From 0a66b6f05e91387b42daff9fd96b923f3d8f7edb Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 11 Dec 2020 23:11:36 +0500 Subject: [PATCH 001/173] Addition to information As we can also configure credential guard using account protection profile in endpoint security. Added link to that article as well. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8711 --- .../credential-guard/credential-guard-manage.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 1d0b90717a..ef647da88d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -59,6 +59,9 @@ To enforce processing of the group policy, you can run ```gpupdate /force```. 3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. +> [!TIP] +> You can also configure Credential Guard using account protection profile in Endpoint Security. See [https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings](account protection policy settings for endpoint security in Intune). + > [!NOTE] > It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. From eb8721263bdb89883c1799eee909ac2d8b8cac80 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 14 Dec 2020 18:10:06 +0500 Subject: [PATCH 002/173] Update windows/security/identity-protection/credential-guard/credential-guard-manage.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../credential-guard/credential-guard-manage.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index ef647da88d..2602ea1fb5 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -60,7 +60,7 @@ To enforce processing of the group policy, you can run ```gpupdate /force```. 3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. > [!TIP] -> You can also configure Credential Guard using account protection profile in Endpoint Security. See [https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings](account protection policy settings for endpoint security in Intune). +> You can also configure Credential Guard using an account protection profile in endpoint security. See [Account protection policy settings for endpoint security in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings). > [!NOTE] > It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. @@ -296,4 +296,3 @@ Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ``` - From 2d0bad64e34058bcc81ae94b6ab1f080bce84245 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 9 Mar 2021 21:01:41 +0500 Subject: [PATCH 003/173] Update hello-feature-dual-enrollment.md --- .../hello-for-business/hello-feature-dual-enrollment.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index 028fdd4868..dbb7bc61b3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -24,6 +24,7 @@ ms.reviewer: * Hybrid and On-premises Windows Hello for Business deployments * Enterprise Joined or Hybrid Azure joined devices * Windows 10, version 1709 +* Certificate trust > [!NOTE] > This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. From e4923acc08dd04543134621fd7a1889153230042 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 10 Mar 2021 10:09:13 +0500 Subject: [PATCH 004/173] Update windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-dual-enrollment.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md index dbb7bc61b3..b71bc4c615 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -22,7 +22,7 @@ ms.reviewer: **Requirements** * Hybrid and On-premises Windows Hello for Business deployments -* Enterprise Joined or Hybrid Azure joined devices +* Enterprise joined or Hybrid Azure joined devices * Windows 10, version 1709 * Certificate trust From 8b7cacb6ce0f28ad385b76c966c60c325cf3ef28 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 19 Mar 2021 12:22:01 +0530 Subject: [PATCH 005/173] added TPM 1.2 as per user feedback #9322 so I added TPM v1.2 applies to --- .../information-protection/tpm/change-the-tpm-owner-password.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 7854157fed..84e7313b5c 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -21,6 +21,7 @@ ms.date: 04/19/2017 **Applies to** - Windows 10, version 1511 - Windows 10, version 1507 +- TPM v1.2 This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. From f18afc7c9610928f93a4a48eca1e2db2179953f8 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 19 Mar 2021 14:22:20 +0530 Subject: [PATCH 006/173] Update windows/security/information-protection/tpm/change-the-tpm-owner-password.md accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../information-protection/tpm/change-the-tpm-owner-password.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 84e7313b5c..8ab05d6e0f 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -21,7 +21,7 @@ ms.date: 04/19/2017 **Applies to** - Windows 10, version 1511 - Windows 10, version 1507 -- TPM v1.2 +- TPM 1.2 This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. From b769c6bb8b613bcd28fa795e6f775ae9baf8cde2 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 25 Mar 2021 17:04:54 +0530 Subject: [PATCH 007/173] added version 20h2 after checking with build no 19042 and 19043 , then I conformed settings are available in windows 10 v20H2 --- windows/client-management/mdm/policy-csp-power.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index d17cdbe1bc..e710db1e1b 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1739,6 +1739,7 @@ Footnotes: - 6 - Available in Windows 10, version 1903. - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. From 7a4e0b09ba37ebf46269f2b8efabd8c0a951105f Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sun, 28 Mar 2021 22:38:56 +0200 Subject: [PATCH 008/173] HKEY_LOCAL_MACHINE_MACHINE typo correction As reported in issue ticket #9373 (**Typo in item 25. Windows Spotlight last bullet DisableWindowsConsumerFeatures: HKEY_LOCAL_MACHINE_MACHINE**), `/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md#L1769` contains a redundant extra occurrence of the key phrase `_MACHINE` (`HKEY_LOCAL_MACHINE_MACHINE`) (https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public@%7B2021-03-28T19:38:33Z%7D/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md#L1769) Because this document is rather massive (1917 lines, 119 850 characters), I will mainly be focusing on the typo correction, to avoid losing the overview of my changes. (Additional whitespace corrections and improvements are added, as a matter of course.) Closes #9373 --- ...system-components-to-microsoft-services.md | 360 +++++++++--------- 1 file changed, 178 insertions(+), 182 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index dccf2b6ba4..b855945dc3 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1,8 +1,8 @@ ---- +--- title: Manage connections from Windows 10 operating system components to Microsoft services description: Learn how to minimize connections from Windows to Microsoft services, and configure particular privacy settings related to these connections. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 -ms.reviewer: +ms.reviewer: keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 ms.prod: w10 ms.mktglfcycl: manage @@ -19,27 +19,27 @@ ms.date: 12/1/2020 # Manage connections from Windows 10 operating system components to Microsoft services -**Applies to** +**Applies to** - Windows 10 Enterprise, version 1607 and newer - Windows Server 2016 - Windows Server 2019 -This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. +This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. ->[!IMPORTANT] +> [!IMPORTANT] > - The downloadable Windows 10, version 1903 scripts/settings can be used on Windows 10, version 1909 devices. > - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic) > - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. > - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features. -> - It is recommended that you restart a device after making configuration changes to it. +> - It is recommended that you restart a device after making configuration changes to it. > - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. -> [!Warning] +> [!Warning] > - If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. -> - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. +> - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. > - During update or upgrade of Windows, egress traffic may occur. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm.md) @@ -55,8 +55,8 @@ The following sections list the components that make network connections to Micr The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607. -| Setting | UI | Group Policy | Registry | -| - | :-: | :-: | :-: | +| Setting | UI | Group Policy | Registry | +| - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -73,41 +73,41 @@ The following table lists management options for each setting, beginning with Wi | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | -| [18. Settings > Privacy](#bkmk-settingssection) | | | | +| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | +| [18. Settings > Privacy](#bkmk-settingssection) | | | | |     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -115,8 +115,8 @@ The following table lists management options for each setting, beginning with Wi See the following table for a summary of the management settings for Windows Server 2016 with Desktop Experience. -| Setting | UI | Group Policy | Registry | -| - | :-: | :-: | :-: | +| Setting | UI | Group Policy | Registry | +| - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -140,8 +140,8 @@ See the following table for a summary of the management settings for Windows Ser See the following table for a summary of the management settings for Windows Server 2016 Server Core. -| Setting | Group Policy | Registry | -| - | :-: | :-: | +| Setting | Group Policy | Registry | +| - | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -156,7 +156,7 @@ See the following table for a summary of the management settings for Windows Ser See the following table for a summary of the management settings for Windows Server 2016 Nano Server. | Setting | Registry | -| - | :-: | +| - | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | @@ -166,7 +166,7 @@ See the following table for a summary of the management settings for Windows Ser See the following table for a summary of the management settings for Windows Server 2019. -| Setting | UI | Group Policy | Registry | +| Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -188,33 +188,33 @@ See the following table for a summary of the management settings for Windows Ser |     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | | [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -260,8 +260,8 @@ On Windows Server 2016 Nano Server: - Create the registry path **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot** and then add a REG_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1. ->[!NOTE] ->CRL and OCSP network traffic is currently Allowed Traffic and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. +> [!NOTE] +> CRL and OCSP network traffic is currently Allowed Traffic and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. ### 2. Cortana and Search @@ -288,36 +288,36 @@ You can also apply the Group Policies using the following registry keys: | Don't search the web or display web results in Search| HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
REG_DWORD: ConnectedSearchUseWeb
Value: 0 | ->[!IMPORTANT] +> [!IMPORTANT] > Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. -2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. +2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. -3. On the **Rule Type** page, click **Program**, and then click **Next**. +3. On the **Rule Type** page, click **Program**, and then click **Next**. -4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. +4. On the **Program** page, click **This program path**, type **%windir%\\systemapps\\Microsoft.Windows.Cortana\_cw5n1h2txyewy\\SearchUI.exe**, and then click **Next**. -5. On the **Action** page, click **Block the connection**, and then click **Next**. +5. On the **Action** page, click **Block the connection**, and then click **Next**. -6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. +6. On the **Profile** page, ensure that the **Domain**, **Private**, and **Public** check boxes are selected, and then click **Next**. -7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** +7. On the **Name** page, type a name for the rule, such as **Cortana firewall configuration**, and then click **Finish.** -8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. +8. Right-click the new rule, click **Properties**, and then click **Protocols and Ports**. -9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. +9. Configure the **Protocols and Ports** page with the following info, and then click **OK**. - - For **Protocol type**, choose **TCP**. + - For **Protocol type**, choose **TCP**. - - For **Local port**, choose **All Ports**. + - For **Local port**, choose **All Ports**. - - For **Remote port**, choose **All ports**. + - For **Remote port**, choose **All ports**. -or- -- Create a new REG_SZ registry setting named **{0DE40C8E-C126-4A27-9371-A27DAB1039F7}** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\FirewallRules** and set it to a value of **v2.25|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=%windir%\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\searchUI.exe|Name=Block outbound Cortana|** +- Create a new REG_SZ registry setting named **{0DE40C8E-C126-4A27-9371-A27DAB1039F7}** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\FirewallRules** and set it to a value of **v2.25|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=%windir%\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\searchUI.exe|Name=Block outbound Cortana|** If your organization tests network traffic, do not use a network proxy as Windows Firewall does not block proxy traffic. Instead, use a network traffic analyzer. Based on your needs, there are many network traffic analyzers available at no cost. @@ -338,7 +338,7 @@ After that, configure the following: -or- -- Create a new REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to **0 (zero)**. +- Create a new REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to **0 (zero)**. ### 4. Device metadata retrieval @@ -412,10 +412,10 @@ To turn off Insider Preview builds for Windows 10: - Create a new REG_DWORD registry setting named **AllowBuildPreview** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a **value of 0 (zero)** - ### 8. Internet Explorer + > [!NOTE] ->When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: +> When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings: | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -458,11 +458,11 @@ To turn off the home page: -or- -- Create a new REG_SZ registry setting named **Start Page** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **about:blank** +- Create a new REG_SZ registry setting named **Start Page** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **about:blank** -and - -- Create a new REG_DWORD registry setting named **HomePage** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel** with a **1 (one)** +- Create a new REG_DWORD registry setting named **HomePage** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel** with a **1 (one)** To configure the First Run Wizard: @@ -471,7 +471,7 @@ To configure the First Run Wizard: -or- -- Create a new REG_DWORD registry setting named **DisableFirstRunCustomize** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **1 (one)** +- Create a new REG_DWORD registry setting named **DisableFirstRunCustomize** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **1 (one)** To configure the behavior for a new tab: @@ -480,7 +480,7 @@ To configure the behavior for a new tab: -or- -- Create a new REG_DWORD registry setting named **NewTabPageShow** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing** with a **0 (zero)** +- Create a new REG_DWORD registry setting named **NewTabPageShow** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing** with a **0 (zero)** ### 8.1 ActiveX control blocking @@ -489,11 +489,11 @@ ActiveX control blocking periodically downloads a new list of out-of-date Active You can turn this off by: -- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** +- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList** -or- -- Changing the REG_DWORD registry setting **HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to **0 (zero)**. +- Changing the REG_DWORD registry setting **HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to **0 (zero)**. For more info, see [Out-of-date ActiveX control blocking](/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking). @@ -501,19 +501,19 @@ For more info, see [Out-of-date ActiveX control blocking](/internet-explorer/ie1 You can turn off License Manager related traffic by setting the following registry entry: -- Add a REG_DWORD value named **Start** to **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the **value to 4** +- Add a REG_DWORD value named **Start** to **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the **value to 4** -- The value 4 is to disable the service. Here are the available options to set the registry: +- The value 4 is to disable the service. Here are the available options to set the registry: - - **0x00000000** = Boot + - **0x00000000** = Boot - - **0x00000001** = System + - **0x00000001** = System - - **0x00000002** = Automatic + - **0x00000002** = Automatic - - **0x00000003** = Manual + - **0x00000003** = Manual - - **0x00000004** = Disabled + - **0x00000004** = Disabled ### 10. Live Tiles @@ -523,7 +523,7 @@ To turn off Live Tiles: -or- -- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a **value of 1 (one)** +- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a **value of 1 (one)** In Windows 10 Mobile, you must also unpin all tiles that are pinned to Start. @@ -567,8 +567,8 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Configure Do Not Track | Choose whether employees can send Do Not Track headers.
**Set to Enabled** | | Configure Password Manager | Choose whether employees can save passwords locally on their devices.
**Set to Disabled** | | Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
**Set to Disabled** | -| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Windows Defender SmartScreen is turned on or off.
**Set to Disabled** | -| Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | +| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Windows Defender SmartScreen is turned on or off.
**Set to Disabled** | +| Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | | Configure Start pages | Choose the Start page for domain-joined devices.
**Enabled** and **Set this to <>** | | Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage.
**Set to: Enable** | | Allow Microsoft Compatibility List | Choose whether to use the Microsoft Compatibility List in Microsoft Edge.
**Set to: Disabled** | @@ -644,11 +644,11 @@ To turn off OneDrive in your organization: -and- -- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)** -or- -- Create a REG_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OneDrive** with a **value of 1 (one)** +- Create a REG_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OneDrive** with a **value of 1 (one)** ### 17. Preinstalled apps @@ -660,9 +660,9 @@ To remove the News app: - Right-click the app in Start, and then click **Uninstall**. -or- ->[!IMPORTANT] +> [!IMPORTANT] > If you have any issues with these commands, restart the system and try the scripts again. -> + - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** -and- @@ -933,7 +933,7 @@ To turn off **Location for this device**: - Click the **Change** button in the UI. -or- - + - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**. -or- @@ -943,7 +943,7 @@ To turn off **Location for this device**: To turn off **Allow apps to access your location**: - Turn off the feature in the UI. - + -or- - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**. @@ -952,7 +952,7 @@ To turn off **Allow apps to access your location**: - Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. - + To turn off **Location history**: - Erase the history using the **Clear** button in the UI. @@ -1035,15 +1035,15 @@ To turn off **Let apps access my notifications**: ### 18.6 Speech -In the **Speech** area, you can configure the functionality as such: +In the **Speech** area, you can configure the functionality as such: To turn off dictation of your voice, speaking to Cortana and other apps, and to prevent sending your voice input to Microsoft Speech services: -- Toggle the Settings -> Privacy -> Speech -> **Online speech recognition** switch to **Off** +- Toggle the Settings -> Privacy -> Speech -> **Online speech recognition** switch to **Off** -or- -- **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Control Panel > Regional and Language Options > Allow users to enable online speech recognition services** +- **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Control Panel > Regional and Language Options > Allow users to enable online speech recognition services** -or- @@ -1052,12 +1052,11 @@ To turn off dictation of your voice, speaking to Cortana and other apps, and to If you're running at Windows 10, version 1703 up to and including Windows 10, version 1803, you can turn off updates to the speech recognition and speech synthesis models: -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** -or- -- Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** - +- Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** ### 18.7 Account info @@ -1079,7 +1078,6 @@ To turn off **Let apps access my name, picture, and other account info**: - Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). - To turn off **Choose the apps that can access your account info**: - Turn off the feature in the UI for each app. @@ -1112,7 +1110,7 @@ To turn off **Let apps access my calendar**: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar**. Set the **Select a setting** box to **Force Deny**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar**. Set the **Select a setting** box to **Force Deny**. -or- @@ -1180,15 +1178,15 @@ To turn off **Choose apps that can read or send messages**: - Turn off the feature in the UI for each app. -**To turn off Message Sync** +**To turn off Message Sync** + +- Create a REG_DWORD registry setting named **AllowMessageSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Messaging** and set the **value to 0 (zero)**. -- Create a REG_DWORD registry setting named **AllowMessageSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Messaging** and set the **value to 0 (zero)**. - -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Messaging** +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Messaging** - - Set the **Allow Message Service Cloud Sync** to **Disable**. + - Set the **Allow Message Service Cloud Sync** to **Disable**. ### 18.13 Phone calls @@ -1238,7 +1236,7 @@ In the **Other Devices** area, you can choose whether devices that aren't paired To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**: -- Turn off the feature in the UI by going to Settings > Privacy > Other devices > "Communicate with unpaired devices. Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone" and **Turn it OFF**. +- Turn off the feature in the UI by going to Settings > Privacy > Other devices > "Communicate with unpaired devices. Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone" and **Turn it OFF**. -or- @@ -1263,7 +1261,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co ### 18.16 Feedback & diagnostics -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To change how frequently **Windows should ask for my feedback**: @@ -1314,7 +1312,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic > [!NOTE] > If the **Security** option is configured by using Group Policy or the Registry, the value will not be reflected in the UI. The **Security** option is only available in Windows 10 Enterprise edition. - + To turn off tailored experiences with relevant tips and recommendations by using your diagnostics data: @@ -1334,7 +1332,7 @@ To turn off tailored experiences with relevant tips and recommendations by using -or- -- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1** +- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1** ### 18.17 Background apps @@ -1388,7 +1386,7 @@ To turn this off: -or- -- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks**. Set the **Select a setting** box to **Force Deny**. +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks**. Set the **Select a setting** box to **Force Deny**. -or- @@ -1414,50 +1412,50 @@ To turn this off: ### 18.21 Inking & Typing -In the **Inking & Typing** area you can configure the functionality as such: +In the **Inking & Typing** area you can configure the functionality as such: To turn off Inking & Typing data collection: -- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Improve inking and typing** and turn it to **Off** +- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Improve inking and typing** and turn it to **Off** -OR- - + **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Windows Components > Text Input > Improve inking and typing recognition** - + -and- - + **Disable** the Group Policy: **User Configuration > Administrative Templates > Control Panel > Regional and Language Options > Handwriting personalization > Turn off automatic learning** - + -OR- - Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)** -and- - + - Set **RestrictImplicitInkCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)** ### 18.22 Activity History -In the **Activity History** area, you can choose turn Off tracking of your Activity History. +In the **Activity History** area, you can choose turn Off tracking of your Activity History. To turn this Off in the UI: -- Turn **Off** the feature in the UI by going to Settings -> Privacy -> Activity History and **un-checking** the **Store my activity history on this device** AND **unchecking** the **Send my activity History to Microsoft** checkboxes +- Turn **Off** the feature in the UI by going to Settings -> Privacy -> Activity History and **un-checking** the **Store my activity history on this device** AND **unchecking** the **Send my activity History to Microsoft** checkboxes -OR- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Enables Activity Feed** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Enables Activity Feed** -and- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Allow publishing of User Activities** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Allow publishing of User Activities** -and- -- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** > named **Allow upload of User Activities** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** > named **Allow upload of User Activities** -OR- - + - Create a REG_DWORD registry setting named **EnableActivityFeed** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)** -and- @@ -1467,14 +1465,14 @@ To turn this Off in the UI: -and- - Create a REG_DWORD registry setting named **UploadUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)** - + ### 18.23 Voice Activation -In the **Voice activation** area, you can choose turn Off apps ability to listen for a Voice keyword. +In the **Voice activation** area, you can choose turn Off apps ability to listen for a Voice keyword. To turn this Off in the UI: -- Turn **Off** the feature in the UI by going to **Settings -> Privacy -> Voice activation** and toggle **Off** the **Allow apps to use voice activation** AND also toggle **Off** the **Allow apps to use voice activation when this device is locked** +- Turn **Off** the feature in the UI by going to **Settings -> Privacy -> Voice activation** and toggle **Off** the **Allow apps to use voice activation** AND also toggle **Off** the **Allow apps to use voice activation when this device is locked** -OR- @@ -1486,7 +1484,7 @@ To turn this Off in the UI: -OR- - + - Create a REG_DWORD registry setting named **LetAppsActivateWithVoice** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)** -and- @@ -1494,7 +1492,6 @@ To turn this Off in the UI: - Create a REG_DWORD registry setting named **LetAppsActivateWithVoiceAboveLock** in **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppPrivacy** with a **value of 2 (two)** - ### 19. Software Protection Platform Enterprise customers can manage their Windows activation status with volume licensing using an on-premises Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: @@ -1519,9 +1516,9 @@ Enterprise customers can manage their Windows activation status with volume lice - Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). ->[!NOTE] ->Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. ->The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. +> [!NOTE] +> Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. +> The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 20. Storage health @@ -1542,7 +1539,7 @@ You can control if your settings are synchronized: -or- -- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync**. Leave the "Allow users to turn syncing on" checkbox **unchecked**. +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync**. Leave the "Allow users to turn syncing on" checkbox **unchecked**. -or- @@ -1553,14 +1550,14 @@ To turn off Messaging cloud sync: > [!NOTE] > There is no Group Policy corresponding to this registry key. -- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. +- Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. ### 22. Teredo You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](/previous-versions/windows/it-pro/windows-vista/cc722030(v=ws.10)). ->[!NOTE] ->If you disable Teredo, some XBOX gaming features and Delivery Optimization (with Group or Internet peering) will not work. +> [!NOTE] +> If you disable Teredo, some XBOX gaming features and Delivery Optimization (with Group or Internet peering) will not work. - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**. @@ -1571,14 +1568,14 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command. ### 23. Wi-Fi Sense ->[!IMPORTANT] ->Beginning with Windows 10, version 1803, Wi-Fi Sense is no longer available. The following section only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/en-us/windows-10-open-wi-fi-hotspots) for more details. +> [!IMPORTANT] +> Beginning with Windows 10, version 1803, Wi-Fi Sense is no longer available. The following section only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/en-us/windows-10-open-wi-fi-hotspots) for more details. Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**: -- Turn off the feature in the UI in Settings > Network & Internet > Wi-Fi +- Turn off the feature in the UI in Settings > Network & Internet > Wi-Fi -or- @@ -1593,12 +1590,12 @@ When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings scr ### 24. Windows Defender -You can disconnect from the Microsoft Antimalware Protection Service. +You can disconnect from the Microsoft Antimalware Protection Service. ->[!IMPORTANT] ->**Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903** ->1. Ensure Windows and Windows Defender are fully up to date. ->2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. +> [!IMPORTANT] +> **Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903** +> 1. Ensure Windows and Windows Defender are fully up to date. +> 2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. - **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** @@ -1638,7 +1635,7 @@ You can stop downloading **Definition Updates**: -and- -- **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** +- **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: @@ -1646,7 +1643,7 @@ You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: - Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. > [!NOTE] -> There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. +> There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. You can turn off **Enhanced Notifications** as follows: @@ -1655,7 +1652,7 @@ You can turn off **Enhanced Notifications** as follows: -or- -- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Reporting**. +- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Reporting**. -or- @@ -1666,7 +1663,7 @@ You can turn off **Enhanced Notifications** as follows: To disable Windows Defender SmartScreen: -In Group Policy, configure: +In Group Policy, configure: - **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** to be **Disabled** @@ -1695,7 +1692,7 @@ In Group Policy, configure: Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or Group Policy. -If you're running Windows 10, version 1607 or later, you need to: +If you're running Windows 10, version 1607 or later, you need to: - **Enable** the following Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features** @@ -1714,7 +1711,7 @@ If you're running Windows 10, version 1607 or later, you need to: -or- -- Create a new REG_DWORD registry setting named **NoLockScreen** in **HKEY_Local_Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a **value of 1 (one)** +- Create a new REG_DWORD registry setting named **NoLockScreen** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a **value of 1 (one)** -AND- @@ -1732,27 +1729,27 @@ If you're running Windows 10, version 1607 or later, you need to: - Apply the Group Policies: - - **Enable** the **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image and logon image** Group Policy. + - **Enable** the **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image and logon image** Group Policy. - Add **C:\\windows\\web\\screen\\lockscreen.jpg** as the location in the **Path to local lock screen image** box. - Check the **Turn off fun facts, tips, tricks, and more on lock screen** check box. > [!NOTE] - > This will only take effect if the policy is applied before the first logon. - > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, - > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** + > This will only take effect if the policy is applied before the first logon. + > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, + > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > - > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** - > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in + > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** + > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in > **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**. > - > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. + > The Group Policy for the **LockScreenOverlaysDisabled** registry key is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. \-AND- - - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** + - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** -or- @@ -1766,10 +1763,10 @@ If you're running Windows 10, version 1607 or later, you need to: -or- - - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** - - -This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen. + - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** + + +This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen. If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC. @@ -1846,7 +1843,7 @@ For a comprehensive list of Delivery Optimization Policies, see [Delivery Optimi -or- -- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **99 (Ninety-nine)**. +- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **99 (Ninety-nine)**. For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). @@ -1866,15 +1863,15 @@ You can turn off Windows Update by setting the following registry entries: -and- -- Add a REG_SZ value named **WUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. +- Add a REG_SZ value named **WUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. -and- -- Add a REG_SZ value named **WUStatusServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. +- Add a REG_SZ value named **WUStatusServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. -and- -- Add a REG_SZ value named **UpdateServiceUrlAlternate** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. +- Add a REG_SZ value named **UpdateServiceUrlAlternate** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. -and- @@ -1882,7 +1879,7 @@ You can turn off Windows Update by setting the following registry entries: -OR- -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations** to **Enabled** +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations** to **Enabled** -and- @@ -1890,11 +1887,11 @@ You can turn off Windows Update by setting the following registry entries: -and- -- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** to **Enabled** and ensure all Option settings (Intranet Update Service, Intranet Statistics Server, Alternate Download Server) are set to **" "** +- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** to **Enabled** and ensure all Option settings (Intranet Update Service, Intranet Statistics Server, Alternate Download Server) are set to **" "** -and- -- Set the Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Remove access to use all Windows Update features** to **Enabled** and then set **Computer Configurations** to **0 (zero)**. +- Set the Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Remove access to use all Windows Update features** to **Enabled** and then set **Computer Configurations** to **0 (zero)**. You can turn off automatic updates by doing the following. This is not recommended. @@ -1906,16 +1903,15 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre - Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0. - ### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline -|Allowed traffic endpoints| -| --- | +|Allowed traffic endpoints| +| --- | |activation-v2.sls.microsoft.com/*| |crl.microsoft.com/pki/crl/*| |ocsp.digicert.com/*| |www.microsoft.com/pkiops/*| -To learn more, see [Device update management](/windows/client-management/mdm/device-update-management) and [Configure Automatic Updates by using Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720539(v=ws.10)). \ No newline at end of file +To learn more, see [Device update management](/windows/client-management/mdm/device-update-management) and [Configure Automatic Updates by using Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720539(v=ws.10)). From 83590458c8dc2327bbf08ef8eaf3b14cefc93237 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:17:12 +0200 Subject: [PATCH 009/173] missing period dot ( . ) in line 45 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index b855945dc3..b05d7fcc8a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -42,7 +42,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] > - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. > - During update or upgrade of Windows, egress traffic may occur. -To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm.md) +To use Microsoft Intune cloud-based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm.md). We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**. From 09543e07518f90aa0c10f58f35a5f05695f87f40 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:18:09 +0200 Subject: [PATCH 010/173] Add missing bold formatting in line 1078 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index b05d7fcc8a..03cdc0afad 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1075,7 +1075,7 @@ To turn off **Let apps access my name, picture, and other account info**: -or- -- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two). +- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**. To turn off **Choose the apps that can access your account info**: From 4afcc1a0ac0543b1512887efaafab081f8af5210 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:18:59 +0200 Subject: [PATCH 011/173] Adjust expression and format "value of 1 (one)" Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 03cdc0afad..0e15ff1e5c 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1332,7 +1332,7 @@ To turn off tailored experiences with relevant tips and recommendations by using -or- -- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1** +- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** ### 18.17 Background apps From 155fa67a96a1f7295015641134095f0c85d44e1c Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:19:24 +0200 Subject: [PATCH 012/173] Adjust expression "value of 1 (one)" in line 1517 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 0e15ff1e5c..38bf1185da 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1514,7 +1514,7 @@ Enterprise customers can manage their Windows activation status with volume lice **For Windows Server 2016:** -- Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). +- Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**. > [!NOTE] > Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. From ecd2cb613ceb439a838278efe0ae1fe31d4ba649 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:20:19 +0200 Subject: [PATCH 013/173] replace comma with semicolon ; line 1520 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 38bf1185da..d5c0006204 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1517,7 +1517,7 @@ Enterprise customers can manage their Windows activation status with volume lice - Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**. > [!NOTE] -> Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. +> Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016; the **NoAcquireGT** value needs to be set instead. > The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 20. Storage health From 0a17ae07fb98df2a7c0ae943284d5c69a33f1f4b Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:20:45 +0200 Subject: [PATCH 014/173] Remove locale-specific part of the link (/en-us/) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d5c0006204..a8bf43d857 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1569,7 +1569,7 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command. ### 23. Wi-Fi Sense > [!IMPORTANT] -> Beginning with Windows 10, version 1803, Wi-Fi Sense is no longer available. The following section only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/en-us/windows-10-open-wi-fi-hotspots) for more details. +> Beginning with Windows 10, version 1803, Wi-Fi Sense is no longer available. The following section only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) for more details. Wi-Fi Sense automatically connects devices to known hotspots and to the wireless networks the person’s contacts have shared with them. From dc69c863135bde13968b6c894e4e6aee2f409b3f Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:21:14 +0200 Subject: [PATCH 015/173] Adjust expression "value of 1 (one)" in line 1878 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a8bf43d857..55ab4fef6e 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1875,7 +1875,7 @@ You can turn off Windows Update by setting the following registry entries: -and- -- Add a REG_DWORD value named **UseWUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\WindowsUpdate\\AU** and set the value to 1. +- Add a REG_DWORD value named **UseWUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\WindowsUpdate\\AU** and set the **value to 1 (one)**. -OR- From 3fa0ed93a57cfcdafda37b579a379046ea441588 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 18:22:09 +0200 Subject: [PATCH 016/173] Adjust expression and format of "value to 0 (zero)" - 1904 Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 55ab4fef6e..c06afafa86 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1901,7 +1901,7 @@ You can turn off automatic updates by doing the following. This is not recommend For China releases of Windows 10 there is one additional Regkey to be set to prevent traffic: -- Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0. +- Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the **value to 0 (zero)**. ### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline From 09b43dec04aeaa3e039138089f93857635339bf9 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Mon, 29 Mar 2021 22:57:42 +0200 Subject: [PATCH 017/173] 4624(S) Workstation Name source, error correction As reported in issue ticket #9377 (**Error in 4624(S) docs**), the Workstation Name description should state that this is "machine name *from* which a logon attempt was performed". Thanks to @ashmohabd for noticing and reporting this issue. Changes proposed: - Replace "to" with "from" in the "Workstation Name" description. - Add the article "a" before "logon attempt was performed". - Add missing comma after 'If "Yes" ' Codestyle, formatting and whitespace changes: - Replace all curly quotes with straight quotes - Remove all (if any) redundant End-Of-Line (EOL) blanks - Normalize bullet point list and numbered list spacing - Use online XML beautifier on the XML code (indents) Closes #9377 --- .../threat-protection/auditing/event-4624.md | 275 +++++++++--------- 1 file changed, 138 insertions(+), 137 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 60967af878..cb86697ff3 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -17,8 +17,8 @@ ms.technology: mde # 4624(S): An account was successfully logged on. **Applies to** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows Server 2016 Event 4624 illustration @@ -36,52 +36,53 @@ This event generates when a logon session is created (on destination machine). I ***Event XML:*** ```xml - - - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - - - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - + + + + 4624 + 2 + 0 + 12544 + 0 + 0x8020000000000000 + + 211 + + + Security + WIN-GG82ULGC9GO + + + + S-1-5-18 + WIN-GG82ULGC9GO$ + WORKGROUP + 0x3e7 + S-1-5-21-1377283216-344919071-3415362939-500 + Administrator + WIN-GG82ULGC9GO + 0x8dcdc + 2 + User32 + Negotiate + WIN-GG82ULGC9GO + {00000000-0000-0000-0000-000000000000} + - + - + 0 + 0x44c + C:\\Windows\\System32\\svchost.exe + 127.0.0.1 + 0 + %%1833 + - + - + - + %%1843 + 0x0 + %%1842 + ``` @@ -91,57 +92,57 @@ This event generates when a logon session is created (on destination machine). I ***Event Versions:*** -- 0 - Windows Server 2008, Windows Vista. +- 0 - Windows Server 2008, Windows Vista. -- 1 - Windows Server 2012, Windows 8. +- 1 - Windows Server 2012, Windows 8. - - Added “Impersonation Level” field. + - Added "Impersonation Level" field. -- 2 – Windows 10. +- 2 – Windows 10. - - Added “Logon Information:” section. + - Added "Logon Information:" section. - - **Logon Type** moved to “Logon Information:” section. + - **Logon Type** moved to "Logon Information:" section. - - Added “Restricted Admin Mode” field. + - Added "Restricted Admin Mode" field. - - Added “Virtual Account” field. + - Added "Virtual Account" field. - - Added “Elevated Token” field. + - Added "Elevated Token" field. - - Added “Linked Logon ID” field. + - Added "Linked Logon ID" field. - - Added “Network Account Name” field. + - Added "Network Account Name" field. - - Added “Network Account Domain” field. + - Added "Network Account Domain" field. ***Field Descriptions:*** **Subject:** -- **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. +- **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). -- **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon. +- **Account Name** [Type = UnicodeString]**:** the name of the account that reported information about successful logon. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** [Type = UnicodeString]**:** subject’s domain or computer name. Formats vary, and include the following: - - Domain NETBIOS name example: CONTOSO + - Domain NETBIOS name example: CONTOSO - - Lowercase full domain name: contoso.local + - Lowercase full domain name: contoso.local - - Uppercase full domain name: CONTOSO.LOCAL + - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.” +- **Logon ID** [Type = HexInt64]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4672](event-4672.md)(S): Special privileges assigned to new logon." -**Logon Information** \[Version 2\]**:** +**Logon Information** [Version 2]**:** -- **Logon Type** \[Version 0, 1, 2\] \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field. +- **Logon Type** [Version 0, 1, 2] [Type = UInt32]**:** the type of logon which was performed. The table below contains the list of possible values for this field. ## Logon types and descriptions @@ -160,117 +161,117 @@ This event generates when a logon session is created (on destination machine). I | `12` | `CachedRemoteInteractive` | Same as RemoteInteractive. This is used for internal auditing. | | `13` | `CachedUnlock` | Workstation logon. | -- **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. +- **Restricted Admin Mode** [Version 2] [Type = UnicodeString]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. Reference: . If not a **RemoteInteractive** logon, then this will be "-" string. -- **Virtual Account** \[Version 2\] \[Type = UnicodeString\]**:** a “Yes” or “No” flag, which indicates if the account is a virtual account (e.g., "[Managed Service Account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560633(v=ws.10))"), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using "NetworkService". +- **Virtual Account** [Version 2] [Type = UnicodeString]**:** a "Yes" or "No" flag, which indicates if the account is a virtual account (e.g., "[Managed Service Account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd560633(v=ws.10))"), which was introduced in Windows 7 and Windows Server 2008 R2 to provide the ability to identify the account that a given Service uses, instead of just using "NetworkService". -- **Elevated Token** \[Version 2\] \[Type = UnicodeString\]**:** a “Yes” or “No” flag. If “Yes” then the session this event represents is elevated and has administrator privileges. +- **Elevated Token** [Version 2] [Type = UnicodeString]**:** a "Yes" or "No" flag. If "Yes", then the session this event represents is elevated and has administrator privileges. -**Impersonation Level** \[Version 1, 2\] \[Type = UnicodeString\]: can have one of these four values: +**Impersonation Level** [Version 1, 2] [Type = UnicodeString]: can have one of these four values: -- SecurityAnonymous (displayed as **empty string**): The server process cannot obtain identification information about the client, and it cannot impersonate the client. It is defined with no value given, and thus, by ANSI C rules, defaults to a value of zero. +- SecurityAnonymous (displayed as **empty string**): The server process cannot obtain identification information about the client, and it cannot impersonate the client. It is defined with no value given, and thus, by ANSI C rules, defaults to a value of zero. -- SecurityIdentification (displayed as "**Identification**"): The server process can obtain information about the client, such as security identifiers and privileges, but it cannot impersonate the client. This is useful for servers that export their own objects, for example, database products that export tables and views. Using the retrieved client-security information, the server can make access-validation decisions without being able to use other services that are using the client's security context. +- SecurityIdentification (displayed as "**Identification**"): The server process can obtain information about the client, such as security identifiers and privileges, but it cannot impersonate the client. This is useful for servers that export their own objects, for example, database products that export tables and views. Using the retrieved client-security information, the server can make access-validation decisions without being able to use other services that are using the client's security context. -- SecurityImpersonation (displayed as "**Impersonation**"): The server process can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems. This is the most common type. +- SecurityImpersonation (displayed as "**Impersonation**"): The server process can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems. This is the most common type. -- SecurityDelegation (displayed as "**Delegation**"): The server process can impersonate the client's security context on remote systems. +- SecurityDelegation (displayed as "**Delegation**"): The server process can impersonate the client's security context on remote systems. **New Logon:** -- **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. +- **Security ID** [Type = SID]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. > **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). -- **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed. +- **Account Name** [Type = UnicodeString]**:** the name of the account for which logon was performed. -- **Account Domain** \[Type = UnicodeString\]**:** subject’s domain or computer name. Formats vary, and include the following: +- **Account Domain** [Type = UnicodeString]**:** subject’s domain or computer name. Formats vary, and include the following: - - Domain NETBIOS name example: CONTOSO + - Domain NETBIOS name example: CONTOSO - - Lowercase full domain name: contoso.local + - Lowercase full domain name: contoso.local - - Uppercase full domain name: CONTOSO.LOCAL + - Uppercase full domain name: CONTOSO.LOCAL - - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is “NT AUTHORITY”. + - For some [well-known security principals](https://support.microsoft.com/kb/243330), such as LOCAL SERVICE or ANONYMOUS LOGON, the value of this field is "NT AUTHORITY". - - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: “Win81”. + - For local user accounts, this field will contain the name of the computer or device that this account belongs to, for example: "Win81". -- **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.” +- **Logon ID** [Type = HexInt64]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, "[4672](event-4672.md)(S): Special privileges assigned to new logon." -- **Linked Logon ID** \[Version 2\] \[Type = HexInt64\]**:** A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is “**0x0**”. +- **Linked Logon ID** [Version 2] [Type = HexInt64]**:** A hexadecimal value of the paired logon session. If there is no other logon session associated with this logon session, then the value is "**0x0**". -- **Network Account Name** \[Version 2\] \[Type = UnicodeString\]**:** User name that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type. +- **Network Account Name** [Version 2] [Type = UnicodeString]**:** User name that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type. If not **NewCredentials** logon, then this will be a "-" string. -- **Network Account Domain** \[Version 2\] \[Type = UnicodeString\]**:** Domain for the user that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type. +- **Network Account Domain** [Version 2] [Type = UnicodeString]**:** Domain for the user that will be used for outbound (network) connections. Valid only for [NewCredentials](#logon-types-and-descriptions) logon type. If not **NewCredentials** logon, then this will be a "-" string. -- **Logon GUID** \[Type = GUID\]: a GUID that can help you correlate this event with another event that can contain the same **Logon GUID**, “[4769](event-4769.md)(S, F): A Kerberos service ticket was requested event on a domain controller. +- **Logon GUID** [Type = GUID]: a GUID that can help you correlate this event with another event that can contain the same **Logon GUID**, "[4769](event-4769.md)(S, F): A Kerberos service ticket was requested event on a domain controller. - It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same **Logon GUID**, “[4648](event-4648.md)(S): A logon was attempted using explicit credentials” and “[4964](event-4964.md)(S): Special groups have been assigned to a new logon.” + It also can be used for correlation between a 4624 event and several other events (on the same computer) that can contain the same **Logon GUID**, "[4648](event-4648.md)(S): A logon was attempted using explicit credentials" and "[4964](event-4964.md)(S): Special groups have been assigned to a new logon." - This parameter might not be captured in the event, and in that case appears as “{00000000-0000-0000-0000-000000000000}”. + This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}". > **Note**  **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances. **Process Information:** -- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): +- **Process ID** [Type = Pointer]: hexadecimal Process ID of the process that attempted the logon. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): Task manager illustration If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. - You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. + You can also correlate this process ID with a process ID in other events, for example, "[4688](event-4688.md): A new process has been created" **Process Information\\New Process ID**. -- **Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process. +- **Process Name** [Type = UnicodeString]**:** full path and the name of the executable for the process. **Network Information:** -- **Workstation Name** \[Type = UnicodeString\]**:** machine name to which logon attempt was performed. +- **Workstation Name** [Type = UnicodeString]**:** machine name from which a logon attempt was performed. -- **Source Network Address** \[Type = UnicodeString\]**:** IP address of machine from which logon attempt was performed. +- **Source Network Address** [Type = UnicodeString]**:** IP address of machine from which logon attempt was performed. - - IPv6 address or ::ffff:IPv4 address of a client. + - IPv6 address or ::ffff:IPv4 address of a client. - - ::1 or 127.0.0.1 means localhost. + - ::1 or 127.0.0.1 means localhost. -- **Source Port** \[Type = UnicodeString\]: source port which was used for logon attempt from remote machine. +- **Source Port** [Type = UnicodeString]: source port which was used for logon attempt from remote machine. - - 0 for interactive logons. + - 0 for interactive logons. **Detailed Authentication Information:** -- **Logon Process** \[Type = UnicodeString\]**:** the name of the trusted logon process that was used for the logon. See event “[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority” description for more information. +- **Logon Process** [Type = UnicodeString]**:** the name of the trusted logon process that was used for the logon. See event "[4611](event-4611.md): A trusted logon process has been registered with the Local Security Authority" description for more information. -- **Authentication Package** \[Type = UnicodeString\]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in “HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig” registry key. Other packages can be loaded at runtime. When a new package is loaded a “[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority” (typically for NTLM) or “[4622](event-4622.md): A security package has been loaded by the Local Security Authority” (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: +- **Authentication Package** [Type = UnicodeString]**:** The name of the authentication package which was used for the logon authentication process. Default packages loaded on LSA startup are located in "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig" registry key. Other packages can be loaded at runtime. When a new package is loaded a "[4610](event-4610.md): An authentication package has been loaded by the Local Security Authority" (typically for NTLM) or "[4622](event-4622.md): A security package has been loaded by the Local Security Authority" (typically for Kerberos) event is logged to indicate that a new package has been loaded along with the package name. The most common authentication packages are: - - **NTLM** – NTLM-family Authentication + - **NTLM** – NTLM-family Authentication - - **Kerberos** – Kerberos authentication. + - **Kerberos** – Kerberos authentication. - - **Negotiate** – the Negotiate security package selects between Kerberos and NTLM protocols. Negotiate selects Kerberos unless it cannot be used by one of the systems involved in the authentication or the calling application did not provide sufficient information to use Kerberos. + - **Negotiate** – the Negotiate security package selects between Kerberos and NTLM protocols. Negotiate selects Kerberos unless it cannot be used by one of the systems involved in the authentication or the calling application did not provide sufficient information to use Kerberos. -- **Transited Services** \[Type = UnicodeString\] \[Kerberos-only\]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see +- **Transited Services** [Type = UnicodeString] [Kerberos-only]**:** the list of transmitted services. Transmitted services are populated if the logon was a result of a S4U (Service For User) logon process. S4U is a Microsoft extension to the Kerberos Protocol to allow an application service to obtain a Kerberos service ticket on behalf of a user – most commonly done by a front-end website to access an internal resource on behalf of a user. For more information about S4U, see -- **Package Name (NTLM only)** \[Type = UnicodeString\]**:** The name of the LAN Manager sub-package ([NTLM-family](/openspecs/windows_protocols/ms-nlmp/c50a85f0-5940-42d8-9e82-ed206902e919) protocol name) that was used during logon. Possible values are: +- **Package Name (NTLM only)** [Type = UnicodeString]**:** The name of the LAN Manager sub-package ([NTLM-family](/openspecs/windows_protocols/ms-nlmp/c50a85f0-5940-42d8-9e82-ed206902e919) protocol name) that was used during logon. Possible values are: - - “NTLM V1” + - "NTLM V1" - - “NTLM V2” + - "NTLM V2" - - “LM” + - "LM" - Only populated if “**Authentication Package” = “NTLM”**. + Only populated if "**Authentication Package" = "NTLM"**. -- **Key Length** \[Type = UInt32\]**:** the length of [NTLM Session Security](/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if “**Authentication Package” = “Kerberos”**, because it is not applicable for Kerberos protocol. This field will also have “0” value if Kerberos was negotiated using **Negotiate** authentication package. +- **Key Length** [Type = UInt32]**:** the length of [NTLM Session Security](/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832) key. Typically it has 128 bit or 56 bit length. This parameter is always 0 if "**Authentication Package" = "Kerberos"**, because it is not applicable for Kerberos protocol. This field will also have "0" value if Kerberos was negotiated using **Negotiate** authentication package. ## Security Monitoring Recommendations @@ -278,39 +279,39 @@ For 4624(S): An account was successfully logged on. | **Type of monitoring required** | **Recommendation** | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the high-value account or accounts. | -| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“New Logon\\Security ID”** (with other information) to monitor how or when a particular account is being used. | -| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“New Logon\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“New Logon\\Security ID”** for accounts that are outside the allow list. | -| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“New Logon\\Security ID”** to see whether the account type is as expected. | -| **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | -| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“New Logon\\Security ID”** that you are concerned about. | -| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** for names that don’t comply with naming conventions. | +| **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the high-value account or accounts. | +| **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"New Logon\\Security ID"** (with other information) to monitor how or when a particular account is being used. | +| **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the accounts that should never be used. | +| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "allow list-only" action, review the **"New Logon\\Security ID"** for accounts that are outside the allow list. | +| **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"New Logon\\Security ID"** to see whether the account type is as expected. | +| **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **"Subject\\Account Domain"** corresponding to accounts from another domain or "external" accounts. | +| **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"New Logon\\Security ID"** that you are concerned about. | +| **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor "**Subject\\Account Name"** for names that don’t comply with naming conventions. | -- Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **“Subject\\Security ID”** is not SYSTEM. +- Because this event is typically triggered by the SYSTEM account, we recommend that you report it whenever **"Subject\\Security ID"** is not SYSTEM. -- If “**Restricted Admin**” mode must be used for logons by certain accounts, use this event to monitor logons by “**New Logon\\Security ID**” in relation to “**Logon Type**”=10 and “**Restricted Admin Mode**”=”Yes”. If “**Restricted Admin Mode**”=”No” for these accounts, trigger an alert. +- If "**Restricted Admin**" mode must be used for logons by certain accounts, use this event to monitor logons by "**New Logon\\Security ID**" in relation to "**Logon Type**"=10 and "**Restricted Admin Mode**"="Yes". If "**Restricted Admin Mode**"="No" for these accounts, trigger an alert. -- If you need to monitor all logon events for accounts with administrator privileges, monitor this event with “**Elevated Token**”=”Yes”. +- If you need to monitor all logon events for accounts with administrator privileges, monitor this event with "**Elevated Token**"="Yes". -- If you need to monitor all logon events for managed service accounts and group managed service accounts, monitor for events with “**Virtual Account**”=”Yes”. +- If you need to monitor all logon events for managed service accounts and group managed service accounts, monitor for events with "**Virtual Account**"="Yes". -- To monitor for a mismatch between the logon type and the account that uses it (for example, if **Logon Type** 4-Batch or 5-Service is used by a member of a domain administrative group), monitor **Logon Type** in this event. +- To monitor for a mismatch between the logon type and the account that uses it (for example, if **Logon Type** 4-Batch or 5-Service is used by a member of a domain administrative group), monitor **Logon Type** in this event. -- If your organization restricts logons in the following ways, you can use this event to monitor accordingly: +- If your organization restricts logons in the following ways, you can use this event to monitor accordingly: - - If the user account **“New Logon\\Security ID”** should never be used to log on from the specific **Computer:**. + - If the user account **"New Logon\\Security ID"** should never be used to log on from the specific **Computer:**. - - If **New Logon\\Security ID** credentials should not be used from **Workstation Name** or **Source Network Address**. + - If **New Logon\\Security ID** credentials should not be used from **Workstation Name** or **Source Network Address**. - - If a specific account, such as a service account, should only be used from your internal IP address list (or some other list of IP addresses). In this case, you can monitor for **Network Information\\Source Network Address** and compare the network address with your list of IP addresses. + - If a specific account, such as a service account, should only be used from your internal IP address list (or some other list of IP addresses). In this case, you can monitor for **Network Information\\Source Network Address** and compare the network address with your list of IP addresses. - - If a particular version of NTLM is always used in your organization. In this case, you can use this event to monitor **Package Name (NTLM only)**, for example, to find events where **Package Name (NTLM only)** does not equal **NTLM V2**. + - If a particular version of NTLM is always used in your organization. In this case, you can use this event to monitor **Package Name (NTLM only)**, for example, to find events where **Package Name (NTLM only)** does not equal **NTLM V2**. - - If NTLM is not used in your organization, or should not be used by a specific account (**New Logon\\Security ID**). In this case, monitor for all events where **Authentication Package** is NTLM. + - If NTLM is not used in your organization, or should not be used by a specific account (**New Logon\\Security ID**). In this case, monitor for all events where **Authentication Package** is NTLM. - - If the **Authentication Package** is NTLM. In this case, monitor for **Key Length** not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length. + - If the **Authentication Package** is NTLM. In this case, monitor for **Key Length** not equal to 128, because all Windows operating systems starting with Windows 2000 support 128-bit Key Length. -- If you monitor for potentially malicious software, or software that is not authorized to request logon actions, monitor this event for **Process Name**. +- If you monitor for potentially malicious software, or software that is not authorized to request logon actions, monitor this event for **Process Name**. -- If you have a trusted logon processes list, monitor for a **Logon Process** that is not from the list. \ No newline at end of file +- If you have a trusted logon processes list, monitor for a **Logon Process** that is not from the list. From 2fbd55eb028644f182752b7b4e77ca1dd3942c68 Mon Sep 17 00:00:00 2001 From: Bruce Dawson Date: Mon, 29 Mar 2021 15:06:18 -0700 Subject: [PATCH 018/173] Clarify that Stop errors are _not_ app errors There is still confusion in BSOD analysis about whether a user-mode process can cause a stop error and it is important to clarify that they cannot. --- windows/client-management/troubleshoot-stop-errors.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 4d9ecb90f5..2557ff21a3 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -35,6 +35,8 @@ Our analysis of the root causes of crashes indicates the following: - 5 percent are caused by Microsoft code - 15 percent have unknown causes (because the memory is too corrupted to analyze) +Note that the root cause of Stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a Stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS. + ## General troubleshooting steps To troubleshoot Stop error messages, follow these general steps: From 4c5fbfe0c405382b1c24bb0e8fa77c70c4972214 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 30 Mar 2021 19:17:03 +0200 Subject: [PATCH 019/173] missing comma Add comma before "or" in "resources, activities or instances." Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/security/threat-protection/auditing/event-4624.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index cb86697ff3..21451eb110 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -219,7 +219,7 @@ This event generates when a logon session is created (on destination machine). I This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}". -> **Note**  **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances. +> **Note**  **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities, or instances. **Process Information:** From 105073233cdb3af66229956a1f5e6e7374d19fda Mon Sep 17 00:00:00 2001 From: Bruce Dawson Date: Tue, 30 Mar 2021 08:23:58 -1000 Subject: [PATCH 020/173] Tag as a note --- windows/client-management/troubleshoot-stop-errors.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 2557ff21a3..8d70fe9ea9 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -35,7 +35,8 @@ Our analysis of the root causes of crashes indicates the following: - 5 percent are caused by Microsoft code - 15 percent have unknown causes (because the memory is too corrupted to analyze) -Note that the root cause of Stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a Stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS. +>[!NOTE] +>Note that the root cause of Stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a Stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS. ## General troubleshooting steps From 46c9450f3d459912431513c6c0a086b496a391d4 Mon Sep 17 00:00:00 2001 From: Bruce Dawson Date: Tue, 30 Mar 2021 14:15:44 -0700 Subject: [PATCH 021/173] Update windows/client-management/troubleshoot-stop-errors.md Avoid redundant 'Note' Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/client-management/troubleshoot-stop-errors.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 8d70fe9ea9..c177b5826e 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -35,8 +35,8 @@ Our analysis of the root causes of crashes indicates the following: - 5 percent are caused by Microsoft code - 15 percent have unknown causes (because the memory is too corrupted to analyze) ->[!NOTE] ->Note that the root cause of Stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a Stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS. +> [!NOTE] +> The root cause of Stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a Stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS. ## General troubleshooting steps From d219731b6474fc41eee8792b6c1f0e9647c2ca0c Mon Sep 17 00:00:00 2001 From: Dan Pandre <54847950+DanPandre@users.noreply.github.com> Date: Thu, 1 Apr 2021 13:34:21 -0400 Subject: [PATCH 022/173] Document Whiteboard policy options --- .../client-management/mdm/surfacehub-csp.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 76b6dd8c04..ff96d2c80a 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -43,6 +43,10 @@ SurfaceHub ------------AutoWakeScreen ------------CurrentBackgroundPath ------------MeetingInfoOption +--------Whiteboard +------------SharingDisabled +------------SigninDisabled +------------TelemeteryDisabled --------WirelessProjection ------------PINRequired ------------Enabled @@ -305,6 +309,24 @@ SurfaceHub

The data type is integer. Supported operation is Get and Replace. +**InBoxApps/Whiteboard** +

Node for the Whiteboard app settings. + +**InBoxApps/Whiteboard/SharingDisabled** +

Invitations to collaborate from the Whiteboard app are not allowed. + +

The data type is boolean. Supported operation is Get and Replace. + +**InBoxApps/Whiteboard/SigninDisabled** +

Sign-ins from the Whiteboard app are not allowed. + +

The data type is boolean. Supported operation is Get and Replace. + +**InBoxApps/Whiteboard/TelemeteryDisabled** +

Telemetry collection from the Whiteboard app is not allowed. + +

The data type is boolean. Supported operation is Get and Replace. + **InBoxApps/WirelessProjection**

Node for the wireless projector app settings. From 1cf9bd401540d909e6cad36dba1b45dff5348359 Mon Sep 17 00:00:00 2001 From: v-hearya Date: Fri, 2 Apr 2021 04:41:56 +0530 Subject: [PATCH 023/173] bitlocker-to-go-faq.md converted into yml --- .../security/information-protection/TOC.md | 2 +- .../bitlocker-frequently-asked-questions.md | 2 +- .../bitlocker/bitlocker-to-go-faq.md | 37 ----------------- .../bitlocker/bitlocker-to-go-faq.yml | 41 +++++++++++++++++++ 4 files changed, 43 insertions(+), 39 deletions(-) delete mode 100644 windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md create mode 100644 windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index 442b60a184..ca14447d5a 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -7,7 +7,7 @@ #### [Upgrading](bitlocker\bitlocker-upgrading-faq.md) #### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml) #### [Key management](bitlocker\bitlocker-key-management-faq.md) -#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md) +#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.yml) #### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md) #### [Security](bitlocker\bitlocker-security-faq.md) #### [BitLocker Network Unlock](bitlocker\bitlocker-network-unlock-faq.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 17dc16832a..71180f242a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -29,7 +29,7 @@ This topic links to frequently asked questions about BitLocker. BitLocker is a d - [Upgrading](bitlocker-upgrading-faq.md) - [Deployment and administration](bitlocker-deployment-and-administration-faq.yml) - [Key management](bitlocker-key-management-faq.md) -- [BitLocker To Go](bitlocker-to-go-faq.md) +- [BitLocker To Go](bitlocker-to-go-faq.yml) - [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) - [Security](bitlocker-security-faq.md) - [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md deleted file mode 100644 index 3459f65651..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: BitLocker To Go FAQ (Windows 10) -description: "Learn more about BitLocker To Go: BitLocker drive encryption for removable drives." -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.author: dansimp -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 07/10/2018 -ms.custom: bitlocker ---- - -# BitLocker To Go FAQ - -**Applies to** -- Windows 10 - -## What is BitLocker To Go? - -BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of: - -- USB flash drives -- SD cards -- External hard disk drives -- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. - -Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). - -As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**. \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml new file mode 100644 index 0000000000..e28fda09ee --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml @@ -0,0 +1,41 @@ +### YamlMime:FAQ +metadata: + title: BitLocker To Go FAQ (Windows 10) + description: "Learn more about BitLocker To Go" + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.author: dansimp + ms.prod: w10 + ms.mktglfcycl: deploy + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 07/10/2018 + ms.custom: bitlocker + +title: BitLocker To Go FAQ +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: What is BitLocker To Go? + answer: | + BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of: + + - USB flash drives + - SD cards + - External hard disk drives + - Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. + + Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements). + + As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**. From 6342ba360332b5d14e1d753770258c6e4afa2357 Mon Sep 17 00:00:00 2001 From: v-hearya Date: Fri, 2 Apr 2021 04:49:55 +0530 Subject: [PATCH 024/173] bitlocker-and-adds-faq.md converted into yml --- .../bitlocker/bitlocker-and-adds-faq.md | 73 ---------------- .../bitlocker/bitlocker-and-adds-faq.yml | 83 +++++++++++++++++++ .../bitlocker-frequently-asked-questions.md | 2 +- .../bitlocker/ts-bitlocker-recovery-issues.md | 4 +- 4 files changed, 86 insertions(+), 76 deletions(-) delete mode 100644 windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md create mode 100644 windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md deleted file mode 100644 index c248a61b46..0000000000 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) -description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure. -ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee -ms.reviewer: -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/28/2019 -ms.custom: bitlocker ---- - -# BitLocker and Active Directory Domain Services (AD DS) FAQ - -**Applies to** -- Windows 10 - - -## What type of information is stored in AD DS? - -Stored information | Description --------------------|------------ -Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in. -BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). -BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`. - -## What if BitLocker is enabled on a computer before the computer has joined the domain? - -If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. - -For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: - -```PowerShell -$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive -$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } - -Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID -BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID -``` - -> [!IMPORTANT] -> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). - -## Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? - -Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. - -Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. - -## If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? - -No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. - -## What happens if the backup initially fails? Will BitLocker retry it? - -If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. - -When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. - -For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - -When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. - diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml new file mode 100644 index 0000000000..933460ca69 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml @@ -0,0 +1,83 @@ +### YamlMime:FAQ +metadata: + title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) + description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure. + ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee + ms.reviewer: + ms.prod: w10 + ms.mktglfcycl: explore + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: dansimp + ms.author: dansimp + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: conceptual + ms.date: 02/28/2019 + ms.custom: bitlocker + +title: BitLocker and Active Directory Domain Services (AD DS) FAQ +summary: | + **Applies to** + - Windows 10 + + + +sections: + - name: Ignored + questions: + - question: | + What type of information is stored in AD DS? + answer: | + Stored information | Description + -------------------|------------ + Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in. + BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md). + BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`. + + - question: | + What if BitLocker is enabled on a computer before the computer has joined the domain? + answer: | + If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS. + + For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + + The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: + + ```PowerShell + $BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive + $RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } + + Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID + BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID + ``` + + > [!IMPORTANT] + > Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). + + - question: | + Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? + answer: | + Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. + + Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool. + + - question: | + If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? + answer: | + No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. + + - question: | + What happens if the backup initially fails? Will BitLocker retry it? + answer: | + If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. + + When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. + + For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). + + When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. + + \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 71180f242a..da0a5da50c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -30,7 +30,7 @@ This topic links to frequently asked questions about BitLocker. BitLocker is a d - [Deployment and administration](bitlocker-deployment-and-administration-faq.yml) - [Key management](bitlocker-key-management-faq.md) - [BitLocker To Go](bitlocker-to-go-faq.yml) -- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md) +- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.yml) - [Security](bitlocker-security-faq.md) - [BitLocker Network Unlock](bitlocker-network-unlock-faq.md) - [Using BitLocker with other programs and general questions](bitlocker-using-with-other-programs-faq.md) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index fa3e9c8fe1..7f54bde194 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -31,8 +31,8 @@ Windows 10 prompts you for a BitLocker recovery password. However, you did not c The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situations that may produce this symptom, and provides information about how to resolve the issue: -- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.md#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) -- [What happens if the backup initially fails? Will BitLocker retry the backup?](./bitlocker-and-adds-faq.md) +- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.yml#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) +- [What happens if the backup initially fails? Will BitLocker retry the backup?](./) ## The recovery password for a laptop was not backed up, and the laptop is locked From 81f44ac1d1096459763885d21f4a5b375365f342 Mon Sep 17 00:00:00 2001 From: v-hearya Date: Fri, 2 Apr 2021 05:22:16 +0530 Subject: [PATCH 025/173] warnings fixed --- windows/security/information-protection/TOC.md | 2 +- .../bitlocker/bitlocker-and-adds-faq.yml | 2 +- .../bitlocker/bitlocker-frequently-asked-questions.md | 2 +- .../bitlocker/ts-bitlocker-recovery-issues.md | 9 +++++---- 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index ca14447d5a..534c27ef47 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -8,7 +8,7 @@ #### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml) #### [Key management](bitlocker\bitlocker-key-management-faq.md) #### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.yml) -#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md) +#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.yml) #### [Security](bitlocker\bitlocker-security-faq.md) #### [BitLocker Network Unlock](bitlocker\bitlocker-network-unlock-faq.md) #### [General](bitlocker\bitlocker-using-with-other-programs-faq.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml index 933460ca69..21493aca12 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml @@ -78,6 +78,6 @@ sections: For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored. + When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) to capture the information after connectivity is restored. \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index da0a5da50c..ff365150c9 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -45,4 +45,4 @@ This topic links to frequently asked questions about BitLocker. BitLocker is a d - [BitLocker: How to deploy on Windows Server 2012](bitlocker-how-to-deploy-on-windows-server.md) - [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md) - [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md) -- [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps) \ No newline at end of file +- [BitLocker Cmdlets in Windows PowerShell](/powershell/module/bitlocker/index?view=win10-ps&preserve-view=true) \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index 7f54bde194..7ba542aced 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -31,8 +31,9 @@ Windows 10 prompts you for a BitLocker recovery password. However, you did not c The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situations that may produce this symptom, and provides information about how to resolve the issue: -- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.yml#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) -- [What happens if the backup initially fails? Will BitLocker retry the backup?](./) +- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.yml#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) + +- [What happens if the backup initially fails? Will BitLocker retry the backup?](./bitlocker-and-adds-faq.yml) ## The recovery password for a laptop was not backed up, and the laptop is locked @@ -201,9 +202,9 @@ To reset the PCR settings on the TPM, follow these steps: You can avoid this scenario when you install updates to system firmware or TPM firmware by temporarily suspending BitLocker before you apply such updates. > [!IMPORTANT] -> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps) and set the **Reboot Count** parameter to either of the following values: +> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps&preserve-view=true) and set the **Reboot Count** parameter to either of the following values: > - **2** or greater: This value sets the number of times the device can restart before BitLocker Device Encryption resumes. -> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps) or another mechanism to resume protection. +> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps&preserve-view=true) or another mechanism to resume protection. To suspend BitLocker while you install TPM or UEFI firmware updates: From f3f4eabee50fbff729f243ab0382fe71382c9f16 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 5 Apr 2021 10:33:54 -0700 Subject: [PATCH 026/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...-baselines-microsoft-defender-antivirus.md | 39 +++++++++++++------ 1 file changed, 27 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 91377e19b2..81fc3644b9 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,18 +13,16 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr manager: dansimp -ms.date: 03/19/2021 +ms.date: 04/05/2021 ms.technology: mde --- # Manage Microsoft Defender Antivirus updates and apply baselines -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - **Applies to:** - [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) +- Microsoft Defender Antivirus There are two types of updates related to keeping Microsoft Defender Antivirus up to date: @@ -78,6 +76,23 @@ All our updates contain

+ March-2021 (Platform: 4.18.2103.5 | Engine: 1.1.18000.5) + + Security intelligence update version: **1.335.36.0** + Released: **April 1, 2021** + Platform: **4.18.2103.5** + Engine: **1.1.18000.5** + Support phase: **Security and Critical Updates** + +### What's new + +- item +- item + +### Known Issues +No known issues +
+
February-2021 (Platform: 4.18.2102.3 | Engine: 1.1.17900.7)  Security intelligence update version: **1.333.7.0** @@ -115,7 +130,13 @@ No known issues ### Known Issues No known issues
-
+
+ +### Previous version updates: Technical upgrade support only + +After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only. +

+
November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4)  Security intelligence update version: **1.327.1854.0** @@ -131,13 +152,7 @@ No known issues ### Known Issues No known issues
-
- -### Previous version updates: Technical upgrade support only - -After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only. -

-
+
October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5)  Security intelligence update version: **1.327.7.0** From 6bef434dfefd005fb1180cf529c20c30b1b0b008 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 5 Apr 2021 10:35:35 -0700 Subject: [PATCH 027/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...manage-updates-baselines-microsoft-defender-antivirus.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 81fc3644b9..40423c50b8 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -76,11 +76,11 @@ All our updates contain

- March-2021 (Platform: 4.18.2103.5 | Engine: 1.1.18000.5) + March-2021 (Platform: 4.18.2102.4 | Engine: 1.1.18000.5) - Security intelligence update version: **1.335.36.0** + Security intelligence update version: **1.335.272.0**  Released: **April 1, 2021** - Platform: **4.18.2103.5** + Platform: **4.18.2102.4**  Engine: **1.1.18000.5**  Support phase: **Security and Critical Updates** From 80817f131dc61beb46821914e5d36a020ec876de Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 5 Apr 2021 10:44:45 -0700 Subject: [PATCH 028/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...tes-baselines-microsoft-defender-antivirus.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 91377e19b2..bd67d6ed4f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr manager: dansimp -ms.date: 03/19/2021 +ms.date: 04/02/2021 ms.technology: mde --- @@ -425,6 +425,20 @@ We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Wind For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images).
+1.1.2104.01 + + Package version: **1.1.2104.01** + Platform version: **4.18.2102.4** + Engine version: **1.18000.5** + Signature version: **1.335.232.0** + +### Fixes +- None + +### Additional information +- None +
+
1.1.2103.01  Package version: **1.1.2103.01** From ec6d0d8fbc626d908ec5fc4df00d05548c66b65d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 5 Apr 2021 16:44:16 -0700 Subject: [PATCH 029/173] Update understanding-malware.md --- .../intelligence/understanding-malware.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md index 252ae4f268..5ce86ce593 100644 --- a/windows/security/threat-protection/intelligence/understanding-malware.md +++ b/windows/security/threat-protection/intelligence/understanding-malware.md @@ -40,6 +40,11 @@ There are many types of malware, including: - [Unwanted software](unwanted-software.md) - [Worms](worms-malware.md) -Keep up with the latest malware news and research. Check out our [Microsoft security blogs](https://www.microsoft.com/security/blog/product/windows/) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections. +## Additional resources and information + +- Keep up with the latest malware news and research. Check out our [Microsoft security blogs](https://www.microsoft.com/security/blog/product/windows/) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections. + +- Learn more about [Windows security](../../index.yml). + +- Learn how to [deploy threat protection capabilities across Microsoft 365 E5](/microsoft-365/solutions/deploy-threat-protection). -Learn more about [Windows security](../../index.yml). \ No newline at end of file From 9e35b7872960d59badb1716010c7f2ceaaa07017 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 5 Apr 2021 16:45:41 -0700 Subject: [PATCH 030/173] Update fileless-threats.md --- .../threat-protection/intelligence/fileless-threats.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index 0aef1cf896..98da71d16d 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -101,4 +101,8 @@ Besides being vulnerable at the firmware level, CPUs could be manufactured with At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions to mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender for Endpoint](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. -To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) \ No newline at end of file +To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) + +## Additional resources and information + +Learn how to [deploy threat protection capabilities across Microsoft 365 E5](/microsoft-365/solutions/deploy-threat-protection). From 24579363cf87c655f7b3b0f18d975b3172a535ac Mon Sep 17 00:00:00 2001 From: navneetanand1 <68837633+navneetanand1@users.noreply.github.com> Date: Tue, 6 Apr 2021 12:59:40 +0530 Subject: [PATCH 031/173] Update manage-updates-baselines-microsoft-defender-antivirus.md Added the missing 1. suffix for each engine version --- ...s-baselines-microsoft-defender-antivirus.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index bd67d6ed4f..5923d02d26 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -429,7 +429,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2104.01**  Platform version: **4.18.2102.4** - Engine version: **1.18000.5** + Engine version: **1.1.18000.5**  Signature version: **1.335.232.0** ### Fixes @@ -443,7 +443,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2103.01**  Platform version: **4.18.2101.9** - Engine version: **1.17800.5** + Engine version: **1.1.17800.5**  Signature version: **1.331.2302.0** ### Fixes @@ -457,7 +457,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2102.03**  Platform version: **4.18.2011.6** - Engine version: **1.17800.5** + Engine version: **1.1.17800.5**  Signature version: **1.331.174.0** ### Fixes @@ -471,7 +471,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2101.02**  Platform version: **4.18.2011.6** - Engine version: **1.17700.4** + Engine version: **1.1.17700.4**  Signature version: **1.329.1796.0** ### Fixes @@ -485,7 +485,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2012.01**  Platform version: **4.18.2010.7** - Engine version: **1.17600.5** + Engine version: **1.1.17600.5**  Signature version: **1.327.1991.0** ### Fixes @@ -499,7 +499,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2011.02**  Platform version: **4.18.2010.7** - Engine version: **1.17600.5** + Engine version: **1.1.17600.5**  Signature version: **1.327.658.0** ### Fixes @@ -513,7 +513,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2011.01**  Platform version: **4.18.2009.7** - Engine version: **1.17600.5** + Engine version: **1.1.17600.5**  Signature version: **1.327.344.0** ### Fixes @@ -527,7 +527,7 @@ For more information, see [Microsoft Defender update for Windows operating syste  Package version: **1.1.2011.01**  Platform version: **4.18.2008.9** - Engine version: **1.17400.5** + Engine version: **1.1.17400.5**  Signature version: **1.327.2216.0** ### Fixes @@ -547,4 +547,4 @@ For more information, see [Microsoft Defender update for Windows operating syste |[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. | |[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. | |[Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | You can set protection updates to be downloaded at startup or after certain cloud-delivered protection events. | -|[Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)| You can specify settings, such as whether updates should occur on battery power, that are especially useful for mobile devices and virtual machines. | \ No newline at end of file +|[Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)| You can specify settings, such as whether updates should occur on battery power, that are especially useful for mobile devices and virtual machines. | From d66654c02ce633d842bf7ff18516ec037fc17312 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 6 Apr 2021 10:54:25 +0100 Subject: [PATCH 032/173] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index dccf2b6ba4..91517590b5 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1766,7 +1766,7 @@ If you're running Windows 10, version 1607 or later, you need to: -or- - - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** + - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** This policy setting controls whether the lock screen appears for users. The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen. @@ -1918,4 +1918,4 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre |www.microsoft.com/pkiops/*| -To learn more, see [Device update management](/windows/client-management/mdm/device-update-management) and [Configure Automatic Updates by using Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720539(v=ws.10)). \ No newline at end of file +To learn more, see [Device update management](/windows/client-management/mdm/device-update-management) and [Configure Automatic Updates by using Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc720539(v=ws.10)). From f51f9a668ca3fe5074b401f822ba34159a01cb4b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 6 Apr 2021 12:59:48 -0700 Subject: [PATCH 033/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 5923d02d26..f31f918b91 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr manager: dansimp -ms.date: 04/02/2021 +ms.date: 04/06/2021 ms.technology: mde --- From 31b8320007213cbaf313d4b1c91cc2a9e6fe405e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 6 Apr 2021 15:48:30 -0700 Subject: [PATCH 034/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index fec89b4964..c59ead8d8f 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -86,6 +86,7 @@ All our updates contain ### What's new +- Additional failed tampering attempt event generation when [Tamper Protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled - item - item @@ -120,7 +121,6 @@ No known issues ### What's new -- Additional failed tampering attempt event generation when [Tamper Protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled - Shellcode exploit detection improvements - Increased visibility for credential stealing attempts - Improvements in antitampering features in Microsoft Defender Antivirus services From 50e59a0a1c76c7be88fc1661096c7eadc644d50e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 6 Apr 2021 15:49:23 -0700 Subject: [PATCH 035/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index c59ead8d8f..88a5e7338c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -76,11 +76,11 @@ All our updates contain

