cD)d9ks$J`T7BYK@ezIa^{68x$#D0Z0cOx z-&1UU9|zzet%5qVqgtDx?h{jaPo^#xsF*+@UNl4 zk#%i5iDkDVG{ony)?%%keLfP%JXvF^J@^%N+g$4Y#aV9nN?iI%X<$39u}S|UWl$u& z^E-^Y0L#OrwS5QJbt$Q=FmG%CD;Oub&q#upbe_&yS3+IQEj@I9)=@2w7@Nc)78+8z zo-ey*EC&K9_w=>?Mrb<~@K(b4`FWnJz9k)ApPZe`!F;gI)M{lC3jmDDA#I&ryYC(M zU`ie}Eco^aZl!hro;JK^&G@;b@!~;xkh3vTHv5UETNiF0E=BvVmqx^`oKS z;)~T99o^Wgh-%xp@j4{}uhIf{&fMO8t;wUUST+1rN1+rEw`M5{Zgb^W8=&~Jz0~nN zDBZbbR~nu!(dV}&mjz0H7DFL7Hl`YZ2oI-oqgwkc(ec5AhP*9yBDGmNzJ!4;z*%_# zv&$YXHaQ3s53e+y4g(>c=l-63#-im|KW=1;xnL>tc_0TWOw`=z+||Pa#_8PWD7gtA z%N@ec{MC%SVhMK8Iz(n`Jp37fM*?4yyvV-aMznrAgeym?C|Z=65S1~lPfZ0|ilHr# zNT0%wHa^eo&?W2+3&H8cUO6*m@k#o?Z*knQ!=AIl#xc}RF4c14O^BAai(cBi`PP7q zz_dGc0La00Z?4DT$*f^u;wDZ<#35=|`Y+U}BBz;>Df16u-Xj!!vQBG{14T1s5Hl%;Yho8OiNU|^WL%y|ZYbyZ8 zw*l!G1OcCCY!FR+<-5UAx7C-lkd75fTy&i9uG-T`VUmxj#8dj~5d%Z~c+(99x{2K* zuYJv&d#OTstOie@KtSsQcqhb!ct%#mqztVh1E_{@ukL*d3kwn917Y7iC#{#-sJzY? z?pZsd=2C#}>SlmhQR1gc11HKh>Ryxb=n(Z`*ufCoaoAu_Ivq+lCB#D-HqA_%Yah_0 zrcW9-F(|)~p;>V()E(^bf5ONqz*6(@Ai{w#4q_R&Olnm_TApWUE$2-#i5++1xQ1r* znbmHkd%XhQlt35WlM2-Lq@w-nB2@z{QG*rPW?ZF`LxRlx$`n%VaM=#-d+M>JQXPDf~;`v4QXu(p;ZeY#*sFews#Y46wJX1Kp46j@r|k zd$C*f7rFs+`yM;!uy^zm0WAsjOiY~hf@lm z3k5i}4M1f~=4&04(}X_HR9ZN-!I?hw1NT%L#=PYN<;zyX?(RgrfVXsJY8_}0(Aiux z>K5!&#pKae9NnlR!TyO3| zK!m~<(Ai_|IMbSq(9I4(SwMqR*Lqk}jO24v&u~xXj-7mu(t;h)dxL5uQZOP-^SL+r zOQ``fhmu#Ylb?JJwS$TptGtmk-<@e!ZkL$P$t#z*R{0-mF^!>q^P_#Tz zC@yZ#DH+#FQL}|(=5j`K*r}Gul59S2);!b0?>qBtE!N#K^(Ax)9ZsOk%Uw=1Q9e&r z#B{;Z|J&tgU7)as-D2so|1ZY=_l122woaEZt7zHOF8Q}W9J{ofd$EV_Mlx=wPfq**j& z6i!@*NLDVjzIcH`{MYFl-Es{tETy+|a&kg%dVRHQqXQ;3n{xEWk(4+U5WhECGq4X* z_%+@UTgd*FrunkdvAJL!bYZ@$PKawgM@q8E`Ic9@+uj3?!NQZhcrCAab|h)8WWIgO ze^g?7TwUvn&Ke2NRE9NVlzV`cGb;KL9H`E!4oo+>3(QSTpHl7ueFi2B}I%>8`is5~Dz z;oFzh?S46`i}DuR`}UhpoDOj-S(A6)-dDe`)?a>3D3FSeN#@<@cXySiJ8V~_*m)j# z%d~Km2c2%%Z2#6C%ox@OF2^86OJ<=PcKtJ9ZBZv(IxXEyOfD@)Y<>Io?RJ*$?h6vy z`8Hd~JW82U$~SCZ7KiOGu2rjjO@!&$43q0?!+v>?0g`chf;%h%6}?%h10SiR96Qc) zC%1^g#)VytKvGWF9ll*mhz0w2LCd6=4 zM?002Q&nBhR*yWoM-;vO<>B)26>|qxujaM-E32ps1D>$qk;pU(a31F*E}bXrCuj?8 z_I)#&enYghqu()IyX1o)r)BsqfirxM-pH$*el7Q{WIfC2gZ_<>JzJ}c`I=f=)%7P7 zw!g^Ctejlvu(i2Ey}_GcPgbvu;zSO_ESYwp!z<0nFXuLU8K=GI>`ab{a$TFQ3vL|w zIJqF?;*n7A;!0FrTTV8VfbIA%q|ocb?cb_&!?1+1+d^H_G;N51)J{FyZ- zV}kavc=LjzrAHk`hNAc-%c3qH&QbKfWf}2Dn^AYBy#MHwweW1`rQwdsv4Yd)OQz0^ zybtpq1#oyc1&qd>B2Od~%XK7tw?OQ|Ww5g!ax31x0g^<5-|P6E?lAqQKj&K{)>h`c zbtB)n?cK`!ngu7b&)?)WrX4|ES)7d21MI=mW9G8uH4erE$*q5hr%~lMIODwkF3hF; zl;hp|Fv;UxeBgecuYo}}0UjLfT8e_?kN)yYdyEyy421mMeZBs~&G2JLhm3;%56#rY z&C2nw^Nq{hc#kd~{7Z`L;hW^BNqN{I%%68un#Jb%Ywj1aP`&K6XYg-_^QI&DlcYkvrt*pK|PpZxt_|1W<1 z|L(Qb{`IZ@FTQrtx`fEmY}mT|9)To&#wKSZrey6`>~^H=j?ZE`S~QZd26+EkE=EpOuX;A^^8!Ou^@H~LM(aX6Iex~Rklf+izS^1IJ$ZJbK z{s?mXDl?Cqh2-I5`54?T|HnL`Vq(%9tl!d-(Zx&NX_=?Dr%^yLrBT;Jg6TrY!j{vG z0@1b1nT(EUeV}rI^)lZ5*!g2hJ7XVfGU3@6#dIrtf3!jq`%T=QcudI;eLmv1FF+2I zpwN_yyRt*WeOWIU9Z_mJ0eXEl=DT8Bv)gX``+fepl_QdIlV-%|+~#4~gt-Sy?r;#3 z$ER_=|Mq-a|AN*-l@yqfo`i;4Xz4Opf4rF8Mt*3oG=2&>&~0f%`ZPQ%dHFFA9Elx{ z#^c{h8*?pOV?CC3BwvX0t?XY_4XnMhjp^gllQcG8Ps(ucEUa@a2!&L=u4K|9?L6?~ z4vmM$W@p<_ptIYfsYg$f-x%EXCJV1F58#p9cC{yb<)*k{&(NAkk+idGB8En5!rRy$8 zSQVY5Pid_1Twi7xYk5^&+#Fy~bIOd5u(ZG|Tk5gxR;ylK_O%L|FJHdkt~1zt?z5Zh z4(PC4t`ww?Gv=#0S;?SaVR54ECN;}u{mgJ|2-!M!&0-^JZR={D#mC!3wI62+<~RLn zK$6_F^z4r%6JR^_oOL*tq}J3T?=eW@&4DU~4ONxf;s6bo?z~7rhAOyNaD^6iA;~&N zreqK6{IHG`u@y}w3{IT?D5#;I8GMx&Hod-v^E@Ex9UMM zBNuwB*i%$Bo4wlG_hS6nGdpu&xppzHww5(GE?{^R0-9& z^*f8lKJH6-+%Qka+$bOn-Qerfsm+oG1ivU)vwl8g!B|LCJGR{By0#c$oU;}7)cLGr z!b26ahYhlgb{N!=$>Bw1Ub3x>iH!uM#*brf-#7aF zn8YW!u3JyH+IJ*f%m2O~#-YdU?b~5+;w-zmH?vj2-JKC77i?o;PU1jB-{Y69ZDR(; z+jvge4%z|VB@@&x4Vrzt*ALlS7S9Jn{rW}y2_EN&8slk;7K`~`Ri(+x_)>J#e74#m`dOQ|baS)B}@S}2XXAkI|X ztZ?y>ifX*OSgex4Rv@q2g&unD+C~WNpMp!Hfh&29K9S1@()j?q#H~kvjazr4fM#Gw zY(Ld$Q~gTz@V+nA)kOLN%PvupWh_Ye$M%L10SvufnBktmu=eFQhee*9UVn#`mMuWf z)X$J$mZUdv?B%>K($kGW*BZ8EC(Uyl!X&JdES_3E4u*aaoUd9ct7Tp|iwwolz2;>? zJ?W->AA;efz!HYZ4dz*TdmzZ`hev`LiJ2+QtF6qs|Jp>S2nw+N zITvDWRz^mUe(}6%okZaey8`Xpaa+l?-!dy}{?UdfQ!|67mwOhHZHF?pZ+Lm>)z9)h zJ@EB2GzuIP95)wr==6b+OjTi(nJG9t+`uE&usrCwMTf)F z)=Nu2WaJSdm1362)IKn;@kZlj#w;y~+Uc=JDE*jO#4si)pm>6@@I_LV^X`>~)*M4< z&5)=!mxvK_1fI^m-V8{%7^K8jsB@{+{t7p{9|NB^AWrC|SC{#(zCVO}3mCGaI-G}R zME6?OLF6t>TlK{D-S>8$s?agcX=5``i&P)PaLwwlEH&zJU(R-0RHNozF^>ui9+(h& z+Wb-r20j6Zm|L%8xbiAf>N#TAMDU9fI*8hrE(K+bDF^A(b%$e-DP3RP3#$J>SHWB_ z(5$)fLq}Pu#q^Y90%Xp|pg`hCu2Cm(OHUogHWM0*7b?A0C^ahsJf4FeDHW#RrsX&J z;%-N555;@_YSuDnz?fy-zeB0fxc`$f)U8(Wm0vOtqx`TNOpoXAJFhL$Xy=#)j!J~) z>Z+s!z(%-RxsjIl>eZ@53(=S#ugin3V&vu5%H(xv0zOJ9Fr19m;8f%cy|&O*2$fP@ zc>J~0MNQ3$tjeID^Bt2WP!^7aD2Aw{z=vU9dgUd#;WNXXFoV#qR5C*pS(?p{ePO^!Bo~<%I;tNlDfa#icp= zv&zcH$>yPExDuP`%Rf&%S%W&s=e|UF(AO}}8Um{AkVO9S#4<@e)zEy~``t*vW+-Ms zRaI3{G$vWbFKE2b$^eFq7*S%a$MRf4a`MspvNi!X1*0kkrs2$FZgZXNzT!%hGH*^h z;J!3o34cR1iywJapdHEQ(Q4qyZx**o10TtG_^zFQl__9Po_}%DYC8tbRAumw^);)_ zTKdk6@NcG=R9||UoL_T9p`2H^_x2{8*HXt&!E3vOy6h-DO5>cwYfZxScD{%H`T!dN)lO>!QusaB zHhS+BjsaRDZ@U@Rs_%Nhul#=Nn920dLQD)s376SxRgWuf|AbUH2rm9A^u{8jQF4!J zskKw@VEHCc2B`b#kphKTZFJtaVyB&Gd7s~&fqDhz_=1AuvMY+d8k{D<54nqOF<{R0 zr@iE^7@BzuXZ5cS0r@}tZwM3LsBUM$t~Oq}P8RDneNx}4Pp8vTh$%R@bZzch7?;l1 zQ>|Bm>V}Rm1)ua-*^DTP^rs*RKMhW~g$aq_9?wHG1}j=6>udChPwd88LTqbk%ef23 zzhJ={{BCsN+4*qGD;|p#>6hPbydA_ScGCJs%>z37osG#7U*1_8(ViML#)$ZQKaeL4 zg=QJ?{K&3e`vkV>OS%rf^U74pVrwbW&(d}GI8-uMxLc{)touKy>FCJ8aZv8J&YTi$ zQ`EIaqwjQ#J=TdY$E@@oA(Fv!g+tVC_&q*uEh*=r7|c|BP-tRj!^jhh?b8cRH%vZV zJ2~IIyZ}vZM`B}D=abuJ^h14I3lX4_%eYBn@qGI>y;jsBM3vyLD>^^Kk8^Uqn`_Y}Sv_FMe$Pt|kFW6h%8c`9>d0@m#bN5| zq?1=qd$#9VC}2(AvDu59*+YP=+;0y%-K(KG&o#b zo9$})6De{5*O}aB4LY5NPHf(Irf>#Eg#jO$*rbAjt$7_XJteC!+bc!b2sJl1gX+9~ z{W>_u!g~8Nr5>A5!)||WcyKGDm;-jQUYmTKx7W9LE_WOhys3RbFv{dtuMFhD)w(b_aceCXgcAS((c$tv|Q^zX2*K69wvua4JdYG#8VM}wfs;c1@ zzVXu1W>b7dvwHFHs{Y{hC<;c=hHMjh1`0o7_pDRreCM~8@0VV+Uya;~yc$GclzhLI zkH0__;JGFy%s`R$^2XVu$B4#U9sKGX0C9&D>D%lDn>!+GJ#V{=B9xNbObWUzV?A6% zrO$F6f0RjM59&MZ3l}gEDKkIKt+W=_!xP^&ifFJGuJOC@mZoP zSxVd*J2lVRgUphpAK{EwzFl!H*2g_nO;&M#N+L?dCW}HWy9yErba`D4Vkop69-d)U z3&@~pk;X{ouK4l%viO3q^z=TqKUc3p=4 z|8<`NLsj`6sndc{HG#Kx+EOT2@sh)|q|6s#+?dQfE^0w+)`eYe%S0g*BAmyMW4n_&Pfzcw=$s!HNH26KNfG5djH0B%47CQ4 zLap_c12Sv7k6&sM6b&W_24hv-U67Gu-M>}riuQKHOahcCr(%7i(_U(M>Rda764StQ z^}sfUTURrb6533zN6NGA@1EE@u;ONrslQAz4oRcnxh1Mcsw5yAY^7lMifNx$RUUFK z2{xrhu8NVui*pPUPrtk^d;`Wz_8(EgFGLILG zSxc5b_)0&IKXqbvhg50U(RHCV<0x9+wqAX~(yxrxx=D=$(v)%% z|D?zs^8u;`Vf|G}Nf1!v6qJD8DW^zxDLrl)tCB@J3}k{|yjA;~N9F=c2?t~1YJUAJ z<;d%_*@ci0HJQ<;2Ym=?p19v%XPgZi@K+zd%Nh5u@I$EDpq+K?XsQNZ>#!8)c4X=$7^S&2rGY?gU`2mt!