From 1ef74488deea46e35c6c592c37405e7422377911 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 29 Jul 2016 15:54:21 +1000 Subject: [PATCH] from rs1 --- windows/keep-secure/TOC.md | 33 +- ...ices-to-the-membership-group-for-a-zone.md | 2 +- ...ices-to-the-membership-group-for-a-zone.md | 2 +- ...ows-defender-advanced-threat-protection.md | 10 +- ...e-files-for-settings-used-in-this-guide.md | 2 +- ...ows-defender-advanced-threat-protection.md | 7 +- ...ssign-security-group-filters-to-the-gpo.md | 2 +- .../basic-firewall-policy-design.md | 2 +- windows/keep-secure/boundary-zone-gpos.md | 2 +- windows/keep-secure/boundary-zone.md | 4 +- ...e-based-isolation-policy-design-example.md | 2 +- ...rtificate-based-isolation-policy-design.md | 2 +- ...ange-history-for-keep-windows-10-secure.md | 7 + ...ange-rules-from-request-to-require-mode.md | 2 +- ...ist-configuring-basic-firewall-settings.md | 2 +- ...uring-rules-for-an-isolated-server-zone.md | 2 +- ...rs-in-a-standalone-isolated-server-zone.md | 2 +- ...configuring-rules-for-the-boundary-zone.md | 2 +- ...nfiguring-rules-for-the-encryption-zone.md | 2 +- ...nfiguring-rules-for-the-isolated-domain.md | 2 +- ...checklist-creating-group-policy-objects.md | 2 +- ...ecklist-creating-inbound-firewall-rules.md | 2 +- ...cklist-creating-outbound-firewall-rules.md | 2 +- ...ts-of-a-standalone-isolated-server-zone.md | 2 +- ...ementing-a-basic-firewall-policy-design.md | 4 +- ...rtificate-based-isolation-policy-design.md | 2 +- ...enting-a-domain-isolation-policy-design.md | 2 +- ...andalone-server-isolation-policy-design.md | 2 +- .../configure-authentication-methods.md | 2 +- ...ure-data-protection-quick-mode-settings.md | 2 +- ...ows-defender-advanced-threat-protection.md | 25 +- ...ows-defender-advanced-threat-protection.md | 13 +- ...ows-defender-advanced-threat-protection.md | 82 +-- ...ows-defender-advanced-threat-protection.md | 52 +- ...ows-defender-advanced-threat-protection.md | 8 +- ...y-to-autoenroll-and-deploy-certificates.md | 2 +- ...nfigure-key-exchange-main-mode-settings.md | 2 +- ...ows-defender-advanced-threat-protection.md | 100 ++-- .../configure-the-windows-firewall-log.md | 2 +- ...ion-authentication-certificate-template.md | 2 +- ...notifications-when-a-program-is-blocked.md | 2 +- ...hat-certificates-are-deployed-correctly.md | 2 +- .../copy-a-gpo-to-create-a-new-gpo.md | 4 +- ...ate-a-group-account-in-active-directory.md | 2 +- .../create-a-group-policy-object.md | 2 +- ...e-an-authentication-exemption-list-rule.md | 2 +- .../create-an-authentication-request-rule.md | 2 +- .../create-an-inbound-icmp-rule.md | 2 +- .../create-an-inbound-port-rule.md | 2 +- ...eate-an-inbound-program-or-service-rule.md | 2 +- .../create-an-outbound-port-rule.md | 2 +- ...ate-an-outbound-program-or-service-rule.md | 2 +- .../create-inbound-rules-to-support-rpc.md | 2 +- .../create-wmi-filters-for-the-gpo.md | 2 +- ...g-a-device-guard-policy-for-signed-apps.md | 2 +- windows/keep-secure/credential-guard.md | 27 +- ...ows-defender-advanced-threat-protection.md | 15 +- ...ows-defender-advanced-threat-protection.md | 24 +- ...rd-enable-virtualization-based-security.md | 58 ++- ...irewall-with-advanced-security-strategy.md | 2 +- ...ining-the-trusted-state-of-your-devices.md | 2 +- ...vice-guard-certification-and-compliance.md | 2 +- windows/keep-secure/documenting-the-zones.md | 2 +- .../domain-isolation-policy-design-example.md | 2 +- .../domain-isolation-policy-design.md | 2 +- .../enable-predefined-inbound-rules.md | 2 +- .../enable-predefined-outbound-rules.md | 2 +- windows/keep-secure/encryption-zone-gpos.md | 2 +- windows/keep-secure/encryption-zone.md | 2 +- ...-with-advanced-security-design-examples.md | 2 +- windows/keep-secure/event-4706.md | 12 +- windows/keep-secure/event-4716.md | 12 +- windows/keep-secure/event-4739.md | 16 +- ...ows-defender-advanced-threat-protection.md | 204 +++----- .../exempt-icmp-from-authentication.md | 2 +- windows/keep-secure/exemption-list.md | 2 +- windows/keep-secure/firewall-gpos.md | 2 +- .../firewall-policy-design-example.md | 6 +- ...-about-your-active-directory-deployment.md | 2 +- ...out-your-current-network-infrastructure.md | 2 +- ...athering-information-about-your-devices.md | 2 +- .../gathering-other-relevant-information.md | 2 +- .../gathering-the-information-you-need.md | 2 +- ...o-run-on-device-guard-protected-devices.md | 2 +- windows/keep-secure/gpo-domiso-boundary.md | 2 +- windows/keep-secure/gpo-domiso-firewall.md | 2 +- .../gpo-domiso-isolateddomain-clients.md | 2 +- .../gpo-domiso-isolateddomain-servers.md | 2 +- ...with-advanced-security-deployment-goals.md | 2 +- .../keep-secure/images/device-guard-gp.png | Bin 24169 -> 47736 bytes .../keep-secure/images/dg-fig1-enableos.png | Bin 17395 -> 22075 bytes .../images/dg-fig11-dgproperties.png | Bin 104994 -> 75377 bytes .../images/dg-fig7-enablevbsofkmci.png | Bin 37375 -> 48308 bytes ...microsoft-passport-in-your-organization.md | 101 ++-- ...wall-with-advanced-security-design-plan.md | 2 +- windows/keep-secure/index.md | 10 +- ...gital-certificates-on-windows-10-mobile.md | 4 + ...ows-defender-advanced-threat-protection.md | 32 +- ...ows-defender-advanced-threat-protection.md | 4 +- ...ows-defender-advanced-threat-protection.md | 18 +- ...ows-defender-advanced-threat-protection.md | 8 +- ...ows-defender-advanced-threat-protection.md | 14 +- windows/keep-secure/isolated-domain-gpos.md | 2 +- windows/keep-secure/isolated-domain.md | 2 +- .../isolating-apps-on-your-network.md | 2 +- .../keep-secure/link-the-gpo-to-the-domain.md | 2 +- ...ows-defender-advanced-threat-protection.md | 12 +- ...y-verification-using-microsoft-passport.md | 80 +-- ...-firewall-with-advanced-security-design.md | 2 +- ...microsoft-passport-and-password-changes.md | 25 +- ...oft-passport-errors-during-pin-creation.md | 22 +- .../keep-secure/microsoft-passport-guide.md | 2 +- ...ows-defender-advanced-threat-protection.md | 75 +-- ...-a-different-zone-or-version-of-windows.md | 2 +- ...ows-defender-advanced-threat-protection.md | 5 +- ...agement-console-to-ip-security-policies.md | 2 +- ...windows-firewall-with-advanced-security.md | 2 +- ...-management-console-to-windows-firewall.md | 2 +- ...windows-firewall-with-advanced-security.md | 2 +- windows/keep-secure/passport-event-300.md | 31 +- ...anning-certificate-based-authentication.md | 2 +- .../planning-domain-isolation-zones.md | 2 +- .../keep-secure/planning-gpo-deployment.md | 2 +- ...icy-deployment-for-your-isolation-zones.md | 2 +- ...planning-isolation-groups-for-the-zones.md | 2 +- .../planning-network-access-groups.md | 2 +- .../planning-server-isolation-zones.md | 2 +- ...ng-settings-for-a-basic-firewall-policy.md | 2 +- windows/keep-secure/planning-the-gpos.md | 2 +- ...windows-firewall-with-advanced-security.md | 2 +- ...-firewall-with-advanced-security-design.md | 2 +- ...ows-defender-advanced-threat-protection.md | 14 +- ...repare-people-to-use-microsoft-passport.md | 40 +- .../procedures-used-in-this-guide.md | 2 +- ...t-devices-from-unwanted-network-traffic.md | 2 +- ...n-accessing-sensitive-network-resources.md | 2 +- ...nt-planning-guidelines-for-device-guard.md | 31 +- ...cess-to-only-specified-users-or-devices.md | 2 +- ...restrict-access-to-only-trusted-devices.md | 2 +- ...erver-access-to-members-of-a-group-only.md | 2 +- ...to-end-ipsec-connections-by-using-ikev2.md | 2 +- .../security-considerations-for-applocker.md | 2 + windows/keep-secure/server-isolation-gpos.md | 2 +- .../server-isolation-policy-design-example.md | 2 +- .../server-isolation-policy-design.md | 2 +- ...ows-defender-advanced-threat-protection.md | 6 +- ...ows-defender-advanced-threat-protection.md | 474 +++++++++++------- ...ows-defender-advanced-threat-protection.md | 4 +- ...firewall-and-configure-default-behavior.md | 2 +- ...ows-defender-advanced-threat-protection.md | 6 +- ...-group-policy-and-registry-key-settings.md | 2 +- .../user-account-control-overview.md | 2 +- ...y-that-network-traffic-is-authenticated.md | 2 +- windows/keep-secure/vpn-profile-options.md | 7 +- .../why-a-pin-is-better-than-a-password.md | 30 +- .../keep-secure/windows-10-security-guide.md | 2 +- ...ows-defender-advanced-threat-protection.md | 8 +- ...-administration-with-windows-powershell.md | 2 +- ...with-advanced-security-deployment-guide.md | 2 +- ...all-with-advanced-security-design-guide.md | 2 +- ...windows-firewall-with-advanced-security.md | 2 +- 161 files changed, 998 insertions(+), 1006 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index a5080b3900..bcb8d3eac7 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,27 +1,21 @@ # [Keep Windows 10 secure](index.md) -## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) -### [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +## [Device Guard certification and compliance](device-guard-certification-and-compliance.md) +### [Get apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) +### [Create a Device Guard code integrity policy based on a reference device](creating-a-device-guard-policy-for-signed-apps.md) +## [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) +### [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) +### [Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) ### [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -### [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) -### [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) -### [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -### [Event ID 300 - Passport successfully created](passport-event-300.md) -## [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +### [Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) +### [Windows Hello and password changes](microsoft-passport-and-password-changes.md) +### [Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +### [Event ID 300 - Windows Hello successfully created](passport-event-300.md) +### [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) ## [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) ## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) -## [Device Guard deployment guide](device-guard-deployment-guide.md) -### [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) -### [Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) -### [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) -### [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) -#### [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) -#### [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) -#### [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) -#### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) -### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ## [Protect derived domain credentials with Credential Guard](credential-guard.md) +## [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) ### [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md) #### [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) @@ -31,6 +25,7 @@ #### [Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) #### [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) ### [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) +#### [Windows Information Protection (WIP) overview](wip-enterprise-overview.md) #### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Testing scenarios for Windows Information Protection (WIP)](testing-scenarios-for-wip.md) @@ -827,6 +822,8 @@ ###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) +### [Device Guard deployment guide](device-guard-deployment-guide.md) ### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) +## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) diff --git a/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md index fc07133c99..69108c1fcc 100644 --- a/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md +++ b/windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you test the GPOs for your design on a small set of devices, you can deploy them to the production devices. diff --git a/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md index f5f2edf9d6..11b782d3f8 100644 --- a/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md +++ b/windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Before you deploy your rules to large numbers of devices, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between devices. Although we recommend that you set your rules to request mode until testing and deployment is complete, we also recommend that you initially deploy the rules to a small number of devices only to be sure that the correct GPOs are being processed by each device. diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index d7856b55ac..46dddb36a1 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -14,15 +14,16 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + As a security operations team member, you can manage Windows Defender ATP alerts as part of your routine activities. Alerts will appear in queues according to their current status. To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. -> [!NOTE] -> By default, the queues are sorted from newest to oldest. +> **Note**  By default, the queues are sorted from newest to oldest. The following table and screenshot demonstrate the main areas of the **Alerts queue**. @@ -58,8 +59,7 @@ There are three mechanisms to pivot the queue against: - **30 days** - **6 months** - > [!NOTE] - > You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon ![the sort order icon looks like two arrows on top of each other](images/sort-order-icon.png) + > **Note**  You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon ![the sort order icon looks like two arrows on top of each other](images/sort-order-icon.png) ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md index f72093bb1e..f567285c1b 100644 --- a/windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ b/windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). diff --git a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md index 4714d0153b..b550a091c2 100644 --- a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -11,13 +11,16 @@ author: mjcaparas --- # Assign user access to the Windows Defender ATP portal + **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Azure Active Directory -- Office 365 + - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). User can be assigned one of the following levels of permissions: - Full access (Read and Write) - Read only access diff --git a/windows/keep-secure/assign-security-group-filters-to-the-gpo.md b/windows/keep-secure/assign-security-group-filters-to-the-gpo.md index f6dcdfddf4..d70e138887 100644 --- a/windows/keep-secure/assign-security-group-filters-to-the-gpo.md +++ b/windows/keep-secure/assign-security-group-filters-to-the-gpo.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO. diff --git a/windows/keep-secure/basic-firewall-policy-design.md b/windows/keep-secure/basic-firewall-policy-design.md index 3863b0cf74..bbc34eda26 100644 --- a/windows/keep-secure/basic-firewall-policy-design.md +++ b/windows/keep-secure/basic-firewall-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but do not have a host-based firewall enabled on each device in the organization. diff --git a/windows/keep-secure/boundary-zone-gpos.md b/windows/keep-secure/boundary-zone-gpos.md index 66865b93a6..550aa7e934 100644 --- a/windows/keep-secure/boundary-zone-gpos.md +++ b/windows/keep-secure/boundary-zone-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 All the devices in the boundary zone are added to the group CG\_DOMISO\_Boundary. You must create multiple GPOs to align with this group, one for each operating system that you have in your boundary zone. This group is granted Read and Apply permissions in Group Policy on the GPOs described in this section. diff --git a/windows/keep-secure/boundary-zone.md b/windows/keep-secure/boundary-zone.md index b44e15fdc1..da0878002d 100644 --- a/windows/keep-secure/boundary-zone.md +++ b/windows/keep-secure/boundary-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In most organizations, some devices must be able to receive network traffic from devices that are not part of the isolated domain, and therefore cannot authenticate. To accept communications from untrusted devices, create a boundary zone within your isolated domain. @@ -60,4 +60,4 @@ The boundary zone GPO for devices running at least Windows Server 2008 should i >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) -**Next: **[Encryption Zone](encryption-zone.md) +**Next:**[Encryption Zone](encryption-zone.md) diff --git a/windows/keep-secure/certificate-based-isolation-policy-design-example.md b/windows/keep-secure/certificate-based-isolation-policy-design-example.md index 8b5e59db2e..0c3612bef6 100644 --- a/windows/keep-secure/certificate-based-isolation-policy-design-example.md +++ b/windows/keep-secure/certificate-based-isolation-policy-design-example.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](firewall-policy-design-example.md), [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). diff --git a/windows/keep-secure/certificate-based-isolation-policy-design.md b/windows/keep-secure/certificate-based-isolation-policy-design.md index 8d0483f776..6a1a244f5c 100644 --- a/windows/keep-secure/certificate-based-isolation-policy-design.md +++ b/windows/keep-secure/certificate-based-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Server Isolation Policy Design](server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic. diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 9ffa767e4b..29866faca7 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -12,6 +12,13 @@ author: brianlic-msft # Change history for Keep Windows 10 secure This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## RELEASE: Windows 10, version 1607 + +The topics in this library have been updated for Windows 10, version 1607 (also known as the Anniversary Update). The following new topics have been added: + +- [Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) +- [Remote Credential Guard](remote-credential-guard.md) + ## July 2016 |New or changed topic | Description | diff --git a/windows/keep-secure/change-rules-from-request-to-require-mode.md b/windows/keep-secure/change-rules-from-request-to-require-mode.md index 156957d053..747345df41 100644 --- a/windows/keep-secure/change-rules-from-request-to-require-mode.md +++ b/windows/keep-secure/change-rules-from-request-to-require-mode.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Do not change the rules for the boundary zone; they must stay in request mode so that devices in the boundary zone can continue to accept connections from devices that are not part of the isolated domain. diff --git a/windows/keep-secure/checklist-configuring-basic-firewall-settings.md b/windows/keep-secure/checklist-configuring-basic-firewall-settings.md index 979ef0e243..af8be53831 100644 --- a/windows/keep-secure/checklist-configuring-basic-firewall-settings.md +++ b/windows/keep-secure/checklist-configuring-basic-firewall-settings.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules. diff --git a/windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md index a3cd9303ca..5385c20f4d 100644 --- a/windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md +++ b/windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that is not part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). diff --git a/windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md index f954a6f45e..996a84ad21 100644 --- a/windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md +++ b/windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that is not part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or devices that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client devices that connect to them. For the GPOs for the client devices, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md). diff --git a/windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md b/windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md index 898aff61c0..93506e5368 100644 --- a/windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md +++ b/windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. diff --git a/windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md b/windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md index 8bf35ebe8e..aba8c91407 100644 --- a/windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md +++ b/windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. diff --git a/windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md b/windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md index 41375ddbad..4533b51003 100644 --- a/windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md +++ b/windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. diff --git a/windows/keep-secure/checklist-creating-group-policy-objects.md b/windows/keep-secure/checklist-creating-group-policy-objects.md index b846638c4e..207e94a1a5 100644 --- a/windows/keep-secure/checklist-creating-group-policy-objects.md +++ b/windows/keep-secure/checklist-creating-group-policy-objects.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the long run by making GPO assignments as easy as dropping a device into a membership group. diff --git a/windows/keep-secure/checklist-creating-inbound-firewall-rules.md b/windows/keep-secure/checklist-creating-inbound-firewall-rules.md index 16681cba2a..bf0e277be4 100644 --- a/windows/keep-secure/checklist-creating-inbound-firewall-rules.md +++ b/windows/keep-secure/checklist-creating-inbound-firewall-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for creating firewall rules in your GPOs. diff --git a/windows/keep-secure/checklist-creating-outbound-firewall-rules.md b/windows/keep-secure/checklist-creating-outbound-firewall-rules.md index 22b8d892c8..9187d83a88 100644 --- a/windows/keep-secure/checklist-creating-outbound-firewall-rules.md +++ b/windows/keep-secure/checklist-creating-outbound-firewall-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for creating outbound firewall rules in your GPOs. diff --git a/windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md index bd5a21cdb8..febc811262 100644 --- a/windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md +++ b/windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone. diff --git a/windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md b/windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md index f72a945895..0e170e2c53 100644 --- a/windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md +++ b/windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. @@ -26,7 +26,7 @@ The procedures in this section use the Group Policy MMC snap-in interfaces to co | Task | Reference | | - | - | | Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization. | [Identifying Your Windows Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Basic Firewall Policy Design](basic-firewall-policy-design.md)
[Firewall Policy Design Example](firewall-policy-design-example.md)
[Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)| -| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 10 and Windows Server 2016 Technical Preview, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10, make a copy of it for Windows Server 2016 Technical Preview, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 10 and Windows Server 2016, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10, make a copy of it for Windows Server 2016, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| | If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the devices for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)| | Configure the GPO with firewall default settings appropriate for your design.| [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)| | Create one or more inbound firewall rules to allow unsolicited inbound network traffic.| [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)| diff --git a/windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md index 1cab0a3744..6a65e70ac2 100644 --- a/windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. diff --git a/windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md b/windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md index a57af52e9a..1c370cc0c7 100644 --- a/windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. diff --git a/windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md index e4ed2e3d00..533859a661 100644 --- a/windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This checklist contains procedures for creating a server isolation policy design that is not part of an isolated domain. For the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md). diff --git a/windows/keep-secure/configure-authentication-methods.md b/windows/keep-secure/configure-authentication-methods.md index c637681093..cee5bff4da 100644 --- a/windows/keep-secure/configure-authentication-methods.md +++ b/windows/keep-secure/configure-authentication-methods.md @@ -14,7 +14,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to configure the authentication methods that can be used by computers in an isolated domain or standalone isolated server zone. diff --git a/windows/keep-secure/configure-data-protection-quick-mode-settings.md b/windows/keep-secure/configure-data-protection-quick-mode-settings.md index 1b0e5489ab..4c7f4c94ea 100644 --- a/windows/keep-secure/configure-data-protection-quick-mode-settings.md +++ b/windows/keep-secure/configure-data-protection-quick-mode-settings.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to configure the data protection (quick mode) settings for connection security rules in an isolated domain or a standalone isolated server zone. diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 79d61b2019..d8db5694c4 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -17,8 +17,9 @@ author: mjcaparas - Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) -> [!NOTE] -> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later. +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +> **Note**  To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later. ### Onboard endpoints 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -44,11 +45,10 @@ author: mjcaparas 9. Click **OK** and close any open GPMC windows. ## Additional Windows Defender ATP configuration settings -For each endpoint, you can state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis. You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. -### Configure sample collection settings +### Configure sample collection settings 1. On your GP management machine, copy the following files from the configuration package: @@ -66,21 +66,17 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. ->[!NOTE] -> If you don't set a value, the default value is to enable sample collection. - ### Offboard endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. -> [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. - + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. - + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click Edit. @@ -97,16 +93,15 @@ For security reasons, the package used to offboard endpoints will expire 30 days 9. Click **OK** and close any open GPMC windows. -## Monitor endpoint configuration +## Monitor endpoint configuration With Group Policy there isn’t an option to monitor deployment of policies on the endpoints. Monitoring can be done directly on the portal, or by using the different deployment tools. -## Monitor endpoints using the portal +## Monitor endpoints using the portal 1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/). 2. Click **Machines view**. 3. Verify that endpoints are appearing. -> [!NOTE] -> It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. +> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. ## Related topics diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 51d6fbf1ae..699d49c7ec 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -17,6 +17,8 @@ author: mjcaparas - Windows 10 Insider Preview Build 14379 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints. For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). @@ -33,7 +35,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre b. Select **Mobile Device Management/Microsoft Intune**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATP.onboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). @@ -51,15 +53,13 @@ Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThrea Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled -> [!NOTE] -> The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. +> **Note**  The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. ### Offboard and monitor endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. -> [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -82,8 +82,7 @@ Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP -> [!NOTE] -> The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. +> **Note**  The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. ## Related topics diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 0376665c6a..3f7fac27dc 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -17,74 +17,47 @@ author: mjcaparas - Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) -- System Center 2012 Configuration Manager or later versions + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] ## Configure endpoints using System Center Configuration Manager (current branch) version 1606 -System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP). +System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. + +> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. -## Configure endpoints using System Center Configuration Manager earlier versions -You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in the following System Center Configuration Manager versions: +## Configure endpoints using System Center Configuration Manager (current branch) version 1602 or earlier versions +You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center Configuration Manager (current branch), version 1602 or earlier, including: System Center 2012 R2 Configuration Manager and System Center 2012 Configuration Manager. -- System Center 2012 Configuration Manager -- System Center 2012 R2 Configuration Manager -- System Center Configuration Manager (current branch), version 1511 -- System Center Configuration Manager (current branch), version 1602 - -### Onboard endpoints +### Onboard endpoints 1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. - b. Select **System Center Configuration Manager 2012/2012 R2/1511/1602**, click **Download package**, and save the .zip file. + b. Select **System Center Configuration Manager (current branch) version 1602 or earlier**, click **Download package**, and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. 4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. a. Choose a predefined device collection to deploy the package to. - -### Configure sample collection settings -For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis. - -You can set a compliance rule for configuration item in System Center Configuration Manager to change the sample share setting on an endpoint. -This rule should be a *remediating* compliance rule configuration item that sets the value of a registry key on targeted machines to make sure they’re complaint. - -The configuration is set through the following registry key entry: - -``` -Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” -Name: "AllowSampleCollection" -Value: 0 or 1 -``` -Where:
-Key type is a D-WORD.
-Possible values are: -- 0 - doesn't allow sample sharing from this endpoint -- 1 - allows sharing of all file types from this endpoint - -The default value in case the registry key doesn’t exist is 1. - -For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/en-us/library/gg681958.aspx). - - -### Offboard endpoints + +### Offboard endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. -> [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. - - b. Under **Endpoint offboarding** section, select **System Center Configuration Manager System Center Configuration Manager 2012/2012 R2/1511/1602**, click **Download package**, and save the .zip file. - + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Under **Endpoint offboarding** section, select **System Center Configuration Manager (current branch) version 1602 or earlier**, click **Download package**, and save the .zip file. + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. @@ -92,7 +65,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. a. Choose a predefined device collection to deploy the package to. - + ### Monitor endpoint configuration Monitoring with SCCM consists of two parts: @@ -110,25 +83,12 @@ Monitoring with SCCM consists of two parts: 4. Review the status indicators under **Completion Statistics** and **Content Status**. -If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. For more information see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). +If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. ![SCCM showing successful deployment with no errors](images/sccm-deployment.png) -**Check that the endpoints are compliant with the Windows Defender ATP service:** -You can set a compliance rule for configuration item in System Center Configuration Manager to monitor your deployment. - -This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines. - -Monitor the following registry key entry: -``` -Path: “HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status” -Name: “OnboardingState” -Value: “1” -``` -For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/en-us/library/gg681958.aspx). - ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index eff1476d26..9d4a39eccc 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -13,7 +13,7 @@ author: mjcaparas # Configure endpoints using a local script You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. -## Onboard endpoints + 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. @@ -21,11 +21,11 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You b. Select **Local Script**, click **Download package** and save the .zip file. -2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file named *WindowsDefenderATPOnboardingScript.cmd*. +2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. 3. Open an elevated command-line prompt on the endpoint and run the script: - a. Go to **Start** and type **cmd**. + a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. @@ -35,46 +35,24 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You 5. Press the **Enter** key or click **OK**. -For for information on how you can manually validate that the endpoint is compliant and correctly reports telemetry see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). +See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. -## Configure sample collection settings -For each endpoint, you can set a configuration value to state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis. - -You can manually configure the sample sharing setting on the endpoint by using *regedit* or creating and running a *.reg* file. - -The configuration is set through the following registry key entry: - -``` -Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” -Name: "AllowSampleCollection" -Value: 0 or 1 -``` -Where:
-Name type is a D-WORD.
-Possible values are: -- 0 - doesn't allow sample sharing from this endpoint -- 1 - allows sharing of all file types from this endpoint - -The default value in case the registry key doesn’t exist is 1. - - -## Offboard endpoints +## Offboard endpoints using a local script For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. -> [!NOTE] -> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. - + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. - + 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Open an elevated command-line prompt on the endpoint and run the script: - a. Go to **Start** and type **cmd**. + a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. @@ -84,18 +62,6 @@ For security reasons, the package used to offboard endpoints will expire 30 days 5. Press the **Enter** key or click **OK**. -## Monitor endpoint configuration -You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) to verify that the script completed successfully and the agent is running. - -Monitoring can also be done directly on the portal, or by using the different deployment tools. - -### Monitor endpoints using the portal -1. Go to the Windows Defender ATP portal. - -2. Click **Machines view**. - -3. Verify that endpoints are appearing. - ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index ddb7b1ea53..0028b5478b 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Configure Windows Defender ATP endpoints -description: Configure endpoints so that they are onboarded to the service. -keywords: configure endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints +description: Use Group Policy or SCCM to deploy the configuration package or do manual registry changes on endpoints so that they are onboarded to the service. +keywords: configure endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm, system center configuration manager search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Endpoints in your organization must be configured so that the Windows Defender ATP service can get telemetry from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization. Windows Defender ATP supports the following deployment tools and methods: diff --git a/windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md index a3687db1b5..0251ff4352 100644 --- a/windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md +++ b/windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can use this procedure to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. Follow this procedure for each GPO that contains IPsec connection security rules that require this certificate. diff --git a/windows/keep-secure/configure-key-exchange-main-mode-settings.md b/windows/keep-secure/configure-key-exchange-main-mode-settings.md index 097d29b877..dd11e2d12d 100644 --- a/windows/keep-secure/configure-key-exchange-main-mode-settings.md +++ b/windows/keep-secure/configure-key-exchange-main-mode-settings.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic. diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index ef0ed28af7..27177d0829 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. -keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server +keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, web proxy auto detect, wpad, netsh, winhttp, proxy server search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -15,21 +15,21 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report telemetry and communicate with the Windows Defender ATP service. The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: - +- Configure Web Proxy Auto Detect (WPAD) settings and configure Windows to automatically detect the proxy server -- Configure the proxy server manually using a static proxy +- Configure the proxy server manually using Netsh - -## Configure the proxy server manually using a static proxy -Configure a static proxy to allow only Windows Defender ATP sensor to report telemetry and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet. - -The static proxy is configurable through Group Policy (GP). The group policy can be found under: **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**. - -The registry key that this policy sets can be found at: -``` HKLM\Software\Policies\Microsoft\Windows\DataCollection TelemetryProxyServer``` - -The policy and the registry key takes the following string format: -```:``` -
-For example: 10.0.0.6:8080 - -If the static proxy settings are configured after onboarding, then you must restart the PC to apply the proxy settings. ## Enable access to Windows Defender ATP service URLs in the proxy server If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: -Primary Domain Controller | .Microsoft.com DNS record -:---|:--- - Central US | winatp-gw-cus.microsoft.com
us.vortex-win.data.microsoft.com
crl.microsoft.com
*.blob.core.windows.net - East US (2)| winatp-gw-eus.microsoft.com
us.vortex-win.data.microsoft.com
crl.microsoft.com
*.blob.core.windows.net - West Europe | winatp-gw-weu.microsoft.com
eu.vortex-win.data.microsoft.com
crl.microsoft.com
*.blob.core.windows.net - North Europe | winatp-gw-neu.microsoft.com
eu.vortex-win.data.microsoft.com
crl.microsoft.com
*.blob.core.windows.net +- *.blob.core.windows.net +- crl.microsoft.com +- eu.vortex-win.data.microsoft.com +- sevillegwcus.microsoft.com +- sevillegweus.microsoft.com +- sevillegwneu.microsoft.com +- sevillegwweu.microsoft.com +- us.vortex-win.data.microsoft.com +- www.microsoft.com - If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. +If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted to the above listed URLs. ## Verify client connectivity to Windows Defender ATP service URLs Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs. -1. Download the connectivity verification tool to the PC where Windows Defender ATP sensor is running on. +1. Download the connectivity verification tools to the PC where Windows Defender ATP sensor is running on: -2. Extract the contents of SenseConnectivtyChecker on the endpoint. + - [Download PsTools Suite](https://technet.microsoft.com/en-us/sysinternals/bb896649) + - [Download PortQry Command Line Port Scanner Version 2.0 utility](https://www.microsoft.com/en-us/download/details.aspx?id=17148) -3. Open an elevated command-line: +2. Extract the contents of **PsTools** and **PortQry** to a directory on the computer hard drive. - a. Go to **Start** and type **cmd**. +3. Open an elevated command-line: + + a. Click **Start** and type **cmd**. b. Right-click **Command prompt** and select **Run as administrator**. 4. Enter the following command and press **Enter**: ``` - HardDrivePath\RunSenseConnectivityCheck.cmd + HardDrivePath\PsExec.exe -s cmd.exe ``` - Replace *HardDrivePath* with the path where the SenseConnectivtyChecker tool was downloaded to, for example ```C:\Work\tools\ConnectivityChecker\RunSenseConnectivityCheck.cmd```. + Replace *HardDrivePath* with the path where the PsTools Suite was extracted to: + ![Image showing the command line](images/psexec-cmd.png) -5. Extract the *ConnectivityCheckResult.zip* file created by tool in the folder used in the *HardDrivePath*. +5. Enter the following command and press **Enter**: -6. Open *ConnectivityCheck.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

-The tool checks the connectivity of Windows Defender ATP service URLs that Windows Defender ATP client is configured to interact with. It then prints the results into the *ConnectivityCheck.txt* file for each URL that can potentially be used to communicate with the Windows Defender ATP services. For example: - ``` - Testing URL : https://xxx.microsoft.com/xxx - 1 - Default proxy: Succeeded (200) - 2 - Proxy auto discovery (WPAD): Succeeded (200) - 3 - Proxy disabled: Succeeded (200) - 4 - Named proxy: Doesn't exist - 5 - Command line proxy: Doesn't exist - ``` + ``` + HardDrivePath\portqry.exe -n us.vortex-win.data.microsoft.com -e 443 -p tcp + ``` + Replace *HardDrivePath* with the path where the PortQry utility was extracted to: + ![Image showing the command line](images/portqry.png) -If at least one of the connectivity options returns a (200) status, then the Windows Defender ATP client can communicate with the tested URL properly using this connectivity method.

+6. Verify that the output shows that the name is **resolved** and connection status is **listening**. -If however the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy server). The URLs you'll use will depend on the region selected during the onboarding procedure. +7. Repeat the same steps for the remaining URLs with the following arguments: + + - portqry.exe -n eu.vortex-win.data.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwcus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegweus.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwweu.microsoft.com -e 443 -p tcp + - portqry.exe -n sevillegwneu.microsoft.com -e 443 -p tcp + - portqry.exe -n www.microsoft.com -e 80 -p tcp + - portqry.exe -n crl.microsoft.com -e 80 -p tcp + +8. Verify that each URL shows that the name is **resolved** and the connection status is **listening**. + +If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-the-windows-firewall-log.md b/windows/keep-secure/configure-the-windows-firewall-log.md index 0784a64b85..086d294c27 100644 --- a/windows/keep-secure/configure-the-windows-firewall-log.md +++ b/windows/keep-secure/configure-the-windows-firewall-log.md @@ -14,7 +14,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To configure Windows Firewall to log dropped packets or successful connections, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in. diff --git a/windows/keep-secure/configure-the-workstation-authentication-certificate-template.md b/windows/keep-secure/configure-the-workstation-authentication-certificate-template.md index 89b5eb68e9..3b75bc141f 100644 --- a/windows/keep-secure/configure-the-workstation-authentication-certificate-template.md +++ b/windows/keep-secure/configure-the-workstation-authentication-certificate-template.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure describes how to configure a certificate template that Active Directory Certification Services (AD CS) uses as the starting point for device certificates that are automatically enrolled and deployed to workstations in the domain. It shows how to create a copy of a template, and then configure the template according to your design requirements. diff --git a/windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md index b4990058e6..057dd20255 100644 --- a/windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md +++ b/windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To configure Windows Firewall to suppress the display of a notification when it blocks a program that tries to listen for network traffic and to prohibit locally defined rules, use the Windows Firewall with Advanced Security node in the Group Policy Management console. diff --git a/windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md b/windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md index 0423277e45..c64746932b 100644 --- a/windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md +++ b/windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After configuring your certificates and autoenrollment in Group Policy, you can confirm that the policy is being applied as expected, and that the certificates are being properly installed on the workstation devices. diff --git a/windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md b/windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md index 694250fe3b..0b0fc49d34 100644 --- a/windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To create the GPO for the boundary zone devices, make a copy of the main domain isolation GPO, and then change the settings to request, instead of require, authentication. To make a copy of a GPO, use the Active Directory Users and devices MMC snap-in. @@ -47,4 +47,4 @@ To complete this procedure, you must be a member of the Domain Administrators gr 12. Type the name of the group that contains members of the boundary zone, for example **CG\_DOMISO\_Boundary**, and then click **OK**. -13. If required, change the WMI filter to one appropriate for the new GPO. For example, if the original GPO is for client devices running Windows 10, and the new boundary zone GPO is for devices running Windows Server 2016 Technical Preview, then select a WMI filter that allows only those devices to read and apply the GPO. +13. If required, change the WMI filter to one appropriate for the new GPO. For example, if the original GPO is for client devices running Windows 10, and the new boundary zone GPO is for devices running Windows Server 2016, then select a WMI filter that allows only those devices to read and apply the GPO. diff --git a/windows/keep-secure/create-a-group-account-in-active-directory.md b/windows/keep-secure/create-a-group-account-in-active-directory.md index 6aeb64d983..6ada08d53f 100644 --- a/windows/keep-secure/create-a-group-account-in-active-directory.md +++ b/windows/keep-secure/create-a-group-account-in-active-directory.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To create a security group to contain the computer accounts for the computers that are to receive a set of Group Policy settings, use the Active Directory Users and Computers console. diff --git a/windows/keep-secure/create-a-group-policy-object.md b/windows/keep-secure/create-a-group-policy-object.md index 42a0e5ae62..bdd41a37ca 100644 --- a/windows/keep-secure/create-a-group-policy-object.md +++ b/windows/keep-secure/create-a-group-policy-object.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To create a new GPO, use the Active Directory Users and Computers MMC snap-in. diff --git a/windows/keep-secure/create-an-authentication-exemption-list-rule.md b/windows/keep-secure/create-an-authentication-exemption-list-rule.md index b0a4ec1118..e48455f5e9 100644 --- a/windows/keep-secure/create-an-authentication-exemption-list-rule.md +++ b/windows/keep-secure/create-an-authentication-exemption-list-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In almost any isolated server or isolated domain scenario, there are some devices or devices that cannot communicate by using IPsec. This procedure shows you how to create rules that exempt those devices from the authentication requirements of your isolation policies. diff --git a/windows/keep-secure/create-an-authentication-request-rule.md b/windows/keep-secure/create-an-authentication-request-rule.md index 1c947f68f9..42617dc699 100644 --- a/windows/keep-secure/create-an-authentication-request-rule.md +++ b/windows/keep-secure/create-an-authentication-request-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have configured IPsec algorithms and authentication methods, you can create the rule that requires the devices on the network to use those protocols and methods before they can communicate. diff --git a/windows/keep-secure/create-an-inbound-icmp-rule.md b/windows/keep-secure/create-an-inbound-icmp-rule.md index f76bba3007..83983389da 100644 --- a/windows/keep-secure/create-an-inbound-icmp-rule.md +++ b/windows/keep-secure/create-an-inbound-icmp-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network. diff --git a/windows/keep-secure/create-an-inbound-port-rule.md b/windows/keep-secure/create-an-inbound-port-rule.md index e2a911293f..212bf9a8fc 100644 --- a/windows/keep-secure/create-an-inbound-port-rule.md +++ b/windows/keep-secure/create-an-inbound-port-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. diff --git a/windows/keep-secure/create-an-inbound-program-or-service-rule.md b/windows/keep-secure/create-an-inbound-program-or-service-rule.md index 51524c047d..62c8e83e1b 100644 --- a/windows/keep-secure/create-an-inbound-program-or-service-rule.md +++ b/windows/keep-secure/create-an-inbound-program-or-service-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To allow inbound network traffic to a specified program or service, use the Windows Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. diff --git a/windows/keep-secure/create-an-outbound-port-rule.md b/windows/keep-secure/create-an-outbound-port-rule.md index 98c85d581c..9a06f49266 100644 --- a/windows/keep-secure/create-an-outbound-port-rule.md +++ b/windows/keep-secure/create-an-outbound-port-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the Windows Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. diff --git a/windows/keep-secure/create-an-outbound-program-or-service-rule.md b/windows/keep-secure/create-an-outbound-program-or-service-rule.md index 342e863ffd..2e7e5c2e1e 100644 --- a/windows/keep-secure/create-an-outbound-program-or-service-rule.md +++ b/windows/keep-secure/create-an-outbound-program-or-service-rule.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. diff --git a/windows/keep-secure/create-inbound-rules-to-support-rpc.md b/windows/keep-secure/create-inbound-rules-to-support-rpc.md index 0ba04d529e..a7cf60c649 100644 --- a/windows/keep-secure/create-inbound-rules-to-support-rpc.md +++ b/windows/keep-secure/create-inbound-rules-to-support-rpc.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To allow inbound remote procedure call (RPC) network traffic, use the Windows Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically-assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically-assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. diff --git a/windows/keep-secure/create-wmi-filters-for-the-gpo.md b/windows/keep-secure/create-wmi-filters-for-the-gpo.md index f4b066d3e1..3cbb5be9a5 100644 --- a/windows/keep-secure/create-wmi-filters-for-the-gpo.md +++ b/windows/keep-secure/create-wmi-filters-for-the-gpo.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To make sure that each GPO associated with a group can only be applied to devices running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each device. diff --git a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md index fdf497e545..6d70cbad2b 100644 --- a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md +++ b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md @@ -1,5 +1,5 @@ --- title: Create a Device Guard code integrity policy based on a reference device (Windows 10) -redirect_url: device-guard-deployment-guide.md +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide --- diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 3974a748e2..94996dab65 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -90,7 +90,7 @@ The PC must meet the following hardware and software requirements to use Credent TPM 2.0 -Windows 10 version 1511 +Windows 10 version 1511 or later TPM 2.0 or TPM 1.2 @@ -109,7 +109,11 @@ The PC must meet the following hardware and software requirements to use Credent

Physical PC

-

For PCs running Windows 10, you cannot run Credential Guard on a virtual machine.

+

For PCs running Windows 10, version 1511 and Windows 10, version 1507, you cannot run Credential Guard on a virtual machine.

+ + +

Virtual machine

+

For PCs running Windows 10, version 1607, you can run Credential Guard on a Generation 2 virtual machine.

@@ -144,9 +148,8 @@ First, you must add the virtualization-based security features. You can do this **Add the virtualization-based security features by using Programs and Features** 1. Open the Programs and Features control panel. 2. Click **Turn Windows feature on or off**. -3. Select the **Isolated User Mode** check box. -4. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. -5. Click **OK**. +3. Go to **Hyper-V** -> **Hyper-V Platform**, and then select the **Hyper-V Hypervisor** check box. +4. Click **OK**. **Add the virtualization-based security features to an offline image by using DISM** 1. Open an elevated command prompt. @@ -154,12 +157,14 @@ First, you must add the virtualization-based security features. You can do this ``` syntax dism /image: /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all ``` -3. Add Isolated User Mode by running the following command: - ``` syntax - dism /image: /Enable-Feature /FeatureName:IsolatedUserMode - ``` > **Note:**  You can also add these features to an online image by using either DISM or Configuration Manager. -  + + +In Windows 10, version 1607, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: + +``` syntax +dism /image: /Enable-Feature /FeatureName:IsolatedUserMode +``` ### Turn on Credential Guard If you don't use Group Policy, you can enable Credential Guard by using the registry. @@ -203,7 +208,7 @@ If you have to remove Credential Guard on a PC, you need to do the following: 3. Accept the prompt to disable Credential Guard. 4. Alternatively, you can disable the virtualization-based security features to turn off Credential Guard. -> **Note: ** The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS +> **Note:** The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md).   diff --git a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md index 90ac580a40..024ddab8e2 100644 --- a/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + The **Dashboard** displays a snapshot of: - The latest active alerts on your network @@ -38,18 +40,18 @@ You can view the overall number of active ATP alerts from the last 30 days in yo Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**). -For more information see, [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md). +See the [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) topic for more information. -The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. For more information see, [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md). +The **Latest ATP alerts** section includes the latest active alerts in your network. Each row includes an alert severity category and a short description of the alert. Click an alert to see its detailed view, or **Alerts queue** at the top of the list to go directly to the Alerts queue. See the [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) and [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) topics for more information. ## Machines at risk This tile shows you a list of machines with the highest number of active alerts. The total number of alerts for each machine is shown in a circle next to the machine name, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to see its label). ![The Machines at risk tile shows a list of machines with the highest number of alerts, and a breakdown of the severity of the alerts](images/machines-at-risk.png) -Click the name of the machine to see details about that machine. For more information see, [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-a-machine). +Click the name of the machine to see details about that machine. See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-a-machine) topic for more information. -You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md). +You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. See the [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) topic for more information. ## Status The **Status** tile informs you if the service is active and running and the unique number of machines (endpoints) reporting over the past 30 days. @@ -82,8 +84,7 @@ Threats are considered "active" if there is a very high probability that the mal Clicking on any of these categories will navigate to the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. -> [!NOTE] -> The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. ### Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md index 2143ccc62c..a5d2bec8ce 100644 --- a/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md @@ -14,12 +14,13 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP. -> [!NOTE] -> This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender and Windows 10, see [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See also [Windows 10 privacy FAQ](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq) for more information. +> **Note**  This document covers the information specific to the Windows Defender ATP service. Other data shared and stored by Windows Defender and Windows 10 is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See the [Windows 10 privacy FAQ for more information](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq). ## What data does Windows Defender ATP collect? @@ -27,7 +28,7 @@ Microsoft will collect and store information from your configured endpoints in a Information collected includes code file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as GUIDs, names, and the operating system version). -Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/). +Microsoft stores this data in a Microsoft Azure security-specific data store, and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://azure.microsoft.com/en-us/support/trust-center/). Microsoft uses this data to: - Proactively identify indicators of attack (IOAs) in your organization @@ -38,10 +39,10 @@ Microsoft does not mine your data for advertising or for any other purpose other ## Do I have the flexibility to select where to store my data? -When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation. +Data for this new service is stored in Microsoft Azure datacenters in the United States and European Union based on the geolocation properties. Subject to the relevant preview program you may be able to specify your preferred geolocation when you onboard to the service. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations in which your data will reside. Microsoft will not transfer the data from the specified geolocation except in specific circumstances during the preview stage. ## Is my data isolated from other customer data? -Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides. +Yes. The new cloud service provides appropriate segregation at a number of levels, such as isolation of files, configurations, and telemetry data. Aside from data access authentication, simply keeping different data appropriately segregated provides well-recognized protection. ## How does Microsoft prevent malicious insider activities and abuse of high privilege roles? @@ -57,18 +58,12 @@ Additionally, Microsoft conducts background verification checks of certain opera No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides. ## How long will Microsoft store my data? What is Microsoft’s data retention policy? -**At service onboarding**
-You can choose the data retention policy for your data. This determines how long Window Defender ATP will store your data. There’s a flexibility of choosing in the range of 1 month to six months to meet your company’s regulatory compliance needs. - -**At contract termination or expiration**
-Your data will be kept for a period of at least 90 days, during which it will be available to you. At the end of this period, that data will be erased from Microsoft’s systems to make it unrecoverable, no later than 180 days from contract termination or expiration. - +Your data privacy is one of Microsoft's key commitments for the cloud. For this service, at contract termination or expiration, your data will be erased from Microsoft’s systems to make it unrecoverable after 90 days (from contract termination or expiration). ## Can Microsoft help us maintain regulatory compliance? Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP has a roadmap for obtaining national, regional and industry-specific certifications, starting with ISO 27001. The service is designed, implemented, and maintained according to the compliance and privacy principles of ISO 27001, as well as Microsoft’s compliance standards. By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run, including this new Microsoft cloud service. - - +This is a temporary measure as we work to integrate our deep analysis capabilities into the European datacenter. If you have any concerns or questions about submitting files for deep analysis and you are using a European datacenter, or if you’d like to be updated as to when the European deep analysis lab is online, email [winatp@microsoft.com](mailto:winatp@microsoft.com). diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index 9eda4d82c8..943481d23b 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -28,15 +28,21 @@ For information about enabling Credential Guard, see [Protect derived domain cre ## Windows feature requirements for virtualization-based security -In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). +In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: + +- With Windows 10, version 1607 or Windows Server 2016:
+Hyper-V Hypervisor (shown in Figure 1). + +- With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
+Hyper-V Hypervisor and Isolated User Mode (not shown). > **Note**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see [Protect derived domain credentials with Credential Guard](credential-guard.md).   ![Turn Windows features on or off](images/dg-fig1-enableos.png) -Figure 1. Enable operating system features for VBS +Figure 1. Enable operating system feature for VBS -After you enable these features, you can configure any additional hardware-based security features you want. The following sections provide more information: +After you enable the feature or features, you can configure any additional hardware-based security features you want. The following sections provide more information: - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) @@ -44,7 +50,7 @@ After you enable these features, you can configure any additional hardware-based Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. -> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. +> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. For more information about how IOMMUs help protect against DMA attacks, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -52,9 +58,9 @@ Before you begin this process, verify that the target device meets the hardware 3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: - - Set this value to **1** to enable the **Secure Boot** option. - - - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. + | **With Windows 10, version 1607,
or Windows Server 2016** | **With an earlier version of Windows 10,
or Windows Server 2016 Technical Preview 5 or earlier** | + | ---------------- | ---------------- | + | **1** enables the **Secure Boot** option
**3** enables the **Secure Boot and DMA protection** option | **1** enables the **Secure Boot** option
**2** enables the **Secure Boot and DMA protection** option | 4. Restart the client computer. @@ -80,11 +86,11 @@ Unfortunately, it would be time consuming to perform these steps manually on eve Figure 6. Enable VBS -5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) - Figure 7. Enable Secure Boot + Figure 7. Enable Secure Boot (in Windows 10, version 1607) > **Note**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection. @@ -102,7 +108,11 @@ Before you begin this process, verify that the desired computer meets the hardwa **To configure virtualization-based protection of KMCI manually:** -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. +1. Navigate to the appropriate registry subkey: + + - With Windows 10, version 1607, or Windows Server 2016:
**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios** + + - With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** 2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. @@ -130,11 +140,15 @@ It would be time consuming to perform these steps manually on every protected co Figure 3. Enable VBS -5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. +5. Select the **Enabled** button, and then for **Virtualization Based Protection of Code Integrity**, select the appropriate option: + + - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
For an initial deployment or test deployment, we recommend **Enabled without UEFI lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + + - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) - Figure 4. Enable VBS of KMCI + Figure 4. Enable VBS of KMCI (in Windows 10, version 1607) 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. @@ -176,7 +190,12 @@ Table 1. Win32\_DeviceGuard properties
  • 1. If present, hypervisor support is available.

  • 2. If present, Secure Boot is available.

  • 3. If present, DMA protection is available.

  • - +
  • 4. If present, Secure Memory Overwrite is available.

  • +
  • 5. If present, NX protections are available.

  • +
  • 6. If present, SMM mitigations are available.

  • + +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + InstanceIdentifier @@ -188,10 +207,15 @@ Table 1. Win32\_DeviceGuard properties This field describes the required security properties to enable virtualization-based security.
    • 0. Nothing is required.

    • -
    • 1. If present, Secure Boot is needed.

    • -
    • 2. If present, DMA protection is needed.

    • -
    • 3. If present, both Secure Boot and DMA protection are needed.

    • -
    +
  • 1. If present, hypervisor support is needed.

  • +
  • 2. If present, Secure Boot is needed.

  • +
  • 3. If present, DMA protection is needed.

  • +
  • 4. If present, Secure Memory Overwrite is needed.

  • +
  • 5. If present, NX protections are needed.

  • +
  • 6. If present, SMM mitigations are needed.

  • + +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + SecurityServicesConfigured diff --git a/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md index 144252b206..df45d7bcb2 100644 --- a/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md +++ b/windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. You must have a good understanding of what tasks the devices on the network perform, and how they use the network to accomplish those tasks. You must understand the network traffic generated by the programs running on the devices. diff --git a/windows/keep-secure/determining-the-trusted-state-of-your-devices.md b/windows/keep-secure/determining-the-trusted-state-of-your-devices.md index 8bbd75608d..01ed85051c 100644 --- a/windows/keep-secure/determining-the-trusted-state-of-your-devices.md +++ b/windows/keep-secure/determining-the-trusted-state-of-your-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After obtaining information about the devices that are currently part of the IT infrastructure, you must determine at what point a device is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this can lead to problems with the security of the trusted environment, because the overall security cannot exceed the level of security set by the least secure client that achieves trusted status. diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index 5e60c5e980..566a6df4da 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -1,4 +1,4 @@ --- title: Device Guard certification and compliance (Windows 10) -redirect_url: device-guard-deployment-guide.md +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide --- diff --git a/windows/keep-secure/documenting-the-zones.md b/windows/keep-secure/documenting-the-zones.md index 88e67e80c4..9c120835e8 100644 --- a/windows/keep-secure/documenting-the-zones.md +++ b/windows/keep-secure/documenting-the-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Generally, the task of determining zone membership is not complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Firewall with Advanced Security Strategy section. A sample is shown here: diff --git a/windows/keep-secure/domain-isolation-policy-design-example.md b/windows/keep-secure/domain-isolation-policy-design-example.md index 2bfcf9cbc8..f5cc8ea0f6 100644 --- a/windows/keep-secure/domain-isolation-policy-design-example.md +++ b/windows/keep-secure/domain-isolation-policy-design-example.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams. diff --git a/windows/keep-secure/domain-isolation-policy-design.md b/windows/keep-secure/domain-isolation-policy-design.md index da2564242b..6f15c8338f 100644 --- a/windows/keep-secure/domain-isolation-policy-design.md +++ b/windows/keep-secure/domain-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In the domain isolation policy design, you configure the devices on your network to accept only connections coming from devices that are authenticated as members of the same isolated domain. diff --git a/windows/keep-secure/enable-predefined-inbound-rules.md b/windows/keep-secure/enable-predefined-inbound-rules.md index fe16701837..59e8325dac 100644 --- a/windows/keep-secure/enable-predefined-inbound-rules.md +++ b/windows/keep-secure/enable-predefined-inbound-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Windows Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a device or enable a network feature on a client device, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the devices on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/keep-secure/enable-predefined-outbound-rules.md b/windows/keep-secure/enable-predefined-outbound-rules.md index 1691399b8a..137de67aa2 100644 --- a/windows/keep-secure/enable-predefined-outbound-rules.md +++ b/windows/keep-secure/enable-predefined-outbound-rules.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 By default, Windows Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Firewall with Advanced Security includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically does not enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Doing this helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. diff --git a/windows/keep-secure/encryption-zone-gpos.md b/windows/keep-secure/encryption-zone-gpos.md index dcb49121a4..357f2eebfc 100644 --- a/windows/keep-secure/encryption-zone-gpos.md +++ b/windows/keep-secure/encryption-zone-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Handle encryption zones in a similar manner to the boundary zones. A device is added to an encryption zone by adding the device account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the devices that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section. diff --git a/windows/keep-secure/encryption-zone.md b/windows/keep-secure/encryption-zone.md index f6fd2aacd4..7e59ef31e3 100644 --- a/windows/keep-secure/encryption-zone.md +++ b/windows/keep-secure/encryption-zone.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Some servers in the organization host data that is very sensitive, including medical, financial, or other personally identifying data. Government or industry regulations might require that this sensitive information must be encrypted when it is transferred between devices. diff --git a/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md b/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md index 35a8444e6e..c7fe4f7637 100644 --- a/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md +++ b/windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following Windows Firewall with Advanced Security design examples illustrate how you can use Windows Firewall with Advanced Security to improve the security of the devices connected to the network. You can use these topics to evaluate how the firewall and connection security rules work across all Windows Firewall with Advanced Security designs and to determine which design or combination of designs best suits the goals of your organization. diff --git a/windows/keep-secure/event-4706.md b/windows/keep-secure/event-4706.md index 3eb6bdda15..936468b4c3 100644 --- a/windows/keep-secure/event-4706.md +++ b/windows/keep-secure/event-4706.md @@ -127,13 +127,13 @@ This event is generated only on domain controllers. | 0x1 | TRUST\_ATTRIBUTE\_NON\_TRANSITIVE | If this bit is set, then the trust cannot be used transitively. For example, if domain A trusts domain B, which in turn trusts domain C, and the A<-->B trust has this attribute set, then a client in domain A cannot authenticate to a server in domain C over the A<-->B<-->C trust linkage. | | 0x2 | TRUST\_ATTRIBUTE\_UPLEVEL\_ONLY | If this bit is set in the attribute, then only Windows 2000 operating system and newer clients may use the trust link. [Netlogon](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_70771a5a-04a3-447d-981b-e03098808c32) does not consume [trust objects](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_e81f6436-01d2-4311-93a4-4316bb67eabd) that have this flag set. | | 0x4 | TRUST\_ATTRIBUTE\_QUARANTINED\_DOMAIN | If this bit is set, the trusted domain is quarantined and is subject to the rules of [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) Filtering as described in [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section [4.1.2.2](https://msdn.microsoft.com/en-us/library/cc237940.aspx). | -| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 Technical Preview operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](http://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | -| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016 Technical Preview
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | +| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | - **SID Filtering** \[Type = UnicodeString\]: [SID Filtering](https://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx) state for the new trust: diff --git a/windows/keep-secure/event-4716.md b/windows/keep-secure/event-4716.md index 8140c94b16..65ea86275d 100644 --- a/windows/keep-secure/event-4716.md +++ b/windows/keep-secure/event-4716.md @@ -127,13 +127,13 @@ This event is generated only on domain controllers. | 0x1 | TRUST\_ATTRIBUTE\_NON\_TRANSITIVE | If this bit is set, then the trust cannot be used transitively. For example, if domain A trusts domain B, which in turn trusts domain C, and the A<-->B trust has this attribute set, then a client in domain A cannot authenticate to a server in domain C over the A<-->B<-->C trust linkage. | | 0x2 | TRUST\_ATTRIBUTE\_UPLEVEL\_ONLY | If this bit is set in the attribute, then only Windows 2000 operating system and newer clients may use the trust link. [Netlogon](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_70771a5a-04a3-447d-981b-e03098808c32) does not consume [trust objects](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_e81f6436-01d2-4311-93a4-4316bb67eabd) that have this flag set. | | 0x4 | TRUST\_ATTRIBUTE\_QUARANTINED\_DOMAIN | If this bit is set, the trusted domain is quarantined and is subject to the rules of [SID](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) Filtering as described in [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section [4.1.2.2](https://msdn.microsoft.com/en-us/library/cc237940.aspx). | -| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 Technical Preview operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | -| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
    Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/en-us/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/en-us/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/en-us/library/cc223991.aspx).
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/en-us/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
    Only evaluated if SID Filtering is used.
    Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/en-us/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](http://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](http://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/en-us/library/cc223782.aspx).
    Only evaluated on TRUST\_TYPE\_MIT | -| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 Technical Preview. | -| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016 Technical Preview
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | +| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/en-us/library/cc233855.aspx) section 3.3.5.7.5.
    Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | +| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/en-us/library/cc237917.aspx) section 4.1.2.2.
    Evaluated only on Windows Server 2016
    Evaluated only if SID Filtering is used.
    Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
    Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | - **SID Filtering** \[Type = UnicodeString\]: [SID Filtering](https://technet.microsoft.com/en-us/library/cc772633(v=ws.10).aspx) state for the new trust: diff --git a/windows/keep-secure/event-4739.md b/windows/keep-secure/event-4739.md index 8b692f1ea3..44897f5f13 100644 --- a/windows/keep-secure/event-4739.md +++ b/windows/keep-secure/event-4739.md @@ -165,14 +165,14 @@ This event generates when one of the following changes was made to local compute | Value | Identifier | Domain controller operating systems that are allowed in the domain | |-------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0 | DS\_BEHAVIOR\_WIN2000 | Windows 2000 Server operating system
    Windows Server 2003 operating system
    Windows Server 2008 operating system
    Windows Server 2008 R2 operating system
    Windows Server 2012 operating system
    Windows Server 2012 R2 operating system
    Windows Server 2016 Technical Preview operating system | -| 1 | DS\_BEHAVIOR\_WIN2003\_WITH\_MIXED\_DOMAINS | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 2 | DS\_BEHAVIOR\_WIN2003 | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 3 | DS\_BEHAVIOR\_WIN2008 | Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 4 | DS\_BEHAVIOR\_WIN2008R2 | Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 5 | DS\_BEHAVIOR\_WIN2012 | Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 6 | DS\_BEHAVIOR\_WIN2012R2 | Windows Server 2012 R2
    Windows Server 2016 Technical Preview | -| 7 | DS\_BEHAVIOR\_WINTHRESHOLD | Windows Server 2016 Technical Preview | +| 0 | DS\_BEHAVIOR\_WIN2000 | Windows 2000 Server operating system
    Windows Server 2003 operating system
    Windows Server 2008 operating system
    Windows Server 2008 R2 operating system
    Windows Server 2012 operating system
    Windows Server 2012 R2 operating system
    Windows Server 2016 operating system | +| 1 | DS\_BEHAVIOR\_WIN2003\_WITH\_MIXED\_DOMAINS | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 2 | DS\_BEHAVIOR\_WIN2003 | Windows Server 2003
    Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 3 | DS\_BEHAVIOR\_WIN2008 | Windows Server 2008
    Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 4 | DS\_BEHAVIOR\_WIN2008R2 | Windows Server 2008 R2
    Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 5 | DS\_BEHAVIOR\_WIN2012 | Windows Server 2012
    Windows Server 2012 R2
    Windows Server 2016 | +| 6 | DS\_BEHAVIOR\_WIN2012R2 | Windows Server 2012 R2
    Windows Server 2016 | +| 7 | DS\_BEHAVIOR\_WINTHRESHOLD | Windows Server 2016 | - **OEM Information** \[Type = UnicodeString\]: there is no information about this field in this document. diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index cc1448d745..f019d14fdf 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Review events and errors on endpoints with Event Viewer description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service. -keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Defender Advanced Threat Protection service, cannot start, broken, can't start +keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Advanced Threat Protection service, cannot start, broken, can't start search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -15,15 +15,16 @@ author: iaanw **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints. For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps. -> [!NOTE] -> It can take several days for endpoints to begin reporting to the Windows Defender ATP service. +> **Note**  It can take several days for endpoints to begin reporting to the Windows Defender ATP service. **Open Event Viewer and find the Windows Defender ATP service event log:** @@ -34,8 +35,7 @@ For example, if endpoints are not appearing in the **Machines view** list, you m a. You can also access the log by expanding **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE** and click on **Operational**. - > [!NOTE] - > SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. 3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service. @@ -49,39 +49,39 @@ For example, if endpoints are not appearing in the **Machines view** list, you m 1 -Windows Defender Advanced Threat Protection service started (Version ```variable```). +Windows Advanced Threat Protection service started (Version ```variable```). Occurs during system start up, shut down, and during onbboarding. Normal operating notification; no action required. 2 -Windows Defender Advanced Threat Protection service shutdown. +Windows Advanced Threat Protection service shutdown. Occurs when the endpoint is shut down or offboarded. Normal operating notification; no action required. 3 -Windows Defender Advanced Threat Protection service failed to start. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to start. Failure code: ```variable``` Service did not start. Review other messages to determine possible cause and troubleshooting steps. 4 -Windows Defender Advanced Threat Protection service contacted the server at ```variable```. -Variable = URL of the Windows Defender ATP processing servers.
    +Windows Advanced Threat Protection service contacted the server at ```variable```. +variable = URL of the Windows Defender ATP processing servers.
    This URL will match that seen in the Firewall or network activity. Normal operating notification; no action required. 5 -Windows Defender Advanced Threat Protection service failed to connect to the server at ```variable```. -Variable = URL of the Windows Defender ATP processing servers.
    +Windows Advanced Threat Protection service failed to connect to the server at ```variable```. +variable = URL of the Windows Defender ATP processing servers.
    The service could not contact the external processing servers at that URL. Check the connection to the URL. See [Configure proxy and Internet connectivity](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#configure-proxy-and-Internet-connectivity). 6 -Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. +Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found. The endpoint did not onboard correctly and will not be reporting to the portal. Onboarding must be run before starting the service.
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    @@ -89,66 +89,72 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen 7 -Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```. -Variable = detailed error description. The endpoint did not onboard correctly and will not be reporting to the portal. +Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: ```variable``` +The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 8 -Windows Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```. -**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues.

    **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running. - -**Onboarding:** No action required.

    **Offboarding:** Reboot the system.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +Windows Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable``` +The endpoint did not onboard correctly and will not be reporting to the portal. +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 9 -Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```. -**During onboarding:** The endpoint did not onboard correctly and will not be reporting to the portal.