- March-2021 (Platform: 4.18.2102.4 | Engine: 1.1.18000.5) + March-2021 (Platform: 4.18.2103.6 | Engine: 1.1.18000.5)  Security intelligence update version: **1.335.272.0**  Released: **April 1, 2021** - Platform: **4.18.2102.4** + Platform: **4.18.2103.6**  Engine: **1.1.18000.5**  Support phase: **Security and Critical Updates** From a82d0238252971abe5329d087ba8f3a0a605444e Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 7 Apr 2021 10:59:15 +0300 Subject: [PATCH 036/173] comma is not needed after URL if you don't use proxy https://github.com/MicrosoftDocs/windows-itpro-docs/issues/9095 --- .../create-wip-policy-using-intune-azure.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 2ec7a43e9b..e7eae9cecf 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -427,7 +427,6 @@ For each cloud resource, you may also optionally specify a proxy server from you Be aware that all traffic routed through your Internal proxy servers is considered enterprise. Separate multiple resources with the "|" delimiter. -If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: ```console @@ -629,4 +628,4 @@ You can restrict which files are protected by WIP when they are downloaded from - [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/) >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From 34fc5b8a4a71b4771a3e507ff735607f6e73b564 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 7 Apr 2021 17:14:10 +0300 Subject: [PATCH 037/173] Update windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../create-wip-policy-using-intune-azure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index e7eae9cecf..120313a70a 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -628,4 +628,4 @@ You can restrict which files are protected by WIP when they are downloaded from - [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/) >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +> Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From 1749263b1236a928ab6392e5ce1c974f27d24dce Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Wed, 7 Apr 2021 17:14:27 +0300 Subject: [PATCH 038/173] Update windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../create-wip-policy-using-intune-azure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 120313a70a..c10b2990b3 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -627,5 +627,5 @@ You can restrict which files are protected by WIP when they are downloaded from - [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/) ->[!NOTE] +> [!NOTE] > Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). From 8cc57f8b6965851907ac2b1a332b6721c7018d0c Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Wed, 7 Apr 2021 09:15:26 -0700 Subject: [PATCH 039/173] pencil edits --- .../bitlocker/ts-bitlocker-recovery-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index 7ba542aced..9d48930488 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -202,9 +202,9 @@ To reset the PCR settings on the TPM, follow these steps: You can avoid this scenario when you install updates to system firmware or TPM firmware by temporarily suspending BitLocker before you apply such updates. > [!IMPORTANT] -> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps&preserve-view=true) and set the **Reboot Count** parameter to either of the following values: +> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps&preserve-view=true) and set the **Reboot Count** parameter to either of the following values: > - **2** or greater: This value sets the number of times the device can restart before BitLocker Device Encryption resumes. -> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps&preserve-view=true) or another mechanism to resume protection. +> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps&preserve-view=true) or another mechanism to resume protection. To suspend BitLocker while you install TPM or UEFI firmware updates: @@ -289,4 +289,4 @@ For more information about this technology, see [Windows Defender System Guard: To resolve this issue, do one of the following: - Remove any device that uses TPM 1.2 from any group that is subject to Group Policy Objects (GPOs) that enforce Secure Launch. -- Edit the **Turn On Virtualization Based Security** GPO to set **Secure Launch Configuration** to **Disabled**. \ No newline at end of file +- Edit the **Turn On Virtualization Based Security** GPO to set **Secure Launch Configuration** to **Disabled**. From 61291e23506c7a8d6f155217834cb71d6c212611 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Apr 2021 14:52:43 -0700 Subject: [PATCH 040/173] Corrected note style; corrected note indentation; corrected font weight of table headings Table headings are bold by default. Adding formatting for bold results in a lighter weight font than is standard for table headings. --- .../threat-protection/auditing/event-4624.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 21451eb110..e4da43c073 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -29,7 +29,8 @@ ms.technology: mde This event generates when a logon session is created (on destination machine). It generates on the computer that was accessed, where the session was created. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
@@ -122,7 +123,8 @@ This event generates when a logon session is created (on destination machine). I - **Security ID** [Type = SID]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** [Type = UnicodeString]**:** the name of the account that reported information about successful logon. @@ -185,7 +187,8 @@ This event generates when a logon session is created (on destination machine). I - **Security ID** [Type = SID]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** [Type = UnicodeString]**:** the name of the account for which logon was performed. @@ -219,7 +222,8 @@ This event generates when a logon session is created (on destination machine). I This parameter might not be captured in the event, and in that case appears as "{00000000-0000-0000-0000-000000000000}". -> **Note**  **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities, or instances. + > [!NOTE] + > **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities, or instances. **Process Information:** @@ -277,8 +281,8 @@ This event generates when a logon session is created (on destination machine). I For 4624(S): An account was successfully logged on. -| **Type of monitoring required** | **Recommendation** | -|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Type of monitoring required | Recommendation | +|-----------------------------|-------------------------| | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"New Logon\\Security ID"** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the accounts that should never be used. | From 0915fd66005bf339e90d5739183f02bb22f0e5e8 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Apr 2021 15:07:25 -0700 Subject: [PATCH 041/173] Remove alignment to move note box off of the image --- windows/security/threat-protection/auditing/event-4624.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index e4da43c073..f34d8e3ae4 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -21,7 +21,7 @@ ms.technology: mde - Windows Server 2016 -Event 4624 illustration +Event 4624 illustration ***Subcategory:*** [Audit Logon](audit-logon.md) From 38abc228699dae47501786a1fa49229369905753 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Apr 2021 16:17:25 -0700 Subject: [PATCH 042/173] Moved note about "it" to immediately follow apparent it --- .../credential-guard/credential-guard-manage.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 911041368f..6872bdb85b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -59,12 +59,12 @@ To enforce processing of the group policy, you can run ```gpupdate /force```. 3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. + > [!NOTE] + > It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. + > [!TIP] > You can also configure Credential Guard using an account protection profile in endpoint security. See [Account protection policy settings for endpoint security in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings). -> [!NOTE] -> It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. - ### Enable Windows Defender Credential Guard by using the registry If you don't use Group Policy, you can enable Windows Defender Credential Guard by using the registry. Windows Defender Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. From d5bafe4693e93dbce98a64582c3205741b2df749 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Apr 2021 16:19:45 -0700 Subject: [PATCH 043/173] Changed second-level sequential list to enumerated --- .../credential-guard/credential-guard-manage.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 6872bdb85b..9183d13f28 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -120,17 +120,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic 2. Enable virtualization-based security: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. + 1. Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\DeviceGuard. - - Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. + 1. Add a new DWORD value named **EnableVirtualizationBasedSecurity**. Set the value of this registry setting to 1 to enable virtualization-based security and set it to 0 to disable it. - - Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. + 1. Add a new DWORD value named **RequirePlatformSecurityFeatures**. Set the value of this registry setting to 1 to use **Secure Boot** only or set it to 3 to use **Secure Boot and DMA protection**. 3. Enable Windows Defender Credential Guard: - - Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. + 1. Go to HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA. - - Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it. + 1. Add a new DWORD value named **LsaCfgFlags**. Set the value of this registry setting to 1 to enable Windows Defender Credential Guard with UEFI lock, set it to 2 to enable Windows Defender Credential Guard without lock, and set it to 0 to disable it. 4. Close Registry Editor. From 3118103fbff9878aece9f54b20d6b7f11e83acb5 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Apr 2021 16:35:07 -0700 Subject: [PATCH 044/173] Minor corrections --- .../credential-guard/credential-guard-manage.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 9183d13f28..7e9ef6ad60 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -63,7 +63,7 @@ To enforce processing of the group policy, you can run ```gpupdate /force```. > It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. > [!TIP] -> You can also configure Credential Guard using an account protection profile in endpoint security. See [Account protection policy settings for endpoint security in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings). +> You can also configure Credential Guard by using an account protection profile in endpoint security. See [Account protection policy settings for endpoint security in Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-account-protection-profile-settings). ### Enable Windows Defender Credential Guard by using the registry @@ -167,7 +167,8 @@ You can view System Information to check that Windows Defender Credential Guard Here's an example: - ![System Information](images/credguard-msinfo32.png) + > [!div class="mx-imgBorder"] + > ![System Information](images/credguard-msinfo32.png) You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). @@ -261,7 +262,7 @@ To disable Windows Defender Credential Guard, you can use the following set of p > [!NOTE] > The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings: > - >``` + >```console >bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS >bcdedit /set vsmlaunchtype off >``` @@ -277,7 +278,7 @@ For more info on virtualization-based security and HVCI, see [Enable virtualizat You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). -```console +```powershell DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot ``` From e4d6704380bb28c17554a38c470c3a7c6e047724 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 8 Apr 2021 09:01:03 -0700 Subject: [PATCH 045/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- .../manage-updates-baselines-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 88a5e7338c..32b88eb743 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: pahuijbr manager: dansimp -ms.date: 04/06/2021 +ms.date: 04/08/2021 ms.technology: mde --- From 31b169e71192eda3d5d93a7c14b9a2c0fd603bc5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 8 Apr 2021 09:03:34 -0700 Subject: [PATCH 046/173] Update manage-updates-baselines-microsoft-defender-antivirus.md --- ...nage-updates-baselines-microsoft-defender-antivirus.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md index 32b88eb743..f3be51a2ca 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md @@ -78,17 +78,17 @@ All our updates contain
March-2021 (Platform: 4.18.2103.6 | Engine: 1.1.18000.5) - Security intelligence update version: **1.335.272.0** + Security intelligence update version: **1.335.36.0**  Released: **April 1, 2021** - Platform: **4.18.2103.6** + Platform: **4.19.2103.6**  Engine: **1.1.18000.5**  Support phase: **Security and Critical Updates** ### What's new +- Improvement to the Behavior Monitoring engine +- Expanded network brute-force-attack mitigations - Additional failed tampering attempt event generation when [Tamper Protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled -- item -- item ### Known Issues No known issues From e24bfcfb2e53b5786d49e862afd5cc6650978ac0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 8 Apr 2021 16:48:24 -0700 Subject: [PATCH 047/173] moved articles to microsoft-365-docs-pr repo --- ...llect-diagnostic-data-update-compliance.md | 69 - .../collect-diagnostic-data.md | 117 - ...-arguments-microsoft-defender-antivirus.md | 83 - ...n-mistakes-microsoft-defender-antivirus.md | 61 - ...-reference-microsoft-defender-antivirus.md | 46 - ...scan-types-microsoft-defender-antivirus.md | 95 - ...irst-sight-microsoft-defender-antivirus.md | 176 - ...out-period-microsoft-defender-antivirus.md | 56 - ...nteraction-microsoft-defender-antivirus.md | 38 - ...exclusions-microsoft-defender-antivirus.md | 54 - ...exclusions-microsoft-defender-antivirus.md | 362 -- ...-overrides-microsoft-defender-antivirus.md | 95 - ...e-microsoft-defender-antivirus-features.md | 52 - ...onnections-microsoft-defender-antivirus.md | 127 - ...ifications-microsoft-defender-antivirus.md | 109 - ...exclusions-microsoft-defender-antivirus.md | 188 - ...n-features-microsoft-defender-antivirus.md | 46 - ...protection-microsoft-defender-antivirus.md | 136 - ...emediation-microsoft-defender-antivirus.md | 73 - ...exclusions-microsoft-defender-antivirus.md | 339 -- ...iate-scans-microsoft-defender-antivirus.md | 40 - ...ediate-scans-windows-defender-antivirus.md | 40 - ...age-report-microsoft-defender-antivirus.md | 88 - .../deploy-microsoft-defender-antivirus.md | 41 - ...oyment-vdi-microsoft-defender-antivirus.md | 238 -- ...anted-apps-microsoft-defender-antivirus.md | 188 - ...protection-microsoft-defender-antivirus.md | 152 - .../evaluate-microsoft-defender-antivirus.md | 56 - ...c-scanning-microsoft-defender-antivirus.md | 53 - ...ed-updates-microsoft-defender-antivirus.md | 163 - ...-endpoints-microsoft-defender-antivirus.md | 185 - ...e-schedule-microsoft-defender-antivirus.md | 104 - ...on-updates-microsoft-defender-antivirus.md | 263 -- ...-baselines-microsoft-defender-antivirus.md | 565 --- ...evices-vms-microsoft-defender-antivirus.md | 98 - ...rosoft-defender-antivirus-compatibility.md | 128 - ...rosoft-defender-antivirus-in-windows-10.md | 61 - ...fender-antivirus-on-windows-server-2016.md | 218 -- .../microsoft-defender-offline.md | 139 - ...soft-defender-security-center-antivirus.md | 136 - ...office-365-microsoft-defender-antivirus.md | 88 - ...ecurity-settings-with-tamper-protection.md | 296 -- ...nteraction-microsoft-defender-antivirus.md | 89 - ...rt-monitor-microsoft-defender-antivirus.md | 49 - ...ined-files-microsoft-defender-antivirus.md | 45 - ...an-results-microsoft-defender-antivirus.md | 66 - .../run-scan-microsoft-defender-antivirus.md | 98 - ...h-up-scans-microsoft-defender-antivirus.md | 243 -- ...tion-level-microsoft-defender-antivirus.md | 91 - ...osoft-defender-antivirus-when-migrating.md | 136 - ...oubleshoot-microsoft-defender-antivirus.md | 3246 ----------------- .../troubleshoot-reporting.md | 73 - ...oup-policy-microsoft-defender-antivirus.md | 144 - ...ig-manager-microsoft-defender-antivirus.md | 51 - ...ll-cmdlets-microsoft-defender-antivirus.md | 65 - .../use-wmi-microsoft-defender-antivirus.md | 44 - ...protection-microsoft-defender-antivirus.md | 88 - .../why-use-microsoft-defender-antivirus.md | 54 - 58 files changed, 10244 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md deleted file mode 100644 index f0c5ccff46..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Collect diagnostic data for Update Compliance and Windows Defender Microsoft Defender Antivirus -description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add in -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Collect Update Compliance diagnostic data for Microsoft Defender AV Assessment - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV Assessment section in the Update Compliance add-in. - -Before attempting this process, ensure you have read [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps. - -On at least two devices that are not reporting or showing up in Update Compliance, obtain the .cab diagnostic file by taking the following steps: - -1. Open an administrator-level version of the command prompt as follows: - - a. Open the **Start** menu. - - b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. - - c. Enter administrator credentials or approve the prompt. - -2. Navigate to the Windows Defender directory. By default, this is `C:\Program Files\Windows Defender`. - -3. Type the following command, and then press **Enter** - - ```Dos - mpcmdrun -getfiles - ``` - -4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. - -5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. - -6. Send an email using the Update Compliance support email template, and fill out the template with the following information: - - ``` - I am encountering the following issue when using Microsoft Defender Antivirus in Update Compliance: - - I have provided at least 2 support .cab files at the following location: - - My OMS workspace ID is: - - Please contact me at: - ``` - -## See also - -- [Troubleshoot Windows Defender Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md deleted file mode 100644 index a5e9c835a5..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md +++ /dev/null @@ -1,117 +0,0 @@ ---- -title: Collect diagnostic data of Microsoft Defender Antivirus -description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender av, group policy object, setting, diagnostic data -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 06/29/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Collect Microsoft Defender AV diagnostic data - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you might encounter when using the Microsoft Defender AV. - -> [!NOTE] -> As part of the investigation or response process, you can collect an investigation package from a device. Here's how: [Collect investigation package from devices](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#collect-investigation-package-from-devices). - -On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps: - -1. Open an administrator-level version of the command prompt as follows: - - a. Open the **Start** menu. - - b. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**. - - c. Enter administrator credentials or approve the prompt. - -2. Navigate to the Microsoft Defender directory. By default, this is `C:\Program Files\Windows Defender`. - -> [!NOTE] -> If you're running an [updated Microsoft Defender Platform version](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform), please run `MpCmdRun` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\`. - -3. Type the following command, and then press **Enter** - - ```Dos - mpcmdrun.exe -GetFiles - ``` - -4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`. - -> [!NOTE] -> To redirect the cab file to a a different path or UNC share, use the following command: `mpcmdrun.exe -GetFiles -SupportLogLocation `
For more information, see [Redirect diagnostic data to a UNC share](#redirect-diagnostic-data-to-a-unc-share). - -5. Copy these .cab files to a location that can be accessed by Microsoft support. An example could be a password-protected OneDrive folder that you can share with us. - -> [!NOTE] ->If you have a problem with Update compliance, send an email using the Update Compliance support email template, and fill out the template with the following information: ->``` -> I am encountering the following issue when using Microsoft Defender Antivirus in Update Compliance: -> I have provided at least 2 support .cab files at the following location: -> -> -> My OMS workspace ID is: -> -> Please contact me at: - -## Redirect diagnostic data to a UNC share -To collect diagnostic data on a central repository, you can specify the SupportLogLocation parameter. - -```Dos -mpcmdrun.exe -GetFiles -SupportLogLocation -``` - -Copies the diagnostic data to the specified path. If the path is not specified, the diagnostic data will be copied to the location specified in the Support Log Location Configuration. - -When the SupportLogLocation parameter is used, a folder structure like as follows will be created in the destination path: - -```Dos -\\MpSupport--.cab -``` - -| field | Description | -|:----|:----| -| path | The path as specified on the command line or retrieved from configuration -| MMDD | Month and day when the diagnostic data was collected (for example, 0530) -| hostname | The hostname of the device on which the diagnostic data was collected -| HHMM | Hours and minutes when the diagnostic data was collected (for example, 1422) - -> [!NOTE] -> When using a file share please make sure that account used to collect the diagnostic package has write access to the share. - -## Specify location where diagnostic data is created - -You can also specify where the diagnostic .cab file will be created using a Group Policy Object (GPO). - -1. Open the Local Group Policy Editor and find the SupportLogLocation GPO at: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SupportLogLocation` - -1. Select **Define the directory path to copy support log files**. - - ![Screenshot of local group policy editor](images/GPO1-SupportLogLocationDefender.png) - - ![Screenshot of define path for log files setting](images/GPO2-SupportLogLocationGPPage.png) -3. Inside the policy editor, select **Enabled**. - -4. Specify the directory path where you want to copy the support log files in the **Options** field. - ![Screenshot of Enabled directory path custom setting](images/GPO3-SupportLogLocationGPPageEnabledExample.png) -5. Select **OK** or **Apply**. - -## See also - -- [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md deleted file mode 100644 index 7cbbfa8d22..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: Use the command line to manage Microsoft Defender Antivirus -description: Run Microsoft Defender Antivirus scans and configure next-generation protection with a dedicated command-line utility. -keywords: run windows defender scan, run antivirus scan from command line, run windows defender scan from command line, mpcmdrun, defender -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: ksarens -manager: dansimp -ms.date: 03/19/2021 -ms.technology: mde ---- - -# Configure and manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can perform various Microsoft Defender Antivirus functions with the dedicated command-line tool **mpcmdrun.exe**. This utility is useful when you want to automate Microsoft Defender Antivirus use. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. You must run it from a command prompt. - -> [!NOTE] -> You might need to open an administrator-level version of the command prompt. When you search for **Command Prompt** on the Start menu, choose **Run as administrator**. -> If you're running an updated Microsoft Defender Platform version, run `**MpCmdRun**` from the following location: `C:\ProgramData\Microsoft\Windows Defender\Platform\`. - -The utility has the following commands: - -```console -MpCmdRun.exe [command] [-options] -``` -Here's an example: - -```console -MpCmdRun.exe -Scan -ScanType 2 -``` - -| Command | Description | -|:----|:----| -| `-?` **or** `-h` | Displays all available options for this tool | -| `-Scan [-ScanType [0\|1\|2\|3]] [-File [-DisableRemediation] [-BootSectorScan] [-CpuThrottling]] [-Timeout ] [-Cancel]` | Scans for malicious software. Values for **ScanType** are: **0** Default, according to your configuration, **-1** Quick scan, **-2** Full scan, **-3** File and directory custom scan. CpuThrottling will honor the configured CPU throttling from policy | -| `-Trace [-Grouping #] [-Level #]` | Starts diagnostic tracing | -| `-GetFiles [-SupportLogLocation ]` | Collects support information. See '[collecting diagnostic data](collect-diagnostic-data.md)' | -| `-GetFilesDiagTrack` | Same as `-GetFiles`, but outputs to temporary DiagTrack folder | -| `-RemoveDefinitions [-All]` | Restores the installed Security intelligence to a previous backup copy or to the original default set | -| `-RemoveDefinitions [-DynamicSignatures]` | Removes only the dynamically downloaded Security intelligence | -| `-RemoveDefinitions [-Engine]` | Restores the previous installed engine | -| `-SignatureUpdate [-UNC \| -MMPC]` | Checks for new Security intelligence updates | -| `-Restore [-ListAll \| [[-Name ] [-All] \| [-FilePath ]] [-Path ]]` | Restores or lists quarantined item(s) | -| `-AddDynamicSignature [-Path]` | Loads dynamic Security intelligence | -| `-ListAllDynamicSignatures` | Lists the loaded dynamic Security intelligence | -| `-RemoveDynamicSignature [-SignatureSetID]` | Removes dynamic Security intelligence | -| `-CheckExclusion -path ` | Checks whether a path is excluded | -| `-ValidateMapsConnection` | Verifies that your network can communicate with the Microsoft Defender Antivirus cloud service. This command will only work on Windows 10, version 1703 or higher.| - - -## Common errors in running commands via mpcmdrun.exe - -|Error message | Possible reason -|:----|:----| -| `ValidateMapsConnection failed (800106BA) or 0x800106BA` | The Microsoft Defender Antivirus service is disabled. Enable the service and try again.
**Note:** In Windows 10 1909 or older, and Windows Server 2019 or older, the service used to be called "Windows Defender Antivirus" service.| -| `0x80070667` | You're running the `-ValidateMapsConnection` command from a computer that is Windows 10 version 1607 or older, or Windows Server 2016 or older. Run the command from a machine that is Windows 10 version 1703 or newer, or Windows Server 2019 or newer.| -| `'MpCmdRun' is not recognized as an internal or external command, operable program or batch file.` | The tool needs to be run from either: `%ProgramFiles%\Windows Defender` or `C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2012.4-0` (where `2012.4-0` might differ since platform updates are monthly except for March)| -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070005 httpcode=450)` | Not enough privileges. Use the command prompt (cmd.exe) as an administrator.| -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80070006 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. | -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80004005 httpcode=450)` | Possible network-related issues, like name resolution problems| -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=0x80508015` | The firewall is blocking the connection or conducting SSL inspection. | -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=800722F0D` | The firewall is blocking the connection or conducting SSL inspection. | -| `ValidateMapsConnection failed to establish a connection to MAPS (hr=80072EE7 httpcode=451)` | The firewall is blocking the connection or conducting SSL inspection. | - -## See also - -- [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md) -- [Manage Microsoft Defender Antivirus in your business](configuration-management-reference-microsoft-defender-antivirus.md) -- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md deleted file mode 100644 index 3ce1ffde39..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/common-exclusion-mistakes-microsoft-defender-antivirus.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Common mistakes to avoid when defining exclusions -description: Avoid common mistakes when defining exclusions for Microsoft Defender Antivirus scans. -keywords: exclusions, files, extension, file type, folder name, file name, scans -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Common mistakes to avoid when defining exclusions - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -You can define an exclusion list for items that you don't want Microsoft Defender Antivirus to scan. Such excluded items could contain threats that make your device vulnerable. - -This article describes some common mistake that you should avoid when defining exclusions. - -Before defining your exclusion lists, see [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions). - -## Excluding certain trusted items - -Certain files, file types, folders, or processes should not be excluded from scanning even though you trust them to be not malicious. - -Do not define exclusions for the folder locations, file extensions, and processes that are listed in the following table: - -| Folder locations | File extensions | Processes | -|:--|:--|:--| -| `%systemdrive%`
`C:`
`C:\`
`C:\*`
`%ProgramFiles%\Java`
`C:\Program Files\Java`
`%ProgramFiles%\Contoso\`
`C:\Program Files\Contoso\`
`%ProgramFiles(x86)%\Contoso\`
`C:\Program Files (x86)\Contoso\`
`C:\Temp`
`C:\Temp\`
`C:\Temp\*`
`C:\Users\`
`C:\Users\*`
`C:\Users\\AppData\Local\Temp\`
`C:\Users\\AppData\LocalLow\Temp\`
`C:\Users\\AppData\Roaming\Temp\`
`%Windir%\Prefetch`
`C:\Windows\Prefetch`
`C:\Windows\Prefetch\`
`C:\Windows\Prefetch\*`
`%Windir%\System32\Spool`
`C:\Windows\System32\Spool`
`C:\Windows\System32\CatRoot2`
`%Windir%\Temp`
`C:\Windows\Temp`
`C:\Windows\Temp\`
`C:\Windows\Temp\*` | `.7z`
`.bat`
`.bin`
`.cab`
`.cmd`
`.com`
`.cpl`
`.dll`
`.exe`
`.fla`
`.gif`
`.gz`
`.hta`
`.inf`
`.java`
`.jar`
`.job`
`.jpeg`
`.jpg`
`.js`
`.ko`
`.ko.gz`
`.msi`
`.ocx`
`.png`
`.ps1`
`.py`
`.rar`
`.reg`
`.scr`
`.sys`
`.tar`
`.tmp`
`.url`
`.vbe`
`.vbs`
`.wsf`
`.zip` | `AcroRd32.exe`
`bitsadmin.exe`
`excel.exe`
`iexplore.exe`
`java.exe`
`outlook.exe`
`psexec.exe`
`powerpnt.exe`
`powershell.exe`
`schtasks.exe`
`svchost.exe`
`wmic.exe`
`winword.exe`
`wuauclt.exe`
`addinprocess.exe`
`addinprocess32.exe`
`addinutil.exe`
`bash.exe`
`bginfo.exe`[1]
`cdb.exe`
`csi.exe`
`dbghost.exe`
`dbgsvc.exe`
`dnx.exe`
`fsi.exe`
`fsiAnyCpu.exe`
`kd.exe`
`ntkd.exe`
`lxssmanager.dll`
`msbuild.exe`[2]
`mshta.exe`
`ntsd.exe`
`rcsi.exe`
`system.management.automation.dll`
`windbg.exe` | - -> [!NOTE] -> You can choose to exclude file types, such as `.gif`, `.jpg`, `.jpeg`, or `.png` if your environment has a modern, up-to-date software with a strict update policy to handle any vulnerabilities. - -## Using just the file name in the exclusion list - -A malware may have the same name as that of the file that you trust and want to exclude from scanning. Therefore, to avoid excluding a potential malware from scanning, use a fully qualified path to the file that you want to exclude instead of using just the file name. For example, if you want to exclude `Filename.exe` from scanning, use the complete path to the file, such as `C:\program files\contoso\Filename.exe`. - -## Using a single exclusion list for multiple server workloads - -Do not use a single exclusion list to define exclusions for multiple server workloads. Split the exclusions for different application or service workloads into multiple exclusion lists. For example, the exclusion list for your IIS Server workload must be different from the exclusion list for your SQL Server workload. - -## Using incorrect environment variables as wildcards in the file name and folder path or extension exclusion lists - -Microsoft Defender Antivirus Service runs in system context using the LocalSystem account, which means it gets information from the system environment variable, and not from the user environment variable. Use of environment variables as a wildcard in exclusion lists is limited to system variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. Therefore, do not use user environment variables as wildcards when adding Microsoft Defender Antivirus folder and process exclusions. See the table under [System environment variables](configure-extension-file-exclusions-microsoft-defender-antivirus.md#system-environment-variables) for a complete list of system environment variables. - -See [Use wildcards in the file name and folder path or extension exclusion lists](configure-extension-file-exclusions-microsoft-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for information on how to use wildcards in exclusion lists. - -## Related articles - -- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md deleted file mode 100644 index b8d2146f28..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Manage Windows Defender in your business -description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender AV -keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 12/16/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Manage Microsoft Defender Antivirus in your business - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can manage and configure Microsoft Defender Antivirus with the following tools: - -- [Microsoft Intune](/mem/intune/protect/endpoint-security-antivirus-policy) (now part of Microsoft Endpoint Manager) -- [Microsoft Endpoint Configuration Manager](/mem/configmgr/protect/deploy-use/endpoint-protection-configure) (now part of Microsoft Endpoint Manager) -- [Group Policy](./use-group-policy-microsoft-defender-antivirus.md) -- [PowerShell cmdlets](./use-powershell-cmdlets-microsoft-defender-antivirus.md) -- [Windows Management Instrumentation (WMI)](./use-wmi-microsoft-defender-antivirus.md) -- The [Microsoft Malware Protection Command Line Utility](./command-line-arguments-microsoft-defender-antivirus.md) (referred to as the *mpcmdrun.exe* utility - -The following articles provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus. - -| Article | Description | -|:---|:---| -|[Manage Microsoft Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-microsoft-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Microsoft Defender Antivirus | -|[Manage Microsoft Defender Antivirus with Group Policy settings](use-group-policy-microsoft-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates | -|[Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Microsoft Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters | -|[Manage Microsoft Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-microsoft-defender-antivirus.md)| Instructions for using WMI to manage Microsoft Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties) | -|[Manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus | \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md deleted file mode 100644 index c08ed64aa2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Configure scanning options for Microsoft Defender AV -description: You can configure Microsoft Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). -keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure Microsoft Defender Antivirus scanning options - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -## Use Microsoft Intune to configure scanning options - -See [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. - -## Use Microsoft Endpoint Manager to configure scanning options - -See [How to create and deploy antimalware policies: Scan settings](/configmgr/protect/deploy-use/endpoint-antimalware-policies#scan-settings) for details on configuring Microsoft Endpoint Manager (current branch). - -## Use Group Policy to configure scanning options - -To configure the Group Policy settings described in the following table: - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. - -4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. - -Description | Location and setting | Default setting (if not configured) | PowerShell `Set-MpPreference` parameter or WMI property for `MSFT_MpPreference` class ----|---|---|--- -Email scanning See [Email scanning limitations](#ref1)| Scan > Turn on e-mail scanning | Disabled | `-DisableEmailScanning` -Scan [reparse points](/windows/win32/fileio/reparse-points) | Scan > Turn on reparse point scanning | Disabled | Not available -Scan mapped network drives | Scan > Run full scan on mapped network drives | Disabled | `-DisableScanningMappedNetworkDrivesForFullScan` - Scan archive files (such as .zip or .rar files). The [extensions exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md) will take precedence over this setting. | Scan > Scan archive files | Enabled | `-DisableArchiveScanning` -Scan files on the network | Scan > Scan network files | Disabled | `-DisableScanningNetworkFiles` -Scan packed executables | Scan > Scan packed executables | Enabled | Not available -Scan removable drives during full scans only | Scan > Scan removable drives | Disabled | `-DisableRemovableDriveScanning` -Specify the level of subfolders within an archive folder to scan | Scan > Specify the maximum depth to scan archive files | 0 | Not available - Specify the maximum CPU load (as a percentage) during a scan. Note: This is not a hard limit but rather a guidance for the scanning engine to not exceed this maximum on average. | Scan > Specify the maximum percentage of CPU utilization during a scan | 50 | `-ScanAvgCPULoadFactor` - Specify the maximum size (in kilobytes) of archive files that should be scanned. The default, **0**, applies no limit | Scan > Specify the maximum size of archive files to be scanned | No limit | Not available - Configure low CPU priority for scheduled scans | Scan > Configure low CPU priority for scheduled scans | Disabled | Not available - -> [!NOTE] -> If real-time protection is turned on, files are scanned before they are accessed and executed. The scanning scope includes all files, including files on mounted removable media, such as USB drives. If the device performing the scan has real-time protection or on-access protection turned on, the scan will also include network shares. - -## Use PowerShell to configure scanning options - -See [Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -## Use WMI to configure scanning options - -For using WMI classes, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). - - - -## Email scanning limitations - -Email scanning enables scanning of email files used by Outlook and other mail clients during on-demand and scheduled scans. Embedded objects within an email file (such as attachments and archived files) are also scanned. The following file format types can be scanned and remediated: - -- DBX -- MBX -- MIME - -PST files used by Outlook 2003 or older (where the archive type is set to non-unicode) will also be scanned, but Windows Defender cannot remediate threats detected inside PST files. - -If Microsoft Defender Antivirus detects a threat inside an email, it will show you the following information to assist you in identifying the compromised email, so you can remediate the threat manually: - -- Email subject -- Attachment name - -## Related topics - -- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) -- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md deleted file mode 100644 index d66447ceca..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ /dev/null @@ -1,176 +0,0 @@ ---- -title: Enable block at first sight to detect malware in seconds -description: Turn on the block at first sight feature to detect and block malware within seconds. -keywords: scan, BAFS, malware, first seen, first sight, cloud, defender -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: high -author: denisebmsft -ms.author: deniseb -ms.reviewer: -manager: dansimp -ms.custom: nextgen -ms.date: 10/22/2020 -ms.technology: mde ---- - -# Turn on block at first sight - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50 seconds), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments. - -You can [specify how long a file should be prevented from running](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) while the cloud-based protection service analyzes the file. And, you can [customize the message displayed on users' desktops](../windows-defender-security-center/wdsc-customize-contact-information.md) when a file is blocked. You can change the company name, contact information, and message URL. - ->[!TIP] ->Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. - -## How it works - -When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or not a threat. - -Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, intelligent, and real-time protection. To learn more, see this blog: [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) - -In Windows 10, version 1803 or later, block at first sight can block non-portable executable files (such as JS, VBS, or macros) as well as executable files. - -Block at first sight only uses the cloud protection backend for executable files and non-portable executable files that are downloaded from the Internet, or that originate from the Internet zone. A hash value of the .exe file is checked via the cloud backend to determine if the file is a previously undetected file. - -If the cloud backend is unable to make a determination, Microsoft Defender Antivirus locks the file and uploads a copy to the cloud. The cloud performs additional analysis to reach a determination before it either allows the file to run or blocks it in all future encounters, depending on whether it determines the file to be malicious or safe. - -In many cases, this process can reduce the response time for new malware from hours to seconds. - -## Turn on block at first sight with Microsoft Intune - -> [!TIP] -> Microsoft Intune is now part of Microsoft Endpoint Manager. - -1. In the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), navigate to **Devices** > **Configuration profiles**. - -2. Select or create a profile using the **Device restrictions** profile type. - -3. In the **Configuration settings** for the Device restrictions profile, set or confirm the following settings under **Microsoft Defender Antivirus**: - - - **Cloud-delivered protection**: Enabled - - **File Blocking Level**: High - - **Time extension for file scanning by the cloud**: 50 - - **Prompt users before sample submission**: Send all data without prompting - - ![Intune config](images/defender/intune-block-at-first-sight.png) - -4. Save your settings. - -> [!TIP] -> - Setting the file blocking level to **High** applies a strong level of detection. In the unlikely event that file blocking causes a false positive detection of legitimate files, you can [restore quarantined files](./restore-quarantined-files-microsoft-defender-antivirus.md). -> - For more information about configuring Microsoft Defender Antivirus device restrictions in Intune, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). -> - For a list of Microsoft Defender Antivirus device restrictions in Intune, see [Device restriction for Windows 10 (and newer) settings in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus). - -## Turn on block at first sight with Microsoft Endpoint Manager - -> [!TIP] -> If you're looking for Microsoft Endpoint Configuration Manager, it's now part of Microsoft Endpoint Manager. - -1. In Microsoft Endpoint Manager ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), go to **Endpoint security** > **Antivirus**. - -2. Select an existing policy, or create a new policy using the **Microsoft Defender Antivirus** profile type. - -3. Set or confirm the following configuration settings: - - - **Turn on cloud-delivered protection**: Yes - - **Cloud-delivered protection level**: High - - **Defender Cloud Extended Timeout in Seconds**: 50 - - :::image type="content" source="images/endpointmgr-antivirus-cloudprotection.png" alt-text="Block at first sight settings in Endpoint Manager"::: - -4. Apply the Microsoft Defender Antivirus profile to a group, such as **All users**, **All devices**, or **All users and devices**. - -## Turn on block at first sight with Group Policy - -> [!NOTE] -> We recommend using Intune or Microsoft Endpoint Manager to turn on block at first sight. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration** > **Administrative templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS**. - -3. In the MAPS section, double-click **Configure the 'Block at First Sight' feature**, and set it to **Enabled**, and then select **OK**. - - > [!IMPORTANT] - > Setting to **Always prompt (0)** will lower the protection state of the device. Setting to **Never send (2)** means block at first sight will not function. - -4. In the MAPS section, double-click **Send file samples when further analysis is required**, and set it to **Enabled**. Under **Send file samples when further analysis is required**, select **Send all samples**, and then click **OK**. - -5. If you changed any settings, redeploy the Group Policy Object across your network to ensure all endpoints are covered. - -## Confirm block at first sight is enabled on individual clients - -You can confirm that block at first sight is enabled on individual clients using Windows security settings. - -Block at first sight is automatically enabled as long as **Cloud-delivered protection** and **Automatic sample submission** are both turned on. - -1. Open the Windows Security app. - -2. Select **Virus & threat protection**, and then, under **Virus & threat protection settings**, select **Manage Settings**. - - ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) - -3. Confirm that **Cloud-delivered protection** and **Automatic sample submission** are both turned on. - -> [!NOTE] -> - If the prerequisite settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. -> - Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. - -## Validate block at first sight is working - -To validate that the feature is working, follow the guidance in [Validate connections between your network and the cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud). - -## Turn off block at first sight - -> [!CAUTION] -> Turning off block at first sight will lower the protection state of your device(s) and your network. - -You might choose to disable block at first sight if you want to retain the prerequisite settings without actually using block at first sight protection. You might do temporarily turn block at first sight off if you are experiencing latency issues or you want to test the feature's impact on your network. However, we do not recommend disabling block at first sight protection permanently. - -### Turn off block at first sight with Microsoft Endpoint Manager - -1. Go to Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. - -2. Go to **Endpoint security** > **Antivirus**, and then select your Microsoft Defender Antivirus policy. - -3. Under **Manage**, choose **Properties**. - -4. Next to **Configuration settings**, choose **Edit**. - -5. Change one or more of the following settings: - - - Set **Turn on cloud-delivered protection** to **No** or **Not configured**. - - Set **Cloud-delivered protection level** to **Not configured**. - - Clear the **Defender Cloud Extended Timeout In Seconds** box. - -6. Review and save your settings. - -### Turn off block at first sight with Group Policy - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and then click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree through **Windows components** > **Microsoft Defender Antivirus** > **MAPS**. - -4. Double-click **Configure the 'Block at First Sight' feature** and set the option to **Disabled**. - - > [!NOTE] - > Disabling block at first sight does not disable or alter the prerequisite group policies. - -## See also - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) - -- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md deleted file mode 100644 index 9d14d25bfa..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Configure the Microsoft Defender AV cloud block timeout period -description: You can configure how long Microsoft Defender Antivirus will block a file from running while waiting for a cloud determination. -keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, timeout, block, period, seconds -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure the cloud block timeout period - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -When Microsoft Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Microsoft Defender Antivirus cloud service](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). - -The default period that the file will be [blocked](configure-block-at-first-sight-microsoft-defender-antivirus.md) is 10 seconds. You can specify an additional period of time to wait before the file is allowed to run. This can help ensure there is enough time to receive a proper determination from the Microsoft Defender Antivirus cloud service. - -## Prerequisites to use the extended cloud block timeout - -[Block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) and its prerequisites must be enabled before you can specify an extended timeout period. - -## Specify the extended timeout period - -You can use Group Policy to specify an extended timeout for cloud checks. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus > MpEngine** - -4. Double-click **Configure extended cloud check** and ensure the option is enabled. Specify the additional amount of time to prevent the file from running while waiting for a cloud determination. You can specify the additional time, in seconds, from 1 second to 50 seconds. This time will be added to the default 10 seconds. - -5. Click **OK**. - -## Related topics - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Use next-generation antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) -- [Configure block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) -- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md deleted file mode 100644 index 96b864a57b..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Configure how users can interact with Microsoft Defender AV -description: Configure how end-users interact with Microsoft Defender AV, what notifications they see, and if they can override settings. -keywords: endpoint, user, interaction, notifications, ui lockdown mode, headless mode, hide interface -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure end-user interaction with Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can configure how users of the endpoints on your network can interact with Microsoft Defender Antivirus. - -This includes whether they see the Microsoft Defender Antivirus interface, what notifications they see, and if they can locally override globally-deployed Group Policy settings. - -## In this section - -Topic | Description ----|--- -[Configure notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) | Configure and customize additional notifications, customized text for notifications, and notifications about reboots for remediation -[Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) | Hide the user interface from users -[Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | Prevent (or allow) users from overriding policy settings on their individual endpoints \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md deleted file mode 100644 index fb15926899..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Set up exclusions for Microsoft Defender AV scans -description: You can exclude files (including files modified by specified processes) and folders from being scanned by Microsoft Defender AV. Validate your exclusions with PowerShell. -keywords: -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure and validate exclusions for Microsoft Defender Antivirus scans - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection. - -## Configure and validate exclusions - -To configure and validate exclusions, see the following: - -- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. - -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). This enables you to exclude files from scans that have been opened by a specific process. - -## Recommendations for defining exclusions - -Defining exclusions lowers the protection offered by Microsoft Defender Antivirus. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious. - -The following is a list of recommendations that you should keep in mind when defining exclusions: - -- Exclusions are technically a protection gap—always consider additional mitigations when defining exclusions. Additional mitigations could be as simple as making sure the excluded location has the appropriate access-control lists (ACLs), audit policy, is processed by an up-to-date software, etc. - -- Review the exclusions periodically. Re-check and re-enforce the mitigations as part of the review process. - -- Ideally, avoid defining proactive exclusions. For instance, don't exclude something just because you think it might be a problem in the future. Use exclusions only for specific issues—mostly around performance, or sometimes around application compatibility that exclusions could mitigate. - -- Audit the exclusion list changes. The security admin should preserve enough context around why a certain exclusion was added. You should be able to provide answer with specific reasoning as to why a certain path was excluded. - -## Related articles - -- [Microsoft Defender Antivirus exclusions on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) -- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md deleted file mode 100644 index ff54f8daf2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ /dev/null @@ -1,362 +0,0 @@ ---- -title: Configure and validate exclusions based on extension, name, or location -description: Exclude files from Microsoft Defender Antivirus scans based on their file extension, file name, or location. -keywords: exclusions, files, extension, file type, folder name, file name, scans -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure and validate exclusions based on file extension and folder location - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -> [!IMPORTANT] -> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response (EDR)](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response), [attack surface reduction (ASR) rules](/microsoft-365/security/defender-endpoint/attack-surface-reduction), and [controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](/microsoft-365/security/defender-endpoint/manage-indicators). - -## Exclusion lists - -You can exclude certain files from Microsoft Defender Antivirus scans by modifying exclusion lists. **Generally, you shouldn't need to apply exclusions**. Microsoft Defender Antivirus includes many automatic exclusions based on known operating system behaviors and typical management files, such as those used in enterprise management, database management, and other enterprise scenarios and situations. - -> [!NOTE] -> Exclusions apply to Potentially Unwanted Apps (PUA) detections as well. - -> [!NOTE] -> Automatic exclusions apply only to Windows Server 2016 and above. These exclusions are not visible in the Windows Security app and in PowerShell. - -This article describes how to configure exclusion lists for the files and folders. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. - -| Exclusion | Examples | Exclusion list | -|:---|:---|:---| -|Any file with a specific extension | All files with the specified extension, anywhere on the machine.

Valid syntax: `.test` and `test` | Extension exclusions | -|Any file under a specific folder | All files under the `c:\test\sample` folder | File and folder exclusions | -| A specific file in a specific folder | The file `c:\sample\sample.test` only | File and folder exclusions | -| A specific process | The executable file `c:\test\process.exe` | File and folder exclusions | - -Exclusion lists have the following characteristics: - -- Folder exclusions apply to all files and folders under that folder, unless the subfolder is a reparse point. Reparse point subfolders must be excluded separately. -- File extensions apply to any file name with the defined extension if a path or folder is not defined. - -> [!IMPORTANT] -> - Using wildcards such as the asterisk (\*) will alter how the exclusion rules are interpreted. See the [Use wildcards in the file name and folder path or extension exclusion lists](#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) section for important information about how wildcards work. -> - You cannot exclude mapped network drives. You must specify the actual network path. -> - Folders that are reparse points that are created after the Microsoft Defender Antivirus service starts and that have been added to the exclusion list will not be included. You must restart the service (by restarting Windows) for new reparse points to be recognized as a valid exclusion target. - -To exclude files opened by a specific process, see [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md). - -The exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [real-time protection](configure-real-time-protection-microsoft-defender-antivirus.md). - -> [!IMPORTANT] -> Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md). -> Changes made in the Windows Security app **will not show** in the Group Policy lists. - -By default, local changes made to the lists (by users with administrator privileges, including changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists take precedence when there are conflicts. - -You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. - -## Configure the list of exclusions based on folder name or file extension - -### Use Intune to configure file name, folder, or file extension exclusions - -See the following articles: -- [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure) -- [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus) - -### Use Configuration Manager to configure file name, folder, or file extension exclusions - -See [How to create and deploy antimalware policies: Exclusion settings](/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring Microsoft Endpoint Manager (current branch). - -### Use Group Policy to configure folder or file extension exclusions - ->[!NOTE] ->If you specify a fully qualified path to a file, then only that file is excluded. If a folder is defined in the exclusion, then all files and subdirectories under that folder are excluded. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. - -3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Exclusions**. - -4. Open the **Path Exclusions** setting for editing, and add your exclusions. - - 1. Set the option to **Enabled**. - 1. Under the **Options** section, click **Show**. - 1. Specify each folder on its own line under the **Value name** column. - 1. If you are specifying a file, ensure that you enter a fully qualified path to the file, including the drive letter, folder path, file name, and extension. Enter **0** in the **Value** column. - -5. Choose **OK**. - -6. Open the **Extension Exclusions** setting for editing and add your exclusions. - - 1. Set the option to **Enabled**. - 1. Under the **Options** section, select **Show**. - 1. Enter each file extension on its own line under the **Value name** column. Enter **0** in the **Value** column. - -7. Choose **OK**. - - - -### Use PowerShell cmdlets to configure file name, folder, or file extension exclusions - -Using PowerShell to add or remove exclusions for files based on the extension, location, or file name requires using a combination of three cmdlets and the appropriate exclusion list parameter. The cmdlets are all in the [Defender module](/powershell/module/defender/). - -The format for the cmdlets is as follows: - -```PowerShell - - "" -``` - -The following are allowed as the ``: - -| Configuration action | PowerShell cmdlet | -|:---|:---| -|Create or overwrite the list | `Set-MpPreference` | -|Add to the list | `Add-MpPreference` | -|Remove item from the list | `Remove-MpPreference` | - -The following are allowed as the ``: - -| Exclusion type | PowerShell parameter | -|:---|:---| -| All files with a specified file extension | `-ExclusionExtension` | -| All files under a folder (including files in subdirectories), or a specific file | `-ExclusionPath` | - -> [!IMPORTANT] -> If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - -For example, the following code snippet would cause Microsoft Defender Antivirus scans to exclude any file with the `.test` file extension: - -```PowerShell -Add-MpPreference -ExclusionExtension ".test" -``` - -For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/). - -### Use Windows Management Instruction (WMI) to configure file name, folder, or file extension exclusions - -Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -ExclusionExtension -ExclusionPath -``` - -The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. - -For more information, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). - - - -### Use the Windows Security app to configure file name, folder, or file extension exclusions - -See [Add exclusions in the Windows Security app](microsoft-defender-security-center-antivirus.md) for instructions. - - - -## Use wildcards in the file name and folder path or extension exclusion lists - -You can use the asterisk `*`, question mark `?`, or environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the file name or folder path exclusion list. The way in which these wildcards are interpreted differs from their usual usage in other apps and languages. Make sure to read this section to understand their specific limitations. - -> [!IMPORTANT] -> There are key limitations and usage scenarios for these wildcards: -> - Environment variable usage is limited to machine variables and those applicable to processes running as an NT AUTHORITY\SYSTEM account. -> - You cannot use a wildcard in place of a drive letter. -> - An asterisk `*` in a folder exclusion stands in place for a single folder. Use multiple instances of `\*\` to indicate multiple nested folders with unspecified names. - -The following table describes how the wildcards can be used and provides some examples. - - -|Wildcard |Examples | -|:---------|:---------| -|`*` (asterisk)

In **file name and file extension inclusions**, the asterisk replaces any number of characters, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the asterisk replaces a single folder. Use multiple `*` with folder slashes `\` to indicate multiple nested folders. After matching the number of wild carded and named folders, all subfolders are also included. | `C:\MyData\*.txt` includes `C:\MyData\notes.txt`

`C:\somepath\*\Data` includes any file in `C:\somepath\Archives\Data` and its subfolders, and `C:\somepath\Authorized\Data` and its subfolders

`C:\Serv\*\*\Backup` includes any file in `C:\Serv\Primary\Denied\Backup` and its subfolders and `C:\Serv\Secondary\Allowed\Backup` and its subfolders | -|`?` (question mark)

In **file name and file extension inclusions**, the question mark replaces a single character, and only applies to files in the last folder defined in the argument.

In **folder exclusions**, the question mark replaces a single character in a folder name. After matching the number of wild carded and named folders, all subfolders are also included. |`C:\MyData\my?.zip` includes `C:\MyData\my1.zip`

`C:\somepath\?\Data` includes any file in `C:\somepath\P\Data` and its subfolders

`C:\somepath\test0?\Data` would include any file in `C:\somepath\test01\Data` and its subfolders | -|Environment variables

The defined variable is populated as a path when the exclusion is evaluated. |`%ALLUSERSPROFILE%\CustomLogFiles` would include `C:\ProgramData\CustomLogFiles\Folder1\file1.txt` | - - -> [!IMPORTANT] -> If you mix a file exclusion argument with a folder exclusion argument, the rules will stop at the file argument match in the matched folder, and will not look for file matches in any subfolders. -> For example, you can exclude all files that start with "date" in the folders `c:\data\final\marked` and `c:\data\review\marked` by using the rule argument `c:\data\*\marked\date*`. -> This argument, however, will not match any files in subfolders under `c:\data\final\marked` or `c:\data\review\marked`. - - - -### System environment variables - -The following table lists and describes the system account environment variables. - -| This system environment variable... | Redirects to this | -|:--|:--| -| `%APPDATA%`| `C:\Users\UserName.DomainName\AppData\Roaming` | -| `%APPDATA%\Microsoft\Internet Explorer\Quick Launch` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch` | -| `%APPDATA%\Microsoft\Windows\Start Menu` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu` | -| `%APPDATA%\Microsoft\Windows\Start Menu\Programs` | `C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs` | -| `%LOCALAPPDATA%` | `C:\Windows\System32\config\systemprofile\AppData\Local` | -| `%ProgramData%` | `C:\ProgramData` | -| `%ProgramFiles%` | `C:\Program Files` | -| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | -| `%ProgramFiles%\Windows Sidebar\Gadgets` | `C:\Program Files\Windows Sidebar\Gadgets` | -| `%ProgramFiles%\Common Files` | `C:\Program Files\Common Files` | -| `%ProgramFiles(x86)%` | `C:\Program Files (x86)` | -| `%ProgramFiles(x86)%\Common Files` | `C:\Program Files (x86)\Common Files` | -| `%SystemDrive%` | `C:` | -| `%SystemDrive%\Program Files` | `C:\Program Files` | -| `%SystemDrive%\Program Files (x86)` | `C:\Program Files (x86)` | -| `%SystemDrive%\Users` | `C:\Users` | -| `%SystemDrive%\Users\Public` | `C:\Users\Public` | -| `%SystemRoot%` | `C:\Windows` | -| `%windir%` | `C:\Windows` | -| `%windir%\Fonts` | `C:\Windows\Fonts` | -| `%windir%\Resources` | `C:\Windows\Resources` | -| `%windir%\resources\0409` | `C:\Windows\resources\0409` | -| `%windir%\system32` | `C:\Windows\System32` | -| `%ALLUSERSPROFILE%` | `C:\ProgramData` | -| `%ALLUSERSPROFILE%\Application Data` | `C:\ProgramData\Application Data` | -| `%ALLUSERSPROFILE%\Documents` | `C:\ProgramData\Documents` | -| `%ALLUSERSPROFILE%\Documents\My Music\Sample Music` | `C:\ProgramData\Documents\My Music\Sample Music` | -| `%ALLUSERSPROFILE%\Documents\My Music` | `C:\ProgramData\Documents\My Music` | -| `%ALLUSERSPROFILE%\Documents\My Pictures` | `C:\ProgramData\Documents\My Pictures` | -| `%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures` | `C:\ProgramData\Documents\My Pictures\Sample Pictures` | -| `%ALLUSERSPROFILE%\Documents\My Videos` | `C:\ProgramData\Documents\My Videos` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\DeviceMetadataStore` | `C:\ProgramData\Microsoft\Windows\DeviceMetadataStore` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer` | `C:\ProgramData\Microsoft\Windows\GameExplorer` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Ringtones` | `C:\ProgramData\Microsoft\Windows\Ringtones` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu` | `C:\ProgramData\Microsoft\Windows\Start Menu` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp` | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp` | -| `%ALLUSERSPROFILE%\Microsoft\Windows\Templates` | `C:\ProgramData\Microsoft\Windows\Templates` | -| `%ALLUSERSPROFILE%\Start Menu` | `C:\ProgramData\Start Menu` | -| `%ALLUSERSPROFILE%\Start Menu\Programs` | C:\ProgramData\Start Menu\Programs | -| `%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools` | `C:\ProgramData\Start Menu\Programs\Administrative Tools` | -| `%ALLUSERSPROFILE%\Templates` | `C:\ProgramData\Templates` | -| `%LOCALAPPDATA%\Microsoft\Windows\ConnectedSearch\Templates` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\ConnectedSearch\Templates` | -| `%LOCALAPPDATA%\Microsoft\Windows\History` | `C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History` | -| `%PUBLIC%` | `C:\Users\Public` | -| `%PUBLIC%\AccountPictures` | `C:\Users\Public\AccountPictures` | -| `%PUBLIC%\Desktop` | `C:\Users\Public\Desktop` | -| `%PUBLIC%\Documents` | `C:\Users\Public\Documents` | -| `%PUBLIC%\Downloads` | `C:\Users\Public\Downloads` | -| `%PUBLIC%\Music\Sample Music` | `C:\Users\Public\Music\Sample Music` | -| `%PUBLIC%\Music\Sample Playlists` | `C:\Users\Public\Music\Sample Playlists` | -| `%PUBLIC%\Pictures\Sample Pictures` | `C:\Users\Public\Pictures\Sample Pictures` | -| `%PUBLIC%\RecordedTV.library-ms` | `C:\Users\Public\RecordedTV.library-ms` | -| `%PUBLIC%\Videos` | `C:\Users\Public\Videos` | -| `%PUBLIC%\Videos\Sample Videos` | `C:\Users\Public\Videos\Sample Videos` | -| `%USERPROFILE%` | `C:\Windows\System32\config\systemprofile` | -| `%USERPROFILE%\AppData\Local` | `C:\Windows\System32\config\systemprofile\AppData\Local` | -| `%USERPROFILE%\AppData\LocalLow` | `C:\Windows\System32\config\systemprofile\AppData\LocalLow` | -| `%USERPROFILE%\AppData\Roaming` | `C:\Windows\System32\config\systemprofile\AppData\Roaming` | - - -## Review the list of exclusions - -You can retrieve the items in the exclusion list using one of the following methods: -- [Intune](/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) -- [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies) -- MpCmdRun -- PowerShell -- [Windows Security app](microsoft-defender-security-center-antivirus.md) - ->[!IMPORTANT] ->Exclusion list changes made with Group Policy **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md). -> ->Changes made in the Windows Security app **will not show** in the Group Policy lists. - -If you use PowerShell, you can retrieve the list in two ways: - -- Retrieve the status of all Microsoft Defender Antivirus preferences. Each list is displayed on separate lines, but the items within each list are combined into the same line. -- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. - -### Validate the exclusion list by using MpCmdRun - -To check exclusions with the dedicated [command-line tool mpcmdrun.exe](./command-line-arguments-microsoft-defender-antivirus.md?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: - -```DOS -Start, CMD (Run as admin) -cd "%programdata%\microsoft\windows defender\platform" -cd 4.18.1812.3 (Where 4.18.1812.3 is this month's MDAV "Platform Update".) -MpCmdRun.exe -CheckExclusion -path -``` - ->[!NOTE] ->Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. - -### Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell - -Use the following cmdlet: - -```PowerShell -Get-MpPreference -``` - -In the following example, the items contained in the `ExclusionExtension` list are highlighted: - -![PowerShell output for Get-MpPreference showing the exclusion list alongside other preferences](images/defender/wdav-powershell-get-exclusions-all.png) - -For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/). - -### Retrieve a specific exclusions list by using PowerShell - -Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: - -```PowerShell -$WDAVprefs = Get-MpPreference -$WDAVprefs.ExclusionExtension -$WDAVprefs.ExclusionPath -``` - -In the following example, the list is split into new lines for each use of the `Add-MpPreference` cmdlet: - -![PowerShell output showing only the entries in the exclusion list](images/defender/wdav-powershell-get-exclusions-variable.png) - -For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/). - - - -## Validate exclusions lists with the EICAR test file - -You can validate that your exclusion lists are working by using PowerShell with either the `Invoke-WebRequest` cmdlet or the .NET WebClient class to download a test file. - -In the following PowerShell snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure you run the cmdlet within that path. - -```PowerShell -Invoke-WebRequest "http://www.eicar.org/download/eicar.com.txt" -OutFile "test.txt" -``` - -If Microsoft Defender Antivirus reports malware, then the rule is not working. If there is no report of malware and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR test file website](http://www.eicar.org/86-0-Intended-use.html). - -You can also use the following PowerShell code, which calls the .NET WebClient class to download the test file - as with the `Invoke-WebRequest` cmdlet; replace *c:\test.txt* with a file that conforms to the rule you are validating: - -```PowerShell -$client = new-object System.Net.WebClient -$client.DownloadFile("http://www.eicar.org/download/eicar.com.txt","c:\test.txt") -``` - -If you do not have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following PowerShell command: - -```PowerShell -[io.file]::WriteAllText("test.txt",'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*') -``` - -You can also copy the string into a blank text file and attempt to save it with the file name or in the folder you are attempting to exclude. - -## Related topics - -- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) -- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md deleted file mode 100644 index 6f5c1e04a2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Configure local overrides for Microsoft Defender AV settings -description: Enable or disable users from locally changing settings in Microsoft Defender AV. -keywords: local override, local policy, group policy, gpo, lockdown,merge, lists -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 02/13/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Prevent or allow users to locally modify Microsoft Defender Antivirus policy settings - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -By default, Microsoft Defender Antivirus settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances. - -For example, it may be necessary to allow certain user groups (such as security researchers and threat investigators) further control over individual settings on the endpoints they use. - -## Configure local overrides for Microsoft Defender Antivirus settings - -The default setting for these policies is **Disabled**. - -If they are set to **Enabled**, users on endpoints can make changes to the associated setting with the [Windows Security](microsoft-defender-security-center-antivirus.md) app, local Group Policy settings, and PowerShell cmdlets (where appropriate). - -The following table lists each of the override policy setting and the configuration instructions for the associated feature or setting. - -To configure these settings: - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. - -4. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. Click **OK**, and repeat for any other settings. - -5. Deploy the Group Policy Object as usual. - -Location | Setting | Article ----|---|---|--- -MAPS | Configure local setting override for reporting to Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) -Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -Real-time protection | Configure local setting override for turn on behavior monitoring | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -Real-time protection | Configure local setting override to turn on real-time protection | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) -Scan | Configure local setting override for maximum percentage of CPU utilization | [Configure and run scans](run-scan-microsoft-defender-antivirus.md) -Scan | Configure local setting override for schedule scan day | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -Scan | Configure local setting override for scheduled quick scan time | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -Scan | Configure local setting override for scheduled scan time | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -Scan | Configure local setting override for the scan type to use for a scheduled scan | [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) - - - -## Configure how locally and globally defined threat remediation and exclusions lists are merged - -You can also configure how locally defined lists are combined or merged with globally defined lists. This setting applies to [exclusion lists](configure-exclusions-microsoft-defender-antivirus.md), [specified remediation lists](configure-remediation-microsoft-defender-antivirus.md), and [attack surface reduction](/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction). - -By default, lists that have been configured in local group policy and the Windows Security app are merged with lists that are defined by the appropriate Group Policy Object that you have deployed on your network. Where there are conflicts, the globally-defined list takes precedence. - -You can disable this setting to ensure that only globally-defined lists (such as those from any deployed GPOs) are used. - -### Use Group Policy to disable local list merging - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus**. - -4. Double-click **Configure local administrator merge behavior for lists** and set the option to **Disabled**. Click **OK**. - -> [!NOTE] -> If you disable local list merging, it will override controlled folder access settings. It also overrides any protected folders or allowed apps set by the local administrator. For more information about controlled folder access settings, see [Allow a blocked app in Windows Security](https://support.microsoft.com/help/4046851/windows-10-allow-blocked-app-windows-security). - -## Related topics - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md deleted file mode 100644 index f767edaae6..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus features -description: You can configure Microsoft Defender Antivirus features with Intune, Microsoft Endpoint Configuration Manager, Group Policy, and PowerShell. -keywords: Microsoft Defender Antivirus, antimalware, security, defender, configure, configuration, Config Manager, Microsoft Endpoint Configuration Manager, SCCM, Intune, MDM, mobile device management, GP, group policy, PowerShell -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 11/18/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure Microsoft Defender Antivirus features - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can configure Microsoft Defender Antivirus with a number of tools, including: - -- Microsoft Intune -- Microsoft Endpoint Configuration Manager -- Group Policy -- PowerShell cmdlets -- Windows Management Instrumentation (WMI) - -The following broad categories of features can be configured: - -- Cloud-delivered protection -- Always-on real-time protection, including behavioral, heuristic, and machine-learning-based protection -- How end users interact with the client on individual endpoints - -The following articles describe how to perform key tasks when configuring Microsoft Defender Antivirus. Each article includes instructions for the applicable configuration tool (or tools). - -|Article |Description | -|---------|---------| -|[Utilize Microsoft cloud-provided Microsoft Defender Antivirus protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) | Use cloud-delivered protection for advanced, fast, robust antivirus detection. | -|[Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) |Enable behavior-based, heuristic, and real-time antivirus protection. | -|[Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) | Configure how end users in your organization interact with Microsoft Defender Antivirus, what notifications they see, and whether they can override settings. | - -> [!TIP] -> You can also review the [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) topic for an overview of each tool and links to further help. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md deleted file mode 100644 index 283f917b81..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: Configure and validate Microsoft Defender Antivirus network connections -description: Configure and test your connection to the Microsoft Defender Antivirus cloud protection service. -keywords: antivirus, Microsoft Defender Antivirus, antimalware, security, defender, cloud, aggressiveness, protection level -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 12/28/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure and validate Microsoft Defender Antivirus network connections - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -To ensure Microsoft Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers. - -This article lists the connections that must be allowed, such as by using firewall rules, and provides instructions for validating your connection. Configuring your protection properly helps ensure that you receive the best value from your cloud-delivered protection services. - -See the blog post [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) for some details about network connectivity. - ->[!TIP] ->You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: -> ->- Cloud-delivered protection ->- Fast learning (including block at first sight) ->- Potentially unwanted application blocking - -## Allow connections to the Microsoft Defender Antivirus cloud service - -The Microsoft Defender Antivirus cloud service provides fast, strong protection for your endpoints. Enabling the cloud-delivered protection service is optional, however it's highly recommended because it provides important protection against malware on your endpoints and across your network. - ->[!NOTE] ->The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it's called a cloud service, it's not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. - -See [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) for details on enabling the service with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Security app. - -After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. - -Because your protection is a cloud service, computers must have access to the internet and reach the Microsoft Defender for Office 365 machine learning services. Don't exclude the URL `*.blob.core.windows.net` from any kind of network inspection. - -The table below lists the services and their associated URLs. Make sure that there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL `*.blob.core.windows.net`). Below mention URLs are using port 443 for communication. - - -| **Service**| **Description** |**URL** | -| :--: | :-- | :-- | -| Microsoft Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)|Used by Microsoft Defender Antivirus to provide cloud-delivered protection|`*.wdcp.microsoft.com`
`*.wdcpalt.microsoft.com`
`*.wd.microsoft.com`| -| Microsoft Update Service (MU)
Windows Update Service (WU)| Security intelligence and product updates |`*.update.microsoft.com`
`*.delivery.mp.microsoft.com`
`*.windowsupdate.com`

For details see [Connection endpoints for Windows Update](/windows/privacy/manage-windows-1709-endpoints#windows-update)| -|Security intelligence updates Alternate Download Location (ADL)| Alternate location for Microsoft Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| `*.download.microsoft.com`
`*.download.windowsupdate.com`
`https://fe3cr.delivery.mp.microsoft.com/ClientWebService/client.asmx`| -| Malware submission storage|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | `ussus1eastprod.blob.core.windows.net`
`ussus2eastprod.blob.core.windows.net`
`ussus3eastprod.blob.core.windows.net`
`ussus4eastprod.blob.core.windows.net`
`wsus1eastprod.blob.core.windows.net`
`wsus2eastprod.blob.core.windows.net`
`ussus1westprod.blob.core.windows.net`
`ussus2westprod.blob.core.windows.net`
`ussus3westprod.blob.core.windows.net`
`ussus4westprod.blob.core.windows.net`
`wsus1westprod.blob.core.windows.net`
`wsus2westprod.blob.core.windows.net`
`usseu1northprod.blob.core.windows.net`
`wseu1northprod.blob.core.windows.net`
`usseu1westprod.blob.core.windows.net`
`wseu1westprod.blob.core.windows.net`
`ussuk1southprod.blob.core.windows.net`
`wsuk1southprod.blob.core.windows.net`
`ussuk1westprod.blob.core.windows.net`
`wsuk1westprod.blob.core.windows.net` | -| Certificate Revocation List (CRL)|Used by Windows when creating the SSL connection to MAPS for updating the CRL | `http://www.microsoft.com/pkiops/crl/`
`http://www.microsoft.com/pkiops/certs`
`http://crl.microsoft.com/pki/crl/products`
`http://www.microsoft.com/pki/certs` | -| Symbol Store|Used by Microsoft Defender Antivirus to restore certain critical files during remediation flows | `https://msdl.microsoft.com/download/symbols` | -| Universal Telemetry Client| Used by Windows to send client diagnostic data; Microsoft Defender Antivirus uses telemetry for product quality monitoring purposes | The update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: `vortex-win.data.microsoft.com`
`settings-win.data.microsoft.com`| - -## Validate connections between your network and the cloud - -After allowing the URLs listed above, you can test if you're connected to the Microsoft Defender Antivirus cloud service and are correctly reporting and receiving information to ensure you're fully protected. - -**Use the cmdline tool to validate cloud-delivered protection:** - -Use the following argument with the Microsoft Defender Antivirus command-line utility (`mpcmdrun.exe`) to verify that your network can communicate with the Microsoft Defender Antivirus cloud service: - -```console -"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -ValidateMapsConnection -``` - -> [!NOTE] -> You need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. This command will only work on Windows 10, version 1703 or higher. - -For more information, see [Manage Microsoft Defender Antivirus with the mpcmdrun.exe commandline tool](command-line-arguments-microsoft-defender-antivirus.md). - -**Attempt to download a fake malware file from Microsoft:** - -You can download a sample file that Microsoft Defender Antivirus will detect and block if you're properly connected to the cloud. - -Download the file by visiting [https://aka.ms/ioavtest](https://aka.ms/ioavtest). - ->[!NOTE] ->This file is not an actual piece of malware. It's a fake file that is designed to test if you're properly connected to the cloud. - -If you're properly connected, you'll see a warning Microsoft Defender Antivirus notification. - -If you're using Microsoft Edge, you'll also see a notification message: - -![Microsoft Edge informing the user that malware was found](images/defender/wdav-bafs-edge.png) - -A similar message occurs if you're using Internet Explorer: - -![Microsoft Defender Antivirus notification informing the user that malware was found](images/defender/wdav-bafs-ie.png) - -You'll also see a detection under **Quarantined threats** in the **Scan history** section in the Windows Security app: - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Scan history** label: - - ![Screenshot of the Scan history label in the Windows Security app](images/defender/wdav-history-wdsc.png) - -3. Under the **Quarantined threats** section, select **See full history** to see the detected fake malware. - - > [!NOTE] - > Versions of Windows 10 before version 1703 have a different user interface. See [Microsoft Defender Antivirus in the Windows Security app](microsoft-defender-security-center-antivirus.md). - - The Windows event log will also show [Windows Defender client event ID 1116](troubleshoot-microsoft-defender-antivirus.md). - -## Related articles - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) - -- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) - -- [Command line arguments](command-line-arguments-microsoft-defender-antivirus.md) - -- [Important changes to Microsoft Active Protection Services endpoint](https://techcommunity.microsoft.com/t5/Configuration-Manager-Archive/Important-changes-to-Microsoft-Active-Protection-Service-MAPS/ba-p/274006) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md deleted file mode 100644 index cac3d9f94e..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus.md +++ /dev/null @@ -1,109 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus notifications -description: Learn how to configure and customize both standard and additional Microsoft Defender Antivirus notifications on endpoints. -keywords: notifications, defender, antivirus, endpoint, management, admin -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure the notifications that appear on endpoints - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -In Windows 10, application notifications about malware detection and remediation are more robust, consistent, and concise. - -Notifications appear on endpoints when manually triggered and scheduled scans are completed and threats are detected. These notifications also appear in the **Notification Center**, and a summary of scans and threat detections appear at regular time intervals. - -You can also configure how standard notifications appear on endpoints, such as notifications for reboot or when a threat has been detected and remediated. - -## Configure the additional notifications that appear on endpoints - -You can configure the display of additional notifications, such as recent threat detection summaries, in the [Windows Security app](microsoft-defender-security-center-antivirus.md) and with Group Policy. - -> [!NOTE] -> In Windows 10, version 1607 the feature was called **Enhanced notifications** and could be configured under **Windows Settings** > **Update & security** > **Windows Defender**. In Group Policy settings in all versions of Windows 10, it is called **Enhanced notifications**. - -> [!IMPORTANT] -> Disabling additional notifications will not disable critical notifications, such as threat detection and remediation alerts. - -**Use the Windows Security app to disable additional notifications:** - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) - -3. Scroll to the **Notifications** section and click **Change notification settings**. - -4. Slide the switch to **Off** or **On** to disable or enable additional notifications. - -**Use Group Policy to disable additional notifications:** - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Reporting**. - -5. Double-click **Turn off enhanced notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. - -## Configure standard notifications on endpoints - -You can use Group Policy to: - -- Display additional, customized text on endpoints when the user needs to perform an action -- Hide all notifications on endpoints -- Hide reboot notifications on endpoints - -Hiding notifications can be useful in situations where you can't hide the entire Microsoft Defender Antivirus interface. See [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) for more information. - -> [!NOTE] -> Hiding notifications will only occur on endpoints to which the policy has been deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the [Microsoft Endpoint Manager Endpoint Protection monitoring dashboard and reports](/configmgr/protect/deploy-use/monitor-endpoint-protection). - -See [Customize the Windows Security app for your organization](../windows-defender-security-center/windows-defender-security-center.md) for instructions to add custom contact information to the notifications that users see on their machines. - -**Use Group Policy to hide notifications:** - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure, and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. - -4. Double-click **Suppress all notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. - -**Use Group Policy to hide reboot notifications:** - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. - -5. Double-click **Suppresses reboot notifications** and set the option to **Enabled**. Click **OK**. This will prevent additional notifications from appearing. - -## Related topics - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md deleted file mode 100644 index 1038d3e8e8..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: Configure exclusions for files opened by specific processes -description: You can exclude files from scans if they have been opened by a specific process. -keywords: Microsoft Defender Antivirus, process, exclusion, files, scans -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure exclusions for files opened by processes - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. - -This article describes how to configure exclusion lists. - -## Examples of exclusions - -|Exclusion | Example | -|---|---| -|Any file on the machine that is opened by any process with a specific file name | Specifying `test.exe` would exclude files opened by:
`c:\sample\test.exe`
`d:\internal\files\test.exe` | -|Any file on the machine that is opened by any process under a specific folder | Specifying `c:\test\sample\*` would exclude files opened by:
`c:\test\sample\test.exe`
`c:\test\sample\test2.exe`
`c:\test\sample\utility.exe` | -|Any file on the machine that is opened by a specific process in a specific folder | Specifying `c:\test\process.exe` would exclude files only opened by `c:\test\process.exe` | - - -When you add a process to the process exclusion list, Microsoft Defender Antivirus won't scan files opened by that process, no matter where the files are located. The process itself, however, will be scanned unless it has also been added to the [file exclusion list](configure-extension-file-exclusions-microsoft-defender-antivirus.md). - -The exclusions only apply to [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). They don't apply to scheduled or on-demand scans. - -Changes made with Group Policy to the exclusion lists **will show** in the lists in the [Windows Security app](microsoft-defender-security-center-antivirus.md). However, changes made in the Windows Security app **will not show** in the Group Policy lists. - -You can add, remove, and review the lists for exclusions in Group Policy, Microsoft Endpoint Configuration Manager, Microsoft Intune, and with the Windows Security app, and you can use wildcards to further customize the lists. - -You can also use PowerShell cmdlets and WMI to configure the exclusion lists, including reviewing your lists. - -By default, local changes made to the lists (by users with administrator privileges; changes made with PowerShell and WMI) will be merged with the lists as defined (and deployed) by Group Policy, Configuration Manager, or Intune. The Group Policy lists will take precedence in the case of conflicts. - -You can [configure how locally and globally defined exclusions lists are merged](configure-local-policy-overrides-microsoft-defender-antivirus.md#merge-lists) to allow local changes to override managed deployment settings. - -## Configure the list of exclusions for files opened by specified processes - -### Use Microsoft Intune to exclude files that have been opened by specified processes from scans - -See [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. - -### Use Microsoft Endpoint Manager to exclude files that have been opened by specified processes from scans - -See [How to create and deploy antimalware policies: Exclusion settings](/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings) for details on configuring Microsoft Endpoint Manager (current branch). - -### Use Group Policy to exclude files that have been opened by specified processes from scans - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. - -3. Expand the tree to **Windows components > Microsoft Defender Antivirus > Exclusions**. - -4. Double-click **Process Exclusions** and add the exclusions: - - 1. Set the option to **Enabled**. - 2. Under the **Options** section, click **Show...**. - 3. Enter each process on its own line under the **Value name** column. See the example table for the different types of process exclusions. Enter **0** in the **Value** column for all processes. - -5. Click **OK**. - -### Use PowerShell cmdlets to exclude files that have been opened by specified processes from scans - -Using PowerShell to add or remove exclusions for files that have been opened by processes requires using a combination of three cmdlets with the `-ExclusionProcess` parameter. The cmdlets are all in the [Defender module](/powershell/module/defender/). - -The format for the cmdlets is: - -```PowerShell - -ExclusionProcess "" -``` - -The following are allowed as the \: - -|Configuration action | PowerShell cmdlet | -|---|---| -|Create or overwrite the list | `Set-MpPreference` | -|Add to the list | `Add-MpPreference` | -|Remove items from the list | `Remove-MpPreference` | - ->[!IMPORTANT] ->If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. - -For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file that is opened by the specified process: - -```PowerShell -Add-MpPreference -ExclusionProcess "c:\internal\test.exe" -``` - -For more information on how to use PowerShell with Microsoft Defender Antivirus, see Manage antivirus with PowerShell cmdlets and [Microsoft Defender Antivirus cmdlets](/powershell/module/defender). - -### Use Windows Management Instruction (WMI) to exclude files that have been opened by specified processes from scans - -Use the [**Set**, **Add**, and **Remove** methods of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -ExclusionProcess -``` - -The use of **Set**, **Add**, and **Remove** is analogous to their counterparts in PowerShell: `Set-MpPreference`, `Add-MpPreference`, and `Remove-MpPreference`. - -For more information and allowed parameters, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). - -### Use the Windows Security app to exclude files that have been opened by specified processes from scans - -See [Add exclusions in the Windows Security app](microsoft-defender-security-center-antivirus.md) for instructions. - -## Use wildcards in the process exclusion list - -The use of wildcards in the process exclusion list is different from their use in other exclusion lists. - -In particular, you cannot use the question mark (`?`) wildcard, and the asterisk (`*`) wildcard can only be used at the end of a complete path. You can still use environment variables (such as `%ALLUSERSPROFILE%`) as wildcards when defining items in the process exclusion list. - -The following table describes how the wildcards can be used in the process exclusion list: - -|Wildcard | Example use | Example matches | -|:---|:---|:---| -|`*` (asterisk)

Replaces any number of characters | `C:\MyData\*` | Any file opened by `C:\MyData\file.exe` | -|Environment variables