-9;+7! z1i(NUrkfWw6dP3)azRpMsMghHAhgx`+ZjK;8!bxLvN*65vBs#hy=-Y55dav*|5M(V zMG8w-;7Js}m)JGC!;g5`W9&F#R(780uIQgau+#egIy$Z&V@HUrP%f;Lt2$Yjs~p!EY8H>42gJWAIUmL*qjx;mroCs{>E z&c6p4H#%L$h=JYIWcnV9CRi`UV2wJ)DOP)nXWS3{dr7rS~`fk`BK6NT`@aD!OQ=_1S8tHtYUuGmm(Ma;;hR$kxN z=K6&2>cNvgHe*`&EG;dac)g34{BBMyT@8MYm%aJ@b*$7XK|t+;*Or+L!>yBK_`~K2 zZw3nX8?CTv^u1;uLm*6_=0uewb+P4tG0(HxPEwT*vA=g*nG>&OBcP<(yt%b@+Ll1?&XW% zc#W6Y+d1OnIqqdO_y;!^Jfo6(wQHGk1M7~f)QYTCT|?awi>v!=2KMij{jg_jVNQJI zxrptAgsp9zS#1PAyR}yt9rh~(_YXh%Mk_cjy0lRG80w*4cD5Q2yn*|i0ax|4pP!=; z%w&lWz<>Mvk8cIy%{l1n{66%OL*eSf%9gIvQg+NHL%;>z`o$jM4z=xXL?UKt$6{RO zD=i%v-nOnxjeKU!&p$zEPTL*lQ9vGE9eSCGcuV+ucG7L+WNXDTwXXM-8*aOkmYnM( zO5GuT>i4}AZu*VELk$8I`E( z?4;+>M`yk3q}Hk8>Vgerv)aam8Kji*o7eJ;CW|9kFGz|6PW4X?!kcMS9aa-<*KiEe z*S{)+S*2?-tAmjcK&7F1lsaH)wvqqc>b%%fF`+o+sFsj$M^Q8Zg(HdlL*HJNl#qey z(yQ-pzkDh(Lo2yFPI*(1UcxoD?o;3xVCRvQHL~@Up&mj{$&p|Q!9Z*n*CG|M;C;-{ ztN1xoS2!IgL|70p{Fb48?8~^W_xXIoo^^R=k8B^G=G*Ii;z)qL7aOSdZT5Q2K z>#^Fl=Rum9r-<*|>zum;LaPS=uiZo)R(7Lip+b~R7LLyI;oMm3&v)J`S59@P=wI4b zI(Q+%v~W27Jf;S!hu)dR29(&`LUC@{PmX6C{J65nljx<=_=Y*g#a1+Cj_I?N`Q<|o zPi8&Oq|(&v$4328pyth|R*6R2>JxczUhH`diL;4@hc3{j=2YvqL`C(>xnC>#Zhb3q zwv}9+Ek)+-0d7K)N>Sqor~@{*1C>MAlsS$a8-PD838tr?KYudJ9iaWuYEm7x(W~rG zr0Egr0Q^}6Fq*uHiQMR}mmI$^l*YfSM$?IaHXJXuo{WDp+tD;C6kJ)oG-us@0N#?D^bBtaWh^9d&F#oztw7xUuU!cG|Qo7LXTwLEc_xXCP%4ch}7Tu$TT zH-AhC2hfz3_pFzY#nt(xrG39CDEYgW5wy^){Ah3^k}JO?^xdYMJ1rgCEBYq7dQ`7m zd3rrA?YhRL2?Sp?We>ARKi{jHN4=6rQJu||Yt{1w@B2O9cAIXlTMaCI5&UL?STm2k zI`X#d=6I*hSHwTPyCy*O&djyaJFP96!A@$CYI{jYFVCdf6h6VU7%7LFM2YkIQgdd?w2oJN^xt#_!Q;>Us1`a6-uo{w~BWXsyaKb zVBo5MsXjjzv)rEA!uMn9APQdZ^5;!Anwm6n?8m~2@90V0#@)DzlB_a4Q{(a*^R{Qp z_r?lT1n4Rz7gAz|+chN%aU=mJ@`Nb8Y+%ew`~oI$8m5I?Uyh|TBrDU4Gx6M)C5DOU zXD;0Cxa?it*OV)YWrpUhNP@6r#kH)a+47P`IeT?0`_WvhRQhAA`(3U(4lyU6Be&D5 z%ua8b94;}KZTC}uwQ1tie0kPe-9cf7piPz$31cqTL%T{k`o?wH9(_|}^Zd@2Vrd-K zP2GPxfbDUW@%4l{cd_+yiSUty>?ax*8PX{wn?zoA(Te+a>94!3e9w9-CR{njs8u)+ z7*yV;RGiX2Ls!X5uAzy6nOvLD7$Nys_;Kq>s(R@1`UJ6Ou)xB3RKNeUMfaw25 zB|0~^fm_0(F^QOp7=~Yw7awkZNwY`t_qT2q^Cd-;k50wikk(3Mg3^uWBF*om=5A6} zX1IB7(QiGY=cIY$d_wh=JuMLowORH(cVsLK)jJ3xi;u$FJHj?ON-z8Us*?!!i+(I3 zTR4{d(PK30ZKM9gCZ+_!#HMJi)(u|@g1_8Yqw-sF+cUeiXLj9VV#ua*TV0u&2oFy% zn{uShGSSFsX(WXJX}b7Zgw(o8c1}*PIlTjm_uk5st#Q}Ip578x;<{95^0Cb8=>GfT ztIPZMi%V~3DLdl5SDImirpleY(%W}1;m`m4*n4yEU*Ai6DQsu?&%gikuYZL1y_i%f zUhg?ggV&?uaw0E(rjv6;N&N%<-N%#LnNT^NSiMx6wpaR|5v90&-=BAUz{QO>_}kn6 zd4q?&`~Ld=>@U3GfBrqI6E649@Ben4|MdOtk1ZDu=!PNMz(O5h7|E8F_QRoY%1PX& z#bb0I!o_S`E6tBkHH7B^bWZy?@8s5$B#jVl!Suk`W7$8-Q%JA zAzH-N32CLzH8m2({XTntIH}VxgkP~acHlry*7fEu8bj#F0KO1*m%WifRw}#)jX{*6 z=BF-|x}7lw;wo@_oI$Da1F={pn)@qbOYY%e%<_>(p7&rPR$isZSz$D|K@BinK@*2N zhxZd8G(7QRj`hOMg6&kmBC`5`7C9?*!1P>e)N8JQ^E`~FTQkh+(=_Q-#HW51udBps zzN8cxOP}B}SUb?%teM(-zal=`-C@r}{?G=mvb}P09m6fJ#6ZCwtqxmdKgHKpx+kd8 z9wBc|v)DGDK>F6cTfzs$oep|<-Uj#tnw|@3ckB#yLgyPwc9ldzBO5uLz*El^BNo)r z<^mrAg@Sq)hlWVo(68V9!Tk%%SzH0;0{$6eWT--;Rm?b_C^fP&Q1nkZp{uxVueit|6Y}obAsN55M=L9fKL_4c^6n?7UtZ`Ex(~J$ zUiBkR#gfv`50(1`8-IU2rVVBQx{LTir#fp$)tiDNk9f88PI*^z)4$KP*y1GKt!E6-(JvbCvTpPz%dhw!gDJE@Ci8_t8$ z=X-Q^v!*6SX+wh=a*cJnc#23_15(HU5M4XWhY*Q-!sPKg6XY%W0$tH}KNW|p)Pwp2 ztLIidC9(?;8y(T^r44Ka4vqXl|)OFO!%_g1Zu+4 zv|8LCv7zgmb3qimXukb;w99C!fK~VYa^8mI@%=kucJZu8OqQ-wJioZT zw1@OIaqhVffW2+%<-!xWKki9!-`)2j*hxS+;l+!4OcJ%vZ?xu+d?&QDwD_ozf)-z1 z<#qelm?FuV*YSwrrZTlVl=``ACT_--tta06*1Av{w1t52x+mhiC?C$RnX&bjQ^ zdRKg|DdgwiV8e461yb-3+sC`9Pmg9tW?Yd0Mct_Uii}p&Zu_0nY*?3I!F>YH?Z$6~ z3tLj@uSJ?Bz|oC%BgMcKALq~uY!yt}V(t!>>tg3Lm6gkx$Gyb%em=V^24p-mir||) zB{5bd$Ikl5#I)1W2)QrK8ufixd814A*8ZunnNU1~fnqaa+#PlDn;~&26e; zhzzZ&yw0*p3(yUWzVzGhYql|G!_2+0@NfI1893Z1T4N<#4~k5i;#LX7x?HEz&&=#@ z(u9hd_HwH_3RQUh42xBIvbj)4XKAN*ZV1r0 zN(#TvpFfNKSi;tHR#Qu>v2^_a7(NjIgu5D=?!h%-9$MwRbKD%b1hR=B^ zs#3+*bAWza<=faOfLh0uCpHuxMDNPQ);*K1(Iz^=F+m!|>v1prgO?`If%{wWSB=Okw5F!+fSA@GueLnx zB(4-E8B@A4pi(PUN`s~y3ARK0w1PLkcRx>D${D4Rz8A-Nklbc%v6xoUjTLR!_HNk{ z^~=S5?u*>veU|SGsa)sB4M!S|8XFro9Z%rkbe-3@^xwWT|l;VsS)7*%q2BA9Lzz z&(RZ`h;*2%c)(OtRJWQn?*ikdDx8HDs$1`hTk%} zMyROV0=q2nA;1~Mh}tJVyGkh-b%OXdXh5JtHSW4P6%^1jX!!+_Zztq}!{7>kpktC* zYer18{Uyf&2jT~?x;a9u`X<9T{>7^2PGn?c@o~HYsM0-;&8Xh3}swC;Mu1 zMN(gc(3y}u?JBwEw1dKr|9~j)vB&CGeB7+Io3P<-R&GR!ha)uf08kf+nIBDKp`xM5 zF;Y00OlWvsZZ+JQfBe38P>reCNW-3y#v#6F6&j$Q(NWF<2Z<<@OvY7@_q=W!CuGhU zb^I3CoFo?z)>5C&`{-=1L*X&5P6}+!9q2-M#4Ni04hT1qQ=9FC8Je0lr@r`25nNdg z8Rs=u2qd2Pu^n`$u6uV7lNCeQNVpvm;o}REi>&tj=@WO`i(Q2Zn6~w%=hP;@dv_3~ z2twp|oBG_J(Yi@FWpyqy1cdF?PY)`s3nc(2p-G7#Ia$8Yqm?Xi+cHlK3$v}h=jy3( zhi!LG-;UsqGaCGQj8M28dj8UUakOE1hDm+A4`Q8rtG!|+>iP$xtc(V}9Kb>vI??6Y z@S=VPmS08E`UTq=6|%fhoejXVMIk8weJcxq^oXr#?-Ii@o1C zlD=@6JAC;zQS6&WU!8qZ-dC`YfH;_{s+yr-48G+OQ{CX^5nuetwKO{-b7=2-%RKBe za5~?|yEP^%Ql2|^4tX-Ok=9IRa3-mJ1`ZAs0W>^pR6B`6aXMn+Cr+H`i?Yhixmt#f zjs*Ysm2uMIbJag!7g|clXlmjkXK8z%&@D+$Pxp=y3s_jpyBi-*#9nz-hZ=SkIwZ(K z_DDK0hmZLY1T{6=vJwDqKRrGgaHm~a1{UiN0Q}&l4xG@<{fRdMzeVL$cJ+E=U3|P1 z7+sNpfupH@QZzgsG@6=-%Rm&E8jK1+4+xe!r^%EXM~hq57TiYL^Va!(_1k>RnKVaz znBs69Z6Ly{eOkx5tX>t!2{Wh=MU3-08t1J+eO~17ZXJ^t-gx_#@B_nxggpj~HTX=| z)>GfMccn0NH~`ZxO2oVd5d(H%I4*X zmzNe|A1iK>+YnU)Y%1Klnz+jIZo#UDhmC}G?rnPHeDp6|_6P6$=Q!=Zz-|8lvp!~4 zsjhDl@HPCbb3l5#^-V8e;K)Hf(W|`< zw>&eN+r=gxof z-~l;e@S#fyp~-~30dmM_RS&mXk--H5mQqdo-EO~f=WiunvbnI9nfI*O)k+p_J9@MS z%C*`+c^@xCQ{&$E&sQcKOGy&_&9>|aV?O6^Qcv6V+6!tddj=&)Hk(GW0meNE3qu5g zAEW;0SgRGda^0C90k#McRKW8?U!CodRr;~s{K=h7nb(?LsB&q)zU}YdB{lLJYk0zC z+{asGS093@LYs-3SmI9SS)xSu@G!TigqNIPuDX)fv{*M(T|>CaR)HY(5F{iesl8^9j>G_ZB7g7<-u znwiYo^>@2saci-rfS%X^aFdKe1hDNMNGbUAt6(YmylId4X%4D$QIB7yrNyIFsWw*_ z^*QvVCEp4sqPf61Oh$Yja2Nt~5?8ag-7V8#RJgqUe52v`cWWwYWD(zy`coBTF#jsX zvXn9^uHC|v*7>~KsEcPDwVK+%e5t>`d_rm~8r{u#p>ZY}KYY(g@kc=lN64)9k3W26 z#eq!`;){yl_uO~x+I8}Q?C21n^_@+Ak3&Mr-&rTXD8a;UrZRA!ooNVI{8l@Gh|xi? zr}I4{FVDtrDqbF8<^W-U<~7%@MgjF6t->yJ84Mika_kvgTb{hu_o39b!$L?^CqJq_ zp>qGuE%ZgTzSq~SX~hdNW)KLYzD+{1pxQrIRj~-=Z6S3Gof#@sV%>j6Q&Xui@y(kj zAjW4t?Bd~doxkZaKdy+HWHhnxzd~^Y#@88Re_E$8yHhm^oFwnRH_9yT^y^GHs^5lp z)|BnJ5L#S@#Tj!dV^SA;)g>b)nCIpYz)!OKxcYvUP7s@^taP5r(mW9Mi(=#+EW+~AK zOh3x|_feIs-3-DH?o&=0b{7q0wRya=GSs2I?_KLdvldIzFtEnUGl4#p} zFw~=Z8f^P_xXg_zV_8U02=48$a!gWwJ62G;IAm}e^&9S$ipr59eOLm*VLR~wJsvt( zqnoUENKlqE{S*3L@Nfexp)hlq752-}tGk9>6qO<*RP**X$4DqnFlu*RN6kdn0np1z zKm-7Ek3&N%;Gn31XQM7Dd_D=j3y8b&!A#1RE(w!T^g2=ViZNKU~xi?