    **During offboarding:** Failed to change the service start type. The offboarding process continues. +Windows Advanced Threat Protection service failed to change its start type. Failure code: ```variable``` +The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 10 -Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable``` The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 11 -Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed. +Windows Advanced Threat Protection service completed. The endpoint onboarded correctly. Normal operating notification; no action required.
    It may take several hours for the endpoint to appear in the portal. 12 -Windows Defender Advanced Threat Protection failed to apply the default configuration. -Service was unable to apply the default configuration. -This error should resolve after a short period of time. +Windows Advanced Threat Protection failed to apply the default configuration. +Service was unable to apply configuration from the processing servers. +This is a server error and should resolve after a short period. 13 -Windows Defender Advanced Threat Protection machine ID calculated: ```variable```. +Service machine ID calculated: ```variable``` Normal operating process. Normal operating notification; no action required. +14 +Service cannot calculate machine ID. Failure code: ```variable``` +Internal error. +Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) + + 15 -Windows Defender Advanced Threat Protection cannot start command channel with URL: ```variable```. -Variable = URL of the Windows Defender ATP processing servers.
    +Windows Advanced Threat Protection cannot start command channel with URL: ```variable``` +variable = URL of the Windows Defender ATP processing servers.
    The service could not contact the external processing servers at that URL. Check the connection to the URL. See [Configure proxy and Internet connectivity](#configure-proxy-and-Internet-connectivity). 17 -Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable``` An error occurred with the Windows telemetry service. -[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    +[Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled)
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 18 @@ -165,45 +171,44 @@ If this error persists after a system restart, ensure all Windows updates have f 20 -Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable```. +Cannot wait for OOBE (Windows Welcome) to complete. Failure code: ```variable``` Internal error. If this error persists after a system restart, ensure all Windows updates have full installed. 25 -Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```. -The endpoint did not onboard correctly. -It will report to the portal, however the service may not appear as registered in SCCM or the registry. +Windows Advanced Threat Protection service failed to reset health status in the registry, causing the onboarding process to fail. Failure code: ```variable``` +The endpoint did not onboard correctly and will not be reporting to the portal. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 26 -Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable``` The endpoint did not onboard correctly.
    It will report to the portal, however the service may not appear as registered in SCCM or the registry. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 27 -Windows Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender. Onboarding process failed. Failure code: ```variable``` Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
    +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    Ensure real-time antimalware protection is running properly. 28 -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```. +Windows Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable``` An error occurred with the Windows telemetry service. [Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) 30 -Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender. Failure code: ```variable``` Normally, Windows Defender will enter a special passive state if another real-time antimalware product is running properly on the endpoint, and the endpoint is reporting to Windows Defender ATP. Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
    @@ -211,115 +216,24 @@ Ensure real-time antimalware protection is running properly. 31 -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```. -An error occurred with the Windows telemetry service during onboarding. The offboarding process continues. +Windows Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable``` +An error occurred with the Windows telemetry service. [Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled). -32 -Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1 -An error occurred during offboarding. -Reboot the machine. - - 33 -Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable``` A unique identifier is used to represent each endpoint that is reporting to the portal.
    If the identifier does not persist, the same machine might appear twice in the portal. Check registry permissions on the endpoint to ensure the service can update the registry. 34 -Windows Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```. +Windows Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable``` An error occurred with the Windows telemetry service. [Ensure the telemetry service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-the-telemetry-and-diagnostics-service-is-enabled).
    Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.
    -See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). - - -35 -Windows Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```. -An error occurred with the Windows telemetry service during offboarding. The offboarding process continues. - -Check for errors with the Windows telemetry service. - - -36 -Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```. -Registering Windows Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully. -Normal operating notification; no action required. - - -37 -Windows Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4. -The machine has almost used its allocated quota of the current 24-hour window. It’s about to be throttled. -Normal operating notification; no action required. - - -38 -Network connection is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. -The machine is using a metered/paid network and will be contacting the server less frequently. -Normal operating notification; no action required. - - -39 -Network connection is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4. -The machine is not using a metered/paid connection and will contact the server as usual. -Normal operating notification; no action required. - - -40 -Battery state is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. -The machine has low battery level and will contact the server less frequently. -Normal operating notification; no action required. - - -41 -Battery state is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2. -The machine doesn’t have low battery level and will contact the server as usual. -Normal operating notification; no action required. - - -42 -Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4 -Internal error. The service failed to start. -If this error persists, contact Support. - - -43 -Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5 -Internal error. The service failed to start. -If this error persists, contact Support. - - -44 -Offboarding of Windows Defender Advanced Threat Protection service completed. -The service was offboarded. -Normal operating notification; no action required. - - -45 -Failed to register and to start the event trace session [%1]. Error code: %2 -An error occurred on service startup while creating ETW session. This caused service start-up failure. -If this error persists, contact Support. - - -46 -Failed to register and start the event trace session [%1] due to lack of resources. Error code: %2. This is most likely because there are too many active event trace sessions. The service will retry in 1 minute. -An error occurred on service startup while creating ETW session due to lack of resources. The service started and is running, but will not report any sensor event until the ETW session is started. -No action required. The service will try to start the session every minute. - - -47 -Successfully registered and started the event trace session - recovered after previous failed attempts. -This event follows the previous event after successfully starting of the ETW session. -No action required. - - -48 -Failed to add a provider [%1] to event trace session [%2]. Error code: %3. This means that events from this provider will not be reported. -Failed to add a provider to ETW session. As a result, the provider events aren’t reported. -Check the error code. If the error persists contact Support. +See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/exempt-icmp-from-authentication.md b/windows/keep-secure/exempt-icmp-from-authentication.md index a60e483753..21100a9674 100644 --- a/windows/keep-secure/exempt-icmp-from-authentication.md +++ b/windows/keep-secure/exempt-icmp-from-authentication.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol. diff --git a/windows/keep-secure/exemption-list.md b/windows/keep-secure/exemption-list.md index 3ebf7a465b..fc0fd3b704 100644 --- a/windows/keep-secure/exemption-list.md +++ b/windows/keep-secure/exemption-list.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you implement a server and domain isolation security model in your organization, you are likely to find some additional challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all devicess on the internal network, yet secured from network attacks. However, if they must remain available to all devicess on the network, not just to isolated domain members, then these servers cannot require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic. diff --git a/windows/keep-secure/firewall-gpos.md b/windows/keep-secure/firewall-gpos.md index b264a38993..229cb2a3e0 100644 --- a/windows/keep-secure/firewall-gpos.md +++ b/windows/keep-secure/firewall-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 All the devices on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters. diff --git a/windows/keep-secure/firewall-policy-design-example.md b/windows/keep-secure/firewall-policy-design-example.md index 41310314aa..8dad2b48f7 100644 --- a/windows/keep-secure/firewall-policy-design-example.md +++ b/windows/keep-secure/firewall-policy-design-example.md @@ -13,13 +13,13 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In this example, the fictitious company Woodgrove Bank is a financial services institution. Woodgrove Bank has an Active Directory domain that provides Group Policy-based management for all their Windows devices. The Active Directory domain controllers also host Domain Name System (DNS) for host name resolution. Separate devices host Windows Internet Name Service (WINS) for network basic input/output system (NetBIOS) name resolution. A set of devices that are running UNIX provide the Dynamic Host Configuration Protocol (DHCP) services for automatic IP addressing. -Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016 Technical Preview. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. +Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. A key line-of-business program called WGBank consists of a client program running on most of the desktop devices in the organization. This program accesses several front-end server devices that run the server-side part of WGBank. These front-end servers only do the processing — they do not store the data. The data is stored in several back-end database devices that are running Microsoft SQL Server. @@ -60,7 +60,7 @@ Woodgrove Bank uses Active Directory groups and Group Policy Objects to deploy t - Client devices that run Windows 10, Windows 8, or Windows 7 -- WGBank front-end servers that run Windows Server 2016 Technical Preview, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) +- WGBank front-end servers that run Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) - WGBank partner servers that run Windows Server 2008 diff --git a/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md b/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md index 33727fc9f4..0c507fdc73 100644 --- a/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md +++ b/windows/keep-secure/gathering-information-about-your-active-directory-deployment.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Active Directory is another important item about which you must gather information. You must understand the forest structure. This includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where devices are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Firewall with Advanced Security. Review the following list for information needed: diff --git a/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md b/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md index 65555cc782..67dcea5661 100644 --- a/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md +++ b/windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Perhaps the most important aspect of planning for Windows Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Firewall with Advanced Security solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project: diff --git a/windows/keep-secure/gathering-information-about-your-devices.md b/windows/keep-secure/gathering-information-about-your-devices.md index 1f3b73fa21..7f4692a95a 100644 --- a/windows/keep-secure/gathering-information-about-your-devices.md +++ b/windows/keep-secure/gathering-information-about-your-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server devices on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned. diff --git a/windows/keep-secure/gathering-other-relevant-information.md b/windows/keep-secure/gathering-other-relevant-information.md index ca8d396fcb..83ee00960a 100644 --- a/windows/keep-secure/gathering-other-relevant-information.md +++ b/windows/keep-secure/gathering-other-relevant-information.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This topic discusses several other things that you should examine to see whether they will cause any complications in your ability to deploy Windows Firewall with Advanced Security policies in your organization. diff --git a/windows/keep-secure/gathering-the-information-you-need.md b/windows/keep-secure/gathering-the-information-you-need.md index 3e8a62b0cc..a11fbf67c8 100644 --- a/windows/keep-secure/gathering-the-information-you-need.md +++ b/windows/keep-secure/gathering-the-information-you-need.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Before starting the planning process for a Windows Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the devices that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information is not accurate, problems can occur when devices and devices that were not considered during the planning phase are encountered during implementation. diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index 542e85c56f..88a3f076b6 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -1,4 +1,4 @@ --- title: Get apps to run on Device Guard-protected devices (Windows 10) -redirect_url: device-guard-deployment-guide.md +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide --- diff --git a/windows/keep-secure/gpo-domiso-boundary.md b/windows/keep-secure/gpo-domiso-boundary.md index 22db5273b8..00fb043b7a 100644 --- a/windows/keep-secure/gpo-domiso-boundary.md +++ b/windows/keep-secure/gpo-domiso-boundary.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. diff --git a/windows/keep-secure/gpo-domiso-firewall.md b/windows/keep-secure/gpo-domiso-firewall.md index 226c9deac1..d1349941e1 100644 --- a/windows/keep-secure/gpo-domiso-firewall.md +++ b/windows/keep-secure/gpo-domiso-firewall.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to devices that are running at least Windows 7 or Windows Server 2008. diff --git a/windows/keep-secure/gpo-domiso-isolateddomain-clients.md b/windows/keep-secure/gpo-domiso-isolateddomain-clients.md index 0f2faadb9e..a6ab80ad09 100644 --- a/windows/keep-secure/gpo-domiso-isolateddomain-clients.md +++ b/windows/keep-secure/gpo-domiso-isolateddomain-clients.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to client devices that are running Windows 8, Windows 7, or Windows Vista. diff --git a/windows/keep-secure/gpo-domiso-isolateddomain-servers.md b/windows/keep-secure/gpo-domiso-isolateddomain-servers.md index fb984adf5f..91cd4e3890 100644 --- a/windows/keep-secure/gpo-domiso-isolateddomain-servers.md +++ b/windows/keep-secure/gpo-domiso-isolateddomain-servers.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This GPO is authored by using the Windows Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to server devices that are running at least Windows Server 2008. diff --git a/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md index b1adf33fd9..092982bd0a 100644 --- a/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ b/windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Correctly identifying your Windows Firewall with Advanced Security deployment goals is essential for the success of your Windows Firewall with Advanced Security design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your deployment goals. Prioritize and, if possible, combine your deployment goals so that you can design and deploy Windows Firewall with Advanced Security by using an iterative approach. You can take advantage of the predefined Windows Firewall with Advanced Security deployment goals presented in this guide that are relevant to your scenarios. diff --git a/windows/keep-secure/images/device-guard-gp.png b/windows/keep-secure/images/device-guard-gp.png index 0c2c1c9d4f781bd324882c2aebf04fd3ed4a7b8e..169d2f245be210e8306e752823def4470bd97d10 100644 GIT binary patch literal 47736 zcmb5VbyQqU(=R&65ZnnC+ya3i!F_NKZV4LP-Q6v?yA#~qArLgUySux?ojiHY``+)a zd)7MVkC|QF)4RI5`d8L_Pl%k17z!c*A^-qDkq{SF005xNAs;t*XaE3e!K79l@&lBe zf|wwneB|9eqycLr@L2!=sER~-`UZrw5v;|(*Z}~j-G4q%eO86~06;T}gs^~;v)1vm zS0&Ma!z#i`(%jh#J9kaX<*dKnOHz6=%5CPHH|Hp`Plyk#o*o;uFNVq~Twc~EOa~$| zq?<8cC;h>%auW*Z!l~!*5@huc(XI@VD!G}Y!KQmYIazSyrsCww{^GvIgRV?)q{mtz z3<95rQW7LWtwt+;^L&X{ZaDF9IBjV-cr>wZD~+X*H8e2D;8DJvDH}jy<$Ldbl}nO; zwYd6n;^Y|uMD+(uKK?={MEiEM#JvJz7&Btt^Xcln#xpwJ(C>r{xg4yyIM zmoTLggvY!Dw2C0K_p$HVYCCQ7d{)MyJXu^tl^$8GoJzG?;Q&`nJ!!N!9^1STznr!# zoOf(QdO1T|z3c6GPD6;m+4pU6%!)2il!6skj6B=9WaOE`zC6o6Y)L?djGZwfzhXty z?SPPLNMk^$1K(S7)TytB(4pvg=lBfm&re${uT3^Dh!uqFGMVi^TcA)lXWp5a9r-r2 z9a}W7BB>0x>RD(`2vR+D1WZiMtXfwWrn%D^p; zNsgm3GIKA2YRarn@3SbrN!S0d@1)!MGMp3Q2<3)i3;Sk+k1{cDLh9)A9@+qB z;rY{aTXP1I?ZKB{{1gwIoyA zw0W02do+Pqh$;PlR`b&V3dpa{7LT?S zH(9iW)gntHvwL&#-X2Q1$!-T(6I+2?Mb>O7U;r3h1I^&yip{q`mc3`l$JsL^4eT}RmtDRemDX@gV5&tTv{$SaJYz-(l;oc!!ZGR6R zGQW3@RfQxY$C$?3l^7VOW`O$+*Y&AqD_yp#M4d{hBtHU&*Hf3l-6z6Mwy$dmDplCw z>Mq2mvHQoSxjp^wwiwe|n7 z;6$7X3eX80#ilY&9IesVoiIV29ZCB&D`(3cJaN*hpulH2_!-01;4>yZ(3PlHWqZ_E zQ~(JgLzROMm#_6o1Qf3)bS?m5JERdcNI8VN%KRE_%cxXyk2TDywK)1uk>NrhW8gc=>g84?s?!8{VJ1JRI{3KW#JpW zl&2;vuMI({{F6)34dI0`umbgG1{w9i+)dT&sFR{Y$Q>LQ6Km909N(q6-MQ)k5ZQVg zg}_>_5dF<1f%b?X3ZBxmK6wX5@7CYuB%A=oo<8ahffXvb@2L!TETwVPVz+0t zKrPzt_~pzns17^5sKy!>@zx#$RW(A3Mz3avm@A zg3$K8o<)S7p9Lkrc~fmPK|!)70j1q-Zn7CozrYdVsclAA1?Un(o>(?z@ZdgUo|f2* zrleDH_bB?85_>-=O;Szk=Z6yQXVYe9$|sn(b@p=_oz{cp6KCgU}sX}tpexkSd(BV|bW>l?()fG{Ve~^(M<{Rw?QWM0TLqo8H zUeGy#4o5Ff+sXV$`KoRIe9;ovyFXwu-bD62z!J;UVz{avkr{$Nu&RE1Df^5{_G^gF zKLnJf+y$_}VC8WDjQe*O9&pe1L70Q)5O9lvPu5e%LQqZ1Jw2V)Ecg#!_EA!rWTBhr)X16!Iul%HTGf zC4Gn~8m+E|lh^~WCUVXt(4RnK77Iw4iKObl7otn+3O<8%psDHHC;fvyNlG=Q4%}>$?!1@%3N6 zx)~NLL-scV25;@>N`HwzQJ|ah#yI%6ROWsQS!l94zos8cy@0*!)%~CVi?hOAWqWDCI7f39 zxAeW?P{)RVz9v7?-1w(%qCF36deIpmwK|THnOfC7Y+zF{n(AfaT8*U9YWk#s+_CS# z*6;OWB%_|7{`j1yQnDc$%0%*~$-o$JwpkyM0&k7b{)Q}6L(O@vcgvb_sRXVZbKGV! zd;*us)g8hKv=-`#24#h391#<~J=^3qJ05(>>p?TE0JJTv%`|C8mdT*PX?eM@ z=W9AH#{322ehkcdj|wa7`if#Qr+0XAD-EJ8l+?KOsaE>RR+s zM+*+Z>D=BY&9!CP!Yp>}R%#7W5Vow5@D> z9GX1_nL~v%m$^@PRSQ`~ZX!Z82JLf)N-im}6H?u1M9En8*W&O}I$qC>yJmhqChA(v zIC!I&@n61}rKBCYg|@`Nr(>+ZYW<;~?Lpf^`BZ4-AhG2m(RCc|yvmm^_cDHBPMiw^RZ=6xuO60c!AbY+s(9{1 zqAwE80dXRdq>#Un&#}Lg{QaA14R!k#)gl{Kj|#Eq#+a)@vVEq_aa$ zZ9UoO=H%F*gRroNgdZCb*iw1>yUZ;=r^)7{-yj;dit}bT`;#m$oeBEWl~l#6m)HJn zrkkazQ(2nPl4w>FRVLireA^>okvx)I6JZA0-ix!Td@&ko88aU3`+&FwDuD*o~SGt54v z!>Ge)tZ$zI2*XE)jzaq9Eear|z(DR=T0?1$T2Fbl=Us?CSKHfr#;4o?2DPEi=<$~@uw|in zudR+4AR^4c7!|Iou@ZGy!q1yUCXFN8HC`LW$qcFnIcPPamgLIY!FWUxx|>4p-@yrf zHs6R+U}QgnYQcmRsM15fVC^ybGtYZQeN?VX#vDow*7_mRK-dEk21DVx?g#uqv_F-B zEm*d6TZZpNMhpa-+$#nyjpGl!No5t zly2rmr)ejM;Z~+5pV~*v!)WHX6CV;s1|?2T+;;Cyg=>C(aDwNOa8n{JJm23sC);l{ zSRaV1r^kogHAY`*=^+<;2TQ}KnWM45J8;tkm4Fdu^-c{H00-4c3V{9R+Xh{!{mxDL z)<5BM^M&-P8=NQl*fgg@xK`aHUQ`Lu!;to4Q7fyXUX=j9n6Q}ZHb;AJdxj1t01p=6 z2SDe6S9yI@{ve7LkNInrTc#ss*87d_Vl>9!04%K9AXM4o=~y9?Ya^mgY%#)v zF5*Vf&Jff8rpv-}cEI9*p1f^y3*>Oir5gRFn(>iE&9q#6xP3V!$=74e#(Knfay! zzEoge>dn_ZF z=Xy$!4c>9|D|=$2GmV@2*gQf9n^Ao0-NyG6jzLn6xt#_RrMEkGht<{4i;hz+LYN| zlo-J0ef!kyIBNrj?;e7#M6?EljL8>i$cPRSDL*b`6d!iiXX{}l-j7&`)VSvJK3pyr zp{PGGpQS8D{4;~k`d;NFqw#2-0Dodo4h61zby}Djrg#g5e-IsB{>IX^8O-rIAhvgM`wkQQ(cqb6;Vd;mLQLPBQpQQL zCAR?NvN&T6<(t=lyON^jA#3Y6gXD9S6Kqs(YV!EJvKkqEs**L5Ja* zE*Nf~V5IYBhtK`^wTau^&S5(k9c&$MH$WX?36rrkG}N)Vt#b859w_&dvf$6^W+oMT z*$U*~!=5A1AwLsl`O;1RLu38$ba4|}*GNYeFEdCst42G)@ua2f*g{Ld1%o$fFh$aZ za<@R_JOk{16-xiS6}4uWt=6|2q7O3Li4&PQ~T0Kl?|G0^Lly)TEPnl)gTSd|ez~ zv2nLyoil6b&f3e#o%SKoB(3P7RwzcyJ-JWtWw#veUU1yw;JvEfj~&o$f-iCLaTxJ2 z3K~z>-q^}n*oTjK-j+<;x5f%O`A*^R@na6SRB9)>ERvH6-RuJ!ck(bSF3JUQ)OU&` zAnJ>xa=dl&w@dgbGiypIx=#M$#1z6Y*2mQ?{RUzP$0(5`u#O?(xItIDM_WBxJt9r? zOCGIm3Hn1V!b(?y<6jp(xE9ved>S)`XNOI-dS&pw2{h8k0H8xma)3LN%P&bs$=J%d z7Y{GS%;1!cq;@ait)`~Oe&#k}D?#6wK(({%%5|wzz{XeN*MWy&%!kaE6xt#Y9Q{l( zLj4}q?EFIb@W&duWeQoQP_rpd zkvOXf#!BpF4%?=ur{GW>Aj7AO4@6MD7h`hKGR1hF3i4+%z^|hy%R=!=rc&u*N?Dqm zLnc#;Fucz(;35++7N@CY=Q)G@hclOK)~i0|qI+oOgr&uK?e~@~I&;YhrN!#~A(1U= zsOL$KWPj7av87PpD<{w(u&ITF*Z)OvPQBkFK#nJ6J+!CYEK+<*)?NT2rGji0&4A+k zwKeW2N@o2H-C&ivC#XbZNj$VLqN8XGvK}LIKX2|Z>KIh$eZ?2_WXx}gG;jCk`ufyc z_XdB*+H_{_U64%Zhq!A=o6wC8`u@1y)L|wMc>g_4h~Zp+kt0dEV13hs&2wywj^RTD z>9lb^hj$_T&>z*;zw1Xpf19!@#P8Pa*J*7J>H7#T8U#_HpU$5~F9&@6E$92(Jqaf& zjx{${%IuF(l$hVn^GShv^5I!5Me^cB(TV!|V!zXeAmu4|k1 zh50JW)n?Emw{4RpZ;D*V^^piNV+<4uVFPQ!MX!RdLdD&>A;FOZ2A-ylooAB(*4<0B z9OEvv>!e99HHWFe*s+Oz1?4h+-DJc$orURrG~(dzndibaODvo6yTGH9SoZwaxpV)5 z`1~6V#3qXbWaUXwmTsRpiz?**V%{44OeuT6>r!;aIb|>9#}}cN(of41Vvop8RYG65 z7ITEb%OS20HmJt~Pa~28FU?tP>pnDiL<@w($iCy*ZR=g6|1^kU6JYg#egGZxtG=zr zc4O_-%r|uTzbw3DBD4}ZN%z7N1gvi_iiT7f7iDBz&^6Kz99>zDCq#~x` z_qK@ElDu>twik58Y`RXCuJ@pwwcKWO^IobWxphcji-1V&-$WScB*DkCSpj8-UM>040axN9f*>o)aYRDqoC`e;TNwopV(f zXVVqLS{*NR&#A4qZFJ{W1MFLEd#XQMwnt@0RvFurmT+5a+PQv~r%@N5s?ucV&mcU$ zD?^)FD|ya_bL$!z+eHPt+&xyj^V}TuI(y?KN5ulYr!)@sWNgovb%#Z#j$Go9Em)E= zPJGGj*_R7r$jI1>i1<|eKEj*h$bDMarjUV<+sz{j?)d21hu{cE2xYH)_8}4t{FI#; z$){6hoonf^H_+mq`0AkV8vi;i@8@^}P4YOmTXA}_I8st^(%~q+7}R`uP$Elw(LoK# zTIb-M`?y!m(O%cVJZ?8ft`XjP07ks`&!{nh260yV*4IWg}DsDbLA zreh;oYu9foCg9hkE*iAJ?iX@mfGVjXA@V_{h>#y_2q^|(P%=p5<5h7pB%SNTB{&ZYy~`iB0^ z@d^tx2)@1smKv-0uvg#K)AnI7oN%`yZKv2IaU!j7nJz+3{XPf(9sZ#l*~tR@o!ILh zNl^@{?_@#6-tv-n$MmAi`VCR~@`v4P*wy}%cS9CC&W8;MVczYPs5l$t;Q+4lV(evp zN3gaG&ga=jRhd34>f3|UKEgYB@&Uds_&ub9--``aW)%k@n>=M5R+2d#*sB1CLUgA| zcs2Ep&<{Vkl!9CEpeX*wRV)-n1xA!#TP+CDW>yrSiIRaX>E})1;bhZzP+|7JI9R}r zg;azAxVEokM;r;Dq?%XE-cV#QmI?(lepl8J{&O>K^jh#AK|!LO|MR-xjUkXef7isn zT_Zrw*DA0Vz`qoU=3EN*KUXH^?MYYI?ahd^ttjvlyir5&za%ECMD)(DhKeRtqbtFK zqRle?1&%$)R_;{D0wb1m+BSIwy!>(|=aHn>+w66@N6Zcb+>ekJnH&|_<3qXa_WvZN zl97=q&I=jXO3SzH@%2oO4nf#lp^|F7-^q7NIIEm*tKPoW-=^R%)KIh+7V8{{O)NYV zIz9d3)FK0Ry1+cnNKH$FJZPxuJQ`2VU5-_vH_lj8q%ijxY0h7qQ%tvGc~8A7X!ACW z(tLN=4y*W;csjr3FiZ=bcobeOY!Bu{lWTwXeZfAx!q^(liA>q-23es{Od7@_Ke8d7R%#yO9D;0_08v0up+3c2KL)@R_J3ec zVIc$W3uJ2(pdc1MpN9cRK!gxo@Oa#KPtUGa|}T$em**03s`F}0yF=N5EupDj;oo*DA-tP397D zbv>Qdqo5K&nG49cOP2z8Wx&uZRTyJ(HA=EQ80cRf=;Sh=KZr&$M|ejIJ)hyfxkldb zw()_u3j#6kHe4&LF^c^NWIz}IhN3g)9J~dwuBP*Hc9Dz1mHSbD%O^dAV^x9=x-EcCr!HH}ceq4-XgLr@Zk?b{jl+GtI z!+aH5Lk0w8@l=z{9>eTjdJ^kha*HjcOIk2Dr;V;{!maZyYQBVUQBB_`JYpW_ECk+| zlYT%Y2B}^8DEc$wa+^q7F{b2L$kt?cn*?u0VDR2M=?39@om6aL!CapP!*8pYSCQdw zsBL99$&7tX*F*K$GxQir%5qYSS4-ptv6FtIqVbtU)_q4TeXdZ6G$`7u(} ziT27l*||JmhKdVqV3G0g0bkx_Wl!2O8H^5^gu=RnC^vP|c*`K%+er>oXZ2LO*Bj&4 z`;upS9W(&nx&mV=1sR@z6|gQ8D7vC`eBS=a2GY# z0MbYMi~m><0|lu^D=v79!qCI>Qk+kzw3CG3m}kRld0aMIV_2Bp3SsqQKB$NSCaVF1 z|71~t2tLCTH8i3iH9d5d&Mljbq|z=BJe&*4e=QoSn^nei+J6_lHa>!nDY6_Ht zd6UZ#rZEWdW`sX%7ZplbCpe&wEQf4z%Z_mI0c_BB(pGjIVvUQ_g+=}yI~c}zao+b#U#X87NbL(=c@=u7`;UIH>)2?W2)BZ<@2}`wzF$^`x_of0u2|7)>8PV#~9 zCVXQ(vGIpT5xCBWKBx~le@)^t0+6cAMHB=p%HOPQX2jkBRr;bL2G}m?@rZbb!-f;) zjhX5$x|{C;+uz5GOO1<4a=bJXJ+g?@AOgBwxwj*D!4?H?MvHYjjubB7PbSKm7>oI1 z-B<3i?VqM`=4LV!Q48RRu(H)j>jOwpKN{WvI6tim;c|Ymm%OfN5aTuijY-7Uc9NWo z)83K{572tWd4b$hxSoWyyEx- zjSb1DCLyrNSo#MxyfW<2cMFl^a&6FCaxCIoJL!C0-DGqKn{Dd8Tcv4yvAjx1>&#z3 z?=SrJJ-dSQn&LbJ#QA_fd>s+!aI@rtUIOVoH~hgEs0}5N;*0QE2PQ)#(0EV!WAhSE z96C5?h$avPMkmHQrH@ACG%5LyP-R*R zfIDzaMU|vRsOGb?`GG>=z!?d8#AsSP;`A$qD>J2d(xUfIO zpG>}&51Nu5P2hG(JU9dTQPh1&YnJh=v8q|I5{Pq%1*Z!>%QM?@a|qlfUBIA?^P_!B zV{npq>s?b?uJAjkwE9S_dm|pYSrhwsT&gOL_%PNpkR}owMO^SSf;) zwo}0N8B;EkCpI+Vgst)1RVp~A64|{I%Bh0Bw)w$ycOQQ2S3EW%1%GHG{YVHBAH(RP zdaKeKzuNVVxQbULnguB-X=j!syGy!_VdLzU9sdr#dIEJ;-Q5qvI;rk%~B-07= zfIYj8cUEoISXi08POV6viw>04kqB}$Aqcg6;7B4>rEmJ`pUJhs!a#JMy_{9br}4dz z8aFx;F;|08*abmn`)a&~!;$)}{HCJmC0pG`cjPh>o{Le*n4ZwzuzdXMo+B!gqzGe{ zPv)vJ78;SuZ@LIn4{CItI@DX+0`LqKK$=f>gY-eGsLBTIQW)Q{zNUSL-F%X+qQoB# z#U$`2&wvu;r+_>kZy_k`vZ0?ys_v-igoh6<$p2F4*1Q-&gUh#8mEe+Q};~*s~@6DU+l*l41P_C z^n4GoHenBJL$pkWm_zUaRgZm}(q0SBS%vo`ZN%OpNIf1{EHmxIHd$f*M;o021ek~;r$OUcUNbn z{=PniM03dmw0envi8nXpA!lE_vEi)+9&!<{DlCQ7S#K}^5XAROG$&*28cFN_zP7RU zKXPJhRKpq0gBjozhUO#v*&g>UxB2t=&47_)LfKg8$%H3*k~S;Sx1t%lD8$~(vigcb zGg@YmNAoT|NmQ>T_GOh@3ukDFmc5JxBYJPwvL3zzBB0gjL- zKTVS7NSoA2zuGD#m*p4Rt-V7Kp6x>B?XO_)krB+I4~AHh0yR8RHK_+BC@v_qiA>$@cG{P(cE3>41>B_@$~mJvKKnofA5Es9*|*3Q{ok zH9JBMmg*f~S$r|Z!11IVn_vd1T|KA>g@myUNKNzyr_x%^>%hl3c)&-=H6Q?wTbc3f z4chB$$K&!YO{`h$>)oyP!_RfF*Y;Va=IcYn%3YEH3?N~YnUgv_mVL#!TS0eBfvQ+* zZPx4J)ayvB=udpw&d zYYU?6aQdKpv$fKlJ#~NGkf~9z<9j;+I!o2OLKEm{&J~(cOUt3WY=-Y-C;2w<^q*Ez(gXv z(SSURyl@a^8`}rp*ZaW7p6ucLo&LD$;{i`x2sQKZKwImYQ2KQ3`HZgbF{K}JQwYZ* zD_P&qelnhO#D(Id!gqDk*IO%PyfpxRZTchN#uJV9+NLiTM7=wzuSb5|uTQ+MR}>wW z`>LN|xdghPH2`zs)=uc&RWOWz&be=lI@&}4Kp3Vo6rdNi6#&qqxrCnFmo>N2E_tHJ zHekM`={3P(v3ngfQQ`6Gz9ABDd>woy%zr{;7vFx$J3l;O_~Ku$>qu3Kk9q)?oTkxa zs8?mTB$AP}N(8pN#7)hC1vI_BhUzUU}3SLfz}(^LUV)Tj3aH-hmsk zN}FvG0`b2v#g$+=kc%V{?waHpY$6vF;riE8=^GZK;*zDksUlBvcny_aAgnE$Qa*<^ zmoufQeQSDSVq-c|S5=b>mS1=8w;is@r5;*9-hXR3y_S7%C`(n2g~NDu@KrZlotcU8 zOibJLdGypHnR4~12K>A;+wl->RPOma@PXtmyMTc^ON&3zH64wq?Y8EMJgQx$90slqHL zIp^|A zrPK2E;@UolW8+$sP2X7UO_r`098IwXy$TO54_zRAP&Fw*Y;8+inD^Q~`Fr z-tG$uvT6f0Ym+kadu4dN?5GC?wJ>(v?5no~1qEfsAAeVRnoblK|J8AIHofbVNwa=( z!dgA%&uTf`xh(LJ9mq&}M%JWH%6`jnI6b@SdL19BxZx6tC~kH7 z!*V{P^O=y3bPU`CQeUuU6RMW)o#-w_SwVq1-BvD%o50AO%{oFgqP!(* zK+mH-Pw6uBQ?J*@&vdJWlfqA5wR|2`skg=6z>e^Gt+cbwMO&^8plBmfZ>SP(;y&u@ ztqMrDTsZJ=v_HNjZ3W;Vv$2>>)j)h%PY9MN`9*z0+vl3A56>(#^GJ=S$9>5ZSfgWB zJ43Ullb68aZab6=BNw4&z8vp{vKr7My){Lbi9fX0?0jM*X20%et_u}BmMe~7NC^y9~rEjDoNIW zoz36=tPM#k>;I$yQNdR}+N~A`*EbcR%X1WxnG~q6xX%A!Q*r>jiWOX-i*wAxuEx!} zFD1F_8wFlr3EQAOQMf+{kd8ileylxx--+by&>d(P?y5re*7zkas;$%H1w%mV*dWyt z`zTcZ&Aq7Sf)n+LBM7zkK4ho7~x zzCgWeK#sOWJ6R%4u@2LH`=&|LZ!&{>!uIRE_M^f?fjIG5?)(Ds174&~SEi*8&`ruk z9jxMZahMxG`A|?+VgVi+#+C zgzf1B@BQOW>Mk`MZLIC74Fa9##Zty`oN+_K9QUk_4zgh@}+0Ov|ZYfo}S zEIFrBNW+wA^t8nDN361bRg?z^CoGO&vq##Y!pW^y3^SbEM3kK(_6x6za1E}FqaAR z1vFM9E?~2xT{#xStLPYTkst@ftg-fy2P;Tg5nNI)OlQ!~m|%)9ge4-4w-hbpb9R;h zbG$R?A?RCR=MMm5B|QWV|GVn~IU3gRB@2ccGGxbSJCW#-E}*BH0Oqi4rZ8vFfH0!} zgg6NPy{k4`z4>Gcik`ALT~Kk&(H-Ho$%g#hS`od4b8*Koa=XPddkez(5-ZToLaTX8 zb~6!R%=mYJSEU%XGRJZAqn`j#E(Oss%_lDxSyaiR`aZv#>7Ah#UY5ru6;gCuJ2CYVK~&giNq?noM>C4j+NlO%*{JA} z#q5&?g~E)V%d~c5Qc7YzKc*KF!8s2HoIwzGHT&*R822?60jq4EV}(Xluw~0>DvM50 zFkAB)_%)iP6S29BN`8NT#4B3YRQbyt_;USPM-g>Mcf zPBmzvY$nM8+v*7K3n+%axMYHdRV4X5FL-!L4{QE7U=KLLsf1bN=Cf$zNNjR|?6eJx zS^AMK#$CIKmF8k7hD{=Yu%e~&ESBc5eshfUq(P|;{ zMODYFBJloryRlA^z6bnT=;E`;bL*_YyMTZd(AJq8GF+aNB~gfwnhyQ>V|o;ekjn?= zs0PDhHVYTb1EsujY!u}WO2-TQ2!lDi+DnFa0Yt3)!i?yP62Cyf4WXDIZfHgTKwxv7 z8D%aQzZ0ix1V2QsH#|cMs0DBqT?YcPcNMydV2Pc5s&#|}{o1p&rZ1~_ zt~BV*pgSiAkRY!Oaqr9iLOMGh9Qg8iw7VQTZH^c{VhG86fZ_b^Q)XV(SrNVjP2zQK?x$6vDdNUdt%2aThE=LtJx01r)7q^w1KN36_V?y%% zy^^W|Jc5x18fjg)`2<)+R{AOt-la`nM3N=f6H#|tH`y;(B(Cf@mcX z_6%C0d_*9u(mJs;X(yP2kMW~0f$Cu$W$n!89p#!zT!05;VN|pwy$A56)g!uX$yHKK1yr6AxF*#oVMf-YvIi z2;|x@pP14s(G33(SL>Lgv1wsReVw8Yw)y^hGyB}>T7j_eK#s0co@>7*Sjh4dxj!S{ zfeMv;(1v?_Kl^jPugA4q{Iq{UzW+_k$%M+0uwR{Ll)vc>^j~Md!I+hs8Q896H;6lb z{qsV{t@&4tyr}wvXxrQKsHvS0bmADu-R;{cOV(D^>5ugT# zI^R757(c#+Xk`THiY*43iy@f`FB5?wwWPv+^Ggp>PXUbMNZPm&)I#*>U{{~Nf(X)%VH-bRI+wD@_%UAWH()rs#BHYMwjnX$Z$+R6oK@;5jelr zT76SC7V`b+`ryfDKI9q3mdHo5uV5Y|BHEVIs*k7jk$$|K%7`(Z zQC#)8K@lf0RX!sZTngyL)f<84kn`rHOyz@su>&Kyi!s@6L`Cu%d0^<-rc>tgzWg*W z_pL(Q5B8@Cr2IXyCFtJxaTq6Ee57$E2^aZ?VI5_BsFpXW7{6e8XIyZdnwv0QMxY8~ z=k$I;b#ZvKf&)>p|3sS`6oD3O!B$}GZ|U|BDlbmv@Q?G=VVA!#;8UdhlCohfj`?&g z1^VnugBvVOG15|&!;~ruv_UaSF*)g=8# zQ;L@3#L#}W64mXz&*}k`rKG%czl2ow!gGq$T6TJUYaL{ToN`ie@1n1k1uC;4Xt1X9 zDM-cbT<#hc8_l1vrCY9!eUFIioggh0Fs+v8_8d*_i*1jw7~{avIf%WTkicH2SRk>| zqj7AKU2#(y2l1AyQMu2JFA!EaxN{2&D+PBk9ea|S8DhnmXEqC}0R%;Xw8z`7yv5^1 zzZxH!C}^iT4hLt~Dc5Uj{gG``e#<3T2H4+cy}deYlLyz)Oc~hLX~?sEyAlgEbg+n| z>!Ubm;O+YHktz|pLpl9w($W+3Ha8acPVNMF^k~UH=BeQYF_dv6?|`xSMujO>`Vbkd zEKH>SwFa@kl#a^^MCpB~?6{VFV{kbbf-7gJHO?GdXZLg1VQZO8cr+v_XI(+xR#-PE zkE~$(lR{_3Hg7&uyi6cvEy*kiZ=&QCbd5^VG`*{)smb_y=?zTLE~vKl2U}byV{XON z4imi*z5ZrDTIGkgy`uL=}#>poT`@%yhkZmQ?JtuY4g9ZC$xPk_MYG3}>L2 zub4hrKIrClU%^9rD<^@DJhYe9X((gVKg$h|rtOhumF-5G|eg9t3o_E1R5#c{ZF&R;h26i~u(5zqwK; zQW%goF_b(0LX!oNe;bBIW-O;|Si2w>)?)jxq&34Tz$&ll{VX`_H<{&>{6sn4Y6WlE z@72-R$VT6QF}%vJYrtOL3@NIN!Mi$_XTC^{iXUd<=0Ah13d}H4*5sKr%vIaFG8`up z19rUfa7(>`ZQh=@FEz3WAFlJ?yuB#O%iRRnE-{$ zK)(zr1J9t5l3LK6jx+rha7j2^w)LZt1tzB?zoOmC$#Lv^m1$I>Q)YE6a>wn8exCw6qrUVbnbX50{YHZ5 z2vS-Q6QHp%rF41tko}GG|0Ci9+F6wZ9&Mf>_X;!WWTIRo&S4HW>=Aa{Pi~jDAM~7# z)}fb~=qfza%PNLze%*-5gi}C0y8XV1d;9Jhra}8H3d>Dc?)Q;%0Hd|ie}Kbsbw5Lz>&Anx0_t8tzkj5m?T zv-7Ek7iA?MOktJ;fY(@nz79Wkzbiy>(Y01^p1K!<>MJSEp!Ebs^A&EOdEh6-mV^ls zV}4ZqFj2Nv*G_OS7N1Obk8N{$WAJ!klR{9WWQ5>0>TH^1ISDh;)<&O%a={Md>Y(Sq zLEx2RwgfI?EmcjRGJL8D+Xexe`N0MKH!crx$2TKS_7lTg%GB2ZwRGtJ zNuR??-e4qh$l7EbDxsCc(UfWW46<7op{uTOVT&GWmy!2Q6N#4a*GY`lV9URT= z+Mr*{nB}zWxc_UWm(c25E%isLo%GWA<3CUZHT;m<&&V}j2{XtX>wMP}1Dv6I3YE#V zSmVieb;c5Pi7bTr^HGo}@_6DCX(5kW$$sgpAYWY9zVp|awjpH@tS3Pg)&YVrgTtLH z3~RsLQ;Dv>C(p}Lg~IWhE|1#C&Z>(=`C|5^sm|>Y>hCIAakGvcA8u-Q~(KiRTTk$)zum4)=E>&Xo=d zCDp^(F5iD`*#EXjx+Moj^47F;PKz+iH8i=BvMF6yr&l!*`4aFlp^B)OfS;(DY&Bv_ zw>Sq^!o@1OP|<`uU&#BOA$&|IBBVC_2M6<1f8&B8gUiq_Bud5XXu-vj(6X$$LbSi& z&QDaNwObh*M{uQaEk`_Xe1QI|HAoPB^OyQ6V_={>>cq;Do{HWFddJ8ztsW=#&8;X< zAus_VfhC>TcaympBphNrw|;2eQ5_+ z6^HHb_r7&S($sDjJ+I>i{ba|D7u`JBqqDcPdx+6S8YiH+`w-cjIIg6Zm_YedCrKV$C z{*pBk?^ZG~Ad)JmjQ7FxU;HLG(V4(5djB@@s&)XmvTW~+%J0`Hm%#mhac){L5fHZy zY^*Id^W7L_@Bn<7{;AiW5&oOLj^+R z;iVdzisp=blLnp9or+DkLY`XU|3lkbKt-jdTtv zp@5PCD&5`9(9+%A2uOE-2h{hz_ulW`_5ZK+eQUXJX3jq6?DO<~p5L<%w5{6f&%EC| z&_AmPL;byIn^y*7{J(sXI|Q%we#@aG-vtW`{Pti2kWyf&bq|Oj0V!n*fC7aay#Ji# z0*XANp&ch4dwbc5)w!yTsSJ(TIQiN&MuRKD4jOp~K&s3UNR^M-639%t_w0~zx{ zNh*&cdLl;?l(OI><^=sCBOp_E|7i>~QG;~oI=?%(CT3@!{pU9FYA_OY2J_JI{$X*i zz-0e41&VdYjY;0KfgI>lxr0;s#~ChiS?hjA7b8lqV^LcXWLPTHBmwV^uE)$`BeJ>= zzS37gCDQlylXWJuW5SyPpSO1jzGj{IK=(p~&hyM&r|aH1 zg&wGm^IQ!-C5%56=5jKX;OZ6*-)*XZAJCXyZ10@SLrAW7FO>HMabKQnW59QT%|j@P zp)U{X6H;Mu)U+~Y&(uOHnPNB~bIo);nhd1{vsc?r=01U@Lm<89%COT%pr`bAh0WU} z;J0F^^A_af=bZ0FLe`&G?dF?E4JXrbBA(^W3`S$7G^+3e2MYzOSLbM9iG z8S1&YYy8sXbi&Pvi4aui{=MVb`qxvRJ7Bw{a$SS&Z7v)1{^sPI(|UoHcE4+kfnZD4PN zn}&*^4~L59J2}Vd{+B$=&o>LQxL{(iFv zX_;)+s;JDRr7Xdyx(8Jt3J*k;I_+cX!4UmEjU5}=vl0F}i-Dk)rc6QT`W+tC@%Bta zc2K}Jtuz^qM9&AYydF{{X3Qr~KoAOwJd*ZDr8S^r8{PSf>mTrAxcg>Mhpx+w!T!R{ zhV}Fr%S~Ix%YzLI7R(j0id7_^;$kto(3R{RyBSp@CaSNY{urz~#Xg!uQM*EdSaJqH z(+IoAbFn861W^V;MDa&$QOP33+h+FSKG|DsIfRjdXq$!eG1yW20~7rLcJ<7;9i`2k zE(hqGZP+DTJ8@aL|Jpc!@7nR-46J>hDzhN#w$ti6IK#AiE@c#&pJTdDE7$&@Jv2eI zSjNcIf%=7{$TzJG4dPky*1B5K9&5=UmfcYyAs}6IkHf3DDX!0wN@9E|meJfzIdF`l zHKn}z`1p_<*^6S}15_TGxb7$>e+1?~g(O^;$z8=WR9qkNyX~FSAJoiwY)y{%BGxh% zGhhXQ3g6)5BX7^#)REK|U(8}$c8|fY9k9J0%K!2b09lYD0l7qc-2a@U4yg0G>IH%H zBJb*7{|NAZNtQ>rcz3wX@qW8*IX>pN38Rc=di}g-N0KUkno9zbZOR);xF+Mga=3m# z<&U~XvsTrQK9x5RE;=2f`pG|bI_v?JsO*$1gZ3mpUw$6dDEGo~wf>eC4XV!k`H|Wc zJQ%8HWgn|x{rw?!Sb8<}6E6G7@4X%pLk4&(^63uO46GGH_pHfi9e4%g0*ug5-R5TE z-h^PA)YnyeT6h7K<&c89Lp6drFWJWv8?KpC9qSBVH;qoO7?zQ&q)n2ixk)m}cQiGM z9fhM@n4gz`GnB<>;=(9Q7>2@1WV;4EzE?z5(-(mV4UnXYMI~)E+RoG&{Q0t;xz}LS~i}gfnXjG>y@81uUso`iQplN{EXKWyOp6Gg>H*&!)cJufzx_72uT(%{UcwWtU z?j00pI;PGe8BkX;ef|OF39zKbW{)lS8hTDGhb>pWAus;Lo?XqTvKleA_iGxq){BQ3 zirPk>_frIYp7;_4Muo$3A16*{3$eFN{mN{mw&Zx`Y%!Vlc$6DKC-D|Gv364LzH<#f zZCc|$iHD!Xlbo&Bh4CF+V%+SO8;Uhe&r7Wx@R60Ak!p$Jy(!a;jrG&+{!rf`5t}=} z`2{Fq52Nxh&TC#f&6I%BVDFo-3QdQp?bu&4xKl>IdvIj(p^hH8}!1ITgSugJKTl zAT`|wQfi%l}CKmUsYrx4|kiu2dR17qxP^5qYDr ztr9nvL7mH)mPg;tnQ-PrhnL8oF^*&G!UE*z%W`sI4w6VClOpAh%)dTuhPbcfUCo4L zL7lJ9;;o5@x9cw_^UUGh2RFNUa&wC$lfy1ISz!{>HYcky4+=0W$M)ECj)!@@^K#L6rR0p=W7yQ#f%o)7$kUpU=t^PfK8H<|$511Q0a zIzN#gp_}xaVd(1$&%%yQZ!IW^jbF%YfMdAM%Yf263e-YC(|rgo^*Ae&8)BbLGt_q8 z-H@tb;ZOgC1EFQv;y*id7)d(Y(MND32fENDV#;+Z&o0TJN=t^EfS&h1igy$mfwZ@b zR(YI7_Szggq#Q<(4N_9l85A9;eLt(KH%1!wL{;8r5j>$<3v$68d>#jNKHAPRhY29u zFp#WC-NfH=djC9!i~k787SWAMMac>>ox0u=G^33*aGY<+#v-6KTIqRkpz99>Q8c8_ z*iyuhp#V(XK#FdkiSL7D*%t@`d5z}A^gCq^ZH4@_mcRHAgt`mX;~p>7V#~E{vTX(5 zF6!g-IH3%b};1B+D48X?DU{GT%-04snJZKd-E>nAWx##l|( zOXrsIUA?*O?8(at8=h?bL^63CQ$CXs^;)yT(((j+zO?c+-x;9=tcN+?A8DM!NY#A| zHX_|EEAZ%HHF)gd`f&WT%vdcrWD#eKtWb38Sh>!Jy}Jh==>EkRL- zArx}{Y^Q`K{$zeO1(~jO8L~hI9^y^?cX;EFx|;G;()BWuKBGLOYeaHZQy@1`?o^gdx62M`7NJMe+bZ|Mq@ zjhlFgy~-NzSgi*njrbh@p8sVFY4STAjs?q)`r{wFYKROLohLV;KL3d&*LhkMvd9Ui zEi}c(s7oh)z>WS+1)!Py!tEYw8%VSZ33QS2UaJS_o}TmfVF$V^%S4B^0sw$uynhWG z=5x&Z50`u5xnNggFzvdAf~(1bk?(Yr_GN39?mFsk5nNj2m(RZ_h?C-h^o{@`05>S* zQ=%>M$~&%J$+)3j8-dsavr#&+B|!L4|4qWq?{rVF{!+po$eJPieZ>Du5}`YL8@?gJ zXqW_GF86C2ivMx|NLDwn`9t(>4<%CAeLi{A?Vc_V=fNZkM4v>QX??rsqHi3Vv| zLl^~n9FlpCE(`cw7hvt88uVKwa!+vfeT7OD9tc2@OIhsrP_}0L7F7Jn90eFb4U$E7 zD)@6(nvARnB&>9G|K<^kjp%pMREs)tOr+Tr{orKDfLzJ^Nx zgya_W(@$uh2S5q*QdIFnq1;R-6wpdUx&$j_jd_~Ehw;`O;6hi;`^$QDUf0O1N&GOz zDMGI0H4M{}+Dpb{&qit`ZKZD97g*daChHZhjOn!Spslpdb?p_ASbHwOT%AysB)C08C1acR6W z4eX*9h3Z(=CKD^&viwB;bA+Ox^d}+?^5axXA#O$UzUApzi5SA7=5?V=S`~CW{m3G( zZrQlfwIg)oMI@8#p=i$1z>(IwCUuwPTxdgEoKeEWnSB*>S=ov8zG^>df5?*Z` zaISpka|tS6W8OO+>`3nz8iDjn7Y~268Cmw7rDRF99FORzQp-Cg=JKOvokr5TE=_YELbnxEu`420}_ z$0Xy3723@Ux?>|0DGcw$cfQb6UYEeIPipZ$U(ttIqnPecdN-5D{+ka#9%7WTtv^9GKM~3a2DQ*>J zZaZZu%6jzA&gInk)^w+L?ylT};^>yCD;C~^ZokMo9=uKtSysfgXcS=V$C!n*&2EH-F><17Q~%;N)yH*=)ghG!rk6M*XM{T2jZsDL%V574cwE_$_a1*$!` z{a6c?w~x6s8n+kPMI5XF0og%~+p8oS3N!&W_V0~`*8xlopw(Ug&gKth^lrWV$MgP$ z(%m^|6_y5m`~-MEc{0lxm{8EYFS#~_Y49{$^r;amOJc!K3i_R`QLZy@bg&M{p5_Gn zrsXGt>xx6&C7#|9_%giUmr4TTa*R(~1t?~A0VUL*;oQ~H6Xn2z$Nb&kPxc}xGK zFHb&xk5+FOMJIUG0U6f0$kW;@57qZRN_r=X*&FAAAXzf@iV@_O4Yipkc=sjq;y&r%B49C60D}EDoZ$Z& zeMsmu%xZ!;KRMNHYP(|LMu0H^zz+xj`~a-j8gDlNQe(*ME(k8)oy~aBEo90~q+B07 zn3{S(Z*B~iu%u6q8z0oa7;2WqwPl(tCuh=VQ4VvTbJP;IoLv(ll6=Bh4mW>5pG7Ej zH9Fq$;SEI!g0nZ7{4w}qs29;R|CyTns4ZVJB#=LDRVS-T{B6Xfxk7cRSP)M{o~4X^ z>W4km&>xVmyiUD}4}tUgaUd2$-Af~u2?3S4$~^NX8tIG*3IJMY_7xI5{GBUIQi$GY z^!Pb1y}1vb5-Y_(0Dh|Bjm?}8NQX{TY?1=k7E!3N6g_AdUos$_GHIibgO|A+50NAU zX%V52m5VwxuSZiPhxB14@>LM33v^u-gN8%cO@i}Ymj`@gW8X6KD-Ltci&ytEt!B3{ zi10VS8=;BwNWId`{f@?KpSQ7~B8qEGmQugIJ{Q)abLMUTG6g-IcbM{b9odRxc}02q1B;>e&~BgNhbN^k#vdvPM&X8U z5Z`3s*&=1}6r>zTZt%3DzSpGXM^Pb1`QFw+N>x!z{Hc{6Pa!iuRi2yYh1W1=G2M&Y z@r71T2K9Cfc{#~QHupfk*bNBbV|1L_27eng_N1TACQX@8Zed<#LAFo*k27=x%J~`{ zMSLkQ*U$*b9LlIemyUaTW50=2SeFDra@~yr@*=ZCgV>TOrsSu8>B<|Yrq@CH9m72& z`6m_lTd^!t37*_X*U?MBh{@=`wyzeIh$gZSOS;ZO+s{0AJpI-r-Il!lSXP1ktsS94{b#VjlEh$xL)dpo;=!~^oJLp z=nYGeGt9J?*@ueE*-XSLz+F|jn_Lqmqn(^YdVF+ogsvZ%`WM2p#>-RQQlxmNGx$ug zXQZm|iB3R%re>JJ;)%TV516IhCL#<~Bk9z}%w{$iqb4$?icC9Sxz4p`KeXdL02fu_ zEw83kkthz{U;J$HePEQkHC_w~@whZDjJlGyeyWsq9ILtPz5|zJ@ z0jTB2zR1D_*2o%P?QJBq$Ib}-p*4!4vG=QctX_jkMQ5W} z*(u?t3?SJ|9t#=OJP*&{SHxSm`x#*(&-sifTBZ8B+a4tNHVL-pjDCqD!$AJ=RE*}n zwJ0%_0nKply|Q!PzK`ltGzchZ%GqjBZ%c+2q$ZebAD2~=r>7rpVmN8xDn@gjDfk6X zr%de8n($iB>)k!_0d6A^5Au1+!C6ZyFH~;VDze=%W|_0dsqg*kS3=&}p~%~>Q(t2Z zUZc>l-e=hbAY?-TmMp;oDE~^{(k23$7}fKFKR!Kru5+khFG&0Irh4v6M8YUbb+M$x zpwr#r7Y4$@OxYJKujRl3IzH1>sV7{p>^D;99@61~)r=S|1l93+4C$a0iq z`(YfOQ$^BmH2}Pk_TY1eHS!E+jX87x(Bp#Oh>4aVBuHbNk@!kk z9Oasg^_IjbP<(QN84J{;GE-I($ejk2{s1Sk0LOmZ1|*>WRX134NOk&&V{xtqqjJ+i zI|s=(oV8xoyct*5wqtQHP5P<4Efc+d=6olwS#Ai0LF~@nS6d$S5h8R1HSQOZR*VBS zYY8jMm+OM~F^n;LOcgyA`nw)4ne!>aD^i77Yu1TAij`O>Y7)HmZT}-RY)4xeeU}q9o36@46-s2t0`N$5wf7n zLO&q6^KvGNeA~IA;(36g&+_{)3>BT72a=U;nOAr6dTSv}4#BM9CfuFlX$yu+VVvwD z8SYEL4ucs%tnMhx)XfUl*+jG1L}i#EV=qUG8IyIayIGft+GI(v+l<&$ASy(&BiSgi zZ}~Wy1*v}S9(4)TCvW`CR_k*yj8Bt=_hVT3G`jK!S}_h{{IyuV)GUdcPy0~gW%=gq zKU(em7|a!>ryomV+;kUu*;ziqY8H%S&4-d^PtaKATGGhW_BLcs3sld;)N2+e(PLHq z34ruzoMKKUnq-*-IF9(_h*xA$T`K6G_hPI~LUSme4iucU`1BBwqZDDIV@0JTN=je_ zANt-2Ibb6bU*P?G^etNGrmcn)!uW;o56|B>ir0dee*IW#uD3kr&mp{4jpQ=1~zYucJ^hn^<<1mQV&eTzZt5>`Lw8Za~;iX$Zm%GUdpL#LdTDQH;)NnWZ&iH7&A3L z%@`zXhAhSX9RH~PIk9Tp^!2e!5+h2PxQPAfkYm(A`Tm64tXHS-kb+wkwclj24CY z=M=WTh~axRf+fij`-dd9<{hnph}vHFS^Aq(YB=W)d6^7?_koP1Bc45NK(Gi?=sP?I z^H$<*kp6mdBmR2{IOQDbPQYCr8A6MqNFM z%d$ZhS%}sD{9~3j9yK^zYvZP>&?Vt*Ga&X}RAhGb?^^`LlBn?1LE1K&>UucLA)Px} zM{S=&2lPL2G_87sqC=g%-}Dy%iPYx5-++bQWYO(4fNDOz{V{kQYghq?S)jTnZ-HIA z$&5!mebXJK1f%>Ypc_XeH0I=cdZGKQjYs}*X}_AAYS=%z`xEJqI^khI(^*uFjdk}6 z97eko`bam0H?L?&8c*^?1h3yu%_K`7@Q=S~%AF@%QeQbD%8OZQF5wNJfv7XuO)Ge+d45|S zujTeRVydB)_urLjjedQ{NJSVTdcoOg?zC(j_DSVzCL!Y>F(N;NP z03nZQzO+=tm{h`nDRf9^Cg4|~|Ktycq8EFJY*9HY!NsUc?+Q#**NzLH5-Id;J&QLJ z)=F+l-ElmyE8@Pht3YP`iu)lZ=M44nOtpz{c;i8l;RTH7$Nt|;{()Bt@5lG$UZo_`l4OT{qwaHn-V z+O7Fm0{!$|g$1*Ki2V%<^_2AG1rpZ`M7q5ED7|cZaQ@**NAs46%RTOTx0v#(xQKuN z|C#ZlzV39IH%HVit>P`H;o-FD(a7`}1V_!t&-77}%)as~#Js*@l;Lc_B3T`o8EkG{ zw>8Bxe37WdrhaN5c&_>~{x#km=jONdczpwroEZ|_{N=h#89Sjzlrl|++cVh&JJcqZ zgQv1@$AAsTZE0JVYEHeY$TgzYTo}SS_qkk7of%*WZMxy`E8|Jkk;5(~_OB>(OYdKE1{73`x*StH$A*@s?++2#I4ZMn#KoHdswDw<$j zt7(pdy?KE!;4r`;`u$%au&9Kpb9#dPB;LIiXDq4ec8|OGEjGYPgnipvtj4hCIW>Ti zy?^I>H*|p7?!Q(h?;C}5NM~lYWvTZ0uOSHi=zl%5U<7ntOLyH9m&RmPQHUReEm4h4 zt;934hb41jU_SV0Iv+owbH?GA>6&^WRQ=m4SGmy}SBt^u=8luHHJK!Y^X4t(fS&Qj$z}d?$i)v2u^?UucOu^<%|gm1N{uN)79U-!nnPK?`=gwvz`0q}q+%P%M5j8) z%u%0iG_c6)0Id1d2WKdfNkxb*zX|tHM<54HC3O`y&yxKgRsm3ZqZsLCG24|=(=!vG z^;UPjgPLWFJXl8{{jn~h2#bJ{tmP+YWg^REa%4TuQ&$9I-2tw%U#}C#g*ZxF;%mJa z@I!J!bI3UgOwfx!_)j@m3GfGJ1iuZwy?48i1(xn_oDn>S=(K&tXHWlRpY+6w8k~VT z+TTpn-OAX2{T4@bw=8BQ0ANkv+c^Rm4rRb9wgXo2LhaS!j=#|ys>LM%%v~|_RgCrZ z2U&N|tPqnB>`OQAe?V&#Xvd60f(tYr8xQge*h1J(q?14NKGVNTQgL!#R=oc;Kq}dR zU#7c6(PY1vcbQAvhxs?)##ma<#~FAK?2^A@ZEg23?Oq2uJS}JcvdXA8*{?o9P24gu zTZ0TAgCpI?EL%&e6enk3^t*lMjFLR^D+BP4YUDlefW?+dYgS~v*O$o@o~gm_`+ zP~bTlAf-j?aPIO}_*$1RU+-?y-!Pl6_`oLw-jIWGHPWy5X%%;^{VN$QS#?%m;Dp|n zfGS(Hr`-$6rf;Rp!W7tMA>96h2Ls`0I;3CFd$5ZGa&vezsvutyv(?85IDG(@>=mDypN>V`FlIs;cpm- z-%H6~BsSC%sv^irnPz;M>0+rWvQyE~yGb3&Y9**4#@Eei_jJ7dqt;S_lA-b|Uoua{ zayIp}JPlm7fb60`1oV@s`x-giKDULmuHgeqy-60x(*uV+sZpHB@!4iT$jAGdfP%;^ zY->!Y{4x|_KcSND*B;Fnf0HsNb2#7V3oN9gvG)A^0mjQ7_>MooBF&`$#OVtW#N@oU z6?^&7a+JZsia!7Z;}f*|Ugy;wD+7}wd+zfSj0|*IqgfcR_dDte2zz`V+z(gWM`qum zq3O+rlA@d;)sTNu!~Ib~V4V-m1Y(o--oRWsbwIR0o*Dlx8=8pz=L#T}{`)|C^nKvI znXbV4?|&6dAaw)ezWYOgtIZ?57bt-iT8~{=5BHIKa9z_@60EU~WKO#yYyWbxZdS;3 zDDV%$pf(Y7VaGCk90zaRc6ym-q z+qEd*lWPx>3<+2$daYK*H$d69(21tI@7s6rwKYqx@ZEe|JF)vi(bNagXY(aL)ytAn zN);#KG&5y+jb8#pxm7EkHn1)EfU|y+{iF%9=Ebb6lo_uo?sB>Q*mr8N;OG^*$SoQKE}WPNZF_wVozJS1hPR*U9j8CzrYbX2cpP zuEge;rg}SKOq(mgd9J8qa-(u~x-j~uyh-I!MMp(xdMxzpcZ|vDUq3}@4D|`9O2Tmn z2ogRXj9s_y1w!Y;bK_LvLWSy+NYw==^9XZs##SH2?P}36R22o+y1BKydIeOSgcBPf zxk#;qA?y-OA1CowYjCTL{^(b32^6&H^;Eh%83B+$A?CGXzFBc`b z(r7xg^p9!Qu=aVAK zS?^gUM$lT$WT*3fZ2>9Pxs4A0|GRB_MB4#i`fReS;d z!&{;{P!H$li_gYOVFCHll(>qMb#6{{edBFAkp4Jv-sISi59ood+Z*)>6-S;4J`gQy zd2z1gj-~M$5u5RcB|DXTx1ctu+P(T?b*Z$K{F?DdRZVLxnE-dCy$|2Tntt;^?=jHg z-vZ&}5$sFtrxON${r*Rke@;P^XX_v={k$Q4Cf3#yW7X%ae@_9z46HwM{8k4l*w}WN zY9i+!8>$SQR^AkD5fdy(_DB|2%GZwGIiPt&q^Z81Prv2CF|tyRf4G)9+8HwVkZN`N z&7Dt1^RBA(qL{KwQ0vM39K7<}B)ft(tm#-$rpnbCzOOw`y%Ozf#vE>99YnLS8!`xV z8@&EALs~Zk7Xgl0v+zgF&6?PI#ATQ(bZTnxHqe=L^ex4p%KNY4OIIE-uH3^rcj(6* zzF4jgR%a;~Iret>B;sO%vV+y3xA2rnEsm)N(zg-r(7WQePG(1^``JpE+yRnymGpe2 zynY|T%Mf5>vUe`{nT%ctmMoOTm5cb6tu#T~82Z;r1tXbM?goB#8`#U>b^d9P@NTGo z`HH=_sm`20T_O`pVziW~Wrb)+S|9Gmi52@{x<((t_;E zjBH@Tiy2&_$As4Y`L`Vp!~$l76UsZIK7T|Jz!Nc`6g=HOgA??T)0nbORvqk_YQkPQ^o)I~cy%W5da&Occ645)p4V)2yred)+7Zf%f>Y*imr*s+XIFgHCdNor6dX&;*yGZFZUm&nzOT7fXiR%w z_E@osu?W!B#k@SQVjCCvGhnh-z&)<)+{DtArO*{2_>sD0$H_rsk>2mps8@~eT`c>b z1BQRuqr0Nd@3D8elmAw%{nsP>_YnDiylf&+ETcdS3A-gk4+)Wqz=v`j*}#ou@2ykc=AVFaO)XwNc)RkI5C7u6LQynLn!$ zzj_ESB@C&YV?F-aB>uKs^J%GIo72+HarHl~DI={m&84=Cxv^z=Py9xbv5Kf+)8>&b zyg5DRDd|R^rh|s_hN4ytw;n`3enxAV|5y&m7cLvcS&=%s_2>^3p4SSjyr_Mjt?@eV z>~d*z`;7rJ)e;L=lW5ZyxqjM=JhV+9)NE3j9K=#}Bntnd z?CMK3z9YA7F~8^Wui&$R0LbLv{Sj$)H-!4;ZnY|o#a4sV{fB*zyU%*39}Xwq&(lxP zq~F?sw=r{u5qEW)HgaTnh6X0vQ2#Nf=sE(P8in4mI*DB-S{5Sr>4#GIwCGiyhlvcjert3A70r)D%IUt-M{ z$90K{5An%%;&vS~zr~Bws0$-9bBc@1{6Zc?czBl2?k1%ZNy|}8t0|w!+$o-5+ftos zaVe5Fo~lQa=82RjyJg`oPXwD z@)qGtFNjp){1*>0?h%;PU`XI&f?ADSZ4M8+<5GrGbUY)C;fyN(P%p=3dMRpBv6QS; zg5<9cCD5L@hDjUHC&y8HlB+6BIzcN2boHAoFB{VNu{ZdAop)~&ib4p9= zyhmz%Ib0@*-add0`;SPpU4YMzh+`Y}MR6X>vCo>)eJ=In_4ns1WMyg4WY-(DYpN%8YD(m_azx0o7?4JQ}P2F^oKR=?A=yv=f zZ@PNgHKHB2dzlqGgFBX6%H%nVmy^FyiGgeyt;MQ%A)lvTzFzX8-|x3SYM9p1yB2$Y zbn$$MPL6-XekiP>`upbEajj%c1sO!;oBE?GnGyVBBtlaaM#bDN$Xo5i;6G=2?L5@C zI{D+*{$-5y8gxL1|NZBGQR{!U(e`=(u7%m^1rU_pj!!}KU4&>4cz}n;NsEGKsS}G;Z3gO!ep6wm>SZEVHqm5Hj1htaLZf@_UD!j%mDlV zz%%6n9lcVm*|$I}hkH7DS?W=M$tVoH?XtRUfZDJZn(E4s9XK9dsrfnpL_!U~HjVja zLgj3+vgy%4I~cUmt!iXm#Zn8J+X)azU2Jt1tTxn=*deDQ@J&bzXoZR}{c7TLCTdmd zc0^y5fWk`}mlmlP^6BRoDq^at_uY4o&jm|Wb|2!Bp$wEdom!7~;C--KFF6~fd` zL$c2Nv%VMK1FFFXoU3Md&r>|>yy9Z=m@bx&N>Sf=(l5`{lpvDjuma>8{rtQZ)Wf53 z$&w(cc5kK`m@tT`fwgg4XGKFyiTMCLaM2=?phL=CLq`awkKt1@rLcTTRlpEE~#oIHM3(rQKQDFFqOn^8*wp%z^9=nToO~mL=3jN<>0YHWFpXUbP ze!(h_f%MfTvP^H(RS7*(Tx?E@8Lo6G*4>Cd{a*hCe>M*3zd0tR0A6Jc`iSNSy!IN@ zkSR!e_m$w!*L4Ea+GBsWz84iaH!sgi`mUN-E-#NZ;ipAm+BYMFBp0VYtf$Y9uKKRF zXTs*(2TBou(+kPEk&&(!^D15*OO1KXlia}Jw?KaQ4aQB_&9;`O{XXovtOIsEakF-E z*_twj0oxf^Ai0chW~sA1<;A$(FFDaUi_)#KY6W9hzfgL!GmG8DOWtcQ7OzY`lzOFw zfsrshwV9#Nc&UFsZ1`ht{Q8&k#7Qmb?2HV_z}a&W5GWe?`Aex0lMc<>cb>GB@bZ?H zc_h*P>isA`-&en%7C-{u52%1`tR$Ro@0^p|oWpL8cTU5uH|&5-HYZ`Hu&bGqo5T3N zIp<9Z_~8z0K@IM*vUaoRv{QHa0X}Y!QJT;Auz+|%QyDw5V>nZSNfggy*DM%k&oTOq z($6j%3aJ8s40uK!LI_m(SI^!&hCJKMZ%DYA`0>)_I^$-o0=C?Avx|5$RB<_SvoUe= zE9=|M%+315%{>2E)Xgzb!r3-#|CIM826ixWlfZwbHFq>=tW$SoM{<>ko1?h5@5z-; z_bBaac~o4)S)2@mt3yZN2X}KpwMbTBVyX}5fe!3xxVp9B@+K97ACuFe@4@cs665Z# z!_Ae81NCCBjba6vI}+c}zqT{e5^2c_t@a;Y^cs>d&8Ll$7NW6p7{)*WJtej;GjEEF z#;E#DNqYNJoO@4RJR~*p16zA+tJ<4vrCAyx(Z&eh(6+*R+5J`ap!^IrT#p#4%W}~;3PZ+#1nm4+V6z(Vjneev>@Tq<6;-cJj*i#!Z~kwDo*<{XQ+M`-&lhCZk}w;zjvPhjSXbLF?nJr!Y6@^QP~v zR75Bz(j<70x`^0%+q9xJyo`)lka_3b-dk4kx*7!|l^z$zIf;bBYNO_Qcx>CK{RB68 z{O8(HFkQFxf)*I;e3GB++k_KRZTv}&v}8#euBMgqXQ<^Q^2kb3ss1PF?ozz&;I`nD zkJyu5L!}DhY15jLv66*fCX)PyNW~SIgk0}WeQcE~=itIYZW15O?H{j>qBO-y<+PP+ zX;$SfAg5Q)6gT0DmN0$!_1A0TI@{}72+z0<@GfjLA@6NcoS#U3;2Bdiq}jbtr_0l@ zo73&S>+T=A=OZlFn{#L9WAMG7FptA^U6}1!Cx4CIS}zU%S;yRI$Q;lS@p5l34CW4l z0ZM!plc$coy6eBXLT19A<{#%p%0_O^)c&QPgDl(d+%#iaa{xKeXyV~kD^?k>^#kR> zV3H6^4+s7jqoivD0-kNOR+l!j@Z;DwuuR-aN`~G-QfD^0ts})r3E|>2T)iOy+I}KG zaGjTYBClmq!_LiU#@y-R&ed5R%N)PEKP>fhuHN?a0sL$VexwyJcWQTj(o^u_tgE8_ zGKAl4%b0(^8{>K&L$ipwSk%X{yYXOuxSCH{lAiLNIl&Y%JsT=3WqQ|jB=!iaM@2Id zecpxH3i@H$QT_i!9vnlybX5cydg)xU`YF0N9WfMVFTN z<@Mzn(6NQswRh@M^@w?*?A#w9?YDCI`52hXjkzxGr7z6k)W479<#neT$z{zHeE)RU z*wG1oO_OkX4!_PSfSu7Ck_aL6Gq_(QzN0`y^O8*xkUZFTjm29D`nA8G+aDL7HN*D9spW)i>YPtbsO;HsUQ&^~)kTkH+K3=|~o5Ha4N>ngNtPI;c4M z9h+R%FZ(RjLAPQIK>}V74&Ng2+&P)8I>-vR*_czJ-PHd2$y~x|mA!iBdmOsSmF~Y1S{&IS1#U{1>B1rO}%8 zPFDxIBZuyQYRbO7jZ|I?ZsiNKFvZszjp2xMf0K>i{%PDvIczT-`O%PpeW&e(YWg=t zM0c{7&<@4=SV(bPPy0JzgxMO0tr&iz4@J}WPA_9F$>qqaF=3~ZUF(QQ6~Pa5s)<<^ zC+-`<)+0ESGz4!?y`G6@`8DhL#IPoR<=|G&kOA0xPU3SMe43Z4nZUic;8l|Gf_g82O3>^$_vSD1kt^V1S>120@UKs(k?u zP>5>cf;dy8lOxzg_%rl~;0x0Kk(K|Se1LbEi0%Z-$E~`n9hW}0Wg<#|&aS?%bDmFN zAtQ|fZw?zXJ<|0szn!}P?tD*ra^xKCc=PB)gD3Q$;tP{{Nrn!Bl zbjxuwQHX>(dm`-b+g%9uEr>1}RH3{^#OHy6? zGI;6mU6DK{2kyyWq~qYH?%;qy&(BipwWR?#!HxnXx2*AU?AAub1B+woWoZfsh#Cce zjq6W@%heWdJ2HEBE_>mZUGQN%Wzy#>(Jx7DawvAbm0!$8hN@N9wv9q(@3Ay?0N#0R zWwKO$I!4x%23>-A+aRlQ!hThIJy$Ww;=v*4@BHL-PoZc?lRK!Gu*)B?CveWwr~>yD zbKMI9ORgJpU#p@A=7@jB8X9M||B|22a=H%OLMN&B!ytXAF7|IxsAK>&blzGF(AJll zUud|%f`Sv}b~Vu-TGiDn|Hu!l7xDku;dL^chIo|5f8X!98SVU>^l6Zs`=S=$@8*un zD+Zzm=`Ebu7WCn*T9-%-q5P0an>4+Uf6W3o2~$^0r0XW=N%$xCw#`5^joxPKD}VoQ zu+F)s3hB`(R4bDABow!A(7pAJ{&L6heQ>T4t-Rb1|LIZ30=&F?NlHev1(^>yAOFYm zeolE0zV7jZADhFED{hYGt~X&<1w+w;lh#E;ij#r3MSl4sZ4QUin5u!^N!b;JcjT0gE#aL@0PE>1@E^YsAqJ= zqqr=T*IBe0i8Oe72WfESA2;4h<9Hlw=j~qPL|vSG8$kUduE1FW^F4lghW*X}Df@X> z4W#T*flokmt^8l2YfRK!lFKqN!FP5Fi2o-z6MMv>MX7wWuI^7kmR)m zoZ7C@AWV)kE^^u--V|*NzfLcm=6Q-PD^*Ns@V1B#g`=lRM>A6@t=?Hx+=SB#FQr?{ z>NoqnGE7&VaE8y=H|vazBBYW+@!`X2^nMTO@4+`>9oGwVYepxz1F_( zo^^edlhvYARB|CjS}`SWg|VqwGo`7`ht-^QT1$q;EtHTNr*%aWqZ`VlJxqPLNYG(# zm0doZ=ZOuwaIV$~UTCK0Fen#T{lE2s>QXS)DA=E0o)zL9V7XDXH|uNR1ar@G458+s znoZEmBqLL~xc?xKv!8A(q^Yo^}eL1YOF)PZn zBj&8FTQ=dN3Q3cl;-#rU>eDpJf>;b&I#jqL)RL?v$PM&#@4?6SeOBsxLAg|(RUtV3 zgs-0A>@t6uDX-F78^RX+GF_7>N;@RZ(bxz^A=Im#_j^T=>os~o^efICz8E7*NjT2be zA7e9XTZ&;;cXr$Ke}%jCfE4nWRKN`zna<)6gy<_HA&{yBKojDZm@hmygad^nmnWVD zper+VdJd41nTvMncWr|Q$9_5__bazbs(cB36)zZgKW#mjCr(MdQRRb)f}R73G1G>}L$7G4s<7zjSz{#gBVB3rvH*)-xQDZY z>h)$GPX*NA!#Gd&2-OQ6@lNHu;QKqXqe<%uP{K^m>((&g-x(%|!N*TQZ1 z0{VYC`|hx&zHQrp1R;o00!Wn>483<$3`G)(p_9-%1f+w2qDT`$5khZDgwT5x1f)m@ ze@GP&M4AF(K~MqFw}a=Lch0%@-21-AANkl}v&&j*&N=27bFGC1>@VhAqB-zuhoeC= z71_}L*Bq66jsKd^>N~=Heh&kiNCFt+(-GPF_N)|8 zc(q&$IV}+N55mL4ba&b7 z&2q1NQBE`Hg#XA*UPHXpoC?5WuxN_cEFf?>v%rq4zkXb5JW~^Gyf8J$2gtj}re?fB zU5630bf7E%7=mKxg~UL1)O6&21D2*aOKwL{xZz2=fzHeS{~Q|AgO|V{B_U6ynOaW} z2<{sk?DoRJ5JCj8gF%(&b3zqpJ?zXVK{-ITbor2dBRPQpow=`!xEHxoH572As6{+b z^IJ)(TchpZE-)=>M{admg;n^f)}sB|Ef&^NXL&8WlIk50R~&XBL#9zJY`?z;$~j(V zIiz%@#?)=Rne(!(zn7#ytP&vv|!4WqUVmvwnD06 zdItKujJgq#vJO|h`HDtZQ6H1n_!l4HAFT&41U6ckeBET%;xhC11To6HP8%VOCrY8; z58G4Qn(AV8zt%ayoJxwaeV8P8CIl58JDVE?F`FcQN=JxO2oF|?V0{wV@Zz8NO;puz zdM;G*WgR)lDNEBPu8A}`la=Y zZ1h^P_d~v#zKQ-NZnkL#5lXGA9656 zor%Ap?26#a;55?K878VkJYR-em{n=coJwN?)|tQTn+-1S`YmEJfg0tNFf?rTUw|rq*#&0S`n>z2zxodc4;&wK*ncvm8IOKxxq`-D)QhLvuac zWl2&isS})2teNJAZNkhx&l8h(-!QzEvK(mCX7qGUlyp0UBvhtYXwzQJoW3O=zHgU= zF6at95CW+nPR%;d)WR#yfGMY&E;4C0iD5%=!?089^26Em*>#nQgbACRgp5E=g1lT! zv7wUOT?XMD-Qvbff&?ircU2tHrw%HVghYze}BPFWO_7ZBgdCMX=Za6 z76V+lIcFW#YS7$2J)3pz4hp81#uhd69fC9oxn!qq$4KrmkO-1jBZ$efzq{+2^b&T5@1lc(@rZe&(@B z_w2b992UAkWZ@727BFD($X~LkLTgv%GnrVi+(xhn8eR$O_M2HKYb#fFMNe7eG)5+^ z$kC_Q-kFdSKad@GTGi5=li>3bn@Zr#z!yJeCs3J~!KY=9qbc(N`f(U*i4BQ1TT!uQ zJlIz%R`&fSwi$=&j$Iixsz*nPqFIdYsrQMzf&**xlP6bRIr`AhEIBSgD?IY;+7Akf z1GaDG->$_x5Ac?NtJ-jHk=+s4H_V2-wIl(6(Kz}N2-fH2$gcY5sk)D z8YNqrHZF5WLM@lHN`rFV^lnd15Q;3kvW#`oDh~n{)9yFwJhpsEl4+x#%kiw`a<+ND zCDnVi;j@s(%=KdKPHh-!w0xd9T~FB*Hy~C!SRv0@CKq?pG?limy)2eFLw8@#o7iQ1 z{gU&o8$@+=R%;uZ#jTO#SXg@WtoS?Oov1*8IDAggR}me7Mu2kZ>yBYQ6%oo%kRSo2 zk$7=Hd>`I^YuEiP_;mMidxIKWD0X zKxZmDyLPEvE0UURW!FYfq_P$9i8RUO{^W9q7+ci#jpc z7On_Z?i^)^Hsza?F>|!)%Nkv=5Ri-8nMx`x7YnwpGx=+e6%x=UT6;@ctil&l+|*qE zs=qSUl9bwJTePjsZy?U@5+LwEzr?!^1wnHqTIy?ZKBk-cJ#`_&=wc9*f}oC8|nE+dk9Q zANxr!Jp!jw^^c5?{Tw7sslLXus~O1#_?*8Krf$4bC2!9H7(;GE;(X%zdBi;#kN2PO z`txZ))r#$}`=bf-Z|dD7d;%(jjh-)HV#eehHp!;yJjx77)`gh&ZVtyqcN_Z7=Y^W^ zVm^Q6L*6yUj5+NK>U~3?e2S?`vL`$z2_XXUJva}oQeoH0)o599DxH}rKh=Jd%jhzl z$)zW3DwxtiSai=F5tuN6%COsD%KJunj$dCcuP9ciMr1gz&&1Lg`=w8mHabXjOavEd z4^Mt%o7(m>e2pVrjNhX88O9}9SH>+1GMhKwtPNPYozf^fL^JdGS(H^evvxMaV!le) zVhk5j#ZYK;(Fy!QQF3#EdD7^!{6KSbYIkb|r>vYp| z1`EMD_H6N%iaNWw#vLzcRV+23FI+^q>BW^v%A1W*DR*xbR^;JR=nibb{(v z{XLpRipvjJMkplK*A2xd6&+s^2#11G`49JN=HsHzvrfhTz&iNewYs|E-_W>HfyXp$ z5i<54RRAgv$+p^x4gkJVTpRS@nQ_=Ul(Usl{1YwKMBBe|`8I0Ad<7mUVz zX0t&qBIs5|jtA2ACSKH7Ywg%j&mYk_a7{$SX;u6F?1z|o5;axaQD?d$<0R(soZVX* zut<6W2Y3-*S_ivv&FM*fn%LAb#3b5;7hT7p!%@sT9e7*b=kfeuwTnP>ZwmjMWq7Ko zArrW1%B0=QQRXdYe|C`jHWIvoUP1)5h zlMZ?6a3J{5u+XqJs{%Y?gOxRrFq##`bKqSOvyca7j?fDIO|f+%qEqvxsx-SU*XgfO zloVg&KLisvnRK2LmI-IxH5;|Xqjya1Scd!H`ltnug+^H3ibXEX&N70%JX$Mxw2C@l zuz&T_@#s!N4^zF=b*DlXshZjM4hj>*b(p=*UlJe5NRO%EHlnKOY)|Pxld6#h9D3w^O^I2%IFY(gSc7@!8StIw->^Vt zrI6rR^{CHR?3Xf-gNWX5&uQHU$MG;bakV;{kNQ3w(BH0@1_DDkP*tQ+BbQc)4JsN`ssGb4j&Y>oMkaWhD;yH5$muTu=(sgW=PQk zg-eT)8#AlB`B=k_vnDBT{WNW!`da-C$k-qLp4qXU&UNd6i#ug~|F2;T>Ni)SyeHwr zYY-oyd9QX}QjvUAJ!$PP4_!#6o0H$}>D%3!9n#6TbN&%u;QY&~IHo1Px-I@i`Sg(e zcd(W>uD`|l+xGuT{^NrLpmye7ckaY9oa6Wz98k8@Vx(e4YsA>!^kQxA;+*u=@$0%)C}n~Rj*`wX#GplCg0ut5hZUB-aheOf zt%jQP;GZ{nWd$GFbqe>>W7yLtkhqH25Ba^F(CYy*5225RGi?HY*J{`5ZlRy8`| zq=*S>6wl~uLDglfgs`S(=8qcivK2=d8u0%vUWAuu0yx;kRIwpt|5T-JJr)sKye=lb z)iiTjM&DI=7#XnlD=sMCXTxv}qGwH*W}1){cXcI_0>-%&)2>^tDro>7`1sR2L&3$vkL4czdqa=lx$k*}g5}N7>zEtjd)oOzZ_|g& z8ohSg#H*z|G>iicEZhV=q;Tav;ThLUyEauns87I$~HEm#|vb-79G*2CWdvt)(IaVA}U zH}*%67bH{Y?U@ZV#VXk*Vf z0dKJTc_FsdCbpL|M}i3O?Z6D@d}i2wR3UM_$;AybV{qEA>Eh9i{8T*0bfv?znEa@E z9sg`jXyR3)PZ~m-1C;9-O1MC|^R$I8OLWCYHH)~GZ(ou#i=F@FqZl!LpOW#J$bBu9 z^#L07Zw7gnwh zdDlvqhK~H_H=8UQ#Q2mAMs^{S4FtWnjJD)mH|)hz=>ngvS0N4z$7F(GWwGCUOSC!W{Lxy zDD{YQq&;d)9DCP{3j#_eKTQ$`M3eof6G+Q*T2;Pe2$eMcPI)YBZRxIk+QYYm#?l2W z;r&pF#jnr!PT@G-wa23M`sv3B@owc7QA{o=EFM8R79aCQ5imw%ziZQL+E!F~u>;=D zLujnh)PsJi!Ae}3+u76DxY~|52Y6JZ|Ape$geDXgsZTrV9F_icMJtk2Uu5y|XCS~M zDj6_9_D0l*UB#xl+MXKi5? zvgefPhXSKC^u+zy2NFTnceY{ZW8KDx_k-;>Z&V@5B4AF6X?L)Fa zrnhrhfA_9MD!Dx|m2jw=#gKa+EnUs*cyw${Xe3-@W?JwsRtZ!alfAS*QUF`#67tpR zSr-ANt;e}kp!zuU=oFYUO0vgUZY)}r+pbRA))+P5c|Bv%B`-S1MRmIQfTJ5nW{oYv zS)u_YCaMo+XyMBr5?9+kHRWfBV$+*^Q>&?LC?+~J@6K}nFyAev`!zvQa&1m~DG%MR zYdnt>$5g+Z&6^0>EMOo7uG(lew$O92k=aZ-pj*|Kn})~xF50TONfyi@fA<(*$IEf_ z6)EL)+R%Oin?%-Nrv8(lVvl!lHUGB}mgw~QZoeb$rnA06y?sGmvZQ=DSiHPKJ z6+-y%zuK?RScUv+a(Vp30lMOC%`Fx#Qd*ajC3voE_ z^`^ZE$ANDw33qBigAUhxtmgFn>Ih@4tKor7O%VobA4rAM4@o5nIKtIhlp z`BPbT1x4AP3FuCA{?02xn)!1l{7#c*o|K{vd;Mf-*AxsR&Ub0jFN4*EEe^`j4HZw8 zVyBtmI736+sNBj5>S;@Hu$JA4^24~J9r}n}ALoYR;%_>H$|ygrP|g3s%CBXgpMt;L85ohSOv~G*n1=r_G{J!m#VRqY8 zy28wQ0-|d`F5x5Hgw1Zl{OpPA-9_^?vlbp1lQ;X{eN4^P^1I#p7`5qxIMSK=)#Dc3 zxN6UmW8ZH=@+v}`pH^+ll|Kbl>PLqIlvWh=DZ>{`T9H)4QetilW7d<9=DfM`dx8MH z#gDj`{sov(4D8Hw2&~W56m~BNse@^LfG+R`0t)DrT(J8CiY`5P(fevOhono;@kQQD zXI0B;W3glpNMouNlkiyvxa3TilXEvDmg4Fq8Z_W*=>RX*Maks|SKka?x3Mm|0e;|M zvnt<5(o2uV@ou$RMZ(GjeGw07%_y}%`@HI8u=B^@R)E0{)c+p;A^QLU2cSXz1{Mlh z(98K`?uZ7g?)s0L?45_?)pcOuAayzg^q*=4v91XX;Ql8{{2#gC-wDR>B?QIcn{Uej zfb`IIpYq#k<=F%M=DqDI+F!J<)_>Y9?25G*s`S_U7=)_kjc4_p;VEMe+tWyQewCN% zoFJ!CDRqPLmrm>OuREWEH^XAd20DHTN@HR*N>EEud>T-q5btm*W40VDR#U8#;=I@E z+jN6{fJvA`k?$JCrDywgWdl7YZhMar5=F;t(Eq(FHue`Qx0NZ+9*iB;kHx#Aezd$W zG4_jQ(G`A?bnC&5DmTHc_#C0hzQ=z}Q(aWnionDAhBPKPea#%|rK^6dq(>p1il1hY z?~sBHCN*|sZsjx6W^8(!Nesf+<@88zU$b1l*I?uo(zrTd=Gf7y1>|+IYP6t7Def+SS-sO6eI776jUw|InZjjY|TW-hmSy`l9~jY++I}l zeQ3Kw9q)0iinY+%wRMV698fNe6`3PCRd!az>Ryx=IuCajY8OnCG;vi;bX7C{U>47| zK`mTpeXr~v*mzWei579l86V)8b^R}RJ@kac$l!#G+X{R)4pcs>4m4Ub9XL8o}^1rkmIk}|h2o-TJR46o+sbqSI{_WNq=fDb)Yo^@{ z7Kc658)V_T*B+>N0NItDbQkae68jUP)rg=sMX=qY#@iP=zjplaY6)34zJ4T?sq|_o zX;Y!?{Kb5yC)zC=V=e}&orZoN>ZEp%ZJ9A40%6?lw$O#ix)gDouF9x$mbH;_Ce2CE zZzpzrqquS0Ln18qy}p_G6INPdRJss>DjG9EBs&PwmZBDQh!V{L zwypx)JEy%}b0I~nZk;>9gVio>5qk~-jt(BTuFUXwnpnbdb62(CqFrrTk^GG=I@&6J z&c%pXA<~S+!MAT|B4-F6+RfuwixA>ioP7}WHn)XZX{B~b)VEY4F+&*#v#b?ElL|}Y zKjhLm@N?54+j%x%)$A7`7%%kM`qItMJd%op_kF?e%(R9^=9xt3c8>e~Nn*cAdkhY2 zT{UcKAr0T`vCo)d(r=aKW^!mXvdAKhcOd_!0JZVaY`Y){WhMDsFXnfz@Qimvi#M_1 zJ~(J5A$f&AK_5IuFXjNw0DxFJ@PeVn^P0-KV>e-MGNV@32`+FOjf9IA+%7QeIpozl zbeA$sve@_0=%NCf78rMa=y9jM<8Y9XT|X))%fJ&KV~d0piz~FAyv>f2fV67YJ%+DF z&ZLPB_6#fgwNmTi-aSsj#Kv&wXAh z?MGbmc6{SQqU7pkfKO9*T^k;I|Kz<}O5&6LQ+Ah6n(HLGgZ`Y*#r0Y1*M`-~*ZVJY z+hA9VA9%Ga4my}VQB}0oy;&9;kn!zpuM54%>63x*192~8Hmh%@$kDZI>|Vr=H9 zCAg-PPJGr{gg>8k;j2PZT<3>Mnm?2zg2K=Am&c24Z(l4o>8ta{_3{Qhm1M5O1B)!V zNai49^t4`$h1mpbmG4bS=H3bxwU$_&GIvH^i|?Was?6258`ohohU8Q!-!HWm$3-=X zZpB$7@9S3Kq?tx=Dr>HNkqDCIpjBU13dB6AV2Lq$b!)d4=)B&c1eVm!%9-zm7sZIITL<1d!1Ho*#5kt_Da#A6;dK^UeW z4cEpW?Lq~?^o4R(8OD5QG&4_oj;iN~F1oPaZlKe`Da`t1Gqi$w`+3DFLhKhBgL!teod>I2g|5u+(5w`Xf4%#B4`D@%D++V#onXMe2p z#emB(B;YR7@+|Z6mCd22B2b&Bf6bp8AT1C`c5QSqutWk zjnmsw5Z2ru-h0g??2{{odhH*gm$P`^a4fpSd@li2sbZvoUd{3^>1({;x7G2d}qHhx5V&|8n<=uq|K|U3>adEpqmj@ zz?SlQ{^+)=x%pjiEnlmcu0E}}A-)fD-X_fQ3LbR|-`r6ec_%roGs)bW&to8Gf^Xg+ zTz<iwG5giRBx`Glv3*U=Lrc9=DL zuVB-ivYRFVYgvZ@-M!kq2|iwq5c!0mdPMY`GKUxg=C;c@9^+=v(&e+x*tmxLq0+WyQ_C(k zbh8d4=J;Xr>Qp5^S%eBW2c~4XYku?Y&Xfj)c^>y%yI1RbXY&hXlo5@ zwwaKO(ETkozB>&SUfB`rEv~l^|Jqzq^Nr12F6jg;UV|^!2z$`|Oi(;)UfGv^ad6W+ zWIqlp%*fG2Dy$_e7Zq99>eq*kil?UeuZqhb2Kf7?xBXOqnRMMhn|D268VVB;N-ULb zm}4*EG>v>)I;5bHEo6N8Z#XdB5e}$oU&e9ysmWG_1TCtOJ;jkTen@J16MDf&xNYf+AY89xvT*Y(lW)&!UgtrBLQ3OIr>3Yqy%7vH z%UbXc^CCh_R}j8?!&CjlPs(Dy1#f zj~#X}UySB`f>zG%u)g_Vg&N>5bH8`M>F9Iy5sQ2SznQ<|h{paw>(@AoSo^CTu{AJO z+vV}UCtdm3BIP{p?n=}Dea1D z-Uw(dG*B7xN$mVMbYZpQ_*?lq+4Eh%r5zI=bB<3EexT5$ z%U8XZa;&M)+5g%er&(FxB_0`oJIMOUYY4Hc>O50TK0K}{q<=tWKv5GPmT5-}(? zY0$D-&Sfy}>OAHEnUT>q_nn}PhQFP%3H6ywwka5HMthgB$ z+{}abZhtz15r{*k?dR&w(OBSm))-RJR>>+ttY%ym;Q(xGyH-IXs%>FZUa^?uHZagH zBjOy!{@879*(1Pl_OW?HP#SRz>XGvtaRhFS>=$W|4X` zVpq=hX>zq>m(O`kGW$g?zdL^xPz(;&#o9O~MZMd!^+x?un}dDlzTo{I(iwMpSv`5& znl`}tP8D@FcI zfye4%15={Yo;QJA*bD0=O;PXC3348Up{-*6svtk2x-v7~vV29Qfs<9fU8?Avk_2eu z#8Ccibn%G)q z^S#*GTSR8WK*j`CQya?k1sAk(PC6tEL3pdq84OrAH-T9 z49)sesCaUt+Dd>D^bva{SZO~80-+!O1`dIr!jqcz|2qGYe2IUWj``1rqb|E)wp?3R zRC_pPW8%5(=|_0@gQDokPZmD+zWgBAV)P7H&)cH0GG0K<>7*Kbl$zLOrw&J-2H-I0 zUk_Z$h~&BPLMfZ3sr5gA>GIM$4Ttuv#BkN}PR=`lp;W0O=fFP(SF>|d1-P-y>8t4;?+wQHM*NPZEGCxsba_{Twg!{23bX*55lsdGKyflsp6E3^n; z6XFJRfQi2c6b+JYAu`COLb5^tKxsJIjR6>ue`+hC;Q#<&wm8mIzD@v8%48AO@ypz)CS!kX}seLX?v{!gmYEN2fTI!vg(hsXq zZOCgY{~di|BzqQp%l?5UM(BOBtQXe)tY=q)6HWksG!7tXP@L=6?DCz){&?1AABvnnsIU$|bT zjGo`!Rlg~2I11VDx%~5%KKj5jgKz$FN6jXM3?`qVa?PB#AwC|{q?Nq*)9bnyeS)89 z)swMbV733lWPgP+qrR$kB#i0+(jwTA}>v$F{xdy0X1v-(!#}?1!v&e&ZB+uG_ z02q-ko~s4b@cX-|gS)`iCt05cb6ch-ln82X3ApR;%TErwyw4&(HS5^kGp)e`4+PnF zi&FEfRp`U>oXEC|W_vJgjAl|6?0!Xm;HQ{R+tX(wyIvD~Be*=S{AD7{hmG{h*w4}} zErH17J-eH!xh*|h#H{9k)>~4uP=2YxOIMDOqPb(u9Z2kBncP;g<@s-~J;)i9_vsrq zg2>|Crd;Z}j?X zJ^6m_J56W1ceLEzI*1UH=2rBIDNra2{?ExSS=A&u_&5K zW!h%q9xDej{j(t|jv8LV%ykLrJE7h>b#*-LtY2A1i&TVaUJu8olfNX$%p+uc7P7mr z^Y&_{o6y>J*-Ic0p=!h|^yme)7T9|68U2vdkjL%TO*7y9V&4$oMR#D3cg3N_(xUCu z?X~xv;q|D?5Tp0;?@=Gmv)%8jdsdZNA;I63fL>5EFwwm<>))W&rq`X~g*0^j*v4;= zA_Po5J^*1XfSHcxfiL-$o&_=~i$e;FrJL1SlD1JRElEF9V5h(J%SQfPdr8dyY+Y7~ z$hx&b-DpEM(L}g`p9w4VJ>WRDDklw;s{s7kR8&>1>*}~>^TO-+2RTu66df8H!J4q> z%*j9y7GGJ;od;T?cgg0afA~a2^@P<7EbfD9i|WbOc!JO0>9A6As=w4cp$Mcmn9I-x z2S}J`h!VJvLD&mY3yqI+!#e`^(N}c3HECMOqS{&*M^E9wcZ!l)B_}Ujh(>DvE$WT6^1nVzV_T&Y0 zR;|PYs9~bt0U$u!IbFoImH$`jxuft4^SqsH!I@*bvCX2Cp0-J5U7e=MJ*K6~{2JGd zusz-?s|D38udRr6AS0vrZmw^Q33)Z-+4n!rxYvQEnztmZDo~Euzt`_Emu}wQgn;|# z@=if;vW{=Y;MWVpubSNU1h+wO>bVnYl6As`mbMf16*EI2l zo>U{#X|yS+JgztoPMA9~-Ws{LD&W7DQ}i%VRW&gY6B4@X?*9B$_ru(XzlL!vJ&-^_ zwtioEj^OJ^FI#CbYTt3-NZ|R@r}pSlvX$`L(`!^G9J#3w$GNoITgW=I28)yFohra9 zP_F@&Z{vTn1A>Tx!Wq5ulTX(|A~HZjMy^K^vOW~gU^q}nG!>F=5NWnVc* zbw$;sr@%UGgpgu=&!4P|7XFi=y--QZS z0UnPvo`Z0Xh@Wj@UW+t+?6a^h3E-90*+Z9ARiIbYmxi;{Z>vL&^3;1{3+av(tbEZs3nd zkTCr>+qE9eVS6Y;!iUY^744z8raB)b%BBv;4_MFBBOLKGu}eb ziUi(gw3QZfDdoge58+QEbdYxJ_V07}+pkum!zcMjGa>5vAz26A(guf=o){y=^jEsT zg?aVDaGB;G2bzTE?PQWBRJg;12Qh1n9KBH;yGV$zAPtlQ?N!kqNMHwRai~p_a@nPK zY$WnsZ_P~lUvsV(oJwUyez#3eGAk@ST*|l$@)} zxahWqh_+pps!$vujMWLbtsA3E?^hT72{N?Oc*dz0`;tiC{g>LSkB}{Wzxb#1JJjio z#H^a1uXX!6Q1K9!0uctsi4shgxa)M~PBK*%*=&E#V-@(BVr_2oQI*;T8Ea`niIX{X z(^{+4P;^_FVpbO(N5`V`oGmCo1$usB5xi2Sg6bActN{PJ+g*nyIE5nrnWLD4L#5Nn z^tTc`ZEouT4`J;?EY$A@NfManvH$%C<3K-r_KzBTNPPURlQIZP-lJvw*M!!pf22`Y z^`GK!d9b5_RBU8bA*gfLiK0$2<4XtAJD-h@AHS#Bq=U*vwheVJhKTz2o~4$_s{GcZ z_{>aCvA170Vc+8PQLMGbYPiOm*`~Fjy=A|VV=&f-7fAIuzJ1coK?!&K;XB za^&oYR!JEqJsVs6HGQthxdAKm<<0{Q5X%Sngr{_y$uYPS*5h}m>?+WlamGx$CJ}d{ z=Rh4g2L1fXp6f`;#$PzRGP6RS(HJ3h8OW*^2g5Qz)l{C9tajn!(ZeJIi<*y)VXlQuOQE*|*A+JY60$vp@K}gXypS}uB=W1^QSHzKX z_pJR*GnE2EAkV|FHvLLBYTTV#oHsedtbHPl*^$(4xs6V>UC#e1=!FIwQr;yvBStq- z1T*P8e>!hed8=N$4qQkkyB^F<2@dWVs^{=(@EYry<5(kLaS|RtsFz41ITS4;Wvf4F6R3RHke$fVS)t3Cb28x==rLG z=r-F*ty^EJzmCO7R}}ufv`P89_6i(;ZovAIFSI4(zTAbW(MnqlupqmU93xXd%STU4Ds|iS!+Ky7~eS!3V*S9e{)>#aKMsHOUHzAVaaxzFt8=o|AZ>;72&H9q^#u@$zSzss*Is!u2)Cz$8y#ld1(po9DU z+eC8jiv^b<@5@V{6v+JL1=juLl>K#3^UZaayk??Llh^fGex+dJxh{|Z;ER_7Wg==8 z??rwa_A$RBd^h^9spA@C)7r9ri-4 zNA>QIx5rMeZzwtUt6|1!=5I?+r}BrKa49tNgy9sV?nuQJ(9V1wQ_}e52*5{_fRwfS^2%sCe?-QKNpvEk)@;CVCvw*hP?478--ND(V2CU6$RwdC| z(I!ARG{ACFzOM%5@DN#E`z{zvnd1=@A{gMVzxR9`jK)Y%%55XY9BoM=qn)@daI?Bu z25LfA&i|U)@NE93E^iTQS>R}CesONj`{kB@8uPI99f_5{obyY*-Hxhj7I>}lO^aDl z9_VfjY~_!SiU@DGcIa#cBzH7P`{$l;CT})<^bCKod#;DIJcW`WewUo=m)YR;-GVfJ zFJK*Zh?HqJ9fXY;YFAS6?v>}QJ=UYXyLr$eBvUQq0@3i+Tqt|Aowr-bHA`!C^VumI z=rMRI0~y6V?RLtMLg%Bmjp~hi>g$c)nyW&38j1hl*AP+I1$Ty0DBatWYw!1uJrI}W z*ry0kA!4|&m#pdgQy|%dTEKxg-+x4Bjz{kGH(>k*$~G1;%l8>~%|6O5iKfkvI?{RHj=V2SYx+ z?`7|q6!}2`Y2(lHbvk}ZvN=Amhr0hqe)wJ7g*5tm@Na4%#KbDVG5d#xrpzm&EWQ_x za_WBxqvsJhO9xS72)9Fwh_eTidC$xmzef6vk;Q)Yss7l(18M*@a z=g*&6Y7}b;vwLSJCl%~GnjwQdNzEfE&ZAH2ekGLFFWU;2{zl;>`;$@XAn~T4tSfQX za_7ShU-~7HBJFL|#Zo>b4z1Gxy+@G93URV9Dgb@;70PY-^-JW6U6LrBPic5XjN1;) zqPey5*X`Z&O`hqXz1@`s7jXhqXIYLJjj0Ei=x@>uvk=!8`2OIrV)k&M*FD!|ub!$c zG+o+EAoxrTXiGHP;dyvmgsujz06Lbz(UqZBfIqdZ4`!d~!Z8+5T|5aki{VTv;Qlw^ znV|Jg)Bgy@ryJg~h>^$czDB~t#4I3seOxwih71o58?5%civ#-!kZg{YgLneP^TlJ+ zW5U@v<60M+FdqQct_m-@^%swCP)k#$>$yhaX;gz&Ia}p%zCf#RY{@;Vz~dPHk?%Wl zPgHsRDe}^g)h0U9H8R;ch%xgcTpIE9Gwr-3#kQGNJM_c_4_;j8%| zgC9_LP?oSl3Q@$6(ESskA|wrglCA+h1eGE-LAf5)I2KX_?t?G|pm)}@hZEAnj(ylv z1dqolM9Ke;%yL5xw0tHhF)=YdK0YZaN}jk6Jsk}p+_$_KR9{~o5)x8gUViG{IAOkb zaL|_>YAm+y;_Qs7|F9lO#suo>>NK%^K|w*K`QPGy{CG2yz-5^EedrUuntStdbcV6Z z&L7@6$>V4YKiWsrKIDO5U>bbL;#Ml3oBh`48(Qq{?9fKZnS>nt6S8Q%GDDE;KO_j{)EWL%1RddGQ5uWje~TD_E*pCZEbB?E6!kS z92rERE0eXRvN^w{S`|lrJ2FV{C=d!RQv*J|T&(@UgslXO|K_&!DoSWW7s$+4k28n1 z#1Tasl^1OA7rAv;{u%P3kOwztb0=;ZRa zG;nm4MHk?=yPh z8C23{EC&Y$2KxJD|CW=T&-Dnd+T)> zRodTuGdPF|M1L?vG1r&q?v%^pKf@qxF#X+)l%kiU=$XvES+b`ouSZjvkh16lhH4;Y zNG0wM@t}(D`}7EV*)n!TS{A?39dOszfro=P0I;A!@rFDi9`f%QHsVDn8ObIi$-{cy z@S*^?Vj$}E;BsYnZZ7Q>fkf?3=X!pA{)IQsuJH^Q!s$@=T~rkQ8a38uE6Gd9bV_5l z%2YUjAARCrG$bnm4v~?O$RiCfGt@XpvTli#{4+gkRu>V&Oez=CZ z%BPlhzb{E*d-~O~d>``>pSJb{5dr`=YnHWy4;E9pz%S!s3~Joo8y+Q>3%nkSEg2va zSnICnV+;ULrWm6}{c{UMK|z^B`|dWAaEA<+nx;0a;Y|nC7J<$9QS+Y|z+QfHVo5-3 zxJQaXEZe^aAN}Q=F1>!wUyr$rnC6VS!(!z89EwykT=cf4ZOSYwYy!ZApvQUGJV(qY zU|hcaaBif=6MtIc!3vZgbX|*ZSS+kipJ!`Wl39p%*cS`1(FBbMpb5Te%5#pSusx*s ze7p+6hmU|1)2==I+Vx0w_t7`^@pkV{r=GZF(*Rn24}Jx;NBixk`0iu2?q7ozn(>;2 zO3anE0n2$8#_s{xU=bkV0stri{&f=wV7>upAH+VbjW{f()|n%hs{5tqct#xvC_0o! zw;M6%y>seZ5@h}kPH4uvv{P&e11Ovt__)S}I6v*D@5=!A(ojI=%?Tx#(SKd>3M|GP z9A=YvH*=s+HKXGA3>aMFVJ$WL*xbbk-#K7Skh_?@6JY4{Uf#uj2?2Zt?dDtj_)Mj! zuX4-X<*9!}A9l$3A~HSNZ7;C1r!Uphl2hPra6Ezqp|ql}Q9a68Wy1u0gbV5Tlb?Z18)B5Io(o?2b&24+Y8I>RWD8?B8hLqKc$8MBTQK#%wemclUBX&g zAGBLB&bNsj82j3rbQQa9DV~Ta0xY6L-yQ5@CI*kTCC_(Ulq#mtlPpc{*c{U6Fk)?t zht5`%rddf%adnz}2}>ONeQH?`-EmU?WndTLX4SbTeto^N(x$PjWW$3EuCcw8XF9Y= zK~LT-6%=ruRI9(eh7SnbXyQwVF_pF85TORs*q(v?bPgq?yG1jgamMGix5KyRj)vSG z#n17itX<=nm)6kc2P}Cm&=r^0)dLQ}$$9w%*f z?^rS6Ak+51cis8|(knPm8$G<9+=#?Yn*bT@SjHv5F_ax(}8ejC0fFp0CV z?`;(HBHLaY+qc_9i_fbOpDbTcIm+Iq>QyzMDba|9I^CRQEcE~M-w6S+0xL!z0Sm=P z)j1bEIQf7tfwi$3@u#Gj-u6<%=9@^$@96yjr-L$w-wo~@Cm9FyGgq{YAIM_LHHJ)d z|1J(S&x>pkcGI7yAMQBR70RMa5rZ}5MS<3DAb-|Oa-N_tV;5|n4-hOFkPOl7e6muL zGAs;^HZDsU*j~e={+aGmU*E{Dl_2&-Dny;0nxFqyShU!=H_ybK7KxoKb(c@$2tp(o zxC}=GXw3qNLRpUkuP<=KIe*5|lVY%@EMULT3=BHi*&I7%@YZT{KhSbMdoJFsWj3Fz z<_T{WFyCwH_QW$L@u-RU>+X8v9NW9GIzBKx85z~#B zcWF_?u^J!nfUy7OZP_TJ#RrZxdKERx))G)%UA>msLSkz-rr2@@)C|IW05KH*0oI7b zzh#y!MBp3s6N?MS+zz+L7gO8CU4rQY`x>M*zC{a0TD%6|JEInktzYsTn062?B4O=ozCEuVbCFgAsPjN9F{5q`u7*}u4OI+Ujqc;SX5NO? z*3atsoV_GA&b`8!{leQ)W;0N~tEr|U+pLPOUObfnm^Z_BjinsDCR=AB0e@%Xjz<=- zL6mSXEA5KF`$XYR^7y`5p`f|97rifUYV-ZB1@07x$_E!Mhxa!*oFO*Z19DI!v}nSy z?}>8t#5|@m?+?!BCC`rQ>aXc_Vj{qu9nWLT<6iGr6%);7l=FSe_F!RBoKE{#{a(+6g`x~)Y47RUX#XCx&~jKV`ZW3R zjHQ93aEw`koI%ydTQ^eLCE z_LP)AUNz)|aRUvuWcG4WrCJY1VSQf|h12Qna8~}fW-`(ad+lkPn6)=dZd!Zl8G