The defined variable is populated as a path when the exclusion is evaluated | `%ALLUSERSPROFILE%\CustomLogFiles\file.exe` | Any file opened by `C:\ProgramData\CustomLogFiles\file.exe` | - -## Review the list of exclusions - -You can retrieve the items in the exclusion list with MpCmdRun, PowerShell, [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies#exclusion-settings), [Intune](/intune/device-restrictions-configure), or the [Windows Security app](microsoft-defender-security-center-antivirus.md). - -If you use PowerShell, you can retrieve the list in two ways: - -- Retrieve the status of all Microsoft Defender Antivirus preferences. Each of the lists will be displayed on separate lines, but the items within each list will be combined into the same line. -- Write the status of all preferences to a variable, and use that variable to only call the specific list you are interested in. Each use of `Add-MpPreference` is written to a new line. - -### Validate the exclusion list by using MpCmdRun - -To check exclusions with the dedicated [command-line tool mpcmdrun.exe](./command-line-arguments-microsoft-defender-antivirus.md?branch=v-anbic-wdav-new-mpcmdrun-options), use the following command: - -```DOS -MpCmdRun.exe -CheckExclusion -path -``` - -> [!NOTE] -> Checking exclusions with MpCmdRun requires Microsoft Defender Antivirus CAMP version 4.18.1812.3 (released in December 2018) or later. - - -### Review the list of exclusions alongside all other Microsoft Defender Antivirus preferences by using PowerShell - -Use the following cmdlet: - -```PowerShell -Get-MpPreference -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Retrieve a specific exclusions list by using PowerShell - -Use the following code snippet (enter each line as a separate command); replace **WDAVprefs** with whatever label you want to name the variable: - -```PowerShell -$WDAVprefs = Get-MpPreference -$WDAVprefs.ExclusionProcess -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -## Related articles - -- [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) -- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) -- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md deleted file mode 100644 index 0db9441ac9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Enable and configure Microsoft Defender Antivirus protection features -description: Enable behavior-based, heuristic, and real-time protection in Microsoft Defender AV. -keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, Microsoft Defender Antivirus, antimalware, security, defender -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure behavioral, heuristic, and real-time protection - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus uses several methods to provide threat protection: - -- Cloud-delivered protection for near-instant detection and blocking of new and emerging threats -- Always-on scanning, using file and process behavior monitoring and other heuristics (also known as "real-time protection") -- Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research - -You can configure how Microsoft Defender Antivirus uses these methods with Group Policy, System Center Configuration Manage, PowerShell cmdlets, and Windows Management Instrumentation (WMI). - -This section covers configuration for always-on scanning, including how to detect and block apps that are deemed unsafe, but may not be detected as malware. - -See [Use next-gen Microsoft Defender Antivirus technologies through cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for how to enable and configure Microsoft Defender Antivirus cloud-delivered protection. - -## In this section - - Topic | Description ----|--- -[Detect and block potentially unwanted applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) | Detect and block apps that may be unwanted in your network, such as adware, browser modifiers and toolbars, and rogue or fake antivirus apps -[Enable and configure Microsoft Defender Antivirus protection capabilities](configure-real-time-protection-microsoft-defender-antivirus.md) | Enable and configure real-time protection, heuristics, and other always-on Microsoft Defender Antivirus monitoring features \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md deleted file mode 100644 index ba1b7c7011..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Enable and configure Microsoft Defender Antivirus protection capabilities -description: Enable and configure Microsoft Defender Antivirus real-time protection features such as behavior monitoring, heuristics, and machine-learning -keywords: antivirus, real-time protection, rtp, machine-learning, behavior monitoring, heuristics -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.date: 12/16/2019 -ms.reviewer: -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Enable and configure Microsoft Defender Antivirus always-on protection in Group Policy - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities. - -These activities include events, such as processes making unusual changes to existing files, modifying or creating automatic startup registry keys and startup locations (also known as auto-start extensibility points, or ASEPs), and other changes to the file system or file structure. - -## Enable and configure always-on protection in Group Policy - -You can use **Local Group Policy Editor** to enable and configure Microsoft Defender Antivirus always-on protection settings. - -To enable and configure always-on protection: - -1. Open **Local Group Policy Editor**. To do this: - - 1. In your Windows 10 taskbar search box, type **gpedit**. - - 1. Under **Best match**, click **Edit group policy** to launch **Local Group Policy Editor**. - - ![GPEdit taskbar search result](images/gpedit-search.png) - -2. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus**. - -3. Configure the Microsoft Defender Antivirus antimalware service policy settings. To do this: - - 1. In the **Microsoft Defender Antivirus** details pane on right, double-click the policy setting as specified in the following table: - - | Setting | Description | Default setting | - |-----------------------------|------------------------|-------------------------------| - | Allow antimalware service to startup with normal priority | You can lower the priority of the Microsoft Defender Antivirus engine, which may be useful in lightweight deployments where you want to have as lean a startup process as possible. This may impact protection on the endpoint. | Enabled - | Allow antimalware service to remain running always | If protection updates have been disabled, you can set Microsoft Defender Antivirus to still run. This lowers the protection on the endpoint. | Disabled | - - 1. Configure the setting as appropriate, and click **OK**. - - 1. Repeat the previous steps for each setting in the table. - -4. Configure the Microsoft Defender Antivirus real-time protection policy settings. To do this: - - 1. In the **Microsoft Defender Antivirus** details pane, double-click **Real-time Protection**. Or, from the **Microsoft Defender Antivirus** tree on left pane, click **Real-time Protection**. - - 1. In the **Real-time Protection** details pane on right, double-click the policy setting as specified in the following table: - - | Setting | Description | Default setting | - |-----------------------------|------------------------|-------------------------------| - | Turn on behavior monitoring | The AV engine will monitor file processes, file and registry changes, and other events on your endpoints for suspicious and known malicious activity. | Enabled | - | Scan all downloaded files and attachments | Downloaded files and attachments are automatically scanned. This operates in addition to the Windows Defender SmartScreen filter, which scans files before and during downloading. | Enabled | - | Monitor file and program activity on your computer | The Microsoft Defender Antivirus engine makes note of any file changes (file writes, such as moves, copies, or modifications) and general program activity (programs that are opened or running and that cause other programs to run). | Enabled | - | Turn on raw volume write notifications | Information about raw volume writes will be analyzed by behavior monitoring. | Enabled | - | Turn on process scanning whenever real-time protection is enabled | You can independently enable the Microsoft Defender Antivirus engine to scan running processes for suspicious modifications or behaviors. This is useful if you have temporarily disabled real-time protection and want to automatically scan processes that started while it was disabled. | Enabled | - | Define the maximum size of downloaded files and attachments to be scanned | You can define the size in kilobytes. | Enabled | - | Configure local setting override for turn on behavior monitoring | Configure a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | - | Configure local setting override for scanning all downloaded files and attachments | Configure a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | - | Configure local setting override for monitoring file and program activity on your computer | Configure a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | - | Configure local setting override to turn on real-time protection | Configure a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting.| Enabled | - | Configure local setting override for monitoring for incoming and outgoing file activity | Configure a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. | Enabled | - | Configure monitoring for incoming and outgoing file and program activity | Specify whether monitoring should occur on incoming, outgoing, both, or neither direction. This is relevant for Windows Server installations where you have defined specific servers or Server Roles that see large amounts of file changes in only one direction and you want to improve network performance. Fully updated endpoints (and servers) on a network will see little performance impact irrespective of the number or direction of file changes. | Enabled (both directions) | - - 1. Configure the setting as appropriate, and click **OK**. - - 1. Repeat the previous steps for each setting in the table. - -5. Configure the Microsoft Defender Antivirus scanning policy setting. To do this: - - 1. From the **Microsoft Defender Antivirus** tree on left pane, click **Scan**. - - ![Microsoft Defender Antivirus Scan options](images/gpedit-windows-defender-antivirus-scan.png) - - 1. In the **Scan** details pane on right, double-click the policy setting as specified in the following table: - - | Setting | Description | Default setting | - |-----------------------------|------------------------|-------------------------------| - | Turn on heuristics | Heuristic protection will disable or block suspicious activity immediately before the Microsoft Defender Antivirus engine is asked to detect the activity. | Enabled | - - 1. Configure the setting as appropriate, and click **OK**. - -6. Close **Local Group Policy Editor**. - - -## Disable real-time protection in Group Policy - -> [!WARNING] -> Disabling real-time protection drastically reduces the protection on your endpoints and is not recommended. - -The main real-time protection capability is enabled by default, but you can disable it by using **Local Group Policy Editor**. - -To disable real-time protection in Group policy: - -1. Open **Local Group Policy Editor**. - - 1. In your Windows 10 taskbar search box, type **gpedit**. - - 1. Under **Best match**, click **Edit group policy** to launch **Local Group Policy Editor**. - -2. In the left pane of **Local Group Policy Editor**, expand the tree to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **Real-time Protection**. - -3. In the **Real-time Protection** details pane on right, double-click **Turn off real-time protection**. - - ![Turn off real-time protection](images/gpedit-turn-off-real-time-protection.png) - -4. In the **Turn off real-time protection** setting window, set the option to **Enabled**. - - ![Turn off real-time protection enabled](images/gpedit-turn-off-real-time-protection-enabled.png) - -5. Click **OK**. - -6. Close **Local Group Policy Editor**. - -## Related articles - -- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md deleted file mode 100644 index 80e5126cc2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Configure remediation for Microsoft Defender Antivirus detections -description: Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder -keywords: remediation, fix, remove, threats, quarantine, scan, restore -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 03/16/2021 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure remediation for Microsoft Defender Antivirus detections - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -When Microsoft Defender Antivirus runs a scan, it attempts to remediate or remove threats that are detected. You can configure how Microsoft Defender Antivirus should address certain threats, whether a restore point should be created before remediating, and when threats should be removed. - -This article describes how to configure these settings by using Group Policy, but you can also use [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies#threat-overrides-settings) and [Microsoft Intune](/intune/device-restrictions-configure). - -You can also use the [`Set-MpPreference` PowerShell cmdlet](/powershell/module/defender/set-mppreference) or [`MSFT_MpPreference` WMI class](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) to configure these settings. - -## Configure remediation options - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration** and select **Administrative templates**. - -3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus**. - -4. Using the table below, select a location, and then edit the policy as needed. - -5. Select **OK**. - -|Location | Setting | Description | Default setting (if not configured) | -|:---|:---|:---|:---| -|Scan | Create a system restore point | A system restore point will be created each day before cleaning or scanning is attempted | Disabled| -|Scan | Turn on removal of items from scan history folder | Specify how many days items should be kept in the scan history | 30 days | -|Root | Turn off routine remediation | You can specify whether Microsoft Defender Antivirus automatically remediates threats, or if it should ask the endpoint user what to do. | Disabled (threats are remediated automatically) | -|Quarantine | Configure removal of items from Quarantine folder | Specify how many days items should be kept in quarantine before being removed | 90 days | -|Threats | Specify threat alert levels at which default action should not be taken when detected | Every threat that is detected by Microsoft Defender Antivirus is assigned a threat level (low, medium, high, or severe). You can use this setting to define how all threats for each of the threat levels should be remediated (quarantined, removed, or ignored) | Not applicable | -|Threats | Specify threats upon which default action should not be taken when detected | Specify how specific threats (using their threat ID) should be remediated. You can specify whether the specific threat should be quarantined, removed, or ignored | Not applicable | - -> [!IMPORTANT] -> Microsoft Defender Antivirus detects and remediates files based on many factors. Sometimes, completing a remediation requires a reboot. Even if the detection is later determined to be a false positive, the reboot must be completed to ensure all additional remediation steps have been completed. -> -> If you are certain Microsoft Defender Antivirus quarantined a file based on a false positive, you can restore the file from quarantine after the device reboots. See [Restore quarantined files in Microsoft Defender Antivirus](restore-quarantined-files-microsoft-defender-antivirus.md). -> -> To avoid this problem in the future, you can exclude files from the scans. See [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md). - -Also see [Configure remediation-required scheduled full Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md#remed) for more remediation-related settings. - -## See also - -- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) -- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) -- [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) -- [Configure end-user Microsoft Defender Antivirus interaction](configure-end-user-interaction-microsoft-defender-antivirus.md) -- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md deleted file mode 100644 index 4f690811e9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus.md +++ /dev/null @@ -1,339 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus exclusions on Windows Server -ms.reviewer: -manager: dansimp -description: Windows Server includes automatic exclusions, based on server role. You can also add custom exclusions. -keywords: exclusions, server, auto-exclusions, automatic, custom, scans, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.technology: mde -ms.date: 02/10/2021 ---- - -# Configure Microsoft Defender Antivirus exclusions on Windows Server - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md). - -> [!NOTE] -> Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan. - -In addition to server role-defined automatic exclusions, you can add or remove custom exclusions. To do that, refer to these articles: -- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) - -## A few points to keep in mind - -Keep the following important points in mind: - -- Custom exclusions take precedence over automatic exclusions. -- Automatic exclusions only apply to Real-time protection (RTP) scanning. Automatic exclusions are not honored during a Full/Quick or On-demand scan. -- Custom and duplicate exclusions do not conflict with automatic exclusions. -- Microsoft Defender Antivirus uses the Deployment Image Servicing and Management (DISM) tools to determine which roles are installed on your computer. - -## Opt out of automatic exclusions - -In Windows Server 2016 and Windows Server 2019, the predefined exclusions delivered by Security intelligence updates only exclude the default paths for a role or feature. If you installed a role or feature in a custom path, or you want to manually control the set of exclusions, make sure to opt out of the automatic exclusions delivered in Security intelligence updates. But keep in mind that the exclusions that are delivered automatically are optimized for Windows Server 2016 and 2019 roles. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists. - -> [!WARNING] -> Opting out of automatic exclusions may adversely impact performance, or result in data corruption. The exclusions that are delivered automatically are optimized for Windows Server 2016 and Windows Server 2019 roles. - -Because predefined exclusions only exclude **default paths**, if you move NTDS and SYSVOL to another drive or path that is *different from the original path*, you must add exclusions manually using the information [here](configure-extension-file-exclusions-microsoft-defender-antivirus.md#configure-the-list-of-exclusions-based-on-folder-name-or-file-extension) . - -You can disable the automatic exclusion lists with Group Policy, PowerShell cmdlets, and WMI. - -### Use Group Policy to disable the auto-exclusions list on Windows Server 2016 and Windows Server 2019 - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725752(v=ws.11)). Right-click the Group Policy Object you want to configure, and then click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration**, and then click **Administrative templates**. -3. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Exclusions**. -4. Double-click **Turn off Auto Exclusions**, and set the option to **Enabled**. Then click **OK**. - -### Use PowerShell cmdlets to disable the auto-exclusions list on Windows Server 2016 and 2019 - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -DisableAutoExclusions $true -``` - -To learn more, see the following resources: - -- [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md). -- [Use PowerShell with Microsoft Defender Antivirus](/powershell/module/defender/). - -### Use Windows Management Instruction (WMI) to disable the auto-exclusions list on Windows Server 2016 and Windows Server 2019 - -Use the **Set** method of the [MSFT_MpPreference](/previous-versions/windows/desktop/defender/msft-mppreference) class for the following properties: - -```WMI -DisableAutoExclusions -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - -## List of automatic exclusions - -The following sections contain the exclusions that are delivered with automatic exclusions file paths and file types. - -### Default exclusions for all roles - -This section lists the default exclusions for all Windows Server 2016 and 2019 roles. - -> [!NOTE] -> The default locations could be different than what's listed in this article. - -#### Windows "temp.edb" files - -- `%windir%\SoftwareDistribution\Datastore\*\tmp.edb` -- `%ProgramData%\Microsoft\Search\Data\Applications\Windows\*\*.log` - -#### Windows Update files or Automatic Update files - -- `%windir%\SoftwareDistribution\Datastore\*\Datastore.edb` -- `%windir%\SoftwareDistribution\Datastore\*\edb.chk` -- `%windir%\SoftwareDistribution\Datastore\*\edb\*.log` -- `%windir%\SoftwareDistribution\Datastore\*\Edb\*.jrs` -- `%windir%\SoftwareDistribution\Datastore\*\Res\*.log` - -#### Windows Security files - -- `%windir%\Security\database\*.chk` -- `%windir%\Security\database\*.edb` -- `%windir%\Security\database\*.jrs` -- `%windir%\Security\database\*.log` -- `%windir%\Security\database\*.sdb` - -#### Group Policy files - -- `%allusersprofile%\NTUser.pol` -- `%SystemRoot%\System32\GroupPolicy\Machine\registry.pol` -- `%SystemRoot%\System32\GroupPolicy\User\registry.pol` - -#### WINS files - -- `%systemroot%\System32\Wins\*\*.chk` -- `%systemroot%\System32\Wins\*\*.log` -- `%systemroot%\System32\Wins\*\*.mdb` -- `%systemroot%\System32\LogFiles\` -- `%systemroot%\SysWow64\LogFiles\` - -#### File Replication Service (FRS) exclusions - -- Files in the File Replication Service (FRS) working folder. The FRS working folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Working Directory` - - - `%windir%\Ntfrs\jet\sys\*\edb.chk` - - `%windir%\Ntfrs\jet\*\Ntfrs.jdb` - - `%windir%\Ntfrs\jet\log\*\*.log` - -- FRS Database log files. The FRS Database log file folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Ntfrs\Parameters\DB Log File Directory` - - - `%windir%\Ntfrs\*\Edb\*.log` - -- The FRS staging folder. The staging folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets\GUID\Replica Set Stage` - - - `%systemroot%\Sysvol\*\Ntfrs_cmp*\` - -- The FRS preinstall folder. This folder is specified by the folder `Replica_root\DO_NOT_REMOVE_NtFrs_PreInstall_Directory` - - - `%systemroot%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\*\Ntfrs*\` - -- The Distributed File System Replication (DFSR) database and working folders. These folders are specified by the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DFSR\Parameters\Replication Groups\GUID\Replica Set Configuration File` - - > [!NOTE] - > For custom locations, see [Opt out of automatic exclusions](#opt-out-of-automatic-exclusions). - - - `%systemdrive%\System Volume Information\DFSR\$db_normal$` - - `%systemdrive%\System Volume Information\DFSR\FileIDTable_*` - - `%systemdrive%\System Volume Information\DFSR\SimilarityTable_*` - - `%systemdrive%\System Volume Information\DFSR\*.XML` - - `%systemdrive%\System Volume Information\DFSR\$db_dirty$` - - `%systemdrive%\System Volume Information\DFSR\$db_clean$` - - `%systemdrive%\System Volume Information\DFSR\$db_lostl$` - - `%systemdrive%\System Volume Information\DFSR\Dfsr.db` - - `%systemdrive%\System Volume Information\DFSR\*.frx` - - `%systemdrive%\System Volume Information\DFSR\*.log` - - `%systemdrive%\System Volume Information\DFSR\Fsr*.jrs` - - `%systemdrive%\System Volume Information\DFSR\Tmp.edb` - -#### Process exclusions - -- `%systemroot%\System32\dfsr.exe` -- `%systemroot%\System32\dfsrs.exe` - -#### Hyper-V exclusions - -The following table lists the file type exclusions, folder exclusions, and process exclusions that are delivered automatically when you install the Hyper-V role. - -|File type exclusions |Folder exclusions | Process exclusions | -|:--|:--|:--| -| `*.vhd`
`*.vhdx`
`*.avhd`
`*.avhdx`
`*.vsv`
`*.iso`
`*.rct`
`*.vmcx`
`*.vmrs` | `%ProgramData%\Microsoft\Windows\Hyper-V`
`%ProgramFiles%\Hyper-V`
`%SystemDrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots`
`%Public%\Documents\Hyper-V\Virtual Hard Disks` | `%systemroot%\System32\Vmms.exe`
`%systemroot%\System32\Vmwp.exe` | - -#### SYSVOL files - -- `%systemroot%\Sysvol\Domain\*.adm` -- `%systemroot%\Sysvol\Domain\*.admx` -- `%systemroot%\Sysvol\Domain\*.adml` -- `%systemroot%\Sysvol\Domain\Registry.pol` -- `%systemroot%\Sysvol\Domain\*.aas` -- `%systemroot%\Sysvol\Domain\*.inf` -- `%systemroot%\Sysvol\Domain\*Scripts.ini` -- `%systemroot%\Sysvol\Domain\*.ins` -- `%systemroot%\Sysvol\Domain\Oscfilter.ini` - - -### Active Directory exclusions - -This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services. - -#### NTDS database files - -The database files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Database File` - -- `%windir%\Ntds\ntds.dit` -- `%windir%\Ntds\ntds.pat` - -#### The AD DS transaction log files - -The transaction log files are specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\Database Log Files Path` - -- `%windir%\Ntds\EDB*.log` -- `%windir%\Ntds\Res*.log` -- `%windir%\Ntds\Edb*.jrs` -- `%windir%\Ntds\Ntds*.pat` -- `%windir%\Ntds\TEMP.edb` - -#### The NTDS working folder - -This folder is specified in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory` - -- `%windir%\Ntds\Temp.edb` -- `%windir%\Ntds\Edb.chk` - -#### Process exclusions for AD DS and AD DS-related support files - -- `%systemroot%\System32\ntfrs.exe` -- `%systemroot%\System32\lsass.exe` - -### DHCP Server exclusions - -This section lists the exclusions that are delivered automatically when you install the DHCP Server role. The DHCP Server file locations are specified by the *DatabasePath*, *DhcpLogFilePath*, and *BackupDatabasePath* parameters in the registry key `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\Parameters` - -- `%systemroot%\System32\DHCP\*\*.mdb` -- `%systemroot%\System32\DHCP\*\*.pat` -- `%systemroot%\System32\DHCP\*\*.log` -- `%systemroot%\System32\DHCP\*\*.chk` -- `%systemroot%\System32\DHCP\*\*.edb` - -### DNS Server exclusions - -This section lists the file and folder exclusions and the process exclusions that are delivered automatically when you install the DNS Server role. - -#### File and folder exclusions for the DNS Server role - -- `%systemroot%\System32\Dns\*\*.log` -- `%systemroot%\System32\Dns\*\*.dns` -- `%systemroot%\System32\Dns\*\*.scc` -- `%systemroot%\System32\Dns\*\BOOT` - -#### Process exclusions for the DNS Server role - -- `%systemroot%\System32\dns.exe` - -### File and Storage Services exclusions - -This section lists the file and folder exclusions that are delivered automatically when you install the File and Storage Services role. The exclusions listed below do not include exclusions for the Clustering role. - -- `%SystemDrive%\ClusterStorage` -- `%clusterserviceaccount%\Local Settings\Temp` -- `%SystemDrive%\mscs` - -### Print Server exclusions - -This section lists the file type exclusions, folder exclusions, and the process exclusions that are delivered automatically when you install the Print Server role. - -#### File type exclusions - -- `*.shd` -- `*.spl` - -#### Folder exclusions - -This folder is specified in the registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory` - -- `%system32%\spool\printers\*` - -#### Process exclusions - -- `spoolsv.exe` - -### Web Server exclusions - -This section lists the folder exclusions and the process exclusions that are delivered automatically when you install the Web Server role. - -#### Folder exclusions - -- `%SystemRoot%\IIS Temporary Compressed Files` -- `%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files` -- `%SystemDrive%\inetpub\temp\ASP Compiled Templates` -- `%systemDrive%\inetpub\logs` -- `%systemDrive%\inetpub\wwwroot` - -#### Process exclusions - -- `%SystemRoot%\system32\inetsrv\w3wp.exe` -- `%SystemRoot%\SysWOW64\inetsrv\w3wp.exe` -- `%SystemDrive%\PHP5433\php-cgi.exe` - -#### Turning off scanning of files in the Sysvol\Sysvol folder or the SYSVOL_DFSR\Sysvol folder - -The current location of the `Sysvol\Sysvol` or `SYSVOL_DFSR\Sysvol` folder and all the subfolders is the file system reparse target of the replica set root. The `Sysvol\Sysvol` and `SYSVOL_DFSR\Sysvol` folders use the following locations by default: - -- `%systemroot%\Sysvol\Domain` -- `%systemroot%\Sysvol_DFSR\Domain` - -The path to the currently active `SYSVOL` is referenced by the NETLOGON share and can be determined by the SysVol value name in the following subkey: `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netlogon\Parameters` - -Exclude the following files from this folder and all its subfolders: - -- `*.adm` -- `*.admx` -- `*.adml` -- `Registry.pol` -- `Registry.tmp` -- `*.aas` -- `*.inf` -- `Scripts.ini` -- `*.ins` -- `Oscfilter.ini` - -### Windows Server Update Services exclusions - -This section lists the folder exclusions that are delivered automatically when you install the Windows Server Update Services (WSUS) role. The WSUS folder is specified in the registry key `HKEY_LOCAL_MACHINE\Software\Microsoft\Update Services\Server\Setup` - -- `%systemroot%\WSUS\WSUSContent` -- `%systemroot%\WSUS\UpdateServicesDBFiles` -- `%systemroot%\SoftwareDistribution\Datastore` -- `%systemroot%\SoftwareDistribution\Download` - -## See also - -- [Configure and validate exclusions for Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -- [Common mistakes to avoid when defining exclusions](common-exclusion-mistakes-microsoft-defender-antivirus.md) -- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md deleted file mode 100644 index df816552ac..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Run and customize scheduled and on-demand scans -description: Customize and initiate Microsoft Defender Antivirus scans on endpoints across your network. -keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans. - -## In this section - -Topic | Description ----|--- -[Configure and validate file, folder, and process-opened file exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning -[Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) | You can configure Microsoft Defender Antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning -[Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) | Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder -[Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans -[Configure and run scans](run-scan-microsoft-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app -[Review scan results](review-scan-results-microsoft-defender-antivirus.md) | Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md deleted file mode 100644 index 38383683dc..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Run and customize scheduled and on-demand scans -description: Customize and initiate Microsoft Defender Antivirus scans on endpoints across your network. -keywords: scan, schedule, customize, exclusions, exclude files, remediation, scan results, quarantine, remove threat, quick scan, full scan, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Customize, initiate, and review the results of Microsoft Defender Antivirus scans & remediation - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans. - -## In this section - -| Article | Description | -|:---|:---| -|[Configure and validate file, folder, and process-opened file exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | You can exclude files (including files modified by specified processes) and folders from on-demand scans, scheduled scans, and always-on real-time protection monitoring and scanning | -|[Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) | You can configure Microsoft Defender Antivirus to include certain types of email storage files, back-up or reparse points, and archived files (such as .zip files) in scans. You can also enable network file scanning | -|[Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) | Configure what Microsoft Defender Antivirus should do when it detects a threat, and how long quarantined files should be retained in the quarantine folder | -|[Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans | -|[Configure and run scans](run-scan-microsoft-defender-antivirus.md) | Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app | -|[Review scan results](review-scan-results-microsoft-defender-antivirus.md) | Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app | \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md deleted file mode 100644 index 312b011998..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Deploy, manage, and report on Microsoft Defender Antivirus -description: You can deploy and manage Microsoft Defender Antivirus with Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, or WMI -keywords: deploy, manage, update, protection, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Deploy, manage, and report on Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can deploy, manage, and report on Microsoft Defender Antivirus in a number of ways. - -Because the Microsoft Defender Antivirus client is installed as a core part of Windows 10, traditional deployment of a client to your endpoints does not apply. - -However, in most cases you will still need to enable the protection service on your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Azure Defender, or Group Policy Objects, which is described in the following table. - -You'll also see additional links for: - -- Managing Microsoft Defender Antivirus protection, including managing product and protection updates -- Reporting on Microsoft Defender Antivirus protection - -> [!IMPORTANT] -> In most cases, Windows 10 will disable Microsoft Defender Antivirus if it finds another antivirus product that is running and up-to-date. You must disable or uninstall third-party antivirus products before Microsoft Defender Antivirus will function. If you re-enable or install third-party antivirus products, then Windows 10 automatically disables Microsoft Defender Antivirus. - -Tool|Deployment options (2)|Management options (network-wide configuration and policy or baseline deployment) ([3](#fn3))|Reporting options ----|---|---|--- -Microsoft Intune|[Add endpoint protection settings in Intune](/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](/intune/device-restrictions-configure)| [Use the Intune console to manage devices](/intune/device-management) -Microsoft Endpoint Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][] -Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Microsoft Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Microsoft Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] -PowerShell|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference] and [Update-MpSignature] cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module][] -Windows Management Instrumentation|Deploy with Group Policy, Microsoft Endpoint Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][] -Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Defender*](/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Microsoft Defender Antivirus events][] and add that tool as an app in AAD. - -1. The availability of some functions and features, especially related to cloud-delivered protection, differ between Microsoft Endpoint Manager (Current Branch) and System Center 2012 Configuration Manager. In this library, we've focused on Windows 10, Windows Server 2016, and Microsoft Endpoint Manager (Current Branch). See [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for a table that describes the major differences. [(Return to table)](#ref2) - -2. In Windows 10, Microsoft Defender Antivirus is a component available without installation or deployment of an additional client or service. It will automatically be enabled when third-party antivirus products are either uninstalled or out of date ([except on Windows Server 2016](microsoft-defender-antivirus-on-windows-server-2016.md)). Traditional deployment therefore is not required. Deployment here refers to ensuring the Microsoft Defender Antivirus component is available and enabled on endpoints or servers. [(Return to table)](#ref2) - -3. Configuration of features and protection, including configuring product and protection updates, are further described in the [Configure Microsoft Defender Antivirus features](configure-notifications-microsoft-defender-antivirus.md) section in this library. [(Return to table)](#ref2) - -[Endpoint Protection point site system role]: /configmgr/protect/deploy-use/endpoint-protection-site-role -[default and customized antimalware policies]: /configmgr/protect/deploy-use/endpoint-antimalware-policies -[client management]: /configmgr/core/clients/manage/manage-clients -[enable Endpoint Protection with custom client settings]: /configmgr/protect/deploy-use/endpoint-protection-configure-client -[Configuration Manager Monitoring workspace]: /configmgr/protect/deploy-use/monitor-endpoint-protection -[email alerts]: /configmgr/protect/deploy-use/endpoint-configure-alerts -[Deploy the Microsoft Intune client to endpoints]: /intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune -[custom Intune policy]: /intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#configure-microsoft-intune-endpoint-protection - [custom Intune policy]: /intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#configure-microsoft-intune-endpoint-protection -[manage tasks]: /intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#choose-management-tasks-for-endpoint-protection -[Monitor endpoint protection in the Microsoft Intune administration console]: /intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune#monitor-endpoint-protection -[Set method of the MSFT_MpPreference class]: /previous-versions/windows/desktop/defender/set-msft-mppreference -[Update method of the MSFT_MpSignature class]: /previous-versions/windows/desktop/defender/set-msft-mppreference -[MSFT_MpComputerStatus]: /previous-versions/windows/desktop/defender/msft-mpcomputerstatus -[Windows Defender WMIv2 Provider]: /previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal -[Set-MpPreference]: https://technet.microsoft.com/itpro/powershell/windows/defender/set-mppreference.md -[Update-MpSignature]: /powershell/module/defender/update-mpsignature -[Get- cmdlets available in the Defender module]: /powershell/module/defender/ -[Configure update options for Microsoft Defender Antivirus]: manage-updates-baselines-microsoft-defender-antivirus.md -[Configure Windows Defender features]: configure-microsoft-defender-antivirus-features.md -[Group Policies to determine if any settings or policies are not applied]: /previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771389(v=ws.11) -[Possibly infected devices]: /azure/active-directory/active-directory-reporting-sign-ins-from-possibly-infected-devices -[Microsoft Defender Antivirus events]: troubleshoot-microsoft-defender-antivirus.md - -## In this section - -Topic | Description ----|--- -[Deploy and enable Microsoft Defender Antivirus protection](deploy-microsoft-defender-antivirus.md) | While the client is installed as a core part of Windows 10, and traditional deployment does not apply, you will still need to enable the client on your endpoints with Microsoft Endpoint Configuration Manager, Microsoft Intune, or Group Policy Objects. -[Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) | There are two parts to updating Microsoft Defender Antivirus: updating the client on endpoints (product updates), and updating Security intelligence (protection updates). You can update Security intelligence in a number of ways, using Microsoft Endpoint Configuration Manager, Group Policy, PowerShell, and WMI. -[Monitor and report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) | You can use Microsoft Intune, Microsoft Endpoint Configuration Manager, the Update Compliance add-in for Microsoft Operations Management Suite, or a third-party SIEM product (by consuming Windows event logs) to monitor protection status and create reports about endpoint protection. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md deleted file mode 100644 index eb8d368bc3..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Deploy and enable Microsoft Defender Antivirus -description: Deploy Microsoft Defender Antivirus for protection of your endpoints with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or WMI. -keywords: deploy, enable, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 01/06/2021 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Deploy and enable Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Depending on the management tool you are using, you may need to specifically enable or configure Microsoft Defender Antivirus protection. - -See the table in [Deploy, manage, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md#ref2) for instructions on how to enable protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, Active Directory, Microsoft Azure, PowerShell cmdlets, and Windows Management Instruction (WMI). - -Some scenarios require more guidance on how to successfully deploy or configure Microsoft Defender Antivirus protection, such as Virtual Desktop Infrastructure (VDI) environments. - -The remaining article in this section provides end-to-end advice and best practices for [setting up Microsoft Defender Antivirus on virtual machines (VMs) in a VDI or Remote Desktop Services (RDS) environment](deployment-vdi-microsoft-defender-antivirus.md). - -## Related articles - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Deploy, manage updates, and report on Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) -- [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md deleted file mode 100644 index ac04928e65..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md +++ /dev/null @@ -1,238 +0,0 @@ ---- -title: Microsoft Defender Antivirus Virtual Desktop Infrastructure deployment guide -description: Learn how to deploy Microsoft Defender Antivirus in a virtual desktop environment for the best balance between protection and performance. -keywords: vdi, hyper-v, vm, virtual machine, windows defender, antivirus, av, virtual desktop, rds, remote desktop -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 12/28/2020 -ms.reviewer: jesquive -manager: dansimp -ms.technology: mde ---- - -# Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -In addition to standard on-premises or hardware configurations, you can also use Microsoft Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. - -See [Windows Virtual Desktop Documentation](/azure/virtual-desktop) for more details on Microsoft Remote Desktop Services and VDI support. - -For Azure-based virtual machines, see [Install Endpoint Protection in Azure Defender](/azure/security-center/security-center-install-endpoint-protection). - -With the ability to easily deploy updates to VMs running in VDIs, we've shortened this guide to focus on how you can get updates on your machines quickly and easily. You no longer need to create and seal golden images on a periodic basis, as updates are expanded into their component bits on the host server and then downloaded directly to the VM when it's turned on. - -This guide describes how to configure your VMs for optimal protection and performance, including how to: - -- [Set up a dedicated VDI file share for security intelligence updates](#set-up-a-dedicated-vdi-file-share) -- [Randomize scheduled scans](#randomize-scheduled-scans) -- [Use quick scans](#use-quick-scans) -- [Prevent notifications](#prevent-notifications) -- [Disable scans from occurring after every update](#disable-scans-after-an-update) -- [Scan out-of-date machines or machines that have been offline for a while](#scan-vms-that-have-been-offline) -- [Apply exclusions](#exclusions) - -You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI. - -> [!IMPORTANT] -> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. - -## Set up a dedicated VDI file share - -In Windows 10, version 1903, we introduced the shared security intelligence feature, which offloads the unpackaging of downloaded security intelligence updates onto a host machine—thus saving previous CPU, disk, and memory resources on individual machines. This feature has been backported and now works in Windows 10 version 1703 and above. You can set this feature with a Group Policy, or PowerShell. - -### Use Group Policy to enable the shared security intelligence feature: - -1. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure, and then click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. - -5. Double-click **Define security intelligence location for VDI clients**, and then set the option to **Enabled**. A field automatically appears. - -6. Enter `\\\wdav-update` (for help with this value, see [Download and unpackage](#download-and-unpackage-the-latest-updates)). - -7. Click **OK**. - -8. Deploy the GPO to the VMs you want to test. - -### Use PowerShell to enable the shared security intelligence feature - -Use the following cmdlet to enable the feature. You’ll need to then push this as you normally would push PowerShell-based configuration policies onto the VMs: - -```PowerShell -Set-MpPreference -SharedSignaturesPath \\\wdav-update -``` - -See the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what the \ will be. - -## Download and unpackage the latest updates - -Now you can get started on downloading and installing new updates. We’ve created a sample PowerShell script for you below. This script is the easiest way to download new updates and get them ready for your VMs. You should then set the script to run at a certain time on the management machine by using a scheduled task (or, if you’re familiar with using PowerShell scripts in Azure, Intune, or SCCM, you could also use those scripts). - -```PowerShell -$vdmpathbase = "$env:systemdrive\wdav-update\{00000000-0000-0000-0000-" -$vdmpathtime = Get-Date -format "yMMddHHmmss" -$vdmpath = $vdmpathbase + $vdmpathtime + '}' -$vdmpackage = $vdmpath + '\mpam-fe.exe' - -New-Item -ItemType Directory -Force -Path $vdmpath | Out-Null - -Invoke-WebRequest -Uri 'https://go.microsoft.com/fwlink/?LinkID=121721&arch=x64' -OutFile $vdmpackage - -cmd /c "cd $vdmpath & c: & mpam-fe.exe /x" -``` - -You can set a scheduled task to run once a day so that whenever the package is downloaded and unpacked then the VMs will receive the new update. -We suggest starting with once a day—but you should experiment with increasing or decreasing the frequency to understand the impact. - -Security intelligence packages are typically published once every three to four hours. Setting a frequency shorter than four hours isn’t advised because it will increase the network overhead on your management machine for no benefit. - -### Set a scheduled task to run the PowerShell script - -1. On the management machine, open the Start menu and type **Task Scheduler**. Open it and select **Create task…** on the side panel. - -2. Enter the name as **Security intelligence unpacker**. Go to the **Trigger** tab. Select **New…** > **Daily**, and select **OK**. - -3. Go to the **Actions** tab. Select **New…** Enter **PowerShell** in the **Program/Script** field. Enter `-ExecutionPolicy Bypass c:\wdav-update\vdmdlunpack.ps1` in the **Add arguments** field. Select **OK**. - -4. You can choose to configure additional settings if you wish. - -5. Select **OK** to save the scheduled task. - -You can initiate the update manually by right-clicking on the task and clicking **Run**. - -### Download and unpackage manually - -If you would prefer to do everything manually, here's what to do to replicate the script’s behavior: - -1. Create a new folder on the system root called `wdav_update` to store intelligence updates, for example, create the folder `c:\wdav_update`. - -2. Create a subfolder under *wdav_update* with a GUID name, such as `{00000000-0000-0000-0000-000000000000}` - -Here's an example: `c:\wdav_update\{00000000-0000-0000-0000-000000000000}` - - > [!NOTE] - > In the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time. - -3. Download a security intelligence package from [https://www.microsoft.com/wdsi/definitions](https://www.microsoft.com/wdsi/definitions) into the GUID folder. The file should be named `mpam-fe.exe`. - -4. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example `mpam-fe.exe /X`. - - > [!NOTE] - > The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package. - -## Randomize scheduled scans - -Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-microsoft-defender-antivirus.md). - -The start time of the scan itself is still based on the scheduled scan policy (**ScheduleDay**, **ScheduleTime**, and **ScheduleQuickScanTime**). Randomization will cause Microsoft Defender Antivirus to start a scan on each machine within a 4-hour window from the time set for the scheduled scan. - -See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) for other configuration options available for scheduled scans. - -## Use quick scans - -You can specify the type of scan that should be performed during a scheduled scan. Quick scans are the preferred approach as they are designed to look in all places where malware needs to reside to be active. The following procedure describes how to set up quick scans using Group Policy. - -1. In your Group Policy Editor, go to **Administrative templates** > **Windows components** > **Microsoft Defender Antivirus** > **Scan**. - -2. Select **Specify the scan type to use for a scheduled scan** and then edit the policy setting. - -3. Set the policy to **Enabled**, and then under **Options**, select **Quick scan**. - -4. Select **OK**. - -5. Deploy your Group Policy object as you usually do. - -## Prevent notifications - -Sometimes, Microsoft Defender Antivirus notifications may be sent to or persist across multiple sessions. In order to minimize this problem, you can lock down the Microsoft Defender Antivirus user interface. The following procedure describes how to suppress notifications with Group Policy. - -1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Client Interface**. - -2. Select **Suppress all notifications** and then edit the policy settings. - -3. Set the policy to **Enabled**, and then select **OK**. - -4. Deploy your Group Policy object as you usually do. - -Suppressing notifications prevents notifications from Microsoft Defender Antivirus from showing up in the Action Center on Windows 10 when scans are done or remediation actions are taken. However, your security operations team will see the results of the scan in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). - -> [!TIP] -> To open the Action Center on Windows 10, take one of the following steps: -> - On the right end of the taskbar, select the Action Center icon. -> - Press the Windows logo key button + A. -> - On a touchscreen device, swipe in from the right edge of the screen. - -## Disable scans after an update - -Disabling a scan after an update will prevent a scan from occurring after receiving an update. You can apply this setting when creating the base image if you have also run a quick scan. This way, you can prevent the newly updated VM from performing a scan again (as you've already scanned it when you created the base image). - -> [!IMPORTANT] -> Running scans after an update will help ensure your VMs are protected with the latest Security intelligence updates. Disabling this option will reduce the protection level of your VMs and should only be used when first creating or deploying the base image. - -1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. - -2. Select **Turn on scan after security intelligence update** and then edit the policy setting. - -3. Set the policy to **Disabled**. - -4. Select **OK**. - -5. Deploy your Group Policy object as you usually do. - -This policy prevents a scan from running immediately after an update. - -## Scan VMs that have been offline - -1. In your Group Policy Editor, go to to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. - -2. Select **Turn on catch-up quick scan** and then edit the policy setting. - -3. Set the policy to **Enabled**. - -4. Select **OK**. - -5. Deploy your Group Policy Object as you usually do. - -This policy forces a scan if the VM has missed two or more consecutive scheduled scans. - -## Enable headless UI mode - -1. In your Group Policy Editor, go to **Windows components** > **Microsoft Defender Antivirus** > **Client Interface**. - -2. Select **Enable headless UI mode** and edit the policy. - -3. Set the policy to **Enabled**. - -4. Click **OK**. - -5. Deploy your Group Policy Object as you usually do. - -This policy hides the entire Microsoft Defender Antivirus user interface from end users in your organization. - -## Exclusions - -Exclusions can be added, removed, or customized to suit your needs. - -For more information, see [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-exclusions-microsoft-defender-antivirus.md). - -## Additional resources - -- [Tech Community Blog: Configuring Microsoft Defender Antivirus for non-persistent VDI machines](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/configuring-microsoft-defender-antivirus-for-non-persistent-vdi/ba-p/1489633) -- [TechNet forums on Remote Desktop Services and VDI](https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverTS) -- [SignatureDownloadCustomTask PowerShell script](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md deleted file mode 100644 index a2ef737264..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md +++ /dev/null @@ -1,188 +0,0 @@ ---- -title: Block potentially unwanted applications with Microsoft Defender Antivirus -description: Enable the potentially unwanted application (PUA) antivirus feature to block unwanted software such as adware. -keywords: pua, enable, unwanted software, unwanted apps, adware, browser toolbar, detect, block, Microsoft Defender Antivirus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: detect -ms.sitesec: library -ms.localizationpriority: high -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -audience: ITPro -ms.date: 03/10/2021 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Detect and block potentially unwanted applications - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) -- [Microsoft Edge](/microsoft-edge/deploy/microsoft-edge) - -> [!NOTE] -> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. - -Potentially unwanted applications (PUA) are not considered viruses, malware, or other types of threats, but they might perform actions on endpoints which adversely affect endpoint performance or use. _PUA_ can also refer to an application that has a poor reputation, as assessed by Microsoft Defender for Endpoint, due to certain kinds of undesirable behavior. - -Here are some examples: - -- **Advertising software** that displays advertisements or promotions, including software that inserts advertisements to webpages. -- **Bundling software** that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualify as PUA. -- **Evasion software** that actively tries to evade detection by security products, including software that behaves differently in the presence of security products. - -> [!TIP] -> For more examples and a discussion of the criteria we use to label applications for special attention from security features, see [How Microsoft identifies malware and potentially unwanted applications](../intelligence/criteria.md). - -Potentially unwanted applications can increase the risk of your network being infected with actual malware, make malware infections harder to identify, or waste IT resources in cleaning them up. PUA protection is supported on Windows 10, Windows Server 2019, and Windows Server 2016. - -## Microsoft Edge - -The [new Microsoft Edge](https://support.microsoft.com/microsoft-edge/get-to-know-microsoft-edge-3f4bb0ff-58de-2188-55c0-f560b7e20bea), which is Chromium-based, blocks potentially unwanted application downloads and associated resource URLs. This feature is provided via [Microsoft Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md). - -### Enable PUA protection in Chromium-based Microsoft Edge - -Although potentially unwanted application protection in Microsoft Edge (Chromium-based, version 80.0.361.50) is turned off by default, it can easily be turned on from within the browser. - -1. Select the ellipses, and then choose **Settings**. -2. Select **Privacy, search, and services**. -3. Under the **Security** section, turn on **Block potentially unwanted apps**. - -> [!TIP] -> If you are running Microsoft Edge (Chromium-based), you can safely explore the URL-blocking feature of PUA protection by testing it out on one of our [Microsoft Defender SmartScreen demo pages](https://demo.smartscreen.msft.net/). - -### Blocking URLs with Microsoft Defender SmartScreen - -In Chromium-based Edge with PUA protection turned on, Microsoft Defender SmartScreen protects you from PUA-associated URLs. - -Security admins can [configure](/DeployEdge/configure-microsoft-edge) how Microsoft Edge and Microsoft Defender SmartScreen work together to protect groups of users from PUA-associated URLs. There are several [group policy settings](/DeployEdge/microsoft-edge-policies#smartscreen-settings) explicitly for Microsoft Defender SmartScreen available, including [one for blocking PUA](/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can [configure Microsoft Defender SmartScreen](/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Microsoft Defender SmartScreen on or off. - -Although Microsoft Defender for Endpoint has its own block list based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](/microsoft-365/security/defender-endpoint/manage-indicators) in the Microsoft Defender for Endpoint portal, Microsoft Defender SmartScreen respects the new settings. - -## Microsoft Defender Antivirus - -The potentially unwanted application (PUA) protection feature in Microsoft Defender Antivirus can detect and block PUAs on endpoints in your network. - -> [!NOTE] -> This feature is available in Windows 10, Windows Server 2019, and Windows Server 2016. - -Microsoft Defender Antivirus blocks detected PUA files and any attempts to download, move, run, or install them. Blocked PUA files are then moved to quarantine. When a PUA file is detected on an endpoint, Microsoft Defender Antivirus sends a notification to the user ([unless notifications have been disabled](configure-notifications-microsoft-defender-antivirus.md)) in the same format as other threat detections. The notification is prefaced with `PUA:` to indicate its content. - -The notification appears in the usual [quarantine list within the Windows Security app](microsoft-defender-security-center-antivirus.md). - -### Configure PUA protection in Microsoft Defender Antivirus - -You can enable PUA protection with [Microsoft Intune](/mem/intune/protect/device-protect), [Microsoft Endpoint Configuration Manager](/mem/configmgr/protect/deploy-use/endpoint-protection), [Group Policy](/azure/active-directory-domain-services/manage-group-policy), or via [PowerShell cmdlets](/powershell/module/defender/?preserve-view=true&view=win10-ps). - -You can also use PUA protection in audit mode to detect potentially unwanted applications without blocking them. The detections are captured in the Windows event log. - -> [!TIP] -> Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action. - -PUA protection in audit mode is useful if your company is conducting an internal software security compliance check and you'd like to avoid any false positives. - -#### Use Intune to configure PUA protection - -See [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure) and [Microsoft Defender Antivirus device restriction settings for Windows 10 in Intune](/intune/device-restrictions-windows-10#microsoft-defender-antivirus) for more details. - -#### Use Configuration Manager to configure PUA protection - -PUA protection is enabled by default in the Microsoft Endpoint Manager (Current Branch). - -See [How to create and deploy antimalware policies: Scheduled scans settings](/configmgr/protect/deploy-use/endpoint-antimalware-policies#real-time-protection-settings) for details on configuring Microsoft Endpoint Manager (Current Branch). - -For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unwanted Application Protection Policy for Endpoint Protection in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/hh508770(v=technet.10)#BKMK_PUA). - -> [!NOTE] -> PUA events blocked by Microsoft Defender Antivirus are reported in the Windows Event Viewer and not in Microsoft Endpoint Configuration Manager. - -#### Use Group Policy to configure PUA protection - -1. Download and install [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) - -2. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). - -3. Select the Group Policy Object you want to configure, and then choose **Edit**. - -4. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. - -5. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus**. - -6. Double-click **Configure detection for potentially unwanted applications**. - -7. Select **Enabled** to enable PUA protection. - -8. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting works in your environment. Select **OK**. - -9. Deploy your Group Policy object as you usually do. - -#### Use PowerShell cmdlets to configure PUA protection - -##### To enable PUA protection - -```PowerShell -Set-MpPreference -PUAProtection Enabled -``` - -Setting the value for this cmdlet to `Enabled` turns the feature on if it has been disabled. - -##### To set PUA protection to audit mode - -```PowerShell -Set-MpPreference -PUAProtection AuditMode -``` - -Setting `AuditMode` detects PUAs without blocking them. - -##### To disable PUA protection - -We recommend keeping PUA protection turned on. However, you can turn it off by using the following cmdlet: - -```PowerShell -Set-MpPreference -PUAProtection Disabled -``` - -Setting the value for this cmdlet to `Disabled` turns the feature off if it has been enabled. - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -## View PUA events - -PUA events are reported in the Windows Event Viewer, but not in Microsoft Endpoint Manager or in Intune. You can also use the `Get-MpThreat` cmdlet to view threats that Microsoft Defender Antivirus handled. Here's an example: - -```console -CategoryID : 27 -DidThreatExecute : False -IsActive : False -Resources : {webfile:_q:\Builds\Dalton_Download_Manager_3223905758.exe|http://d18yzm5yb8map8.cloudfront.net/ - fo4yue@kxqdw/Dalton_Download_Manager.exe|pid:14196,ProcessStart:132378130057195714} -RollupStatus : 33 -SchemaVersion : 1.0.0.0 -SeverityID : 1 -ThreatID : 213927 -ThreatName : PUA:Win32/InstallCore -TypeID : 0 -PSComputerName : -``` - -You can turn on email notifications to receive mail about PUA detections. - -See [Troubleshoot event IDs](troubleshoot-microsoft-defender-antivirus.md) for details on viewing Microsoft Defender Antivirus events. PUA events are recorded under event ID **1160**. - -## Excluding files - -Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA is required to complete a task. In these cases, a file can be added to an exclusion list. - -For more information, see [Configure and validate exclusions based on file extension and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md). - -## See also - -- [Next-generation protection](microsoft-defender-antivirus-in-windows-10.md) -- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md deleted file mode 100644 index c36705e722..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -title: Turn on cloud-delivered protection in Microsoft Defender Antivirus -description: Turn on cloud-delivered protection to benefit from fast and advanced protection features. -keywords: Microsoft Defender Antivirus, antimalware, security, cloud, block at first sight -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.date: 11/13/2020 -ms.reviewer: -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Turn on cloud-delivered protection - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -> [!NOTE] -> The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. - -Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) - -You can turn Microsoft Defender Antivirus cloud-delivered protection on or off in several ways: - -- Microsoft Intune -- Microsoft Endpoint Configuration Manager -- Group Policy -- PowerShell cmdlets. - - You can also turn it on or off in individual clients with the Windows Security app. - -See [Use Microsoft cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) for an overview of Microsoft Defender Antivirus cloud-delivered protection. - -For more information about the specific network-connectivity requirements to ensure your endpoints can connect to the cloud-delivered protection service, see [Configure and validate network connections](configure-network-connections-microsoft-defender-antivirus.md). - -> [!NOTE] -> In Windows 10, there is no difference between the **Basic** and **Advanced** reporting options described in this topic. This is a legacy distinction and choosing either setting will result in the same level of cloud-delivered protection. There is no difference in the type or amount of information that is shared. For more information on what we collect, see the [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=521839). - -## Use Intune to turn on cloud-delivered protection - -1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. -2. On the **Home** pane, select **Device configuration > Profiles**. -3. Select the **Device restrictions** profile type you want to configure. If you need to create a new **Device restrictions** profile type, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). -4. Select **Properties** > **Configuration settings: Edit** > **Microsoft Defender Antivirus**. -5. On the **Cloud-delivered protection** switch, select **Enable**. -6. In the **Prompt users before sample submission** dropdown, select **Send all data automatically**. - -For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](/intune/device-profiles) - -## Use Microsoft Endpoint Manager to turn on cloud-delivered protection - -1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. -2. Choose **Endpoint security** > **Antivirus**. -3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). -4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**. -5. Expand **Cloud protection**, and then in the **Cloud-delivered protection level** list, select one of the following: - 1. **High**: Applies a strong level of detection. - 2. **High plus**: Uses the **High** level and applies additional protection measures (may impact client performance). - 3. **Zero tolerance**: Blocks all unknown executables. -6. Select **Review + save**, then choose **Save**. - -For more information about configuring Microsoft Endpoint Configuration Manager, see [How to create and deploy antimalware policies: Cloud-protection service](/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service). - -## Use Group Policy to turn on cloud-delivered protection - -1. On your Group Policy management device, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**. - -2. In the **Group Policy Management Editor**, go to **Computer configuration**. - -3. Select **Administrative templates**. - -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > MAPS** - -5. Double-click **Join Microsoft MAPS**. Ensure the option is turned on and set to **Basic MAPS** or **Advanced MAPS**. Select **OK**. - -6. Double-click **Send file samples when further analysis is required**. Ensure that the first option is set to **Enabled** and that the other options are set to either: - - 1. **Send safe samples** (1) - 2. **Send all samples** (3) - - >[!NOTE] - > The **Send safe samples** (1) option means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. - - > [!WARNING] - > Setting the option to **Always Prompt** (0) will lower the protection state of the device. Setting it to **Never send** (2) means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work. - -7. Select **OK**. - -## Use PowerShell cmdlets to turn on cloud-delivered protection - -The following cmdlets can turn on cloud-delivered protection: - -```PowerShell -Set-MpPreference -MAPSReporting Advanced -Set-MpPreference -SubmitSamplesConsent SendAllSamples -``` - -For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/). [Policy CSP - Defender](/windows/client-management/mdm/policy-csp-defender) also has more information specifically on [-SubmitSamplesConsent](/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). - ->[!NOTE] -> You can also set **-SubmitSamplesConsent** to `SendSafeSamples` (the default setting), `NeverSend`, or `AlwaysPrompt`. The `SendSafeSamples` setting means that most samples will be sent automatically. Files that are likely to contain personal information will still prompt and require additional confirmation. - ->[!WARNING] -> Setting **-SubmitSamplesConsent** to `NeverSend` or `AlwaysPrompt` will lower the protection level of the device. In addition, setting it to `NeverSend` means that the [Block at First Sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) feature of Microsoft Defender for Endpoint won't work. - -## Use Windows Management Instruction (WMI) to turn on cloud-delivered protection - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/defender/set-msft-mppreference) class for the following properties: - -```WMI -MAPSReporting -SubmitSamplesConsent -``` - -For more information about allowed parameters, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - -## Turn on cloud-delivered protection on individual clients with the Windows Security app - -> [!NOTE] -> If the **Configure local setting override for reporting Microsoft MAPS** Group Policy setting is set to **Disabled**, then the **Cloud-based protection** setting in Windows Settings will be greyed-out and unavailable. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. - -1. Open the Windows Security app by selecting the shield icon in the task bar, or by searching the start menu for **Defender**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Virus & threat protection settings** label: - - ![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) - -3. Confirm that **Cloud-based Protection** and **Automatic sample submission** are switched to **On**. - -> [!NOTE] -> If automatic sample submission has been configured with Group Policy then the setting will be greyed-out and unavailable. - -## Related articles - -- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) -- [Configure block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) -- [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) -- [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)] -- [Defender cmdlets](/powershell/module/defender/) -- [Use Microsoft cloud-delivered protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) -- [How to create and deploy antimalware policies: Cloud-protection service](/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md deleted file mode 100644 index cee61ca977..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Evaluate Microsoft Defender Antivirus -description: Businesses of all sizes can use this guide to evaluate and test the protection offered by Microsoft Defender Antivirus in Windows 10. -keywords: Microsoft Defender Antivirus, cloud protection, cloud, antimalware, security, defender, evaluate, test, protection, compare, real-time protection -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Evaluate Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Use this guide to determine how well Microsoft Defender Antivirus protects you from viruses, malware, and potentially unwanted applications. - ->[!TIP] ->You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working and see how they work: ->- Cloud-delivered protection ->- Fast learning (including Block at first sight) ->- Potentially unwanted application blocking - -It explains the important next-generation protection features of Microsoft Defender Antivirus available for both small and large enterprises, and how they increase malware detection and protection across your network. - -You can choose to configure and evaluate each setting independently, or all at once. We have grouped similar settings based upon typical evaluation scenarios, and include instructions for using PowerShell to enable the settings. - -The guide is available in PDF format for offline viewing: - -- [Download the guide in PDF format](https://www.microsoft.com/download/details.aspx?id=54795) - -You can also download a PowerShell that will enable all the settings described in the guide automatically. You can obtain the script alongside the PDF download above, or individually from PowerShell Gallery: - -- [Download the PowerShell script to automatically configure the settings](https://www.powershellgallery.com/packages/WindowsDefender_InternalEvaluationSettings) - -> [!IMPORTANT] -> The guide is currently intended for single-machine evaluation of Microsoft Defender Antivirus. Enabling all of the settings in this guide may not be suitable for real-world deployment. -> -> For the latest recommendations for real-world deployment and monitoring of Microsoft Defender Antivirus across a network, see [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md). - -## Related topics - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md deleted file mode 100644 index 3ba4ef6bd1..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Enable the limited periodic Microsoft Defender Antivirus scanning feature -description: Limited periodic scanning lets you use Microsoft Defender Antivirus in addition to your other installed AV providers -keywords: lps, limited, periodic, scan, scanning, compatibility, 3rd party, other av, disable -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - - - -# Use limited periodic scanning in Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device. - -It can only be enabled in certain situations. For more information about limited periodic scanning and how Microsoft Defender Antivirus works with other antivirus products, see [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md). - -**Microsoft does not recommend using this feature in enterprise environments. This is a feature primarily intended for consumers.** This feature only uses a limited subset of the Microsoft Defender Antivirus capabilities to detect malware, and will not be able to detect most malware and potentially unwanted software. Also, management and reporting capabilities will be limited. Microsoft recommends enterprises choose their primary antivirus solution and use it exclusively. - -## How to enable limited periodic scanning - -By default, Microsoft Defender Antivirus will enable itself on a Windows 10 device if there is no other antivirus product installed, or if the other product is out-of-date, expired, or not working correctly. - -If Microsoft Defender Antivirus is enabled, the usual options will appear to configure it on that device: - -![Windows Security app showing Microsoft Defender AV options, including scan options, settings, and update options](images/vtp-wdav.png) - -If another antivirus product is installed and working correctly, Microsoft Defender Antivirus will disable itself. The Windows Security app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options. - -Underneath any third party AV products, a new link will appear as **Microsoft Defender Antivirus options**. Clicking this link will expand to show the toggle that enables limited periodic scanning. Note that the limited periodic option is a toggle to enable or disable periodic scanning. - -Sliding the switch to **On** will show the standard Microsoft Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page. - -## Related articles - -- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md deleted file mode 100644 index 4e2de05ee6..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md +++ /dev/null @@ -1,163 +0,0 @@ ---- -title: Apply Microsoft Defender Antivirus updates after certain events -description: Manage how Microsoft Defender Antivirus applies security intelligence updates after startup or receiving cloud-delivered detection reports. -keywords: updates, protection, force updates, events, startup, check for latest, notifications -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/17/2018 -ms.reviewer: pahuijbr -manager: dansimp -ms.technology: mde ---- - -# Manage event-based forced updates - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service. - -## Check for protection updates before running a scan - -You can use Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, and WMI to force Microsoft Defender Antivirus to check and download protection updates before running a scheduled scan. - -### Use Configuration Manager to check for protection updates before running a scan - -1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Scheduled scans** section and set **Check for the latest security intelligence updates before running a scan** to **Yes**. - -3. Click **OK**. - -4. [Deploy the updated policy as usual](/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). - -### Use Group Policy to check for protection updates before running a scan - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. - -5. Double-click **Check for the latest virus and spyware definitions before running a scheduled scan** and set the option to **Enabled**. - -6. Click **OK**. - -### Use PowerShell cmdlets to check for protection updates before running a scan - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -CheckForSignaturesBeforeRunningScan -``` - -For more information, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/index). - -### Use Windows Management Instruction (WMI) to check for protection updates before running a scan - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -CheckForSignaturesBeforeRunningScan -``` - -For more information, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). - -## Check for protection updates on startup - -You can use Group Policy to force Microsoft Defender Antivirus to check and download protection updates when the machine is started. - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. - -5. Double-click **Check for the latest virus and spyware definitions on startup** and set the option to **Enabled**. - -6. Click **OK**. - -You can also use Group Policy, PowerShell, or WMI to configure Microsoft Defender Antivirus to check for updates at startup even when it is not running. - -### Use Group Policy to download updates when Microsoft Defender Antivirus is not present - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor**, go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. - -5. Double-click **Initiate security intelligence update on startup** and set the option to **Enabled**. - -6. Click **OK**. - -### Use PowerShell cmdlets to download updates when Microsoft Defender Antivirus is not present - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine -``` - -For more information, see [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to download updates when Microsoft Defender Antivirus is not present - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -SignatureDisableUpdateOnStartupWithoutEngine -``` - -For more information, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal). - - - -## Allow ad hoc changes to protection based on cloud-delivered protection - -Microsoft Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates. - -If you have enabled cloud-delivered protection, Microsoft Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Microsoft Defender AV to automatically receive that protection update. Other important protection updates can also be applied. - -### Use Group Policy to automatically download recent updates based on cloud-delivered protection - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Security Intelligence Updates**. - -5. Double-click **Allow real-time security intelligence updates based on reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. - -6. **Allow notifications to disable definitions-based reports to Microsoft MAPS** and set the option to **Enabled**. Then click **OK**. - -> [!NOTE] -> **Allow notifications to disable definitions based reports** enables Microsoft MAPS to disable those definitions known to cause false-positive reports. You must configure your computer to join Microsoft MAPS for this function to work. - -## See also - -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) -- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) -- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md deleted file mode 100644 index 279cf95a5a..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md +++ /dev/null @@ -1,185 +0,0 @@ ---- -title: Apply Microsoft Defender AV protection updates to out of date endpoints -description: Define when and how updates should be applied for endpoints that have not updated in a while. -keywords: updates, protection, out-of-date, outdated, old, catch-up -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Manage Microsoft Defender Antivirus updates and scans for endpoints that are out of date - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis. - -For example, an employee that uses a particular PC is on break for three days and does not log on to their PC during that time. - -When the user returns to work and logs on to their PC, Microsoft Defender Antivirus will immediately check and download the latest protection updates, and run a scan. - -## Set up catch-up protection updates for endpoints that haven't updated for a while - -If Microsoft Defender Antivirus did not download protection updates for a specified period, you can set it up to automatically check and download the latest update at the next log on. This is useful if you have [globally disabled automatic update downloads on startup](manage-event-based-updates-microsoft-defender-antivirus.md). - -### Use Configuration Manager to configure catch-up protection updates - -1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Security intelligence updates** section and configure the following settings: - - 1. Set **Force a security intelligence update if the client computer is offline for more than two consecutive scheduled updates** to **Yes**. - 2. For the **If Configuration Manager is used as a source for security intelligence updates...**, specify the hours before which the protection updates delivered by Configuration Manager should be considered out-of-date. This will cause the next update location to be used, based on the defined [fallback source order](manage-protection-updates-microsoft-defender-antivirus.md#fallback-order). - -3. Click **OK**. - -4. [Deploy the updated policy as usual](/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). - -### Use Group Policy to enable and configure the catch-up update feature - -1. On your Group Policy management computer, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates**. - -5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update. - -6. Click **OK**. - -### Use PowerShell cmdlets to configure catch-up protection updates - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -SignatureUpdateCatchupInterval -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to configure catch-up protection updates - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -SignatureUpdateCatchupInterval -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -## Set the number of days before protection is reported as out-of-date - -You can also specify the number of days after which Microsoft Defender Antivirus protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Microsoft Defender Antivirus to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-microsoft-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. - -### Use Group Policy to specify the number of days before protection is considered out-of-date - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following settings: - - 1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date. - - 2. Click **OK**. - - 3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date. - - 4. Click **OK**. - - -## Set up catch-up scans for endpoints that have not been scanned for a while - -You can set the number of consecutive scheduled scans that can be missed before Microsoft Defender Antivirus will force a scan. - -The process for enabling this feature is: - -1. Set up at least one scheduled scan (see the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic). -2. Enable the catch-up scan feature. -3. Define the number of scans that can be skipped before a catch-up scan occurs. - -This feature can be enabled for both full and quick scans. - -### Use Group Policy to enable and configure the catch-up scan feature - -1. Ensure you have set up at least one scheduled scan. - -2. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Scan** and configure the following settings: - - 1. If you have set up scheduled quick scans, double-click the **Turn on catch-up quick scan** setting and set the option to **Enabled**. - 2. If you have set up scheduled full scans, double-click the **Turn on catch-up full scan** setting and set the option to **Enabled**. Click **OK**. - 3. Double-click the **Define the number of days after which a catch-up scan is forced** setting and set the option to **Enabled**. - 4. Enter the number of scans that can be missed before a scan will be automatically run when the user next logs on to the PC. The type of scan that is run is determined by the **Specify the scan type to use for a scheduled scan** (see the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic). Click **OK**. - -> [!NOTE] -> The Group Policy setting title refers to the number of days. The setting, however, is applied to the number of scans (not days) before the catch-up scan will be run. - -### Use PowerShell cmdlets to configure catch-up scans - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -DisableCatchupFullScan -Set-MpPreference -DisableCatchupQuickScan - -``` - -See [Use PowerShell cmdlets to manage Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to configure catch-up scans - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -DisableCatchupFullScan -DisableCatchupQuickScan -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -### Use Configuration Manager to configure catch-up scans - -1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Scheduled scans** section and **Force a scan of the selected scan type if client computer is offline...** to **Yes**. - -3. Click **OK**. - -4. [Deploy the updated policy as usual](/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). - -## Related articles - -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) -- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) -- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md deleted file mode 100644 index d12fb1fc54..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: Schedule Microsoft Defender Antivirus protection updates -description: Schedule the day, time, and interval for when protection updates should be downloaded -keywords: updates, security baselines, schedule updates -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -search.appverid: met150 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: pahuijbr -manager: dansimp -ms.technology: mde ---- - -# Manage the schedule for when protection updates should be downloaded and applied - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus lets you determine when it should look for and download updates. - -You can schedule updates for your endpoints by: - -- Specifying the day of the week to check for protection updates -- Specifying the interval to check for protection updates -- Specifying the time to check for protection updates - -You can also randomize the times when each endpoint checks and downloads protection updates. See the [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) topic for more information. - -## Use Configuration Manager to schedule protection updates - -1. On your Microsoft Endpoint Manager console, open the antimalware policy you want to change (click **Assets and Compliance** in the navigation pane on the left, then expand the tree to **Overview** > **Endpoint Protection** > **Antimalware Policies**) - -2. Go to the **Security intelligence updates** section. - -3. To check and download updates at a certain time: - 1. Set **Check for Endpoint Protection security intelligence updates at a specific interval...** to **0**. - 2. Set **Check for Endpoint Protection security intelligence updates daily at...** to the time when updates should be checked. - 3 -4. To check and download updates on a continual interval, Set **Check for Endpoint Protection security intelligence updates at a specific interval...** to the number of hours that should occur between updates. - -5. [Deploy the updated policy as usual](/sccm/protect/deploy-use/endpoint-antimalware-policies#deploy-an-antimalware-policy-to-client-computers). - -## Use Group Policy to schedule protection updates - -> [!IMPORTANT] -> By default, Microsoft Defender Antivirus will check for an update 15 minutes before the time of any scheduled scans. Enabling these settings will override that default. - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Policies** then **Administrative templates**. - -5. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Intelligence Updates** and configure the following settings: - - 1. Double-click the **Specify the day of the week to check for security intelligence updates** setting and set the option to **Enabled**. Enter the day of the week to check for updates. Click **OK**. - 2. Double-click the **Specify the interval to check for security intelligence updates** setting and set the option to **Enabled**. Enter the number of hours between updates. Click **OK**. - 3. Double-click the **Specify the time to check for security intelligence updates** setting and set the option to **Enabled**. Enter the time when updates should be checked. The time is based on the local time of the endpoint. Click **OK**. - - -## Use PowerShell cmdlets to schedule protection updates - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -SignatureScheduleDay -Set-MpPreference -SignatureScheduleTime -Set-MpPreference -SignatureUpdateInterval -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -## Use Windows Management Instruction (WMI) to schedule protection updates - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -SignatureScheduleDay -SignatureScheduleTime -SignatureUpdateInterval -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -## Related articles - -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) -- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) -- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md deleted file mode 100644 index 500a1de1c9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md +++ /dev/null @@ -1,263 +0,0 @@ ---- -title: Manage how and where Microsoft Defender Antivirus receives updates -description: Manage the fallback order for how Microsoft Defender Antivirus receives protection updates. -keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.reviewer: pahuijbr -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Manage the sources for Microsoft Defender Antivirus protection updates - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=22154037) - - - - -Keeping your antivirus protection up to date is critical. There are two components to managing protection updates for Microsoft Defender Antivirus: -- *Where* the updates are downloaded from; and -- *When* updates are downloaded and applied. - -This article describes how to specify from where updates should be downloaded (this is also known as the fallback order). See [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). - -> [!IMPORTANT] -> Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update and starting Monday, October 21, 2019, all security intelligence updates will be SHA-2 signed exclusively. Your devices must be updated to support SHA-2 in order to update your security intelligence. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). - - - - -## Fallback order - -Typically, you configure endpoints to individually download updates from a primary source followed by other sources in order of priority, based on your network configuration. Updates are obtained from sources in the order you specify. If a source is not available, the next source in the list is used immediately. - -When updates are published, some logic is applied to minimize the size of the update. In most cases, only the differences between the latest update and the update that is currently installed (this is referred to as the delta) on the device is downloaded and applied. However, the size of the delta depends on two main factors: -- The age of the last update on the device; and -- The source used to download and apply updates. - -The older the updates on an endpoint, the larger the download will be. However, you must also consider download frequency as well. A more frequent update schedule can result in more network usage, whereas a less-frequent schedule can result in larger file sizes per download. - -There are five locations where you can specify where an endpoint should obtain updates: - -- [Microsoft Update](https://support.microsoft.com/help/12373/windows-update-faq) -- [Windows Server Update Service](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) -- [Microsoft Endpoint Configuration Manager](/configmgr/core/servers/manage/updates) -- [Network file share](#unc-share) -- [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates) (Your policy and registry might have this listed as Microsoft Malware Protection Center (MMPC) security intelligence, its former name.) - -To ensure the best level of protection, Microsoft Update allows for rapid releases, which means smaller downloads on a frequent basis. The Windows Server Update Service, Microsoft Endpoint Configuration Manager, and Microsoft security intelligence updates sources deliver less frequent updates. Thus, the delta can be larger, resulting in larger downloads. - -> [!IMPORTANT] -> If you have set [Microsoft Security intelligence page](https://www.microsoft.com/security/portal/definitions/adl.aspx) updates as a fallback source after Windows Server Update Service or Microsoft Update, updates are only downloaded from security intelligence updates when the current update is considered out-of-date. (By default, this is seven consecutive days of not being able to apply updates from the Windows Server Update Service or Microsoft Update services). -> You can, however, [set the number of days before protection is reported as out-of-date](/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).