>JPCIqQ!&!<= z>0JQI6jgnFQhcnAJ&r5EtS%Nvh6c#?r19sy0Jf5~!u{mvUBM_CU5nPB4+xP6K0P5d zelz`gkh@^`8k+D1G>$xBQd&9uuh=#3I7q#Jz|0hnx&v}$#QE1Qb31D#@@T4zmkyL7 zkCG4^rl!Bf$rQY;uuFgPhrmCB*9CK;gIJW1)dyas>FMd;lb%w_U1o%PqV#F2l>_%G zhi0r{>Du(#Z84n7pd`Al+zKXVwab_N5h)&Mk`vScU8f#OQn*OsT2 zSLfOgoi8(rQA-yauT&3cNuOtl1D5k!}>=E=*_kkB3;hbpn?sqawD`T3lT-)JfdqeE@qk zU)7f{8=qy{IJSS`{SWY)`zDp3skvk8jbARs9R4ovU2<~hF#>{;+eR5v#zZ3`bW$hn zWt!VA5~aBBf~46OTxs4kym_!L?m{?sOoX7t&WZ{jcvDE%2HPfDJ)gYZbXMQV(2~<4 zMuo<9Nb&+-#LqBYOU1ES%aTRv_lJdq!l93p{QhA}hS)W!gEUm0x#n^*kk4(mf&G~| z>_&ZGbrr^KdjE!S;crE@iu0l)Dc27o1aSHjy%kxn*Dmfv>wY!?%g(2t0;9gY(p`9y z-&%ewFVnpzA(;TH!!@hl^PfN~d04}EM+Z?5n)bO-nk+loR8lC>B6hew4-cQ%A-(-L)n8r!$6iFo<5d&ni{@IQ zF#7iTB{*;_{y_n<+KExNrXQAQ_&01o5A5_c10zfC^HyNjQR4wJ>htLqs#hV7o(o1P@B8eR^oz~%u5 zG#@O&v+_UOV?DZH!o46(+?z#h&Ik&GkF&2Lk13`HXqVDk|jWzMu&y2bvZ5rg8eM zyuXntOOe@G)@`ImZ{Xo9+14gPD7_b%tfrwM3w3b>Ei+*+{u%696t-d08e;C7?#adr zShSOu_Ef^R0aE0LFTF45kO5M7bO$Bdt+7|0gP~|`6T{8|IzS;QEp6v*P?{hG7Myb{ zSlLtdft5Gro1(m{U{V*m6Y=({?rnUYzx9{?;u!qqzM09iw(TWK4VD?{P=j@FTbbe` zv8-rM5tg3L1u-EaBEnnx44Q{lS$Q-bvsdChc&#Ck#L+0}Rr&pmPgt9}s_v4MWP(Pj z)?N0k^{^O{!DM#I#x`n(n0Hj_<=QI9>aBa2iX2(%17S2tmOq9X5#^%~v~T0lrc^4b zrXXz_Tiu6BY|x=$ScP<)vmo>KBGugMFRR+iyLJk0LPe2d9{D(O`BiFaS+-K70O1_^ zTbkx%S@+AsEl~%>E5FyPC(F3X4;B!oWaTJ%F6wg2yqSjcGfu#N_bTF%fDKEDjYNN~ zy2riy)^RzXm^z>#Ro!goPQfJZ-}`qkR>ya%uWwtkr2dQ9h|&EwW@ERS zSr^5YZS8ZtLvPmK#rz*L7d(GwF6=%J6y3QUSIHFh^;cgjzs=9H`kwCln1bo$RDZch zNENQR`$)6k1N)goz!1GLt}bt(b4-=Zy9##O4u0Lx8{@d9jPx=BsaQg@ zZnjmXF2Tu(-sL}7su>@25Yc3uMy=9M`gw8PCe4#*mDVKp{)KA7J=qTcB^hJii4@pw zb~RDtjK%&Tl{GbcQZk(U0|NF4cd>t5uf3;GW}1^@H{v%tVoM9Y63eH({Q7~f{^?b{>)v}XVOPCX7pa?sm>y=DEx2Y$Hk04SBO@gE~;bnoF4>k$} zyTpLB&S@jz5(>YZ?rV3CSgcz!ij!d=VymLOy_>!TYB06F^S}XcBcH+zTDZ5rTU+WQ zNk8;f3^3~(_J5j7*DDM|6|bf?eWD253jlYnsmYk#S)zV@xkN#^@t*t<%>J6$QG3ZSlc^Tnb?H|7wb_)Ye00RZ z5HCVc8}rCdu@a$NSANr>*DVj{aYywlSH6CY;K$AnZaDCyk)_%4JW+goh2cweY5#Qf zGRmZjI#&*@r2y=Y&od`?!BMu0W)OUCISg*JAfkl21R}wT`GNSkhY-ZooHlG94`^+- z!G5~!zV{=C9KA+?D;do5=dpEbbJcd{*EN7(?R4y6g*C^EmOqwM)#sQ>+-V)V@le!W zFGVYJ7p?g3>)a*3AG_RfNF+*)Ce$PpYegj!P=k&Q(+DqPi0y}eG1Als zE64*zF)Ua&;UVDn4{(G>qqR6N3hX%C7yDVDxp=%$R@~RXif!I_MP-WvPtY4T3N#Ar@GJk= zKc%5Sw8@{(P+xz}5@v!vf$D|H?L-IE6=@)Vyro%+^e4|K9PPX1G|AU{x;Tz8aOuX7 zBc<%&M=~WC$7(V5;!N!O?EqOGXHZFi(1rf z%w&?gWC;DC)azK(y^H*nsqy9go zk*4pG#A?@ZEAV=7`2^KC45uGIcC3u|F)1Y`7tk$iewEQugymyqRK^&#UGDs!Y7j)e zzrCR~8hj}-`3x7S+b1_b!3MjD&QRIIiiUlH3=~6W#0;vlfdikrFE^q+7}Jv{Zs%bF z3f<#Zju(CmLSnkGXEhdUeHQFNkE?#3S-)y3(}Y5QU4+gq?F3yQ->qKF2Xv?W(Uk3? zYSuD4qk+1*tw!|@77uqAs%j!n86gZiJ0^4+Hh_m`hY2*5!Qy;@Ypa=rP4MU@Bt@Hx062b9%eCEEhcQWR5kPR60|Zj>b*i3g}5SylU|rl+fCo{G*Xf(xhy z!G*f*=C?nfcJAK)9=#IR>BotW4~@-_dF?nzd-N*{*D|Ov`_)^9yM%{^5&+u6qqw*_ z^pA_#nO*Sh7&uI?T`v5{^1=Eagkuk$K+cm5t@& z6#u`<_RD=GJ|;TQj%f6MyLNl7Gs3opP|w$|T$0N-X(0*yj1S;G(>nJ?l=A*&9DR_S znCJ~n{1-8=uz_3BUT$3w@TZLx^tHA?WeqXo<(EgI<$J9HwY9HZR z0DF>n|4Mh)_RW0X7aV*H4?@Y>i9i8tsTi4L{_(vIuE1Mci0$@p3?(*?+!987I7umD znwKd!rP~}od<;jPac#WhBy0!A+T9isF1Ng!GQU;ll;>h~48$FD z`K&?_P4*7GeKDkQ$`{H=@Ic47xMWqS&|~&aJO??0lga2u1`-Fc;ov_Md8Fp{l=i?N zlK+r&UX`5caQEs>DmfO0AW}eY8fMAa$(}esvxc`fgla`n*kK`<9di`1=!iXslpDmU zpXe=we1$UhRg>^J8C5DMuJ1`bzvx7EummxqT1)O6TTuUp3a?9>oW_ab7dJ|yIjlfC zV_An+`)=!)oNCjimZ+Gnd&ma})Lfbr{+oh7r?p%2&rsOSq}Mvqy~;qAtn9imuS40e z&jIz95!&Hk8->b@aNs5~1Y23)qkRsd4IF_tvLz`ss!S^R?*Gu~Ba=^}5hj_-!bD(= z>4lhHoanF>ZKn_qc)au;>gCR-u;-vDj(^ug;ZMfb1vh_8gQJ$pbV~9kE+D~`C9{E6T#dQsX3&%Fy zgpIq*D;!}*o-h+=C6EYNWPDLD!E*&Ok}U+fdW@T`x?|kl=EDAJuC|OX^0ZSOHiT@F zQ-#l6YD7%m@j>-~XzxajypCc=-=FJ+wZ4S)KH<^oEG($lFN{B5B?Cwp4b2}(Rz+i? z-I|&d&eyI}F8}(HMEACbGpFFA=ip*r88y8O+GgdKWA>)nb|IxavPaj*pp);KV4v>jCQyzrlAQ3UM9HmGou2^A=+G* zCOzuv{s1+|+n5!GI&5eI`W`pLPSjd723?OJDJ!C8mL6-dc*>vRpxG`qxe_%!&4=s< z2M-SpJ_%NzLmMghmMdh!#14Yujuzob4BF!(4QdI%612~UKb8mDQ`e~;ojut22Gt|< z3%ur?_C9la`%{SLgBG}-mNu!bwY8!G#qtEDG{fW(rY+!H8^Ur=K0s zMevnw+~>zfnIY%HYe&K8Av08~r_MNA2H^U?2UBMh%7;>b{wbKsc|U*s8n2s|0SI^Z z^r20fn(FIlIDiABwvcGKXX)urc2G_v;iMyg4%f+IKNB5N$irN~w{8dr>0zi*=vej~ zd+Sblxltg#emi2U{KYOY!6rIj^Gb1)=HzVPdnO5+{Nmor2M9*ClO)rAgATipr+YAwTon8= ziF9aIQS<(e3?^7T!iW;26dIfaTcc`JxTx_;Vx$1VS=I+{qKJ{neKxDF4IqP z=%7|^begG=BXzZgGmcYTV;0FfE(H1$yJyuosEo&2Hlnkdzgl6{AYAX-r5-0B!%=b51HWtR+ac->i=xP}O4(Kg$Yr5H{|+ zwYys+WG}bs!1jx>o0Ap14(igVny}odq32&{ea~=Ei4Na@GoE#SnSe4pe5g~2XHGN< z+?PF^s=P??#zY0sP{I#}0d&q+a2MObB3u6A@4&4qUqpqE@Qee?3POT}p49@^lm86d zY^5HZP0a08`vco@m9=D=bn;20K{WqudKRKcQI063C z@Bee>Kq;HTYA}J`m&HsIVt>{SOfvHpE}F(CzhKF>CilYejOWgmhURd3@BQ(8^98-% zxPragjs)!bAG?A-R~)pnI{P)(d6kb@C-z^!8u|*arrY2nr^_HTdYmb&bvIf z1u55dSaKd6pm_RLjHlMjXeF8-2WYo&xgKSOm-hZMQKiYtv*sn#!3*1nR4ym zRsfl*xz=FTgXxQk0~A{DZX+WM2VE45R1jA7?7#0zJNKP#`e$oX6R*R#@XlQU=8c20 zI0W-UZA>9B@|>C=UEnnxYWVf;2JYXZSu3CncQsTzw0)@TN0u6+p9}_vv#ef*2jN}9 z$i5uex?5+=Hw`x-uOr5x8BEK+Be1D4S|U#U0@6Y^oa*uJRYoi{Fu0iL{OP#M;lHzK za{RydI)iTX)2y}3V{SP_%C7O*4Kr6kzS7rsB|lPsb?8Nzyf`k6q#@-JkCCK6ux{V8 z`cX&|24Jv~fqsiNrlb?(u3+QS4pYr6A*ra8C>6{1tOIeAI+|C%%pBx*`gIl6=fA7l zDqD2)hS4nRR@s(foRGTJc2K-BDO~>?fk3!kBC!AdvpJd^dz}FB4?}c65|E0D0+1OM$ zS4zr<*U8DE7Mm$|`fT^{O66q`zIBk2y}P`~xeo4E&uM`!>wV%#!-3h{cD2HP;A`Zm zfR~v}m=`McKS?~WEAcH_7Cgo&X0{EA?2qEsch*S=rF4HDxi~;-t~1AnM&G7ipO(>E z6`koRaTg)JX~fhUgxw(ig}E3!trjHq0sCuw{52sskri6)VXs~M8Dc_e%Ttl6jo>Yta7Aaf9cQ(s9yj^C6Vs4@{5G}PFOEjy-;n;qN=-xhZC3H$`f zL!X>lQNQSDN)Ws&aLv)4{9y{)wu&Ex89L7M^gFonk{_{mixN!1ou?Pds2oX;iBo~?@|T- zP%eW!p7|l9?$)=2|5E000>e*8%IB1gYGPLfe0+QmBUHpqwUelgmFP*4++5BJ&yXLN z7L6pCj2{Kd-p?>F!Oe;v;vB|Zi|9W&+*K&#P-rw+wPyx!48fFq^m`wM5g(`%K0eLc zRlr>RukzN=f1(RF^a8d!p|&>!N@S)*|DcaAOLJrS(5-<1tVYXeq*p{mVpK>*m9@D{ zAwcFB^mK_maJ=NBY0gQz;kTp)NZXi;!cXY#BnyBtj)Ma_{W2=m-O&w(nk+Q5P_>!) z6DW8!Rn0vt`Q~mq zcvTvUmqo~wqUJYS=0$z@KztJJS&8F%ouFO98;k}*Xw3si(HgS+? zOkPFmlBEG!-|V{jC@Sha2h}xnekYrq=%PpUyY!GG_I5iN?IWqZoNoZ*zI+Ki4sS1v z3RHz%SWN`MdslmbElB#nz4tQ?4&^4b8R6$2&}H|2KeA$YDx!J-XCdzk{6zAVaYZumN5I3+*roMl%n~er_)H0Winp&OsMCt7`2USg?&6qZq zgZ2QHI1m?hqF|s?FJj&x%S-*Z@-cBZ&KNP7FArJnZs6eNPSYApj*>@FD4;P{Nq@yr zk|OU)n(Fc^zL)fU2#>mD=h&*P_rO=7oP?YO)Cbbpg0Lf1F|RwF*tB)!4ubhOv;=l9 zT949T=m`%WJ*wC(L=HbhHR&W!N;ailXf|K}AHv=Pn(P04AJ;BzqexMaJt849GBP4r z*-1wBo}oyJ5JHlbkd=_V$_z6DIs z-@aXNk1L2cY;)Jh_PpmRv>v!4uYE^*1%m%bf`jFMD(Y&yBttACvu2)!{>F;H4nI%N zU&m!FEc{yQ0)S+qJX(srdQd{~Xll1;NSk4N?43(Q*+wGu@qt_ZwIK|bFoc5I>Guv8 zi0JtGnTFH@G9Ym>`s`yq<3GUo%lr2uE0ynQOpc^C?J2Y$7tTq%Pj<$yP#xs8FS8C{-P+Xx7t;mwYAoNFQ+mG1|*zrS827Yb` zx9QKvKhwJ|8p;1n`Q+HU$~!!402b{{9i8ed1Dd39+oB#qU(AQq@#56B{&aDCDr2w6 z#^hh#5(c`3tM9^h-y|C=(cf`g@z~4rPv38RjAfJwqW2}fK7HdD)r}SAhMmOMPreK3 z4T-ernwk!zlVxYxefTMV!9|x{Qh{50hZ<596ciZP*!fCTy$r8+yrcA~} zGk78TUPoK#jGkWTby?X9LPGu~ZRM~x;(_!