    a%db-~A?%UTejE2tKQID!hp1^uR3dTTI*Ljbm`ltiq_DwDTBYU1949pMkx$arg2` zti6|MB`~#4uGpbp`6s zKtT5A)%I1pJ)gvBd#~^rtzw!ztcq8kP}au7_niG=-;FPD(9%r~KQ1myJ#J%L=q8Sa zWw11q{j_|pM=~Y^6kW|ltFcO=ynwPkQFWWuwI?br3coFTEv>9o(tF3@K#bWy*50@0 zwL2yTH##6s!U3BQd=t%Vxw!aDQ(~L$aX(56u{FeZ^$zVSYsmNHONzeTpw^~{qp9*a zdbu*%vaqo5LC|y6IY`hZTMqV=ex=f1k)pAkqTbjrkGl4vv+b90!aCURH>A5?7v8%Y zY@N_6W^wK+f1o+gm{WCXA_CuoIrH|eTwes=S}oow`S9kYMt$)rnAe_)e#&%a+$Njq ztQ*$3fAjl<--nibbkij@47768>I}8~Gv##zW8H5`)=O;FDWBswA9E=_H`=h^GA#^w zIT1~>k-~6)>$T}4!9%I3ND=>$t%J*X2Sbxi^Y6Dt(9D3D&CG(W(Z^u2lobV?`jvde zpfW;rUXU675!K8WTDw|8DW>YH$H83x*I~8dC6z=f)r)_U;|{4}rMi@I)|9U2TG5bC zT}m#pWcFez2Tl?5tmREB5EEHiK@e@?nF}+?b_aLT_Tr3zw9X)wG4GgKv1wJ)PfKmj z{X=m1TnfijEX3ek=UyI_;>PJrfl(ofastN~zmN4OxLm!_r!22_Qna=3pUFp!Db22U z))l{7ldddV`V7jy`5+MXOq1z=GADXMorHu4ZyU?B_*7Yen^cqTZSnY);qb4{gHAFI zSqoATU=42N9CFPajY3KwVMn8Du6v!=rY>BwyyN5Pj|`|oA$`8HA^tScVR{t#XVBNZ znORhnDJ(?*Qwm6xo_EhQ7{q*j8NHi@*ThxKc-}Z z#o!B*3UJ;QuWNum1t+nra{GTH0MI?iyPP&u(y~nOzTJ=jsi0n0mUwDhnUgaudXJ zVsl;|17XZGYP!BGp1U5|o;po?LVaLZe*R6_7h!Qyfp0>?o-c>~qV`Xz!sNbCKFK82 zs-Bp8Z%)Y#{N{ zqEBMrmu8*5==A2LX0jtfrm2;~?wAm{jnaS@OY2BXHH>mQ)Si7hJ|ydHF84<&8u7In zjiiFHa-Lf3oNP-u!b8sN>zxBtV8KT16&~7R@j;%Y9$dL}N1bM@2-n zc~f-Ua;EpRm|PYks>Y@dxm}U)r*olS(VyA)us3-Y3-2|M8>ecoJbMZi+*c|4EPb8G z7WAFWS`<9d!je($W{ntXTK2>@+%JXsaIemUZ1U?owx#{H6`{Qf&Gig zVzYr0^jAt_e!8q2T{+rTxX*dJKLwer`vy;9Zc}ZtZolyx^!mg)<2teDzbNLSrx4MbH`JWjfii zt2w78=Z{*b#qNMlTgbj^diBbJO>x7;?>NDhbi0p&L`|ad49{wO{F6LZ1cy!;nePl2 z!>TYiN?(QGS>;%-YT>XHOjG%Lj-YCD9b_b^o60w8e3JXy8!BmYx*e;#RjdeX)k<(p z4VtR}r49I_A%CjB`4(13J6ziPhQ1s)fb`K_l2tRppFU5@KyFG_@G23G&@(~xU6g}(0415H(zbxMgGRa$QUnU$dM&70lJ5R* zUpD9x)1L{=oJ#q0CsubVj2S!Uof8W^ppO1kliX+>8gdub7Ir2$xnFbo{mtrdXo4Wo(|jpJD%Q zN`Z-T-H!Uq`Wglo;xwL9PJ2|Hia=qcS7z7r`bWaMEsI)CI@w%f-Wl`4d2t#OgAufO zj%Q275ydE}5udJ<0rAL#;^tN)73ZkEdy!&7M=AAqO4c3$FQJ_3WC>ocKuzFICOIql z!*^>OQ|eSF95vT&oURz%9{z&qD!y%l*6o&bOene)GmQATUL@;{Ii3aI_yNOM9*Z0o zOqurAqgu!)$svR|R64r*Eu62=dm&M7meCDQ;Kb}2Jw;tas2>*jmgdulgrq_oqly&a zR}z$*Z_1zmEnT&+9e8)Wc%s5c53)TV7Q>I`UZIQ*9YVQC)yW_lF0OkTp z711xaQlD*V!GI|o5_}vI;LoyRdBkIFCwm4y*;wBmJ=Z_J>(Q}2y1sw8v+(Utut+ zAu|PmD<5468m|k8PA?Loj_@g;Wnn;?&V-#GF{3$EITqd=Np|{4F_jokFWyt?5Nj~r zL&oZVP{3rMXZW~WDLN@N=E4f1=kJuqYdXO>o?hGep0Ws)enFH0!KEe}H3_(-P?-)M zvBii=rwT_jA*~Ou864O2u2W8|Q|t7IxKi{|xTwms)kaQb3qL{ zns!y34nZXyVwBgee)%&4Z7%Qg^C?}^-2W+qod}g9q|p<|Rg6X>FY`~3@i#}=_vqKZ zLYQzV@V_cpnGq}ONAa-Ch!E&=Aq?)5I`px5eNL_6_Y_GDDdCk`5{B#DjSJKMgh%D2 z0Y(_Bu)BS5`s)q#Mtq-yr%DUY`B5kGo@p0|?~(r#wNRmQAZF+YxB4FHkZFOQzv_O3 zJM!~sN(7|hjaS_kZ|4_JLyn?@%jhRr0?h)H@@w8XzISII`3MQ;l1rAj8*p|GN}f9X z8rW@#TgNGrqt$iUH9BkRw|JcksOdcLMtsCxhq?xX3oKZEh2(SwIo06NMWjAIvC}r0 zoTD>258O$8Syvrd@3L^szGN!_-VcUoQ?E&@s;_@^+UBTdpl7g%Qu6d3DRhaS_PK6Q z_VV^7{9;QA#K`{@Zh5;3gQ;$b*?K8{I&%>ne#=Equ{3|I8l_i}`CU!WNST6r??`^a zR6uOpNS7^HUfbx;1R1!4d4Ply=rFD-_mHJmy9*GxJff#Gk&HN%zRLYcal7ls)2J7TCSG1H>g2gdn@Uj z%q^@U!SQ*gWG#?75ylet(G$kr=~Evxk?wP|VdX>z7>d;qvYh%Z>MWvjd+dJugt2iU zzF`IRh6iPfeAgdenpKxR(U-ux64gfZEfEcQPy&DQ?uyyht*7Gw7Qvl9`B>@n9)%5| zuhTPCg+{ETM?7d1S9OfR`XV%X*-k0VjQB*Ew^m!xIx^c70aLlYA5~spH!XgDYD|EC zb~H;9TE8Mw^qXkmc1L%yubCq(uOJoL1{Bj*%+d^Z4naaF`*X-%Nom1-zu`gKh@Zr^ z+kXuW>tk#Sskb$MfSmmoN4(12g+tKZFK8(V5)quaM+dxWxchc7n9;ao$sxvo!Y9H& zF`fBRUBLsDKeD9}3Cp}cPZ+9Y09IU`$!)2A7N`I`Y(t?$N(1dD&YT`>Nbv-pq=Qma z%m_eg@o@yRA-f7 zn82yf6x{Fx%ZV|$r(wnHo$x0TnuIAOHbqtpwag)$UVq+auLhnox;`IUeS^Fc+*umL z;!vMmyeIWut?)girpmbMQ#u89!)FB8$Hm%cTsg|@GE^km%MHW;WG{cn=d{^MD|M9$ zB^aT~4>h(1Jyn3SOIZw(982bKBt(P|6&h|th-#S{K!iH3e(%+^&?cZwp>UTgU_+7) zT8OF-n=Y#Num;f$YuUI+*|=T<+hKi3IZ*AQY9azujyZn_bY<&Knc}AzsXOXd54-1o zUn|f5=xoZ%IW)v8c(RF>KlPPkk_nz%XrS@ z*W9$CA*6zTqAF6Rt!cjzVLP2#{Us4`*lk$MS)Wd>^i8`fTX5z=B1e3N$zj2WeeryZ zay&pdxbseU)7&6cuF{LcEYH?JR{aFWM97Xkl;mmj`av|`v^ zYHFiv4hbUv`$fqJjdSzLH6-QGc-b>f4c%QpoH49Yx%}LCR4%tgnYymXj*UTRmxdl& zZHOedoKu=bID36viuL{L^{uC*;SQ+D-yP|~D$v54iZfMlh7%_hSNCSHh>cbCpJ0F< zSeM`#G5X1h;8smFo3l>Sh{xCDWIor6`ZUlOPq6Z`Vr~n?pXaQ#e?4_JUeI*8px{yu z@Qw^#4lmyzYv3aPUd)9SjZtCpN{eT|+)`)!ldy*oex^No%d6C(xaJ3^RzRjS~T(VEf?&r%npTL!pV8lmo0UP|u z9yz3Xz4)~JeDkk_=517=+ZC1EOU`E;L&sC5?TNH&N4;@>=)XttPvoPpd)}f_Us;kW zlIk&wTJ^_tfP~UjcS*RV@VK-7%&jtHXplMmm0Mq`$c!Nvry^j9GWv?Wzcn8;_f5*> z1Lzl}0v!LW*ydyGQc9i{)U~sbjbj)})zBU3TM0j6I`UyXn zb1#Pg88IVDMj*1T|&8@@&B0201NG`?%6b8;yE&YTRT5e_!jRj~7en)&!Tb zVl3GcAnnFrKebHbuy~Rxun_NFuOj=$PO7QphiaIOP7-Ju*c_bw6<@{8w zc<&+H8Bj>^+2bc@20uYITfwZROtQ)Q2jykn5AVtZTM5?5rA`~KTfK(77-H{*7>Hf# z>j1`go{*2P!eK|?uiVP|V&ZOejarV%r-6f%hNu&8OWdCUtqg>Ul0 zBj;nz<|HsB;Z3; zP=GJ~axpF-0)%LIM+XGZA_`gr5ElRxBBNcCB-t6;XKC1=a*i8W71gN7k?B@wbJ%o+ z?t_L9oYmql4X^AhD|nIBLU@qxA>Hu>@n#|m00Yqa;zJ>T7F^mi*wcK@!WlQ^?DO1D zJz-iFXu9N^%`}U$E+p&XgYLYIXM@s``MkxrvkAE$l`tx0hS_O{6V%SNRU1v4cLxjp zj9k&rfvVE`rB~ko&#bt*P!*@zJ<@m;8sFx-MHsD8BEGAX`vH|6HQNGE5TYZnu(1pn>}grzleIlj?I0zQ`w@xgayYxxsBVHTC5 zZb57PB-t*JZ;PF5O{93}8J4L{%Z^9B!27$Atq5%PYHwI_v689U-pM%p;8|G_g00I(E=WYNldFbwTo_JrkEe!`M_C2gq!QQxx8_V3Gr&R>er zvM}SF(82W0U|^GkPzSz1Os7`0xTsqM<-~5wCUZ*@|!{PjS zuA?7-c$HrBy~8a6=~3ugG~}_f!jC+C8yash@)LJ!R1;&PRZPD)Jqn&^bthb9K-n+- zaV+LKzjQ=s>Sv8OGOkZdw6nfA&F_3#W%C3Lxhg$F=GWIPFH@3qeC)xh)<7x34I$^R z;rIYwk0_AV#&^8}FMEz^Q;dfZAHbs?&RC>u^e{OT;0O>scg6xHYrx^R2b7ND09(kU z;es~zp}fqx-hfuaMxoApdw%~f7c^^ysXM8|Kq!&Di^f;`E1RO27FGvzj z@20+RFWtDO(#Vbgw!+GdQr^nI&Xg9pmFF804z-uGTpT1c(Qk5J73>}&qyxM z&!3ix)$m45Gi6eZKZTnNcjPwLiY!cR;m9-1ac!$y$Kd(5nR|0#UMsMVZ}xpionwge zkg;GN71>VZ*2x6eMahy}F*O3<>#&wXOltD)4cm^LGuKI^L#}2#imA?L+L1x{ zZ`fRnU9xZT{wDUkoW-0dPzaSc7v%WN@cqdcUrSyG8*N%9c`Xc;F8n$W-xZbCw%xH> z0_ZDGL_kAsN`0P4K)etlz?jeDRrSM{MnC|dmH`rOPr*l}dv{Gv@>-ClbDjfQE-Fa( z_if|{o>5$7-7OMJ5l97<{XlsuVUKBOb@vyS&f4P65Ztz^9|bBle2!&Zq(2>dx7j~; zwsfG`?)_>6NWeQ_%O^6#bpm}TbFj1mldx)$`*Bil^12>LT@cDrB1p^b7wou4FZ6$#J zw2T1#BLY$SC;(CV*d0-dkn0Jf{k!TG>v}h`&sOKB*K}*nJ*_^uGF8o7PD0m|e3y@s zNVX-v9fofbH#YZXgA!pW0Kgdo>bsc~M_^>!kX9jzE&ShPXSJ9j^trpXIi)~sOoY1d zyY6aJoVP9TteOLhN6XraxBl3OX13j~vnPe6gnyQ}b1bpEy@F9- zNTn#Fv+IS&m2cXsc;DaMp6*N?EH(G}FZk5^FQ`cX5o+_5;nP$>P*I$(HZMEwDvrA< zl5Dsa$cI*+-zcaZa66#zT`uka2`il}O>_Q}ahem^staVDwm*ly`?FI2?n7hjis#+d z#X>hg3&V`;(K7-Rfr6N+Nk0z*_^*Zz(_GzOcS)2f{7z&?PD{n=H zY{uXRY80s!vvJmMtVQo3n~NOJy3C}X-&m4s3|VkI!*Ao4d2N+ z;pPHBl%d`$|8s4#lz1oMnr%mxOZ?0>{rnbnhna6OP?!pzcw?IA;ujH#_b=0 z>{htWVheb!=I=Uq2z8YE}4 zqK%O4vi@d-cmqJsDlk&j{cXOQaDZT+KSXmkkSt20%iqf1KDlG@r~b*j<;a9&>`az! z79jzP1&eG}*P1BUPpjzEeti2IBQEaaUZ&N*jVnpj!`h3qoZ#+(3ZHx?B-D_H$gF)` z|K8Oj&ypIxs>(+Iiw5O&BuWG2(fT7ni>v1hw8Qq?c`$vNjVHW_tttTziUs*I zf&Ae`|EYg{=|OqHAo!fPk8k8`v!&?JXfR9Ovko1O4gXIU#cS-eS94soR> zp!i`5$ftkQlFHy_jKfWrhJLdVH)|gwBsl_P{!iyoqRn zNInEX|FAKlCnEW{)DJ=sq0+x7`XAZ`15V9aZs*0CKApPGBMqr0mttfID4^RSXm zGxCNB+s;9T2PP>n2nx?R#@w$sPE}CNC*8{JS-2}9AbAA_yx^u&kYQCzu=`NS>4L5n z3CfrKO|JC80j6)wuhuvw_a4f9HU4|n>R+)O6f&QTZ+noT1l6x}eXz><6&N#n_~&OY zxs3)ay{IAKZC7V#f#~k}?_;6yc^}t>182AXQ?Kow{Brx3iIwz{16au+T{-#e;>km2 z!dsSH*SAVlfXJ`ao__D#FH-7b3Q{t<4Gt<_Nrg2!$&f7o>VggligkILdSGWdVV0Vs)xFh+=#M39nS}HZ$E#s3I z`US-vE`DB&Z5F1wppWm$H)2i$37uS~DkP`lJ++P9=D6&$CX>l;z%LP@9a0A9AS|(z z%E_o~D8(Q%dnK59XInBlFSn#I`Ur<9Kkwvsou@MJ(*P^^#`*BBxs!rDgT@!_ z;$QZ!ZA#6G+&fk+i1hr7gopO}{%mFSS;CkzGRc1DgMBcgUm@^QgNV7`CVI=sb&*i7 z5oEO#7Bj9UQTK)C-C$q0jKoC)bZS9h! zu=%T-X_YbX38&SuFf})8mz6^@qFnwrCb*96NrM1d1O5$R#iY`(^tw}{vN!8Q zXFJK?TtuzL>Rv##Vl__qlhw*%Cx2M2_MmH8vZ7iwi6cmK^eo!xh1BCH=Au|cn}_eW z0CP2=7`kJcC_7bqa&^%fr&4*;{=e+*3NmJkYO7gSO&ua&yTau$p|!2M+&{;)*X^=~R zpD}66fC6F64pNgpp*QzqmUt*P`i%@OvhQV-{w6o_v>4qK-<10RgX>ey$+ZI`4u_ZE zbHRQ63|CX7y_Fh%_%fJokq!r#A7=@yr~6z9;w*+H$Mpoi$S$!!zE?p0ax zUpO`irP{7Ja~3UOuZ9vnVqwWN9)&rnUz11{xmUMC%K83!FF$Qg&GFt#t<-zo~h52t~Vt*bI8j3y2moGupQNjWKT)xG%~AjOpd z}5zQNP71Ard+0-ZBEd zTP;!mCS9F?rl77g_Q#Mgu#`lf;Mc*I=9e4o@Fsc#l>mCOzT`aq_u`@|f}Nmpn83S_ zOB9LP4m$LoEeDJUFtu&&l`Pv@m?g=?RVggkL%A(#Ibit?i12g(g zjs$Cn7jSo0gPz_0WvJ0lyUSX;MV_jr`TMA4(`>&!A+WXmx(&L)@-`r-x)gj~Gcc>L z_3i0dG&(Y#bpR52w)v)}BPV%mjn(kM)Od{k)D_gJa;9L7t6hmsv*~Vm=<*Mn;LjfH zT;`NG_y^@%L%D~AW|Vaa)3e6GNh#B|I>_AsY}ShW8>uQtqe8BJvIAN6FZn>G!H$yI~iJ2A0JqM zVP4Q6V2}x=K?Fd+z7u*PhO+fj)q!|z0isFEP=7jUcooqW$bvX)aN%0w@sxv zYAuRPF-_gJA%-(n&12?SyO5kw^SFYFoVoi!~`faFKE z@Qu4Nc2~!<=k7t`ld3pt<%+JH3A!y++r<^Wrk@DbD2KL|XU5NrinLLa{b-bkV?(^?Iv<#bzwAZ zk7{Evq7wqGf9LCdp)+Nbdhh4PPmF0h{3|2Bpww?%Zzr-%Tz}fRtXbY2Fgf~sdiDO@ zk}QTNl+^~;f7;%8ps4!Kj1O|K_AGe0kNiVrudJB}Wt1D>K3+TSDB0dL^Ffa~1Sz1; zvpjtB4aendt<)d9vQ`&RDN_@8%d~f8(39LhezRfd!ma5SAvO$-jL*1I7XjP>cvHj@ z#DmRT0bEGo_a0K)R;^g;f)v659^_gAECDz}1we>5Oa{QI!~bHMyaDoD*d7?r@_)8o z|9?&T7GXPd$SL;|XVKVmXF=VaUSS6z#tw&;oe#mn4B^j*D%IAmeaib-7!BP=9)2di z|1x*}O%BY}cz!^KdjwE>^))i(=DOE$SmpM?VLi^dzdl}&DLdq{2Bw_hq^#$+w%T`M z);|n$Z*t%MZZ!IU05(R6Jp9Gw1MzdwWY05^`q*oNx=T6#1ORwOOTzC_9(tX-bY1Nl zfYht(czrzIIL`7sJx4P;RO#BShc5l7I^E$vwLR@zbjp~B9^Xd3A;3Y~qFz~hGc@`$I!;UY(1gC@s@4;yx<_9>Xc|!`F7J zu%6b@6nEx?QR}o7Xy@9O8=4(_^E2*RVG3n5ag2yX$W3@k#@Kur_qfi^qeYV2G^(x=kMcQCid4gO~Src8_>YtBk%J-rYRo5Fw zT6(gmM-1guu??c5kRK0>4t%uVyruu@Us`vk&qq3eVB1G}A^~0JKPq;9dVHnGvm)$K z5KZj`K@}(+c?2$hU4CV; zsWmBu;4}2x2ol>KlDzdeSdrY)5c1pp^aXBB;nAcA`I-qhFIaTjz1akb4br=?p?nn& z$-WqBs+{ww)zirEP?-_hjdw24l9r53cqVN8Vd!)u8u$`W8wJ!@9&1nFd`Q-9cROUa z$%17QoG8cy;}%?pq)HNNNmX@p)l$?5r@@#>A}zMgHt3V_4*N0pdbO8a0s9 zk*JPUq85Os+VH-;{N1YGM(h(tZFD8zZL<1es~3Cj`+B%>ehw9WdpGXbI8WR{Z*!0A zYMwErr&3pZs*U|EcDbzmDX-{H=FTn_qr~d^Fb<~E2X&_j<+tMEIhE_yx^u(}EfCzs z($^B3P5QSk-Tyh*qP(u~P=8w?yUuZY)y~D3aMAJ+(S^?t@qnkb+frL>O1!AfFH2%x z!}}HZ2LCA^(vl?73f?om)+ywdUPj@+g8ju_fjTL_*GX!jxf=@1^k*Hmw-E_=WY0JtY4qo z2W;*cHv^OA!Qz#zuA&R`#I-Vlw@>(}2XKb_8km^6TXtWBESJ-hnw>HkniqD|q|3VZ zhkDO>vTRfei3K!yWwc-RY`Se@s)Uz^n18E|6vZ4w-jFHHVemY3c%ox-Lw!qC!tQkj ztqD?u-;1O3^$t}#-9~wT5nt{NK&N6b#Z7)MsVZW~(6yh#MMnikR;v1&&)y~IgfbWH zbpEt3S&@}k)JW#2fUm?7~Tl6N%loOfE`nn%rJF(~+5Q-bweGk>C~s(qg~m0v;sXX-!7_p}HOYY^lnxq$D0)>b z+zJenRop2x5dr}_GK!`X9tSMs&~RL34#7-lX*EEf6I*J%VjE?#z*Xa-ip*V&xX91S zw1-&KFCdZ;^A5Kf>?@IYJ2Tg2+&Of*Q~uH;Iw+|o>l`hyE2 z3SueQ&m;Wn5^1pi#7hSFn8EZSYKcRRE=*S$s+IdZ?bJ@YlL+$(dc&3Qgw_JoFd94*XO?!5Gl9?kyHq~K>{ zF71X>=N3uEhd>7bSKf2i0hsLfhV99;72eBu|2F`QD?pL^($6>y7We6nT){{HnYF);0gT2J0B&aQ1Zo124VIn(C zrrth(XnDlCBfOZymVK-^WTmQm-PDQcMt*)^{rR3jq?i#d3G#+EptwY83hic;-(X1^4i8kbCCn}uew zE&YCen7;h;P=_H~i-7s&O;}*Q9ztJlOS`_@!3T+0pcc_jjP|)rMzVguG*?Xl;K4=p zTf^y&&!86UAlB%678y~qnD^3W*P`I-q|_#Kw}?sFBpBJ$-aKNJ)TUnX+<+|Dy*#{y5`*Q8Mac1J81K}yDN z%Gxc7wi%r|UmdT0Got~#A7SbB{ait1@=-9I6_uqNNuB|rw01iWudMn$3z1A2(}Mdo z7hg~yoxRs%#46MJ?~et;r(H?Tc?YrsHhSyTs^~><)38A6@3D%{`N}6juXsEXDznz7 zf?4-p#NJ*@UZqoOX!JT=7+QPhwd0TDRMg*EJo~Vt zpHz8Xmw7fR!U-X^sTH7{Qzo%p|<5<{t9*hLW>Pp4EpI;8=E@(4J*w(C=agJXY@o zR9I2?mgVQycn>~F@ z$Lm5?1q&bv4_wdX?jPsdfga7&q@T*SOTpbuS@cKV!+@R<=?K9+X|HH-K`J$fBNJeZm9!WX~~#ef_4N$?Hul!iG7%)KU7toVxsZ-8^Qv7Le z2DU?rloJ)50h9)S!2y2C5X`0mhahEa1qTE#5V!_#6JXjDyUG;$+!XgUtl_u#aXu<$ z?+aTxq5x^cdr;^)%aW;t>HH{g{#v}!LK%d5&q)=^u<$vBiEM;gP|4lV>@bNspkuCr z*?Dmx3A_-UpQRrA0t&L^hVU4f>DUaSFkW6@8GmU(e@`4P zdw_7%zm$rfqWY=ZC`}g$e3so~$6@W5_kXZYL|^rA+QKnrbRy`Fx~Dx&)@QYoz^bC^ zIH{5;BA(Y!dJkCXD@B2aqdUeu8Hp1bY8~#~cCR=-5T2zrqvh6VLn(|tMPvlNlofRq z$^c=H_MksUqj7vw2Q8dt+aqvW=Hs_kQ)UIv1-{I>>FVf(9DYGqN6(aIweFn-?ozTw z0ZS8S54|j?4io)gOUD^8p2ldoy5M(u+#6qQ(sDZd1rfzvJ;wAF!)eR=y^0JFp`|j# z?^=@JG5u|Sb#Dsyu$uVGF_A=#@}T3ol)0%($(2MVSb(}`9w!yA`UmmpQ7iOuJ8qD-(a@gD71o^UbG6`cg=L2hp7G>lC8#l_^+U3n zeEo=xuM$o(cE0QE0Ib1sn8}$@VlRv6;?=EtW-WpW7npNy7;zTB-Pj;4$A+Aoc)+nm zd(g44yb!0nuhe)NOgXEd>aw{Yc+-WaAp&}XHUm&S0^B0W3BvkNYs@kKWe!Z7CodXL vFW~lHO5*Jr(DYxf;LBB(K&8jK`-u5@R78`og(^_a0)b>D6`$ojLB0JCvp2vn diff --git a/windows/keep-secure/images/dg-fig1-enableos.png b/windows/keep-secure/images/dg-fig1-enableos.png index cefb1243444fed724637dece0434f235e6cbafba..a114c520de2c54e0b841126bb0763b39eb4d706b 100644 GIT binary patch literal 22075 zcmZtuV_;oDw>S=;*lcXuHXGY+*dz^4W7|e!HE3+7Nn_h)W1}(uC+&0Z`@8qPA5Qkn zo|!evYi7;tgexmbA;IIp0{{Rd8R?Iz003AP=w|~94*GlU)UyF<0CQB85(89@6C8pn zkQSl}q5wcmEW)!f6sQgdl-6+s0FZm$e_#Xl#byA2#-z+gQFXUZr@!732?m@umsBBB z5`3==w_slcwjPXqmX+`CB?@}3Lb#g)eA2X!`x7iH2(M0|(6&hIY=^|<^c}u$$^^-$ zk^D#`9h6EnCv6n=QZ zKf6bU6x-e0IEYdEhPOBnk=^F73rLW(rY?4XIj%g4v;NZs0c*1n&x;$CnLdTBNZ96% z24U`~MwYZfP;qV-Lj#TM+EpVuYWd;!JS$6gplx%1=PMWFCTc+3M-`m3OfpHof}Le3 zclD7+QF61(B~l{U&dFCU30MRNolAk+riF!?5)!Kq`IoWVhtFG4+*<@Kf(4h-Q9W)v zx-f(kza~6ju{OyUL&f9JY>!vXnP6&Q8C|{Hf`+?bmTrz09zGzoTp%rWQ44yl|7mOp zHf}DwAM$kx4eFod$Fa3laRWC1mtI@sMc6_*qUrQ8H4Q?Wb}mNX!b79OzU(KKF(Lwv z`2`FcJX4)CHjhxu9x;fTs;#)|GkrPHeGa0jT+Q%h@Rv>hrkhwg{L5J${LlANhyC-U z&LzTTRbZ}BPK(i+ib~6!;s#Z&yRu5lQ1H`(up5LEYChu?@?u=&!$o{RH_m2pV{z%K z{!oejQIP+X`iOqnCH< z6H#6r2*GLm-_x!Xlg#?;Bzi3)DI4*qz^wzliS^OFb3qnJ5?K6R@!6%UO(|_N1iQSY zmvJ&D_EFjV}wD5Lu zLJZTvoVt!MHpw#yLgtuH>RL~#xx0ct{aTQIX2PBw>T0_rT^4@29 zZ=pBLeRz!$ITdv@!yfB)_<`vIC- z%m=fQ#IW}ghxq^|MLKQ=ZdZH{~R`t`qU5mM%NDl^mYS z>+x|@FMJgE^40kB*DBWyZ*Iuq3BmQnMbey*K=RFB#n$0yb^O&BXH8a$IYNx2m8(Wu z=S0xMWLiuwrO1oE)sL+`r|jsK!w0U0AqaHFuP{-_`9eUC3~TCx3^7FU-Ftk|R~O*j z1?%%LFskIbVW=xC=!H8Eb!e-E{%$1aY5AZjd%JpRwO)GnIYsMrh5ETPuARStxwi7e z?zh$_0=PI>pN9cl+7Pxg`x)#YjPLeHxQHkAbvOqEQ(ESz7oG{<@&qF%9hAKdPi=Ww zZBRBG>Nob!%`^}Jd965w=SsZjwQ^kjby)g%Sd?DVjDHg+I*s zm-R{Sl5OVRL<@fdo&y_F+lCE14o>%f?CRqK99}u}vBA$SYa*665bl{t;pswqWHAHD zfh`mTU$!&COF@0_v#{-wfamHOXWiVD#LqDBTjWB*!!r^D3#~!yAZwwoT76wN^i@Ij zD9Uq4jNI@#UdnhtzF_P#r94nT^&0<p${i zza}fo4rbr4Em;qeI?6QVrDx8hz+p-&WEk#gB5-}viZz(K_o-@CsO6rK_W-RDE3qQ; zZT{j)E+;+njW2ZTu{{Z%r;m}VG-SrIx>Y;8{I7ma?&A1MyyU@R8JJ z{>$UB2I|o{lPfxELF1E`1m>G;tTs3WR3yUWThM&GNg4J^sqccxt3otT!qJWS+0GV& z9J+k@Qx7usVF*{KSzpWDqgfYG)2`Y{kM{wOK6Y6Bd(m)31tBjF4-?Es>9xRuz$sFB z1O8eml^0E>A8eR7jbp#KHi>^ArA-1|`R`EyRfYU3KdTN^4n;zV2?$jNm^VNn}J`+Vx{b>q!&4JZlcQl<#UmD$Xn4>u2-BWQEK%+K+?3YmB=A^4!u^KjlJ6*_U@ zdI0ccq%jQ3fit{yd;p3KlK+yKPQgw(su}-(99{@ z!SzuwhLipXUqcnXTKQN>8hU(j+DFJ|&U~bqS7nLJK(}tD4aXbzJ^a*NI2tB$G{|m8 zB=ViZey9OarbIDxJi7{hJn!hE?2%u2ec$D5?BO7ne&OkM8WGyl3eJ$s<8QTQm1vP> zWub-gghw+Dj9_vHC3u>MiE04WfP$8n={U?2Fg0NkctxYq`y-Uvo-kv3@`hmRb|}ua z8RT}ueVz|mE~1AXJZ~UBqyu|;NR2xjllOFuakz-$XA7Mtu{)r zJ9t}w!rp{iBr|>piVK-k_wkp?cP1sOt?8!x1;V9lkDd(v%e2gxAXsb;!n>~QSpzq|BQuuPjnHeo8aZmsh{+bNnS z)#B%EsWmSfp*y8r^8F#zH--%q90jJq1l8kq*+R|Q@nn9vk#fwm;gl*EgZ&G_zyo$Q zGb1{ZCt6xP0!p3;HlNw6e8*~VwP%zlvj~I`PLuseMx00Y_?6QP(1-Nm46&5hsY#d0cuql z%s2wg;$caS0QnU)pZ$wMh0h}Wl0*XpoEXvGdG*wc8L~nxF41E^z0-NQu4LB(H;)~2 zMe52tnIGNc(!WRx2I1t5tj~z3Hj&2|5buC~mqtoN6tSqdmX8i=Gi49%CIMe-?Y2pr z4=hXx?bOq>!U$d$Pf?t-$1F ze!S{n=@Z*~XT!sVFgx{Rk0}heuaj!IgJ4~tzEF{R9v~N;+xKN z6jVTo{PtBq=wY)d=A}m%2w5rS>>^cIAmgaa-wi=+ zQ>johw<#WaOE%Pvdf2Y2W3t$ z??aLuFTW2WC*;(ZtsZUX@_Q`I=DZ$p1uFG@LwrJ&E~f*|v@Saz17QwP;opP^f9KAT zAmYBrK5rEr%fd0QPjvjcOYnPk>bTQ<`Z4hg#ag(5;Ji(i+&-$aNOVukZWv_mV*J$Kc;9`7Q4LKs59WxHyPen1)b z!JeZ_*A}mQuJHYFrB|_ceq{}@u0J@J8P1>sEBewYbTIlo#WM8~=3y5XK`)wna1@`# zp@Jh^|wJ-%x|eL)gYie9}&Up*sRMsN2mi)6}yY)~lE_ za?8b(a>GWkpyfIxcqW9T5tI+^t8JSHUUj2(l+K-t~2+qZCC*jqJ*Q|u#z*9YaJv{}l ztPz8TeBG-}s)J{W3jNfE&1Ml_k$1}^PFV;>s}uqomN|kn6Bqn&e*pD@H502038qHf zZ^%OP`3g`CZA8w$4;(5;aNDcdv${^ zY5oz;h}BhiVS)u##LZX%``gMt*aJ9-8%SPz)AW!`OXj3SUNa3VxYN>%0_+vEa+8+AKYQ%8F<*gTiF~S50|1jyMU~JRj z0B%>WSV_xZ$>-_uds6>wS&w$ZJ6Vq?_Zcp*RALiLghoaiu=j~ zJ2M!6oC6VG?U_Zw0V&#U-K1u(^v5juVO; z5#^&NZ%q&&_YggeqHoYoi$p|dKJ`*}WX@R4nmrPJ1PTfG0@CGuzaAFiZW=Ljh2}(v zn0B10fYtqx6tu9UB|tOgU4~%W5{-G3z>{X3Bb1FqJKn7V)m(-!IS<&=ryf+($9`k1?MLiD+6}2OEY0=rH`bNuaQxL4*Vw1`<`>S?A6b z54}D_+eS!!mnfzLh7x6@!@piqaE67l3{Eo2R7mD0pl)-c7mL3 zOQ&dJ0E#^?{hdRP9NMfPqp+<{_ptrI{B8X=7bK|4-mn}>>=X8Ou#}zRxTm(Oaq!jl z!CU_mQMZ)3_{H#_fsL$kK~CORj1aJ}RZlCn+@vGcO$Q{fFC=}}6;uk)lXZd}hwzG+ zdS+VlyP;HpA=}c6+J1UST&RKScFIvs^sg4Rql6$@@Lg$8LMNrGg!LA^j(6-Vt;gx) z8c9iz3M_Nyl3#a?K)7oPAzk1z{IYBou)(TkU7mKt4~Ye-NVI0YeKp=MB_xloMeP1p zMkH9ZB5X>Shpe{0jfwWvdGVhtQ~dAlkI6yc^5>G@=QA!FBBzG2=@*m#r75?!o1oP_ z#p=Z{&=fOL?{lrNv*5C+;tkEAdzQ{7oXb$<4x`=C;b_uMpAkV-|tPe0RpNf${-*eI4+TJ}>kBu3Nny5(sY zBxb0jH9A>xgj!u4n8=goW4$xfKEX{)aJE1ROp`P&#jfn6wsJ|qTA zWUaw@S(XkiB~Tm$+rXhlK@OQ>HMf=Y-O*loI#(j{eXifwoYdC5NE0EgL7KuvDFZLA zq4C`J{3%w@;df~3+fyX9?{k(^jDN$g>*WYzoX-5s#B3*etX;GtcW3%dcp zY?&0VMsIN!S$az{S;;4ig;sqpAc<;ymc9GH4lFXHhd8DI($mG_;p^D z`843`{4)Z2acgb(^MESBw; z$*Gr)!Y_l^IZ(b_kH7!iZ$3Pz|`3F<*sE99X9bzCmz?kY)OjZZ2ug3xG4LWP*S610)R`j<h7$w0t;8a1%cQRZ!J`vRk5bCkob}rx=z>=p~N~73(6jo%6^v zr$EwIU0ZKYC=AXV`J1fdM$E1U6$|wxFAf-y$NO)ui z*(1Xx*{cc#cP#;#N0OqD#bCczAStn8HN^^2t6iJ}F_XWu&8oNWs~1(h)QgY^R4&nd zn`3wDky@(opfZj}bR|4Rb!#|oF?_lHoF?1v!|y&QNe8u_wiK~=u->YQa6=bk+qJ>6 zSGg(7%9v!da>e4h?n|xdiGC49znJ9q=UjP;N(FsA&hq5->-p6LAn)Tc))2V!2Ahmy z(Z3z0w~SLI%Yq3YRm%xc$N5V$xo`f2a8;2vNX~LzCOjX3JxLvu>pw2z+KR;vF1bc7smW7Rly@($^7q|u%MLe;$5hd$#Mb5JY z2z_w+yqc~PT$z;({wKkyIp3^f(_lGd}jXupb5w(Ixe`- zsYDUx3yYcwUn`&1kAtj6oQ1zq!6^fC7ez1268w5tED8t`)v<)^t$4zywNQ+}AE;2? zJK{}g==VtoT};f=uvUwOopj!Im4H7>NL%j@bn_uq5SD27Y@Kj4SI0!z?}{` za658xlyoEMoNLChfF}^ix|sa#WKu99!K$a?P3PDmK9rZxwq~Z3Spn&i8IR`=-ic!y zV_(OEosH25Ls*Ix2k1l*_a?i=B)=`NY}mjOBzxXk-B5tk5@S+BK0sgG;4uEF&k45c zttX=w=G_-2NV{Cmg}-K?)7x&+n~iaLyD}{4n#=G11|Q1Tvmajr{MSjhp)p~~Ko}K% z2dUG;IzN_<7qMg(3i@MIt75+q>Qe-or)s^GE!WT1(*N}LmSxeztf|7Op_V9XACq*| z`cI`*363(qb((SelJq1XIE8GGlxoB>O+30>4De_r6iIaP?GuUfl{AW!EDFjl4P5QL zzfQT*IzLg=;eXEp8gF9Dk)7sFE5<|7sXpknsnQ**T}vC56qh~fN4+UeH`tlYd0`4u ztN~Hi!q)%oKPa6xA=x-_7Xpp2Rv9~yr&E#tp_eglp5OXcgFwW~O1kbQj@(UH_2B*) za%yA?m9!5#R97*!Jsn%a%->2Qxz2_D^&^6|+-av=AsWt8hK2d8^U_Jbo{O$<5m4GEALYUZFv{VP2EW7DBJt9J*|ZB%Rt`%gK47By`CPaHM~ zp@)8qB>7#@IgC-C&}K^Vx|f*@eFp5&HB3OciB_gfs*w7#rMbQ8--jzo4IN zouyoRC^Ycvw2^zAN)HZcw*qrsjz9@@pU=btJ{#T-YAJ?~-zae8{6TgisDr<_v@`8W zW$*3jaH*FVi6YNLkObN7*=$~EcOtn~pvJvtSOvHM%X;9ki);>ALh&AxZLtLzRAEzN zzEo^?eh;TY2rPamO7kv;Wn0QmO#xU$HyLP;t>KSi!YF-g>_KZpNa{{`rB3$pf4T0R(Eie0 z@rq`A)vv{TvIdz^&{w>R5paV8@lLa-040XPW3W238hg!11e@cKkwpzc$~kW z9*YGB4oJ{@hbw?^+SKceCmHx;f6t#6YWC~-%+J3R7|M2kwy%Te zGyY}BgLwSARMgbnI#eY9q?$bkO-ltEQ11-ksu@3<{yeDx`cIJbQ@ukMu%Dp*sJ zYRtR{y0OCY-w@UZN0)U!{@0*J@^7Sgj*_6Nu>d6wLd<&{dE~+`Fwj_ZF!vTdbPoQQ zq^);IQh~4BN4n%j#dw{wD%*0Y+l&fY5BsU)fkAxx#*U4h*n`)RD<`F^5iX5mK7)zB z7dZ+Y41$F@zh|-EO{GFPugNDp(g;qv{O9us;%JCqDxgmei_8$h@PD|;8^-*n461G$W#VH7h&)feGk<5Goim>2g6V|a32=(i z$(ZU~jwz4kspjHy0s@~0*SiiTzs8h^i(9W)=i&2m=q4%?ncD^$QCath7=SGJ7dfgx zEp&fS@KyGa-@TvC3b^vdvUx#nLqn9#3JHMxz&4SL(A>7a)Cjb;fYHscZM>-tu6jVs zR~wy;%4Shx_aL*js%rPJv)E_-B^p(L+mC3baC)(IF7$f;<(J?EKw+0H87=d+ByKSz zQ^;FatUy@|P6d2$jnMI?;}yZyO5m4s;4J0@mXjJ<*(PpG%Qp&KLe|KVnufLayAM<; zib$!opQ|PGt zFtfCXclHRj;J#p=pf$Gh%WUck|^0(2;xF-4|TuqgVscj$K`b_(c2Mft2sfpB&$dF)5$0!p1CC&YskS@{*x#zwNr5m-4jqDR{L< z`5wy%Q0arYm84Q?39cY(g1hzmUim*&<3jW6p#P_x@!~i%b`5y2HFe(hJXJyL{k+$T zyxv9w7cs72dv{Ue4QIaOd+||4mG{_sfNKDqh(UFTy-3n}fWk@!j358y>`QfB(S*;% z{lq%q%Pj)8&!dox8b1fI6bZPV%4`nXzZ@QLt zmw=cQ+*^x$-@EApIp%hUGh!*%c9zHPKks|61j3|3m(D$K^RB0t%b}@dnQILrRqJI_ zLSXV(!-r~7KSnqT(#-f!aoBS{wLq4QM}{a?GbS(CGg0i`Zln3~NduMe)piJoI6`m= zCTeh2iI!Q~pme}73el#qO|x$2v6*%qhLp()L7htiR5GT$MaTX5*IK;ArGr03K3iHo zN(qF~3ekF8rXLVDy5i7!Hybrk+OIxnFK0{i_Z>-ST4xaR2*7IGNhY+FlhDnFIOA(%QA@DVkbwsgYwn zQ*M~NDCKUl2Ce3&rmGeWx?&65jQr=3S!GPa$h68qjHEmD)a6ImTpR&oct`ZJ+|4P= z#M^vltr>%a?dp+kkBhO5>l_IOb%Uji5VsAC_G@{xUZGy2vKEF_`1bF%$XnxD=4*sM z+aTpkI9*gQC4;TPC}=mF-D?w2kz_YvOT*%kD-%*kT}TmOGJCDKxffhT_qpa{f&p0h zB<5X?t_=>1`UP|x?|X5_1*Gnvnb7$$EPtykI@CCHgJg4z&v5|{`rhnQ4alC(3AIwi z=@fx5SbH9~r1p|_+j19D|OP~N=7 zNp(>+^_r!V_{l#mu+WKxDRvaY20-ngo@pY_N~tr$A9>)U(_8#=IJOca#4K8%Oj@t|Y@!tdT>*(N zw{!;2A-?e;70-Hn#_+4ELg}|MI>*Og_>BG()vu~>3cCnHoDCQ10o)%1VXt&V+k9yL z7{_D01;sz74xxPZ_nvM2b%r0N1aVie0n?rT!(&qlrqk+S=vxrC@eKGTH3{Oxah{i! z@ZD4=&ThY7pq$eZxqB%QaY*8ota8Y;r&a~sP$-R3bXt|Hgb9{LX#G{~T?+K;vDUF9M*NZyvfmSrFon z_LC#v^I{S0q=-efUFLeaUAet6wMkB1bd>#0_%UEaI4=xEB`ITz6X9if5cJ`FIeGfE z*cdUS)k#~NFQi4=KePC`+HzsjkB%T!Tt ztD}1EE`m-Ehr3;-Nb9g$ooP9`Hd3b7m-S7vTW8P`GOVjjdq_T)vNWy$x%~=u;6B+u zgs@`Uh+9mb@@= zGO5HrOJQ9|sO36q=>0hVd4A_NM1m0mzX>0lK^oqD-QYNAI}_CD7Pzikz7ai&5xnAO z7)!8-7wz?NPjCnyUysk^DE&U_IblERvu{pms-hT#8o$T&fip}HWh3BzHR^pwlYrV; zrl{4FTp|iE+>c>)l!6Er=j*@Qt_`2W-%#;WV+~o~SEvDUtS>L)$myI_*jii$ubC*u zDgL~No%!zJH7H9GeI9*@Wwte4eZ`-OvVD2;8$;?!yKqFhM5Tp6ggST*QbbTrj1~ZS z9~H0+B`Uu^oTMOzoSwcsXT2bFImF!4K0W*0xA62NXJhfTsEk-TT?E-2Q9);6_JVjR zJq5+{ryBrLLXT8R>{hA|N-N@fG@TlPCkOQGs3#W>opsc$Xs9|~f3>b5mIzhA zd@dW`_?h378z{?S1F76YO(ywc+_L7A+(dGZOFvMaU9HvYfsloBQ7au!2*%CV<@MNJ z(39OJVUG!)o1~r}^7>{F$r12te2I{`>ekd(kc*4P0fAY7ADs>S^9MzAQZ-W~RP>HM zC{l|qHf=auET7Um+Bnk{U<;f3ue)hnumk~wAM{|d;7==?%iW~#Mg@H2B&C0o!VUO31a88z;Vg2C*!eZ1wj|ihcy{C&#f%&L|1)UZ2j+sO8K$( z9Rm7KHctF*PzK|FmKughS4RP~B(bJ_)qcKS^dUL$BeV%{mq|A&JA1zezwV}LX9Zwc z-rrF}IeoU$5O22fQxBmT;0gOEuHaEHi)2c6mT&=p402cJ8obz~UL*sA3V1<*q0W>4 zxM#+Jf$G*icC&~whBY!TMv1nqMhw!|!E6aIFU1Tk!PCo(q{#b#ZL3a@nG*G;LJru1 zc3fhomYBooy{OXG6w@ly6biyeitA7A)k4ll2$`(z)2FWk>?M9}0RB?xNAdaTCKMFn zl0NnEemFb|;XqV3VnA>|pn&z$eO49{r?P%h6kRL<^pkja$CdERkT7p<7Uy;Pk#U?O$t1e;I8 zec9Is)`&2klYYWhNr;S-=1Yv*c~Nut?N%(AQG><@$IVxF}lGRd8_sXYimuO zyl_MV<_Z`Y`j;H8Hd6hA1~=ct;8va=E~!0EEmq*ePtKARq<`@NW$6BPGZ%0EKP64p zAi0TCk*U-Ij~I3=#G3M;O8E*eSZ)uid{Giyv^d-fwoS$_lPji=hCau6L&-5UlD&7ppt=3;p8MZ zL~^uqE?rF4rufMVhvO*qw^NN4wBlF`#r_NVU4&TdOhj-dc0>Cp$Iwh7`LPKG z%q9vda8iyBozVyA6p0UnZRKfxGHG!2pk$X**k?+RI`4`%pH1i8MGSoDAr)^7mV`*z zP-6Y@w*0Xd;fhq0ZHW>aD8``VpPWZqE8P#uguOG}mNW#2Ks~wVdKIPn4+;cvH)FO) zq%f-kp^z!wKW>g*e?65Ecw1>|*h}93Eow)Vcm8gtqpK z`WCD_K?t#)v*JZ8NG`zA96hFT2t(*dbJHTMy^gm?c>aNI_|pgA zAj3B=oS)ZiUZ366P0YFgFf6KFrUQbw8(3Vq5#^hm?QWDS&;zAAB$& zR>}h1ecNXI14*YT36%dus*iXQBw_dxQOlMIjRgg6l?{dThcA#lBpeiOK*nzmn*!l8 zrS(7ucOnygoJT=;wTM$8V~q$(uYjm_dAQNUyFEe3RbNmhqeMc@k$bgGhkKN&irv(WMw@DHI=HAM85ISL1AG{=#8|cM!z{)h}JyuExf%4x&J`qz`XPre&#H4wRk|vo73|ay3pYMpsjF z;o|kJB68R+`wcNQs}DQnrQ2rWHYPo-1Auf3VGO)-g49a?qe=x^?X#R%AxctS7N=5q zYa`;Lo_3o_2NbY0G7WX;AuuZPS4}1WkvcCw7JK%dtSKx!0mUF?h0vb;1J~?92%cX3qn?V_ zv5At$|7N7zwlXshi#@b}T{u-CjsETrV9tqzDV9a5Nhmd2oVNt=u{%?~B9>G?=p?3h za9%o>TNHQgLcHAFGoSUZ7knf~A)X9Waur ztXE^8vk#K$=VShd4n!N+1xvJlN>kGYLIrVrR#wwUo1g38v>x9==PRfmw1pKVJ&PIB z=_D6BrzA)@X$o&2kE?_)dq1Gk==g&%?Ps&|5EnNHQu+&G^R#Cmjkc$iyyFze!dYF% zf8LhZ0~+7CJ6q`TYydCJ$qR|~=NoMKsmUfRoHXJ{U_38>ph5=T%Epetr~_a{h)B$@ z?)(=Q?I$xMEjWasdfO3`AC-hlXCZ`SPm1qV zI;@*Dz!7amULhK?GwS2MwMkWGJf*Yf_YdGC5b>yfV!Zij@7!RqsDhp^JVks*zKY(^ z99sl}Oie`Vjs9)!O49|krpX}?hs8Tas2$sXs!P+Q{||5dta&dK z=zcE$tJ3M@2_JYeE`=NWs05Z2VLA=I|q&*)o_PT^#hBq45rFVDIyGp4Hi zk#Oo63AzsY6&)g$;C_8a{dSS-rtsr~c5o7^`N#i-2B+Rf*QtL%aUAk%^P5wl zPMHb1g|?A#*&E(@35tAp(Y=kL)ncaY|K_-nGSTanx25@4>mPpi)JY{vsAt37$#pF) zX>cGsxPn@1t9Si^-FXV>)sB5&x${MdSgcixK4w=@E+B2gL0P*uP1Ks%q-9rcFURWUeWV{diNR=XQ0~ z0AUA;g`kM^ekBa?N%rqVS`Z)e1P===l^XYUb$IolaHPVnGuQm@3rw^*Xl9ngDZ465 z+Wv;Xv=W2%XXI486MBV;C(>0hBueX*0D5pW<*Q->L1m7`NKZe9Eo{TI2>*+D=w%MV zX>QZ7DvH|Sd8)!hkQ02*T>sysqc{7{<2fO2+PSZjCFC1_i|zDf zY4}BMX?yd<%qlu6l|>Do3rXH~!cexJ_rl)9y#e&v+FFW&;ya~iE^0tRF7k zn(K2?UqKilk8~G?&8~*eHzse(m7cEKDjko^-q6kpN{WLs`Q~JNJ3^&DfTErL-?>&n zR*zGeyJd|YmZ%?{&*{cEBOwo*JuJ!5x<02%7AV8q@$85_H~>ta(>bjP!Hdpjht~b< z4uH&%DNYEhR_T*|f^Tx8b8^in4UmY*rKwGj39Q(r`XTZ7I>W>&jTg#rD z3(*mEO#m9i@~ht({lnnN%(+1c1x!5NkJm`tK8Uvt@;j3A1*27$E&hfpFOkGiIgd)r z?bp-m>+5eVPu@VYwl(j&HA)|(wPZ&e)YWBwVJtN`=fmzQh1}{JE1dpSoESsXHu67U zGM0+LhM)`Fpc_`#y)UunuMe>~K98Hk$V{Kw?yo`Rohd2e*FEk}Pxj~jhJi0Fj)`6! zl6HRjOKy>E{%`wy4(kdcos4EtT{Z^{OkM;Ol-&LO@VNlL9TGGMAzFl^%Q)Cxpyo6= zX+Je>+A|B}H!RFv)Q>w_{o0JZC-A7bXSB3s6IPas`C|vOe()W)J;Y~3Z(ZalnfDtm zZ_mPOF2@zZ_g!aquh*@HPs_jV)?GKWe48PBkg{do&dy&u$U6GhKbP}cE!vJa!^jl4 z6;h}^K=0FNf6IbNW{tU0r8-A~G9W{?KNDG8BO`&nrHS@182KbO5L<(u{CE0J` z3rmw|W~gXuZ-C$dDpb4Y}!B8A;vh7VSn`w>Ak{$zqf$cqs=v0HIyI$YLoN-zip#c zxFIz*sfO%`rb{dx<~aR+IKp=`V^sp6PqQ8Z4eygS0+GOhu<;4{DDNOga{{@UU$6Gt zT|gJl-pCF4I3L$iq&gs01ltAE|cGYffc7o9_Zp(Y~!n7y%X4ULVSpFTCiRzw^5 zxjoxXfM%gsQAM~yFoO2A+Iyg8YKt9pIKHauHITY+kdx7ZtL}!okbEX#zIp`UG$7>j z$M|%LDsgDWLfCCL+PAlJqeJ-TAE-s4s|O1qpBV$^N4w}J>w}Mj8BQ|u+PRZA{E8p# zoV*+)tCq_Q#XG!AJeSRn7obow%tgfXS+c{vH0^aaS@naN~T1-lkK6B>co?)&)eTWc_X2$a2^jK4mf=%YQMWJj6l zkC}GNw{*9P^?k+w?h|FLWb?i@2P}#&z3amr}|&!{nhQ0yE{bN|b$7m5cQh3B__h@ebyj zqZaBva;QkU4-s6ShW5p`Eqi6D*oLL(_KhtTbVZJo7CUNW>~Pl>s*5*fr%y-iEhHy^ z#O}~z@jC0t;d6BD&2c_u)VgIT4B4Gfk?QiC-sr#>mu_F77m!pTNq@N8D?AeN$C zEZhRdg1vy0NETefvZ_wqI8Zdd`*E>CxnPbGG!_zzSyko_^ z@c24vrMaV3N#;@AB72kC+CDEAHTc5bIk%SA5VzrXmiZMH_RkHTqVjCtribtG*1t>> z@_0cjG-7u2fBsy7CHzw@Yt9Er=BVU)la#t-{e!qnny1XrWbTL_FqX23I4j-elSVOw zIz!W*>J~H-^3FGnqVYak)#X7n2|S16658QZ+o1yE=)T>}vB=HFcU9tEz08VzU19aC zkF|@*jfIYnQ~xuf{JjQb96dNZ|7_|1*h{Uk&lpS8=br!9>HqYxb#?q^?A>an`#Bak z7NVM=>8F-{>IM3)+G3i;8A_II+)EX?eKXzVdK`JdhNNLC>5FDfTGed%-U7J7ll9Gn z``&zs#Ej}=$y^jisaeZ~(>}j5eUe$Gt_9i+X5%L(CIz{}dQII20{Zzw-elHD!@vv6 zM8|!%gD5k+{u3swo;-xWJWkPLW2Y$ibGv>Ap%M`xbY)%j$w+jXMF&>Y&ba>Kb-m*sS;EudN11{nMOj@1VP&S-@qlD zCp~Zo^Sd3{C76Ho(0=iBf4CC+C0{CNDBgEtlZ5+>$0c3-Mb(xvjkpp67!*K)LH%W` zSx8#3e^^Wo)8jYApg4@gu%if+O$_gk=C&`Y;lQBS(ZUc1K}^03P4oKp?2qKSMI*S@ z061O|PIo@CZ{1{q0Ze?{`m~#{P@*)7)7@Xa<1(X?f|Kd4du8H6kt4oQ?^wEAeNheb zS5_VJ0|CnmIHF$xuM-S);EcasRmRv#jDz4=9p&H8W7&?-*;r*@r6QRP9T^*V39dkq4u3W{c7crcu=5OP}8&itS5j1Nfq(H@J7TZ0SblFXDfZ}rv|-LC{jO~R8?JkU7nP1X0{49+Anfx zK!YO+uRM-3{r~53YeDiuP?|!b9pY&i2L~yMV~7|I4gG1#6Z~ws4Bh-K?X`d9pIPel zuo&HvcHKCJmd7+8p#x^}r25;elYz25^|YU)4`USB^iBSsC1>*R*HJcAUX^xIlDL{+ z*(`>bfdt+8QWD88XB`0%R5TJ=v>&8Pt4!vbni7B0Zp#;;egPQga4Kb}!(G9W23Sco zN6BzenEhBRb}}?67fzIj7gQi=qQXc^L+k$P0GRwLp}<4tMNXk?d+5UI-sG2jhYQc)DsI~mf~heU zywecRM-1tJVWvMZo^D*PDA1W%10BAjY}r6SlCzMc7FovGYelHWlXB=mTg~Ckzb9c;S9>(#n!4wdANx-Cfyi?)q{D_raw*Bv+`oFw|=`1%E!HI^E_oK6I+J?c;$><4_hHa9|fnyKo42#U0T)M zo?^N&NwXbO)|^zsQ)R}a26bbRNYd~0$u_#mc*uFkQO1JBtck^{8vYXL?CvXF?c6MT zDB4Y{&}as@ziO^QaeEKedl8$D`Hyw~xBn-K|Nrw!Rvj+S_m|Z;Y>Y4J2k(itAGr)k8pc8&z*bkfD zE+E~UD2uD($8RA!>%IE_I=S*dD7&`*DEl5UmXyH=$=G*kY!O02mW;7yqKIT^l4Y!U z3|U9^U5tHavX*@bBSi>M_bCY5e;=uuT+iqv#l z9+)+eUZ%B8p0%U?rb*03ghX~ur{bJPvoht&otzHph@Ca#3|JO#!MxDY0`iuYgIvSa zkIzplr)b%-@$6RvAB33N!9LBC3j>mm=7aC~5z3SEhlEc`NB5_FW(m_rUw(y$&>23` zF>RFDkxgt7ZVQ*_i>TXpKFHR>hBbmETSOne z^;{whC}iLTGanKie;^a#O)`XR{prKc-Pj*ihj_QxCydk4m9=E%IlzVO%zNzDxNvq8 zqp)H2t?E=%x&`y2WabuKajpD)D~md-%iV?kWZIbBCdH20Leu^X-rlQR<>i&xIod{s zb6evs%rK7w5i$peB-l?#r5FaHvM-v z+8Co7{3zfDV3GpB&=J3Paex>T?eNQ$1Ce#-&W_O$1HUA>p0i_*P zX>+3iVzjZae~y$5n=+8l91M>m_KDn{SX|)hDgpx_RNp|dh;;S#U4eqAe7-P!o1=Dj z)N5cw2yjyG<&Tc@`O2pj6x`%fr7MY-nOGb%!LBF;gHzkqcXe1Npyfe54q+(QE}wcE zSsNJui{~8i$#x9RucT1MvVQSNdA=SCAByzQ`wpF$_Pf*3T#gH8{x)IS(Ou2(;LL$z z9jx8fohB=1UC&r%%Nl^tzrIep!ytmjDk>JIXTB+4U?PiGD9*3AUMdDN6b`njDLP*g zx*<{UEX1fdLT@CVg}MOP(XqpDD7i@1evKV7`Hj+N+2+a;)K^d&yxvCb2s3Ap7 z{&ykf@jWdc!`>889Y7u#*3%E;`o*E3SG=b=L-4|m_P=$hHjfTFJX6C6$XBoa3bJ>5Vtd&au6k zN=s`0c8u7p0SQa_Ug2@8epK2nT7*11i2Kfs4!g0SBNn9sEA$c}FD;SVoHcWmoP{Df z#!h)??`?1uMY+BN#(^Rv^HacMR}0tDv$I?_d;3OgpsTzh_;Fc*QkWzS4>c=eZ@O zz6BhJ{(SaltoEr#m%IE&pBsKb$;5@COv0m3ZNqYg1`e%*|NMEPY@We;pSYL5716gZ z(fpnbwqIRHTwq6qhJ1Qk_-)uctVNAD5tH_X;Ge_zV)63J^t&8dl)qbp_p3P<7udH5 zbIwG>3vOBj8>ffQ)8vbb?Fu1C33AP*P#OAm@cH8NtBDh^1xXFOY`bqgxe`;CUp#a2 zZniuXRWNYr$J^Jqq_2Gqu_U%cYCs9QwB%Ih{+C;>2+-?RR|H3G|DNS!ZC$l;(}SAuD+!8$SCb>SMnyHV zD@O;fXu{AEyuY`Sa+#0^hsr(l%eU^Pn^z1JU^zSANCzp*o4JnQ*aD}kszw?-iaFm( zxTEWze8BWKb}`Hgha zdc&>@56)rEX+*aPt=f+TR@Gy!=(4JyhxvcQ>S(W8v8=4W*OkK4l;O$fS#x@Te*d?T z_-We}Yb7^ndv=Cu=dr6$6Qy9Ia1SqcnGyYIJ!F-~;u|P;1u=u6Ri^ zg@I@^`SIhuO&@DWG{EJPNG$UJLEuT>olk^#9w~N224^M1kx#8lBZvy+%(KdAbiT<| z!~}b$0s%7H)UO$Z+WC)~!TenjkJDtsJ_{Al&(J=&D;Ct_0=xnJQQuW@3keXGjcanh z^zJiDHNwAmSi1%AJbOqL(2J!dI(TZP^&7sZseeW4XcO@Ss$05 zAKM;Av~x(4LO~{6i5T!RC3xT^b_(Yu4o&0M(6mUSLJ~Vyo)Ak9qBbtvrIQJyihC}NP&_3@HUUsU9}Mwsi@^M-p1I{L$10qAlT<}13Fbx!kta;c=mpAAuk4Q?DmF2 zC+Veik_Z`QfGMHG<HSS92)*Yd36}`KWr2%QP>?MUjZ6A_HPz@3c)x|)A_&_a zzt{?IFf4OZ<)RUK&rTZK3%cpm!!Nb=_Q^u!KHFq*$QxSI#nsfLJn&uL z7su%B1W&}SdA#XSh|E1Sh;Nsq&xW4-IL>oo_&}UAS0*t;#{n{OjWADEP0LilN!w&PI|KX>aI)nN@jv0 z2U>d0=GL&UC5YW^FT{GUM0I75)YG~L;I5+TYZ?2be&zucPedILNC44N-zLE1h3{9) zG`kfdfHBpizCwAbG%~a`sz*EO-K}qf`L;1?Ir_p0^D&LQx;3Y+i|Psr&xd2BJk(}TedM$%Tu zkKhC zKnTGm(vfdl;AiYSZwjuyxVF8;!eKfrX1yR4g<=Ng0`JRMI-6CQ_Vtd{y)}%%VG_({ z>#oOK1>ThjL9{O&pA53#amjTO3#bxuXl2x77OCd@R*Csk@ z3grMcQVZy4N;oma&S2|rgdM@S&yB-8*siK-9v@eaGMsH%ik`J`=#eR9?NoPb)qX#Y zlM7h71fG2ZC`o?u=)Fw3RsnFlOAdKSLrNfg7ivCCDLBx7;?33y!Epj$dr0lg@8EYj zSPcT`PG9Sin9O$9TSxX^+;YJu1eR)eA|@ak>^!y?F0iK>zr46pLQS&lL5K$s?aDktP6{MRF*wO5w$) z=?o+?2?x~`3}4sk%;GoBG`j^AMeWJ(AFFp1Cu0i?UwxS3+KJthQ75@h5);OuNWx{- zKc3OjnIOIxc`_jBTfB(6OVF_+%}44|H+5Cw+dI$68ymUcBm3&Xr(CK8l?s@-eV-*toeC4U3b5+G!M}c))?Ns?W|{pVz8RUv@x*`tL@<47-hndh=CkHR5~R zUI_xw0J4Zi-?d3s{GO9M6#A$P|=*P9hztu!3?uF24XQJgIauoD5e&9hXYqQ2AXOKO_^-77w1x zv&5sFq!c}^qG#5_m}=Yg80>(!(6E7gObq2t4-jfGTh3D%N!H~DGA)IC!HkPe0#h%A zGjAjw@__^2Qv>5laBprP-@r1|-^haSdFQZ-#tPR!H!7*}wQRBgYe;&2W_* z!IR*Y$B(1PLN=Q;_ecHyOrWn;P89j?_Ae+ zuJgyUd7fl=6Iw~GAu+2U~GvaTu7!1hjwV2=C7*E^_+rFfbUu|GQw*m@r6SU?ijDrNp&-*3OKT zqezGG>tY(61?eJl(-iycxI=oZMko>oHa-g4XGtCvQ@bG}fB%p?B8XI+gfGpM97>7i z_;XobASBsR4MPCAHcA%T0Ou!d14#(hI3w{-tQ=3J!^Lmfi;Kc9Le2A{T-w~t(8a~> zMN{2wzn7k>`;}`%I+-BEP*s(J*9r>Hr^~B-x&1)!6Ul?HzZ+S?lImxZ@6Z@U#T~or zo$Y~022K15f{ufpC3Q_r62`;49)eL}H9JONW z_$lAtZ*2H5lI~)F3+FS=SJi{loIc@(o5Tw);$yh{K&~gOu@SJRF84;Q#D(9rhF-@P zNO!sH2&A&5p3`m01 z=-kl#YS~OLXnJ&BD9w?+MWOXxI6aLLX1XP6R_eM{m$;RyquZ@z@y1fpDlBInLJE|*W9+I=y^G?q2-yhv~z23fh90xVKR zJ1iRl#s^FK9kdvxan(je4};5Ni)j0a#R&Dd`S`sN`%fFHM3e~)Oh_$X4)y_WiTDK#WuGI|{)dga3IF6v^G0^O6C zSQUKm$tabPKC5yq&Kfd>$#*2C?Xo&J!7@^jT7_65Z)f-R5QnWl$nyBZ7S+)XG9LrJ zL?Luaq*xB=QYqL!;S8ACWi*6PFI_D$)Lgbsj&aA_Fbd-{utUbq%gXgatd}~%du>8i zby!1T7&Hq10_tXO=Hf^S;2rg*du?4kHvFFR9HFKEwR2ESp%y|lgj8?N7B$l0P0&bPD>PdyVrKzRgMu<7X zsdliVv8lbV>?FjAu7srMQF*b^9A!KzR%WA_?yvU8PkRlW-y8u_``o^ztL3bLcsP9F zHRO^#inN1v9Gz;jA#%^Y0h4d?V~Ji7Oj@xIa>{~pZ0R=!QMtb^<8<~yUV_IlbFZDq~u^0uwR<@pFZ56 zGG#~*J?+*QLDMv~l^!k*1qe=#S@8AK&{$}r(;T_oZgp6>4N1~MGX{%m*!8PzXVtk; zlA?{2X;*O4;GYz;%>uR%N?Y-9nnHz}I=+v7Kvx&OXi{KW_TN)cYli2-F=zH?WR(27;`5@ zPb}3j__&@#j7svyfBWLxv2wXcy0=q*dn+k{!Sc4wkvLx#h$|2wSTL}D#Qk9^kr*qh za0;s#`M{|qpc!xK3t@+hT7><`ZG+@UC9~aH`6{z;Moex9TO?cdlSVh~y3t-!m8|J!-?eKri?k(-84kw=#e0c>3V#)T45WW-egAN&c6S zO5-ZvqC;8p%FR}5PC$&fzYNp7a{J+S=<#rb1$6$XA2=W4nMFHIjC64@Nn#rKn1+(8 z46y!wzP2QwM9?mAd{Q5DdwdS5?6dz&I^wZ2gRfqP{I@pojGXbQcUn5|ZG?vd-|RHs zgl}DY++z^7H`E=@i+i|2=W?vyBgMs@^OfqMJilwP_4p87DHoLQ6a>DHbbi^IU#!-3 zifJ}(Md=GyES}daXw=vrkjMV}Y-MzcFTfKxT{7O?Qa}dHij|qeITto#uONTyDtN8^8k0oaZ>-nwk4W0r`!LIOV6jjNbTC z28ZP3F`xPwX-ZF&Mo-`i>)@LG^3AGCu;X{ghg@YOc+wecS}OA?hdFdLWr?ks%P7(^ zPbIg(irtY>Ro2V=t5mDB7g%)y3aSvtLL~!aeGJ07eK|WV)$Ub-tt5hUsZ zEv_5;wGyDzjGx_H=FX6jEbD>s2O`-iq9Q8hNnjSwwSnSOzudf+_Eq;!TZ;a>NlSqM zI64<<)zV4GzCw78Ie>s+AzNGW@f!nRKv8P zx4)T>HOG$#OeiFTqnPK4{A}Nz8m7lm_mD?gs!ih@-NwX&x3wtYLlcNHb#BhwH!+W? zUZ+~k^;p!4;X<7GO^sHfOh?+w?kz@UIGt!13I7}`fV|}t!-Q$1s+{>}(k91wYfqB% z@igWZv1h`(WlxNiw+~%s^mtlhBvR5dJ$m(5(zJGUJhP3iGH+iTLtn{eGKy~fPq@4# zOt^V_{NvGCYe~y0H!>Mx$j(|Bj627Q`+`sDXGKSnmSP3XS!v^Cz;{MR{4HLlKA@ob z7UR?}bv#`e%C>+?TV)}9yv1B1(2)c4tru!oo{&XI4()j<^{4Q=yQRCk&(!(KVAA?A z)oYmbnA8tgT|R$Z*H&A`|5iN@3+1`roA%LS{3);;7F7YSducQ6Rv}H%g43(rw!Yj^ zKO~0(EO*%mQe&esUAJy57IlN(1Q3QlB(xy_+w*(8JoDAjLZ0_7ka9QmyZr#)gbGQK z$x)}io4d00QDBSH|FUIwLe+sK?Zk{Q)lWv1w7J~~b3Cegetu5)EZpgG9eTg<7JZ)S z<D^#Oy-Ak7fivKVPo8`8Mc#-dXX%#V;UGlqS&ouXOM{bz^YQsmX2M%Y!ZC zg6-|`5Q(iRn5#G>R1uyi4F>u#Y6Qmc=n&?bCTi?7*r#DJ@9*Nzenr?iVzM0(qY5gr znaUMqdVaV^UUo}Lxn*QenEO2Pm)W=FpoE@#Ujmn+IwKGpjD<2C+^>F*p4B<7_8wAu*mvlr_;GEdtNcuZAnzfOW`%CKjh!IO{&Rm^ZNE zahud^WHJ=H{OmH5abY8>Q%FtflLl9%%AS~hlxM_#iugo~gB9`VYJmiYoY=(|`NPui zhpAXpnKb=lFUxWzluQji6a;Bn#er^g<1~|%k!H>*3=9H(g=GLEX%j2lI%Rz)n-CH| zEPuBcH9UXzBr`#ZAbdAz+EUgJ%ZzDqmzO|MB>wYBM+a{Nw56RU0s*OIfrhaGArKZn znEF^OnB?9h6FXix66!wglRsCt$Vn*Ahu^N4!5VNMDH^^>+2?9WK^TYG9}*(zmbi<- zXVDs+uTpK(A}c^v73)tS6|CuqohK-DOx-7bR!P~nO)n%r!3?y{O><2ddB;{)^>b9xprc$JrtH@>PW`>b?+8BP{+)Cq;us0lzAmH0~9kW;gbbAy8rwtcyq-o*lIi`DlM zr_T7xdIveI3jYI6$gHm_IM{$B|eCNN-1z(r?Bd41==h`bJwpVQ&# zDaWXTn>&s)0xs6ZO7M4bApH3-7b2?z`V{i*7t#Yv>ZY++W(W6DY9t)k#WhYw^nD%W;U+qqr7Bv0iF3r)F&_YuL0wy=1U z@}t69_!utHx52l&EhT;Qn<3_`jjb*jTxG!0@3T(`C+c&p?1@MrM}*H<;GSD3LZD1H zNlS=O`aBaJQ6RZB@F~eWf+MRHrkzsrORTzf6<9DG6CEQ7PF=B{7cRw*nQagLlWl9& z1bhG=!JhAdBPdpp^Kq@t0V%QyG13TuzgWyoU_c^PmlB3+I z#mkUm*ACPM{V(k6^f@V{EjmhA6?T|LkvnLyt9Zoxb@Z~Dc{*+A^ghJs;++J7B`C)H zztk-8xBRTub8~!cmv{R0oC(@dLg0H8h@7m=z6Kn9q#oZ-o{(^h;Skq%O-e}m=rfI- z+&FANl3qyal0AkawJG*h^y~vF!bj+rB5q{*K|BY7Qnl@GVr~%_F_8h8Oj{awW)SUK zIHPX3T;=jq4Sqw8(V#U1$|O&Wil-C#E)29dQjYL>_P{XWdfqI%q3YW{;Q=ip*m$h6 z%2ayO!a9ePRv29%Y~aHs1#)r8FIe~`CaPL&Hmz`4*}N4VLKg0Ubi-zZOzKYFInE~N zj$9R83!`E^@_qcS7?o4U5}XrKWH>SDkKZDk6V1$RYA0)Ec!l)b1FaT7yWLxPVbaSi z_>A6}wn8{&DoLh}vPEd-hN9zU3&rv;CYqfJ2`2yCObexQv-l6#mVU~lP5rm-sJe>5RV%3Nf6=R1uAWxGBDlr_BD)=A9r&%8s^=~m4S>DXYiNomteAP zb`zg0G9Jvs5AD!Yj~=QXo4F~6t%-?Am;0rQTI+UrGUn!ZeJ7P*MNIg}pX-8$oRq&{ zKO`9;KP?HAON>OLOZ5HPc3t97oJ4U+L1>uiQ+7Geg|U^@Mq8JFwH>%yu_{(v)ml7F zC>sS{b$f44#`9**Z<+K)AQ%NLl8~+uat)(j6asITAb<8ipfE(FrKxEV@b$rDQ2xJN zl;3FK6+dSY+ZevqJ}qpTe$+4WbuQzd2HTG_BZ^wdCwvQ00JEEO+yw9E^1 zM;k)$WBhI+_fdfBULn0DS!XUE^JllH?bJl~{rp5$v->o*&dm_wUVm6zcsM6*SJ-s} z1tw6eO7W{60j-~MNgo~x=c$Ak(K%0wjuvVLhb(O_YjqR-m!5G-PaC3J$>Z?v8dEEt z{jk#?7lXaJu`dP*P5d7xt~%OvOpV_bvuM7ow>pvwWZ9w#P{UqHVo%LU?CazE0vx}a zU!gTMF8wu}RRnzMUtCBs=wKbO^;il|HXuTws~*R`Ak5^zbsi8->tA0d-K0fSCH|zu zk6297-zb^Pp)t(1iHwLF|10d2FjES=teH2{g>&}B{wb=EgeX2p(>wO|_I6x1M^wZ$ z=yf6T)Y+Le-{>sMC2^jNPifA31V0`xH>=?KkCdKB-7akfVy zs#@M%5p}l`)nwA~Q0@K2evr=#)27Mu+C6LD%Ydxu!;_+D(48$j73l?B$nOFx9G`FiS}PCw?;4sH_C=u}BXT^{1t0!|kp_pjG0eA91#HLjOx4V?x! zeCGPh`Z@kvzxO5k^kw^pIQ^jyz8T zC(+U&VhSM5R{SyCH57A)`)aKDLoDqqN{$6f#_ufpyk&8f+zWLKU~3v_E(s?V`-pVB zv6xOd1)O-k-#{a$cJ}}V3#*12?TW?z$D)5af^BDUMbb{yH_&k%X&_uJS%Gx;(vERp zC+fA)WtC?fdjF3QoVtp-W;x7$u0(XyBX^G3z*oiB-HN4y$5kdeetbpPx!`J0># z`YKtTzKw0Ksw1`(5W9!7+|w0A+ZF z7gB3x3D+PJARFM>0b)Pw(DFTG8Y}+eFnSnQW$SY0C(BPC%Q?XOeB zLC}~vg_4i2fi+n<#Hi{$aa9e*By(|e-a{l?73j97Mb^g&UwOXovJ;~bwK)Wo{&bWJ z)ACUhHc~>Dw@^XMUqxGRIvQt>C`tX8l--vZ@w(mrXSKPY3E7rOf@(Q?c2I3~c8-2% zEv;i$7@splO*3q!HNE5)S;}iD0r!=J!lrhBdSDJz1j0L4-4a?g!J9c`t1MD7`8lE! zkN5#p=dl{BG^nMxM>b+r%L23p9Rcpk7~X-kf;nu)zWvEkoFAigY{j=?MjU7Ax7BTY z=0go*S1qol0EhmN-xzl=hfaz{AEu`&76$xV_GK>=S0xPL^}$c5f0TPT8fBa5fg1kJ zBAz!zK{7%*vU^FY1joGJ{EIzXu7`6NSaODITM({T5|bB^+fp!63(@inrHz0;Z<82e zrPTfz#rxmG-$>$yZruK?5N#`jA6f^-a%XDF9x_OPxlt($niPcM)C$t>H9;kuR3J^J zhJO4oUqd22cg(vg(sNuh zQQElr#hXglL|s4iAj$D(wIOImQ77fHQ&S7X*j|g9U?-cXiUcN^bcRFvh!YdtQ{~d| zzapwgNwBKh%YWV96Pg`M(u-E#$Hw3pp$?I#1vV$g-u0#0l16I1%_GhX+#ZS@W7mq^ zntaUXX3uny%;WZvbZDDd%Hd7M5rCWjXxvh+boZTwXP-CsFAC;D1a3r-e3_djfkqLt zYZkQtCFrZ(w?zl5_OwiO4ci6WCDGQtnNEp3hM2g#?=QRO%pdbzhUmH^`%C@m%pQ12 zE$5Jj&0>YN*WOf_okiZjA?_>xqyjQs<|X+rlUL$2C_%px(CXNZJMh7CCAe^j3w*N( zrSJmesi};|jG81q4nm`$)pgm01-uD?$x^6t?z1}7yq9w0xo#&G{mSgyTf1JLF}Amo zGN_Fck&^a^=Hlh5RI&7SH2R~ztDB&XH?a(I$!cir;eC)ds5B(R1vWYHZ_=%MU82JE z4xj8&1&ptf?o*`Ep?{=Z--=xL$%dc)cC=pC^d|$QO}MGFzt&+b@{E1~XkLx`);*o+ z*6;a&4d14pBhzJo+Q_u*Q|N#8GVWz%W-)@U#hn)O7AFbmDz5Dz&-|CaCaKHY~fKbL?ysGsX`;)(r{D}pm2 zPZ4>Ywl&;2@iyY86N-U|Yk$xl#C_Up=5hqT>)5mR!4&CH71^L(0`J3d#H{p467Q=L zRq+?Ie)I^J0kqrq$lZuOocWpLJ=u{wmY7GzZ{86reT~!*GztYFyaZhq$E+;1D;s;O z3{VmWNaQZVlHN#!IN*I?7^d+3rIaf{H18B(%$pm2FOkiRW4`i3>Ki)X2nF|pC4{(X zp^2OCcb!cpupfQkZ%*YewA!tplogD8w-ZX<+7+F*(aXFctN_YcFyj*niWmjCU#c`e zh_BB`34S>gQIuETb?CyC+8HQweI8GCyJXwtda=UyLhsKf6n*AU z)&E!@FM`CY$+it{5X8-Y;1Zy6Y~|jZjsgBAYn#-egHV;lY1i?v<0G|bNreK5&K|7U zx4A##oXz}oBvs;FNsn)G{QlRWzyYn>gwn=AcDU?x_tp~bxz3nQjs5oXpES8HTrvKr zO-B(SkAK;>okQR3i_Wsmx`xUbO^%yGHU))vp^078v<-)AlRx$q0}=lTZtV#L3KdJH z8t{OH{!L7P4b1hUfhxlKhBj1%QJJ5 zI!94b%O@1RVE;;Z&wqkh%QJg(j@I@r5y7NF|DgL(bUDe#=a)9ZB3Wpi^efRatiFIWG?aB>vV8D-hgyR@I3hLamg*pQP5F!2%kB%l3&a!A>iV zKMj*;NLdYs-~9RAy|!Oi0d3O&KAJE~_J|L(q@gIopJ*Lg*I1VZ!yshq

    w%pY#`% z+FgIyEc^Hc1(Q67O6KH@tC~VSVz4;hedpd@8#g&szd!hC78Ke1Uq5J_tH=8u)auq2 z6l|Md(oGT-_c@W)=-X;F(scG@v90uZvmQg>^hwp^&@VHP{>Zp{mYC;bVO; z3zNeIT4{4_e>x*De@{}e+c@v!2R#$;(S{^+btn@w{HI8ihE64)8)6#p@9*aoug5FX z>cxy>r1(qCRjP^89DrQ=wEx9*_buT1y4P6WHztsP5H}EK0wjxbk)(CKig+u$ztbD^ z#B6O?XB7HJf)#1=He7-vuQl9HSDE<`H6Yg_mI4y&P!@R_0${3tec!vyp_CX<>5VxVl*2^4PwF^2v0x-)TiI2Zj?@_Zk(-VRP-;zt=yeriP|LyBRTxZ$59o@`Nz+ zl3H{K$bC-GJmuL2c?Y8fy&QJT#9bsbls_9`4WC^3utG!RG3zkM;TpoHs81E5$&ekd%*2PFLV&zaRo@A+n4HDAbGrJ?qUdK%}` zfJF|UVrEW`C5R)UpBM4nCT1XxPZPXD4^45pj~p_H|6`~BeGjoY?%l{7h!}F;FUKCQ zr%8qUPC87xo-e@QA&^gC&MV|zqzdAx*AnDq;dimVckTsR@i%|H)e1GK z4cvY84!n9rb9@tgS(AB{4H6Bo=@11$Wrkq5@I;dr&1|%9^!loZ)|{b3l!ICOI}=S5 zxN=pW<3|Qqorbdk4RK^Js3b#MK>F$IA8PzE2Gh*PkyRKv7*Xi-7$i3mTXJBH)W2mk zJ7<-U3Ww^r;92{?uRF{-bc2jORyLlUt9MTOD|~^MZL6WqB6q(X$=9Fn39swd+gmw4 zfd;c#kK;cC4Xa`KMt~y#Qa$z_3XL=x|K85>rejD(@rO@?My%h$bNxs3LTJM%B1w}& zM;Xc+rN1b%a@aTv5IKd`HMy@rk_Y0&Gd@VcJny?swxjf2;hLLN718rsM+^2SZo z?KSCsniZa_;Gt^m!Hg@TSxi_qCfD{30N;%HFMQ47pUTJc<9v<}DyZZH{0lQyuy0mo zb+@J&&To%xf>*(ni!~ATB=bGnptu2e)ZV3-ihlbO+1u;-ygChhzeNiAck}1%q|#Z@ z4p-JF=;`TrqCgUW!T?A$$#p+03Tw1ioM#ahncw%HqT4x|8|E!x``u%Wa#}PQ$W&xx zKN?N9&_<*0rhAQsavv^0y(aQJY#a1=O1D}0dN~dzf4k8Qdi~30^3{*Kd&@J&QNrCH zY+r2ob%*z^JQEJ!G3DvvZ>HMH>2t4sSr$>27be1!`-Q!a=?k%bxF1UQI zBPqM?DPfsPOU?C3o=>M9QE5_z+mDnYAwowJ`3K#7EH4PUdMfA*xVeOaz176bW*}yT z=!ozD_8G*`5Z+IA|1}?5ej%ztoH$MYP6Bh{Y^yVRlj0Wb!hZ;!oVziw`fDG?u(m#| z8pj*hW`H3U#RMI}*N!v1oZEW71(To`IZ;ihLfm9Cv9GP|?$;O=+nUq)H(P*o-Xz_P z2swJ4aAp6>daB2e{#nS@4_Ys#tDrs8r>-FnKIfz!&26(n) zhF2tR@-(4ugf25~xR@wSfQU&v4b|5MxY@1yirj{ekMX?*dIA3W<@jQHx{1*r%uj6; zC!*NfGD+v<{V2yl8jDOmFV_7xb#*tO;Wg{67*xb;azP)nHqSUwP9QQ>B)b2@-{dik z%)MKrzD8Pbz&hSPN8RLCCsPV(GfD*z>^PV&Rwj?J-0ndS2M7$B58X|0>7aLQ*?pIA z1$D0ej@v*7IfB@LuA?B9BD|Mvvt_-T*YZ-3)d`+Or<(Fl;gY$8rE~e43nqn=pT|c1 zYpj@_eoP$%7E9$!8!Ff*RPOu{KD0J6VwvLDH}v40PZ*K!(8Muf)o-08z|b;?|Jo0b z9!&|pX%I8)dIo4yx2&=~U&^8sjha7uf134qH=WSewI@P^WRYA}>BH@(LbVb89XYP^a_v6L8XjtDu!C_z~*t?1%Y&`M7uLD^oX`|UHh zKlcjLOZI5HcrR(3l9GHkc@z8Wac#y5%ZdzdX>J4D0vq|K91BOxxMZ2Ub#^sA75hUv zU-MfnwNo+|dK#6sJPAZUBY4q%$V7hN zxvTb`T(d{R&vKWYYqReuMU`_qIIF3#{A-el9_m94OJ6F;`QxUx3ZGAuPj1J`#J;jZ z<&XI3>PQ9~#+M83LNe}+M`1XOAD;Jp}b^*08Da`e+Llf^H9)p5x{^!an52@DTe`yKFdbvSImKuS{2X} zeo#|6Tl7sFva$l4m3gqMs$u{r5!Rhnot-~*HZn{qqU&obmurU;Km*o>`dQ^5U~lL1 zV%@cum_dj30gQ|;aJ65c7IkW4@T|UuFXB01_OQnnq zsFXehv&yrDg5FS16F}kJ0I@wa!{ieil&dR4&1G#W8Ip-y!1J1%M@g0*Mon;eOlf~? z|J>1=xKezpFda|Ifd)=)D;;gyn0>XDk<+f%SZaxwA!bYCrD8&>-Tc!?kV)$;AR^Od z8=~QDT!y0DoR#_+ZcQ(tI%|>&k2#cbsgqRa0LZWz z3C4BaL2H>{0}Ms~SE4;rfd{FQr?sJO7O>ch(&hLj^`85Vth@G4tomIP?@3{W|3J$z z;bgh%_O<|auAzN#c6RAPMeQ^%&24I7Ez(*K7KjK?x$16N3))ag>nB?gXZ%u)(z`%d z5i?1kKYxagZ<8+O{9hn;!t#3uh4E)VcO_V-f+?QV5upcD!x@s_$>fR3w#Q5B2-w%J z?8z?TlqTe5Ujvn0T(NWExFLjBJ{kB$)B?!c-s=sFRcOQ383hVZZ}D5sQ2_92-sayV zA$}ms6IQ30ci2IIGhSVXm@^>RmSb{9vg?6dTX7OQFzVU_J?EO<@$ADHFtjAm3ce)- zq_P&9TP;r+V7aD;aG{sL)H31abit|?Hzj3A5Yx@)^qB?x1FRQWYe01#0X&bE#`GKMz7Yptce-w6CV>?(`4 zhUiCITV<&jdXY#_r^uA=a2y|c-hyg77tTrj$eG5bR#NhV_;0cT7vJcdf;c2m7UiH! z6Enl~&Z={x^-CQjLfo+IB^|OD=5e%bVQTEO2fJ3-CJqbxp5#E_WdQOD+L~7|C=l*$ zjri8H8$wJU7^yawHv7JX7g{V#8sS>rXq zYZL|YY@Zt1W)IcodCKO4E5-7SE}o_y=(r-W3}9PYjT0!$*z6#&ydTaG0PO#hP@`H3 z0jDhp0w=jYt&K_T^KF&!{F(-JSmSJnSF!1x`|d(OVDCS3*Ks6#b;e*2CxG+~y|7UH2;?NJ9aCK`{B*(ve}{##G&-oC56QZLO8H`7)wKdgVj2CXqPXCri2l z`h>=J(U+Y)K+h&HR)-vD$V}RD&H=D$148|7PZnug(%>MS-w=K25h<>hcp@EL;GFT1 zdRg!=*6wmZ)t_m^+=QIgbTE2h-ktd7f9L>+sTUX;0%EBG%cGpmb}7Vp1w!yb7ny#> z>D(W9&hwh+2D*Flv6!dvce>s{%SzxQOW)vrC0V9@MCii9^?R967TqOm0mzXIF1%bM zY?L1c+Ck)?Ea@&Lq|mQVz%qDQ=;uLmfZMPXy;*@Uzq}p!-DNx98hsh-tjsi|5TNYY z)*2Si-&uMD?!Y*+YZg^*V3L$MG$liAzhfgj%LzM63^|SCjjsVy{Ab_g6V{LaIZX)f z3heQJtj3eCNn`=)t`nuWF1J)4typ#LvVxMhv+H3R>(JaKXza&lFZ98a&scgi$ZDRS zuS-|4(aoqUEW=act+2C6XydnucK^9u_ti~s*cNQ0EaY+#8U@e4(8T8(d%J;GbT^*{tM5UFCsM%yHwdjlgSYY(|!PJot9UQa z`w7^Ve&{AmH`NsPBtTw6RLN0~Sr@dk;UQ3t$Pk3OX?H1PE9w-nm>f*7gfBfuJW#LqH*OpsmF#A9RX&OrBwxldtJ6^u38DNg#z8s&t9#Q39L6mLb5khTYG; zMC=yyCnbfx(bkD5oK69$$>|mv9}ZlpL&_TW{d57vbO}YbRqMCp(i!GFi(fo55$bR< zD23?n0j2yu(7*#4C`{V6>%Q87pNM2hYATvqJ1R+h5l%BeCRAKnvGFE114!r%r=sbPB|LV?Vc+f@J(?toUdA2P|5bksK=&^qN z9PWoIuB|OVZ*{e+m5gEs#$T+xA@YD?}#jnkgsRU$I z8Zxrad%g=({b)lZfa(m9F|@C9CM8^!u-T|D>zBWm{IM_)#v77z&09UIY{n{0A;RzJ z4Op}AT>dbjvU72u?hwP}3Etl+JUt=m5NA#2blc0})SRp3(qO$qV0CaGXC7})Y%CFA zZAae7@%f~UXXf}Y$-U;XUz9~ygoPRQoGT3XtUt zYXN|%X;BC$ukgHjyeSt{&pImxQJJ~(^8DtXa)th02S1rZDv0-Wu>H5YZazx6vqzXnKllM2_r ze-Bx7Lj1+BbFRj%76U+ia&I8XUAFh_;HC^>$2SAQZ3*b85*8I`efu;2hUi`roxPQA%M>A`Tpc?7R6XD&%cDPa`c>JT6ZdM zekt#DM2Yw3)t}j=+0pL9I*qrQxRfNe``77>$3dN>MOS~5f7cPJ#0zu>-*%TkBNE&N;$1X-_~?l4KA;_1I6<@iT9L~(LA!KUR4T}c5tT&0Idx7$ zk3i3C8HR>}BT00L>uvh&{m^!!!`->JAokSbAb0aIkIS~_WirbYsg@}dkd+DWo|DK0 zcx!xUX2ESf_cDljZ+@78tSvxL1vJ<9277{cMvff2%U}k=Z zL1AFj_+Vh{I6QN5yXrRC<6*crC!O_CR2D(iJ(+(yB$k(yNfMqmfnjLzM!NfSQ(skt{G^ zr9r$H2=aMs6891UkGw@Z;&S}1I5;Dt6RJ#fS2n58T zc7L>>6zwyBE)G^jG#JV7N&bnXATFnCvYnV|GF*T2^|UQ#OV96SZ}$i~OZAjuf7c8q zv9mMDvn>*n{O;wo*5dEXXi9OA@8R^f7%<=YDdikNm7#b!5C$euz!M$@rsBQ)|3C1+ zoFKx$j4q;YhQPtJeEJVc3+ON~h41}f{_k#TeD4Da|E|CP@UgJ4_@+9&HS-#i;jCiX z@$K&z6pf1yG4h8H=sq?fE(y+4y>0FZy5#06WKtzbcMe+06;LJ57ECeh5iehW5-S*+dzzXvX+6p*=$K~5PfDi%Vze6&2|jTVOIC%S7@P8Yjt5uX?52FO*Bo~ur-=n@m6{K ze)J(!9Cw0&kvP9zU!LdEs7#$ipW?{lC!r6jLC2x>{?%PK;Yn;Y zpL*EcpW|5SZRMdWg#+>Z{@Qa9W+8#<_dkWx^7@@vRG@oz;Smy>)FNSVh(q$ekS4lT zCBE)qFJ&L;%`h+be_VlE&EAk^%-6pQabA*8ov>+jOPm1gRsxUN3J~Q&tu_%u22#Wi zy4Sne!vayMma}oD1d;ofS>xw=k?V6yQv-n}kHNoVziWj<2d}mV?5jzHmlwrlnLV#n z@GA_L`2vmnfpI!~+q}r3#IEWI3`)RSi=S?^hn~Oj2@khY|KidI7&S%E6QRl;q@LIa zZdHLO1D4{WXQdYmW-4=D-Nc{<8Grx&-PqV@^xhEVeVyeCV!!KOO9>ccGJU(4eJ@(p zEN8nog9><^q;|9#)Pe=3F@SarfmJe%hFG|+?#sRyI8HLvISZ;|7-ZZW1YMfzWYTG_ zTfYAudDKjM1kx z5<^r&KEfxjb4GFjPWR)vm*;!SED0H8m_nYAPT2pygZ$@5!JXpo9u=bpRq&0W(j6Hp z@C4^u59SznR(8JTvh7thC9c3K4^|0>@zCoRyvIEo%6|Kz%J{mC#!D`e4RPCcA@VZoTK zEG_9dKS4iW618Nh-0M_DA{2>msLYz*10(!e2WTqK*VqxJsr)p|bgcX&Hh=%AmmL6q zQIguSv%Gjq-_z-Op1l@(8k;sQ9~lQaUe;2kP%vl5KNZ5qRS~sk!%^-%6UpkFV$478 zzD>GZE_}8Wxl2XO9^JprW*B_HWkk~Dh}SI=kJe1@A)MR%n=9Re4>WKee0)+$2s1~S z{&CJ2pkWkmXZyWhMZIkIj=_z{2lK)Fqa;d@s;9dJ<52Dog`b+HFGnUvi<2%-*3wY1 zb%ZW}%(*Fj^>oYOgX) z|79^Kkv@rXDb&>Ax?}_0+M|D1yUitz!zh6H@ibQatzDz)hY>1*u!dj`(Dj4|1ax}g z6WT#zbx6`o3ZpPK+~0)XLw!$6+KUK7a15kciyxaB>`p&1?5+Mtb{r@fM*PG5;Z6V9 z2>+NAWlBysX+Pd>SbTdF{vseeOLu)Sfdk`;0uNor=!?E#lXsa)@ApT_bCPG;;k}&` z;$)MW_O{?h?vbd@!4VQOx~w7#mHep*B^PIWZuN)~hVS2n(gUHWKVs>TPxYw_?1>9N!!cwDGCxYe-Jv)Kj=>s(32$j!t46 z=Mv@Xi=9JO=3$)i#T1L=wC#rQm1ZcN@nI@(-cO`jMU@f$%Ra&H&h`IELBZ4~yzJ}^ z@A>GKy3PmNc&B1G*4+Ny`3} zLo4d7#jXr%=jZu+Iy(EAXzzhiy)C@s0;D!w2!L78gN{W0ASnh)jeHgkWCrf}yeyoL z-duxP;sRA_ft2x`>N~rC1jCJwn?1*%#S0B{+sj(0)Rlx6t-oeVK#Yi*s>0r{-0bf8^! zEDNm9TC%b^BwOK;fRO9P1Q}sSgey6WnR*>~(9bqo3tE&u`p^cWM)Q9~8^aHB@Q5%c zOHC&P#Y!}sDrtAna2GN3=1p+ClTCR72IZjtm_Jc$tJxl9f#Qe zUP?d^ug}{vZx{vIdM#%WD>H=90QvrqdPWXiV^?g!kA2&j7fNsvA+I+L?h6t zHCOY%2a|m(R6!El$>RY@J*!7u`(x$g%^2_X_Q9SZngm>ZG{{vY6g|?F* zB-O`NoOevCwIK#B5N@)-1_cgm%QY-Wa; zi1w+$GgvuGA+MA&xRV8kyw9zeQj8d%HTHu{u2lEF7*Vp~l*>WEwu}5la`PW^Ts0#% zuLw?Zn^9HK0nE?mn+sorJ#Z;j&}oNb3#3i6Pj_}CI+Tdc@9yrNo;q`(71og8?xxoL zN<*c>8;fpg;Y7WW_x+kWZ|rj$W$2g*&-20L4RK2K5I74f+fnt+g0Bw<&IVULt{orS z`<{@Kk&Rx1-z#E*M`F`hICSj=c)gfvxt$nn{e%m4{-KC3->`YXpMkEO%WhKvkzUnh z+WWLWGplV^H%eCvJ)pG@)o_kQv^IW&s@Tu-3@r%TZ?c{bnmOC;5s%*$oJ*7m3I*uVZ?Yv&oJo3HdgmsA&lLW40eTgYRSS#D$Q8ibilE&JY$8yrxh=HBM#+wTR@ z&*qx~Ce;3dF6}$KeI+}K=MbS_*7;O6!R7*Gx#%RZH-X8Fe8)-y35-~g7u6&h%;;L} z0B?ye5=A(-^EfI+w{_o-fs!?|SXX`AT0+_SY_ExT;jHi9f(FCk5n>O88h` zJ&%2CP(cJHtANT~Pq9vt{Ifa17_%SdC%$O>!IsRd1gIs-6n;sIPrKIN7zZljdND4< zLMz@CTLIMjwjtENbiXU>H2{S1=OSaBj0tEUF>52*)Yj9he+xu|uo&9Jc%H3R^G@k_ z3%~yt%%b-AkwHHR(lGq3ZH$d_mfBqq4yv37*@|u z|Aen?fL2*V-?$*yrxuT_LaVvwupC*=MB}H@=0wnJ?#QbZ<&$KH(}2a0jr2sx$(y{_ z@>vx>cX{Lm-G4$-8gu***gAO*fcw#T1$&S7^~<_t6;ocj#%W|t(lhJJmoeTpT0E3z z7pKWV$)&mnlXa&F1cLREw0CL`QfG)O05301+*0(#N23Wxg>`xTv}+?~CJt?enTa*; z<}!yjE1IA`T(6{^O-c=l(#)evG(nLC|LT}Dj{6k zVe4#0O7~_57qGG0lT2s~-VyUtfSyFHNLVQ?A@-?;z0yu75)siqRAZbdX3?$#aJK;1gdtlH>7;Jaxu z_~20pAcp(T;9$607U$ae`T6awr@*QDI0*Jzxv!_7r+bDbs&9CI_b;smZtv!K+ngaN z)NNCNetv!qSyoo|>K`ze+u6MJcFac%On1x}@eQ6~Gx*Q% zp>rr$$`_u=Ce-GA?49Nv#BE~WV>&(bYNokr z+|C#u&~`wCqu91fctmbykc9PAznO|&JM`MT5oum`7H7q1okFY>|+itgRd1LEy zy@B3F9ypXwZYGVzP+cX1wnUyzM8|9ouF@Rb z9%gslZQ8YYJ!#&^0=9A?TzwLBE0)`-hj9sBsT)RB;ZX76PII>&wSPm8nh@;f|CNbf zX1g9k^Pq(O;A69E%NU(1&28JmbnONJFf|6S8vwxUz-|D5-2ecv8vp=y0~noee|k*y z6(0D{>4Mz=Hg>yDkr=xrIdJR-pzZc=ip1D0$$?`x0ByH_QY6N1Ne&#l0cgAZJqA~2 zS@!h&efh)t^QZL>>W$5!UK)WIyKUKYKAP<8O8X%ySwLW4DvV49Xo^F0JPmc zjlrAeS@!&m@x$?}ch&M{@!hNAdhOuE*saIV^w`ueUcE7frAMVlD!%A~y_cZQ-K$X!f`_>G=YbN(c z#$F)M$@YUkhd6FLehC86b5;Mjr{`<2Ms@ihJRXGhqg~WFBdFFitym>E5U;w;P_}qR zM6@ws;@qbT+|mE|2WNFWF#X5*>qL>yYewyGAF^)G^+8WkoL=`(Wtcv34F@ z)|blDpVjYQ7q^1wN-D%NS1UJ&i;C&RFh767J?=aZGd3J}>YCc++geMi7ukQPUtPgw z6}9j`toq3I<4)3WdDO4;t$DZuF8>n=0;DV^!>s}DEmmiyr2B7a}MB>vCw(ElEv zIl^K|pBR1df@n+?M^N8F$q>uo1jK&h-ije23%uXqwj5300k5Q>_jLoV{=Hru(=GOJ zYSSzWorcEJcVJLe`VzXu7=|l_6N94B18I}!Ld0GNI!mS*Yf3an%l(7|Qs65J=$&KD zn+h$;ZacMZqYxN5g|v>Qt#6*Z^f`3#PBxrm?ncuhx}b%ENIU}>P?8MkyIaaK1wp5* zpZ|L~BiOpnB=oUCq25|P$!dTKr;VTo$bl&Gn5Z>^9DvA=h7z+e@veh5mn14S+?1$p zMA&Y>@ZRv;s6LItv$u|>pH!rcxarb1@%@Mkf%<5QeM=6ahU7|3GDT;L!`8KkOW?gP zwEfAMB1qFb@Aiq)N^~_x1o5qTeJNQFs*eBSv^q!F%iYEheUo48lDEbhNx>Pu34Apv z{BK8brw-GJ3NQBYv_}YfBO)IjIBJ*%Jk$(&Df%a3HxfMJ7KDS7a_JZCCo@*G zXgfUqgcP(hg11c%in!X`>9?^oXQ;H1sHx;e&b1Sw!R}@FAU~bjC+~#_2>!p+18_{)GxL{PTym&d}=iZfnuc70vDr+-(?<`Beok_ zc2@9Ml;V~~(A+zA>Q5P(p4+b0Ob&XNT&~bbt!&xnr)9V7=EF)<_%#Z~m3FII_Q!1e zzm_F;Z$L^7A)y?Kd7XJONB(?d>tYIC|?vf0m&~l%PjaZm~C=(CD z3Qz3xpmXQZUCaE`At+BX~8F;3pJ^fMMm>{n^> z1*m7xf2jFCK=*S+rMd`2V^s;)2HAgMl*%kUqWpFj*%h}J=KY6Ue$v(asg>Y?IhCd$ zfoR1-71$~l(TktXK@QAd%k6+@5gbdJiQ04B;5q-nDdGy^=xf!%h=am-nh&`sDc0A1F1~9E_XtcQJoAyi9nZ zaL`tlz`Ds7sm?nh=-o6Rq<6UJSv=Z1k?4IS3yaVldIa4q&}uH4J`WpW;iqMgX3