-> Starting Monday, October 21, 2019, security intelligence updates will be SHA-2 signed exclusively. Devices must be updated to support SHA-2 in order to get the latest security intelligence updates. To learn more, see [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). - -Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: - -|Location | Sample scenario | -|---|---| -|Windows Server Update Service | You are using Windows Server Update Service to manage updates for your network.| -|Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use Windows Server Update Service to manage your updates.| -|File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-microsoft-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments.| -|Microsoft Endpoint Manager | You are using Microsoft Endpoint Manager to update your endpoints.| -|Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware (formerly referred to as MMPC) |[Make sure your devices are updated to support SHA-2](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus). Microsoft Defender Antivirus Security intelligence updates are delivered through Windows Update, and starting Monday October 21, 2019 security intelligence updates will be SHA-2 signed exclusively.
Download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-microsoft-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from Windows Server Update Service or Microsoft Update for [a specified number of days](/windows/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date).| - -You can manage the order in which update sources are used with Group Policy, Microsoft Endpoint Configuration Manager, PowerShell cmdlets, and WMI. - -> [!IMPORTANT] -> If you set Windows Server Update Service as a download location, you must approve the updates, regardless of the management tool you use to specify the location. You can set up an automatic approval rule with Windows Server Update Service, which might be useful as updates arrive at least once a day. To learn more, see [synchronize endpoint protection updates in standalone Windows Server Update Service](/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). - -The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it. - -## Use Group Policy to manage the update location - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components > Windows Defender > Signature updates** and configure the following settings: - - 1. Double-click the **Define the order of sources for downloading security intelligence updates** setting and set the option to **Enabled**. - - 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot. - - ![Screenshot of group policy setting listing the order of sources](images/defender/wdav-order-update-sources.png) - - 3. Click **OK**. This will set the order of protection update sources. - - 4. Double-click the **Define file shares for downloading security intelligence updates** setting and set the option to **Enabled**. - - 5. Enter the file share source. If you have multiple sources, enter each source in the order they should be used, separated by a single pipe. Use [standard UNC notation](/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc) for denoting the path, for example: `\\host-name1\share-name\object-name|\\host-name2\share-name\object-name`. If you do not enter any paths, then this source will be skipped when the VM downloads updates. - - 6. Click **OK**. This will set the order of file shares when that source is referenced in the **Define the order of sources...** group policy setting. - -> [!NOTE] -> For Windows 10, versions 1703 up to and including 1809, the policy path is **Windows Components > Microsoft Defender Antivirus > Signature Updates** -> For Windows 10, version 1903, the policy path is **Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates** - -## Use Configuration Manager to manage the update location - -See [Configure Security intelligence Updates for Endpoint Protection](/configmgr/protect/deploy-use/endpoint-definition-updates) for details on configuring Microsoft Endpoint Manager (current branch). - - -## Use PowerShell cmdlets to manage the update location - -Use the following PowerShell cmdlets to set the update order. - -```PowerShell -Set-MpPreference -SignatureFallbackOrder {LOCATION|LOCATION|LOCATION|LOCATION} -Set-MpPreference -SignatureDefinitionUpdateFileSharesSource {\\UNC SHARE PATH|\\UNC SHARE PATH} -``` -See the following articles for more information: -- [Set-MpPreference -SignatureFallbackOrder](/powershell/module/defender/set-mppreference) -- [Set-MpPreference -SignatureDefinitionUpdateFileSharesSource](/powershell/module/defender/set-mppreference#-signaturedefinitionupdatefilesharessources) -- [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) -- [Defender cmdlets](/powershell/module/defender/index) - -## Use Windows Management Instruction (WMI) to manage the update location - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -SignatureFallbackOrder -SignatureDefinitionUpdateFileSharesSource -``` - -See the following articles for more information: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - -## Use Mobile Device Management (MDM) to manage the update location - -See [Policy CSP - Defender/SignatureUpdateFallbackOrder](/windows/client-management/mdm/policy-csp-defender#defender-signatureupdatefallbackorder) for details on configuring MDM. - -## What if we're using a third-party vendor? - -This article describes how to configure and manage updates for Microsoft Defender Antivirus. However, third-party vendors can be used to perform these tasks. - -For example, suppose that Contoso has hired Fabrikam to manage their security solution, which includes Microsoft Defender Antivirus. Fabrikam typically uses [Windows Management Instrumentation](./use-wmi-microsoft-defender-antivirus.md), [PowerShell cmdlets](./use-powershell-cmdlets-microsoft-defender-antivirus.md), or [Windows command-line](./command-line-arguments-microsoft-defender-antivirus.md) to deploy patches and updates. - -> [!NOTE] -> Microsoft does not test third-party solutions for managing Microsoft Defender Antivirus. - - -## Create a UNC share for security intelligence updates - -Set up a network file share (UNC/mapped drive) to download security intelligence updates from the MMPC site by using a scheduled task. - -1. On the system on which you want to provision the share and download the updates, create a folder to which you will save the script. - ```DOS - Start, CMD (Run as admin) - MD C:\Tool\PS-Scripts\ - ``` - -2. Create the folder to which you will save the signature updates. - ```DOS - MD C:\Temp\TempSigs\x64 - MD C:\Temp\TempSigs\x86 - ``` - -3. Download the PowerShell script from [www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4](https://www.powershellgallery.com/packages/SignatureDownloadCustomTask/1.4). - -4. Click **Manual Download**. - -5. Click **Download the raw nupkg file**. - -6. Extract the file. - -7. Copy the file SignatureDownloadCustomTask.ps1 to the folder you previously created, C:\Tool\PS-Scripts\ . - -8. Use the command line to set up the scheduled task. - > [!NOTE] - > There are two types of updates: full and delta. - - For x64 delta: - - ```DOS - Powershell (Run as admin) - - C:\Tool\PS-Scripts\ - - “.\SignatureDownloadCustomTask.ps1 -action create -arch x64 -isDelta $true -destDir C:\Temp\TempSigs\x64 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” - ``` - - - For x64 full: - - ```DOS - Powershell (Run as admin) - - C:\Tool\PS-Scripts\ - - “.\SignatureDownloadCustomTask.ps1 -action create -arch x64 -isDelta $false -destDir C:\Temp\TempSigs\x64 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” - ``` - - - For x86 delta: - - ```DOS - Powershell (Run as admin) - - C:\Tool\PS-Scripts\ - - “.\SignatureDownloadCustomTask.ps1 -action create -arch x86 -isDelta $true -destDir C:\Temp\TempSigs\x86 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” - ``` - - - For x86 full: - - ```DOS - Powershell (Run as admin) - - C:\Tool\PS-Scripts\ - - “.\SignatureDownloadCustomTask.ps1 -action create -arch x86 -isDelta $false -destDir C:\Temp\TempSigs\x86 -scriptPath C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1 -daysInterval 1” - ``` - - > [!NOTE] - > When the scheduled tasks are created, you can find these in the Task Scheduler under Microsoft\Windows\Windows Defender -9. Run each task manually and verify that you have data (mpam-d.exe, mpam-fe.exe, and nis_full.exe) in the following folders (you might have chosen different locations): - - - C:\Temp\TempSigs\x86 - - C:\Temp\TempSigs\x64 - - If the scheduled task fails, run the following commands: - - ```DOS - C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x64 -isDelta $False -destDir C:\Temp\TempSigs\x64″ - - C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x64 -isDelta $True -destDir C:\Temp\TempSigs\x64″ - - C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x86 -isDelta $False -destDir C:\Temp\TempSigs\x86″ - - C:\windows\system32\windowspowershell\v1.0\powershell.exe -NoProfile -executionpolicy allsigned -command “&\”C:\Tool\PS-Scripts\SignatureDownloadCustomTask.ps1\” -action run -arch x86 -isDelta $True -destDir C:\Temp\TempSigs\x86″ - ``` - > [!NOTE] - > Issues could also be due to execution policy. - -10. Create a share pointing to C:\Temp\TempSigs (e.g. \\server\updates). - > [!NOTE] - > At a minimum, authenticated users must have “Read” access. -11. Set the share location in the policy to the share. - - > [!NOTE] - > Do not add the x64 (or x86) folder in the path. The mpcmdrun.exe process adds it automatically. - -## Related articles - -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) -- [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) -- [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md deleted file mode 100644 index f3be51a2ca..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md +++ /dev/null @@ -1,565 +0,0 @@ ---- -title: Manage Microsoft Defender Antivirus updates and apply baselines -description: Manage how Microsoft Defender Antivirus receives protection and product updates. -keywords: updates, security baselines, protection, schedule updates, force updates, mobile updates, wsus -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: pahuijbr -manager: dansimp -ms.date: 04/08/2021 -ms.technology: mde ---- - -# Manage Microsoft Defender Antivirus updates and apply baselines - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) -- Microsoft Defender Antivirus - -There are two types of updates related to keeping Microsoft Defender Antivirus up to date: - -- Security intelligence updates -- Product updates - -> [!IMPORTANT] -> Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques. -> Make sure to update your antivirus protection even if Microsoft Defender Antivirus is running in [passive mode](./microsoft-defender-antivirus-compatibility.md). -> -> To see the most current engine, platform, and signature date, visit the [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates). - -## Security intelligence updates - -Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloads security intelligence updates to provide protection. - -> [!NOTE] -> Updates are released under the below KB numbers: -> Microsoft Defender Antivirus: KB2267602 -> System Center Endpoint Protection: KB2461484 - -Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md). - -For a list of recent security intelligence updates, see [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates). - -Engine updates are included with security intelligence updates and are released on a monthly cadence. - -## Product updates - -Microsoft Defender Antivirus requires [monthly updates (KB4052623)](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform) (known as *platform updates*), and will receive major feature updates alongside Windows 10 releases. - -You can manage the distribution of updates through one of the following methods: - -- [Windows Server Update Service (WSUS)](/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) -- [Microsoft Endpoint Configuration Manager](/configmgr/sum/understand/software-updates-introduction) -- The usual method you use to deploy Microsoft and Windows updates to endpoints in your network. - -For more information, see [Manage the sources for Microsoft Defender Antivirus protection updates](/mem/configmgr/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus). - -> [!NOTE] -> Monthly updates are released in phases, resulting in multiple packages visible in your [Window Server Update Services](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). - -## Monthly platform and engine versions - -For information how to update or install the platform update, see [Update for Windows Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-windows-defender-antimalware-platform). - -All our updates contain -- performance improvements; -- serviceability improvements; and -- integration improvements (Cloud, Microsoft 365 Defender). -

- -

- March-2021 (Platform: 4.18.2103.6 | Engine: 1.1.18000.5) - - Security intelligence update version: **1.335.36.0** - Released: **April 1, 2021** - Platform: **4.19.2103.6** - Engine: **1.1.18000.5** - Support phase: **Security and Critical Updates** - -### What's new - -- Improvement to the Behavior Monitoring engine -- Expanded network brute-force-attack mitigations -- Additional failed tampering attempt event generation when [Tamper Protection](prevent-changes-to-security-settings-with-tamper-protection.md) is enabled - -### Known Issues -No known issues -
-
- February-2021 (Platform: 4.18.2102.3 | Engine: 1.1.17900.7) - - Security intelligence update version: **1.333.7.0** - Released: **March 9, 2021** - Platform: **4.19.2102.3** - Engine: **1.1.17900.7** - Support phase: **Security and Critical Updates** - -### What's new - -- Improved service recovery through [tamper protection](prevent-changes-to-security-settings-with-tamper-protection.md) -- Extend tamper protection scope - -### Known Issues -No known issues -
-
- January-2021 (Platform: 4.18.2101.9 | Engine: 1.1.17800.5) - - Security intelligence update version: **1.327.1854.0** - Released: **February 2, 2021** - Platform: **4.18.2101.9** - Engine: **1.1.17800.5** - Support phase: **Security and Critical Updates** - -### What's new - -- Shellcode exploit detection improvements -- Increased visibility for credential stealing attempts -- Improvements in antitampering features in Microsoft Defender Antivirus services -- Improved support for ARM x64 emulation -- Fix: EDR Block notification remains in threat history after real-time protection performed initial detection - -### Known Issues -No known issues -
-
- -### Previous version updates: Technical upgrade support only - -After a new package version is released, support for the previous two versions is reduced to technical support only. Versions older than that are listed in this section, and are provided for technical upgrade support only. -

-
- November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4) - - Security intelligence update version: **1.327.1854.0** - Released: **December 03, 2020** - Platform: **4.18.2011.6** - Engine: **1.1.17700.4** - Support phase: **Security and Critical Updates** - -### What's new - -- Improved [SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) status support logging - -### Known Issues -No known issues -
-
- October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5) - - Security intelligence update version: **1.327.7.0** - Released: **October 29, 2020** - Platform: **4.18.2010.7** - Engine: **1.1.17600.5** - Support phase: **Security and Critical Updates** - -### What's new - -- New descriptions for special threat categories -- Improved emulation capabilities -- Improved host address allow/block capabilities -- New option in Defender CSP to Ignore merging of local user exclusions - -### Known Issues - -No known issues -
-
- September-2020 (Platform: 4.18.2009.7 | Engine: 1.1.17500.4) - - Security intelligence update version: **1.325.10.0** - Released: **October 01, 2020** - Platform: **4.18.2009.7** - Engine: **1.1.17500.4** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Admin permissions are required to restore files in quarantine -- XML formatted events are now supported -- CSP support for ignoring exclusion merges -- New management interfaces for: - - UDP Inspection - - Network Protection on Server 2019 - - IP Address exclusions for Network Protection -- Improved visibility into TPM measurements -- Improved Office VBA module scanning - -### Known Issues - -No known issues -
-
-
- August-2020 (Platform: 4.18.2008.9 | Engine: 1.1.17400.5) - - Security intelligence update version: **1.323.9.0** - Released: **August 27, 2020** - Platform: **4.18.2008.9** - Engine: **1.1.17400.5** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Add more telemetry events -- Improved scan event telemetry -- Improved behavior monitoring for memory scans -- Improved macro streams scanning -- Added `AMRunningMode` to Get-MpComputerStatus PowerShell cmdlet -- [DisableAntiSpyware](/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) is ignored. Microsoft Defender Antivirus automatically turns itself off when it detects another antivirus program. - - -### Known Issues -No known issues -
-
- -
- July-2020 (Platform: 4.18.2007.8 | Engine: 1.1.17300.4) - - Security intelligence update version: **1.321.30.0** - Released: **July 28, 2020** - Platform: **4.18.2007.8** - Engine: **1.1.17300.4** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Improved telemetry for BITS -- Improved Authenticode code signing certificate validation - -### Known Issues -No known issues -
-
- -
- June-2020 (Platform: 4.18.2006.10 | Engine: 1.1.17200.2) - - Security intelligence update version: **1.319.20.0** - Released: **June 22, 2020** - Platform: **4.18.2006.10** - Engine: **1.1.17200.2** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Possibility to specify the [location of the support logs](./collect-diagnostic-data.md) -- Skipping aggressive catchup scan in Passive mode. -- Allow Defender to update on metered connections -- Fixed performance tuning when caching is disabled -- Fixed registry query -- Fixed scantime randomization in ADMX - -### Known Issues -No known issues -
-
- -
- May-2020 (Platform: 4.18.2005.4 | Engine: 1.1.17100.2) - - Security intelligence update version: **1.317.20.0** - Released: **May 26, 2020** - Platform: **4.18.2005.4** - Engine: **1.1.17100.2** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Improved logging for scan events -- Improved user mode crash handling. -- Added event tracing for Tamper protection -- Fixed AMSI Sample submission -- Fixed AMSI Cloud blocking -- Fixed Security update install log - -### Known Issues -No known issues -
-
- -
- April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2) - - Security intelligence update version: **1.315.12.0** - Released: **April 30, 2020** - Platform: **4.18.2004.6** - Engine: **1.1.17000.2** - Support phase: **Technical upgrade support (only)** - -### What's new -- WDfilter improvements -- Add more actionable event data to attack surface reduction detection events -- Fixed version information in diagnostic data and WMI -- Fixed incorrect platform version in UI after platform update -- Dynamic URL intel for Fileless threat protection -- UEFI scan capability -- Extend logging for updates - -### Known Issues -No known issues -
-
- -
- March-2020 (Platform: 4.18.2003.8 | Engine: 1.1.16900.2) - - Security intelligence update version: **1.313.8.0** - Released: **March 24, 2020** - Platform: **4.18.2003.8** - Engine: **1.1.16900.4** - Support phase: **Technical upgrade support (only)** - -### What's new - -- CPU Throttling option added to [MpCmdRun](./command-line-arguments-microsoft-defender-antivirus.md) -- Improve diagnostic capability -- reduce Security intelligence timeout (5 min) -- Extend AMSI engine internal log capability -- Improve notification for process blocking - -### Known Issues -[**Fixed**] Microsoft Defender Antivirus is skipping files when running a scan. - -
-
- -
- - February-2020 (Platform: - | Engine: 1.1.16800.2) - - - Security intelligence update version: **1.311.4.0** - Released: **February 25, 2020** - Platform/Client: **-** - Engine: **1.1.16800.2** - Support phase: **Technical upgrade support (only)** - -### What's new - - -### Known Issues -No known issues -
-
- -
- January-2020 (Platform: 4.18.2001.10 | Engine: 1.1.16700.2) - - -Security intelligence update version: **1.309.32.0** -Released: **January 30, 2020** -Platform/Client: **4.18.2001.10** -Engine: **1.1.16700.2** - Support phase: **Technical upgrade support (only)** - -### What's new - -- Fixed BSOD on WS2016 with Exchange -- Support platform updates when TMP is redirected to network path -- Platform and engine versions are added to [WDSI](https://www.microsoft.com/en-us/wdsi/defenderupdates) -- extend Emergency signature update to [passive mode](./microsoft-defender-antivirus-compatibility.md) -- Fix 4.18.1911.3 hang - -### Known Issues - -[**Fixed**] devices utilizing [modern standby mode](/windows-hardware/design/device-experiences/modern-standby) may experience a hang with the Windows Defender filter driver that results in a gap of protection. Affected machines appear to the customer as having not updated to the latest antimalware platform. -
-> [!IMPORTANT] -> This update is: -> - needed by RS1 devices running lower version of the platform to support SHA2; -> - has a reboot flag for systems that have hanging issues; -> - is re-released in April 2020 and will not be superseded by newer updates to keep future availability; -> - is categorized as an update due to the reboot requirement; and -> - is only be offered with [Windows Update](https://support.microsoft.com/help/4027667/windows-10-update). -
-
- -
- November-2019 (Platform: 4.18.1911.3 | Engine: 1.1.16600.7) - -Security intelligence update version: **1.307.13.0** -Released: **December 7, 2019** -Platform: **4.18.1911.3** -Engine: **1.1.17000.7** -Support phase: **No support** - -### What's new - -- Fixed MpCmdRun tracing level -- Fixed WDFilter version info -- Improve notifications (PUA) -- add MRT logs to support files - -### Known Issues -When this update is installed, the device needs the jump package 4.10.2001.10 to be able to update to the latest platform version. -
-
- - -## Microsoft Defender Antivirus platform support -Platform and engine updates are provided on a monthly cadence. To be fully supported, keep current with the latest platform updates. Our support structure is dynamic, evolving into two phases depending on the availability of the latest platform version: - -- **Security and Critical Updates servicing phase** - When running the latest platform version, you will be eligible to receive both Security and Critical updates to the anti-malware platform. - -- **Technical Support (Only) phase** - After a new platform version is released, support for older versions (N-2) will reduce to technical support only. Platform versions older than N-2 will no longer be supported.* - -\* Technical support will continue to be provided for upgrades from the Windows 10 release version (see [Platform version included with Windows 10 releases](#platform-version-included-with-windows-10-releases)) to the latest platform version. - -During the technical support (only) phase, commercially reasonable support incidents will be provided through Microsoft Customer Service & Support and Microsoft’s managed support offerings (such as Premier Support). If a support incident requires escalation to development for further guidance, requires a non-security update, or requires a security update, customers will be asked to upgrade to the latest platform version or an intermediate update (*). - -### Platform version included with Windows 10 releases -The below table provides the Microsoft Defender Antivirus platform and engine versions that are shipped with the latest Windows 10 releases: - -|Windows 10 release |Platform version |Engine version |Support phase | -|:---|:---|:---|:---| -|2004 (20H1/20H2) |4.18.1909.6 |1.1.17000.2 | Technical upgrade support (only) | -|1909 (19H2) |4.18.1902.5 |1.1.16700.3 | Technical upgrade support (only) | -|1903 (19H1) |4.18.1902.5 |1.1.15600.4 | Technical upgrade support (only) | -|1809 (RS5) |4.18.1807.18075 |1.1.15000.2 | Technical upgrade support (only) | -|1803 (RS4) |4.13.17134.1 |1.1.14600.4 | Technical upgrade support (only) | -|1709 (RS3) |4.12.16299.15 |1.1.14104.0 | Technical upgrade support (only) | -|1703 (RS2) |4.11.15603.2 |1.1.13504.0 | Technical upgrade support (only) | -|1607 (RS1) |4.10.14393.3683 |1.1.12805.0 | Technical upgrade support (only) | - -For Windows 10 release information, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet). - -## Updates for Deployment Image Servicing and Management (DISM) - -We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. - -For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images). - -
-1.1.2104.01 - - Package version: **1.1.2104.01** - Platform version: **4.18.2102.4** - Engine version: **1.1.18000.5** - Signature version: **1.335.232.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2103.01 - - Package version: **1.1.2103.01** - Platform version: **4.18.2101.9** - Engine version: **1.1.17800.5** - Signature version: **1.331.2302.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2102.03 - - Package version: **1.1.2102.03** - Platform version: **4.18.2011.6** - Engine version: **1.1.17800.5** - Signature version: **1.331.174.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2101.02 - - Package version: **1.1.2101.02** - Platform version: **4.18.2011.6** - Engine version: **1.1.17700.4** - Signature version: **1.329.1796.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2012.01 - - Package version: **1.1.2012.01** - Platform version: **4.18.2010.7** - Engine version: **1.1.17600.5** - Signature version: **1.327.1991.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2011.02 - - Package version: **1.1.2011.02** - Platform version: **4.18.2010.7** - Engine version: **1.1.17600.5** - Signature version: **1.327.658.0** - -### Fixes -- None - -### Additional information -- Refreshed Microsoft Defender Antivirus signatures -
-
-1.1.2011.01 - - Package version: **1.1.2011.01** - Platform version: **4.18.2009.7** - Engine version: **1.1.17600.5** - Signature version: **1.327.344.0** - -### Fixes -- None - -### Additional information -- None -
-
-1.1.2009.10 - - Package version: **1.1.2011.01** - Platform version: **4.18.2008.9** - Engine version: **1.1.17400.5** - Signature version: **1.327.2216.0** - -### Fixes -- None - -### Additional information -- Added support for Windows 10 RS1 or later OS install images. -
-
- -## Additional resources - -| Article | Description | -|:---|:---| -|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 installation images. | -|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through many sources. | -|[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. | -|[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. | -|[Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | You can set protection updates to be downloaded at startup or after certain cloud-delivered protection events. | -|[Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md)| You can specify settings, such as whether updates should occur on battery power, that are especially useful for mobile devices and virtual machines. | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md deleted file mode 100644 index 51c34c5b41..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Define how mobile devices are updated by Microsoft Defender Antivirus -description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender Antivirus protection updates. -keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Manage updates for mobile devices and virtual machines (VMs) - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Mobile devices and VMs may require more configuration to ensure performance is not impacted by updates. - -There are two settings that are useful for these devices: - -- Opt in to Microsoft Update on mobile computers without a WSUS connection -- Prevent Security intelligence updates when running on battery power - -The following articles may also be useful in these situations: -- [Configuring scheduled and catch-up scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -- [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) -- [Deployment guide for Microsoft Defender Antivirus in a virtual desktop infrastructure (VDI) environment](deployment-vdi-microsoft-defender-antivirus.md) - -## Opt in to Microsoft Update on mobile computers without a WSUS connection - -You can use Microsoft Update to keep Security intelligence on mobile devices running Microsoft Defender Antivirus up to date when they are not connected to the corporate network or don't otherwise have a WSUS connection. - -This means that protection updates can be delivered to devices (via Microsoft Update) even if you have set WSUS to override Microsoft Update. - -You can opt in to Microsoft Update on the mobile device in one of the following ways: - -- Change the setting with Group Policy. -- Use a VBScript to create a script, then run it on each computer in your network. -- Manually opt in every computer on your network through the **Settings** menu. - -### Use Group Policy to opt in to Microsoft Update - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and select **Edit**. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Select **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**. - -5. Set **Allow security intelligence updates from Microsoft Update** to **Enabled**, and then select **OK**. - - -### Use a VBScript to opt in to Microsoft Update - -1. Use the instructions in the MSDN article [Opt-In to Microsoft Update](/windows/win32/wua_sdk/opt-in-to-microsoft-update) to create the VBScript. - -2. Run the VBScript you created on each computer in your network. - -### Manually opt in to Microsoft Update - -1. Open **Windows Update** in **Update & security** settings on the computer you want to opt in. - -2. Select **Advanced** options. - -3. Select the checkbox for **Give me updates for other Microsoft products when I update Windows**. - -## Prevent Security intelligence updates when running on battery power - -You can configure Microsoft Defender Antivirus to only download protection updates when the PC is connected to a wired power source. - -### Use Group Policy to prevent security intelligence updates on battery power - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), choose the Group Policy Object you want to configure, and open it for editing. - -2. In the **Group Policy Management Editor** go to **Computer configuration**. - -3. Select **Policies** then **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Signature Updates**, and then set **Allow security intelligence updates when running on battery power** to **Disabled**. Then select **OK**. - -This action prevents protection updates from downloading when the PC is on battery power. - -## Related articles - -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Update and manage Microsoft Defender Antivirus in Windows 10](deploy-manage-report-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md deleted file mode 100644 index 92315538b4..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -title: Microsoft Defender Antivirus compatibility with other security products -description: What to expect from Microsoft Defender Antivirus with other security products and the operating systems you are using. -keywords: windows defender, next-generation, antivirus, compatibility, passive mode -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: tewchen, pahuijbr, shwjha -manager: dansimp -ms.date: 02/09/2021 -ms.technology: mde ---- - -# Microsoft Defender Antivirus compatibility - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -## Overview - -Microsoft Defender Antivirus is automatically enabled and installed on endpoints and devices that are running Windows 10. But what happens when another antivirus/antimalware solution is used? It depends on whether you're using [Microsoft Defender for Endpoint](../index.md) together with your antivirus protection. -- If your organization's endpoints and devices are protected with a non-Microsoft antivirus/antimalware solution, and Microsoft Defender for Endpoint is not used, then Microsoft Defender Antivirus automatically goes into disabled mode. -- If your organization is using Microsoft Defender for Endpoint together with a non-Microsoft antivirus/antimalware solution, then Microsoft Defender Antivirus automatically goes into passive mode. (Real-time protection and threats are not remediated by Microsoft Defender Antivirus.) -- If your organization is using Microsoft Defender for Endpoint together with a non-Microsoft antivirus/antimalware solution, and you have [EDR in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode) enabled, then whenever a malicious artifact is detected, Microsoft Defender for Endpoint takes action to block and remediate the artifact. - -## Antivirus and Microsoft Defender for Endpoint - -The following table summarizes what happens with Microsoft Defender Antivirus when third-party antivirus products are used together or without Microsoft Defender for Endpoint. - - -| Windows version | Antimalware protection | Microsoft Defender for Endpoint enrollment | Microsoft Defender Antivirus state | -|------|------|-------|-------| -| Windows 10 | A third-party product that is not offered or developed by Microsoft | Yes | Passive mode | -| Windows 10 | A third-party product that is not offered or developed by Microsoft | No | Automatically disabled mode | -| Windows 10 | Microsoft Defender Antivirus | Yes | Active mode | -| Windows 10 | Microsoft Defender Antivirus | No | Active mode | -| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | Yes | Must be set to passive mode (manually) [[1](#fn1)] | -| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually) [[2](#fn2)] | -| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | Yes | Active mode | -| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | No | Active mode | -| Windows Server 2016 | Microsoft Defender Antivirus | Yes | Active mode | -| Windows Server 2016 | Microsoft Defender Antivirus | No | Active mode | -| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | Yes | Must be disabled (manually) [[2](#fn2)] | -| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually) [[2](#fn2)] | - -(1) On Windows Server, version 1803 or newer, or Windows Server 2019, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-on-windows-server-2016.md#need-to-set-microsoft-defender-antivirus-to-passive-mode) to prevent problems caused by having multiple antivirus products installed on a server. - -If you are using Windows Server, version 1803 or newer, or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key: -- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` -- Name: `ForcePassiveMode` -- Type: `REG_DWORD` -- Value: `1` - -> [!NOTE] -> The `ForcePassiveMode` registry key is not supported on Windows Server 2016. - -(2) On Windows Server 2016, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In addition, Microsoft Defender Antivirus is not supported in passive mode. In those cases, [disable/uninstall Microsoft Defender Antivirus manually](microsoft-defender-antivirus-on-windows-server-2016.md#are-you-using-windows-server-2016) to prevent problems caused by having multiple antivirus products installed on a server. - -See [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server-2016.md) for key differences and management options for Windows Server installations. - -> [!IMPORTANT] -> Microsoft Defender Antivirus is only available on devices running Windows 10, Windows Server 2016, Windows Server, version 1803 or later, and Windows Server 2019. -> -> In Windows 8.1 and Windows Server 2012, enterprise-level endpoint antivirus protection is offered as [System Center Endpoint Protection](/previous-versions/system-center/system-center-2012-R2/hh508760(v=technet.10)), which is managed through Microsoft Endpoint Configuration Manager. -> -> Windows Defender is also offered for [consumer devices on Windows 8.1 and Windows Server 2012](/previous-versions/windows/it-pro/windows-8.1-and-8/dn344918(v=ws.11)#BKMK_WindowsDefender), although it does not provide enterprise-level management (or an interface on Windows Server 2012 Server Core installations). - -## Functionality and features available in each state - -The table in this section summarizes the functionality and features that are available in each state. The table is designed to be informational only. It is intended to describe the features & capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, in passive mode, or is disabled/uninstalled. - -> [!IMPORTANT] -> Do not turn off capabilities, such as real-time protection, cloud-delivered protection, or limited periodic scanning, if you are using Microsoft Defender Antivirus in passive mode or you are using EDR in block mode. - -|Protection |Active mode |Passive mode |EDR in block mode |Disabled or uninstalled | -|:---|:---|:---|:---|:---| -| [Real-time protection](./configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](./enable-cloud-protection-microsoft-defender-antivirus.md) | Yes | No [[3](#fn3)] | No | No | -| [Limited periodic scanning availability](./limited-periodic-scanning-microsoft-defender-antivirus.md) | No | No | No | Yes | -| [File scanning and detection information](./customize-run-review-remediate-scans-microsoft-defender-antivirus.md) | Yes | Yes | Yes | No | -| [Threat remediation](./configure-remediation-microsoft-defender-antivirus.md) | Yes | See note [[4](#fn4)] | Yes | No | -| [Security intelligence updates](./manage-updates-baselines-microsoft-defender-antivirus.md) | Yes | Yes | Yes | No | - -(3) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode. - -(4) When Microsoft Defender Antivirus is in passive mode, threat remediation features are active only during scheduled or on-demand scans. - -> [!NOTE] -> [Microsoft 365 Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in active or passive mode. - -## Keep the following points in mind - -- In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself). - -- In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode. - -- When [EDR in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items. - -- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. Disabling/uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution. - -- If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](/microsoft-365/security/defender-endpoint/defender-compatibility) in order to properly monitor your devices and network for intrusion attempts and attacks. - -- When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app. - -- When Microsoft Defender Antivirus is in passive mode, you can still [manage updates for Microsoft Defender Antivirus](manage-updates-baselines-microsoft-defender-antivirus.md); however, you can't move Microsoft Defender Antivirus into active mode if your devices have an up-to-date, non-Microsoft antivirus product providing real-time protection from malware. For optimal security layered defense and detection efficacy, please ensure that you update the [Microsoft Defender Antivirus protection (Security intelligence update, Engine and Platform)](./manage-updates-baselines-microsoft-defender-antivirus.md) even if Microsoft Defender Antivirus is running in passive mode. - - If you uninstall the non-Microsoft antivirus product, and use Microsoft Defender Antivirus to provide protection to your devices, Microsoft Defender Antivirus will return to its normal active mode automatically. - -> [!WARNING] -> Do not disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This recommendation includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md). - - -## See also - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server-2016.md) -- [EDR in block mode](/microsoft-365/security/defender-endpoint/edr-in-block-mode) -- [Configure Endpoint Protection](/mem/configmgr/protect/deploy-use/endpoint-protection-configure) -- [Address false positives/negatives in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/defender-endpoint-false-positives-negatives) -- [Learn about Microsoft 365 Endpoint data loss prevention](/microsoft-365/compliance/endpoint-dlp-learn-about) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md deleted file mode 100644 index 7a04c3b3d7..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Next-generation protection in Windows 10, Windows Server 2016, and Windows Server 2019 -description: Learn how to manage, configure, and use Microsoft Defender Antivirus, built-in antimalware and antivirus protection. -keywords: Microsoft Defender Antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -author: denisebmsft -ms.author: deniseb -ms.date: 12/16/2020 -ms.reviewer: -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Next-generation protection in Windows - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -## Microsoft Defender Antivirus: Your next-generation protection - -Microsoft Defender Antivirus is the next-generation protection component of Microsoft Defender for Endpoint. This protection brings together machine learning, big-data analysis, in-depth threat resistance research, and the Microsoft cloud infrastructure to protect devices in your enterprise organization. Your next-generation protection services include the following capabilities: - -- [Behavior-based, heuristic, and real-time antivirus protection](configure-protection-features-microsoft-defender-antivirus.md), which includes always-on scanning using file and process behavior monitoring and other heuristics (also known as *real-time protection*). It also includes detecting and blocking apps that are deemed unsafe, but might not be detected as malware. -- [Cloud-delivered protection](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md), which includes near-instant detection and blocking of new and emerging threats. -- [Dedicated protection and product updates](manage-updates-baselines-microsoft-defender-antivirus.md), which includes updates related to keeping Microsoft Defender Antivirus up to date. - -## Try a demo! - -Visit the [Microsoft Defender for Endpoint demo website](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following protection features are working and explore them using demo scenarios: -- Cloud-delivered protection -- Block at first sight (BAFS) protection -- Potentially unwanted applications (PUA) protection - -## Minimum system requirements - -Microsoft Defender Antivirus has the same hardware requirements as of Windows 10. For more information, see the following resources: - -- [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) -- [Hardware component guidelines](/windows-hardware/design/component-guidelines/components) - -## Configure next-generation protection services - -For information on how to configure next-generation protection services, see [Configure Microsoft Defender Antivirus features](configure-microsoft-defender-antivirus-features.md). - -> [!Note] -> Configuration and management is largely the same in Windows Server 2016 and Windows Server 2019, while running Microsoft Defender Antivirus; however, there are some differences. To learn more, see [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md). - -## See also - -- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) -- [Microsoft Defender Antivirus management and configuration](configuration-management-reference-microsoft-defender-antivirus.md) -- [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md deleted file mode 100644 index 8c921a84b9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ /dev/null @@ -1,218 +0,0 @@ ---- -title: Microsoft Defender Antivirus on Windows Server -description: Learn how to enable and configure Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019. -keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012 -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.date: 01/21/2021 -ms.reviewer: pahuijbr, shwjha -manager: dansimp -ms.technology: mde ---- - -# Microsoft Defender Antivirus on Windows Server - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus is available on the following editions/versions of Windows Server: -- Windows Server 2019 -- Windows Server, version 1803 or later -- Windows Server 2016. - -In some instances, Microsoft Defender Antivirus is referred to as *Endpoint Protection*; however, the protection engine is the same. Although the functionality, configuration, and management are largely the same for [Microsoft Defender Antivirus on Windows 10](microsoft-defender-antivirus-in-windows-10.md), there are a few key differences on Windows Server: - -- In Windows Server, [automatic exclusions](configure-server-exclusions-microsoft-defender-antivirus.md) are applied based on your defined Server Role. -- In Windows Server, Microsoft Defender Antivirus does not automatically disable itself if you are running another antivirus product. - -## The process at a glance - -The process of setting up and running Microsoft Defender Antivirus on a server platform includes several steps: - -1. [Enable the interface](#enable-the-user-interface-on-windows-server). -2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server). -3. [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running). -4. [Update your antimalware Security intelligence](#update-antimalware-security-intelligence). -5. (As needed) [Submit samples](#submit-samples). -6. (As needed) [Configure automatic exclusions](#configure-automatic-exclusions). -7. (Only if necessary) [Set Microsoft Defender Antivirus to passive mode](#need-to-set-microsoft-defender-antivirus-to-passive-mode). - -## Enable the user interface on Windows Server - -By default, Microsoft Defender Antivirus is installed and functional on Windows Server. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. If the GUI is not installed on your server, you can add it by using the **Add Roles and Features** wizard, or by using PowerShell cmdlets. - -### Turn on the GUI using the Add Roles and Features Wizard - -1. See [Install roles, role services, and features by using the add Roles and Features Wizard](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**. - -2. When you get to the **Features** step of the wizard, under **Windows Defender Features**, select the **GUI for Windows Defender** option. - - In Windows Server 2016, the **Add Roles and Features Wizard** looks like this: - - ![Add roles and feature wizard showing the GUI for Windows Defender option](images/server-add-gui.png) - - In Windows Server 2019, the **Add Roles and Feature Wizard** is similar. - -### Turn on the GUI using PowerShell - -The following PowerShell cmdlet will enable the interface: - -```PowerShell -Install-WindowsFeature -Name Windows-Defender-GUI -``` - -## Install Microsoft Defender Antivirus on Windows Server - -You can use either the **Add Roles and Features Wizard** or PowerShell to install Microsoft Defender Antivirus. - -### Use the Add Roles and Features Wizard - -1. Refer to [this article](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#install-roles-role-services-and-features-by-using-the-add-roles-and-features-wizard), and use the **Add Roles and Features Wizard**. - -2. When you get to the **Features** step of the wizard, select the Microsoft Defender Antivirus option. Also select the **GUI for Windows Defender** option. - -### Use PowerShell - -To use PowerShell to install Microsoft Defender Antivirus, run the following cmdlet: - -```PowerShell -Install-WindowsFeature -Name Windows-Defender -``` - -Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender AV Events](troubleshoot-microsoft-defender-antivirus.md). - - -## Verify Microsoft Defender Antivirus is running - -To verify that Microsoft Defender Antivirus is running on your server, run the following PowerShell cmdlet: - -```PowerShell -Get-Service -Name windefend -``` - -To verify that firewall protection is turned on, run the following PowerShell cmdlet: - -```PowerShell -Get-Service -Name mpssvc -``` - -As an alternative to PowerShell, you can use Command Prompt to verify that Microsoft Defender Antivirus is running. To do that, run the following command from a command prompt: - -```console -sc query Windefend -``` - -The `sc query` command returns information about the Microsoft Defender Antivirus service. When Microsoft Defender Antivirus is running, the `STATE` value displays `RUNNING`. - -## Update antimalware Security intelligence - -To get updated antimalware security intelligence, you must have the Windows Update service running. If you use an update management service, like Windows Server Update Services (WSUS), make sure that updates for Microsoft Defender Antivirus Security intelligence are approved for the computers you manage. - -By default, Windows Update does not download and install updates automatically on Windows Server 2019 or Windows Server 2016. You can change this configuration by using one of the following methods: - - -|Method |Description | -|---------|---------| -|**Windows Update** in Control Panel |- **Install updates automatically** results in all updates being automatically installed, including Windows Defender Security intelligence updates.
- **Download updates but let me choose whether to install them** allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | -|**Group Policy** | You can set up and manage Windows Update by using the settings available in Group Policy, in the following path: **Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates** | -|The **AUOptions** registry key |The following two values allow Windows Update to automatically download and install Security intelligence updates:
- **4** - **Install updates automatically**. This value results in all updates being automatically installed, including Windows Defender Security intelligence updates.
- **3** - **Download updates but let me choose whether to install them**. This value allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | - -To ensure that protection from malware is maintained, we recommend that you enable the following services: - -- Windows Error Reporting service - -- Windows Update service - -The following table lists the services for Microsoft Defender Antivirus and the dependent services. - -|Service Name|File Location|Description| -|--------|---------|--------| -|Windows Defender Service (WinDefend)|`C:\Program Files\Windows Defender\MsMpEng.exe`|This is the main Microsoft Defender Antivirus service that needs to be running at all times.| -|Windows Error Reporting Service (Wersvc)|`C:\WINDOWS\System32\svchost.exe -k WerSvcGroup`|This service sends error reports back to Microsoft.| -|Windows Defender Firewall (MpsSvc)|`C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork`|We recommend leaving the Windows Defender Firewall service enabled.| -|Windows Update (Wuauserv)|`C:\WINDOWS\system32\svchost.exe -k netsvcs`|Windows Update is needed to get Security intelligence updates and antimalware engine updates| - -## Submit samples - -Sample submission allows Microsoft to collect samples of potentially malicious software. To help provide continued and up-to-date protection, Microsoft researchers use these samples to analyze suspicious activities and produce updated antimalware Security intelligence. We collect program executable files, such as .exe files and .dll files. We do not collect files that contain personal data, like Microsoft Word documents and PDF files. - -### Submit a file - -1. Review the [submission guide](../intelligence/submission-guide.md). - -2. Visit the [sample submission portal](https://www.microsoft.com/wdsi/filesubmission), and submit your file. - - -### Enable automatic sample submission - -To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings: - -|Setting |Description | -|---------|---------| -|**0** - **Always prompt** |The Microsoft Defender Antivirus service prompts you to confirm submission of all required files. This is the default setting for Microsoft Defender Antivirus, but is not recommended for installations on Windows Server 2016 or 2019 without a GUI. | -|**1** - **Send safe samples automatically** |The Microsoft Defender Antivirus service sends all files marked as "safe" and prompts for the remainder of the files. | -|**2** - **Never send** |The Microsoft Defender Antivirus service does not prompt and does not send any files. | -|**3** - **Send all samples automatically** |The Microsoft Defender Antivirus service sends all files without a prompt for confirmation. | - -## Configure automatic exclusions - -To help ensure security and performance, certain exclusions are automatically added based on the roles and features you install when using Microsoft Defender Antivirus on Windows Server 2016 or 2019. - -See [Configure exclusions in Microsoft Defender Antivirus on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md). - -## Need to set Microsoft Defender Antivirus to passive mode? - -If you are using a non-Microsoft antivirus product as your primary antivirus solution, set Microsoft Defender Antivirus to passive mode. - -### Set Microsoft Defender Antivirus to passive mode using a registry key - -If you are using Windows Server, version 1803 or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key: -- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` -- Name: `ForcePassiveMode` -- Type: `REG_DWORD` -- Value: `1` - -### Disable Microsoft Defender Antivirus using the Remove Roles and Features wizard - -1. See [Install or Uninstall Roles, Role Services, or Features](/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**. - -2. When you get to the **Features** step of the wizard, clear the **Windows Defender Features** option. - - If you clear **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**. - - Microsoft Defender Antivirus will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. - -### Turn off the Microsoft Defender Antivirus user interface using PowerShell - -To turn off the Microsoft Defender Antivirus GUI, use the following PowerShell cmdlet: - -```PowerShell -Uninstall-WindowsFeature -Name Windows-Defender-GUI -``` - -### Are you using Windows Server 2016? - -If you are using Windows Server 2016 and a third-party antimalware/antivirus product that is not offered or developed by Microsoft, you'll need to disable/uninstall Microsoft Defender Antivirus. - -> [!NOTE] -> You can't uninstall the Windows Security app, but you can disable the interface with these instructions. - -The following PowerShell cmdlet uninstalls Microsoft Defender Antivirus on Windows Server 2016: - -```PowerShell -Uninstall-WindowsFeature -Name Windows-Defender -``` - -## See also - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md deleted file mode 100644 index 417b11ccbd..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md +++ /dev/null @@ -1,139 +0,0 @@ ---- -title: Microsoft Defender Offline in Windows 10 -description: You can use Microsoft Defender Offline straight from the Windows Defender Antivirus app. You can also manage how it is deployed in your network. -keywords: scan, defender, offline -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Run and review the results of a Microsoft Defender Offline scan - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR). - -You can use Microsoft Defender Offline if you suspect a malware infection, or you want to confirm a thorough clean of the endpoint after a malware outbreak. - -In Windows 10, Microsoft Defender Offline can be run with one click directly from the [Windows Security app](microsoft-defender-security-center-antivirus.md). In previous versions of Windows, a user had to install Microsoft Defender Offline to bootable media, restart the endpoint, and load the bootable media. - -## prerequisites and requirements - -Microsoft Defender Offline in Windows 10 has the same hardware requirements as Windows 10. - -For more information about Windows 10 requirements, see the following topics: - -- [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) - -- [Hardware component guidelines](/windows-hardware/design/component-guidelines/components) - -> [!NOTE] -> Microsoft Defender Offline is not supported on machines with ARM processors, or on Windows Server Stock Keeping Units. - -To run Microsoft Defender Offline from the endpoint, the user must be logged in with administrator privileges. - -## Microsoft Defender Offline updates - -Microsoft Defender Offline uses the most recent protection updates available on the endpoint; it's updated whenever Windows Defender Antivirus is updated. - -> [!NOTE] -> Before running an offline scan, you should attempt to update Microsoft Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). - -See the [Manage Microsoft Defender Antivirus Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) topic for more information. - -## Usage scenarios - -In Windows 10, version 1607, you can manually force an offline scan. Alternatively, if Windows Defender determines that Microsoft Defender Offline needs to run, it will prompt the user on the endpoint. - -The need to perform an offline scan will also be revealed in Microsoft Endpoint Manager if you're using it to manage your endpoints. - -The prompt can occur via a notification, similar to the following: - -![Windows notification showing the requirement to run Microsoft Defender Offline](images/defender/notification.png) - -The user will also be notified within the Windows Defender client. - -In Configuration Manager, you can identify the status of endpoints by navigating to **Monitoring > Overview > Security > Endpoint Protection Status > System Center Endpoint Protection Status**. - -Microsoft Defender Offline scans are indicated under **Malware remediation status** as **Offline scan required**. - -![Microsoft Endpoint Manager indicating a Microsoft Defender Offline scan is required](images/defender/sccm-wdo.png) - -## Configure notifications - -Microsoft Defender Offline notifications are configured in the same policy setting as other Microsoft Defender AV notifications. - -For more information about notifications in Windows Defender, see the [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) topic. - -## Run a scan - -> [!IMPORTANT] -> Before you use Microsoft Defender Offline, make sure you save any files and shut down running programs. The Microsoft Defender Offline scan takes about 15 minutes to run. It will restart the endpoint when the scan is complete. The scan is performed outside of the usual Windows operating environment. The user interface will appear different to a normal scan performed by Windows Defender. After the scan is completed, the endpoint will be restarted and Windows will load normally. - -You can run a Microsoft Defender Offline scan with the following: - -- PowerShell -- Windows Management Instrumentation (WMI) -- The Windows Security app - - - -### Use PowerShell cmdlets to run an offline scan - -Use the following cmdlets: - -```PowerShell -Start-MpWDOScan -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to run an offline scan - -Use the [**MSFT_MpWDOScan**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class to run an offline scan. - -The following WMI script snippet will immediately run a Microsoft Defender Offline scan, which will cause the endpoint to restart, run the offline scan, and then restart and boot into Windows. - -```console -wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpWDOScan call Start -``` - -See the following for more information: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -### Use the Windows Defender Security app to run an offline scan - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then the **Advanced scan** label: - -3. Select **Microsoft Defender Offline scan** and click **Scan now**. - - > [!NOTE] - > In Windows 10, version 1607, the offline scan could be run from under **Windows Settings** > **Update & security** > **Windows Defender** or from the Windows Defender client. - - -## Review scan results - -Microsoft Defender Offline scan results will be listed in the [Scan history section of the Windows Security app](microsoft-defender-security-center-antivirus.md). - - -## Related articles - -- [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md deleted file mode 100644 index 511ce4e363..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Microsoft Defender Antivirus in the Windows Security app -description: With Microsoft Defender Antivirus now included in the Windows Security app, you can review, compare, and perform common tasks. -keywords: wdav, antivirus, firewall, security, windows -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Microsoft Defender Antivirus in the Windows Security app - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -In Windows 10, version 1703 and later, the Windows Defender app is part of the Windows Security. - -Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. - -> [!IMPORTANT] -> Disabling the Windows Security Center service does not disable Microsoft Defender Antivirus or [Windows Defender Firewall](../windows-firewall/windows-firewall-with-advanced-security.md). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date. -> -> If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app might display stale or inaccurate information about any antivirus or firewall products you have installed on the device. -> It might also prevent Microsoft Defender Antivirus from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you might have previously installed. -> This will significantly lower the protection of your device and could lead to malware infection. - -See the [Windows Security article](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center) for more information on other Windows security features that can be monitored in the app. - -The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal that is used to review and manage [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint). - -## Review virus and threat protection settings in the Windows Security app - -![Screenshot of the Virus & threat protection settings label in the Windows Security app](images/defender/wdav-protection-settings-wdsc.png) - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -The following sections describe how to perform some of the most common tasks when reviewing or interacting with the threat protection provided by Microsoft Defender Antivirus in the Windows Security app. - -> [!NOTE] -> If these settings are configured and deployed using Group Policy, the settings described in this section will be greyed-out and unavailable for use on individual endpoints. Changes made through a Group Policy Object must first be deployed to individual endpoints before the setting will be updated in Windows Settings. The [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) topic describes how local policy override settings can be configured. - -## Run a scan with the Windows Security app - -1. Open the Windows Security app by searching the start menu for **Security**, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Select **Quick scan**. Or, to run a full scan, select **Scan options**, and then select an option, such as **Full scan**. - -## Review the security intelligence update version and download the latest updates in the Windows Security app - -![Security intelligence version number information](images/defender/wdav-wdsc-defs.png) - -1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Select **Virus & threat protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check your current against the latest version available for manual download, or review the change log for that version. See [Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware](https://www.microsoft.com/en-us/wdsi/defenderupdates). - -4. Select **Check for updates** to download new protection updates (if there are any). - -## Ensure Microsoft Defender Antivirus is enabled in the Windows Security app - -1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Select **Virus & threat protection settings**. - -4. Toggle the **Real-time protection** switch to **On**. - - > [!NOTE] - > If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. - > If you install another antivirus product, Microsoft Defender Antivirus automatically disables itself and is indicated as such in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). - -## Add exclusions for Microsoft Defender Antivirus in the Windows Security app - -1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Under the **Manage settings**, select **Virus & threat protection settings**. - -4. Under the **Exclusions** setting, select **Add or remove exclusions**. - -5. Select the plus icon (**+**) to choose the type and set the options for each exclusion. - -The following table summarizes exclusion types and what happens: - -|Exclusion type |Defined by |What happens | -|---------|---------|---------| -|**File** |Location
Example: `c:\sample\sample.test` |The specific file is skipped by Microsoft Defender Antivirus. | -|**Folder** |Location
Example: `c:\test\sample` |All items in the specified folder are skipped by Microsoft Defender Antivirus. | -|**File type** |File extension
Example: `.test` |All files with the `.test` extension anywhere on your device are skipped by Microsoft Defender Antivirus. | -|**Process** |Executable file path
Example: `c:\test\process.exe` |The specific process and any files that are opened by that process are skipped by Microsoft Defender Antivirus. | - -To learn more, see the following resources: -- [Configure and validate exclusions based on file extension and folder location](./configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure exclusions for files opened by processes](./configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) - -## Review threat detection history in the Windows Defender Security Center app - -1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Select **Protection history**. Any recent items are listed. - -## Set ransomware protection and recovery options - -1. Open the Windows Security app by searching the start menu for *Security*, and then selecting **Windows Security**. - -2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Under **Ransomware protection**, select **Manage ransomware protection**. - -4. To change **Controlled folder access** settings, see [Protect important folders with Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). - -5. To set up ransomware recovery options, select **Set up** under **Ransomware data recovery** and follow the instructions for linking or setting up your OneDrive account so you can easily recover from a ransomware attack. - -## See also -- [Microsoft Defender Antivirus](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md deleted file mode 100644 index 21a6e74562..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/office-365-microsoft-defender-antivirus.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Better together - Microsoft Defender Antivirus and Office 365 (including OneDrive) - better protection from ransomware and cyberthreats -description: Office 365, which includes OneDrive, goes together wonderfully with Microsoft Defender Antivirus. Read this article to learn more. -keywords: windows defender, antivirus, office 365, onedrive, restore, ransomware -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -audience: ITPro -ms.topic: article -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 03/04/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Better together: Microsoft Defender Antivirus and Office 365 - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) -- Microsoft Defender Antivirus -- Microsoft 365 - -You might already know that: - -- **Microsoft Defender Antivirus protects your Windows 10 device from software threats, such as viruses, malware, and spyware**. Microsoft Defender Antivirus is your complete, ongoing protection, built into Windows 10 and ready to go. [Microsoft Defender Antivirus is your next-generation protection](./microsoft-defender-antivirus-in-windows-10.md). - -- **Office 365 includes antiphishing, antispam, and antimalware protection**. With your Office 365 subscription, you get premium email and calendars, Office apps, 1 TB of cloud storage (via OneDrive), and advanced security across all your devices. This is true for home and business users. And if you're a business user, and your organization is using Office 365 E5, you get even more protection through Microsoft Defender for Office 365 [Protect against threats with Office 365](/microsoft-365/security/office-365-security/protect-against-threats). - -- **OneDrive, included in Office 365, enables you to store your files and folders online, and share them as you see fit**. You can work together with people (for work or fun), and coauthor files that are stored in OneDrive. You can also access your files across all your devices (your PC, phone, and tablet). [Manage sharing in OneDrive](/OneDrive/manage-sharing). - -**But did you know there are good security reasons to use Microsoft Defender Antivirus together with Office 365**? Here are two: - - 1. [You get ransomware protection and recovery](#ransomware-protection-and-recovery). - - 2. [Integration means better protection](#integration-means-better-protection). - -Read the following sections to learn more. - -## Ransomware protection and recovery - -When you save your files to [OneDrive](/onedrive), and [Microsoft Defender Antivirus](./microsoft-defender-antivirus-in-windows-10.md) detects a ransomware threat on your device, the following things occur: - -1. **You are told about the threat**. (If your organization is using [Microsoft Defender for Endpoint](../index.md), your security operations team is notified, too.) - -2. **Microsoft Defender Antivirus helps you (and your organization's security team) remove the ransomware** from your device(s). (If your organization is using Microsoft Defender for Endpoint, your security operations team can determine whether other devices are infected and take appropriate action, too.) - -3. **You get the option to recover your files in OneDrive**. With the OneDrive Files Restore feature, you can recover your files in OneDrive to the state they were in before the ransomware attack occurred. See [Ransomware detection and recovering your files](https://support.office.com/article/0d90ec50-6bfd-40f4-acc7-b8c12c73637f). - -Think of the time and hassle this can save. - -## Integration means better protection - -Microsoft Defender for Office 365 integrated with Microsoft Defender for Endpoint means better protection for your organization. Here's how: - -- [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-atp) safeguards your organization against malicious threats posed in email messages, email attachments, and links (URLs) in Office documents. - - AND - -- [Microsoft Defender for Endpoint](../index.md) protects your devices from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves your security posture. - - SO - -- Once integration is enabled, your security operations team can see a list of devices that are used by the recipients of any detected URLs or email messages, along with recent alerts for those devices, in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). - -If you haven't already done so, [integrate Microsoft Defender for Office 365 with Microsoft Defender for Endpoint](/microsoft-365/security/office-365-security/integrate-office-365-ti-with-wdatp). - -## More good reasons to use OneDrive - -Protection from ransomware is one great reason to put your files in OneDrive. And there are several more good reasons, summarized in this video:

- -> [!VIDEO https://www.microsoft.com/videoplayer/embed/70b4d256-46fb-481f-ad9b-921ef5fd7bed] - -## Want to learn more? - -[OneDrive](/onedrive) - -[Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-atp?view=o365-worldwide) - -[Microsoft Defender for Endpoint](../index.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md deleted file mode 100644 index d50db570ec..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ /dev/null @@ -1,296 +0,0 @@ ---- -title: Protect security settings with tamper protection -ms.reviewer: shwjha, hayhov -manager: dansimp -description: Use tamper protection to prevent malicious apps from changing important security settings. -keywords: malware, defender, antivirus, tamper protection -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -audience: ITPro -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 03/22/2021 -ms.technology: mde ---- - -# Protect security settings with tamper protection - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Tamper protection is available for devices that are running one of the following versions of Windows: - -- Windows 10 -- Windows Server 2019 -- Windows Server, version 1803 or later -- Windows Server 2016 - -## Overview - -During some kinds of cyber attacks, bad actors try to disable security features, such as anti-virus protection, on your machines. Bad actors like to disable your security features to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper protection helps prevent these kinds of things from occurring. - -With tamper protection, malicious apps are prevented from taking actions such as: - -- Disabling virus and threat protection -- Disabling real-time protection -- Turning off behavior monitoring -- Disabling antivirus (such as IOfficeAntivirus (IOAV)) -- Disabling cloud-delivered protection -- Removing security intelligence updates - -### How it works - -Tamper protection essentially locks Microsoft Defender Antivirus and prevents your security settings from being changed through apps and methods such as: - -- Configuring settings in Registry Editor on your Windows device -- Changing settings through PowerShell cmdlets -- Editing or removing security settings through group policies - -Tamper protection doesn't prevent you from viewing your security settings. And, tamper protection doesn't affect how third-party antivirus apps register with the Windows Security app. If your organization is using Windows 10 Enterprise E5, individual users can't change the tamper protection setting; in those cases, tamper protection is managed by your security team. - -### What do you want to do? - -| To perform this task... | See this section... | -|:---|:---| -| Turn tamper protection on (or off) in the Microsoft Defender Security Center

Manage tamper protection across your tenant | [Manage tamper protection for your organization using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) | -| Turn tamper protection on (or off) for all or part of your organization using Intune

Fine-tune tamper protection settings in your organization | [Manage tamper protection for your organization using Intune](#manage-tamper-protection-for-your-organization-using-intune) | -| Turn tamper protection on (or off) for your organization with Configuration Manager | [Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) | -| Turn tamper protection on (or off) for an individual device | [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device) | -| View details about tampering attempts on devices | [View information about tampering attempts](#view-information-about-tampering-attempts) | -| Review your security recommendations | [Review security recommendations](#review-your-security-recommendations) | -| Review the list of frequently asked questions (FAQs) | [Browse the FAQs](#view-information-about-tampering-attempts) | - -## Manage tamper protection for your organization using the Microsoft Defender Security Center - -Tamper protection can be turned on or off for your tenant using the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). Here are a few points to keep in mind: - -- Currently, the option to manage tamper protection in the Microsoft Defender Security Center is on by default for new deployments. For existing deployments, tamper protection is available on an opt-in basis, with plans to make this the default method in the near future. (To opt in, in the Microsoft Defender Security Center, choose **Settings** > **Advanced features** > **Tamper protection**.) - -- When you use the Microsoft Defender Security Center to manage tamper protection, you do not have to use Intune or the tenant attach method. - -- When you manage tamper protection in the Microsoft Defender Security Center, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows Server 2016, or Windows Server 2019. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006). - -- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft Defender Security Center. - -### Requirements for managing tamper protection in the Microsoft Defender Security Center - -- You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access), such as global admin, security admin, or security operations. - -- Your Windows devices must be running one of the following versions of Windows: - - Windows 10 - - [Windows Server 2019](/windows-server/get-started-19/whats-new-19) - - Windows Server, version [1803](/windows/release-health/status-windows-10-1803) or later - - [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016) - - For more information about releases, see [Windows 10 release information](/windows/release-health/release-information). - -- Your devices must be [onboarded to Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/onboarding). - -- Your devices must be using anti-malware platform version 4.18.2010.7 (or above) and anti-malware engine version 1.1.17600.5 (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) - -- [Cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) must be turned on. - -### Turn tamper protection on (or off) in the Microsoft Defender Security Center - -![Turn tamper protection on in the Microsoft Defender Security Center](images/mde-turn-tamperprotect-on.png) - -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. - -2. Choose **Settings**. - -3. Go to **General** > **Advanced features**, and then turn tamper protection on. - -## Manage tamper protection for your organization using Intune - -If you are part of your organization's security team, and your subscription includes [Intune](/intune/fundamentals/what-is-intune), you can turn tamper protection on (or off) for your organization in the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) portal. Use Intune when you want to fine-tune tamper protection settings. For example, if you want to enable tamper protection on some devices, but not all, use Intune. - -### Requirements for managing tamper protection in Intune - -- You must have appropriate [permissions](/microsoft-365/security/defender-endpoint/assign-portal-access), such as global admin, security admin, or security operations. - -- Your organization uses [Intune to manage devices](/intune/fundamentals/what-is-device-management). ([Intune licenses](/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.) - -- Your Windows devices must be running Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](/windows/release-health/release-information).) - -- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above). - -- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).) - -### Turn tamper protection on (or off) in Intune - -![Turn tamper protection on with Intune](images/turnontamperprotect-MEM.png) - -1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account. - -2. Select **Devices** > **Configuration Profiles**. - -3. Create a profile that includes the following settings: - - **Platform: Windows 10 and later** - - **Profile type: Endpoint protection** - - **Category: Microsoft Defender Security Center** - - **Tamper Protection: Enabled** - -4. Assign the profile to one or more groups. - -### Are you using Windows OS 1709, 1803, or 1809? - -If you are using Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), or [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), you won't see **Tamper Protection** in the Windows Security app. Instead, you can use PowerShell to determine whether tamper protection is enabled. - -#### Use PowerShell to determine whether tamper protection is turned on - -1. Open the Windows PowerShell app. - -2. Use the [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus?preserve-view=true&view=win10-ps) PowerShell cmdlet. - -3. In the list of results, look for `IsTamperProtected`. (A value of *true* means tamper protection is enabled.) - -## Manage tamper protection for your organization with Configuration Manager, version 2006 - -If you're using [version 2006 of Configuration Manager](/mem/configmgr/core/plan-design/changes/whats-new-in-version-2006), you can manage tamper protection settings on Windows 10, Windows Server 2016, and Windows Server 2019 by using a method called *tenant attach*. Tenant attach enables you to sync your on-premises-only Configuration Manager devices into the Microsoft Endpoint Manager admin center, and then deliver endpoint security configuration policies to on-premises collections & devices. - -![Windows security experience in Endpoint Manager](images/win-security- exp-policy-endpt-security.png) - -> [!NOTE] -> The procedure can be used to extend tamper protection to devices running Windows 10 and Windows Server 2019. Make sure to review the prerequisites and other information in the resources mentioned in this procedure. - -1. Set up tenant attach. To get help with this, see [Microsoft Endpoint Manager tenant attach: Device sync and device actions](/mem/configmgr/tenant-attach/device-sync-actions). - -2. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Antivirus**, and then choose **+ Create Policy**.
- - In the **Platform** list, select **Windows 10 and Windows Server (ConfigMgr)**. - - In the **Profile** list, select **Windows Security experience (preview)**.
- -3. Deploy the policy to your device collection. - -### Need help with this method? - -See the following resources: - -- [Settings for the Windows Security experience profile in Microsoft Intune](/mem/intune/protect/antivirus-security-experience-windows-settings) -- [Tech Community Blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin) - -## Manage tamper protection on an individual device - -> [!NOTE] -> Tamper protection blocks attempts to modify Microsoft Defender Antivirus settings through the registry. -> -> To help ensure that tamper protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).) -> -> Once you’ve made this update, tamper protection continues to protect your registry settings, and logs attempts to modify them without returning errors. - -If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to manage tamper protection. You must have appropriate admin permissions on your device to do change security settings, such as tamper protection. - -Here's what you see in the Windows Security app: - -![Tamper protection turned on in Windows 10 Home](images/tamperprotectionturnedon.png) - -1. Select **Start**, and start typing *Security*. In the search results, select **Windows Security**. - -2. Select **Virus & threat protection** > **Virus & threat protection settings**. - -3. Set **Tamper Protection** to **On** or **Off**. - - - -## View information about tampering attempts - -Tampering attempts typically indicate bigger cyberattacks. Bad actors try to change security settings as a way to persist and stay undetected. If you're part of your organization's security team, you can view information about such attempts, and then take appropriate actions to mitigate threats. - -When a tampering attempt is detected, an alert is raised in the [Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/portal-overview) ([https://securitycenter.windows.com](https://securitycenter.windows.com)). - -![Microsoft Defender Security Center](images/tamperattemptalert.png) - -Using [endpoint detection and response](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) and [advanced hunting](/microsoft-365/security/defender-endpoint/advanced-hunting-overview) capabilities in Microsoft Defender for Endpoint, your security operations team can investigate and address such attempts. - -## Review your security recommendations - -Tamper protection integrates with [Threat & Vulnerability Management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt) capabilities. [Security recommendations](/microsoft-365/security/defender-endpoint/tvm-security-recommendation) include making sure tamper protection is turned on. For example, you can search on *tamper*, as shown in the following image: - -![Tamper protection results in security recommendations](../images/securityrecs-tamperprotect.jpg) - -In the results, you can select **Turn on Tamper Protection** to learn more and turn it on. - -![Turn on tamper protection](images/tamperprotectsecurityrecos.png) - -To learn more about Threat & Vulnerability Management, see [Threat & Vulnerability Management in Microsoft Defender Security Center](/microsoft-365/security/defender-endpoint/tvm-dashboard-insights#threat--vulnerability-management-in-microsoft-defender-security-center). - -## Frequently asked questions - -### To which Windows OS versions is configuring tamper protection is applicable? - -Windows 10 OS [1709](/windows/release-health/status-windows-10-1709), [1803](/windows/release-health/status-windows-10-1803), [1809](/windows/release-health/status-windows-10-1809-and-windows-server-2019), or later together with [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). - -If you are using Configuration Manager, version 2006, with tenant attach, tamper protection can be extended to Windows Server 2019. See [Tenant attach: Create and deploy endpoint security Antivirus policy from the admin center (preview)](/mem/configmgr/tenant-attach/deploy-antivirus-policy). - -### Will tamper protection have any impact on third-party antivirus registration? - -No. Third-party antivirus offerings will continue to register with the Windows Security application. - -### What happens if Microsoft Defender Antivirus is not active on a device? - -Devices that are onboarded to Microsoft Defender for Endpoint will have Microsoft Defender Antivirus running in passive mode. Tamper protection will continue to protect the service and its features. - -### How can I turn tamper protection on/off? - -If you are a home user, see [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device). - -If you are an organization using [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint), you should be able to manage tamper protection in Intune similar to how you manage other endpoint protection features. See the following sections of this article: - -- [Manage tamper protection using Intune](#manage-tamper-protection-for-your-organization-using-intune) -- [Manage tamper protection using Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) -- [Manage tamper protection using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) (currently in preview) - -### How does configuring tamper protection in Intune affect how I manage Microsoft Defender Antivirus through my group policy? - -Your regular group policy doesn’t apply to tamper protection, and changes to Microsoft Defender Antivirus settings are ignored when tamper protection is on. - -### For Microsoft Defender for Endpoint, is configuring tamper protection in Intune targeted to the entire organization only? - -Configuring tamper protection in Intune or Microsoft Endpoint Manager can be targeted to your entire organization and to specific devices and user groups. - -### Can I configure Tamper Protection in Microsoft Endpoint Configuration Manager? - -If you are using tenant attach, you can use Microsoft Endpoint Configuration Manager. See the following resources: -- [Manage tamper protection for your organization with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) -- [Tech Community blog: Announcing Tamper Protection for Configuration Manager Tenant Attach clients](https://techcommunity.microsoft.com/t5/microsoft-endpoint-manager-blog/announcing-tamper-protection-for-configuration-manager-tenant/ba-p/1700246#.X3QLR5Ziqq8.linkedin) - -### I have the Windows E3 enrollment. Can I use configuring tamper protection in Intune? - -Currently, configuring tamper protection in Intune is only available for customers who have [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint). - -### What happens if I try to change Microsoft Defender for Endpoint settings in Intune, Microsoft Endpoint Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device? - -You won’t be able to change the features that are protected by tamper protection; such change requests are ignored. - -### I’m an enterprise customer. Can local admins change tamper protection on their devices? - -No. Local admins cannot change or modify tamper protection settings. - -### What happens if my device is onboarded with Microsoft Defender for Endpoint and then goes into an off-boarded state? - -If a device is off-boarded from Microsoft Defender for Endpoint, tamper protection is turned on, which is the default state for unmanaged devices. - -### Will there be an alert about tamper protection status changing in the Microsoft Defender Security Center? - -Yes. The alert is shown in [https://securitycenter.microsoft.com](https://securitycenter.microsoft.com) under **Alerts**. - -Your security operations team can also use hunting queries, such as the following example: - -`DeviceAlertEvents | where Title == "Tamper Protection bypass"` - -[View information about tampering attempts](#view-information-about-tampering-attempts). - -## See also - -[Help secure Windows PCs with Endpoint Protection for Microsoft Intune](/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) - -[Get an overview of Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) - -[Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](why-use-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md deleted file mode 100644 index 782fc921df..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Hide the Microsoft Defender Antivirus interface -description: You can hide virus and threat protection tile in the Windows Security app. -keywords: ui lockdown, headless mode, hide app, hide settings, hide interface -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can use Group Policy to prevent users on endpoints from seeing the Microsoft Defender Antivirus interface. You can also prevent them from pausing scans. - -## Hide the Microsoft Defender Antivirus interface - -In Windows 10, versions 1703, hiding the interface will hide Microsoft Defender Antivirus notifications and prevent the Virus & threat protection tile from appearing in the Windows Security app. - -With the setting set to **Enabled**: - -![Screenshot of Windows Security without the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-1703.png) - -With the setting set to **Disabled** or not configured: - -![Screenshot of Windows Security showing the shield icon and virus and threat protection section](images/defender/wdav-headless-mode-off-1703.png) - ->[!NOTE] ->Hiding the interface will also prevent Microsoft Defender Antivirus notifications from appearing on the endpoint. Microsoft Defender for Endpoint notifications will still appear. You can also individually [configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) - -In earlier versions of Windows 10, the setting will hide the Windows Defender client interface. If the user attempts to open it, they will receive a warning that says, "Your system administrator has restricted access to this app." - -![Warning message when headless mode is enabled in Windows 10, versions earlier than 1703](images/defender/wdav-headless-mode-1607.png) - -## Use Group Policy to hide the Microsoft Defender AV interface from users - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Client interface**. - -5. Double-click the **Enable headless UI mode** setting and set the option to **Enabled**. Click **OK**. - -See [Prevent users from locally modifying policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) for more options on preventing users form modifying protection on their PCs. - -## Prevent users from pausing a scan - -You can prevent users from pausing scans, which can be helpful to ensure scheduled or on-demand scans are not interrupted by users. - -> [!NOTE] -> This setting is not supported on Windows 10. - -### Use Group Policy to prevent users from pausing a scan - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus** > **Scan**. - -5. Double-click the **Allow users to pause scan** setting and set the option to **Disabled**. Click **OK**. - -## Related articles - -- [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) - -- [Configure end-user interaction with Microsoft Defender Antivirus](configure-end-user-interaction-microsoft-defender-antivirus.md) - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md deleted file mode 100644 index 504ea78af2..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Monitor and report on Microsoft Defender Antivirus protection -description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Microsoft Defender AV with PowerShell and WMI. -keywords: siem, monitor, report, Microsoft Defender AV -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 12/07/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Report on Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft Defender Antivirus is built into Windows 10, Windows Server 2019, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. - -With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Endpoint Manager to [monitor Microsoft Defender Antivirus](/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](/intune/introduction-intune). - -Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Microsoft Defender Antivirus issues, including protection updates and real-time protection settings. - -If you have a third-party security information and event management (SIEM) server, you can also consume [Windows Defender client events](/windows/win32/events/windows-events). - -Windows events comprise several security event sources, including Security Account Manager (SAM) events ([enhanced for Windows 10](/windows/whats-new/whats-new-windows-10-version-1507-and-1511), also see the [Security auditing](/windows/device-security/auditing/security-auditing-overview) topic) and [Windows Defender events](troubleshoot-microsoft-defender-antivirus.md). - -These events can be centrally aggregated using the [Windows event collector](/windows/win32/wec/windows-event-collector). Often, SIEM servers have connectors for Windows events, allowing you to correlate all security events in your SIEM server. - -You can also [monitor malware events using the Malware Assessment solution in Log Analytics](/azure/log-analytics/log-analytics-malware). - -For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, see the [(Deployment, management, and reporting options table)](deploy-manage-report-microsoft-defender-antivirus.md#ref2). - -## Related articles - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](./microsoft-defender-antivirus-on-windows-server-2016.md) -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md deleted file mode 100644 index 4f66329874..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Restore quarantined files in Microsoft Defender AV -description: You can restore files and folders that were quarantined by Microsoft Defender AV. -keywords: -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 05/20/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Restore quarantined files in Microsoft Defender AV - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -If Microsoft Defender Antivirus is configured to detect and remediate threats on your device, Microsoft Defender Antivirus quarantines suspicious files. If you are certain a quarantined file is not a threat, you can restore it. - -1. Open **Windows Security**. -2. Select **Virus & threat protection** and then click **Protection history**. -3. In the list of all recent items, filter on **Quarantined Items**. -4. Select an item you want to keep, and take an action, such as restore. - -> [!TIP] -> Restoring a file from quarantine can also be done using Command Prompt. See [Restore a file from quarantine](/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#restore-file-from-quarantine). - -## Related articles - -- [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) -- [Review scan results](review-scan-results-microsoft-defender-antivirus.md) -- [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) -- [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -- [Configure Microsoft Defender Antivirus exclusions on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md deleted file mode 100644 index 878a95ac8f..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Review the results of Microsoft Defender AV scans -description: Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app -keywords: scan results, remediation, full scan, quick scan -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/28/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Review Microsoft Defender Antivirus scan results - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -After a Microsoft Defender Antivirus scan completes, whether it is an [on-demand](run-scan-microsoft-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-microsoft-defender-antivirus.md), the results are recorded and you can view the results. - - -## Use Configuration Manager to review scan results - -See [How to monitor Endpoint Protection status](/configmgr/protect/deploy-use/monitor-endpoint-protection). - -## Use PowerShell cmdlets to review scan results - -The following cmdlet will return each detection on the endpoint. If there are multiple detections of the same threat, each detection will be listed separately, based on the time of each detection: - -```PowerShell -Get-MpThreatDetection -``` - -![screenshot of PowerShell cmdlets and outputs](images/defender/wdav-get-mpthreatdetection.png) - -You can specify `-ThreatID` to limit the output to only show the detections for a specific threat. - -If you want to list threat detections, but combine detections of the same threat into a single item, you can use the following cmdlet: - -```PowerShell -Get-MpThreat -``` - -![screenshot of PowerShell](images/defender/wdav-get-mpthreat.png) - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -## Use Windows Management Instruction (WMI) to review scan results - -Use the [**Get** method of the **MSFT_MpThreat** and **MSFT_MpThreatDetection**](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) classes. - - -## Related articles - -- [Customize, initiate, and review the results of Microsoft Defender Antivirus scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md deleted file mode 100644 index 5b044eab79..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md +++ /dev/null @@ -1,98 +0,0 @@ ---- -title: Run and customize on-demand scans in Microsoft Defender AV -description: Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app -keywords: scan, on-demand, dos, intune, instant scan -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 11/13/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Configure and run on-demand Microsoft Defender Antivirus scans - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type. - -## Quick scan versus full scan - -Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. - -> [!IMPORTANT] -> Microsoft Defender Antivirus runs in the context of the [LocalSystem](/windows/win32/services/localsystem-account) account when performing a local scan. For network scans, it uses the context of the device account. If the domain device account doesn't have appropriate permissions to access the share, the scan won't work. Ensure that the device has permissions to the access network share. - -Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md)--which reviews files when they're opened and closed, and whenever a user navigates to a folder--a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. - -In most instances, a quick scan is adequate to find malware that wasn't picked up by real-time protection. - -A full scan can be useful on endpoints that have reported a malware threat. The scan can identify if there are any inactive components that require a more thorough clean-up. This is ideal if your organization is running on-demand scans. - -> [!NOTE] -> By default, quick scans run on mounted removable devices, such as USB drives. - -## Use Microsoft Endpoint Manager to run a scan - -1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. -2. Choose **Endpoint security** > **Antivirus**. -3. In the list of tabs, select **Windows 10 unhealthy endpoints**. -4. From the list of actions provided, select **Quick Scan** or **Full Scan**. - -[ ![IMAGE](images/mem-antivirus-scan-on-demand.png) ](images/mem-antivirus-scan-on-demand.png#lightbox) - -> [!TIP] -> For more information about using Microsoft Endpoint Manager to run a scan, see [Antimalware and firewall tasks: How to perform an on-demand scan](/configmgr/protect/deploy-use/endpoint-antimalware-firewall#how-to-perform-an-on-demand-scan-of-computers). - -## Use the mpcmdrun.exe command-line utility to run a scan - -Use the following `-scan` parameter: - -```console -mpcmdrun.exe -scan -scantype 1 -``` - -For more information about how to use the tool and additional parameters, including starting a full scan, or defining paths, see [Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender Antivirus](command-line-arguments-microsoft-defender-antivirus.md). - -## Use Microsoft Intune to run a scan - -1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. -2. From the sidebar, select **Devices > All Devices** and choose the device you want to scan. -3. Select **...More**. From the options, select **Quick Scan** or **Full Scan**. - -## Use the Windows Security app to run a scan - -See [Run a scan in the Windows Security app](microsoft-defender-security-center-antivirus.md) for instructions on running a scan on individual endpoints. - -## Use PowerShell cmdlets to run a scan - -Use the following cmdlet: - -```PowerShell -Start-MpScan -``` - -For more information on how to use PowerShell with Microsoft Defender Antivirus, see [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/). - -## Use Windows Management Instruction (WMI) to run a scan - -Use the [**Start** method](/previous-versions/windows/desktop/defender/start-msft-mpscan) of the **MSFT_MpScan** class. - -For more information about which parameters are allowed, see [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - -## Related articles - -- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) -- [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md deleted file mode 100644 index 1bbb45240a..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md +++ /dev/null @@ -1,243 +0,0 @@ ---- -title: Schedule regular quick and full scans with Microsoft Defender Antivirus -description: Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans -keywords: quick scan, full scan, quick vs full, schedule scan, daily, weekly, time, scheduled, recurring, regular -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 11/02/2020 -ms.reviewer: pauhijbr -manager: dansimp -ms.technology: mde ---- - -# Configure scheduled quick or full Microsoft Defender Antivirus scans - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - - -> [!NOTE] -> By default, Microsoft Defender Antivirus checks for an update 15 minutes before the time of any scheduled scans. You can [Manage the schedule for when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) to override this default. - -In addition to always-on real-time protection and [on-demand](run-scan-microsoft-defender-antivirus.md) scans, you can set up regular, scheduled scans. - -You can configure the type of scan, when the scan should occur, and if the scan should occur after a [protection update](manage-protection-updates-microsoft-defender-antivirus.md) or if the endpoint is being used. You can also specify when special scans to complete remediation should occur. - -This article describes how to configure scheduled scans with Group Policy, PowerShell cmdlets, and WMI. You can also configure schedules scans with [Microsoft Endpoint Configuration Manager](/configmgr/protect/deploy-use/endpoint-antimalware-policies#scheduled-scans-settings) or [Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10). - -## To configure the Group Policy settings described in this article - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer configuration**. - -4. Click **Administrative templates**. - -5. Expand the tree to **Windows components > Microsoft Defender Antivirus** and then the **Location** specified in the table below. - -6. Double-click the policy **Setting** as specified in the table below, and set the option to your desired configuration. - -7. Click **OK**, and repeat for any other settings. - -Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) topics. - -## Quick scan versus full scan and custom scan - -When you set up scheduled scans, you can set up whether the scan should be a full or quick scan. - -Quick scans look at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. - -Combined with [always-on real-time protection capability](configure-real-time-protection-microsoft-defender-antivirus.md) - which reviews files when they are opened and closed, and whenever a user navigates to a folder - a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. - -In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection. - -A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up. In this instance, you may want to use a full scan when running an [on-demand scan](run-scan-microsoft-defender-antivirus.md). - -A custom scan allows you to specify the files and folders to scan, such as a USB drive. - ->[!NOTE] ->By default, quick scans run on mounted removable devices, such as USB drives. - -## Set up scheduled scans - -Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. - ->[!NOTE] ->If a computer is unplugged and running on battery during a scheduled full scan, the scheduled scan will stop with event 1002, which states that the scan stopped before completion. Microsoft Defender Antivirus will run a full scan at the next scheduled time. - -### Use Group Policy to schedule scans - -|Location | Setting | Description | Default setting (if not configured) | -|:---|:---|:---|:---| -|Scan | Specify the scan type to use for a scheduled scan | Quick scan | -|Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never | -|Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.). | 2 a.m. | -|Root | Randomize scheduled task times |In Microsoft Defender Antivirus: Randomize the start time of the scan to any interval from 0 to 4 hours.
In FEP/SCEP: randomize to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments. | Enabled | - - -### Use PowerShell cmdlets to schedule scans - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -ScanParameters -Set-MpPreference -ScanScheduleDay -Set-MpPreference -ScanScheduleTime -Set-MpPreference -RandomizeScheduleTaskTimes - -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to schedule scans - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -ScanParameters -ScanScheduleDay -ScanScheduleTime -RandomizeScheduleTaskTimes -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - - - -## Start scheduled scans only when the endpoint is not in use - -You can set the scheduled scan to only occur when the endpoint is turned on but not in use with Group Policy, PowerShell, or WMI. - -> [!NOTE] -> These scans will not honor the CPU throttling configuration and take full advantage of the resources available to complete the scan as fast as possible. - -### Use Group Policy to schedule scans - -|Location | Setting | Description | Default setting (if not configured) | -|:---|:---|:---|:---| -|Scan | Start the scheduled scan only when computer is on but not in use | Scheduled scans will not run, unless the computer is on but not in use | Enabled | - -### Use PowerShell cmdlets - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -ScanOnlyIfIdleEnabled -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -ScanOnlyIfIdleEnabled -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -## Configure when full scans should be run to complete remediation - -Some threats may require a full scan to complete their removal and remediation. You can schedule when these scans should occur with Group Policy, PowerShell, or WMI. - -### Use Group Policy to schedule remediation-required scans - -| Location | Setting | Description | Default setting (if not configured) | -|---|---|---|---| -|Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | Specify the day (or never) to run a scan. | Never | -|Remediation | Specify the time of day to run a scheduled full scan to complete remediation | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.) | 2 a.m. | - -### Use PowerShell cmdlets - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -RemediationScheduleDay -Set-MpPreference -RemediationScheduleTime -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -RemediationScheduleDay -RemediationScheduleTime -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - - - -## Set up daily quick scans - -You can enable a daily quick scan that can be run in addition to your other scheduled scans with Group Policy, PowerShell, or WMI. - - -### Use Group Policy to schedule daily scans - - -|Location | Setting | Description | Default setting (if not configured) | -|:---|:---|:---|:---| -|Scan | Specify the interval to run quick scans per day | Specify how many hours should elapse before the next quick scan. For example, to run every two hours, enter **2**, for once a day, enter **24**. Enter **0** to never run a daily quick scan. | Never | -|Scan | Specify the time for a daily quick scan | Specify the number of minutes after midnight (for example, enter **60** for 1 a.m.) | 2 a.m. | - -### Use PowerShell cmdlets to schedule daily scans - -Use the following cmdlets: - -```PowerShell -Set-MpPreference -ScanScheduleQuickScanTime -``` - -See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](/powershell/module/defender/) for more information on how to use PowerShell with Microsoft Defender Antivirus. - -### Use Windows Management Instruction (WMI) to schedule daily scans - -Use the [**Set** method of the **MSFT_MpPreference**](/previous-versions/windows/desktop/legacy/dn455323(v=vs.85)) class for the following properties: - -```WMI -ScanScheduleQuickScanTime -``` - -See the following for more information and allowed parameters: -- [Windows Defender WMIv2 APIs](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) - - -## Enable scans after protection updates - -You can force a scan to occur after every [protection update](manage-protection-updates-microsoft-defender-antivirus.md) with Group Policy. - -### Use Group Policy to schedule scans after protection updates - -|Location | Setting | Description | Default setting (if not configured)| -|:---|:---|:---|:---| -|Signature updates | Turn on scan after Security intelligence update | A scan will occur immediately after a new protection update is downloaded | Enabled | - -## See also -- [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) -- [Configure and run on-demand Microsoft Defender Antivirus scans](run-scan-microsoft-defender-antivirus.md) -- [Configure Microsoft Defender Antivirus scanning options](configure-advanced-scan-types-microsoft-defender-antivirus.md) -- [Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md) -- [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md deleted file mode 100644 index d528f6c837..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus.md +++ /dev/null @@ -1,91 +0,0 @@ ---- -title: Specify the cloud-delivered protection level for Microsoft Defender Antivirus -description: Set your level of cloud-delivered protection for Microsoft Defender Antivirus. -keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, aggressiveness, protection level -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.date: 10/26/2020 -ms.reviewer: -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Specify the cloud-delivered protection level - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can specify your level of cloud-delivered protection offered by Microsoft Defender Antivirus by using Microsoft Endpoint Manager (recommended) or Group Policy. - -> [!TIP] -> Cloud protection is not simply protection for files that are stored in the cloud. The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and devices (also called endpoints). Cloud protection with Microsoft Defender Antivirus uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional security intelligence updates. -> Microsoft Intune and Microsoft Endpoint Manager are now part of [Microsoft Endpoint Manager](/mem/endpoint-manager-overview). - - -## Use Microsoft Endpoint Manager to specify the level of cloud-delivered protection - -1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. - -2. Choose **Endpoint security** > **Antivirus**. - -3. Select an antivirus profile. (If you don't have one yet, or if you want to create a new profile, see [Configure device restriction settings in Microsoft Intune](/intune/device-restrictions-configure). - -4. Select **Properties**. Then, next to **Configuration settings**, choose **Edit**. - -5. Expand **Cloud protection**, and then in the **Cloud-delivered protection level** list, select one of the following: - - 1. **High**: Applies a strong level of detection. - 2. **High plus**: Uses the **High** level and applies additional protection measures (may impact client performance). - 3. **Zero tolerance**: Blocks all unknown executables. - -6. Choose **Review + save**, and then choose **Save**. - -> [!TIP] -> Need some help? See the following resources: -> - [Configure Endpoint Protection](/mem/configmgr/protect/deploy-use/endpoint-protection-configure) -> - [Add endpoint protection settings in Intune](/mem/intune/protect/endpoint-protection-configure) - - -## Use Group Policy to specify the level of cloud-delivered protection - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). - -2. Right-click the Group Policy Object you want to configure, and then click **Edit**. - -3. In the **Group Policy Management Editor** go to **Computer Configuration** > **Administrative templates**. - -4. Expand the tree to **Windows Components** > **Microsoft Defender Antivirus** > **MpEngine**. - -5. Double-click the **Select cloud protection level** setting and set it to **Enabled**. Select the level of protection: - - **Default blocking level** provides strong detection without increasing the risk of detecting legitimate files. - - **Moderate blocking level** provides moderate only for high confidence detections - - **High blocking level** applies a strong level of detection while optimizing client performance (but can also give you a greater chance of false positives). - - **High + blocking level** applies additional protection measures (might impact client performance and increase your chance of false positives). - - **Zero tolerance blocking level** blocks all unknown executables. - - > [!WARNING] - > While unlikely, setting this switch to **High** or **High +** may cause some legitimate files to be detected (although you will have the option to unblock or dispute that detection). - -6. Click **OK**. - -7. Deploy your updated Group Policy Object. See [Group Policy Management Console](/windows/win32/srvnodes/group-policy) - -> [!TIP] -> Are you using Group Policy Objects on premises? See how they translate in the cloud. [Analyze your on-premises group policy objects using Group Policy analytics in Microsoft Endpoint Manager - Preview](/mem/intune/configuration/group-policy-analytics). - -## Related articles - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) -- [How to create and deploy antimalware policies: Cloud-protection service](/configmgr/protect/deploy-use/endpoint-antimalware-policies#cloud-protection-service) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md deleted file mode 100644 index 59b3c2fa74..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus-when-migrating.md +++ /dev/null @@ -1,136 +0,0 @@ ---- -title: Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution -description: Troubleshoot common errors when migrating to Microsoft Defender Antivirus -keywords: event, error code, logging, troubleshooting, microsoft defender antivirus, windows defender antivirus, migration -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: martyav -ms.author: v-maave -ms.custom: nextgen -ms.date: 09/11/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - - -You can find help here if you encounter issues while migrating from a third-party security solution to Microsoft Defender Antivirus. - -## Review event logs - -Open the Event viewer app by selecting the **Search** icon in the taskbar, and searching for *event viewer*. - -Information about Microsoft Defender Antivirus can be found under **Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Defender**. - -From there, select **Open** underneath **Operational**. - -Selecting an event from the details pane will show you more information about an event in the lower pane, under the **General** and **Details** tabs. - -## Microsoft Defender Antivirus won't start - -This issue can manifest in the form of several different event IDs, all of which have the same underlying cause. - -### Associated event IDs - - Event ID | Log name | Description | Source --|-|-|- -15 | Application | Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_OFF. | Security Center -5007 | Microsoft-Windows-Windows Defender/Operational | Windows Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.