{EYv`#&n?dnBTn_XUw^#KitlTBS6iZ- zd@Ho4sI1DE`z6zxFL$nn8QAd?OoyuPTs&XT1&+DP;;G}5os|;%w}Z+-W}cm$O@NXN zAixeConB*j+mH75e+j-ION5a2tg@r%hA8u&k=E4K)>c(ioJm)e z)zJ8Lqk??u7E56$9xP-U z5pJYyY|e*s=#CI{)GaL`u!9D@Pe0$Pe9ORp{&Q3neDiqWfx2Ex|f zkvHvXKNgksB)iiL7Z^=Q5i|9Bd9M}}6co>t*FUG6=W-~@{`$*euh;RCt)+%$w)UJ~ zKsyhgYLyE94Kz?H%pm-}doUf2M_}C`X~FuYEX!lt-C?@dKPibpBRv4=C#S>Y?FVj~ zd{)1SaBp8KD!jHgr#*NNC$)^t%+DLaQ~oyViN#*Y_#m8@neLk|f`Z+%OH2J=gXsPF z5jWX6FC;81jOUDzIUhCBmD4r+zsVh>c`$QML1>X|$BrHFT|~d-JHhha$7i2Pin2bO zeGgG@a7zVJlMf2)eDrybde{}$rRQt?1$5Gg)&6O$2lskC8X6LZ>oW?2a|{fA01e)@ znKT)5o80!7ye2Nb8!v{VwBy@I1J%sj+%2QH&xWm2YUBeThX;kGz8e&(ze^1@;R{Gso|X>Y3+g)PDc2 zDp79611;Gw*THz!emv0=ehHPXU1mHGTD2u6b(%S-%Zr5(RJ)m7^LvMUHMwd`8dBMC zxGk&|Ye=bwy@RXI_8BsXFD4BV8N6ibVfBXD*!sA7ibIn4V~adJ?$=s%uZ!6^Sz!4o zT{q#$a$9^s@==j`zUS0suP?ExUk_G0T4-SOvn9?XD~tP(bcn$|M^=nr+wV2SMnm|7?j8M2COMVWk_S_X@kzhG?^k%V^3P}9 zB)Mzz&v*R$qW*P-yZ?Pr|GL8ezNmj+;lD5H-&gp*{A+xa2TK;~L0UWr54OTC$^zDU zLh_TN5oAD_uId*VNktzrCSq_8m#nJ#^F{@b^PrFrFV$39-geLM@bH7}fbgd&zL5yc@F?$=$}Wxvcxsez)nxbQ>J%LR}9I5BVHHv-H1Vqi_y_hA0; zxpU{P2QOq8N6}rl&_6cztkaBL)o$m`ov(0Kc6O?-wljXsB28D7dUQZgNC-ARdkC2k zkYYk3J%mA_x}`;F=prFJ90AvY+pOd1%*^Y_t~_W#-`uKt$J$RWf%Oiyt1Hn=J;%P< zuh)y%25dDSgA&+3G9vll!D%9pMTgP;up4iEgt=ja!)xy$imS%Pe?&AM+*7YM$+??( zZ*HOGS_d%fh zd2{-nI{l?fA@DUoW~g0#jrcoq_C&YrJ$haA-JEn`*bA29cu zo11ZjpqG9=oxemUu*sNCNT}p`;o-fz7!;z#lUm|i#)9acxo=YM`dm{(BOTmoi^K*m z%sV#rEWt1Sxnz93?a6mg?k0V`L?-AcJ;w1-%~}uZy@%la-PPrDRQQzw91<}^j??$; zdxKc~X?uI1^`H(dAK&iC1`U%Hs`_UyUfiU1&!>U?DkEpNHj5w_-r%Ur6A`50D=SXr z<>mYL&oHp2ozFIEybG%a!7V2bJN_u<69{jpvfwqzOn<|L3g>EbON&a=SWD7TxAmn9 z!otxwZ9>s4xa7XE9TXA4us4fUpDW^(;HoyA^jq}82+4AwNOZm1@?{22&L)Z2yZZWL z@Hl{$#}Gpj1fi+MQCRR4vRitWl1GTWkpv@AvyO{$^rR>J_N2DS;K(8r0YvZwq9X7( za&R%K515tTU-c#?pIKb2sHxfaFgEt8m>Bc>Q7kKCZZ6CnGHHD;idM{8x3qLE#L)s^ z06)hfJbv<|l$_il49n9;F^l8r;KRoahPKjWO~wQ8lhH#H`#H@vF;C6sDM9}6b}36@82gPjK4fpYIULeZY@lNxApryA4Z#RNMsdO*e)+x=zi<$?YC&k7b7%JL~FSbj4k#qK^WutcR_Q(Cz` z-DqT4@?I`KYqN(dg7q@uTOgO zBR7an3qN@L^=mZ|Y&ZS!Xai;kYrtLG@9F7zT}DPSz6sFI?OYhB4ea&>v5;WS2H!pf zad9?m0c9h=JWftdR#V;TdyhQuR7w45_2-A^=_3&`q2*S#w);M}xBFmqMEOvUUjwYo z=P*fe_!Rfoli7EWI6>6)$+SJXQMl_x%vQX(B+pKaZFy2zQ{(qR@X>FY$E@{EE-uGu zXnelJCQ16c!d>t(lx*8D#1xBf0@LihN-8_T3w|>&Jgj}!DV-;y8zZg# zdykQkm4CXQ9l`V09I2e0ruh4AO+mEU_Z}Y4gu$j9y=@TZX@5yC`6SvaR}Mrr_{t|4 zf#He)8O~U`it*LggDc_QQaw=RhlV`p1PC4A*YoIaZLD4o7DwYcSu>BC2sE(0*i9xa zR!fuW#yR|_c)pRAL4i0^O+|{X0v#=_SD^4~+1s}%7RN826%;%zBBJ}`kn&D5^#!?*kYU-A7^#yzRR9=D5SFM))6z-E|(MgMCw5RG>oDim^jq0z68C~vc z{Ak&?{7SA`VD9v=aO#a{>H)X&$aE&TAYy$)R(zC85m(Jvvx&hg0}hb2UV5ryA#IupRrc~=aP7yJIQ;dfbJ+;^0^+_+dL7Vde^ox32t*ouJ6ge6_cu=S2R9BMmwWlZQitPvy zXfpycv$N;u>7NV@-Ge4X21N^{i2G@uqcrEBtf=xkx$C3-gzCWHAkGCk9-b#)-jAGo zGheS_?k`CS=|h6Yb`6$0HIkm&tj_f<)D`@#pUF<=SSSi zr+SK>1_n0Lq~#IaOpqbJrKIG$Y4}H8pC?j1|KsNmeRnc%&y`(~8N^UQNky_r2iIrm z{DhMf2j_g3rO%ZID{4n*gq2MKpU^$(oUGOlTm;WMdZ?CR9e&@N6c>N%!Nbql)9czR z?y8!O9D!+qrWiS^d(^hk$x*7XBP35JwS}J9EuhaJPwQ&F$W^2iaGB zi^9=3h+c3fxLQ~q?4x#i$f>V$_R1B?D0!bwv+ACnlG|}Cx7lK2UB@K7PHx2Tmi+KL zcP;vyfIwsjLm)1+%z9-eqq0&QAb5nJGZ!^AH5$x>^mTE(4W9@t4smK*HKD-9!3D1B z_~)KbmUbt&4ggVz*DhM(C6Dn8leE@0;1#}R-RQRI?5ktR74gF)2e0XpS%(!uWN6IR z|0v|o*3XsQtv&zfcbTthYSlfi^sqh)|9&714$IkxY`V}XAC+XmsnVJ0l(Pu?P zQd>^>0#j4ec?oZRxHvnP*$W&ZNXjaoSpt1{ubR$({P^W79$QC|xP=3qC#9eOY2%AA zx6R6o9K?@@h(99%V(X|CHjhdg^ta8DyJpW5ZV>HfLl`uw6ITi6JI;1cNLBhcF`{9tpD z_s|*smqMM%3{#OCr{j_7hJfZmhUn<%EF0cRZO7_3%V9#w5 z{-hSBw0{bG0R}-mJ#ueyLX~b+^MWYz_!~mqK1Ff&`Twl(|6k?w|9TOPWe256?GHAmck4qZD`ycwV71?;}^ggA@|3Q|NEOO4L{R$`^b+9>y>wj zOGrQ#VYf8hSFa#)rvDkk+FT9I=$7HR*4U>MM+Wxwhl2&&nE3fe%^* zx0YU~OIDP7*Tei3Mc95su)4*FT#L;xDeAEs4i2gXRg@GIUt>kDp%Q=XVz%(-q_O}6 zmwG&r0A{fAI9-?I%y?MhrOIN3v)f+RqiSAR9i?gGLm7wm&rw9_N`%$Xp<2?@BJNuI z6`WtZdi5C^UxEObE9(Fb%Kq#|p5Lg_ZETvgXMec6ySKujS=g;GwFVJaMoVk5FFIF> z=C5B;5-K$h;)kpP(z3Gank~vXCYQm;KOF70G)B@=aIaRZySsbJ=@(p}DN0=I@mj)V zAHYF&XrSsK5ujr&@@TL^ni6Ckg|{D&f?CSn-U|24^=XfX6+RxDn&#H2xrMW5daonx zL&&f!>v>jtkB*!BIbt3VJ##QB-hW#XbX%jlWK`;?84dOCVRiOC@+BD3$h0IbH{&%0 zPz&w+4D*To*9nzBjBNpja#B)`QTU^Hq9Q_GItqU#KqyG-oFE<{G!SUq7DP*9xNm7j z1`6{(WYeTxZOp}~n##t+6hz}8__-&^DI%I}ZKB*|;P*T^|V_-r2d! z>*6VYRA<`$EnQua(BihFb-E?A=2pxsAN}0Z<5lfHKb6E7%ji6j&tv@KDUw)nS99PR zaHMdH5YM~jBQGv-na$=yJ~vJX#XJi)Q~=1mcOY0jeyq$GEYHDV`QX6=OOx$#Z4SIQ z<(8(8dVswrmNL{YdCEr>-YRi%de$R>!mZMz0kSw3wm2<8cpd=SgVsY0BL|{4B{i{DBVuEJpP!zQB-`^rr=&bn zUy4w|z!&TrblC7R?(yy55iBN%G%uVVpkBNU%yj?J3?!%Qc<NeFGagtnPqWjFAD} zc+K6Q5O1SI!_KCAqK|9x3!FyaTo&ju`6DjoirpUuyZ{_G{lCA&tSq))+nA{kzI@pC z?M#=Y6d!7O_l;R1oN9?~>j5bpco0#W>&tO%<4^tl>3MncUPj0BqaJ?0T~tt@nD@c7 zfRvnEq9!0}c42|p#*H8s?8rRm?!L8sxW6FN>W8t`ddT{+hbL5l0}~U35#|k%mh#NA zYvXMd>ZK3Z;^OoOQv!zT+uyrY0YtW+5RSJVyq=<(UY(*ck$m$U*~5oK9#0Ot1^}q{ zf{#pduDJl(B*YIhGHCkyFaI#Hhq_9f?JPQJo{^E#Zueo7bKuLDbLi@vl?-?gjS`pW zX7Viq{QCQas7Ap{Z^ql^iA$lu<238o4}#M*NNE(wB4%c+@Uc%~VmM$E4dU=oKet|H zm6T%?6pu49js^wYP&WDwUH{P6CW4v^^Ix(pdg#O1GwdgFZ$jFJ;`IBI!!hw~C;DEv z&3xGhq1Fi?J>R1QVBW&DsD&@_yAhw4cl5GJ>(yXx#P9z8e$fP(P~Ugi>e=g<)*^-F zSu8j7eQhx^StXTcxu^Y&noh)LL`TkuIp(AK)y0*cA1TDOnK+Ln%s!`>)ymv+Q(2kR z#>R%=xP}!}knFKIu}m>oT~ha6v61w|2~|3Iq$xXhT|-2SGpPTmRqUiAWOR{Yb-=Gd zVmFJz(`#3(?!=5o0u53#-*M6W7qE{{BIL}4TQzJ}%y^?`R$kpK}^ z`AC!0djIHX<52B%Q_jRZIrcSijOMO9NnVXfAZ zAj`YhF&KDsC?ULhaBAv1%=A!x9;)LoPCZUR@esiRqdZb(UJhmO&QpcdR^mA-6*-)l zD#^RTQNkUK!h`rz5*-aYyY7h-U&?{eqBSFr@+^~trRZ#^^EYNr&LEjk=3O_FO5|ekax9GD&TbbmWapJ-M4RFAi~9B7Z+Fe`ZASvIe0;u_dBz0WVU> z?)O<|MmtiCXc)1VKu%4GPSwas$uex9-*eN`b7v@6<-aa`Se-w~bo_V@*;TA(Wl$pm z>Q^tD@-WkfNbh(FUcD;zj&dU`9j=4#uu2>Y+YzM*VYl4+901fxP>`h($*eD(Y5Uk7 zqhD0N4d+80Y%<%-#_keV1=KY=#`bd}l&Oqp7s%*A*hTv=LOjTs}bCQiu1z z0$h5>%fDS^wgtIZK^N9;_pf(r_!D$78?UAy^EI&wlapVFqlW z2t?%_(66|sY{+Jk!4WNDw}#8O)}EU?ckK$j5vldJHC~Ei7~FY>E4j||YQ6xMlXID5 zdkbfyx>t@^Zs3W$@0dSK#d8Z5!lZ4y(B$>oxL5fu`o_d~WG*u{=vt2OBI2mN7z~xdqYOc|9*rPmITNpgaj%*F(VR!SEnp^cT2Damav* zyJd_JnHRSa3`s}_2|>QZMMxZjl3o~iW7)mD_%s8MMM3L_G*tm41>VuaJ9~S3R|h#% z4jfFqj=?2kP4T>;%qochtE;L@^lNx}Jv`U}ZYQ}cTDh<2iKwP7Cf;ZLt|QSh#viNo zdeijh^E=bM+sUKy(SncY;(7;1V?2fi15bkg&r3K;H3V2wJ;oMYj+|LrRanpHG&8Jt zV!tr4obLi&E;YK4XC&h@J50yhOg}IE?aMz+CE#G^ZYp-|!Gq`Z1-Rl&+oPG;cK_i5 zj2;Qs-**zw$yOQ(5VPFjl&aUmRR@AwW{8D zZjX|PK5=nzSX#HwZ{XBKFAR-808}!I{Z#V?