    k4wQo#7eYIG14w3Z|8%0t)E z@}A7(%qNiY$a=(Je#pS)4t%+-lZ~X}`Tzk*AFW!N;Hf6$sZVA{D`32EbX6~;R!hk! zKU!~2Who;>4pZzu$dD}Nv_~YZU3$+%{ZdNK((twI++o+!RQKX zPa2*Ml^JuNnc3eH-c-I6wC-d%2%}}Y4S{KhW@S1BK@IY!n4+_^=w!=&#I7OTqyt6; zV`J&mQIeD9o{|hL3rdhd6o3iqmOpuBHrBT%Rr!V+q3ylp8?MdUPfQWdmW+Hc^9|H) z%z_4d!!HO|16gH~{Ab`wG`7;vVnF<=M#08JgvDS22^;-o8fJ`q)@@1KikRL_oT1wI z(2jVq+Ecd`oJsYKv}DcrzTw%_4vqI$unMm7uB#rf=lMXa3%J3I2Xl^=ubW(Q$zu$! zmw_kTXBHfYSxNunf!VWDaz45uvf#G4=vN(=&0mkTwnGrR$i1KRH5K9lTk`{YBU@lJ zO^ZH@D)PgNuh41LJbU0f)CAHzc*}f`#cemwfPZL1YLmb7mvVts1R4_Y;Ec zoS`OK?56S<_p{@n8se}e>E`XE1k%Jh#Fqnyd;OJzn%MN#Tjuy_?6&j$=hgd(mf29& z*Vmh9FH=T-z z@l{jWf*}dfO>OX@zbjw8vJTFs(DC>|1q7aTuMEE@Mp-|XL4R+T#%3|-*1Tn_XlD653A{Vu6K6$Qiacjc^_T2@A@53+T0er`a#B z*ewv-rk;G`o?LMNy!pLaO(IeXb}xspR0fA$loT7x2U8t_R^ia%8Cn!%nGw1XPIPhG zccp6435el*CDQrk?L|XkIC`gHhL|UVK$Nn?DaxER;4Cfh9v}5VgJRS0*h|RtcQk1RFtR%=`SEny3y!bWq!Z;8`w^z4OcmyyiWf~@sxyo+x*&g+?l0RkPfSp%Jy{dTvlciZ^B3 zrI}Rf<{iBo@21L8eSCLcyoOZYDcqoW<@}*P?r}HY-$&5{8~9l8zMTqF)=|AD2JGJC z$TZEd?&0t>SI8t8iYKq6;REwM>r?px)+8XN*JCTuX2IvnIy1if2L+Vm>M3%*2k*v$ zf8yyh{3>bG5)vSiIKzDX<;FG~G0l2oC*N4HU?W+Hz{3ACAF&SvOK?UaYsk?*hJZ%i zVk?oc#c4GG}n?SnD{#4*s@w59Y9x;SvH3}$Zlaz0E7BuG|cAo6?Kx+dcJa` z?_^dV<7|grag(^mAxuJllS82c%BO~!7Mq0>cNx-lQGW|rU3{NMRHy)n9KtbWzam)i zu-E;O|7T0;TDd%({`!~Aq0?kMjI5S1Y;WP+LJ6^>>IY%fdiuQ64XBNYptscHf9|6- zmB1v@v=~4#XbwEt!7plEMhMkfww(AG+CqFP{`5u;!7fZWMrl(EY~66qw{#ElZ3aP} zW~7(o8&2bsNrt2(*skM#eV^_MqK7L_S*q)(VoU4M;lEybjv2CHf&gi^c_hp|ekIR2B@f zzPPvMK3SryK%d)|FAWxel}ZJ;Q1mIqG!n7^ek{>P=x6=<4?1N<1T{Is=uRe~`kTy1ek!ly5(`a-<=d zCY1L(tCy9u6eVd$clsP85+@{^Q0ncv4`rS0YzRvj)q^s=xihG>s@Mm%ECOedk2Uf) z>5X2&2U*}a34RkcpUV=a_>S`Tv+R9>E=5?ey+UDk$$Om)0g_`gtl~(2zB)^$RGCWl z`|8R0m^4IG!ZJr${nNess4H`K`Un9^*!shDm(=H)R`wC}q*wAFP@ON;@u9x>kuxLZ zLhSViU5g(`)Q6z{J8()j6I~`S~78f%0=wJ(^vhc^x|Q6 z_uj0Fx_b`v2k^m6#M1-+(ZYt4s`CWybr=vvGx|}^fnODHZ4^>v2D1f5cP}Ym04zaK z+WKU%(|W~!fff%bX|#ZpoxOAk*;DF?{L%^4M4^HH!>U$X0rgI66+4DG;8s9f`E}+x zjg9B-E<+}ZoVnJyfuEHXS)I!K`Fu>Pn33xV(a6_K3*no^h^Hr}SBS3U$C2>k1G?f< z83yUm(dh%YK`4p*@w=K6$r7+1Y6K1#Wx3^hC^#Bxse!<(Q3SLCI98TS?54pZ=FyE0 z?nmNc7SGOJ*OQm#Ik-EG!LPsaOA;J8Oj0uvfH+w{kl+*_i3p zf?0FLHVVX5)>*i|1H`3V)zWg>=Ygx)r4RXUP=>wa+EmNvo=(8}*{Yp;p;qqJ z9N4h?o_A=(cdkwW(CO2~5 z_DNH;k#6MSPP+5${1!*o?m574voE_=?GCS43Xia~bY{>5_Qv^Z<7Q4uUKn8M>&DQA zJHJ$Nl+bRsF-Q_oDmiRNF;a=-j+y>PxJo-e9n7>WObMBQ%WX*C8Kc-MU#eHWf9)Nt z3}j`($~iPv({cJ4eBo@DH_YTRWSe*BlQh3Zv2rzzf3=LwTOG>_0)4&Nafwx)>|#qd zLQ*rkO|RR3)GxIqocmt5#nH1R0oYgf$m8B?{ScO(BP`;>9qdf29Mq+Js1XcXYcAcf zePMdki+@u41(obV&E=>hyF_fx0Vcy@LEEu$6-$VuHlEv2*-R(5}p(E7E zSkJsxKpcZ3ab+@#k z-0jr#1*fpk3}MhYyS4e?6>_2=;0?3)B|OG;`2oN#Zy141O#%Jfhrx%|v&XK#-|+a? zA0crVBcqLaj5j_s|6CcSY18bGI!Ddq2bpJghlO8rnJVf}w1@b-9 z_5GO=nP7!~o|wy}(8oNY-ry=f=)06>-BaZ9yKt}*Ulxl41?iR_ZkLPLX7A_|ivhqf zJmXih9_$}}-!}D@3+P{b#irY4Zqp66;6rsnNkGeC=$u!PwIQT}wZ?3=uCPv(c?LVw@kUY#mfVdei{ zsx&2p?|(|tzrSc@ZBIl2t`(W7sbea0hz|XqqVfAesqf+rvxo<6B}`e}pL)72@UD0R z(H9KzayxH(pXDCgpATyt{_@0XZZsOI0j3Uuc^ea{Z=Pt|Nd0{FG{M4xWTqd~$o1#U zm&L!-l`m1_$TVdNHkDMI$w?b_U~O6-?{{+?T$^<6cH2Rh_eG(d`6f$ewnOn0OKt_s zCZsG7S(%(d+Z5iud&9LjD>Et|ttxAH!+g%_pN;eo)YCa7w+3WGR1>a?+_=-t;?CBQ7iw3pqKYGpS(o z%>_d-r>t*QV()zJ3o7>s1opVgLT`Rt`FQz~9*W#FuVU-%^NNGg^&J^hBOFka#4h&> zHEdXOm9+mt!$hcIk_%s-P%bRYU8@afQ# z4FP1=n6{qEw$$_R#*m27Ylz8HJ$Wov01#WcaEcaN={Z2s6dgnY!i+iIEe$#h90Rc>p;Ls0Vu5{O7WHOkpy>k;XJu(|0C!I9UftV( zQTQOcQy8!!)w!0^`%hmRER3U_z*?u~#(CU5afI;mUbw8^bkcB4xQ1{?X9K#+snJKp z4}N$?FB#PW-;)k$dzHF!q)~2QEnOw@)v+{+SDd*AMyN=7eDLEm7w*F;ZlH{h>Ue7mNnJ@M9E$0{_CHjus_A%R{Vt}@R%ioRo36)fx15cWyVP2xHzj#T zV*-?##3ZyJFT@BC-Yyp`gWDnZLg%2p_~1e!f01@YF<1L;DgW6f9UNeZATsWdzaPBv zbYuju4QCYw7m(t7`$s6)Uv-4jW2m3%pRGRcH5-e;Em_I3Hwhvq$Ykj+(i-1f1Z>QT zgc0j(DrbF?oyyvIYJZgbss)s#-e$gj_o>n({^*joJARz))0j=Zmug8M*oH(|YW(dt z-5Wi;rO56PM;vV4E{imNboJyQODq3&C;zb@=0z)w&3wIXSp;+y)>^9c^qZ8#>Dm#p zfG>oTEF4S_E7tpg;n;1IaK#nqiV5?t&2c<-+nAETx+BRqHb#-)D>&(G?)3hzq+!Re zgtv_rvtBDqwD~ATkX0my>CBxMls2-#R3lDmX(qZaW~W7I@*8m5?k5eHMfMjX`TJGC zdq2m%t%0k5m2npd+e=0&2muvF+c|RRTzuYnByQU*I^BmK6{_IVHm@GY|_POG) zw1&Ht4{}&2{OyFxBU0)pNrq;2J;ViW>$&ntWh>wAM(x^bqz^)2bL+)SSczi*2kVL) z1igZ~nP0|xcL9ht_mflBQ>patSD>cq6)#S`Ss*pKaCDpY!D{+o353`pdnfr90oLR3 z;oIP$1*T=jYNna#uC+9JU*lx$w_p1U+wX4skPo-%X2>L{`StXjz;owk$b!FlrwL?_ zv^QV3w6XrRw?6#?6DRVaPmg_HoR1CEIw48uXSE}gUPG*EUZFK3Hd;>F2>{O6a8FH5 zRi~|HxXA9_1GPSoKvXZ0M=S?uxG3(>2!gJnPNswh^Pqv-6P<6nFdHd{v->E!0PBH7 z-secS3`-fz#%KaB4}{gG7Nr6CrWPk*szs(Qtd>=|StQ%U_PL2Dbne&YU|2w{4G{r` z*P7|SX1rDLiq+y`Y_Z!H00WG!8}WN5e@iSM-K)=_)ORI?-3O9R8TBZr?zo)=Cx&dA z?Wt0aJsNJ8SXJ9#XB%kA3!$BJ3)oW~W}MLm*N*CJ9VHg`jJ#^*Y?@(?oc;#P7_?Fm z4GT`Gwyw!nxhR2$K)$lC@W`IPQS%|n0cg(m&TDNyC{*A>Ah9R4KA#`99b>;>C!14S zeX9kXlp=n8J!eIgy*h(YVPR5HAkr>9p?l`nE+s!n7WP1`{G-$^-PnvsU;xc}`r*A0 z5+NQ*_=b1>mOyf!{jyvM0<9KUrllmh=Vae=cTIHB4>O-$UEok;3mV8-aS*Tr^OTR? zSFH#5D?+@M6yDVP)n3v@r3d>cN@4Z&4v_3z^2nAuK~UhLb>y0~4Y`$JR-odts6;b> zj8wjv$0^JlU89{+T469fEFZcSXu6KQ`RL(P&I;}IW}lCO(!luj&ssfZ@QV*f1~)Y& zJX-8SnN||auK54j+r@Y%Gi{2`?;ZxZ>l_QVj=EJ#wyaZWw{2O?LIY(RSy+f z>~0TVnAHD!c3C0-5fD(K(;ha1h6RG%vQMuJGb9)-m6Yhwo@V01^eQr%#%?Tw=@*f%Le}o0|Gc|)Xv*BOj@8AA&N$F{IVm)46b$LeO=%Ys4rYEMuWuv-p-r!4&Ep9?u0`}yVanp^NFwMwl=`Z}*B=2%D>64CI%52{ZwBmeZPKn&; z-R6Qfzuhx8<;4R{$eq$TwhOC2Mz;0Nzj%S3h9x`gVs0ObY4xr)73u+(pC&ioP^J96 zTO)qU-EKnzHjzM*aQSKneLY}m(JO;aBvy~(B-!N{>2h(+*-g}Q;^hiZ4f>FuehcP{ zP6fZYeSJLdzz^Q`8~J;!t`@2~rCsS!Ykuv@qK817<8w>#G|ha)lR&VXB)DqoF3s@* z#}zo*S_ZYcn30n<%hn=co;4Di^p;xN5RueX@RnKtYIS)3Lh5+>s>rC2uQInrxP-i3 z`*AHMb@#SFgh1SnyGM?@W9&AMB=&i(EYI6=^fxnye0|YC=-x181hwu}<4M@66-s~- zeJ(Cw>a;Z~5XTX^rRPPMxVFxc8@ms{l)L>&*WI9-v;1RP4z~J}grx_^hZW?K>hl^c zhJ0*4`&+dfmK^tLtP1L`XH4~)PBFg`SXOP;1C?>dRZHGW2#$K_bI@in*VjjN2ZNTL z&-<2DG)6HCogmvV&)7(l!-Zb^M*+l6&AdTvV{DrS;S#RNv!1YKtLRi9?RY~^Ou;fp zKg3T6u9yHT%?Z+Mv6b97;qN!>MF<91!O(pub z!`)IwjwQBN!OSWc(s#{0M<~@J0W+xKwWc1Svs-=`h}h)~c~_h)!pn9M6BZ>&p3hKN zflJlFs{Nedd%ti%icK{@r@ePAbB-y+Rv798fVBm|3HFJ#JJG$cvH2@A!*lf;OAipM zok*m1OPhIgcMh@9(Qwb zlBt4rN0)HD%lYpb>qCT<+y+ep$d-rVw`-@+i?F^j?SCE6g#8SEWbOf*5ZbIhNUu zP;I73wxboz)rXrozay#c@9rjWIVW25%#n@}@Gc&R$*iAH3n)JbWMw;VgVD&4!kgXX zKlMXWHYR}Ys~3UEOHo=;74I)l{-VF%9Z{GUYyE?4qIvS_eOKjBtB`Q0{xwA0{q~m4 zP3_RgRQS`y+sxczsOLaxn>udKEOLiD<+aTYn!UW!oZ18mLF=~m5}r2xN^#xW9iNgo z$RWKSjwIPCbB<>+O<6N|7NJEcgv4HPaQ0juLW}`9Z1#KC zjK@riYUJ^l8Km8eEXAX6T;YzrKhHlzG4j=>)oSVW#nqx>E^tnX!t2;1{*S1Vs9IW$lmv< zxVp|(xzwj5D|10d+gjc_3!X~GFP4nnf8oYpsrT(cMf+1@{F`?zKwIm|&3@rr0sHWJ zYp<&In0wS4$$_6%#@Qgt4PL&%$=0}yGJcsFa7n=}k!vyqHwpW@XmC?@w$H^#RZ3WA z@Fh+SaUGuD%{x$Gtwc%1b4lBX@_feB-3u2FY-HIqvzl4Mi0IT7^TF@HzrgoUtYXiE@|L32pu)vmU$?j>h1Sv z%pT*ukrAB2@s6hqz%{c=T?hC%J%Gj#w2_oNeH0|?#_wNSc);q9<`8zK*9|ouP_9DN ztq%~K4Y$;qlg-zguYt|5y7rr?(Zm1*J`2f2yk+My@HA#0-?Cwb3rqY58gYdK!-d(m z5{ewRfTEC{6LIq2D*p1_Jpc~YJ?(8e8XGDB6a|o&u8!!|72wJ;Bf~3|{pJ4b_S0{= zw>^ElMLC9!Pw^h+j>67+3pEuy;^&xn*N1s zTuu)39Uc2YC65%K>cXmrN?K2uI8kOu!IACK_?Jw2QeK832KhC+#8}YSNj{E2r|97+ zVl>!=Wxw8wvCL_p`TU(i)r^4kS;eopND7Szy|4VwH%mz$%h~bXDCuA6_j>)NEClBe zf2pC_6-o!7wi`aef=*S>QycQnT8r;466PubWt^9h(dWJ`<=JOzvQOUXt8~r%a-Opw z|1J8;?1pxD8_7WD+xpuHbJJi&rQ2zYL-lxbAdIh+7k3yTao>sivFU`gC;HWn_}~@F zK=3%`B>dURgjW$JU}iJBN?zfogQb`|uGL$kfl=iO{*(%0(jc>G(L%vl!etZH!xf}~ z+HZM(YkK_$CT9P{<+6{ZqWeLA-8b4%2vBnLd}y0F9}Lr&pAmwaY3A9(s2kLDL_A!K z^2`gRn6Xd-ybC>M^^4G@6xWr$ z4Uy$;gW+6 zJe`OKmnS+kERh*-k}uY(>_5B!T9w}mK!X75QEcgF&QEhg&x>VH_Ve>IkUkknKjd~$ ze&Z9FlY7%FH;)RV2@R6Pa_}bxdRoFw|D|bSruE*V`kYL5Q9?ANyJFAL5C*wnMjx-7 z_NfajrTsUxe!iV3`?Ba$y9^mFbI#w1!k<7nT`RuxcYn5e*Z!Av3E~)^2tDzrc$TLQ%p>ccnS-Z;n~+Bfc@=G1=^&Y9v<-L1C8WCd=}IddkS#<2#m{_DIo;_K<{EL zWjZ3lMt~;j2*2d^h7UYyGGzdrMg1W=sy&X8_gE$Uz9`b8y43>M;pF0!0F zzaWaeHDs|!ZC!WxIOB*~B^m@AYk7lUdr4H+zBH;M*Khj#i$~LU1_QT~yyB&KGDe^C zW7FILuw~|Py`Taiv3iJaGs<$tceN;S(e`1U8T<48MFzeD0_8S-UL>29S9c9aX);~F zT0qdo!(zD(gUrqn6r7-LR9h?_S0EvHmYY3)w&kN_FZCes;E@^ z2AoJ-I)wvsIQC&1+9I)6b2LS-*WYbh@qks*)H>ah-jOb;)ckJLbI_TM@HLkmFzmHX z_RSu{omE^9x+xZe9`tgi<<2!xVhJpQTcFH4$f?~Wf`SjBDlnugb_Xpi#htnT*hp4f z64CMj4%ljB)3#SIDDpk9c_bXXKX<@m04AS;+}~^PJgxY;x56zX`=fd6-gGVVqNuIL zs@&k|UN<@W>mN`fFV3yqvkH(V70V416eruuN;C^NX6}-Lu&rxekNei2JWRsX0yDxE z6GQqAkvrH)uBSjkPtYCJg#`pI7-SkFsw<@KN@i5bL?LEaayNW4$a{-N{^SWdJ1+5# zfmeR^);$f#TKqFrKM=-j`Y!5?Htot~#JsCkpUnG|6bm*tO7jtK&GG82a@WQz#p`K6 z2+3Rk2H!?%GyV6oJv(`DBIm5!F}B!=c9KzNht=F|$0uaJyt`)FHlv&!(-$AAkn_=A z+q`3$ti3h84X~2N^d;^?5m;8Uo{y#Lg|{{at3=X(nAw-}`w$WqM$wSQ569uh-%@^l zJht8twY|?wP1j3CDq0DV6c$6UH{p_VyUccNZ*uOuj14oeO3V%2SJAV$Dv0h+@DhGE zTAh*L5e^ahv=~*VpyX2qG=A>Y-txS_NV}r1szw>UfnzwgAMbBx5fAW1-&_=zQK%<+ zPF49=6h_syh}YZXtUZg^)|OaKC(PWCb2+=FGHRO#Y=F9|f3aMC|5?}2uzmjkJXJ}% zb7+cOEF{;-_ptVt%q~0loCH&b_|;U#n~Ep)tzIXkxQ#Sk6hy>+a{IBWskikM*%v3- ze0zWQY850^64(?|&WoN&z+~Qx0atO9!Bh@^vxB83EpC$S0vEgP-i=QN7UcZ92m178~Jk)xc_s(w2*F2fjC}>TNkL}2j`GG+u zV8mm;^teD6G5VzEWW>VKqqTjl!Oa1V@Bb) z2B56i&a_Wypb&L^G~}bv)6n6wZ)3j;S%|;GN^=~cOq`QwI(<+j06x|C|3-}+NO@l! za9!6l!ucy!S8+wTe`ZgWz}Ev>Ic!X589_V2Jzm2D|4zeRJ_9^7`&O{F_v;%&`<>4_ zM9$%c`($8i9W1v0s#892|IcwZpe%g&KN1hc|2h6Ym3|zYUs3j5!^Q4a_l{bP8>FPD z+|f=KS!v$QB_MA){F-60Vl@5>y zh|atEL2$-2RP}WO2X|r8UF0MCvtUZ6k9hXD z!3fuH^}`|!NSSZ9^X8dYy)T#+<5!C(#R@8&inpg<-u;s|hf>eV{z;sCkjU3kjmH3d z;Hmjg``^br%Y3B*P|1jxDiD{1+=W-E>4y*W2`kBQ2Z?^NHmjvz7TkS>83Ha|8;kXB=9)h8J;;YI-YgD*=8N4?5H3-PvKpJhpf{z z+}los48=Zft7l&t&-^%LgY=}u-azG#&*!)e^;byo@BDDczNu~XS^%|Uq`c^jNge!` zt9?0mU?ISIvugF1e2hBwZ+3}!{yV#5*0t-YKWOeD`kpI*;!_)0MbxTMy_DHwT(5$o zOKQ7ALw9-h$Sd4>`+R@86yLFyWs(18hBfU6b`p|&i~$^HYyKZy;8j38kmbX(6{b`* zee`WpMt&r1p$8#-mO9zOQ^KnBdnzH{Q)R*D-Ve!XF zv9YmTUMR%p|5aOgld<`0$uIa2jess_dOd;_z%9R*bvc68Kz$((cbzsV7~K=6r?3s$ z90HZ)c<55rANSsT^zUh{-*$NLdlmtf%{D`36rQ(<7ODl6O4{7#+M+>_Z2`T z!UvHa-_&bp*YM#Zpe9RbTew%$M;G_1eVY!j)92yw4oWEYJ~FYm&%bD*0HEF5ymIQp z2MGh{)J8k2ac6nKDsucM8gy80rV+hJHqmpsrBl3ITJLb&!mG=RnV%o3)P-TDMJ~~o zR4G|sscB1e#pCHcYwzSCQ`>U$dAF4@eb2r8?l&XC>AYn8dC}dvMU()M+Ar7Vi)M-$ z2&|=SZVP}d1EN0B&CNu_Mb&779(UfO6Ly5_VA+ciQ59=YB<-CqZVp{Wu%!njizRI0 zSwZ{e{eovx54vcO{Hq5Xn>MM=rZl$tX~~QcHjq}heXU^-~?s!m9Dvq)Ec5c zVt@|u_;@hkU&r{et&*?N5SYPzgL7CMStx7j#GQlKnPvXV&m%7-^{(e72Tkq?Y2SG4 zYJGMF?4ZkmjxJVP6gA!C%lzFg`XDm&UBt`xns-c^0H|PXlha```+hvxG1$L;m>{r8 zu9Bj9ZTUUO1LQC|`DO-CD;bey!xV#*_@6(C?*z{dGwbQu!MlY{MCYR}ZJW(gRthrB z>BZm7rI}s4r(tYowjVqqK(;~&E%^%zhF+v5|JeAqgH5Y>w`F9!n^yIc@n5NGjx^5T z*Bo%+?ZKwk^YM2weqiQq)TRJuS{0pjbn36Mm!nopan&ULrS+zKW;CP>p_zIn$_yB(AfxatOe$* zY3<=YkmR&kopTdHR{F>!uY%{Mp(> zvU!~0z18a|y*FAJ-kLlN6td}d$&u3h#!066j?N1SJAqS})BEHbWefp32v#?V=Fp`i z=4I=>K%ar;v?ZvfZ75wVo_4a-ho1Kop{w+!t}nG_Cn#bUX+8(POrm}_sVTu;MG-Gl zWOOV=lX`NEhfRVppLSXzAlsgjFTe2lZS)+}$si>28CMxxuIPR?bA4N{k=Z3#Bde}L zrF9?Y>*EuEnngzV({~q{_*?)`m|1%Gy#?v&7>;Sz`B$Af$KUw5?Y^+5?)g;hdOPrU z1r6HOC5y|0h*ZbWm?NW8#DC+s0e4D#LlWA6=z z13;9j3PE!BON|zx?4pgR0;)$=v^Okc%KmA50mvj(AEuy5kU4S_|FQExe>P%Naq+a} zPD(`g2?j|GkEGn)!#&m)b#Ywk0Z#lAj|_(J^U!i1NF zX7Bh%(O${>s=du3s<0;G)wLai@$U})|D5YV*bA*s&0JIyo?hzX;C8*%&))iIf-7bT ze>QltI(w2)>vLybN=JE2uiz0C8|>mO%q`c z^3VI_Teo-WQAY=ZleA9}43 zHZkm50!3etLnvyh2aA0PG6txtR#MI5^vm^!yLsZDLf1&Lc4u@YImu>DGakAc5bEzx zF;1t+TCA?cc;-9D@s1cuyLVXRI=3q(MVLl!KQ$2*NbOPYFK)<-&Vr$gt2^EwgvJ{F z)79cq&$eAx-zIO#E|);7R;WFCw=w0#NtbVqkV&4EuH7|*r{5#pq!Ps3d^r%;>d!lN z8*E(X1p+1&<6-4Er|)T4(_lC^@s`H)(=m_aiPVgJKfLRV7HKQ@tmdjw0q zR(2=;*)Wh))|9yLUDIyha3ud~f?CHEjJ$>+)T~(?rU!LGk6G;_$%{+?Lie`*{@vSj zXSYAX(;jR1;a}p-7f8o6 z&PJsr4oet!+)rEzm$6t)urPgJL8!dn##;K5aWKK7$M}|jfI#dYDaeuw11PnTO>uH) zIzOYz=?tRrU^aFu&dM&8t``?$_r#PuI~@L~{)TWajKj&deDofo=>2*6wSt%npX#4i|sC8+SoCKMU85cMU&@%d#C*LqtBBk;8WS9D9MDcn_b$fg)+R~X9=%8 zM#J8s6L!&WNsVZrKB+3l9jZI2v_JP7tBW1^qbeEIK_q(!grzs&nqR#X4*QS#bmVOk zeD*qt`S9#Pt^c#09P~H;Umg1%2Sh5jiniAQZD8H?UInNwa&!NHRW=hiNamt`9QY*c z8IeyZLHZbaNK6zQXugj{M-&d@4Q+(>DZ^vCHiv>Mhrm=)a~{?S_y^fzdE}ibie&Rog-sH)BUubam}3JM9;Ef6vST zwV2j9$wh*{Z|U120^)*{_Xllr=_~H+2tX{4UDQWM2o5!bj>QaBcP88F83=G4Kb2_X z$s0!{$n`v*m#unfG*wnGZ9X-Kuhkz{8hzBdyK+Fu_o!LVjwgM)gP0`%_r_G#6)@CA zUt<$4I?>4D$5%ekR2=!R&6Vlqy-+G^r=Km)AD_`^k-d>0nrkuDyfvU{!_g1=N&(ZxN2)NoTe zAfj8-ADUr1`<%trh2ilxK$l?9juLb&9!M8|Ngj4FT=>SJen`4#IK^Rosf6s}q=>l5 z>%1xBvThg6`l)uBGnD3$`D$m%FU_{nY&FLLR`A_beKvc{lX<`kb>)*-fF@6lgVU_R z=Ux-p@6(b1WqNlgfM|w}>_L;-0`CX1&?*3$Pj6<})vthBkALPAo~&*%QMD?0UF#C* z2?P79hw|Jze%Hdgv{<83OYgPqKh`O|yCmAEZ(!|vC#Yo;OUS)5y3-=>_&oW65Uxn) zd5@d&8Cco^@Q6SM1dDL1@Hw{!XWcbIVQu3aIz(2^=YagCxXi4mZ2y2Bm^zy`n0iJuUd2KQYKPxT(Bo@=;%Hj2ClR_2rfK4x)zKxAR1g1o#P* zW^#wN`e}T7=uoE6V*30fqb6q^Dm$BEA!v$p{d_G8rpf*xiKw?}>Ns)OdrR>M$oTqq* z@VD|Hhs`cWakSm9x*-NL2h^pS?TES6-_T~eIvyqlIhzy_&Bd#z=GUcwwZPZ*K(@e-U|+t|IIn_*Kq6{`aFqK4{{ZpCJ); zUzfc7cGhj*>KjD}E6K5Zz*eiD>JY&tJ{0tSme@4%h=+3fqIK94W^VzFALWUBv3Zxi zPi?9Wr2m18(Cq`rc-_9QUGpO#)NpTZo`*vZ7~vA}{Fm#|ZcUIJv!NWnafNOHgQ@V4 zlNJyNxb>8WQU>-qo~xD1phpvSUDX}`IW0OhDJfh&c)z=wc;9OIB3uAtwF{Y^I}1@y zU=hdrTwH&>W%6^ELk9c{D%xOZ|AmO@p6POOKg;*Q;f0j8(&7 z<9=#7l;TR32sIyMKvc|KsJvmSa6GcS@woxW@W(KGk zN1T!#y8GJ03+7{nSlK?DbTV||B<$0(;ecbHS%0Qx74rjIC&yat{pC(b6=0lauVkk- zLdCUz@?WvDD7NL;bcGgr+zdE2p1dv8rF>>lgT>r9^f+PAASIUv~w^hiGP2O(oS#NGj6{;5oLLrWLNmX=oN+ z3=#&2A%s0zj_EFw%ae5T?>rgWX!;hPRx!@Es@b1tcL6;X!EyxEXWTTyG>5VNzi4~U zsHVEDZ5RupAY!4YNU?!{NSEF$AYG+*r1v5vbOZ$zDFV_1h|;_CUKNlQdM5!Xp$7>N zAe3+I;C;@y-}8(!zIVLmS-&!rWbeK9T64}d=XG6^bmU;u1@744ewVUjso4_lbziG! z6k10E>~5h#_plQh5E^=Ss4cT9W#1E&sjv5s^>Ws5ky&zt-pz0^ch?-nw+RZ8i&K~e z2nSXvMKCzlnby&CSUsLqAFsG}9D&e%-Z5LSUQsP|r_b|Cd=91PdBu2WE8MKs)mNLF znK51;$8yZSM)WV664krmyNeViymnctn0{Azi0uvpRgOip8UPYzeFe9uL?}$%_J>d6 z4%IsN1p`$IdXa)8H5lNcPgFWvCF?C=#`iH00Jl6#Ef(UBPg?IzyfAQWE$-r}dw>KP zxSY3jTeTt}K(1FcVe${TLQe|*2u`If7Z4WY^w;l-dL|VC6Z_Z5yzsyDS;xUkmFJ2o zp1^_xSEC7p3`4eqa(rwM_W^gVAda=yZ0W+TDq1++GGu}Zv%T=kj=!Te3wtOj)1v*& zf@}$j2o!d^*e^aMB-_l@j}g_!f})-C$Dz|I&9%PdEL zdI-oqxsEO@|VK+7@SyAM;DK zh-a}??_a&Qx&ToSF986I!TyFb#@ucz#O|zWpw(FeKT`s3PhkOY2iL}|O9^at2?K1d_H zH1k&}>&mK5cQU9=-T+*2fX1=AAc%@+)WnP>UhpPsHOOwYAd~g5W_)hwF8in~5iXox z1lMi>x0dJsMawrx!X-PWaZTWhq@P7A1ELBp%hp zDT|`8T7q$j7m^bxPYmEvUt5s1)@Iq7k&dyx>3x}q4n%P4i`y5wn#6UY2E!42~N043xzP&ziTFpEx+mlgI&+uRw$ zW?6P&wS?1lHCuN?*(P~I{HZ9KYS%HL@EkRTeXVCs@_OZ^Z|yw&-{Rl#TEue^NP;U| zNKOU4wMH^yUKbnJdU6dXCm(liGgN~o+Y@nehw6ISHIE-^c6mdOCaakY3OC?jdY+nY zKfKf*8rRx-^4h2~-OA3f!$g(9m}oGkL_=Ll2QzrcJ_!K; z0QLU$USEn=4OI z3wwr(>c0dc#*?w18$-^8GaH4(7O^16KoM?o6u-tCKnTD$vq#Sk#DzNX-Z8)V#T2zv z^7Q$=(z3>Dmu|fy_!NULloj@NL_9BES_sgJnfn*-bbJq89Pbn5&zsaAwi>z2cWm>e z-uao6kOl~FB{Stwv+weFtlA#@ zL0(PWR_h5uDn77^7538Q9b-|I#uP z@}ES2zX<7*UqoHk>bsNz0U+1kJ@*jpvk8Oj@SoAU!>};~*36&r%E^0Ox)!R= z{TWaG^>gsQ{QLjwXB{hGVS(*jS&U^DMrr23kQO!a4aNE;c+Q2+jM1{}qZ^Qe0_u_( z)h*Kp?W(y>;z~w*{I3xyiz1mtS||yLx~s}lsC-sO+pt$(v?AVXJ+2}pD*xTw**Ofe zaZM^ZiIkSX``z2!13y;o3aua;0_iw*yFJ-bvua6-``9Z0lI~fKg-Qv*OO&7xSyJ_Z ze;7J1Fj#S%`iAnqpQ5CIDy<&*RNg%KxiuMJQq9a)9?^Tzn zFlLBg4~_mAP@b_> z7V#pbAG+Q8enK|hFmYr!C%S)7ViR68;qh_G=mh$`xKDVw*?FIYBWpX3%09BT1-~jz z9ENlph!(V*x>vjIc#=rx=Hrs%R9hptg``c>3snYAyah?rw^!mT=CNQ`O>z@XCKjJ} zYn=?VmNr=}qq*Ch%4!BZR^2&W&jaSdc$9B)+d4$V#!WoaOh_0Jza67u33Auq9X$&8!w zy|qthyu88W!mE_d>N5k|vSc+`@&!hQz!J~}IB=&IFpO<<4! zXPKX`twN~`lhnpfJl8Dp!Yyj;Mf?sm|ef0AY; zR$9jWRP&xQb?nqfKs3B>0Q{Iw#(LCFvqe{e6QbEoTpI9YOx?F)KRbPXEBS4fB!h;Q z?bgZ%ryewjTIzqet{oCetl6CWEf1W?umiIMl0*ZMl;URhofB>oGFh8?m4|oH=UR~t zA$m-Uo@mVluTdoy97-f6rUfV35?yNbQK0Kes~>AzmMZzc%)cqX8j ziYwGXqJKy2wBB83!u5CyM_J_(@J7KHSjxKEXPU+=G$6t|>L{`Lqg7)npet&?(t3TQ zNw}Ieh&$0Ne!pU z3v023xQkz{2E;m~&c)=Yt?9J5)k;x)gAm^}ufzchMAF9DUY<+ZS&mA$@p3=?*Ds?S z<0U#Jq;FOUIrktg5EX2}VM|>-iRW(K9Pm;-!STz%QG6{#qYxo~V5fJF<|VWwbkg(> z*7BhT-{gylH@a@I9e0bE?|x;UWBDa)Kr{D!qxoplp)h;BNj5#sr2P zv40787yjk*e>D&mIr+ylgDe;{^3D=`p8O9FDUkijdBcwfwP%vsbaudDo~2hNPkPau z$mUY_RX?~E)X&O)ojw2t$3PJJQYoor5L28yJT+R~D?PK7yOx&oj*O^Bj;54}^UEs= zMknTCbfirVJ-Yx9C6P?=B$dkL)fN?2fFdCTyhqnBe+C6LsvpOm>WF$D>gier^|OwW zO92rHy~iv25}aS24yp}$yBJ&X5!Z2ZBt^*vmw0PNrcSKI4SXZ@B~l^z}8UjaytaA57Jew{(&hM z)?9aYLu>h7eZ8|!vY26myRvVoxany(ICdis2IkAvJRCXn6SMm*ZX$T0_Pxd4(>U^_ z%Ll7ZJQVMLE!XXtZ0-C}4q+3++^&Ng(kZ1lY{ML_e-LDrjJG?t31vK{Ol@ho%9=0y zEp<6LWa6UFKLE#k23bT8pH&6h=leT2>aVmVHp=|=BM*K(T3nz{V0PR1H~c!Vwo#(O zk1X>ygf-`_h)~V=z|ve}{Vfe=i(HKXTjQ_1 zwuEu(IuD6ay<=%Z4Jn$EX(oHAl;v5uz9m>$6FXIn;1yGRU*|FK z@b{z`DSqAco_>>pbN*F@{P~ubx1D)8LnNBwv^RhHs?+^|FQr(U5&}uoAh-Hp_x-q-C3*!jS4 z_x|Mj(H1##in^~C3f`p?c&RTg-vSTMhtg^`R*r^~$D8_8wbTW|x zV3}?2JOTeH!i#A~-8d=(2+;DNdW|n?bP2eG!D@@KlHfrn3;)+FrSV@utk9x*94j<;VL(^$*tPK8@XiKXE?@>E2h(?%JF~T!7Woqy5p;INS$e zdZJg3&#f(bvomTKJX=ya)Kj=|_Z*|X!2!bH)K!iw`N$FHip*alEb1gfi4>mASxf9S}IeY@` z(P-uR`|RU9S7wDw==%2-f8|)_O3Z#^nYYTAwy+S}9vM9SQ;Wcc>pUphQ%6B$?&D~~Q%6wANl6Z&{F^Qd}@3OI68tU6HoYCjC` z__DBzmCe+l_I?A0kYa*K1e?5nxP81XZc{+igGDXr&vFzPl;5$Vo$@%Q&asF$`xhND&u zYTVmYSC3_qg+5}4R$kKVwY0H=wQD2M1By~+$28@Qz62gnE$H$-{tXN_eW2vLR# zcPM^5bI)~5l{Ccd+G+ao_9-1JAFJfsK5In?>b2;!+p_&Ty)m0w?^bgs1ytSDiZ`yN z*VLIjKLGPuPK2z2jk(d{?_q14o?##Z3~z2ZY`Fjx&oA!kmKbR*RSVO3quk&2Axx5aPvv?kG{{pz40tK<|Nc{_i%_P%LsqH0UX z)W-u4Y)cmkrLpg=qR^T(q&W!6@E1p7i3+Mimba74rra(r2(JA zx)kNetOQTwWnu66!+NV6%idt+tf3}-u3|?#O}X&fSamGh{3(L{5E*Xu2E&n_Cw!xL z#pXrgH({{>(xIa8L$HbA=@PZ|n$?N!Q}k!R{0DlMfs^{=iydUy0kMgqq9PL{UMIFK z-)Vb_2wwL0qA++8qH^!05w z)Nox}{|E#O$VG4MQV1sy5i!QPshg>+;FA#3`(1c&+Gd1A|1{+E8U%QB?-fdT0Q(oI z5U>95e6GH35idxMM~=WSrph1k2US@|`WVLY@3{@7tNkPYN@V}ypJwzI)0|kq5lW#_a-6;I=AJyv_D)S z(W{)Rj&F!A_-VI|){nxybB8g{CIp3b=9kNH9`c5If@Sea5;Cbo`Q0_CIb~_4u!lGM zs_Iu>JOyYpnpX+OosTT)&evl{RY*I0MvkI<{+qQD_~u+1$ct{c*LdnySXhX#us0u3 zUW9Wh&~R~-uaKn&Nz3T)gmS7V$|^bE!#Sc~*kvLDj+`A*!hbyx0#V`n|=YgcsciXcieEn`Bee5kR!BHzVCsV}86 zDit=e87;~T$QU0D*^NkHUFTsa$0?WafMSrn6e%G0#Bkzj4h;}7q;e*8J3LP5?z z>BG*FFWeViZl`uRR7nn=fn`Tiucy~gTbl&v7f{G3V%C?K3AYmkuwCRoI?D={6XNfV z%W;FEq2J*wl<9U>2uJ~G)k4t~{|a}c(Ew(q_=2#{r5%txBzpbF9y=54@n`~y&XTe9 zBu(`SD{;#K`ALfLS^K<_x{~fdjx4`=wOe-;BCkCG-Mfr2r5EVweuO%edpyB%q@AG`r#R zcJVfK-&7*PTd(=A#BSlny{ZFJ1faarHg%MJR2QZB-6bC@tzocE>p!x07RmkmtAPj0 zWdc8MVP>|4YK|S@aaU_k@ez`7U99zQFUMOQ-}^K;Ea6>6`O-O=k43q77nO6xl}p){ zW$~*!3F}V|Jl`YBTW(h&G#^agZqaFfW+)iWxg6&r&#-ycJOw!sPQ@`ZEYGoH%j9FW9$xt2~BNFhT z;L$JWas$a#qLYL_RV66C{klsq#*s_tS?+vi($|$P8Nl~WhKqD~HpHR9VI3$3053$q zl9-YJy_Z2xs6JP9VN`vp1K^x2p*@m%qVePI4|+Hxb%9VvuzwCYai&LS$Ur1bMK$ zoLCv3{^ON!eODN1*X>L+Ccaq3sVv^l5gg!#da|3Y=~w0PKqWzR_r5s-m)Z~P=TmJypL1FzUww5)TQ0meq1MIglC^XJujZ{zMCKPx-1+fDubPrwLBJmz!S!)HPf zo>@-cWp*G}b2M+cgn8qqg+fG9LWnpJ9FON>Uw=7z=d2S*(|mw1mvuCjVwc&S*zq;> z8m;@5GAnJRMP|=DwLCv8*dxru(~ah|TeA~C93t19zH3ei9wV~9q+?2Nj2tDbKihi* zX9RD|6StPI$Y^d=^wSu3etV*AB=10&l|*Z1Q#Ik-v5!z)zdfq7#^IeDhymZsvA(N_ z`Z`<~adQ+?5phjXDehC0`H#UT!BcnXCRUU;?%gTvC-YvQTzD6;_mAhn1kOS$-ZtYu zu-ksYp!^gV|Ble}nz_l4{J(4#X3Ko=W#A?L8Lym>2U}&A{#lNPvXiga(*N*UbRXAc z$uoWJFjY?9*==$Tz=Ja%#TASLh*Fl`9G#E1yIduSV1f#gp0z~c{~~x$wYlDb>a)Or zJg5%5-CO^XJ-FoG&cm_h{T~;F%~nh}dwV{A4uA zsxAP_+kkLijM`($Cfz;z8LfWe)nU5h4-Nq~Qy!4m#sgo;mtoVhrUXpnT+{hv1axwYK<2 z{ERU*7(|S?OgVU1qI=B%J_+sXfjP=WpjoS+O)2Dm5UyO_1rj<7nZL>etV{Yyb7^Yq z2xbKW-pzIn%VoL@O~d)|)Tg zy%wztQ&B^Ahzb!AN!;zb%-G#}{XldaQkYz>^5nMo+3ws?j`0}5B=Y(Ex(ktD*aUqj zftMb5Ob8Uqj@LdN9Bll48iKO#T)g2<^nGawWLvLw)aqLc`s0Dz)Mb0pUElr0`ujNd zuHC#`ZVh*@u^T<5oZ~$W#TT#Zx_f##kNGZ{g6h3|=sA!N>WZp)dujbR;O^6{5F-z< zYKWv;Tg$)()cZrBft8ionWSv=z=v4-k>W)x+hWbsNwu({1pkOMa(TGa3n5c%#+VTPO%W|4ftJ2Kg>co&i+Vws@A^cAzIiulZIAhEjLd5r^QzTap+X^97>Xw z@MXUVy((2dkk2~Af&f~^Z!c*)R=F;k#p!bZi8m&btH~&>?ZnL53#9;;B%qI6^B?ow zd(!JMe3GUEl635(XC;Rp9A1`Czs_ht?(;}tqi+&Ha&(nZe5-?H&zeUQFzOQJWs3h zB!c0zKE4nO*6I;rQv1)@^7=}~wfS#P`)wa0If=P0G16$eJa~lnf_?d(+H?udEFP>k z+sL}`+wbCSoB-@auM{}6{AA?pc-FiXau#W(TUu|DursehC`?qtv?kqi4AlJM`ec?RUV`{TZ+R)_m)~@b3lT|CFMg41j>b zOP1sPrc7Uh>QwM9EtOovOAQZM z$2+Ro(zY3QeqP;-eVczG0h_z-x3uMmD&0eEygvSO=w0O4(+2Mi;yxbXL-`r+GUf*a z_N?I8w7c~q(e!f6R(8>nz=tZqEur*k9|(6)QT_T*anm1Jrb@e}f1TsvZsIrVI%cuD z3!D1`sQszEfo~JwylT$_**51-p!VrJdxLc<_{b`h^fE*aoY^>k`HyUh_F5g5YR3VA%v!9+hLz6T|X+T$e@-|$6zbc*g-+cnpQl5)0Jlf)0f5pv86Odda!)X|UwaM6SZjul_w7FYO(7W2kjNE@q4V^-DjU`{B} z&xD|6l9;5!E%1kg%yhsE-I}U?Qd*kc#<;zzFq*_9e&OKY zi|V@i*6tR74A(0VAXyrvF7u^4g8x5_uGGnr-NfoH$!7R?eXhBS#bb6Bl5U}36ym)-A~hfBWH@a#7hlZ_YR8C z%=egmz}~VKg)9{tBM6$lcB{d(1SnKys@jv&5>6@($a2c|@?A`^EV+Ca&M}sR{N+eG zuRejK>;pO+=j5{h4~&aP`(^`g_V>+$KigYdy! znIVlYDCe#fnwb^1<3^M?NMUNMiyq(sZeL7NE}Sv54}d0Cw%syY=X6Kxf_eF z2-Vr=ciTU_K~;U&@lDw`>rg5WNA3f`0qhv!A8($ZnJG9%1;nJNziVa-+Ko^4TKgE- z`a)-|ZdA1L5FNQd_NdYr?=P1Bf=7&T@|W{xla2*%>(xqtA53~EPB%u_^oo}-)kVp{;dW= zlypW4C`nQBFHaUiN#b|d$%Yen3+FOB6fl)#)Qcs0p1&Xei@f&#)QOP(3qZ4^yaJv}x`6gMwZFh7@|z_8LAUy#57Qa(~74wZ9t{gTK`tqTnut4)z4e9}T5{ z0(KloBfbWxpw3W-EBM|A8e=o7u;`wEko1!MB21+mN4|U4sS|;@BQ7`(a`b%QmZc^x z{zH`RQZYdCQx=C6WrMg+;pF-SCW;GfuXT=r!{xoaG?Z*xIxzP-J`k+oADrAM4g5fO zKycW(*A1_%6-vqnt$*04^7cDCdSB*~pXZsMTArU)p;mX*yoAQ`wz>A+X8dR|-b{B# z&eH0$d)LUSZE?$~-pe8w)1oWG;y%{)UaN85?sM*z<W77IGZ6777x)S|IhX*@Y`iyDH^*&OaK04E%EE+KWG<00r zO@QtRTzCQlo=ArRFy=C=XRGDDey=;B?h%?ap9uDs7_GX+5xryc~!{K5;FS7$Ll4MbJ&%$7=X@`jp8Jw zkOG_VSe#7@OMo<0kb<56cH8lmUaL(L#U269NL->}J4;Ymm9Jm5GA9nlya7M0Es{TW zwcA_op1p#)T8Wy${@DeABrwYc37zW~pse9H^0U8?zS*@ch$WF@Khz$idc@&8+><@E zvK(7xsd{IwH@d+ykQeFu1ilLn+KGk(|M{#1+#mcLUqw2%tCV#rNF`OHS}n@}n9xQ5dcrUiIDzh5SyCBE)nFNjBT)Go=TQXs9~+kt_U( zc8_XfgKD3jGAy36BmHROtV}IX1Y*}Ik8AsRqme5ywp+ElLxHSslB7)<1=WzaY}*fV zK2QAK3xAi?qH%`a+p+Z3V3;1}cM+U9do(%L?gg`#+lHP6w!{Q*p#z-=fYGArOeBg$jDrejs=pxhZl^lFIMM_ff>1p*s0 zzom-O&jv*piOu?$8q-4b?6D6f%Wjy?dy9!f-do4%PdHoqc*9N~$0-Xfgw|z1J0Osg z{DRuK3=WUbbZ2@r7nXfS6+v7F3&Y@4yH;k+fEb7~t8LYV-y$~kA+H#qF2YB309Cia2TQ^ZBR1Wc0C*sz~5-5D~ImPz>D1U;ryon%b;IO z7ek`==#?-!UDGor?vDDh-gV4q@+cWGn7(S[ZCXRHK{iRA;IF+?8?=lFd!sv}XC z$u!&yY|OsazoCHsCO-&JKuRw_R0=>IWKEEQH0|p>@Qn4c|5hgdz)|}I6ldyH0W2*& z@7O~Se%rqe19ljI5}?|+Ri^&t+Y_8}AQ7b$5tDZS47B?Vu=T{a-X@Y zasz}J(;o@ngUsrm@n7w!HmNnA9rqK0ZnANqCZMF?P@Co|IJQHBh5!vo_U8NASrK;t zEK+P|+5>I8s>!$(?g+VQhaH$CCg)Bz5vzB&fGg?p1xM4t9~zyVlfspY)sn9}@J`-i z7VDf1*x~Aiy>EGw_%V7KtzXC$Y)e3>wrEWV0OvP2_8tdEzi|o3bC3h=fvZldB&5Yg z6PPE&bQZ>Cm-lV8fi|gb6;PCca7oL(?b(T6--54DL}vyeGL`8&kv%}->@5-siAEQ@ zYKjoIDR?rhn1y7|f4o64b&5##Ifwl?sFX~WNA_8D#V%!BE8jAo9(FSX56Mpk84PLQ zFitfbUuk7QMyYm@kgb73F>z#B;VRmmO$_bmGZ<%E`vqCth1DLhxgWYR7(01j@Ikc5 z%O!7;k1p-=3Whg#cMl_7Y#O9`R4~Wr^GwyIEs&OGoK0yVovvu9)QV?R5+ zD!5pwfF6FjB;{C#Wv2zv;FsMa2WG_-`ohF2t3vd&8D{R6?Zc)8;V~^i3LeDCv+iv} zj@f*?8m$in)GO4Z9SiLd(rB@BuUitBYWxfRWPsXFvds^)C%0#Y9+GZyA9LuL0>o;e(D-FepfC$f0a z3jh9P9_G{jKm{h%%sLKN!A^nCsti7{ALW@lKssi7tnQ}AsGu)iDCg(6`w?_M&qV9` zY6mN2BaWL;mxl^TY9Xa**B25+rmULlEiE9((Rid=UMV;K&^t4y*n;& zX^$?QH-3zhZ^u@0Pz9vxVTP5N@0X~S z6P9QKTKblk3Dn5_rG&D2uZn8f*Ufq4x^Gwo<}kOj4IQ>RV{hY@5XfGU4&%gH$4>PymbHgY4*lDol@E*dvsm%l=NH%212M9$!@v2f;X z0Gi{@%7D8GxXZl4uBr)d`6k|{twR`Mzu)NSw?6^I>S^2#wcoPvL``T4Y-brrj&GP+ zy|v|#=BO_)M1Z&Q%IXz#o@T3)7^6_rF>_`X@9t@(O`BA4@c;gx^g;=W!xKNmu+XXy zk!b)6!7x~9oKee*pY*$;mcblJjTU{v4OkU)LPOl({)B^ij7I}|HC*xmD?en8g3LsV zYfcIG7KC@?o#f=jD&KE)p`+e%)tub@s6!6wUfUy$s4PK*^`8JjA07i~=yfu!wGhb=MwJP|Mun9&puA`c)>(G?gQhAD#HZDV%o@INp zK+@py*PxdPg;L4%B<*h4>m94i0)r0QdX9^gN;w(2Wr+AC*UMSE4%owpV!6A6k))Z;ArB^&k@!mIf(+|Hy48+wwUht_LP z7+>~WJ)_tYN()J-UYeJf*U-{O~yYe7{R}Qkw*r?od5O9~~n;Nacwd zn|>gtqi1k1yylRdK6D{gnhe?U_%!lxhZ|ww&f$n#5&N)Eqc^h;W-mM7DEVd3`A;U= zHYw#CspZLD5x_V{^gM+A>W7LU)TzM~vjI+F4>3UU1r(&w$lpMC7l7z}+ZMj9!sO3Q zJ-J!+1GL0rwVqiXg-hxR%UN|R&j^kaNysb`htPto)U~pg?nYSi9)!_;uyb`!JW>uS zo$a2-SHg<Cw2-y1ZUb1YDeWq(@6XHPa( zq({-9_O4;ju9Q#5XYe9oUv{#ZEt2^Id-`YnXC5fKeQIkPeps#rSw(rVn_uqY{p^7l zJQ)Lxtyh`rglR7iXdDu-pe}dyzLZdoKlcsbJkOb7){mSg5(0vqR%;7&N-1pHF-Y|Q z4I(6G4W!K4jvT64hvQ$~R7vJ9Z_4FX+=_nDfkuogEQKevXU*-u&}Hi8R#stKTPxHy zp$cgE0NyB(?JYu5rcfL3*z$B9&6bW8u9~auIcs-Emcb2^mESqh&hD_!Yq7>PVj;v@ z7J~ZRk(iNCXYu&h8NC*k;#JTwFNwu98h+dyHYPl%tN)F*TH63K?`_P&YoFT`=ScC> zf@k74B#LB;GES)heQ3a=^P_gVPV1LZT{>=>@@_NIlqfdvP1Iu zYVrE@uD+@{cxUv+*OyxaEabr!Wd*&s z@8;XbZAhVeI<|Ju7ox?rzwQC%bK8coebh>xV_tx$L zr{w!>Gk_sg;O6J;etsc>8Xvj7Z{Y6+8WWtL3$9L%>aDR5kEu|mIkD9 zzu)o54@i>lT`X8=6kA@@V`fn9-X!hwP4+k;?+XLoxS#J-x+&>bL7ux|s7>$8l;Tbd zZ8j>D)naV=`1IL$nLE*^_@l(2>Ggy7Coy};gX<9gWY>D#G)Z4lY+AJqwj~^AqPOe- zq@GW)ZAPK>X1N7*Fy<2v8O&4&g$-XBwWa3CuqmL5Q;z8<8#qTkVnn)I zw7QnC-Wn37-JhqO=TbTrUc!%-uy8r(3(>ExXPH#2nlbyd^odXF+osO*Q3xCO&<8ky zGFisO10a>Zb#3)gmt4!q5cf3bTw`hufA;Vp&s6@Q7!vZi9~Em;fhOMR`)5y)DkWO8 z_SOXZ%I;IbH#S(euquHfZ(}!H55&gbhtXh}GW)7{L+4J5hL-Qeemk{Ou}nutoEVC~ zwvRkxS~xekGjThU1h~U;ng5XDToCbw;RoKF*|KL90duX`!odA@a3!%A@wysVvHt;G z_y?e(BQu@0r5vghq~Z#m13qef-1u^4B8eLX*jN693|4cobvtO47OHi2#8Hv(M`2f7 z-ktF_ixQz&2UVlVEGP@A9uzBXQ248w_(?Oc)kM+n371{`FVu~|>-_gx)IAyf0ePu` zTF?%dh<{wQi#Dd%E=#a9o6Ha2H;yjECNw{WUjqK=Arwf4s}ps~M`Q0&-eWWF(#Kcl z>Hh=aMriig=RRLu?!@sn&in!EwURre|&y8a{$rV!$+@{M;^=6 zuB6hA+kpG6c&`aTcyOx@Euy%k0IiHzYUkBW8g0^3eFAvJ4L6Xt{lT_+pZ9DH#wbS; z$>^;0HHLS1DaIt~cA>>$yhub5$Hx}Z^p#=Tg!d?MSW>c;^k(H6Vs@Dg$h)j|(e(i! zbQpvBX+3^crTJK&!G_HW4;N~j+sWQ5UEIy+0iY7Cz{GAd0=&Mx7hz!-5SoR4+8m0H zXC(&&cD2_KEK%Y;hl|fq8`-*nDORs_g$9@I9xrXzWkQlsFZ;(cO}eqKjm0^%*Mh5G zUrT$ed;Oz}zCbWgK>1zTk^tg=9lzx$co}BHD{1}(8kB*pTA{)gZ_>=EC$bHs2S?oj zU>c5nf=OjU_IYDl=Umvw#QO;KbceKy-eUZ7iE?w^onrZB&E5rDwWxuDZ%f{G2bEa2 z#*O2+WwB7uCcuUx*b(uz`s!bxp28YZ?msB;Uod?@tDmlCo4@))jiWoxX5;{Cpw&hN z`piC_GH4L%FYK~rSTWhWL4HC|M1gl7MCt7Z0GXEpB~v7l;69W67rj1fb3>)pbv z64RYq{9acVUEQyu-F-d#4M*WT{abL%cGOA|P4yrguR0sD^&nV$yj~t%n_CT_s^Thc z?H>2h(P*;qBD~0Pgvf?xYc>c=duQj2@@=h+EYehr#RRprSx2$I6_%QogdFOdG4h@hP*E{+?BvTJU9 zL_`EC!l}MWJFO?Y#Phz3zQ3*U1J6Gj)PW1jXV=0PEHN+-T)qQG8YSkOTS0z;qPNgD zgW)|KpztVIM#G`CMJj&&yjjBfsrKH=AX>(6NnhF18alN{5bd}Y08ju*y}M`3l%eWB zCyh>PWthK5CAyhvPs`I|Ld8uCqjga5tQ{lRwO$8V)hp0pZ}cUpjW<6QAQ*eBU)CA6 zD|VSxtyM*A5x4wO7(c3d88PF4h0v^4^O_noM_#T?UEqrCoc!*km+bg4l){u!`zBw& z0nTx8v=sIe4O!2|vvoY<6vb)!)71?Rw4&|bQpe3kxTxrj8eNB%0(p-qy>snbhz-?} zmKcxaPttJ=JFSAT5I(nyt1l-`IGWG}cbrG5>r&Sr@Oni{Y6V(gW&jw|u)h)1&-@!f z{gtzs`)%kzr)~g`&;FzazS6$&A8KXPZcUi+x{J9z`Ome$BF%${_>j?l3?Rl7R=)53 zhK5yT*?=+TgWlhtks|fK@Od3ycZi3QsQ;u%)@R0gK875H=%w{L;Mz;`R{D5I_gh1W zG6n3~rt{GxGV%N@S$we>s=P@Y0^&S>&UOo?EUySJ7b#hx&{7*C3Q2DL)7+lQUE^K zZRzm?uC=2mcMo4gf1=3qvAzBg#-K%>;z^g;8!Tswi&YS43#N%53CkT&aq{4Lq{Gk3 zKnb&ce)SWUozf$#K_?%?{|WBM7jtV0J1{RnC|C^PX2;c zDP4Xh21++@1Nf|{ltiCI895|BxD8us@TTo&H~#d#qn!s;e&6zm691i@eS%$7D;ZoC zX0;XepHB{z(C+J!BKmUASN z^wG**2K*qm0M~pjc2kHV;+D3slLv+Cv4HL5_r2)XLFK%0?=x{u#yDc3AdqPszazdA zAua>nZC+wV)XN4x*Y5}3suhZE_fNhWTM-YTJ7?g&oNUQPy$%+OY9we+{TZ~R*bEL$ zxYoQ#b@&0?b~=XqV=i6BGxKa((XMII9mbn1!A#|o2@h}2eF0bCrva<2{P`bkN$K(Y zsQx_bF)r_w0}t;^_Z)AZZ{LM&S6hnv;}6AvP0<8Ya2o14`FT*R=j^nDt34Mpa!87A z`Ibbp0cmV39%*ctsbBgIo~GC>Ifm#g*jwZfrvNY#GZI{y5b|UQf_jlHj9IWag8V9k zYJBn28!%U{JSzts$YUqFz0IU&hojt)aPk9O!fl5RL*UjYVy67vBTHqy_3AZc7ZsTK z74tJD0;>0d==krjBwgrgGVY&HoY$P3u>r)!Wsxg9*@dVggVoCSJD*j1ht&sAb2Hxn z&qmGr7FZlZkN&1p#PomY6cJ1W=$E$j9}Elll~?~$5gz(?6|v1sB@l-EH5T@I81|vE z<)87fOB=ZktJnAou>`1ZPWBvv}gzWkJOMO&%qp^j2a*t!ty7*H?N^OX*Rn= z$gzpJLWclP*|*2jy4-H=ICXp322n28D=f6)AT?g%i9DE0s_*33L8GjNVCOk)E&EVt zr2eNLjsZVXQP!azrXciAgB-91hoYn_)bnCE^)oma-ex1n4b}SMCrVkztS+1>r<|Tk zboY?fkE7AMO!b<^fEGX(!u$C7x z!n9v0$6&+)$pKnjr;gYXkX|nFRP;7YS62IKIHapN zU|A#)dggQ|=ySPtsCN#_Pj^jF`@{{zm4XMmV9$3#aHG7t=>{m!Z@g3`9x|zZR4b5b z(TO5V!5pQy!j+ex4XM#?!in_O`7#xw5*V_dc(C`7jrK2E)bmm}$mMy5bXqj5@vXXH%+3a8E?K z8{QV5X&^;^4EW%LYiTjjDY(K{Dao>dCJnuGrJohl^oxky&_ z$&+GMIVkUrO69L4iMJKfjS>{&btUtuwO^K8mTN-Bu6B6a38EixCj7+DBFbXnbVXQV+#e*TEEI{IoBEqE;mfRDt#-w zdiKeqksNW0QRCQ!tpk2P%H0d%KR(7q$)slA$<3bM*y+eKdG7to^Bg%UnM}JF%;fttX4WI^QtI z{inxrn-0o+Pqn7Un3ccX-SKgyi@$^F_2QXo_F7zEE)QN6PZ=T4&z7fMzr>9{SjFRBVrHEe!Y?8f~ujRUG z>|~8Bdce1hnECuQpFx;}n@33UR-W>h3baJ0A(*gBl};PqdLbpc=%Jdzbw;IWpv~*KR>rDF^ITb823EF!SiX#sJ`A!`p{*OEhz^f zWy!>h>-4MZWMP-=u4WZGThhva+PEu(IjyfPWD7`r;l)R#$Ow)Gnc;Z>08A&5dBn@rw|-4a<~!UBEzpnnKDx?#_xXjRHopY&gRntucp#~ z)_q0%rPS3Spq*kdfyAb%EEpAN`DmosiU40<^xaLLzHxbpsB9WqX*w^n<>71 z?YUH~4ZR8@Y49rO-@D~UaJx$olQQ*+>GSnzEBGKh2QG`QI2mVI1rJOY7F(@IG;OpA zjRmF79p>iDsk<-~)dwHH*^7zi8U8B8ox%9tJ2t|n&JWK?)1DW@+=t?tO9)X~GJO-` zAIEAa6z<5kYh2ND4SEGB6*wWGvi1vhLXT$e%|6i?sUG2W98*X4dC3%^8 z>fOAFW#uD}X+h~bwt~Qg7+|Pu?d)h6yf?IJ@d;7hAhBbC!hdGQ)VgQtzhA5RfH&ZK z%@6dOprP~=K&m&3_7cT??jaII$x5th+^_)`KzJb{i%oPoMQ(Hz3VJ|b(n%<3-TW%W zN-6s=6R~U6sdUslA-!`=K{+zt~@FqL8tfe4d+*w7g75%?R~Y`^9Ww{eIdVrphLY; zcjbKj-rkHT{*^;;>x^eWcqLIRqpi5d=K`2E_j{lBJOA)E z!f?hu_g=?Z$2!*9&y%UagqAZmaWy*lC95k@`)I5B%4W+=2GtnHi*GOV=pz%d)EN%b z*w@>PlOM8k4+)?;o|G8qrK6)#IW++`1m6q+UYn;lczB~EKB2>!DMxef>AZ02X3V!@ zL%r;GR;+$2gBh8)d)n=*suka?wq8x=OyHEwGII#88(Qll!Lsv0QOSv=+ZHPx=&yD> zp9mIh@#s=v@hj>1PC~jp_31j=;jz*VIXAk7dDr{X4(bp;Z6p-+1Ib}ffB8zEw$N%j zXRv|PoI?~J*|TePWnG%XVm=G+M$nJ+`pVc1p*_GYA?jsB&vCwQsb&#Vf%emyE{mmu zN421+-002cooQABTfKE12Sd$pz6WRTXwX#?^H4VEBU3KLxQr9H4UGgAcjj#b2GWYe z#T$UJ3tp%VyiR7(ocTUp-RL=cxLnF>5niFN=6k$|ueXTAGO25Seg?SSXnsDJM`fR&*Ib%8q?Px$SEag5l(e70SP-j9Hl!uCzskwE^W~U32E3Yr$4x^K{vEF# zPbNEzQ+|3)ar2FKfbPd6tG3#QxIt6}I<%y~WGab&s&xN!Q_*BVA$~TmdMFr4S^D)A zG*KW~&WH@+syiL0QeKtI%!8umR@gM^63(|=#2PW95#u&GV`=*;*A%_=MS3jAm%!YQ zQ(Xn@D zbfQ^2ews|8llRw~?76{}osFOsB*iCmnfy`~vrj8Y>O&KgKohyx4l_E^A&Xzkw&Yld zj&-7;M3WKa)$yg?o`~fvj;5zF*0bWvFN3s4WTBPx;djUty8Q2A8&r4;_Clv-R{6)N zAs-QwL?NkhV!)1aq1)9bGe^eL?d)c+(^7a1vj+OZ)ra}}2h|mNhhY-%gseFBsCcuO ze4ktSDZlaoz+yQ{%0|E9pR#y=-wHDCA0v7)EX{;M4xGlple&>i6Et0J5ro#dqQ={ZC+YlaMs@ zC;YE|GvK#a?Ej+A{=fR!wI$R%`JRGYJwS&MowsOW)Z;5h4l@Px+X+?aDsaB=sR`Fa zF4)2zH#}+!WCiX)&5%|;PbI@gRTXFzuWmZ$0!O&m2!<=7tUeN@I##If;;_{EUZ2lN_1&`+h@oA3A==QwV z;}LC5&zbPEq@B_Y1tKWL=$4$98DH+3Ai#hNUO>GhIJ)(8j6OTr^|raKP*$s` zOuc@b&8t)@$b26SRoCxt{PV24fulzXBIQWiOxH@j2!u)F+xpN~yMY~J)jg-(GJ5T^ zb1K{mLqEl8kdq~-6c&_DsH4jYOWdGY zbTZDb8mC`xS}1a!tW(Oq8jFbO@36W*YpW+)NA~K8f)lip;>Z=drGOie^Bx8Mdxq4V zb1U8kKb6&v?h0+wN{T-85Rt%)T=i_sC`L{Mw_)VnT8#s+RkNt+0tv4g?CG~EV4PG&O{Op+n^R15u{Q8#3 z`*$w4JD*`hLCi5v&ryNiQ@FOI-V-&j=}q>4&6`PVPKlRKGQUF$bv-{ zvMtsx*RDs-EGMTQvPrO|&Jeqgdu?{S+mf9ueaK5~|s>3+R*9Tr7m8Xs-`JOfi2Y}60yUwR}61_I2 z=5ewvK+8zRFC84J$VJ&_WZHIY`)Gc4r{LS<9=gs3y8SYU@)IP@_L&kNTSQ&+`=!&D zqu}=aRBH$6e}K$2f29$l6b{WlqbRj>2TcFQp6x z1xilJwu1tuB^&RJQa`)Nl%#d4yizdKCy>*o^wE{|{TKq_`Tcj?K_!uSwQ3cGWIpvF zcGqBCopG`IbY-$}bKEU+1!(TD4XQ1*XCI4%RCzpj>hW+gORG7`^iHqPeVN_$qkNT# z-fNQi$Km#4)WNe`PqAatMRC(n_flqmN(b<2@U8mBX}aM%P*)5Aw`wo>wX19O{zl61 z*5rE0jvkh$!qF6tkjvhn+==XasC$>Ej|rECr_p`VBZ>VkS6l6>NDjMLKxTVVVs=;c zPJo`RC#j>@qUYJFuJu%naU(b>Sc}(U_EI@sm_}niZr4ZBzlt%9y$IDiZvJH-oo@|D zdq0Ce!szVwVs|^$z`b!Hf2K(LWhQvOhFOSD1jojM%p-B;&LcL{pYAQrgzDf&N)yw^ zUDN-mnxtH#1qZz6KT6*TwP7G5>f0T~EN(wp!f%JBHc&lQtrh5N@t6l;CY_I75Q8gbapppT1(vS{%28ngpt! z1_Z*@eQP`HIc-lLI?_$K_Z$_h+v#NBsp4Ona{5+#sVmXjrelgsMz-uQ`UoK{_aG<*PWs2xwMlBrLa0Oa2ULX2x!=0CZAzZvDh z)-oWi^+ci0AifSev7u_ktTy!xUP1Rb4Tkpd^6>pZ6L_n-l|O3_tIw{J;(Up4L|`Q) zvnv%*nuBKGF%#C$8@y(JbqBdOO0@A@E|1s* z?ksc^pZFUx>81;A-Q|JKn#B)Rw?6lv>>XM4%EvOzfDU$#-r|k zcSo`%1dh9ashEfiW!*B$L1)wDj=aHx7@y}E0^B)9*44CL%`rJ+$OXWzt*qY(TBi9f zXOg7vvegQwh@E;r1Y)j7bbL>|u!dS$a00*2udL`koF|bSRShRGJK==ue56Yewbi*Z zhh1^|-7hfPNBDuGQ$PYlBrht7ek&8$dRTA0kbq+_dl4TEej8g!)T14En5bl6H7eLv zw43Y-+!lAfu8fuV#q)+ z(5FPXRcyj!+C}IpdYUcV;JAwpr6Sy05^O_h4;JENFtW@Yc+)gOeG)-|ydij$@qO_I znTI3ZyKP}yL6%J|3;P%^KG9GKFFCpP?ZqsY=~Q?3G?X9cONPM$>3%_$_M& zfIObBAXn2>iL0oZ=yle?I%|O`SHhHA$CAgh2n??z-IR+ysZjSeH+CG_H->}nT`bsm zr6?YIb<6gf1>JXdsWh9_nkTu)xt85Vrw8+fR4OhB6eFK{c*NRYynT*lc(NLbODJ#J z$HIJxgKn`@z#+nLNYIyz3z|rZSe34Yhg~dXbDemaI0xxPb{WHZH`Jwd7iJY}?>O`% zYFA2;14uCHha8iXWQK*?*X#-X=Qwwk7dO@O_hdQ)9KLr91dt5Zw>-Nz===nN$eOB< zRHX@boPJ)C4&3smrX7Ay%B9>DWDA8h!?sunYN=*VuPYizbveC~?c$+xEAbRq4W)AV zyfB)VvxfO8Y+lGSC*MPh)sSbimNbiZw_5F}QuKmc?9`6<@`uj8NHaEzgz@|xbr+eA zXCN9=4*9M6t5uF#gKD0N4-^=BDnKCRs-Ur>qcej1BWx4xw$V<|s%Svl-m$H`h{gnR!swx$#rPnXeu{_8exJ*h{GSda4UZ?p($aS> zU3sat)Lj(h4#IBsXu#`v=mu~fA$x={w1427c zZ?pTqL3*Q>F4sO%&Rgl*qNzCtnwD)6ZZ9UJW=^%cLQ6WXr2u9e91V)lc#h~~x40#9 zhV%DR&V}+!4=BWv5Ims}SJ>Pk9RGvYPLN!xpg8`+;+6inIf=S+55V))|6dW6QY2m1 zx8$9LLo;)? zA%9Jx-^@+og*xV82OqabQ4(W|GpwDi^z1pqX@b4hybH}QZgRl*6NV5;37mJAaMK@e z-Q~N8E{ei{-QW2_PRG0O= z{Q>wO(7X_$QiM4E#80C|JcfF**&5X&p^SF#y*TQB0CLM~-hu?gaEQ@#T50YON2$4I z`E~$ShjjkHDn10Oz&*%r-id7;k!zu;N^YpP=HPRksd3G4>h2t zbFn1*3kvj>5L_o10A~|RSaB3`yCa#Q@i9G^!Bm96107+s@^apL&PAtMDiYajbf^D^ zLAd60w6F~3Zg|$j+zPJ9x`U~5R!4TXp-$RYebBQ-zC+(CePQ4ld>nrbHZ?dJeNx{K;!(#hD*}%b<#~=eGtx5+3`$ebMiQCVUgaI{SO_!uwMT%PgQ#r!hv&CmB3gg zNsmV#8BT6I$@*n&OE!qv&Q*yxS(5JdnIBXjcT>OgP267(_XTn~QjNH)spuOsHhRrV z0FnGKZKN0X>uUbXE|c(BYv5;4JJcshWpc>R@oVv^PQ}MC0vaA6y$Rc?A zo<`l0O(n`TxJm-)iBmqmelG~>f+C(7&BKd#a~nVpFI( zmvH|eOZxvSvIy=@!%#ZGy_+=b&YsS5VBvscB=vtstdVoC%UJv{;!mn+CZ1F^^6Loqs2%={_W@Ie~abW34Q1P(&vUSW0_**;PiPR z5x}c~9Sm3PbcVxP9uC9Tw)x8nJ^ozg2x@`1!V4bx+adGphwL2^yd^D62hKeAK1pQI zE3PSPyCjV814^)4Vv`#H3W4~S1o{5LD>9aB+)y0IWIaZg(#C`?j_|Hq&2F(B-*cD* zXZ`~eEX9l~32-s8ewEKfr+5G4Jqm+$v{Kzdf4nX%hH@Rx$#@p}(DG@jy{s3oM)2$^ z`R)qL7b77iSpvJ486NpTb=d6SIg_d$_Qe(Uje>{lyO9wfNW`X+xBB_n?unk&@Z@f3 z=MH@*8ruQ{e9*=J1bmd-^%TAXO6M_EFESUoLm8Vpnr%^|72||#%SU2z$1bX;38niO zt~izGs0N9LA*45iqiT7K3mqN?v?;T6^^lM6>~bBsyTY%p7mt$LR_2wQC@G((M+~F) z6iv1B|AY88e&gu+fZ~8LPb(@M>%+rlcofr*XX;QY@rS`AFD{HP$#i zDurvUqvg8|c-QknEEsVzEc)(VmSWbnoziUS9&J#yJ>B1PQD&4jwx@`Bc;+sSdB`>7 zFc_+72|S))`3Ta0StdJN;&}-d8buq9>PVRbZF{7Lq}y%Y~fSQ#;bx&!&PoGNKGsbWet|zvK$jt5wQaPAVNKN>q`c z=0j5OD6GCe9Y!bKmA8B6l27a9JEi4QsK6mqcaqrAH85^X_ex~4`E;=EPMWSp&rlnO znug+_x?*$Y6$_6}gZRLb<7;chn>vQE?~aUF*Mb7xsQ5cP{sau`Q%|<%R`wKj`7~UJ zhU+=w(^>cv8Giz?HN0F%TcAF}UtcI!QBRpAIXlch zlZD8Yh&JuyL$gbDRy!eP4F;bw=H$J^L~Fgn?EK<7d!}i zfDj3Nci#rO{r8AzN;V6TKq_2?ZFn`n5!{Xs^*l%p4VcN8d{uShETxU;nXEKFx<#d$T ztb(kNV_pPcq?vSdf4sLzu@W8+fDR{s;DS$&RAxW0X)rdig!!?tI z`psmHS_LV^4`!cU(mRq>VzzU>O~>q~AE@wXb4p3)WEyOq_E>q3tpoHk+0)}v{>_)@ z_HHT8&&*rz0T|jQ%2MSp)s+|C3iCk*K{g&A_D!BkcLAGj31$4hv_B?c#Bp58*6!O; zP%8N~<#{l`>=#eYS8k>=r?a@rXxA>LrlL#2z;7sf*XHi$yfD>^%U~==&RZ;ceX-6% zL4i?iH_YnNc4PdIq}H4qGW`1|*e9h`x1_@aUwZ<{j*#2k3SPAIdSzPkoftzscW&F| z_X5Rx)q=rqt@)`3eXP=-ZhLSy=Q|5@J4s`w)6?##N@CEPC8`*%|9o`j*yF8s#EOP@j_LIvlOV>R1I zZ7Ot=Vq;&A)jnw-XhV#pjj2}^ucScqS%Hi9`1p8}4|Q$ix_d_2^hGSou|476ZPob( z%UU$YYf}M(@)a=;o`(Q~2M$4I>*>0|o-NnY<4Qr-U8aFN%*nb(63F>OPVs*M%lqIh zV!4X_1(t_i{{TywKfi#$vck94=fao2&TbU;{{bQ8-A}iZ{-t%}=yA{4fylq~cC@V9 zih#D<`TH3C7bRm1>dZ7ErE>0`2{q)aZ2-ui?lOaw8>OM*5vE! z5Hczr=5g6A_@w^dx~>krxEC-x^5Wa2Olh;RPjLNcxqOZYSqUh$MylP%grBwsbM==% zsEEEr7#gB}gQQkeJ3imbB}O75_1_e&oqCDR__NqI_;EO<`CH~+#w;mivU|7)ak9uA zJrGg`@7;6toIGqDPU%6d2-M=eWDovSBDZ^Fpmh2)=$m{$iAGQw+ubY3N4o4}oQ(mD z(X_XA>^fE^@5=iexX^7N6F3p`Mbbxt$KEdM;vXd-9!{PafvW%J=pFfA= z$AVa{7)J}+(uqve*xnF{GC$!Vl+_eug4i&Ng<7#Jh3XC}Pbh7bJ@|Lzr4#}yq$aJs z0)}tkc{=AtR=bVKJxW89{noslBuT9e4Z>tv+nHDN;eij(>Aeo;6z1!JcXW%dLJoWJ zPR7i*^CGoV#CT#QqMmy#9n)lsu-kwaa!{lJ4ruQhV%&m$5vnAGiB$ ziTgiivV?*!mPDk)>9OjE`Ad~->5l&EoS*qw)K}OAT(fxVDYBm>+JX)tKQBP@ul5&r zv=ghQ5Ekmhrt$YhB_KUWDgR9N>7H6;+Yb!`5IK+0?%f?~*k zon?Bv@UOkWMIoRAO5q59-MiKSdbR|e%#Dr+_CliV7{Uk>>!nT;tto2 z!fRInGX&?{%@5Q$*lpx#L``7~tVNxCzxa1%5vccwWyuA0zpuWmYcJ zpRMvm`H{>xkAf=ILEzhjnC`2Di)BQLtlhKGP!kxzCtMd*C%-o^vI^kzy;7h1oEqg* zp+@)N;sTM$WiPcGil%qDl2kXnVcD_1hX!hhos_Jis+MnnPXtOsh);Bd@-MrJ>X#hV z#mc(?OdUq{U-xEMlJT`wC&{>Jgi^aP@i-uHFw^^YFD_Mz$~PDNrZ+4KfhM0_cp5cb zbf&V%jV@sk8cjtXEPLw{+-m1tOuYWq)1_00uswwFahoXJlauGM6DgoC$zK?hUmRikTH2^925JG=s6=0xrPesfpub}){&gCwo%o*E zmZx0r6 z;}PA2&;6%YI8-klf_eW3WGu4X+=`8a9D?m`&&=b8I`p`4xxLL!5a=h(6?T2DwQU!G z{hACLoBdHs0M^Ib(mn`I-j}VZFx-sUJh;B!{W2 zteY8=cq#Hc=^Qxlb$p^s$=`|srpN@0Uct-qb`XR(10795`V&PThs?vc~mi#_wB z#TLnqx$7QhNB+QU|1@}@cnQ1#a1@9@fKXtDNPV`VHDW9USy{D1y25*I~Nd#OfXbUFOfx8VEiMl16gkfrQ)CHc*cxT)EaK9OWS7 z5(A%1f0YI%H#q*J5e2#t#Hj@##Jm59wo-Q=+eYQ2PYsupOr4{~gN0gI*0*5eosNhh8M9mT031SNq;XIN5&f_ zwLLF$FrrTlSjvLk=?FDju|8;*;>=tQO3_$&qmf?6zA05 zSnLzn5svy1SAYcFTApY>Z+r2BkSEV5T|=b2lXJlI-fei)%A(?PuOnjTgffq7?Pejn zF8g@@6s84MoDi&g#jR+7xN8eDw!_tY4kmO71fZdY$y8XFF{}#zgg=$R&E$pgW+qF- zQUHr95OHj_+s85N(VGW1^dN>z#}e8!P?^&<8b@xfj5lR*p6P>k^>YUJF6Zi#yh>gh z@02fUI#Dz8MakNj{UrVT?8WR1k2LoO5=Xadd*61}Ou0jJ9=x9*)y?8O*JiM`Bkd0_ z`J;7PLz+8~Ht#;n0f_SxFLFfSe*YTW{?fC1_DKED2^7h2Rqs+trOPNVtHe1*!KtFgRktLl{2gGWsYI?|VHMn{21O;Z zCtv7JLs`C_r^KpOfTc3K*YWj}BdN#>ik9%rY?FURV8FrnD*}r(^o6C7WF*1_i<0o? z`(CE)V)mU}50m(6kA3@=%QcB!VfbR&73|S#v5}T^l&LgP@r;E0|_+%{RCG(M!9|kHhYV zzWM}2UkxDovg)XN_>tlyLyBSSPy7`R#b3&h$0T*&I!n|(jG< zJA>h(OIvPIm}dh@V*iM^L@xj-0uq1SoX`w!sO@&xZF!wQ-5>a82FeZeEvNMCp;Q+C_tp@xc@c{)1bIf=5XY7(Nn4E#}Q1 z7%iH)WLSCPV~x<)c0V;$)-&)Jh>v>fdhmiF^EC}gcgY*`oAcplm`S4;&|Di}2{tBh zxA6!;AV%;H5c?~TI$AS%2(znuZgChF7=OJ36-SHB8}RecMRR6d{!Kqt7CDn-PgoAJ z>qsQ7xz?$%G9K+JlcU5XD<4VAAG+(BAgD5-g2(l^DNwVu{;U_sOpZ7j7b`^*2>L@3 zqBa-7dxB5&UPQH2+y@%1ovYY?GFuDX!xka56P~dTOw?JnK|QjEX-Zyl$!-NPdA(D(Iea{|&xeLLj~4ilh~Mb5x+1DE=1? zYMY#yfP}?|E~Jo*OWpG%0<(xHd9TY@6*$Z0UFI>1g7!a>ff5#EE)MFdE{J`5B#b%m z-o9c21Qx@n?9dAbrOr<7UE zANrJ+o2x8vcw)#X!Js*Ix%#L+@}K*x*SjtrBe$N)JYUGt(E>2--aWX^9iG=e_@bHf z@dixv>mp-L->=7->brkN(|~(-hVGl{QCW8?8)Bwx*4beRCr#yzcEB=Dtr1tlXWJYlQ8QV|ivIk5q*= zePNY4bSR0@S0b}r2{6i`8XsmbfbJyvoB_mh0E*+I!?Amx?eEFl2SD~mBQ_%NN1=iF zP0j<>I9CnI;6o|gsq*;Q2lgKwcm7ED+?@cyhwXZ7X5a)I|Gr37%k`#DB?2@gNNV%R zta=jDg_9(p(bzkAwFZa{B_){~43|hTTn#f_%tep^;?11{EeFo2x$YM@Clja|Cnbl$Dfmww z$!G87Q(?N8Q>8lmXNeBuN3TnRb=)4&m98m!el<{fO&v+gy|v;2Wr-7jHznr1U4 zwTVg@(%VDno(pP!(mlRW^G!uYLFC32RSzHIqiqYbmPjG11(hfk6#L`a1I`SkVNxZq zSE#j=2g(~h=G#&=T_+At73#H?Vqf4Wqh8{%>@K$IRbvLltf}Mz*@;1iS+8nOdZM_o zu!0*Z`L;ii8T>Y&*9SQrGnc-i&ww18qRl4U9cZ84C z(Em$bYM@p-BCRPho@=5=5WH}KSE}?qT|sYBh`=Ll5JIyp(Jo!4uV*#3jDiO$f*G6` z#J?F9X{{LOprW@v_%D9(e;t_O;n06P^W+s@PHgby@ezh*ItYU%>W>Nj9`9feonskH~<>dg{q@P(oB*xuZD7{wYTCPYi+83hm@4 z$gbHRFZmhBnzV_hIRBVQtOiPG1fnHeE`0Q_~M4Udq zf0BLl7)+JBU1?4)3~)GC883xZDPFDH3triA{9E@-Gt3CCu6JJCrYTXyQEh9f8 z+5NQa<}|GdR}MmHs?-C^Ld8nN2@#5V2A7!3acpP(XrP+I;NEU=;=h&7&`deMA0cJS z1Q`=haKT#i6CX27;1qr4JE+eru!6Y=_S>WSi1vRk9jo{=4-M#jg06F~`as~$9lbtV z~>>K$7Yz0aZU1I{ty*wiPi@x9QJJ_VIVnsW-dei_Ehpf`sDl;9_bj-D$%+9%WVHz0q1$H-OvvdYi79wtm{<MFr>_Av=-h#gdn@27*%WZo7b)*K(d`J~xH3u)uhJ zcfibWITZjw9Alqar46F-U(KODGd2E->|R#hax?c;XZs$J$s?ALlpn0?RiI*^8)&+; zh-B1hPa`U9e7;Z&N_KIO4&{;4vMbllw0a~-#~AVshqiL)u6R9VTb?se4olZxc%JA0 zOl*SM8)HKm(+slHj#azKA5<9+aEML@96g5FY>INkt|)`56A!Dw%5N3rjSx#^BE)`w zZ5zy`AgERGh>m$m9b5bqLKd!VsBr)1^%I^nOyo8&d>sZpaRpt_1y%_(zOsaKgK zee_17T8qa>Ubl|#&wHeXiX)DwE+Z#I<{e5`#}xJvTH_5C<&5>MRsJSf9T0xQUc zQAQo&k>#4o{r455Y=xQpSn~?*>M%fJ9yPaNs*L8#|)&ugAjTDETy*mkNYk;4>` z&~K}&tG~Vn8FV<+_xD*}!s1?arQVsF)MCXjhPa+gChW}>*fU!!*h830p1KwX+;`i- zSefDJ3g>;*7jJyYUVCq~s6XGj?q&z3!KgM7KvDi;I6p{q_FN>B_j2S)x5|YR(lS>dX z5b4>1tX}mE)e#K(F1=e?@_>c^WpG6$D8hF(%|7vFB5wBj44knF9^k|cC1Jyd^Gzmp zUcHE=2TMe#sVfdV^ZD`Ae0iY@4E;a;`#=2rQ>HLg=aF=OA1n2hQYD|hICNCygqC|W zd}4>Yyp+JHZCGK{n^SyLGx1V`TGKiMcpTw_{4-4bEif*VbD9NsbuACcv{8MAOsR&0 ztURp^sRPK zf9UCE>+B5elIy4?QB~~Cv;rFVLBi#+rl~hpm&6y1%4AU|ccb#n(nU6v|IqcM<^kA! zyy+N_1$dz{d{3de5d`6X8VMSLU0j;#?t2CD-7;dS{r=ke*`V6lj}_fa8M$_+JiHXcdx6sF{r9S)=elkdQvy3~211c7_Yg3 zQAA`ajHcuY@-wzLR?gb~b9p{eoZD2HgZv|X-`Yq0OfxNJ`jb;m);Zu1zZRhYa-V>=_HXcO zX=5Cf9DdNYjwEh_dVF+g48MrjSlxRfJuRfb+G1K?1Rnj<+r@c63$5CBr!&c>l9|rX z&%ZDz3%;}1k|Pi?Rum!#_h5z(i8oIbd6SsR3YTwDjw@K2ICRtFCHVxZ?mL^Fj9>C} zV+Ts8AG~2tso&j|nU^18e{^bh&<^k%%ksPR*{(H6M|qyib1wt`*bV`_bI19yYyA7j zwQzbhEf@n!zbDBI`Ej(eThRx0dstfu`SLC+;{)y>j`vUxg@f4beq!xgKbgQ3Hf zsk4fR_Gvv{*@?gnurkl3k5o1pG*8GGw1_th~HWb!6w7Z}S7`0aAl*Gk3l_qeCT}FIWA#P7`DMz9w9h(Q|?YW*(2K z({{?|(Ia75aCQ8%wIfvyseI_Jg1}wT*3VBTy46Kg%J6y$Wu&j-DWUd)%g)a4$n5b@{fwkT7GN=}g{7`zMv!k=a=pIl~!`a{cn8 ztM615{_@2YmXH77)^sh9x93}EWaT%wTJ1?ca+@Tf^;>1UfQ@%`NrAPkVffEG(!E8w za=iy86KV}@Nh3EI;WS(P=CDn;{dQ;V>eIf;(y2m++-m&w_#StC4iyjA{t&mirjykR z4emA>gXrH_Yacu~>?-ASfaUg7IQWY}D5zfX-L~bAdbdWoM$PwAbLVA8&z(q~A&rUl zy$8k&kq~}n?VW`B+iyE=AusLVd#9y~pana#+ z-BV5yQ~UU2o_da+)2G<;IXsCw>hlAi;zq`8Y3So7Ny^z8J>nBqALKDcKdeU>P8aBS z3|E5fEL{q{&SQ@L1wF0jWX$m8y+IeQoF3DI()V_Z(}k0b+%GZpE+{8YQs2097W zfUo&kxZ#c-PzYb&igR"=_o(d>Uu$6TS}L1mFu6L%QlU>V7Qge?=SWAuyC6JW;f z{Rc7gcP%>>IoIF3%t+OF0HWjCE&{HW14SR8I5aZ^*Bg)$9LVmA4cxr-#YnOTTxl=} zald~DUt2q;Q9SWg_A0b5uX$g@8ll*88v0W;kZyjT|&AF!@W0eF8nkQny@aaiu}m* zEhn92ywBZZnAsg7g)e($SOVvudXfuX7VehN#wPRCCywZO&g7_pRwMN~;>E^h7 z-ho=s*Ys_gp3|0Vd0uEftO~|+K7gSwf!Wm9aDzVxsuqT=Xv}I-@Z%I~=&rU@ykX`z z`Q$?s5u_k681z2dGU|gW&#sN*>tdgya(>0)Jn17-l8b6s8|tKH84Nt@OFWh5nG^kY zIw@~C1K}rfJ1@XaQ@d96R14PhOmaeB&Na@3?tf{V`%I{Vx=Zc{EIs%CMmymucE8rWd_dx13n5j=rlgfHH(z?-Z8wccimiFDDs2+ym?IGoEyd(Wsxcb zuct}$*`@7qRNF07jiRMJ^2?3vcBSia9QbzqXnvezyEgW^=`VGC4JGc?_Of9KIxTKsfc`Y$T1@X`V66%O&)eXue&z|Dv_>hII>Zl2Tsle8{4TVhHAHh^Aivif+*Bf-B9Y3X)AB3iteJwJAQrZtzz$uWu#CI>M9q*+7g9r+ zwmRRJeSB+YYcvIhqMPU<#$>LLO=ekAR^vn8^m%#D_hqWRUW=YzPJ4ssYAq$(TA?4$+RzS+MxKVL;iq}Iljkb zPh_}IM7XxTUINSc8RW)I*^*(J<9i@nQ z?EbG#jNPMiCx(}jOu;C_Bu1Dn+FWC}fKmL=g|qtBXXL}BDG7R8WA%rjyABDjny#(4 zER?-moQZ(7&$c7wdD?>G{q)rynP81LMM3>CG(%fLZF%RvH zTDM&(!^>D@)CtWHmadZy^GrRrhU4sof}4|qPTAFDbQA04yBCx5?Y0u?H$4R42jO(o z<;kG-E0)G&;90@#?!M!`DLXf}$XEjRxXLn)SBE1Oqjez*`t>A0hWdxO;GT;MSfGQm z`Y=`toyNmKOJo=yZ{X6BMPA39@+r?>c&_*l%eNMH#XBT1H*CvOs1P4*V=FjY3K=hC zTl77{6rk<~5GAI%byepIa#zFhNz(K-xm}fo22LM0yJRw?%vWqH>!cMAuyl-2;NN`A zuqs1T6H2kaK-=mZXmP8Y#X+rsqjIR@O~MqGQATciHz>c#*Z;&?9_GGnd%U2jl!oRa zjKz=93qB)joL9W$GV{_I<^((FC^p?3zT|Sbqx196t*$k(aG%=lHoGpuv+}S+rSYDY z%vZc`zszS|nQU0&8X-TXed7D;hOV^i1jBTh-K+8?6A$VG0<0it2bmFCD*~Ego1x4a z-XN42-Ej4VU&rRLufKn<@SESq9A^2N8MVIy4q1O(2f1xL^S#2;D|Ol7AAGpzSJB*z zx5r1V3LWmlj-qqc+zynF7IhPS9L-ANoo5v|5_Hn9`^vhi(%C*7zHR3+WGCpC>X7w; z8#ASy8fkWi0BhxLv4s_)l5#IDYLUlj(1b~I>yaDv~ z`=1dp*5egr<2!}ZR;QO5OrY}G-S^Aaw6-w!RBOM|hw$jzWwv*IrltR0R5xR+ym4e# z$mGD4P-KwwrG!OYAvOF5x!x7(haFT3ir!5w#E~VPM2d0CT+y{!pKGx#w2Oxs8R3Tg zWf5-m-`0vIu~19(qD5+>`JfGfP!F^urp@YUGPhszhi;E-zoz70ZPu?+q&i^exam@% zpBT>SVg`$f%Wr0;$1)Ph3<+Wjc)4lz{va;ujAuBZ{$zqhVB%n6xV-HpAsz1()shu6 zi^wgelt%R1k~h)}91*GWSQC#$J{4~Cr-^T02Wl-;zVsx!}{=*j!e zMBz?nVS#e5W1LpPEP2i@{46}zEqByaFuQzropjN)cuS>fMeFkFfb^`UcS3{`IonS%u0E1Q=M=8Y*wbJ%ScNUByvlg(7OhVJi&uLoV_=WG477G-uyr_MWSk-vp@?gn4CIV0wYo*D3!?9hra2KI3WsY z?Zw@#6d{wQ<3vgauw?Vns`1<(K1Dg%QXjb<>RtAvPyKHz-6!4B$Q1Z(pU7oL-)}`^ z|7`t5MLx) z0@VzJguvezk(^5<^^*VeW+Ly0{K@ESH_5vT5{ZBXfm*jKpsl@gIcv|K#V+s-WH-x36TULrQeDAF7C(ABu5_b{K~zRj<2^ z+~HtN^gVZD8Q0J}BTP|{8++68(jpPo&(pt1_8YhmA(Z%E2_YDQ-l?xVWNc`6>oxOs zB1POtCl81PYFeT?Od^nXd{aAKoW-!TY;DUvg)on-i_Hu8S(FH&|2gmfKTHWCc|it;8W ze|MRpAI97t25i}7Xjt4-R>z4RSAUyiV`O)fSb8$yDvPP(=X|M|9Tmy(?%sr0I|aPp zP;m#DqTLlMU(Hd8Ai@abA?jJJZa;k;_jXv3ph$yEGeZ1?Pj0V{L-Of<|C^NQ0G@wV zV-#|19;7CrUx}x8?2oB}@{5?!umX7gW5wO$D8Q=w=dhOP@=r(1VcrM1^%a7MZow7m zf|B(cmFV%wCGPVGe^|5Wqo~4h`xy9MKF}KU#hXuuc^>tVNjmQI_k-LP#rig} zJt;N$2@PE>Rdq;?s-p_^LAxsxLd&_*zkOG);e#&VyE2wjqSiZIed>BpEk!wgx>4XM znH82%sP(i6crSe5dH%J~t@}0jXN7WlYwcPrINJ|0T3oTs-jd5Bud&Oh%JZ_YawH0^td348qdchd zC|${(Pn}L$@YZkrk*7@;CU(P3?0& z>S(d)3uDhS^oRCE+bRSz0r8JsV!3{|Q~dMGd7u7G0Hwz3oP68EEjp>t13t{awkV$W zvTU~hNFX2djE4I6>_(1fP74i2T+4Wt#i(6J_ zt?KPt&npqt&lA$5eyKu2+PAuC;|8-`Tdt1$|Esn44r^*#zlF0cSg|1%il~Sb1r()8 zvmqT+P?W9+NR5CHA&^+MT|_!cQ|TZCq)7<@Q9wdbT7W=83rGzl5C~~^uApb{eSY_x z@4L^v^YIUY$zrXQx#m0O`;IZ*=rQyAu9xSJm2b;T(tBgylS$B8ywBPe$G>B6dp5Su zSe<6?NpHyQCp^CR>}SXhT;eCkq=R=fw=L5A6;#_Ye2;jLChDsQLrNU648~ML5$3V` zMZ0tg{AIAQt!0n;N?5tuAmh(sd~|DGu4qeC;YWpWgrZq#+U4$7-#&&BDsz7t3!OMJ z3?`yg`iF&#y$$VMjIxP_t7%fXs$*~VhUiGt5M&JS^cXzR9Ox)b!hnvlH1}q_!Ov|6 z#+HtJb@NALlUx-t)qsHbQA(QJnyp7Ftd~MS{ z%?oU|?{Ys<8f8@?ZKaZ>7ga7kf4-)y?Mtfq8(g~6gvdYUJI^ zb+G=-MO>~6f9v-No7*U0l{`q*%#Dt+p$a^q$GLtM+&m<=Yj$GZTo_*!xjNvANxF23 zszZ5==m4ZFT@9tAP6NwnDlp#IW_h9U4G;CT^Wp8Op@HKg z8sVJo*Gkm1| zqrx;ov4uLF6-FR0mS1zXeb6;Y&6IV%oUGS+G zt}Yyq!J+bepUL(XVF-8 zKNVjZLp0BhI56e9$jZr;G{?pWL zsi3(ge*asUoPyeqmR(QVEwPL7W1D)WZK|rBjVK+LS~|=LKDcC7|Ew*7Bphbu zo^ptz0b#@FF@LX&oxU}n8<}u;fws+ju{l#=s6#!xF!85j(yb2{$M)PGkGDPdda^=( z^Nm+(f)`Q1^l05X66TiO!BM|lx`q$#@*u&n*j;ndPe4}f2KPDOYooUGxKZ8 zmu6hNLqo>1u4PNEDM%3jS<-&PL#otwHkXp+y-X?3?gQph&VM3Yz&rrFO*rNFplvT8 zan{v}m{8Ry!Vq-|N?TUdW-ezwNpp~+!d8G8cdvlug@POc>~4s;FH2$Ds17MQYfj=u zIiRa07y3l_fDfOA;Lxw}|I~lZ3{?0}Lv9I7nT+5Qkt7>juPiH^96DS9Dt~zk$+x;9 zn5I*03Q5U;j#E5a9y^af6VMS7=C8x%V>S1Zi)zl4QHLt2quqPrtzk2(_`X8Jc84{D z6DW>CJ9*2Lw(%Iz8_Fxkf@jvh0TS7FuXB+(_hOmBkJtBhE?h&7>K2yHZ3^MY9-rzh zJ%mh1xOcpE!&RH2lsi<`Dp+Wf3MyMw_DZf71A%tIxJM7>9-6*|&G#<1+pz{C?%$`t zHp!wN!uyv5@A3L6A_}`D4J~^vmr^te4xM1=7W}G2CaRBLuLNBEZn+%BGO_K;gA0N* zP|FPoiWl#_k+E^=RbAd@?eQSlZ+TwviUli6OX-`Mh668#JqSmwgME77$+=8@AYPeU z{b;JKsK%Tdw+c2X_baD)^@XU?&seRI#zdp+#1mODeeb$G^#tj5rkjVTKO7nL*8fOp zvN;u5oXSt)?e~crD;SU7PSnZWdavU$Mp`;&b_)FlK39HJ&QDzl=tzrhmqiY9HjbLK zR-R2I1Yw|ZW%WMg!M)sFx>wvKK97xg(ko`f>lPC|!bXkqrR0-UlS@6(iK`gjP@hJh z2a=O;_?Fsf^Oh@n*dLfD@|v6iY4IAeqcX6`*kSUxCtJb!Fn;neU5NT(*ofH|imlWy zrW2IaGv*IQv(8mM!cWWF*dMSt6dT|$V$#ldA-~%v@k}$T+PA*Q)QVmA9f|NItVfii ze5Bxt>N!8I(^P0w^KTInTM4d}L8|2P8f6t&zbTX<)6N7?6VPRXojmxuAwNtia1QT% zJ~Hlo24FpuAK>FhEnT?zWMNr$>ulPR{yH9eiyUeVj|FmB-Erq^go6KS$K@u5nb(aM$K`&LWm?tfKj*~yrC&Uj ztE_?!-ipq7l|4yd?ucZGJuCIUA}!CQ-Y8FOM)XoqoXBGAFxzNbSjkaz5&|C@>)WqD z=z`tV;2Ra-bJ(CrTh!=!xAW8*;k&zD+}2geRl5Eyz&ZsvU>m;^lJair6g`d$%Zvo> z4;=wW4dK)dRk<~CeGCzJG`XNH-#BTTaRK&G=W9-a8e<7F+29i_lj^it+Khi+-Z%sb zEx!B#oGHA8YyB2ZtxIvq9(@?ldtGhRD12r%2jI3rrKV^3X7A`yrX>17nL9T0c#VLP z)v(Qn=S!@*hpE?JemqR4qQJ$!NWkT;d-Dlfm@pTxxdUlUk78B33!<&!rxY|W!)gbg z!8OLqy$Q!J)a`ZYmT)y6{eHrA9ZDMSXWl%78l6ZloJytGhff9|OW12ikoUjP_rUTX zwW9+yR@koK^i_zsBM*V;8!5RNIbj<`>W*sFH~GCD>=Zp8bPZEIta4v5KJiR<#va44 zsDUe>rfTV7tBy_Tt!18UsqW%5;u3;hI3CAEUQ?gmRoY2>{MIvJXBL6{+GfJ3@?~(^ zcjh)JH{x!Q2Nyk;?r0B}u7p`fj+LBfutn{pM>=&6<0|u}zWFs7ew|9qK?am>K9&=Z zt8D0V{)d@(TxF$x+2yXY-MCEOn+b(q#A^g?4|xnP$$BE=c%mDL=TRvQh!8>870A`F zOOkFUeg5i(%QBcR6R(mV{jquS&^WWnLZr?+rp;S86-xXW{yceN%y#kpRTIGN#9wRa zmIE7grJca*wy15w;<%UrtCZ{i(P~dJ{#~SFXqbIv@LD1%;GM|EcBEsNl?}#pA?RwV zmSKCb>V@v!x!IsD-!-seX*}F7vYf3jatMDh$1nKZB*D*QM>j^fJ>*3b&0mzT)0?n9 zPKKrGw<#wg`jg|QO!tQ-Hae-E@EY`kFqJ5YvCh(30oX7dZQBAp$(84|`VHM;^Hl%r z8VflF6ez~>HM<3Rp|b6JO!@;p(mJ#hIlr_$)$fO}Ys?@rQzPo#(~a|Y+@#e8H8&Vp zjjT^M>1$MAX!x%tBj_sWtu|nd4NNRd@(zdywpY4PcN5CqIo_~FN?iBgRNSK1$M$qO zBq_T1>tc5N%v7Tqv;^doTx%?y5F>Ym315BKHmw7v?IEO8=o5FqCd&%R<1z@Qt?|;d z^9@A|f?eh;o=*_jO0=r)i_=EK7bYB8))tyn90hRGj#Ku}I0aO1$;A>w=TvwD+Ob}^UC%3yLA<}m{ z%>P2eueqRzkIeA7WIeQW-8ClH9n^IjBX=4M<|^}R$|a(Q;i~)vEbr+@G}c$fBcX5@ z=d~UsT~qW~9FtT`SB*WuUMT&+p1DegVy?@7W3IBNKLg)MitASLme8s5Aeh3a zpyRK9ghOt|u&7-b7dwB9CXV(hd)*IhxIbZ_wB9Qq&9>5(SUa{w&OI7}Lv z1D}y63~U_4V2{u+%U=bnVq8fE)Wqp7T1$}tqgf!gO^pgFt5CMC|Bnnii{+YgBYBN9 z4*PE5A#k>Gy!!p2AS|yYi&GvV({Htsbv=UM8ovO$g@z#646NPe)AK5=V|iL$DACRL z*8_g60@o^8E;#p8-WipEgjx{adL;k|_%-$(`wu@y*t2Pt5CU8tCsphh*`v^(SRQvL z|Mv60d!AH9T<80iq}pq*cS{0xmIOsaL*?*-qo$%}XaE^(_Ie(W{eg3^M#w`@aGsQE z2)38*TVSY!K;+Yp{Iv78oOU(gR)EQ(3V&Z6^*D7vd_`5Ly+qu1oU3o?q zIl;=q(m%tkNBzQCJ*u!fhX)(7H6k5FOD1qre{&Olk3t~2$Fz>)N78}|sc|Q8A3YGn z(Sb*~z;I+);Lx0eQ#vDD_r{`GlYI=kk{Y(jBygx@^D{^FOfB z>)1?BoZLyB%lCw!v|Oj^@3h>7Ong{a;q~m)w$uYu7d3b|LrM<2oNrsVDRb+Z**cle zR;(?iX7ISthg7wZwc9O1Q}+R?Yo{>Kd7sGBVMsD;o?1bCFEkEWi}(YUxTtiPts$x) zRD9k`D)Q6_wTxwJb_ZD-y>WM&yH2l?E|#iD*P2L?LIilw(bCKlva}PqUE$G3MGk29 z zp%Nc+;P4Fo8AWB(!8d-f3Z|`ili-Bljp@$6(a(=4)B5Z)vkU?9S(K{E;CbGK912tH>~ zNoKKJTY*T){PA6)*UsWXq&gO_q-&Boq)3nQYYoR~Hd{w$PJDV4FSY%%>zFCg&W9`Y zw4QiP?iSIp}Xf$)Yn14;f~|Ee3m^{^V6@`H9Fnz}Ox=pa%7jW+l=I@L#$jHRyI)`A2QhdsX%TtNkc_J2c4 zZrZ;nXv2S_p!tYa?=;(cN!DM~Wq2(8?ECrlIP4uY!)z&lFm zUENXk@_Bglbm5ez9538MM&}}>9QwBM`H&Zg@M=GNS#^kOiI;V1zcqEwmj0S-oa!xR zIrTLAdo6}wro3ZgN`&X<-XqzvpsS0zrWVLn!5>r^LZwg*tm(t=VTDN(aOrHy(K0bZ zb;d3xh4?sc3P8PUdRWyRnNGWN1_g{ho1fB5nUe4Y%i717Yvbo?ork7X8gf4IPZ)m2 zw{ou5nt#^=8k81Jc=?%Zm6GpsB@!*TQr#A)6zfswsjK_B6UT-G5g_H{f;JEwWjqSh zz@`CxN@%9wiJBq}AEm=ax3SX847PyOe=*o1zZ=pJJ1&@TVuvwS~pk?U5w*u(mi(j6RIhtKI(PX|JsCiL$LX zYnX9HcX-=cz_T=d9iR7v-0GD6#52DwRS} zY3Phjnr*>RFQ*+`S5wHh$s{cpDYYJJJP75L^vxy>$7uA2p#HJ*M2=UgU#o&T1a?HC z&i@avvy0;J8|?In{}b$dahRN!cc(Ir%7N_B@ks6_))r6E(T7qdR4o?0X31EIta9zO zqFZ2k`7pJQa-sy*|Lysq8a`-28zqR2iah+xUq~{5E2n5D{(*-hq3=>q&7yC{Lz`9ib3w~+v1o%aUWBP`V zUu?{sVO2t>cR#`w-20dS_CR-~ASj^;>mcTw7cmSz2Vb-u5Cct)9-cPnq2wR_`Eo66 zU*xs7E7t-E(7{UvXHQvl?TkB2RHyy{n}MFFs+H$`cPOq{XsoL734J=dHv8^q^j z&B+o0bh*kuzq`=B=v`!)8){hA=ZUZ3>;8?5>F&NKfTPMtM^Oe7XQ z)?U-dM!pyY)~=!CV37Q(djdtW10{pD5RER@_TOl9lcq$LP2gkar8oYY$f|zE1s(*C zyWIkGu`3AcYPxUVoEJ4{6|6VGycm9becn?gNbOY4501;q$S&bqqem5t$_t-k*}dmR z{((WRWzI$2xT4yss_{xR(1`S7oE`6{+aq1RU4I3vw;N>hAj7sW+i<{KgrT4(12EJ- z?oz$+{ix`zro_c;J9O6Lfp^`jzq^fZT{S?uH=_Tb1M!|9`t_e$dT)*Q|Bat+bz|w7 zyz6f4aB#Bx{&Q9b;EG7QoK=h_lp0IR5(9b72%WW>-)2I3q!X+qiB6_{4{E{57bX6r zAN`eJbP$A2Qo7( zky|;y5si{R{m?$<-L$gZKaj&VbQ{jCPJ6ikC(Zj^fNKOq`oHtf0XGa}WlVQ2i;CpS z-PFex(gXJGREoUE8dxhA3^FXMw2Z6gLx7XrZb30uB0kabRBdGd%huyt2k1EgKYlk+ zQpQzujJdV>jGk;o&WBNxH-(xZL%c+!wwIgfxqw4v9UA&7nMsU7NdJ7hV#`YS`2A0{en!Awyl(?0zf`6pD=<2b^p+W7oO)O> zI=h*O#6e{8uAEj+%&aq0>sR2PAkmfroY#BHphYZAMrpb5fXwL+V(D9v`Va9hcZhF<=^@>bffZ=AGnFqhT_8%z#)L`fjZhk z)uR^z z?=|u_o*nK|xvBt&%?_5(&Q@!1ZsWr0b#h!$O~u?V6OB1(uXevUyc~TA+eHaoqBuJo zi0uORN@ILMURb0vrcLU`2K^hZZyBG)d___nb#q!gwi^)bIxEVar+5y33%!k}kAUtA zUG#HD+lKqhY9gZ3z27fLA>V*zBkAYFAqVQQyT$AGW)ntbC0jJ(8FJ)j#8w!r%K)0odIx89_~ z$P*{3xBf2YjE^+VlJnaTY18%&r0qSxm=dH72rj(^RaePMcOr_hngK<*;B=cpH?{{H z6aN-484z($-fU>q!dDFmPlTxuZ0|AU*8GoUdiPne28i7mW^#m*^ZffZ8Zzmb z&{j<`9Vh!Uk;5g;O!v+gQC!wP9tnBS*T6Y&Z9Mj0gz&kPHGD#kSTscF$@o@?eAhOv zGL6)dF#8=O3sX~Yqt-iWl1703-Ta(7SY=}UoZQl=XNUD&3;|6?;X{nNYW#7p{jZC$ zHUUuvmrN6`gkTlK1r2)6O|xg#!Huv8n?3dYo6I+*Qe5Ld(Y=LSSHNxv1xExai(mY@ zTPylXF7acG(FLb1;C3_qKf393y#c<*Mg*T7ZxUrR00;d3j_`duZo&PJnt%_3;zZeh zBF@~=9BI{X#UJqNdAADcX%^D=#^>hFHXxk@QAr5u*L+tiEs%z6Gszfx0L8M-$xiBr z?BkJ39-JSW;)b;h`7h%g~-O((xH3n=NFwFj4ZqNTM zP%-~qq5A(geua`0rl^&p97i@1H~=|D3$v%e>1ytP0)up^F!eq)|EWOlKQ`HW7{lKR z=c!Sk%+ci7QP@( z0;m4Y-Cj4j-tU8<(g)ExH~+n=b7HGus{mnXnGKT)QTzL$9)b*ApxE<1BOva3;BGf7 zsAIxx{)p!Ba+sBg7GSPueE$#3mFcP{{VFRlmwM(H9gf0kKavVS3!muUgzIzP3Ooze z1ov|5(p{xycC!X1Bl2?`Zq=*yNL~khJ&|>emplycyQ+QcU9UdfL<*Zb)wpqEKXEPSaXP_L5CJkELwX+3(xY~ zI&~>Rw>Jswv?1ex+zM;RmE5t9UIA@%2bMeQxK-R$7SUhki*)!SA@5FSQ|kObiwJtv z$}Y+=q@O3@WK>3#L6b*+l76|Q&%0>bqWC#hTg9slyBn%Fw}5Md`+i3_af9NP@M7M; z@rS#UycwB$AO7$j))rWBvGFqccGJOtNDivY+UIf)_G*mVx@~)-q6QlH?pnP70@~gm zbcB?rB&YX@x_|0S@kg%UA5}xgcS`3v#8CO3rAkB8fN1h{>n~IV@KrJRtWayOWYmI% zWi8;MlpLa(em}K(uK=liwYOlyFE!Lk_y3`WDya+PQ#dUDjlv;5-7-o2fbWf#_T)Wq zeRe&lwp-dUxH5Pn7093%;^o7fCgg|kUPr6b_nE?eHjycwH`G;MOr^|n1e++%Z^R=1 zxU1)ca^;nEejQVNHL;+HhaUwe`mYeieyZ_5Vwf&JhT%zzsK0GG`MRg`7T7I7_aurP z+qS;BaINcLYkW-EyLTbf?jYtX8q;^!q(OMd0% zaHx(0-M%5y2g4z)a!|Vk^BdL0-^ka&2`!i4^hU6zd-c!HlKTU^rR>t(l%w!a10ZL) zkfBcpe|$;?r)g(Pj!BoS6{}9+ftN%9uJsCR3xK6`K~eAD0#s81*%`BSS0qhuF2 zm-5kn>d~i6uz|SJ@M>vjy(GAUpeyAst4>Y2=+ucnd$vKNB&BU zt8ukt3e}u&QKyAVjv_^SC&66M(bdU?oTh*e&AlwG#g`ow(psbQ!D&vm21I=$vPe7m z`|Sgx`RFsSnYEc=FM*fow%$79GJOB-i```pmv379-!^%4N~GfIz5+6NWpBbtTrt~t z;Csc@T%bHYU_5XUGM?ts2NLJ@24MeKI#~YR>-=PJ<@pHLh12OBp5GaP+KKwX%5v`l zR{X4lWrem=0Wp<4Xrpy@l}L zDxx~w>~|F88aFxm?e{6{r6P@u4qj6C8@$XYyM6qCt0=QM)Z)2>$x+|v@ZWqL^@1#R}vqM!v0c@9`D+A0@LnUR9$FXFZhAa;IQ z16YgExfG8d_8LbVlrJTBUEh71A7>nrDuP*;b?{UseUvuYU2wjez8Z4J^*w)BJOMT5Fcy0WW98DYttU0)ZTVU*w;z=>s^%C%8Cv#!TGas2>usI)={Kie%)7KG zN;%r~gch2%IBSbDyynUipG-A&l>K%B#S0!tRn1FqrcY0-P4yFBM|^&wHjK4LO*$Ae z)Lis|7@~phyn<;;LSt{8h)D|VT0>_h6pJEy+sl%h*YOqzTx-*}ooET1dzdSqnYobx zS&1Hy%YEBg)*ylvgnu1pztEH}SWC_JUMm(>w~w)~_j3;pacy?g!htNwOZ?0d;gvW) zUy{E?dZ_`AG-30xni=1C|EjO|;Cek>**(BmA*O6ra@i5PqXyag%7E4Ddiw&_U7B!g zK~kk7yZE9`t9kUUUwWK#j&GJbDj-8z#+5XWiuSyq+7+cleG(7l`$NFt`9Gf%HmUw< zkY}f&P?9?AK0|{mmhl2_?@<#x2O2z-b$mS4bTjXnfqB;wGfG`C*mc8(k+z2$o!-XC zh7o0phuw}wKT=(PvPC^S@*vOO*~dR9u+Hz#wz8LtQ(wh~VuJxIlQ39PKEjMBBbkhl zi;J_<^45)d&afsp^3vrPa?#JiOZ*PuNPdU#usV|J=WD2BfuSy)(P>0N|7^k|*)M}nB&%c*c zo;?+NyDSJe*gb~_cW~9dA5zQ1>K_eoz_pF9X&pDxvv~9VL!7-jO({~vTrDa7_|MTX z;!&w|0xkiFhVZ?|hOg=!$#FgC1$VO#9ZH!>6(7=kF*Kl$C(Jh|O^qatX_ts{xq)ar zcZjNOp@?i+Ko)!@E3@b$9PNt5Cv7LO8yU^O+3>`ve*M&yna1$=ma^pUT-I^62~(WYRIJhbqH@@LNlua%L6l_fIMZy(lo zMsN3`TBX-~SbsS(R1(=ywpNPoR*qb$5gY zi;*#Oz3$80)b0`g&!eA1>kf)vA2XPL6%XXORw^$e z;|Zj8ZRQ6IP0xra|3nAAXB-Z#oLxG&MG6MW;t+!hLN@iprcC00pv2K4661 z_fOF~*5^1k?Q(r9f@9;&)!U434<9H@kjW~^bn`H8nJ<2!p2KnN{t$o>YK!YLHjnh9 zyN6V~*lrgZA;8fj`_obo3emzHS&}rS!Rp z*kcpQP}!)(3{_TEYxXo+Gz>7FxGAaV1hNviLI+&%@9nnCQf*zvp-t-E@8cY@*7zv_4jcf6ly1)_E_X1WkHd@0w zP5x>Q>+JZs&7F(KALb<4GwDiJps(Ka?V`jV-fvaCCjEhDqc9?CvldR@C$MQM^2Ts{ z2;!=qTF%6iKD)uAU`EO09P{&qBhJ3!75o@nIM%`xDn@ZB%jq4t>PcMpkZ!@)uB)=k*+ z=I!ST=7D=Bh{&hD?h)b{Sds!EL<$Qj9pg(i1z*gES;mCg`neP}@IGiTEz5n;KdKzEzTQ04Hi_ z4Q~J4_#K#xd*C7ecNgIQzKqr!>|>{_Fp69qFNae&P={Y0PoQrg?exC@UH4!2qEOS zXwF1?)n`H_Lm7H$hN1~U@9_v*fB07DU-g3ji@eI+1jf@s9oAJ>^n3e}_mwOY=1+5u zQb{=qGUx$=FB|My=LH)ms2z$kea_Wr#bTqTHKx-UEB}BV4lw$Ug7nbj3k;qGhf^4x z!4(1XQXI%udCRE%u!Ou3ch-ImZ_|$8#WnIIINLT)KBkd&@=kJ>l0Y+;w&YZb?z%RUiADK-5C`IfmBo?4_(ho{P`@rdD!M#^%hj8j!?~xoF z*BahoG-r){q$27EvO?OuXn_1$^yHP)q35(Urf2&XhB-+*8xl`z!5kdo0yrTgrH)1_ zt+&s-AV@~bVsL#s6j#lR>5(Jh_BciO{FBGH@K8#T-Hy5DFixKlr^#&8E$`1D_JS9l zmyYJ;*T*Djv^*fPW|0!(Q^9f)wy1#894D*FIYUw}%HA$8S&`wsNgAvX;tRWFIi{Dg zE-lRBgn2tT+Kk6;jXYasId4W1a(SNCMp=aOxJSZP6XEzIj(&O#ik*aJTQ5O%n;WZk z+)a3gWX4ItPFE^Wc^!wm4;loH>f1FGHO}9Bw3!^yp+t_vrYF7 zSd+IgyLHr`bH`j5c=AH$wi2x3x9n**Yp&C&aqX?}KVK(+yHH#m->k30iz#KRYGv(H z({07Elhp?Yc%9V2O7;vkhE|}%3d8-uE8$+@syW}T+DtxnZacf${yF^7JBdn{7b-{e zv|=UqcfO9U=O1Xm9xw6Jb9K7DQrqGhG>1G7NY?!N^W;XJ)(#qiq4Vl`XDv&SQyFBW z9gXA7nKN0Tn}>g1y0FR4zCoIS!xOqYlh5gYNIQM8O#=X#&qld%sUtPZ8P@aD{D1rHbQuxRxVfC zw-l9Wm%f-HZ_in@&dz)lKNbpZbe=6Px|;_F#A4v_niSS*`E1ZQd@e32La~d?#DVXT zX?z*)!86LgsaS_)j`9?A+RWNG=atS83r zL5f{F322bJOM z{`>3KR_q9HB^gyq9A0F$@XWeNTCbB^LD@2K#flA8rccVN^O>lbW7P!va7%b2@_0($ zarHd55oXwAaH)yF^~46uH!O53VgrX1e7&}ZMMGO)4>G)AwDRpVF7J)bm_2tkz1MNT zjuXwEMPFW!S^MJ1;wUZ}w`sK~%B+(4n70@0)hltTZ;=V-&BWo6vL7<;e$}aOEQNpM z+UfYt4Q~2O^l8mV0xouSPy-w=H2=Ucsc1bz9CwViM-aEvYx$|}b1)0LKpE9pI>zkA zcLWPoE~1~Xsawsra7d6}@RDz{NqCH}Fy}mpUdj7Pj>54v>sXmO4wIe_P~14^TZA~( zI&cK^0W_naqnH%bMk=-gk!?>2REIyUv*xb!m?Dp+Ncm@Qv)~S!anIsttT8jRToSX< zW$uusGmbltp&YVjK0^sJ9!RiHRx*k(W0rRsQM8DpdezEVK@M=A^62@U+<~qL(Bq&Y z!>{olr4`JtifCwho$RXs580%u7ilB-w^L(zW7C+8>_51IibT)p-uaZE&@c9d`{AYYJ zG}2VHX*r%dEkM_-vodecgQRgyM2I}ocaF6Ius_hiK~h4HT5P+RD5 zToUI)P$#lb=f{RTWXKI*UuhD$M2*J*oB#%+dZ#u|9n9n8w<4mrrTn0YshnO?S!juU z;)Zvt`?n5I#rW@=TnpagI6DvjMnxOwlmw4;9176W*~zrfUP>e2)xS$FMliA#3OHB% z?sj4y>-^A4!7;Jrz_#qp$~Vi|KsSnb6RdOQ@tSI@y(Q zo{XQwR7wX1>q)Cz8K zxBk3i0M%v~)BaHvbGFC@we&-kLL^Wps1;Fd?^y<9m#KO7B6hQ*NV#?xqeQoo>Pasy z_t+I;mTuoVdU{MF(2^g?8wix(j<)g%FL~ApFA8SZF(4;K_i1xPYz3z^J0xBD6PvY$ zQQGgmZ%(4lQjakU0`Hg;qgc@%Pr%Kynr8(Yil)CahXSRYk@c<^Zu3y*tQuEgu!SWS zFm;&qA&5bfp%u)s_V7eSzK|86%XP4Z!p!HG;f^@#09H;YC3`FOqM|+8mV~xc)lv_M zkie5QB=T?sKhbUCRIzVHrO`|pp0U7fxZ;JGs9E@OhiXJ?)*xLRDtI@)N>|>j>ypPeSaS$&EKecwQ&4>vp;^h17nEeugOE~aF=li4YgaMYI?Ox?8tV{Ex6C5W z?D{E{own0Et$Z=7V!@G9Y%+h-)-+(UMK) zoac4%#Gfsrcp^9}w}6W^LmEDFv?80V3f>%*GV~z1YflT4ATHIyc;&3aZH}sABep7{ z?dqNq7gEUI_i|DEwSWlvvE2Eya&8nWyYxE47{)A3~#dy^*%}dZ3!9CyQPVtLR2@Yim3JxyM);zFC-L317@b5pE#XF$G znk7*1Egilc#5n*sA3yE05>G=pGYY zEx6~Ct@IP7t(9?&3i3sanOXi3xgJdndWj@PAD!bz42B$`4trtSW-rJLnDiN zRWJG(cBR$ska70@oOkN zIFX}aSUk0_+K!V@_hBfEZTrPa5;OFLie$rYZuxbto{JzHNI{JEhbY1RdqG2@i<_{*~a9pbaDBk U-bsrn4t>f%*Ys@eX@~p&3xj-Y_5c6? literal 104994 zcmX6k1AHFM)Az)-ZQD*7G)bezRvTN5@uZDyI}ID#wr#VGZG3tE-~8_Oc6avncIR$( z=4NI?zbZ;2BM=|}0DvqjBdG!a5bFQ{8ij-SNKd$b(S0D`9b~kf0RW}%zY~>f5O9K=y$UuQ znTmKg7%P^BfgB#~O9*-HGPZIzx|9?Y;ZRNpWKQ{b9*vRv? zSHAT^+x@}#Tm7QQVcB(N?Idg$98!`Dr!qGfsYILvee2g?-@x`Bi>kVS8GD< z{7MM|9(;v_7%947I{=XTEFv7xrI6mmMil&xdL*8z2LcCxx?E!U3{c0M2|!^#TF93FO$IoLGPi(=ml2D{7{WMBjHSmT6`#YO3w7&y3;=Rs zu|H;e{pvn}QZX^X6V-rX$b8fZ^G@;Y+wR-`AK%O?Eb!o*_jxxq&Jx5s+6bbFuz+$U8Y&G%c5|oqGVdYPIj4ql1G4 zTm0IdbbCJ+eU;9k2Eb;ragG3BAW6ldHc~4(2nPU?IsOb)p9pWd@tC?`h`OQIx)EQD zcml+!`g+9C#1TxuL{3KZWk1E~g2tDvdJ8*3jGUlhtle82(aS z@H|j%;$+4opJcS;wG@|RiphwmxX@SNdEp@glzV6?;)~_#Xj;%8`|!STum@|&Fi|dG zL}Rj|d4)*y@ls)gN^sCN$3Vzd|5ls9nE5{9G}$l(^S@rbJftfqjki~ za~o7Dm4k~hxqhVakN?7vl`AOEOPnRJz_qxyto-ZJg1(+eqL@6TIWziC`fu`I$Qw5# zdaO#QYF;8(99(K%Y_BHz z+gJNF6h^yOzE?@&w{lLk;cnXi8RB>RT6ZRLYveycKm57-XsXATy!D8e7o6(wK$hHYS-)9=s|7IMiqvzzK!mnJ1AY5kG; zqx?tuxSglsv?#N%U8+_4*&pT8;1^mwT50p>3Fyp2)n(Q7B7`Cw1z~~P3YJpq0>a!@ zNw-eBqO+8&4g+wOynWGzNBiLukq_&u+Ne@`K}J<9Xu?sod$p?284)iy>6?v4I_^454aE&jrm{7AI)&P24Q+OTI{exN zTIxFbwV%r~%c&Py%Ug@ki<%YV75`){nD5ZE}fow*hmM zzRxmKHGNjv9M`0Qn8>8FUC=1ic(L z3fB0*IK0;vi8e4eP%}t0${|FHV46Ld+iiMH!g*8jNis=tBi)=`iNBKh3payEDT|fR z3U3Qni|7E0nfBPcR;HG$jT{j_3qu8uolVE)%jtFSPUa5ct`}|!>yW;KNA5(=O<)mD z2@3|3K$4hzh$3IY#V0g|Vw?!-D@-@)C|#SR25G>Q2{nZ^Fxbv3{W;Z4uJCQA z@l>$(H|QSu*nVC8;#|AQ{CDd3mJ{c~hhA^!83_l{I;sZngDS zgG6(Fr%+RyY0>b+xS*)oZ?zk>CpDh4ne}?(#Rt3TGeWPnJFb)YRo%AxSCQe4RdtZM z!o1nM>9g!}?Y(G4Xz9O)q-R_Gaz$Im(?Q4?$X8fOl!nFTxq0FlVKtTL1;%4(ltI#t zx6E@lW@H{@^~j8Y9ZCmDkG+5Q@SFD}$O0>_5ng56u(PDD#OB1TR^n+_X`j9#11iA*mXZFs&&uacr>a0zL9e7RN|wp{u5b2i@mYBC}-G1JGF<#EkuHLt+lKBi`qW?H3yq3w~&kMr&F{vz~SH znP+>wm)ZS4!Ytm2^_zB&OPu$G`7D0n_4aE|`}_X;+fAHxUnknviP6?&H`=rEHl;Sh z8?n<*%M$Cs^P;+MYfI;AepX#>IoH!`()Tcdzb4;eZ=+EqprccxM}v@qjwJXYVTP8B`J6hlGqF^m(%=9z88Dg#4%(0xs*Jce#%Gkh_JDx4 zdldY=_WO-h=cuTAyH3$4GJh&g**L0C_+GC#-eIgAe2%{6gDBU5k5EvXy|jRuQW5i5 zBhv~^*$^a76a!L#TvZV`cx& zz-=S67psdVc$n?K886*GX%oMI_!E2MJ1F_EIp(iC&^^S=C+d?aB+L?}|edc!Kjzy6zi9~9-^33Jx41BSJEYN=_q|x?(O1rG zm7+>uEy=9%rqb}m#mmOD$?RuCjn>wDqTh2@cki6kib-hWMx+t2%|csfc1Zk71@RD0 zRpfKw15E?S8L0WJWi6Ke7uVE+V>6o5kU(=qbuzI*YQ5#k{>!vLsibNHlik zaR&4>x)|e%DVc5F%@Rn`*!O~V_;0190FCO|i;R^X*=@!7X+DZ8Duo|oQI!@`PlD$3 z`noVT_icCvM*8YzmMKQpl@yKN+sOpE&rnf5!>BKg$91dbY$ZY6 zm55mpT45WG%C1kTc0ICUny(xaJdmtwkYv@UD=5d07&vj(uOReW363noJH9S%t)3P! z<1^(c&8L)_{uHMbrl+_DYH+vBrg`s|Su<(jJVJbPn>b%PtGdt$-QdDM&G}w#;VG z9_po2@T8$rKA+Bv?}d3GD4$F4^G{6-x6Lh1NLUsKvj zJAP-?gr`AR76ruiP{+tc69j4Z)l*9H8;&LvuvT(sOcOMUvC0t-qv0N^WR>*DdjD0k z5K-4_AEUGf68~}=ph83j;_}4Jc$!v|GKVBVU&bDb$3CJq^Nbh73rTUG5*t zd9$vPv@DfYdw$7ReyZzDOinkc>O4(T!PU8!F%%980=Pp}rImgHEq^xWldiG*?RtHujSP1P;Y2Gu zQuwD?PWjauNeoFD_W+7$0k(`@(n6N|#m5_B>zwuq+pi1+w8T-899c1nQ=AvrSF?^8 zv0+K+`p?YF94=~TENt=zDi&e7dM|1wj{Yaxy#4@Q9Sj9e+8{ z2M_oSeo1DHO&b2q??VAVT-rCQ=&~e}3VS9fXum^=J^9Qgtxd(wOx?9jW&NDW-I+?t znA(n;ns}KabsP~Ki*#FArm_xMF4j&4`=UO| zm9x%NRUBO0O?cG=R7P9k!h{4Yki)|II*G-`ki=aAo>*74Gk`#0Qa*&zFtLb&fQ}e$) zzTf&mXh8r8;~lRQJ!?Ecy3-V33EZ*lD8!1*ii^%eC;&}c-?@5mV}4RX?m!sdcw}%e zfd&UCK3_L>D%wjv9Ju||9(rYt7LB(|IQ^UN$K?w<_I>eE@x>;}@rAlc{<{R78R& zUMkCj;6;BB0ff5z`_18O-rEi1h{oaDMQ|&FfNQmnGvvN#YEFfA9W(#X`$- zlqA#?Nc3*}W|;aS8KuWuv!fmOJ$7n2?Gy46=GSK#VQWa1Fbi#%3%ROdgc0Y7VKaQJ zt1=AY_e%eGs374rch3L(N`L$^Yz@@aalxxL;HW+|Tj(V`TM$Ppo^~I!wl~81P{A5O z@>P95j1iLu!OWb!?Kz#JCeR-vZHI5OqTs5eRC?@Q?ry43K>{e5kJTL10u(}Q93D=A z&tzN_f?O8Af7rN6{C1GAzun!)dnjq%&p1%*PmT;l(Js6u2?*lc1JF`4cm+n?*}HFs zLOM1Alb&`O5~L*}d)XiL(Iyy^Oi`3XCWFO_Ul6~UqQnYJUAo|ANYQnm`PjMf zs|U}Tsk)Icr71#rTF|b+9sS4l66aKDfWD>tveo+FFj#w)PVgd-qB({dC%o9&8oYL$ zq>+tHg_+-M{|XXJxUBhCx?^B(a)R-t zE0beEM`N}%fgt%UOf`#DRn+>(ho8;oFuOsTdrWaY5S0z8a~AtVp5~f4sj_o}9{3wh ztX27ijZg3F`&7(d$K8=~@ElHRLIYi&>|x!%{TWmGd69bFLhJyZqDR$+8RhZrD(zTkrE?bVe<*sfS&L4QBaysG) zP7TI;y|`Mb|FqmQ`q}GBy`abs;fC<3ywTQ0B7f`i9irnx$ehqx(^_65cl5eJU1=yL zZM)r{%nrD+h!tCqF!EWM_J{L95|()>(B#ue6r+6<41!a%(3Ho|hv1I)hE=D1?-CDYZI}#i z;8Mn@$wEOvVW{v?K&`kJQhBO;kA#E@f+AhM46LXwIm*%pS^&TLUBcb{paUKfFSVAM zwbU;Eb%vmY1+NC5A5U8oA)IOL`j(Q)4NS@#s92Jh-2BEay>l-yh-}`BZf(fk8}coM z<_;>CVew%+Vu215W|iE)z>3aQ*~`-_2g%nXn~tfyXY0eME*3C#jACDkFvkL1hu@2T z3kc|CBnM%ub_M)O&e~pIph}kupgaFX2NghP{{`!xCp{SF>}nmcv}>h3A6Lb5Ir>9^ zbKm=#AAmAV1c>#(iZM63F$#Fi?Y-_@6sN7g1rFM`WZK`|PYJ?8%>4i|_^gk#n-RXG zMlNsv8Ro3Fdon*WMWJ2i_&NhJsvutK_y6~4)zQd3sU1W>j-ZT{M|U1eR}o6Reu?8+ z;*%-`?UoP?@!>z~wR+tX=rl@Y&0^6iL?8^-@WVW3Yss%zmra2#{qx7|oz$=X_K(8w zmvRpk9(}@?PB^b~2*Ya$1@ASK(E+FNEYVkg`aD;J;*~68f}kuUJJDD=O5STXKkH5t-$!Nn+LWKj$vuX-k$ZC0BkW$32Zc> zI|Kp09rwdssOitVs3BwYwsc{_dxtiFu48vh z--2=I4Db8S3I6z6m|HcHavRK0Z7V%6LQ?>?(T4zEy@ntH0lky&8L^b*O?uL=d{qcW zCAaM4Bj;+$e8+OYL6CV!UK?#56Y?Tt%HarOmQZdDuVLg=e@eP`Jfz;p7q1`v_WPOY z49VQ0Y|HwuCtqDc_JJyn`hom%b&Yv8GaNvS0Ua~%WkoVp##Ea`ku?Z$a~%h#6OCgS z@%)C$IrlO>-8#HO7mo?~Miv6?II#s^j$yK8UnWGnG;0yV3Q|(p*EY`~>vb3cs1sQw zrC9!p0FEoHZZ=1MIKE9+=sy})_-qc7=1X_^m~{1nKFgJ>F*z9`h1fGa)%|+`Kd=J< z*|(-GHPlr=h6XQZw*4$Cc1!Qw3x)^6B-$8BEFe-!9OG=iO2aD;4KZ~G z%O#+oYaqNVgR{m>pRc`u2Wp;`k`1r}m_}kkpAiV|SaKUwLliR+9_@R7ZKvF;V1*ni zWfu0PYup&O9_GJVo(1wl_e|`Y1G5en7G`UOram72zM;3wtbHFbAJyx#%oOc9D(CGPve0v*8>^if7xgntApeFs^}Y+-Ep4@2kk&%%y_?okOf93N1T zZ~j)UUhSX1U*I}4!$gH4<7zHuhFHRoxvVNB-<-x zN(lUz{RVbg7OAxPg;FOtc+c!lZ_F4aDe(xW8TEs5kZHA@1~TUgcT|Ce4+OcKPXy%B zvgpl+QAv`AiDT^_GJdgeolN{bLRoj0asUq~CM5$v++(VW^X=*#&&qK7jVu_2D$uFcvRJUD7t0+tlDNN)Shss)-6%ZQ21??`s#J5V%# z^9+Eda86TwZ%b<@nO7On-AIsc%)Ib6S&OyzyhVeb8;N0gkcc=&3zsVzGeLDV7TN~` zOu$x9_JXrZeSHTOBpbO7*L}I3br=B*j{CR3~y6D)13xkWN~Qp z$K*#ZKV^kwoAAm4%~7a07v<>Zv`^8(MM@vM;Z{Z$szh^dv#P6>PP{4vBW8InA{Fp2 z6@w7@Tw@bD`rs9ODxN^$J`5Oj>Cd`@D{If%!PqiN)tz_w1T4gBd!hR&;5XTj z59>y%w)TVX=+q{bEMtUGTl~SJHQmb=tlpWhk@-bB&*fz89uJe}KaunhIx`~m2JC(k z(~8;5OgWGRK7sth;Nm&^4`|PyJyNOaW~H-;H~Co76^E>p>B8#6YQw$I`Ch{w{#g@# zA}xChZ2wYv7O04l@{Ue{-dX^yH~7OmLzads^@4z&QP>Gc)k#=> z6S3HSZLtL$3wQtnNQX_UyhjxhW%tAm5h^0qnq+e3>C7*M;2%37Vdnb0_>2dMcT7cy zhABnvuFJ&C?8rw{^E+XSw(Ia3>+YDOPNu*P&Crijo<`L%<$`r^wn(YD6R%RZr>n5Af*gJKxG%`X^jTkNe%n=QR_(e{#~^%*@QwGp*YQ z-h*|R#?r!z?_>L&Vf;9~;oS;W zV!A{8eo;7b7t}TTVU3HLNH3ktC{Ts9I)0*Ae5IUumB{;uDycLyvbJ0&iq|>#kubFb zi#kL@_JHmUA;uD{M?==}(7qkc+Tq~r>~+eF66|%dbeXKxvu}g9S;}e!1&D^PhFwGA z$KSGw6fX5j(s}-{7Q|0K5xC6FZ~lNs?os>1M8AtEVdO|mZ;^NEq>zA~vKubqUMpZ! zsKNU?T9=X1zxhAL)dM__`4qr$9fMmw+gC=&Q(|x+nNRCPvp@KEk@cx8rC3?6?Q%xI z3yChO6aSvdKeN_=!Cm3bX^l9gHi@cX3^A6(*agOJr5ed6_-IzNkUogq4gc5=A(80b#}8|&-m-Cw-FeS1BS|LJHBP=mVP%}J zllgC(?^lTw0Rjnr^i|2cI&t`x%iaDIUzw6oZc%@&)Yj>^_FfBQH~m0NbBL#AH;88Z z)!QG_&&$kkrfre&yM6!_k%#Fv+I9d(Mhc@jV}&NBCj8e6FSRrU4m=gwxJzW6K{XGh z$a>tsp_53itqmIGoy6z$9A)|hr8t#ZL`DLH5kjX?f~!$N1O|euk&lBAf$_ieBmZB` z=zmy*to8K>jg6R0&A1Oo<^hi&Z}x`|Gb8KSSZ5?St@{2n7^%P013~V~@Ea99_wx(> zxUKRMN#yCYyKin)rQzE(_AxWkvo`WU?6e~=gNm(}n;^!JIMa+#qBdg0rp1I4KkS{6 zb}g%7b;oV1P%h0!9K3_CW}jn>_Lh%F)Q=nc*C1#Evo4~ifUsSH&AO*gXhH-O8B{63 zrt-wYgkF=?VtR`dJ%Qjp7CU{38b+Pt2ErpDVHZ4MibsGxuI)5W>Khmc>)%mG$`C5h z<_*qaH(}m#r{5_u-hf;5_Qnp)NBWWfuSOGZB@R>IE0%y7(MlZQiay$Z*eqOxGl~*NUsfhiRYONdRTW_5<7v>P z<@eV56u{&AK3Gv^=hf;j1T678{|sm z=a0XpiPyLwr{+XgA!Xj13=O5EvUv>PWshxsd~1aRN#EEgJ@p;^33jbe4D(H+HdZn> ztMVk6zH%+?l8%3w0?{?{QB|932(y}#RaY4pzA_w*60b-{lH zs4tS_#_Vta2SKOVPpl@+S&)UToa-%JZGT#LkEP)rCdh!Q5l<_hrO>K9UNiV^>EXD% zyu6JK0{|^*?K(Pkbe~m;Bc}6V(DXI9Qj(16QNQYULjz6>#8AERHX<~zc1JL0L#C!b zd*XryOujxvVt{^iLmJtV)K8^e+%d)81^t*}A$j8w`(eM5ax&DN3AiM zQt-dWFT3YFRH-j4kHHyS8uL0E9M^sJf*mSZ@RUE zWrmCVJHbH$wQ~Z9rfvZ5eJaGC?dI3z-5#h{xq+mP#mWJw-whzXn?YggcKX|UyH#sa zj}r@{?{QFFD&wm?eF=4P8>+1V)7iwcT=)JD$0H@{zXyh4rsn4hn#_N!h#{P;_+3rH zD#5@srFkq0!B+tX1AH%aBvA>ANMh!P*@9YCqK=0z^WaxlHP#a$WY@&dcS^v3zxK&X z^tGsyKGt;@$3)gjN5{Z`1R%9Og+^CHA--l!@tqs)vzUY4Z{O7dEq#)rjH$z4SqGW* zDBAL>{D5^(+5KIuI5qaU{nEJAvWuk&MN82A>#ejFN2Zz6@fM13t+{z?%!G?664|L3P-*!4u``kgK{vV_IRtRP$L9VaOx*I z5ZYqRUR*7fi<pUogeM1m(S?{Dg zylZ7gP3{@*hl?)~7*1xCp>SlH#M#tRUqH3(i|&rjkuY9I=` zlij&LfuI$_j`>7 zx%cm{V0E(JPTf{%xO@z$Spv>d&hHaL3%4UV!L%qor{1pb_Pd13d~C3G=bnBG;;D_Q zE*qZG9Bhc%q-+4$;wDiZh`{J~o|}&8qJu%tgmCc802PS{c69nd1#QEa5qA&G$;-yN z8^S<>E3x(_8IuQN(oo>-k>bs9dVxxYKegp78Cc(G%%oi(rqmjXHS4wZyk3Ue$udXR;1U{1; z{|a#Wa@Zr(m+f1CJSM=HNk_*pUyV%7M9z&;;s_@PC+A!13SWudrEFTCo{U1%Yyj!W zVny^~ltBsOaKB~14(0cB-=1bQ7$z~chT)~FDnv$Pu6*co5AK$@?p+duKfX<<5f5@X_T8{De1jPndW$Iw(5$b!=nF5aI!F_SI`J#m{;F! zX0xY2cf3uBgv;u%bwdF4?}3j|8N+wOPGI17de{~4ik62=(qm1E3co%2n$>@IfRys+ zRCSblx6x$)H_Y2jwr^%Ms|(C=Z!n^baas)Crxwkr2^|^QBR9GXXV`_*tNiBYUw0(0 zGN%}I)nQ4|KJ56VH(_!(=XUnU>i456ntjzLx20&(^4@U8ee2Gg!BP*ZYX{+kBR zpl*nv9A9ki^nr6wJxXv;tc@HX%K{wE#{O|GMo1Fpc46!jk3Y#An;HoC3N5pao}_pN zDZTugP3!knCbnih6-!;{_?F{KvCb*Jo8sZQZS-YyClQkt0DhLTA2^zxN~5cLenyv+ zlZlkDBI=1dH_mN*Y}Oh_nZ!tXS=psl01r*`vu~9hv84bfcj=IfNTu$4tGCf%mQRrO_>PGztw`~S&@;7FtpaL2#X%@2W_Y8WYwRLxxV3P%ekjiV;&_e=mf8kRCj4nHg2QqC~E+y<*0RYp>TFN#lH zf@r)h;W-yAsS>fa$iqL^epjv5x5LGR2KVDye^4U^>+&Z4AQn*2>D!K^Mc>TjsWn!a zXkqaT-aM#UBVt_ z_i0K(YKfz9mV0mbJd!#r-&UJx0akxEWRtJ3vl<&55kvSp%{|z{-v0c5_C1fn)D4Y%3M5%6IIl@^3|pwe7x~{OAqf=Xngn?r8PM`%n*6{88~AwEcJfE z68rWk@v&J9r3=;$c41wmh3N3q;aV9MjGhxeA^M(J7_({BK4}AoH6rt67~{-i)BCX5 z6cWX&LO=&^l1)cloe5q}q>rG8cKK|aQdI`|(+V|Ir(hCWviWLI(Mk{w(wb^|+A8sS zSXeL90g0e&!A~tsVuHwUbI3|V3vCEFFkDQAGCcb;ihuamOU>B=N&eDHjU${?dgm_pluX-ZyWDY4^+9ynx0!~^%S^ux&k zl693p)2WfrrdAt}pcry;TQ7`yY%teS7Q&{TO6oW%ocBGCnP2Mo2H$zyOT~Z?cwQ~h zwE5}8nO|R5IX9>S)ICVwiz7U38q@UZdH@t&Jcrdc_TbMYBF0JbT2}_z;(so^(@t*Z z-|H!Jyoyr_BRP_9-t@me9 zg4BN1#Uwcm(6(ygXd~7+#3u6#VN*OIR{CD`2%kAnP2J0w;mMr|*Mp(5`#*KXg(=o4 zee6z8_-fqnXE}FbZe=d*&j%t9MF zsE`29BCb>N=nwrN_hBzH_(~G+wL-6)IZCp!(cT?g3~-?#;=H_t0bpXD#`_6NLc4IG zkchf|`4K$xd^7QjhJ<*gHF}^TB@N)KbW~s}tCjovKM@Q1kYqg6Haa0nXETW0_zj$zDBK)Y} zawRt7;mUrD)ErXq1ac8pBO+%TkgD21wemy6s}d26Tz2 zqRe@ zeUukP&jdtXbVn1(A!o10S78G))+|hS*;3qsG=|g6Ad&`?Vs-RbVmM^D419jMI;7vP zw1t%QIj8>N_~7${(nVerp63YSOv{5_#%Fn#t zU9cPnX;{Ss89>Z59|0~FodF5RK8XSYbTYRWup0TYXvV=rrG;>VHQ?AaYOD8K7Cn8H zfZ#8xQE@qe*y8L)+u8nO#Y8Bz;#B@jO@@0Q#ofXkWSsxDI?s3r6dq%x^}G;D#B)i+%gOLurHy>-+50-<4mSPAH#5%?n=Nv{ z#;?1H_{6>HQfsf)63Di0e?Pw2kqOg;=-h4;Vu{SWy#TnLZ+Mx#CsI#qnYZ6pdJpTvh?SvAY%@ru;?TAj<^p0RA;cIy;@ec3Pi_(W3Y^AO0Tx3&|>=kNtwZtrCjIYI919fk2*&nH1v+ zU*fotK>gCNk!o(t`h$z%*l^{*itZ2uj^!S>cJiHNCl+JI=I~9YuxQKwm#9Qfu&I`i zn-sLTFRpRDH7HR0{hF0{wYfupai?~#YvASDx%#qeOxv-VtCr`w$5n`!yK<8wlo1kq zwsN$%QU0gmrGlR4W0Bwy97!BXZrU79RcpG`t4>PhC9V+>&YtdH9oeOpe%CiO^~pd? zn(RHYet%P7#C3(WD?Wd)fie0adIp`@s>2hrg9t=8+B4ce+DMTn8rvqBlvXN_b~QQ3 zNDLAH?Tq!uvH9v2_<+&n#_kydN`Bu2Ue~4Q2`Imm@^a%lB%#O@nu()uIX>ENgI25a zU3^R9TOAZ_KB*M}L8_%?$zvkFr8P|a* zpAmDNIYAAyf~Bfz?rXa~%l3#+Z18sSie|S#unk*-V?in^&<_0;nye&=^0DzVU%)!U z+!hRj zVFC7@K79ocbxhD1r>G;7yR$QvIy(u;FIQ=|j-Rsf`l70H;VTfz;@KKq44qL$IM#7!l8Vr!vg<14 z1`R&z$*~t%UnbdKCbg2W4%LI|cpOFP_f{|JO*eNDAaW$?ZM!z01iFtrrT$nY{q%SM?MB5g#G=~dG5+=+C>vU@v%L-~D zfya%27&$7SNr*jNQF9G@WbfD|N}d9ut8kj97_0vnX;p#;pyNWxmWmDIE&Ab3#HOX6 zZ%`9yXs8PdrO~P$V8Z|$wl4x1bB^k5{z;?c2@(_-wqGs&Si8VPLV!nqSC+>{K8wgF zRUNy%zRCeTsTt0Pr*#$7^-ckR1$a~c-jS@>5k2lnHi2hFfHKuNqiE^^VI z60HqGJm1!UO>0flu3D??<7NqS)+bz-g@@%afUCN1ocF#uld>w7@R;{2Ztw1g-CzS< zE`=y3y9Foyjf$N*as1mGpImX}&xR4~LA?cG?~|dPc(pXOzZi=n2X2sMvwm+$jM!O= zLRTY@lc>nPuuR)EcoZbTv@t^8Qr_UZ z$+GgYsD8H}e8gC|n37zF{9}gWPRUQhKCZe}|8-E+z!dY_6IuLll7G>yXeVBu+Gp6r z$;VI{HxCbf@XE?cP=GF&>9K*3Z1p|*Im((p>;2GPz$1?;oKu3BIOzThZwrUsnhKB< zejuBDgFbYaDbF&SjPQRny=7P&P1iNrgS)#2f?IHxV8IFQuE8}p48c9PL-61h+}$k@ z+}+*v%>BIQ>uY{=PqkE6@2c9iRwbhGn&dlI8KCfz4l^-ujjuB8Pv>z9)Y<`I? zJF;VDMqpkGp}zdzX3PEDkb-Vw7e$TBnbc6dV7uOh(GWIn#{Md9%8=I^l06svxN0fy z&R%>}YSIgf_4$jrKteauQ7X&tZ&|%f1}oHzt_ zRxT?SHH1JiDAl*9Z}?wnE&0}I^F3A|BKYb1 zJRKH8zCC0!?7XyioNH)6B5k&{dJz0t`Kd&WC8d3KCM_-P@ci7t%1YYrB~`YN0cw#k za>fP)xOZ8m*o#tPfvO#rEKMCH$w^!ERge+mg?WXtF;liokvUS2@$Y9iq|u{k8R!mIyMV6^LAH+5I5F@mW}ZJ!@pj-ugoJK`Lq?)J%-baA-f$gM>ws!K0E!g#*_T*xbLhA#ZZUdGro} z<&IJ|)WFUSROJT(%h)j7MRqIt+!dN1<}M810MUcf)3wo{aRcnZz|s!Cw^i!cALnqv zkI&r9PKL_ZbsYB~L0&(;qov1Z^cN|3XRnVO!PoIH$Iw6Hb0P?8V!IxoFk^c+Wgl}c zV0+L)2A)bXMGeR1}cijUDWJm$Yc!na2rQiC=7Xt$WweiBCQw~Wh} z&k5d~LGU3B7lGT(Ab8%TDtC8%TFINS4q=T)Vh@VIb5KZyCp`GVCO8& zkTha;m3yb$9OZG~4$prtz@>cBhmVa-l_ZNBoj6#+XFKxbZk^|*b3KaSlMXXE`1>T( z4KI;HSt#U7%Yw*8`B>%DBnQ!=f zJi?D_jF>brP6#Vi4~p6N%xF*ZA)m}pg0c*GkYh^y;%!!9$Tk(8!wrn<{Dx5dcP#%~ z`o34zI&Ar~`Xol>%g^+o04h!UiXB)cRc?TQ*HW9I)r)K@uq|JafYY8+zPM=7AmaITAxZlojjJoU(y>Gg87Q>1MTGlhx4Hdvj~l zGS=s@r*2(oXGgUOceCn{fZ5mIniBIG#`)&v7Ic+7hxeg?SRUl!rhtZ+#r#q4@dHK0fWHWP?zC4nRZ#V<))U!oO6D7Ty*)LxsDXDaZP7y9ob6{7U%QI$pc({U1 zNGX>_FfMaE1>;$JU{j8}sSjOuia_v?m`K&whdzte{Hp)>WE=;^WYOlInag?v{=b5< zvbs_yjINE1y$=}o>bC$&(IaAjFFZQF66L?e=Raqpca8xem%9R>LR1@sI@HaHdGO!z zKbFM^VQt6zNx~NkGK{~ZYcRBTa^{e3%qGIFeNY7Bb-FUvE-TUrE_hU1P7-MM@1i3x z?aB3b{Pu4aGvW)2e2?%!$$zuA*}F!cGBx#%S-)jqU|_U~x0R%uSz7XNayK+Kia6vp zkxv6tS>NkA*^2TCjh8Vki(iXDyhJ5}^kK8;=V2U+(B)-g$cD_$TWqu`M99s_Kvbn~t*H``dU00IlQA(X$H!6Ifjmmmi z#k2f=TAq>7QCLxP z*>#hz(fzO8{$-*7-j!BxQ=Qrjsa4BW&VPcbO{0=dgv$9R4Bv|1Peo#<%mBqKSLmN^ z=U1IsPDHZK>W_Qp6^~@^rtgwdWoYNh$+oyh2Mh2}Lst#SNJr7-%WD*A>mC#2Vr-h$!j47hc=JKp_GP-ib_{W0RaJF ztufuz-F?v$|Ibb3{r$a?k`i=Nu5DFQlC>uqxI5Z9zta|)YrQotzjpA0s5w6HPt_0h z4j**Do2>g{N6anT0($*D5vtgjvo^C2_A9d*dXjZjir~qCOg`P`5(*ZUmXN7j>dTkH zzvp*MBQeno=X#)^xHvXID%~3dryjLg6jz;)f@P9l08l^@}hg=)3F?W*jx|?qK;(siVcqUSuN$x+*{;N8C0PN;9*&t0g5VnHH+>p zT0zN$IlKMt-e2LeiC4a4-Z{qmcVT!vO=I;J!*_Gdm@F2GR$bnQc@a7u1(r}@S)o#s zV_%&@YrFol&#(HCF3R^LmOBs2oh00RelMmLF$?{TcW3S1rm)$_Cqz{1ecN~a(1(p= z=7pq!yAJJ2JYTm*%i)VoDGxIFvar5ouv5cc9Mp#2mm~n04kCz7Q!%Kn#|8#ppYDE8 zN_sCRo>}oA{yII#uXL9YRKbhSp#{zGvHNLIG+Ez5 zAiha^^P8HQ>Q)s~Vc*<4WCPTy>n>CLe2Z3ocVH#;_7)-brZ8 z!1Uf)S06YrYx(n}b2DlfnqTY8%`e2?sMhl+k*#~;KgxjLr;AS8>9lynV|5v(f4%XE zDI3Unktv2ceeyn@wW4VOi&5mHRiV2zD^E!OlBC|EXp3 zTg#HWLl;EalLTbj&w-yDwDtw)U-=Un&gWq;jEWfG02o*eIu-7JFHc@7$nFg$>v8$O z{#1;^UO&PeV=Pzg`}dSu90W)*HY?7VrUqs_)(cyyjE#+rs;a5FdXgx`0+UbXn~f%_ z;fkKqq|EiiNgL1e3biUWw&nR?Rgi^5;rmM!MVWmTl@KY^k60;%^mHPJhducTm5`7S z2+a>=HRstKz^zh78?dW$I1tzqJXGfeKKX2t9eOM7-+1zuV*B;EA=b3eRl6rsVYMpP zZ-5sAtha!rwzM)=w^dw<&a}t0p{V00ia4%!dv_Wb0#q7?!#nbHti8!TxcY5y);pm% zs7<{$}I1U(U@ja$E-~P1e+WdUgh9 zGXBJ9#Nb-A_K;EdScZswAwzFNV%b6+lSaqK>+p(F2&}%B?ZB++jxpM8rQSrIT zjDzOhoAVh)s9I&Euis^7K1b0c)Mu!~BqN_WT@XNP4{$I*dCtp*t{ zORo%b3j2KBXqWcu&s>D%*cSyh0lIv0fP%r=u+xba2W&U;>x)N}_gqAgr1h_s?-j9V z_=&pIs{A?@KV#PzbOl}J$VU6IU0m2uXB{TIMG)&eJf0ZngCrChBGQ3CyK#WV27*82 zMv38ag*w3%wm4=V^$z`QQtnznorneylpd$B?=_3cs7c%gZSl&>sF-=!`r(7$THc0> z(14z#LwI90fd9&52|xHBY%K6m3XX-NhJ6YdD1ZF2P2NdvK3iS=mHrd|D6pa2+@nK+ z2O6tk`S59RrCIndx{;YzpvY>Pnhsm*P$F|995oJfs@)M>lZ)#&LnjMabsqXqNIk>S zA@dRj*W>s=3Xe#vT3){>`a|0y;@Gr)elyBdA1ov)W0q9ur z2yhw1eQdQzqJD2pS-mp0A&Jjv`+@bZ7{?&DfS{h9dn(_H)PY|R;qT< z{eBIl8ljFK$LD8#f&t4@#*LT(QgtUFx;-iWl~`B`4PHYUSc}izf z5jj!d--v`fA1ElSYb9rc3{|xU5;`n2hOheeUg8$l?rN__&Ijq*O>bLwQFA`1{82p0 zR-5BQ^AqW5pIX9yH&ew4r14260FpJe*Zn_^4(K?=x&AXL*m$c8?_nhLWolOIO8|8Z zZSAow*a&?S5pK7vuCuU>mz3pIPPm86`3*BP4IMIB?rI941@h+83R|?Ux1g%QxAA(u z@7|RlI#)-+3SX<;L#IQp_;Yny@zbG)$dnwo)nq6Pu5Zh0f-Oq>?vkXTHt68TSr7|w zf9#3>_E1r{c8D0ZbRZsR+wf&b6+giPXiU1(?=((hLoX|v?h1RNmivM)R|jsHD}PQ= zqG!EmX)QPyM%VxyYAU2-`$&quJeEbHS8;eyB`5QM>#NXop%I+_95aOJ88GNVr3apk zMVTv&emP#OUbP|g(nHr8A;R`%B;3)m((gQVZZy$h*H2626NS7a_TQOD-VlW|nz!<; z5j56J8Ure8vDqLn82o!UwlrLxQ}~T)bcuQ#ms2c$UMyWz7;d9R>B_~jUO~0axz!+s z#udp%g;Rc_gtRORyGZcCUf(K2iSm+4IiVt-M#aDs8yTR5C<_a}jaZ836+sBj!mali zReNk}XiGfH=qKym*^ayBLo2SQ^4tM40IW$ItZ)sm>z=2nD3%?2U${>?iu0Z^d7U~c zvyp(7X@^dzh5bwiMLYj5ZV~EByj|++ZYxzLxPT4i?nAcks0wi4m2Q#F3v>!QRbhs)a!KCvw#&ag<)CJqDe~NpP4OnXGUdxrTZJPu|yS0bdP-T zx6P)Bi?28XM=M(&rIPcyTalzfa>f+u!z-zmXjfeAx0SfFh zN|nMwc=lJ}Qgs^Sc$|q3BR_*YSD{=9WUfSZXH~aei@wfmQ?uLw3)iqz;O5$ld1FzS^3v`w zskwF?5mrg4RsYoq^hsCOd9|X)Jm*_qi4AaqwvP058dOv_5DYxzQ{%H7=`~ru%BnOF zQq@Ts0B70;(2j3M3cv>?9z$B)LX`5vb5A0jwQ2~4@-(HSu5<_)Y}_5*5}S09f9 zEA&);ho}F{o<)R|cWEWHI+h zh<~Lry>3|EO<)9n?SiGikfF0FGbuq4RlRTnRoAvbb!~zPUF>kdyM8vJ9c?Y2kv=LX z#5UVe>R+&Ki*mpH@<9Xl=Z?M&#?T2~S6fM8O4cY2ik+M2f6+A|AKc%m$=(rA=~|<& zV(a?m^szJR-8N-m9kZ_z{U|^kbsV{Dtg;q&$1_6}uNJ2meym=Cw&a{LDdZCJM@?`pi`U&i|YeKIr*<~Bp~{B zSo({OwaSSFHLRDcwPkvSnBWS*sNJ_)U!YAd6Lwvw?>>wW&VB7Hga8CMevmCbkA)Q_?mWrj?E5xckS&}oDM zQ6l;*^*Um>_Bk`~_3z9s;nIR02h7=uTh4R49R~~1clWd4dh@1lj|H}G{5(trqDsoA zwx+6Kt;D9yT>0OCE;~zn_L3mTv!?-&Ri^F0lU^`0aD~P&6_qdupMBRa_4^J`Livey?Xz5QAKZ$N85XyQo zf(Ir7Zub>!Dw!D-pHjo@b-#tzp5lm)3wLr1IHFFyT#*3xzu~Z7r;hjU#hc1^Gad3w zCW&M-`{W09_AF#zd7`-eNsr~gvyA4PQid5S$glat{T!*8B?s%sXQ+6Oj&3=iq17U8^Hdk404_fdt|K_si! z?skRatBCd&b3=u7B1dSUQL6co9Bwz@w0r78O|oWtI4 zd^Q_}r=QjU^$>;EkFd*$+9quN{P95=IIlt%vMvDey1hZ+R!`>mvKp*}`LG)}o&SJI zEonpUT3tE4i;MjEkKu`%ITwEcpfG3Elm}T>)JYptS=a9VD=-En9^l1f)b5FycDuF8 zxsFs{=F=o?^H&y?))Cmn+XdBMD3+3S;>W?Bh1HzeC3U`MY-zisxB}PXxuac$9PSI- z!P>7j2}&+i%ZIG;DN!Kn{V4X*r+>G0tYj}w<-dNU5`Iw;w1q@F4i6Jbv&r|#Wh=cnZN|bn zZ?+9P$HPQW7dXF~rRSnqo_KjDwTJQ&zrbPPuiuS|K+1 z?1inBdF_&DEDxh2-qk} z&M?~@CNQd~hwf^wa);4We9WwcuX35Jv||h`gy)P|cOAdwJq7^;6*`hJ8Qfsv5aUSZ zfL3${=;LOpyiiMKaLJXV#4`Dt)FXSB*K9S^Mq9|$mz@D**=3WAqUITO0kq!{-~bf= zi8|dzr6p*e6Z0?>zA6)OVl$6E`t0eu(2#LcuQ}eW+KDNwzm zEof0fj0CRx>NPrm2VR90cW*S|5UL1%l0a-JC%b>^?L0{zbuonJbP)90aUvq<^yn;S z87Ay{Ekd_{M(22L-AWsYTIm_{8yGQr&YwDtxX?WcnY)h&h+Dq5XLVdA!<*}Ki+2eR zOSg67O0!XbhJ<$);Qk`lfjkz|c8b)P?zui$nc8;E^<2qZ%>=Yz*)Yn*kwljSgQwP( zOd^N$#+VZpiem=rD@7M%TGB&A3na9ngPyXEV8eLJ(e3rBib0Lr;O z{;4GuIEXGC--H}d_0cHL}cUf^j0#X%+<Y?@9)6b^SDjjo|WpAQ+({FA@62dHkT1=wu9yXjLVUBQ@0lF-M3L>aJ# zcChFH>HYad+b8}6Dwu+V84i=|pOYH4VU*azJ1Wf>Kx}WQ8ap2sbEqC&95OG7C{5ys zIn>Ar1M*MgJ{4eM?}2tJw8H%{b$MWHl^Yjl<|4N3NB}Lf5pyKM5({>+Z(zPL|ZP@lmkc#VvjB#Xz+K?gqhR$eWX^8aT4q{bI%gNMqvpe8LB_RH6*6f7s zlT|bCGS1abvWO--zL>>Y^@Wq^!0JNe*&AaT_j(_+vO_AUJ=awdD;M$;a9|?oQV(>O z?l)p1%I{x+q4{*vK}o<-zaOzHpz|%9@?^#TNZxvsgx*#{L0W0QvHaEH!5k|F3oV z&ma8)`$y3xbYUOUIk18`(+5lq@#1S^(%V3Wn6`B3rB43e@w{UCw2Dy4-LLPT<3#n1#k58RRJ%d|IcZg4_7Q5ERgPvrs|6}up3 z#)S6Q7qJ}vH+Da+-nz1r4K5O9KQ(_N%DkpAgLJI_XQ8obVt+g5kqxC3@H1(DsTA?c z{YE}u>1{Y7%%)fOz7fEm9#yw+5kgCruInWeG!`6V#mkbPtXXWQH!Ferf{B}vF{hQrY%f8^e(aC?)#xal4F;mrVGiARozs*Sz-Q8pxbCe!pLLtrcn$#bh%W*yLWtx%IdR#4@*3p78MfPVZRh&%-i7W2Im}v2RoXtCfK0uJ|97=Nk zk27HNg)80N2mO=Icy6$oqVyN4?cVdw8vK4gdIbQk?(7nPKfcNTeiBq zCsjI6clIG7moWE>1o5W?e#Ft$mctZQ&`MJSVX^M6dZV2b@wTOBRu+~Pnd61(G}N!M z6EP(2|M@DIodzeKOy7~jVGUAP^(jTDm9g_6qo#y{umxA#C2@qMXGLzvt9)28oZJzd zCM0LsRe`0FEx7hy%n7X>23rDqDb6Lm?`L!Io8b_en5b@eDeq#wGT##IN3fM&sdqB- zd4-~a-$n@mPqXU~QV(CkPbofghQ>VPE>Syc)pr;}`F$XNH9@YI!-i_RnXnKdjx*VS z)-fYfsf-$mryiflK)!?gXw8a&V09CSf|f6)+mg+k;F!daj9_%6R68qE{W)b4{&@-b zb2AA==iEN9cz|AIsFO)hb&|TRpkAzg1Bwq`+?+k(23!<8^N&eJ`pnF~pAGxJJ10*R zMDCPj6}G#mfl2Wbo-CF}BP)DHNEB=VZM_vLvTDwmc>O65#RuaA?lVOmU`N;b0&ic- zCUP9NFy#5WYX#e0Nl)533ArntwH3j;{V82j&K>hu-sUVFy42qC~ zH@|cW5>H6$u_lgh<88zfuEBdkOVZnC(LW>DEE6%*g>z6>{fpCsgs6blb`qfy9B8^{ zY-1ZnGv#D_{HEKUF2@*6xCHis?gKK|wNR+I#ii5+28#$juQ_}|5=3-`#q(TxH8J+B z<|;{A^o^HInE{?cMqVCj$NK$h5lUPh2VyHCZ_~7eSfF|JjtvA{KTSk9=iR08ccE74 z3V7{u2R3Z_ojqJz3Sd`GAWUN(H~dkV>FE!cc`I$fjPDM!x9zKU01M$Pvc@z&)tkuA z?;M~SjZ-;EzrSz+8%i+lmkDFvl^67rI8Ou)wmdgf;w#aB$+|DNTi@v$>O^jJa$tbJ z88iV&<+uluoKOUwC-U$Fk5R5l3>;H+1Fjl#$<42NFFU8aQd;A+LDzr6-?rwsVoSL^59y#{4BEwu z*-m0fcDdIGp{UJ&G8VcPh>+7HyJ@gF*~UtC^kV{+QSsX-XuwnheMj>2{6_-h^-NKCv;z9=7^*y|(y=GPUGRB=uS(gx zS0W;sr(r0dUp4NN3}5lijEvq6#@pyRa#l7Ew@|*`pR6uViuF>>BWw16p1RwKA}Tdb zP?dnsmg729KZ-Mu?NbT;9+lpOYHc_>12tTi@yl~xy&<`V$#BY-_OW(1F=ce*K~_%Z z*+O-*Y5q@>@1~{2CeTebK3$x@)OrpOo7}0qCE$Q#>Oki(y2SY94xrBd8`Y8VRPO6M z;Hf4(wHdevl!~#CPT#}v#$lq*&VKjzyj`nvN?7{dAupy4N`=2COM&Wr%ua7W$IcS( zK1~BL3eL7hB3@&A>*5ank!{rl++IJ4mY3(TGr|>QijS1qUc5bYzUKT(h?t-jQ!<2d zT$aE-cS|~9`ruN>V1n^^S!B!(z#W7KXw5I z?@sbTf7X~#+ZmVNXZ%?R$bI=~Z6mmZe5P?RBtqa9CFUUp$J9RwmU4GFx~5#;OnAMH zUk1uE2pd)J_x9jZ&1S!+9~NTYov!R|pO(gzwaz^DUc*etN99c3eyK~JHOvSz9L*!; zjkQ!`PRj;H75a1Z+zh>|L}mQeXEnKkEgpMaqRJ!=p5iZ5)pQgw_3dTMpXs}r4&Xqm zIZMAzoxAaI-OWRqTA&*+_Kl^rO8_WRQNl)C|8d1n;7U;Av$`1hD^LpwoR-XA*8b5Y zJia+*v+HtX3-s@1A<(LB&nO+r&7IH(+Uk40V}6W`o~N2oSI~neU+l-xAg#HMy3k3V2cV^8i!=}QA43W65;Ek#^_f>I9Z)}IM3cW+4#j( zG|ZW#sY*)1-fI^hZ5VcJLB)>O3)Bf7ipHH53MZR2Rz9zF+97v3Ra8(9a@LH073ou3 zJQ_)P*T~Gt@)|6!Z@)RoQkj9)QN8VE1Q!JtpY?AWCA$tA{W60Bt_u$dJ?AV}mtHyL zIL`aVr#e;GQQLD-H;zs3-tKgOn9`hP8&4=B7!78zsq@4cKCTWFpo}Y4_1g9iNeY8Q za#9j9San~C)+`0~;8gm4p0LkLOay+53%hFej6OKimA@aiQ_ z#N-9bn5VK5=9%9SEXnVO;;@qaL@D+G%5#)I2K*n;fiYV$a`$1&tH)w_UqF6dNX=Hq z&%6o*a8y7Kqi5}dP80V24xgmX#^bWsqNx9^UNB0ppDUG~=q@6nXs&h-A5O`JxRE8TjRW@+W^Of6&QN7U_s&2z*=1vextw$XoFQx;jW!xpYYt zp=a+;Bkb@9$yR)4yDTfHZmS2_I!FMC;|louvQ}Cy#d$$NkDZ5~Fv+1LFf)AET6Fq9 zMmrdPsgVek`Z=czdj+ggKg*dDqvQmU0TAePMSx{Ykcx}i?ZdD`Rh-Ia(b=FI*Z+L# z|MT=&UtPv#aB|lG2=;^bhRx+!geUVU+X!8UGLa7b5oZuRuJ*`d9=lilGGd%xP+bv< zAV>QbicmTXO3Zq>g7l%h^HSFU%j&Z&nf^T0+;xwz|-0o#T z{U65O1Z09V5&jFqcmB`%4XzP~b@pxA8L|CRsm7877MPp7m>%A^7XdFi&ghH#&|mB;G|HaEbF<45eV z7U%*k9C*NOpMA469BoDH32wo*WEIXqbMW2zlf5k@npatpM5Lp!X=y@^$A)g-%ZcB0 z%1E0>zE5w#6|9pp!%+jfQB=5#p@IB3Fq}XOtRa%Nw?*CIbjkyV+U?Yz2S_%Wl0qq8 z2MAI)bkYI#%<)Mrm~r88TqrPSk!Li!UO${qWfl`z!fuO>P1;kHyQPi6TBdf&87Vx) zW%9nfOO&d|4ZGGU<5gR0jh#~sxY|BGUSIHmw;-redgqAVkkx^P9t1HB{@1-Bv4;v8 z7b*vjWaz$3*e7(>d|jf)ZVs|NslBxeD!-3$^Crd~AsFe9xTix24Vi(q{Xj$li{lY` zX=cZPKg;57$P#p%q}fj020AMC~Ho@ zV8}sMFW9cOBk#Mtg`!VE6+msTZH<|16#n-V$WFm^Rn9)$)Rn`!4h%NR9a$gXmil23 z$dFk=A0XE4gLDkDJdR3H!y+t`SI-jB26!U^!ty}A3cAf&XWl#PU2W=8eJ!ZL1RgpOZGW9UDy=J_i; zoGYlxEeQ2LXaJN*Ptu4VAbz?c>mEHqc%a!RkQTO@vz`f`O%j~3ODKA_m-zJ`Cjyv_ z{j2gkvxO>dK5YWASUC7Y$gjL|JtQO38<}ea3d4MR`|>t^K6Hcyc1~e>{Zt)u=4cHb z#zgp=!^ik5B0z<|;!iDJmzKEQbr+VK1=-Ij&x~yjr4d=WIvhZWVKmJo>V_NmT|uX7 z9=S_=U0>0@F)_wLouJ@`+U^1{jL6b+;4GEr*-;zjUjaj@H-ATn0QFt-GF3*5il|CN zexkCJB8^2xIe;QbO-*BjqKbjVco-x)w))l9{;R686sB|v{=uj!>!EcDa@_&xD zb3_!lz(@A~4f<_`=|Q2P^K)}#LSAYNNsuTT1;vA;9X3nKb6XrFTb7fn5g$*}o{f>N zR8Lp;{OoYu%P^XtW_>}{puTADPJ!#OscYLgN9~_bg$<r10QFmelfDCj-Xe$6Ci{$!YT%ttfP$uC5M=2=eg1B0%-xi8~$Lxx7Mh z2s<1ItTM&_M#npLF(4i;VPEF5@Nz<(uGN#r#5pmVx0;vo#X2DxMM06&aC7LK&w%?f z#zk$}kDr2Pg(q~B(pv1oxMX-s!qVD$r0;5Ehdr?0q((~~F0k9;TGkYsmuZhx4SPw+ zIItV7QOI3mndfNa5EU(Se3SivSZxU|Wi(g0go!(}=5zkEmF-$$QOm&i&Qp0g5qHM$ zX7x8tqJ;iK*2_avIsX@`RQWyl5*n)5V=Hz-y!PuQ7Tvy-6)qj!(@sonpQq9H5geIR zlH97dd7~)0^$PSkA=q-kvEOsIGL34_CV%MZJ9e!5U;Utn5iKl8*ivM-B@F*EBHrf>eRT5DOkKGY z5ruurI{-5H3#VtJUAMlcp}=MIPW%t2Gd4Q9?a15tRl(1PH&C(I#>TMC>$bGAk|m=T zvTi}XO3CrD&G9i#e=2g4Y~j~A+&J8K<+*wK#M}DY+xmJgq+r?HuYS%`K~nj?iPl#v zp^6@YCVgvt3$_hn3Ir$vp`VZhI5_e*93>_D$Kb(_kB_&vx9ExrL1MWNu%8f9Az$l5 zoOJdx1eWOIkM#l6o!l*;nowO`jjx*uVFatZtjXWc3N2B3&?Ac+hpb;?ix)Y$U)wCm z9ofIw zZ9$fd(cMprB;1h>jdHp}%6~MPAUEtac4=zcjoW!bKf0OBmdBY=XdxhPRy| zEL;i0drk`^Xer%hP7D9RkN$fwUds5^PYvSAtsZ_~Btq&PQimMk$ApBSRP98qO z3H^{7WDpwF;o84X;F92_Oj_17W68s)PgHBmpRs=bPxCP>peegf047K{*dCuQwq^@{ ziR7C(-i__kVxhY7L51H|CICn)V~-g89{6>s^4X%o51egDLjFQ^ZWew*H|2`HKNX&5 zp^|#1=bAv_Hv^k>T?OLK+hZ%%X%;|!_Y08l~Pd?HE71}IVUg+(wm8HT>I9g&1Ai$ zF!;wsF}=w$R>lvOD=vyzB_LYBZCeNLgX+w6tf2fnH_grIOq4na=#Kh%kTSc=XP$b( zMEN#7b$Dl0@E01zR?9TM-ARPaM14Xdeon|9`Z#MPTjg0BAbKvFxT#1gda$K$TyR2% zA?n0wVd>7LpTU_?fMZaK$HUGCB!gx zboc1!sKwls-SEJ;TI*zxEQDzqJp$IZ=+tSnr)npeJdR8_=baJq(*B0|Fn9TOyC8~U4OhnfsxQta1UU&A%R^IaJ#C%)La1@aZV&3aztfAdLTkxCe%VejG53|f~y)qO2I$9cB6Y{1U zpFHxDhXmgp&*UT9(!4`SN+ap39!-}JN*oD$oRPBy>`%mx&i?~MsW=icU2rGQ9fEDG!v~Bn%_!ey#~3JZ z>CUh)FnnfJC{sokZ5yONdfk4Yud_2rdWeA_!>9iW4i8WP2WaR8M>NkcGG-Ke~_PCMOpQ+5zucM8(Nf2RRNYu8qSs zvsZHshca;u0309ML0jY7LH)I6N+fAVKZ4Hd@h0nq7zI4|IC& zk>`EvnWbg+GxBDuD`zS(-qlRMtpcw}21OD9va@6@OpIDKHQS7pN77W zu1$n`O^!T`?1C6ZwCV~SST5hHoj;=>YA}9Th?|fiy6cWTH+wjl7tF2v5GOl)E)lix zg_7FmgYE;OA;rs2c|6B%4H`T@qh?BoFqI8pBm9Rtqk{;JO2-cN(f}MAL?B-E^8eD| z5J@_X=lwj@M})vKkWlaE*h?|GL0Rxxq>2Xiw|YaVC#54nbqm$qEN;l6C{ zXCK$xOXHGa_aC?o0(R@HAAVV({O=eoV{DR{9de3&(tU(!wCLnRvmc)2xg0 z(^VmDR_n3vAr1GX+Gn{QszKk^7YdjNeHR( z0|SyjLJv9l)_1s$@B#9`O9hlSq7aeL&DhTwPtJ7sr*hT9J)NPOWe7gF!T#v|5SDh+ zPmnVqP`XBhmk$K%65ED>m*<-gOepVoQJo>C-XA+UZVU=xoSXH~dct!Uslj>-NwT}n zl17ZX}boh!?lRSP(eI-UE`81`tV?I9Ej;#pewh%pq+@Cu40lE-5a8re9& z{yMsI`e6FaFItvZhCE)JBDsb;73||-Ml`7wvT;vE4dKmDSLb49XXoL$SEt{sQ1D3# z>x9V-4}spju<0fLfw6>MkMOWh>4N+D^lP-JEHjzn);bwwCDd~MrTWLWXK^*ojYF6T zp#Tkb*Zi-IQGtuR_|Tz)zqJNa5I@O_EAl+0HE{)1Q5mfS4QcqeJhsaYqvEa)ZKnX) zrk4@-xS_T)Gk|J;@#R2?3s7R=U#(7gjGP0qFBHaI(WMxW;Hfiwy#duflq*?*x zCw_l}Ush!hV+SEhye)TYe*U%_Y33IXe)xA2AIyL#9THjb875&=@fjT9Xt7t4yU;BN z)-dDp8$#v2i8tq;i0LLU)pXNz%&a1bLSMKQjGKueL(E{;2Ifoar8>!k#P%U&-jibm zn&B4{U8uI}%hTti_>7SbzrhLUlVfuiAihc;^w5!(FpYl`miQ8uI20g9!$X^@GIJ0R zvD{L3ZEmV1n>NsVx^$??S-trF;Xx=Ssm(+9-d%-KFXw@i)R1QD8fHi3(v#%>(1mGD zo|o!a9bS(n%gFeKG=A=vyQBD3AFs3pt$#o03dZPkPS#)%x`or=mrpueXu^97gyL)2 z*f>jbYl#hvq(`BAdON6QH21{oS}}Sa8wn8|!W@~JpRTQuhMrnl>cPZzz@+#5EDIS zAPJ7f|D7zSXyvbb0J#a|S|g|5lyQ*d$Fk?C|7H?Pt!?<=sECPP)D`RqKo%ac4XD_{ zQK_w!HNK|q^Q)ZZ#X`I6P3E9c8u2hSy(*CJNE}YFzxc@XMnkS87%ocjkeztpp?4;y zLYXj(hle*XI0&)DEG1Rs_vJuLtoA;gO&aT+mo&5}E_0S;r3~~W)6XgK^=?Ru-~{jn z>6TkX{JD&bg99rh@jkAhVZZpAxd6QmSV*Vg9&9BMsX!eI5p>Lm@0M^WJ|ygomnV1h zrr8N&NavmrFu(j|RV&!Pvcb@$u~e43AlcB>jRaono&nA`Sa2~fy0p)wzA|fZc%zp( z1t7ElBbv*43YgK726%OoUfioWj0JNuR#b^1N zOEZk)W>u&qi3v*JQ%rVK(dFY>{n`uhy_mmeSrD6{rTzZHUTpE&_jW&lH?E8ut*2?Qx)8pMGZw|l%>o3>7ZiFzQc^ny2L~(Lv5^t4yA3^gd~9%y zXAg)uv`II8CY3=4q-A>NM_=6dDgxNt-x3vLzmsa!qfYSOj^kHcvXB^YuAj-6!zv*G z+KNx?8%oa{ktT5**o|d8LM=6d|A4wxLRK>`8tKh@3%1K;zJ%WDu_HK{zZ?V zXE!q1kgTPi$RN6>r@X1q^SO*k)y#Kn){subwonwGExzA=wR~eTa#>p62Dc;|fA#!x zsLbpw>GQljQ8w-eL~#nQyU(G4JC-crSyy8k=N`7wS;5h7ea6DTQm4-qIWhjiv)aG% z?WMQ3_eZ60eI}|~hf@=sMmUEec71L$;9)NAHCaH3&i@vcUQR;RPe&GqfSi1ty|C|9X-!NN|+YJyUl+S`LpFLmYw}KIUBp3ew$a>4DwxV`xbcf(xXpy2V zMN*vNUMNz$xI4w&J+x4uXmN+)?yjK}*W&IT+?|{Eob%m#?)dU!jU+!Zvi9DO%{kZe zEZujzy#`<>Si@<-4Ra);w5tfrTbH5`VpfP)otPtGQwzFTtvC{ElOIZr>Dmo@$zcM!o5L=wO19%bo zngst;%*q(?Fk`@TaFV4dL;RtY0E8ui$6LpHii?ZQ@np)@Q-NgZcKoSsJsYpS9@FmE z`Ssn;IlF+pP7va`?@=EO#FK-`tcZ=4Ub-_+q@Jk>6di>f3QoM?@? zcydqxY+95zhvh8tYeq*Y*p^0M z0}s8IU2`wKfXO=KOa2;lu+QS8;|pdOL-?JGz+|?3b^vrMyWbT6XpBCcvXEHqlqcz` zf+VBn1F0JEjjtMPX%_p()UWc+3nq-yK0pw(=@Nz{@!eUPU{3X2*o2I+eO#n#p#^`u zmp;m_WCIl?ms=W>(^(XzyG-VTho{QERcFqn>xAPJ!*-wl^B_3ZghN!mcXHvA?Thcs zh6lX<-lK1%hSZiK!od;#~7RE^u63vcfJt_>wsNWLpam3e_io4R9a+ zYWe81n||lYo9@cMLNUZyD=Yi{aP(5sm^V{{jeYW{nD;W`5Ha2eg16TgTv3W^ICG7CwHeKnE9 zs?~GZHbXG72db_8cbm0|Ygp!Bc4%kppa08J<4lh``gE*&`c`{=cmGmgYRgXjaq5(u zdh|~fYp((FtagEKYb&J566HiF49!M9#wMNuSw(9j=?LGXjK)M;cpleF_rt_Ba$K20 zZhbkZ90GZI^#LzECsTw=X|v(EvKT+4Rv_1o5_O2Pf@b`{uc(C>#&lqwh)gnv+-N@B z$7)UK#(qg&;WGr*CbYMh(@_h@lw&Epq76bCjKKzv837O}>~dhCxpMIP8QwuMr+=SQ+#hk0Yi0kzFwfHA62^{` zn(Jwwmt%hE`+EFvY7*y_q5u^)8o*?k%Ae*^!RbD``+{b#Ql2$i+NMdcpE}E5#gwtH9hRx z$P$S&s~74jxXzHql7?Cu&qAY`sA#l=cuSQLBnNi;HvRs)Y}jU0 z?L?YLL+9d!3kkX$Khi*=i{%ZH#@OE8adtkJ`H7`6k|5`(_*u)D@|Zu8xu&vfuOJu=N+!aNq1ZS@A&zJ@ zKG-E1IcSsax^TRzbtJU*#xb|&l$T?*1OIBn23H3+l?^!Q@Alv4kCl!Bsh=W+KI9oy^_FiPpa#n&e=>8_^{!lz6qGmmtRybuk zh8@o(Xy2H-f{g}QB@|#bv$4H@LA8QKEHObFUsCyHzUxrl+GOKFYcT8n=)wxVZK*JS z;L(X0_EPLEt9cqmGP2HW42{+2As7W34#vv7y|;=6}7jLs)&Zp`LCmR7A?SCs5*d0b@w!oYeuB)?AiRd ztI-BP&FcvrQo}RD5&{eDtW3W$$7m60aLK}->h*`9 zh&;3$KuPD;!6LM2AiCO31A3TtFmV5y4zgrDURLxo-?1s0eR<}u@)_npaez<;N$?}3 z5Tm^r-d6efX9+sxGg(;-=h{20HbX;SxwnjaRM*wRAbht6em3G23Dc zA%&O@al4^y$*k?S=#GafGC{EHt*L+ed?&Qazl8R~<>q;S!n|KjJW zN#5go^%t>0yxJ#=^PJoCB$;ZI)`1@6Gk(VXog1Cw@H(?v>lCcf(Hxg4!v;8F(IS8lkG zj=lCRmsvn-k*Pnj-$0EC>n4~qVr zSKNk4`x3KB?ul8%L#9ct_-5NL^b@9NQ5<8u48x{@S)N#}y1f64U{RcG-WjopSkF)0 zl?%3a-fKTAZjljkgw|OT(iP@dX^>oeU=0wYOP9z9^qFFcLT*P0}s7J|Mu5_=*aPFCDCT>CkHWJH45)x=CY143Q=iG70=@% zms@$}9R`%T^GVN^71gHCxR)S&&z_gil07qEdIv8um8DJjd7n zNI9V?N>yT3yuV^HKg-xWpA?lK+$XT)<;UUlL+THM>c3K*C?u zLqd%LW* zActpTe5_5usJu$+R~0aEI?VwCNUiqK`|`P)JFx^cc(_C;2IioB4JIMEQGnNb_}^N} z>&l~~8N`EVcRlL6@2(~eB#~K6a=HRH=g*G#t38t{t{1LOlp3#o=v&wpKbO6tc+8^z zNRO+QAkwz!gEr0_tRvAi=zVbeGbyrr=l6_Rwpj<_c$aHoa?sQ@D~K(^%0;LYoFzP8 zer{=MZGZk^qs2{19;8WoriaD02DCLS?>_68$oL4k)+XK;WbqRiN}JXb53`NYU? zzmEvt#JRebt;tT@GW$i+*Q?tNfv+@%rr796iq;@3S~%}-YmF&kEfTnp9)`YL~FkFOdR zL!mZ`sA%(9Gpyg+Q#RS+kr|@FBb*YAp08a!=MIpWKVihs2uVoT{QK*Z%${MOCFBqjH@o zKq1=RMiaSUNX4raDzPWSVVE3AZ*Me^kJlgNM-h!np6^Z?kfRE7mWoR3PNq7QrtsOf zb?8TrPUD$8oPB#9iSQKhvY&qiQ$c4{>VvrT0hl(Q!^5UldJ-(httc@vUD&yJeWrc( zucEwsRs=cz0jHcvgOfa|*JSJLVm2!cGAzLVd2_6QzF_|BlW1A+%wVB}!=SXYdz~>x zh}#6;O}|uXOsL(P@TW(`UR(-&Nn*wHMu$11^*pd29(JU^k;fqi#ZQq`$#8X#LhF6tz_}o@ zfjOoS0TorKBkm&7F9HNO`u|%Ieo;et-E;P}Xi!vF!{rsn5vPq$rl2R5nqqGg%picL=cXN@-QGfP?)q5)&Vsp2zO(Fz zX??wopWZKkzDBo#4q)upVXmJh7^X+u#`U84+!vQ(MhVGCa-JBwOO00R92Rt99><$L z_U9fa*BIe9oAUl%erU^UYWj3;T^rF9wDn>kcdhGrYgC2I=EGx2*Ra;L)qGfinL#1i zOaZ?_oQRg4bket7MX7WK#F=!TykN!l_p!)mcn0^EwTZ1Fp;l3#RH4MVjQ&z1h$#_$BW3M8Md35#@p|!rQJ8&$C_6@TQN) zgm}QR>qVF_#P6sd=S6eWeDDe?kDUnSSCH^2&ewz=Q8C%wL&{NUKb9|&mV;1|vkN2u zSCiwGj1<_&m*4}M;6*iay(vMz{l8Vcgg$^wQ1tLuP*VFbwy20B`p{eoLWwB&u~YNT zYzh)aYX`9OUI(-(H(@fV4poCt>~r7Zep||Z1In9^!YZASK$5;}WB5HjXERRtDRJ>*9w_z^lCt7Zc2;I;lT9DJ0S2;krU06fsAIz857C)>s|zm=_LEZ94MvTn1e1V# zW-$V%pQ!+Fw&Lrw|B(2Ml_i+8ddj^(9Pp!*>{6CV@%e0o*Zu|m_F+thV~$N2kqR$5 zY%MO>qR55Px{TZgPjI%!1`F#bxKvH~%pnD>4<{X*#!?IpZ?SX)q^`Y`tkfm+qR$sT zh;rVo#YR%--l)=_Dxmr{iE+Jf3v6M>A_N->rkRG2GKXam$xDkX>Z+u#8=D!rOl5hg z-*^dcT&IK5E-PYeaPTk#+D0N>KigJT?eEHkk^x-D1swaPtW=tXNhV+bd05Xmw!f@p zgAZhESip@WTKk=}XdHnPlR_Z4qhPj&LM3UkiMq;CkI851D|Tq|PXRlO({$&wA2-;B z4JK-{2KWag#3J;o8kaUm=saWY;l8*~p)Vu9!1y95X`>1ewT-7FS$kG#J3y5%-JrZ; z9_%JZI<>Gc0OyOMLYBR@nteHZaeNH-giUS*QciTXr3Ly)a|Qr5;!BJT1N7p|bvZ}d z1Awi!J8*r#j1XkzXArds4N5Jw9O4<)-W;LOXz-caplQNA9Qp@PG?QOt^IbMq`M-f3 zEX8R^nzg>kjL1L(66T%d4{M+iU%0amD};_#l0B5E(cJE+kTl^C&UytfFwhqX92W7^ z4Iu$9mz)$BD1T#Xgn_V_%U*FXBqLHET3UO);ZsyBL1h_?|90&E%e^miZ%&XMT;k;K zQ{|-%#)F|^1M9KexQIN}4N}GD@k%r_5duv=q@bnV9@})v(|w!sg#^gjy?v%|2je?v zV=37jD+3Is97Gz@d0#-HEZHCYo!g@7zMw86m^vn=7|`Ab3l40{gqt<0B6FgnNZU(` zE|xKVUGKfPD{P`d_w72HrY>niPWqdrjRE8qt}c!cKF;Jc2FzbE24!)D&4!Gv6sVcB z7$B%?PLO*S$Ger2(qi2~l=Lpa1m7ozz`MHiTQ%s5nRbT*sG|76s~4+DlSZZ1Egy7; zo+9E?cR&iV6t^mvjkBBg7Nkg}g~3>q+B~XKB}bA>*a`1}m87TCMCNI!gsj~|WX3wP zWq~YXGh^>F&zBS%pDAj$O$CTLoL|d4OR5*fvlc}o9T`-4)F3?0UDeF^!_?Bw!$-a_+A#>`q$t&kt|b?Rh%lP} zSA>ai|0MJGZIu`c3W=Hc3ZJMR6OpW$Q(laVnqL>QzmDLiTjpA6#q&;c_iq15jcQ_`(GgIfV1ofTeqcY`=16(N2wA;fbqhrm-w_XA9411s2jfwDFV?e=~Eu<|!^ zGkexBM@az}j$psHT*0r=fM;woqXTaSdEPxXXxSAbkpot8msaPowJkx4fS|$^yugWW zyG2;QNQMFqc3>TF{#K6cu(7EI(2p7*#Vs%U!7*zUY(E#(D1O%?nUr{O!bEfO#r1wf z#wFqpnMo?$@EEt%l92 z8|FC09#O0$nwS86NA)ZgmUpI2$!(fd-Hov0WflgP$jbrJm=+J2-gbjHfQp>eHh%Ig$U$fY8B1wTw9H+9IsF|#T1%#0lx1tb~g1Ww7A zPbn)oRb=(rPFA7*64X z?b|qvz3~;joTa&pv<9gUxLdyA+wfGEgfjg0(>eD7ikcDWBsb*E1CovFiox?;hJ}gz zI?;b+t0LIk_m^K)Y12pW8A3D=SuErY{(rCN2;(h{ldB*0q3Lv3xGAxX66a3l|6w4) zg5Dv53$0<#h>k{rDbSzUS2*?3?