**Old value:** Default\IsServiceRunning = 0x0
**New value:** HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1 | Windows Defender -5010 | Microsoft-Windows-Windows Defender/Operational | Windows Defender Antivirus scanning for spyware and other potentially unwanted software is disabled. | Windows Defender - -### How to tell if Microsoft Defender Antivirus won't start because a third-party antivirus is installed - -On a Windows 10 device, if you are not using Microsoft Defender for Endpoint, and you have a third-party antivirus installed, then Microsoft Defender Antivirus will be automatically turned off. If you are using Microsoft Defender for Endpoint with a third-party antivirus installed, Microsoft Defender Antivirus will start in passive mode, with reduced functionality. - -> [!TIP] -> The scenario just described applies only to Windows 10. Other versions of Windows have [different responses](microsoft-defender-antivirus-compatibility.md) to Microsoft Defender Antivirus being run alongside third-party security software. - -#### Use Services app to check if Microsoft Defender Antivirus is turned off - -To open the Services app, select the **Search** icon from the taskbar and search for *services*. You can also open the app from the command-line by typing *services.msc*. - -Information about Microsoft Defender Antivirus will be listed within the Services app under **Windows Defender** > **Operational**. The antivirus service name is *Windows Defender Antivirus Service*. - -While checking the app, you may see that *Windows Defender Antivirus Service* is set to manual — but when you try to start this service manually, you get a warning stating, *The Windows Defender Antivirus Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.* - -This indicates that Microsoft Defender Antivirus has been automatically turned off to preserve compatibility with a third-party antivirus. - -#### Generate a detailed report - -You can generate a detailed report about currently active group policies by opening a command prompt in **Run as admin** mode, then entering the following command: - -```powershell -GPresult.exe /h gpresult.html -``` - -This will generate a report located at *./gpresult.html*. Open this file and you might see the following results, depending on how Microsoft Defender Antivirus was turned off. - -##### Group policy results - -##### If security settings are implemented via group policy (GPO) at the domain or local level, or though System center configuration manager (SCCM) - -Within the GPResults report, under the heading, *Windows Components/Windows Defender Antivirus*, you may see something like the following entry, indicating that Microsoft Defender Antivirus is turned off. - -Policy | Setting | Winning GPO --|-|- -Turn off Windows Defender Antivirus | Enabled | Win10-Workstations - -###### If security settings are implemented via Group policy preference (GPP) - -Under the heading, *Registry item (Key path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender, Value name: DisableAntiSpyware)*, you may see something like the following entry, indicating that Microsoft Defender Antivirus is turned off. - -DisableAntiSpyware | - --|- -Winning GPO | Win10-Workstations -Result: Success | -**General** | -Action | Update -**Properties** | -Hive | HKEY_LOCAL_MACHINE -Key path | SOFTWARE\Policies\Microsoft\Windows Defender -Value name | DisableAntiSpyware -Value type | REG_DWORD -Value data | 0x1 (1) - -###### If security settings are implemented via registry key - -The report may contain the following text, indicating that Microsoft Defender Antivirus is turned off: - -> Registry (regedit.exe) -> -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender -> DisableAntiSpyware (dword) 1 (hex) - -###### If security settings are set in Windows or your Windows Server image - -Your imagining admin might have set the security policy, **[DisableAntiSpyware](/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware)**, locally via *GPEdit.exe*, *LGPO.exe*, or by modifying the registry in their task sequence. You can [configure a Trusted Image Identifier](/windows-hardware/manufacture/desktop/configure-a-trusted-image-identifier-for-windows-defender) for Microsoft Defender Antivirus. - -### Turn Microsoft Defender Antivirus back on - -Microsoft Defender Antivirus will automatically turn on if no other antivirus is currently active. You'll need to turn the third-party antivirus completely off to ensure Microsoft Defender Antivirus can run with full functionality. - -> [!WARNING] -> Solutions suggesting that you edit the *Windows Defender* start values for *wdboot*, *wdfilter*, *wdnisdrv*, *wdnissvc*, and *windefend* in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services are unsupported, and may force you to re-image your system. - -Passive mode is available if you start using Microsoft Defender for Endpoint and a third-party antivirus together with Microsoft Defender Antivirus. Passive mode allows Microsoft Defender to scan files and update itself, but it will not remediate threats. In addition, behavior monitoring via [Real Time Protection](configure-real-time-protection-microsoft-defender-antivirus.md) is not available under passive mode, unless [Endpoint data loss prevention (DLP)](/microsoft-365/security/defender-endpoint/information-protection-in-windows-overview) is deployed. - -Another feature, known as [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), is available to end-users when Microsoft Defender Antivirus is set to automatically turn off. This feature allows Microsoft Defender Antivirus to scan files periodically alongside a third-party antivirus, using a limited number of detections. - -> [!IMPORTANT] -> Limited periodic scanning is not recommended in enterprise environments. The detection, management and reporting capabilities available when running Microsoft Defender Antivirus in this mode are reduced as compared to active mode. - -### See also - -* [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md) -* [Microsoft Defender Antivirus in the Windows Security app](microsoft-defender-security-center-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md deleted file mode 100644 index 01ad795e3f..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md +++ /dev/null @@ -1,3246 +0,0 @@ ---- -title: Microsoft Defender AV event IDs and error codes -description: Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors -keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/11/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -If you encounter a problem with Microsoft Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution. - -The tables list: - -- [Microsoft Defender Antivirus event IDs](#windows-defender-av-ids) (these apply to both Windows 10 and Windows Server 2016) -- [Microsoft Defender Antivirus client error codes](#error-codes) -- [Internal Microsoft Defender Antivirus client error codes (used by Microsoft during development and testing)](#internal-error-codes) - -> [!TIP] -> You can also visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the following features are working: -> -> - Cloud-delivered protection -> - Fast learning (including Block at first sight) -> - Potentially unwanted application blocking - - -## Microsoft Defender Antivirus event IDs - -Microsoft Defender Antivirus records event IDs in the Windows event log. - -You can directly view the event log, or if you have a third-party security information and event management (SIEM) tool, you can also consume [Microsoft Defender Antivirus client event IDs](troubleshoot-microsoft-defender-antivirus.md#windows-defender-av-ids) to review specific events and errors from your endpoints. - -The table in this section lists the main Microsoft Defender Antivirus event IDs and, where possible, provides suggested solutions to fix or resolve the error. - -## To view a Microsoft Defender Antivirus event - -1. Open **Event Viewer**. -2. In the console tree, expand **Applications and Services Logs**, then **Microsoft**, then **Windows**, then **Windows Defender**. -3. Double-click on **Operational**. -4. In the details pane, view the list of individual events to find your event. -5. Click the event to see specific details about an event in the lower pane, under the **General** and **Details** tabs. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Event ID: 1000
-Symbolic name: - -MALWAREPROTECTION_SCAN_STARTED -
-Message: - -An antimalware scan started. - -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
Scan Resources: <Resources (such as files/directories/BHO) that were scanned.>
-
User: <Domain>\<User>
-
-
Event ID: 1001
-Symbolic name: - -MALWAREPROTECTION_SCAN_COMPLETED -
-Message: - -An antimalware scan finished. -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
User: <Domain>\<User>
-
Scan Time: <The duration of a scan.>
-
-
Event ID: 1002
-Symbolic name: - -MALWAREPROTECTION_SCAN_CANCELLED - -
-Message: - -An antimalware scan was stopped before it finished. - -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
User: <Domain>&lt;User>
-
Scan Time: <The duration of a scan.>
-
-
Event ID: 1003
-Symbolic name: - -MALWAREPROTECTION_SCAN_PAUSED - -
-Message: - -An antimalware scan was paused. - -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
User: <Domain>\<User>
-
-
Event ID: 1004
-Symbolic name: - -MALWAREPROTECTION_SCAN_RESUMED - -
-Message: - -An antimalware scan was resumed. - -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
User: <Domain>\<User>
-
-
Event ID: 1005
-Symbolic name: - -MALWAREPROTECTION_SCAN_FAILED - -
-Message: - -An antimalware scan failed. - -
-Description: - -
-
Scan ID: <ID number of the relevant scan.>
-
Scan Type: <Scan type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
-
-
Scan Parameters: <Scan parameters>, for example:
    -
  • Full scan
  • -
  • Quick scan
  • -
  • Customer scan
  • -
-
-
User: <Domain>\<User>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
-User action: - -The antivirus client encountered an error, and the current scan has stopped. The scan might fail due to a client-side issue. This event record includes the scan ID, type of scan (Microsoft Defender Antivirus, antispyware, antimalware), scan parameters, the user that started the scan, the error code, and a description of the error. -To troubleshoot this event: -
    -
  1. Run the scan again.
  2. -
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. -
  5. Contact Microsoft Technical Support. -
  6. -
-
Event ID: 1006
-Symbolic name: - -MALWAREPROTECTION_MALWARE_DETECTED - -
-Message: - -The antimalware engine found malware or other potentially unwanted software. - -
-Description: - -For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example:
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
Status: <Status>
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1007
-Symbolic name: - -MALWAREPROTECTION_MALWARE_ACTION_TAKEN - -
-Message: - -The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. - -
-Description: - -Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software. For more information, see the following: -
-
User: <Domain>\<User>
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Action: <Action>, for example:
    -
  • Clean: The resource was cleaned
  • -
  • Quarantine: The resource was quarantined
  • -
  • Remove: The resource was deleted
  • -
  • Allow: The resource was allowed to execute/exist
  • -
  • User defined: User-defined action that is normally one from this list of actions that the user has specified
  • -
  • No action: No action
  • -
  • Block: The resource was blocked from executing
  • -
-
-
Status: <Status>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1008
-Symbolic name: - -MALWAREPROTECTION_MALWARE_ACTION_FAILED -
-Message: - -The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. -
-Description: - -Microsoft Defender Antivirus has encountered an error when taking action on malware or other potentially unwanted software. For more information, see the following: -
-
User: <Domain>\<User>
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Action: <Action>, for example:
    -
  • Clean: The resource was cleaned
  • -
  • Quarantine: The resource was quarantined
  • -
  • Remove: The resource was deleted
  • -
  • Allow: The resource was allowed to execute/exist
  • -
  • User defined: User-defined action that is normally one from this list of actions that the user has specified
  • -
  • No action: No action
  • -
  • Block: The resource was blocked from executing
  • -
-
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Status: <Status>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1009
-Symbolic name: - -MALWAREPROTECTION_QUARANTINE_RESTORE - -
-Message: - -The antimalware platform restored an item from quarantine. - -
-Description: - -Microsoft Defender Antivirus has restored an item from quarantine. For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
User: <Domain>\<User>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1010
-Symbolic name: - -MALWAREPROTECTION_QUARANTINE_RESTORE_FAILED - -
-Message: - -The antimalware platform could not restore an item from quarantine. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to restore an item from quarantine. For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
User: <Domain>\<User>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1011
-Symbolic name: - -MALWAREPROTECTION_QUARANTINE_DELETE -
-Message: - -The antimalware platform deleted an item from quarantine. - -
-Description: - -Microsoft Defender Antivirus has deleted an item from quarantine.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
User: <Domain>\<User>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1012
-Symbolic name: - -MALWAREPROTECTION_QUARANTINE_DELETE_FAILED - -
-Message: - -The antimalware platform could not delete an item from quarantine. -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to delete an item from quarantine. -For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
User: <Domain>\<User>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
Event ID: 1013
-Symbolic name: - -MALWAREPROTECTION_MALWARE_HISTORY_DELETE - -
-Message: - -The antimalware platform deleted history of malware and other potentially unwanted software. -
-Description: - -Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software. -
-
Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
-
User: <Domain>\<User>
-
-
Event ID: 1014
-Symbolic name: - -MALWAREPROTECTION_MALWARE_HISTORY_DELETE_FAILED - -
-Message: - -The antimalware platform could not delete history of malware and other potentially unwanted software. -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to remove history of malware and other potentially unwanted software. -
-
Time: The time when the event occurred, for example when the history is purged. This parameter is not used in threat events so that there is no confusion regarding whether it is remediation time or infection time. For those, we specifically call them as Action Time or Detection Time.
-
User: <Domain>\<User>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
Event ID: 1015
-Symbolic name: - -MALWAREPROTECTION_BEHAVIOR_DETECTED - -
-Message: - -The antimalware platform detected suspicious behavior. -
-Description: - -Microsoft Defender Antivirus has detected a suspicious behavior.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example: -
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
Status: <Status>
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Signature ID: Enumeration matching severity.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
Fidelity Label:
-
Target File Name: <File name> -Name of the file.
-
-
Event ID: 1116
-Symbolic name: - -MALWAREPROTECTION_STATE_MALWARE_DETECTED -
-Message: - -The antimalware platform detected malware or other potentially unwanted software. - -
-Description: - -Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example: -
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
-User action: - -No action is required. Microsoft Defender Antivirus can suspend and take routine action on this threat. If you want to remove the threat manually, in the Microsoft Defender Antivirus interface, click Clean Computer. -
Event ID: 1117
-Symbolic name: - -MALWAREPROTECTION_STATE_MALWARE_ACTION_TAKEN - -
-Message: - -The antimalware platform performed an action to protect your system from malware or other potentially unwanted software. - -
-Description: - -Microsoft Defender Antivirus has taken action to protect this machine from malware or other potentially unwanted software.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example: -
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Action: <Action>, for example:
    -
  • Clean: The resource was cleaned
  • -
  • Quarantine: The resource was quarantined
  • -
  • Remove: The resource was deleted
  • -
  • Allow: The resource was allowed to execute/exist
  • -
  • User defined: User-defined action that is normally one from this list of actions that the user has specified
  • -
  • No action: No action
  • -
  • Block: The resource was blocked from executing
  • -
-
-
Action Status: <Description of additional actions>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-NOTE: -Whenever Microsoft Defender Antivirus, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services that the malware might have changed:
    -
  • Default Internet Explorer or Microsoft Edge setting
  • -
  • User Access Control settings
  • -
  • Chrome settings
  • -
  • Boot Control Data
  • -
  • Regedit and Task Manager registry settings
  • -
  • Windows Update, Background Intelligent Transfer Service, and Remote Procedure Call service
  • -
  • Windows Operating System files
-The above context applies to the following client and server versions: - - - - - - - - - - - - - -
Operating systemOperating system version
-Client Operating System - -Windows Vista (Service Pack 1, or Service Pack 2), Windows 7 and later -
-Server Operating System - -Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2016 -
-
-
-User action: - -No action is necessary. Microsoft Defender Antivirus removed or quarantined a threat. -
Event ID: 1118
-Symbolic name: - -MALWAREPROTECTION_STATE_MALWARE_ACTION_FAILED -
-Message: - -The antimalware platform attempted to perform an action to protect your system from malware or other potentially unwanted software, but the action failed. - -
-Description: - -Microsoft Defender Antivirus has encountered a non-critical error when taking action on malware or other potentially unwanted software.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example: -
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Action: <Action>, for example:
    -
  • Clean: The resource was cleaned
  • -
  • Quarantine: The resource was quarantined
  • -
  • Remove: The resource was deleted
  • -
  • Allow: The resource was allowed to execute/exist
  • -
  • User defined: User-defined action that is normally one from this list of actions that the user has specified
  • -
  • No action: No action
  • -
  • Block: The resource was blocked from executing
  • -
-
-
Action Status: <Description of additional actions>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
-User action: - -No action is necessary. Microsoft Defender Antivirus failed to complete a task related to the malware remediation. This is not a critical failure. -
Event ID: 1119
-Symbolic name: - -MALWAREPROTECTION_STATE_MALWARE_ACTION_CRITICALLY_FAILED - -
-Message: - -The antimalware platform encountered a critical error when trying to take action on malware or other potentially unwanted software. There are more details in the event message. -
-Description: - -Microsoft Defender Antivirus has encountered a critical error when taking action on malware or other potentially unwanted software.
For more information, see the following: -
-
Name: <Threat name>
-
ID: <Threat ID>
-
Severity: <Severity>, for example:
    -
  • Low
  • -
  • Moderate
  • -
  • High
  • -
  • Severe
  • -
-
-
Category: <Category description>, for example, any threat or malware type.
-
Path: <File path>
-
Detection Origin: <Detection origin>, for example: -
    -
  • Unknown
  • -
  • Local computer
  • -
  • Network share
  • -
  • Internet
  • -
  • Incoming traffic
  • -
  • Outgoing traffic
  • -
-
-
Detection Type: <Detection type>, for example:
    -
  • Heuristics
  • -
  • Generic
  • -
  • Concrete
  • -
  • Dynamic signature
  • -
-
-
Detection Source: <Detection source> for example:
    -
  • User: user initiated
  • -
  • System: system initiated
  • -
  • Real-time: real-time component initiated
  • -
  • IOAV: IE Downloads and Outlook Express Attachments initiated
  • -
  • NIS: Network inspection system
  • -
  • IEPROTECT: IE - IExtensionValidation; this protects against malicious webpage controls
  • -
  • Early Launch Antimalware (ELAM). This includes malware detected by the boot sequence
  • -
  • Remote attestation
  • -
Antimalware Scan Interface (AMSI). Primarily used to protect scripts (PS, VBS), though it can be invoked by third parties as well. -UAC
-
User: <Domain>\<User>
-
Process Name: <Process in the PID>
-
Action: <Action>, for example:
    -
  • Clean: The resource was cleaned
  • -
  • Quarantine: The resource was quarantined
  • -
  • Remove: The resource was deleted
  • -
  • Allow: The resource was allowed to execute/exist
  • -
  • User defined: User-defined action that is normally one from this list of actions that the user has specified
  • -
  • No action: No action
  • -
  • Block: The resource was blocked from executing
  • -
-
-
Action Status: <Description of additional actions>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
-User action: - -The Microsoft Defender Antivirus client encountered this error due to critical issues. The endpoint might not be protected. Review the error description then follow the relevant User action steps below. - - - - - - - - - - - - - - - - - - - - - -
ActionUser action
-Remove - -Update the definitions then verify that the removal was successful. -
-Clean - -Update the definitions then verify that the remediation was successful. -
-Quarantine - -Update the definitions and verify that the user has permission to access the necessary resources. -
-Allow - -Verify that the user has permission to access the necessary resources. -
- -If this event persists:
    -
  1. Run the scan again.
  2. -
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. -
  5. Contact Microsoft Technical Support. -
  6. -
-
Event ID: 1120
-Symbolic name: - -MALWAREPROTECTION_THREAT_HASH -
-Message: - -Microsoft Defender Antivirus has deduced the hashes for a threat resource. -
-Description: - -Microsoft Defender Antivirus client is up and running in a healthy state. -
-
Current Platform Version: <Current platform version>
-
Threat Resource Path: <Path>
-
Hashes: <Hashes>
-
-
-
Note: This event will only be logged if the following policy is set: ThreatFileHashLogging unsigned.
-
-
Event ID: 1150
-Symbolic name: - -MALWAREPROTECTION_SERVICE_HEALTHY -
-Message: - -If your antimalware platform reports status to a monitoring platform, this event indicates that the antimalware platform is running and in a healthy state. - -
-Description: - -Microsoft Defender Antivirus client is up and running in a healthy state. -
-
Platform Version: <Current platform version>
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware Engine version>
-
-
-User action: - -No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported on an hourly basis. -
Event ID: 1151
-Symbolic name: - -MALWAREPROTECTION_SERVICE_HEALTH_REPORT -
-Message: - -Endpoint Protection client health report (time in UTC) - -
-Description: - -Antivirus client health report. -
-
Platform Version: <Current platform version>
-
Engine Version: <Antimalware Engine version>
-
Network Realtime Inspection engine version: <Network Realtime Inspection engine version>
-
Antivirus signature version: <Antivirus signature version>
-
Antispyware signature version: <Antispyware signature version>
-
Network Realtime Inspection signature version: <Network Realtime Inspection signature version>
-
RTP state: <Realtime protection state> (Enabled or Disabled)
-
OA state: <On Access state> (Enabled or Disabled)
-
IOAV state: <IE Downloads and Outlook Express Attachments state> (Enabled or Disabled)
-
BM state: <Behavior Monitoring state> (Enabled or Disabled)
-
Antivirus signature age: <Antivirus signature age> (in days)
-
Antispyware signature age: <Antispyware signature age> (in days)
-
Last quick scan age: <Last quick scan age> (in days)
-
Last full scan age: <Last full scan age> (in days)
-
Antivirus signature creation time: ?<Antivirus signature creation time>
-
Antispyware signature creation time: ?<Antispyware signature creation time>
-
Last quick scan start time: ?<Last quick scan start time>
-
Last quick scan end time: ?<Last quick scan end time>
-
Last quick scan source: <Last quick scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)
-
Last full scan start time: ?<Last full scan start time>
-
Last full scan end time: ?<Last full scan end time>
-
Last full scan source: <Last full scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)
-
Product status: For internal troubleshooting -
-
Event ID: 2000
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_UPDATED - -
-Message: - -The antimalware definitions updated successfully. - -
-Description: - -Antivirus signature version has been updated. -
-
Current Signature Version: <Current signature version>
-
Previous Signature Version: <Previous signature version>
-
Signature Type: <Signature type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
  • Network Inspection System
  • -
-
-
Update Type: <Update type>, either Full or Delta.
-
User: <Domain>\<User>
-
Current Engine Version: <Current engine version>
-
Previous Engine Version: <Previous engine version>
-
-
-User action: - -No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when signatures are successfully updated. -
Event ID: 2001
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_UPDATE_FAILED -
-Message: - -The security intelligence update failed. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to update signatures. -
-
New security intelligence version: <New version number>
-
Previous security intelligence version: <Previous version>
-
Update Source: <Update source>, for example: -
    -
  • Security intelligence update folder
  • -
  • Internal security intelligence update server
  • -
  • Microsoft Update Server
  • -
  • File share
  • -
  • Microsoft Malware Protection Center (MMPC)
  • -
-
-
Update Stage: <Update stage>, for example: -
    -
  • Search
  • -
  • Download
  • -
  • Install
  • -
-
-
Source Path: File share name for Universal Naming Convention (UNC), server name for Windows Server Update Services (WSUS)/Microsoft Update/ADL.
-
Signature Type: <Signature type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
  • Network Inspection System
  • -
-
-
Update Type: <Update type>, either Full or Delta.
-
User: <Domain>\<User>
-
Current Engine Version: <Current engine version>
-
Previous Engine Version: <Previous engine version>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
-User action: - -This error occurs when there is a problem updating definitions. -To troubleshoot this event: -
    -
  1. Update definitions and force a rescan directly on the endpoint.
  2. -
  3. Review the entries in the %Windir%\WindowsUpdate.log file for more information about this error.
  4. -
  5. Contact Microsoft Technical Support. -
  6. -
-
Event ID: 2002
-Symbolic name: - -MALWAREPROTECTION_ENGINE_UPDATED -
-Message: - -The antimalware engine updated successfully. - -
-Description: - -Microsoft Defender Antivirus engine version has been updated. -
-
Current Engine Version: <Current engine version>
-
Previous Engine Version: <Previous engine version>
-
Engine Type: <Engine type>, either antimalware engine or Network Inspection System engine.
-
User: <Domain>\<User>
-
-
-User action: - -No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when the antimalware engine is successfully updated. -
Event ID: 2003
-Symbolic name: - -MALWAREPROTECTION_ENGINE_UPDATE_FAILED -
-Message: - -The antimalware engine update failed. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to update the engine. -
-
New Engine Version:
-
Previous Engine Version: <Previous engine version>
-
Engine Type: <Engine type>, either antimalware engine or Network Inspection System engine.
-
User: <Domain>\<User>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
-User action: - -The Microsoft Defender Antivirus client update failed. This event occurs when the client fails to update itself. This event is usually due to an interruption in network connectivity during an update. -To troubleshoot this event: -
    -
  1. Update definitions and force a rescan directly on the endpoint.
  2. -
  3. Contact Microsoft Technical Support. -
  4. -
-
Event ID: 2004
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_REVERSION -
-Message: - -There was a problem loading antimalware definitions. The antimalware engine will attempt to load the last-known good set of definitions. -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. -
-
Signatures Attempted:
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Signature Version: <Definition version>
-
Engine Version: <Antimalware engine version>
-
-
-User action: - -The Microsoft Defender Antivirus client attempted to download and install the latest definitions file and failed. This error can occur when the client encounters an error while trying to load the definitions, or if the file is corrupt. Microsoft Defender Antivirus will attempt to revert back to a known-good set of definitions. -To troubleshoot this event: -
    -
  1. Restart the computer and try again.
  2. -
  3. Download the latest definitions from the Microsoft Security Intelligence site. -Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions. -
  4. -
  5. Contact Microsoft Technical Support. -
  6. -
-
Event ID: 2005
-Symbolic name: - -MALWAREPROTECTION_ENGINE_UPDATE_PLATFORMOUTOFDATE -
-Message: - -The antimalware engine failed to load because the antimalware platform is out of date. The antimalware platform will load the last-known good antimalware engine and attempt to update. -
-Description: - -Microsoft Defender Antivirus could not load antimalware engine because current platform version is not supported. Microsoft Defender Antivirus will revert back to the last known-good engine and a platform update will be attempted. -
-
Current Platform Version: <Current platform version>
-
-
Event ID: 2006
-Symbolic name: - -MALWAREPROTECTION_PLATFORM_UPDATE_FAILED - -
-Message: - -The platform update failed. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to update the platform. -
-
Current Platform Version: <Current platform version>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
Event ID: 2007
-Symbolic name: - -MALWAREPROTECTION_PLATFORM_ALMOSTOUTOFDATE -
-Message: - -The platform will soon be out of date. Download the latest platform to maintain up-to-date protection. -
-Description: - -Microsoft Defender Antivirus will soon require a newer platform version to support future versions of the antimalware engine. Download the latest Microsoft Defender Antivirus platform to maintain the best level of protection available. -
-
Current Platform Version: <Current platform version>
-
-
Event ID: 2010
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATED - -
-Message: - -The antimalware engine used the Dynamic Signature Service to get additional definitions. - -
-Description: - -Microsoft Defender Antivirus used Dynamic Signature Service to retrieve additional signatures to help protect your machine. -
-
Current Signature Version: <Current signature version>
-
Signature Type: <Signature type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
  • Network Inspection System
  • -
-
-
Current Engine Version: <Current engine version>
-
Dynamic Signature Type: <Dynamic signature type>, for example: -
    -
  • Version
  • -
  • Timestamp
  • -
  • No limit
  • -
  • Duration
  • -
-
-
Persistence Path: <Path>
-
Dynamic Signature Version: <Version number>
-
Dynamic Signature Compilation Timestamp: <Timestamp>
-
Persistence Limit Type: <Persistence limit type>, for example: -
    -
  • VDM version
  • -
  • Timestamp
  • -
  • No limit
  • -
-
-
Persistence Limit: Persistence limit of the fastpath signature.
-
-
Event ID: 2011
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED - -
-Message: - -The Dynamic Signature Service deleted the out-of-date dynamic definitions. - -
-Description: - -Microsoft Defender Antivirus used Dynamic Signature Service to discard obsolete signatures. -
-
Current Signature Version: <Current signature version>
-
Signature Type: <Signature type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
  • Network Inspection System
  • -
-
-
Current Engine Version: <Current engine version>
-
Dynamic Signature Type: <Dynamic signature type>, for example: -
    -
  • Version
  • -
  • Timestamp
  • -
  • No limit
  • -
  • Duration
  • -
-
-
Persistence Path: <Path>
-
Dynamic Signature Version: <Version number>
-
Dynamic Signature Compilation Timestamp: <Timestamp>
-
Removal Reason:
-
Persistence Limit Type: <Persistence limit type>, for example: -
    -
  • VDM version
  • -
  • Timestamp
  • -
  • No limit
  • -
-
-
Persistence Limit: Persistence limit of the fastpath signature.
-
-
-User action: - -No action is necessary. The Microsoft Defender Antivirus client is in a healthy state. This event is reported when the Dynamic Signature Service successfully deletes out-of-date dynamic definitions. -
Event ID: 2012
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_FASTPATH_UPDATE_FAILED - -
-Message: - -The antimalware engine encountered an error when trying to use the Dynamic Signature Service. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to use Dynamic Signature Service. -
-
Current Signature Version: <Current signature version>
-
Signature Type: <Signature type>, for example:
    -
  • Antivirus
  • -
  • Antispyware
  • -
  • Antimalware
  • -
  • Network Inspection System
  • -
-
-
Current Engine Version: <Current engine version>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Dynamic Signature Type: <Dynamic signature type>, for example: -
    -
  • Version
  • -
  • Timestamp
  • -
  • No limit
  • -
  • Duration
  • -
-
-
Persistence Path: <Path>
-
Dynamic Signature Version: <Version number>
-
Dynamic Signature Compilation Timestamp: <Timestamp>
-
Persistence Limit Type: <Persistence limit type>, for example: -
    -
  • VDM version
  • -
  • Timestamp
  • -
  • No limit
  • -
-
-
Persistence Limit: Persistence limit of the fastpath signature.
-
-
-User action: - -Check your Internet connectivity settings. -
Event ID: 2013
-Symbolic name: - -MALWAREPROTECTION_SIGNATURE_FASTPATH_DELETED_ALL - -
-Message: - -The Dynamic Signature Service deleted all dynamic definitions. - -
-Description: - -Microsoft Defender Antivirus discarded all Dynamic Signature Service signatures. -
-
Current Signature Version: <Current signature version>
-
-
Event ID: 2020
-Symbolic name: - -MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOADED - -
-Message: - -The antimalware engine downloaded a clean file. - -
-Description: - -Microsoft Defender Antivirus downloaded a clean file. -
-
Filename: <File name> -Name of the file.
-
Current Signature Version: <Current signature version>
-
Current Engine Version: <Current engine version>
-
-
Event ID: 2021
-Symbolic name: - -MALWAREPROTECTION_CLOUD_CLEAN_RESTORE_FILE_DOWNLOAD_FAILED -
-Message: - -The antimalware engine failed to download a clean file. - -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to download a clean file. -
-
Filename: <File name> -Name of the file.
-
Current Signature Version: <Current signature version>
-
Current Engine Version: <Current engine version>
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
-User action: - -Check your Internet connectivity settings. -The Microsoft Defender Antivirus client encountered an error when using the Dynamic Signature Service to download the latest definitions to a specific threat. This error is likely caused by a network connectivity issue. -
Event ID: 2030
-Symbolic name: - -MALWAREPROTECTION_OFFLINE_SCAN_INSTALLED -
-Message: - -The antimalware engine was downloaded and is configured to run offline on the next system restart. -
-Description: - -Microsoft Defender Antivirus downloaded and configured offline antivirus to run on the next reboot. -
Event ID: 2031
-Symbolic name: - -MALWAREPROTECTION_OFFLINE_SCAN_INSTALL_FAILED - -
-Message: - -The antimalware engine was unable to download and configure an offline scan. -
-Description: - -Microsoft Defender Antivirus has encountered an error trying to download and configure offline antivirus. -
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
Event ID: 2040
-Symbolic name: - -MALWAREPROTECTION_OS_EXPIRING - -
-Message: - -Antimalware support for this operating system version will soon end. - -
-Description: - -The support for your operating system will expire shortly. Running Microsoft Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats. -
Event ID: 2041
-Symbolic name: - -MALWAREPROTECTION_OS_EOL - -
-Message: - -Antimalware support for this operating system has ended. You must upgrade the operating system for continued support. - -
-Description: - -The support for your operating system has expired. Running Microsoft Defender Antivirus on an out of support operating system is not an adequate solution to protect against threats. -
Event ID: 2042
-Symbolic name: - -MALWAREPROTECTION_PROTECTION_EOL - -
-Message: - -The antimalware engine no longer supports this operating system, and is no longer protecting your system from malware. - -
-Description: - -The support for your operating system has expired. Microsoft Defender Antivirus is no longer supported on your operating system, has stopped functioning, and is not protecting against malware threats. -
Event ID: 3002
-Symbolic name: - -MALWAREPROTECTION_RTP_FEATURE_FAILURE - -
-Message: - -Real-time protection encountered an error and failed. -
-Description: - -Microsoft Defender Antivirus Real-Time Protection feature has encountered an error and failed. -
-
Feature: <Feature>, for example: -
    -
  • On Access
  • -
  • Internet Explorer downloads and Microsoft Outlook Express attachments
  • -
  • Behavior monitoring
  • -
  • Network Inspection System
  • -
-
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
Reason: The reason Microsoft Defender Antivirus real-time protection has restarted a feature.
-
-
-User action: - -You should restart the system then run a full scan because it's possible the system was not protected for some time. -The Microsoft Defender Antivirus client's real-time protection feature encountered an error because one of the services failed to start. -If it is followed by a 3007 event ID, the failure was temporary and the antimalware client recovered from the failure. -
Event ID: 3007
-Symbolic name: - -MALWAREPROTECTION_RTP_FEATURE_RECOVERED -
-Message: - -Real-time protection recovered from a failure. We recommend running a full system scan when you see this error. - -
-Description: - -Microsoft Defender Antivirus Real-time Protection has restarted a feature. It is recommended that you run a full system scan to detect any items that may have been missed while this agent was down. -
-
Feature: <Feature>, for example: -
    -
  • On Access
  • -
  • IE downloads and Outlook Express attachments
  • -
  • Behavior monitoring
  • -
  • Network Inspection System
  • -
-
-
Reason: The reason Microsoft Defender Antivirus real-time protection has restarted a feature.
-
-
-User action: - -The real-time protection feature has restarted. If this event happens again, contact Microsoft Technical Support. -
Event ID: 5000
-Symbolic name: - -MALWAREPROTECTION_RTP_ENABLED - -
-Message: - -Real-time protection is enabled. - -
-Description: - -Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was enabled. -
Event ID: 5001
-Symbolic name: - -MALWAREPROTECTION_RTP_DISABLED -
-Message: - -Real-time protection is disabled. - -
-Description: - -Microsoft Defender Antivirus real-time protection scanning for malware and other potentially unwanted software was disabled. -
Event ID: 5004
-Symbolic name: - -MALWAREPROTECTION_RTP_FEATURE_CONFIGURED - -
-Message: - -The real-time protection configuration changed. - -
-Description: - -Microsoft Defender Antivirus real-time protection feature configuration has changed. -
-
Feature: <Feature>, for example: -
    -
  • On Access
  • -
  • IE downloads and Outlook Express attachments
  • -
  • Behavior monitoring
  • -
  • Network Inspection System
  • -
-
-
Configuration:
-
-
Event ID: 5007
-Symbolic name: - -MALWAREPROTECTION_CONFIG_CHANGED - -
-Message: - -The antimalware platform configuration changed. -
-Description: - -Microsoft Defender Antivirus configuration has changed. If this is an unexpected event, you should review the settings as this may be the result of malware. -
-
Old value: <Old value number> -Old antivirus configuration value.
-
New value: <New value number> -New antivirus configuration value.
-
-
Event ID: 5008
-Symbolic name: - -MALWAREPROTECTION_ENGINE_FAILURE -
-Message: - -The antimalware engine encountered an error and failed. -
-Description: - -Microsoft Defender Antivirus engine has been terminated due to an unexpected error. -
-
Failure Type: <Failure type>, for example: -Crash -or Hang
-
Exception Code: <Error code>
-
Resource: <Resource>
-
-
-User action: - -To troubleshoot this event:
    -
  1. Try to restart the service.
      -
    • For antimalware, antivirus and spyware, at an elevated command prompt, type net stop msmpsvc, and then type net start msmpsvc to restart the antimalware engine.
    • -
    • For the Network Inspection System, at an elevated command prompt, type net start nissrv, and then type net start nissrv to restart the Network Inspection System engine by using the NiSSRV.exe file. -
    • -
    -
  2. -
  3. If it fails in the same way, look up the error code by accessing the Microsoft Support Site and entering the error number in the Search box, and contact Microsoft Technical Support.
  4. -
-
-User action: - -The Microsoft Defender Antivirus client engine stopped due to an unexpected error. -To troubleshoot this event: -
    -
  1. Run the scan again.
  2. -
  3. If it fails in the same way, go to the Microsoft Support site, enter the error number in the Search box to look for the error code.
  4. -
  5. Contact Microsoft Technical Support. -
  6. -
-
Event ID: 5009
-Symbolic name: - -MALWAREPROTECTION_ANTISPYWARE_ENABLED - -
-Message: - -Scanning for malware and other potentially unwanted software is enabled. - -
-Description: - -Microsoft Defender Antivirus scanning for malware and other potentially unwanted software has been enabled. -
Event ID: 5010
-Symbolic name: - -MALWAREPROTECTION_ANTISPYWARE_DISABLED - -
-Message: - -Scanning for malware and other potentially unwanted software is disabled. -
-Description: - -Microsoft Defender Antivirus scanning for malware and other potentially unwanted software is disabled. -
Event ID: 5011
-Symbolic name: - -MALWAREPROTECTION_ANTIVIRUS_ENABLED -
-Message: - -Scanning for viruses is enabled. -
-Description: - -Microsoft Defender Antivirus scanning for viruses has been enabled. -
Event ID: 5012
-Symbolic name: - -MALWAREPROTECTION_ANTIVIRUS_DISABLED - -
-Message: - -Scanning for viruses is disabled. - -
-Description: - -Microsoft Defender Antivirus scanning for viruses is disabled. -
Event ID: 5100
-Symbolic name: - -MALWAREPROTECTION_EXPIRATION_WARNING_STATE - -
-Message: - -The antimalware platform will expire soon. - -
-Description: - -Microsoft Defender Antivirus has entered a grace period and will soon expire. After expiration, this program will disable protection against viruses, spyware, and other potentially unwanted software. -
-
Expiration Reason: The reason Microsoft Defender Antivirus will expire.
-
Expiration Date: The date Microsoft Defender Antivirus will expire.
-
-
Event ID: 5101
-Symbolic name: - -MALWAREPROTECTION_DISABLED_EXPIRED_STATE - -
-Message: - -The antimalware platform is expired. - -
-Description: - -Microsoft Defender Antivirus grace period has expired. Protection against viruses, spyware, and other potentially unwanted software is disabled. -
-
Expiration Reason:
-
Expiration Date:
-
Error Code: <Error code> -Result code associated with threat status. Standard HRESULT values.
-
Error Description: <Error description> -Description of the error.
-
-
- - -## Microsoft Defender Antivirus client error codes -If Microsoft Defender Antivirus experiences any issues it will usually give you an error code to help you troubleshoot the issue. Most often an error means there was a problem installing an update. -This section provides the following information about Microsoft Defender Antivirus client errors. -- The error code -- The possible reason for the error -- Advice on what to do now - -Use the information in these tables to help troubleshoot Microsoft Defender Antivirus error codes. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Error code: 0x80508007
Message -ERR_MP_NO_MEMORY -
-Possible reason - -This error indicates that you might have run out of memory. -
Resolution -
    -
  1. Check the available memory on your device.
  2. -
  3. Close any unused applications that are running to free up memory on your device.
  4. -
  5. Restart the device and run the scan again. -
  6. -
-
Error code: 0x8050800C
MessageERR_MP_BAD_INPUT_DATA -
Possible reason -This error indicates that there might be a problem with your security product. -
Resolution -
    -
  1. Update the definitions. Either:
      -
    1. Click the Update definitions button on the Update tab in Microsoft Defender Antivirus. Update definitions in Microsoft Defender AntivirusOr, -
    2. -
    3. Download the latest definitions from the Microsoft Security Intelligence site. -Note: The size of the definitions file downloaded from the site can exceed 60 MB and should not be used as a long-term solution for updating definitions. -
    4. -
    -
  2. -
  3. Run a full scan. -
  4. -
  5. Restart the device and try again.
  6. -
-
Error code: 0x80508020
MessageERR_MP_BAD_CONFIGURATION - -
Possible reason -This error indicates that there might be an engine configuration error; commonly, this is related to input -data that does not allow the engine to function properly. -
Error code: 0x805080211 -
MessageERR_MP_QUARANTINE_FAILED - -
Possible reason -This error indicates that Microsoft Defender Antivirus failed to quarantine a threat. -
Error code: 0x80508022 -
MessageERR_MP_REBOOT_REQUIRED - -
Possible reason -This error indicates that a reboot is required to complete threat removal. -
-0x80508023 -
MessageERR_MP_THREAT_NOT_FOUND - -
Possible reason -This error indicates that the threat might no longer be present on the media, or malware might be stopping you from scanning your device. -
Resolution - -Run the Microsoft Safety Scanner then update your security software and try again. -
Error code: 0x80508024
MessageERR_MP_FULL_SCAN_REQUIRED - -
Possible reason -This error indicates that a full system scan might be required. -
Resolution -Run a full system scan. -
Error code: 0x80508025 -
MessageERR_MP_MANUAL_STEPS_REQUIRED - -
Possible reason -This error indicates that manual steps are required to complete threat removal. -
Resolution -Follow the manual remediation steps outlined in the Microsoft Malware Protection Encyclopedia. You can find a threat-specific link in the event history.
Error code: 0x80508026 -
MessageERR_MP_REMOVE_NOT_SUPPORTED - -
Possible reason -This error indicates that removal inside the container type might not be not supported. -
Resolution -Microsoft Defender Antivirus is not able to remediate threats detected inside the archive. Consider manually removing the detected resources. -