(!gAYan2E~EOnhhh7teG0iK9MQI3h6 z&U3EcqSg;&8+laD^k1tlIgKv&e&Eee{A&`7&cA&-6hI@AIKqbZ6HI=_+9u9no%_*A zv-db`*VXPx5J)>7*)VSN%`lrh^8TWW5Km-DtDNoN!z_5m-QybZdphwjo=#d~&CAbJ ztUfFIx>_jR{nn9UPgXVAVA=9KS(|x`RPr!vne=2F#g+MjWrt^XGQx zDgfrdY$cB53CRqCbFAzqrP;dFe}1%i|L3GIqV?Q>U&ck-5oJ_5 zew}9Y?Cb$AU*1!hNs@QVyB@I^LlUi&6ws1Ay88rMp|Br}f@prX>-zl^e;c2nn0Z&i zj$i1Ak5Cy;^X}}<%167_0Ti6ZQNA)9?nMMxOphx9;)&||`UwR$9Ni|;*RP+wc<~qx zO`w+Zra3)r&yX5;C|jwn#!?Co~uP+yyjDPF;{@zV)z&H7cQVd$O|y217yS zU8RbBsjLEuWRzZCuHL+P5nyRQeCrXeJQ00aLT0*sF#`oo6gM(-+z7A-bo9)ZC()uZ zZhD(Ao`g|Afp@ny0&kKfJdHxFC_O*2Y`ZeU!M>{sW1b{3+DT8JzLjQ<-7MJ{ZQ0$N z9bVOb`iNA}fs31KLf_%iI@jX*8Xbhx^v9mP#C{jDJ60@4G7?q^FI#)=fw3_KP>VJb zARwg)4^&T=xQbNb@&L`Py$gm1Vld8&ESuphE)_Yz?sZi)0NgX$&;l|v^wNyr2pb#7PL~oN$axMW{rZD@L=OKa;%UICqI$Be*LQAJ-C6^ z&JLC}ebAOdU$*s^w|o*yGaIk#(jnxA)y)ZhGfPW`l}|@0uVk&zuMF3RQwl5@kdO?_ zmpKOm(w5M0-QyLBY;Z6{;Y8-0FAQiO!2Yxm0;Rpctd;4ezIer)1GLVj$)kiV3#4`B zZ(cm_jY0GlQ4tWktqa4isSg`Qi!Mqd{YXjgO&rRv7ch3&A`y%eB5*$-f_?F>c$x-I zv&UJ~*oP~h>0<>wqjB%hlvxgUjo3`JI%N?m7&%%ph>iu9;Wt^d9#fQN7G1pjj*@i@ zpeFuk+{6X=#9CZQzoaTYJ)GZ zfNOl}{{7@b)PjWMisT^%CO~3;icF&aTZ9sd4bm5{_-1p8WSl;I*34tEQFlP}t;A)w z>F+x-**IPQp#pEid3!VBf{w>__45hYO%la`aa1M_b*(0D9+zxG#@ z{m3?=DP0>sNQ8Ahu@NB}s$T508oQX_UV`x|N{MpJ znUvI2RD|nHMkoMrM^y1%nrfu%ldqA#sBYNUkYEphH_nDi@JoF?dd=b1Gk0bODL^b1 zPi=!Iu0A?)(k^YDt+ zDzpoNE}DcU<}=VB?94h97nf6D8pG-AIts{d1W$S3HaFkPx{+Qs?Y)MYZw16Yn4VKQ z()z9xY|+a($)e)Rt)Gk@jiF&NQ<5(OM3#zeBeJ;dI+dINFBQ=a$&IZ`BJoY{Abl#| zo}8Dh3OKc0lYBdq1PQR>df@iTAS-@F_JoN6T^h?WAr!Qy!0Dr{=R!d^lcaHe=NFM6 z97^cjoP*8Lih^+2zhKdB#me0M|AU$I|04lK-%ZvLdV^CuRP(_e-Gy<58Uy zeQG1==l&vefxVjktTn}=?@{U|2*ACfqGA`A7mHUepYk^m;o!(18DzgL{i|p5`*e{K zpU7nZKR9Gwt_w|#2%cXVwbiuoP*zp~e*(L9*IX_MM2G8ICl)ud0anld)SR9f@N2xJ zS00HW$Qv6a_NP$a+C@7Xeq8I<(L2F$Iy8MALDbTei@QS&7l#EdNL{O8{GaCII$>=N1yWu zixygk=hE7Fn%|+kaM|lGUDtq5rgPUZJdl|tse`rOn>ke6&3teA(4Si94FQl{ zo3JFIp$U|vJx-?l=-|okvvn*Ssk6Blx%=V;G5lg)Uy%LzBSUvuV4T5wUg^#qqPRHn zdZEVNbZ7CikCVj3u3bZ??p9RCm|aTI!lnxKgOC1ep%%C{Q`>ysc5g`>q@|4nkLkd_nwOM_D+nih=1!z)eKMxR z8OL(B46fqyzf1>P^}Y6qRDhP~yxfzwBY%7A1a!B)sA#^&h`82lzO!=wRpNRQA&Plf z&^2%5_?I#-n`sj&KC5HsGZBzR82T_@zGMWUYN?wP^vP98G3;zvR}^D}k7nPka#79b z{Y)FUz{0r&)Wv#Zg%fy$xXJh;IrwO2&^dd1zs1#0YyMBXTPKbWdr@%_5fQ_N!cys% zO~!C~qQn$xNZF-BnmD6rN+jB7NqKR^E^f-OU6_Jfm99#-LkJBEi={Wnh zrHX(gQN?ZiyHIHmx*4!XX=TIG-T^inpM~~Y_RgJS`ZZfL2(yt8g3e79wX_ON$o9TW zVdQ21Q()G47v%*SgNJVhMl=}qx>}xq9jV^Wv@2+g+t(kaoMS~nLdacicKkJ_+O~$z;X&L>NyDl3$%&K5ErjY%*MD zKVE$gpLh$UaT21zu%$_ks`FwSuNKb}%@UWA!X0Xho%A3ZVpEA&1xqgX0cOAgBmg#W~SRbqK(&h z69{vEmb%(twIXpW3RG+LtdZ(vwK%a}di_0-x`(L+l_M_pvjIW!@(Lwq`N<4Y)%%@{ z;O^F))HPE>tFbj70VfHqe2L(jaGN@8usYY~+hklgRs@fS_$-&jy&z?~lBcV>$~s_r zw0fP;@{svi)sA*z_pPlR5Qa?np3YFqc*F(FFI*o;eI4>9Jd)X2MSh3Lw?s18hRaMi z5t){@9zA+gmt~OJc6bAn{EvlSG_9;YW*Ilx3|F13VS0F%XLMBzFS&J8r_e5;8JanJ z(vR??Rzw9(b`@^F2`=V7N1{T3!oD1@-xK+jO}kKr0ITc(gnC|^N4sb?s_&JQ%={|+ z`k67$OwldxMx;ZXFZo1OGv9!t5wB+mU9G|3#dOtrWHGC=HO1^%K>tWjo=o~#4L8%j z&1oK^QO~frlRNUu2*|?7e$*9vibhg-7d=W2{bQ=RkQv`L!$h zOJn2FhagAd=l2)rujm2ThF-t$QaQapWS z&ad$C2GTvNtqpbimNcq9U0_73GZo9yvh|wBY{!}_vy{mwOLQ6&Z#W-Rr@wFk zt$EQLi7o&xiE_^H1r2x$U&!g9Jf8fqqIQ#(denDBK#mQopC^MrsgmPiX2uG}EjiI><2EMJO@M5o#5oq) zW>Fvfpx}=EAJjI#zXnwh0Z4fTPAC!sU$@Z@&hPAEaJ6svtmU-N&KFHP3=R)(CFRl| zf65tM#whr~d(@wbX?SQTwr%7}VR$$%jT^VFHc3yv)%#HkZ%_7M)OuEpLOH9O%Pmlq z(k}e%@&O&ON{5tMC;RL8XXKge_c;VVqt(-&m0};gUuOhUK8bT-g@G}^x)`-%$p=$& zyo>(4zJQzYk~i43@_*a(5DG3Gq2iCjT92ieYu;$0>$P}>(B}chGdq@4&-CN6Plc$l zu>`6^m7z`V$B#+K+g`#sf>xT?_wBKhCuOf*J?s0HO#ObBVRniq<%tuLW@!`bk>0%X z%zt}igGUt7`+mkQI?@ciCWH?rCOJ&7Be9Lso`(PV@n`l>y z+XX$Yn`=3Erq|56^A&q;%EmLf(}WSqjJRtxcdN4R6xjGnzP+=n4A908kVC^if`+73 z;-cafmaNpbXD&A`3TAZ3afUWlMc!)_WYyb)Y{srBNf!QO?$?!%ZtF(~Fd)%^1JCgC zJu#x0qa_C<<;jlB^bYg*Yhq%pZeqT!d3b{o4p!V03kL4X9+D4S7yeXXaX}%0UM48l zWuO>Zg0bg2Ii;>O45COVMr)grJL|&fQg;46}Z`~L@O?k!U<(h}F zF(V9pn7GAna{)Vf7(|=l5xy{)O$%OVf%$al-6~%wJaCrPe(@5SZBY=hnj5kv6k+Wj zdg{ZN>f&6Ll3G%G%!t5#V`{Zgg+D4t;g4P1(b*z&0(08hKkCt;ThS`EnOPH^f8Q^i zPWK2gv1Bk^+Rurio4LlbXX!&k)3rjwj4VgydE?Q&dipe9>SeBHSJwboEeuFo3~K_m zo065fHUdv+i-<2QEveQh;`siSZ=LZGNIzgeLX^g!a(CHfZi?qlE;`%4r=ei^jfv(e zMrSDfB`+V=NSFWHrAp=-+u(EB%6d4>=L@@*XYS;Ice8KG7qu z!(K#JU0rQ6P-*QjwGp7Ed!`0>!L7up>K(fXOs#$Kj3i7<(vy8<;k6-ssuf^H!RMi& z*!f^>T^0xy4VXOm&H*#U48ac2e*6Fn1Ul)T8xfC5EK65kYkYQbUC)2_1pWt*~wy+G?o``O%A(rI?fs4FxS#?ryy2Ivf}1f1yt)wR&X5S zqkpd~$O|zXnmwxTXW5`h8jY^W{?r4zJ;S&->_oLAC2gP*pp?_Y4rvN*je42E@ zievio*;$$EY;Hm1d#d8j)*FzLNbm4}d-kMBzVXY6Q5*7olvyEmr#r~^l+g9Zwe{;? zJjOWI^jG$rYV(Ft{B_0Huuiy1;!VL%lC1J9CvEjRLfwNa3QqpG zJahi7#F=su(;%U(-D4t^`ZK)e?^}4B{O6UP%_mJi?emc^7jL}V^^92*sI)S zt;wDSyb%#r`cZEEmAEE~^6Y(eC4=38d+j-LtQ?7`NJ~d%S>~JW8D{4?&kFkQ2lN?e6L%=}rNv})&O z)>Zj>F3|aHj1o^!Y4AHpln;EGE28zQe9u8~>esSDl>qlAj%SLxR{U%sb|L<;J?U1r z=bPF7*-l%JhN|z8W{vH*x69bf|VEJ>x zo<&kltVee0r0h}mC~Z4SK5OJ{=i~1#eB=G}acj+H?LJyh_ud(*k%jw#gX2^=oQRF=g=`$X(Dt^nAJ*=;s&jINb{h zKI{`J0CVs;&+#4ci3*~Pq2=da<2d=Isi_HiH;JIO7*+vf1OuDPMg+ZSZSAVs0R?4c zG6g|SBEPEhG6G+E6nVZ9bDeTxC1V!x^||F(F5J8c-?&A*gC`U$eBv zb1rB*rcS>*8|~@ZX~v`2d|>Ls&wz$!y5Tq9$Wtc2sWbDZ)3@&!8}EE^HEP-XhDYr8 z$Pd(qYcq!jx;V)?RZE2~fG3;WU`TuZyr*J(^dLr$B^otS@7}!|de>EGnP1QyfHrw7 ziKfZK9>oF$F#`1;&+o^?q6xpPtu0ss!0Zpg@1?=83gxEPm*2OD5|fgGqM~H4 zJ`_Q^jN^Q8aL|iR8lG)XK>gDu@m!xs8vZt{MS7^p#v9myoUW8)3KCzykaK{`G&$h-AqJy)}}PCqcUOfqDaV zBs4T_TaY?~dQN)gj8{_9J{=vMaWT(5_d!p^@-Hqf1|yvI>{$%q1HexVs06ShR7+#Q z!jTO!CMKs&`R|2zu`2jkU|^t0lBTmIcH8RmVLB$JXLIjjdxQSN1yH}Cc$U$!U-3uY zA@R(x#+9dU%D6;5FZtwo@%IE7QBbr#OBy_JGd_W4?z{1)#G?EvsDK(UXJ!9Y_&2`? zVJxKfF-XZklXZ1PKxO}$sb7KK+3m6dex4fkgic;@e4J!UtvIvR<|JSqosP&5aC z4ABIl-033%$kiErk*jiqyn6Mt$ASS0Lv@FNzkeIh-339k>Tc~2fd5wwkc~LIrGu&s zM%ZrfHt-JA)gz!I0ITVp!?oHhxx07Iv#6$tg`EMo~ z6B0@^s$NZ+wcme=2LgwPdV)?3nm;j!BY^M#;6{;wpP_hofK-Qpg(X$4QR|dT3ALl6 zV|P!_?99wrMn=LoAh;3{e~uMZAP8((>mjbpgrx0_{JzXg_*R5qJLP&caSA z`dnSn@hd;Ixb2G-Cx->T#CCgwoZcKSbrkgVU5Njx6NNKxKr}-fOoB$N<1Y^c9ar4e z$e=?TfQ9MMqkS4P@RWfMz7(3(*R`}x`@V$~WB<{kMp)|MkbyU7kt zkB1_b$0k>1NeQMS>rT*YyzTLETFE)s(mNN{6@7SluVcIvTG z!PD7?YV#~}3f`EUe(U?7Z;`x#pFVM4W`oc{J>O~vfsbq2J_TU{1Sa3MHeD&XhA2^! ze#FOvw5+1B;o<5?&0wVc+j(Q%HK1@^xH)R7`@jyl{XXUUSqJF)$-eYc+#ED42^;h- zpZcEv^?lLB)bptyKYZB5cl{e*fAz7Ow$@XJ_6~LQ)1Q0v&em>CIJGDxdNj{N*)d3- ze@wo)M|`tbH)EtKRY^fbNI^v;W=%*f%Du38?2}+)JI&Ti@!Hy&-PY`*I@t&}1E+!5h@Sji-a&?FOeAPaS1YDR{F-^m!XGz`bGi_gd^p&CMiLg9obaaymyRWjE@unx?atZDi!YaJPI@Waal}A$(=w;+PIpS<&7; zWD%wey3fSL%+1Z$+A_jS!J*?