~{2ST&@G6)gL~p1f892{~D(9IR2U8y5AO;d$DMR zXo{gE0q~|XvQiT5d#PLH`?V*o6J*D#k%eD&dS82k;__+7Zds{R|6be(gg#n7jKq8k zf6!K*Kro0K$^?Z(DyBQRkNw^RFuChb<6Yy=SI>9P)s1P2*Hla-K{Ia_SnlC!l%i1EsqM?SkVdER{&pTs27 z_v|Sg8Q1F+_**)HH`E4%FS%pkLQ?I2iu_(flDkFq4i>R{-pq*tebPD>vBF0#y+vsb z3erU}jGafzVqF5Vg!Rm;X3o9_Jb2i59C#Vpt!!BXZpClYL+_RODY}lU!K| zLq*}^@#pjG0aCUfT;<42N^zJX#0P`Ld?-QVg=ibVk8>ZEv>8f`KU36h1$@5Z1AB`) zd7odlYtM%n^QPhA3T=RZGzdl4pnkHD!rdtlINAJpc`WPG(M49*;C<+k|MTv8D9zy6 zt=)@Sv?_cEuzWyjpnL{t+WXoyn=PPd71Dw5>J-H+eVy$ehP14PyuO(jB6EZTWG z&wC!a4s6NryL72{1di>vnWN7*pF@MSH7EIO4L3Tm;R+s~r0<+NV(IhYD(f7|xRyc9 zRO|}l|9ZY!DoJk=5DVAus2q8DCypRlC^~A$r+>}&HL0PEM6&R40m0HwLdZx*%M=7~ zUM)yTp(XV2n{WQrE~wMd4F#xk)o})lZu}py0G*j^kEjoh?kWLKsB|{CqyaiB^xuCZ z{8-DYf%){uV8eyOH*D6}HPd53I2Sj&cQ2BXWYumxsCSk(|nFurpL{L0yGbAJ= z)XHMi|6`p0$50>M=WYJ!7w?UtkS#Y*dR!o(cz$nYQrcDw|GR$vou7{9Rc-N8hpnKh zlUql-1B!c&izY76aDk)hosaeHdRa*1%)H~_BpjUqtA^{^s}DY`uAw3Fbrl5|*xTiw zVk*N7+uhHapdZn%r00r|?iZkn@B3z~(@9cyg;6;|bI|;(57vsV2{{ zTAEp@pIXmC!i^Wgzp>&wAQJUugKy?ya!y3|#4g41p|2kz2TEEd1ysM^%>qpUdiar#`Jt*ti3V7cq$JK^{< z+g-G{f?-Ro1kc+0`a9ooXsPw~)S1`bP>gfB14>)A`|d)$=W%caUy>q3dA{rm!3aO} z*j&S+-j1^^dUOS}iAViU?Ss8ykW`hO_6?pa;A-!d$}*AD6dNyTN%L}dK^~> zEB&+eB-6&!FmFmP;G1q3`O5R^rjhS|dFXTHv+q^Y<2UAuvr||dms$O{YF{6`5`mO-yn)=VMo%^5*S0xqY;C*gix2{p4;I=NUMZ~4 zE(d{;8+KCrSJ#af59c0JHgD0MRytG;n>-&X#tjO{3R2F7Ygt*ronK#TRNRWUel@ez z;TQ%0vrMCPX8^jJ1sBSB_865D51!>;3IMbxl0RbopgzRK!&tA(XCw;ZF@DYZ zd@XXw8I0(eLjI*=>4mFr;vh%VQPb1T^{iNi<%LrH#9qTlJp7Qt1?L+rMHr+iAxfQMQA>GR|GdulJn2^LJ=jMuh|Hz^TAI zdM?j!42nK7uc>;lc~RoZB>J%?%73@S)2^ILg_bswUQnCH#@2Q*nB&`YLPq|Ky8_c8 zLJEjl&}4vAkdwh~B?*vo9WM%6AyHo`IOsl}>1;{D`&#f2eXH?oWN(q=F5&u)GB1Zj_93cTxk5o7^jFOSlTU z>(vv-v+IplSE4TV*2a&SL#{O6`xzO>+i-$3wKsei256Rui)EENN%QH<%l2;8=&l5c zbuV8~DiOh_8s9f0nS1Sk1R)^m4C- z_vEqn(tFjhpba#710-@FS93obx6jQpi}Xl9MU*h*FF^Dl&jbs0BqyR+ys4bjCG_ZX z#2>_p%r?6Ki3yN0iNulraQik-j`|+qg=$Xcbag&IR+ETMrAONia03f*DRs<0-UoEu z4q`d0(7qb}dS9!fA{3unjCkf|atO2xZM^-zwV+q>!gapxAc^*Apc-&^aP>nAa@dJd zH9*Ah){YS5OFGJ?z2UzLkGm4mO(**#qo=0DupkUUu4bNGh_ZBK`RTu{ zn5&9@zS4KESG3TNI_-G+vQf@Id6f@-<^hh{yG{6(m0`lw)4Z+Lg1ts67h*DEimwBd-9FCfHfvTR>HkSW zhEXunKw}n0!&Fw<-U{Kv+G3|jUXtECqX zj)T$~@vEg@@Byh-n)5pw4&5)nN=n%8;fbYR4SB z{_6xFwQIs&0fy}LKxt`(Y_~FtS^CJU{x=#zxgm{$fFNI-Qz*HieYvetlQAWpQplFf zizqZhSHzD629BapYg!$@c(_|+Fr7$DOuR-`4iGJUiJ{K33y@gL65PsWe(nyF9W;i@ zuIMco$D|g+U>pdS{2%_OUy+tpF5tvIcBx&3Vk6=9Ok}?1GcI6Q z;<#0U!t~OqsMtsp{R?7x6d($D>04ux$Z_?Fs{u&uRz7?YdUFh==bNmU-i)s11Gv=_ zxk*?>Qk1JJ8~cbD`6kn+a8UotSX?15hCE*j03L$UbE)NEdu0PfMGVy`c>$|Hj(e=3 zQX4=a~+wx zfgI2m9E#s}!gkHS4M$g471|f-HVGewK7UX}^t*~*7eZ23z*G5joCee-^fX(%wD5k& z-FHEAZa5lR0RC_^lZVFur-y$|gQpXq@2>Wo%rC(_hc$ya-R~ie0*5*NQ}*zu;f#BB zvf7^1+bCA}%@1;}Amd6SypdoV6;5WLu{cN~ofA=mYb(Xvr#DQ;(mGBT<7Dc5Y;#ut zDk=;hNHiaEnH+gJ zTinMu8z$$Cl;tEo(7#9e(J8#9AH83KQYxa~MVfjNpPty3I#~<{VL%bxABM*naHF-* z1W6E9!*}wo*lO&3)oK0{v1|@X2}1iBEcd2RU|)?>|0V3#guO_5uH%}^F6PT69JyKY z=4tm{3q!~Lcjbf6f!xr5>BZu@CBzPb)+B)k-E(64A2jk;{p#$S+BoSOj+#z2Iv06y@(XVss3F)!d`!BeH!*eD&>?cBp$!(%5 zmb%c){;Le&ppa7)I8;ehBg-%sA_brRPnh4l^M81nrAGxgN75cP{nJ=$FOl*6{?@}D z7PW?JNWs`Z-R~>K42=)&It3rga@d8R;lEi|1a966tTo5yFKfHwf_J0P15EGx_EhME z^ZXJC0n;R(`2LpO5=UCJ(iqWX@A~|QRoIISMpOV=H=xGtTXg?ZqWH0wIP=}|+X_?! znuJI;_OdX55Mr0`A-rcT3Y}4Tx$?|gC5`Gd&!ur=y+ULqQd1hVz_^spN|eLm@YOG} zE7)qPPFgd4yTwaKV?rjZ_RK3ca{~-$_U7OQwD_WJqDZ&uOK-%5xb|>ZcnPgCQ&x)$ zttx*(T~l4_#aXVsk9LhDcW^LF<4kw?{3sOr;k9YVe+*DprXA#-*N}S=@Y!b=Z@{?< z;uiao_J2s4|3hB?4}~p2O?#B-=d`PG$&)#reBgJ}_oT*x(1m_J(;mWVb&V=6YC;NW zrhN1rw-<`aH2lUIlVpubaQvT0m;3iT1gB9Cto&}p-{s-}XX~J*uk;VzvrEi4!EG+0 zV?YMEsA~wJEX$5caqma(W=v)kGU6zKj#H-z^6iq>Vd}evyk87p;Oe2MO(KzT3{Otw z7>(rZfBoN!G8De#yLY~4Nzrchru(X+$D}johUvNPaynfTSQ4co-VIQ@Uqu{cuC#cV zXK^3sx_elB{D@MNfCz8C%EssSQR#X$)bq_&mcE;9VR*Jez@nhBiiKO}^1pU#733`b zSqWTp$mK-V^uHwfNWCie)>AT8o`{A;eS>heCaV-UA(}Qwqd6>CerhBlBNXPyzWe3EahUYt=#t@-EnX&7bW)&P zGxuKa9mhmU3gIHugDLweu4`X?p3y|b<>Qr)gA|!H>cW2;{_EnL;V`5pn=4Rxb9{bn z=1*b_YJrVBkqMNsQrw6>?q3hB{gH5Amqhr%$p1~%+9$_VHq1P)$vQL{z}XTolGl&@ zu!4Ix5nr|+h6G+7vK}*ditVj*1PdKqx9Z&8?JMr;v&23+eLugX;iw`90&T7o?}O~@ zl|FMJ)Hs8(p?jIaGU2#9KN+7h3VL<45GO+xnXSFWUu(4Z0P>-zz-E^vBdf-bWM98~ zdwSn1KAWoszQX*_r*gN@vGC;%?@Sgcz4i`84*5&JLb4L^ilFZ9`XP>|?Tw@o?nT@M zpT|C*+hTIj{3jlMi@)tfdMl0?WRRjP#5G`6UU%H(hdS8{+*$0kk~{8|^<+fM_3-1# zMQG_I6Z$}`-62Mr+dD}BkW@M!6Ru|N&cb0c>8oYJ7pBAjb(VU}R`h#=CWhkznv*Da z3#^V5;Pihm{*w$Qg(qQp)pHuW>Oh;-GL;i-tfJij^ZG*|yCJR#86YS*nKKkIkYI0Y zfj$B{XYOLbzoKJ{4f5Exi{B1bJw6`9OACu;eua0Qr<(Ftqc@l4G5;m>8^IL)nX|M- zlVv`DOI4}1Ai>#uIOmlA9$r+Qwvcg`#b0l*KE`B-91#m zbT^#{$!e$T$Z8)X5T))euBWPyK^Qx69a#l~i^}#;#G+4O-m}og942s0c)&7ryCGYQj5;NdyQjmUk zb2KbeucROCM^o;)x2#t4^wOU)YxOeks%%257$f{|{byT1P>6Ci(>2GPmMJn(VO(oI zQ>Va!1XL+vg~3pIfMsCn$HRD~HrMDv_Nar}Z?FJ(xja(&$dEEbwEcC&E^x<2b-v#HLZ$QUf-Q7*uysIV0N zb8`oh&A(D1mu*>N0;G2u0Ixxa^!Ox*NQQ^uMUZc?R9j*2xhEZw`1Q9rn7n+!4|I*G zvG{_cdKv1?K-{sJcZS_UdV`ZZ@YW5qRY~R48l#^x>}a%gUtgD&TK==sSR^l+Mm+O= zkUf9xw78h^`4L6AU4uEWdotvY%nAS_d7Uj$lymOct*hSW+O&9olUdkiOx{rB7`OxaIn-LSnvpl1eQhClI-o_x z&|_OF6P8Qbop_*dREE(m1N74UXgU2T4Ha;RS>KR=DY&1fmns8MA2xWpJ(AKn7CG8K zaAO-b*HN`L-H}QLjGi7JOWyhTTWM>bW1HDn1hon0Ksnj@T=TvC>T*P$6bPVI32zvJ zKKFknr*-ps{~k@!4FwZ`gL5GL?h+iLl^Gf{jl&Y2pCgOe&Fs=!xY>YJKgq@S;-G#v z$I;i&vMM8ByzTa$nF2e=#YnbtTtL(y31DlJCOgzgv7iX>NJJUpdMU*CdGYO3igf?N z#KE18cnM zZjBCMZ@kFa5%h4QzsfvtlKA}S?p8du(>#~mJ!emb9Gj>rwoi{>G9%)64|tR?XES$i z0S5nQdbET+0!rWX>Sol{z3(;&REvt#o$qj@}nB&p4z0kI$h|CskF;2279po8S zQj)xNmGMx{jiv|u+9TSoG<=lf z9Ss*A0|8$a0~3Rj$Pq43I{ky|=#w}WbP+N3w)$|Hez+^Ft0sEfGa5k>l(Lgq4ewj#E-s zzgMFAM>Ig&VSHH^*@`R_seCEawv$Z z9we|~VG%6q8+Vh(i)PoM{LKwUzxumELO3UF?6(Ke46IHeK zjaYmF0?%)tm;FsrQH*Md++Up6KkSl4+j8W=b7I4{wtA}HVyY;l8NRnBySwrlQRa@hMFtR6M<~-5;ffHS#V4jzD^R{A~23&N7}k&mUHE&$@8`ZWVMiKeK}|sEzlT@Qkym>B7U>@9SkS?K zI52dG1#-}k6%q06dG5zHVQWam@xB*mFBk$PEf6)PU*Iz*vKY3>4_(QTeY1IM<}mtY zf?MPHJbEZQN}l$u8b~Kz=jW=)S4CSE z$j8A{On5$B+ga{Bsil6H?E#f_9_(<^4c(QE@X zaUJ+#^=OsfjscUg&rx!-ESlCZPaW5o6YAn%n#orJ4NNP1hIY@(9kQ%ukx@Aeyj1eK zo7VC%W?EwL{RiP%INOu3hbB+UDUPw(Hd`{H3Mv?QZ(C&}A4DY!J9D5pJWdX~*iryb z^lAD_-2P41Ip-tLKX3EjbZ*XDd}Tw6uGVe|au8l8@>M2;)s5C!ic1vp4xHlo^Jd#& zIM}J#o@_fO8}>G^TYQI*E5Uc2-co&%X^$aj=t=-^Nzu-|&U;XR6G4%D3p<|k{kpoJ zY(EKf2Yl9VG;&y`F1~>pz2bC5ta&vITP71}!6QC)3Aw-VV5ff|qAvfM&;j55C&B20 zZ030jD`R07o$6A= zpdgU-%J$E@wtKadwqKkbA)2BjD%|^~iD;E31BpLvSVaZnW)@S&VbbjCskSm&X72K0 zL^q}sS!hCKXgH1*BRIR=u z{r*m2Z$@}<<>T95#Yegz(IO>ZhdeQsUjyw50#xrhm z6z#L9S?c?uROF}*ydxk5@^p)liyzWI0Z=Ji1Dx9D`NVA1A)yQ3rpGhgt+0Ea(^rG~ z9RnH?NHTe!E^p(UlEp4RZWSLt#>4-^T$Ao{jwojAY)+1+5;_zf9|+hZ(dpH7=EUkF zppXvQ|IKo@%gapnpzXuSp564LcV3LF{1bzfmX)lmw-)s?!%A)>CIIVG`zW{EoAAVf z_LN#0)eVVfvFIPYGlVi^R+(5UjnhX$=H7_$w0Cw}Z@>Ebc3tb{B-Pbn^c^S2J%a5v zC#J3TwU?ts=}b%J38qno0ucwR+}^&vPqk$abG2N^?hk0I@OSFWKtey4zPU=17;65} zbL?NT5N1&Jr#QL_!58|AUM7)S*^u4V(-@CvFf05l-|or3Vh6A$SeK`am1p9h-!7-V z@3`1YJ9=urbZL!^SK(XZDS@5Sv6rZ174<(5QO7Pi{oS9u$H z+%Z(p4N{1D+=FlsM81zICq9#UV%mRyeT40^tC_VLbG8xph=<(`%5UU-<6){YV4YlG+_%Oiiwtzd3Tdf9ma!a94=0EyWYTY@_s{ zTBQBmnd;oC53h=nL^E$&Fy*waS zU-8l>@xe{PFSN~TRTHNXB)cfG+Z4%;rNfZLmxS}Fuqb*`J<@)+L{`;`N>E`YAN$Bh zdDHM)&xn;r#72k9hRf$Wftu3xWhDRL5M^LG5f}M}|0(JN z_o#gjh}VDHf>mw)C6&F`S!D=9m%~C^>_|J>>SMk@pw}ff{D5g(+FDkgzopA%-$sUL zq`t>-hK}g&jtrdr0!6lV@D4HD6b&{}Pg`^%615}O^;mdON)NC&f(mkI7z6{|c8*aD z5Kd7}eWA7~Ccy5_GxK4i$-KNi$E@ltY^v-2;kGihml<@EB6&yQDktbK$TllvFPYWM zL-rxZjA2T6np4=##Vsok1JJqs{!N-|LPkRX=hvCNY&m*1v-T7cHEQr`GuWaq+!REEl z(yRl#xh++PN=-YF%1{1~M7C+m6prFBs$V;OvpNznK z^hqwJI$^;@0)G`ypU0t)SR=Wkq7n~k)^iK1-f%^s7}rk6fwSvLj7fu!qoUk#T9=!U zTAx;tL67>DMtW!M#WV#VtlpGC?>pqORB-Hdy%ZHA{*a{-?Q|X_%k|Xzaj9koW=-+M zu#iC#c&XKhv%Q3rbyYN7mm~Gni|PmjQ(r4&dx+aJq1OO@)9X@_q=LWwO+het_H}Vd zz7CalpR3etP#6yXCCAHh{u`P|`f2-dd`fma?`-p6(YATF*xl{=BJ6flj;qevD(t(l zKpIzv+!=2Thk@Ss;?o*EYSn9PfWUWzTgbm~TN}ut`4_^vCbxKP3if}nH}Bkw^j390 zVMUW&D#u9(imW%EymmPdfZJboQtf9Dt=Q#iQE{X(H7}2A7NoSXKiX-!`YwN`e9B{N z<{I{09rltm$FoO|)b91YTMkg>p#dnRT*=yo?s;f4UN;vTlm+$7+5*tq7qY-Ke=pXC zpnHI#2-g5cLmqg?6(_R+dt~O*0n#wffz(Y44;3qX&vJ(Q`aN>0+SK*yjupncQ9Iod zrs4Omm-y|e$SfK&an{b8@3|IujaI*$8~cH!-Al;V!$6&7z2fTi$b+CvkSM8TM)+UtMQDTHX;!z@caoWqt~*_GHb!2e8Yujj@xe6RPzD?LeThsn0m{o zIHIL%cyQMs!3n`-NFWd#g1b9|ySok=ELd;`f(Lg9?(P=c-QC^Z$-U40*4K+4ho)CI z-KVR%PF3x_-w_+R0AbGsi^rC8iXM}E?8OC&B=-%sf-+>}`g0wcxM=9y!R{)8*BhDb zpW0o;(S(BHwXKIE%)cHfU?zm{DgtU{%wW{bVbUh*Z$9zDDcZ1;sPCyp%YQL$PoUP1 zVBluPOckCk!cpb`t*gWz^}MStAb+%zgy|3#MEC!pxAO73cXL18O?Fe%nY5P6!Ee#0 z%fw&1z77Sg#((PLSMi_Fw&tuPcRSObFvr5fE()W{Q@;4B)=oDDDmpaAu zDCni3^EC8Qrn=DyhqQGj&Hl@ME7S3y6v#G=8;d&`DDwX`9Q?QKz;iE`dbsm4{4`N* z;cL9y9K`qN;LpluvXx=eZu>*_+L}QCfL`tk(9F%Y{R55ZpV&W~!f%iAe#Rmt2_g1! z`Z}wxAlBD{a~29Pu#))JuM!~)|J$5>%~ zX-BC=75gal8kBUn&^j$SfAjkE5b>GveRMWVJ)ODQL@+FVB_)hFV#_+ zHcjBsv7zOY4}c-X)q8S4pgzkI_{jJwad~-ZS-su{PlSM_Q3jLt?P=;rN?b?Wb_F!-|8aVibCX_ zOlH}HiHNN(!n&2iz}RSEybL1(v`mNv!JTP{17WrImIrP9+FOYyj(a&N4^~}iwp#Uo zR-;YGLdP=ZrZq+p|EP)(Ml>+ZuJ!^6h39iFf2}JBes!g96uhw2m1b^WAUPm+D)vf77?yzg(H%BVV~=HC|C|Vn^J5QP4_k z0`a)Yms$AEvF`Qwv5S0MKep&ww@?N`9X5G%r_lPH*^n&W6zb9wN{pZXx)A$^1(65K8bS2HS zwQ`lAjaSbO3{|fyU~OVTVsm%@laHC?t!veTmcxh3z5E~94YsB?SZBq!E?2)nwrSNK zHyw0XPS_tHI=5n1;v zi(u=xUjCNZr6jS!itbwTwT{Hx|8yG=U~wXo`83@(@2SQ`smoL1+ew>+-tt&&RRH;L zb?pgDdHhTVAjLQxn-0yGn)qI-_A*^$nca2Rb3lT?dOA9H-O?2DlN74%_l~0kdqI8X z%en_G^>GlK{riFSlx8yjsLuBoEEwbleg`q>^;&eHs;IEB zaTGurdlYdJdH3sAb4eoRr$;Ls;S&|YFS=8H_jDu=myt=2 zD8|b9(CVHq41_60MXi1?Wpv*e zM@>nMpz64ed|K7qrNTR5kLc&XwNHPvKKd*BEo<;xvpLE7GvGoV+_QxVSa{XGD)ZzM zTIs3yh#Wm-Dm7k{z*qNfWj=v?(r>^L{8r(6-qOF&yEOY{bniINya%=&&I-odxO zrSF>ApT=Q(ksBr<*2~x@bGmDsajs^N+8+F_Tp?32BXoli;*6PV){NUgbF{8U-jz6h zX?yPO*y^A`e)9r~Ze@8s=@!f^94FI7X?!P^`7RgQ&lA017KbVX&6G?@hV2ctX(s8J6!IG;N-{1Z4aCCWQp>Ct4FnSU=I)bot=Vq218J@3kc# z_b9N0hw%|mZvG6@Fu&8@l$KPN`qYo~Zfg@^o+aHJ&Y`aD>kXy1X|o~mzWk+r8iOue z*YB5)Ol{$j#|oq@?h_FTP0jQKo*odGN@Te*^NtD11&L7-p`xdmhTNW5mJMy|sCqwc zKwfUU4kEiT8L|!%zJtIazVjpTr@4Wp2=JdcQ-f94IX}bg4+#3En>Hz8jDUY_1s`d& zFq4`z&`khYUwHjCl-}x$%4}1j>S|;GA;bk1{_SHlYo&x+{caM&th%#Arddx)qKa0x zCbC^N(1^S)eyS>kabmKWw0qG1l?Pf8nzufGzvlITz4kMzf z9GUP2YS@;8xd>zaZ|(+ly72oWGq0Q!y1rnN@-u$y&4ii=S^WRcM7BA$ag&4|e6ENN z$RADvfAe3|o9D*-X}_asV~@9&7~G4aBY;|)zPz+(rmsov;%2!Z$tDAyzbq{hW&GfR zOEFYx1rHU&UzpasvH>7!!~n(m%4Yuod@5{KrrA~|ithseMiN;adQcH4m+~fI92R6b z70`tw%Z~OKxx5hom@2jR`9_c-L}){aB$dzSg&)d&JJS6_8YZY48Iq;UXq+qR03%>D zD?*2nV((;j?kSm2ql_s`jLd?pn>pH1uLR@Ol%J;hP<&vs1VUC!1pPI?0r&PrgD@jZ zf>WOIhj<4uClm-Uo(ZP+^fcl?7LScPkR>R&n=ppM5o*+J^$8>O_@8LrF)=DZ9dkw^ z=x^j7Hra!4mjea&1=!LtQ0j<-25h68O25D#gxRCrdx3A3V|&6r9~cAL{*BV%tI&DQoBoQx|YL}#LEpn0+ijwQo3y2j^?qd4NC986i3KvU8Q zpO>IE#s&Plr}?77jSj9Nx?$Ez-VIuSZpHUKhS;=)a6O)&&Adwv%Vm6515eTh0(GX0 zAv>Q&`ME10b`qpi{-K_CsNQ5}%$UsI*S^5|x_xE&HibRUqMKKAPyox<9@1KQ)Tw2r zUh(XF8La^W!t_=prw}hjg1-EBiMZ)^0@H1UhTFOT|9T~E6t1*etuvV+#**XatsYpu zS`gTX^d119i;xBIXz=lhIVfVm$M~p$=@-(`xYC`$r(5Tj0VbyhsIc;jTJM`-*il%T z0X9(K7RmkEM7-&~MpSOw8(F|Pw;LirXz1I<}-8>IxXZ*loai&UMaX-@Q@^!~_$omclm6v(ccScHbK7qKX zwEFTodK&5D`s747@91=Stax-<9F#EP%V@kjCstKjFY<*hs3`TFF z?UjRK*dN%|OL&QF?cQq{IY2_a_8<>VF0Ssd%eP^c8LHyhXn<0e`g*JiWpjx|aWmBd zn=)mXN;BHS#gIHulV~5I$m8PgBq%&I&fcEsfk0Uq6~-p|c0dZ|19lq)lu(SMqN=S8 zh>a{|{wYA{-Vixh_;zmN3gI6-xC<)@7YG^NyW%Dto1G>2hqph+k`4m_1^r&Vjg5`f z)&ILMhuq=&_wV=K0{=N8S_UPeSNQ<>zrRo>N(Tvd9?@c>B6z?0ZC-fnB-SRX-JB(> z@!R8}A}BCft+qysN6xca&aBm34r!A|-(}82+q=$l9&V%t?|WRVbqGHj`OO`YXseB1 zLI2;8`aq4|nR5))eP?_TN z?u~y)k+zD2%2iA~DU{Ie1u&Y0wKaGtH>moP!14sYqUUf1)4dg_3~%JecK+O%YIu6j zpQ;M^Er;2puiVfFVPBPSj_}qp`YEqsTgb59c0XpEE`{Wf)LX?HypT+`4OF?`?o&5hblVg?i*L+ z6;*MmHaF6lI5&X*2_7U2^*$1}Ew{Eiht(@e2Q|H&@QbK4^Qmkl;rR)y6DV$G5yCm} zbr*Ay%1bDDtAyxWw)T159+q{5eSw2Ru>Z(MJN>zBO#Q3!$e!aoGZjrxy|lE4u$$*i zj4YMsuZzkOuDgSm5!3vvBIdWj>i!j(8VUv)==@!O?TSaWv0L48;x^h57qZeQKHFiZ zn|A9p8kYI>LCUpEj2tp%UERRUlYZiN%;+B?dN*+(5yI)_MkEsNTEx>QuHCdjx|_-> z>_?K6ao$PO>Ko*=&OFzaWLEN>;to<4fN0;5d1>tzBz%w|IN4lOvDnyX5sY%qnPR z7&LdtH4%j`QSr^7<40)W=N-kqU28->DT~MDOl5%#YeIRlsrJzFj`@>hnYU4T73p)S zU_!ea3-iiKa`H+FDDd#8a4vh4xfLkCD>LAu^f;X(-~z*-Z$)YX^1Q+jn9Ih_^fsql z0xLLf<<`>5*;C2WR_yI?H97&8IO=xSPMguE0@yDnp<|s~OA@n~LYDQi1EG75oAKKD z@ij&5q_@0adfcum84q>pZQhh1eKvWY{S#=pKUO>Kg19VTeSwUZ19E$knFi-m$>X?DRb71@Ba~N=iE&X|=WRimjf=~|&d}1-6rTv^Tb^>E zDsj5JN)&vyG6NoCqI^M#a`B(v%0+mniNe``EmYOmX8M|GX#_u{ue_+D+M0(7N6x3( z8d#`OVz;EHcjBR%?y+PwHa^rd(eRNg&|_nNy!AQm^$)DAt+%RSiXViEj_7!z6_%7d zok*huoCh`|G=RpII!kmm+sTmOzt>x@^F{Q=wS|aMedyJ|7iv8vAdi;t7WUA1u*?;u z#~T|NX$k*jx7IdlR*hgplx5)KK8_wbytu=kbf6z9v;k`K@7@@!BG+Q0#XI-(7Dyf4xN2aNrE#}$@`UBw6QlLkgGM8e zQ8VWTZ_LncsOgjbl%#HRn+J7moqK|ySJ=7Ww)v^pv3H3;iW%C!gDfh{8QQ(&bpK2^ zhYvktKuqs0vIi(z2-j&dT$b9vxk2z1=g&WWd(7aF5X8^sog-swE9^hVx16~^z|hex zM^9Lo)X^PhZW~NU|IYErG^b*&aAyRzIQ_aKHz_$}m=Jk)@iY>Z5*xXJFA=NJyA6tr zNAm!+2@UKzJb*AW`^~GNG|#Efoua~+(c^|yjif&n3!Pv!2KG>cU^yZE8xGJtLno}| zy?YmWjl%SeKBwWT%tp?7+v1eZuuu<+X7}r0xg>q}>}P&t_)1w$b1_fV+w)xCpv>>gDEh%?-X32bx{_&U2!o$xN__s#uY1fdO;l}Z;8T5WJnb4jXC zN;+>?enG&39qn0~?WDZMWIPS@L6@PjEyPdm^@YHI+?wp&d%jgJD>tFKL#9>PSrDj^ zIP80ft%R%gybA7?{g#mazD!C8mzEE}gJA4OIZNmSxBsZl9$uNe_I!&*uC)%3e@z(s zt`u@i2f+;pa+Z3!9p|`@N_^+H#DmS50J+4t%FK9&SXf5jQ zZkL7QtGyH#=|=F|(>trZbQA__1(bBwkuzQ1PC{97^y1IFE|z?AI$o;6G z2HlRCwM|3|Q9E1Qq%hTizt!^lj`EuUIcLae2pzxctE~UhafQYjI z#LZ6gAi{LCBs&L32(xd!?DQ&3;veW!_43U+Oz{x=ecYr7lzorS&F?kAAoq)l%CuT@ zStYLl_~{ydWN!`QO7(dkv8X)}7w9VYyT`WdWu~p~-LSRyZj#bSHG02H{8n^`MB;yCERg&YNMHMR#hhS44#Vr?h?Oz> zJN)`ILi6wtPw7(io_lV31RG2V18_%ND~R)xsuFu`{?kV9vbDJMu_%8=)J)6bdpq`) zmNvPS_^Ji@DG69du~h5@0UmCgWy9v>`m<4v-8+!cLF3oFiA$H6)?rKIpfEz%m>};a=O=571rdq zhYgukFHoTf((;6if}){XN~dXQM_vt`1b8$({FbS)sN6)2cO&JiYN!YG#<(-|%VVqt71o*SEL3dwV6`ahaKG6BC{I zXey^Yvp?-ochY+1_ltDhc3SU?^D`1>!o*N@DdTDTgY4Pd)Ki{Mf5}6|Ys{RRC<-{_ zl`_ow`0WojP(2*QqNWcrmfYFyl^w6TBO^&(RkLotfkxK}T#c<#yCE?7mMqMisiV7Y zb1r`@(Ncw#jAT{ku2xfSIRlcpn}mq0t?-#Vr9LZdrA9u_H;mB$BcK=I>K>m$wW3=n zy%8g>xbxf-HI9I-9HTIa4Hv%m%!LMj&h0;?^+l;BqA6A%jV;F9zBZXrLBjRc2A7uF zUMlaJ?IM`4B^ouug9JOVK8JRDuF%=^dlbpMF2vWBwJFN%wi@HP;|GXzC_W>>RP!kUN44y}u1YBPXZJp+qJ# z{eCFuK|1gCa1$3lB0}cvLGW!)5SsA)Li~c1e$V1Kcse#_8c51f*3xd3wA!$=i#>g@ zkjI!gkg-J6l@|IA99dS8w|lero|{hxA4c)V`*@!fSt7v0;&RVDqP2M??N_D}N1GZ> z7R|c^L*eck+$`o>0<&eXHg8Fgi;su5p<5*vub)YTczWUJ5W~KvNlUnlIK^JBsmn#D z?!ke*75zAiXB$wd)Wt-1#ZTaIfl>hm#k`15kgj6?0#*a_hx#LujT*`pB~E;*n*f))G=cY2N8(%k{Fkt}0Oh_rz7)FDa)bzUV4$-YP}}_>l)XPi{{v z8OXh~P{X1i+w7VPYeA)Tir69gzuA%m58fFbAxI#c4$Hg*)khE1diuw3TypOz*%lyk! zz>0;)REyH*N^;YE)kbD7e2B^NQ64)w9N59_k-+E3J+5KTqA*+B>Oj+09RMN)qJ9gxv>I$p_77|YB$fWc ze%;d6#!oNCePK7kr%w6NGczTeoU0o*Oe$hO?Pzkm4d`Z;9|j}g=NqgyL5=rRKq7`g z`SHW-Ns{j)#;z!|YT3DA%vm)%C4rI9G*`?qrlnUbDm*zBO0Dd74xhG3#(hRaNztYxDFFh5^%H z&%;6-tmaR4ry?ynN0k4Vxgg9?h5zMDMmq@v%4@x|vjY`XTUc0tvRgwru4iV{5dSHv zwOuJYxk=b1>p0vp%YA#6hq?!-W%3HgLvCNT{_A{@gZ$JjE^oNRiWFlS{$3=RNj)fd_TTZ4FcCeM&6d?@IBq=Y2R~e7v7R6QM1J0XHWG}!xQ7Ko?h-HVixGGb zm|-;f-o!yv1jr4|Bqi1CQ&ZIu&ET|^+Nc$Na!75zfzt!k#a&CTBK5B09cL0@K|%g* z(pOFIFvVP+9%IEj57^V$p~uq>DD8XC-)j z-~K}ss^TVZej#cUph%5}lKcfRg3g;CBXc}Y<*uQN!u>w(Qq zW>poVgM#}Q@xl@K+J1c89SmOkA%hp0NVoVl_r_CNRAz0lGL~gZM6_&~W+ioggIbh! zIIjG*HRwMNZ=G{>sxS*!aPO!2)A{tO|2o%B$_wtL%TLMMuNEx7u@G-uB5>Y^dvTkv z+Z1b!40teyxjp@w`FR_=b)#R88P1&JAxXxKZbxeU0lej3*u9aZ#RO(Q?NY)hsl=lQ zd?#O(g7R7}cJv)_jg|F1b)DiN+9TQ#WBptnDXel{duD&j|t)eJkV2rI(qXt z-q^f-XaDl<@HQ-4o^GUNcqyYP^Oi`Zya@_MnwjU^Sj{?Wyb4wk&P%{!`0p$qOAx)O zfuRXyyl{BFjC=bn+$z;7c3lhakve@qo+#$=>cm`>b(&4X*5-RvPC>V~$#32Lflxt1 zYhJMTguC0(4;agS{<~qwGl@8DXdfi`*f3K?!j3QF*mwOF(r#7vgZ_fBb_!90MEE4q zb~BX0JM3PLUzCc5I--`?@7|B}+CBkJ*e-Pxrdu5IBqO^?%VTG8aR@h&Zh@%H^T5yd zRB2p~LZ0pIS<~U24l`j}RjWzc&Ce?Fjv7*@Dp<{?>~bG_o7Rh@qWp#Q!JV5txyN1a zssp9a4-ew&uj3~wOZnO==n75lr&1=lgF#TcgTCBPD4VzwB@Lnjdtr@6uU|KD{}}>9 zmf{aF;Wot{Ldk8X0UF#eRg^|mN<0}od1j_~sfX`pZOKB^NiAONS`0})f+rzwjQF^* zj5@KBj4H6G!D(;qr+Nc~Qah;hxlp^J#~w;R%~Pe`j=*PSS3?%XEh3dp31Ur<#8(`m z_M7`iRRxRMC|UTJs~imL6!wEPu60C}A&EW<@M+g|dnm`WsQB(j0`>n*Q9*=^sBo+% zJs#=6z7M`@95J+e*9p3Gjp#NzJ#lQ{gUUN@RX%_|1b*|ufj|`?8KcCHH4J5G zuVx@JIa6UG|8)ix1N2{bg8Q=m?l-G0jsaaE(m4|c-oViAcYlhS-@^W_)SsV`qI-={ z0JIv{Uzq+d4Etq$$`WAD`oLrW9eiMdj{glV^n`THg!~MJu3G&UBmG~$`zIay|BCc) z`|e+t=D$Y-(~1Cd(g-s?1?P1M$KwoFJO$Tu1=n;5`)_aw3mroT(EZTAW)vXR>>*wg z!1IkGTMVP@Ga(laB3le%?z18njv`yM5&qSGuLvRf>%qFNbC!ER(GcI_U*6)scko(v z_l(%L=hr&5t)@CNJ~B4E^JlXkzZs7>;a7cEl! z(X-j|6#XFl86pmSQh0cY#hbXVr(Ies>CxdAjzEFY?gCHy#ry4AjF~zs<29@WkC*GY ztLOVr8}B#XhX#0xl>Tc$sfQciyTloc;)dMZ8fARQ07{Ub0QCK#i@WM|3jWR&C`9S~ zu1L16AL1iI0sTfp-C32U{ptM1)kCnDsc>w9OpXsb5J!cu6x~%|s2k~k%ZGxHT!@7* z(`2*ytS*q7E9NF2e$6V=e6#xt=}31l6^OorP-`CY5Xk<3be!XzRu`4xBM*(AH_U&? z0O+MiMJQt$MDhI`pgD+t`H}|Ese2EN-;^Fz7BgsK!m}Mu1n+&`R{L7-h7kxHSxHMe z-j(Tuz4-I0vC=~Pg=!MKt`#AMl9aS@{@zbk>@Q`;cy~3tpZs@ExaUJhKLYndheH&` zJ;wq}eUtSmS?{C(!Q2m)n$9_k=)O)@l z1=b9Ot{Ut!^Nt*{52GGzNX-(T?7zK`f@IEpiQDMEU3_6QcPzp6lM1mU^CofdBSqmy z_6+ekxZj3>>MD&2ugXnrbe)*LaydW~t;|x+S-)%u;jbC$h&*=`Q=2+K-=;-UESw_X zJoSf+CUcS~RioeAYn}|m#nn|tTACVnu*73W&Jo4W{oB#+v3}3{eR5dD&mv-0?*x8I zOp^*zbXLJBad5d(C=lSR!A61a?|28+gj|ST&8f)GejC0gkJ>k*qNm8Nrnl?$>!CD+ z!6La>GmdSEY~k@vxcz;wx%I_jHVaIGG4)qA(3eb`(D50Fp8A&yZso~hH9(1{jb3;h zvpjcQ2&IWLJ2Th`wFUJ&)a8rHMpCGtS#}C)zm2yyMce4PZ4cmGXE1VxuqBd!WS73O zQUhWt7?~sxj3Dqi?10sea0?fqCoSU~?L(vKhsmj!CF)(YZtMeL;ZN0x8`cKqi)Oz{w#ERB}|$@%<1qqI#SW$-BS z$U*J`KqY!SB_$>3f*%^s(Bp-Kgh1hWOnBk#6c9-Zw7H7I=NpF8yY51~rryHU?`tB@ zpW)=bBw&cJ5M}NNRlg^MYH`8Mc~h5dDWPGSPlFxV(~h>GKe#r7YhxsnH6L?Q|R)38ts|Dy|&-7 z;*n1>GI)omRhZpzCa~Hb>c+^2cCLiU<8E*RZ_Dcd{^7inZ2a+9petW-BEZM;o|>$m z!XP<1645&;Sf%cBHOH9+sOuD+i>wuKXvJBh8r;}16!lKu*LS_AXsRE}w|uQW%@OG3}3!d>f$4|FWLz- zv$C&thY{WXE=+W-q*YW%>+i(G12qLj?mAZ3y$IE7T*x?EWd-*5>_%L~9s9W@;;Kx~ z*}DtK7w?Q8o5=BEH5&DzH_t!uiSf6;#+ha}ZIOZeGbg(-2XZ zZ&r^GG6>3cQk-r^58kV=2@LgwGTd7e3k>(r9dM}x^oi}~ZLvPg+vBinUX=IIoCp+j z69kOKSW{SOCCZ^{#XI(|3EG$x+I!}xBER}rZ~c9i5=yqU!qfT#aF{|zHyV-x3E%f` z;x-DS(3EIAZM8S;-U5;fBh`7Gu79NmuLe)$>(MYB&D<97?*?Qv$h=jZwd6o1E~2kV zQm}!h#ePof#hr=Pt9P^TsFMc5lr2||gLmY2kM%EH(^1iH*PV|2(>`WZbT&rOI{m&@ z#5ubTcahyISW(75HTyGa!dA=)z}t@zQQhiQ1vbWl>=FDX_~1p(Tj#6!z$8{qOwGQG zx~P{fzFV0HO^&5`Ru-f7Ptp9gB;XFVf5%MKRUzryk^TvP8DYLnust>`ng4e+Tcc=@ zUzOvv*Rh7X5dnCa=Qc?0SfF}7XRf^|UZrmBNd7jZ*VhuKBO;ncuLjWBBPkR1vr(?Pa!)Mmjj{eU)F`H-^24ZP+SO=}ioy9^aDuXA+fxMCl@B zhQ#3=u=m2(Ynb~C$FQu*LfH<&O0DBFe8>n?U>gX0RiQQf@Z8W~5-J=|Pnp0NhVw)u zORW5aTS08mr0>=W{|1ubig}6TAP^Pvgz` z6y-QLG$gI1rRD7GtYI!;E&+xPEVULMA0Ovb%7W7y6WB-8U)Uc%^~~}dJ#mx`SbtCV z$w@U4oDfY=>(mf@Qyd-Yol$@KUaqq-YyT0LtvKji0Zm5J_XTdId{MJoVN7nMOf6fM zCh#EeXX+fB66>1^vz>a)QoDz6Dji?0Qeb3^pN9MYY$nk7o$;;BW9iCm4)JYgbg1~H ztRh81wZ^4Bk&d@dkN__J!A|>iLD8lFe#LGj>((>~yyiUw??L*3(qrA$f>@*1#8$jf z@0aB&`#1s^YRt#^N$%X^Dv&r@Hya5L0`?{Y{ zTIQA~muI=9@mq-b>59&s!bgta{-z%lo~EFzR|RHd=z@H#t!0)v2qX~wn?F5K_YUuP zjnz2`tQUHIL<8&|;;t~CO?}#SoBpGKsF=Ax>X-@3p*~t@q7Lt0dq4ec1$@{W%*8!d zQ|?*7QCm~vhJJRr1DLPg5~~7|1EB~49-z|kmuCGsdFCP@D{ySAXdVHO7bLQ@XeepQ z>YW$!hhb?6{ijg2qNJ!YLYC?PHB}L;bfYLOfdjp261uyr~QTK(7J6X}6GTl=$9lmx&&Q#8836vNtmvCD;d=Hd~LnLrr> z6Eh>TRMYH zbPyY>RHgZRqnehn8ICd(kv@G;9@4~s0)N8*GiFB)?H<;a2B#RfF8kFzUn2di|NCyw zc#p!bpgh0c-TywoB!3pNW&uzAPsC^PMG+jr%f)*0MVUF50$cp2{c zxqcax-fAr4-qvLLAna`Ww4N^we~^REz9SYH z7zbsh_gdigq~%XhHLc=TKiJqzQ@kxLDhx#Yw$>d^)EA*gdogRG9TRA6u#JoXsQ4_< zwK6lv{)mG=f9ykSWW48lbhY z7jcBVyxY89r}S^wg(v5Zovy29RrP)o1^GalCd^13@7j^L-j>)y( z(qEgBS_SVraa(?U^lFhwNi`XOL58CE||z2@ZY`GWMw20)qX;=ie@8GrP)HVa(pA#1S0zr1>j! z=8QhMR-TTp0I)G>96Hs;-XjMO8z$qs*kA&+3PZyHuDg?H8GvFz6EQJKstykW8#jO+ z&)P@#1_Q%ZM5b7rW%bfQ#P(!=5);5_Ta;I1=wce$CQm3LtF^e@dK?vdY#p_-N6p<>3o{V+5F}x%yVU{vWV%eb{L8AO$eLKob3(K)N1pRK@+?dr z5l?zy*Fwif#Ms)r!s1cy zp$-zEC^gV?NijUX37QZlS!{x+4zJQvr=9GO;bcMSGa&B0J!1d6Nn2Z6W8*-sI}IGj zztm;Gxm_O(Zjp&Dc_`hf6v@r7VDb1 zWog`;8u;N~BGmpf5UT1)MobK=_}Eha#}HXaUw>_Td;4n~hu9G>^{g~Ba~K;=!$#kD z^=(ez#GJMez-mQ zn&MEq+v%Ed>)3g*nDnrau91P`oWj-WwS|S;ZGuq+jBJH4Zh4}xQT#2Pm9 z8B6VQL~)iO`*?rF)gG~IMa*!IQPp#3yK&n>Dg}i~)3?-7EGBOsVW~0g{?;E7&D+g% z*uJ|BCXS9p4Gj&@uRu{%HuR@0dt;+}b7p47o;tp4Hu*5)Qx#Ub>y#kh*2XVv=fqB8 z?Oy>n8;}~-ssC5CX!~^&Nw^{gq4rs>~IuR1A6uSfX!1HGMxueynYwE1eHtga&vZg zgb*lK7t)rtnS(RfnDrqrn%0p@bEqrcG`0NoHnvxK<96nh*KzqGcbEVMQ)};7R3ScX z-=%R@%4`qG8zy$`ndKEdqEq)A$OjXa1pU{$wal8I7E4*o9JQmTs4$h{GF>nHTjYrx z{B~=2Vd^~Ei1`QpPHl~zHi_TTDJZP0hh?Oj*6I)ky`5wWEA)kS_QPW)_8hLKeEOr# zFv^r9ypa0b0R#0-)xY`p?P%{tE&zXb#Y451D5(3F89ap5?H_|<)DgJgY42dKDG8&& ztxH|$MH#oA#j2*%x7Oi$=f#biK zXoDH2)sHmD!CJ+-x{{@5viDrB8}h`LK1VD2@^%SnUtIO3h7x)@Cp4Q&Cc*<;=>^A@ z__?xO!?7NObHf(<{kZWpKi@L8kpmkJHZO%Rm+!v1N$&#yyQ+@AE5HUWqcMyw1X!GV zV9)!NL7N>|0}P2!q{pW`Ol6PbsIb*?(?#{xHBZQQ^Jsey#FdI<7$J&wdq1EDioZt% z568e)YU5uYKjcB1Hw*e{Dw0!DQZh5&=$22+?h(qSeR&=heTy4J84evEML(7ov#-r< zPez${1U)&n10Rppj-5K%u-4Z69`{4v+`0;mXJD*cTM{*n$L5H|#Gxe2b$0FKQ)Oal zYz%3*Fj;c=i`Fy~l?2|3?H&Xj$ybKem zD!oHrM^-qQ!K8|OHEq82R#v(DNjEpk{4=BM>Y2N2`^&cyM+sT^iP3s~6 z&2{NU4u(}=rn8WACMZVMyKvF4D?A zK46^y+(gHp4zd`#Y0J26%8wL8=ioWh($g@sH;DOL+pX_==m0c91c;6c`}}5ma#JsU zz6rEOEbv4HOxrN^-yc6FlA-z!O2n4eAy{9lH+TPhfd%XjVme?k>uP!LdJEVf9IZb6 zT%kW9vTe6_6K)R{8G;KqckZPzd5zPT1EaK$?lgE-JlB58?Xk-YQ9Fv$99c{wJ<%~^ zS>bZsxqy;EYfnWD6WW!-WMKw*q^iEim0b6|gN%=*ei@7CIX*e4`YA?0-kjcq2kMHA zpb$Gu32}#YUX{2W`U*gAq+qjzd}hBXUoI*DTx*swE#!2K4#mV1z%bdA-ce^f>t_ls zDq;4df-V}z^D%VDU#TnYeD6CkkRVUc%Jyvu#3r)>ChlAO3leU>dy^4gnzu}F$CUxe z+qT}ASM{ppO;;8F>f}|4h8(XO^;ER|;^Ov?fNaus!W3-Z+uJzv0QE7$8Qg;*46^RR z{N9wkiCa!?rW&)Sc=>n!4hPvY4AD@az-h9pJcY?KlHODMU#Mf32a{FpBd|Yg?$pQ= zRFXN~UcPufNQccyrB<>4leBYwzE-@@3|B15%xlqVe3aQ!eRBy-g{JqO{Hml62qqC_ zXMPskDF^AC?204KTy>S@iyjT*uvfS~VeBF`d+oHN>fld*J7NztN}Z*?HbhccX~9Iy z!ag^3nn<2YiQm!jmqgCG$Pdu)T2b^&Yn2-#DA~9^!=$~NsQh|jnVqsML|Bfem42fS zqij13Ydz2$4y{L!LrS4rSu8h+AA;kcPDB>#RSycpQsChhc@51Cyji89H=Jt^t*<%` z)?XU$sl`uNmoP3C(6?vlQ>X2mh5#RVKYLti;6dnfg$d%t3nuRFg}IB;gW7crsJr;p z0&so|NK5{Ua@vR>vT|}9oL`P@Y)3~&$46P91L&s+I`(0Sb)g*@pkiy!uPxg6w%Dyz zMCvarsil>szpya?WAIUYOZGevg@zz-M!{?6j*Sacq>3ywL?|t)44{e?1#0{d8_5gq zO~ja?L<&x(!@WvoV&a8GpnRt|2kkT2uV`objpwfE?alY6G%v5Mt`;0#5ERLpfUH>( zQQ}<$Vt9Aq0YU)KbMv(+7C&kw$aqlUgjW4&Vp0Z33%FWa8hXalD3irY22=Ij?(PD0 zi?m1ODL2^|O01Wp2M%hYc5c!M1iBAqYt|`%dsR zcpPPNhM{^YB>$(=r576C*w}cO+&i9pm+Me@%DODTkP#7q+k(b`fq}*K!D@r*zbaw~Cr8oMR$T(CUm zKIb=`Q3pj=Cg`Z70+O$SwF}^8D@mSvFZ?&T0bPkaS66eyjq5D@SB`B@GxW$>?NDgD z(8|Ej^8Cox7I}25o~n3Y%2Y?tg5#9gqH^g`*)Pl4!)llI7_hU<4A9&jXgqq-y;X0` z2|(UuWT_?9c84hyTS(riJyU#)pBAV~O*Gp7)}dB_-)<+{to=->S{Q{~}p7XkN$O z(o$)tR}G`JmIY3_v7xHU(aY=6I&7XP(AuR6*Z+Jh*qDfYc~=^|W7{fySXmTC%3@6~f$>zZxNxlXm^9LfmU;B!-xO{&~m{Hu6QRaWQy zdx|Y4fRK1*>6yObNdc4rdy?}o$0wqBO_9q3t2}khmrD#J3$0qg1E9Pp5xvkZYG`^* zJV&WWl_0fD)wlYCPy_$hzjISdQ|-OrDnM%_x8UC??oX{ONpOnL1PZ4}l}nzE2zRj-9RprxbQcHLWxm)5!vkTJH}8GJJ5r$N&k z!7lRR)7r`(Xv|KU5?3v<5uWI8V;|8KPY;9Kc$5kv0yG9mtgXfi_bvZM)qB~OB8qs& zpZ>C?!wiT)op(XifsuS*=1F9VkJ#5iN6AXKJkUXB$cj1NUy@}26q)$ARF>4c+XNH` zLC?K|jPIXTE4L92bG}<3kzY42=m(B`*ddy(IZ3a8zYZkR_nL(=RzT!Eu zm=RrrR7l!MUIdByxM7>|y`MFV~qrr2df{JNEYnuUmBGV6fH8hT!XPd#imCKOl?Y zpWDfF$S!=@~RU)l4{-A z+qL(;yh3yP903b>UxBP9c>Rh%V%(kM<(>fq?ECHKxovkxV;%O?GJmg+aqM@O1kCP> z_$}cPf11#9s4!HS&8*0GTkn7nDC7?u!@+kozlUJ2%CF8xe>?-CV6kS{g`eBbXHWO9 zHQiOxa@=3GGWctsI83@@^2S=3xh?^A?Mdrwa1{SU=}L#z1B7_+T?VqT5=?aW_GDzC zq-`J8wld<^cRcR}nTr^Q&fT4cJk?`T@vc;n?M#E}S1m_NPt)hh$0TPsz#r0I!*htbz;Cw zc7VH+>Zp9__SNl9b2CTVSS)vIF@iP45>WyR%P!6GQR?DHu}w(e)8Cn|MJCTnm@F%f zsO98l07Yg9SBL6+_31_+j_=%jVhGs}84b z{-Z7PWn7AQwr@})4mwZjp#gv=ul~NhrsxOa`8T{B)3r}IRUmcfKxGrAJrQ-j(YcVb z!X`WLmg-2snA1yb#mQ@W*fg}?_ET8Yp$Z*IPR}Z0MTW6YDBYE$!BdjT3A89wI3ab- z`un|rTJ-^v1Qg=SKO-?~YO8GDtR4|}SBCqcOpBtuJq=p#Q=Uw1V5Qw&ZbarnzeVwY zKbxy^M8JP#-~OHypaAMx=}%_@G)0h(>sB?99i*-`wrOW%InS=!eI?^fzxC=r4(whT z0qTYU5fyiB57Xzfz2rp3GAsE!crGun8L-+v{oYvunvdz zaxnpUiYW zf@J@D7E8<1k&+yb6-<;*U9`w^@Bd^Ftl{D$47u0~)T#I#vw?+cZphgJIyzV+GP$D$QELzj?!z73G%A@mDfVW-n zaY#X|H{aBm1XbjNF=Y;ZUW56;eOp!SO$KeS(6v}lV&RW7B`Oi$U7O!;Bv6cNgjEr{ z%Mwshi;LLqTP(D{i$GJU^kHGs??udL+%fHk32$d~pnS2<%BM7?pR;K$o#Dj@CJ}V7 zErj`PJ=~^Ci*8Uz27E?xdX?1Z{I4Et&F zqg~h+zlzXsg&NlgoE=Y$3k`TvvfIR0aNrYAk5?054O7gmbCJv%a8_e`R1ntlUdES=HYF1alTgJ&(ZKG)vdtDaR!#J1R ziwOoYpUa1H)OnsCM_WH%@XoL^b_oE9dQYRD-1wQw)(sjg-1@5XOE<0TRtsNsvX@ml zV`+B?Ru|i)QSSN5W7HdK+uZhqT7X92J~yqL=L7^z-gon2W0&pPQ16q1B6p8PZQ-Tr z9X?v-^54z;e~G;e7#k1;F>B5X7ddcXE954_-}q;wdzU$q1~v;YX&|<;et&*uEW8ya zJ3$xtvFAcWILrO&M@U|U;w_`j_Utb{AuzzQ|5$Y4? z%e~ImtH92wrZsSb4;^Vq;fxADi~mD=fxOR$O)h5rceNFd{n|@{&Q0RxD=_QycX4P$ z9ktf>e)IDIVYp@d>rt$pwCLBNT1Ebw7B0oNR2sxSZh6A?P>pPg#FjFEZ|C?Q=F3cn^X)y5DJ^1=0oz=&pHjTY&(YR}6VJ4qH3$ zJRtM@JsP-6YalM}Kcq+EJODQfJ1Q{kQKk}b=B>4(1ZYl;gNB3pJpsEjk^1xQ`@8&M z=>%nzt*>17L3sv zS@-gZ&4WDw@9WD?RazGU8h5Plj6S4wk~lCM)n=M1SqN zjR`w#{n->VKj~X|OtQx|(P0a6o39e_J6%;KunHC?NBskR?9Wtt)O}K?_S_UUeAfQt zYIMbSAc8R`DW~P*!OnZ*{`V283XWl z+`+a#k;MSS+<&fyD~o7yxb97V`@|8jx^sUA%MCn~{c;s65^x=y@=>d&)~$?7h0PB1 zs6-20KT03u<*IxeMZ{C_wA6ihdZaV7THl77X6Zb6D~-=*cdbCZM>)O5e*SxG<$n*d z8sdvTDcO)6?ISb!{aE{w-5dAJ&?monpMc2y;jF{5`1F*8$zM#&tmOQZxdomz3bA)R zT6uuBw0(G1&lH($g`KuwX$d zqc?XF0uSw7vZ_z8y5z$kz7Y^Cu;TrlHje@&i>3n~v2PvMUe1_sWr$+r1<_TE5kvB{ zz?{y!s>&hb{>#^bSgrBtL##%j-?XbnD@d8a($d}2BkgdRqssQXAMqk{8kx~$?FdczlmmW#Oilkfu~)mkxK&#}wmt8~z{_V}|68l_kbKUq zaF4RXyx(LTc+~Wkq!lPgDEvuRffYPb{s+%KD`G7b=*2!CdD)28>_teDxn0 zFY?xt@Xk6XKzD;DhQ_+wKSg-0S&J&Xc4yG*&BGFP3@b%c<>fu6AD;Gj={GC(o~^*$ z$J*V;KE{C5WscePQS*^#{^hewkx7oqYq!#a$P4W$)G8)&8=I6_rjFBt`bFEkKOO?9 z(mCJUx&;^4?xs}CF|L$M5t6uN$q=nUNV-akb zpTlLnx`Tma0g564pRogL)hx=~0;s{u5WI}C2w*pAlm92ZdifTc<-BwN+haoA)cdg= zr+G)yeT~+RMVm;?7Avjk*|Eu4zShn!r*B_(v;FQ7sP-UUGTTbYyC^*u#yO4r>3>F) zIA?iR;cI0rZ|Qonv__Wdc6{qra4}v#=ZXSfG5Dbg_Cz%zp@)k zqc0Cd%~@kDZSZyt1mWtnBTCZzFy- zI^!Wa!}Z1E&o7EU#+u#arvDgb2C!0BQD0Ge*s}<^YBba_re7p-?HHpD(9PiznDQz$ zXF&xzK-}4-TO^9OpC(ki<9!(Kf)^<5d%on=*47R!`%%#dp!Qma*R0~HMf?XDx123# z(`9mD=jU!01ai7-X+zOZqlIx@ot^QA_kFqa)H=2qu-uR{{q%TGcaqwD^TT?GZa#Yw z9UUFJogv$k`A+Dzqb4C)N(AS^?D%6(0bUBWpQZEWs7uNklXxs+AiFw}8$R8I{(>JM zlRmpfNN9G`MbNS8ldI!=yqLIk^Lx8cA%o-T#m>&LP9f&(6U9Yp`%?P$iEjAow{`BM zKs{KK>&g^U4X_nrq4XmMo>x&`G~3-C$cqpUVkmJ zAfyFKnts~cOX3_hs+kBGqzjsSJ)dcw+0ge?R(7OT=GknkgyE|t{Cha3&0j<>ZC}L7 zbp^C@vlmDnlPE%wYAD;wzZde9IC`=|+a>?saq+@X{8I1YN$-e^-+^!e`j-RJ5d}Zl zIo@@FT?RNAX_AiMD_!ZoKWcbPbo7Khf8o5@uty-?mZo}r89sDhpg4qR5B#xub-!O4 zo`A|An#=6z=}xFTd;(yF3bH2EseuA3_$OyLe15;M4SVD-(gC^O*smzbUrm|0N!WOo z*!c>JFlPIGYLHOS(+uQjWtMMWJvkQke{O}IQ6GZB2(>YNd`Ng=jA%PW(x~@R=g9`$ zT_WWuy(se)=F@j9x8sCiFkzLkaW1}DUCM&f+{rO?#=z{B?$V+Ckp^@297N}KAN6mM zow=n5&|^!}A9bEqpP0~riY=?0*8F_S>u>Tu4j&=!8dd;0+qOrm@yvVZ~hF`*tC7TR%IPFUiR9oi)7?<3AYW%fe&wSmlb0$w4EX|Xa!3sLPv8Wxk z{7KV^-P$8>b4!Uz)Tq?*rOIfN1|f_qciCO^kfl?J`lBl6RGXlK(Z@C#!-Z>NFVq{*dgb81oyd2;BSJHuFtgli3M8>%Rk`|ea_Q~mP}LJE z>=bxjOf`63r9#8!NEA z-)h+3zpW-plj*Rl;$%UQZ;m`+NP( zU;L$K-|+tLrR`YEfyhWv@avuWsDuS}ZXCl_Pi1B~$^u70eHY$YPlV&;H(@)|i~Y4H zWqQ|>x${zjtf8+j_p^0#p1e$Lk42ep*|54^xO`IJ;Vu}cWu%B!uik$9|&2e**0F54gulMj* zHD>q7!o=wV{b`F+&AX1?DQ%`aLBF-^QvW#?e)sp0;e|I7u6O`>&@}8xPAU)tu%id=AtIv9zvuN2lj`OnMsj zDE;0dn8X?G{r$!|1F))TFpoJ%0mJlBL{kGCESKx>-_li1d@sp2)IDBC6{wmYL0#h2 zQD@I{N4SfBzy5q&-9+rL?uvYoHP7=5Z2`+t6@y;0C%jbF0}bRmNlDd`s4sNpgqJ}& zz1p>h@KtPElZDq2ji9GjR&#XR=@~nBlEwKI@lNzFnqG(qimdv2 z%E&-tWOQV7bVB=P1uAkr2*vnfs@R?EO$rMs%-dJ4^U$L#^BI-{$$;ZN`$-hm15V$I zt>dPeG}513)aR5jjeY3ksHwGiG2H1XiLy(uVQ#s(F1>KAlA9sNR8<%D8(A1I;O*-? z!q1=mf@5PycRj_kG*~Eg{mBeUCfg*3_ZHf8G^`N9GlbGMW9`wp&5wWX$`+IPZS6ex z8E_ZgE(~G=x%GJaplP`(tMff)85$g7Yc9L5P}?5*SQ4YBabCprO*hq@RapAZ^eWcLIXpAA##n7C+j?uv2-?Qg2@&}xK-&k!XigS^^aq%l^|R!9 zQOv-EcY2W9WzU#&CTDlXG?cdw1N}dY$pGHDZPgH|GMIF*p4t3%#k5V;I~AVtYVauM zYoX+b$n!FtI27Y^xTnIK%<#jK@PF`kyHE{jCO^a zFHb531%Do^MgyL|=HsbxH#%ij<`nsMSNA}<(1V)2V7SM$uuG|;_f+II*_D#;dm|I$ zr2ENDQxIuoYhnp+-m{q<^o=M~Am<9k6S=yhd|p=@v$&l-@Gr^nB<9|LlVvD-?22gC95@fp{eXO>O>8(c_Hi^PsHAT&X#DyWer@_ zdZrl>H^S1Va5NFqDx=r-QGLxEwP$}BmX~o<(twd4(RhU$x!P?~#WaN5h6_a$?)Q$# zkA3u*5;}$izPve^Rip=67p_113#<-y+oLh)<1_E3kx|d(?-B>=ZcA#h>mrat%pJVG z1JA8|e;ij>-0iame&ReK-!BlD(?eh~i)uVJ-uGzLRVZA#IpmRhCYQ!H>2XdlZSp5ELg8sz9@0iMJ3S${W+ab>92LUwtGTJz0h9W*>@S=U{~-CIZP1R7 z=iH~gOs2vaA{66ZZNn0$`w~c4@(ocoGL0@Ff&7+DbThE1O^~g-G3h-9d;uH4Lu~l= zm=wc>uSZzgY;xjENet$n=B|HNX&F_`F(u|^-SFta{6g!Nc3!NosjFue1$snHa7kL2 zQ&(IqbUsE<B|Q}!!~9-=9v?qN%YGHx%fer-0Er$S*%sGH4_K<4blEx{zX zZ#8~ry9_gnYUqr6GSW4`mWRMRZ`pd&kxi*ZKu@1Q-Y_$h0xi3xg(cD@AIg) zysxy7VRH76CtacIc@eXDNr-INqkkj~L5q|lZqWNPv|W|a*jjcwGw_076d(O>PH?p; zKO4FLv%cZ56$nlxk9YclswZ>t|qqBmY+gv{z|${uW>CV3ODn#J~F)HXq_^slzkihopYuKMk(b)}z(+^{`3 zwF_)sra$gZ%h0%JvYt6ItUzvFCN32rk8hae5he=FeULhvRaT=`|Gj>r9cg#qGYW3% z>CpOpwefJE&Ew~!@as)hgE*mpZB-KL=T3JkDGfytedxNudhiws8A5Uj^K^P(-zPa1 zx%PK*plc3Ct(0|QC)L=X_h_OXU$H>S=tff9NAZH<^Q(DvPdUmWBJbZt#>Acr( zdgbZYET7xv@=E!nL+)lrtUmZ@TFaQ^P zQ)B0fH}PEPins4}%Fj7`9d8jfKQ zw^^gNJ6@EB+3(~wA1;+2v>H5)IY(DgzUEnGwv1Ymn5K|O<4EkK;dF@xe9g~Bj)9Km zC4nq`2)z3(A$wF=Tad18xXI5@2Cao?TTyS|>&bMR+mAc8p${dpAb4ce#@U=S zF_k|ZNkBHdBby{?N5sZp%WnlirBT6oznjLkbdFF&+x@)q-MIFj z3OhcOXxkDq`(K|*lpZ3W230jRF3La6<5ph%RiOO6{{J%Y|0%0T!SO%$i@*2+n~?Vz z3;Mn`?0+^AN*!?At*u>6L{1`!f^?a``Q_G#a<+o(SnObGGcfyW6NTK<9u1w^g zIkmqzd8+HMzU)LkNYw8~Y#yRz(|WlymWx77CV&mg_BLHS9t_g(nntt4OS4nX?Gbsy z(C?z9?L2IRMkBRs@j(fBL$+CPtCB7FFBr+Fx8WKp9z}Btwvm+{usM`+69cz_+YTy= zygKF4#d_zY=Ju-YF)RAG5DlZyOq;~R%s1TJ7v9#94VCbPqY@>N;7mp!zM#?b33MX3 z;eGCfQcYJX*{`urvuJwm!3e_#<1J1GN>(s|)xr>dyF6ttXR?!*h6P0+{aWN#P5icD;4N9fl? z2Ud?sL*=F^_*HCge++kp*R&h|Lwt+&LEh6w0w9T52Jg_fR@U01VW$eKeDmvGS#XKT zAYzPdf;o-C&h9Q7hg(MT8Z0(S@zMJzo(W?E9(>jhOwJ-(XQOrnDY(qd2YfTi9J#OO zVGl@uvy@WP6u$DwlRv{u^;Dwr^+?fj&P^NEYCy1>%D@)dOa7fD-3R+*#;*+Q?RvZC zK`t-BL}F=rR>Vlg{xtLDj9_CqFLzZO{x~|Xbk4<4Z4Q5GPMI3m*D<7}u)@0n&Z<0B zOP*eK#ezDpEq;So?$^PN~c|BZ~;48PiL$UGhQBvBBLf`4ND~)Nke* zKkqk-@0YV}6HEWzj@%YR4&(pr*HlOt7)p~v5+w&Ly%^^Dkt&YxcN3|zA^pY;k6^W$ z2ENq9s!HvFfeWdmy$QBfSf}0 zC^>;}ai+D1#}lOnx3%kh>YZR)pNO1|(NSEE)#L!j50A!i+<@>bMHB|9(cfxQ=f6Bj zj;lCnYft@7_->$P&5Vu7P*ufQ#?U+*6sGhm$epd%pvi&!smEgLA<*VumwaDi$pQRH zP5GwIS0jA;?&U5YZYEoExfZ{tgf@L!XHVzF41xPvmi!KJo34GNdp|Eg_ij&Q?0gHp z)_UXaqrM6iq=X=UQ--VL1$N6#d&_)^rs(J+N`pVu=vX$LuOkEq0T1u6vxzboEOSSN z&sDteU%CjJ^g`~k$)bQ!=d98H3hTo27W!R}EYEklaz)CUG+_xP<@*}(-^9}Y!QWpT z`9C2MNvM{4_G!g8uqCjtA<~;T{==s-43Ku?6PSCJaYbNfW<~envhS0Zex81*Ct%NK zxV(5|p$d~UNJK>*-_%e@n2y1|Hp*te!7@D)EgdA?!oR7$861y zem0{cO#(CEf{Bb>jcSv9DwPodMhZARpJFb-Pcl_>r^kZZm*$ z*v4nmr51JQ{`P|o_61w==4kw5!nwAM>|o435(nMOU%$FBp4;qTXjK8giJ~*~R;|GQ z%qdd{P*Z+z)3!>?)R*oA-dWT7?q9O`S6BrS!6u> zvogmWGBSj%$@ZBq@uLapg^`+w21`r(>+<~;>$R0APE02HfQQTan+)y@&nohy6{Ylt z%K^F_vCM)}&5gGWi`f6&h#JT#GCjF~&b4towUfoNbYUG}Ki(nazq58&?s1#|VNRSe zJW4_R61i6~fOSC5RA3Il#eQlg^Rm>j%d>9~&{R*iuDjLcDuh+uUZoZaNRGW?q)%2d<8j5u;ivb*0=6&GV(y* z>utaCpT7)eurSHtR|Xa`M9YD6T}y+yZ^ln{#Ze zhzMNV)3Q`=Z2^f=(hX&G5OX#0uSI3MlgdR(kUOPM;@F`STax z9a`z&s?c=y+Szl4{_jM6?Xk~wydGOR+!~Vr=W%Z1;t`gMX>KnjhUd5ZhdX`=2NN1M z(JvU@?F*OBC7P8bh+@w6b=vPW$J_eM1UM@J06#MW3*%P|Iyio>1r!=WOC{cMc`pPwA^GpQ9hYq__ zuz(z}wel<9bp1F1?Zw`yJxqQOev!U0+j)rU5e22_i~;^&xpd$P{lgWek$$ts*$$-j zD)_TMBRQh|o%9)f=EVC&PM3jmNNqciyo?swba{TsD5BYUXqlh>nMsp$ zNIJZK9Mqah#RS;CKA6=EC3Wc}!V+=OVI~e1=ezb$Qc?nU8Y%hW2;kTgS8Ksr6~Ry6NdDvwj@#FW_dRp~i1i zuh61ZRC#gHW|h4qhXpW-Xd~Zr5*0bbaI%~QsBc;|7*haV4gHBY#gr}R1dDGU$!VTv zfA3h?hZmepAT7N%y4prlg~`~V??%|g;!&2$%9MwwkbRs}n{@QGw1B56Opumcn6}E= zgxXlaGm;7i)O%#sGhKo8h*HTd5-J0PO@fb!sA-8gS!F)hAM_Fy7b?S6h>YrehRWq3=N1c>&e5B2me zJ24CHS@hnufHd6`k+ZyhUcx3D*1t+UyTG(bVeq?{uWF8 zO>EurwwSdvWo4N!&zZzw>Gn_Pa)B2a=z6cKZjL%JTOCP2ep&oQ4p2PGzgBmDslWfM z;j1;5;LN9usl36>f@|35CRp5!a>vLX7tCaFtZ1KIR)6RIYr_i+lF^_P66LDOV+<`% zklQaGZw#1$qhrZkRF?99T9WDxpR znb3rl`{{-m@r1I=7vM|N7;Y-l>acvO4~77QK>-l|s%9A+=Z0WHl?+Z6mdYKc&XrYx-Z1`W|lhsu0@^Cu|Sx5Anv@^BEf8#jcCSVG`(~ zp~Q8ip8-g_3krJOs8PKYpe|%>R>C&&V8AxBB~#J7&(l~Hzf-vSjr+}pd$Pa7pK8Jp zxIA)FC+#kpEgCCGF?N{^LX1)Q!%s*)T4_$?OAr-FF=iXXyK&sIY2d}IsY8aYMz)*TXMeNH0o+#*&Z1HX6eOZJ@8 z1-t`Gy!&5|7sznRO_;!Zd7+pCvqtZ%)+%k&1_Z}?fTf(#9hcw4&y_jH{VM4|SXM%; zWFw)X1)-jUbh;O3H^C_gYX@-axsxT|=p{$?T1ZBk6Xo3ZXMG>7+gM1Oo_|FH5>NJ` zUNJ2SDfCevHtbJMCk4zgx+tS4tQXA$^E?%D;_9D%7Ww?XQzXDcR?M)o#y&>y`#*x! z3eiBHzFDxve4DZ1weWW3k+EWKfz21y_QAS$;j9KA&uPh?QfFP10q-}zdkF1L>8|TB zHDE_^6NxmIL0)}`nE4Vl{6JVg^cmosq+p6L0 zM2ynMB-`JUJn}6|ZYWU)5A3P8ra*u=Q2gaL;`@MnU@*XUH%oLXy)*ANumox{h-LH% zfAvS*0YS%Y52fN3{#NGR{-VxSMaE{>2y5uK(EFyH5gtXup4{bMF>-Z)apP~gS3ZeX z@O?EgC;~m+gRWdV=Ww_cX7`vI({8eRmOQ^?46MIKNe9{xU2*RY8E#XK^U&VNR0IbX>lJY z$xMtB9PnX@AY7995th`7h+DM=<5QgOxWx)`^ZN0HZg99pdMlt7jx@PzX7MYKqI$Kf{$Ol;8`o!DF|QGXLFco`;hcsy!RqSbOQMcJtbG1^R1# zdN%qy=T2Z(dxMjKoyUQLLkf;3-|r3%qjXYhVxu2dwR-MNC*)~R&qdZPYDuO;b*I4x zkFd=h?X6SMVjn&}riwb{)|_xFwr^pK?3_pr*=ZapkU+M6aOcn2*dT5;3J$1$8K$Qj zMCm3RI4BzT+O#$-1GqN@axF6VTO>kixze3oV^Rb&-*+mUK@_v(9tS>jjckPO@xD= z!9uY!5$^CERgEK%dAeSoOBl$%X61|M;7g|;EGmwNnYGRv0BM7vN)R^2H&T-hpZQ4a z%KVOQb;sK1dyvy=J_m`7rUu$m$fd4|_@9PLY>gxElFG1~{Z(nV{1cu}lMiq-_$W>A zntVkK+jMPtMb#Dh(-3xV=hSdnI*5KnE=A-EJQ}I;OJHSq1NRsf1Of+5pkXtC-$Et$_=tn8Z-iH;B8`F z_KDRNWhlkP&DD%@)Gh*Igr6j|6{*=!y0af!WHW&1Y2dFA%&A7RqEMFFCMsBD?h+Ggr=#@GN|F<53?GboYhUjXwg9V&yYTE~J+_bbn*4_NDf70Y zt$S6VNJ)X@&Fa&)ZAD&z2vQBq z=JU#3FB%Q{!vVm(V)9P>*Tzk)cBUg?9El*xYmE*GbQiAI6st1r>^717*sQJFR46bq94|oaT;@v zNdC;lU%u{8dJubRSI+f*Z=mO~0n=SFoB(7le?psQ^AT6RM%z(0vD!^5XU6Y1`TWh+ z$ds_KBdNBY`ksBB6+{SB3^q_>(Cv19zqT$=n=o-!lOBIsH|CO~SV1tf%m%M+VXNyR zTMQRO(?Vn`oSGE04Vi5ZF8&mRE~1xnz^7ESQ>m=C{aVee_k(BLFP>%6X-P~R8ETq4 z*lx@Y zr9TH(G7wjAmXgw~PtCQocn~lgwRbfv3db?-SPHn+=IilgFV~^`Xz{&%Xovk)hP$#_ zc&=Y#q2Y_zF|v~sStZ3@2f4-XoGWWMI3PN^ea~(s+Naxp<`h13K*!GcKUm)S2g`=y z$THmjRdD<*?f741?qUTb@@exRu|C&v;bQtr&3-D{7o|yZk@bK$O+5d=ov&AM9bM!X7xerN}8yZ3< zj)F0J_vvi-KTNUpebIu7j<5TScr2B)7WWuwHkDdFkGp3~=~nm(DUB~#Eji>eZs592 zT+tMA9}K+p4!l;`>tlJX-IHq6pIVP09Zb&XUuYZ)Lk(;qGjrC}RMu8q4lz2Tc`;C> z(o$+-w@d+jo>P*cfw`3V%V6?lJle)})-)C#KI@KO4H}ng9or~74HG@;Q z`>AKQr&$3{ii{1EMHs89A{mk}%4g#8JPeeUC)btlr)EyW7hsYPo-Jr?qS9V=suFtM zYECB9fytHNA*~ri=mOQ0;3f!=AZ;%lQtn2kU7!#nWP++5c=+SP>Uon9G0S(=zbSkr zImm0DDzHI&Qwk{#G2$)|5@fh2$MWMFQGaAYtzQAtTFrS13wc%-BP{5--q@VB>;CM3 z@6YIXluM{p+j1v4ozyBbGHNe$?jG_8uTnN#KmnGP_Gwcs+MUA-uCjN=xSz{<2Wm}< z2Kb8KV@QeH^cztyRI!Nsc~c(N;WL+1tNZwsC6o>1RQ<>VoPX=RjNkd21^BkX-zQlO zv&NWd3FzP0KE?)wU7Hw3Mt*ae$FncFO>TAH!gaR&3|7~K;yVA~Azc2mK8ooaEl^L6 zO>m4O_m#xVQJPB;RfjFS*=hS%&_;6MP2xKe^V9T5&7q$bF%D<6=w9fWt&5Fq-p1a# z@T1=CCcnm8SdshCua9*I%?oRGpq!2gk2Rp+$_(wMWOfSnttGp_PqCXm%M_foQ#%0R zsoCE`z`5V~S9X)1z|0;>A(C&NCk~x}1U;L577%=a@yYoFa$<-!AMLPtwjsENYDMD| zno7I|{#cWBo7g;lXPOvyIi>4hxtBB+yibT+H<)~Cxc|)}LI-q-^qO#9FS`kO^IBTl z4C+Q5TX+nyHHhn3F za9zu6lQtKcT z(VD^6LMbUlwXQ=XC`Id3Q>e25=j9t+lE{*3p2=!_hZqr#dONj7S<2t1PIzzhk^{DL zC@OHA^^{aEI(Do+4d{<(t&xQ+-lm0X0cUXfRT+gz*< zxlCJYD~@!gQuAa{+Y%9wRuv~1sx$-JzVaqN$470h)ZRC7QffW-yj=swyhUBGi{HiqspZKXGEO)^@#<+3=yPDvL7+UNNb?kBcDS8oqNoN+y8?7Yo|c#u&Er zBzxz(LiXF2;$IBEM>`rNnr!6jrMWmOdD9OKFplTMKFpwNg13N&%YNdD`&i`UD~f8^ zNLO!c;>h|TI!UwOVwz02Y!nmwrTftWGkjl!Wxhs~x12Yep;?9ZU3*Jt0L`84-{xWw zykQL{Y5_7Vp5w6G?YM8JTdHcyYxm&z2uqHZ*C$Z=ZZu)?XTWHqX#Qb!M#DLMbO>?? zZ5xYw<=269v@Ucl3s2|}s6(G9VjQAQ*F-d>R_wr)4hhhEyu(>WZ>#r(5$gjT+lff&0l-%zft=q90KF_$2y(&yeq3y0k54 zPh@LiZd-kQI@@OzHl`k+u6e2)J&p*=UB$ZnI(z*zJJYiz2r^YxuAi`Blh!DQxPa}$ zfVU*0&z>z1%bfr1-oX+vWYhf_)4!wdefFs)B_UNv4iw$9FC>>Fj1qV@=@v03m-p#Y z%#U|q2t!din>;i|^;{a~38V50>w3rRtip|qTVAG0GorN8oa*A7raG?iNR*QpS|HjG zE>Aw20MO?O6MWcV^xP$~us(R74YX{*l&_2Gp)0+c=+Ersn@;x7tq1cfs=HG6l(?mr z-BXtoeDn}x*H=Pc2ex!GITBO-@DplwcMp0jC%A{G?9MmoC!4*~!+BkUV;h*nfwa6$ z2IZb@fE&z&>k5`^YgcKAuk2G)jGx|gZ8Ow0yXHjwRxBL#J8c!{$o=tqmsS{1?R>57 zj*q_@*zp=0kdso_S;{y(ecEv}Fjq@JM4#h-cO>J5dNwoIj{@l3J>#=3aTISuM^yKlXQ^3QQ!33m*J_8WOH+~mn zDr|JCB)8J{R>EBIpks6W*`8^nwyA`+#525%!6QJXzWOfcHS58GSXoEuxTtL?c(}0e z9nmPla*`%cgT`V^>6|c{ugqdkhL8FB9xfbpWw9UfO-e*ClLDG|+En`GkSEHlYOw#0 zi z&X}6b5zRvq161dDlY=2u=vDiD7|NFDfnQ!PX@IShg-KEC8K@2nv6mgG*sD%kygM@8 z79Yg#6I=7kTF&fSfBNrxbPvw?_nRzP{n0t=j|}G#V7+8Yfv~;>B88hAEtkLP^7NZ{ zkU#WWdhY5gG8^o8NYQxyJA*19GQ2_#mQe^EKHpLm9OJ!)AJGqZB$@8d19CsO()_%5 zTQ0kcbXa5Mx!m<2H@cmdTiEDDJW3noVF)h_O6!c{SDw?U$BZI?2wI3W#U*_`K zN$uj6X>|?@YpH3e?MDrS@e0iS`OyHki(>L0djiabb9*S0TQX7e>g7a%tis-MJ243H z?p8J09Q&v-WKXMga%Vr(A)or|!#JKJd7T^E2;A>2+m;>#6&j+|99xcAQ#U^Fx9;r2 zx*Q%S=@N7M)&+dDqX5vasZ0^|1X6$s;}J{*CZ+e!ij-Xcr{0u7L_6RHaEsP4{Eh{r zonzTvhQYMKjOlSMAQ>7V(U~3bTFPg$Mfwsb7vY~C*IAqw==Z%rX!K1l&WM<$?|hQ% zn%9M|i%IIvAf75DEZbIzZoSOx!sPJ=Ik;IXiDauAI8I0O%;qd*R z8aO9^|ET&ZFLcEJn9a5FP0*@9*w>y63Wh-Dc(uyx~F`}fYQOklrH%O2`u8zY}HaOT$OG@gCt{B)8@XNs>o@W z4SFr_nPdWFDhkz;P(6C2Ayna!LSX-chOvz)YgbCoyN65@&A36he^H>?#fow|Of~ju zrP)JmvG3@1Yin(P((6-;To*qu^ik90TY%06%1t_`W@Yb|-m^vUM-hfcBAp>YF*`DQ zCEX9^eqkUFe!jo@Y>`un?#I7Y32(O8Ev9NObysOi%2y%Z7QWpf>RSLx;I z*|vAQE%-71TH=>HCX4-Mb?-Wobrg3Hy>!fbFoN=8t3SPL=$EyqtVTqr3AZw_I}IpQ)bu`B(rk%Gw#@`8JnBV~R&F zQGe(1haKm=D$@pRe}8keOp%c(o@xv8+IiKpeGDyqk*24r?1GbtrfyQLh>1tGV)Aw> z#>ViqzL2NJcC}akAGY2)EUGo^|6PEDfFL3zr6L_e*ARkAhjb6!F?5$wN(x9fNO$K9 z2+}1vba!{hnZ5V>p7XoTIqO<~&YE?tr|z#g!LkI#qDIA2|Fk}G>i+nBBi@dSqK*JUstxOap~nz$LYxmzCF*k^ zcazc|F$BiOpgA ztC#~rfr)!N=s?V|du@f|`$TJR`5}=6+V&-t{9RY{OqT_9CyQCksd;VvR39Pc8BeNA z1FDAJKW2v?uKgaXoJnv5hWbRvpc_vw^KYk`U&{I~d~~Z{3eBBgGM(HCC_NjEAO{dbT>t}#BFG-twU2%|g-&02Lznd&*pLUT_ zW>qg~_f7LVzNdcDX8OSmrihm_T6C%`z6tjNXqE|UdYf=W@A{bOrSONbf?w?ax;I+I zKm<5b-IACuvDX7TXym5@sWB=)GsNG)9V%YD*<9Q5cYH5k=FqxW8+~QNl=hqE(|?h} z2+#kw;q;ICdND2GFNVI5&j~**BgeX>%cGk`>jn?~l^LJS13|tyv^Gw}^NN9kqu9pk zP|@a121B@g)u6}NdaJ-h%b@4{5GebCt)x^D{te%=bQX)zXQZCcEjtZng(z z0)lEY4pDb`+uEz!y~In{27#AL?%%ml_b|I}8h+AF=oG_gE>uKptlEwa=cqw>G*lL~1`CK3DMVG9PD zswmdr59_AYO9F!Y#UQzIZ&!%I<@S{qs4kd+sCa4vLG+0s=**;$?hlJ0j==y7t5QY; zFbhK)?(6CG^`UFo0WvqH`EPEU7aO+cDnZM3JUWbi?{czj3e4A5kQs=lZ_~V&ZO*o^ zfIoxZIeM>QUd$7Q7h2%aTFjfM}^i+$Px-{h{(^r@Yi_meEM~uvAk?{5_$@l6&4rke_l%Cq9&ay zHH5FyPQWiFiS6jD5by^nnnrUpe~U70#r?kPVc*j2ln*HO+++rYC(GR@NCAP7f2FQr z*44EK+5Vi;E8rW$Q&$o={I&U#nXP-T@f{^-xP3bD+M@DnV&9na0-v>hUkAG^uRX^@O z-szhkKADfgQ;?f`iAGO3d7u>V^HAe!-~_zv631(SVMfNOuC=i_E&arlsCtqT80hnw zG#`TefI0JcJ!w<*4^Ni$zl;FE)m3p)egJ!Hh_FeRu0NPK)8}E2M1w{@eMpEzGz#u? zP+acZQsOd9im+)FKx6HHzc@6Zb6GSu4GPaFtwOPijPu&YBINI@Kb7%zRD7U*xP812 ztEO6q#=qT|47|Fz#@I=}-KvAKeZmEV8`(5WM6UO;H&)>;Ge*4=es>v<_xd8$z0_W( zFzthot42?YxtgA>UAg*WYt01IV*E4jn}+b4_fXNt_xt6d53|`@-Z4G4h!E=eH`n$~&;4os z?EP0${M9qU$Hsj9o&MgSvJj1jYi4;ImE3YT?^6~LL2bnfmsb!dUri5DKvJP~@<{X4 z&Fd9k$L?bD){5D?%?yTZGV4O7-u_qk@OxJ9I_=>^_j8n$>pGia9g?&A4BL_kL1y$a zw6kN>5FNwWHU-(cv{~(B?NAcYS_({_PtyhNq1gVl`n$d~-Z%ieO5&1b%IT1zwxyHy zM+^0_l|N3Pa$SOo#T2`8f>yfZ6b6! zqP4TyOb9keGeKi;t$|iC6$h(MKYODGW}A0zagq}q3Gi!-C>oiQ@yhDNaZ`6w>^rPT zzv(p!alqO@auQ~vSy?Aijs02=FWTi5z@sz9UwrvIGnawuo7MxO_LcqDXwnG%1Ii+7yEbuR}Xt$3KoM>vPqOh9!7p@N|SAw>#< z&2m6X0Gpy#g4>KN|A$ypbBJN&3Xf!4=^J$ITRO6M}gaH1QvLtlnJek#$BG zPS%%c%_}04#p$4tooQZVn}!*Km}aLrb2g{$@BO}%&)BlYS(B74hHH0NO_}!F@d6Y` zA+ydO7W;f}6UuIfv-i>)qqX3h;A9fNQcVwWMwgR;B2l8B5e!dK63lt&^+8kb>0p2$^!7(L+F^}ZB{mBSHC*>eV35Q{p{>(?RL-G@ zO&kD#KXg27kE(lxhd|{{!GlhBn`IXq0{Nd>D43v{a29mp4<>^;Q}l}RgR#4O0Hm(Y zQex3cT&oqm;7afY$7sWel)U?esgs zuc~bp_fPueb?bYN5-B+NEN%|gA|88ES5P25sjBMcb+si1Io)f95w&-)fqYyf5mSMf zS#`ml9At#gS#RgA#RnM$|6c5PMD(2RAAtF|zpfIlw&RLE&KbOks(y1fra6{)6}{X9EeKRp3bVA6C}O3c~P^knzE7(i zXRet%SxXq9QR4l9c|}P%JYyrtDW2=c&t!(hBbf|gs;5nk`QGFu-@RGa`$aBSN^8q! zH!jg?u4Z?R7Z9v}M! zT^hl(LQMQ^U99i6u`Jw6d_Hxqk8}j4Hdz9)5x)^UX9wL~m;y}Ru0zgy`?o(PJ0H29TRIK4RU0MaQJ@zsRD>1Y;iyVD$R~bDP4(5Z(fz1t(b4{} z7RG>6{gRg*vShxS29CyB45B#qm@rtEgU$i+<|4tEN8t z7J)&|$cK$kkQCq-I`B{gOX?;J9iAZrr;v@%qPSpI* zrF6J*p}F^8sy`SI`8TmMA7Tzx&qocqtZGc7T~yKCqe|g351O!c`!{0OTf2o5uB>{O z60Mcru*6`J{i|ng#X*Wl;BW9!V@E>yok|l;V@Uke6ehbcg1gPko954n^iJrcg8y;9 z|Nl$S{tu5*YkGpz=36_aJ|#b9ToQ%nvqF7aPF|4~YyUHHDsTFdWB|gkh$w ze7C#r)s&LhXal8V3j^KDlr;jWtqgAa$#+4rc?$xweliBnFZ#BY@K(Y5eF6oXu^i;y z`EcqeB63~z24^kEt=)MB#UJs3`3%Z5QyF|m%IuKD#im&cv8%!1VaU}@%>H~r&0#g< z^9dzQGlRH)vmkGSe8K~JtwYW0yRJ=reWCIt_tq1|TfywoFX00X9tXuyk{w9ves!+2 z@cP^hQM1e!IPWD=agM2yQX0z6^KCJ}-PC#S>N2=lAl+8_Y#99H*T7&>rN<<-%F!)a zqhJDCzn(g~_ung+d0`^g<&=osftwz_%SlpnJJEH20(TDcBPx!0*#e^BjhEI#Xv^<0 z%NsYa317EJQHI21&41Jiug#~Ia8Jf`A?NA{-?}H;X5Ye!f@%X`rOGaourcxb zQ(>3YmL?l!*lq3Xb7=5X!Om==U?45qUKki>Pt}*1_2pvn}+`pm~(?N;X^3!O$|SAF5Avg&G}`YmY&ov3@R zG)H~6zb+Pl*7m6WHm2HraBN}~@+|Akb&}Z-F=Xrj@1-l7o7#rGHYd**M*+eMtH4a5 zY+ruE*|Z%=DCif35S?LE$!B-)$LcwuYMo6ZY(tFp!!!YS(n+Em>-ZP2?!vT z-a#k3F(ZpuO!o2}NSSW8)oAMfHsqtxd{W>m8B3?@d0c$VdvRPM(s^ShhweXUuI|X@ zQGUp#RN88cEXM}8q~j3?+*g-!Z2Gd9uaczAw=fBl)l4eaoa1n-HrwfsI=H{ z(+RPR?*tdANnrZ#FSy6eYG)nPsf!IaB7yyL4=Z0G??1a6RHV&`-k&5}_wk$ZuN7^a zQrd4i9$FM)Hccmane79Z=jg61+hvxgF|>rztJ}5REm^| zJe0YWF?BSbH`RwdIQ|!P5RZ(KCkj{$K2vs8lQiGQ2mCO zAztEUlw$KHQwt>hDjx&ym+@be4(HC}gdTA|?qxjA!@Sd*N2%BMHx8}KJ=YZ+$L#Ym zF3cZ?5p20WPW#ft^&OXArb!6+CU}H=gvzaV)a;~x7iruhqHukTbybI~f?ePdKj{)3 zlv__T4+ej}l4%L<3W)#U|H5fk;i27Ew&sDvycUfnI~BS(iS0x8_1A#>dcUm1n`MHF zqMe&cBHi~@6Ly}GBX3?y>7OU-T=Ta{{pI&ln&)6)@9FM1+I>8?E^VewIlElE93`UO z2S=O6LMN;^ckA*zf25=}YD@~^FO@#gE+U;u7LfR*$im&+lj2;7q77UBl=76~Q;%O> z=HUxxKEDVVW)B1V?!S}$3(JscFk!$ungz~{eO)X`s_BoDNcQXi4y)QHMCK20AEHB> z80B*?a$uA-V`3H;7X89ymDl)`_V{>T9OKq^#ikYb4H-Ch@1>5^7x&oPQ5mmooS_6g zMrF*8PpUR$6Knkity8@VnN1KH<_&|QOp!I^k->0S@!zh-HbYvin+6|NY0#g^o961| z4dJUVPKK3!v+gn_&&PjlrxO#BW8T}R9dSCiB=0W*S;>CU*lWHKn55TOm|f&~eV4CJ zn3*@n*+cC`)cR*tVti;jYNlNhQa25qk&QGDwJmcW{`NO^!@GlKo0LDv+wtDd$6HVG zwu{Jg@edt#H9~`NkDF=V=-L=soI0_JhbV@e0)DxD>oQAkc{@N!Zbyaa7<9e)N`k-c zCtGi>s*>~iB6PZ3zt2uZXgJu;nxZUGo_Y2Q`qA_iy_`DiSB{?`2ZRwHx9fO96b(d1rOfF6p-}t!N1kW6XN69PD?YFbBo@!>p6O3G(7Y4`^b4iek zvQ3WTK^SvU{lrhGmg;~50MYwdJ!;xH-UmA@=ft)~qi8v-1Ac1yjBWLOx{)c4h^`v7 zosi8)shf|otezX&GP`!m`uT-Hv+#OwOD}1`wp;jEb0naB!de}Z zJKy#C(rX*03_O3iBY@z-V@lnl76zX`RnNd3Fh%kM5Lo!(bqS_+rnB}^~BH5O$6 zEcB>2?PB@m8qBV2zC81HI$F69eUMO+z1^tQ!TarT3vC@O*!1Y=vn@2Jlae2TlHKB~ z>Lv4T0Z+O+;3o@XQ}FV&NvC$SHtoYBWnAqxg*Doa&}T2^-`vUs;^eYOGjtz?#VK_Q$u^SS~QkV8ZNgg5Ck{fV2b*U9XVDVwJSa@Y~yHg zYgrapAUe%z@&x-HPEN~T+I6e50#j7I;9z4bZ~Tw&<7Dr`F`fmQA^^Wy-^lp#JbJuLlyF%mfo5bKXW0h zKo)=Tt}*@gG79AFqBJb*gwIdGI39C-7L#06S*d1kGWZlaa~XQ)(HK@21!4c=pV_al z!EJm9s#^3LKHap1_J$x*A>`$K!_1|wu6csAJ(tskW`~nq=?Sf`raiwkmN=P#9FDgWO(=rou{`wG<}Vb6sj_ zRQB)kv6FY`JmaIkrx_g^wj2k6V2Xz`iPNxLi>i$R zO7Ix#!#;_;6S&(*J|uV|fHXwFjeFY>ac zbNpT*4PZLDudtM{W+pzgt< zxJ2kxE1#3^t50{B(V^(N>6$l`mqaHX-kcNXhxmm*x`{$_-_ango`)F7+dZE9OMOPN zSphAbIrV?AqSxsG6i1ATX!ES4;d^_w6HwB5(C+nE3>hfgxu!P{{us{ibVAUJey15f zgPa-5siHUUelkNC^opm2>+a*gwkzCVjkR$>jnIvSOZ{YHUTSaqiN8ZK zTGN8YOU>VB9G7VCcLEl9dvYXSahem=>`_q4mFqWB{%oShXc$a*oNb+1cZ0>oj!*4o zFgzj7z$j-78^4zk-XjB>F`U^ zlp{q?fz<7?3mNn*EXP&Pq^XTr`L@V(B9$A^6jff}NNl{y;X!Lgd8x@bPnk5pHxU6{ zAe2j(ha2mFoB4SKQzE5X5#F)J)6zpr&D?-(PN%gBwgH_?w5m5mwP zdU=)Tesg4}y?*sROL7SZNE1jWei{p0MvqMVISxqbx*%%8x~+8^n!b=CH65ah&ZQw- zuPnQ`ZbsEMcfrR@WIodv?KLx;IM~cc7PiS7yF5WXd)BVgNqX91A^h%>^{;qCNBSpY zZ`dxoBNxk-!RoKdiVQD)!TmNrqApdeRyM^Uh{M!Q`PpEuPgAwr^!BHkj@N6iUHS%m z;=tPhHU?a4q3YK|(s780#h%;nea`DqMtzU81aNU-vfEvCxBa-C0ilR5uKF$wVR=O< z;&ReTB{XH5hK~J|b84Jr_w!Wg8Gh?ABcHCv} z8~NR{j%e`-9d$~2ev5E5*Ke7}mb4C+>CfzJFX!)%%tNm`W+_IjioT~y+Tc*93Nhbr zZ5G#zw9gWkG2^;AnYG6jP2VReOAdN50||Y15H+>A=SJ2Rp7kwj(gsFd!OzDh3d@Ep z{Z%%M4T7k3g?}W4sRPb`XuX* z2WTE;GwQwa)%+loQV1oYI1Phk83ChJWwLC%ssZY`6X5HO0hozc!b<` zqBa6g7~G(iL@X3F5|%zkwPSx#ymDBTl%}o8?l$dYsF|)5sjEq>jb4tUBK#w&Dy;Je zs=N25e{{jIq2D&OL?D3uo`j@@)e9*=J&0U&^pcgK+S zhs_@^Nw)*6>($Pk=KjoJiXtV}rpdo`LGLeH;nkZf~pCswC42?`}UCrRkA0ez| zzG#|H8y%b7h81h$3;lWtWJ}5%FJdR*$*nSch^Dg*MXA*Kq{`@*xABFy5yI1 z0=4qs2dCQ-QTR*k(eaV-aZz}?$8GcX^Qo<-$7+pJ+HNi**j!iw!ivJqy&Q#}W;@>M zQX@Xug~cbm)>WM(kipMT7|-g2^?px`2{;go&1pHs0t~qO5ktI(gZo3XmY?r8GkiQh zebSTO(D%F0QXQnLprRyyxq3)E5!Fl956!*v_yMpi#%;qJm9fyb@Fq~-SRd~yvv5?`{4kW znF~sj9;#1()$3>lyhc?ZQ;64@DQSwL539xvWQ^J-7W&2fe!)kfs!pH%eCAEX zS6^4-61i8scq=B7vPyQw&qw$6mk%ZI$nD#ERej6mntvV`Z)kFs=}KuJIyvbx)qqAp zYe7m}tFS(QTBpcxKwfmwi#f)MGNHYe}{bTdkWY?M9z4=_v}#G;UZLAzgg<0 zF}k!6R^n4Q=T9#xXp#)M_iDK~p%|Qalq5I_1TF3}Z3>}a)k6e(yyRdWr=jk;g-D?1 z2lc9|I9$*8It7_cf(p0GJm2F{U#E(I?t29SpyW@1$1|w{P#Vi!M(R*^(o>a-v?s8? zQ`~h%Pk}(;vV^-0F?j^L`&<*w`#&~rG1XKrA6!3RXD|!+JPr%=W-u@0i*jj7s1;e# zyf67n4WS*k=_Y;bqaC}xgiu>T=^AdUKF$BcqO9_Vvp^A6xn3={8Q!MB96}NogB}lirkU4kxLte zdWI&uxQcv3QQymu4Hp+oAz{%`uo4R0Y?LW0=CdlksG*Wflox$+Ma{*fVUpg{M|@NQ zBql^5TYM*;2-&>LS;R*P`xu{=e0v85OP=GMejM7}K!XxjE1Rn_D5_m>Y@ zYHm7`r0m>m;^S@Hro1wHVt}B(5o~Ip6)m^*n)E~Ml3ETsiBZ)7=U>G*0LshiDt7yI z&wo(CuyE{M9Zq~yeeQ% zd=kyJW2wY?CkwlUUFO1lDp8*+Dz`NamP-GCg^G%{yD!2(kT0jmv%_=sk;#xb9zyh+)~SI|$5f&KGEUzd&TNe(cZF@NQ1tWB~~gz_`% zIY8-6IYKS4mN{L$x6E|tUa^H=BH6N*(Q}{O z3p4u{)V~`QsC6}W$=>!5B?O@LZ+j>DexEw5qXGohxo=vdQKd-3&d~=C=PYA>e3B>dV>#B1!9T!=Z)a6bsGQYBts|xi74c&j#`r2GvT^yz}F=y#p zrSl?NH;r;GJB&|286ao9hPZBUOsmN)**A?2_P&9aR262fK2QCU9h%gkQT0K8E6mNc z#^G2R>RxZXS8!n%o}W^kav8wbwO#r;$(vwfZHx5B=zy1+>~(-58YM-VI9HPb7#i6X zNtdpXOz0g$?;vL#K5}z#aC18GQ0+iwJy72caSKrt9_Svapa3zgAcdEcPBP2gQ`>to$g;&~y3Wl&7h+dtjKnr9OA z^gTO7iKjve^GVJybBG4nTJ8s=c4`xuJPk!%&<+b(*l!`Y$%yUIRa1~q2W6~nMB$DY zD9AkYC%KI$EXJK|S&sEl&r8$2SeE2uP+@r?n`;6v{$mmUFYDp|G;7;04`|zyZbpX+ zSE;XCL^JJ@?9}9SyS)>wKtX*TEly!?P7C0K+t`D;ijG zBGU=srb++_J;Ur;pdjC)O43=CLg8@p^2~&~f4O})6P@f*QTY@wa5IvdJKfb1Q?+5o z_Kv=p{_XpAbEamNI-{gGd^D6oL5cPB z?s*aFK9Ca&I}fUyW-WXFj)1)>}R%gn?WR1+dqw+0Q`)$X~BQcFYRTbE;KV z&x1glpNxRH{pp4D<+KmP$V}UzJW7zlpd6@-Vzl4|@Z9c@nxjF8N|FKn_4*#$v-7hk zo3S9^s`=DM_=65+e!%KSon5Z^wEJpi$-`jhDY8&ljs;{!0LDM6J26$+iv;ZIz1lgT z)LtM#{ejgu&=DIj*cm-SCek)l!t)SeV>Dd$nPsKgJzv^^k?UR<#x;9eqgMnN-5j9A zg3v#X>tXA#Y)~joJNK;}tr5rJOW~0Od*0-e-Dzn27EPtxqD<8;y==0W7o)#?j)Z|A zGyTO{*6y!pV+27V-v)ly4mr!qKe8IsF$pm2Oph9+<(Nj3)@bq+<8kD+wQ<*4dlkM@ zUZmT{dVc!r?M&jXX>N(BKi6K?F2|`EJlnoUVKOV04kIw)>4l62_Y0=Hiv)c^2)-t| z#cHE#eY=K#M=m8GE)&u9shROF6$8X+I1zZA^{h#ci$M$Z^?n1i%v}G-6<+jnERL+C z$Z?Rr=qvjBmL(4@4j1C*Q6Af#L*iHCy0gU=DE=ScrurfQo$0?Z%&KZ+(AC8!6buq(!6mN&F$(U~U}%68Kjp4|q3=5fm)oY<6egh0XZI8UTC z<}U#V+jS0e&a_DV&qF1^U~rM&=35_?ROq)MtHi^8hf(=CqH;`zZK8oR3C-u+=%m|{ zlV}Xs_QMA$`-9()o-#gmNvR!+MRewFT@o)EM|tRtF((qDwa>VFWi{sS!`SdwJpsdF$eVvHaciVZsL+s>Jp>QkRMnC1% zvhr13HVprJtXyU#VHN}0&%>6V-`d#o)ycjBUQfFhUFV|wn}m&AHa>VfZSGbXGLymr z!0T_Sn$ihTKZBKBa8WlGyO>slhMV$Pi{rQ&pV@OdM~pRH5Qm~p?7fHr*i_nt)6d`@ z%s$(0sZF%%r}2Y1W00Vca4C)Y?1)kcYua50#<~ozg}>kQsd^gBQt43t;Ak=FYlVMF z_Le>5_Wd3xXyc{UXg~?H4%~;<8IO>IvP$vJY-EAIbj&u;#0V!+0wx(oCuo!0)pjs~ zB7+sh!08HyNQtiNQqliHN|-WXv~-?s6A5PKKYyX0k=d6!tsDZ*(gEzR_=Ok5=GV4Y zz?5(3oouUby`KUX0VyYBICBTjX>vkrp)*0Agg*1IKE+KInG0sS-oyoY-x`#?I$D7( zp&26ECjI8<+9!YzLAmgp?jvNL?`_DIRQsP$IoUAV6{u6)-rUIH0B;Xw+>= z73f2IvOcomi!bRuKu7OUPv&2*ZRSU7|1`zWQGy4Y4>4L`{UhsT+P}vE-0DRmMES@t zLGmiwc3{jog;)?2mif6@w}hrjfyRVlUZs_IExG|^6at83v`EtuA0vnUg6Glp8 z{_#t7{j;QP85p~mdYHOIU0k>@nvT|M#FJ?7DNcz4KOD(~>OP~s?=!FT_&VmBnsdJ1 zY1>yx>M!Nq(pcBfQsvWg*R>|f7*$>0)KXK^;$iQsZG5HMb+dDV5hGdM$-Jy(``vW=2t3R!+&~As+djg}{+Cb?g9}AgX^E3&lS1wiw(E5Qm{rtX8#- zynmg&Us}on0+o;GBRn3K7j{lY`!-M%-x8fRQbaDD6UhdlB6W1Yi#Jh&Ytn$!)p*)O z?!>eB&)DznYg&;X(NZ}ai=_SUY>bZfbrGM|=gDCwo(-;dc1{cuPHuN%TZHU}^;_pJ zDl!pNkx_8GCc>G*EhBxwwp!!=hvH^i^mX)6BE^uzZGaAT^epgtW>I^dUuc=r{q1+v zHZv!Wa#`KCSx_hoYq`zdn1UkRuLBkktCA)QN-X``F@dN5N^kMkX#?w7Ts3MUN*=fu z+H2y{tMWZQp`(K&>Vke*{QH~#MJFTuy2$%~)J~Gyv__LpO`UvPOkHdfPV^?tS0^L{ zM9UzzGzy?)s>4z?PgshCbBF2trr8X0U=Ni$dfkLXAMt5j9X&0*d4Vexj5LLWPm;9b zmC_UR|KKCBMA<+dZX!dy230M|ru)e++Y}B}Fk!QhOBu^HXEpK8my~S>?mpU1kMAv| zHwQS7Cun-t;G)UpZE_)hc;Z@KK9qph`))xuwwE(yHVBtKYWZ0`bx9m)-ptDr}Axht}yS0Q_+CqmANIdk79y#;$CCHzZ8i9u}0k5@n z7Gk9UOK5P$f$bRm`4}+SOl}n#mUBmwy-H2Y&BO5vaNCwvnrO414Qs)p1G;3?E7J3# zZAboc`2S8dfX#OGsu>#rqXF$7p)P8xiD&72%k#g!iXF;M!o&g6Vk~tYX+a?O#Be(p z%V1F0>&g+o<#eNt$begzqH_$NNl_3tKJn+|!Z7_vD_HGd<{Tv;O2F4H{+ z_Hu$Ujq;m(;NQ=r^1|}0E3@=Gl)21V^542aRI7NF`Z|rU7P8YbYU(MJ9}ey+@bA6b z1P}ZGvg1u|%OCeQC9)=FcXa$9 zCkY16Y>X~gN0LU_H_;UDojE3AhYNT+|GpOUU07v*MizjQ`i?n;Xt-s@C-3e6d@LI} z>6VgO=AOouHkY!sNvT>ZsIi_$3`a}FZN;q(n~$;U_WISbSn|$7)-A5lk)ELx|9Sk3 zbrIPUVt7wA+?h7Z&5&LAPiIc}Gb9~bHe@Duy1l0-JUJ*WOHMNF7tcXr{ny#4UFSYM z7quF190>6gv+j4h#CZyDVuPK8;}WYw*jU8$LpLUgsx!#%gsZcH4M4Rjt`48i1o(^G zej?KYe#4kO6*u3tIr^t6(S&ImnK_o*JX^}$Ce1xBJrg=Rjk43EVy@B%TR^MRiM4g1 zDszy45zTd>04l@TlmlZ?y)d!=Iw-GYO}+)Oz8(Ei$JDfZ!1#TWa!zs1ZML8BqksDv zTHELCd&P(Hu=QDI|F~aX^kqry6unJl#;UViQtZ5`ZgqPv1%FfISGlkVHEAB<$G-Ee9*Q{QZqGf8v4yopvtr{kib}(DXq1~QJClJ-tT2~`7 z5oecU%W*Tg>A63&%bgCiDcdGqlpdjXS^c;XSd8f%qBm<5u;vN5uVA)9cY0wksiIz- z?hs?1N2FATT0!W-9qSbjrfO{Zqz(#SPb>`DL(wU%%+q#b{PAa2&(VFZ2F6X1{ZLF^ z*Z7X@AK41>v^#t9qWu=j>VsZKRdT23Ncp9ep~r|}L0Pu>0RJZ#3 zb=x!YsB@}+Saf=KApo6Tbf8VSx3$&l_uIO$5dNfgO5f@RGR#;-hi$|{@6?(mPv4FX z4o*zJ;m*0a!k_b=8`+%5A(vCW{%>=N8kBX#cuUjnq}(o4CAmQO4JMevC8N%UmmqRe ztFn!fyC8e1L<=bRrE33;y`j&dvm)NOaWfHVSxKFE^W?P_?9g5BU;xoXrS;Mv=Qw(s zNZ1&Mp3j^wtjGT;aobjf>jhIu@8wAN4A4b=o2K!z*>$i!iV5Y3B2CTO+OVI?gSz`Y zw}0?wNg7+6XFR9lb>|3;8Vb66lbxO1skD z90Z3GB~L$g?~Vtx!S%aN)SBf^HJaO^EPAB2 zJ6AOYa(i+TwELx#3n;Kfx9Uq6${6z*t-9G@xux+ScGRZZFsr*vrkx6RYG8BQu+|&i zV-;zv{8xV6etAgywXeC0O>1>7=lY3x>8~&KrhRiIj*UBwSVtPnsUWW*G_`|d#Z9wV zBd0pexq~N;%dtoGe+6Owm_lNq7Me{VNRo&uJ~##ZBN7@3z6cac z$|sB7PSEm9$m;u*8oB%7Fxyf4c#9oxO!QY(amE{G=3A3)M*a2g2$AueMuQqPjyUZL zpYABA%rr8a&$kP))hRvf7$@yAAzB~ebT8T=haW`CGX(+Lr|Ra9=Qy8gQ#O6i)igVM zJ{n6@$oB4DUdddU-jAX)vL9ZrZ*HON5YLP7b4AC4VKdc8xNcjpaPw~>Un*wY) z?x2X=%Tud1I#2(x+mgVKNS9aofaO2uim+F&Zsd1m`-$C)Zy1D5s~e>VNY(k=NzDDb zHhoa#XZs}d_vAcqhQ|U+wD*27yA#!~;;E>T`JjovTAl-$le>Cx69^v8Q+NK37i_8$ zS}E_SVKU()e*0XXS~r16^AnbrJ_)~l$kq%kEo}@;XItK381qiujoPYIgZZGEX54`L zvgJm~)V*)uwSayjcvu~f^Xwz5IXuX3uv%;}ULvw#e$3iiRqAscR>4Oz_8~0&akj&^ zEEzbC0n_*PogGBBOZ`mgR$x1U4a?d*Qd;J z#WQA;2MZV^B9nVB4fwlOta)}%&?oH*=aGxqHjxSK?QZd~YgDn%z~Z~AzdQ7&*F4C# zU1B~%m6E`wo*^gOPT6{=9xk)sF6|Z*~lXv==fXM$Nv_ekkBfU(^F6lfqJp*}8P~IaMS>_~~L$pb<$Sjq>!?=iu z2sj*`1Ru&8s!}fh(_{MrSKcDAy(T_jT#SHDGs6GPxo_8}U`vqA8QF5a zDg63(+gUJe$bdajj_#hvhBxFNuOV^(zJBie8blD*iBBzpG~`IIgT%9rw#V{&dwY#4 z6aSyzSbz-KNhKvEQBY6>1qEkjX0o!fy1Tof$%@Dw^S^=;%OR&RDvwK!jXF9yU@({h zFXRF5Uyk}e7SquOuipA&9Z37~FH>TAcx@`6_D5#|@|`88)Kv5x))oT5z)^(7eQ! zviqMWeD}zsx`l~i9zW9Gts8PCu@F!9NbpwqK*>`EjX25Hwr?bVzrG{(3+VjVvIfFS z=-=L^oSV&;%6n$H;1)Cnp;l8yJSh|6D#kJ}xfj z^OtOKGNq-Z`|n!vii?Z$@;0`%wxEOmkd>c9MiHXk&d%Zzq6El(3!A7NJpOKp7vi%+ zi)_A>l$3nomOzzB1Y*(WB{em5eQhmAl3WZ|euZWUGKdopfVM*G*Dw|^=z|{CYrvi~ zuo!E~Ef_nvQIXUN5`LA|xm=;On2Z&G?48H2`&s{D*N$Ua3I6FGRn$0{T;(J=y5pF` z%y%pY%T|puqIW6bJGMNm_u-MO?*~k|rggu3W{8nOsr2v69I@cWNMT0Sn2u`=a?)I{ z{QM_#Y#SFtkzs|?(iubY9dXqbH-^rWJ^EeiAYwUG|8K*;#tLxjKH~z)1p2QDN^0KC zT6Wr@i6binu5oR1|BD-T?>!7bqVcbUsG_=89ks&edw>64*LxN40KUxSA`M|4zU_{)sbMN6yMfa4lFiyxFKItQ(upq1p$!uX?+Hs>oZp?W2lDYA>05w{h8)u-CiSp zu=O!TTT3S`s;NkC=7&GWeqsJbG=z&w+nDvT(ZPmGkHLtY^zDs;c0=QBwfx8$ER4kY zl+GRLyM#~p&`u&mo2j^`l6+RfJ#VHq#G(CReRZX^kVmjKWO`rTG>QA8_>`oR9S%(IURfR zsO><5gQW)plk3EnEL7}dXRT!ke=TZOMPmu^!bC{jH$&Ad#QgN3##$2hquOP;S^CQ0 zIFK0yiz}Z7q6XJSnG{zrZIC~eYP+P&YKvS)(1=s>ECX$mcCV2|FRJrx}fM6X8ufx7lV1de^vB>?(8gwHPFU# zSz{koAYcnJ#QCU`7WDgfGTv{O08r>E>a$wP(8!8dyG-hMFk7c@cAeO0HQYSv?o9Zt zV;J?UE^LofLv$v_#%1%M>7@|yJxEFDpV8f}I3TO3+jSzPXQeA+XDFs+yV*73DX-o; zek|rDJybpUsWMPGAq`PmS3jqscUE=z5$lcdwTGwK=G*o1U0UQMMJ`hzet43qB5rSf zPaWGGzmDtX7eZdY9BEUw=`h|12pgNa9nL*XCj!2{=}w^=rYB}H)}8+fsQ{j4D9#^L z3HmWw{`?-m3+CCa6Q*0eIy(B%wIYAzd%sP;S;nBJ;{BI>@`Ar@lGoU~Nb@{lM-7}E zP!>}E(>q@i=Zgk({!j?`n_%XrLTi%zCiBrlKS(C`1?Uxc*i-Yxx#$%M^5>c5*r?lvf{G7GSBvZ1zHZJ@d_Y* z8KQhuC3Kq3r~P?f<>cg~t*woC$zK*4jW#tkHTe$X`LgtJ!u^=LF);~gO|6al+uIvkJCtKOm9jZG($_ySvrD0# zoKUt_=12Pb2gjzi4rwPx2ggVI3uD9m1B2tUtNRqnX_^$u-sZ~M*53ZX!2yMGu)DRf zzP`P;x4piyu}7io?{2NHZtPJGsVB!PQ^Wm(L(5xx+iRP9uMhu|IqldYUP9&x69@#t zPr*yR!@yVu|9!YzE|p6CD|$&wOUuE*!QP+2?(Xj4;h|6{6ud?#6tdau-QC^29~*~< zhpnxx6bglS$=@9;7ISrNqkmvzaA=flWFs5dzL#xaaAbRD_p~vX%oF~>yyT|@@e%@o zKp^~OM&>aXCnqQC>+2-U>$~w@x3;$4edE$-w9d}X_V)G;!fV>w+fOG96E7hU2m}Iw zK=_;Y5;mJ%S67#vot^hvt0;Up&~^LV`9 zInFC7De3eLArSG_hN=_7!^0mwX`MR|vi}5GVTwSl2()z$C_fa6zw_gjBf{n*P3@?X z2{w=Ot=_`kAFOGf+Bp99WH~HGm-AVj@+Bsp^@rYv4Ce9vLPu5iChf2CV&w8A(?RmL zpY-hT*ndNBAs&y{-rincU;jI+N?Ti7Q&SV4&!;iCBKCS&NFi*{)~!!%Q92IWzy+%2Ad<;o`|v2_~7Gn#%}pL z!0~deti!Z*s?QC-UbHj>N_A4)8aJbZs z`_>oEeEF$%L^*SBDbDHk$De&Fqhwe;Hg(tN;{W)6|JUD`MlT-oXPe?wzW(sSRrB&0 zsz@L>S?zIB|L9A(%X-!}Zq|vbBGBd=t#1A1lP@pcaCorH5i+)#0#uEioGsO~y}SYp zb4Qrq?W9LI1(r?;#asrR&SDErR(qV)Kl<$Ji&xB|W*7qQQFo}Ck&CC}rH_6SP_{0` zT=+GU)Pe%<5U;)+;Q!y=nFd95WpVuTe4nYB`IM=d$s$ohG!cbBP!{Q?yJ=Rzrjbnn zX=xAzn?(>51dWPY+!dFMiiwJ%pr8o2E3&vuWD!A|7HQtSZ{PZz`Os>T$yCLe`CuyZ ze&5f#_x;bQy8k-&R-G4Dv#iT5-m&xSyF8HI%9lu>5Z6*QrUSRe0YDyij1n|Q4{ot) zKlAWRC_X&Qfjn}1WvXuK)X9E^P4cX1fAcdJb=+^s z_tB*lmrIzgM-0qHJ60_EyfC^4BQa!KWmM{Ky_##0-zA^Ky6f z(EyI#>dc6brg)i_>>rXj`jxrn(D0qSn5omey#3;e?>aewytO*qoSkQ#kn{Z_U9Btd8jfU`;xzpbZIW;l8XzYnD9+cbGX`lLrghv=PGe6dz86Vj_Z+=Zv zSMyfOtiO1L#n1b4lBZ?c*&B^Jb5nMW0pqjt8B0dy^&IsJS&C+PQJfguSDqB2H_V>q8M$cJgTeC| zzKgGs;QYQ;|0j>Rv2j{I??8QiCvhi#j`apDNIc!&zI$m(>H@%z(T3ks^+JI|Mv*VDjb0wKg=qQ&}U_6=H;d3vDzfW=tZjj!eU zq_mC$ZEvu6Eo!3%Dg&ZxAEKMj%HySKt8;rug~KwQr8O1wx6 zZPG^XxasKJp111jqZb+uf3>sYomYj5ii+w>-hnS+X{x88IyP}hd3kYmT3lh-xe1A_ zE!PF;GAk-7cAmX2I9lUEL(^?#)vHrIKk%=!5ARGc+Vu4 zN9k9c=%a?}BQ*XNYe8|tH{Mt>G z3yofZDVqn!y7Tan$Wg5Y3A1N33)7ait~M+m5%@t;hX}c0jc0>;UDs^L6Z;%v%)jBqe~e*0vxhym&}_-Cx7(*w6{HSL}r`Km&g_ z`7XTHe|>>oySSjNsyxN>gW2CYhIg343Ty8HJgDx8_SQ#tw&L;NQ{T-*30uF~%fGMnuL0 zYjj4VF-)(UHDmha%a|D^G{TG^aBpVuVMIXP$Ui!h!sVSCW(nxs{qI>g^3A*Vt54r zTr!O(Fe`%M;%H1D>Q$`FV}u9-bD|3XB%T)}fyO@`UW|EJ0RWMuF-c1bfTGBv$O|kc z5F;w!5=cb6-Wy0fjS+r)x4EhLN=NI7c-`!Rqg^1;2vdUWmV!kDfiUe}2qX0P>H&)( z{XqM`zdnw^BrgL1xI_*U1i}`{TEG2wi0 zqv^t>_SVMzVRPqhZ0c7;8j-YnUlPwCg1{6bNIZoxni%hG*`A_Za_ZqI^W&#fud?$d zO^6j;0HBECkISBzcwMmsW<`;sF+pHfau3v&84_cPbyt+YkUt%zjor#A5{D6i5XH+P zjS+z;UKS{XIay}WSm*go3p6=RLrz+K1goN=^4s$zD*q{OrenKAmLPuNBo`EL3EWS- z&|5+fn4)C>k)_ao5w7wx+#VDFB!T&*#E~L^%rS`gl_^gUh@>O{iKTyads9(SQGJPu iii(Pgii*nr$Ugzx7#8wDH^dtN0000r#sY2h{$LtGa0$~=Qb=TcY@~3c z{b!BSgj1XR?egj4&0|A%PVW`pbLJlJ-qrni=FEznTU;zWntE?e_x1ei-sv+JY_`vh zCVDEDH;rF5@fbEvtw%h%k0~(G+=Y~ir>vV{gN~mNyAIQ zJ8#$5RJeWrAp4wek57B?*o8O?eOhV~MJkOlO}U21!CO;bgWy$3RcmjZ1Rl%eeIjo^ zXZv0Drd$?WVtL!|T>WUF?3@Y*Hd0bz*YC=vD0IM3&?B1fN^wYD`of?5ZY?ld-k`Z# zJ$>w|d3teb>(<&oW5~hR^}5(zO|owEag4hWze+p2T}t0UvOE;(x*O8=8n|rs*t>}d z`W36sdG*AK7&hK%VZ4#6^>S=5mqk1+(U}uqwOP6##G!_{kn2RKgoxb0T zz1S|rvI)&?nt}cIQ-)Gp8ypsOsO#h@YGSpIz zpIOOATYX~ul!L>tINdG?Pfwkq#r3$$#Fj{6#=uyt_Nk0u_J?SPDRH8qVII z4DY=pDB`5f5AhN;j#VsT!4gd{+hZW%GJCI>_5;nCWy_ z2Q1cBS`E;=jS=T2e9weWGSbpCRoC91&zbn4r=92FYx+B>kyU~mRfGggR1NA)^SG=)B+)yig@cW_3PC3W^X8}~ zY1_PP_B`c|rKm9}elT|QY}({Ru{3hr6*Yk=$~A#Jte}fo$;;naAl~ySS7)L8*q=H+ zbS$PB&?_dE+%RQ|G>EHH8)Isjfks@!2hI~eWT1!}e`|D9SRSAq450P~6zGCMji%>Q z)!&>fwxFdyS>^X1xa zerf|p&X!9v?6rlCc}!K|E3AyNY0O@ZU-mb%7HBP4+7cbuOM_6JTvfpskso3we!Oy* z0$}OKFRy9-cd+vavCkG9Bc|~rQ`c!ZQIn4B$w1==rStGJdUlZSl!m*2cH)XETH5ke94%xH!uw0OU ziyaI7XW({??kj2K;#M0e%?P^-(%?jf1~K+FT?GUcgmNDZ=em=L6^muwWIFjQyD~{N zpUBjVVGO0}ijr`GQ%Pz1W>t?-9>2KFK8iSJezfkY#!U$64TaB}a2Q*KJ9olCGirZNa(6P*` zNK!|!3adgtw8EK;6o{cXeF~~#p6%_KA!A# z5?EK(=eOejV1`&W6&d<6Ftg1c-*3JSQh+T5238oX=OVEeB8dx}!M3aE2N~7qcYo$# zdmo8qQvySwA?jUBxerHiC$Z_CSV+S`F7zGZzS4^2b1z`0j@1BqLyQxaBB!Do4B zJ|j0J+axbB-9~wUFBywV80)Hs@pUwJe$T&NPZ<}ZPLX}sR^R!$>jt4B8hFD-_$Fu2ZR=a z_{ye&5Oy$)`%^bRKPRU_Kv%88s#~euw`n&WzIcEB2`+9w<$U6O5W%qzNn6UcQ^!f| z%&D#$A+4)vzqU%sCJopc zfsW4R*DuQ)Hz#X;EzQktXZRjR61S&oGa5~c6H6#CTtkTQTCbf3Be_Us`3Uw zf1^L?6oFlb&`b7j4_@L+@aDF}4DUpZMp6h!{%1MELW`eqSnp#}M&p;KeE1-%{W#H8PSKj{dIrNyfsQVBjQGx1J zH7JoA-^@DorZ)Y3#9)&5eQy`ippW}ST}CLg!+ zjD3L$3e|rtv}+_qd7!Nc%s{OIE^B_!#D>guWk8>VFxB2`*xbcg%^4cbkKESHbdMqp zWd*9aaoLmI(7x_p-Q1awSU+3JBoeJI%}`Km@8NDA$Vk)vtXL2MwM%T|`Fg-5k^Cx3 z&r0aJlV;u=*4(ypFI9&GQ|T4j4B4!mD`0hCBIwFQwf0jZQfZdE1hM#(o*)z|vEs%S zwCIJ7pF5=p)}b*SR;2v%c=a``*LN{2gr+ysW|b{SHs(bps)7ycAycp!8y4Tsju63F zAvX*n#IDSoHQ9IxRNapXu2S?}<4j#I3i<9Q$+zzuNheCBD}htn5|vF6Cfk_P>C6^v zxJyO;cH&DhWsOZm9Pz(uOQuH~Zj&aLDu1^KdcL5@U+$s|=?>itZyQvg2K$+OmP^UaQf*5huBJ_$fPYt667}~K z2dUg(#sdU8zpCIMsoE~;oVCa1-A^JR-H(Y^Lo6s?Dv>Odw(CY2IlYDbAf;bK_2H(t zrx#IZl#VOZVp%%%+%{AdK%Q8xg#i~KHP~?&)i)LE{%y3f!7nDMa>-n8CURZ+W+Reb z6a|NPb2!J5@mFBrMbrAN`c|*rs3|bRJ87+`s_DU2m=CJvqKt#(#x<;Hk&Z`Ps_pv- z)MS5uUaEBfQ#gjszOTfP{;VX|H#Tj({d|_ksG{NUM_!r^*b42I&{iT}a1ESWijPQU z!@V0sSAQ2Mb|99_RiD4BZWuXGlhiOBR5jqCh5Xhw^xK`};S`7)S+=aB%cZqamYtj4 zEvFgw9oYBj3{8Y9Ddc{ZPHNHXLG25qtpOfv(3%aZlG69PalWrDKm2D@A?(U7BJq++@-9ErV?dWW;xiQL!#v%D6FxhtOaUjuTr9NJKr2`+e318zuwS9Nz5gyd(kZdM zK0*nH$~y|ol;94`gog>JUuj*KikY-WN1gAEU?tie9I71ug7sl`Y1Z_?w)i^cDZc9L zAt>jM8uT;71xvx7;v2V-6tC<_*qnOrm=Ja@k~g-6MJ*)ommnQ$`9yFTbJQT6=<>T9 zUhplW8&!_h#8|QrpQoN#)+|P0)QCZ2Md<AatF)J#dGDH+fK+I!mK^bG+XR_ecc6}`kZ>H)~o4o>7H_cB$iJv%9Km`T*9a%H|lkKTiA)G z1h7444T><2!Qho{zh&3=12r|BeveZ#zep}lVwRuc<_9{IjmfeAvvqLC&}1Bxdiu~kvY=^E+@9rWF-|xf7Yt8s3j1ZN9RAvr4YXM7dC~~su9rKD zb?exQ;aJ^2rySukk^t-u(ahF;oCzR;N++mLfamUAuSIe($yx_PmKYJ3)E45owcl4* zW!Ahe%`&U(E`I8(U%8s|0GT+{@=)CadkwJ<1*zW>s^!I2VwNUmlTSMfR_pHo!MxQMWjHiuwrF z2v4ikpp7wzm=j|8+V3>F0#ytAnohqHLUMX3<yuV0bpA4$+K@y41J)5<*HQ5#H&PzBM7y@jCPkA^kEoKa6fIInq}II-C=k)6O#T zQP$Xr{Hv&AebKmkYXzwR`!Ikk0Be98;6l#+@@c>LDN^SYW9o}MZ`$%eP2haQFS7lS zeZpjUFtJU)!w;!B%!OxRCJH7ZfHUw74^$SH&Bur0!YYC9ClTtBN)(kA&rpGc zbbi#Y_0b3l1p}0?@6@dG*Ygs=Yo~K<~#U#7g z!P}wp5~*Vpr;CpbXZ*JJ)J?+}4>>R8_>_4uG$Z^4Yt5r{NfQA$g8HAO>`xNy=~7!L zu7*nz(|#|O#7Ta#NRgL{Yh zwHmLiAih}ZjjS~7`BMP4t?x@|`UswC`bN@M7J$5hkN{MHLX!daTk`oApsLIv%+2~X zRj$M|k#iu@-ui{1Ms8J$=YPRz_v~2Z9PuK=l@QIb56% zZ+|967e^QF4qoyKNDFCt4qp0Q1!i;Z^8{;S7cQVgTbYCRSBuozUd3BM^ zqp1?)$Ju@LzlCSN(6?dkrvdAzrIeaLMi}KZrU>Uk=!TU7&N0N z)!J$yj=5OOsW*!Zxw_qB#Ri)M?0QQdp;&1xE~Ra#BpDAPfXjpPix1)c*bIob7p9oV zL~K8LMK~&tL%w$KPL4FnhPa-0dq+7l56;pefu~lejC^Ve>*-t-+baZRa7jPc%JK;2 zrJ8gNYg+J9GiU#&JAbRfH(yyM`adMc6M2Om7hm&*s7rI3(D8md0}!fWM%Hmc+j$Hr zNnXGsWB&c{7a^a&oc9;jaCgw+T8Yx6fj*d&Ij1nyiv?NK39leLlT_bO@FWvZs@M7Q z@fX&YzW<;nmyS{uBRP*a{b6%;5%V3tM6|i5b9MR}`}U>Ce3Eu7!#stzuT)8tM}{jg zzqh2e4z&hQiy&bZvGnE_4828ME~d)lQaJKw**6pS-wA$2thV4?9wa<;8oO*oSm~*P zgcbMS$1J>HMatJ9l+8ok$&by^^;(O$45fsh3JzB%x>` z+b0cg7Z7#j5mFj`XP`P1_`&^_@Tf`bN40OsSKwAXdSqfn*b<`aU2}0`#j9}LI3yau z{X%p#F)U4apKL8ns}9^D*<)2`DwZ|k`B5rIrz$zU5b2Z;ky|cxI_~S&s;(0-171}O z0(Y;dH_z?#F07qlp12VPh*REdmXaPqZW58Xk*cJ8axR}kASFvmz&9Gw7`lL18ez#+ zLN7c1v1}MxSNCX1TK&eAF&)?cU1#1WD^D497Yp=~BgQ$h{;i-lsLerA0ZC{0*#+Ot zG8Ehu@o=4u1}J2Ul#Cd#=*vnat-gFyL007E=ZwdG51y`96pNe}hsid;DV3s|g#vTX z7W%%^wtmOlA}81{C4t3O7`g%=K++;WcMl|kup&hLmK;)X{#(H_psp=qp|7GR1;Ij) zSX)LE|3Ih5=lpJ!O0mlLZKqj-w8=Y5(%~U4LdtoE%p9-dCGJ&Jegfg{ciw#!oMYT$ z_{(itIYnw>e1g4r50_S{0G*&R$0-%RZ)a+otc?G#$NB?m zQozsU4}Lry>h(RIod>BxC7C8^r*cHb?b?n`s^PW??murgoqOK>%*Y_QyLPjSP@=B& zYQd-F8==@_KV~LJXFxdod_8gc0P%$041@5$`U*u*725!ts>m+K5LbbbiK}A5U4Tp` zlZX!{SJ3+D8#%>IIa=~Rc}LmkxrK5Rq7GTGu=l-tg(+F-*&@L3k!3>#bs@nE@!xV< z%>81lZ#X1o@-eSQ2jmni@x*3QxqClINrK(LqfH;5^HwIZ{FR~^^!ddC3<~30i^Zt- zllC`C9!e~avT{N6kS7Bt3m{2dnl#u@TkySedJs z9eK8>9Y?qA;b{T2aaIPKoUb|OakHph4{w&IQHR|H*#p)XG2~k}e+lb8CwWb&Si6kN z>2Mb4v<$@`YF>NkVh0y&N&HrM#F5A%eNpx~!fDPnO)=9(QyGto)K z%R416&!?;TmoBZdG79gf;}?1mLh9lCJL!0kkb2`Z!tyEdJd_ALpTYimV$Y-y+FS1Z zf2#IqZ#y4Xw$34mt8^4^ixCNS+@~iEZa;6{y)kHzyT-^GwSLX1!?JENze3RMqX^0k z@YetIY2x&$ulp&hLj7ftn*SUzh2}Q{j>)$11&l41z3;%?ng=l zo)7Gv&WTcheOfhWv$;*#4skDj;JdPux3_wn{JusTYO@B68fflUj4$BsmkSBMO=@4^ zBLB&ucg=+Y^SS;{$Gb}w-r&_8<=c9FeI4Ulm&1DS=qZmR_~OG$9b6t<)pfMjtsRL1 z+QRa3yWi>jjKu8$$+_jy+VW$@$?t9-rYH*3{6~u)Aeq zHjApg$*-hw*~H2O%7PTbwpkk$+pgW`HH@-M00@pOm`72djF)+NOQzz!+uZ0atBas>2{e5DkU>9Szjp% zZ(?!J?(@?nO={#D4GersnYTtwn&AIz#rXV5xgpy!`=2HHe&h`r4Z=GaW7DX3^>7>i zQ-mNwuTX&EGYE%}hZxHMjY{bafSbVkae0k6`S(w!K1arEd^)41wb)eR?{TW73ScN_ zcK6Kz#6y^R^Iy>WBsrTg69O%cTKypIHS6I>G)Q6(A>qF`0hbnpP4YcPwbb9G=S>|F zHpJ<|Ar)dK(Mn<1D}OShKR^VZS97Vek!S|@d~w2XkpCTF&MWBYRo1sMj8**IA(Xc| zliz^3<$q;RJ7FHAqE?I0=vf8t-&-F|oa;3FJskwyS+7DO$hUrVKzn6}$=10HGRal}9Hy1ZGB4ZY>$ASIp?|s6uva+N!h6MZyP@$BzDpiP6 zK@t`lw}(`JzVIRS+HZm3o6+e}86okydcO#PU-?5^b6q$G3JnPNHppKaQN#I3S*e@C zupSi%q>846Dhur6Gh$~;!!mh2n0>9ojLJ$B{IypSWi;}L`wf{JYWPCq8C+t$dJLK6 zGE8#3klonEm!zA?Y)sGqe1XJF&Jf9>dj22&Zli>jTOTNvJJ$}y2cW~c^3MzUx8JS5 zz0=LEB&Ps3i66<$?pL(FtYzEvs}y)g3yy=gw70qNpk~&&uqXET(=n?R9glcl+bwq`h?dRBLDG=K;UB;r6UiRj;PTHp!o*gP}8L0fTX zh0Q|8y58%jKtFzM@G=QFw+MS#jD;MB5JrR6tYf9Zr7;32cna#kFo#w%J(O-ZWAI90 zR_|WiGZ6UJCqgRX?oT26ST9>|WA-gh7f?^tuo0%p9LXrT)wYOnTQ#mY**aM86?tON zT6*&MN;gp@<-j!U!|+>KD_KNJ1%7m?#DcHeZ^ia3)Q$N}7^RJ9rcu?J;KR`mLa=f_ zNsc&3wATSLCKt^OSD2R(`A8R#xnzZDDKLEe+0d^6hz`)LRND%xkrb_$cZXjp%v-=^ zZy@JHL{dPcv+jyG5i7YNOA`GeUn(Ff#WF}dZpQT@q3vY=b@rVW8Tt{_Z2YV^(6dICbq<~|6n1bX_5Ht-{gV5|-iH+O>H=$&8{dZUas zH=KDq-44@61NxN!!Yw2{sgm3@GDcnLW?HMtRo>54ulB8A zks5y_%M+GYsNF8?nYU2wrDgltU|9hsic#3rBbRDDO%#0{4LDY~7aJbSjhbQ5ctop* z2MjHBPeb43zZ!S#>i6n*{?Z0ySC~)iuaKf4(qo+=9*JXh`Urlzi+cl}MUe|3rVg`U zuaYZ`jG1C+EWeO!GI)o1kw~UTU2OGf;$@Wb*9v51%|>EByz+x(1Xc_&?7kX(?f1+) z`5kfmsvsmy;XmplvSq>|wz#oYn zTaA}bk>5lSm%zlu-jU?-`SS$a_%96M7ndb(xev+iod+ZQ03J+|*!n8vmU5me(||${ zvtRC08J4CR+GAZ+l($s`Q-_7+2A2Hd`3!vWs2V3{gI}ictY4-0dQQ*|1 z7G&sYDDH>j)ahSw+QK*90y-(*SIK^D$LaD?^y(RG_wsUMOjPg^v@nib8utVo32-@( z-(-*SdfzEPYYq59tdO)_$1wwIv!Ub(l`c-Wbw|33?anYMDQxcOb0e*}kN302DN&OD zHwsMZ@2Hxc4xd^oCbFMypu8OCaIMRj+A3NrfFX;;E7@j-?*Z6fWf(%X+k3oCoyOX+ z=U;*{VM{~NN@I|ei+{f>E}!dUDs!wDfxZ9O6n2fYY4H6P`S)SKuGyDtW38b@SfM zzoZb?4njhd+(bfU-4T{nr;roGFG)<$nB4G*Y93adUDOmJ!11v^>Y2BY+OQUMDxbp+ zpj&KboX7e6@zce5N1Nak1SxS+s~S6M>b0e*}U=AaS}!+AKiauO91Vh5f*K4t^OlB3s2!XKgE{6}%X0yHwn%!86Y2PE%Buymw*6$WxpJ*F% z_{2mdXC`+^SFv!oq++k|>9gSL<@TjAXnNEGcj7)fzQfq@0@zm47Fx?@MmoRGLkuij zTYF;>B3e&u@9MlcFxc*#DW82jmFl)rR)>juZx$yk9NE?~j4`KTy43kLo7p(z!zs$4 zh~ZzmY0N^QyiO#BpjPn$JSTly_9AbFy60a{f^3Q1i?2bpQYSDV>6BZ}ab3KyRA76* zbu9CkgY;QLwBG{^%@E8kP?}4+y>=@_bjO>gxqz~@~=vSf>%j*XZT*M zEqC-AhZIWkbY=U5Tc1J3}h zmc&j`H7WSpi*MbK65}NPEP!_WvP0|iw-jB3T0;}Zb*Aq9AcvIX#{QiJ-OnUT48^4R zX^F&p4ojQhZ=#>XS``E)DYTd(YVglZcVl?t=-Q(XIUuBaxee?gQihv@HbE$!!Xzp~ zF549Y#Ela&=JiU9#<^w@WQVW@rsOwyN`>dw!dAtP)OrGbq;~8eW_C2TI>%00l*^)w z8ng(_5kRY(~t1pJ5oNtco%JJD~0|uLJ}QF%u`m z3ZM_6j&(=t#=fMxTeeS%?=u`oR%U&R$V^c!9m9Gf+okfUoeuHm(}O*$Fw{d11tioc zNR13@pKKs2P_p7F`tKAeSz>)D6eWz`Q>J8lWcrao@nrX@m1vUCv<~%;7`*{=3GQ+y zP%06>1vkj_mzs*#+jhs)ew@Xntkg7#T3EJvAdpbahIbh))g$-_I|wnG{d{Mwhfw!d!chYwMY`8pmQuG%B#5KYkl60Xg+@owW^R~py_x!&rOCkwh|IX zq<<~XAVnT=aef6ozdlsNGI847%I{LZ1tJP1( zcihx1)sw+p^hYDln%IsSsaS-A)!DKMTRU_ERBP#K`kh{d#Tw)SSg91-T30bCX40Rp z>f&X{%Nk1`q_|M5^$HnJvYZrUQPl-(GygbXE?R9^L+QOU#x8OEvsqL@zUXPSk_N5% zYXYilwbWZ*eNo%oF}%FJow5amN#6WI49Q}ZQa)1ls@3dbwGxXE3i8G-;a9rA2rWE_ zb$PNC5fZjVG8)k{M7w6i3$nd89(guJ{6vZ;a&7C(NuNOw za!%s?48}fGr=jXsC&;&81feY7da`$^G5KKQK-u^$9feLqH(o}nAlg1k z#S+HgF7=WR;F{o&Zz+8?j zUWXvA^?aY?RF6PioL%vg%#Uin4|DFU#h*oRGN%6lz=NUzZ-YIX$?`PQI8Ud{><6Lp zcZrrYB|&wL8H?t#FXH!T_i7uZf%AG+LO%(UGG?qaiSp7(05GUc?(BgVXpwmJJxKH2 zC?M%PKaX4U-f_C60|IJYR62Wdy3UIPIxdyhp4Xn{{7xBt&eop0{Z9Hh)*g!VALsW_ z1#GAKs?2ZcXU8^P8t@nVZc^be(PpBk#ca()`(+Ndv`}&m^fZ6k^^}da`dqg5 zlqB<0;32@R^XU2X6_1;(mXitb+8SVk)549=GZ}yjFxaoft@RoL_zM9U0spp`=ows{ zxXpCq>U(d#CJf|50hS?DqlZtu9^-tPUmhR8b_ISEb^9YfE<1eecZ3$QNwOd}9midr zU#KK7K006WnmSxkJ>wO1P$Xh1(?oVU?pz(rUVx?T7RC}hb-XletNKR zd6Ft7i<)4SZx4PW*5Q)PvtWYTW+aJy>LmBTqnyg-RiXW@*q@He^G_`1@{iJ-#1a?y>UxS*zNvQ(|xhreXTw0cW%DseKam`8(>b) zov-H~S{=yZt7VhT&*%#0kJA1JQV+PHVcSp@>xjB)@h8F1jusd zOBR)ON-b_*cAgxgywWtK^Smw+p%)WTg}eqhyA;G&uYHgTlnIN$?yP1!PxZ)(N&aR; zb$y6cdh4rEb{*FhVSlbj`GW5bp1m0V9HDpl`JKYqe(ttEw!A^=R6q zHR0UWJHO*LfKglNp)M`uhSoDMG^La`H-KV{o2=v`RmMYuACY5n$HTaH6J0=Q1C)jjR4u#4ugZ^$ zAUb$W9Gf|`)2dA<4T4JRc@12~S|5!;=)dow7;E2G{`{k45zb$LuhE?#g&VOj6AH!bBZTQhDxT61nkVFfuxpiWyFK_sM(Dw?=8VvACe7~~ zRt4ifTC~>%0OBE*)HAtA%$RHUCL`eMlhh6k%hPtNDHL4K1>OlB)IHGWYpxA=Q_Q>M zt$trE8UuBnXTZKF>zhvhld&eWCLD(F*|QYii|tmKFhWia?himCeM*$Vg{fAbrR?OW z%CIz}3ncJ72DQYVg;#{E>+TtbZQ=G~vK%n1z)6XYS!2{a2kayyrWb?K;%Px`hSdPa z5_klZ#;@aE$Ca*hCTeS|a)-iSM!vp$cDhoh{5YTMKq(R>o{UTrtHjg6ry|xgWMv{1 zlBO|~XTW0b9>E-~39p>&nxmw;Jyw)70e`@mW@u@c^fo#5C83_jgpcsU_UO7Y>JMB8 zLpi-A0k_0&X>#?vw?vtW*=*?{3uNZ4$_Qo!gV&!)jy-!kgPMAf-X`M$j?g-Kko<80 z*0BGNf3f5E7KvKkb=V%Q0LVB0bOiu%Y0rQFWFmJcKqxB2M@6VFfoRp4^UYAI+0*p= zUZD9ecb^J7o7Gw8kenz9QKP5J*+`qDyNo>|8m;SQcbvBxMYuxUx-H zvY#FRFwvXCq;q^rqU1F}VF&5_nZ5qU?f*NV+y(Fy=4&*2z7aVfIO1n3C8J=ufktB zHgh44vCKTGhKsjg@%scbnzG?SUgA?pSDW~6nMLX3rfP=ta*~Q|s#3FD(~i+-k`bh> zC*}1SlZ{vi!vvqCS~Y{9T|3I)C~`AkzWfqYvR4)5sh{i5tGE2dm|IuFDW{jQkSFp)U z3XOY!f6u14OA%9RQ2rA)i>6v^HFKAdde$coSlf;Dwf-btgc^TEfQ9xDtyX z!ZTZH;ZrkM{2DBF{e%-o2Sw-Y$Xkj)Hq~A2IHE7l_~vb*`oebaPe!hv+&#L*fBiOQ z;M3bs-~DK@#XsC8lZ4C3gKxPGxxG^`Wg#z&#n~>QNNpkU&CC2}c5W%Acg`hUMfwxs z(HEWLaC9jGiskYCFti-66D|~i%kM1slWn?$vep4vSu47&ag;=oj}Er99Gf53oxeLs zI+-H6ZHKZKoe2v89jO`dXC1_Z>sa#r_lGEuk2pitMH3ys4_!}%EZ-h48PrazB81Gm z4O&4H;U6keMH5HsJU`WwieGr^*3E20*{7KjmhWK$>l(G(s~0r-;$atgb0vS!5{eaN z)i#V5l5G8R zJY#Kqu1h;7oQpUU7@$F)*J#O914D4jHLq(g{#U;6f0SeMdr!ly%q!r?0Lo&8Ay%(L zP-kpH)&+eT9`scP%sSwk_txTj^?i6-vVu#S^-bts{kbp#*c0FwbNLR!C&Z3Ql3xhj zCFB}3OI$tV<+7F6RCyjMwkEn|( zd2l)>zO!yzrMT&?;agwfr{$npf6}bDDM5)5BL+!c! z*q@^Q(+>4tCO&vV`G`{Ule!x^8?thXM5RvQB@Rk>5;uruPborfDT$do3%w@dzj8UL z=19zPB84~Ig~#)SI){<~BH_45{c4o_vC9Mt6uk|kptU+G)VVBKC;UonJ{lsFc63sd ze`-%8pnb!@O?kD0p2t^MDAx9_u5tWh7t@CnoUcc+&I}e*$!Th*$gEYco12;^a_7t` zIG3X7qaHFdJYrL+r>8OEH>6p-58@Vd^vWM1(<(6}D>e-RFh?*4$O_KhGO~z$R1%LK z2o2#VNk)(wv%Hrd3ChK88JSDw8g zlxn(~4f+VSOhe*J-*R=;s1DZnV2&^nhd_hFYKwms98y9XYD%#Hh}TFRZ*{)5+(d|L zn=TmMAm&BC_>rTJsvRLYq#UbQ^8WiJw#Q4$NAp7)I3rsuSyQ~hVEp)p9Mu0bHf& zgu$t&C#ckgwXuSMZC!9GLQEi|oDlD(PvVH67G7_$_?PnE;*tvUx~qb!i^dmD0jfiAVE;2xWrJK>=&wumoC(NAGPvE{XG}jI_?DiH{301)}tA;Eg2{0PYc%q<+;4(E`l%ZlZaHoQ$N@Ih2>>tyiE23;mQle0HS zKU*3pBSVLn4M`rasMJ7tYNfPao&)xN1rCi3_uQf9j&42FD}a>?w{Fp_*Lk!^jCvyG z$E-0mp*y;IsPKi@Y|4^O@DBH1`80Y3FnPL|j3o{7mfr^$A;EK@D24(X`5Y2DgYqxC zKdUOwPW%6&j#bT(&E%8W;2T>Gbyt;;DY}TF7AM!H)82qJp{0R$6A-`{qebF}goz-^Te?JbmJ zUrSXvBDCRRnS3Q-CJ7ud?z2MN$$VcPVoRf~j6xA)L^fvnm5-ql;cvX{bqR2_7oU`V z3&<0x!67;zh-^uLHToOlS3v%wX4YDR zi)iw9$r}rx^QoZECWFiPo?P$Z*TDYZfxpvnK5jhqQ!)?XyrKs+Z=};6(Du3&7eAL9 z;eLb53qgV;g^W|vQ%%BVGQQZ~iz#6$%$~KtBFCPDsKMNETao16{fl>W=|glpZMw~1 zaV{F^;3js};Drr&3j<*3Kaq%Zh8+!qXu6)ZAgjedBsP%s`%{t!g$JF~_9&jO!F&y@ z#t;&3$A?_#6d>zYbG$MiAvR;ziSaXb52&0hA8z0^B-8 zW{}*&|9^_5o&iUs5*4ODK6nP)iD2D#X6P>42{GP{^95qiD@J$Rm&~MSb)xh_NquZJ zP^C&95K@h2@VGdNi&PifiirzNnE{_JZVtqLVv}hF=`vk8+|FB`NQ6jUxPtFuJeTeUQ}GlyRN-psWB5 z$VAzMr7cpRh4t3FLCPsGgm}@JG1n){KIltL;-Oj&?&?b3OJ*l$bio~-mxo(!N47sO zwc~-XZm|$hl92EQB{Fz89*yv&h6>VvYz_pcOEG-Ew4_$A|7*T8#WTrM1hG0Vf z2HPTDS#r)uFW57{BDKlFqyp9fF=y1_T(w=JgNQSQmCF7rC8-b%$Ol=|JVxe zspi4d_UBIFTNdrdS;jBG?%cHy-*gJ4T#a@s-cNl8iU@o<1?rDsUr-1-bh7 zRx+}j!ab^BBp#7TE)`a0^cwv97p=t&@VCH<-AdDzbPbBYfx02Zjm%u0zq2Wh(kW%$ zjX}|cj5c_9Dpy{0imc&bd7D#Gk|HBhdZn;}Ru$=!V|eAF`m$IYx`FA?5I!SF_;3%f%>}pluZ^j`$A`{q zFRA+EXqjdYox3aZjW!w2`R?F*eT8$z^7wi`4{Usx zBkH5X%F@DVQz=%|x<|B491lpAPDEuHn^99gsH5;+_dL^yE_YmzMna+>aw44hm7;gU z60|`hHY4;=;>kF&cqzV0t)5ZfVBnN3tuA{C(9y$Q+sG1F*)7-q9kJa&#JOh#qXgw& zp8kgXe>zP%i<8O>bIUr`HvLD#m%xnyRp=B62bYTRYldHSJ)!^V0$>i4OY|>^GvNP! zQH+ta+sWAVj;!w@&UJ{Vy`AT2oMp~L@!nzG*{RM%`ZH^K8REX(foB+!JnSsJA=(X5 zGy!S}Fs-}D0BkyMm3`MvM6Q-ab)Zm7vtk{0>~;C?e3J1C$nIITJf(kFL4_zk4)=+^ zi+RD#>Y)8)!)O&n97+BZBbmsyXj~0L%aQ$*ST!~9quem-p!0o#Nlp}2Pi$Z=`IMTo zW@!f7R`f18H%-JTtfcUqB?Aj))Zkd2CtIt#p=`cpdZslMVJ-`?({}JQd2~{9O7OR8 zVT^wvaJxhOYA*a$&zjK1St(_b_Mqm8-+W>3z$&bLd-b`8?}h;LVu^ycnRb+G9VA{F z`&5UEQ=ZVW2BsdTzcL2_1y3C`@PTS z7k`~IbI#fMU9s0*Yi$}WRIj&ww_-A8h;I z6CtMuqr+IKdeED;F$@!AWdQ{||hsot`yAaav6 zgTUsmf2JL3XEJDz5mAwWkTW zx3hG<4>+w|F6u^0Nk-4&vv<&E+i|evV!05lFKqD{Zg`{>hMM8L+wPy5HK$2LM@muL5N95`$6>6Pdbl!=N&h$9!_tEh7E9Eg zSjXeFxc5*=^^E4YUfD0dv!+0*B(7N9vb@^ShQRXSa2W6piDyBy8=6r&KEf~4XCI8s`r zzAxKW*amM_76eO_t1N0~`*vwYBRC@zeeGQVC+R$LqQC)ORQaH)|7c+aD_Dx`Q!SZ~ z)w>i8He0y`W}0^E#^h=@h0+Hd9by;`A3jGLgY-c8)GE%Nm*2V}Cp~4B2oiB;d0)k6 zM_w`afNDXS5{qEM0AmuMZ~rtI?tt~6x2J3#hk-a0LT;yH8u~74Q8C{)Vn|c6iSF|w zh;xfVv^8GKBEf`G4CTENFK#x3;nS9dLkIgOYDl2Qazr9fV~QsPWH6|z+i00Ae6xsp zE_7l~QTt&f2D-a0VRPHw)S>S@zYGGskyu9*x?-AWxK7-^VQaYU5Qlg5gy;+3EjRGp zCHgMhOm@6C+ev>jz!)jEGzAVsrd(qy;;gJgon&^txOloixVf$j3W|?@BAoKFO4aaUte$txqP>q9(UNSD$Z3x>gHQdR-r|jXr@E&{kz`olS8GNMS>g&G8?uPIQRiKHL zNOkI|q{*p-z?cxm$nMAst0|(vd}*q}z?{)1X+PHLbN9HdDT+N4Go@p;x-wyMB>i{bv zENiFu^nz!vZlALzU7p``_cXX)4BL>`JDg`;Ctm^6!5qg>2@1Pl3HyPVP$CAH z$AyJ>tZA2)gm&r3$V^K73@B8T*4b;~jp$LFG3mYVXX)j1gC1OS?sm{%tVQ96zw~b( zIm`{U%C$sFkudp)FoY_1f*1?A@DFjnJjm;q5I%0WUG&v+9r(nW=l}Rojcc{jS4)24ArI-;$=HQ z!PQD&Z69I#lyQ)><4(NKp;jAndWZ#N-(1&kILvV9RWT>Ij>szHv`sI3$hL6aB`g3R zcwY;@6+Ujl@o0R~_-eQc2NeHm9msR^5{VVq)kXRjKo@@?fG|lbK_CPmbI$jE&F)notyZk9_O*VoH0)R|u5~h9}gEDJ6J2X=--Kpz=gDk*vaQ>ckM# zBf}+#MEFT1F{l(@STMD_^l=#1)-{5Ag9zUDq0Qa)J%=9ALyuM}pu3M2E&>Pc+K-*~ z=Wkc(g)a|7pf?)OQwb9xrJ)UPeK>Y6W6mSJ5i0dyMTxDQB587aiF% zChF*33%suwQ#mypsRpbfANwdT@nV-8V-ozxl^hV7<-*nQ{g#!!zg^vqvj(#onB?19 zirXPT58fo-mbS1RhkR+ci2rM^`s!+=;bLUMWWm>S z9jaG8%RbEq>VZwhFRWwVKet7A_RiW!B9Y6(%%9AQ2+zJdn8WCWAKG({t7kG&h?y6Wvb&E&YSBbTt7e1 zg(czckkyKtB0ni=O0I!@r^(utINK{aN+Pyt1S)C-!?rqg8!-$U9&GI)0$EtH(@%g< zp+mp#Iq-{%9}^VhBSjt;d=g=+KPI$R?q1gOu^M6@cn=^bhwV~J-$m-etfelt>Oxw; zFcwoRoknh6jlmIwccer`4^D!X+a?w)&Oo*Z227gqY9j63x*|lt(4**pzF}9wV(*y* z@Qlx_=m)*J&{DtlTL7wyh#+Dv+y5i;DsKaKZr?UT>ZAK==1*BY{E%UCjjq-P{5r5Y z6)X820)r8N8IEHC+xWkLXka+C@DVjz?LqTI!=2-_@?^$#a6OUY(D_Z5%-#FpT#*F= z#zOX9r&DhIn|Y;Z71+ly@Fu_5cSKfD{v%-Ld^DYt=wLaJ&Eg78iYwqtFl*^bJTHN; z{jZ+V_j(LCsj=&m@7Y#A+0qsumPIb(8<|tG5k==8&m9aKMqCql%H!yOG@k?8^w|=| ziFbwY(}sdA>V>=Ag#slF`Q&ljG*-&`ie&g^Su9GF@H2%4B7?r;vK9-x^@+Qy3A>*7 z%Q3sG5isd-Mt^sBqH*6N9$MPMoq*eeFU!O-9iP=elZg42U+A-}Oy!A0-aKkCEE@?O zTWWnlq?j0BoEOK+J8&=$o}|R@d_SrMT|{iGP8C$?Xh;huCg{=uv0OJ?_Sxj3e{SA; z1=EG~mQQ`Uj(||U;Y=z#IQP)hQs{)RicIW2A5b~^6@S^siJI1b_1DPm#(r3Jaztpw zV?)h#0*q%sxrVx>;)1!q5Tl#rw06Ef^p!*X*Z8R~BbH-Tf{NY)jsi*{pCOwF|KI({ zt%k|DDci0ASaxiwHVJlBT}M2TYEp1perWS)X2wir=@*W7PsYOKmWl{({2@Qw1qK0a ze{t+1JpnEk)xuJj7g>$v`+yh@a1SuEtZP&b^5B#q_n0!F^&_gXC zXw!p(UE=mE`79pwU!BNJLUTKgU${Bd2WIz51I}m-QNZ9Mq8va}f$4&TH`#Eo?RHFr zcAw(_h@S&IA=1gCsz8V_NT#5Fm7mKB>IMA^DNW#${~vyonHF5iv{wApaI=AoFbXB9 zpa3IQk!1W6RS(J=k@`!uSI`&C_(Bf`uTqxU|IknqWU~Ji5&NOn+t#fS4WqK-cb_+G z!V{9wp75gcX5e5C*So1JCgY|64F>hJ-cP}3J}YGbs*(3dX%~#4Aq~#L=_X1)- z4>5lG7ff8A4Bp9!lJ0Zut;8jNsgS>3Ms#2S1gbETsN(_T6rk!L{7cob@`nu0;FLdOQ)$=K#ZS?8PRgi-RxNVU(^>p6u6fG)I=}Wwl^Ktyua-wH>Qz4Bka2m&RZE7qt=NZE&W?$u1m)1zDkm^URL1}d_jtl|4Jj9 znRgaF#5*p;a2F=cQo@%*KJ8D^mM^+*l?Mq8i5tY1>v#zrNY)?{F(f$xw5FwGj?%Xm zEbkl;%4E9BXdNb?*RNWc6<7_185i+_;V<{=wPX}2pvATy7fj3N>T{oKVs zUwJ>BhnlNZXWS$}f;l#~JL=`5x{|RE#5y2fN6W#I*Xpbp%vV+tI1&&B^~}|`o*fNn zY{fw@bp%j#L>e|PG*me$iHc;yA)z@@DP3|k^=Z^vpUQtFM1BwpRqO~7Lw_9@jUqtI zl`3r}Q_Ai$=^jczO1X??HX4CDr_7AY`4*Z=i>{r`LeDq(G$Wj&r%M4)(N zoklU@I0z^n0^9(+CLZzs*>xM;gRGJU;H<7<)WT_al`tO=Akzqi@6dnW@__%Fs|Y}1 za!sz*0AKm%g5WQe|GyEgbXA~R%89;XweOV43y6=r-H(~wo(!2?Q9dDlVc1x+Z@;a< zb@@_d!>0TBg*eVhybh3TGf3dcgaZsIl6x_MkAoVC85vH8f;z$50|GM}S0j&{?iBSns%-jK%JV*%tvmXAn z_Gw{VOf-lX`l2d}eD4(WY#s4yQ+pa#P6~r3DyzW*vzLr!(uO3i zsMQng&RivmsO{-w5L)byAS?+iGZBJAzY8L$ua9re3SgWiwKA7wwO zSw`YEWnq7$ZG7jC7#SDI&5u{i{Q>#yF9U(-QFRo&FQyTmC3XJ3)Z{p%AHL2n59;)N`mTO}wFCwG9lVdQJKNUw- z$#K2|WrB1R=eZpQ&m!eToWTdwIRMss1*2aE{ja!q=qRb}fj!uAJsFBY%03TZHG@HdNy;hgePgTCl&|U2hg@93Zx1bJjJJ>{Fo;C z8AC*=xHrPy6b6jLZWV_z0Hl6MVF^n##hVc`bJ(P&SZd*kp*H^P&rhAe4-nbw7Si(-w z5*_Ss_0q22FRJZBYZwJmapO=Lzc<9h_RZiIRW}vJV$09-Vdic>V%xy%Tm{1ky{sZA zcn^_&s)1V4W!ya5bKgJCZjA+oP@-F)#`H?toFI}dgb zrnBQZSjE@CT*pZt$OTk|5|T#i?2Jr%He>i`J&TM$>IgB8$Mzh-HYWh05Ket#NQ=l- z^uSj5O%Jh%tR(>*${A$|5eSg@oP|tY2@_5EZz&HW4$nEu9$}*C?O?m+B2kg6`WoU6N%aj;eqRH=)y-?y7z(1?uR;|g@?}}wy5yT` z>leZAuKYa^+yi(8SRQzc>1W#Sam09dEbV_AT9jp7+-nn@vUBD;W1Yw9l1U&-EE){e zjDieGXtm+m?x)K43MbGsBe~r>`lS}9;JIW3Gasb4a`@kS`uQQX%leNPVqtrCn5=p7 zehr0L;2k!7%Xko;{nhF+b{UB^p3sZJjpoAek+=ld=I3ZxdZt2^j5u=MSduZ}MQjrg z@$Et`m2?x~HZsytFu8TWTfEv|NPK{UW*NpsIY1<3&cK_=&DO&6f{l+WJYera5^o*A zvCsD(ElL^LUwc;(lXempQ+pE@clwnV)4Z)hd!pN)NzBzr9*62d`e84VtvNx&#Z0&GEOpnknbFA6EtsUe4FEm-Zjn z@0#UyVj(G^*!%27v}b#-r;{FZ6g%-`(nfjaBX&Ys4;Auz!JTH24bx=r;Mfpkj18P6 zX=W$suW}(j+r4jKKhDH#SWqVAIXed@{YvXlTIbkjQ|C&1nTHsLh}eQ6G%>pqzmTJT zJ0WJD4ZSJ%X6b&x(TTzsi z0&>7-4y-1rL>Aix-Z^9d$z9`P^mx{AGn2Q>T#2;Jo54d zz4|6%IUX5D{O9QL;8o*i5fD%vBGDj)!+2duF_&OYnJvP-4KDvdC2Xv;pOrGHtiyiD zgCtn|SR1SGHjdEA%z85RvZ?ZoxQ+}<^vpA|9>-EvdQQOt(yWgN2DoPLn6a%TjTwm+ zH~YY&1ppl^6ArsRYMxglHtR1q{M)sz*?|>g_4HnXNyph|*L2rrXr%7Go7KQvP>{8Y1-hm@7uxZ2Lp;mqG?`n@gMn>nb>#DZ|t*~4t= zjWVy4BtaO{frZL5Y2U>Ps!)uVhAe(Wx!7;)JMx~B(nO=@ysFxI${a`z`%88P*dxpa z8<};1Y%3yj7T!$Ilb!SJb`M-j(g)Gb1&~z{#02q|%B$q8Z>RM-_ZIhrAigb*3h)WQ z-fxdL-D8c*vQtc0UE$1qPsS{R6UWP)( zpcE&?Tw>m7OyoqvOT{RME{ELDKLLi>nl;KKyTvz2Ls(XxTuzM3qEIWZPMsK4_H5&W zqkIx8t+PpY-K}@twkOj_4QM-NHr3c!1ukqaUO#ZC$zNr48c3GU%oq9j{PH375pO8O zX|AH!tLfZ+@Fg~e#%J;=SwNX8X6QKFTvd(;68)5~ z#vg4(FA&UB?CKuq`$YdH9O66wd9OsQ(~m9OXZAaTc=yxJ6(6TBnQvbWqe#KdwW@9s z3JorQwFykeydA;yp&|$>#r;&`d{jEjJnWW9zDkHm5lTvno|BtJgG0_TDn6y^Trjm3 zKL&L&u|r6Q@G&!_w8XcZ&<6{VldC?(b0xbq!--LsW#pL!9r^0MJ=uUOagqnO8e=&@b2{+7vkk@6TKFCYx5Od%%tLPpJaEaBD+ueYA& z@+p7mjoF6zXz4fvM`QX2}>sTXi9t6g`wwgO5oRA?%ZJX-W-ix}vXi z$J^E*9cKLkr-~^qmS9Pl<o#XF(3y>B;+>C;tRiNsa&i{xrDRG;Zg!_Pi?Afh6=gYW96H<^em z>;WEzjAc|&mvQ0!(Jsms#=$y`&EIZ`&3_cDpCS>lqXCn^MSJj@5Hn{Z?SAELcA5I5 z+45a9N6$%w(uS~px%}ydCrMv?$)^?dePE7kh$f41AYWD~3B7X-HvgMxNz17GdQlj3 zmS&5R0Dkj&o4e?6ay7kJmnJ=Iqrfc3?!(et8ENvzC?Pc$?ae#^8NjN4zhEe4aH-}e zR@sOSJf4+nG27U1I~6M3QTHBBJ@(afc>@6d?8d8@naE1Alfb!4!{J153NIyFHdb0v ztWJ`gH8tY%bQsGg|1hKiqkO6^_EG z*nY51#~UxZGQ0^2Knbq~{Tg2deKc>`KAx;7u{MsWSlX*terKMdY#Lp~^&nEJfba8} z$=E7;RBKcdTGcnsRKn4E=6+hnXnF$Kh=cOn$N6FIckjO0#vNs#rd_jyRCFQmI^r1) zE7ULqPI*GUL4LHJN&t9Zh4F=cOrNaCwj2)1s8g(Xtn~0#p*oFn`Wos-yhZYy237QD z@lQ=r7_fS*G(Me$nc2VSP5AI$72MA3=T4vuD=!w{)A5=`LHBvBwR@mmW>p3miSq5o zmy8#4kMTX^;qB0@d;4lY&PXF-!+_Xft?if7j`iwn-M3_F@0&BZPM3|{Kks`%Rn3fJKMJWQswqz=U zw@VC10Df~!Iw-9Jy;poei?KuC&L=Qob5vt$dbp<0K%1xr#WqbFd%Im5F(;udbAEd z0&b?h>C-qF9Zn%z_JVb`P@5G57w5OstGbN+c$RLmvTvZiQn#w0E4uqOB ze>iMKw*wKGx7dx3W|#eNw^S?#yx-(|{SrEt>*b{N8le!`-@U7aOp>T2ivf>Kqah+kXD>}BKDukc-ug`DMT)fJf7%~!C~X21w#nK!{Q>VulmGX&B-e(C6@ z0z$a5#b-AI%1HwRE~ihCKjBp=Be}J)70UkTvSkRvW_O2ugP-&Tv5Ewkdg)Z$7%x3M zV-O7p=XhFtwWTz@5K+wF6+3hct-)xFdkl@{>B8-#mwLUBnF*5l#iyLR$hJ4EEaDyb z`tSDoy(ws8Ps3VK?*0j0gv|0Pv#YMpB=@xy#S77q_<-8)#2=} zfl22tXe?^euU-vR<_=M6w;xw6u_oq#sb5tOXyhZ9DzaQm-XQEI#rA%wfk74m-D;(fq7$zUD<m)48bq;2Og2J)y#|UjI`AsOF*7$4}p~&%ON4ITJ$< zXR!XIL9t3DQM{(+G!by-wRs!!esTMKua5xY zZ8~f^2z@2`oP76m&4RL!s9cvl28X!gF`oh zJ6v$L`MRXo2c~86)PS&+^R*?jCh4;((D_;d->yyVI2#)BEPrVm9rVT&Z{FjkSphd- zZQxAy_-?M&dBzK1@A1#S6l8HTn!JF7=@a6^#Kk?b=8;vr?!H|tj)0@>1ey&&h2Np~H;OQ|A!j2z7M)n96 z5#<7zmeVI|k8jaJjPQ3MS1z3G?!P3sPpO5M5nlvaG#PEvxy>uIF=@-JO-cTt`f2c> zfnP-4*9~Xs6a?~_t#_aJI$h%1HIL8?2_9ILu-T?_eKkr}(g7!+&(oMl$cu7Y_xwtD zExj2O-xun`Mh^B1_!$hyNMJFVw51EfRE;YzC!U&28ERSRceAo1NyDdXri@|9NvvX& zy6E90s)eBOIEoxCKz8URSs74>7I&E*+dLC^i6Cs24#~!6Cf1PqTx#3Kq}9R*vSJve z0DOW}Y93d{W_R2cxdP}ezUZhqYJBJ zMMcy0-wxr)2-krLG*TC4$#TJ8H3;Dau{Qj|82~$s1$n*=r{mY%;UC6r^QDuKbwCK_ zUfE15C0#^Z7yC_>X^^6gvr2w@)J&}yr@6*JYH7sW^zaub;fjtYsp)3HbRJ48x=+47 zR>xLAwY1X?_oj*S>AFlzTWT^g6or3?7cb}GA#fe@ zljWY;2u@$i!ohJ+$e2;+=cyP!$H(g7Xv*DjhmpXZarAL{6;19=Qjp0FBPBy5xeMVa z_*JRap<8Y)HpxOTo3tho0MM;ZIgr4%j3utJ1R_@ z7G8somW&t1mU!CzcaYk4OdHy7+#Irkn9)do_1DqdkaWbcS3nkFR&79{BMG|Q939`M zSe@OdZDvmUJLuDT0!`FBbh0y3!cWE3y_5^HiTqZQ|1Dj&`oIUMwL1?}1n7HUqn>2+ z*4W-5&@fgU)j5>DS#ap1)I%08pjnLO@5YVEq5_e$(eAuHd;gw6z)U@0#R?++4MD)+ z3IP7!8i6fBBLI1#e?L;G0WA*wTdMzWj2BpX{hLO9Yl*ZxnRjM^2S8%pUtQz8T zS;>1m#X+XAHRO^`eRS0tq};*e6(-YHFW$YK#%un)&U|jX$vRcIHZw$HAL4DU154Mc zI($$)xv%%dCEs!2b!V<5#r95fWED^clC@;!CgMe`j!S(s?HzT4kAy4lV)@;>)~nE< z=@Ti{JvphbTV48FdyyI}mM#Tf-i`V7Oq5fl@G-`&X_<5j_YdUjyg29{YNLTbqhr1E z2fPC?Vyn9=cDM$~elvS~UD!!Em%#~#UgnWxA!DVr^c$DyiY=1)i%pIxx*ny1i~O9I zmJ%W0y!ZBAj1x;ws@QI{Oi1SKn7LON3||V`R?d|6K4w}Gpu;RSf76x8|C_bM?jU9( zwNHF%wRP5x1{*SU>FVRJje=j|MRoEBx&mjcwEPs67yQ;$QjQ?*{n;Fwi%?nIU9hK@ zgRk?2$o-nwHils(+zgB6J~ZIPd1)`H41*LUdb*eGOl^71?|F!N{hYS&0JX7<+S>ZJ zvHjlUw}^=1`A^GWYgR_4)r*;oh_U99@}hCU>8R3$6=${Xuzp>n!|qyTjqH(>^ofm- z)yxD3q1mnK3Vww>PowXVj?q0_8)$QZ6BC}Qze^8rLbyUXoFl`qEyRk6+nEl3I6b!R zJQb@%MzWT%vQSJUUSIbvgoe|MBwXB!BWg1!Qy@qeEI?c%G%#_NnGiYHD{ZHaj)L>i zX$nS%Hbu5WZX5PW%$Hi@I^Rto`y$s+5)VSrBg^?UTE?|1v03TWE7A88#weE{^9pSf z8MCvlo}p-PL|z5O?=CLu!h!(*hwix?>F13Z1GsoE-NX3n!r$u~+e{ObZK&&)GRz5* zT74QRpy_2}3YWW*p!U8SdM_O=ZDv09zP{&;+BojhqEHO0Pdv<32L%Fvs53Bmr|U1k zAArVC`9Y8S8?6F5cW60T?%y?rSAn*csjM0_!anqf?Owg_EeiN3tgKA7m6M=|8iRpE zOB9NErAk0{BOiYZCBZSo=XoW#`W7wG;lCK!_wJO7iM9L`^>0 zTmY!;V3370pB4vwJ2O$U?iTc0cR97_K6w*^NhTKW!`Bgv^n00PITGonU7+IX!@lHY z{QJd!FWQXV<4UgIm8yu!1nya)2@2cLCKWJ6>4xN6N(+C@-%!4c+eYRSWEG_TjZrNV z6&|c2Y$O{K?Js7Y03o8p?Hp4p$N@4)m(fTx3gvGd>Rl|0`FvVYLWImlG^&ydBR}ym zw^^0Ug93RKqDYykEe<{L-IL2nD`&;$X>k@h_O^DnnTj6x+@(?Zx_I+gw%RrUL6v#8 zCR$7qxoxr^GUlpPexbIlnFg!cl@C;$C*&wk4J%pZ&*MhQ{cQ)Tf{pGv^KXf&k{mOx zz9*IVq8-XXSG;!)Ce7?}Pf0RY9cRH3*j`HuO=9ccr^Ltn$og_?$b`J3OZ7CV0cDsc z4sVvRacvK3xFl1+N*R|+$Qkt`_a*mBxMmLhZ}<#vB342;>u09aJ-U~@e_>-v%M^2h znALZRM3q<2ZfP+s9X?q_r?1#7mUMXfD@syn%9~pn4`zRJWDHuxdpqT`)za3F-`BEa z>Vmk7a$O?VLAzNHH2pop=Qu(-TqEXzfF1YJ0ugjSm z>;4yd3op5PH2SWQ(mHR={^S|Qkmc|fCb&mqmgWMlF009WoFls0JZc??u(Db*toZ^$ z6HSaV6^%b2YZF|3emOL{)H>tp=#L?Dp>STErrE_rI{GqQWJI(LBM5^^iZMx@()uT{ z-S;oYMUmXUhZ`?mnN3<|U}-+BPNF8P!H|xuYn6~GF$B*g)c}D^vfrfqC#+^^?_sVy zH-tnI8Qg69qq|Kcm1c{bB5$%# z7Zc55*ovv@v)V>#f@FA$md3pv3~G?b?#vTj@kcRdI>#r_H<-5&$1O>r%OKX9B1FSy zRU^_^DRXQ?D1L~AXE)HWl!EO{+>@_Y7_3^W=vhp>I&spq&H0DIj8xk11X-TZ?|91( zdA%N|4E`-QjSW~ACDqqkeAKaa9U*^_*}tinmYbI4L3|;er{^C=Fd6AOmn|Rh*oyXd zsX3LPxvaqcDO%&XU#F(Lx;Vl~2ygyiiIG*rM#op=uFT37LEvJ9#jHr}k3nY{(ah?& zP_`ZQhX2_)gWlyzvIZ?hQ>$(f+3y$rk81J%>(}0@bnm;zt}on>KPICfJ5cZ^agWTt z;5E4Z!J)#Q*}$o;@(^u*;1`KIGoQd?IjEWdDFr^x?{JWZ-OOx?efkRHBKdrBoIrG7 z^@LtF2I6m?SkGW=i}z3$md!29fWPzLSq&_U)46&Re{eZdY})hS6E|6K``nP)rrvta z*8*Cph(y-2hj)IzVX5qZz$eu{M4m*(^O>|EJ-lU#x@Gp#ELH@4IsREXuDgqgwOEf( z?e;@)OMK;2p(6Zti{ZmKs+ewie|J_Lm@PhLl-va369hSTKN%SM&6&@P4MJ@{k#dQJ3zU(xO3pT=s-s07 zLQ)0&BNXA`12(N2fl|bHYvQj)oL;<6;x|c^d79o#8?&R+ggmsgYo_C3_)(p`Z3C}D z{Dn1P>J+{8TQ5;iZnXQ$PWKgLNsIfcJ7Wy#dx~T z85!jtfA`jMEOM#{IS=%E?*8Q`@Nd;6JnqO$L!o(vn^uC)6Vsv2XMHnmL~`wM>QW?? z?mppq_Xm_;nQ>>MCRr*}g1y~Mggy~}yBbK>Iaqaa(~!x#4N0@f`LknkT=He=)Q!}* zBTKDeMCeWptEP=y7{3V)jy8`u$2oB&&hrzkFKL55Z8jg5YkQ0Tv1*o+eAROHaZ_4X z^0O>vHBU|&Ua(l0CW}=cw$HJ$R&gR7H0c6%6p&2t^(Q03n301<;BLJr^TZj;Hd*mw z>=Ad0SOSaYZ%RzRX_cWG=0M*ymoi*HAs$o(!Z05gAIfADQd6Ucm;7iK?~&Ik|M^Ix z%49CmL}_wvDJ1JSQTSH5NHg|=_nqf)+Vo-wZfUJL4M8qhUzrE&y=Byc3XYg=vXSU` zmy;M29=LkrTvB%Kn77L@_a7t3Xe5`g)Om`KygeE?gD5LGC!1Z-4k6QKaonMVZRU$+ z=}sgII+2vPu2QK-vjyJ(6DI z{*kskPNrlc=kya@2k(mjiFL<{YDR!uDx<9L$R863;bf#?b3Wy>H^L`oj6u=ln?F^1 z{y1&~noA2k&wBlRm)A^a$1>y8OnS2ee4?9c{GU>fmS^o7Thw9fciF|Y%>1M&3?JT+ zHojTvJYyd`xi}?qX?{=VW*ojh9j%6#X?653BO(V|C_M=8qw9N`yopG+2JZgD@Wvw# z&BvP~s#e}BAXtipQ|$gWJ~}!Q8OH_eiIdf(6&w+N^$y%f@Lt|F(bd!L@9Obw`d8s- zD~d?9QEyZZS3?i!;9$e6yKg!h?FU;gxs~KW^TZ%3FN*GKrg8qRB_#7 zq7j*Mwk30#iG`MP=Be8TYun$+)1*eeD@(5_8B0e}`%Sndx^n)Wf^5Hm^1(hPGdW;z6ZQ@I%;5k(obv=9sw2#z?mRv6VVUYeqBW5A^&YBnFn(r z5EUH)It4(evCUvuA7G2)zy%>}lk^oqKp;%Q|J$I5duOZr)QQZ;$!m-{`cI-W4bqGa ztM1)fT}4}tx=OMuLHE&5$|;8C!)^EOk-)0V2Uw^6>zZh;3xcW{aD^|{^_)BNlj=vz zbpiI7J>9GzzM1;*0y8ZPU7f}?71to+`(s1s07u60#2lT*oWWDJWWG$+lxt$ztPcne zzc>UZ>4M1Ad%~K)uw6sIm-JZZ!#-yXtmyHkv=b5Knc&X*_VBsQQDf2r^#{6sI_U^g zc@P6Ho_=nXDZPhKr{FrI*ZyBCn|bbCbD!-qrX0IT$`)f(I`LwglN@uh%zS%Hk4m+o zxH$qokeEhBwBAX%F3w`Oo>c6yM*5xvBUF34Id z8d2c&`4-}57P8%hhcX4a(NB~ldj>t~L;&m9c7GYG0eO}k!tGlv3_#3DNYp5va_YKK z0Q)~qi- zLI+REqm%ELplddow%FMP0h(N(K*N)Z!t7=X$Z2InZ!5g?h3dHBfuiy2ZXG ztMQ8Zi%qEeSryJr;yy3jec{|aedu(k;d*&<0q)gs{jQ@z745LF zKi3ngJ-2)=Y|(XJHOumpx~w^a;z#|1Bu~rZgw`1Wrv`dF-;M-MXn|;)GxjPjuF)_o@7Nl1QHZJ6+7Ivc!Q7=E36lLI{%qPX7oSZ#n?0xi4r zf*vOy=t+)~8*sULrU1R5Z#YZJgI_Pe_2*x>ZK*U|K!k0&a#eL|7lIA3 zXRCk0nH6}R2xN36<;Y|E5=*i&Xd=ooJ+_NtD~99`|;&Pi|)viw|$;&r=ni_p^L7kfDV3H^d;2 zIx;UkWX#N8`zhb;Koz1Q-Hp)V64NEs?F`cDTV z%X0jBsPu!u`sKIJ;J7`jK&Qts#CtSUBEwLF-rYVSO%(&9 zSyd)rsceR{g*)NqCQ4MKVFJxX<>mdWxsMM?MKCp6Wy^jbc^sebK^H3;K3qp6S6^>8 z9F4GfSi_t2-406O>-%-r?$2#J9H8*&pE&Sgw!2}rn;SN_&6mRGKoptnzLUpB1&bEJ z{xbS=T}9cMSw(cz7itMM;r?CdEvsu!(zI2kmCfG?NT`Qj!{YI0!Y|mtVkMFGO3#*Q zhMXfacQEmgg9E6d%{&saNnMCPx|0)RYMVUC8P{V>!1OS&!T9AJEHLdJ1^y26P{O&ICR9x_{|g;j!YgJyAGx z0(EdOng*Sq{(#JKVt_!6Y2R%17yAltx0bvXuKn{GF48s5=1&!b5BARQcJ|%Q?w;2l zVg;h4n6AEkwN?W7io$$249V^(6UKtFeSbBmH2CW`CQ&|sX%K9wc^hGBK$))Rwx?`UkZbSuziNQi^;rtvQI|*#Pm;b#uK*6syIRVHo+CDLiv`G39Me zvS=fd?uh#)+ou@9GTFFn56bgiFQ-p=w7U(vPI;t>>hQf5`=VcJP-|(z20D{mdlvFt z5A}k9&PR$m$;58*gyGwOL|ZH?+6*2i&FCca!Z*rHzu_;#;%S{T#Tn9$4UtY5%0}t| zX0>aTFXSi(0??O6+~-};Hf+y;Y!Grk zEFZ`YB=lWx2e2Dt;n);6tPJjVV;c3R-=RnG4VUo?SM3u*2hXl4oX@6FlWq^5C)Ho1 z3s+yyQ@FH;bB7I(2pFP$A4s-Iew53AG=#Xcp4Wx`dXG9yyI?@uq&l^%`x5ZqwV<~^ zi_A}I-N1`5Wk`IATw0`@A7n;r6w^z{Ic(H5c**qB5!RELBo#SkXP#X*ykw?5vg8nj z2Mf+}A+y~-V%U1p3*=;$<)fWwPanF7+wFxsQpsXb5N^|Kq~z4L$nO2D&iwYd zEgwnfXqia=c2h$Cc9=S9P}c2W`cP#i{*`F_tAU0a^>9Jg+f!dchYRl!W8UX~M%oED zkV=rx6_Cpv&;z!+o32Ot*T7lfmyL4R&vG5MS5iI^<@3i`ul3Omz_aqnHWBky75WM3pahG#Vp!Pe z^Lz~v&ttYAJ7|9c95wD&QDfthd^=hQp7Zr|`tP9HWs zw+o*EVPiSGJ>8ga8Nv}50DIC21jqXGPYvh5iQXH|0(X1+cYCF#19yoH$4+-c!oZPk zixf9608Rt@SgniW7rCzP+l?VzRT6u~yIOTPI%`MU5G~i*qw@jnDkJT&c%`A1nmQXT#%q{QRr;g6i}@QO-c>;ZW^B zPv!*K5VpeiWR%wx1^c^mmud3lY#s>;zrcLS->01S+XI0!dB?ZU&6^H}2Hf=UiX3cg z7T}n$iHG;#gICW!>69yuR`}M;vqm(5fFBLW7d>Y~czd3H3!g#pJ@?go(YFnwQr2oy z1u$%&67~i;`6`?RKMUzE(!75TKn4|HUgs2Dg-DTFgb2t0l<&E6kuAVgu*VVV?nk-^ z00;A9fW-jZh7IT|*&mMn+3}ujv+LYH2Z6po{-<2Mkrdbp1A!oo30CO&NaKO18uB6H z8#dGP@j&#Ai$N2C?Qtzrw{l9q#XdeD85EmmjZL3Q32(!I4BCgyK9Ge&vW3I)in`!( zd^-O&&w8^sXJf|{Z)c^<;I7Z@=DN?zI$XUh2Da(LL~|sCvvg_h<%M}DO1k(E=-HBWi zsRBwqg75yM5soF9vG^6?c3fM6xrX zIlr=!Dd=UNW^TG{q!{-Z))gRSOm5{T1|`SXAJU{bW7VuMA-{R|%qu{}ZVCU_<9OJ@j->JgGOI4>6qB5~yBHP= zjD4L=pCP;3$WH!s?81Z^??DNaMv_7R>&U>qFAvs#s_(o6?yEs-i!MZ+ z9PPBvnsteeeQ~3frpHRimAH%C-BrislQ{ahswsd&p6UAM0io8{v^ zcP(Br6^AN0U)@|b1FCHutet2VcKLU2r%0qZ_xVJIHo*0_GYz-aHlH3@KfiTBNb2Np zFQoX#^j&G8f{Kv;Zp+6n;Q-8eQ10=VLS`S6mL*>$Pj;Vt3o(m z7rncUBD#GQ&WQeVe^ZtE2l@EaBzh>LV@-7bQ9sAXIm((gEVOS;783~GgwD&IYKSd| zHf9Dh9LzPa{H2opL3r&p$hfEeIokNce~iX0aIcB@kM;nA`v~ct6AXT>>giX+%SUQ# zhyAN76*a z#Q(cXyln(9F)3jF63`YNS*0y~^176@`ph2oTz->-%Dhzu^>Kf=%P}K0x{yF6!9V&D zYe^=uadlPKL|5%*6Pjf*h4Zkg(Y`|dfGQ4+RIQKMg|MqArF`uvoihR}qT!Q%DPk3aHa7Lhu8ChY`3%;fn<<%#hdD`iq6xxJ}eQPVp; zc#v>*Jsv*{+Ekec%d9QlU88QXr^qXPOcBAp?B?rI@n+hngAO7|8WnVm*S9WoUdq}r zwBP~VwExxFcZW5xb?XNZ5Ku%2O+^Jm353v*CMDE_-a`+)igYO!1cEdvp@rUi3st&+ z^eVlG9zlvUMFd3@&z;~o-~I0QyT9+b_x{6^XPBA2XV2Pez3W}?p8cn<-r&eoWWcad z{=Fc!^QxLAPlsyfcs%EptMhDqMML-l0h(?16p_Lgm3| zO~=Z@a%5lZ;zbTe?sH~Gu1a_RxG_kUgtj_+f+C1@UTliFjP2g9N_Ns=y z*Vkme);HjIwC;(G7M^}S)-$<2v=2FzM_Gp<7y>e*J-T7$3R5+nM-*fMg4!3m4odw8 zhnKAu4FS{3PO9ya(jRIX|N3n)_N5o1LUxK zbhD=yu7tB-fg?$CB<<%)B@&Es$ZE*CdWcOD=%{ys^B+?oWZzu6&Xsi{UBeKPgaMDm z>%4@wq+)wDDuT!`rTY=(7_z=gtXDNXby_ZSThrP^kbtgDTV5LE+QW&S6X`46Dl*g` zvLXSM_f9$#o<69g(lubSPon~XJ{%R(H_FQ2}1_g7?$l>epjKsKehxkezK!DXWg>B7|P}-ix?mLOf3QlTV z+xr*;d<7IzDegQ$6BN9w<$5<9q9Vq*r+@LtPpO;84)9XgXW?sRZxsb*yRw->+rr(a3NlKpWRdNqJYGWj{nMak#Bf+;$uGJMbqA%MUEZZ1X-5R6QylQ#nWI` zmYQG89DdFusKu6_CB`5>0+aU3AwdD&oomgT>CJ1V)C-Mk#Tu*zPb00zd5Sa;+};6e zPr)-Tm!FJk>D;a9KnLqoR&MZ-(4u%2T}rEG^{pruehTn`Xf#bPYM4^WbOt*3ti#n2mpkC-Ov#I_{D|mo6KB>dXUw1by7vLpmCHr7>j7vB$8` zb&Vlfa@&?AT(gIsZO9XxLytP*1mV|Ydojte*DmVFoIa(&DUSo1`XK++FfMtpwA}EA z*?=&l5g%zBJ?VQYuQ6a(WO^fN2Sh`@VM)0U*2}ODNH_5D^PJWYE9bTLMmfxA`wLwg z<6_|5SE=szFiFKo8=Gi2^c5GC9OqixLClp7d}6lT09h99qln0XR9nqT?@ z>De?)d1~C}{K#{sOO<5Pm1KiA$VXjkpI(Vuml+Sz`0Dzk(An;~;1^H0d94m|&ssC5 z+^(vxt{3Yu0I}rf<^x?8tA{i&X!Nlyu~BBl-!Q(**+Oo^5l(&tkxj)f-%yV~UVv2| zSK1ixw-pwt8rC!v*4MYaPEi-sA?QqSQS0p`@LbWh*1ymnaN8m2{7JFqOj3Cf%B0z& z>Jg+|T+e(-Yj*vM>766rt_wad1iBKLwYi+>8T>7&rZw*H_WGmhL_Ld4=J=#Wcn?(c zByO`gbkw;k5=i^hz<>IJFO5yqL3fYz7LbYrLFBwr;m(R$syTnthhSg(bYJ3Ab3z})KYI8Bw z_i6|twV+ykAqHt~C;1JgI<=urfuzfgh)i=ipkdB$&SmhbSR`}pc>v7XE_vNQ_oqbh zj-K!ChwOkhHqX#8hJrx5Kzh9P<_$Fo84-YXT>$)YR|*kD68{Ins1p&rAb{I|DN1zN zcp^SupeMSX(Jq^LlKC2|$E00c@(*VN_xg#xSx;$97)0UAKP$HLB}7lNBOGKG60v zxs-5w@5$k#UEff?vbSYuKdRJb+Fay!U@=5f{j~=vB6crA=tGtFe}0)T8`Ql_>&o^{ zMzkf9KppY+De2^;fYceV(Srk&eBPVkkb=@JEIWySIqp>$l&yPAtZVca zt`zr3meeULWge88sd3UuWPvwg^oAim!l|l{)U^1+D^OahG)DFGrD&SI)m*O9G_P|N zwI{pUgM7vI-b0rBYcA4M`W84?VdK*qyRKhe+Vvee7dcKEE=vtl1Fc$k|K%ec3E?1o}?T=$R6lpH6_1@XAlm zU9)HT`hv!F*$2m?A``?lv#shROPqNhc@@nl@qhM~_=;fVi_sID*2rikUYyquH+2=v zBr?XvG+gAKlqfqCl3t1R2!$#Rt9A^DI;9HG%v=;l$JT}Ks_{yfm)8qzuE=VQdE_^} z*TX64OJB82dsbVvKcBGZCbk-t^qQS>aVUvQ3#~OPqHamaA~QQx>H7GZFH)R!fWW|n zQ+lwJo4S*zQXr^KD}LSL;*2q9cz=#$+ot_e)LZT^nhh^Yf7G%q^_BQyKP2xkZ7(V* z$mPuOv&P`?xq5_FM3+6P8&QTDz`q;Bt5tDkITdybyNa0HE!oYq$a!{&64>-Ok=jZ*1*a{M42(4EDu8FsiC%;a|9L6f1YkvvkSRfW6YWn-v ziS0#!YNqJk+t$+-ZyGUVHR}2a7MvSFj1Cg5XN9PJwiC-hl$HHXS|2glP`6F@4L&X) z`*EtfuK`QCfs7ncf1!o?F~pp%SaFOhUMaC;ylon}|4S&GQ-{}16D`2so&Nc@m5LuI zoYlGh9gUTAVULjComPxFw&CJ_+@3}CTaZZYg~{V_t)L1`aYOym9%?4#aQ#v*Jnh_P zdo^onR!(WKS`oVvw>Iu;c}sJWgPCpFbLv`AlGKzC_%myq>FEp~Obzuy(t_s91KU_>`6AO?mgqTo}~P$R*CG%#e;@xJwK zPUOidRU+Zd9y#~cfm)>b0r(G|hP5<7hmS84q7ZFZ-a<~#OhMz-L*GbN?d{~{9mH6u zi}dXcC%EEdEMs@yT(s$J`{s7)&u%>GEVJ#Mm%O7~vU-mVs$1Epd&!)&S6_mi?pfV1 z%7k2rt4qpK2+7qI>ZKoxV=&~HCp+_p#paZi1#-hsCa+tlw^w}{+^5Je?0>n^E++Pp zSVhy%!Hh)zXx1YN*bGQ8rIxnY+ZuoXSS+x~b7sp4zL)X4o6?th*31$XpPL7^bj5Ls z)(u{6s{1Vl`AkYyn(qmrr6#_V^ZWyWr!!mmA|f=Unb~-EAQ_%jdCZ*cdRsHK_vd$b zzW9>b_sgyx>yPhN*Bwq{S66%_tBcrzgbHF?1e)SU(3H((>CX43(pcTI}Yi8UUk9F7f?A%*gt%jw^p~8I1 zqSwcN<-@w2Ndt^D2FLCD3-!Wya>N|bL;aj;_8x(<0oB%vbKX8K357R8?MJ{))rpZ< zs$&Fa)KEvf$R$J#-XzYm(n7#RujVRrV;v#u3kAahM@DR-d_e{GbKeh@dW(L2U~)P$ zDqX-*9IT!ernPY}IPoyrS(1l6*6<MsE=Hs8GkYWT-xPL`zY9CO zzEmrfYZL{3^xA`yJZPBN*QxX^FI?-}H3VI{j4>=ZA0_k}49CWJSu*TJ@M3-2cmb