Error code: 0x80508027 -
MessageERR_MP_REMOVE_LOW_MEDIUM_DISABLED - -
Possible reason -This error indicates that removal of low and medium threats might be disabled. -
Resolution -Check the detected threats and resolve them as required. -
Error code: 0x80508029 -
MessageERROR_MP_RESCAN_REQUIRED - -
Possible reason -This error indicates a rescan of the threat is required. -
Resolution -Run a full system scan. -
Error code: 0x80508030 -
MessageERROR_MP_CALLISTO_REQUIRED - -
Possible reason -This error indicates that an offline scan is required. -
Resolution -Run offline Microsoft Defender Antivirus. You can read about how to do this in the offline Microsoft Defender Antivirus article. -
Error code: 0x80508031 -
MessageERROR_MP_PLATFORM_OUTDATED
-
Possible reason -This error indicates that Microsoft Defender Antivirus does not support the current version of the platform and requires a new version of the platform. -
Resolution -You can only use Microsoft Defender Antivirus in Windows 10. For Windows 8, Windows 7 and Windows Vista, you can use System Center Endpoint Protection.
- - -The following error codes are used during internal testing of Microsoft Defender Antivirus. - -If you see these errors, you can try to [update definitions](manage-updates-baselines-microsoft-defender-antivirus.md) and force a rescan directly on the endpoint. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Internal error codes
Error codeMessage displayedPossible reason for error and resolution
-0x80501004 - -ERROR_MP_NO_INTERNET_CONN - - -Check your Internet connection, then run the scan again. -
-0x80501000 - -ERROR_MP_UI_CONSOLIDATION_BASE - -This is an internal error. The cause is not clearly defined. - - -
-0x80501001 - -ERROR_MP_ACTIONS_FAILED -
-0x80501002 - -ERROR_MP_NOENGINE -
-0x80501003 - -ERROR_MP_ACTIVE_THREATS -
-0x805011011 - -MP_ERROR_CODE_LUA_CANCELLED -
-0x80501101 - -ERROR_LUA_CANCELLATION -
-0x80501102 - -MP_ERROR_CODE_ALREADY_SHUTDOWN -
-0x80501103 - -MP_ERROR_CODE_RDEVICE_S_ASYNC_CALL_PENDING -
-0x80501104 - -MP_ERROR_CODE_CANCELLED -
-0x80501105 - -MP_ERROR_CODE_NO_TARGETOS -
-0x80501106 - -MP_ERROR_CODE_BAD_REGEXP -
-0x80501107 - -MP_ERROR_TEST_INDUCED_ERROR -
-0x80501108 - -MP_ERROR_SIG_BACKUP_DISABLED -
-0x80508001 - -ERR_MP_BAD_INIT_MODULES -
-0x80508002 - -ERR_MP_BAD_DATABASE -
-0x80508004 - -ERR_MP_BAD_UFS -
-0x8050800C - -ERR_MP_BAD_INPUT_DATA -
-0x8050800D - -ERR_MP_BAD_GLOBAL_STORAGE -
-0x8050800E - -ERR_MP_OBSOLETE -
-0x8050800F - -ERR_MP_NOT_SUPPORTED -
-0x8050800F -0x80508010 - -ERR_MP_NO_MORE_ITEMS -
-0x80508011 - -ERR_MP_DUPLICATE_SCANID -
-0x80508012 - -ERR_MP_BAD_SCANID -
-0x80508013 - -ERR_MP_BAD_USERDB_VERSION -
-0x80508014 - -ERR_MP_RESTORE_FAILED -
-0x80508016 - -ERR_MP_BAD_ACTION -
-0x80508019 - -ERR_MP_NOT_FOUND -
-0x80509001 - -ERR_RELO_BAD_EHANDLE -
-0x80509003 - -ERR_RELO_KERNEL_NOT_LOADED -
-0x8050A001 - -ERR_MP_BADDB_OPEN -
-0x8050A002 - -ERR_MP_BADDB_HEADER -
-0x8050A003 - -ERR_MP_BADDB_OLDENGINE -
-0x8050A004 - -ERR_MP_BADDB_CONTENT -
-0x8050A005 - -ERR_MP_BADDB_NOTSIGNED -
-0x8050801 - -ERR_MP_REMOVE_FAILED - -This is an internal error. It might be triggered when malware removal is not successful. -
-0x80508018 - -ERR_MP_SCAN_ABORTED - - -This is an internal error. It might have triggered when a scan fails to complete. -
- -## Related topics - -- [Report on Microsoft Defender Antivirus protection](report-monitor-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md deleted file mode 100644 index 0af4adc9c9..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md +++ /dev/null @@ -1,73 +0,0 @@ ---- -title: Troubleshoot problems with reporting tools for Microsoft Defender AV -description: Identify and solve common problems when attempting to report in Microsoft Defender AV protection status in Update Compliance -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Troubleshoot Microsoft Defender Antivirus reporting in Update Compliance - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -> [!IMPORTANT] -> On March 31, 2020, the Microsoft Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates. - -You can use Microsoft Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the [Microsoft Defender for Endpoint portal](/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see [Windows 10 product licensing options](https://www.microsoft.com/licensing/product-licensing/windows10.aspx). - -When you use [Windows Analytics Update Compliance to obtain reporting into the protection status of devices or endpoints](/windows/deployment/update/update-compliance-using#wdav-assessment) in your network that are using Microsoft Defender Antivirus, you might encounter problems or issues. - -Typically, the most common indicators of a problem are: -- You only see a small number or subset of all the devices you were expecting to see -- You do not see any devices at all -- The reports and information you do see is outdated (older than a few days) - -For common error codes and event IDs related to the Microsoft Defender Antivirus service that are not related to Update Compliance, see [Microsoft Defender Antivirus events](troubleshoot-microsoft-defender-antivirus.md). - -There are three steps to troubleshooting these problems: - -1. Confirm that you have met all prerequisites -2. Check your connectivity to the Windows Defender cloud-based service -3. Submit support logs - ->[!IMPORTANT] ->It typically takes 3 days for devices to start appearing in Update Compliance. - - -## Confirm prerequisites - -In order for devices to properly show up in Update Compliance, you have to meet certain prerequisites for both the Update Compliance service and for Microsoft Defender Antivirus: - ->[!div class="checklist"] ->- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. -> - [Cloud-delivered protection is enabled](enable-cloud-protection-microsoft-defender-antivirus.md). -> - Endpoints can [connect to the Microsoft Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud) -> - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level). -> - It has been 3 days since all requirements have been met - -“You can use Microsoft Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, VL, and Pro licenses. However, for E5 licenses, you need to use the Microsoft Defender for Endpoint portal (https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints). To learn more about licensing options, see Windows 10 product licensing options" - -If the above prerequisites have all been met, you might need to proceed to the next step to collect diagnostic information and send it to us. - -> [!div class="nextstepaction"] -> [Collect diagnostic data for Update Compliance troubleshooting](collect-diagnostic-data.md) - -## Related topics - -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md deleted file mode 100644 index 7c7bccc364..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus with Group Policy -description: Learn how to use a Group Policy to configure and manage Microsoft Defender Antivirus on your endpoints in Microsoft Defender for Endpoint. -keywords: group policy, GPO, configuration, settings -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 03/31/2021 -ms.reviewer: ksarens, jtoole, pahuijbr -manager: dansimp -ms.technology: mde ---- - -# Use Group Policy settings to configure and manage Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can use [Group Policy](/windows/win32/srvnodes/group-policy) to configure and manage Microsoft Defender Antivirus on your endpoints. - -In general, you can use the following procedure to configure or change Microsoft Defender Antivirus group policy settings: - -1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. - -2. Using the **Group Policy Management Editor** go to **Computer configuration**. - -3. Click **Administrative templates**. - -4. Expand the tree to **Windows components** > **Microsoft Defender Antivirus**. - -5. Expand the section (referred to as **Location** in the table in this topic) that contains the setting you want to configure, double-click the setting to open it, and make configuration changes. - -6. [Deploy the updated GPO as you normally do](/windows/win32/srvnodes/group-policy). - -The following table in this topic lists the Group Policy settings available in Windows 10, version 1703, and provides links to the appropriate topic in this documentation library (where applicable). - -| Location | Setting | Article | -|:---|:---|:---| -| Client interface | Enable headless UI mode | [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) | -| Client interface | Display additional text to clients when they need to perform an action | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) | -| Client interface | Suppress all notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) | -| Client interface | Suppresses reboot notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) | -| Exclusions | Extension Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | -| Exclusions | Path Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | -| Exclusions | Process Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | -| Exclusions | Turn off Auto Exclusions | [Configure and validate exclusions in Microsoft Defender Antivirus scans](configure-exclusions-microsoft-defender-antivirus.md) | -| MAPS | Configure the 'Block at First Sight' feature | [Enable block at first sight](configure-block-at-first-sight-microsoft-defender-antivirus.md) | -| MAPS | Join Microsoft MAPS | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | -| MAPS | Send file samples when further analysis is required | [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md) | -| MAPS | Configure local setting override for reporting to Microsoft MAPS | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| MpEngine | Configure extended cloud check | [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md) | -| MpEngine | Select cloud protection level | [Specify the cloud-delivered protection level](specify-cloud-protection-level-microsoft-defender-antivirus.md) | -| Network inspection system | Specify additional definition sets for network traffic inspection | No longer relevant | -| Network inspection system | Turn on definition retirement | No longer relevant | -| Network inspection system | Turn on protocol recognition | No longer relevant | -| Quarantine | Configure local setting override for the removal of items from Quarantine folder | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Quarantine | Configure removal of items from Quarantine folder | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Real-time protection | Configure local setting override for monitoring file and program activity on your computer | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Real-time protection | Configure local setting override for monitoring for incoming and outgoing file activity | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Real-time protection | Configure local setting override for scanning all downloaded files and attachments | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Real-time protection | Configure local setting override for turn on behavior monitoring | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Real-time protection | Configure local setting override to turn on real-time protection | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Real-time protection | Define the maximum size of downloaded files and attachments to be scanned | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Monitor file and program activity on your computer | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Scan all downloaded files and attachments | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Turn off real-time protection | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Turn on behavior monitoring | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Turn on process scanning whenever real-time protection is enabled | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Turn on raw volume write notifications | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Real-time protection | Configure monitoring for incoming and outgoing file and program activity | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Remediation | Configure local setting override for the time of day to run a scheduled full scan to complete remediation | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Remediation | Specify the day of the week to run a scheduled full scan to complete remediation | [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Remediation | Specify the time of day to run a scheduled full scan to complete remediation | [Configure scheduled Microsoft Defender Antivirus scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Reporting | Turn off enhanced notifications | [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) -| Root | Turn off Microsoft Defender Antivirus | Not used (This setting must be set to **Not configured** to ensure any installed third-party antivirus apps work correctly) -| Root | Define addresses to bypass proxy server | No longer relevant | -| Root | Define proxy autoconfig (.pac) for connecting to the network | No longer relevant | -| Root | Define proxy server for connecting to the network | No longer relevant | -| Root | Configure local administrator merge behavior for lists | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Root | Allow antimalware service to start up with normal priority | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Root | Allow antimalware service to remain running always | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Root | Turn off routine remediation | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Root | Randomize scheduled task times | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Allow users to pause scan | [Prevent users from seeing or interacting with the Microsoft Defender Antivirus user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) (Not supported on Windows 10) | -| Scan | Check for the latest virus and spyware definitions before running a scheduled scan | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | -| Scan | Define the number of days after which a catch-up scan is forced | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Scan | Turn on catch up full scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Scan | Turn on catch up quick scan | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Scan | Configure local setting override for maximum percentage of CPU utilization | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Scan | Configure local setting override for schedule scan day | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Scan | Configure local setting override for scheduled quick scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Scan | Configure local setting override for scheduled scan time | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Scan | Configure local setting override for the scan type to use for a scheduled scan | [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) | -| Scan | Create a system restore point | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Scan | Turn on removal of items from scan history folder | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Scan | Turn on heuristics | [Enable and configure Microsoft Defender Antivirus always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) | -| Scan | Turn on e-mail scanning | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Turn on reparse point scanning | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Run full scan on mapped network drives | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Scan archive files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Scan network files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Scan packed executables | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Scan removable drives | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Specify the maximum depth to scan archive files | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Specify the maximum percentage of CPU utilization during a scan | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Specify the maximum size of archive files to be scanned | [Configure scanning options in Microsoft Defender Antivirus](configure-advanced-scan-types-microsoft-defender-antivirus.md) | -| Scan | Specify the day of the week to run a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Specify the interval to run quick scans per day | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Specify the scan type to use for a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Specify the time for a daily quick scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Specify the time of day to run a scheduled scan | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Scan | Start the scheduled scan only when computer is on but not in use | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Security intelligence updates | Allow security intelligence updates from Microsoft Update | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) | -| Security intelligence updates | Allow security intelligence updates when running on battery power | [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md) | -| Security intelligence updates | Allow notifications to disable definitions-based reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Allow real-time security intelligence updates based on reports to Microsoft MAPS | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Check for the latest virus and spyware definitions on startup | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Define file shares for downloading security intelligence updates | [Manage Microsoft Defender Antivirus protection and security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Define the number of days after which a catch up security intelligence update is required | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Security intelligence updates | Define the number of days before spyware definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Security intelligence updates | Define the number of days before virus definitions are considered out of date | [Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | -| Security intelligence updates | Define the order of sources for downloading security intelligence updates | [Manage Microsoft Defender Antivirus protection and security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Initiate security intelligence update on startup | [Manage event-based forced updates](manage-event-based-updates-microsoft-defender-antivirus.md) | -| Security intelligence updates | Specify the day of the week to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | -| Security intelligence updates | Specify the interval to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | -| Security intelligence updates | Specify the time to check for security intelligence updates | [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | -| Security intelligence updates | Turn on scan after Security intelligence update | [Configure scheduled scans for Microsoft Defender Antivirus](scheduled-catch-up-scans-microsoft-defender-antivirus.md) | -| Threats | Specify threat alert levels at which default action should not be taken when detected | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | -| Threats | Specify threats upon which default action should not be taken when detected | [Configure remediation for Microsoft Defender Antivirus scans](configure-remediation-microsoft-defender-antivirus.md) | - - -## Related articles - -- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md deleted file mode 100644 index 9181cc319b..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus with Configuration Manager and Intune -description: Use Microsoft Endpoint Manager and Microsoft Intune to configure Microsoft Defender AV and Endpoint Protection -keywords: scep, intune, endpoint protection, configuration -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 10/26/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Use Microsoft Endpoint Manager and Microsoft Intune to configure and manage Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -If you were using Microsoft Endpoint Manager or Microsoft Intune to manage the endpoints on your network, you can now use Microsoft Endpoint Manager to manage Microsoft Defender Antivirus scans. - -1. In the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)), navigate to **Endpoint Security**. - -2. Under **Manage**, choose **Antivirus**. - -3. Select your Microsoft Defender Antivirus policy. - -4. Under **Manage**, choose **Properties**. - -5. Next to **Configuration settings**, choose **Edit**. - -6. Expand the **Scan** section, and review or edit your scanning settings. - -7. Choose **Review + save** - -Need help? See [Manage endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security). - - -## Related articles - -- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md deleted file mode 100644 index f8079cd1a6..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md +++ /dev/null @@ -1,65 +0,0 @@ ---- -title: Use PowerShell cmdlets to configure and run Microsoft Defender AV -description: In Windows 10, you can use PowerShell cmdlets to run scans, update Security intelligence, and change settings in Microsoft Defender Antivirus. -keywords: scan, command line, mpcmdrun, defender -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 07/23/2020 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Use PowerShell cmdlets to configure and manage Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration. You can read more about it at the [PowerShell hub on MSDN](/previous-versions/msdn10/mt173057(v=msdn.10)). - -For a list of the cmdlets and their functions and available parameters, see the [Defender cmdlets](/powershell/module/defender) topic. - -PowerShell cmdlets are most useful in Windows Server environments that don't rely on a graphical user interface (GUI) to configure software. - -> [!NOTE] -> PowerShell cmdlets should not be used as a replacement for a full network policy management infrastructure, such as [Microsoft Endpoint Configuration Manager](/configmgr), [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), or [Microsoft Defender Antivirus Group Policy ADMX templates](https://www.microsoft.com/download/101445). - -Changes made with PowerShell will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, Microsoft Endpoint Configuration Manager, or Microsoft Intune can overwrite changes made with PowerShell. - -You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-microsoft-defender-antivirus.md). - -PowerShell is typically installed under the folder `%SystemRoot%\system32\WindowsPowerShell`. - -## Use Microsoft Defender Antivirus PowerShell cmdlets - -1. In the Windows search bar, type **powershell**. -2. Select **Windows PowerShell** from the results to open the interface. -3. Enter the PowerShell command and any parameters. - -> [!NOTE] -> You may need to open PowerShell in administrator mode. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. - -To open online help for any of the cmdlets type the following: - -```PowerShell -Get-Help -Online -``` - -Omit the `-online` parameter to get locally cached help. - -## Related topics - -- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Microsoft Defender Antivirus Cmdlets](/powershell/module/defender/?view=win10-ps) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md deleted file mode 100644 index dece3b9c83..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Configure Microsoft Defender Antivirus with WMI -description: Learn how to configure and manage Microsoft Defender Antivirus by using WMI scripts to retrieve, modify, and update settings in Microsoft Defender for Endpoint. -keywords: wmi, scripts, windows management instrumentation, configuration -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 09/03/2018 -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Use Windows Management Instrumentation (WMI) to configure and manage Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Windows Management Instrumentation (WMI) is a scripting interface that allows you to retrieve, modify, and update settings. - -Read more about WMI at the [Microsoft Developer Network System Administration library](/windows/win32/wmisdk/wmi-start-page). - -Microsoft Defender Antivirus has a number of specific WMI classes that can be used to perform most of the same functions as Group Policy and other management tools. Many of the classes are analogous to [Defender PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md). - -The [MSDN Windows Defender WMIv2 Provider reference library](/previous-versions/windows/desktop/defender/windows-defender-wmiv2-apis-portal) lists the available WMI classes for Microsoft Defender Antivirus, and includes example scripts. - -Changes made with WMI will affect local settings on the endpoint where the changes are deployed or made. This means that deployments of policy with Group Policy, Microsoft Endpoint Configuration Manager, or Microsoft Intune can overwrite changes made with WMI. - -You can [configure which settings can be overridden locally with local policy overrides](configure-local-policy-overrides-microsoft-defender-antivirus.md). - -## Related topics - -- [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md deleted file mode 100644 index 7c9f620f36..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection -description: next-generation technologies in cloud-delivered protection provide an advanced level of fast, robust antivirus detection. -keywords: Microsoft Defender Antivirus, next-generation technologies, next-generation av, machine learning, antimalware, security, defender, cloud, cloud-delivered protection -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.reviewer: shwjha -manager: dansimp -ms.custom: nextgen -ms.technology: mde ---- - -# Use next-generation technologies in Microsoft Defender Antivirus through cloud-delivered protection - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/) - -Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. - -Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender for Endpoint next-generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) - -To take advantage of the power and speed of these next-generation technologies, Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense. - ->[!NOTE] ->The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud, rather it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. - -With cloud-delivered protection, next-generation technologies provide rapid identification of new threats, sometimes even before a single machine is infected. Watch the following video about Microsoft AI and Microsoft Defender Antivirus in action: - - - -To understand how next-generation technologies shorten protection delivery time through the cloud, watch the following video: - - - -Read the following blog posts for detailed protection stories involving cloud-protection and Microsoft AI: - -- [Why Microsoft Defender Antivirus is the most deployed in the enterprise](https://www.microsoft.com/security/blog/2018/03/22/why-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise) -- [Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign](https://www.microsoft.com/security/blog/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign) -- [How artificial intelligence stopped an Emotet outbreak](https://www.microsoft.com/security/blog/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak) -- [Detonating a bad rabbit: Microsoft Defender Antivirus and layered machine learning defenses](https://www.microsoft.com/security/blog/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses) -- [Microsoft Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware](https://www.microsoft.com/security/blog/2017/07/18/windows-defender-antivirus-cloud-protection-service-advanced-real-time-defense-against-never-before-seen-malware) - -## Get cloud-delivered protection - -Cloud-delivered protection is enabled by default. However, you may need to re-enable it if it has been disabled as part of previous organizational policies. - -Organizations running Windows 10 E5 can also take advantage of emergency dynamic intelligence updates, which provide near real-time protection from emerging threats. When you turn on cloud-delivered protection, fixes for malware issues can be delivered via the cloud within minutes, instead of waiting for the next update. - ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. - -The following table describes the differences in cloud-delivered protection between recent versions of Windows and Configuration Manager. - -|OS version or service application |Cloud-protection service label |Reporting level (MAPS membership level) |Cloud block timeout period | -|---------|---------|---------|---------| -|Windows 8.1 (Group Policy) |Microsoft Advanced Protection Service |Basic, Advanced |No | -|Windows 10, version 1607 (Group Policy) |Microsoft Advanced Protection Service |Advanced |No | -|Windows 10, version 1703 or greater (Group Policy) |Cloud-based Protection |Advanced |Configurable | -|System Center 2012 Configuration Manager | N/A |Dependent on Windows version |Not configurable | -|Microsoft Endpoint Manager (Current Branch) |Cloud protection service |Dependent on Windows version |Configurable | -|Microsoft Intune |Microsoft Advanced Protection Service |Dependent on Windows version |Configurable | - -You can also [configure Microsoft Defender Antivirus to automatically receive new protection updates based on reports from our cloud service](manage-event-based-updates-microsoft-defender-antivirus.md#cloud-report-updates). - - -## Tasks - -- [Enable cloud-delivered protection](enable-cloud-protection-microsoft-defender-antivirus.md). You can enable cloud-delivered protection with Microsoft Endpoint Configuration Manager, Group Policy, Microsoft Intune, and PowerShell cmdlets. - -- [Specify the cloud-delivered protection level](specify-cloud-protection-level-microsoft-defender-antivirus.md). You can specify the level of protection offered by the cloud with Group Policy and Microsoft Endpoint Configuration Manager. The protection level will affect the amount of information shared with the cloud and how aggressively new files are blocked. - -- [Configure and validate network connections for Microsoft Defender Antivirus](configure-network-connections-microsoft-defender-antivirus.md). There are certain Microsoft URLs that your network and endpoints must be able to connect to for cloud-delivered protection to work effectively. This article lists the URLs that should be allowed via firewall or network filtering rules, and instructions for confirming your network is properly enrolled in cloud-delivered protection. - -- [Configure the block at first sight feature](configure-block-at-first-sight-microsoft-defender-antivirus.md). The "block at first sight" feature can block new malware within seconds, without having to wait hours for traditional Security intelligence. You can enable and configure it with Microsoft Endpoint Manager and Group Policy. - -- [Configure the cloud block timeout period](configure-cloud-block-timeout-period-microsoft-defender-antivirus.md). Microsoft Defender Antivirus can block suspicious files from running while it queries our cloud-delivered protection service. You can configure the amount of time the file will be prevented from running with Microsoft Endpoint Manager and Group Policy. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md deleted file mode 100644 index 81126c45bd..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-defender-antivirus.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Why you should use Microsoft Defender Antivirus together with Microsoft Defender for Endpoint -description: For best results, use Microsoft Defender Antivirus together with your other Microsoft offerings. -keywords: windows defender, antivirus, third party av -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -audience: ITPro -ms.topic: article -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.reviewer: -manager: dansimp -ms.technology: mde ---- - -# Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) - -Microsoft Defender Antivirus is the next-generation protection component of [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) (Microsoft Defender for Endpoint). - -Although you can use a non-Microsoft antivirus solution with Microsoft Defender for Endpoint, there are advantages to using Microsoft Defender Antivirus together with Defender for Endpoint. Not only is Microsoft Defender Antivirus an excellent next-generation antivirus solution, but combined with other Defender for Endpoint capabilities, such as [endpoint detection and response](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response) and [automated investigation and remediation](/microsoft-365/security/defender-endpoint/automated-investigations), you get better protection that's coordinated across products and services. - -## 11 reasons to use Microsoft Defender Antivirus together with Microsoft Defender for Endpoint - -|# |Advantage |Why it matters | -|--|--|--| -|1|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Microsoft Defender for Endpoint](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | -|2|Threat analytics and your score for devices |Microsoft Defender Antivirus collects underlying system data used by [threat analytics](/microsoft-365/security/defender-endpoint/threat-analytics) and [Microsoft Secure Score for Devices](/microsoft-365/security/defender-endpoint/tvm-microsoft-secure-score-devices). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | -|3|Performance |Microsoft Defender for Endpoint is designed to work with Microsoft Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Microsoft Defender Antivirus](evaluate-microsoft-defender-antivirus.md) and [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/evaluate-mde).| -|4|Details about blocked malware |More details and actions for blocked malware are available with Microsoft Defender Antivirus and Microsoft Defender for Endpoint. [Understand malware & other threats](../intelligence/understanding-malware.md).| -|5|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](/microsoft-365/security/defender-endpoint/network-protection).| -|6|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](/microsoft-365/security/defender-endpoint/respond-file-alerts#stop-and-quarantine-files-in-your-network).| -|7|Attack Surface Reduction |Your organization's security team can reduce your vulnerabilities (attack surfaces), giving attackers fewer ways to perform attacks. Attack surface reduction uses cloud protection for a number of rules. [Get an overview of attack surface reduction](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction).| -|8|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response). (These signals are not available with non-Microsoft antivirus solutions.) | -|9|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](/microsoft-365/compliance/offering-iso-27001). | -|10|File recovery via OneDrive |If you are using Microsoft Defender Antivirus together with [Office 365](/Office365/Enterprise), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| -|11|Technical support |By using Microsoft Defender for Endpoint together with Microsoft Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](/microsoft-365/security/defender-endpoint/troubleshoot-mde) and [review event logs and error codes with Microsoft Defender Antivirus](troubleshoot-microsoft-defender-antivirus.md). | - - -## Learn more - -[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) - -[Threat & Vulnerability Management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt) \ No newline at end of file From 317be5e07a27adce68b53a6cb8a09c6ea7a9ae34 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 8 Apr 2021 16:53:23 -0700 Subject: [PATCH 048/173] moved images to microsoft-365-docs-pr --- .../images/GPO-diagpath.png | Bin 321833 -> 0 bytes .../GPO1-SupportLogLocationDefender.png | Bin 143101 -> 0 bytes .../images/GPO2-SupportLogLocationGPPage.png | Bin 30056 -> 0 bytes ...SupportLogLocationGPPageEnabledExample.png | Bin 30445 -> 0 bytes .../images/WDAV-WinSvr2019-turnfeatureson.jpg | Bin 72631 -> 0 bytes .../images/defender-updatedefs2.png | Bin 86176 -> 0 bytes .../images/defender/client.png | Bin 95720 -> 0 bytes .../defender/intune-block-at-first-sight.png | Bin 10402 -> 0 bytes .../images/defender/notification.png | Bin 61437 -> 0 bytes .../defender/sccm-advanced-settings.png | Bin 48212 -> 0 bytes .../sccm-cloud-protection-service.png | Bin 36313 -> 0 bytes .../defender/sccm-real-time-protection.png | Bin 39349 -> 0 bytes .../images/defender/sccm-wdo.png | Bin 150655 -> 0 bytes .../images/defender/wdav-bafs-edge.png | Bin 4989 -> 0 bytes .../images/defender/wdav-bafs-ie.png | Bin 5158 -> 0 bytes .../defender/wdav-extension-exclusions.png | Bin 41677 -> 0 bytes .../images/defender/wdav-get-mpthreat.png | Bin 12472 -> 0 bytes .../defender/wdav-get-mpthreatdetection.png | Bin 52810 -> 0 bytes .../defender/wdav-headless-mode-1607.png | Bin 3120 -> 0 bytes .../defender/wdav-headless-mode-1703.png | Bin 29474 -> 0 bytes .../defender/wdav-headless-mode-off-1703.png | Bin 36389 -> 0 bytes .../images/defender/wdav-history-wdsc.png | Bin 89728 -> 0 bytes .../images/defender/wdav-malware-detected.png | Bin 4649 -> 0 bytes .../defender/wdav-order-update-sources.png | Bin 1324694 -> 0 bytes .../images/defender/wdav-path-exclusions.png | Bin 45627 -> 0 bytes .../wdav-powershell-get-exclusions-all.png | Bin 38553 -> 0 bytes ...dav-powershell-get-exclusions-variable.png | Bin 9323 -> 0 bytes .../defender/wdav-process-exclusions.png | Bin 58487 -> 0 bytes .../wdav-protection-settings-wdsc.png | Bin 180857 -> 0 bytes .../wdav-quarantined-history-wdsc.png | Bin 16698 -> 0 bytes .../images/defender/wdav-settings-old.png | Bin 82864 -> 0 bytes .../images/defender/wdav-wdsc-defs.png | Bin 79642 -> 0 bytes .../images/defender/wdav-wdsc.png | Bin 55845 -> 0 bytes .../wdav-windows-defender-app-old.png | Bin 131968 -> 0 bytes .../endpointmgr-antivirus-cloudprotection.png | Bin 11884 -> 0 bytes .../gpedit-administrative-templates.PNG | Bin 143074 -> 0 bytes .../images/gpedit-real-time-protection.PNG | Bin 214961 -> 0 bytes .../images/gpedit-search.png | Bin 21889 -> 0 bytes ...-turn-off-real-time-protection-enabled.PNG | Bin 127160 -> 0 bytes .../gpedit-turn-off-real-time-protection.PNG | Bin 230849 -> 0 bytes ...gpedit-windows-defender-antivirus-scan.PNG | Bin 222790 -> 0 bytes .../gpedit-windows-defender-antivirus.PNG | Bin 297202 -> 0 bytes .../images/jamf-onboarding.png | Bin 103540 -> 0 bytes .../images/mde-turn-tamperprotect-on.png | Bin 92380 -> 0 bytes .../images/mem-antivirus-scan-on-demand.png | Bin 65327 -> 0 bytes ...atp-next-generation-protection-engines.png | Bin 354941 -> 0 bytes .../images/server-add-gui.png | Bin 116206 -> 0 bytes .../images/tamperattemptalert.png | Bin 155319 -> 0 bytes .../images/tamperprotectionturnedon.png | Bin 81543 -> 0 bytes .../images/tamperprotectsecurityrecos.png | Bin 122318 -> 0 bytes .../images/tampprotintune-alert.jpg | Bin 81951 -> 0 bytes .../images/tampprotintune-huntingquery.png | Bin 99124 -> 0 bytes .../tampprotintune-windowssecurityapp.png | Bin 110587 -> 0 bytes .../images/turnontamperprotect-MEM.png | Bin 85225 -> 0 bytes .../images/turnontamperprotect-consumer.png | Bin 143971 -> 0 bytes .../images/turnontamperprotect-enterprise.png | Bin 137849 -> 0 bytes .../images/turnontamperprotect-intune.png | Bin 268408 -> 0 bytes .../images/turnontamperprotection.png | Bin 144909 -> 0 bytes .../images/vtp-3ps-lps-on.png | Bin 130838 -> 0 bytes .../images/vtp-3ps-lps.png | Bin 63613 -> 0 bytes .../images/vtp-3ps.png | Bin 39597 -> 0 bytes .../images/vtp-wdav.png | Bin 40925 -> 0 bytes ...in-security- exp-policy-endpt-security.png | Bin 199714 -> 0 bytes 63 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/GPO2-SupportLogLocationGPPage.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/GPO3-SupportLogLocationGPPageEnabledExample.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/WDAV-WinSvr2019-turnfeatureson.jpg delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender-updatedefs2.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/client.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/intune-block-at-first-sight.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/notification.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-advanced-settings.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-cloud-protection-service.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-real-time-protection.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/sccm-wdo.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-edge.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-bafs-ie.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-extension-exclusions.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreat.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-get-mpthreatdetection.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1607.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-1703.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-headless-mode-off-1703.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-history-wdsc.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-malware-detected.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-order-update-sources.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-path-exclusions.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-all.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-powershell-get-exclusions-variable.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-process-exclusions.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-protection-settings-wdsc.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-quarantined-history-wdsc.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-settings-old.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc-defs.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-wdsc.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/defender/wdav-windows-defender-app-old.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/endpointmgr-antivirus-cloudprotection.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-administrative-templates.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-real-time-protection.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-search.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection-enabled.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-turn-off-real-time-protection.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus-scan.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/gpedit-windows-defender-antivirus.PNG delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/jamf-onboarding.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/mde-turn-tamperprotect-on.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/mem-antivirus-scan-on-demand.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/microsoft-defender-atp-next-generation-protection-engines.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/server-add-gui.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tamperattemptalert.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectionturnedon.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tamperprotectsecurityrecos.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-alert.jpg delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-huntingquery.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/tampprotintune-windowssecurityapp.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-MEM.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-consumer.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-enterprise.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotect-intune.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/turnontamperprotection.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps-on.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps-lps.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-3ps.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/vtp-wdav.png delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/images/win-security- exp-policy-endpt-security.png diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO-diagpath.png deleted file mode 100644 index 7f5019db43835a955335a83b25cd25efaf2d1293..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 321833 zcmYg%19W8V5^ZdA;!Hf5Xky#8GqG*kb~3Tkv2Al=+qRv&zVF@tzpvKn)$8=?KBv!D z^;Om0yH2>gtQaC3E*uC52%?0zup$Tu1Of;MSPTpp@RQ0P_#?nKP)9{EL6E9R{1e~- zgsFgx00>BJEd0AZB=8v4PF%wg1O%!7KQGW>+Y%!Xkgp;MVF6{g-{&8Y9Y(|66bMsq zm+f1ZP^>F)_2GMdmCLmR!%aq7dJHCnjywAtWvhWk_r{ghksH}-rwkBW_Kb396EZ!d3e2P7s&&hfAzyAr9fA!DO~KtGp5VXJyV(pp znb(v|AC5;9PVFYffyv|pe_Zf_q9lBBTYo{AR_yj&@AP~^Ko(9JGT&Fg=ks}=FI764 z%xWJ2N2MXTxjh(9rPFD%+v!`WH`^ z=?z`A<;dsyvFV?P-E_{;;c|AlkaI5B;`6pSwJV0#pmpU^tGJ1z{=x^G9Mk3_({p6N?wz08cf7$Bt&KN@7tvDM4N6jR(mmDxp z>U>}zm`Wb)`C5Y@4M_|*C=N=q+7nFN(d)z6&d$zSv#l-`9=iUoGZkvc zVGRyAyzgN3gC@)w(pUwM3X?{F3A4Swkqx(nM?3Xn?>&3;{zH|Ndg9^ z@@DUQ@?+?w_QFbN$&61l#om8@Pgh?hc`lhy7v7!45EUJ=CAN1^vUI|V{AjbNU-@fN zztDDE!VP1@gsZT7!;mJ8j45m#lYVl7`@`v`K3z}G4Q4qQzkMPRq#Y}QyDcy;q3D4) zhCs1=VHFr_@+qS87LA6e(YsV2&nys9T3#4b@Zj(7?@bOh7P|_bRQQYOSWB~X%asQwB@rgz7Z*ODj40C|w|4?a1tQCd z*&f?vkLug%B4KyI;LPy>Q-XTB!_|XSd3!MNprJgYCbcI!i&_`h^OSj{OoElc^0xKW zf)JJjk<5drUvS~YGjT(IOQQ_e?%99lf<1`P7 zFr^_8RLVwS7+PENOpC3C_GLhGC4wgI4v9lfLGx)Au${k7y9n@4*|qdUk&>FFA=c5Z z3(?&bz@BEGc!cx=tAS2IDNkW;g3-Jy&<>aqZ=xsl(|K&X-xAvQ{~8%WChBKHm7-^m z+GD=W85TOiZWDjvY&+vJt8w7G>kpR-FMxEq`FN*Dht(ngDzia%pyF)n0+MaqEHFQsT5LuJfXO6 z^VRV%q9Dk@`LOwrOnX1o>rLHzhVJ=#HZ0o7X@CAf=V37E2h?r(_7m)aV(I~e(hkOtX-cpOg_vd~^VJA7gF zNQ}0}dVa@*GzeE@%5ub2kOw*!1h^h?!D+LaG8KxucM{+mPYYFh1^c&|99&Xqdhek`#s+H$M#_` zF@b^D z%|PaQsbPiOcwF=4Izs}lG16CU_^iu5&zU8W0>sgEvf8Zh29+zya@e~C|=MwmtL8+FLR zU`79KT4VYqSo0_P$-H?-L9x8Tr2ZkVn7~~RBwBu&J49qwL`)Vs^$@@@Gk{G74*Ga9 z98fj*i8zh%oB$Hd$J1kf5XO!1H5J%0g)B;ig^L znNs7;?DZ(r=q=8%uYbpYP^>*>F}12ww|^D`t1d2hYvB452N~6&YugkPWWXE_vXfu0 z()$H<8Ucx>GL#O?3Db|AcJNvwmvo5VRj_ReBy5@|g^m}ljY)|gjorl-#HUrXpqBoc zmq(CuRSrp65HA2X?;$EChEqCVE7tpW`NEhHG6NN0BYG0}eY+|3LW{fLT+ z+LGT4-79<|2kAa?9OK>p_KU&m`!o-F4ZSbxb^&S9_yHy+Ca_=vy9iF#%k}?s5m}th zpYJbWVPUnkzci7(UMWkjYxxCUf0Ks!_x1I?ytohJgE{r}^za)R?hOnK9L>jCInDMj zExD!vn(@4?OIF}iCaT2*ezLK$SE-#C-Q}Oo&Ysp8=zBNHb}=yVx?Rk^jLni{NKCB| zQ&tFbn>qhNjV}rop)!*{JIS-26;%Esz8=QC&kELpZzpB;;86gYH)w(g1LHT{OPwf- zjJ;;UpwsPP{cyT~$7XYWb|z%9%I5S33FlRsMw>BIu&mxbf#X+nTq+W6L`rMv3ApED z)r;FfN^}O6NwImGCh~?5f*%ta5uRFH>ekFG?k=|8LjT(6 zt{p3&{b{l4cfH~GV$dIT&5RYZKGEQ1TpT>-yW7mnECKts0)j}td%+UL6_$KW83=p` zfa+Utj- zX>4~lUyy*fxVXByx`V@QbN9!^&W=8Nv$B*I$Mgw|m{=~)$N0C~2QbMqczEEgxQ&E@p58NDrvr?KL zxo`r21TBOx^#_ZITA@%AOim17<`T1N#iC_lVX;`D0j}^}=|}v_{YgD7t#ysHlT&6h zhEDDm?7c^UXhD6qNQ9HA!YKoTm&9~nbbNgL4RS03LO0*~*FzfgyGo&aEDrBcUtfSU zMPUDhU2iwO{CBUX^>uAAp0FNcU^B{GRpYBi%gyssxE zVo%2x$}bF-CPBRac)p&ToKlrE7KIDW{Sb3FIet{dzUA`$k_(~90rWTT^+*OT?t+E0 zvh@AR-O(u?-t_8FG+tz6r1>5Biu;@Eg(yT7-)lG$zcM*Fd23snK@CH0v(1Kst1A%> zj(;>HBqTaIdf2|{f%*Pw*W_o%U+tqc*&PA>2G;T!=5@Xri^0$uJAISa&gRX`EPN$u zqsdDf0DU%gQzOaJPGD%Rb&`R(qYTfvFc~ugRnHV33lA+X2P_x-pOoa4g(Y}>aD|(b zNu7Wp3T2x`JQUXXc_>JT-`zeR$1?@rg3sSOX2&89#??CRCOwrY-P~W+TkL-_G2z`z zPF_w=Uq3$!4-n)gA|N1q!N&C`|6kX{16`xmlbAAofYb;ghGX~6EdxrVS*lF3(e*ws zec}Wc3^S^#ZLb$;vK zhVwUyy=B0t`dZHG@BIWVg!{R)wBl*>HG`LGo6Tc?x$I90)jG5__jbE-m)HAUvK0*L z?fHd}%ie3aDr+wheK?lL*2*eK$adPSAW$&S`(r{By{*=CDtmHrvZA6w_wzP24q8M+ zWW*f^*Wj_~a?1@34a?Q4tE#J;)2*+%A3#laU93Ou+2}j5FmYQ?`;+D28~9X=589io z35W>cZtpr>PPk23Hd=h#r}DhtVu(2G&PVp|=U3)TXVDVs5*3jz*Lm1D?T>C*mQSwE zmSz@OpRRjjdb=*;d+Sr_1r_2_YwgxOuR7iyGi(VqeRHeIJZhS4mzplHC$qL%9gnJX z+NV<+@z^j@Qr_Q>rm}cEe^Xh(A|U*3w2+aPADPU`Nl8iy4i)QqIb4G|VeMh4H-`wR zh7m5Qj|-+T+96UM>A8Lrm5>;nDG=k^t+iMvb3R-2z8$56MkWk;L;BdBhWZ*EgbB8VhDJki^Ajrb(>VUxw(Z>wY$GItAAZzZAoG*?eXpw+O zF3DU;x86sawVG9C-gRU732KqRfYtky*LfTLHq}|iS*=w?T{w5W*|KfN0*Ywqkp7q1 zG{@1}n=mt@vfcGQf(#csELqY8ZC+0Wd6n+Rg5<>h0?