{Y*kXx(t3OLYjSb1+)oYot$MV#m${cKqkShF9Kg+%SxE-fX zvuWkuhUddOUteFlL4RJxpzD7MCrT4B%l3oSilci=WISwU7nhdC59+QguMKmAkNL6) zr%F*fgPbbCKV58VklyxI;$RLWMr}WTj@!m)zP)U!np#$-8!-4MJElZTP0PA~y=aoe zZIH@?qHW@5Q&Suq{*^k-hrU5_vG z63O0M%}uvySotlaa{LV$Y~1Y@n53JbcTv&SPQT5XI6iLD(*PiBgqD1G>P4?jrxs9o*OJ` zTN(s<$_Z9J9fs%?#WSvxQlH$`9q??fN63}27tgc=zbl&FlEOS!mQ(&ISy{Kx6nS|* z=sj1&^YcMZ&j)S%sh$^(e`T6Oj!7qI)BP&bp zS9MQri%msQkxBo#hK7dS_U3YOL4kBmP7eQ6{-7OnV|5y-zkdDla_X^3NsUZ{gSKYv zy_A`L495Et?HZPuSP_$^W&DyUjfS32@aGZR>&wUa2CTK!%+1qZ11s0-+UU*dOv8Vk zXMaHRMkgI1r`vyZr~dQj)?`l}VV)jwWIV2Dc)j<<4dvDN$S0)~LPA2&&ED(3Y(Me*%0I#$5*Bu%AyLNkSXlhV<`(G(Io*9XxAHJMQDF@1=)wN)~8cq)YRn%@*?D zb-GyoThZvojT?m%9|UrMJL`=)FJx$LIfEb(c}=ppbb12kz@5L3X??AqcT?A%IZtKW*{VL;_-ypUAtyL$Fs@Q*!&pWD@w|nLWrT!3~MSl%NJT@&H zn@=7w4X7fyHWG(j(9qD}-BkU%g67Y~0b_1-!&L7>9PL|mcm28Y979~9Jq)wPF${t- zYt`)2yx^&ll9ILhGA%}Fmp^en!-dhmerfnrx;Gl=J#T`FP{&Dl-J`qTqpznYefq&@ zmqwvo@`wC^?72Sf&$RE~V|^qhW@fF6?YbP&DQRiS z1_lYIYnq0`b>l$hz8NrR+?Im3njl*ii+^d5t&YWee`{k9opqiM52+je&b`{vww9K3JO1>oE%(I*JJZ_W#_Yt3 zAoA#^@iRFV5u95(k*_AkhI7^E?@{YmxJvj+-qW!RpRI8a#xo7NE)Ib22{xzvW}B{? z_pvQZRD-13Al9!N*m@zrS*R zWf}OnFJ;G!!8=HeE26d2C?+2KCg%M%zY6Um1sho=M=1n@S%R)lk<#=n=ioHyv8g}$ z$*P}WajrhY7^40;H(j`2G@&ECILzTeIDkIF_to*{zC)9ZZ>~s`+HPo(h*q$y6O`%vXWva}f%{U|$r-~x&Fb>=pBWQdC z%ekttq_-t8X=?3fUTMPHw|Ar5*Tyg^nsH;@nEd3)2^@t8ctP+Q83v;|C&q42o1u4bR6-W~bYn*B2O|47WU+ zo|e|CqNYulYBDyxy=7?LF|&Sd+r9h%!~K>-|6Ky_;&G<|?(>l~iy<)^`BssKsiNBl zs*I8o6D9xt{hRWhQO(|dQ8g49;ZhUj<{hXNIp%Ynn*P94)WQ1_2Yh>MfMtBV; zb(~7AiZHBHZsKRU5>kB=Q&anIoHgT_HL6esxDw|PhWUPSn(a*a@O|1A7Njj|rE@Bn zI~An?K9@y)e`MicfWQ)E4y?ugpsmr0C%@Pdvn8$|nCbqttPfLp*1kKIrWY2j2_;fG zM=y_p0@((aO@SdtG-lfSw*K-Wi6UmO{Mp)ST>V^~@UdZR>k|FBIOt#EG&`@NsygMk zS~KWX-$q40b3ukar0{Pp%@{_tw%_3Gc^7F>C>?CK)M+#Us|1e8Jj#ZN6M;23Hp3bA zn~U4(c|A+lgy0Pj{0{!lYRi4wvDEG>qCXw@Jj(}D7V`v@=PLqFFS%1UX4+J27;e5N zZ5m%vYkhfNP34_kceIC6qIRl)&d=hvlqMQQN;)=Xd6ci$)|duu#`AJiwY9a8>9k;e zxr!REI_AbkV-Ob(1C_&9+AkcsmXn(+!}S{Cyj%-6kKZ3B=gQq5;!N2i`mwRj63&h` z+G>cuI9p82x)bW^QqILcDJ>Pg%*%Vf`Q7XCfU(|Qot(Tp)A82(8 z!xO=b+*}@YmK#z064S-=0Wh7btE+o58Te;xOi@!a629%j&d~$2EACPUdU|@WM4LHl zPRE1kml~&6L>MbwHE4}5J{)1eJump?$&B`j>@T)j%L!(>O?JudZplk(px$AQ}?H$?WSfTCCkw!wNS zuII?O{lxhAEd_-@&?6Htg;Mv!1S8Us^mG-hP9H)33ZKy==AV>2+oFFdTjEVyR~a~U z3j&^}lnLqfOSIXz9NoGT`(^sKbsE{PoATe8_xl%SmGCohY94*#w4N`tEUQ~6&+%*d z|Eumiqng^XI38pal?NG~cu0@7QM63Pob3P|WmQvrnlQi4(v9ws3a z14xx90a1Yff^>)!=@5h<9i_~5=DoFiI?h@%Yv#k;Pxr%F`~1(|=brn!=k9Y(+Ld<& z)681Qx&hJde&3;na`#BTn(SN0BXrVcLO#P)uLw!8YpW(Id@x@780_sVzy)@B4}KrG zH8Vw7WU;<_dqc6Sh3S+|(>eBBm#()GlHVHY8_vB!ZCa*Y2yR?pO0tV1EqA-LRgHFH zmE=ovhoW8<@Wm|eljONl+gT3zC1?33VaIdp*7@PYd136*cEsD~p549c_uN<5LTlO| zQe!5lfgL#&v;4AIsNeXazKyN;OF{9XZx&3;!8JV5i4OkO9&C(=T z&3+8g_~DCy$m^eP_zCZ?Rh^5qb1~q)RuY3C*3(3FG&ghmb#8N2%hP$WTPj<-3C*oC; zJK-Y4JFOa>S}rqLAha>*ygfQD(CdnzXC2{&V*RwB zCeBw)DM5uYF~=WO6!( z8N3{90IJ_aX+Xm>O0fNV7sa`a%$M0#(y)`QbL}+RfEhXzZ7=OgmR60jw+WGNIYz_a z5eQd~+ZS?1Hxa;=t4zjb&l#CBI8p{pO?)^%^p@7O#lhS)Y{?u3XJlSxS&nSwMLxOg zxD{i&TWJ=4$=@ETc83jgDs*x};8GES5msq+P1Ft_w~{CIX;89D(3OLXd2{Gy@2tbn z*}9r*OB@F{grmzi$dhd59;_j`7;TfLf&8IT`(fvj#l;)O*J=m1J;NIF+fY`vACTc& zhS5Tlv=Co>AlcKDpi!u2b+sX#74Y3XksTfQ>-iK$IMqzpWHGJMyz?F=uHCprX2V4c zvT^H<`PdDM1Il>8ET(?@^j;I!P~)K$>$1ccSgN>DRg2@Id?^Q=)wO!nYhw?IahYm_ zzxLwc(b@x=qE!J3@q5I|FE}!gH&Siu3OQ7})LaT7K?J?0>PB>M$=1tbI5uc7=sm;@ zoqX?Ugwjf@*)XTnwhCNQ*?Qw+oFiV6EL>}aO zYA(B1r-04hO|od0-x5<$Sk+P~??v$ia1ZhM02?BmQ3Q#OuuYb!nxCk9RLHH_8=LL0 z3Ec?|%&V+fsE0d?a)X?-KX&e`k7Zz}vOhQE494JLx6=Z<-SxAVgEcs!Mz+fK9q+ax4WyAz7OOy z-hex0`Wx@H zq}O6{WzQIShPU+x1y&Wl3V>=}>$8pSlVX5JX3D8&Em5+T(eo12oS8b!RE!V0FwAGb z^|;MeWBw3oiuqC4_E1K)y}lx~XpCxyyb%GD>o<#@S)Se}CgSvT_GXY@^amQ0hLeY` zr`42^+N^@NIcxnbYujaw^Z%NfiVAx@ zP?^Eb;uU44IlKqc`PO7Jw^F`KD`)#N+2!RJqO#6Y?Y3!zh4rKORtrCeAp#{|f#JEq ztEkIe9bm9fODQbVN%CLi6kJ=4g^3#I5-ly2y^$%`4V?w;*8}l!n)>pYBG=b~dWoTX z1CjtFz+4ZAbw4okZ0ldJkXltfB$LTIIB%lHpKk!`TOQdr#uDQyP77G;kbz6Btz^ae z^)a&E*{)6$SWyB)iMs|tIg4Hkrk%h^S3q>_luVQ7B@o1Lq}5bSoXT`$l=|CqbB4wV zHKr}mWf|F3LU>9P=FWp2KWMb&q{{k)!3BZCZDd{jZ2Ra$!US*n z3sy2V+V!mu*_+;(*QQ^-+A7(r=HA-=0&1$3)!jcYRr#CwB6?B;ff~U=P^IgHt>%*JxR#m`4cS*@7XNh8}#^(e{Xws`4o(bXz?A zySYx!3G6&Bfb5|H6N(GZ^qsHp&p)3gTWB~}guFy(SxFet5<>cwWU^W=@R~7W9m2??A9BNAgC@!EIjZDjgPiU;39mFXNsE=!$~# zq|2iiKUKJe6#?mG5Hq5}UnryCpPH(uTRGC)&G~>!x}a}`%aeXnB0(M&>K#O)I+#7S z3#y#!T2A9ln5_cV*L0Yab#ooba?9vWcO^we@_vi8jA7zu;V2f-Q(tBn!NYf8nz>d% zhYJ<>J#IMaj*^RdR+kC8^X-9{;6yN@cVMJwz9lt9u5cA>6_V)kShhrOuA8Xux^d;B zEfk-bS6ZgDwKwoq3d!w9cYX!Nv#C>vBj{a=fP(fj28_NuW6Xz{!hOXvUMWm3^H&y? z%z^IGrIy(TY8p~ z3n%8If^OZ_xh`OGgYcFinyH5IZ47j5a~bU>jl5Gm z%Yg#Y>IlvjLWvTui^Xb+MKtnuZ#(8G(9_yI=Iq{8J|-Fjux4c)ZS)AUPD+1XWz5sjBs+V6H-1{a@bWUxJ>R}v(MSu=)RZ!)s8 z4+%jP7xctZM45|k`SYw988Lx2_y!sQl76vGba-Dp)bhFY)9ffDCF}zh9y&IeAvOPg zMLh9L9yOdp^setKkBH+n_xcyY60YP`p)WNI#W z3KfoQKs6K6>Kf`7ul{zyyg_a&Qc$7Llbdk9!mH&#oSHd?xez4Sb4hokqVGOUa!LTh z#q)gktfhsLWt-dUhWIAGzjQ(h5!f?6ZQ{c z`W}dWZ0#E$`l`CG(Cc?%`X0Uhmu&VgrF?<6AE24@kv}2ce`w~1P5$1we+c=ira$xQ zzvKOX0=_?#@?-D+SET%b&i}6+f#vU*|9z)jxy6_Qfml@abuL=|ccS^dhko2Y|I=vR z=B5G1ZMc%BVsjw7K*}U^3(`=EKH2(fJq}jlKn6}`iQgafvI^L*9Z1f **Compliance policies** -> click on **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-policy.png) + > ![Create Policy](images/ios-jb-policy.png) 1. Specify a name of the policy, example "Compliance Policy for Jailbreak". 1. In the compliance settings page, click to expand **Device Health** section and click **Block** for **Jailbroken devices** field. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-settings.png) + > ![Policy Settings](images/ios-jb-settings.png) 1. In the *Action for noncompliance* section, select the actions as per your requirements and click **Next**. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-actions.png) + > ![Policy Actions](images/ios-jb-actions.png) 1. In the *Assignments* section, select the user groups that you want to include for this policy and then click **Next**. 1. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**. @@ -62,9 +62,25 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i > [!NOTE] > Defender for Endpoint for iOS supports creating custom indicators only for IP addresses and URLs/domains. -## Web Protection +## Web Protection and VPN -By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. +By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a local VPN in order to provide this protection. + +While enabled by default, there might be some cases that requires you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below. + +1. On your iOS device, open the **Settings** app and then click on **VPN**. +1. Click on the "i" button for Microsoft Defender ATP. +1. Toggle-off **Connect On Demand** to disable VPN. + + > [!div class="mx-imgBorder"] + > ![VPN config connect on demand](images/ios-vpn-config.png) + +> [!NOTE] +> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open Microsoft Defender for Endpoint app on the device and click on **Start VPN**. + +### Co-existence of multiple VPN profiles + +Apple iOS does not support multiple device-wide VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time. ## Report unsafe site From 03679ef55061c9adef8c35fd7bfe1515eaaf805e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:24:30 -0800 Subject: [PATCH 3/7] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index cbca86da05..bbb45a75c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -66,7 +66,7 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a local VPN in order to provide this protection. -While enabled by default, there might be some cases that requires you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below. +While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: 1. On your iOS device, open the **Settings** app and then click on **VPN**. 1. Click on the "i" button for Microsoft Defender ATP. From a9192908d3390ac7a6e62a8a5ef6a424b846c497 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:24:39 -0800 Subject: [PATCH 4/7] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index bbb45a75c7..7200eb8d20 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -76,7 +76,7 @@ While enabled by default, there might be some cases that require you to disable > ![VPN config connect on demand](images/ios-vpn-config.png) > [!NOTE] -> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open Microsoft Defender for Endpoint app on the device and click on **Start VPN**. +> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open the Microsoft Defender for Endpoint app on the device and click or tap **Start VPN**. ### Co-existence of multiple VPN profiles From dc9c61f71ffe4b3a7ab935226a4a20c4c6904b1e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:25:11 -0800 Subject: [PATCH 5/7] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index 7200eb8d20..a5e183572d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -68,9 +68,9 @@ By default, Defender for Endpoint for iOS includes and enables the web protectio While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: -1. On your iOS device, open the **Settings** app and then click on **VPN**. -1. Click on the "i" button for Microsoft Defender ATP. -1. Toggle-off **Connect On Demand** to disable VPN. +1. On your iOS device, open the **Settings** app and click or tap **VPN**. +1. Click or tap the "i" button for Microsoft Defender ATP. +1. Toggle off **Connect On Demand** to disable VPN. > [!div class="mx-imgBorder"] > ![VPN config connect on demand](images/ios-vpn-config.png) From b6eefa3718a41eb4dcebc2289ab70d5bcdd413bb Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Wed, 9 Dec 2020 18:43:49 +0100 Subject: [PATCH 6/7] Update customize-exploit-protection.md - MarkDown table restoration (the table is broken on GitHub due to non-standard table divider indicators) - Whitespace formatting corrections (end-of-line blank space removal, redundant leading whitespace removal) Ref. #8765 (md_cleanup / follow-up) --- .../customize-exploit-protection.md | 168 +++++++++--------- 1 file changed, 84 insertions(+), 84 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index b75194d814..964158b256 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.reviewer: +ms.reviewer: manager: dansimp --- @@ -46,44 +46,44 @@ The **Use default** configuration for each of the mitigation settings indicates For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this article. -Mitigation | Description | Can be applied to | Audit mode available --|-|-|- -Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +| Mitigation | Description | Can be applied to | Audit mode available | +| ---------- | ----------- | ----------------- | -------------------- | +| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | > [!IMPORTANT] > If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: > > -> Enabled in **Program settings** | Enabled in **System settings** | Behavior -> -|-|- -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option +> | Enabled in **Program settings** | Enabled in **System settings** | Behavior | +> | ------------------------------- | ------------------------------ | -------- | +> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** | +> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** | +> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** | +> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option | > > > -> * **Example 1** +> * **Example 1** > > Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. > @@ -116,10 +116,10 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir * **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section * **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation - >[!NOTE] - >You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. + > [!NOTE] + > You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. - Changing some settings may require a restart. + Changing some settings may require a restart. 4. Repeat this for all the system-level mitigations you want to configure. @@ -127,8 +127,8 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir 1. If the app you want to configure is already listed, select it and then select **Edit** 2. If the app isn't listed, at the top of the list select **Add program to customize** and then choose how you want to add the app: - * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. 