    {;qrLJES)1#-JMKQhimhTzftPI=5Eh1FXVXUnlVxxC1M^&mtv+f9zuh~KaS{`LO&_QeaA2h)$sR~f?TIrhw*EtmwuQOq0L~Hi4zj@-O$TqvvvNHXPcC zOz51anrfqL2bOW`iMDUTmCP2UGoFD_<1R^-MYSjx_uKn^S8($^{N!Iw+7q9L^hh0X zv@E-pmFvo;vcOZzQxeq8CK5QX$}b{3h*3d2@_|jxxhkp@+0Vv!2R4HFVE5QgZ+iv# z1LBC9mSCS3ps`Zs@v_ zrGxH1Wsh<4`)6;dhlKxF;V%d8uW$7a)QiI{v7IDM=r<3}z` z7k0L)*2A6spLoM_SM06=Lg$2%S#lnN6LTzpha7 zZjCe7cayKzr0!(VHJH3_Ut!7xX>vUkO%`z?kNg468M%Y4m(S=nBrN!L`GQPqV@XeP ze@F#)#7S^I(n-4}`ZTokU5jbYFl20PH*EC1*tV*(nO7|8N0Oyq` zSH?%Q;~gOVExTMyIL2#Wi^2Y_fqkWsGzVPDe%X0cZrgas&#Fy&LosuHfA^N`c3iPS zx56aW?E#!!X40!Tt&q0F9HxR|5L5peT?;@&o0XklZjdNYet7{Tp>)jPny-5P8jd_0 znM-d>I4d<~3gyK#gCFKecBLD6)bkHX4&%7hg{0`$cgnN7cajO!d&-e z4pE124>|HeDqFp@fH^v-sei3FFfI3w(E`rYZ!oCL$(?#|oEXb7p>+74CsoY4RqyTA z2SjT~wty$K+PY@}0FGuwQyz{O09KWP&H3JhzbLB#5Gli5Qn^+@Sat>I_MLIzd6FPU zRc`p(#w=$Zu3e|QO&Sl&)1s?J^^XTL?a}%`W$6s3h!B>1gVo^K$$zL7O5mKXLM^kd-8Kcq$@ z!6MuEA5+wl+?|;jdK=<%_t@y{W!PLIloSNU5_Bi}uE2CTjcSyl;x9w76WK+KPh9*n zgbal;>pYZE?2$DYQ5sE&B|@k9Rbo$z|2(0V?*;}MaInocgr8d7rp$MJ-~4V3XL;f* zI@F_0IGv_skDRjOCl@(&n)XPCjuyl4S!StN2LWc6!9^IoZJ)oyLLkp9GK?eCsLHE- z5p@$6V;onj6N8zhKhEW#npJV&w=;FdB9hRh4s4Mp`NiD`6`?K#Do!)3luvCUFFWp# z^qESCDQ9K~J@1v65W3nx6Ld0_QCzK(lo&(UaBuKY6XkMw~F$0?hMeyCRpNMeb8HntOwqdAGT1> z4og=Y=3Zf-m=0iK#g^*LA^A5 zvGPL@2J9;}V4h@kpXJe;G*o-~u5yzNJh(=F75L(PG?_fDvNC@ZLJ2pS!Rm`^nDP#2qOPls11)3?LG?NwvHekLr1% z;Jxr}2V?K%wl44h7%`eTUHKaqoPiAX!?WMOn+%v)f2F&GO5d)jk58JcHU}&KQ5f)O z0LulPC)t|U5ie`YQN=o2ZY=H6RJEVi>2b%$C?3FXV3PkxKyo$eCGAQ?)uvs3O9ku; z*a>NbRfMFIg3K=d#;TQM2Q9d=vFy6{B@--gDrf+(9y-uE-Gh9%&W&3qrt0bn&mE>9 zkc_d`(;@H(rs5ii;xCk2NoH3)QX-WOeR&~`OI?m(z$5Y1RI{@vEAH6lpy3vHPbsR_ z_ZIyaGaJl16gKNSmz@DT=R{*JfPCO`DBy_W9u zJ_2@K^n0S0lg8VfMFX!_L776n^hh&HEu^XC{rqBhp4q$gN?N#kBjsFday8l7&*d%- z;4^$S(4F9e-kzxn8MfgVE`|a+g8-Bfi8I!urktxd)B((zsRl-8>V;pkG05c-{3(;& zV;{N|VI%qAdvZz)Of!ag7K6f05_YA{gg7?Pa7k{e^-71dnEE=Aw^eQ?v6vQM>rjBz zG%#wXRbz;H%7ud=@n+jDXVb1AhsuOBq`VI0cEZ_f$ac;!iN@Mv0d zU+jhjs9C@Riid+plC^|o^V~3oXJo~bB48j>UM1SCe4eEN`-xC$!rjKP=&Exds2#84XZ(d4Ke+Y#FbnA+u45HK6 zI{f*L0Kj`VmOP)oIzN&EIhtS;71|>fxHzYP3kPE{84s3Me)vn1`y&UjrbYpU!%G2VuzAU_?fs$;+^TmACoO9rj-|3E*V_c zFS`m|>+?fkqsMODb4;Z#q<3oH3+DYtcj{^B28OdIf1RH+39MOU*H9?HE$@8M+DLuY z>Tte(XF_jK3n{V!$&?90x+#soi*~tqu3GV}n{(8LC0ClMTaHe0UVhL?jOt8GT-;RP z;hSLoctO_lbLi;=RvJl16M$`)dj|fJ?)3B}@Y$bhVDyF*=2N8@%-e6GkS#atEO5%} zqDuA#Zd3%)vfu;D+y3WK*;&#&#$g= zyIj#I*_9O^O#ld@B)8hY7(*W6HUE%!2|XGr!*^~`jgV^Q=Q@xZUwb0rs$L`Wg176J zljgIZ0=i*fqtA&u-!eby1^XdO+o*v+LoDR$t?>p=dYaBdn(1Ff0$t=4$xjXQNZ;it zthMAEV$+{6DDWMUU#Sm5%JKd%DDudLBI`NQD&2XfT)3I3!6Ny}>W1xKKe*&} zlIr{?FadgwC{~bD?HAMz&G$^vT2SuMZMZch!PwfsPF^s{UctaD&` z5KGmSoMy>5V9UB=Cd`;-$IUwBqifaBu?keYGWZuzI-7hLdq7Jg@b~;X zi(7x;q6H#l>HM$E=D(S*J%>BNKkavC-*oOfFefSBk0M8#mpKsHGa<@Mx|b?=UvtEA zBKmheiD^iF&H9Fj!va)jFn?Z-Z`YHK9x)}QtV8$tWwN=ov|t=%zb!M@tdj}p(ZmLY z^rGY4TeEH>DtcdyBy?S6`db&5CWT-cZ7EV$R=Ox2H@28cChta=X3g+H)lhehN3qz9 z)7cHD5}SNe1EUeyRP%|}q(aMTV&&|tz2LomkMj}tc>N2amL)aAPtlW=mr}#*xQB(w z^Mc@DQ3G6BKAUHQ0{XU@WUG=IiX=KV-*k-ABMn=6<_(-9wC8(dMa&8Bw_I$n~5fkhG3WSFGxr{JEeGXtZEkZa$puZ=PsBZdv%gvhbsZ zngW`g)m{IlH0SD%Hkr|{-P)qDa1H0Du@a^F9_{LXy0Y3T36OtLIgy&`6#Q<_c+TYO%y^D8r2h&G(%0^8<7%u zjrFDcST4Kdc+W)xdPbC)20bJkVvt6IYIbptecNUU%$=?j!Ix6tL|XQn9)BdO%uDHeF2@~0*+jY6n+ zcs;~TR?DIvf{j&1xq!Q3yX* zz(D~Oj0sPh%-PU_I5&$r|DGXxOhz5QGk*1^c7&i+_wQ-kAsHcwhDEC zFQK5Vj71h1;_bb<0fC$ITZftk-)(XZ58k?5cCJSW=m0fp3(lZA^y2`JnJLSx?mef;a~t@t><`_gQWQe)Igir^&zE@_>+ zFu*zi%LE{9L=N>Ik2qhjJf28uH$I6>JQ*v)DOrt_tr^=c-s^CEBrI~>#>NzBET&aU z(rCu-p$vp-PA4AmKi{gC?(|(qvRmSi2q;@i_BkpI>>O%hEXZqswgo;qB0Y!vTF@l_ z*~6uA(gwmxM}uo$YA(`)!X`Kql6sxN(UW$WGzGX51;Z!{VZFiVy|7{C4Ar;ea85PO zSN^X}ZvCEOfovGsGO!DceNg@W>R~U^|s6kdREb8Z`3KygFmqjS$?(5Zx!B z8#Xe9e5u1UJ1S8DK&@aU-WJvQ+YDcAN(GZ4d3{he@Y^kJHD#6=<5^xWFO-NmO9D-g zhja(F6z12gz*9s-9?(6K>o2*$H}vH&GSGn2dePL?Ia<{s-U&5Vty-S@*(0B@s3sYC z$@>76eoi&~C1ke~q^>?-DWDSV85KnpU3AbBbvY&Jz~%X^rFHig@W1T(XYMh<$ zLlZQY*+93Yr1;#5`D|d&pL~Ne6~wf@0{G`h^#@_f)AZh_uRFipXyh~Y&M!Q{t}ht8}j52R#7DS8vBy~M;9?!$)^tR1w0qlwt<4(nNs}C2hGgL5lSjgFTL-~-Lb9R%0Lp>|axvRTB z8m<{Am*@mlKl6&%hCj9AC>r&GhBM~0)9X0hmJ6vnE4fEEzvuhcl6z4K$A4F6JB{c1 z&8dTTg5RzBy8aj{F}$XE9(MW`5;{)WgmxT-R{d-Tq{qFb~ieu2?EcY!DDg@ z)An)ko$* zQuM8CmVts_{Nogb^8Jl9n|eYIeSrQ|2Go*d8$~Fr_MB2T&Aiv>9ypd`Vfq}BJ-u|} zwt`&g{M%_&4{H}rJBfrpE;YAH+$C)EU`eGV=2F?Y4(A@gJ)imwC~&VOm{z%PbJ?JE zv{$_&haP?p?HzEi?sH@;a9QN6(t$z?wiCn~3~tW3yg}T_;8AN-&3BT)Y6`JzzQIo> z{kGe6Da`5TkM|^Das%19R1P9Ev?tb`v}XxQ&s-Idtc;vVKmI9i0m>M`&iA<7cgej$ zU63;a|IkkRPC3}dJLu%Q-sb^zXMx>*F$E%z_=1bcg@Od+`kVL6nkNa%7&*O%r^;%c zp2;cxzO?-5W#R==&>T_8u|V%&PU#`BCn$t-JX{hL(92lXpE3$Hfq^g`XIYYUIsn-~ zEN3GPbpF3or2h?W`+xGRvj_h>UHkWi?%%ha24HW^Y0g(Z5T&h=+|rxKKe(cXzB7ZX+lJ&;q2d;5XrDnzI_|*U!d0t>-s{YE;YY-;EEXHl%)!$tr!9 zENPdttJB3uFj5k^TDm4|afboUPi}GLC8TkA+z|?%lQua2jPOi2Dx4}6VfIM#8hv> zWa59A;|={b0rnjbt*AsCZ}J*Yu9sAljrvxAf0z<(ZaI{oe23YUpp=a6pf}-!ZuXmb z9j+9w`Hn@T7K++Hmtb5q>G{2jop^kmAVr0v7^7GQE){kCy<{D3nGyyp?CyOE72L~{ z{GVoZ5F(2ND5B;`awkPd1+V=T@G*hFkFyyAi0S^$^nuI))N--h=MLXTFH%h@Ki9g) z+xHFTV`&Z7;zDNlj$V)q@Eq!l`!-*%eC{jvyhn$mK)4*b8R>GJTE!ElWb8ps^D`oWy zlIJJAOvw%vN?PSiS~b5NUATZ+pMg=T(dWB7LwHUiM%5}gU$!(3rE7J^I>FC|3~$4B z^JCR&5Z+v4Jp6u$9F6dzv*1m1>!?}L-zhwI;fUVVs>NjfHjnJE!n)~Mho^dy`jKDJ zjU^v*dftcPNysY&O|oHd4Rc*~F7F;Y-aM78t=t^G#0D3BnjZ&{fHD8VA*~DA0CE|y zTRes!s)xz5Eo(f%H^KsLf#0$*k8fWsiapRwhY9TVPS!EcrL zqpFHMqQJ8$jNc64oKlD)aW^W!EdEyTInR-Nq||Jces8#H(-S-AFfvn;-m)+(gN>Ux z;`5az^S;gunkGs%iPh?0>Y||-NMlVpZiXPKH4}KEC&)>IY9UW44{LhD81JE(PHR)RHbDkIPdYr5r0_f0_#1IV%~6lrfM}P4S!jRvAXt7m8 zvcBjbLLE<4P|MUlupdi1}J5dS&CzXPR? z6=f!aTS=1{Q6^$Uw5(v((i*b!SwC)Z-6gKw{OcG`HCYn;Oc(q25kTb)tQPvm2_GH< zfeui%DxAq^{}1bc0Fr~W;Kp%J)35qlm7YX;@%4GOR5t5pB-iVR2nwVjU!vh%@fvt` zMxyHi=}_zhSCQ-lOA()`3s?rSaD_lydZr52zF1)3WGv4AKTRLM`|#Mx_^{ z9RI59uzz)qF^|vk_IOJXP(8$^w zJyQz{3XGUjhNXr5%5Ht|jO&Rq|GAVlTDk!F)eg(^^V6*cz;{3`oT-^wX?fW6t~dA< zG2LYjmyf_x68$m85&*|^k3Vq*9-Mrh5gY@-vVw$5>w!+3=JwZR*S=p>qw1HO!0tRX zmGIB;aA9huElr93+PDUe7!cHD(RlSFPT+OAhb(cVf&)yJr7&2SI~!pf=E3$VBI6B% zavnGTxlQ6r2jKypsVQ6&O}Q@??{DGs==UYvQW#fspA@E#2w*^8LVUaCfb!$nVlND- zl)d}9oOI6>(Ev9-zc4Xa;MLk&Zp2^$bo^ge`kuYJf3k-fvd+UI0X8gK9`=u#H-j#{2NvBW;1j;*6 zt{>Bq$qlzW7-5MMJY-_BW4DLA1_-VqE=~*}OaWL_keE*I}YfUM=)UHP4+qAK9 zR8enfnQwEo4|7?hvsB{4{&G;pw&4*OK~sG1)^@XGG1rg6XJs{y4Z{P-&O2H;pP}HM z1DHoZn*%Io)Jp0MmzS5t!Sp{U9X^-hpur1P&mSnM!9yl@cSF0-kTDaIAYnH@iQ%(= zhj8=;{KzwHZV<3{DLrSt&-?nk0ux1iZ^?%&1jybQA2Y8nY8wVyPy*SP^s#IN;yzc6 zB@Fze^T+x^na5&KzEF`J2;_a+)!M;1@e4C@Bk~q5%5t{~quX_LV`aac#}S0>gu&&1 zLLP-w6El;;4#m8gLR{Ytcqd)odVg^DJUneK1_uXs?XH>wVnpGQ>k9h$sh8C`3BM5z z?$+R;h_xSEPo2UGZ^068Q^j4`=~t@Q9zVW1N z`2O`!h}<{+@`{RO-rifzN#eDCw*1LgB_zM%BSOkxgt3AY`-&K(`wRnWo;ZuLMO2M^#W1y(8W2`@<(s%_fe$=O z{^y-<0C&$E!dH2#aK60j5MIu(W>DDH6VTu<3;l9;CIf4-M`<_$Aj_9dW`M{n7qO}G z03wfwJp4Oe6SK7q3K0a49sHhmue&ZtlqMx~xy3J^MP0pmAzjWRcC$9BD$1e~^Q%!KV!s#tJs$SM2$B zzV_y1+##ukl%v&~lO@#^mca~V^$r-@y(SnTaA{4Fwu#j3wB#y3%<02lO5xdX0$WoL zmM#;6Zcz|JJXZI)52MFRmM+*#B!8pWC3rxR4shxo{H9X)xl(upPBWJhfG!{IE7cTx zuFL&T#dKJtglt|KOhud^#-sur2DU-jiqh_oT6>P%hn)}z0hu_32D(e+ZhBN2&!cRE zUlclP7vzSKZgh5>W)V6&=YD;eBo2jzEc)Shx}1R0uX;P^nWZa^Fz@{PD&q8T*Dbyy z%z)=6(o=77a0XmG;66!qlI+kkeW08UHKChWidIZKfVwX(gNqS^v&={A!G8auql)!) z{?^We?1Bl@tme%k`Hn#!1t;ac({z#^WxLt_hd&-AWSN<&d9Emfl#bs0Ndo*DT-@zM zE(=x>4>^18b?T<=1c{y7Kf|5L$@ zH9Gg!hn%y95@Jgn$k#A9*YAc^)JO8Yroyx>BccnR!mQ?`@v?$@C z(M%>a646iDn8}&WTkpBOb(m&O2r6Sr7LM1O3mK1%Yz!YGQI&JK+4~EOi%p69G2Ik~ zP{lMHWvwpXtZ7Fc|2^>j{{H>lGX_n>xBea0Z+O{H6D2`JKtw{U!e5|4E?Z0-9qmU> z?XF7yyUNf&?tVKM@PH2l$4{!5Sz1LR1ZH(>wGxoxgcI$1+ia%$tVE^toK;pod0^bu zA^vW5GU>{}5z&KD8OdMyPvoQ3FSlCHj+`A07x-D{d|w`ctMB3!{@LRjM)SLmWv4ZM zv8B2RjyC+Az)%5eo0%eDD!Tb!%&uOFN-%5*Vv(E?8lrXr?XYctzrW>%Yu2-dSwpOm zriS?C>A?8pWH9sX*%?<|>S2s>B8LW;N3tJOk6-=Q$10FiRu2&g$%18fpl+WHg|zwlzPN z!XL#(T$qV|p5wk~sD)({D6r(yM>Eytf>E?pn!Oy)m3vW9&5a?j2qfj2!jmnGytI-% z+I`GLC(qXqmxAwuMD|biMP+})$v(6SWNO&l=g(tEGyXSiiJ0(nQuDH<12i)~2|KmOg4;$9m(W<^syYrg~e17%OzRZXiN1 zw&t=yCOJStglkbkqsQ6Utcv#-FXm9+W{o(lb{%uZAcFw5arD>Y$S}Hr{(jIV%>4Fu zlxpOLFxrk0#RMhC8}MWePpUa=5VHY0RjuK_dhl5oIn!?w2hp>(Z*H%k`xcVMHgx)4 z0}%CFK`(i?W(C6xI39?6(BYBb`*pt~ZkRYX+}14kV&`)Ad7+74;7dfLt#S9T!Mkqe zusZPs|Md=@^ttPprxO8Uoegad=S<7}gyoKDTbo`Eenqww5-H)%7S1Z8O#r?@kd#C7 z@wWm}ji1fqD6WN%6wpWRXd!~%rk=J!*iaLI7<=LzH7~6 zqMz32bEaktsc?rtw1)gL|<({z#h&QugD~$;LQUoW&Y`wv zq7}NNUu4+sJzMl^rHl{jV<|Y#Wsdz3G$V%#oYM6-ybl1s@K4WPYBuLwU0#ms)IC`u zB=hQPY>WBr2VEn<>~RSXKQdUmEB_fAX)s{f9T{IN8{ajgzM0_zAG;L(lK5JNlqt5u zVn1(0_m^7jS<4d{&i}4>DloYfo+?0aNeieN#Dd2D)BT*A_2>DmpD7mn z$1}-i#qGoSz(C*{EdzGyW{ihqTw+D{v{aGPbtto@oAl7)+AT=W@oH1r1_S#8_gxfn z@p8kn{lb&j{;-Qz>r*o3va0Lto#Aus)N}IqDc<|_~m5QTFSGS)5l*pWuCN0I=p8k zQ+mEMvj$|H#h-zWd$mK*0)2_$2)x{{;sW6}BtOTL>!qfvMNA1b-rL%^0=^@t$um#- z@Jx)?=DDTAr)BH&OcTli1^lxGrs=2P>%3FY)1gT&zIPdZV;=r8uSHB$o!BRvKQnPl zA#zy0GL^lFdH|%^={PoGoCgWfyg$N53U2?n%#-idq0khe5F~~Bn6S2UR1Er(zis3vNRXb~7`ka0o4FCqQhzg% zWFtVh$yZy7g(WD_VZ?S+j*y%Mp)k+=wiJ7>%d$fO5et8!l8=|8utR>eOAdl2CuU4> z_~yu!9JLID(R`0mk$a`5BrF*vxkj?Gi4wS&7a+bdDKjeX23gfjBP^J!)4J#qLd6!h zCR#ru?OIRH6?Y_{?WmVn!Jj}mxb9r+1JdM>S`6n-hT0~?LB5Zh+6QUM zC2C%ZTqUsQlB~qm;>9ycz5-OVKy?oqt(Xy`U!bIbQF@8!?L0=&j!N)lCFXXw25;|A zKKI4h)nDlSn}11keI;c)!18&PV7viaSp6)C>}qogq?PD`c9cYhDG=ZVJt(#0*`){? zjYTU75V(ZW@}9slB@qtc6EI)H9P-5WarfJevop62yIsEL-S1XSZ8j#GooBD-?XFC> z+{8G-HdrwTY!i>EPYT-Nhm?5&hoPZEiZpOqoErd#qh9AxMc*yGvy}ed!{b%0kiX-T z!sD$K(~_i8Q5HlUCiM{Y;zp^v<+F@9!X(!YbrAE^=ZmyX(AYD+xGGv zePU+_V={Ssd|mmbSP2M|lx9&vCWdpzi4_?Pgd_S9f)pKKXehj$qO5=Ax}|=-SUgzD z*i!!((GQH1G#u!>2~kZQem~b}!(wjV`pFhy*0L+ZC9ZPCG0pJA!oGMA7G7xU6@x&G zW0;T3tcA^N%2I*5H+4fXu;e!ZsERI~*#9HhFd>Nvtwe4rmglP#x#D$ncg~(d_=Di# z%q857H}do?LX#=$_L#h|9(6b!U3W?@8WnLCyOTsY(qS+u;=Q}BXpL`+3=ixX^32SV zd)|Q{s;Hl&00snwV8(2l6a6{>vrE&~<4E8cZ4;KSGE>A?nZdFD+$%Lr57D77n01q` zHN~OFN%H(Qd?qwa9~z|RXYhdzeRxq3FG&B31J*cC)=(^xf12LcayX;bUFTh^O6LHL zv9H~nX&fgA5yB$jBP`KJG2@1`fl?;yZ2VW=O7EzBBXiOdX(4T<0vWDyla zXn--9nbZs3Yqy!-!i=)G#-mYOu-<6n0yK6mB)|pz`wrJF5dLLDx%H3lVhQR zbzn|GO!fNo*M|9L?V^8VuL&D#O+=vTBl7(W8VPtrx^IT`-~EEV4+q5~FtE^uST-M+ zlGi~Q)+ZK@Fb80Z{Gnn1V1Vw1fv zO@-io7s?q9qN2b#3$-*NLDrY}KKHyPD=RQ|9aS-XW1=C2ph7SuB5^`4QZ*@vc~5L% zoCDO)A%&Lg#b;3ob%nQmZ`fVrEH4@_XR*%Fw8EqN!3J~POC9b64~0+{i!cjWS}aL_ znantCynGMMS{Nj6?i#1ge|{!8_=FRk$UoMEt~)-3p^_v%=wdv=f*sbo6yM)*_-hcW z52a$4jAu}zQi{rUFBiuupoywzv}RxY(nI*-X-~sOz<->AED1sI<}}9-nn<8;?dVD? z;PLnPN!hnGmiIg;1dy@zp&8=xU zw@OMD zy+1w{kD}gn_Yiap$h*03;mNsQcKX;h-d<*_J~q5>l7XshcZEtQ7s0dW%FF}G+%zgp zOBCr!Wg-LLmE;MMvC+_bOFALaG$Ydj8-P2h6FfIix=RC~mc~F!%!{InfBFIzLM3WRAkG7|5&BgKuPs zp<`P|&K<)*92%VgTPSpfF{Tf zORay4Tn_mgIc$W#U+bSTovvUU9qafzc$Pl33~I}G3H5~6xBQ*MdA-x)?Sg*=ZlY|) zqH5b61m3ChtaRk&3;zLXxwht}UGqCp= zWkRUJFX*T4g`?*eEebwYOhGWLbzjDDXxswmt`&oj_U>dfR1{`f<~>{ZsULFeLEbPV zo@E*ct!tRKg#kF!N;rWv1~c=Ikh`AP_i#V zs6+O&*#&nLbRW6fjh+c|&nHTJBht&zXGZ4T>&z81Hm?m^+C+wlI~|Pd=XY9gprDCR z&z*Bcc6HjHrECRlOoqY&@VgE;W9IAd?#+`0V1po$F6A3KLUvW!`PK25*KH3z8tdhy z0GJN%1wnlp-ct77au;}@Bv>G50UcW2u{Ie@P;Bm(uU|C3fLJ!+4>{ykNV%&bCe)GG zCw2K?l$5?%IW=8fwk{mhXwRvsYNnfwd!{z4^1vmv3@W`}>p2A8D*j} z+QGdV5-I{YluTyr@RWa2T%p{v@8#OuNon#HxUzHZ+P^2-I(KvNan`~kvX77=Kgn>1 zM;DMR9||4Hj?%vSZ3cn*jGNr@SO|ZDnh9BadM|@|c~JWw@*2UjeU!oE0B8Uxe*I7; zb&Zg{&xFqXDI0RXC9jnf4_DWb$seyEv#ym3ZB}%v%HuElKAuXQ{9?ZTX{Nc-W-Z^I z*#=AAt@6J${2xWzm|SsbjAPtld>4SgU?;K$5gF0*Bg3%#IF7^ol>KdeGX8D#ba9@& zejJ32b@Tg$OM0>36adr`kkHb!4gDRW6>%LJXoFjzWfj^t7rDD^AL7(Bx@uTF9wTiA z-CA1O@g2=H7}v@mKf-QgatrkdXZdKD?E_77$B}ORcyeUf-eTbX3eh`bBJp2+jX_@_&@-2J{*b zK>ULlv?C{dVe>Tl{y!*g6Qf~F&ip)|(rp$=7*#s7uPTfkEwu|%IaxK{v`;G)mwu3@ z!YwV$DKn$|(4e_9uHz$@eU}KtkZV>XuZKxM6!0Brw5ex&%xx1oZt##_C+;b*Pr!i1 z3qWe2Aw*_2%$)z71I53+jMo1Vi6#u+QhV_N-SeF5%B_!#q|Kv1A=P>vY3E2LprS6D zMFKDSlSv0cbDORl*zkB~EFSPo98t(ZgfDy@gO=w^1YLyi4ehtwUGtCO&GPyioQd4m^b-eql%tN%X)Ga|6a(;nse*l^_OyIV?bNQYiBw8jMu)J89G}LRS zmU5VoGJ0BXVFAIG0TUd}%Uqcdl}wnnKYK7fslYEgddvg^sT^31{>Ad`MUJ?2A}U^! zuym7&qyFP4x5Y6^a%Um!UA~d_z-u{L_%+Tznu;o$g|zA|Fa( zrbk$98C1nC5?XKbv%}(CEC%p$h0#ZzidRgD_=5kk?ShsC6Z`kiJ1&rHZs4pzEDAZ2 z7`G1#JNxPnlpTpX`G&tAR{ONE_e-cYWxeNqE_EA7aD{F6o>}GfyT0V;?tIH)qg__8 z-v{=)+EYthffqJH-{2j@zA}$jGuh$8hZZb{3@q!=CBzX(&eo$reIvJuonu6hw5JI? z@ZFbg#Kc~DzJ2uaSot<}E|xMb|B;8yyp9b^{dEz(A=h{~|2#*oQI(9dDNK&AW`t9Q zs+!JYH(mnEWsE`}Wj;R>c>xzDJ#j%u>;| z?=#YM59&G9!5nP+jOGW8G8TQ)x*72_yPFXaGIp=V64ZF%tozq5Y}U4y5@(l-SJz^o zTUUF#kL~asNJke*y9Bf)qgw$Y!3HWcEM|$n1tNuy%9H6o<#E?Com_}*4;>f!)I{)s zL(Q&1v75%lzD@uIcYuk!jp4U7O@*nyqmy~>D9&R2v2z{Em|9wWAzX*4+Dn46v&{AP z{_tXycI+koy8FYbHD^lb(CrdwG#@r{XjV*ga~aKhF4Y)iK=p#OAwP_@FGw1r=aOeB`}?V6E6?6d;=92nnX@Eh2GFPbmG|fQcJZWxn1M94$~?f5A$eb+#H>8nBRLl zX^at?+y?Pd(B89=Qw&et{ql+1@nZXVtKmiGoc@UQ@e3orzQBbYbjFVy^#8h(2LX4T z>JmDfYClfdZ^d$rdsZYdW1XFR1i^se><Km@(esdVH`o~2IG~U%P z=qVhFpFHL`xN(}87GOa2R+uSZOO}v#U7^PqB*o7k48c5 zf#L@<_$qSb{(eA4IC22c2OJU)GFWg@gO{zgSA@r zluqy-il!r(!_UAd|Wn2(`O zwEqQfIb-Wav60zhZ^8J3v(^0URLL&ji{pQox)s2lO@Gfr)_^)ApjQqc*U}-c4m7FN zv~MJz9AgB9>hJ#UkEx@v^DPXwi(`=(34IKg!M~i~s@X32)?}fs5Vm6FGJdA7MXK)b zPs=Hg$(CQAwW9moel=ew|MfVVFEVdQz2JNKQ70e0Ia8;8$H=OS&BowGC}Hf&jy!*4 z0RAp)l5sJ^#&`DYYC^n#;0XqQeq~Bq!T@c@Kw8e8A&E3)uDwVtSTd6!uaXe>zfLXjQYu*^TMXBo*MbZcu z)RaKA>15&Ig&CIGN>WtI4;&q_*QHUtfYep1T8_Z35S`==c-2)Z<0GB;BDC zNS@BfWAoKbuKJ-t-cl6oP!FX<5x9Pe<`qC)YTU6V{^t^%#mWyJIN!rarC|)Qi zf>>HnfC)`3R4#iI;c${W0CaH`RsaEf{sT2%w+h#K)dzJLGjIKStXF7gL){{N76FY< zdTxUo#~l!%*ENC^e%6c|a`v@!Q4#+p{Ra*~0n5hoJ{{HK#PIVf8GE33xQ z98<2_@EaavHa$8T;TZLoGs*b?fXMvYL?a_o_MJvx{~^r&liZRuZI*A6X9gc0+Uh<@ zgM@Q=6?cvl!;TueKXe|*Bz^mk)6GY0sQ!dI>P_qXqN2l8%?j~G*Rl-LayZFMUrrMl}u9|>GW zr6-Uj1L1KRxSBt*idIjws*-M7C)TXyz54&qLe!$&{3gFW3jEhqghwZ(1pG4uvgy3) z$DykVp|Szh+&|6J;kUURUTqmKYf8`wJ&04hDT)gvCw0x6UX34E<`v9R@bQiDa+RGV zTD})jmwfZA6A&<$Ng%H`x&yDO7SMHUGK#lLx`D287Ak6k&)|pJyIA>A%3T(Lv4Jq0 zJ3+FsvhjL1N%ubG<#o7ApyS?AS9ja<@W6_%zpmd$x$r;~*47E|``sews_vPhf zCh8UGP(zaR_GL%~yx`UHp>flllls0kSWrO6YD;%PTIkL%Up~ zW}!$pD|ix-?N=-GtDtdFKXe9NqmjANp>|-(H?-c4&(=9J9oOQzXZYPqH`7XQaWu%g zUi)LHeZ+^WwAZ0c{E_wbiq9pkw1vhP`p7BKWjc90$0bSH4=m37ixS72XIQ9No_eyR zbs-FJqenSBH-;dc-@`2~`kp{qQXX^+a1QE%eB|?SZl=5#YOYXmh2@WTLR42~o7jVA zi@Td}ug}w{&5d@q`%qsMNnvLvX-q@nQuJB*2H`2n2KxDE;C9AIZ&DZEr^B^0UAiY_ zCtW2k7stoP1daA8q^hcJ-^xf4aX?!x$oKvIeJF~6&-G?+xlWhCrCA=cKl+pUCnA%n zWYeJa&cK;04Bu&&V%rY~u@tzI(i3Dz;sq$K>v$SI$_lbyP1Av67I>LnFU5bh)zX^x zPrXfsin6F$w;X@pyzl-^6M283{0Bus^>YX{LnZjr%SAQWQsD{X7`)q9TXfD?{H*s+ ze-hFqZR#N55qLIeO_v`Npcf~A2>@sV0FGdQ=|IG5Q1?M~ByGF*=g0HyVU=!IXLIus zTAk8NT9CWbO@rhsW3CRC_M{`b=2MBTW<8&FJFTAKN11wAQsL=UjpNZ-)2YSv=~3_U zvbvVUUFYtZ?GI?C(vCA6Df>VYAsQq1)HN#XX)>!-)>#!AI>}SH6_VKP%_3Uwi;|A! z<$auq{|46Z@&0hW+Kk5IME<9T1AFcbMZyA!7p13;-~AWO6H5GY!~~rSZUB>aiZN<7 zi6Gk_eRkX+TTgA5>7Gvv4zy_${j?#F4=te8hc^4`nhp9-Dc4QI+E zb6i0&Pm$Kg6Rn#d2X@74If^#msF?QXFkV$vH42}{?RrOK<|_S$F_XN4b6$fZVkL;z zLKqXEz4Za!3OEA)(*6JH@9sDTpQ4z7TEf~K^wicv$H`>c;{~V(O z#0*kej(5a&fR9GdR1<;)`tyV_BAQhrnQ4%XxMuvMo#t8UjKfT-CF{9s@kTUjO-yze zHWjK1C-#nYq^g!9tO-p{i+Ww!^5;mkn&q_AxG^--fmhMrw4d|?D$CuIId1#kEjgnz zizXCEQ;v5&+O;`Se)_MBs6&bfy5r*n{L5$Mu=&X=z>P7Sn1N;0_l?cDkqKg*z6ssV zBU4&(MzYZB)Q@(lowk5tiRBkX%s`2Sl~}auAAuFERI3(k^j#01^_@Y1!rY2~P=g>q z_d66ouO0A(Eg%~Nuq|q>cHK+>1ANtdLCt^o|GCM94raVNRi|%}{FOsU6uZPPijEqkbnFI(JfqKa-;nrr++#1MPx<0pU?%7E_RNfH2uC$T81B)z4pUg6bt_qax9Lq~zM?0paW>3op! z{Ey^x>GH+F)@;j@+q_IR$t3%pb}D5mUC}D%y*|b^L*@yp`EI&E=+$^0GifycFSn>( zUqm^q5XI6G1+;d*2WBh;x_WD&?RM&%l+97!D}HA<-rsJIwp~lYO8PbQ#O#zqcj}q= zJUzJF-q-n~ZmFTMQf`a>59q;L7ej&P{fK+?w~%&&_!j7qCGmSfu@g;<7Fi18{PO5Q zpIv>M2e@v?@>MNu8`X<^jlnWftc%u&k<;-~z34x9D|etaRV!c}k8V7;1nXC|D*@*S zJ!Ll6wFmj&am8HfP%|IfLaYjc+IWL5O$BTtHYPd3bXmIH$+rl*0%dJ-k6UcuqxfM? z04vScKUV_zL(%<^l~6<81|q^8iDE0J+jCRP5`ST?$|??my8rY~68R_D^`*8bn8DzL ze}x@fiDou!wO84vP_cTqr+I zi7fwwB;LOZbyqwqFvU9ewT~+=gl@N)Ho0KmV#WArTi!BGhE>n)$D#=hb8m!vu2rps zMS1Uo5_KLs)93EDi@P8(AyG1+f&EaxcUYjEub@`;S^#K-AEzoLSb6)M4p{G!P&(h+ z#8I^RY8%#g3T;)dzF{i2Sr*(6HEOIScR96e>HUQ6a5Mi8I<3H=b3A-=%sQdjO~9h$ zHW@<(a>~)?FUmh(ho2Fxh4h<|)Tpq(DOvGPmG*^6xu}4rI8_&jrF&3_DjZ7b*kan} za8HZSoJH}=^S-@u8StHW=S4fck$jhTw~1Z>5#*k_&%8DCJK$dn8-o3o<}15Iw!Y)~ zu!nJ(BZZF%eOT3??%y|OCF}MW*vh3Y>;)&C$#hrOHLF9Rhjm5tfxRYW67eDP@f*0% zL_8S+-b$LBc^TZ^XVo?@WFLqGe|tT+jyv<+bNE#NI8OGYg3C zh9XxdnvqqGN89vq-M!ye`2OCqTfu$LCaETcymI}Hskpn#(2k$6dUNtet0Nl>j?u>}IImBRp2K(FydDnvSUosYOSfM* zhSFV0X+dcANij~TpBc+A*D5AKA#JK?NM-b5anvHVT90!Xh!~>mpB{@@{2Vyylf$4c zYWyc%0S#_^t|nHq`fHn3p;}Ju`?}6DQK|;n@Bs{i)ptls83>H?r41NNuMhamb=|HY z0zPQ$+dC5L_z&!sXFB!a8=%?XgY|=-XaJu#?0+2E1>wBG{v~nrwD}V|AjxOQ_l8Vk zVh8hdtEC0IOt&w$88}=%cWlG}X{F37@Zw;)H0oOiYfd8mtjOt<>yE?Aa+Q|=bN+eC zSc5G-JIG5{Aw*SpI2(UKUTh8{VKJips!D;17cDHP>^zQXWp=joe42drY-XI1fis0L z;g%-b8_2S$nX%V8{>=~cQ|3l>%Wu5zxKh~oUYkY$NA)=SfLHVTTw>v?bP;gFdZvVH1I{^S!~=iblX2TMJ{Lk-9mR2_`u^4q1e0Bgvx-_+GFA zP&8!lrj7n>Pp>JsH|~uMVM;1<0Hn=VOSj<)m>aA|GBQSJ?hijAl(c503J-Nu{IzO| zXnx@Hn+vTLA6|22Sl7zU@Lf4Lrv>gi^3>f8ekjOf9kCvrT`w2&h1+|$@mf2k?&rdu zo(AN;e9@-($E-k0d6pOC{^}U2Em8Uh;ZLD0R|H1)T?_7VqRe{$%&%ne%B+jsazsv} ztVi2KVR@a&Ao5wRZNDS#A@s?TN*+F9mi(8$Ahexc|MNim@-S+-E7aww4NH`G2crkq z(ox9BSr(a_H?!8xO%n&};>dJy(G{0!*a>)3I1j#jz?wz)3rvqqC)!}-}AWw{gi{qsx z*hx955+4Iude0e6hSwMBFxl8-^UPB)CycG)^sR80S zsQVb%E`%AAv5)&qWhn-}89l01v z0Ie5Zw2cGC4vcd4cyJJYM_BdCf%T3rBKCWB6Di z0ZocQDlJPxbFQa44yDD_0?5FA1SQk4SK6Pm0v>b679eu$sD8e6iNH$oe^{+)I4ds3 z;?8Mf9g$ciftW(?v?OE$4&zE=&O5LyR=61Ij#)7ZGhg&RprE)T`C{d0lI?aD^_Ts@ z1DpBXeVe;Q#ffOYnEM~}T(nx8>71kJ78vx&T`juY-G0sdt`=HiCFPDe&f)gX^ZX(c z&_2Z_%R$m>2Ih((pwAj-78-jr{pM?=5S;fo)gU_Jh9Q*e#*+Sb-4MbxUP}yX3rk7;XgnUkdCbb01%jprOehM37 z%7ee2vOPMFUF%(AO_y7Vu37tMD#1rntM4aY$Z;tekJDo^YOMW)rfKqbG)}Buu;@no zq|aHBN;NV@&!9+d8#H0FOeq>g3`I)`VCZ}>t2+UDo?yiTpf|fw@Jyuzxo_6xP7g(b zFfQhwT_21BeNa%UNEylr9Ynm^NJw@RknI4S>6__@5GE;zTsuWpw)VO}TJ&LdHT{@= zKRuDoIj!hsihIj2RN`d>xG3Wv8JMqu7EI1@KpMI#^gqx)p4`mEaBOtKl##7Nnflt^ z{@B>j6QJG48Y)m5pa?8jMn!%k8TTmUk*wqUVgjB}93m+T)TOEPIzJG>bpUi*Wsuz< zeg_>>;#%l#P`6(>T|H^7(}Bd70CTouqkg?XElq zZ8auY^)g7sK_PXi_3cZc5A=f{@RWA0UxI>KQS7ljTS8g8SgSE%MO^W@k!+Ssy+YZ^ zvTUY5rw;L3igxN%USSTcm?}*k-*nAYX}Y9MnwPPhI+ga)e>Kltc{yTDvoISma9W|f0(a@T$7elf2NBJ}70{)bHLoH|$yPrQB!O^u#;c@?VY zWECd4%Kjr<$FS4fyQFac4d(!=$=kZE6Dnq|c+O3jWzo`sS*bCxC*unL*;X$5zEN@o zgj~vW1BF22*r8Ja878|ZnKyS2j^f(VoCWhDG33iY-ZgR`7rmY3xe&cMYm6-o-g5U6qSan80V`F1mP+tK- z%7hL8u;m8R`8wA3wQ~M1HhhJI>f|SbpzQP7{g;%6v6a+dBLDvag$r0a02fK;iqo@^ zfZEk^^U`stbC!SrnlAh`1ME|->VVXyL|O;yQIZN5{=YCIAO*vsoCr-p=h!|;v<%va zO?A^^rZ6^WO)`0=7*sjG0k7g+Jw)q1iel@54I_~HB$@nkPrAe_!uonqR?#TdD!!@4)e-) z`S~*Y?(Tf?Ztre!3iJX3=$RC*9GS_WoGRAXeg@L1(zUz3SWUH^@Z7&%c-7ibJsY0R zOg31(p#k&~^S9pCx)q8I1I!hk&R3@@Jse-2w^%Myt{c)mb-LoO2>n>-PiYHROvkfOR*tXpL$ff7J&cds9h`wyl*Osmf;&wvwZJB{?G#(ef)8&?!8; zKgONjUP>@GU3ZS}*(P~CK4-lrJ)Ry1x2W7hZ&ISq^XTtLoZ4|p!TRlG2Fkgq24$Xq z+dC8v7Zb&rCV@ z1GQOLB#nv_aS1*mDokeR32gXx>Hi_#$0GRlXGLp*z4W7FHgtkY}Dpv>;6_SAs<~wtqaYDf|Q5c_gPimzRw#NOVW*p4R_R?DRzr?FwQ z>UKzgS~33d+hBMs@-NpbYYHwL&WBT`T zscDvpJ9QZ^SRPqDwo=iFLn*8)2KA7r0cIZCfT>vD!;MF#>!kN|^Gw;%PgnQ*HvF|0 zS>WJA+R%_diIO6Yrz97u5SHsscU_9xenH<-?1Cv0-7YSLV~7}uNik-alNSY+Hndyj zEEYY*+l>2<{OKd{F9mc>LaJjwyE^8@fsEtABca?E-#4eI=_F8<+)EQM9fU;4>XdX7 zpoXXa1u6SduBw$#lbrRIacdR_%crob5G!s$)Y_7}qH&(*ih0!E1^*OwgPLC}Qg>!DB_>b|N2~bK{9ZM< zuJBDDg4)KcVX{X3RYD%N+cChQQ;(25AdcdkB}s>?2~j(oJ>)SpF_e-(QM7!DS)?cT3M1-Ohr*I zbE4^;WlM3k_#ms%W8JX4w8?3yax$?Xp4W;4=_Oh3c^2a6L$>}-Xj{tFWy9{cy@pa? zE0N)(@YrXZw-;|(v>R_00G4iwOF%$?hllt5drEqG02+U!l)wgAvI5LZ!)7+k8o_|K zej&D`uQP2uDfm~%#H3J)k-s{=1z+d@BQ%z`<+ZCIzjcW;LHLRRlnRj#K=azcPH_09 zDSq+2GPVoIqz&@^NReoO=2o<3cvEYi%ZgCO*sqO3A2#F^@DAJi7Pu56VVaWiAfq(2 zUe<$g<^1lv_2-rmNyGuyvB$B=(51^^Gstf+cGEXFNUTR9e~mGVwOh!>0?;13_bV*+ z8S?=_T0lDZSjmP*uh*^k3l^Mca38cQDsct^iVONl?EfUfK;QRs2tYLW7t;XrXa9f4 z_CfnfR$nPk;fT!|FwF-ah6dkKm}aGG6fH^DBSGK@;HRtE04qJw0Dc`2cW`h(MMbr+ zu<*=-#Gt$TC0Qs!HO4fUBwzRR&DZ)zpgohIBs-?dBrWkZ1l{~sSMB@PQ1ZqC#Df#`DRtWmzSjBho15^ z{NKhVCij!~ZrX8z@;ZX33e(_!Yffb+Z)sC$={{JeAVPP3(8UTiQ@+W&X&V~?0SX~G zZO|RJ$HyhKfk!<+t0{H4oQ;Qa7#ha;Tf*2VGd+xik)IS|aMg{ho(wY~1T52O;~-i( zs8rEuuG!JabA>H7l)s16{fnPZ>PRKHI&FxGk75KmfuIgP{>4m6G0k@k zI6t@Ad>n!Ong_#C6uWxerw1OD!07)7Mp8$1KHIj`l>q8Hk71+;?1%%ehf5Lizorsx zo-UbJqLc{Jn-p832w&_+wT@o{NH%NDPcX!t}_`L7` ze(|5{I{Vblwby;`wfCBH2JmEh93Gw0*#;=gKKR6p9@^sE!9>Np%UppV-V;u_C}*+k z7cbfWZlQLeOWZD%g2p?Y>@^~uDLUoKwMoLstB*L@lyA;SZYZdKNB+W(^0N}j3^btH zKK;WC0^~5_lHVqroSlt@{laI!kbt9Z70%62{PhLg(9mELn=@LA=uILV?h2z`bKwb> zETNx{;ZCAJKa8*0Wa;VY$H&LZ%ga&OWQJOThUBihML;q$=7`MSYB`@_dE1%C<}?>u zO-r@0qiv{2o!R`23uNbaHl#Ae*bT-2P@lw*!D9Jg{Ddb)fE{412Em#S8-b`{!_R-; zxY3|SBM-s&#^lvji)xxp7UBDQ6dyaB48!8vLv75dvIN`;Ueig-*I;hG_?)3|u>5BP zKLi(|p$PKb(rm6=MfrC6ukw8pl0w}96^NtuEP9ww^d;RLQNqSh78Nt#@3)i~zRmPVvY5O^}5cr)J7-hg^kR{+I$-|L8u zrFM)8uJN``&&vod(JWgjw3i6_O$#4)Id z+UZj-!!o&uqom^#$i~oeUC3!Q&D8IdAc7Lalo#B6zMh}^)3O!H2$#dSA1JK#WbIzf z(jem1?tnS>!6uGhw*WP z=c%={9L=j}K@go=*fWP!f%!asM`tz>Ig}RG54CjOjKUghl3fpJN2eCrpiKO zymeAHOgLQF%uH$+oFH57SyJKNzXzO(G3Gg&Hq9e+b`d+d2|-#_cVDz4l^oDQW^$)K zU-|knkD1&GN|W4btMSt*f~9}8+wWY+O0Oo1QvX;gX_@d~li%7WRa2aoX1h9ET+Xua zBP|I*&qFvbW}BDzRD$Ac}fOnP-qZrBlO z*N`RC@WbfcyKrg`(9WV#a5@cLk{TDC#=?h1q?^8@jj*CLeT09_($^+xX6r(xMY3kVLnvE<_jgj4cFXBP_-xogOK14kXcKZ<}k!8reXUZGRNt z!qAY5b|3Hs%y(oP1e! zuo42uJYIf(+7>RT6MCH<3&ZM5{r`(z{?m{bgZO`M;lm#cLPA3RZ`C<^jC$lbziSC! zIO%^V>gEefCLlja(2Z8DHt=3{{fSkwT9&1f^>RyN5-NvdxFlGfS^9abQ; zZs8`Ww#E5JR|3r$AanD$G|1E4jD4t8r z0Ivj4=J%$`aSp_o`PP!$%HY;k*n8=wZx(Bac@b1CLGv&K6)8-^FmRCEdCzd|VUdf5 zs*X9LCoB#3vt5~5g3Af>*a!WK616i0sj|m2q&;_cQ>+7-j2ncV#w4 zM>Loo&Aaq;>+06&_Unn=cVPW5-Lv5_5K5q?Pn9c!padwQRq87Kvx2z>Uw+>|TOmub zlmjkkB|`fsyz*D>fQ&&NKRvu#i1<7UCEn>>Dh?0rv3&@|L*y7Bhxxr7{|!0E(PMeE zhK9J1P=Aq-eko!m$&*olm~lzy`8SL{8@dl0rT(Hc#ej$z{ot(JlDEJK+NxLU?YSTV zZ2rvmZ{2EB6k(;M@bibSy7EvM_9E(~kiG&NB`H%f(0}}*>~EN67SlWHGFQ{s=0{&( z8zx~ip5+&UQz?RKLXFGdZ#E{)`n_)#tM6b?C{x+5OmgxM!+YQljUTul2oht9U->sx zMfv;3yPi_7C{qiOFp##pCr?=+0NqdVv9H#NeeM{~r`eSPgv}W>z9pN#L2$@F(;(JT z94wRg{MV-@k&S!GBvUXTB8`f^Gft#Tfqmug6xi-0w?`aHt78)|LVfemCcmBO>}p zT?7kr66rlX+=`?Fftvi?`DmnNu5-p57t7APtxD9n7oSh0T!+DQ7ZZX5l% zA*H}cQ1al?aUXkrn-IO6T+8>D^TqJSD@qG6~^nCRnLpjoW*D zFF70ykJvj^MyZx?q0)03zO~b>^dmcTz`vSs5odR3nsu@@E%> z#Z0;aM0PE8%(s*xgNX7HBtmUCx~AMjJtnR74lUcvuN;m4R;J@MCi;KqO_YVBMiWX& zXEst;-)0yG{yLjx``(u@!A2qmhd`lz5xrgwN7eckzqC!V{)_uu2r|m5-}grlO&X1_ z3blKWxBXm0pOp7@)gS1QoQ=e)q1zY_%5r_BCiP$*qM=ty&cnu0);Pb;kCUKMqoFF2 z&7>ix#p%`XA)Rk2hO)$gZbG9Gmmt#jpPNOeS5OQ~o=G&LnUQyW4D;(6&P@Ho46KNT z&0^IB)if1)T5gPbzn$wRM=a~ENnXCTr`>54BKh1udXiTvhls1rublC7zWc}{qZM}` zV&oOP@Ye>L;eI#^-p^`u>eK=yz0r>ef+WcPZF-5{M)N<_bPJJyJJ*IKUk^*mH2c6& z>roFh0vAK#gzvvN4O2WPsbz|%e0byap{`ZA_^|6CC07Wqvf`)PcTPXl&x1#(S*H_* zBsZ$5|^aeb)yhev?R5|x+S4vGH zZ{tiO@{L4OIC9KEj71F@?5~_6y&=3rSsDuJCqaoHk`5!I!qxq)UjgCXx0?$7C@Bf> z_y0;n=mB!oNjJXyon^c(`pd(L0|0LEmGui)Zdq?5BDzq3Q3JZjF94kWcQiYp8;pN9 z9EDcvv+doBeXM!)qVm7Df8AJ)lmBR0j*AsUX4_3cSN=BPVr`G?=+JFexM{ED`u%-Y z#=#Ov@2@Cg!yEFM_oF_c+osD6ihge3Yr5oEhmKh6%s=blKT#iJ!~m$oX-bcmK5za+UArsKrMA=sO2s55~3maYVN@2!B`!^OzejQ zXM>x^KU(i*>hPtf*^@{zjeAx$}_xATfeL(xO?==&4J=vPm_U+b0!S`6w8 zuV^jevfn))qz=XvaiV<<2}8zzv#-JV^L?v*sWb6!uI?npul^tv$@ZBp0X}cb(USB< zWD=O$f49i?W_M1N4(>0V9Kvpm@{{?cD<;rBL@ndQmVAjMn429lLwje52#*@=zT{Tr z?>d95^3%!U0}e(z;&XX?f%(q7;HvLO=hK^!#@Z?YWP~*}MCo6z6^NIR5ICkUPqK>_ zYa44w-J3H5m+18y^|UkuoW;!FV+89VfE%u;7k;!qYOE6VOh5gg_r#`BE>fehV36fd zAifF^j$NiuwBEX)AzdEZ3y8<5X%;LRj-$SlIlw2(QCykWe+!*7cZB2|6j#pD(f{3d zFtA7(PJkC{P>C15HleE?!zdW4$g`{?oxDvwse?d57K~2;7{QB~#FjoB*T^%?qlp(l zn;f);h^g%<=Vtqb#jedVXk#eF-7-nPF{8=YR+jnev3iSnT6_icPUfN$< zk-MPEzy%YE$NUOm?NC9z`sBhme>o@MXuajhnf#y%0oU7xw=m~Cl_wM=l7f$9pvpVA zSCbkj%tBKuHdp*(Oqcd|2Jx9GwL;FgF?FQ`q#{pYI&FybeeW07Fq?Uk3rr|3bBnb# zG8F*KK_~fSet3Su@{rcYj{;t}RL~7E?~mMGb00oCE92U-C9=Xr#Y-4B-V7bO3$H&> z-`XqF>U+*ckAQt6BSCnzbj(>TL*eh=c)65U5~1}bYV!*eg0Oc>O7N+*d1jb=l(>Im z&<^P%Gx1I4``|UKx*xR$O;8VyAD-rK3n@UA63zGO&_`jWq(qjJ=T>&+C4n0BEy7c5Qj@B zC^$(dlwOW*zCwVfYP85|c~y@IBTkU1%Q?s>>f@pA6vEekqlA3y+SBj94Ei8Gy_mGVY!p8z zJ-ye^xL^ObFzkzyM7^ak;h{{HN+%fyBeL1vF3v&>_S3% z=CrDRM>T`3o2tbvt;Vq$%;?ut;m->@oRbL>#XmLi*|8FGB|!qsbzz0L=y{tpYvVso z-fcd4enGh*wG(!ZEEea=hX0aPS38)N9c6&-Pw$WAG|_O z=E!hbXPBYG=(_qRDr~E4Q=Y#kQ2tVtqhSXLCwWj{e^;;Oy+X|@cmbr*f)h1%HCU!u zR=T537dR2tTYj#`&c}E?q-*`Xy;HMfdu`dRd%GB7?lNn7{qPlJV();H;{K7(c6 zEtKE=n7sw(I`Uwpnb1kiZ@E&Fh`spfF)EdMEv(Xzt}>4T-KNgMuCP;gJiG2PB=4qY>GI1Li+tiY$VZK^ix^(RsAG6pD)sSkUdq$a zDjnGkR{o+i3?g9E<-YxK+ivnZZ|QqgD&8Y?9oIHQpx}3MNf?l#gjVS-XAfVka6oyW z-jfnA?W!&Ft}VL;d+GYV!|-bl$}F|budk>ic$<;_$M=*reOm7oLdFUQLzOO8s^`~v z$(!c>s-~ZZbGT&^XX^TlgmENL6Jf5cI?W38xr@1!~kU4Ji-Gjf~IXCeFa``?DPqPt>FGgJ=~KlX%Pf0c_e#FQD-P!Ww2T>d zNoH-Aof^yHp*Q!Ozpx|hPG+gPf~bDp);%7hsUNkJwzRi!p`Q_ZtU||a_)C@)?lC~N z@wJZE7HH+mjDF~{>4d9N58=;jxzbaIY2%C&jjj9F>6SMwGNlg$N^yFa_XFZE_GyKX z`N5b8`Gtzsbg3S)UwG+1+=S-k4S-4dTMq1zfAoJxf{FcJkc49O&taI>vZ%TWQTJgz zUa`SU4l+jYvA?hsoSSLB&Y&f~l{`Ko3@@iT3M24Aax|vlOB%ho5pSx{`6)v5(Oy?Y za75ude^JcOr+`Ir{)~_>1ntj-m@VU}P`KZW3(vwvj(=GFulD`#w@&q`SYJG{;=k4e z(Yol@4p!ZHIkCHfDpqvu0y(ufM{HFjv%bSsyWaN)FYaUtNx+jk#eqJJRvY?!KTIu2 z?$l`MZ`r=H7MJe@@$d)Jp!t2%2t@q z0*}{ei#RAu7qye5DAheJ`OJ(L1AhhPwW8CgZG+ljdsY7!GSV?{~ zd0SGXV;}Xe6)wO0$JxY-E^fGBpQW(TtjF7)*F?#xI-83i(kL&_iuyY66{MqRXIZo} z_nvD_pwj;d9!Dc$^-Lc@Y+#d7Z0g7 ze+6$)vQphw zV<8XxG3lx6*?v$N_h4k!EAw|f%D1`@AXi|<98Q)!^;fEZ+vZAsM3i+bOh+BH#Bghj zh-9Tj;WEQqin0v_WrjW4r-4-3l;1@JxF2gofGZzBII@2lQQ%I{py?ayLyxz7^`dJN za*)CGWRj@eR#H4QuIS~DXCERl`<&*i9GvYpdJIL9P}(-4>)unw&>!;o-U6P^+Hd8uq72F;1(o+{jHzY8Be0xhH{tl7-`tUUtcfu zp>8$1UOzGp;N4z1*XS2B$?c0aQwgw7J%CgDF-$JQtF#x<(ryE&#wSVS4w5Y8(0z23 ztkjdy*=`eZaH)$UzL+pMouw8frm*&h$QaaIm>wA|az73sPy^s2jzcc~2mo1fmZcow zU`{9Pz8H1FIkjF6*a|7N-}Q?J{Gcf|KeraPIGQd76p-(HB>~q+OGg#cPeDc^zJ zACC5y%z4xfO%V%)UA1fv2W4C}iH6RHyzzov`+k#wb@z)Ki}Euym3@p)vUz7Vj>XeRvurVKmB~?)d|}f2 zPGpboB|AeV1OfJ(n(_2w1D{h(LgQ$<>ce z@?7Gs>dMQoF8$wNS@WwsvT>S|P~ZeHEVjvJG$HLM*=XA^kO|g@#0}ZV;LvaB`f61Jq=O%W3;}?`I%r_9m1VL z$)fkkbfXac@1Jo)ABCh>F%6ZyHd`MT{uJe{Z5`5@tiYd+#LG?1#?-HUvYwl?Yu2TN zmno;ak|k08?5l;VKW$|mrc%)nLX2?oni^*r$=u({Wa1_X1x(YDZM>V2czt!nI6~8UWK~Fo@i}cR0vNYng*>r7+sD z^0!C@>U*^_VG!r^Ff8wHl9`37SRrrlJh6M>Xz00Am`f2d^HWne+Abu9!Wpylj0@c>bfyb4L6dF*bdYumsBh2n7=% zaC`s4>!{sRTw1A74()9W3V1{de==8mCubeGiK@`$O1sIu8uy$Rcah?-n}Az&Z+!4+ zHNtpjlXr-$ATpQjT^qW+o0yBY@92_~fS0#-66(+PZ3JA~ccV?Y-(ZuY%K!^noZhiyw>VE!9m1S}AcYO`vM-+NKa0 z>00i1(8xD<1M5R_{#Z#ox?1aZlF70h_Q91QOuJv#At5orDh(;I7HCYl*hL6&cf^_q z5vC?CF5A^Hk}fXj;1LG+n|N07XFzG=!I3 z6z*kL1c>U(DH$Z&llB%qrLyPufs#apei@yrsKnZpsjz_*gL@qW1!sHS!6LRzz^{Lp zs1j7d(4dJ?Qb3VU{W$)d^7&j5gVF@p#Ww5m5kh5F=v=Xt(N$Mi=)jL29ar!x7@ipD zIMtCsofTkmdt_=!4#2%m!6VHxD<>BzOZ2A_R0;EU zlY9GNFGTVfqKJ)wPP za5HAb)e&FkufA)!#;S+&y|feDE*FHG#ghdHhPRa@1^Q7D1B2mvVez$*YiG|FjPr;3vT0Qf^z zRaHf{zPal;CCh&~BgH975$TQ42-AWU%oCs+tnXWCUd{jjKea#Km_fvG7rb=&~Tyn_L81>UZ6&VVzqMYDgnzXxz4Nuuq8rr14956^l}SAp@_O8(oiuGC>`bx*BnI#>MWt1hUe4Po8& zsZ2-YIfGTxMCpDF(#GsS!D-F?U3(nd@?0K+CZwnfeu{SUuAt&i*so(KwL3Q2%;?nQ z7Dg!fik5fN<-pRSGiV_8rrIeddS5}^5otNWTd&R1uej$()GC{!8-i6wao58iH(yKZ zo=;EI)*y|xRdqEGc)l58gZ>IIqqb5JVSEDA>4p9s`3uFaIqB+^SqBQmBMr1?QR40jJiftJ3j8L@K33zKSn`YO^~h;oTnsu5x8RVbd2XdeBx|Miz@u#EIGHQSw?hM1cd8_^GLz>t>Q) zE~R|NZb`o7zu)(|?-f95dAL2f0ju3JTi;*TR2?4fm>uu#zWLB)E5cLrHj-h9rgnO) zdJiKj+jDncugGB)McQ4hx(>5i89fU76c~y6VF$ZW=OBCLYYnbc*v$Nik6Q=J@9S|y z@b?8*O(i`d*3b?>9lb~3n@3Hatp#60WSC~SfiZV5uMXxth?|ak{(g`0u}W`rI2rHn zJFSSYecM#-?dj^8&j~6pIz4>tm)jl>-@11OToF^=iF1tIzytsQ8HKGhumeCB#*?u8 zV1a^SNo)E(A`De>|E~SiUY@^z35KSZ(~_6q1ylg_M_nNcbEc?*g7dbZ+3>oTMBF8% z?&obM-S8nfc)49p%C627ijPJWXU?ULF^6P-2n6I439b9nuex0nA|?@D=8dH*Q%fE(FiNYw3NplNL$l zXd6qumAtxQR_2`6A`|5s)A1YCtO0Nz-L0yD{<3|R`6ezt{m^=A34Xn|S1eFOn|xzh zq$bzP6b>7LN87D7jtp|m!`Gw+F+IQEJLDLX??-@YK?lMll-?BDa#GJp^V*NYOS2d3 z_CMfeT4=GQtxL3PN0f5$z0G~#uzyL*FiNNhl>Kz@6S1HB23DTwt(Kw&W>Dlx;@Xvk zW3a8Tdx5`EE)5-dxbnM9xe%8HJn)w9xVdaC_6F{GZ!K1Zh%&7CgC~Hy%AG>`8n$KZBE#9EOhHY3_HjDLa0s;aY z9BQ;!DB$+!+V)~&Cz*FvP~!FKO!A@ z{5-t++v)v`Kh)RcCEd&D^A2e=SKg~6ltzw|w`clJ#}|#3UA?M>hXQKbS9DfOa(U#Z zr}UPKAoVS^{@C)1K?2Y9l^aJbSS70K%K;o!j|slIw@3XIro)7J&G@Qtl?`wB8vN@z zE*-z|E|SGnHpS$RW6?<1AkuVL_x!+ii`kO9{gWql5 zR6x+EY5C-uuffo=*c?4*;$HnB5?2b?u?`%%>FKFOXIIJ|50IUh!_DiSr(sDVR6&d& zJk5$~!>o=k*+!5vW;mFo+U&=yshghnVydtFfT}S!W9h*oSyNwLK0b5EtcbcccyM`9 z+b-z>7S5b8t3@TM^DVBOJlsarjr09epKyL_;@y0^5oU4-I%&sT`9nt%w?+b9bwZfE zIyQAmJZ`A48+v(lTBcd(J{L?D9^{EbK?C^yc?hKYAbU&f>4r*%40VCjA};9<5Vi zDn$y=6RL=#*>583ezS&{nV4%7YxB`S?bftc2l7q%iSV?vA0THt5IZpW^}TINvYTSc ztZu`F)B3(Ip^Q$g-Ks04=iP;AEj*wxh$aVQGNtO!GB8jUOPg0M4(7WfY@tI`RkI^S zmu%-LgCdT?|JnoA)8KShRdKztN3h**Q5@o#?6TPbGN&VjJUltBqH4LK`0QbMK7ZR! z*9Om6R~E|gx11=by!s@S`lmA6WCZ!k+pH!9>sx6W6-{W1X4#pr{-%4sW@RfT;xUYh zyh~_iEFN@0QSVM@^_`SmXs(En!iN4xWn!R*f9szM>)E-Y*BGjMo?R=OkfzYj#~SL|`q>z9aE&-?c8|KW6GcnfLIOu%t>UlV z?#7!hstyp@1$Id02jNF<&wf<|j4(sp7>IDp1YA}~5PQYnGzzU2f0N<;$~uVE_nT^7 zagfx)?2xgNN|RPu^I!7X_R<@n2OE_1fKq<6Pl|KOP6#kK0|06O?eD`vD=@2u1_1S= zft>(U)%=!rSAdNkzNgOwu##bKwEUyj7y5<8f^GlL&6i}bXI`zvTVty=U8W{M`{LNk z!t3yW*66WSlx90HYV_=YmVBmHqF1K9TNRB>U)fXYZNMaT9m0c5i;(|b^m1KjJ0wm~>s@#*^wN^Vfrx9-B`nvWWt>NR{O7SIH1TPgav=>8arZm#%l%-DU?$AaZS%nQFf_rDAYI6^vbfR)z`?GqCd z#5(#84i1ivEaszYKXFFPi>wcf4z)IH@D`U`XRi3lE)R-yblN8Tsj4*BUnD!?s+M@B zi1*44?9t={`ysSJ8IE4r4hF1V^v3STI^1-&Y2CI>l%d~2=IVpS4~vk;A#Yn~hU$&6 zQ{7wgMn&XN>sCS}I|P7VbG@+k`|z|UzIhy+05|&8huibE7D(ElNvBo{`ANvDm;S%= zM$I~R<7aVK7m#?j&w>5YlQ4xj5%6^V`I`zo5N;;>!L+CS?z%2GY<3G@wXj@b6W3-N ze|A6&wn~Ahu##<#mc3^J$W;c{}MZYdP%uTSuU((dbYZ{+LBRw z?_NA)?>`V1e&E!P;ZkeWB>oaj|7&XR_V#unW@w>ey3(GE$rj=nIerj|P~ey7 zJ-)t|vZ{>1EE7riJ-|$L!zB1*PP9S|*M5n@YbqK*4^S-;Gx=|6?SHD}|13lLa(n1+}JKuqIT{GY&1N;OehRZtbcSn^Hxzgy^6r?Gl@$+r8m@()W$F~IKl99R