|$Zy5#7X7^u(?tL289PUKB& zDRLBWXJ==#%?h@{L5fUvry#GIUW49{R)+&g6_tfznG8JzW##z@%%3O%YQXA9jsi16 zz^iz&{`Y+|>+SR>?j#`>9wvUUXrLEZfH!!w1+8iAL`>}0sVU#vapzN$mHOHO_527q zQO8%)rX<V zIB6Ao2-ce3+}wpc_43%ew|lZX!(f61zcI1?`W$_34?b-&u`{GuX6fo;yx)-PTW>>3+5L#A?DHZ`*?`-5Yd zfooG%9cEcBcZ@Oc6Wb!R4W2q;mc8De>12YF#e$?^`SEf&IV(LTKQqm;3ft@XF*E{l zQ2lE;Sm}rYTC~=sracw^iIt9#@pd_U&!NcRVUi1_e*W*r1<5Zj!4!!HrweCb0*>0+eR)D+43{XdSn#L7J|E7H zC;a~=&jeud^!@W}8{NAQ@;2!?IG`g6le4)q?b~V^x%1Kg6$0&hvD&!2yj;Y0WVqmY z)!BT{0U@>z@89;>fa#Q1UTz7jcR&*6IwwBH<>`E7Zfz}cEJvAa-QFRTg4p%j%0+GZ zJ#~>)abs;mbAeY)dqX?9W695gwq-ywxu!b70v**6fellZL{E+R!5Gu9Y)|*sb=H&D zM&}?Cd^6qFYQ6PT@j^y|0UA4eDh7IJ<5lOKjk!JS^{Hj|O5@vHU?{T8)MO^NI~sL# z$0|%^hBa`%5_z{6e0_eLEmj8p2@F|lvc~fuNgU;U*-wqJfD(^^-J(<0 zbh@8EENH9a_LLHjH3SmUwV@%K*TmDMz;_0+UEgY`CeR zL4d((r4ATwLU(uh`}^}}OSWYTnr$16npWNPUm#rI;E<0LVP2v@Qi6|RRR;~Y3$c%p zuaWpMd%g-iKnR(;}P*#t+u)dCXGx@0YX0P*+1PJ z%&@u}7?_xZ#tAtb2FAz7f3f&;+5*3Wg++lD&I`DO77i%Sz-FYQh9J`#$X}Vsvq`p+ zWL%@ielS1qc2JP|9U|sa?CFwzq*pEf1JjF>z@etOT7?*6Dq=fJ z>WEyZGjIZt_8!~222kMW;t|5@$j!{SKD$V*G%|CzzfV?CD_F36Zp$y&R99Em+RCx7 zOobt@*|2tOBqarJ1itIkR#;kUo@;Ao<3RYJ%kDkXzfxb`n9%``NtOx_En+Eqcy z+gyU8IbGZ0)nC%&!#&qzxo^}!L@kK*=^soC-hYK|7r7HB_>G^I-OH>^e6J_$qZvBA1qEuo}sSTlziTC@~;(YX2^fR^esXHllx7kEb?>Q^r z()m9bUE?_vgOP#ZJ#`y2-tOwsx*fdpIa#SdfD)Dd-pSRaq51LADLMw>;lZW3k(Jb7 z+Bf_8nI3dO)Y#ZqNJuD*CJXshQ2n(Kh8c^RhMHOsztQ(Q@O1w*FM^vil3oMW)xFFG zqxlROsEh>!lBy+hER}&d$k+4WJvzEDh}BMdI89_fd(d3;PbS-PW4(Xu*<%MZetXv| zwhXL%&}iBcb#|~wm_!A>Bf{-;TOKl|S;;#bdWwJvHq5K_Xc6bzKi1Xd#!uGL%Be&S zg2;~vMgkKJMG$^H2hR+-&&2JV+x#t0Eygn%-(m;8*NoXf9>t!!{)FxLP)nO$_4SD;oIgd6t%yUCFM++=&JJP!XXEkzi_=ZTSL zgfw+AYJmVi;pa=shn5LO$>2?N^Ay-EkhOchVU9uhWb<}KaURe|ky)~6jA0K}3>TGv zdUb}492Cq!=NA~@`+_ypgh1r+z(ccEqY=FlhYE6%KTa+G5hsXNdUlmNDB1F@`8vm# zc)$Cv9xIyXu^)T3sb9QV%%YsXiWK(${@mxd0D*GLt}q$#qQbNa1@-Sf>zIEBL4&J(FHqB5G^1rTnL5G&GlLJw4EvG54CzUo{_m=v^n#P@TxMyZfJZi?p>o>%a+o%oj=v&XR^xdWV$Xal zii{2T%tw|N*|D2W{j@?BFH*#HH?s&xaS+~qj4e@r7Wm7V_y(2 z`-$7Rv`KY- zK{tT%`A^T%pfI!esgq+(#KuOOv6O9Y{?>$l*9-0cc!?V|n*X}Iyew{}Rv=p4*^P~f zna#P5-&|UPZYHE40g!^fh~z-e65s|-a(iLzJ8;m-j!TjyOis!&4^)%6O4DYU=Guh? zz1_i5owl@^h0FR;qfAV46eB4!wyKuq+h+uKgkwhM`>aCjN)|adI3#EW#JLbXSKfUG zBCr2iHxV~6+VM|$iQT|E*gHq2aXvTOi*yyPCR-U<$&rcCvhqqBYg9rm7X;bvy(Sz^ zyz6P(FDcN_Kd<@@-mQC!mkbNpWoOzZB9Ra{0QIFI_OcNr}y7I+n_>~I) znEppSbG@>$wCpEwPTdhYbK-27w_K`1L`D{ag8=EgGCL{s7beL=^(crDGNegHN7e_@ z(7@(|Bp&8QC=|)r$thQ4m5MsA3`$0ck}%RK0$dRyS?MXOp-Y+UPo+z|9&Dke=P(62ZXRp069(y zl#~dFR_WWBhy!`Z1r^LdaBqq5n^q2u2WJ+bG!@FXvA&Lg?KK#Ic|EuTp@jVA=!Z~S zTMKLu!^6W%OG}kOARr;Fmuo;LorHx4bUzk!^A2xs9VjU&=V6aN|E4k7cD+zI1^4Qq zz(CmDKV5Boy`EK5l9T84g=U+&VO;kC8$%^sU1SNzgE35+KEH+r=3`K1|FP=dothdN z8VU-ahH(jriQsCyTwHh&!5-IS+SF*$Si{l*iZmOw?ou`$CPFHRZimaTPo9(Vs6cSd z)qK@rzc;kKz5Q}`G(I*~R#wJpyXkc@TSUO+f`Ne{?=Hj!(qqH+Z~k_Z1n#coX47t2 zA;KO=>-|s9Y^-|OBCpR@Q@-Dyy{pMYQ&G_(K@d5-KKUxd>vtzMZtwJ+_p?A$E1Sg$ zIh>{Xy5dL3aQdL>>bi7uqtJ5BX1kdrSri-`3=E31lN0|n8Z0Rw5Xi{Ur9usVvf9$n z(LD7!TU<#5AmCmcM5gK)dwcIaWxsr$ulMm#rh<#bq|@%F!4^phdAq^k>W)oc*F;4j zgu&_R`Wh`a=sQX%m>U`0ui18c-|m}_#OCJ4?G49HO->3iWpX%H0b$7NLq;5xCT*G> zL&ggLRl0+rM$?*t)RZN@w{{i7;AMQOyUt~>Ei1$IVx{S60sFU0t9NsC{lx*ckNd-I z?%+5qtVB#Ha^m2pCZHN6CWf9I{2%LAgsvHO?5EoAX{NMr^;3qv^k*$cyGKvt%s6K6JHS&;672YYa1U1$PJU_~?8^lXAK9 zYz`Pjx*w-%0J)sUn;Ua;^Z4*^W()pD!x-q6Do?_2%hp^2~W z*BoFffrfQ5xA}aztGzZ42MT|s%}{#T;bWwh!IggU??RFa1awGJlIkUo9fnED0!!6O z+s25!Ljg_hE{}utR``Ho)p@ViuYgWHrrP1@Y7rrVrcQsZ&ai~{^5HF_y8fZUw8n@ zBi5=9WlqE0IICSS?trZ7Evmng>Ytb8t~MMmZ=y~Oh}pc(KYsmUVr5+zT#&M@d3;2? zSn)&=f)6fOI15{OoDgCi#Xj<$_UM5Y^NVW&lHdO|{vA8qRJZVJ*9n(|t$~S2+2&Mh z_3kAjGFzqqtqHC_VHz9-J~l>XAE89jkB@!2A>!9vdtL|oFEK+YS!=HI^YiDcjX%lB zjSUP8^!5EW^=&=5#iJQt`Zhe-knq>D64K-1(;N=}{$OKEU0i(pctb7*7)N3m)idob zl(Rm&LE|pG&b2>b4h|Rxi@k2P@vN-*-t`>>wFrj=$!NJuMjW^sC+B#zxoVOu^@+wP zolG#Kythns7bZPLSyN1c9c}zg+s7RQ&I;(dAF$P~Md%Jpcs- zZTM^2W6^Z%>_NWoFU&dBzP8xfns$Fbe{(Z>dpp*=<>7mk9mr5!*kbU}CTCH8M)D3` zsDy4(WN_elb-vQIu`~y687!!8rXHkfdVG2k6CRm7YE)>02Ux;=rgmS-DEU5XiPtI= zwjAs7Qxfj3j&X)9V=)OoMLt0#>aR`JZ?V|S^)_RG{4^^cC5P`N<5+~qEfawL*!df_ z?DuBhn;tM0UOp$H<``jz0(I-LE8Lzw*qDR1I9RuPU*=0{F9)<-k$mAaDLD9LVIdg@r?4z3DQR_8^UWhd zL<+UXKV+K$4N^}hE zgGNoW38*4LZH?aws@jPOe-hLGmrPN*`cNjD-z(j{rDd?@Zs8)?GsbUXvu<(q1S3R=Hk|U zUP_u5SaK9aH=X^%BAM0Km)7WknE4RutrU}yl_g@vn1)XT>W04!NO$Ipo`De&SXX_u zXQpP@X8W1EFXo+*%nb`tujiNII)s|X*KpP_qIdXL^fwx@!67kbiQu$FI5%-)-v$NZ z4X3{(BwFn^7Ka)9(E_#v2qx3{Z$^x_KfnV)$MMNP1wk;0ZI}~criG(Jyy#aheG?}$ zD&u~7O=y1e!LENvV!*?ffAB0fL*^e6Y+Lh?G;zfQcd`L~5cO$%5wdr*RVo zj6&2s{-Q3VUnd4Ml0}M&@AmxW!GfaXpqaK9%xTh$gcgnIKJ^-Osg{ka!H~5xMoJbO z!7&-wCo&YW12sK=@y@^=rna0&IF?Cg*gb>Z%L3tHg-<$UFl zB#JPFZ=Hmn^tu|LMmFbjlou+&FnYHZ{h-g zqIsi-GI8Jsl3q4(g=f_0Rd!&9qZ+(goD6tfXEBT5iTw+US8S=kByCSa&o4p zr^jv1&IX``5mQbCvI}ZP6vIQ1De6*|l-k%@;9FrLHN!!z;(2o7a&nzkL5+y~PZVW%&9dMu%!kUp!5xXmXxeC*O4>@Du%$)VII-#ZRe5>{1$ip7egi`xrjY!q zrc%Te2y691eK9dLDJi^0tdzN5L5&j=V0pO;)AQ5w>hvYmpc!~)nvjSW6Ee|=&L1Bi zz!8X%@Xy&^Kt{+v1#$-uhCLd|09Dq=P)RB)x3Q`b&}G@;sQB`_Dwle(Rg*lI#zE>k z9zRnS5XKPq1W3?;&c-e3En!SJN*7>~s9mw5NF3E;_!ccH3^KeHUBa1X??H*&`QUrg zMW&b%Vp5-$Le7SF!$zt>6LyFEO`ZMc*9YjWQ^1gkQo0OdV06cN*c=Xfa5!E9F5WP? zwW82oRGYQv25%7+@n#_m^v8C}^EoP0JJf{NX$Z_jqLHmR90G4K0`Dp{S7{v!w^D z2*oRAWX&O{#KDgk9H^%c9{c~2B+n*bUHO6P4a*hRQqk9j6Pfb^KiF+HKI_Mud|T4F zK|!wKpPM?KEJ+C~6~h?^=$9^Wd;VoQYYDrJz_^-3cC{TdTqqu5Pv;P>(|E;93I3FNe}8dP zqHEqRQJp$_fuQv~)pxYNP(=$S^WUNr5nFwwDvlUrsbRokVUWC0?OE7V8urMNwe27 zkoHd4=B}hW6@9uvM94Yrb9r~;kCj`3Xi?W;qefu(PWygKk<6XR?^rgjD?922!D&pV zqqbl7*p_hYS=R!|l5d_OplvB-kf&FQe9K04W{s~v{e5O;W)L^bRrU~t#)Ey`Y<*;| zj}O9%$x_;)RN^~R`DnS6LhRzuD0`K;Xx3c2eD!|Wpmu1~S-j(hVwH^W@{hf?eeKXB z%Rh{4vguq{?D^;(g^itPrP1T%7IV0?oS%vCN%D}1iF?3lYqW52y3{cvw0JW@`}EKb zzXc1%m5Td7SQ7%~Aotu((}rd|68{`NVq~p2bBLI7n}sCiGHR`bg^Sa^w$|OYv>`fo zos5z?`-)b}6oj_;9F^^yvP0jGBQcQPy^^K087fiay58K-9?~g0H5K5b6*bd~CF`z}Nt)M?DttPyQB9K-f93Dqvj|B%BLzd9`iw0XpeLEsb;k%INX zJbtsyRJbv8(?#(n-@3%EnlhS(LWqn5lRuQt-qYRm)UK0$WUnB z_dzRyf7%4Qqp$^-I}f(B#qOo6Wa^17{jxR7nPZbNPp3enb!=L6H>z=wXeIo?Ra5 zvL8ZXz!xO~3%;aCdTwbw_oGNNdES7uAfM4b5zS_+^m$2bL!))v_JA(uVwlt=Cw$dm z#B^BUD$vx+m8jFSCcaigZPZL5e`t`M8N@veL(`$cJBYKAgNHW5YawP?Km8q`G<1U}xtTKWs$7Czvr|LK<5{2=M=cx&v~BK!#{;ZflH(Ou!vaO<9?do7;+a_63#tWUN9QvhCez@_m7Q@`T5Dk^l_32 zV}_v3O>HCux|*)y+|p{V#!D;GZ`C}L*0i+_w$l~1svLV8m{GJPM29~6s=~o^W$rz^ z4Z9oJidjA1d+@S8Niu(l@}zJR(M}2C|Mo#S+2n8#S#py}aC=obG|6K0s~}s1|v2#>0W*uJUZ;C#2zgPL#QHXUrDL zM}!V`20LnG_qC@o#j=~`M3i=}2v22wFt5S^k&wV;m_7|7d~rG2U>X%mn+ z?wDW=_k?0FP!#n|T=FI4)ihLArY!B3HE+(cY4eRHZw%aBr8Y1K)&i7r07X5Sm9!$60FQVbIb5MEfPo^v&#C z<;0ZjHN-gsbBgtQ28rnCvk8fe5s}pQoDS9TutJu5aJLbSl2&l9=P;!(zNCru8o>wT z&Xw*9efzsmQGse!lM_9KciA&Xnc%TmyuP>lqc=D9Wr+WSmMPnxA3vbr0lzeNNNiVJ zjaDevTzdr;)mzOgMaJyw@zr=uc`>ydxbsY+rDnqmL#AcZbo&c+7xWZEsp^d(vgy`k zLWh5(j%Q?KFaZZ4Zf}9oYh8W)-tO*X4qt3bYO0#3Xo`Yd_QJwlBIf=gSey~R*T_4p-D4g3=5BmkqeWPjSQE$eSq(B9R66ORbx}zYM9rq z8^i(_C??L0NP}U3?L)Q7M1}=*)sD8@XP(ct{i!f`x=y;I6Y!*Ox8ia%Jv(V{m)+`c zyI35I#5QKc*`iA0&%NXOx2kL@_xxy1)QVDn(anv1ujpC)5KF1lX$G}n!~g9TKZl>n zW6h(){;cmdCuWY0C;4DoO!v-Qa`qB;sr$1{emmBws%oytNQ&|LOeY)} zAxu+_O{1mR=Qn9lB_UD*m8ODtu^vXYc99zK3EjD70FA=4y9i+|0Z2_9lkc*&d(lSdu_>Tc(>OznK8%=%9yvhgBxKQfkv^| zI~zyySnIqGNBs&>Wj}}dseoq5D)w=Y2?%sO+h9D3^<)`d(0of?&#H;B9wvRvf=~W4 zq9gImb#sjp8S38YK~zL!z;uudYrrI>c-UybIQbA;S(&`h1Ym-NnaUaxLQ!0_j~?vj zVznQC^S;g|b8q z9vYgOqYJVxU}VHBSg76QHaNG^SlgyquB=`G6^S@VW6YxRQBdIFc2Wq(WUAzNiYmKB ziYMFrO)}*E*GZ>o-*~gp{KYA5SD9*PDRw>-#Bb6*_DRmEGz2P9;l89+r9Q}`rh!8k zYFwzhpOBz4wH(PJ3l}WLeYcDP#%a05+Qj02e^8fN5~L|1NlPrK((&?)TLlkS9??MU zdYmD$MmH7Y#n-1ZkGbOkGF6Zfs38RHZ(u0@=0rTwbS+nxW7&gy$cBRnFRQn{jvaQz z5GsPt`$v26uITMGnAofV!n=KzJdcv=(0!~wUrte(u(fP{H`06D&6H#T0*tXp(Bz@O zLxGB4YjZn22TQ5)AKk@x-Sy0zEqQr)tpo+-Zx}ebE7PhvYuRe@i8)#VA+Q;9=^Uu-x`T)@ZL#^gUCx=|Xov z=Aiy@=9Zg$JV^7j00~-&Vd)+bzk2i6aoq$So5l<>9QbWIx8*E9%WQL$lq?Uw!B-4K+rp5bBSTVi(h z`K2YIvF|iw@24-3#*mQIX-T%5Rt;&AWznqiV4ThO{wpDBzq!QIA*$*;a z<6Q59x9Qfi!Je7FW*P9f)vp+5QAX2DI0^{IgqORgxvkCB?7oZW=qOaMU|cXE+yWY9$vkee67_sed?|DJpAhtj@5gYO4#01PlrjQjSiJ$x~sVd=pMn|9dZ^ zqD(1{*mUUsD-5Fh`JU;igTCc8r|V2yUM!i@)gv;NRck+aJ|4A{04 zW-z}1Lql}nLk^A(4*sm-5)zTo(Q?w#NH8z~dMyqI={d2!lG=Upa>&4uMluYQq=)Dz zy)>^?ney+=cq_vAY>P@ni;B){Jy#DkHL286i*k=S@v%B8vFj=i?K1G(qGzNWclf3h zvhG6NCFVmk%69&PJQJj^h3i962~asD>g1-ESp;y>2vR>r1zmeqWBeQP+b->4odO0% ziVjlE8$@^Q4DCjqm;X{bE2*?<(4U-CVf^5FJCeN9danwybs1a6S#_&3;+$r?bFi0M z%`}H*2`f>&;GoWdsLUeJgQ*>-vdrwrDqGo;LrJs-e=8fwJ4c z%!!V#Ie!QIS4}x zi2h<=+AspywUYcFpMr1-$0hEQ6f*Y=RCb%}nN(Mvw+dC>4Pk$HN7Un7gx0@4nZ}-v z;;d!y+Oc=OS={7m4d%-E%#CCQ$dbmLT4gGhPL7TO#bbYlu$UM`BqSMGSwsYcn6R+h zo14h+h^(|f4LAtzl)>N8wli_Rqj`je>O%(wDwOYypo5{sWLT8LS<|#BB(>yq+f*AL zva($jUUU~;v=*PaWRyAMRmbkokW7kprD)I5S7os-{bcXnyNM0TxH^QdIfV#a^{3C>KJy{|TXEDZJUe^pz zEWS9+p_i<7?Lv93m0Dc%JN1^hSTY>nID3^MA96=G{dJqeSW;DSc6Axhu`LpSWp3A# zht9il`B=VGWyPWCu)7(i^ryHuwEdX7?#<}rkf#=Uio(o2IG3CRRCA(mVKgMP{S0?J zDzi=bkMH$+S5yK*yei#{MgDH$aIpx^3ORT`lRL)&6wga$0PJoUHmpNyCa)@(AlbK< zYWaSo*N2A3__T^KsIB89EgyXrftHSRG&XLh46l+WW^gP7k@_`s@?&*^IV_lAe6yS<`6d z*OEpth@(mEO-zt(i5VF=`MT|LZR7r8$Em0WDi}7MOk|ce)aCoS4Vdi)gQu-C*uT2V zvdvP8XP!o6+I9oZTlMixI9&i`AMe|(NW1yR$H78W#VZ@v@+G3o4~5UgrR&exq-%u&8s zkvxuPNzI;7C-G;AOHp$TRc#gZ&xS*_4=a1#L8j7JOw7xy#zjf|x}tD4rl>AZ4t#Cn zbk8diCEc&AP?gO)P_=HkPCR#fiUMPItQ_Y0L@r^l3kd=;< z)LLJ^SC0f)&`-4MCviilwisc88NoMn;HJY=+q#A+F(-->TFIqCu5*88M+Z*t|JMfk zweR6>zVzd3><6h6fX~e;Ths@?(^T%WqYfK8Pi;w;AyAzWHaHmk=GMbxOrRcVXA39H zMTJX-_5W2nwbBcQ`yR?>#DPGNp5j#KGDXdoH(G7G=j`z0d;6m+$du~SJKhx z!mql;lA)+fl%BvrhSeK}y5eQ*nXzm{fNDuh=upn78H&9sdRR+c(4vUk?XEz!9Hkm8 zoSB%$$hzK0e5xDwgz#5c#u87g(O5~__{LAy>;@B(O@Dh{^cI!FfacSptZZ#9NSSPT zWK98)Gf}1Vh}DYcp?t}udX1p%MEm^>G-Hjs@dU?a3HwS$6Xm@qXHKLYf3`A&eF1?&YZe}hMKBoG}b7An30{ex%m%+ z+HWMFDRE^r5wXY507+$&DsR08UyHoLu9Z=?mcpuJ8%B^mKcA5RD<(oO#((INel|20 zzI9m$WwIX6Alc=Hqy4(da<*HNUbroyvk5Fb_cOjP(fJ_>97?m5pHsFYZn*7NX{((P0D`Hg8>dv_!n|WYn=@;M3uge#$K%@yP?+C zh?duU5CMNN!^6r;lA}+>qqf3&$nVhbLUISex+i6ld(tlP@@xzn%mr3+>ZCul`WP)3 zCD-~CZ@;6FFwXWfC7{7MF#Y_Q05@(>FV&|ASFR~0Mn2SqgTsj#pIODC83py32H_(t zT+bxn)1{I2BYpHX2)vZ6_1k zwr$%sCTwhH&$Hj(^X~7v4(^kgv$^NeTI;{O;~CmVa>8kxIqa24UpoCI&6t()6jT-0 z=&V6=-msDKZH^kzACJfSiDkYNjw@GzzdTkeH={`G+=N^yjUNWPBN^43cXA7<;e_&z z@f}%lTcG4}YJ7a6etMQxT%vMjR(w{xa$-t4DB6#fp{$^zypfokt*oRY**@80ziioD zSWHo&LUVi0R$lx2VD*Y;UV9V|l6@gjLQ#!2Om-|na?0`y?|0<;J+%KHW-tSJCYJx& zU!D3o`lKbl1}ZukQC)0T<#g2cyKY@qHp0})m{Qs9O>y`MU$)kafHIasx5})N?m{>Z z6z~q!;Sx+6_m){YbU&vir_n6@SQ{gusywEle%1FnI05^>?|99!kLdnnnuM{$+8@DA z^G=)&y;sC>mJQGU;#Xg1Q<&#a;bGR@;aON@Sy<#*UgTI^+*w%M5$*5pK5HfryeiCf zZEyeETIbp6E5^;B8cQE0!|pa=ngRLw04_q(X^UpY{}NxXBdq5GN15q+ zyKbah(X==WvuF#kPI^HyU^&YFB4L zq%vA11iU2WJg0coHCu<XHaxiH7AOSM$ z0ySw_%+mIlsVse1Lgtf3B5Z<=JFoUg09^Utj(l%hMcd)!^pkX&^$AEWA?+4^yDq zqfUtUiJEN`ZX{TqDjsW6ugN7emTByx$4v>4EOLC896FhLKi@nr)L~kd+2<*HfluW#QxE4v>UZN=u~YWTZ^eNl0)qcFD(+ zq?`R$b2O+0ucmOoIo>yx4PXL)=nqRstuG04qQhg{bWoUex{ z3uUbL1+vcBR*sLQEQerjDvG4Lmgw_)W=enJ%gfqJa2e!WqXsi=LL|`fu)ovVP)?MS zQTPwZT%ibSJyCjQz#n>Mxo{O0l2bYz{To)Pa17I2R)g2cC}$5jc6xyP1Q2aL_}5K; zWClMhE!Cr^PYNh%1*s#Y{V zNCE*dP@y|fqHg7XWtraE6NY|x(ap~ZE?zN!4vFeC!ze4%#$(q=vdwDai1GeTnFXsB zt5meJTuCAg(5OkQWEKZqt3d0|Yz3QXQGjxo4P2RE(Y(2{zMo~FR+TEvp<^(N3e^xz zlT4MG)uL(ixKtQSy~R(QER8bd@Wsu{^o$jIl4#ZZxiMCnHmxF+ibk9QCBwKe1h`IlTRL@kU3Zx9xs4HoLWyz1vRaP5u;Ozvszx8US5SOdbvLOivGnD={3O5z8%~ZfT zF497wVb_@SXpk&Yw0xlHf@Py7WBw%)pk}jB&KW!@lg8oCn;#!)mB~~kQZ?H94cRyB)yKPL^Ajh*xvkpUm?*$7zXYhTGlKr# zL#SygvYYXLI9NL6DZ zRS!r`fdOt9St5txfdyE=2IQh}I;x-`G|qG5(+3CON>PAKgVg-ffgQVT=k@dWrks5?nm_ zg5Pni*Fg*1-3%aEvQ%DZnlNqMRElUC4B&N@Cg@_b=gykSWyxq13!Dzil$Wa-hEX*7 z{VQSESdEnRWXYpSu%_X(39obkFwO>5FkGsN`+x)PZl4+?2Cub{&gxMhXUAH~RvOKM z!v!8Sr=?h>SHqDegTdn7yJA$ARz(r1YS(;9uLgd;Vlh>^mMh%DSps|7)~wFepAZ}T6qP2$A#>VD znY08O3Ol^4cF>&Fs>w1*t9*G>A#g3~9iu88o#WJoA~30B&6o-GR_w$Xht-%JSMc>w z$&v(aoAR~ZoJHTOE`1!e^u zMRhejO;t@jokVptH6V3=#!6fIYHNlH>+(wT(#q1R%1R$cj1-l` z#N>kM+lc(}aiQA$&er_OcokKKN-8^wN^_cua{7vLGP)`T#xe%RDnHo6!8Z}o(HPhu7}+79l*y2>n>b4R9v(vh`#vnm^#YFqQFYxD4G98b$|o;c|qAUh0% zY}I$cyM%_eBH`62lJAY{iyDCukg|yV#ip&J0mIeB6xjjIP=;243bSO^)@bZ4@DMgr zh&EGfHuOnBVXPdzNVY#+T3|eSO%2r>YIUj5+1c0{8yo$rrs(ObKsJ(S`l{$EdRcmU z`irX31;I06lkdb@m~d9L7?6rOFzf@hE~^yQC@|VM8QM6#$;s`>7_91{VjF^n!dA+W z$hx*c4v3{9esvbMLSU;16LXM)%FxWYV0pO&=VyKZ{0sUIe0pIM(P#_F;D8XhtYs}- z)vJqtPQbyN15i%9!{y+)jW$$Hm(OYJW%9+-Y-Wew^9BxmBP~*0UboZdtRMgSJW0ER zL6^(r6T$7QKX?I?F}vOVa?|vNeZFYCN_{IR-QEjAcO{%Feb9|+(VSjhP7lG8S*6*nBFiJ-Oe>#Nv1Es zq;X35&DoJ}a<<|pMr6dny;fE7a=t=23eFT%l9Z_Oq84J+ni1RTs2PHcSOUhW6hGxR z@Hj9Ok3UE|p08_ZG#KgV zs6-o!x{goMXfOTe{KMTpC5LQ(4OQ1AG0dsD21fGb-+CpWbt&&}?ki`K-dzT-aEY@& z7p-uM7IBJ-LKc!kmlS)7iM)x32bmbR4FlaNR$7OXwF%OvAEm2dWGcEb zlcQU$oD~f`wx;6nT3VT7gW#T4QDay0#ZL*8pEcS=4&RDZx8P^mu+vXb)X&pYj&igP z(p2`)6?ajU_wh7O@N~U+IInC)1P!zfx~@BWfsQ%P-)BnkN@iJ);~M>d@ww9FWtEx zN%ew2b{|c}1T|SgzosR6d$X~Usa=JQo(bu~e$-oyeFk4JWXdd-ldF@5T0q@s5GybsIQQW#DhVotuRRrqq*pE5$}YLsXJ0|s5CsE4%LD~>(R0U z0Zk}+!EDJ{^XN`_xo%gG$yTrE~~9Zsyc4O~5DV3N{R${d#FW|9UUy6!q!Dm}uORdmG((zwO2k=NmGH$!Np ze5rN-ahWM+WiB6U4+PFv5;JAM+Vq%IN`4-23C91=3KxrTadWa1&Qh04~m! zXtN2DQxf8cyYu!Lyv4PjnJWaDNCWGAaiSqds3FIVA;;{Y$8hfKqCj?{0Ov)tbm9Ns zd(|$~fxCc{P8swMHB&8HWs&HY*3}Ed$Fyj`0mol7hl4#p1#%FPY>nh*%WPCu@=k#w|Fo28xs*C8CaTmIc=6 zm-)HvRsdUrgCVycTF#tt^gQEUo4AXFs0H&uL8XZj6reZ^`EN{olyBb+PDzZv;gb}S z7V5M7hGOO5;1K6G>5YV_(}+S3)>+?PCP8Ku9&mn)&TMx?A|Ym$N7h`$PF;aa;V89d z=hQ}t<3CN%JIK&P&7_B!z($bNhmpxfk~xj0Ka(v#iD9sYpScXD!HS(Egq^&EWyF6N zzl5PXiK)i>!FU#81@FtvseY2PjTJ{ubop1X#LBTt-X%ldC)QKT3FZn>KqJc@Slj5Ms}*O)m>ADFXs(F#M)i+m6B^i> z&65$0_k8f4XxH^hmr_Rl1Qg&TS>rfm4OMOR0I+FKS&oODD?AIQM1=wkz)IZkN2V?X zD-6dXm-zk_@L3y=BH~rwK5Hv-$}~S94MnnhgZYrh7zbwm&rkpeW_c}R5rhc4^vA$h zQsB&=uQW&ENB3W;?yAe$0J%`+y@SZcSXlHSlDk*rTN574HjSS-T)aIAW;`>?*8vzo z5=i9r5Rm_!Y(UZIoaQ*!KXALfjbcae11wg`(iw*s6$$dASAQt{QRUv}wWD^m6Oz~? z#lY8oXS#I>@(FBkY-Z(UPq2)`VTu_+ZFIh7@V!CsUo>?$L3S^_U;Toc$yUiyT{wHK0*vrD_X}#ZKS#M=~?R$Lc`+93GDYO6WQ_)@s!6wmHS{|lMsDe&g5Ok zZm=*t*@}!vGJ;zPOs5iLN+A4)BhPG{ot)=y+Y(o`3bS;kZ$9oGEC|2h?q#f(G(=t$ zkTaieiLatCV6dDCi{9%uP@cxD$>S+H@J$rQSqj!TDr_9+`{ka{4J8bFT*WrFR@eQ` zA9p($cA`vkR0I`Vc+iC;Sjul(F>L&XU(*(tue@``PO!No#nZc~Fnt z4@DR+Pv5pfUk-Qq)wBibs0I3{5$ceY5!HbQbENQspM@Lw)vPK06o&`JmkuBMH~N2q zp8pwMmZ@ud8IUeF#9<=)5Kw09V#aKRNloKZJ&XXNBq~YGjE^yha1o&uECi@9h{c+P zjlccCFatxXC05K4YE)Tx;sxCmo{AV(wHyLVm-G_^3#vyTUBN7-3T5ilZOHI=0;PP0 z?B?L}`(2L*7dr)P)n>apBOCdGA^oOn>pANWJAyn7y6l`B{T`n#kevM_0Gd2j`VUGt zFckrQs>t9!tlYZ{bAFp!SoD>H!nZ0hQnM(=R@T;opzsD|5;c)P?YQ|Y8~Y*%Uz19Y zmnC@}JsvTMCW7v~Dk{|1>bovtZ>ldMC@5nnB&28LC}-+ot7<5yE35n0!$(TR!`j+V z(OS_};W5r^xYTaj*x=KEX!GWr-Fl)|M$p;NQ%BOw%~sj1xtFnMoxXUGqlv#b>fOus zYwZ)j1u>5NcEO6oT(d=4wM^MXQP#dA(9p-$%t|Hx4gdS0Jx4xOp5-cI)fh(?>}9LA zmyPup5$~<@o{)iJkGiS0`I^1VLy)>lsF|3R$l+>L>RIb+8nD>C1X!Fgr@GCh0N=$> zCbW|&*YlpeoB!$8-|hEKkh96~)oJ?`upM@bQfNT$NP_gS`Os)A3AyoZy_i#?IE zsHv6C3sY1q&FO#Est(pUq#TeNuQwPd{U#*+>UGEC<+T2Ow-La9;6h4;oQ?mKwiJvUc$MqRAa6YmEr}kJ zrTfVRg6{p_A&>dt_?lb`y$!#ay?cHX7ZsAYua-7;c8>qbg9)pJ_@eTC{Kt=|;^N{B zWiDGs$NIuTV^dSOhXhZ+DCyAA>73Y?@q_D*WJ;D zbV_w&)8E`JP*h+6l&*W-QJ!?M&H8~;QxboLI7#`anK6z$Uh||B|*VtafhsJb5_k!cN+xw_3b^r1^{@tQ*+>~2k_?m{o(Gr>0FiRn;DggB>f89Ks+ehv_Y!o`4A#;Wgf6l4u;Z3e z71-k#G9HvFo@6TIiI08wPtvy666FtLmNy};1Bq&8X3fk?+4wd;<0JM4b#@r1gl00W7rVjFA zH==6mT{Uw<`;c$(M9r-%%q`?hO$=lOzp6_~%UW@j`WTgA$amv)d?~AG3R^kK9kG=9 zsOvD|clCr2QM;Hk0K`Ou4=s?uCdflB^nP#>Lx)@fFACxkO3oTu&YA>frW`Xp%=YF{ z0tupQ??jPn;4ct}=|6*?9$_>vl6e=J5q**nW)$}~32)}?=3{PSJ1`%k4UB~N{mHol zFlHVZExB21sBCQ9s8^Gdk+IQeu>f-4W@JE?62kRavIvodQ3NNSir8)raC=O!`$T7S z4AXBi$?B^k>@3PasU7RoQsHoYP??2%$(j*!BDwBV-t!X9`1N-xahTQI#-A-vP7eU3 zk84a!fWsm~J#UZDD28)yk9f|1A5+s)eLfym7Ut)@yuDKx_4x$^kecid$CE%=77+2q z8Kh}(IfBqJ)cpLPOX~W;QLsOLJl@@bkcn8%-+>V6fdqaZ+AX#=c6O9V_@jpk@MB|R zpbwvc3G&M|`Z@Xv5Lvl%aU-a+Y+*tD{YDMJR#({EJ~z#-B4QdY;P0M}v9h*=yq_oU zF_q=z>C-`%fZgypzcQb%)8<}S|0|giZM(awVULpe^|-|Ne!p|5*hz++cf+sB=GxBY zUKubQ$EyVS?u;l}6?Ykv*Hm_6d0}7-o?+XF*XL&O9XJS`DM?O#L6+YLuAy>RT zuYr6k!nZv2+DBUnmU{&y>@p;s=y4xcSC<|a2@POt^f#&l-PqrO;dG}%BriAoHCqA| zYdlpb2$L3wjAweTn-4+SBp3x!Z$j|g-t!rwvdU}phLBlc*!^Jv3^j%6t^543s}YAh z4EXIB5bnszvlt00sL6B4SsR%;>)06^`#;r>l9VFX<=n~axG&r}+Uc5&kf(@;*z#~F zvYw{wV=98k%>&ZwM2JCb35?){Ko(fdrI) zw==eO1hPgpq@I$_rCGGK*ls>N!Di7PGyVkaG1ZVk!n?7e#l50J=b-{{S5iLyMPzNth2YWT*F%nQY++q2=6} zBja*N$(Ptx+-oZy4dwGJ#5`QA70UuGI~=Z5oF!-^#8d^uRhC3VWoOWgKJOemzGGZu zq%F2YZG|>dC73B6Enl8PJmgGW{LQ62^|dU;g;#Y^^cTK~H$_`F$IcD{}@)rBlw zE}SGaTumNKO&+@iTPZs`KFj3grL})4$SSDm#N!rNQR0_U6_yiJ<}x(4ag`SdvNxjM zCB{l|KVw^(t$8ls8X9m%l**y{oq`oeC4YK{Ck4(8Z8;3_@rSd8n|!2rD}BCT(r&N2 z@p3j{z!8@fg5MHVloJk0=-tWrm@Mu2Efx>f3+4>ACyoOOLEFn9t0uG zBDUgU7b2ER=GKagjp8DT$EYqm&txS2E3j2SsFF^#6Nnt%IM8F00MGHhcOdU%bP_~w z{m*#Tm&-?Ue9cAMExjh`^XX7DS95YR{bMPa(LWj)gqh=e;L4X^zzzVVqcrK7qoOL0 zb9{ZK(%J0mL6mJ8jN7u^$ZruXjfw7>lm=y>++w5znPT3nSA8 zsv`ElG13z8kYU%0^{(35xYX2En+^8W>pp10#pUJxHv!*IFHfGA-y0x!i>{6iXvzP9 z&+YtlseAvsN)5y~1#$aa?Cs+o%SuZn=rF8Uam=C69sd3eR{8x30$C+htU&f-s7Pd+ zE?eN7SwRMvCaf`_;?0oFZbSz-wihVl!okCfhbZ0GV|@g5)O|5<;EhH@J2mKScIH^H z=XX!?@c$y_Z=q-UGb&)kOV+W$*v7!CovJVo$@pScW8-!>kVWX@$Xn3)uio>%7<|R| zW;*#JxZ1~?!DNry|tek zGwwr)K#rK5YgzBlkF4#wqF-&%m^%GFuj}jg5i!!XidT00?{kmJDVrppXK9$9pCdIo z&e2h$mD?`o%RIP0@H#FrlXN={2D1>~7(Z{braERe18Z+08NEC|`VO^YKA#VhC~aSZ zi`0ERUN3R29;?>8*$e7D7xHjxYIr=ZwIs}&zeSLAxBmO6GHW6DtJU#zmgWh7l>L*U z^JiPbd$$WQl;fgjA5HiAZiW5*3bYLT3mP$5Df~Eom(xKK@TR5VuUTL#yk1?J9Y_h7 z-im&Rq4D)SNJC=J>e^54e2Z$)*9z1YI`r&dAXhZQFag)mVyrcd@#3+IlRiCOC!uw0jxxMf*%f@yZ@oK{%73u zWD>vN3%+dmLv|S`@Jr}XV<)emq-~&P>#1w3&?;(Yb@@EakmV*0$q3z+LEP#Qd5ejK z{3cSMNqRqfBM~f7kA7H|qM;j-#qDmeGMT;BtVz_eXoV8`9o*-MDW%gNlpi04O6WWz{Y!v<_%Brlz( zsNiSpysnRXXCUe5cfV+OWgC2P#p+UK`Cjjr|7q!8CTRWGo1SP1aMahR^PLg>Vqv)X zq<)y`?tqUh$vW8Ha{NJJ_)pUHBs9yc3xI}l9A?D1Z)eTs@xV2-e-9;%#(wTqv-=?)hSrLp;|%9@f@68}HsWF(pq?;cQTKM!%=!=73&Y@5_8+%t}wd{pBEqe;wW(4e^VoppUKI{9uo# z+us+xDVI|MsOVh<3z81?Fhge~=51;pWD1;-$l9Qayj)MTZb%CBn z+m*xK+JNbk`R*B1Sd?IIWLV-g{QIJQ;i!_=bNBnwf|?f>9klL+-@f)bs#cX+=};G!-5CgI79aaWnLH zB>r9_e#N}k0g4rKr6nYS70NLWuz&uQ1-;B4V} zdEEW->}Fr?qF1HZ=8=~ zXVv~S$mw0+WB;HQ&(O%-F5CX>_{#PR7~}*}xEii5R-MLLoU*l@c84EXE-5cXyFqv2 z-L#)R)Jt}D{Eon4yMbD-6|R&m%+2QP&by2zXr&4d`AyibCFl-RsrG<{f25A-feX0V z?uJQrUKTQ@Oa3e^%>=FX8?^iKpO4VA>=$oCRw7tu&wN->};IiVCAH0zhx2f`>s$PU8rts1;lfU4fbe$js^2{Z~V}E_x-%T+Ie?- zt01)Ib$h&|rESjNsw^%`?XNDp^_QP{`y6N>{7uRGHr)*RcQNobI2=~rZOCuZTBZ3| zUF3Zn^T}_+c${8jsRpz;tqkONx+g^1EuYCx@7zg!*>8>YmfmiO>+rAJ<3!GUdi)VH zjIGdrjMdXf(D~)IPI@z9XV-y}{WQwlp%3VIs-exyVsa``uP-Vns^P=+A5S(!=ksZy@L+n*^rV z$i{f_Mt#Y~Lh2bn0|-+6a}n#$`t^Yh_s_&;3=He*H?_cJ?#F0+Y( zN7aA1sINI~tsYvMyRtuRE&kY6iE>|3@r1KB*qbcy( zFYZZot!$MtY!$5VG# zdDmyfUsJ_{m8#~w8}a4aS;tkJOW)-|Rh;|LuK(KN`{DOGoN$PR^Upw?3wm2$0^GY zhjAOB%~?<0o^PVJ<+~t3DC;S03qO7fKYa})a}ExGk+p*X*g#HKBuG+E)7sWpU{TxQ znB(PK;U>GpN^U{|B|w4nANA9Unj@*DPAdKXSEBwO;Avuz&7b&X2WS%_CGKG|8)2ud zf;*amsU_OoCx;Gz-blw?+;c`n19u9i~X6%;?+U_{rktAus6CvF$FRQ4ksTHJ+ zL2Z8zF!S3EmeeHWP614Akoz6xlbxezyaHk4jde#4wxfcrKdXI-lCXIa;!u!^f;N8;-||gDGda9prN8K4UQ?BwEy4@!ivHgnME&(C>|UKYp}1QMNt2@4p3bJXk35OL z+7Hg|Rs{Xb2nb}7zC1Lye*I8@a-=glNSoU zDm;6^vZdduALlP8u>xHhKXc^A>)ZxtKjCk)@>O6UzPSoG9UUDJibqKCT`cx0n4&-L zH)bL^r+lq6ow6ltB3#flGiOFok*0$BO70vEAuZ}V=oC<&o?k!jWC{L{yYuWU3wJ_S zOBy^Fvb#UtGYL{%O8RQ3aPuY-32Cb8eykda`to7II+_LtZtT)IvPzN)zjZI?r~d5E zw1a@?8=WhZl&Ek&ErwVZv7tCy(DN2hs7^G@TpS_M@D5oi#Mw)uRlZpYcmr$)xvTwD41w zF|?QAjHjZ5)SaVj<*b~-yE%G<$y@PCEQuP+zVu8iWXdNQTDYJMcP9OBDRbKfJ0OSRc^y6;y~5{am~L4agzKFCO1P_{F17r#3VK3-JKjnRSZ?O zWT0D>ynMz2TcDhqkG(1B{s~O~{kmaIAw=UYj)b6Koldhz+u)up_EGg|8oWd+*srx zf@&*T61ZnwgapEtw89`b7P>ci|6TZf*PU;vo7Xc@okPh6`j7+c3IwKEYQZ6j||-9BH7PrIo!L z<>u4qCPryMZlebbc#x0el7wKYB1_azDX-%(0?FQ5|Kd2<(`tOs`1W9Vcj^8kNE_z7 z0R&%wVIw-2cr)>kl}yo=P19G?(AAI@nbNgcZZb9mdod7I(04WpOztf8|#VNnqB!W~mIpoZ70k1T@*fEi5fZxO$(p@4&-lzssTXpucffL*BtUFPUublRlw z-GZ#?L#-^w@>U|ts@l9#%9>UR&!#f;VXi8@!jNDkQ|akofIsiRZwfSIZVI%~ie!l$ zcjcG2m~Y$zAaas<`vC>HUj#G^LTT{Ynx;8;>34J3Q78b!cbUM~m;L4Ohg;>V^&kMWlVGxax-8dMxuzRx)|_jSVfAro???l9Q-a6 zyq;Sa-XrYW=tTtmg==JW*r*LS=^eMQ)5gGEJ1N}TChETfT1t>VfETr#`JXu2xW{GC zktv5vh$$Pi8BD*E)*rZz&HRb@ap-+%k3F-2E;+iZ2f6APy7PNkJD72cAGGG;WMnmL zWF^6!^t2^IO<52;ir--4D9+*<*ySmwUfpNip4r3|n7jZ9SB{eQ(Z;%Y%jKOiw5JWZP0 zN?_w+th+UB1cUkbHFZz>A+La1J1Wc-yJ-|rW!cx`$WVn#Q>mDuOwme!&rC`?yQO7%nMa2;i<&UzehI4uA)0*yI5z4en+ z8Aw7!oV2}}K!z}8D{vL$sv>s3K>7zkg4!M*@is7zgL+$ApH?auy%Dq@CHFPWC29syk+_yt%~{cSW?HbmHJvQtVif?fG~~3l2pOe+1W+g z`4FaFMU{mRScgRIm(k}Nw8J2nB`>g#Z+=sws?41jGpBvK|$Eys0DAv^>KuQhJZKHcSi)2M6a2#rHKi@ZpZ+H%<9ltFfg86ep2@zrFTXi-dsypGQ%wSb~Rl(u$U% zK>;x*^K$Fz>v7IXI(&`3#wIR_%czt122o}#BTF;wB^!2}(Gw{V#ww5|s$wUrW5-cN zOaO0Nebt+!azk zHudLrCg*NW`)%3=@k-K;_O1w*i=w2Dnvr(;PJAW+7(I7{7X1jgB+hi^c?#W*kY0}- zj5P8aDhvbVeQLz}kcA2dO;v-BSxFkS`(RM#An8JY*IlDlu%lK5_cQ-%@w{qfTC5$Pc%Nu4p|LdkxY#gQPkV*9h3L8!iziWo`c&&^}A z{gz5o12>x7m4ByKbet*kFo-=koG}TMKy?Ube?1&zrP=!$4hc&8ByXc_0dKx~K|+Gq znbAjmL~Bl+<&?`f4QJjIP=!z^f=4G~yz3WinTi57Yi?xCNIhn@@1Y^UFFsb_V6NR~ zCHE*@aMdvfnRk$>V(1%yX+pDI?ClS^a(Mfiu^gadc8_$Dn@z{Tsc^Z8>&r#CF2%Zg z&KyLyv1BP(&|Xr2$1B0czwo&VY|-W8Q%DdiQKeOVoL=WFP{RZs+c9H-N~DyPlyXVT zJJ6jyz?gdtn5fVrSj?uwL`Y5`3Jp+*zXj(il`UEx{t@k8Z9I8?(e75%q&5L=z3`v* zmyZAH0r?L$AA2*^ZXG}H1kGL0u#&fSi7*14(gPaCHl6_VOqgpD)08F*5ggZzD`=Tp zc$r)6K^o|*E4OO_^@d0v!}f3Syhu!8SexS+vdlrId|VmA4U!!0(gwsAaxAY+jjqo0 z^~7_uH8YGYr0fm6#06N?{B63IFM-?cy1z6JVbeqbnyOTXN=#?z0#QwhnyQb2p7pPW zlkq-l3z*^qzl@&lf=t+6Mt(w#9Al`#nUQgy6Rf&Uis7lLV629JtFX_?Lxar$^I%n+ z?<7Kjbsi~5;(5mMI)Z}=DS`O`@QeGLzJ;bhMRuk0`M3!~ea71saGm2s8c`5nB8bV9 z$FIFOv6Z};B>^8GWG3KMd7(;zGfh&2Y=3F@wh;*!t2Iy6>~pv?72cTCh>%s!&4Syz zr_Q9ZF2C8gK46;=Y3<~w{Pi{6uK_!U3Y;^G79%B5rlC;PGrf($->}_mt5T_O2C|i9 zijY;8l`dAWnTQVAeIBt1{z0Q7(pO%#n97v3W1lYn)oqy#l^@byvrxsm?{oSbsbZAJxy65O^)#UDjz3GQsTwl{Do-Q6l0kVyKzTPAjipqMA8@U!U`Zz(AZYn+~sPmXV&y~qjp~I zJW~h+uk3$_Gkr#wEjTsgE_V+@K+sp7rEEoZXw}y*66m@oa!2(M{jF~v^oef6o`FxT zZ^z53lOyjq{<7AX|t@Kv0LqY*pCATAXLzw|JjLT)+4Anl{ zUm|sh3ZmfS##A-g_&VG48LDM>O!B==lTZ%TB0K85+Bxk~`k<9M!#$g~*C5V`Jy4VQ z#>oLBGlfM&PSK98;39(BSukhxHJbKG<<(m{IP5+Sb3R_i4k&48Y5&t!lap$Hu{;Gy z{j%Rz_h$rDiz6f~yaFmX^nAJm0h2Vs;RE$*LTUVjb}5lZ-{gsLF+>AQ!zD@w$IPs~ zj*=6^k9VVz4~$LajE{^JNYzM;67fpv9Y7F-CPyt?=qo2`K$z<2@9<|#(pMw~S;62R z46-F_m0q;cx90S`nDlvt?#TUa&U>(u1oX!pr=_7v4{^b~0K^C3guKKdqlR>PEIb4p z2tuKJqA7}kU|=7+7|AePcnpg6_)PiNTxL%ayk&*NAJLuYcUueBv$_RtAFYE}d|ip7UJxvHDtP?5l5c9BE|#zg|c*Y70}51b7C2* zT#OCur$%Up;7LwEd|I`?F0L0`wS+dHCZC|7AQcrA-n&T_P_f-k`(G<(XI7baIzX4wnMA2XX*m&zAeA+j_mR=nEQGgXW+!U`(t|xm)gy__e^;mG@!LZ z7HZmv6B~qe#5UvDyk33+kuhK61PHbe&4bUKga4ZAq{pk(t9?j`Mb^?(yq^6-Dfsu2i0hjnU=y0>LHB zKt-YE*7vi30c_2*(=v;d8a?>?hkuqtp7BgZLj^}=DNAH>S=R0 zfI2TLFMkC|g&>X^X!{ot5s{gh$^Wm;gh*(0qUBd$Nb)`bKf|x@3m-I#nwf%6%yiJ3+y#8v;GR5^)QTua7ytJD<(&M zbMBA#IAIDXWbYOdXP+l|w|?C_BNrtgu`GVtnMHVv983rzf+VCInuFUh>0sW&?aD!O zKhd&8)fE+t~Kn&tlWarr1b;FUB*2TO5DF3t_(%NR120~=^*t=1g*lfUT7lUGo|kV;Sk*cq3VnQrr zAmQb5;vb}nmFQ`zgx+WM&d0QvLLU zkWlfGVzW8;1Z+&*4os^>+|m!Jwt(W9l;baxKSz?^x{ch2`8JlFN? zz4nTG-M{a``}UFqJ}_>+E5Ha;V$2B(loyG)z-m?&l>u;9<4!!9tg zIb+^Khxq3oJ%*Gyr;dkOR!zDdnQ$DzL~JXDuE?xp5IYK7ZemC&s(>RcNiO>Q?e1F^x#tTJI=kqQgf33}}gP{GSK5fAlmZ zm(a!3DT@DDe3D{qXr2ecX3!B5SanrZ`g?9kGR605LN1}SnvHKgkXP5KNGObSK7X0X z@9wbH`y|)IO>RWVIw-O#a%#!;;~k>te2hkSr9|$Z!^&bJ^$qk8n7LGaWvd?;SBo;- zhd^?JYE68h`&^ZS6}paUuq32eO>m+tS}CA2G=~5ic9fmdPj8Z%v(TNTjMKYw$=$7T zb+hog)OW=(YaHLk%Ib8r`J%dcLq$__IB_<&rvcW#M@AB_=gPC4rGSPgY8|l*vz#9d zjJ5LT85%x|W;y+3chi$o>eg`($hd=HwXP>g*+d{MFob{RO9*9E)+9Vs_!iMpH+@lT zVe9vynGv~PAJc>AW_WkIcNE?~f+s-krqXyQD0%*VEaZ9C@y>fUcI+4Yjv>@FU?vqY zS9Bqs1PqjZ@+eWxZb;|9PY(Q!RiEXPHJ9K~XL=)(rp=c}lHedXFg8$*KP)jBM)rp4 zQK68=JJG8i1K${+l)X#pt|QvPi=bXrAhF^w9Zs+?+Gi0BD5JPVqhu*|B`QfZR)>|S z+G-v#F)(MFKkE*o@!VnhS9otxot@9J4U=7V7S$bvs&dnm zX2=^St7dH&IfMTe^ASvPT*J zki2Cli@b|-F`t}+l`v)`V36iD1@UX)V@vD%rPhXV}^0Ok9_wX4mM&vEOIh05l>Y5&6q!`;}-4ICLtMFjzbVL zL+A%jkq~>7;h7{x#jvojA;sYpqt$@+Kn)te7oiNdl47%NZT5dLyuxC`!()^#oDxC% zwg-^WH*QF!dRtjHQCtM(l#}TKIVmaLTYVAR+uOapy`!TlP83YDKbAs0$y1#~{4)-{ z<;v-PzG7#|+J&5qJ>!w8Ul-z|O;-)IR0>$p(N8g1UFxcs$jTyoHpSlmfcZ~UF#*IS zO!9(4)|O-@r4NbLru|!L5yQrGt1RsigOn`!NrR#+gFXWyx0yuZ z_jJa}S=8kqrIX!GiS`6*&F$_+C)Qjw5FMql{?lqTa!bQ>uBoId({w`lRtIO2(m07x za$YN<>6BK3U}B1aYGPQ28Vd|GN+Z)u(lYN$;TLry%cv3QM)lSQxgjU;No69wMvW4N zbIGzr%1;4vQ)WSrohgpf5tl`AhrgV>Op6&^3Ko@q#eH!PLEQ@b6sqOglrL-fv3}}# zd$6I(IDX{zY6x2lmntL5`|}`f#3$L1bka&SucU#674{giLIe;K7H->>ortHc^_wvB z_tzSo6x4*QfCW2MPMzfkRF2YAd#n$PHAL>bSHPUnDKQqr}6ti5vH~b{V zXp|TDrdY-`VO-_zhg|Dx_sT`Aq! z(%Lp~SE*s*VaoB=MhK$rZ7Dna&30|bW!y7e&})_Uwg`xYrODe>k&eOu;Uf9Ai%wa; zyuAFlJsA55YxiJZ;%5CKThiab!l|RF%?7>^tc{;!$yi7m@&|?ve|nB<@XETF)6wD1 z5~C#~(%CKgrOlqD2@I$bVU>ZNH}NgFIG*%p%GtNScq^W z(NO1|!6?7_|x8w(3LcNHl|3;5J24O4tigZyy4#`*n3#EEa?t5WZ+9Wn+O2 zux(igw3^wSp z*lTOJrDDs897;uCwOp2376#W9`=mn$f|=>ak# zoCXvS=%fQJpZh^BB)#^Z7cvV7=G;xGa!DDh?3^HXC$$~-E443&!1t<}3Gwm6qw{^o zE1=ZcfW7bq(hL9c>b0)I17Vlto1@aG&xGooc{iAz-yD z_@FPVsH|-F*%z?Z;_m5Xm1S7n>Hj?0Ot~Xjk&x1?3HQ&W;;A0%Pt`%zp>FN&N zQ|F#8cUmq~B=i>)&?o;n?pYqI^rbqaq4sTa-vV+P-TT6?)ocu?i~7u93uZ3MZSJ6# z=Y{p1mZz=Jtc>(KS2zR&hOPoyL(T{~9y#7ia(A_R^q=?3FJLbnqG2vu{(5&*kwWVN z?pj!0mv!c8e?oO#^E~XlTXk%I$_!|`&lV4Yj33>J`IvU?85@FNFpdl1rUU`sAGKhg zJYOpu#zH=Wc|9e}%F#D}rExjxEHB#=vRU{S(w0Og0#f4mrCJakryRo0#({gI#YaaY zH8qIp!Dp?*-xGoE`jW3*sqZWja;m26e)oOv1eaPwg1>mFVI z-$=9DQ-Mw7|{Az#m1^Mc)`@hSPl8M(LF9^;c z@f(!+9C#5oq!ACJg^r$yl(F6)VWfe85%L(lOPTe0#hz&N<;#~7P^~`Or{RR0m5y`5 zG_e{=kkbcGm{T z37UHdi-0u!A(jK{L*Q5rd|^y*A^v_LmSKxO2)F3vJey!6PTuG|7Nt!s1Va&>lVXyE zJ{cp`{e@V8K|{E}#Ew5^MRyKqP>s@-VA;t{3IVMsYrbrby(BD*HDMZ{ZQZeR=gU~T z*3`kcG;?La5zZE-V~=IU2{3#_beOa`#4Vr|+Lva<@mO`tJ72M6y5o(Q`hpPoTCx}W_{a-Mav zA8or|CITxL!5uqwPRsDLl=Nor)tcswpxRm>WH}e^fIv1iyKKk?Xql5;eRnq2c7HU3 zAyg>A!v@yV)!?qZJ>iXiY-~?22|x-wnv;EM$U5!I?GSZB8aN0}+x^ggzQudWEI82z zfM<5Mx!oCmj)rmrpSX#w4FHb`7v0ajV)z)!V=o|hSI|_jOjWDL)Cq0ZLox>_8whcQ z|Al4aG9rh;&ud>;*y!9cfOXrjK}_(=y)R#Vy@$tj&f`n>Mw>S)GuIt0{3>^hgCi&S zo)mtQ@S^YR9PFnCgFj_n$Q2!QHd#zOQMb=4Fs`k&Ed2w#6vAonDK?L`uHn#JxMh$} zle78Zz``o<+7~PVe6|S;KAP%+<0?*>ex6=#I$yadqy=`D)E$;iNd!XLDu3;e+-4b8 z`a>USJFk<0zc|%s#eBC|xjRFjG)>!YPRD9-G&L+Tzj$`s?N_>XU#aNZo(#-ed0A}x z!k+<17Re7;ZLrgmi(UN`SZz0K=SH79YH;}Zq8qlzMVhN`YUX}8kmA@Z4!;8f1%>2Y z8g-6Geua^*{8&@8>gIn7ebo(0%qA4b_ygUX-o~X#&WT33j?~LmU>9}2{hG+`_ zVLP<6;(l&7CC-8i*rl2#UuC2O6>+k;#%uo?v~Z+lS@b8@Z_iDgN?3hPELIrW==7>C zuiJ-og=-;aS39pZIi;vtFD+A@F<6=Vjb7=-pitxsFN&3Th9ieJh13<7Rzm;f_ai!Q z?;`j(7(Efd_wJx`QiNa37y5i(SMXoMD#RX9&>o1p*0j~(W`Cl%xcEo1Xk70jY%Kj2 zakpQcev63SeA{R}mfG41eK3|5LflGwCnqd@4q@Tu(d!B$eb>Mb{s!uc$x#}u;Jdt} z?W~_wyQiJ259Q1m9k(##cAN~s)Y*=@ohS`~c|^!qc#?W9<5BNDPM<|sMtG&tq_eQL`j^zu3Kg7n z!1pcfr)k}OBRy*-0rpx_luXhAaAL?xk`RKFAI4Nm4 zPfygGD{(UqHB#etg-HBKOImIl4=Q&H^?n?p@V#Y{V)r{xXw)m-%{4@;w!sWuR4>&L zD?<887&T%+%GyFf?mtb4t~WC`ijcd6$xN5;{(K}qBS_NH({-$Kzuce7Z5J05a?y4a zsmI5$_11Xe2fye!TM|yHp%Uu??||LeX2#b~nXa%+ba=qk?6PXw)FA7S@?M>98qjZe z(4=Ak*m0Ch4aI$YLVcd|eet)ln;+|kLZ@J_w&0KT-Jk0n<WXFV@xG!#`0@m_DY4B; zhCPb0-kl*N`4g^^hBtkg7bJRm{W{6oMtWH{58x*--^{@6z$PFF>e>klsugRkTKx-+ zXx6XVXmPJ7y&BAg&8d_6at%AL)!jAfn{GN~5Yu+TPmMU}2@=b+RD5cJyg{RBcMdZZ z*px44t)%X)I5C8*T^a+BpXIz;}@RPMfK zkoqTBSt`SvFOQ<2PqebPgb1@zHBs;LufP}B^1pv>#t9=qME>IIUY9*FVK9&6P_Y)c znvM*O&(wPR56qJf1pV7#CgP&mqFmzp13AdlcSxm#T1p|PxNmhWFS5^h4zT_Ss5dS66C7Iq09equ2Ryp{1?X$T8YJt6_U*Z z;8CA^Gzu;Eg{F`*%hb~K4>}wMs+e0f94%6KY#0e}R30g==;>`5kMYm{cBK&5==5~* zA}kyn4R!TS_zQGrXXg)WcO?0_6B)#9tobIknWDNz*w`Z6vI^}a-V=nc{9UQTcdy1n zL)+xD_ujm9?5J^uiHG0R*2_i?wHUp)%^^PqKEAfF>)PPp&7|`|psxuOicU{3{kC<1 z&^zhmVGgwoKV8Wjf)*BlFCw<&>kC6hNOBg7v@;fjB`)4W2R*s<^yZiK0fUImgDtRe zDB0iXJY%wRhw(EzwL|BGEVAzuPIuIfxLR?{x5AKL)@yd7JlEq7x(l?_`2!)Rmtd_r72{K|Y?e16(Rj-?5pJ+Dk;f&(ssjn7^{KsY=S3e}(m z+}Fadr{w)xT|1seGM92RaNzX$V#j~bS~BTKAVyVnQsgWA9VbYc~6S0F9$Af>UP1Gf_^dc~&EK~HJa}|o zU5rwQfIR?Sc19ImqgnK)Qo~=8Z3h`dZ3Pk@?u))fgq&!?MZ{Qx75Ks@h;m8bAmD@k z9oOA5ssZ?Eve|;5us*gf_i^hXj3Io(=<3{)TOulW@}I%fMoZ&q_j7`;q#?6*xl@)h zefEUf_op$y6Yx79p$7FvC#(~MOTE#23V#HKTUfxKAI)gR+~?ns!}bsf%)LY)i9pGE zARu@LH07?hN7?Pa)n5($r_b}}QKbJ-6Y%ud3~yHu4;kJ&PXIm!L8q6v^b=^GPi>LD zNG$%eMc#l;3?+aKep4Zy^2iAEXD|?=p=t&fBuxOqnrZh*5CV1pY_Pmu@m=NE%a#}% zVVb+XvI0E-zW4%fgyEmGXTBcGTa?GENs%|8l@YAlen*jXnMW)VJ6hE#aZ?1UP~>WF^*-Y0h6b02^9~`s6ejw_E6xl^jO6v@M^1o1~K` z2kbx$Chb&lVs2Yc`qG^Oo1DNMKF{fvtfm25^4CZlUDi&5h2As6U(Ef!U!_E&9LLUy zbn3G3@VJ4yf@|UXf>{LeH<$-gIpJ7k)iuja)+c`%6@{yez>Bkn2BudtQ5?qECTT7EyKsPm931{R90@AY$b!|ot-j$v>SnK1W2r|%bDI~f# zNKDcMOus!@dZ}I!$W4kK__=vh1Rb9?zjWeC`OHSQ{cKw{i3MOnPb*ehCk-lnj-9|M zS&&)P?sReg?Fh^?y&B_AF@M^=-mCE=%=B~vghPXAn^*b7Vn1=%Lb7>p9|%>BNs^mD z3HdAGPo>LmNGAls@WH8&r_<-SeV*kpst6dPpiM*nj>0#@>@!nX-gV{A-{yA3 zB6V%M7$$Yx$MDx_2fi`irY#xrOS-IQw)d!=v&Bho>skd4dRMu-A(LVk9oIvdR~V~I z?0IFOKkiEm_z~s&sB0unz{Tj^O^a9GH;i_lv!6u%>m~83Y20EyyN8MwohJ=+1gyyb}ygvwQ~2rGjAMjmv|9T zWFFh|1r~A94c~G#3pyIODtuqcMTL{!And#WS#jj@fcLRO8C=RJMNAm|z8!PHjs2VR>SO4lwvkG_A`ZPzsVQ-QJ@fe(eg zPBj~A>hBD_caCh|TMHe??~fWhTfwf7@H{5-)t9}E z)KwK45NKsO{ybZ}U$9yT4sm%NeSDwbX*s?~3idl01eu0EZJ(K0e`#$kv6|oXHG@uY zN&^NLx}qN#!Q;>^rzZUdbATd(}o zo9nm68o3NnhDHHdKJ1&AzD?gzW$Wt*4gD27SE44r z+JBM$xkq1|RGj!((;8SIc~cJFaZf|V1hT;X1`xP0(vckF%L$ps&o~)8RNW_E>Jx)xhO8*1nJQ1ab^l zmQ0dJN>&C2lla`R;ZTow@2=eoYOHh@qjOlTha84@mmo$+{)~$c06?a!rq- zf0o;==jj?%ou*5|LruEur?WXd2|_-Ct)DSQNFj65;YJf|Q>61| z?s7O)1Ik;cMx3w4yW+ivc@+sxR{N=<($7ArD|FN!31QxS^M+|`is70WYEd~UI`!p9 zup2eAE-nhTtTiwk#8|Q-#^udky+7wApz4CZQqntJ)+2Q*7vrdfrGJ@7Yus~(+!nU- z+lmA@LpnTdub;3p9Vj!c)^E|6OF;*B(4g1d!w2_%#vyFF_l^z@`ET=D2|i$MfpF5T>tqzW@?YO3R8T^S3v-2Yh3j@gD`tOgun=R` zQfeo;{p`mY;d`fviBh)T*AVlH%Z|dvR5Q^m@4;0T&0fB8DWA#iRy>=pAurAKqtqT% z5kVOD>{r@^yei0{#dRsysNKkCxsm229^K=rJV$>5t988CvI_cnil8#bz9JP_0(IRT zG3JjN*y1i0Qn!6q6{CA zF7bg7K_v{nXo0@)pl|M4b_@<7r0f6AW~{NXz2SFaK<}ejRFi}%mLK3Igl~oGSn6lk z?G7W`kCxabX*}tqJ1}=2p@JkEP_Rmx>5|A(v+Zs5GEu}=#_C+C`~!p5J6)pUn6O<* zt?&blY~wb!-YD7*-}6&@BD(iFc&NBEs6U3BFVlr!rUPRML|cUo+bVA<;qr1MoUqnc zPpCLtIh=TWy(3+(nXo?Th$J!wt;%{#%RXbja@dbKWsfRTq(c8ibBSH9f=Lp>dI{M+ zf#6G!@mRdw%6lIuqw}ecB>EdIVglMv3f}j+{#)B!ixf>U#VUe#gp%}{Pm3kIiLUUb zp-4TghNwZ1CN+EbS89BfBeJ9EgdwQDM7>HdsqvJfyS3~60iLCVoWHun;oX+PIxFkI zz|Kp{w=-dv4K!`Z0Lap?tfZ(X>^1>-S?I|+C8;)*1@M*jx=l^zx5Z2{|DFH6puh}v zgKHt|a_Z!~++jZk!AK_IG;U+JsVvIO$wNxoq`|{5jRI^A)ykXE%7r1O*XOoY;j@d2 z0`JYb>WYi8{WsgE4%?)Q=3be|MSSbe3a{Xcx2G3URy8hY>Ur{`-iD678BvJ-z`G(A z;65*)aTK38wMFN^w)6#_BQ3IXGlPqGzoSymO05Ag++mhzRt48}L~la7Zi1tU<)xYM zQ{%U>1DS!ezbjM=db{uQ;xZpQa0Y1ce##z*X(+vW#32hpX;dUUcGXbQiMGJCmrU#Y zo4U-qnOc>fpwG>* zVd3F2QZeKK|K3z&RN1k){gTzx)K_>~mqq_rYtm_Pak2-xDvs~-%C(RYk#*PkS#~eS zpLdXUjM~V8b->n}^qI{AljKDlA{31hlo0GG*Vl|yz+ON=ONvpDV)*BB0xd%_4#)^x ziDnO~mPb;%{4*?v1dw&rX1AYDrh~>(RN}Ua;i_`2ezwihrX_Y+A*zVS5p)vH_{eeY zT+Shauw)b_>Pyy?m7Am%yS|E|HSO?oA6tYZAv~xv@JZ|M3|G9rwR((vuVfGWcDWn%aaR zd^46l`GM&c^!DMC^ZjCC`K3S6F70JRK$|@y*T#rOpE5RYLhhRn(rc7Lf*9i)yY=`C zt4jTu{00Lh$x1wkV9AJN5g#Onr7@i|>ZRA8#;8Izzo6(rcX;F|M=#5?87^D${&N{> zNbHx2Xr)`#L@Fr@H^#H^S2W{uNHUx&nt+`H;_oN@k*5z{J`MArMRyb#-tcpiLr3LKCO%;Qzota7Z;f$xk}M@Lehz<^2K; zK=nhSAy2KBEDm{x$DjdZiwMi*9TqHRO+8mcKpg{3x}Kq$Ryj-wk91RVBe|zvrh`rR zOD+ipk?8t}Go3Nwciz4NQ_xMjVLsid6JXqmkMecpqK8OviF@Pe_(&n5MGYz@*c|Im zbhKknH2ZDrx3d{D;Uv6Jvbt-#7W@t=*(52ZiNxQ_to~yej+6dvlcL9jdnG8Y-VMgI zth&Q0f?{FnQ7RXMs}!y>swhF!Sz0*Wr!KnB{J%_J)_*}{z;llKbx6om1EW2qVKO7(#yiX;bl*3Al zv1h%2hhbte&BbE>^(6^9yQd5{^pi8gY>6mwl1c=5%d&=_ScngSGhh|WBC za;N$_ptHK1udHlthIL~%7BpTl5=Bg2ab7<+iPgd}PW5_4>33Arbjly9H;&OsW>fNE z<*iqwR9&5=*f0VN?@EgfiR3U-3Rod}c+i7IbJV@0tOXqb(svwGMxA#QIzSG-e!9QL zOg(m4#G3i*E~Ij=$sYnb@pzD{abA$AWIDdWl9BEr7+Wwyj*)NPeOM$s+Y!pOKbIr5K=aaqKJ=&{DK^wamXNs>i>%s;_U3`Ep|F*l7wr6jY8Q7}lAB_|1NANUjbYRf9@czy6l9(&z(eGhKeVMvk5=w8wy`851jG;%DkU zV^8RUoF>u&9B}k6Oj&L<#?8I+p^^mE8{r4C(@k>4jM^%~~& zpPo&pmo0}iOK3zsCF(H8ff2Rr?N4R*g$h zYQ6GxLNtS9`&a$9cT7FpW$D2#-AXiUg*AmzZhB#rOaqU??K@ zn!EIeI$-i?kXli3`u{dgPyUpO4@&Ip+}=nHtE9Yk9m-WUF)#_ho+r(s+?Ek$GI>ZN zme{>;S5KR|z*RC?@1$QJA05B{AWl7T#)D#NwyI@p{B{w%yb!L$jC#6w>g+tEjR8?- zT$^4p)-haOKM2xE($ZgT@Yp*Z8nV$6<7Isv6Wagf0V^7XpA(&_om@{a8<*;*Y!eMF zRmQu;+iB*(1V7Z9kC!_Gn4?EN(_J|9JiyM%Qn6AxVBb8sfjl!!dPt(I$|e*D&9+Y- zVnmXQp@b@O(Ce)`o}>mhFhvwad{g=t>~|9ne(`$zxh$lA5!J8YwAAz*pMVAw2(pqQ zC~WGv*8LR9F!#CYYr*RJeD168Owfw0Dg0xEd;o!6vm+N3!8!}dRSpfdW{_avR`0Wj zAY5D>{_)k{ywS}|=yO6hJ{6>wED?Jx>VWM!ol-J}@jGr^9AD*Z$tGt{-)kGR*2mu~ zV+}MzS}U)+rZQT(;A}F)uR|!JiIio=*>XdfdZWZ2*Ljd6vAzvaqGc77%U$#1MIbJ) zg49VtbzdkNCl&Gpnp-rjoEs3u2%UjfsJ+e`ND_b6zr z>)Ci~Tj%EFiz@53Gc~b!{$^+0YYnyL8IH@u-G@NYm;ynyK?*)YyeeUW+7h|Lyy_`@ zEjw)TE(g3^g17IdTJ`D52#Q0lW5y5$Xo#0FZe73kh-_8s5 zzsUN71O(hb7xasjnZ>L%$nxTx(Z97g`ffU3)?S}`U_jnXvl};JX5+xPE#U5jQL)Cj zn?`@c*u;ssM8YjPxfzZlKdv_H^pn-Z0?zLHSbW27J`*ujp;#KYjR$_kLh zy4p9zx+5o>4L?DR!s`*f%gtxU8F&%-q+3jjE!l)V%&jtHDao+)Enk1{ zFPxHwC<$x_vy@r=3Xw5mljZEYqx&BgAM4z!2Oq_-aPZ$W zYr&M^@?CT$;jVs$)wG8}%C9GeXp0O(-dKf}^E2e;b)S*AG%_wEcdPZ~BeFrXcn-|b zVY4uz6sN3x80af`GlQrk-(5y9Zwx+sjCwuS8xgLs$xeV#M7XJ%@Lr?*gEz}>zT~IR zOM|}&f8`uGbFPhy``9$_&kg;e35XeMr$fAK5|*$5Av2;8&% zllU-_>m~bYWg>)Jd-qC;2_;DS?f2XOoup|kFk;U79dXZdWDDynt(UJK!Ot6DCZ|>H z&sz6Gl!(s6i;;%@L;VzhAJ|*fsLcW2f#2mGOc`BoW4huz*+B*|?SWUMKwh7<=ovzV z=LtXvT)}1$wukUSyvgM%OcEHQv4L|97|9gGzLD$usq>zU@{SbcFmEBy}B`y3h7v5S?gU=w1 zS-&pU1j~eghvR&Gg%*>5Z2S*#T6psC z`s9A1s*~|tHk5v3lDq%XYXF&vE~HC78+VJ;6~k;dSQ?QDE-6fna2ogG#g@#dNK(qP z&tb5_dzUQmN*omwRa!&g@CufK04yrTubsd+8&FKbrwUj@Ny_uh4OiRn!tgL~*pL$_ z8R+RAgG18B)*q}H@~awD#+5hy5pTL_^f%zc1^g^^!f4g79UKBZYrU~~g58sv!VKoy zQvSNn0ARfdx`X0go3{YiGyh1t&da?kT!2lEximYzg2)IB=tj`>wbdoZabn zR7X4p&xM1{G-!m6`+ZHJn`gp{^3{(cn!uNnG}94wHU)dXrvuscwT;&n6Z94JxljhQ zcXOrWN&r`q4hik#0!;`m?k=UGNti-4N0*ap>$y{FnU|@{1lS}kMJv0pF`uVgz|&|y zeyORgvdBrDO;b1NIX^K+KQWl~SwWt8AbbO~@h-44yPB(d!kNJ-UUTn_)I^xa)k3A6 zCzg7C>i1G|T*2cMO`9a@P`9r_)^mP4zTZRY-TrA=QM@fa@)CR0s(7t!Kut}Jkh+Dp z?KnkgT&>f;Nl=x{>bom|4~L;*l5l?hbNQ>l3}FDcI|x110w>qzn?C&i93iH?S4f^c6{_Vb&y6HJJBNJ~Rrg(`&xs>JIL zy`kOf!9FVCoRqI=u^ZCD=(EY_{Tcq?-Ke~i3tKs9qx6K(D3BKI?@&tr$0LG2}9_NN!-`v>Sn;N`8FW__Eb;tf|?54pV0j-_y znK<{RL*dYFSo8L=VWQXwPsfjqzqG(tNtaJ2wcWQXMl|wf&Aj_ja9H8h4#F_0HTSNu zc|22;m?6KdE2aiCalJhbzt@Kg?YLz0JHjgwQ42JHSd16i3D=CQHLQQCeYpXS2mTK2 z^S%E$-}=)Bn_&wvxh|?HC%$4({jM@c@QODhTK3a{unrSly+Dfib}0NGt)NH*d8czq z8caf8ch!HtZL?}^CY9DC80al~9(jB^@#rh;yO?cVmCY;myPLDUnRRF)M>u%<_OBy| z>&U6XfY)`h8j)-xp5v`Gd3hn&Yl?f8k;tlV1Lx$COi6CoN5Rf#%Lb_CcLKxoc<;yF zWdiIq%sjczoT-Pn{Cvs=C@GFlCDzMmB(1~v=#_u|wxb{8Gdx8Iuh4L5g5WQ~kcP%2 zzSnu^ZX`IyoK)biq&@!~9P?g8Zc0xe^Mx@_*@Y1zxW-B^(+3GfQ^kmQRl}$eA(-s? zKxtLNxa)|8enNhNp&Y+)9%QE2)O;ju*<0MU=6Ij_c3ZtAhx-Oe!B&R;E9wpBee0Td zP*;G&iyIB)Umi~pV@b1D8{16kp?DG)d9W`eZ)X1mx@u{w@9TS&f2f@w3*ZD%gd-;6vFm|9 z36i(r+uSdAth5PFy?|%&_d?}OC0Az8mB70(Ti|siX%6-6$QxU&<+|YEgpjM)=8Zt$ zKv`1!1U4^kCcGaAdB|R;Rzg6Jmch?ExM=ZYDf))-oVPv=hzSDb9IK`u1nOHyj<-5bbZFz@qzulvb#gbK?(8LkD}9j7E*h!@%_uO#Gz>Bal}M< z`(}B?kd8oyAUP73(y|%dzhivvJV(+&g-nKFV3+QNXE1M9UePs6$iAQ!WP`@cj7N2N zj9=fdy1Hr>^0*fni6#!wV8urJsOxP$o-({69Y}IMIjONlc4+(GsroN2iF+TCVwmHG zb&1z$En(SxH%bG!#6CX7qELyNDHd$T3e5h@mgJgV(gwEwy_UJ}+^t(fZbXeby(69f zA?9rm<(m5=(CsX5_t?DTZIaadTY(gA;qPBpRz5Is)#2d21g=Y(%&G}8eISI8xrR;p zlHH@i*l_fHZS?{IhO$>TZAG{^m<(x1F*KUT&b(*-G1l%N;+4JfUSC9PW~PxpH643E zprWj@{cBhf)^uYBtZKBPpe<4-s@`_t*c$LW!cDt2)#}NC8M>L#4IArTOU0X8TiLus zbK|$DwYNJxKCiB=P1`efb@jDHKigA-;_@smt!RJNW542kr-pIgH19y*tb5N>Th`D- z&)@#)13sykQ})@NU}YL&!vA=%+U{&pLl=g9l5;$Z{;znl;dpW(A}9g=w=@Z#X3g=VG;4;=T08estWNEFS;GUq?4iLKo%92a1TEL80%)GJbt4 zpP1*Nm@E7a_-r}nV>Fm-Ws3@2Es zv&Mvxa(@1*mz|O#=y$ov{;@A78QDGQk#v%V?8=cCb%0py=J9BqQKrhdlPlW?XU8$y zFA2)4saIK!T2v+NmC(Wj$q&IVVF0>En6#{uWE>BEC`MQbN>I{*s5?o>C*u-P@6$sw z_%>XKRBs&f`t3-@*g<>R|_53Ll;ytSg85mU4Hm*7yS9ctkXxE-|nzm&2o}G;*+*`j8!z2 z;?tW5*?HpJN9F9J*OKbx_o-XCnLt$Z|6Y~Mt5-ntd zpq;z^-f#tnd~v&B>ts3UB8P9%tkYrI;;$1zOV2Wy2oiO7V_syL@{;lt%2Iw(5qJ79 z5gf0M-m7K@HcmQMIijB^eN(#BtxBP^jGyd08(cL~#pMB}?>p)sHHp@jg60<(PzH;H zrevOe+9%J=z0VbQb355@sfv080PhDMV?l9LVqEn07bWq3Rrk3Oy4r5&wW=?7R%hVe z^(i@KU>j`S$BM-pwQ#>WH6WZ(lB!G6fly#~pnUF_lG0}Kca!z=)1MmdT(OJJ<_$zY z`s#S0(siTbaU<|zZ-0MraS?}7s0u-EDJ(=@p?ml4c#zbr!+mE6VV3W1AS;XPvAVVf zt2BFdm@84A#@ZQ*r-an}@5%9gm5m?Af^?Nmi6d~Phg%&FUx`7PWM}*+a}@FXHHNosd{1_mthM@eG0dx|Sua-DYsm z!Fgv~UQwt{AoBusB0>g1(;RzhhW9^BRcB{vhHx3C-(S>|;?1Qxf}=_u>YF3gm^q*? z6O_KhqPy<&S5<|b2mg{7JDYHR#c1ky51beBZj0=>w;C+XTgQ-?UH432sp}ITv-eon zRYitL8e+UtTb&G74j`fcT72uf@7mag0+nBNV|7s5#78+W0MF{BmHr?z4uVYC0}ut$x2XW$-zK?wV{Pg{q(l@ zm3|^QHuYX0GPSaUQG;G%Z`BG}4S4&V;Zg0)w zZ_D~Y$TY}X;XdckdE?O8jN8}ct&k%7#LRf`*X17#zfSGS#d|+QpP`iP!b#JP_2rX`QRG7e8JWga<6s}`HHKnaqBx3NWA7o!xnD-8llE0_L|k4znxAbLUh-P* zsJ`vX{?EAVg;t|?e0uX6h6c$^9q0R_+p(Cj@83^~w~L(h^qp3YaPC^v<*LYA3+hsT zEafB@_v%}$7W2-9ucQ-tGY{@XM4*4fp&MFl<_FM7emVSem7b0og+o)zUaPR$>UL`9 zuaR2W?s;B?Dwd2xK_Kt!>TW9HL4S&S22L?FTm5FZkzChYS=yf8<#T^)Z*M!vC%^v3 z<@p;1q0RX3*W_-H%P#`@MZsgKT+>*IK8WCxE#~WDY)n;z1jD5g;R%63;wgoZslIwzA`kSf#V)uTgnEQ$sP zv{gS^neRgLmEfH8Q#(=)bkF~)w`TpNZBJnxX|XO#@I9{nPK$iS_u97l4O8D3a%b~- z8zl?~?2YYBn>x1yJo9RYwF|m|J|*$M!E~8tMS8bva(cSgtw8`{#38AKjJd~KVOb^6Y7Ki2?-zl4#(b1vyHgwRWfp!wZHbRo{ z5Z>74Ca9?L4;Qu!zuVd(5jm2VxA&C?S~X6u-#yx^hp)l(heRq;)1S2S&1{fCZ?GU( zOFb!lo8eZyy{NBf^9EC135SG{qK;sGVMzB17lFlYZi%1ed2A|35n_9csAL1YRER91 z)1`~si)+eRO6z%t^>UZBLkb%?t2-I0g)Y3dI%QM*^#d|gl~gw^B7EmA+wnN>&b8R@ z(jIqg_~g~(ad-IIdIV%LN>Ic29AqJtb@V06QrQed?zF8al6U`8= z@9)~xEEEgLpp`RQ`LGcIMwwzF3aq(eW&e2MKy2t=^Sgk~08~fAVT#45%EkIflvW4* zv(D=E1$)l5VT`OJT()fLra{b9)&bV_R?iESmBv=jgZ`wf7RRR|`!tQ5On|e`7n}2l zj|Y-|C!M$LAe_)DUi_@GpAQWD{v z(nq0|@-HU*GfwiN83K;7`tGmGf)gW{y5P-Gyj|7kUhlVGLE!)oVxck}6*EnRiPkCsbb*V8Bni*eX8KC|@}iI) z%s}Wa9vVD$`ME?pK|n5+c4qWxwSwoEC2TrEPpd3k>Y?(5hHH9)%+NJaZ&#j83(rG@ zjE5*)FJgP=gyF`G;cqm6!OA5gj0fZUTWx}LbOys;OBZSa6@V&xga4mUlu`YMNotEh zp~ubfHf8 z@PDX!2kywWu5CEBJ9g6P*iOer$F^L1juU31NKvChIy z<0m89Oxh6}+6;4SOVbo-Ah3N9At*2fDoizC{P%1rZjvdq{N{9fdC4@ZCl`^f-N0XC zU4fI36b5>b-aNkvRV+&{Eg=Fxs{61nkU|1I*Ix<|V1LC>r>?zFTVK6mWX!i&AC9rX zBisYIc3^&K`ui_Y=m%rz>8nxUfjRFSpN9mK=ThGgAfZM5wD~6f%iZG)7yiC z&Ln4~&gQWoLYFmzpdknYt24THHhlk$KQ<*{<5CLXZl2KHH3;6;>$$UDX&Tk)=874x z9=3;>Q?BMsQ4>fktZ$6Fk}!#k_md+`Xaj#`v68{oW~fxzXg7-s9XqzYUo^Z^AMlS{ z!~V`}c&sDOqrWUJI@R;xvuiao`xy$BvkV`%^W6FcN1WFk>rJo^mLL(o{X$2;G3bS| z&*oK57>;Tb;S9A816&C+hn8a-d}IQdXMlCCUlEc9OzJklN5}NGz*k;bym4&hr#s`w z>&hblT=1NcK77+ENb9qL*hnam1f%@1i!8B47`=<6fEwipOy|jC@O#dNu!u0C;Q!!V zz!W6_l2x{azFE0kZ}zzq21&)h3qt`{#E#56L#aF@aITf5V=|joH+EH98J5JD-!&*! zn7}bE(|8CYzQKY!>aiHQWwQ++Q(jl!-Mi8^;}wwJs;UqWv?eeD+b3G4g8q3S_>g-vP+@TOv{c$II^DGJnlCn=HECKKTiM2#rk7B)XeWNVotxWxKVf<3 zprt#6mc~o}R{j;1R}e<&>6l5bM5%f!x)2%aFC+2vYPx`%#LE?jkTtF73KtGCs{ik- zy%|7qK#7l!?;0ZZ`w9pt^^fvH8715#K|y8N$;W62P6*wLZ%sV3zgHFG5GE9gJan7if+YTBB0=TiRbu-`(_|f zN?|hxDFRWT$^=MWI=gHl#d0;jw?tQ(;mC=Z$s33n(EKDKC4hb8i0SWQy{f|R;`hN@ z#ibS@&m9nzc~`cTJvUZ83)`_@x0a_5a&enCvWsji0e zLM7nPcuRCmoImc{$QJrJm`dw!YN$FGB-rNi!wh4j{`Uf;?4R?J@qb_t`#B0g)$u8S z`7kaL!j4YdF!WER(pmmiU6FpLg3M5@2?}~kJ(5*oJL%TPmhMhLoIKWG$%qvh_$n0y z+9N6{1O6p&t=JWbhyh(Dsqec7DL^`Dn)@@J4_}Y{bpFdX#>q3+ z7x0rCT&6&3PBUG{VFt_rMx|Vd6fH^#hdnFsIG`aJ&un9g6C~)ZC36`IGtqmm?)Dl$3Uuv5L;0(+naEk=zFiWBSQ6mIyvdyT`47lW!8HHl1wv;b$xz&P0Ep+VFEVboHrVNx5dZ2|Fo93or1kdnF|#{GaqM35)&R_&~qCFItH&69SWw6m3!I&7i-X(psay;H*E5(GVo*o&KKdkYj#AD6{lz4@nq4yeD{Q5jl_gzo*zp9h^H74$eCU@7rt)K9?&HU9SWI@7JrJ zD!-mC7xD|85J)r$;!aFK{-`9PdG^&%U;E^sio?9iLQ0Y1A?f0gW%Dww)rj;|D~e8< zTYhz6XwZj{gOfTo#X(%!a5d+Khs&>H4Ak3|RBTyEv|~&fTOqjV1(0x6mAT6&k#IgX z00hP00a!@)hl{mZ1OQ7r0HANRF9;R~8{0J(OqQ9y$csl^1lpS69Mv*I+JT@2 zJOMPyqeGrqI3#vQSm>09hQDA@u&iSC^79Lor&US}>PMe%d-si4yRDzXo`lv<4luMJ zdy&&L?8o()Cvy@+$25pha$ub3wu>8fPL@nBI31<&R|jBo-!VTNY-J&U291Dugdv?5 zRBCZ!)0Ogsz3}nUBn!IYXYix7Qum+j*0=HV=!k zG84(PHU{%76sT-oucFFQEEg;FX77s;IZ;G>f6kp-d`?GpGmXA{xBE?L3{QZ!g2Q5| zA_9XhoZ4%?eBxhH5zJQ%=rS@Qq98kPVqzlHh1US-;Bgvp;8TnQ$t~!9cEBiVg=Zcv z4NH4*eootNddoJ8!X@opQRlHKJ@PQAIc0G}OT~$+(FitO$%XcOipK~j(_j6XuBhFM7`|W6MjD!81EqZabA_<_U zn@+u<1dt^VB7sC_mj^tsmjtu`!WCo;gkKH55TS=Di>!N{nRdrEsjfONNQwaxEIqCt z-Vj!g%=Q@sL9djhJlMNA@C`qJ#b_FCc~FsG%09Qq9tz_-`);PE=wE~{`-|iBlJp5MV^)U346M70+XS7L+iKFNRL{eS#_|-KD=7|olit2W zuhNp$&UOX#DILXBg&D>56fq75M`C+vGAuY(SWP1@l+;nj3 zDzv$3DeLt=x(^(d1jW~C{Uv%_zh!p+1v?Ckp@j@Ce9W*5DNdZu(o3&(arMr(^%|$C z!1!AFNKB7=G_MG+VqZ7+OLjD>CHoAA+OYWXl%>nD6jdMJXgN7BOT0aQ$;#B?-1hh8 zqLI>|oA7aTb{RE!5E%5RySDLEW5YRFbe1A&I+_Gj+K*r_`OKtBa1dDIX*x>E(o$=3 zn(}{iDhmq@#*^tyO{`#H^`O-@K?1g|nlUM@Gl<&N7zng*#Qm{AH_n>RZcKd>7z>6p zk^X(6!o>zTA6L;sH=$`pCQmGgfnGn(dXhjMtN zC!6(DDkIuh9X%W3Uhk#jWG06Lpd1Yi4Na`>q~onD+vVR||1!KRRCxXjN(n%YjtGeA z-g$H)bQAO2(b3D#_K&qgAA3i7F@|{gTVtDZKyg{pn){^vur&N`QJ^YATu)a2gg4>f z|Cm)OvAw41x^}}lLoHu4u1$AYPk5f8T>0n$O7SjVtb;BezFH2BXwpRr>L1UK14$#3@bM0?N^L(*`F~(p-!_Eoy zV&!j68(IfNs}056F~cFV+4~@>P=n8tkT`7pbVx(~GK!Nbq3>Z>K;S8X#?3Wow%82} zviHRbF_21hB#5MUBfy`^fFDR=vPcl25dZc&#+pQH8yk##YKs5SH8k%x6wv#2z^9eJ zRyVJNcWt$HX}zM7(q2&cfy&fwYDKG*#^!c33Ckt`!}1zlcV;$kLaW(E%}FLRFDPfR zWVMD=31Mcp1sJ?}1PJ`+c)Z?wlNrsw)ILw?a%d=MLmf+F&y|HApSl(5dgn1+53ET4x@%6InCB3fOeHc}c?Mzve{-$=pGuY~{;7(?- zQKnSkbVw;-(P$j_(nbsI$dyo(SKXM@%%-vY{yRUV;WuCdaCr1F zqxw=cjJ^$ZJyn}ZAwocgemZN9tVJWDBRcIp--tH zvGxNTtUlkLh{MqtH-J$M6CuHBv%+rG_jmD6%CnPmwN_VMXKiaW$%4W+gDee6KYw9xQO!W%w?aY(|;cgreym(J}yHbzP`NvlmE5ZZZdpj#c&Jt zpnKPqIB=k0#&#r`5!6CCUOp6)bAsr5Dt@yo&t#X^YOMi~!5Cov6G<#$U|?WrNm&t7 z%YZ%xw@9mnJp%)sK2_ys$hNLY)yBHd2gn9(nx`!ZrOn)smTlWXrBO;2O_YnbUEzUMeSgnFIL-e|?=U8~d4~U)1GU${2WjeO?^3Hy(~~{NcTa1xV#O7rMX;F`VrZq|18|T8u^V?yVBT4}j7~a2a6H;#J#Pt;3e{Q=$DF$!jDilw-Mun2DoE{q zPTc6!)Koxl^|Fo+-db*5-5sFn7C`BLO}TVA0G3Vc7qB<-Q#U2NV(Y`=?CuopIS`Rk zy$faU&$qw;EMX};d}p@quaThkO&({m=C!=o%-@cuTX9ra7>sxK=4%>S<}!qe%a>D? z<`9BlgLGCGn_eGds~Q|gKr~l3y%8KCRST%h^^5B^(W&+OCs9T4?KX&M=ni|*g5qT3 zR`S>#7uLetwd;q_!#2mvuN#ppt4Zh2uunNHu8-Qv#gmgt8~YBJJT@{+u@tmw!dHP} zJ4@U8@Ih((==MQbEYu5A0$Gyh2KEG(08zJqNv&-PwkbHrv%7~YYz&xLP3+`6Y$uVK z>zaz5&YhYVFO&ssHxo+eSwqfYgAd;e7d5m{)>siJbchn)0|m=ZF)1lycsn0 z-9DnBSCaubV(f=Ti7w3HiVm*Kk>G1II2Ca_}HGhzifPnALM1(iN&+iEHLyW)- z=ufJdgc$rACM;N1qfu+IIV|Eb#%0-fgcZ%knp{mI2WJrrT`8->@FpyS(;-{WVy>6i zQ()TmVSQs$8h;pM{rk-b^5fnAkUEPiiz?i`4f%ZC9z+KcB5$B(scS&>lDIP+hRcCZ}kx z)>9mMb_U?JX=A#O?t9t|e=hNDglU{EcIG}>pdctek1Q||*0%((DPOZ^tmB{QQ-4|B zt}TSzlAW^>l&yLUvU(o|of}cV%D*Q%rCcr4%&TQjio)KvuP(qBqtGQ@c4{-xeR&oP zq0lDTus_|L1RTj6S$D@`rZ zXb6ipx(Jz(Iew(Atk)Li4sCfx5-rrEi4sSy;i#OKLC;!~P0yWOOCT%f>>^-E%jKMondjx1-_o zs5B}hLFJ(-Nr+Y9M~9+Gu*y+>fT$k5sLS>eyv7sRm2#$cJed5+gP*}Y>GWT-4npTT z>lqR~|Gy*j*(8j@3QBmA>~L;7urGGzJ-fGV0cCp#Z=Yow`wjbF9r=ChF4uv5#%kiH z;YQP~sG`4b3xh$PB7U8_zE;r40t8m@0Rmm2;VI|F_B73NRE^n>Ou~IQP zOo`go5>V?gc)g`yu+e$)Y4sc)oTH| z?U@}rB{h*Y>0&^{G)S}u!iT?s$9fjr3X+7Vg7%hXpZq0@x5yg!)Rdh{fX-}l^8h5M zDW7R1IYl6`16;qFO3$Tg zGnK;$Ta~cy;^HEc$wV4p$p?9TtoF&u$>}y2js_%r9UdG=X0p#-I{$V@RXp!RXksqBkR+PyTyd_tbcW}QzmjHG&{-HPs%}?3H>Qfe-aOT1(Ijc0Z@PV1 zd<>Z~Zd}tqTcT!wH1Hbux`d6V)2u?A*mU@G4C>CpFtsMoXgN3b`!Uy7PmHEl11Q#- zG$G(QVLc|vDq}cF7iV~%^H?dHH#){vD;+W(()pdR2^*o6X^gL<}4r`ikigj|FTj<{4cV!k-?L)wYHK^)Sj<>!yjL*jFb_gBvcv zlB7#N#{=mIfJ$L~EWd1{@(N^PMr0fIOl?25bkeU{;7zG9f z`bF8RhRh2v24FWtO}CMfW1kdFNJ27sq-~+wE;AIQfC;vQBquR@sE!Olr-irMLcXM1 zA{`HB5d~~@h#(o`w`X)O8ijKb4y9*==YcDAr=Z6`c4+fPlmE!eA}r(^3C!(7UIWU+ z-vF#40wgmNfxg?9&m5l%IWy-qKl55&-2lI47l8bKoil1oQt~VYRk(XaybyN-q-1Ql z?@z+xumTX6f3!3Gh`hMG-X9j#oe+~X&X;TdBqJ&*aesf@0|@Lwzh99_3r`i|qdDE} z?m~)hO;pyV1)7{1ZS9s+C90}?aH$&Ia1SBM;X^v-U`y% zZIrgH<)e+8lOR{3&xIE$!vd{R>cCJKacqI)g9nqh_vli2vnO9P#4@fuV4z0({D%-SE-I&St#Wec8 z&;<@hibM*+X1Z9qEHMy(lWcPRawlpi=N~}xUU?x zHWXJ0A%WN+en$`0mWb{;_?ns!iq3|Zq&WkK_SbVuVhP=H`k10}J@p5jj)%uL5P!{C zUt$<~f!DrRG}{{o{;=feJiViv9YTy@UmO_VKA=EqB&e26Yutc3Ft?qQUz0OLOroHuc4x#p{z_Aju#K456a&gb>>&)ONz{mrjIGE?Y16L z??SeXaMf|ztvnoUn89|wTJ$68-P%Lu7~8Dy!m`QzCHh{n=zGM&1Uz+3{ zN?R#%TbE}#rf5p^x_btHFS7MRkNhj3f`A~WlWvq*0NP{^C8yoew|K#*!S_ElWQiN0 zHsdl$YqT!P_@gZyw^xNL;U5mBwedJ($ybBGi`6r>#Qw2h`Og3g_eg+mj60?+3{M}8 z2tnQ=e?d5FSOHRkj+amF|9-;V(}ACHHw6TrC%plXHz2i0NGhI2C&f~q#C{_BP;o#7 zyCP)+&0+;AyPhp^u#TJa3Y&6Sr`9wl79&>GM*1Z?nnI^YiEQMz zJ;bwEb@&fpsmA8~EPoZA?8fM*;zbIQP7K&Tur32*a<3~ZE299nP%SN6W@hFFz^AdX zv7vE^jm^o?iM5gWoTwnTgdWh<(7dp)K&{i&QC{#PkJHMlts+pdG6!A6m!AKHxvMr^ z*8_w#Luz4sG@==DdJEmDf&I*OcIh z_E_I-;Y#EDnI}@BRJ*p^`f#c&MU(_F&Drs@YR?Lisu_=byXGgEyG-vI9tZUB*|S#T zbi{Zh$86K@LjCjEHKTRL_-Pihtg`J)^@elH{;fY!8ZpVFndE||v!xti#edicCbnwm z46YB)7Co+gYFxivv@8&q z(Ok66^sZdyc5yj5vznSKEyt~+bWcR9_w^_~Vyh{#ZDU?V#;QFj`OLN{aKJ-LdIQcK z=Nz(D0dDj3`6u6*%+9P(qyQ-_gpm(lKBi#91)SeB7PuU2h%5HXAI;`@@TX+J_Z`mn z@9W6i==<>R>+9S2=$NPo2^tg@{x#UETT@aZ7I{=wS*cZ{%depDV*_+I*6ziVXCz=G z#M}4g^^wd+pDDXTQ$Vl%xDXD(spBL+cv@8110T~XLTU@tHqFp@*pU#d5$*Lz zN&M(hk9^yChh->cBnS})6v5bE4E#YQL&2nsixPs)I<1Zcs+c5s#uxrnc*)dQ8syqX zY}9OOWi4o@DyC%hfv_~N)#GL|TK7fJb!ckMkF5Vq%*uNA`ONv&v#`XKfU&YX*&$*o zl6v;=dU4%bxn0)rqA{Obb8|S_>hLZoDsw-2z><@bgG9jPJKr0PaCA`n{U3oG^3M`= zD&v!$m4$bE6*9+*c2^Dp0IyJ>^`!UU)t3DU^YOV?W)z)D>rdmWkCVIKjisil`ZO{) z!{sgTFFb93RkiIz78JvADZ@j0m0|4q&beu6r61ui*+t_TL5TGj32t|} z#txpHo2xS%MIl0weP9=G3JsD11x^P6Zmv4lXXe=0aTCA{{pmYni?E<+3WWKXXX_B$ zulu2U?2N}q2p7Fo3}O3lo3hxM=NrRMG>QVd)`*X$9>Ae^tVE*?vQYn)d43WG=PJJ=1=`V6n zK$Quw8XES}cZ3^6~(&le04vMxfUh z(6O{R5l{^{J<9nYGs7}u2956D+X;9(fmlPxca05Nd&>JNNdDT z>%a7GG0a;KzaSe4+Yok;YGs>npZ_-ml;0ULg;Po=}!`E8rpGCZ= zl*ye+U6s1k=B!p1#&_qXxE{?A)$7`&{49X?=jAUrhLmnDccmezN5X!yX1BM~=Fubz zd{moWHiv`td(*(Fg2_Y%)As7Qsk!M^1Cje|{;&NZnF%^t{=cy>p?1?#TH}DP6I(~e z>h7T95`&$%$7*wGYF0^GO-?~hO-Jh|?OV`L1I2>`{n|=`q8t7&NDQ2Y^uWIU{Fb0JOHs2jdYSX@1aB`(>Qa2&jl64Yr2F7 zqRl0r?Z0BHc51mg`S#+#Y^fC>2`aE?=C?lw8aPv+BVlO0Ryi9Bxu{| z3?{and!5esr}E=$f`?sEK}bY1b5kJ>kIig=Drh>J`yGI?xf;(-5I$B~gZ)bv5k!g- z@3M8jN=Zvg5402PSv{*j(W2l-vG~VD{Fte^GMJ!!|ASL54Ssq2c9stk^=GoGvBCn+ zV!g+`3Gy68!n&%CCDWv0QE^Re<^0N8pGd9Ni8hA`lqjp!)^7U?6v}cU)y}5l$@uBB z;z33vicErqwb&Kg(v++k2!kODCz; zYAq{+L&T{4;J#Ju%rYN`w*)3lP%(Zf}2(6(aE!>c1V>2|^+&>W&Fx z+vx6>tzi$32zq~JD@&bL?QU>wh)SQ3^ak{)Xg)lEgo!o}l%6~7fD`IzVZOi=ZP?9T;Lq!6NVhH@P*G8>Rxqv39b_p2S0_s6 z8RwaHFgfiPF3;I^Qt6E?#rcUId`|?CtjWQkf&tgyAH={9SNFvH9hn$z?jSqn{0cb> zJ!ZW7_rr``mx2S5rUAh71oP0KPYn@ZK<c;9F^+kc+T~Nx>R7@2@@Djx3-)-t-FI+GzkP0$L1b_0Kx^nV{yMJnxUEG#X520bvz`p+Bpa zIq3ri|9jAgJ%D9>f@#{&*tidtSWkEFLIs9cF9!pdU)DEGA<&E*|08L_XV#o49A2Z5A{d zZwJY{r@zT7>7 zaT*FSFhsLy+J->-)%DaQyHci81M&OFqyo-$=9cZZz(ZmGA6h&u_rrnoeG00ooXx=r zASp`d+IPSpcGqm_tf|37-DVa5=&qE|k`4=vqIudwrw(oR3}jSXWM=?L-l!1TrcyXX=G1LjPUiZ%r$B}!M38BZ72w+dLk`X})&a=Bzp{uHBQz zQ?#S&tIEyGYTe`7$mf+?=oM0MioYZpJ>JLU!>z5(tt1dBvUF?XFCN`-JF~1t*PAHu z^$mDpx?5@tUF7fl)$U27F*)5wZYC{QYjU$QzHYKowlR6_FLs_G7nfN>Pjt^!Dk-SQ z1wa_Di@NXEZ~!h2JT`qrQH4K(O7MZeLLgIpeg(3yF%f}t(_vtZIwU7P0F?{a545Em zfjaML`tXu%*OMExegk&V;+UA-`RBWDMhPeo!U>}ugJIp&B66QIv2c*rQ1Za98FKl) zp5oz;Y;P_~a@3;KOy4F6tU%?n>B_Zr?bEZ;hlgZ_(j-ZXxXi+`;t8lF_e->fa~)Nq zbYy7wVA(*PW1Gq(n}u0^M-#)SzDOntjIXRbBcO0K$&HRqZ#`{I8X^5&#x$ z0k}p$AyX)u38v2DfGDw)4lRnLf&;_SVIA*CYj)9s^g_0I`MB!&&^)V!)GGy^Q=fT|)ms@I48=J@-tnHilT8F{Cgs?Y~9F!Aj}JQ-vT}z+DK)Xt~0sdJ`sP zo79r+YUB+++0!$vM_OWZa6nGk9F^|hx%hp2$B^h=tH;k;o8&7*xcpDk^`k z&wKZ;e&rTFHFZ9T=sYe?WXjD*`(d6x4xZ5zCP8brc8X zh*+(0Q|UvUARS<`}gi4bjB)>vKz{RmRzpJbJ0|Qe& zP9?O=Z)LRTEA}#BTd?*f+8>1!i5dN4^!z&N>vco7&@l5{R5BuU)rTa2cNyYgFNZE1 zW;USx!7rj!nsA@!$FNuC(sx9#JF=0$(B=zHY4tRCP|OVm2G1Z;Lw21X95)K|NV@bu z_UnxIO$aGDnAGH?fTtZz3Hbcz@|u0AJ>9h*gWwD@DXgm;A~E0mOx_9pBW8h5EZHUVVxyx?dlA6tjhc! zy6GV{brpo15}_?-Jy4>o!UcW|l%S&5+vxD3Im57BgZtnKhyj6S!L%pf)*$Epo_&y7 zivv_!z@TzeG_-yY_2;W}+ASFIx1YI9u39;}J?U6%v^KMCNeBV1L_pv-?wDl-t)xA{c=K88G5Ay82@L ze6P80;5gr*1s&4Zltl5(>+9Wny-cFgjG)opNLrD1g>}^t5gt9Ir}qUQ3b5INzcV7v zZB=$bJ$~KXO)SR@Z@zB7A-*L{7`bLhB(*s_3Lj!HSzxF z0@9cp2T&n{=3>mcVb_p*cDsK1Z8MaAWyoV?LwR04UH71R2_Ga67WVlrTBK)X87rps zM2~Kel`T|KV^s`t`{|r16 zN+OVSjIm^I)&zzQ%avFH7nFaD8sN0_vJH*6#RVtnu8^>O3AnlTIryK`&4%ixzMOn) zDvPt*n;4k)B9s7uSnmNn)8+*{2uORJ&mW|&7qVxb&`J|VCeC{F_-VD>)I?9+bO;Qm zXAlW`2Udu{HYAU6QO4%x)r2o{cL;I@16PkIX*s4Nfr?TLG@petgLA{(S`^MEK5I20~q_4m!RDRR)yM#3{WKkVuAfb z;Mq}y0U;Hj>AlDMqkMZ5U~NFX#BttfZNeor0&P2S19)iZAQ6lx>pinQXxaQHkSWvU z!Gc%0IT%_#HV|J>&Ldf0x;>}Py~wft^xk(7ml}`@c-#apF?R)F(?&SBF6RGYAX=!KeP*UP3ch<6bLj6>6U6Js?2jR&AA<(nwefZ+h zq7e7PF`3~&eiVho>e`0_{rk@+z3YG52e$6e8u}0sVT3oE0D1xMxny0eca^UJdbsn1!tJ#& z;G0a>V1q}zDpH$|=f5PnwF;;uF*u7SeNINztf=fz%=W3Ed{@2g^g2Y8Z#SoHQpu6( zZn}Iryo^$6R$CGEpd!T7=J%9D1_?wbg^-lY3Rzy43_9mc&m*-`HfO#A-0jhS(VYAz;m{ zNMgfB*<;JeD;V4)fd|`R0WK;QH{3llkmT9`X%7(nL>UkwxpFoBpCYBN8U1B)u-e(v z^J7_(1Spd!4%r9@6ci&D5M>U6WbjkqmH))cTcvVc8wUSZ>v#rLRYRio31xStgVl3Z zeORL~8~h;u>VczQA556hyWMxeMjjOLn(w@|{uZIzngLt}4h+~K_)P{e9;^%{3cj() zqy~L=VJX%}un-8QG#|w@)kMcPJ@@CANqEQiBaeldSwu^$Nh7Zw>15)_=$MGazzX!O zKNc?XLnv*bMPC`OShW=z4UjdN^##GEA0vM}ANi|?5-mq0(&Q-V8ipI>#&J!6OW$o; zb6-xa4S{SQJ@G?_7s{dtKbQI%IVxN^Uech+Iu31vBHm-8wl&>`j+2ju!)$hPyjN?p zJ}i^7N1J`FS${l^jFyFihJt~{fpWtfeR+9_z|V`b6KZN|)F8xC--1|kuvv+`tk#kr z&-ryHlI)Uu$sT#?PHNES!3E3Ck8?(U(|@P9UU~!ob760Gas#Ng)6-J~NGAj&w_^dj z9b|GUipdrif=W446`(slIpz}O^jbkgOm6MI&6$}4+nGdY&xDy!LSHtrmaue(=H*K> z3yVM99*8k;@gY>gd%&S!zmWb?@WEhA6B(bM2!LK)79qR0^j!TFT2fY?Wl@AiEg~Kj zqhYq4As87S?*~oI%9x*PKOR~dG)vlTbb5c@RYOxp zVrD~2`o@p0F3KA>S)+X5B0YbBASZ>SDxE*)CubKie(dP3!Jz@hBpDO4o3Q>UFeAM@ z%bn$Hd>K>O-0L$lz7cXlguiVG2LQ^losA4uQJ03sdvHO1%GJ_^e!7o~l>MQ|92SeI zD4gb=et-TALG}UFpZ&fPL~ke$^J@}BYT!PC%$q?c&U5EBkV5yJ9}f#Ys!u{iqW3Ad9V}jTD-b!^m@9Ckfe};*N};c}5zyF}A`p#$la(w8Dx+ zV;NXf=p0eQosHZ3=ZcF<*Az>*kRvXEH9RG;nJpJ(nJ67&@=`X@* zq$20>xtjgL)^e>v(aK1qKG(@(--hg6&@Nf8BbP} zmPHTzvQUxE&iZZa$v)6z8HUGd8A$GQL!%g#s~-ywnocB7_MyEgYQX^D-NF-HoE%|> z5Y-lg#uB^cT-mwx0`n6DKHs9ku?T&YFl)`X7{DmP#{N&Gf z+F@u$aP*&^Xit8-{=P)uztYIiXya^O#0FOa0{VUs7vfhOpy3ILkT*(grqjV=dD*Wq z*W~ul>nmZPO@SRnRZt+6N|U_L7R&?4u`1LXC1xBo5QP}Asn=V%?XE63c4b$NVMAZ( z1zN(3$UPyB$N~j+0ngPcDk_E=#F#Ore>7q+P$H~kiJr5D>=(d_&=<%#*E^UxxfSv= z>T};9pV(8vN0zkapDb6|@o?|6oj4;0495kwTMD9zf>NWkK=EZ- z9q0@_ROB!dZS2J8*uCeKo5DOQ@6}^}^<21_0g@t!#8}ih|KQ;xnkkwb4m)Ygs4TM4 z{{w4v(a2M?|OCgzpHt@l|P38RV((Ubt(qLU?VOZx`x z3IR;P1m z^|i*y3IFERj<>e)*oZnUlWc{>R9LG(oqKL1C zy$fmc!;}T4qkGFkV zj2_#rKOes}>210;PgCj5_8>Gk-wx=-ds`@BeHmIL?svY4XdhrQ8lLRaFjQ8YQI z)@mn*v+aJG^vY!N?Cjjg${K~mU=Q#!(ZEM#O;-K`@;vqCqTORSu`+kxo~LAg?#3+B zX>lA>K6gFyemj4@Jz94oP74bDxxb0~c|+*yRsbJ^$GK$PjB$h!iO*ra_IDJ^<*Msu z6J9Mizj=^DZ-yr+xp1xjpZA@qp`{Q^jQ}{{8=ksx;((c7vVzcvkpevx7 z=ef`46Vb=*{=fdF9%u2Y$ZNY4Qa6G9KI+2{B@^wJQ8-U{ae(9p1fY?