6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, select the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. @@ -140,14 +140,14 @@ Exporting the configuration as an XML file allows you to copy the configuration ## PowerShell reference - You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. +You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. - The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. +The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. - >[!IMPORTANT] - >Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden. +> [!IMPORTANT] +> Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden. - You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: +You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: ```PowerShell Get-ProcessMitigation -Name processName.exe @@ -164,7 +164,7 @@ Get-ProcessMitigation -Name processName.exe Use `Set` to configure each mitigation in the following format: - ```PowerShell +```PowerShell Set-ProcessMitigation - - ,, ``` @@ -179,34 +179,34 @@ Where: * \: * The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. - For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: +For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: - ```PowerShell - Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation - ``` +```PowerShell +Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation +``` - > [!IMPORTANT] - > Separate each mitigation option with commas. +> [!IMPORTANT] +> Separate each mitigation option with commas. - If you wanted to apply DEP at the system level, you'd use the following command: +If you wanted to apply DEP at the system level, you'd use the following command: - ```PowerShell - Set-Processmitigation -System -Enable DEP - ``` +```PowerShell +Set-Processmitigation -System -Enable DEP +``` - To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. +To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. - If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: +If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: - ```PowerShell - Set-Processmitigation -Name test.exe -Remove -Disable DEP - ``` +```PowerShell +Set-Processmitigation -Name test.exe -Remove -Disable DEP +``` - You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. +You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. - For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command: +For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command: - ```PowerShell +```PowerShell Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode ``` @@ -218,29 +218,29 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that -Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet -- | - | - | - -Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available -Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available -Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available -Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available -Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available -Validate heap integrity | System and app-level | TerminateOnError | Audit not available -Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -Block remote images | App-level only | BlockRemoteImages | Audit not available -Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned -Disable extension points | App-level only | ExtensionPoint | Audit not available -Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall -Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] -Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] -Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] -Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] -Validate handle usage | App-level only | StrictHandle | Audit not available -Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available -Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] +| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | +| ---------- | ---------- | ------------------ | ----------------- | +| Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | +| Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | +| Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | +| Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available | +| Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available | +| Validate heap integrity | System and app-level | TerminateOnError | Audit not available | +| Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode | +| Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad | +| Block remote images | App-level only | BlockRemoteImages | Audit not available | +| Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly | +| Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned | +| Disable extension points | App-level only | ExtensionPoint | Audit not available | +| Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall | +| Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess | +| Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] | +| Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] | +| Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] | +| Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] | +| Validate handle usage | App-level only | StrictHandle | Audit not available | +| Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available | +| Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] | \[1\]: Use the following format to enable EAF modules for dlls for a process: @@ -254,7 +254,7 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center). -## See also +## See also: * [Protect devices from exploits](exploit-protection.md) * [Evaluate exploit protection](evaluate-exploit-protection.md) From 95910d97fd5ba84010b5cf2bd85877d62ec0cdfe Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 10:09:00 -0800 Subject: [PATCH 7/7] Update ts-bitlocker-cannot-encrypt-tpm-issues.md --- .../bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index 121d7cd8a1..8e005347db 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -116,9 +116,9 @@ The domain and forest functional level of the environment may still be set to Wi To resolve this issue, follow these steps: 1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. -1. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). -1. In the script, modify the value of **strPathToDomain** to your domain name. -1. Open an elevated PowerShell window, and run the following command: +2. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). +3. In the script, modify the value of **strPathToDomain** to your domain name. +4. Open an elevated PowerShell window, and run the following command: ```powershell cscript Add-TPMSelfWriteACE.vbs