    p2!0{mPy0>H{@gLzv@`%a zmjswVTSh7BJn9yDID183Wm+{jx=$&5$Dx|#q9U_=IA>}T~872{d1C-~a zSWK*4yVQb?Qy#*M`T5BWk)xdDadC|2ozr z?HJVrylSb^*>#j7RBh^+&(VQaq7}`xLZo+d;Qp%(_2S;8X~}A8|Il;1a=v(NF}f?n zVVG`?y}<=f)jG-{Yzwj*YmMijq*^pcVP#NJ*W?`My>D|oe|U5+&>H5xe{@P76u)M& zO})MN#Rx$zQ8`#Z%`BNPJ*>K~6x4)a zZkYK?Xg>d;2EX+^d&2{cT0}&d`2BAYkprg6R+G4UJbO3UuGzh=tI|XlL5LcNZ)&;P z$$nRwO3SmvXaz9IMclcr`nWf)&#z-ww?`U{Nie;Ca$pjMc)wk3$z`i!lKZN}TQWWV zCnoo!5twEW`1z992+Wi2m^kKUSWdLV`3F3{KI#r;Y;*~nQNj7$VCoaFzT$%eK^lMT z`XRd)`E=YgxD!=ziqY~ZcR#IR(4%2~`TZMnHfCXY{*})0ew`~iDP7@5Xs!^+ysz81 z%_F2A>a?03|1f6^-X8#p@5}T7X=S%wrAEpP?yx-(h#s@nJ39QPKV>}G>TY`!Vvam0 zS}3-%xj;p))qjgxQLj%+&tbTj7LQfY**o=iz%WR^Sx57@>Y$p*X0n9iaKe3R)ieD@ zO8ov=XGbeRZ#PST?shN+6Usz$(E(#s8apD5?^=wkVQ^m8jsDC3CmQ|-7yr)esxm~RRJqKjs6~JFg*=7MsTKpX**{c=EMJB=#56(?JsYx@|*AP&8s}__{#ILI(F7uLqb!T4`LqguOwEo zG)OpxFsvtAmHAXnf}|!Pb!wN$^7QE92R9t<9xZya%-pa2i+|QFF9x;q|DM%9G-!1- z1{=5)1PI-$vuypCx-)SlaUP!0T!sd68De`e(Nvl@5zU_S(6;t!=nLGCZPNz9QSyU^ z*^DZLw=Ki-OzCOJK6SbwR+I~$#p!dGjLg5}sZrj}xE#>_uB-z_CEtP&pfIQc%3(_e zG%zXr2dMu)hXrHRn@)kNA;Liw0>qADn#ov=E(l1zO}N~z__MXDeW7`IOr79OG~I2K zAbirbC+BuAn$|C4e||hXxD$#WK3#5z0JJs;K8hV!5765GVHOgWHEe!fy(?prf29rg zuOy6Nn!jsp7Q@5~`VHZF-fwY*qaWjl4nJz^7iOZ!by`73G{4Z{aEX)WsAZRR>|SLX zgUTmu#%0>qEsr-f(pgy)Oe;Utdzc`>y;vjA(gzO&0nUP*l4j-rI}6>mk465FK}_w@ zfRR@GACF8mlV8XEwMq2Nm8x$aZUk1b`W2R2CH|#dS+8x!S}Gw{{n#^F=r|NnuY0;1 zuGRI%UlGa}^2hSihj*8ea9HR)8$d1ydosH!&y@3Tnp!!#EfFi0x4DLxDtr?{12ivV z=KxJ9szCxH;RK-8|FNhst+3;^`}W@H@sW#YVcd}^IGyr@ngw?fJ(-;jZdnT&FUDJ4 zD4zvo&Z+JL;^pfY#cTW#(OoC1h1Z7jYvC^$S<>ppbA6ylLq}W!kyD$#OByz#t}>;* zKL_(9bdD|7+!$YZdJh133>S+(b4R3@P`D5^6ZMKR` zFG!F=?}No#XTyn8V4@-mw39oja$y383^aU8rbEtF@=c0S2O}l%r*_+hpyKw1ZmwJd z;iW$YGAvI&nw)9&I}wfhz6GA#%ZA3l4+1D&)8+MbQ;w6n5n&2li=zei6iO$ zZ3>6C0bB+gAo)hp07^M}kWkGTb4x!%1v&h5UX=e|%l;X)|4;!7N)4gJYBf*4hfCCL zKI&*`DHF85NE|lTygLU@6~>x36;)(P{RY~En@_P`i@hcJGIOt0t&H%TqpmQ>JomWX z@;*~w^cJT}hrtw}tuK8J1X!W|JBQ&40IM(z zynt5BGY60-PTHH~5+vPi$pz0dWYfm9+rdG1+pou+o<^_a9rR*H=ZD407qV_9y?c1l z;8qBRqumiwksKnl#&F%UYPvD88v1R?vahFV+pkzWt|?6^ub#$V1VRHWa zakn_~_A63J+N-LXB~^1KCur;>|I+RJXn18_0)nW{=eeYf&bvl}Y6QR9R-n9G3~ORK zMp~KE^3|N8_`|4=owWo_=FGC$jx2teD~v|HH{r8JW*7@+N^ePb2|9J$plXpc6f+ab0(>4ATJ5K@&W zeBd>^Xt~h%xAS{!U#4o5SSsfk+^420N7ddPf_?wxRFezU$D=E|3*iXeA9e`u-`BQl z)wT00#0TOWWC-jI4a!QkV{&q?0C_*X26*AC)#B$<*WAVHl@%71XiZ6O*G@La_n+=N z*nYt>m)B&IUr{namZ$iwKw4ohrx12M$=wao`5fu#%-S@O&QOa{<@+DK!PVB+?Mdpz zY-GOfpFRZ%(wb<*arRZ^@Xr2iG<4PrqmeN^yN6arNZ*oa-TaQ6M^!W1{*H=d`Q78_ z!EQ;W{8~nUqs=PvWCROrOj(bz`3K+G0dv{Ga*m_w9b30y($_9*VVei8p2&2FS8HSY zdi8wd=M>+=nwk=+&c@Xv+E7`M;nhfn0OQX&4D9&pNd<{4M2zJ@)PE$ttCC@Vaa%kqzJJ5km+f@a&Y_o~x%g?JAN#^KPtqdSa3O7=dBi33 z5FD>B*KOXCWIY;+SaHuAC`2->U3se+jzTeCI!ZYhOzgeboKEBAYf4ZMofKZ)Vfq0v z5U+`gkGK!-+EM_6tvf>T#!I%m}HkE{(2 z%J*@c=;>;V^#j$~X7c859l)RXC2`ls;M2cpOjR!-EiCNn2_0JA-nT5Y4Cdv&gUxmb-nrzwHgeO}!EejU012k_^JW``!>8`vA9Wpp z!(d-qD95YBFFVa&`F`sc^pk#J2}!5>PI}-gj;bVAjixRN>~BF4C2iIjF%Gjg@GJV5 z;{x3H!uW-TMjL1=(yfV%ED9aKzXc7Y0MIssCh!-oKfPqZBz%QTz-jO zb7Ly(8?sCI{B50L_^&Eb>yFcoD1RS9Iv@D{ix%sv*1{^Q9Jl#5KNaLut-!89a zzJYz_4K{LBQzBoHNXvbEj|dPy*o*UN$aV&Qr(b}sP9xRAW51Xu05@8fYrMZvM7G<~ zysWQ0@vaGyhdU9}kY#NnS*UG839W}b7884`LM5g&vkDS|s*g&QZj)C|6;|my8!S~? z6Z1m?YNdZa>a1VZ)uu($97ti`2+1#{I)KS3=?7F5`45cxQ(38e+ih@YLqbW z%}n#7p=z@|t$i@#_ijJmUuEdPnYOe88}7i_`SjmDteQpnK+J{f^7>SH@G{rIT#^6!PB$d?0nadkJP^0`Z25Fd6 z;%2X**$`1F0}HWr3@mH|s|a&rF?+;Qb@DHjBXwBW+TO7cLf#UZpVHrexoOqZH|u`} z*21@&_77@n%U3}GtsmG^x_F9ji-7aS1LEEL4hZ!0weU#5nO9*)X8OL_NxHfQPbHf_%R ziR0(+-BrLktRDbw?9h>@)v}?W5eCV{u>jAb56PG zI$@0wHi$|rt#A$RFt;+nx0)S`^5M%G7(jb9skYsCiZ`MWod8EEO%Ii!yRya8 zp2|>EMoHJkdpPKp*&6f^t4>YYhZ(*n0sJf_At6@C;?Y8z(Ez~(>y`r}{q5Mavo-*#DRza#jfbm1ZPS?0@*qJrEL2P-_8izneG;;-3z zCx459p{REe^IoWMr*5cvgAuS~E5N;)v#)Ogu|tB>p&Rqmg>9gBTtq|CkPXnBy6;p( z^)4_-6IYD2Zi17Y43fKMmpr2S*+wZ?mo$lvU%_&e3?VHpO?6DIYU)V2n{FD1Zrcxu zTkV0{*1xa~Gu1}AaxT`M0fXB4os#=`tb4JiD9^9i3YeMdrwV1{@93hOWu)&PbFg8=d1KMHk_kQPtG(~i3$Yh~>ecD2&{UKv;;SgU2nc-QgOJ(H!pjgw ztsq9jHGrvXZul&j81ZJP-v3Lom3onx{4{1z*s}2!wJ5{S0W1@oy@3!$Ck2pu=3rq) zg`v!rpzO!RGrupcgtqX5y=ii;oYuv+^w1ki&2FAlxjWFp-D|nSrhgI*nweLZLl^q2 zV4Aki{`U*4wXK*}{g`7ant^p-8>7~Mf3vvZrhoH*6J_`nn0-ByZWpeBHQsj5MK`PY z?1zx<`4>M=n$glZ#i?T@P{&@;Y!0IP?8tmIz+t_9%_37%!sFSqY4Sw+yPaOl>Y@MhLWzEWac#@)JH@*jdr+KJ zBw>@|fY!{G>{}gi>bNhdTO~9yr^vniOzIg&Wo|?#T2se9hkSn*kdt%zJhP|7I>WM@ zf9E+ha$J_(T}!iv62d7T;{0ni3(O1FsEg?DdMQCiIgm++rI%`+ThzAn*>2`_qN>R2 zC~}UQt`h9wJWkabh)qa*oCdXRA#RBn+qpVX;(D$I-(ObUL4De)F|np2Q}$fOZ*oK_ z_9l{5cmHyiZ4v6h0nc*W}qQ_2E+m!y90ZjJ#hd7yg9egXM7tJx*<{I4m)kg87QR|_Lu`fl*Qb7O>K)bEx zBMiMT+``&aV+V$at3f@9YSS6*<*nwbc|Kuz#yk;~D08!`0cwTUwYZWC7v4J2OZBIf zS>%y$D0%0f^haatN*#7PTfhyj2I$Ts5G4%fy#tHajF;WJcSB4D`m97rwsk%k#d5&^ z>{s+n?KyM0=h5Pb1uQM?GQ>s>VghKLzzEUJmx9}sl@150l<&A?F5jh0NJkSAabc-_ zxbAJ&or?;@o{s0`A!tZ))Ts`F)P^2%P1bxL>wXJu?|cKlOQ7R~_ASbdQj*^e9~VEnnV zE4PY5GSIMMIQK2l0oQ09N(`9#Ik??XWC-j{fN8}V8!l*dooz;^INuXLVNM0&i{K;j zw-Kur*H)hMn;k_Q@4-M?A!w2Jm&pdg(;+aCgBaq*pTd10&^(B6#yt&0AE*b2C{;8} z#_2=oR-ugM1LyOBp5}LXtK%^4(nsdE&*;p|=CO+d`{s|M4rWG#@`{=sw!0%Y3tNox z*YH4gAUb9PmjhB19nbf~CC8VX4=l;O4sUk}xc$gkM%W~VcomtmMJ6-(r0SN5u@@0t zTL%hr6?gPn6l|f20_fJYfWtTbsNDZKqL1mC-yu0{t|pFXzfxy*>l`UDyQ^vEhUW>* zg2lRRZTHs*-HY!W{CYOMsrDBOgJn#B>HEw0Fm#r5jk=Ef~>7zTj zYF81qTucm7D!jRQlLoq66))&{Xm+ureB>G0Vf5aY0U=v7YYJ>e&U7a!d(0%5+0LAh zfBbB1yvStgM%qX~AN%f(7o^V&E2NU;xUA-`)|=Ahp3a;LuW->lm*q)@j+I&lc}L|) zre}>OF$eO?C`0p3&1#AbuXytvXA@%1S_J<9f?_uasXISnSeYneYKyyYhr2fJQxt?< zI<`@@w63FdKhN5lcX0|!5QCbJ8#cH`$L-#?$8TwM^|jt0?nVsDi1W<9@j$0~k)7+5 zc@8)2C0(G;kwHqZ^rygc7dz>!#p7NxLa;6@`nWDt^qcOjSiFZc!eW4+!oOD>soq4N z)?K%mziiko92ykh(Ly9KP^5WiWx;|@@MlcHeCXO6bz3Rg^U)s=szhC%6d#}Ysp_-^OB9UIC-M-P%m08vJZ%NqhiTki-#$86*$!teeh$rSDm zse|7&rt7=xQO$S)f1hcTcQVwZN=e=3v4XTqx~|vSX`Vf_sb~*LKB0OT%2ykoa1<#! zjP+|MnKXT~Fy`hulGQ1`&c5hWefY*J7K=>(n%QWZRJ0!BA-xVm(b~?hi%ys!Qyj%Kh8Jv zse@(TW}zwh*XT~D5dWX_n9S^W;L9e5P@}>4|K|R0*%OMvKQe&~AmRn}^X3fgtgED{ zsB_(4Nz~ii3ikWe;Ur%pBFV8rJf%ChmSH69ZF(Tf7SnFJN(S+X16HTI(D)*L?7=rd zZwt+-ZIk+9$Tsi&4# zkv`|+ALEw~G$mV}z;k|Z7x|S8_1K2_GZiXHhO7ok$nx`n{sT;djS8Heg)i%rQk1_Y zvZ-Q@;G6iS!rm>Jh}@67o(@}4(abdMZ1FTn^gQ~!RyihU;2Pd7#)vI*e??;3_&p_O z6);NVeQTMq*5LpcagmkkpZiGTskDwGZzivwR;bv$<#Vxzm0#ucnJLb$vLtUkJ#rbP zePbdhP5cntz2eOH!zV{CENbYc81GSlWkUoxbNDVUWKQ`Qub#}?>9|eUI;GUOkJN82 zt(u*vIWrOi?Z`*m*Kw3X!y+7eV-Zx^hxaKSUc|4jo*wJvCT$)xMKZoNy&;deSHwRx zf*WXQEIn|hd>i!H?NIXCu}y0+e(u@S40IM^CWg@*GjTP zSql&+<9$quTAu!dO>Ew@%uM!56KJfH@y?QL>G9-g5{z! z;~v_h9gz&bM+@?v(W%m@?ruM8WQ?X-1lla@2D_B+^`hA?E%?jZQJ3#XZ(i@zr#fqV zTsyTxl06-MIkI6#P*BWSHi>k$RFnep$w6OLZ25S+x_MAl!nqxzw;Nc%b$MYby5XdU z_PUE9t9?HT_+~)y-A2yW2f+)mtd9)=F)|J*C97Lr#71bpgS=$>iz{YX5_CD+(^cQT z>6{0997eTm?U!)UhFt#mVOO`N@T?B#(hKAgMS|sPVo+j2K z4s4su6fTXu(#W%v`bkyOL6_C# zc7WfPml-Eo>k<0sZMWdfQ7r2jR?}w(Rc&kRNhfOahvpCzj z&!^iDAGsj4t5Lhf`=lJQ%S{a50IV}`F63a`Z6|(;hc{ivLD`)i|9wM87F*D??t?68 z`E*Bi(zk9=kp1Y5Yysiz8HOLJfFKrzP-@rF&%oo|UiVqJN~H6{9a37DJ8>r~wNKBQ z$8)wv?bxE>H^Zjms&Oz`C}vVqhcwxnn$rQr10m-_d~{upVU7t_;Bi$2P5P3>e)t4M~^ z_2b3sk0fuIFtLj;i}L!=ZeIM&>pc0)&k1H{*ZTcBpP-lDc&`s&i!+c`w{2x&Y&mgE z=_|CVG;ADP_o{%3kdWfN<|N!8W@l$N9E;U06`hqp4ad_aCFk>1AHa;h{Osr@kF`;( zZtmQu5tpn8S6GI@t8ECsII>=~oS)X`qQ>o}O@FIY8DR{LMgI9&=RQhZ$S%;3yq4+! z5`eY#9B7gW1{p@0z(A*B<(>eYHVD20z#0TJ0|IJ-gxG_CLT0s)57cm{V;1nw6TnnYF~9)W{9>&O3pLE>X|Gk~&sW>6 z^CuIoB~Ro9cYuk=o?~mPsZz4|V9M+izi4EDsSB8u=RnBmBvTgVu|%}o2MzBYu%6fK zv?*+=+1u|MP2&r&ARlZk279`69^*=2B6td@Jpl&8%d}19*?F` zLb#cM>&RMB5WEnPGl1OZyC;ta(X6fx>ES`Z*)h(MsmlxJ9bhfcZ$YhoSQvd5#U_18 zBavLo7bqmwcM8@4ZnRXz OKo+LfCi%uL;r|ADy5xfZ diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 92c3514ca6..4f2de5952b 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -1,6 +1,6 @@ --- -title: Implement Microsoft Passport in your organization (Windows 10) -description: You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. +title: Implement Windows Hello in your organization (Windows 10) +description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 keywords: identity, PIN, biometric, Hello ms.prod: w10 @@ -11,39 +11,41 @@ author: jdeckerMS localizationpriority: high --- -# Implement Microsoft Passport in your organization +# Implement Windows Hello for Business in your organization **Applies to** - Windows 10 - Windows 10 Mobile -You can create a Group Policy or mobile device management (MDM) policy that will implement Microsoft Passport on devices running Windows 10. -> **Important:** The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Microsoft Passport for Work** policy settings to manage PINs. +You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. +> **Important:** The Group Policy setting **Turn on PIN sign-in** does not apply to Windows 10. Use **Windows Hello for Business** policy settings to manage PINs.   ## Group Policy settings for Passport -The following table lists the Group Policy settings that you can configure for Passport use in your workplace. These policy settings are available in **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Microsoft Passport for Work**. +The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. + + - + @@ -123,23 +125,23 @@ The following table lists the Group Policy settings that you can configure for P - +
    Policy Options
    Use Microsoft Passport for WorkUse Windows Hello for Business -

    Not configured: Users can provision Passport for Work, which encrypts their domain password.

    -

    Enabled: Device provisions Passport for Work using keys or certificates for all users.

    -

    Disabled: Device does not provision Passport for Work for any user.

    +

    Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

    +

    Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

    +

    Disabled: Device does not provision Windows Hello for Business for any user.

    Use a hardware security device -

    Not configured: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    -

    Enabled: Passport for Work will only be provisioned using TPM.

    -

    Disabled: Passport for Work will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    +

    Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    +

    Enabled: Windows Hello for Business will only be provisioned using TPM.

    +

    Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    Remote PassportPhone Sign-in -

    Use Remote Passport

    +

    Use Phone Sign-in

    Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
     
    -

    Not configured: Remote Passport is disabled.

    +

    Not configured: Phone sign-in is disabled.

    Enabled: Users can use a portable, registered device as a companion device for desktop authentication.

    -

    Disabled: Remote Passport is disabled.

    +

    Disabled: Phone sign-in is disabled.

    ## MDM policy settings for Passport -The following table lists the MDM policy settings that you can configure for Passport use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). +The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](http://go.microsoft.com/fwlink/p/?LinkId=692070). @@ -153,9 +155,9 @@ The following table lists the MDM policy settings that you can configure for Pas @@ -165,8 +167,8 @@ The following table lists the MDM policy settings that you can configure for Pas @@ -177,8 +179,8 @@ The following table lists the MDM policy settings that you can configure for Pas @@ -277,8 +279,8 @@ The following table lists the MDM policy settings that you can configure for Pas
    PolicyDevice True -

    True: Passport will be provisioned for all users on the device.

    -

    False: Users will not be able to provision Passport.

    -
    Note  If Passport is enabled, and then the policy is changed to False, users who previously set up Passport can continue to use it, but will not be able to set up Passport on other devices.
    +

    True: Windows Hello for Business will be provisioned for all users on the device.

    +

    False: Users will not be able to provision Windows Hello for Business.

    +
    Note  If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
     
    Device False -

    True: Passport will only be provisioned using TPM.

    -

    False: Passport will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    +

    True: Windows Hello for Business will only be provisioned using TPM.

    +

    False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

    Device False -

    True: Biometrics can be used as a gesture in place of a PIN for domain logon.

    -

    False: Only a PIN can be used as a gesture for domain logon.

    +

    True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

    +

    False: Only a PIN can be used as a gesture for domain sign-in.

    Device or user False -

    True: Remote Passport is enabled.

    -

    False: Remote Passport is disabled.

    +

    True: Phone sign-in is enabled.

    +

    False: Phone sign-in is disabled.

    @@ -288,7 +290,7 @@ If policy is not configured to explicitly require letters or special characters,   ## Prerequisites -You’ll need this software to set Microsoft Passport policies in your enterprise. +You’ll need this software to set Windows Hello for Business policies in your enterprise. @@ -298,10 +300,10 @@ You’ll need this software to set Microsoft Passport policies in your enterpris - + - - + + @@ -309,14 +311,14 @@ You’ll need this software to set Microsoft Passport policies in your enterpris @@ -329,8 +331,8 @@ You’ll need this software to set Microsoft Passport policies in your enterpris
  • PKI infrastructure
  • @@ -338,20 +340,22 @@ You’ll need this software to set Microsoft Passport policies in your enterpris
  • Azure AD subscription
  • [Azure AD Connect](http://go.microsoft.com/fwlink/p/?LinkId=616792)
  • AD CS with NDES
  • -
  • Configuration Manager (current branch) or Configuration Manager 2016 Technical Preview for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
  • +
  • Configuration Manager for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
  • Microsoft Passport modeWindows Hello for Business mode Azure ADActive Directory (AD) on-premises (available with production release of Windows Server 2016 Technical Preview)Azure AD/AD hybrid (available with production release of Windows Server 2016 Technical Preview)Active Directory (AD) on-premises (available with production release of Windows Server 2016)Azure AD/AD hybrid (available with production release of Windows Server 2016)
    Key-based authentication Azure AD subscription
      -
    • Active Directory Federation Service (AD FS) (Windows Server 2016 Technical Preview)
    • +
    • Active Directory Federation Service (AD FS) (Windows Server 2016)
    • A few Windows Server 2016 Technical Preview domain controllers on-site
    • Microsoft System Center 2012 R2 Configuration Manager SP2
    • Azure AD subscription
    • [Azure AD Connect](http://go.microsoft.com/fwlink/p/?LinkId=616792)
    • -
    • A few Windows Server 2016 Technical Preview domain controllers on-site
    • +
    • A few Windows Server 2016 domain controllers on-site
    • A management solution, such as Configuration Manager, Group Policy, or MDM
    • Active Directory Certificate Services (AD CS) without Network Device Enrollment Service (NDES)
      -
    • ADFS (Windows Server 2016 Technical Preview)
    • -
    • Active Directory Domain Services (AD DS) Windows Server 2016 Technical Preview schema
    • +
    • ADFS (Windows Server 2016)
    • +
    • Active Directory Domain Services (AD DS) Windows Server 2016 schema
    • PKI infrastructure
    • Configuration Manager SP2, Intune, or non-Microsoft MDM solution
      -Configuration Manager and MDM provide the ability to manage Passport policy and to deploy and manage certificates protected by Passport. -Azure AD provides the ability to register devices with your enterprise and to provision Passport for organization accounts. -Active Directory provides the ability to authorize users and devices using keys protected by Passport if domain controllers are running Windows 10 and the Microsoft Passport provisioning service in Windows 10 AD FS. +Configuration Manager and MDM provide the ability to manage Windows Hello for Business policy and to deploy and manage certificates protected by Windows Hello for Business. -## Passport for BYOD +Azure AD provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. -Passport can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Passport PIN for unlocking the device and a separate work PIN for access to work resources. -The work PIN is managed using the same Passport policies that you can use to manage Passport on organization owned devices. The personal PIN is managed separately using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](http://go.microsoft.com/fwlink/p/?LinkID=623244). +Active Directory provides the ability to authorize users and devices using keys protected by Windows Hello for Business if domain controllers are running Windows 10 and the Windows Hello for Business provisioning service in Windows 10 AD FS. + +## Windows Hello for BYOD + +Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and a separate work PIN for access to work resources. +The work PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The personal PIN is managed separately using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](http://go.microsoft.com/fwlink/p/?LinkID=623244). ## Related topics @@ -359,14 +363,17 @@ The work PIN is managed using the same Passport policies that you can use to man [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -[Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) -[Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) -[Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -[Event ID 300 - Passport successfully created](passport-event-300.md) +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md)   \ No newline at end of file diff --git a/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md index 25f0fba560..6099d183c9 100644 --- a/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The following are important factors in the implementation of your Windows Firewall with Advanced Security design plan: diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index 4d81cd0545..ab784f1c9f 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -16,20 +16,20 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | Topic | Description | | - | - | -| [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | -| [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. | -| [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) | Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. | +| [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | +| [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | -| [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. | +| [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) | Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that's requesting the connection. | | [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. | | [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. | | [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. | | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | -| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | +| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | +| [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). |   ## Related topics diff --git a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md index da5029050c..575bf12fee 100644 --- a/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md @@ -23,6 +23,10 @@ Certificates in Windows 10 Mobile are primarily used for the following purposes - To authenticate a user to a reverse proxy server that is used to enable Microsoft Exchange ActiveSync (EAS) for email. - For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site). + +**Warning**   +In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](http://go.microsoft.com/fwlink/p/?LinkId=786764) + ## Install certificates using Microsoft Edge A certificate can be posted on a website and made available to users through a device-accessible URL that they can use to download the certificate. When a user accesses the page and taps the certificate, it opens on the device. The user can inspect the certificate, and if they choose to continue, the certificate is installed on the Windows 10 Mobile device. diff --git a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md index d37d352642..d724b1862d 100644 --- a/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Alerts in Windows Defender ATP indicate possible security breaches on endpoints in your organization. There are three alert severity levels, described in the following table. @@ -41,39 +43,17 @@ Details displayed about the alert include: - When the alert was last observed - Alert description - Recommended actions -- The incident graph +- The potential scope of breach - The indicators that triggered the alert +![A detailed view of an alert when clicked](images/alert-details.png) + Alerts attributed to an adversary or actor display a colored tile with the actor name. Click on the actor's name to see a threat intelligence profile of the actor, including a brief overview of the actor, their interests or targets, tools, tactics, and processes (TTPs) as well as areas where it's active worldwide. You will also see a set of recommended actions to take. Some actor profiles include a link to download a more comprehensive threat intelligence report. -![A detailed view of an alert when clicked](images/alert-details.png) - -## Incident graph -The incident graph provides a visual representation of where an alert was seen, events that triggered the alert, and which other machines are affected by the event. It provides an illustrated alert footprint on the original machine and expands to show the footprint of each alert event on other machines. - -You can click the circles on the incident graph to expand the nodes and view the associated events or files related to the alert. - -## Alert spotlight -The alert spotlight feature helps ease investigations by highlighting alerts related to a specific machine and events. You can highlight an alert and its related events in the machine timeline to increase your focus during an investigation. - -You can click on the machine link from the alert view to see the alerts related to the machine. - - - > [!NOTE] - > This shortcut is not available from the Incident graph machine links. - -Alerts related to the machine are displayed under the **Alerts related to this machine** section. -Clicking on an alert row takes you the to the date in which the alert was flagged on **Machine timeline**. This eliminates the need to manually filter and drag the machine timeline marker to when the alert was seen on that machine. - -You can also choose to highlight an alert from the **Alerts related to this machine** or from the **Machine timeline** section to see the correlation between the alert and other events that occurred on the machine. Right-click on any alert from either section and select **Mark related events**. This highlights alerts and events that are related and helps differentiate between the other alerts listed in the timeline. Highlighted events are displayed in all filtering modes whether you choose to view the timeline by **Detections**, **Behaviours**, or **Verbose**. - -You can also remove the highlight by right-clicking a highlighted alert and selecting **Unmark related events**. - - ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md index 50e1c02405..fd75059fff 100644 --- a/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md @@ -13,9 +13,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. You can see information from the following sections in the URL view: diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index a7f48785a0..5dfb3959f9 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -13,9 +13,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. You can get information from the following sections in the file view: @@ -60,13 +62,11 @@ Use the deep analysis feature to investigate the details of any file, usually du In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis. -> [!NOTE] -> Only files from Windows 10 can be automatically collected. +> **Note**  Only files from Windows 10 can be automatically collected. You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available. -> [!NOTE] -> Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. +> **Note**  Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP. When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications. @@ -84,8 +84,7 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. -> [!NOTE] -> Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. +> **Note**  Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. ## View deep analysis report @@ -122,11 +121,10 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -5. Change the organizational unit through the Group Policy. For more information, see [Configure with Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). +5. Change the organizational unit through the Group Policy. See [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). -> [!NOTE] -> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. +> **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. ### Related topics - [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md index 8a803eb355..e1427b0400 100644 --- a/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md @@ -13,9 +13,12 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + + Examine possible communication between your machines and external internet protocol (IP) addresses. Identifying all machines in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected machines. @@ -40,8 +43,7 @@ The **Communication with IP in organization** section provides a chronological v Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address. -> [!NOTE] -> Search results will only be returned for IP addresses observed in communication with machines in the organization. +> **Note**  Search results will only be returned for IP addresses observed in communication with machines in the organization. Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed. diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 22271072f0..0a7f63c71b 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, and the number of active malware detections. This view allows you to identify machines with the highest risk at a glance, and keep track of all the machines that are reporting telemetry in your network. Use the Machines view in these two main scenarios: @@ -35,8 +37,7 @@ The Machines view contains the following columns: - **Active Alerts** - the number of alerts reported by the machine by severity - **Active malware detections** - the number of active malware detections reported by the machine -> [!NOTE] -> The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. Click any column header to sort the view in ascending or descending order. @@ -54,8 +55,7 @@ You can filter the view by the following time periods: - 30 days - 6 months -> [!NOTE] -> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. +> **Note**  When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period. The threat category filter lets you filter the view by the following categories: @@ -65,7 +65,7 @@ The threat category filter lets you filter the view by the following categories: - Threat - Low severity -For more information on the description of each category see, [Investigate machines with active alerts](dashboard-windows-defender-advanced-threat-protection.md#investigate-machines-with-active-malware-detections). +See the [Investigate machines with active alerts](dashboard-windows-defender-advanced-threat-protection.md#investigate-machines-with-active-malware-detections) topic for a description of each category. You can also download a full list of all the machines in your organization, in CSV format. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) to download the entire list as a CSV file. @@ -100,8 +100,6 @@ You'll see an aggregated view of alerts, a short description of the alert, detai This feature also enables you to selectively drill down into a behavior or event that occurred within a given time period. You can view the temporal sequence of events that occurred on a machine over a specified time period. -You can also use the [Alerts spotlight](investigate-alerts-windows-defender-advanced-threat-protection.md#alerts-spotlight) feature to see the correlation between alerts and events on a specific machine. - ![The timeline shows an interactive history of the alerts seen on a machine](images/timeline.png) Use the search bar to look for specific alerts or files associated with the machine. diff --git a/windows/keep-secure/isolated-domain-gpos.md b/windows/keep-secure/isolated-domain-gpos.md index b7f6c3b921..745da6642b 100644 --- a/windows/keep-secure/isolated-domain-gpos.md +++ b/windows/keep-secure/isolated-domain-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 All of the devices in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section. diff --git a/windows/keep-secure/isolated-domain.md b/windows/keep-secure/isolated-domain.md index 3d23484bf9..43e1461c41 100644 --- a/windows/keep-secure/isolated-domain.md +++ b/windows/keep-secure/isolated-domain.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The isolated domain is the primary zone for trusted devices. The devices in this zone use connection security and firewall rules to control the communications that can be sent between devices in the zone. diff --git a/windows/keep-secure/isolating-apps-on-your-network.md b/windows/keep-secure/isolating-apps-on-your-network.md index 09367196c5..c8adf77620 100644 --- a/windows/keep-secure/isolating-apps-on-your-network.md +++ b/windows/keep-secure/isolating-apps-on-your-network.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you add new devices to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Windows Store apps that run on them. Developers who build Windows Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. diff --git a/windows/keep-secure/link-the-gpo-to-the-domain.md b/windows/keep-secure/link-the-gpo-to-the-domain.md index ab224211e6..ba14d60b0e 100644 --- a/windows/keep-secure/link-the-gpo-to-the-domain.md +++ b/windows/keep-secure/link-the-gpo-to-the-domain.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target devices. diff --git a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md index 288f3da357..718b2e22ce 100644 --- a/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md @@ -14,12 +14,14 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Windows Defender ATP notifies you of detected, possible attacks or breaches through alerts. A summary of new alerts is displayed in the **Dashboard**, and you can access all alerts in the **Alerts queue** menu. -For more information on how to investigate alerts see, [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts). +See the [Investigate Windows Defender ATP alerts](investigate-alerts-windows-defender-advanced-threat-protection.md#investigate-windows-defender-advanced-threat-protection-alerts) topic for more details on how to investigate alerts. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the top of the alert to access the Manage Alert menu and manage alerts. @@ -84,8 +86,7 @@ The context of the rule lets you tailor the queue to ensure that only alerts you 1. Click the **Manage Alert** menu icon ![The menu icon looks like three periods stacked on top of each other](images/menu-icon.png) on the heading of an existing alert. 2. Choose the context for suppressing the alert. -> [!NOTE] -> You cannot create a custom or blank suppression rule. You must start from an existing alert. +> **Note**  You cannot create a custom or blank suppression rule. You must start from an existing alert. **See the list of suppression rules:** @@ -94,8 +95,7 @@ The context of the rule lets you tailor the queue to ensure that only alerts you ![Click the settings icon and then Suppression rules to create and modify rules](images/suppression-rules.png) -> [!NOTE] -> You can also click **See rules** in the confirmation window that appears when you suppress an alert. +> **Note**  You can also click **See rules** in the confirmation window that appears when you suppress an alert. The list of suppression rules shows all the rules that users in your organization have created. Each rule shows: diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index bb867e4dc0..c55903536b 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -1,8 +1,8 @@ --- -title: Manage identity verification using Microsoft Passport (Windows 10) -description: In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. +title: Manage identity verification using Windows Hello for Business (Windows 10) +description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E -keywords: identity, PIN, biometric, Hello +keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,65 +10,79 @@ ms.pagetype: security, mobile author: jdeckerMS localizationpriority: high --- -# Manage identity verification using Microsoft Passport +# Manage identity verification using Windows Hello for Business **Applies to** - Windows 10 - Windows 10 Mobile -In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. +In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. -Passport addresses the following problems with passwords: +> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. + +Hello addresses the following problems with passwords: - Passwords can be difficult to remember, and users often reuse passwords on multiple sites. - Server breaches can expose symmetric network credentials. - Passwords can be subject to [replay attacks](http://go.microsoft.com/fwlink/p/?LinkId=615673). - Users can inadvertently expose their passwords due to [phishing attacks](http://go.microsoft.com/fwlink/p/?LinkId=615674). -Passport lets users authenticate to: +Hello lets users authenticate to: - a Microsoft account. - an Active Directory account. - a Microsoft Azure Active Directory (AD) account. - Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](http://go.microsoft.com/fwlink/p/?LinkId=533889) authentication -After an initial two-step verification of the user during Passport enrollment, Passport is set up on the user's device and the user is asked to set a gesture, which can be Windows Hello or a PIN. The user provides the gesture to verify their identity. Windows then uses Passport to authenticate users and help them to access protected resources and services. +After an initial two-step verification of the user during enrollment, Hello is set up on the user's device and the user is asked to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Hello to authenticate users and help them to access protected resources and services. -As an administrator in an enterprise or educational organization, you can create policies to manage Passport use on Windows 10-based devices that connect to your organization. +As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. -## Benefits of Microsoft Passport + + + +## The difference between Windows Hello and Windows Hello for Business + +- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by key-based or certificate-based authentication. + +- Windows Hello for Business, which is configured by Group Policy or MDM policy, uses key-based or certificate-based authentication. + +## Benefits of Windows Hello Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. + You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. -In Windows 10, Passport replaces passwords. The Passport provisioning process creates two cryptographic keys bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Passport enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Passport keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Passport keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Passport key is created in software. +In Windows 10, Hello replaces passwords. The Hello provisioning process creates two cryptographic keys bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. -![how authentication works in microsoft passport](images/authflow.png) +![how authentication works in windows hello](images/authflow.png) Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. -Passport helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Passport credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of TPMs. +Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are generated within isolated environments of TPMs. + +Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. -Microsoft Passport also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft Passport on the user’s Windows 10 Mobile device. Because users carry their phone with them, Microsoft Passport makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. > **Note:**  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. -  -## How Microsoft Passport works: key points -- Passport credentials are based on certificate or asymmetrical key pair. Passport credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. -- Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Microsoft Passport's public key to a user account during the registration step. +  +## How Windows Hello for Business works: key points + +- Hello credentials are based on certificate or asymmetrical key pair. Hello credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. +- Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Hello's public key to a user account during the registration step. - Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. -- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Passport gesture does not roam between devices and is not shared with the server; it is stored locally on a device. +- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Hello gesture does not roam between devices and is not shared with the server; it is stored locally on a device. - Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. -- PIN entry and Hello both trigger Windows 10 to verify the user's identity and authenticate using Passport keys or certificates. -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use separate containers for keys. Non-Microsoft identity providers can generate keys for their users in the same container as the Microsoft account; however, all keys are separated by identity providers' domains to help ensure user privacy. -- Certificates are added to the Passport container and are protected by the Passport gesture. +- PIN entry and biometric gesture both trigger Windows 10 to verify the user's identity and authenticate using Hello keys or certificates. +- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. +- Certificates are added to the Hello container and are protected by the Hello gesture. - Windows Update behavior: After a reboot is required by Windows Update, the last interactive user is automatically signed on without any user gesture and the session is locked so the user's lock screen apps can run. ## Comparing key-based and certificate-based authentication -Passport can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Passport. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Passport. +Windows Hello for Business can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Hello. Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. -EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Passport keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. +EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Hello keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. -When identity providers such as Active Directory or Azure AD enroll a certificate in Passport, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. +When identity providers such as Active Directory or Azure AD enroll a certificate in Hello, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. ## Learn more @@ -90,15 +104,19 @@ When identity providers such as Active Directory or Azure AD enroll a certificat ## Related topics -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) -[Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) -[Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -[Event ID 300 - Passport successfully created](passport-event-300.md) -  \ No newline at end of file +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +  diff --git a/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md index 3187e17371..49dc1620f6 100644 --- a/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ b/windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you finish reviewing the existing Windows Firewall with Advanced Security deployment goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 057efc5773..dd002d75b8 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -1,6 +1,6 @@ --- -title: Microsoft Passport and password changes (Windows 10) -description: When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. +title: Windows Hello and password changes (Windows 10) +description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 ms.prod: w10 ms.mktglfcycl: deploy @@ -15,17 +15,17 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -When you set up Microsoft Passport, the PIN or biometric (Windows Hello) gesture that you use is specific to that device. You can set up Passport for the same account on multiple devices. If the PIN or biometric is configured as part of a Microsoft Passport for Work, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Microsoft Passport for Work is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Passport. +When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello. ## Example Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. -Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Passport on **Device A** knows will be outdated. -> **Note:**  This example also applies to an Active Directory account when [Passport for Work is not implemented](implement-microsoft-passport-in-your-organization.md). +Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Hello on **Device A** knows will be outdated. +> **Note:**  This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md).   -## How to update Passport after you change your password on another device +## How to update Hello after you change your password on another device 1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** 2. Click **OK.** @@ -36,16 +36,19 @@ Suppose instead that you sign in on **Device B** and change your password for yo ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) -[Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) -[Event ID 300 - Passport successfully created](passport-event-300.md) +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md)   \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 224caa847c..e99c7d38aa 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -1,6 +1,6 @@ --- -title: Microsoft Passport errors during PIN creation (Windows 10) -description: When you set up Microsoft Passport in Windows 10, you may get an error during the Create a work PIN step. +title: Windows Hello errors during PIN creation (Windows 10) +description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 keywords: PIN, error, create a work PIN ms.prod: w10 @@ -11,13 +11,13 @@ author: jdeckerMS localizationpriority: high --- -# Microsoft Passport errors during PIN creation +# Windows Hello errors during PIN creation **Applies to** - Windows 10 - Windows 10 Mobile -When you set up Microsoft Passport in Windows 10, you may get an error during the **Create a work PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. +When you set up Windows Hello in Windows 10, you may get an error during the **Create a work PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. ## Where is the error code? @@ -222,14 +222,18 @@ For errors listed in this table, contact Microsoft Support for assistance. ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) -[Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) -[Event ID 300 - Passport successfully created](passport-event-300.md) +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index b78b6f94f7..45548bb40f 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -101,7 +101,7 @@ Microsoft Passport offers four significant advantages over the current state of **It’s flexible** Microsoft Passport offers unprecedented flexibility. Although the format and use of reusable passwords are fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with both biometric identifiers and PINs, so users’ credentials are protected even on devices that don’t support biometrics. Users can even use their phone to release their credentials instead of a PIN or biometric gesture on the main device. Microsoft Passport seamlessly takes advantage of the hardware of the devices in use; as users upgrade to newer devices, Microsoft Passport is ready to use them, and organizations can upgrade existing devices by adding biometric sensors where appropriate. -Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 Technical Preview domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). +Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). **It’s standardized** diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 33d9bd1f92..1bc9344b78 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: iaanw **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + There are some minimum requirements for onboarding your network and endpoints. ## Minimum requirements @@ -33,77 +35,12 @@ When you run the onboarding wizard for the first time, you must choose where you - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements -The Windows Defender ATP agent only supports Windows 10, version 1607. +Endpoints on your network must be running Windows 10 Insider Preview Build 14332 or later. The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows 10 Insider Preview Build 14332 or later. -Endpoints on your network must be running Windows 10, version 1607. +> **Note**  Endpoints that are running Windows Server and mobile versions of Windows are not supported. -The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows 10, version 1607. - - -> [!NOTE] -> Endpoints that are running Windows Server and mobile versions of Windows are not supported. - -#### Internet connectivity -Internet connectivity on endpoints is also required. - -The daily bandwidth utilization on each endpoint is 5MB. The network bandwidth utilization requires ________ (ALON, PLEASE PROVIDE MISSING INFO). - -For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) . +Internet connectivity on endpoints is also required. See [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) for additional proxy configuration settings. Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10, but if it has been disabled you can turn it on by following the instructions in the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. -### Telemetry and diagnostics settings -You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization. -By default, this service is enabled, but it's good practice to check to ensure that you'll get telemetry from them. -**Use the command line to check the Windows 10 telemetry and diagnostics service startup type**: - -1. Open an elevated command-line prompt on the endpoint: - - a. Go to **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc qc diagtrack - ``` - -If the service is enabled, then the result should look like the following screenshot: - -![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. - - - -**Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Go to **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc config diagtrack start=auto - ``` - -3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: - - ```text - sc qc diagtrack - ``` - -## Windows Defender signature updates are configured -The Windows Defender ATP agent depends on Windows Defender’s ability to scan files and provide information about them. If Windows Defender is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender in Windows 10](windows-defender-in-windows-10.md). - -When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](windows-defender-in-windows-10.md# compatibility-with-windows-defender-advanced-threat-protection). - -## Windows Defender Early Launch AntiMalware (ELAM) driver is enabled -If you're running Windows Defender as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard. - -If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender ELAM driver is enabled. For more information on how to validate and enable the Windows Defender ELAM driver see, [Ensure the Windows Defender ELAM driver is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-windows-defender-elam-driver-is-enabled). diff --git a/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md index 95ab7cda01..d2ed73907e 100644 --- a/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md +++ b/windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain. diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index ea397b440d..942dfa02ee 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -14,11 +14,12 @@ author: iaanw **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) -You need to onboard to Windows Defender ATP before you can use the service. +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] +You need to onboard to Windows Defender ATP before you can use the service. ## In this section Topic | Description diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md index f29f5afbb7..420518e4ca 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Procedures in this guide that refer to GPOs for earlier versions of the Windows operating system instruct you to work with the IP Security Policy section in the Group Policy Management Console (GPMC). diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md index e179647bac..bbecb7b8ad 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Most of the procedures in this guide instruct you to use Group Policy settings for Windows Firewall with Advanced Security. diff --git a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md index 2d848ec539..9712af0076 100644 --- a/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md +++ b/windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To open a GPO to Windows Firewall diff --git a/windows/keep-secure/open-windows-firewall-with-advanced-security.md b/windows/keep-secure/open-windows-firewall-with-advanced-security.md index cda993d4ad..8f20a73c1c 100644 --- a/windows/keep-secure/open-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/open-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This procedure shows you how to open the Windows Firewall with Advanced Security console. diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 3350d1f5bf..3609eec53d 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -1,6 +1,6 @@ --- -title: Event ID 300 - Passport successfully created (Windows 10) -description: This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). +title: Event ID 300 - Windows Hello successfully created (Windows 10) +description: This event is created when a Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 keywords: ngc ms.prod: w10 @@ -11,13 +11,13 @@ author: jdeckerMS localizationpriority: high --- -# Event ID 300 - Passport successfully created +# Event ID 300 - Windows Hello successfully created **Applies to** - Windows 10 - Windows 10 Mobile -This event is created when a Microsoft Passport for Enterprise is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. +This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. ## Event details | | | @@ -35,9 +35,20 @@ This is a normal condition. No further action is required. ## Related topics -- [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) -- [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) -- [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -- [Prepare people to use Microsoft Passport](prepare-people-to-use-microsoft-passport.md) -- [Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) -- [Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) +[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) diff --git a/windows/keep-secure/planning-certificate-based-authentication.md b/windows/keep-secure/planning-certificate-based-authentication.md index 69e599b812..ab5b21c69b 100644 --- a/windows/keep-secure/planning-certificate-based-authentication.md +++ b/windows/keep-secure/planning-certificate-based-authentication.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Sometimes a device cannot join an Active Directory domain, and therefore cannot use Kerberos V5 authentication with domain credentials. However, the device can still participate in the isolated domain by using certificate-based authentication. diff --git a/windows/keep-secure/planning-domain-isolation-zones.md b/windows/keep-secure/planning-domain-isolation-zones.md index 208265eefb..a18fb27051 100644 --- a/windows/keep-secure/planning-domain-isolation-zones.md +++ b/windows/keep-secure/planning-domain-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have the required information about your network, Active Directory, and client and server devices, you can use that information to make decisions about the isolation zones you want to use in your environment. diff --git a/windows/keep-secure/planning-gpo-deployment.md b/windows/keep-secure/planning-gpo-deployment.md index 050a5550f7..abdff4b8ca 100644 --- a/windows/keep-secure/planning-gpo-deployment.md +++ b/windows/keep-secure/planning-gpo-deployment.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can control which GPOs are applied to devices in Active Directory in a combination of three ways: diff --git a/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md index fff34a12c7..0718187682 100644 --- a/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md +++ b/windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have decided on the best logical design of your isolation environment for the network and device security requirements, you can start the implementation plan. diff --git a/windows/keep-secure/planning-isolation-groups-for-the-zones.md b/windows/keep-secure/planning-isolation-groups-for-the-zones.md index b4f667a50b..0c4488940a 100644 --- a/windows/keep-secure/planning-isolation-groups-for-the-zones.md +++ b/windows/keep-secure/planning-isolation-groups-for-the-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group which represents that zone. diff --git a/windows/keep-secure/planning-network-access-groups.md b/windows/keep-secure/planning-network-access-groups.md index 4d9b002e7c..929c583624 100644 --- a/windows/keep-secure/planning-network-access-groups.md +++ b/windows/keep-secure/planning-network-access-groups.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 A network access group (NAG) is used to identify users and devices that have permission to access an isolated server. The server is configured with firewall rules that allow only network connections that are authenticated as originating from a device, and optionally a user, whose accounts are members of its NAG. A member of the isolated domain can belong to as many NAGs as required. diff --git a/windows/keep-secure/planning-server-isolation-zones.md b/windows/keep-secure/planning-server-isolation-zones.md index 12688b93c9..9995c0e5fc 100644 --- a/windows/keep-secure/planning-server-isolation-zones.md +++ b/windows/keep-secure/planning-server-isolation-zones.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Sometimes a server hosts data that is sensitive. If your servers host data that must not be compromised, you have several options to help protect that data. One was already addressed: adding the server to the encryption zone. Membership in that zone prevents the server from being accessed by any devices that are outside the isolated domain, and encrypts all network connections to server. diff --git a/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md b/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md index 4fcbd977dc..fdcf972088 100644 --- a/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md +++ b/windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have identified your requirements, and have the information about the network layout and devices available, you can begin to design the GPO settings and rules that will enable you to enforce your requirements on the devices. diff --git a/windows/keep-secure/planning-the-gpos.md b/windows/keep-secure/planning-the-gpos.md index b22f0497cd..84b3750822 100644 --- a/windows/keep-secure/planning-the-gpos.md +++ b/windows/keep-secure/planning-the-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 When you plan the GPOs for your different isolation zones, you must complete the layout of the required zones and their mappings to the groups that link the devices to the zones. diff --git a/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md index 1801d2a86a..8423e4b94f 100644 --- a/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you collect information about your environment and decide on a design by following the guidance in the [Windows Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md), you can begin to plan the deployment of your design. With the completed design and the information in this topic, you can determine which tasks to perform to deploy Windows Firewall with Advanced Security in your organization. diff --git a/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md b/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md index c800eca94d..736612379f 100644 --- a/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md +++ b/windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. diff --git a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md index b2b3c5c437..6363ce613d 100644 --- a/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md @@ -14,9 +14,12 @@ author: DulceMV **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + + Enterprise security teams can use the Windows Defender ATP portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. You can use the [Windows Defender ATP portal](https://securitycenter.windows.com/) to: @@ -34,20 +37,19 @@ When you open the portal, you’ll see the main areas of the application: ![Windows Defender Advanced Threat Protection portal](images/portal-image.png) -> [!NOTE] -> Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. +> **Note**  Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section. Area | Description :---|:--- (1) Settings | Provides access to configuration settings such as time zone, alert suppression rules, and license information. -(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Enpoint Management**. +(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Preferences setup**, and **Endpoint Management**. **Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. **Machines view**| Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. -**Preferences setup**| Shows the settings you selected and lets you update your industry preferences and retention policy period. -**Enpoint Management**| Allows you to download the onboarding configuration package. +**Preferences setup**| Shows the settings you selected and lets you update your industry preferences and retention policy period. +**Endpoint Management**| Allows you to download the onboarding configuration package. (3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. (4) Search | Search for machines, files, external IP Addresses, or domains across endpoints. The drop-down combo box allows you to select the entity type. diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index d6fbfbe19d..154996d6b6 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -1,6 +1,6 @@ --- -title: Prepare people to use Microsoft Passport (Windows 10) -description: When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization. +title: Prepare people to use Windows Hello (Windows 10) +description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization. ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B keywords: identity, PIN, biometric, Hello ms.prod: w10 @@ -11,19 +11,19 @@ author: jdeckerMS localizationpriority: high --- -# Prepare people to use Microsoft Passport +# Prepare people to use Windows Hello **Applies to** - Windows 10 - Windows 10 Mobile -When you set a policy to require Microsoft Passport in the workplace, you will want to prepare people in your organization by explaining how to use Passport. +When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization by explaining how to use Hello. -After enrollment in Passport, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. +After enrollment in Hello, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. -Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Passport. +Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Hello. -People who are currently using virtual smart cards for authentication can use their virtual smart card to verify their identity when they set up Passport. +People who are currently using virtual smart cards for authentication can use their virtual smart card to verify their identity when they set up Hello. ## On devices owned by the organization @@ -37,19 +37,17 @@ Next, they select a way to connect. Tell the people in your enterprise which opt They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a work PIN** screen displays any complexity requirements that you have set, such as minimum length. -After Passport is set up, people use their PIN to unlock the device, and that will automatically log them on. +After Hello is set up, people use their PIN to unlock the device, and that will automatically log them on. ## On personal devices People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. (This work account gesture doesn't affect the device unlock PIN.) -Assure people that their work credentials and personal credentials are stored in separate containers; the enterprise has no access to their personal credentials. - People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. ## Using Windows Hello and biometrics -If your policy allows it, people can add Windows Hello to their Passport. Windows Hello can be fingerprint, iris, and facial recognition, and is available to users only if the hardware supports it. +If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. ![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) @@ -59,6 +57,7 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows > [!NOTE] > Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. +   **Prerequisites:** @@ -71,6 +70,7 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows - The VPN configuration profile must use certificate-based authentication. **Pair the PC and phone** + 1. On the PC, go to **Settings** > **Devices** > **Bluetooth**. Tap the name of the phone and then tap **Pair** to begin pairing. ![bluetooth pairing](images/btpair.png) @@ -80,13 +80,13 @@ If your enterprise enables phone sign-in, users can pair a phone running Windows ![bluetooth pairing passcode](images/bt-passcode.png) 3. On the PC, tap **Yes**. + **Sign in to PC using the phone** 1. Open the **Microsoft Authenticator** app, choose your account, and tap the name of the PC to sign in to. > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. ![select a device](images/phone-signin-device-select.png) -   2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. @@ -96,14 +96,20 @@ You simply connect to VPN as you normally would. If the phone's certificates are ## Related topics -[Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -[Microsoft Passport and password changes](microsoft-passport-and-password-changes.md) +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -[Microsoft Passport errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -[Event ID 300 - Passport successfully created](passport-event-300.md) diff --git a/windows/keep-secure/procedures-used-in-this-guide.md b/windows/keep-secure/procedures-used-in-this-guide.md index d19699b94b..7374820ed8 100644 --- a/windows/keep-secure/procedures-used-in-this-guide.md +++ b/windows/keep-secure/procedures-used-in-this-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The procedures in this section appear in the checklists found earlier in this document. They should be used only in the context of the checklists in which they appear. They are presented here in alphabetical order. diff --git a/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md b/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md index a24379dacf..f4134b9ce9 100644 --- a/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md +++ b/windows/keep-secure/protect-devices-from-unwanted-network-traffic.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall cannot protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable device are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats. diff --git a/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md b/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md index 890eaf1d99..42da77aa05 100644 --- a/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The use of authentication in the previously described goal ([Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) enables a device in the isolated domain to block traffic from untrusted devices. However, it does not prevent an untrusted device from eavesdropping on the network traffic shared between two trusted devices, because by default network packets are not encrypted. diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 9db41d44f1..d9f6804c8a 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -32,9 +32,7 @@ For example, hardware that includes CPU virtualization extensions and SLAT will You can deploy Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. -The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. - - +The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > **Notes** > - To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). @@ -51,20 +49,39 @@ The following tables provide more information about the hardware, firmware, and | Software: **HVCI compatible drivers** | **Requirements**: See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).

    **Security benefits**: [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. | | Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT

    **Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. | - - -> **Important**  The preceding table lists requirements for baseline protections. The following table lists requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide. +> **Important**  The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide. ## Device Guard requirements for improved security The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. -### 2015 Additional Qualification Requirements for Device Guard (Windows 10, version 1507 and Windows 10, version 1511) +### 2015 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) | Protections for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| | Firmware: **Securing Boot Configuration and Management** | **Requirements**:
    - BIOS password or stronger authentication must be supported.
    - In the BIOS configuration, BIOS authentication must be set.
    - There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
    - In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

    **Security benefits**:
    - BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
    - Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | +
    + +### 2016 Additional Qualification Requirements for Device Guard (starting with Windows 10, version 1607, and Windows Server 2016) + +> **Important**  The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Device Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. + +| Protections for Improved Security - requirement | Description | +|---------------------------------------------|----------------------------------------------------| +| Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
    Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
    - The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).

    **Security benefits**:
    - Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
    - HSTI provides additional security assurance for correctly secured silicon and platform. | +| Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.

    **Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
    - Required BIOS capabilities: Ability of OEM to add ISV, OEM, or Enterprise Certificate in Secure Boot DB at manufacturing time.
    - Required configurations: Microsoft UEFI CA must be removed from Secure Boot DB. Support for 3rd-party UEFI modules is permitted but should leverage ISV-provided certificates or OEM certificate for the specific UEFI software.

    **Security benefits**:
    - Enterprises can choose to allow proprietary EFI drivers/applications to run.
    - Removing Microsoft UEFI CA from Secure Boot DB provides full control to enterprises over software that runs before the operating system boots. | + +
    + +### 2017 Additional Qualification Requirements for Device Guard (announced as options for future Windows operating systems for 2017) + +| Protections for Improved Security - requirement | Description | +|---------------------------------------------|----------------------------------------------------| +| Firmware: **UEFI NX Protections** | **Requirements**:
    - All UEFI memory that is marked executable must be read only. Memory marked writable must not be executable.

    UEFI Runtime Services:
    - Must implement the UEFI 2.6 EFI_MEMORY_ATTRIBUTES_TABLE. The entire UEFI runtime must be described by this table.
    - All entries must include attributes EFI_MEMORY_RO, EFI_MEMORY_XP, or both.
    - No entries may be left with neither of the above attributes, indicating memory that is both executable and writable. Memory MUST be either readable and executable OR writeable and non-executable.

    **Security benefits**:
    - Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
    - Reduces attack surface to VBS from system firmware. | +| Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

    **Security benefits**:
    - Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
    - Reduces attack surface to VBS from system firmware.
    - Blocks additional security attacks against SMM. | + ## Device Guard deployment in different scenarios: types of devices Typically, deployment of Device Guard happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying Device Guard in your organization. diff --git a/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md b/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md index 049625343b..fa2225b9c4 100644 --- a/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Domain isolation (as described in the previous goal [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) prevents devices that are members of the isolated domain from accepting network traffic from untrusted devices. However, some devices on the network might host sensitive data that must be additionally restricted to only those users and computers that have a business requirement to access the data. diff --git a/windows/keep-secure/restrict-access-to-only-trusted-devices.md b/windows/keep-secure/restrict-access-to-only-trusted-devices.md index d2b47a2dbe..dc34b9ac84 100644 --- a/windows/keep-secure/restrict-access-to-only-trusted-devices.md +++ b/windows/keep-secure/restrict-access-to-only-trusted-devices.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Your organizational network likely has a connection to the Internet. You also likely have partners, vendors, or contractors who attach devices that are not owned by your organization to your network. Because you do not manage those devices, you cannot trust them to be free of malicious software, maintained with the latest security updates, or in any way in compliance with your organization's security policies. These untrustworthy devices both on and outside of your physical network must not be permitted to access your organization's devices except where it is truly required. diff --git a/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md b/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md index 85d7267abb..57d1bc1e9d 100644 --- a/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md +++ b/windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have configured the IPsec connection security rules that force client devices to authenticate their connections to the isolated server, you must configure the rules that restrict access to only those devices or users who have been identified through the authentication process as members of the isolated server’s access group. diff --git a/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md index fa9c66bfb4..e3cd578183 100644 --- a/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 IKEv2 offers the following: diff --git a/windows/keep-secure/security-considerations-for-applocker.md b/windows/keep-secure/security-considerations-for-applocker.md index f7c0df0eab..c959f1bfd0 100644 --- a/windows/keep-secure/security-considerations-for-applocker.md +++ b/windows/keep-secure/security-considerations-for-applocker.md @@ -40,6 +40,8 @@ AppLocker can only control VBScript, JScript, .bat files, .cmd files, and Window AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules. >**Note:**  Two flags that illustrate this condition are `SANDBOX_INERT`, which can be passed to `CreateRestrictedToken`, and `LOAD_IGNORE_CODE_AUTHZ_LEVEL`, which can be passed to `LoadLibraryEx`. Both of these flags signal AppLocker to circumvent the rules and allow a child .exe or .dll to be loaded. + +You can block the Windows Subsystem for Linux by blocking LxssManager.dll.   ## Related topics diff --git a/windows/keep-secure/server-isolation-gpos.md b/windows/keep-secure/server-isolation-gpos.md index 149730d1a5..e0075d930f 100644 --- a/windows/keep-secure/server-isolation-gpos.md +++ b/windows/keep-secure/server-isolation-gpos.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The Woodgrove Bank example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. Woodgrove Bank copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. diff --git a/windows/keep-secure/server-isolation-policy-design-example.md b/windows/keep-secure/server-isolation-policy-design-example.md index 4d38ed4c99..f6ddc73bf4 100644 --- a/windows/keep-secure/server-isolation-policy-design-example.md +++ b/windows/keep-secure/server-isolation-policy-design-example.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This design example continues to use the fictitious company Woodgrove Bank, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. diff --git a/windows/keep-secure/server-isolation-policy-design.md b/windows/keep-secure/server-isolation-policy-design.md index a2397773da..de45c1b7c7 100644 --- a/windows/keep-secure/server-isolation-policy-design.md +++ b/windows/keep-secure/server-isolation-policy-design.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). diff --git a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md index 06486c2bd0..81d0358abb 100644 --- a/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/settings-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: DulceMV **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Use the **Settings** menu ![Settings icon](images/settings.png) to configure the time zone, suppression rules, and view license information. ## Time zone settings @@ -50,7 +52,7 @@ To set the time zone: 3. The time zone indicator changes to **Timezone:Local**. Click it again to change back to **Timezone:UTC**. ## Suppression rules -The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. For more information see, [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). +The suppression rules control what alerts are suppressed. You can suppress alerts so that certain activities are not flagged as suspicious. See [Suppress alerts](manage-alerts-windows-defender-advanced-threat-protection.md#suppress-alerts). ## License Click the license link in the **Settings** menu to view the license agreement information for Windows Defender ATP. diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 6c3504e01c..6cbed263b3 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -7,45 +7,58 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: mjcaparas +author: iaanw --- # Troubleshoot Windows Defender Advanced Threat Protection onboarding issues **Applies to:** -- Windows 10, version 1607. +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) -You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues. -This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints. +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an endpoint onboarding or connectivity problem. +You might need to troubleshoot the Windows Defender Advanced Threat Protection onboarding process if you encounter issues. +This page provides detailed steps for troubleshooting endpoints that aren't reporting correctly, and common error codes encountered during onboarding. -## Troubleshoot onboarding when deploying with Group Policy -Deployment with Group Policy is done by running the onboarding script on the endpoints. The Group Policy console does not indicate if the deployment has succeeded or not. +## Endpoints are not reporting to the service correctly -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after 20 minutes, it might indicate an endpoint onboarding or connectivity problem. -If the script completes successfully, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. +Go through the following verification topics to address this issue: -## Troubleshoot onboarding issues when deploying with System Center Configuration Manager -When onboarding endpoints using the following versions of System Center Configuration Manager: -- System Center 2012 Configuration Manager -- System Center 2012 R2 Configuration Manager -- System Center Configuration Manager (current branch) version 1511 -- System Center Configuration Manager (current branch) version 1602 +- [Ensure the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) +- [Ensure the Windows Defender ATP service is enabled](#Ensure-that-the-Windows-Defender-ATP-service-is-enabled) +- [Ensure the telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) +- [Ensure the endpoint has an Internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) -Deployment with the mentioned versions of System Center Configuration Manager is done by running the onboarding script on the endpoints. You can track the deployment in the Configuration Manager Console. +### Ensure the endpoint is onboarded successfully +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service was successfully onboarded onto the endpoint. -If the deployment fails, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). +**Check the onboarding state in Registry**: -If the onboarding completed successfully but the endpoints are not showing up in the Machines view after an hour, see see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. +1. Click **Start**, type **Run**, and press **Enter**. -## Troubleshoot onboarding when deploying with a script on the endpoint +2. From the **Run** dialog box, type **regedit** and press **Enter**. + +4. In the **Registry Editor** navigate to the Status key under: + + ```text +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection +``` + +5. Check the **OnboardingState** value is set to **1**. + + ![Image of OnboardingState status in Registry Editor](images/onboardingstate.png) + +If the **OnboardingState** value is not set to **1**, you can use Event Viewer to review errors on the endpoint. + +If you configured your endpoints with a deployment tool that required a script, you can check the event viewer for the onboarding script results. +
    +**Check the result of the script**: -**Check the result of the script on the endpoint**: 1. Click **Start**, type **Event Viewer**, and press **Enter**. 2. Go to **Windows Logs** > **Application**. @@ -53,81 +66,25 @@ If the onboarding completed successfully but the endpoints are not showing up in 3. Look for an event from **WDATPOnboarding** event source. If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue. -> [!NOTE] -> The following event IDs are specific to the onboarding script only. +> **Note**  The following event IDs are specific to the onboarding script only. Event ID | Error Type | Resolution steps :---|:---|:--- 5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection``` 10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```. Verify that the script was ran as an administrator. -15 | Failed to start SENSE service |Check the service status (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). -15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender ELAM driver, see [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) for instructions. -30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md) -35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```. The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md) -40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md) -65 | Insufficient privileges| Run the script again with administrator privileges. - -## Troubleshoot onboarding issues using Microsoft Intune -You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue. - -Use the following tables to understand the possible causes of issues while onboarding: - -- Microsoft Intune error codes and OMA-URIs table -- Known issues with non-compliance table -- Mobile Device Management (MDM) event logs table - -If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint Management** section of the portal, and run it in an elevated command prompt. - -**Microsoft Intune error codes and OMA-URIs**: - -Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps -:---|:---|:---|:---|:--- -0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
    Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

    **Troubleshooting steps:**
    Check the event IDs in the [Ensure the endpoint is onboarded successfully](#ensure-the-endpoint-is-onboarded-successfully) section.

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). - | | | Onboarding
    Offboarding
    SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.

    **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.

    If it doesn't exist, open an elevated command and add the key. - | | | SenseIsRunning
    OnboardingState
    OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.

    **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). - | | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional.
    Server is not supported. - 0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional. +15 | Failed to start SENSE service |Check the service status (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). +30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). +35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location ```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```. The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). +40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md).
    -**Known issues with non-compliance** - -The following table provides information on issues with non-compliance and how you can address the issues. - -Case | Symptoms | Possible cause and troubleshooting steps -:---|:---|:--- -1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already.

    **Troubleshooting steps:** Wait for OOBE to complete. -2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start.

    **Troubleshooting steps:** The issue should automatically be fixed within 24 hours. -3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time. - -
    -**Mobile Device Management (MDM) event logs** - -View the MDM event logs to troubleshoot issues that might arise during onboarding: - -Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider - -Channel name: Admin - -ID | Severity | Event description | Troubleshooting steps -:---|:---|:---|:--- -1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ELAM driver needs to be enabled see, [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) for instructions. - -## Troubleshoot onboarding issues on the endpoint -If the deployment tools used does not indicate an error in the onboarding process, but endpoints are still not appearing in the machines view an hour, go through the following verification topics to check if an error occurred with the Windows Defender ATP agent: -- [Ensure the endpoint is onboarded successfully](#Ensure-that-the-endpoint-is-onboarded-successfully) -- [Ensure the Windows Defender ELAM driver is enabled](#ensure-the-windows-defender ELAM driver is enabled) -- [Ensure the Windows Defender ATP service is enabled](#ensure-the-windows-defender-elam-driver-is-enabled) -- [Ensure the telemetry and diagnostics service is enabled](#Ensure-that-telemetry-and-diagnostics-service-is-enabled) -- [Ensure the endpoint has an Internet connection](#Ensure-that-the-Windows-Defender-ATP-endpoint-has-internet-connection) - -### View agent onboarding errors in the endpoint event log +**Use Event Viewer to identify and adress onboarding errors**: 1. Click **Start**, type **Event Viewer**, and press **Enter**. 2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**. - > [!NOTE] - > SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. + > **Note**  SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP. 3. Select **Operational** to load the log. @@ -141,16 +98,101 @@ If the deployment tools used does not indicate an error in the onboarding proces Event ID | Message | Resolution steps :---|:---|:--- -5 | Windows Defender Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). -6 | Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). -7 | Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again. -15 | Windows Defender Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). +5 | Windows Advanced Threat Protection service failed to connect to the server at _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). +6 | Windows Advanced Threat Protection service is not onboarded and no onboarding parameters were found. Failure code: _variable_ | [Run the onboarding script again](configure-endpoints-windows-defender-advanced-threat-protection.md#manual). +7 | Windows Advanced Threat Protection service failed to read the onboarding parameters. Failure code: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection), then run the entire onboarding process again. +15 | Windows Advanced Threat Protection cannot start command channel with URL: _variable_ | [Ensure the endpoint has Internet access](#ensure-the-endpoint-has-an-internet-connection). 25 | Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: _variable_ | Contact support. -There are additional components on the endpoint that the Windows Defender ATP agent depends on to function properly. If there are no onboarding related errors in the Windows Defender ATP agent event log, proceed with the following steps to ensure that the additional components are configured correctly. + +### Ensure the Windows Defender ATP service is enabled +If the endpoints aren't reporting correctly, you might need to check that the Windows Defender ATP service is set to automatically start and is running on the endpoint. + +You can use the SC command line program for checking and managing the startup type and running state of the service. + +**Check the Windows Defender ATP service startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start**, type **cmd**, and press **Enter**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc qc sense + ``` + +If the the service is running, then the result should look like the following screenshot: + + ![Result of the sq query sense command](images/sc-query-sense-autostart.png) + +If the service ```START_TYPE``` is not set to ```AUTO_START```, then you'll need to set the service to automatically start. + +**Change the Windows Defender ATP service startup type from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start**, type **cmd**, and press **Enter**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc config sense start=auto + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```text + sc qc sense + ``` + +**Check the Windows Defender ATP service is running from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start**, type **cmd**, and press **Enter**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc query sense + ``` + +If the service is running, the result should look like the following screenshot: + +![Result of the sc query sense command](images/sc-query-sense-running.png) + +If the service **STATE** is not set to **RUNNING**, then you'll need to start it. + +**Start the Windows Defender ATP service from the command line:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Click **Start**, type **cmd**, and press **Enter**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc start sense + ``` + +3. A success message is displayed. Verify the change by entering the following command and press **Enter**: + + ```text + sc qc sense + ``` ### Ensure the telemetry and diagnostics service is enabled -If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service might have been disabled by other programs or user configuration changes. +If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. The service may have been disabled by other programs or user configuration changes. + First, you should check that the service is set to start automatically when Windows starts, then you should check that the service is currently running (and start it if it isn't). @@ -174,7 +216,9 @@ If the service is enabled, then the result should look like the following screen ![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) -If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the service to automatically start. +If the ```START_TYPE``` is not set to ```AUTO_START```, then you'll need to set the service to automatically start. + + **Use the command line to set the Windows 10 telemetry and diagnostics service to automatically start:** @@ -196,13 +240,109 @@ If the `START_TYPE` is not set to `AUTO_START`, then you'll need to set the serv sc qc diagtrack ``` -4. Start the service. +**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service startup type**: - a. In the command prompt, type the following command and press **Enter**: +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Startup type** column - the service should be set as **Automatic**. + +If the startup type is not set to **Automatic**, you'll need to change it so the service starts when the endpoint does. + + +**Use the Windows Services console to set the Windows 10 telemetry and diagnostics service to automatically start:** + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Right-click on the entry and click **Properties**. + +4. On the **General** tab, change the **Startup type:** to **Automatic**, as shown in the following image. Click OK. + + ![Select Automatic to change the startup type in the Properties dialog box for the service](images/windefatp-utc-console-autostart.png) + +### Ensure the service is running + +**Use the command line to check the Windows 10 telemetry and diagnostics service is running**: + +1. Open an elevated command-line prompt on the endpoint: + + a. **Click **Start** and type **cmd**.** + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc query diagtrack + ``` + +If the service is running, the result should look like the following screenshot: + +![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png) + +If the service **STATE** is not set to **RUNNING**, then you'll need to start it. + + +**Use the command line to start the Windows 10 telemetry and diagnostics service:** + +1. Open an elevated command-line prompt on the endpoint: + + a. **Click **Start** and type **cmd**.** + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc start diagtrack + ``` + +3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: + + ```text + sc query diagtrack + ``` + +**Use the Windows Services console to check the Windows 10 telemetry and diagnostics service is running**: + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Check the **Status** column - the service should be marked as **Running**. + +If the service is not running, you'll need to start it. + + +**Use the Windows Services console to start the Windows 10 telemetry and diagnostics service:** + +1. Open the services console: + + a. Click **Start** and type **services**. + + b. Press **Enter** to open the console. + +2. Scroll through the list of services until you find **Connected User Experiences and Telemetry**. + +3. Right-click on the entry and click **Start**, as shown in the following image. + +![Select Start to start the service](images/windef-utc-console-start.png) - ``` - sc start diagtrack - ``` ### Ensure the endpoint has an Internet connection @@ -212,100 +352,90 @@ WinHTTP is independent of the Internet browsing proxy settings and other user co To ensure that sensor has service connectivity, follow the steps described in the [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls) topic. -If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. +If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. -## Ensure the Windows Defender ELAM driver is enabled -If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. +## Troubleshoot onboarding issues using Microsoft Intune +You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue. -**Check the ELAM driver status:** -1. Open a command-line prompt on the endpoint: +Use the following tables to understand the possible causes of issues while onboarding: - a. Click **Start**, type **cmd**, and select **Command prompt**. +- Microsoft Intune error codes and OMA-URIs table +- Known issues with non-compliance table +- Mobile Device Management (MDM) event logs table -2. Enter the following command, and press Enter: -``` -sc qc WdBoot -``` -If the ELAM driver is enabled, the output will be: +If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint Management** section of the portal, and run it in an elevated command prompt. -``` -[SC] QueryServiceConfig SUCCESS +**Microsoft Intune error codes and OMA-URIs**: -SERVICE_NAME: WdBoot - TYPE : 1 KERNEL_DRIVER - START_TYPE : 0 BOOT_START - ERROR_CONTROL : 1 NORMAL - BINARY_PATH_NAME : \SystemRoot\system32\drivers\WdBoot.sys - LOAD_ORDER_GROUP : Early-Launch - TAG : 0 - DISPLAY_NAME : Windows Defender Boot Driver - DEPENDENCIES : - SERVICE_START_NAME : -``` -If the ELAM driver is disabled the output will be: -``` -[SC] QueryServiceConfig SUCCESS +Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps +:---|:---|:---|:---|:--- +0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
    Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

    **Troubleshooting steps:**
    Check the event IDs in the [Ensure the endpoint is onboarded successfully](#ensure-the-endpoint-is-onboarded-successfully) section.

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). + | | | Onboarding
    Offboarding
    SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.

    **Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.

    If it doesn't exist, open an elevated command and add the key. + | | | SenseIsRunning
    OnboardingState
    OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.

    **Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).

    Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx). + | | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional.
    Server is not supported. + 0x87D101A9 | -2016345687 |Syncml(425): The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

    Currently is supported platforms: Enterprise, Education, and Professional. -SERVICE_NAME: WdBoot - TYPE : 1 KERNEL_DRIVER - START_TYPE : 0 DEMAND_START - ERROR_CONTROL : 1 NORMAL - BINARY_PATH_NAME : \SystemRoot\system32\drivers\WdBoot.sys - LOAD_ORDER_GROUP : _Early-Launch - TAG : 0 - DISPLAY_NAME : Windows Defender Boot Driver - DEPENDENCIES : - SERVICE_START_NAME : -``` -### Enable the ELAM driver +
    +**Known issues with non-compliance** -1. Open an elevated PowerShell console on the endpoint: +The following table provides information on issues with non-compliance and how you can address the issues. - a. Click **Start**, type **powershell**. +Case | Symptoms | Possible cause and troubleshooting steps +:---|:---|:--- +1 | Machine is compliant by SenseIsRunning OMA-URI. But is non-compliant by OrgId, Onboarding and OnboardingState OMA-URIs. | **Possible cause:** Check that user passed OOBE after Windows installation or upgrade. During OOBE onboarding couldn't be completed but SENSE is running already.

    **Troubleshooting steps:** Wait for OOBE to complete. +2 | Machine is compliant by OrgId, Onboarding, and OnboardingState OMA-URIs, but is non-compliant by SenseIsRunning OMA-URI. | **Possible cause:** Sense service's startup type is set as "Delayed Start". Sometimes this causes the Microsoft Intune server to report the machine as non-compliant by SenseIsRunning when DM session occurs on system start.

    **Troubleshooting steps:** The issue should automatically be fixed within 24 hours. +3 | Machine is non-compliant | **Troubleshooting steps:** Ensure that Onboarding and Offboarding policies are not deployed on the same machine at same time. - b. Right-click **Command prompt** and select **Run as administrator**. +
    +**Mobile Device Management (MDM) event logs** -2. Run the following PowerShell cmdlet: -``` -'Set-ExecutionPolicy -ExecutionPolicy Bypass’ -``` -3. Run the following PowerShell script: +View the MDM event logs to troubleshoot issues that might arise during onboarding: -``` -Add-Type @' -using System; -using System.IO; -using System.Runtime.InteropServices; -using Microsoft.Win32.SafeHandles; -using System.ComponentModel; +Log name: Microsoft\Windows\DeviceManagement-EnterpriseDiagnostics-Provider -public static class Elam{ - [DllImport("Kernel32", CharSet=CharSet.Auto, SetLastError=true)] - public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle); +Channel name: Admin - public static void InstallWdBoot(string path) - { - Console.Out.WriteLine("About to call create file on {0}", path); - var stream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.Read); - var handle = stream.SafeFileHandle; - - Console.Out.WriteLine("About to call InstallELAMCertificateInfo on handle {0}", handle.DangerousGetHandle()); - if (!InstallELAMCertificateInfo(handle)) - { - Console.Out.WriteLine("Call failed."); - throw new Win32Exception(Marshal.GetLastWin32Error()); - } - Console.Out.WriteLine("Call successful."); - } -} -'@ - -$driverPath = $env:SystemRoot + "\System32\Drivers\WdBoot.sys" -[Elam]::InstallWdBoot($driverPath) -``` +ID | Severity | Event description | Description +:---|:---|:---|:--- +1801 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Get Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3) | Windows Defender ATP has failed to get specific node's value.
    TokenName: Contains node name that caused the error.
    Result: Error details. +1802 | Information | Windows Defender Advanced Threat Protection CSP: Get Node's Value complete. NodeId: (%1), TokenName: (%2), Result: (%3) | Windows Defender ATP has completed to get specific node's value.
    TokenName: Contains node name

    Result: Error details or succeeded. +1819 | Error | Windows Defender Advanced Threat Protection CSP: Failed to Set Node's Value. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ATP has completed to get specific node's value.

    TokenName: Contains node name that caused the error

    Result: Error details. +1820 | Information | Windows Defender Advanced Threat Protection CSP: Set Nod's Value complete. NodeId: (%1), TokenName: (%2), Result: (%3). | Windows Defender ATP has completed to get specific node's value.

    TokenName: Contains node name

    Result: Error details or succeeded. + ## Related topics - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) + diff --git a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md index 73be4e0fa2..8340e9dcc0 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md @@ -13,9 +13,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + This section addresses issues that might arise as you use the Windows Defender Advanced Threat service. ### Server error - Access is denied due to invalid credentials diff --git a/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md index 758bffcd66..618894db96 100644 --- a/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md +++ b/windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 To enable Windows Firewall and configure its default behavior, use the Windows Firewall with Advanced Security node in the Group Policy Management console. diff --git a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md index cfe2f28953..717abdaec8 100644 --- a/windows/keep-secure/use-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/use-windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + A typical security breach investigation requires a member of a security operations team to: 1. View an alert on the **Dashboard** or **Alerts queue** @@ -39,6 +41,6 @@ Topic | Description [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts in Windows Defender ATP which might indicate possible security breaches on endpoints in your organization. [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. -[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external Internet protocol (IP) addresses. +[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external internet protocol (IP) addresses. [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md index e2e57dd1bd..3aabc0a07e 100644 --- a/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 ## Group Policy settings There are 10 Group Policy settings that can be configured for User Account Control (UAC). The table lists the default for each of the policy settings, and the following sections explain the different UAC policy settings and provide recommendations. These policy settings are located in **Security Settings\\Local Policies\\Security Options** in the Local Security Policy snap-in. For more information about each of the Group Policy settings, see the Group Policy description. For information about the registry key settings, see [Registry key settings](#registry-key-settings). diff --git a/windows/keep-secure/user-account-control-overview.md b/windows/keep-secure/user-account-control-overview.md index 32edfe0160..1e1801da84 100644 --- a/windows/keep-secure/user-account-control-overview.md +++ b/windows/keep-secure/user-account-control-overview.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. diff --git a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md index 44e4ba7803..03fcc34124 100644 --- a/windows/keep-secure/verify-that-network-traffic-is-authenticated.md +++ b/windows/keep-secure/verify-that-network-traffic-is-authenticated.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 After you have configured your domain isolation rule to request, rather than require, authentication, you must confirm that the network traffic sent by the devices on the network is being protected by IPsec authentication as expected. If you switch your rules to require authentication before all of the devices have received and applied the correct GPOs, or if there are any errors in your rules, then communications on the network can fail. By first setting the rules to request authentication, any network connections that fail authentication can continue in clear text while you diagnose and troubleshoot. diff --git a/windows/keep-secure/vpn-profile-options.md b/windows/keep-secure/vpn-profile-options.md index 3d14b8c9a7..ef04831e0b 100644 --- a/windows/keep-secure/vpn-profile-options.md +++ b/windows/keep-secure/vpn-profile-options.md @@ -61,8 +61,7 @@ A VPN profile configured with LockDown secures the device to only allow network ## Learn more -[VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) +- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune) +- [VPNv2 configuration service provider (CSP) reference](http://go.microsoft.com/fwlink/p/?LinkId=617588) +- [How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) -[How to Create VPN Profiles in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=618028) - -[Help users connect to their work using VPN profiles with Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkId=618029) diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 004d818bdf..b9bb671c49 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -1,8 +1,8 @@ --- title: Why a PIN is better than a password (Windows 10) -description: Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . +description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 -keywords: pin, security, password +keywords: pin, security, password, hello ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -17,36 +17,36 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -Microsoft Passport in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? -On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Passport PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. +Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? +On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. ## PIN is tied to the device -One important difference between a password and a Passport PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! +One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! -Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Passport on each device. +Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device. ## PIN is local to the device A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -> **Note:**  For details on how Passport uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928). +> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](http://go.microsoft.com/fwlink/p/?LinkId=691928).   ## PIN is backed by hardware -The Passport PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. +The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. -User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. +User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. ## PIN can be complex -The Passport PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. +The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. ## What if someone steals the laptop or phone? -To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. +To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. You can provide additional protection for laptops that don't have TPM by enablng BitLocker and setting a policy to limit failed sign-ins. **Configure BitLocker without TPM** @@ -63,14 +63,14 @@ You can provide additional protection for laptops that don't have TPM by enablng 2. Set the number of invalid logon attempts to allow, and then click OK. -## Why do you need a PIN to use Windows Hello? -Windows Hello is the biometric sign-in for Microsoft Passport in Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using Passport when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. +## Why do you need a PIN to use biometrics? +Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. -If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account name and password, which doesn't provide you the same level of protection as Passport. +If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account and password, which doesn't provide you the same level of protection as Hello. ## Related topics [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) -[Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md)   \ No newline at end of file diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 17ed75ffc7..e0fac10aa2 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -334,7 +334,7 @@ The sections that follow describe these improvements in more detail. **SMB hardening improvements for SYSVOL and NETLOGON connections** -In Windows 10 and Windows Server 2016 Technical Preview, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). +In Windows 10 and Windows Server 2016, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). - **What value does this change add?** This change reduces the likelihood of man-in-the-middle attacks. - **What works differently?** diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index b5d38c765d..bae239bf1c 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -14,9 +14,11 @@ author: mjcaparas **Applies to:** -- Windows 10, version 1607 +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + Windows Defender Advanced Threat Protection (Windows Defender ATP) is a security service, built into Windows 10 that enables enterprise customers detect, investigate, and respond to advanced threats on their networks. Windows Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service: @@ -76,10 +78,8 @@ detect sophisticated cyber-attacks, providing: Topic | Description :---|:--- [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | This overview topic for IT professionals provides information on the minimum requirements to use Windows Defender ATP such as network and data storage configuration, and endpoint hardware and software requirements, and deployment channels. -[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. -[Windows Defender compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md)) | Learn about how Windows Defender works in conjunction with Windows Defender ATP. -[Assign user access to the Windows Defender ATP portal](assign-portal-access-windows-defender-advanced-threat-protection.md)| Before users can access the portal, they'll need to be granted specific roles in Azure Active Directory. [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | You'll need to onboard and configure the Windows Defender ATP service and the endpoints in your network before you can use the service. Learn about how you can assign users to the Windows Defender ATP service in Azure Active Directory (AAD) and using a configuration package to configure endpoints. +[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)| Learn about how Windows Defender ATP collects and handles information and where data is stored. [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the main features of the service and how it leverages Microsoft technology to protect enterprise endpoints from sophisticated cyber attacks. [Use the Windows Defender Advanced Threat Protection portal](use-windows-defender-advanced-threat-protection.md) | Learn about the capabilities of Windows Defender ATP to help you investigate alerts that might be indicators of possible breaches in your enterprise. [Windows Defender Advanced Threat Protection settings](settings-windows-defender-advanced-threat-protection.md) | Learn about setting the time zone and configuring the suppression rules to configure the service to your requirements. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 23f9e3d1c0..c70e57a4b1 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 The Windows Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Firewall with Advanced Security management. It is designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Firewall with Advanced Security management in Windows. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md b/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md index 5dabaedf02..9cfe29f6c0 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 You can use the Windows Firewall with Advanced Security MMC snap-in with devices running at least Windows Vista or Windows Server 2008 to help protect the devices and the data that they share across a network. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md b/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md index acc229bd6a..47830f44c9 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md @@ -13,7 +13,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 Windows Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Firewall with Advanced Security supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot authenticate cannot communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices. diff --git a/windows/keep-secure/windows-firewall-with-advanced-security.md b/windows/keep-secure/windows-firewall-with-advanced-security.md index 51c6967315..4433aaf633 100644 --- a/windows/keep-secure/windows-firewall-with-advanced-security.md +++ b/windows/keep-secure/windows-firewall-with-advanced-security.md @@ -12,7 +12,7 @@ author: brianlic-msft **Applies to** - Windows 10 -- Windows Server 2016 Technical Preview +- Windows Server 2016 This is an overview of the Windows Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features.