`SweFll2Ote&H`||i zJX5)i#+ZvYlU%NQMXS5{~o z{U-I*38^BT>2_)|?YzLc)$MF?S5j*QFJ;sD^j2mxems@UWHB@Ws88$snj4Q=Y-Etb ziPvvhLQRas{;-=NV7EIv$R!H!c(){fuRosNlV66jwzM8VXU zU}mJ1^bUeY@ioN0ggdOhCjgJL&<5}B&{4oxL_}6ZIX`OPN%bd z{y@O%^d)qLT+)7*333w1F>ma99gWS}QP&}0S;}gRsbseTRjtuv{~3>_$K7GLk8ylb7pzVoNR4Bi@Sk0Hs(_b(kq@Qb2Hq~D9YfcGdGCV%F0_?b39d1n6#RbbvR`ckZ%GoNR7t4uC zxk@QXi2~Cxm@Fu#nJjh^OO+lo&=%;lNqG3$N7VOAn}zon0&<$IwzvH*+v^>A21}oi zg1p$MOK74h;~I3l7Gu^$uS+yKcWbcIIbz(l-$Rpm*WL#g4ToFfSkDYF!(6T36En@C zGdlw|IvGv>hsNSVq5=!`0ouHCu;X;cKDi|C1xPTrLK?w21)>YgH5^Nf&@5u~CoKdY zE!6&WbpOtKcxt;!zb6#HH~C4PMLa)NJm|Ixdo*zY=tiCx)oyW(%P&1&4tSP?IUkx` z2-qFk}=MP^GU&`;T0fb=^)(1|oAG7b)`(z|yvFlTy9)H^=h z@v*VHyStq)#<-cer8djKyR|dyu4Eo~wl=#fl$JzXMdfO34J9Q7HMP%i9iC>RKNqL- zCPbLYbUJBSSrMVhv|8Emb>Cl~k|p4YVo#S3Xbu=ptc`vTF3nAJYBfj$P+vA(Uqkue zuz-P<>HMWX+n*WsQzV0@w4g|D?f>!g&Ox33|Mz#cHg2`KHruw_Y}>YNYqM?JZME69 zZM(gmzxjUN*G&J`G*hp~UFY0RnFB@BQDg?Aa2U`h^*o$oq3*Q+x8rqrwO*^?DN&~* zB1U#PZK!9swJd!*zPM$q8@+B{o3jUt(&-$*TjVOIe<45p*}%gCcKq!TywP7aFX6EK zhz3U}1Rl2f#JwTxE%RpK!sFufz(20sb5UT+Bs9a|ApGfU=6qR(nU6%0ABw@VL%Hwbt-vmvs2D%clov`TDyZ)Ft<@?&{ z$#i-?{W&WhXTI9-`FH7NPDISNWd8bRsLW7=-DTosd{~a;@48wo!CLN`yi#Ujm)Guw z2XOa~M=XuQA7*{F+u+N}ay*_}44F3-loimG{mu$yQWlE9Yb}-W_7z6(uu_(K@o+k? zR4RLUapC>7dW^c)ipT3-*41YGFQ+?`&6*|VrpKoo1y)j$8z}o{u3l!78A__E-(Vzw z@2M>-6B4GSq!cCu?uy)AZyUQl_KQUE0j^^NWg#Tq>6dOF5sf?6!ZvV=y{AtV|s(ohp?o{KGYJxYfG#rp;l+ zGQ1xPxKY=EA&2Gw@FLpXkrPmDv!)CW^8a6n$s3v%t#pUxFUNgCW z`f01hV)b_WS&qGIN0Z)7cygo5<7=R{F;#~-)vd+gGx1|`m|Wq1`habKG{E&E7U*zz zYzATkCP>NQpUrD7*8Xf}d>ZF@L~S%JS+9S$-85zqYmC*An%`QRc$u=qu`QC|4eS~9 z-Of0a=KDJNjN|`$QKSDl8s`6$wDMZd;q_8fR78Ouk=jdXtI~SLl+BJ%m%26^u2Nsu zR%SdKAhPW=x>%_Piiu{o=i}4mdcqGC6$MuzQglqruN>n1t_H)=hGHAq>SVH{0P<`; zdx(XN<6Aud9|NSzVPhlzlu2{GJ2=hA=!lK2iNP&2I0fu|h`9A`*F7aADWgfHIUKHz zvlE3{F!$Ap2s?l^}1GT%oyr!qN@%`#CQ{?Skn|)dj|FvJ= z%ZfaF8Mtm{^R|fI9}U|^2r@}UM#}x*?lIXf@gH}3dKrbBH(N|q_I@}5{x6IxI#Sf) zd!1h!PG~dHP+PAzQ<>`iEgZ*GLQ zpnV$3VQnvx`#wU1ES4dF$|)SvFF~M4;*NQKXko449d@b&oEPKPQAe?jQ=>-uW_eJ0 zvhxRPX9k=bD<+$gUwFF%v;#mU09T7Kd@F7^!_w#8y%{{ z>0^5yYA$cn6u=n7U(edws&xUjrD-hrw78>l_IB;r4~9A5?_(11XL>Y5r?u52Z8 zxz*f;+K#Tkt&`!uztUN-t9+iXx`DECeQ|Mh?j$gYgnh@T$$R%XCr!`J##UN_pT%Ud zRxGUs1V}#eb}9iaGP}`S@)Q=uMledjqdjgxNJ6O_4(V?W+&iPa0YVdAIH^-uQqgY)L=xDQ_~-B5O%X9b7;5Va$in)uuQKOQgD~>w-zjF@4!2o?)q(VW5oksS>rIaBl581Yq9&hIgj{fWo2nJnu>~w0^t&Kwypf-5@i+Tx-Ett z(n`#SLk#IvzmL)V;c+xa4(|qshQfq);j!p`Ww4k4vK{;Hp|GYP@>vPoQyHn;7)p{UyJ zE=IGh4cMfg#J6tq*8u~F%7e$hKw_ZNA$_na$H2g=VPZk|`0AoBj)_S7kH2w#o|;nr z5iBZ$9Hiy}r3fRBc^(b83DJZsgb+QPB}#vRS5nd39MMyAr*E&(xAX9H9&KJ+bX&sG z(MfSJ5PUi$d!C|g_q9CSjJl<~<~p?c=t+cKrn*MgXL?-f##2fDJ8pv&7XG z4huwXNOXF>zr}dDU7b|~qyWBx6i#3cEhtFjcDoWB-rECwgKKM^nUj3Ltn=~$VZQc$ zij4AJGg#!oY)YHP+{(cHyiq$e$k6HjcF`o6L>`An&}_--;&FIb7+bJZ3v6*C z;^GLH4G*d;=GkjCuvDE#^l?});GQ4X^3cTM@MHe;4-F&zsGy~^tEtdwbjQYN$4|Dn z$r;^X^Lltgl*el{o2sZN6VWb}%gJCd_(%+K+H0wTKktV(le1QDG+ZrsWvA1-I=|v_ z-3dQH^t8@d;DuJB)5O5T@Y)?bylT-ytI5|G6ED^z!1Kb2?in2Xd>kdA*iSo%w)Ij8&Oly`_nf&p;m^Y}2o-2`rKVjae#X&>t0W z9R#a}8W*KdR8VL+6;%NU3PfoMI*S5+p!j0^?jEy=Ol{e{W*EzzZx`U)3wx;bDnC@X zdUKXW8L@4u`=*gDa(=Rned3YCLeR%CybW`F?q7i-G}TWFZ+v+mJP--E3j`yu$Y!C& zPVc~f`iXb>QJ@e;W;=t?>*->?RA$l?F}0T#@0qGyE-p39>tGybJ*Ik5$+e;r*iv$9 zsyP>R+$dW;+L&^vtE+nRrN%ss?1Se0VEqAcK4hlZ7*0Y68M5UwG1=Cx3G4cTl~@WMO{OEU}MMgVTp`oT1J z{FjNukc0&r1}#O3yJ1yjm@97~tD=YQOjnStCQ1a~U3`c@0aRbDc&swUG|Zhz9ST0n z=J`co<-pHN74f0*AUI~P)&T*7G#H|WwEsbvZZ08CFe&I_0Vngnw}{}cT<^A*Oif}) zLWCQ6i%+F1CX?1e%In?Ntgzv$Etw8qlle<(+$-J44qxxr#eHfzJdI9%3kx+b*tXVr zar$4dAHLxbH>hiMDRBxBv9Vjde!a`*kd2^joIZC8z-MI$=id190}2IQ>S6{#6M^^+ zn18DZyie~;n&iMjCOA<F0LArfzTLR+8QY=X;aH4+ z{zdHh7$O{G;T#u^!YT{um+qW}F9pliF>n5z;44`zoA-a5kug~s#bP}JJ6|#hhX7aB zWpP(YcnLa1RMLZ}hM;28Y2gM=ZX`nWevo9K9SCori+}i|EDkv$FOaQEpoE+6iX~=o z{+L7E1h5MQ36l5GK2e|usK7maw0US3OolY*_OJ}t7;E;#K&qS$LHo*2|WneiO^OBS$E-Dx5=FnKmd*cL;SC? zl4&^tcLS(T(7o9YrZm$~LXsE!rB8_5n&^1hALgyBqL|!t16j7I_TF0%@!$KGNpjzb zzVl2GOZH|qE8X?L?9m7bbn|Rg68_K&-R9pShXQ+7en+RqbFhu%|0V{K>?0BIAvs0wo(q;=RUIrWB?9QSB|C zG6?BhUpB)4oJ6aW^@LMzb=m6DQ_ln?w|NUXvf~+7e&s)=RdOFaUeBc!cl4for z)c6yF@S+M^K|!tb^=0+7QV@5<6N*`b?_lOBQB(qF2p7c1aa9^SOLGV;WTH_R&10hg zcf-EEzJXvKkdLptm8y!?)TeYDf6{L*g{dVRj$rRTdJqs%eY+^B`70sHeYdxvkrX@NJQiJYP(@%w{S=%q8clNQ!To60tm&vC z(ngVL`JDG6>!-;Eb2p?l)FPF}zVzJ#OXw(i#v&>v3oh~Lo&sguTP}o#XpbT1gcuOj z;y$xmf3x8Blhu&mFo+U~7Qm(o!a=m;YR#EJY>_GM_SF*Up{3+5_Cay=cZ(GG5RJ|9 z@(X6+#Kpz2V$E|uelj%)50Y(wQihZ4fkj|hpnb{1G)T3Ih=kl6Mii3Ou07 z6Z(&YV~1XemOu^>m>0nOaHDqjeUFlU5x(9#xt&|#lmL8MIaFuHuw$T%f5&${7u^37 zs1OOH_d(xuez0Ck_D%Eqz6+Y?p-?#Rao&w-C#o=4op$h}BMAsegi=pgdn84KVG91LGRwztZnP~sZw6qD}?NRaRb zah6nY00fk=Lm}T1K-@GWExz`N^UDr&-+Y2~m9%=DPv?$I`5e;Oydk5C0?5vnYPM4y zQF3&VWAf_OvxV^cbkvsX0C=~X8o@O!VTq)1qSMbhkA>VF-K?LXg33 zf2RHFvGXMu3ufZafopH~*W0;x?2prvlf0RJj(6z#a9S_OL0WLJ&F`N(6ERvG0H>*< zb;|=-=~2X=q@<)641@w14hI0V3TF4~bK>NLwp2Fz+b09iuX#Q$su2v0Yt-5!bgg`m z>?pj8topW)3qtRUZc@cJ$=C9&;bqCz|sVNXyl}`xvOOi6oUzbWg z5!T#bWqk*E7M*u--w20&r%0%CQU^ zE-k{Y|3|Nh&hxDd(t**xSJ~gY=*P8Ko@rlzeu(e{?+#ol14@H>5PT0GB}K=#2ZqP& zHr@kzIFT~Q+vs_5l{w)XMh66mc$9?1|A{txvi;#e82y!3>Wzk%7Y!D|!|Y=hpNbT4%P*`JfN!bn7}xKRe%x0~-3yolA@eU2 z@c$4c=_Z0q64)`cr9&7DNkXTBBSJVCnGWa?feQOxvVtw;=&4z89_e^D1{YZ|HWs2> zMnN4WLD(#>2nC)^MMWdsn;K!<+Uf$hH!xY$mQ|R82fuetzTJ)}6qYo#%+X9I zkx$WTH6$8}h!8EQZ$G?M+HvCbY~g3rfPiPulc7=>vV=1TR`=b6BH>xKuJ^b0MUY7r zT-I}O^91ayU;6=EGa+rShm+g3v}$yYu|;FS*4)V7N7Un*{<<4;2S@Q=zzINEbq-&v z;GYPBH=L*@bU>VsIEBczarTxdyl_9AdehBF{eX{8H=CB6qyrIZ2~;r%F;jm!N%Shg z1Gc`&r`s*AFbp(#gzX+OLJWg(3(JD4>hHFXSlFat?G8sii{n^o3xK;M5w(SWT=$M# zgztA6vP_@dd*o7UZ4+B(-S_)_gH7E?)LTk-a&y$O?yMM)ImFA}gc6USRRk}N<<3z2}r(A-ke z(XiARAsuP~Lj}T>W!Z5eYq7P3DymiCT&OGnqfUc64)V-My`I zSK_Lh_LP0^jEe5|(F5H4Otur;AkPQedk`LSWF2=chj?@ZtO$qaM%nrKNuD{l00wFX z%HYahT(N9krfB%eKH?i|gCR#2%ecmOg1I1g1dZZVjttWsi#dx``e4DAi6Z0wY(%Y? za+wl&2j4(RuwLI0ipy)xgrqMmc=4LH<}W4w-AQ zoOBdLG%>}xT&b6vUk!DcrT;u?twy9puPsqS2Q=6`)g>JUPgRg;KY`Pglc3?;RUY}x zjqcw!6)S+Gp50KeH*}A6Ath5$Ths1%ddF?oot>6OQ89h~nA7XNyHOk^E}ON{Y_}ac zsny_ghe@kBC$Ho8b~36Wt?Inc>U~}N@9FK88dpthGLvgOz6m?2q*}e1ZIxs-m;?pK!&b$3C*8L+7Db~>JVJXbR^WS`98w(8%*K)#QZ z&yj}_l)Q!fP&i-i`MlC18w$ywio@qKynBI-I;Q3H+*wH}Yun~|-UBR@CDU1VJG(xs z@&#{pe~q$Nshp@T}Ga5Hq$$7=XW2nVl*C2 zxOR9){?Kf2chQyQ48JdVybV*7lh8H!D1+s0Ap>$)T%{k5CMIN(LDm{i#J-=XzwCpO z(L{qM^hy4LE15U7+HNi32JMSg#@)BVorschw?C9k5* zVieF6FtAEJzR*e%3cmZ+vQ)D<`Yt6+HH0HV0ji^x4=<8I1UpEA4j(1`UOP$-a>wo#~W&3CSny3)3#yTG@1G1NVYW#82Nhv@P9k1|m(@zg1#;I7TM(vLK_VP0oVVcq#T_b^UfVdi_(pD0(>o z7@2_A`Fv{flG|;!=K9}BDS;1<_uc~bXy#cI(abBrJKQaZEZt`)A)7dRpDK6CmSBqNPlOk=QTK z=AXjszqD|upd~3MGjuvsO|SFmv@4b)ZY*;d1eXgqw`;?iAQ?_-H~cDhl>41A(~_3D z_^{Er6Tt!B+aSHA6n4czhShu@=znMYpNF%`870K8ABHp+xFGCS!-0}{zDgoQ!8r)BCj-TRO~ilB%)q{7 zZPFcNRPd+?Nfa?hP;`mMVBzk>-mc=?#DgxH)=T3p^rOvj&3$z*V)z`hZZn)~a@XH_ zh9%kQf+dwrPtkftIP3MCS8IpVBd!Vx2{q?#wwrW78*yzvN}t{W-z!%g;!+ z6`w3^HdU?L9ubiLe2Z$u-Hj(R8#o~&q?bKCY9H*M_x z_Z2oQmjxP^WXwy)g-I#$ouKE__LnG`@kF;)D{wx6Kz#+yB>>8Tf`re^A1d9O$#D=` z!h=FtL+d&9-?LtE(FJ?cOplHiz{u3TAvD{KZf}XrIa>RRyyaQjSZt)U@Yl*h4KKFm z-z)n+AnMTI=_398src=)zpNQ|zGkDWrXrWws~=!n0$pwgfE+RzPgz)0gFF<_HCU}n z*r(HLCkp-3>e4jsICFdtz=*y^5`+nSZVY~@upX`$OKK%yP3Xcbty`UEwd!BpBn&j% z-6fQ7_k5|U`X-PIz%OWbxqIxrz&530;pAH+V;)TDF#xDNB2(veuNE7*Hs@DOQIE?5 zNoMQrhe%#a7Zwqr84{Z~=`Qc9#O2FOW~-Lh z%gk|PFD^MLop%j4;&Vxc40gz~rPE7TsdG9lQAhDxB1}s&L9LO~=(xyqHcK(b4L%mQ zp+fS%WL@uXnQGIzC)T#VHoMt9KSP_x)wpbYTvQf~#9~SgD@ZlnP5_!#yd||7-FAbA z5{FEZ%Tw{iYJ2hCg+;LtV~+PVjXz zCr05swgg{htpo9+il?@Yl-q7Ed=^VCOSj&9^zS1sKua*4O!K&Zi%ANLo66!@+_ceZ zv@e&3!4M@o93nFm0t*&*aJWs42)=7LGZ|NHYH1;{`trxsSZ}BPdfLPt!3uY@(HZzN z6s4(^vE_GNjUkPB=ID=YX=k>+!Py8nD4ZM}b-hmy)waFK+350nDz3u({>3E?$L8`o zxhm-Zi^MjCflzwj{!v`c>A7D548Vs+N0EWf9Xia%Q|Ybd^*BhaEiMT7cejhw%R(I< zXCo0oUP^d)-TPwEf}<>pY&9A^ns6gwNI!i4eLfGz0O*Lh6+ps~kx^kWZ`$>;XSZA% zWovaQ1Syln;Idq^3FGlM8oRz;OCGDd{2dAzo6q15K?8O)^5`Bq$@R*8KW2H$bh{*Tig^{Hwy#6yR_Uj;Z8X1qz^0^0` zTsB9y)0K7)&V8fffZz9}&rbJk(JN@n$L|LE8GobK=Xk60+6PbrHoar7I>+e6M8x*` z+~ea&dngP&NX~z~LQiY+_yL3eJCLe|76S5-(D_Y7E1JW@Pw5|YqAN-<%W7VE^IKZ! zJGw}qGQlL5;h*ZvroV_{=Su=ULSDY!MpL@s5QVkr7H@B4R>-7ynoLf=3rXzBFMTK0 zCKaUB4or-%BqiPs`TxBf-OlS6d`>t;gQ12){`XP2=`6n2 zbu8a(-*+(s*QbRDG*??`O%}J^w%vW43f$7@>;lL~H(f8Q(ZG=Rr03`t_pgH_#g>n9~Un%=vE=$kki)U1DxGW0sZi1{l3pO9iX3}c1zK7ChyZ=5< z<8?wsN`_0N#yVyr7nOQLzfx24m#((nBSwiE)4;GyHdGt*Vy79s+?V@7e)4B!3T-Zv zLBaY}xMnjKrv-FD)b+Jw1ak)Ve8-b?V^FsD&^#NnN2^vd8TFHlXEWN;h40h#3 z{}ow0=AM$as*W;r;B5vKtHi~?!a~RJO_wmYwbZLORB>{mZaBW>iceT-;mRPawra3# z+E^UX5)c38 z92d1GR00M{pqHMr$ihOLz$a;Ac^*9Qcc65Uc7VkJys5LbwzRr)bGj8_;1R#Jx4a&a zE-c#<)%;fO1*b{Bnl2y3ynS&plbxK5?6ye+1zY(^9JC-vG%HRdu*NbJwdl#znYp^7 z=ODiNu&mOebuA5K7soPM1;?;CMa1j1rDG!PY=W0&5VzDo2AlD8Ej^PQS&zr<%yT02 zrKja8eV<&9*N1QaY_dJ6B*dkWff-0hzqfsBQz-0QTbs3=%_&^A<8a&|l(Kl7D<(%G zXmj5?SUNeW`_|*iX!Etu?t|wOwDrNTgAk3+^n<+s58-nsXzwCSfm-!rfBWA6Fh&F8 zsk*WT42dWV0E} z0g@p=iZOx1&v}p}OTYmJozw(SgD}QZT3cEX@p;lp;vHovIC-g$=qsqJ%jjt7>1pVu z=qW;FDQIcwXh-RbzKQGoL_M0+l2=>yzX*{z2)rxEY@ow*E+smWhhfsgQ*nE833!@I z>7Ix;&Q*s)(+rIDHO`G3fvCRTmP}QaPm6GI1YtxW*fO-EY|X`-N_`2P*IiXB4(23Aa2KuZ!hDMs6Z;8r>1_n(s4U%X_5n&@=; zGh&3OC_U)$f=fWcV~_-N%NXW->OXT7Nm6+$0je^T7ja!%LCyGO>k4Y_xq0si)zm#2 z=?4|k4yiprLE-3Rsdu>5k#+F)u|LtoI21$kE0dp2F z6nXe--F|N?<(JLXMxoJ;Zk%d#>YlF)8p%6>r_5K|UHH8o_dtzw;XSZ#i#JqYC~M}o zh5hfD%F*Q!B@R$EIlY!)K)`$WhOlzwg2B3|cV@|DRk?LsvsKJm;yI4?e%IPi<79gL zI}jIE=TSdWR(37iwRF4FgTchiM)aHeZ=B?*Ts|jrKTE)k9L#70u*~0{Dr>jf9jhzr z4-1#KV>KGLHdi|hRx1(+kgy+b>snHlYI3fCz|~f^`2t~v)=7N4=AO!8MAU+UvZ9JA z?P%7q$?3|fnm0h3xH7}#_a*f8Ge?!3X+Q!a0;2B1pSZ=9sW^|IJ>`SYo^Z7zpSU#C zc4ki+loF;!rWlNI#t5w#{Y)?CF+uZWd!x^^aW_d_TW{m!9<4sqLJ)%trvS0{gd~P- zw(QCwUCe7wu}J?l15*QiMa7G`teCdw)6-h?V9Q1FR>49|;zG#=uL(A{qur&qyA%Js zHBA*&z)t96X6?4r^C;i|g*{D2j)xBq=1#5A<#9a=QrrH)?))<2#_vz;;tXT~zh%~T zz03izlVg#Qfd0<$`KY?ChHPk1m(yu%agoFrLII-eNp!K4`9}_>Ha1Xh+hzsFEp6eFR#;` z&56wXwB6a$%;6(G8?$oe1>5Yl4^JnCQDQU3(aK2XYwB`}D0!tQlPmb4q=HyGJ|7T` z%cY<@qn{fUdey|n=F-}Nn+Q0$^b2j85i7>S(lAO}Tgz!ro~Youw=f6Xi6Lf2MwcqB9a<;>B6Ig5;#p<~3R!fTaTi`5^=O5_Oe$;@9BvuqHL$ZM zgr7EHTbKj=LSmfk5;hr1@=`MJO=74?>4^MTUC)JVMNprDC#H zfK2ex{U;TrV6#}b;YSG`aJ3F9G1;d%DG%5AKK5s~Xwoylo`V#!yX_~1#TJNVJRJ;# zh2woG)J#-xM4A5Hel9vOT;!oc0->zJPxAI=&&pK6{>K{+0p*F|g*|{Kp7;aju0Er*t?pFW!&KdVCiXgjwx~g_2{*mK$D^3- z(f0FM*1&mHkLiJlSwsLriVBE{A z`41^^V-Bc#`y1=E+VnCH560YPZEZz$b#-mc#OzEZ<-20E)N{*B)hhKNv#2@y!n}ia zuWQY?YNf=*y}Jsf(&;;jiA?r6TitH&y%9mBBq9{_o-bb6ohrj%G7Y!qcDP2TdjeBo z(7x0+lz879NGV)7$}}!ZEV|jGom7$m_d(WJ{P&tm?o6DFU01G6=@dG>I%^GSJ7o9n zzY}kNJE$$NL|7M=*>yXdAyWf3puxN5{cEvEL%|^f@inIwjos{uwq-hF8bdJ?!IJeE zH(-8NMy^YH1@y*=&P4+RvG%Wq@N*VM#qCA(f$ET3<+ zlNd~8apJQ5ozSW4D(U&fZV|@-2VA_0DBRONq1Z3v;J!f)-BBj^2a?AK>_KxaVJqSw zv`3e#G!3R4855DiuVXhd7BW}46oO`wCgk~>TM1A==&38D)i5mDTpNv4V6G*_H@S{F z@=D;y1hIL^R7bp$A276Uz~L?y7fWMK=}bz~YXPsbWu@c<_rLS14JfHy^2 zWGQ?T5wh^maP`#{lys0>#fl0(t9VnXTtc7;IJ;dl+Go?2?er&HwuyctQVAaCiVsL`EiZQjlS)vM0|WATNSehc88rmh6cAC2 zU^Cf$01sze)&w+%!|tDARx9=mulU84B@KB^MxUpwAn`baS9fy-Ndp}p6)7nxYwJ1a zAh9D%<;aVmxOoJ`z5T9=;8|E(;s$<7DB=SC5q&>=Xv0zkMbIspStKv{MVb>9@VqbA zIamW|9Q123f$ZRqNF=^%<_A|ZWDy~OXQeur$gR)y3!OGzW2yu}6GwT+2SE$_1OZ;E zGRFCRF%hx8{i*5k(J^=TXSV7`Qt0M*LrbY}xkZ@y#0HA`IwDA-+YdmTuy7{xAAA^w zhn5(00vNoMqQ%MmxUBkuC<$fgayu6n-pw~98&gBPMufUWM%3luAXWHY)e1RlgfvI; z8S1%23ugv>!5|p)xA^lUnW7B^lOv&ifk9Q=#-t0Lo`4CCO)`iGc{oTK_=2K?ISYxZ znCL1PIC!iA(|E;L$Kkk|s;cTe!go{k&EH+LkNR+6T6oPCBQxJz9w%GvwpP0+*A^bm z?wAINF@JG69;h!3@MuHndeeXIE=E~YrqW?)k*#=n#^G^!pRG7-?A^QD@HQo_0eR~# z*&KRCPDxc%$V`n>dTqgj;nsoFEiBDbIh^Fw%Rr( z6pA5NR#eojdLB*dtt>4Cbl%-ZPUm)Nt7<~}t}ZX9=H%!qC@d{#V>P?FYz=@FRh73u zo+fnl13M_UD~YCc$u0kr?H;e=ztx!<9wB8y{db?TZhf<@rmGDbVd=7+)MO@pbFrJ` zQ(5AX$hjQdrk_ySEo5v*3+YK+pmovF8wb3@-hvq@L>)35BGmnmb+ziG@_&NEB%szx z&df4`JP{UbF+))hXL>BSEW_Z}!X?7X;Nb$z2J-TvB3M zEe0+W`+NPF0FuzA9GF>1V}8t7^PmR5Q|@RS7tH;ix}{D(;N~F$LK6ecmm_lbiiKrh zSZ@`$T$&({SJQ0#y0(o7>sMO(L-oQZ1X~eF1AQv%*(g2D4?9Q~hL+>4WZYg=rXC*rXRm-MJUFo+G4c-Be8(VGQ>)b+ zHHs#9LX>Yy_vXa6HMi7QXzk@xYq^>7O>n#HU6iAhuH$Hl`!ZG4cADL_N#-KpvDsY} zM4*+lZ{BTviVsI;v)CPNxas*hsR+_BN30? z=ybDlb9+uSk(SHm{2Z26G0547_3>}@9r>A}fkz8Hn}4qduoO=5x?QCM zKUU^B&2@f$b8%5er=+s%j~6+tF+-vN6gG;`cOrw}U}#Vw4kBX#At6kU>+a{DN{Uq7 zaU%uz>zZLnGbGr@Ka1 z68n^3+#~V){IHj!H9py$(SF<4u2u&KpP4;n@$&ZRd2#&RdcB3H)gnxuH|1)<8LU$Y z%m004eG5sU-s66WR?F=Qp2zt^+50VNB5)6t#l^@;=}&tja7Zbzq3Ksg zwF5IL}4a zJh%qQkq=BnNKMa9Nqn83IT0iQ$TJjg6>za<+p^Hp&WMQNcHKYPtlB6T8~Z!xluAeX z)6MN^GFr}Vv(CgowcRXrdb~>wr+Ie!THnj--))=IbS_qY+ikBI8mg)7MChIkd#Ja3}RTG?d6^)GUCoVot zgGI78|3(^`Tg%wUk)KpdRoPve%Sv^`=j5dP{teCzd&B>-zU|!rz!_??`HG7Vfl!_~ za~62`$XZputp)Yz^^nMdu^oTmu~U!Q%TAYZ%l=VFXy~UWR{|tnWo_M(rE}NUmmUh5 zloFbJR>*|<+$iok{OcLUP(9mH-%=cXq1!&~3O^+Lp>Q5GKYPv7dm*W8cirFX8ocKd?=whkZSw3nE+;J;}B>-Ux>FOFFb-GI!G1(id zhgU^`9Jj6z=8kaxxvisf^X?9?_8E6X`3v(6;U{fP6DoCoLsnOR!hiofd%T#i$vZ$; zlk{C*HOhBPh=_2AKa~)=P3J$M&NHo;way6GmrI+MH+8;yjFz2+X5=V$wasnD_ZEFm zP>grIO?A(5v@W?*8NENA=JxFP#=yZf$37DWBgV|>h7ez}hW5QECT^!nmAVP^(^Wc) zg?V6?aNCOZC-Z@zo12@QoSYZAM%%{5THyIICf&M*B3p&WO6`b&qmp!hs}bSqOsrU(0x!4>zh;sf9r>~g;)rlh1KCI%~J(xNrmPns1s zqSNgXY2kuQ`fce*abj;`(!6TOjq20X*z4zM!N@`7sM#EB$T^aTYyjjncs*SJpb;l7 zo&5aWQn_KP1*ou~+?<@p$43Q-gpO;Ap9t7&CaGS2w?d{ zD2F{^l4}Uxk02EO-=idWt4jI-xQ#8$%>__i^-moYkZwQEAP%k^1CHWri!hfg8xmsZ zVZn)aARAuXM-9z!aeepdlAYd&71Y{Ryb4Pn+&>#=E|JgSYb(sSL}tg5c;7`k zL#*#nF@DrPMJ+-j=V$iNw-sdevO2X1XoHbaLd`njsy`K9qTK^0>c0*(~q^ ztbBGX?Oa$yWa-X-ARbBdOLPjgiy8&VY2Lv!3~+O%Ea_l zNKK4tRcSGdt%U`$8{_isWFklA^>FJO>$zeTS|wzi0R~ns4P9+wF366i&9cSawZ+-h zWs+*yZ=%f^RRK^Z-lPwZ-H-m3rd)Y~*cQm(vENX{D$-9Ee2Gjs=>_>OKW`wF?xzy|{=vwz zOVntE#?L6k9Zd8nSLz`9ps5o_nCMZ%Ig~)iNN~q0_RNys_f$!`HjHd;Ev>Gu@%_Oy zSNT0(H7PAUu{HcCu-S`?i)FJfFE0^juXuWDs1Y?(W}-goTAo z8?o^RLFK^wz#407YyAKO#K;KDA1zHyLS`IX+|zWEHe#zY;DrlFAc2&c+uD--oI#Md-0JoMYIK7-%?MI}SRo@hIXNqCi9UVN&01^ABXn<;Pi*5sG z`+tfQUV`UgD?nH@bmh6=ye>MuGV)dLUKBIO#7Q(xNKjo|GxZUfBm{6-riX47_f?468Jd; ztnTMU;SpIEEVLU9nS$L`61H zx4=*@4{leIrAMi8nS_Wm&;>%7ihPR@EoSrevpQc>8zy9#7M>4$t8v zLQW+c%IPp@bLu%@gwFEE4BYKc`g%Uq6zTZAGG2FlJETEQ{VG8yXZBAH2M0x9MBQd^ zhxQ_5TFw$hz;rZrIeY$lS#RwI->Fe4^!opO>F{Q!bFOZF8edBbrJVeczbnVQQ0-UO z`YC?JEwg$yE0W5jktL1#TWx67YVQMp)L6)!w!eOXCFl_|bKa0@)X<1s@Ov{6|9rN1 zim_s^HU)lFsxnBF)Tra6r5fGmetN&`Pa5&k*<2n6%kv|fOmLvC@o+hX+b8DB4)JQN9<6|IV}|NTf}!qku2uKdsuPCPASix z5z+U5Ny@vr&yxO_h$f@{t;1ZAU_I=ZQ4EH=SjuF70Eq`L~+ex+-rrV{DAtv%|B$;`#N}R=p8N(V(pt*(3k9 zlk5EgA>EmUON{NeWw})u747hEnoX3!fSR1Qv9q~AHBdgUe7jwCtH-9UWktGF%v6DK zK|i6=Zui?jIPmY}3wX)+$yC09vqFA~*zH|KXJ;o9qhlq`1ls)9uTg*BLf6hR7WI5x z?nE{=CN2(MAU?}G8!HPwTzqI(H!w8~^J)od!5xG9^5($yKnud7O(iM{%L8C!(Lp=} zSCNpA0Bd3u@c9NZ1`Ff(q-147B|;&Oj*f)#{z#ydmX_9bbhOmhWB(!K@6F5e50>8i zuY$k0fvjMeue?*Bl7dnFVrfXvTwiy*yVK(87+nLy+KkjC#GQ_c!ZaGUx6AP0oaaj= zu1E|%b$7Vx;_#AG-oiX4Kvc=n`{7Ng*{4H8JPoIc%dv6WC!hPMMT``d%YpygQB}~< z0L7G7p8vY@)t6qb0W3OOXxD#1G1nZUP6>-vX*GVW{XQqY2F&8~Gky9(LVv;teBC)% zjN^LsjJzthENw3@%&#v_F0R1X&#o`et!>WF&%WpqK)?X^`Vn9IE8?eUTi6Cku!3 zPPx(K5{tiGZ>>AY3>A$yZHafvC zx>O?*n51-5>AVl6h9N^-t?$G0#;5*nJi1rG+C#(N?DV7h*-}|-b4^#f_5U&T&VQZm zUHfphZQHipG}*4nwynvwJx#VXVX~WQvTeJbbKlqA-`CS$&=2S5y^ggGJt(ljjvaS6 z?OSUcGy;P>|MTrI9GUpx{vP-W$q;B+SXg*?JUujzw1 zJgGOsk9lUK3*oEd;d}wFyNsL$YD5MR6Wi5>`@VPA_cP14yiq0PHPcgv)JCF6QQG zQsP76|E$3OJdU64TLA$qt&cA9V8*&AuuKgOF-ivN&sVaGZ^2l75)=uHN~5ys8YW9J zmnMyL!)&>OlX+ao60G9GnL+3iSG?wT=8B``zxxjNJUPRse&~~Bi#DuXgZDin=La(C z_j;4>UeB+c9nL07{Drv1H9lXiq(ecI6NvOkDc{@`C2lJtreQI~>0@PNJ2w&J=5Xudc{`|)!5@bdC{eh(ene_F4>tcLD zR?}LeUrQIz?R3tEeQ8@&{rarv?@dAB>SSP?d;njsfiD5}_jzJsqQ!1?h95|&1%QDP zVWnnmO=V@H76Z%5=I6(woSa-^W1|x4?(QzJ|CNoScW-ykaQttP`W!*@=@r~7pCR+j zL*lw75w3;xW)ll(UH&Esdv_#zCwYaAJ2vJ|VA59nrt~Zz$RSX)AkdynI~bzc6!anf zAxuN(3z-<0lq2MaS1M)<2M=#NRQJ~H^EgNJnce%G4IqB|Jv9Nb>nNBkj%4M#UDVyo9Qbd zxD77RsgJz@-As%@gF+rBVvdpY?zy-{b%<X(56Mz0h8Pt#DiKZZ>0U zYe|yQ(EnOpT;IfesB!C;c$V3Dn!GOYS^%KB{tZlNwdnEH){CFjRJW9iwd+cTt0X*a zlla{Cu5S5)KJJ@6e#N^cVUo2WWbMY{o%$&tg<3x)uGAe+eNOnPGobaz>tfo&vsJ% zE5t#RyiN==2?Hgrcyjq6NJJHJ6OeF({fmBUWipIyCDITjf{?%~ax^ZV(UOwQ(gQ3#C5a=sQwb+9o@hnTjJjE&}0wTWC;)#cHiLeUKGkM!RNKf>-v__ z#;F$I-$g0EXEC~B7ILDs^>MRCkYQNJy@_op1<&DX$d3bJ44g+(_atx z*!)oZ6!a+8Z3lc3;Y){ES2}sL%WRNEacD8h|(^aA=#B$W{b=L80B1km9eWP?-W|z`_4CTC5682A`}Qq%s5Qj=e;?%cm;iW@p$*l< zUo1xXrZ~n%KU)h*>RReWOG#}w*2#iSAkr5qh|jHk`S?>x3BE4GZ~j3p`8#Zn2VG;` zQET-wryD&A#m3YL7K4%U*M2S}<4-!)>-k?IEZ3h``}8cS?U~QOOGq&Ocz;Ly*MntG z>8FCYhAtK+mSUVDuIo@o)=ONA!bTq^W{-{|8$;P_ZNx18jUDFiysJ`>hS%hCG-W#gM|6oGW zTZmiNBj{@3aJKmI=&ort_H`OQ-Ttd&nB+S!A>z>&((+vyF$LB6C!S`+e44i5&DJ@z0v7vB{}r;yUCkP+llPgiswv7KXv0 zOx3b@DM?~DIDbdsb?cTb;(Wu;m!$+y>*kJ@7Wd&e!URN5`G<>jcx{Drp!o8)ing}b z>0WYR-Z3{_#`;qPY?e63=bp?A|N=dkeK&+gckN|(w7i|WOZjnX4 zU0eeUo}H0U=myN)-1^1A!n+M53)(VzO9+c+mR1MLKUA& zZj4t=oZZZ^QIBJEPt;acgu)!#UXn=LwGAfDj`sAys$iA*C>Kt4FzLxvl*C+z>IEkpNi#_&;n!!kM{w0P^EHx>JY?R|w1jUO@4$ zi&G+8#bE`AS@_vUdgMVKWGwWzxM-oaA~FUBM5f3wplM1P8fp3YKu)ynwOFAV4LILB zpp{yx(I2pBZfoOVV>4&Tz`|As2N#cMsjK7QdlKWwHL4x=z z9_F~A9t>G3%z2xL1CFfE4DA_mwv_616h?#1C1feGOT*P#QiJ?&b8s>wXk*}Y$Xc=l zM5Fxl^#v)|40GkO)DTLEF5fK7)M&dls=%J+4rVUXV}-WIxD2W-)~SeLfQ<`$2^cD@ zey+aYI=zBknq+@~>@Se5nGhBxoE^AC5Ec1;3TRz3?Znmy1srPnmFm4K2<)bxn6*T( zee4{R8QG>G31uk#0@_uV=AVN+G8})&6xaBpAZQ?*k+MWgq0A2L9|;S@Ib2*^mY0{+ zV8JEmJc-`8`4w5eLXk(6W zUD<;14Z0$IOFYVqhFnOH2$rLavfiiyEylKk(h#I(n}Mb3pBPaJG4hD?4i}LOjx-@) zTBPiFv?-hFb2Q)Ob~yG7UZ*28rGNj{piL<7Gao{taoOv;S#?WckZ1((-@<^8fHz2h zvWa5Bex{0+3u3|!<_M69Ce< z0%bqGX~Ou}GT;7_Df^E$GWFfWYi)E4xK~grbk8 z?#25Tr$2^0>QDso%I4z%AgJbRK}v9Ih+vSh7G$T2;A#VlHs_iu54(oYVkZ0gYd?$n zhHA3G+nI{)x=XP;QVJq+aJw?o?`6AjILMLru~~4Q=@*EQsffyCbkFeQIBKnGcm6{o zPe;*2mmBlq$YyraVjNKpD_3&x5JJ0iQ=A|M>7$E_OPlkv1mN>`+S(5!*AMp(6(b4J zuOoSrl*(Rf8SK#Fw8(a1RSmZ4H^cEbfv&E&*v~ZoEz#(19MNc*5HU~MfP$J+f+cd4 z+qHgd5Gt=EsEsK*~JgOZc> zaj_U~H2+R~$6Xr3QAXo)dB60d34=P`eUEASQRX%OOEW2f?%YP=IX2eI@o-}<=iAS++SbO( z+VCnJ`_q%Nvvg^+4+xR=_RdohvUqj}V|w^K_PrA+cI(e5EIa^kK6p@+PW1O$pVgS^`sbP%obI~{BX9zl3G1|S`Y z7*~jsb!d0gdJEQ^0-lS4#}O&Jn|-{c1AmTi;SF8dsytDZbW%k9IsXMMm+-)INn&V5 ziDb%h%qhhwec+lL-+Ylj$^xeS&1eo`A~ubAvJ2z9mSDaWo?Fqfh!R1TbWK*l(t$W>zoZd4@MOcGL6HLO#pK$a`NtC{HoB zwMTPMj+!?79sOW49YSR*o2MW_3-$&70VVyy*8%124gK=6y0VhBy2|(Bt0w*BizVG2fJMl_iq152VQcIjW-i^D} zB=N6C@1Qse5PM0{{5KEhpK-rUTXgMWCZ|?#=lnOnUq0rO{BJGZRmA;g$|Q@B#+a*m zIB4p6RDNmwnu$V*OGCh0`$Z``ouBg-v#42xJD1@|MPeRN)Js`S4{KRZ`PH}W zZniv$Dh!?}THH0_dYe_<>o*y79uMBClD;szklItpTP+b=9TK z?WNU?t+lzf_IHShGy3}a(e8wVgoZ%7Ec{JshUZ6!X!bed(fgN2D8t_5YdaC}!ePta z#38Uz$`Dvn(3tT9S6oSD`Y0EHrJk-gu`(aJ8)k`jai@O!HA)BTOOebx|27krR#Wo$T*3}29-A!N=IbbnbA{wV8S?cPz$!N8H$HlF=n zySQhz@B5_K+vRclAhY@Fg;|rG3Z4vqVI?Q#YpoqW(VG0@^#i@Px)3`jF&;(|iqFk) zchhoTU*mAma0mb4_wQ1jK784_J}aG_eBP_8-Y>7;eL7zYaDjt+XQ$8X2w`rw`ojHB zb;HjqfSm>YC@Y5LDm8hFrAjpzi&yXvmvuVRmmddR3|NZVb z_X{eFLQcR0`#&rvjL3oj{@oGa?;aH>u9${s8@Q&v?N;d&7d92W?2j)|g@`;wXaClc z^p8_s`1)9)b2xW~ZlRA(J$O97qm{#gL9Jlu9!%>BO?93KXFurTKGbF#0~Z$& z&&xZvj@@-BqHJ&AV)xz*pUwd<_tDwamz{2bsRYSBV3MLza$ss^A>hCBEM>!~ivlxk^a)bKt~w7KesVIhMYER^X#<^kAd3)lib(8^ zLeog6`$;^fhWJr#^?3_ZZu#3j-$a%Q2qSe-NfK>9`==>x*vXb^2zsn^d(M@pBH0fI zBPC=Y?NRt1(s0os6b6Sam0ij$=KFSxDvV^zin( z=~U#d+2r74?Y5tM$$#G?zFe2BtoR8SKw}ncZ#T|&5BD2iisNgChFzrQWeg21EuS9N z4b&N{q4L5JN>%z8(INyAO3nfzg_8eUkm!wDR}0ZMq!USGe8hClsr33Zqs9$4yI=oW zOR+pF(a*Z_|LvWh;pKn&TQR`_+$CcvJAN>=Q!(9;Z<#*+tq&h))|`xzS{D;uc0%j# zrwts^7tU9CV$j?RONo}vL?+(s@}Bg0ooX+)3b+)+3UM+vx39%khR>qB+2$hSI9n;j z@Vr=4@OeAZmXtNK+}aKs#Z6xTO9b4~kB-v#Yeqh+B0kudu=?kI2?)R$=;bBcBrZQA zFUL4Bm?H)xvCiTZt9T;;=r(W6fA=*tMY#F(jWm3!VnHW7Th@qod{h8%RhyjN?Sl1w7Z_3HLKGDEeK?d-xf)D;_NY?ix+RyDYv{_C`9U{6 z!b5KtBFIUVpSP4f8*DIF8^U_?UI@=bqulai+NgXs}Yqg=>>~-1z)O zjU~I)20t&^b)}^U$L25K?=wp3#hIC}Zz0HfT%FT#gsZKWF;To9ebo6tJqZKae=Nuh z7*{qTAL!t2w{EfsE_NoCF*|oNcX}5SF=4hd&j^G+lEil<)&yKeixc9@aUHzroXhSX zCvvQahTMn-^KNAs&=(aQbE{Fc3^8iFcJOGoq^eX}jqeGUJ)3W5#D4B)eEtmPZ2<*c zO=sVBc$=+pS4enREL|Osu!TRVFLOKJ9$s3wTRHwLIIOo>y)F_4K_iE}G`dThYI%BI zZKs4vz=S-R%-)iV59AVppA&-X>(99sUtH9D#6A2&5}y+aQY+@Np2%}0CpKnE=1qE~ zq&bp(PpS(Ib$PrL4#XLmX1=FQBG9*vo5#&5MbIe+Vo%Bkng^I40!eE^ti~%&-Hn^JAS&uh%oqic0F?R z^RDT2q^7OlYGZO0;I^+e8$Id*jO^_%W{ah1AVUWm6zDOfhkBvZDB29M@))?kmo7^h zFgB2z_{DSHPT#S6aEe>Rh&xUEfqYjA_PXitKeIP9b5@-6n=NhxnboEq|S7%fS zq|4LK;Pn#fX{qMr;mL>!)j#F-_`~^Q{R^O))mzJ)uP;+@e|R{%zE)P4e&A{m6T{d$ z5T{_E!BSJd?CiuqSYbH)Dhb|Q*!Z&>80 zdcLpow%FVxzlV*^3IY<+<>-1ASTipka%FK&^6i)U-~lNcW#ymS8aUJgE5#@_l{1JF)n%P~1I(ZxjXU}ZI1 z!D$H*%FV$sIYlG;gUQL?`$v68OJ}*ZsjYeQSW^?v$|_m#$=D$b?HSKISg<%{<6DRZx$-@(LkVBouz)v=I} z53!JMOjdlXJb@5__w^2C3Um?))5D<9XJBDa-#oRVen-Zi*~O3EkDY*x-gNif6}O+c zHE~n1r`#BrJz}B2X;pFZYlyZKVXS}N#Fl}AcQU(<7+UwvYIe6?{tKf8$Qa_1@LOQzQM`&QP< z<5IJyCYbJ5Gf>ZbC4%zj_#jp{rO~Bp^zEAYW3*^-Fh2$!5wW($LF>;^v%7hzOoFWl z7VN)Eb3WOIVd7R&3W(=zm$SXIeg6c`DAmnemQHx5UKfqddD?PePeXm*T-pk?eClIo z#ifVl4=!v2dq210>;3cecoiuAQweJLFcGadk{k2vkz1q?gRw0}1Ss&6)8$XpD_go= zv@I=}a9hq@*CbkHu*0S-=@*|DKECfSFS=P-eRELIQcmZW7tc(ID5$uCtX#Bq8sb0j zG0iOor9zd_u+Y(8k7m(jf;Zm|iW3r8>RLZO`rxsXl9HLlaa`T*J$)`kIoNPVDf1Ks zJm@Yc1R^caFE(3)&ajAwd)45fQ*$-ImSAx?imE3h~za-~PDRAW~x&7XCa= zj`3+#jSmeKb2bz34|dH_IJ{w7rbp)sDwV@FePj2mEH#pGwIMG;FR`cCX4LRG$d^E7{{pG$9*NdH~4^u@+@@Sx*Iw@;Vw`yRLd zt1l2opuIl#^m2cCH9$&DR&-gShkr`=lZI)%&UgSA9Z_Rn(%n{UG;8n{bk3{T&QB&2 zLc(_x^P9EL5 z{0=K95Qh#%UhneR97%`^*Ja(0`J>?c|KKF12)qbsSNeQxf-oDl#ME{}V~lGOo{fu+ zS3{MmX|4p_6&Q>le7`N50-siC6MMIUYq_McvMXIlrG_bosYa5V5f1e7E2>rS=55Z= zUIBgrtQ%NH*5pZh>FXG|p?Bp%GGX}90m~oMM3EmUFgfc(tG0gnx$EbI#UbJV9|W9A z213ZIC+z?@02Mx@Fqj)G_Em0G|~q zAc6s5*bY_}=mY@Xu8fqn0KT_M!{+})36leN&;Xya%&-XXcKZD8?j9cLsi~qwGdex& z8yr);i|=JnW1kunAf~sf-W$ZQ-?1otRO$sR@QG}5b595etCSRa^N7atb0>&T#&HNo zhzKVxtpe(Kmd=}wBUW6ahRhl&BwoxNbanECTs~~4k5FV+rdYg_ji|4}0UlOym#mWL8C zY5#PW=cEMvhX`VXS-WcC)BCJ`o%emEcp-~GQfRs*8%K{rb`tTgXK`oSg)!ZzXNaPL zxI(&OJc6(cp)5klfl{vPAmH+Tz%}j-eT6Anr&<}sose1X3)v8LNbr)63Hi;4gZ@Sp zjjMSCfo~EXjx~CIl_O^g+ldBAZNaU}r@Oi}6fV7@qr<<-FZKOS?sH}o3?wf@+c@As;Jn_^;dqNHdBX+f}4z(0H*z z93rBPW*h8h48I+S>03Z6i_N4b(xh2ypx^FXT2$1(w6ye%RJXPRdD)NJbLG(R_(K(Z zpW6DDDykOhDJtyM?4;H8uz8q!SYeig=(#hKXi(Hnu&X+|Mi`Bl*A3VJIqei!Czh?b zr5K>FE;OqKgGRlag8xBJ2pZQq_rLwp2}-n7ie&Kr?$Xy~k*&G~7aQH3&CRJqCJ>1r?qa3= zkKlU<&SZXYr3k~a7{EE5K)YH5CuXv*1_Kt!K#?Zh5`{3j2qX-oynrfuqK$`dDFWe3 zhV7h%0n!=lo52@c*;^HRrpnwH#$UU*;stS2-K5eRNwswf#Tz04B%?_|2=srwq;-8f zEHpKxEdm@2HFfzh`aL2;FYEP@a~97ssORN`gX9`<=`v#7 zfi1(k8H2thjbMj|ELplr$XqGhkZRMxUT$gegB#cR95QulNXO|FNMh@m7ayOa!fkmA z2=nvH`TpdAHa~LZ*_dLuu>}7MQ3DlXy#Gf3)Tboq^fLzp1yQrJB+FAaUiq*lC0Qa- zVv;gpl?Fc-CY0pVv62xe@x&p_1JscZDPxleR7v5?SspU9B_9Z>C0|p^;S>8x#ogk( zbjbwTmNZ;m+VJiX8y?fYDo@Yaz|WrR&8AnD=Aj`eWZj#q>Pu*}GN)T2G3}o+B&uNq zTiRgTVn_)zRvn4!T*JJ-Dn-_xr(YJL#xJ z7reFA|E*FZ{pIyzd8Qt6sP6>9n=b~0nln0EK^eM6JdW4pN~5y7va+nPF*_=>XXE1G z;K#;P9DvJr(bf-HMB*%<`GZdu| znMg=P=SY+wFAv!yjMIe$o{7}L-r|Oo>rUDN3^+V#2W1cB)#8J~rBf^4=?26{Xa_aL zm(Yt6$(`I8gcj~H?wNY*_;3t^os_#TnPghzvI<~-B1TP%c)gz}yXSN>Xx`|@zYkwW z9BO8@L8oMRgCz>d6Ff;x1Yjn>63{Y#fy@>a?t`sT6&XN>4iPi6vm|qLa<(Mg>C}p| zwc3}E{w3>An^OfI816eJ?REu&3JXKdKoATk6=j$+SMQK~NsKwGO2yb5v2qS_9t;z5ty8VLY+;uO8Qsbv-Wc zMqG=SO|bw-?|G z508sy#djZ&eZD;~F2sxH2X;ov*_;8YS?2pQ(}6orbxj|851U01-GhFaLidKM-Vf#b z@$72#Wt|0z9Wn60hXjbeueKT}b@j8`fOE;&5~L|iL#|g)bumK6h667N+S#LhqbYLB z)NT(0)Y-OrbP9zptpD$so`<5Lg{Gp12e*WngQ6x-=j-w6Q6q~(m>tFMrNdh0>V(v& zAphXv25i{r=m=lO!W}j8h-%JwNkIb*%h*LS18qouC={nw>{5kwh5T{+X1m5dW8B!K zFCjXta)ikV#t3+~m2lPiNO{f~MyITs$q2t()0RS^EQ|jT9E@v$-H)~xjP!SwVf-o? ztj3}UlOxGD3OYrR`xp~*g<_V*!5ly8HAJI<&z0p|)=BQvJztYaHLCt}_7 zw@n2(aD?cy6O<8D8V@7@H8JpHC+<)7N9al$PqrxND_Qncky?zLh%o}*R0&!YULvQM zI7ya~TSB`O1*fPh&=D`6CYhEK&Ja{ZT&J2SGK5&tJ8S0Jftu%>S!y`CYpQ^X(>wXi zupFxgQ2J%cHX2ZuL&6A?%R7`NPlR;&3Ak2;ra}ciKntvZ6h#Aa^A>8NlJ_urvVwHf z+t;_l|Ll6#(>v8Ne|!9VTwEH%kyJh&{XUqPt}%|qB*ALXE|Umg_eJXNs=RzlYK^*t zm+I7dSkeSnyc>I&yb7q=D;dg5&#ZkW$&1Y)&X$hJa`Gk)`wXkdxo>5kw#D=PUych4 zwnj%~X(h92Bzh=?x5XX$wTGzu-1qwi^_i&epcrGqwkO=Br4<9DEj%ndG%cu6Vb3QK z1qrL)feQ>3T9z&!8CfxQsvH`x4||fxqIN>nkr9}PC+>J5`h@u@{EBV0 z1c>9&OB|jZ?{YXBXC>nGZ+S*YBS1Zs{bNNH-N1H@PtF|sE~#a#|eCy@I@QfE(I3i;@ayj9KdOL$MU(c4Ib0tc9eet0Z4_eWstIf;#Y|fV$FEt0c54mPSFZNCx-`NN&~#$wJjdkN-z5=<=&YN z7LDS}BO;i#1wzw;!h_P(-qckJ3jxB%E6f>;B9swE(!Nk-xi07uCHfU+q$NGmTCz30jFaev9Qyz%GlYNfE@%0^`V!%eC~p^ zN0QF+x#itt{s40b>R^Gc}Nbm9B$L$aG~1a>APV)z$V8e_~Gj=vb8`-81wDxQO%2uoI+! zIRXPyQZWliJcj7Apt_cJx(CGECs$Y?OZKQ)Ccbrm5O)gy^1Wxn{juZZd)Nm-*$;Ow zf!>RS(v#qE6G6(NagpyyIYk3!MvS3H16Lw5eOcQ|kV#Z4APde(P!dAkjaJ6mVJu`Y ziRn#_%aGt6ij-u8^69h#Ugo&ft`b^bN}E<0l0c|}2ws0YZX$e=z$dTUZj)d}^eGoe zUnxSx^v!c7fHpP$yQALH4UhTnxVK5Z5%teOqP4ks zR_X0h;WK17;GAPG9;pbi1i5LjkjAluA@r}zStP`=q`xSOJEP)$)Q|qK4+wW5ZH^z2 zC#ySigtKXvDuS0k+j!>Q!E}PLC#po!$WL9rhpJlS3ywO*EQ0(a3Iu=F{A|)m55h<=}wad>?DFSH0 zyg0HtKDwX))@10H&d${=s1E)fISK@%*f8Qq*JubU3S;ZKva|hYMd6RVlZDgf=6hgc zI|6E9b#$cYSpdt8LVefQ1EFQxf(8fSwk(RdOYMX!sR@)Gg@H%US5q^gY=ZniPm&VD zZzoWEva;5~93_9!zzB|QmGRsIImF24m%k)Ynp#+3V`JNJWX;XZ<>U}RxVyU2q<%Su z<#s92-WAR6+e3v#isnEyB#HeB5hBvEqka2K*K`H?3DUrv43YY!If+@N1J)CV8bn9- znQ{SyNQwS8IZ>Ldcn@d_7tk-MUVux=21EZ28}_;R9wTp;$fM)40#;(Ctdd~8!QkA; z?#KK6Szuo8hh=4*f)GJfO!XMAQY!u*WiRiB*N+`fR0jfVujC_)Z)7IIFISJRZ{l%M zxl&QlP=btD7**p#Ny}f|p;>j58R+QcGK53H<14J0?FUYGph&G;E{WcYb9AdlaIwTGPDgSFw84o$Ty9# zduh-k%vDH!-2T8C}ZlvT9g~st_m-ol2D4(K_A8jc#OjLZ-JGS7gJ3EM?&z1!T zJAX(df}{4EyrYpKapYUbjg`UI-_bh3l2dW2Rl9&@<3-NXVzB|y5&wrrVY-0lijK2; z=8tXaQpj3>@a}oLoA1ku%Q$j0ywnFw3qskBOy}F^fVGG=Y-+68{l3}#K`C)&X>}Pu zP@4-6`ecQz4m1Z(upOO=1J+~%WHH*Ve2dlE@OFV&uTN+4iUChMlK$f2==No07KP{x zSh`YD=I-tnfBqow$|5rM@rOf)0|rVTeT|wNO&*-IW_Cp)!6~1QZ|2r`3=ZQ!*>Y_Z z$N0%UC8m9>wVjiH-)+^|#zo%2fjI|cR$WEAu|hWlviOSLv39784=HS1(&Wfh13qIJNGXJKxRg@vUAm@DZs z_V@Po1_vRIsGQ3xrH!galq)G!`)5{+J_}xDNV&ON8ye7p-rwH`1_oG+1bBpmkdS$f z0QYvl%Y43&{~OLRIr*B9_noD+HQY5&aif~I0r>~zSOvmUg9ZXEhF;Nq%Wd+fRD+j% zkL8FfT}>1`?arK;vWq;2Fbbj~mb5)*dM^5JT(*o~_0sVKK90;j1s?XRi{QAKwFM|! zFx^ylITSW3RtbXOEu6LJJ*Eg59@cz04F(Kz|K-#e6BGv68;-fbp*qCCoG`(xK z@L(vOjW~eZlGX&9L9ko}3exqF4hXdW?^FM0A`5>$Pt()U zt@V*WCkZ?ag|7%`)coG2c9-n1dugf>j=+z{ zI8=b!b=uL3vU~Hku*z}fnBLF8kW3ytgy|0!&lmFCdETnlERVi1kP0W{J;HW;d5X+y zLGp}|v#$Qe>R2nRHYnq<*(2zKWlr5{tGC;^bP5E9YA?5&rE+fgzg8plO~9NBf}gJg zLiHKw+-^ZayGgfo!bucZI{>pmK}p9G3$qH>Qkae!W9#P})kO$20@bqRqrBBaZ8l}o z2lA^SA;=DEZQ9j~LqkLBZBCVKZLR>Z3bd;SKPB2i%1a=R^tC+sz-iz(yXG zAC1re7KumbGk8QH(?xu-;NaD)EN1F5g6Oze8@I@^DTt@DZr2Yn1r2+>HQF#|Wec{; zhkL^OTsIhnRPW{Sarzw@Ei>)ow>?w6iTbUrt&t;|E3u!$jJhoXzE4lZn{W2JFY^1P zwY%RG0a`{=SO2!s@QsavV()fZ7>H0!leB2dO6mF-U#M4>?tOWSzIZ?qljSuio6C#j z_xdGF@^Hi&{`;WYuk4#O)r*XTm6NQd<`VF`8tCtTdw&Pa%t=W}20gy8pn(wMukt1{fIF6$6;4is-wEiGrR$ zz67?dsky-W<>z~EeoVA_IhM({II^Dj_~~|+Lnx>bE3*g@x1~;yAK)&*I+VeIT2us> zurMTdtEA53Wb7R4Zo_;YhFV>e)=Zt|yHA-~%5Dm3lvdKyUp?}2&)R6=ipg4G(1^M| zm1LD;x89t?6kPcRWRK5@{UP3%T? z%lo_GyPvs~yPThmzWi>3N|?R(3kx}bP?QVllz|bu?<m`d${DU%aDIN#n$7=w&KLH5s;loQEGjx#;@ZF*ogAH^KHKIk@}>ID+B_sDLHDfK$gawu_4Lp zP@Ct5`KgulTC=f<|HW-zU*FV296$sLZU`|u=WllA;-O;-3JTRfjMqv)3;&sK^*Z++ zXfW5Vud`pM7>!JPVt0~`mnv7ItJW}7U2U^}H(wyBiuP3W7AdyIu*QD&apG{+(xUZ(UpUQ@-~TM-mJ$PQ3d*b}=za zdFkL)ek^^y^@<>RJbP|-dwkyPS1Q4H(mnf*&4*_il>&LkvYmbbbrweJ={C7JR~=OX zM@A$izd;QR!+*2!@*P~BE-lQ)ntB;%DKP=Du>sew>JcV$$K5S<`1m+Hes7-k?o+8i zO142)ge8jriigr?Xeb2DLP0@6r^lsO3?NX#$OA;<3SYm9V8YB*>;t%KZ_o5$pO_a%)%-FfVXGQqW)3RHoPH^QC`P98#ji_I-Sb5a8$d``Q`rZ^w#nd6iz8{5uI#NCS z*)Ngneg4gSZe)4&iueqAPK4bg>~x?gH7yYieK0W4((836%=3PGx^@tHIUoE(u`#k!v;rBxc)&tWR>J$rbaAfLA&Y6DP>Gj+6EK z?C1s9`XK!Hg#NA!7<=Ymj3LK8Wy3D_S8}WMee7^uwo%YlCicuy2@iB<=jsJ@(2t&c z--ly>A+Of30iw$s9j^dhHK)qdyE9CfPAH!6CQ;8506BWmk zgbK>H>3KT@A4+LtIppUa2(j4BGnbS)h%MGg=+XP!JoaU# z09+k274SOnyPsvKl%HK(^thd3)of(}#@CA4TIkErvf^TJOkzAduYBM zFw(HFFu1U9fX~Lx&d%s%t7-<><6^Dd>z1k_*^!R*+LVm)A}Vt^u-hkQ#cZMfY>^Qk zP|^P6@vkVa&&9!Bp4Ujqy9A*_n-TMz>E_8k`29t$hY>4wgjUk$QRH3H{{xiUZJE_~ zk<&j7H>wd~&>0;Y0UY~BHk#CFZA5>`2s56#D&Ua66qf0AKGazIEfG$mC)e|o-1||v zj?WEwaj&nz&^<9JjD~f;^f`@uYK>=znKC$>8x#=>!{_^J)uN=bv8QQA;)xdfkZy#D z*YE7?Ep(?~(|@5$Wv^`^KcGTo0uG_kW2q*xFmdy3NAvaJi3k=JQ5bDhJdZ8T>vzAR z|4k#{1h(C13u8z{9Xz`Fc}6`A@g4bre@0_9)Vs9ohoILT&LloDu>%L*?8rZ`?(u9n zq!p?NNneCIWZAZ*t4qL@4B~5FV~$C9|4a62H@BU5UxJL9B@e`&kYR5{1>IX`qu*g% z#}BC{T)bIQyAk^TF7p9bK(fu#uy9Rzxf68AdDk-5fe$E7$Y3vx%WIZQK^2%v&^ANC zNA$d1Eajt)T+KqSfcmXK(f04em$R8M=^(dhvavjZ?sNj4MMEe?(6B8uNa$q+^w5k1 z+c@%Uf0efM?i~Z?yx71IXI(3eqy@_aOA@cKZ>*Viu6Ih?+EkCSLPJA=okQ5?0fVys$W>f^viJ3s zSdvKKsL^FL*QcCj|2VWUyVZXAwDIsJjN&$l>0+e5N?JRe$)LwkXxXTVEU_RYXuD7v z>NOJVdL7-7ghZ?JtfqX~vcu=_AZ_v#4SiQjgBZ`9g@%KNN1&;^opblNQPKbLb!>@~ zxzW)7su8&&n$AJ5%l&=s{%m-e+GOVs{CF5M{F`r=J_CN!w8P=SB=iIH+pc0jjY>Ig z8cQ!e_oeM}2RjFc011gm?IHof)urXn=tzWs#8-lEAfe8Hn99Jw;EJChE+PWP5;ktP zzrX(<=!O!y+gIE3QqkIqZKu#okMY|f;8phyuL%@}UPXkUY5L~I+02ZROj=Una{$@j z_4&=rc`$>d0y~|nTG!|1X*MxvV=(l|PM5n@xAo$#974qdR6++&HqZxKMsJ&GZpxg@?vhxTJb&ghTJt=t|m?VBF1x4HB4-OxnvI5%0j zkzLYE(nrMdlp8iJq;L_zM&X^}f1Wg|n^*gLyWY(N1r}~F73;*-1lhuDc#trkwoh7e zW-|P&@3S1jgfn(dsxk>uouVn~CzFGZ%5`UQyzEJz&eP=_8dSCDaidE?h4duNg?u087U$s5;`Y=zz~G(>4MDI)f8~5 z=@e>h$wnrS9HQYygyvmv~b28yG>Wr`LF{sq(+6}yeTVhTYeQRrdoE^9m-0-oYUOCHAaPZexR#j6I)9R5U zz{it#h<2H`w97jj9vT7?RDpaRS>fm%02=5kR?Q#(vF02T5D-8JQq$Fy19yVNot&O7 zyG{9-A_)hK3N=ZP2)%^QhW47#D$ahrk?(R$#&xY_Z6t~mWv=kR00ORWa?yAx!+m0& zC`q3+2@I+)(NPe3rSd@|3L+BJS4=Xh?j3-rM&dU2VlK2kE2TXRKN)c}ME&r)O_KK* za|;&rqnd!LRoUnoMVaTF%*1#w+Fvytse|%H*xYKy1Qp@W+4u+VbBzhwfdR4>yY>5L z>`EUWD7h%Ze8KFW8jQ(rGK+7H4xbg9)jckp@5>=M^Q;zFKd|GZiClQ~$BwNo33c@a zDmCc9-`@$bbpJo9-Z{9g2k!QcZ8o-T`^2`{*tTt>u^T6i?Z%DOpmD>-_Pd`u&+oo- z|IJKhGCBL~uh#mkiK(G`BcPhS6F|^ry+3@7xike1; z_oJF#?#pNq7yJe(W8>|L!odIOl1@%+WI6zN*ZF3ro3(XiUETS9l88}%ppa2WN(%aM zdl@2bZjG&SF%r_}&Pu*=;Qg+4VSv$V7X~yS#Kj8V99r1RZoc+VOn`}7n{2e~p8iwt zpLFIC(n)ei8Q7v^P{3ndX3LQBFe-Nl|9LZXZ#1|1A|^@LfNe;vIv0~@F<*rP&2`Ny z$^ehYa}%nlr-C2?mzTiC!boTHXDcy#XNxKyhcO1K1oJ8`j7Hz53kvpIYg%5J)Z{I- zaP(n+oJ_K1dz@5QnSud12tt#zgMU0r3*s(q#7xYF2`4SiE&b>a=JLTT!8cA9HS-J& znj@(#B^Z=P{tcIoPVLBWir=*eJ4Mu-AW+@g`e5XCq8gg1Bn3e>Tkd|3FDgSJgA9^Z z4L5l>f1*K2$wZ+{j8Mu|hE=d<+LUJv%Jn1su7mW>tJSKkf&_tjAA4#FKZo8OqW&%! zR$#3HJ3Yth*8vhj^IE(d86ntxh5jB`fuV}_g}{M3ziI82pzj^va)+r)_%2GC9$5i< zO`1TFAx#N=Xkfmf(sV1rC}kolJB{OtABi<)Z&r&#%=Na-<|er3>GV$>|FDTak9sEL z!h{!dmN~%_SJ~?TMeC0pUC)+!_KJ~jO)+Wb$@1URo`cCeyXg^S$t~vdEP7@Jq}qH= zCJeP?~GWOOj0^dt?KCAfLs8pH0Q;b9yi3XjrCga*q15QHlxr4QDk&Ea&-p13zH3);AN*!ogmf)L;Vuyhux3Kc1e46kL>{G?~YH zlR^@7jRO0%Jxpq2JOx@U&kGx#Vi*%0UG?@>E=fidyh_FdZ|TnAB3fagy?Mtuc!||% z2LoqxRBv*M%5hSkuREl9;lQ4jG`dN{K5fv}N=0|UU;#uVRW4#I)JBApG&jz!1V@C z4$IO|Zt%s4n`4!D=(*d@zk#}45t`K2im`NQ^%<(=N^;7<*_~Yw8+EE2pr%t@bz9+3 z9d#?fB1AWcXRMoa&bejHWIN^6le}|}eG@WBWVOr*caq{PDg`_EI zQjmk2PYm0`QNGYFs7Jw{g_5V-z`mRPLs^-*HlLE2h~Xyq+M3K&{mD!YPV7trl7LDT zX!1y9Oh$i)>2FeQ(d&(aOoDuF&2E|U&h&4`fi5dqs-k+KL6;3lPe{{RWk2u%kn0O~ zSVsKw;}c@UI>+9j@;m3;iv)f0#2|uizbNrtIFaEP<*0Vi&=dBZW%uD_Fzqu4XClTA zUOAJ&X+|hL2AJFh5mP&u6w0qmXf>eKv9f?-j{alB0Z%AgQtzbW^M*^)Dv)CbEt z9R!g=a5Fw5@B=4s%|oM!ux+Zd@ZYzD28uJ&$y-EmO8mK~D1TiL(408grxUbd`8WUX zwV338&M^Kr@Io#=RPe8TV56idWOEcJm)PXsn~?EK)AV_sD$HUc-|-s^zu9s#KGKby zNp&N9??UXdWw(u85YUg!Q)*6tye12S$FPIcHr*9973^*f+e~Iz#Bd{v!jxZ37-#Zs zbJt*<$bXBdfVN=;r;CZtm%i$b4c{%kcEW@Y$63snbM__DO#>4pQ}HnYvBAw!Ll@-b z1wOxx-0i4%eGN-%EE(tTh9?&@og*cS(xCI5VV+9v194Ms4)W@#*oF}MOA*;g4`V2M zS)p3YdJ_D^a%$JF>KaH2FOf@ZUWbl!S<{(*3)QVD{DN=iV4a4a-hvF@OG<*^cLNK>7n)hfYz9rz&beB^uUO9vd1DfQKj~56K)97n5!J-oa#p zQT&aCz@(GxQf|Rl+*zP_AI`CGJ>)#+?Scz8mBrr1TOzNdAP+%;E&eE)u!SxAW_?)M zv#)}Z5`kTesp1-U3_5rJnL@@wF6YBRp)+2~8jN-}V|`a^U2 zA+*-2&6T6em1Jl7XfhcD_&%1FFvRPK8rYsN^B*o2E};WmTtPK@PjR;}9XtMnAxqlB4h9ANSpR z2Zt>XoD3ctT(8PxT^mP${mGTH$v~yTP7awjG@m^8+J3pDxpZKe`nQf+2v5g3rB`Hv z4a-}rVxEPGX&=6BhO#aUtx#x6N-`4{M^+o5=T8|;u@e-SCLA%FXk$yu!GmlZawWZv ztQ3%QH(;Pizbs7>5U#%-EE9XBt!4r)X@+i$HeUR7PK0^`0QusB(Rm067GZxpSQ?_QRV_xv&he}sBNy59&>1x!jf~&FQVe(-bPj2@aAo|Th-QN zes4fAPCp#{=0ZLjs%dv_TKWF%i+pdYD;=9EJtQslbFdH}`*cnn=}*f#PggUf>yT{SzddFX zW)^m5If0Me%D}9kI0Sw4_Eag^z=juJ^mIqT`Od2dJ#cfw&X_95qDvDTS>CRK4y@>0 zT+n@sIy#0SD&5@6Xi}8Qp z9J4h;_I#Md{l()xwJLggGg|k}(HsyfM;N6P93WTg zve%9CS}iA9tAtsVN(HGT5(SyNUhP=dZRmlGt`3;I%07_NSr(6XO-OYkxKm4iPz# z4+l9kG4=5t>0{aWW5-J5LsC}NXR^EoFn^wJ_MI&ziDVb#ux2aJDCKXQ^nPwWo41aN z9;DH_bMn}4bUdg8Uv7Ui^wW+{GckF4upcfB{abio^6P0kKeu;usI0&G)9ZJyU6Vtg z-=Y_=*ICA*RTm?S???TyY5cytO~~tP;_h6zGjcl{^tyXQ^7-&Et#8{3IN%lw10L1@ z+#+zUgY-Z^Mk69humtt%FlGWbTY&9aZ`{ANy-o5nz}I(uYU*r?rT^E&gjmpf(&x1Z zfQ#nm2h+dO@%2Y`uaLn8_tX= z)}lQiPa3kh`# z`si3n)c|RO$z%FhLww)erUY@Nt9T=Keo%oxhux~EK0|8Lx`TUK9wIJt5&VmNR~fT2Dxx6NRNwT$(=_h#8C=)I}viu(7cbz$ZGp^a{4fOFC-fjEacR?5h`D4>a=AKh;-vs(5}n z|C;}n7Jr8-@-`+UEZ}vyu4SwpmMXwUb~R9Jh1ZEgfr;(%YitUaj4VnV;70+Qy3Y&g zek26GE{iyABjFSUr2;-+5u0|`T{1wld6xf7+uQZe!$efYcx>*4Yl9}r>Yn}{FiVjP z0cr*kgsxm)7QScKt76v4PhO+9tKn_>47r;5meXeCglfqYD^$SP_2mm3JiO1{G5Rno z?ZeIv5I7;AYUgxSWBg7pBots{1K|Hl8X8cU4Aj(`JkRwu6XWCU|8!v=B3@tRZohr6 ztgLKlai7X$0xFz08WCcO%G-_4%;K2QM%%KcW`#kA;G7UvAT2pLz$bwRX_G_8d)eB5>|0qI$-e>q4iAfr^_5-5 z+atc)+h!l1Ss+`17FiUx%NYd_X-4@}Voj|n7ueur#^528Oj~=T4s)03N-fAIX%`aX z%h)~F7b(A={l8EANk!qppM>M%kTeCak3dNXK=JHo~B6-Rs1qdMOg+U*>K|vx2p7*Esr>E=kvf83| zgXgI%hVs4dq#_M~Or>NzhRFguM8HcC`A#~L$g`uPptvu2oMQ3T4M1Ph`|1Y6+-#gI zuKfNu7Lzj9K(ftA_CB3r5xMwheQ|bfV4#vb9bvF{{ncd|``$9_edl9G8=4A^uS4W& zZSmLb5sTyIUcR=Drv3(kXy*|&bTXCDux{`q7fAJTgIRp}LhQ-NbM!aj zcB0V#?YVReF97nrw6qj}>fPSn{&@Z$Iv}kkfOZpFJJ%OWh`Bm7E<68;7LfcH)$=GF5>*l|jP6|D0$%+wE_9vg$!ss|< zzvSoZEIa%Se%VmMuM}}Vs9v*f$b-@d|Fr*1d6)8Gs8)a(-JCn&%;j++Bp|W1aR}bt zb>4B{me1A2yL%Wzb>pH(jQzd3K7vmvdo{YI$j!eGx1$P4$&##|4GeS}Uf@0t8-zps z%M<@evl)P4yZ`mir6BA!1Yq@c`ZyLHO_d3jCTHoW5FDjq2cC1%uREa#qYJ!SS+<&G z9Q(NE?`&=Lv@U`Lmm+_^@UqMZ6*%xL{wlb>M_78ztGEj+%y9J})yksi5) z^n^Md9vxYUOd+5mOW;TZyu(+_GR`mn+CEE1Gh1KxO{-O+JzilF3GkskWON z1hr}}T=-IoG%_+%H#dZ`uWdyLn*%0CyUAf$4V1gODqY9N<9?49A{ZZ%EASC1(UzLeLsG! zZDiHIUmW!_&oK0*x(Z$V#A`A6n98fu*S4|}v8`-iKQ7K1w|pjx8VW-R|E0)6h=9=R z`wRmyEItHCQX^8IkJFYrp8*bG4mGuvtfHjwU-8h@hlCLy-Tv3VvkeuL7D6*uYn@hR z)`!j8b#ChumRZ)z(vKIKTItG)3jMyCZ_B6mNyJv%+^yNa9+qoXzn7QmB8|QW_EjWF zZY%fVxgP(Rwv3C7?Q%Ox95eyr67jww)c`-iwSi}MhtTnplbdY(I@Z(E6B!ltc)kHB zfN=qgD-n?pH}}KF_6LrjQI*CA5KI!n4TLW~{bdP)&rGsXlzLx!nwt%J8?HdTJkzWO zl3EmaC2>@1-_7>-Vfn6#kQt0t+uA(<30-GdZA)7pisjV^uJPUdJz0Kma4=Aw0mUV$ zx>@2jjLsp!emZa}eD#-zAR;VvUwgIcBFUj4$(45Ouyl%xlrA|eU=1=f=s5bOX#B5} zW9?1UojDez)Y<}-1g@dsY#!g>Rl=;GpAz<~7x&6)MusvHGTGmgiR|x@D<#?%_^rhi zHJ@vXwb?PUsio@Hb#?WObgDB9j5q{(6g)hS^QEu^+_jhni7^xCiC>Qn4<{#$R#!Nu zr>mfIKLhtYFCf_wX*S#Ed*+{j;a-eS_6MLxRwE%5Zk_fDAfxkpAuKK^XKOK54K zAPlq504r>uodje<&CNSap;F!9YPz-SM=S-;&#!p`Bu=e4R+itBB>}=Yp!?0)vypl@ z_*wgBG%Hgh5lOiw6Nzd>vo?lHVFp*km;ApRKCj?Vrl3y=+mzgGD=f53}N>a{? z7w{DP-rY^WE$VfZmzO8#b3@4qulT$Htj1~jWZiZvUF5L7g+){O6*id@r|{Z-o58y8 zEII6Jy)5HR*~wAZ8J)exq+2g2yUw|#Xl<7aROPfwR&W+AyDS(#{>@;;B7~p6g5rKp z^zaxbgn^EYzrMD4ak-C6_+_ux?{enc=(++E^5Kc(>b?*!w~~$yd87Z*TITpXx1GO> zf7Xzf1dj+CpBO;t2WQ=L?rYF$8HX2JWx$PfvvAvyVjTEl#XNeDJ>sPermMN9M za*=*HK-G8Ev1x7DaR&TflWJ*0^9e5F7uhA&+^PR|TG>m&823oE$gwlr_>+a>DkiqX zyp#WR($)EABdmcCI{%kAL9*>+j*sUbd^|fkYni=tAHdWcM;q` z(VP}Cn~h&#^)zG2^8-mk97CZDciB|Eoe@z3GGn3GTjR%N3tIKY?ftUGzfH`W)GA^W zw3r{DEAi(HAk$(Rq@WN@U*(;>!3N8SCZ^t>5MUd@9}l?w+I^Eaf1K6JV)YEU6mwI)!SoyTRjF zS64ZBexGg^!D0*u6@PE|p;jm7xiVcFq^^m#sou2A_G3gVZ|tKIDW0SLzn%I%$>%pE zSlDe}ma@=Xfg&)B4T?mC)bC3CsfY@h%XBm^dh+^b1;D=OvDKnQd#m2NK&3FK{^RdR z=-4%$mooD&PquiemkS0o1b~4H8A2g}0P^XnB9&==?WxE>5mA$N>PNO7xVUf}591*( zZU6)#2*vH)6#!VT0#U@XG(&*DyQbPsHKg%+;`i_0K9 z9jSHF@Y~eMGw%^YDJaxNs;w{U{LY)1-z`Tiz4)NJo-y=xo*KWco#3sbq^gh=!BT?} zOL*|-r?Qg%BMg61EL7{qlNxU|I6_PXDWsk}iZWGuX4>*rCtX(7&3X&+MXq0L7@~KED~&=z!Yk z#Fsfq+ZexI37aosTo;6h*(=i1R=HJTDuE*9%5C*Fk0~7%76a$*Y+2{>*k%}OQy%8> zashvQh6iHnZNDV^cPxyD=Rr+B*;LDJ>mdOd1|Il<63KOZXB^l#Y1{VX?Zd;xIXY4> zKIxzN&Uo~z%6lZwbuqFIB~o95+1u|tr!aS|%SRpn_2M7xJ(sPozc6GuQ5tt4{JFal zlXBN!)MaDh+UX7zzKc@&Pw`U-u}zMlRWJ1Fy5BrgBHdUnp7-2D6}H}D>$KZ@M|0Xf+w7~5fk=>yF;v7H2AB^ z)?{VMaDJ%M1Z%0iRom8dAHSVv6J@a^iO4FM!i{oE@-b*QMmsO(pN?O)EIiPXCPvrG zfE1znGz+LE3!3Maq|oADzI7;p&FJX`jM?{uHtirKBMRcBbSOD-6ll>ZXGzoJu|U9w z!oa1$pBh|a)bRM5^^KEopqW?~?%TBGl6WlLocaW5NxEE9bx4SR=q7t=*ntVRyNomh zaa6oSXeETQJ^YL<_Bo1Kg;GjmN?nvUF1|EP?4qHASF79F*&Qp%rAgsyHj9Yq{oS6 z9!85}fB)~s+E%IY3K1XH!s>d;>+!W1$z@s!I_l+j#rSyQgy_55HOwEYUH}{EbfkPZ zL`>1+9v1@xy=i+^nSLOhbs>pwt4*5}9L@%ix%D4XSFczFZ`efj?S z%H6bVIdh4@#4a&mE*`LjpJ7*C8G z8JRo%lpV{Nbe%NbJlfxqS%2V(V>Wp3MO}BCG1xp};z>h~1|;CfOv5N)yPWYj(Kl24 z?PyK{|ID+`nGFOGY-v*7A>WYzVRl6-sk5gtcu+c4wp4|G^>nhBZ~zPLBsPm z!(pe3a2LXg1u^-LN&%V6I zCQ2{ye@m1y{Emi+v39)y8F_JiePU!N<3cAP@ye4>@DHv@CAeojG7QQBREQHWn@FS| zvF55x5enC${xp~Dr=T<~^It_98k8~z3A||J7^Ej~Wj6_3A>Y()-dFzj;~xNRYf^$h zl0Y6?GRu3}K#7Z~ZjBDqhM%*@``v{4-4uVGG;uP2g9@Aq`qEc#j=J$us7jM7Akl>X znJHbuz=g?L1*T7Biwb!nV}R@sNdP@ zEgR9b&TzC;3!KN9T?XHY$6VvAzu+)omedz&dm+3qzq;mHbn2VqUj0ZTixUM~86>Ec zGUC_FYfghiOKx<>fOv_%qtpE(mJ5xagwiQm&30^1^{6Vy&mw<=nN~DE&W~x6n7Pz{ zK(|0jOI?Sui7Gf+Y2WniQ>KTsYa$$!7C&gC7i zN0fo-3;pmJC(U__~%+O7lU>L- z8xwj}v)|duT?_0Jd`t>7yxJ$-vMoKfsIe}fv|H6BbG2R*6puzAULx9c7YspSyz)0N zF!1%|7o^1o{R8eGZ*Olh*_8jb`vFxtLem&WA2@w~OA82>-!B-hh57gqd!IgZzA}qD z7vsyQW$U_b=E0dsghQ6i8w~1 zS*qkTGG$*M-xO>SWJ&FmGPVQ%?;;)K5=<8C7{X}S>w7;N_lR8;s%-`1%6QxCK#Qe9lIv`O zE^pTxIfU++9p#O1fWjJ&B5-r<6!oOKIUi?>3w{ga{J{)TeV@64ym51rIdUq{QpAc2E=QQ_s`UQ+2ZYy3+=aTV}Q8un6O z4TyOcMO=K}3dspQI!ObdvUr4qdD+?UeTY@TX7)hDL=!k@+qSjjb!d1Pm53h;8#|&< zMGtDL$LDsbO1-nQ(>f@rOjbbw2@Xz_-y8UYS%G-viNtuM;@r#4-t2GQ+=7C4Yt8m^ zfB)6uKKmTBoE*q&_xAV$PR-=Q9h1-9qAg_8TgTGdJw>p;IdNu?1+0GKc7A8=o~w_cXbT6&(dv zCZUaJUOokXHg8s3EpC+fjxHzS5hdI1u>iyv@6}2)=jJT~VLG=Sq);?NeuO0G%NCPp ztZA#i8>`%ZO)d>IEfi}d5VZTg26)&8-r&xYkC*%yF!Gq4i3TS&ptpARG;_)yiu-zs zFQQIQ#-=EEj=E-8+>JHvsZdw*ZJ7k-7u^-hp|}b?Vr`=;L-c~hSvRb5a^&0W4f`$s ztaDh+{F<2|N4+xSr#Z4q%nZSSyx6z`P8sd}mn!4C&ue^MFG|-pYq#Lt0e7~@pdr}) zH|%=!UFn%Te&mH7U|A;6uFm7M>3;iy%&!90b=kh!-rYQ9#vVnCA{#9-_4{8|nmSrt zRq^%b?dMAnZXctJa(Dl#Rg#(GM?1;K==N$ue>)53)0~OdW%ln5{R!=L{G12B%enx= zXU2DcPJ3NbJX2torS@RIQI%KlcbXe_3fa@$&uN>FofD}InZF<{4HFMiCVR0&!h23xKN}Dr=%B;ZTt|2owtgZs=mc zuOEPDK_q14-4wtn*8^ZouXcxl-%LtK`13zz2I%Is9>+gj$;oKes94<{9bbl4r=}1Q ztblJ5Ek}aq?hte(eza+HEKq|$-uI{2wcFdzo-Cyd?>yh)&lkPe6p3>D9di%gPVNr3+)#M_$$3X!9e17=yB z>R=g=h%Vdhhsq9#0KNx~YSilwtwC^IOfsMWyh<_0zUC6-dR}fqlPAJOp}?$YYrS6H z)YH*PC-Nn+HxUa4rdk?u+U{MCl-l0*Z-$q6xjg5^q3n*%>}K80b`(Z`(Tg*R?>v3oz1f^PfJ&9YN!=l=)xP zY)eT=MMXtP_<=y-!=!vhzjxg#s{#V>KA97;j`+Nv-Tq7JRAYg&~7j!=DUOnT>KX2 z=JHwh20>?oZZizXpj-_a3W_#k5^zjc%A#Euc6$!)yYs6)0+<$%Ivuvu-;&G2>8_K` z;SX>{F61Lj7D55vArrExtoc*hxaZA`1B%8mUny8p3_|9Ig>rdX2PZFOtwWA6003$MgJ~JB|dKpPT z2yqBesh66X8VoEf5ZpbF2+Z^nA;lzf{q7kMzTh`7&qI(Y!PUFhfYS&tl!d*Vx#uj~ z0YR4jeEj@90HZZ*(EUl}sb**)>sit`pcADBFQ$kNg?RI`X~##|`114C>r-cOJ*ryQ zUdv3gNg2k&HN68a6q5W@Sn=pa3H|xTKw<)Jnk3jRm^K)#; z#`=iSyv4}tcSCNqFt1Kf*gOn*62VMJHN48mfjR#P*AEwna412`?v{8ld|8u!-sou5 zzHJ>5&CMV^l|hrQ|2XHYxmA-U$m>h}-->Mi&Zen?T#PXETY3gGaAAeT;3)!1;Ba$R{62nIk`kj2N z5|`rl6+2A6o~MQl8Ad`}96~1OYkL_qKnw>Gl!J~3XF@^tH|4x z)8fUJys~l>s|qa^X%#R=AfloIAIt%u#g3_(ph!VC=OHssLf{{H$cgM2FFoBh5s{~z zFhC|MpFpFetX#rg^&cgL#X!HXn<-dAbL!tjWQVXnyt z3`1eODqMgDszXsx@%^->VWr*>(KLAGci-3B_12pAw+CUL8?64(d|q`ez0TT&eBq3% z37SHHC@V&~yrT8`Z_R_0mzMm&eETPs!lEtDt`IpvZZJycYZU)3e z&jQ6S#r-3$2ljD1^Hz0N+F4&$&6E3L>EBb?YGVG*g&;tdnU~(t0sQKavdHl8ogQZ^ zz_UEKOBNko6(cJ?^97c-Yig+SDBV*Q(wk7|Z}1DY+wD%w)tsW<3Att0Vv1G2M!uB( zTlKhKJMI|&v9M%^xM6UFx<_#qimpT*GCmU@St#LqxGLlFE zENDtt2>AJV-9pHu`DB99+16Kt#Dc!~^n2g)0TWbPwo<*OE*0E#BrQo0#8|P6XT|tU zNdoS4PbEgaIws^S6C%~y9-?a6h|;!-XF>L5yfMB^wzWLIeGmV3A&o2ILd?`=-=Ek1 z7w^T<22bc`X@w*?NJZwY!6DEDFIcw00fs}WU~n@BN}Umn2SR+f72`sVpK7?n0NlK9 zgHi9K_gi?&H!Kta=gwn95NFhDGHeS+j_#?W!F-fC1I_==;*s${I+_fnl-W0+#q1b9 zHb+V!w5_pl2vgsGrd~!oANTQmi*NnpvOHX2^4e!-5)-*|DEWktnc8Hq;?~SRM`Na_J- zfA4T^qFYNQ;lQDc41OZ*tzFJzCSdysZ4OCEmzb7?L*|cIwyOBw^ji`BXh4Z3{t)Sh zZUiFyjTE{|0n22^INBGoWwl6w+Pc_&?zYOfkDCu98eC&dU18sP>nY!lWQQ2cbIG@r z!y+yZLW*0`&P+YIE?e2H)ZJfSvwcA-iUI1{MxV#V^G`RaI!AYBT55W|8odighkl>u z(X+x5Oib0b-cSu4PWFID+)nVJ8wQ zTFuyXCS6JYJDdV%O)v<(F2pA+RvO~3j-w*?$&Klp~5L%#vn=?MqA9-oke?zz(Q6!LHTSXAzQwhdMTg%t_s+BF2vpBrChW>m}+DH_VYUD9JnjYPy|%uQ~kndbzdDnA2`{b zY4LG8{_;MDk|fQ<`^8hWbLSaDnP^g$A~>j9nt)O|TZli`lli?!i6Im%viQ{o!&`U( zl0E}LTW%7aBv5Wzh{m}WPXP@HpX)_l4X)^sIbl#Hi*a$X7*uv5BU|Q3r9}Ttg93o2 zdzlU~okLV-RazDi%Uyua1@Kn~o0Xcl@1X^j-#QE@ld@=h1grf{eltUSFRAp3am-Ud->`qh^yS zdEa40-md{WRB{+>x1PYNf9r$kOIp=L=Uj61KdaeU8YAzUo!zBz9RqWXi!^CxJK^`u zjRct_tuJPY_Gv&x4bNTV<1YIh z{8bo`5)44X&gSt4+<*uZ;9-SC#}JO^NAy}Fl@v?|fZMK?12~+#qKRi{k zFf{7V?L=aK)`jLJ#ZiNWS263@fB2nwY2MNUk&H%Y`wM7LlgF>NvV?a z#RcjYm2c-YTgFd-ZC0NX{`bd7dO>{1cTltMmz2TC4ylAiK;yKh!+i5#}D>MwQ zOy(XS<4iP_VY1h9#fI9lUf6T0#w3i#42Y!^yC#Dy`o`_BwZ6D$l|?Mp+{ic&PfG&@ zDQ=Coyxr|^46 zCeb1W*p(P`$rQs2hoQ)zLKR2RcA|Sy-iE^@(8Me0K&qf8bgU^$c6}t@g8HAy11>Yz zQ;=}Szfn%(;wGS;rM>?@rp~dw&T#G4!Hm(^b{aOeoiuFJxM5@4Y-~G?Z99!^+qSiz zwfDQ;WB-8pY2MF`agA{fD>b!)iF4i@p<<1^u+h39{0aV0*^x!_#$3No7rmv9$-%`MxZFB`HfN+5?ldGQKVmgV!C%~wWUL(1 ziIv%MoROO>UvwIxby>eqYYkS`I6VFc;0(d5LgWxc(aAZ(8lEp z$y)2`ngqa$4NkwzK)p_VC->MBI`nk3o7L8J@_)PH9J$$^6kRM{0q*6?&()hO6QY~V z%U{ilP~yA`HYe8R;~r_4UR;*WMxO77dOQpdJyF(OnYstYR&pAk-nO4S-k-;%J9&#) zL8Gp@XB;#4bVBB>z5m}qL=+Ahk%MJ`bg5}udmU)c?DVi3ul4-Z!Z5Pd*~LRcNZ)ilLBStI6y7dJq>Ecc`MF zg8cj=U{E0|)~2;yF6ZgO>I|xXY;VHqw1O&ezBrtVz~j(lAak_@em{S>bqwy|ZcxEy z-K|)gWk(6$!u)rYrt-M|%FoDO4qlrx{wF;FuZxx1gt)k(<`#>VX?WSEC%~9Sn;G}~ zoxjiUuL`W>Hj^%wy5@7*LR4OTJsUSSH!m-~GARI?11?gSn3ypr)$#T9^~4`nA)J+Z zgt%v6h)A9{R~tdMp@3RRW8>w;yJBx{etf-~!CP_+a3Q2Axb9>fqAxdF+@HgSjcQU- z+uM^LFY+T1BX#9l?_7Lt1Av+&1)}Kp>CKO;?e#WRLqh;rjxjy2UWB8poVKH>|d@%;>-B12y4(*60j95Zv2QH?T8EqO?b z06APp3?fU!bKn>Bu%9KD5U8N@!%CMldFvkMBq zWaU#Jg_DjG0zlw1lc)k%ojVq61|Rg^cNIzjd>!6N*UzR8qqk+N)sBlI!D;iga3mbw zOR~9m6{hjamCgxk)!#`8pI3`rJa}oz?tF65JrDxWIx7`a8St27sL30L=v^Z?k z!SGk#)zj>2Pz@?J09Tq@T@dMe2FwM%CN0Dy=bZjFiuT97F!$2 zfFvb6^2+AMMpT*z9DtHB8&6{g66%7EM~YTfRzgDEKvX*+J6j>0jFlCgjCA`fHFx7- z^X+8t^}#)p$L&{DG*h6YkkC*7Ov_?r0SuJ5ZkxMSfieQJv(h)OPqmSU?-s!LQ&W*q z(EW*xWknU7Iy|R9O-cqM+rMkY_Yxm&&L-?aJ z#QSp@&#bHnmph%qT2`+4Y1uS;z0Kvz`Vdb!WWajaqNg*{`M{8di>m7N=l$pFr*4bu z@zh6vG~6Ljs|rwV4axG5iD4t)k@VE)#X<;a8C;E7Q-FLY&e=r=O1ABVl|zVy0Ear&99 z=FAN}R9X9lEDjlHr=4dKSE?#3&`Rhj++jyN2oRr-pI^E!%-=Xxm+6}{hg!x3K4l#F zUyHcPNDONY4`F5^L9x!7H^6)$vb40MVEBMO!doKUnF1$fL8b!d!5WbEDImqjN?!R@ z1C(dEy1B7)a_%m$mP8bi|926C1Eure;sADp+0Y}@};7CA0WyQDRZE}l_9?Rm1O>t)> ztZ==soB?zapnmW3{L3fR)fN!^_1c)4@@<4zU+ePu1Y%l>%XfEofIQkK6-B@eu_B|T zZ)OI&15UVYB$xAXt715-f{wpnHD@ljz5OjQaU6*2Ai;%Rm|arV49{U*ob=ZnPW&4m zAInn)a0+i%FrQny4Tn-1Vyfc%QC6$deE>)MDEhe&&%_=ipr0M z+m-t%=;Gs8QBovTcF8_+`)q+e1|w0WjnPGM%0cqKS|@nOFHj`aMHPmZj7%E?Q;DZQ z^GYt+R*NSoTx=B;<>$TLr~WwOrD|I{%Z=_zaV)Gq0v7z}9v?Yeak=VVviM*I4b4yl z*AA9A>Ib*d51A$^zXlmuJqj(199eE2OnB|hz7+s<&ZylywYjNaV-RwLeFCE&2y_~` zs|Q1(fJyv~{mJgjmd)>Ru)BMEoBhd0M<-iBRix@_FI+qKzl-s@GYsVW6%=YIjesVU zxpo#lb`?{2EJ|t{VcuNztGKDUou;7Zc|+(nvm`4dX?bTkE8-=uEV7E&?1w1hbg*fU zZ+F+Qi%POS`w75ycjEaN3xDGak5r^#rs%EbtDC2kMCNjUcmCUwS3kzO`{#yP`+E*LT~?^|n{Own-hqHeOa2 z(?-+QqPC*8vQ|Xn>kTQAz`z(GEb=`R61W&42vVafqQDpsi*I22<3>8UP1K{n)s;aueyyazPX__aTa%^nu_U+!QNi!HI(V6{SN`ninrJ3Rj4*>@Y-}1^#!Q!;I zh|bl8Mn=5n$MEaTK5c_G))xB0CaK+0i*I*_72&*IrQU6O^*=MrdI>V`oM3JLi%?5t?d4KcMxFu)6>!2-rx6AvY{2j8u6uvp z%(ol6`}NDFlq#LNy3mQ{2JS3VHeJ8GIrKmMVue|(T;5x)2+uo`XDd}z7o;g>lNohJ zhK6!V#0zYZizwO8wKZJz-Q1>!4J8jLXVFE;4TL3m(tdV6J)uX+dNux z-L-=~5?*bn>uDlAWM{<8Z7zE)2?|y7;+2|{Fx1;q!lgKfD6Nf*`0>+zjPp5+E-@9!J4IVlJR zNK$xy*Z+e;DiR2bO7_9M3qy}aqeB)-`a@N%P}@O(VMiM{f*Hpx^AB;0pR72YQUi5~p=I-{Z@pDjQLG?D^%Z~&Qy#fGab zmH?YsXz8*PX)^Hq17TEa(T0GSu&;xLX`lcQ;a@#py~KOpc6ztB$kBKICSb;81*%Wp za#Xw%I8Dth;9;P(dI0sp9ghY!n^S9NGYbs7nD$7g(zdo7%RAab+W}vn+jT2`-fp;e z_^W(10$>9r^GuzLKF|9v3@`wcVZxMNMzwyoUr|l%smbS7&|-A8TRmJiq4N1j)Xeu> z%f;-+OSdn%!>p{;xQ-U*IU+pl^Yf&4V)kQRP3Lj=q<|pC)|c6(B`J7Wl(h78pZhYs z^NkK(8XBpRA6OU|ViFP}tjv+1uoeImk3Ja9F|Q^;h=6-?KKFax4_p|yZv)~RJiIQy zk1iT2>UrH{S4m0#uc?5k1Hn!Y`nxNj?IE89$mUOae}wA+Nw?d9NG;$!hreheB_m~7 zZnMbh<%1RTcGjaOauW5K73$-3R1)@iZve6Ww4Xrlv$<>T%5#mc0> zS>8p}w|88tlZl!G}$~UiBbEb=lmtz7klMV*gp7 z|IFXE#CyNeargO9Ae93R)y$-rHh2jW7`#q4`2i)3$7NB=WiPq6g|Tb~$FX)h!V2^I z&)4=S?8*9Ut9Mh_&9@)t_@+B~%fHy$`-UF~)6)`Al#ljQM{6sS8e4{GMb-!^w<|YR zIBg!!S45NG&;qBYl|sdOUFU)GcWP?t5%WKm08)e8QCS3|GbGKu!5)01^Y8b-%sV3- zXe7tQ!L|B*Zj^d{O1N{jXZUSKT8+ht2haQ~9BaLX60Af+p8>lxg%?Luv47Y|Yj9y_ zZmb)xK_d-8weswge$}|p!ez3oD$pF9c~1C~eVH%!Z-rLHRQg?G|2~4lsBARaX37*E@bD=5cKmEGadt0kXo0Hy8vxmnNtm(B z%rh0vJQxz?_tgj4n9tMQuGG3NL(I0wx8l~TSVt8EzAl3}nq`cI!-fWQxRlN zy{RPaAedOgSOGNaW$+xAGlGJF+xsJoq>EuFJ8G_I0ttJ@Z_9nd_!|y8bO17Z?#}m; za0g#ro?{76G9$(3jg61@34l8fN;J$9Wq1im7$r8DUbvgo>m!j;x`TadDYG zkoh#r<4@qfG7$Ld%2T()6I{-eu+=F-o$+j!1wz(sGc#wXo(3wUr<#G)#iD2y!lXSES z=#d(*JHD4F8i%*xSwM3$GNILkbkwT3wuE-ZR zyc`#&J{T>T2M-PXvNdbTk;dRY$CP^jA?ZA_dzM8@>D*X#`<0b*U!LLzD9SQa%VdqN zlE-arAK4EHGOq*PNQ<9_Z3WtC4ZdIE=FIthgb3TYHiKRt{Y-h>Gu^#(rgn`@P=kHy z=i27Wul%O`y8YkA&yfc&MRCJwKe+sZG|#43601EXi+4tQ~93oiX;QBr@Ri3 z)cF~~4Bw`p&*oU~{+!`IF=%+T{m&BE$!7KDBLn}8rNNov7Afm4jqtaaF0uJZ&@nko z3_CL#)+kyTiX-f{%#Ft+SI}x=^N^68^c@SKH)EF6)G}h%64+)}(oRr|?Tkft3=Oui z(c)2D&9=6kh<)7IXj~6lzqd49N(PB>ITrR`moN!Dxf)mtkdWvDqKmh;_Z0O0{{DX| z`qtLgfE8ew9hmw%v=9D3rfJWfXJ`*3gZ|wpS}%^KEOUyzZ2m+y1x;*WSVg)opzemF z_tjvG#|*9sN0A1xSxT)FX1&P|6>o^A+JF2vnP;Ms{ltMupBk%a9oNtW1S24Hr6XQ2 zjBU7SG*}Ukmk>b@JFAM43!nN0z3g$b=7~B>QF5P2k=29aZWhd^+Bw=-3yo-t*2;18 zqTiX|Ke1KfMg03B#KWlnx2|62N@5R%rmfFtt}d{KAqLo6CNrdm0I|agYWP5@$TAz0 z@JFraU#yEC+il>5id|6H!<1LF{uM0bPUHyKBxRF)4m4-2O8W3v`?duBx@O;=qaEXh zIpt~}>26k=RQHby&HA{SsNT-B)3^s1l}rU_JR1dPer5UOF~oh2_U|^8o!|J?L``U$ z%Q?!HjcU0vELr$%oZ?h%_%p$1%zuE>ea?Hq#(-z3(10e-AZFD~ng4b!QO;qM$vEE~ z@gGGJuaGnS-wTk~pQoaJ-dGd@0z_v7>M!&9ayublA{|%RR|+q1$v1{Qa)p5_b4~#a z>SN(e_vA%7@kQF`c5C_=oQSfem7h0eUN^l`ep@Md=n@R_8-??wdYG8dgnZosh^(0? zZg)#{gGL{fo4VO`N;Lt5>j73eaUa`HhScBf*&TbM?$ZxUOaM-QYF3s24-dSwZ|%+f zy|EbXjqfpt;Pv&DmxqT0v-A6Z!b*|^ykB*6_vlTM*CD>1PLU%8&g8CH$y0=%`H#i& zw+`W8{RDGNYLuMshRGmh9D|)aurD3Q!p%?=LxJO~g-SaGd2!<0-(Km@YDn90Lsj7M zWhE5$?zTQ^zxp*D4{g+>UdFBtZOHu=Tkk<5DLRpl^f?NXe~0R(K4x>qJl z5T(ihEt4dga7m^!?=WqIj3h^+gNGJwNuBa?eWCO=it~qL&s!Bsme8jQj>||&;$Egv zM$4=`o;#{BU1DVNZ5Yqt4xO-WDP9ZzeAbFC*1AeO^PFc(1({VXb#{d0PGs@c!+@IL zrZ3WIQ@g8@n7M6%WpYwd%D#m@Jd#jP7(dwmyBY-k5oFj11u1R-9a~MT{a+4u^U_n4 zE=*yBp}fe%G?|){pi~xJACYEfM9*zmIPE65y(c&vgYg9pak@%R+IW;*G@CTYxemIW zxI{c(*Jh8r{ zCO$AwnJlRPnh}W+>9J|JFj>-_s%_PM+nPmV-0><}t%CLBJKNVCA8TlPe+^44&W5Jg z$dfgF3**XthU&IvHnnmn$2qo&_1=$WCQ zvH&wwjyxC>sQOx5OjELLVzAq;k?O4vPTVwmif}CAoxGipR&v81N8RFdT!+|_GK8Zx zgtwDW=MDzfg$@Fv%x?W0K7DL1k~7{;1|-SlQRW(G8QNRAU2$({ZNo~>g)8O;I5~Tq@c?|bPV#88;C2o5;p_Hn#o}#mkva?uta-4`>&g26koOfsQ&DB`-|{TajOeU&9Rt3%}e8hYrWs)5E<~ z{Z%Gb^JDmhyYcCWwM1GSdNm~N>nV!hImPssFD{orsLWn2N|7LgBypm9x;TBb#rayo zePQg%@}iG#LS|sYv)@%j_nRWB0x`ed&lp@psy+3pMUQ&2K=89HLbMbUFfB?V+p2Y8 zy8a&Cj43!HCwcn;?hM8TH3z`8zPzkiw^406I1&0m`ZTDT#K|hz`UMfIY_{J)o`r`v zSdAI+Rz!9S26_ci9j!%%V#`-Hzba%A_TjkYL*!ID)bJ&@I-ze;8zpH*8==Ji1-i@8 zB5%J}Y}LsxdwX65xq*y_;%&HMknYwBlq!dcifRXRHvz6rKsx|x!v6L5<03+1oW)Zs zprN5bKtkHV-E^~_3jNO?O1h&E7WteFIu63=*Y%@ zX49sAzvHN)J3ZvXrghL@mz+yJGzW@b(nwo-N6n5@9&TW)o0|1=rO zI{#6lnMr3Cwc&k-w#G~RlWc0kr&tpf1mVSb-7F{WV-5XceP`@6k|s;iIxsa42v9g-=slJZRi#<7$6pI_u-3QXp0P`=A`E zC>&>*#*K8w9E)t_D-SD$x*!2FsU(^NMsM4;1lLqMiG#UcdfM@5!x#on;RSaQW2)q@ zbM&I`t3lP99$EH#iYQ1@rn4VD*_t4;%Z%TVzy#vkhi?;IKo@~Rtk#cuD_KCbJQw3 zx_|tcdVh;+T>zqg(Y8IGqy{Sj(BfA^A7IlGGE&ZB)Gt@d%evY&j>JKez5NQ5k^6l- zu@;${7N$s{xQ0lRb|rctk)1pK@?Xgj=6Ho}RiOT7k6ibI!{<&zO3z1K*n4B*yzSxQ zW_k!wooU~waHE*9LOLQWK+4teb7bKDGMfvv_Mp!xoE1ghU+EAB|6;lQI$(<2qp|Yy z>h79mJa5IcDO;uzf#2S7_l2RLzv{%|^jDsO^+vt5qmfXNs$_P=%{@1Y7YpO<$^GZm z=i6e3hv(oRH8H>Y9pDaqdU^^B4kjA~+I?Q%FMWKDrg8!1N~V0#yg8tEtt~GPyQBF- zB44hxulsC%K)!mxyu46TQ2~_)TDQl8i?uA3+8u99AN^ghu&~7?#e7E|BxKBcqY9l| z@s0*+g;z9SIMF|Hpc`(#$8LQS1i8jZvQeYMNj=LjPO;4Ui?Yn#4za~rWVcg}87&RQ zXUq;4)=*eqg#CV5(U@&1xmbl@Lgk{>EDb;W4t-m<=1<;}>vFLX9TgQ!WT+Aku)LxP zc^kdo-T8`XmVm-Op^DrV>$PS(M@I~4gTK-L_r?C7FaP6*D>Yj8HVIk=#@UK_&($Y8 z3WH$)h4&RRzD9EV9W+XwO>L|&?T_9q!6h7=xY)xxMtQm=Rev4%2vJflcK=!5RXYSe zO8l9%T93thmc?)#UP;G<6;*d|B5@ zt);N^pJI3zdqL z3Af}q@4X-t@LCs@l~ra71v)1HIFA7{2M6G2N{)#EbF)33DL6Sf0ru922*kqV2=~5= z3SQ!MHxfM!9=kJFNv+qJ8D*1)hJcVaFVDw&q`NF`2Z>xonu1y+y~^>nPq9W4ug|{< z6yc*0#(hG)spm%EpZl(KCr2)+>TZ%bOvwphV zY_u+$%nT;E`s>L=q{{}D_N?=6LSL!5)o-Ds@KIgjP*}I?QnS|yLbIQLq)UDP%~Ewh zurEI!Gy>j_ybK*n5-Zhcy*?7`5t<42|6kAoJ3Jm2=I1Napgt4&B5_tB(8-6vG3%O# z@*%=S!J;X=AOdsz{wzz|_{LMy>Gz7f#R($!{Km{Msimw7=Oho{%e7>7P8Q;*r93r^ zdxkR!A>1Y*k~q7Q2;fD5$B4{iFduGnU4b)T#^LLW6q?Y`^wNtZNzDoi3pGJcc1vG2 z{+7r$%8!exq@i)NUuR?OMnu*_$@SG@WJe);Y)r<&3g8SyQc`8OsouCBCarrBl3yzw z5^s!Il$!Bj<8yK@pI){JqtwG6pB-jf#!YD9WJX2ve>A?8Y{lrv@@6{GIyE~S#ayB$ zu2nnD$~P!;GNeAY>Aju5d$_oJ@C1jvTx_)1akGzi48*D|HCwlNYL+eH3%(qYbJWss zbGH-}>;wEgK))NHUHU5Z3A9H7po1l5inV5&WEW9Y!n~-^Fh(C0=UoZ;mBhL7jIpDo zV&mnR5aJIa7RU{biuK~3F+HmT6}(AvKaT?4g2Lvg%tNS=qEdaND41^tyGw6;(uL2Y z(2AdlQQ(GP@$i;amcMbVr8F#M)vP(&H8R>Yk_xXRvMk%WmtV{IoG+i`EoBW@3a60L z@f~9^>B-)IL2|vk{chKTdg)0DP#lHerL;dFs1sy zb9S@St8B0<^nb)dc?uvRT2NX#axS;68F-xyrmqzN(<`zMhT$Ji1B#s% z@q=kwH*XLjtjSfAqsskbYxIstLr(zykcdt6pBK~pT~m`YO6=5Z(@%8l-W&Ij`<5Xf-dgGZoK-MPNv)!xcPVjfT=;CL0e9#VZYSx>CKM||(T&n0L_rs4;gGw&Ri#ut>GWe0x3ue< zb~3wm`np~`_gu`fM%)h_&&E=&ntGDly89ZEAt+&+{d$?qcAGps^Mn;p{6>lJLxFP1 zvSl!$DCy+b7*3=_-SVHLV@3zDVLPrMjdw`*jd-=_=dT;w%~jq7mcO5?eBE4KK9GHe z&Of!@L}{Oj6mtLPNwE8mH})!ERc`#<9Y&K>Z(%tQBtbT81d5Yl#huN z2MCzlCFCea5@ty;n7)T8W7fpwCM}LJXecNIF$fF@UY1xeUPlovEnw?BgN1*|Ei8og zw6?WnW?`|nwnjD&Jczx#JRge(8iqUGBe=wN6G@yvZ|v#{BIU&hk% zthX29$;`olm1PLW97tQAs_GYj2#^us5rB$_Gp^cD6%eeFpWHUqKVU>d_hbY7!tydD zHBABn*mDX^O;>nZdD_}ENKX;nm5KBQzvR$*qf61u1T6%RJ3{={oZ`lUSssltQzFCD zwlr2QhGn&(MmN-e6yp_XbApE_s!;bOsgF5dbj3&fS1rrj0!j$D#>X9`9Wx)kV;ADf z5#JWh<;QE+Ur6Qi=4M?s4QSxRL0I-l=Yz7f)39P>U9J+{vgPe{(Xfu~IG{K`-ZF-?x1*GFd7``++ht&bP{$G8!T-+{4_(HoeHHkGA`IB85WKdY@X zfEz%F-v}`7VdvvaZKH6b!1u7spiTKbN>D1FYBP#kDpN%#bzJV<%(V__4;}ZHWA%f99EH9ipi9qyQ9%%tc({UJk;jCE8F8N-gggcg~M%-M_T$W2MP z4}91Fkkjh-@8=LPh#vD;um{8yq>po=Vo~sC12#N$m-QU@C0i;rZ22OU3N?@5tU6>Q zTNmdM`kc#h(*SNVHqhzui+(8(!gYs;l_?m5sAgI?L;LkFa!gQr&z}2UD6;=WDFEmcSRs7p-d?X$+INO1|5aA${OEEqT1{!BR70YGKQi3z&TG^mkQjKv% z#0_KAZu0l{j7sEIXIJ zn+BF8>r^jgM1^VpXEHHtDK(Y!f#q%L^MRPL&x7`B4AZkx$brc}mlPt$G5hB_kOHHaoJj|SG< z;y^JoFQhi#v>Vtbkqwa>m_HXYGZ2!!JDMiH^6+heq)7@5h10ObMuX0#M+g ztkw$0olE90pHbYFLU_|5glJ9<8b_30-ydjSw#3>nrUu0GLCl-b&GS(cinJbK>ZOzj zck1I>5;DIby)^_uqS)@$3JypbPQt}O{Bf$Co{02yVYj%zE=z@Ipf;?kT5t@X`?JqB z&Kj~QD2l)nMnTpv62>YZRCmE$`Y^r7xb{!6pME!age+0@6Keh7e+ST=yjNr&HGe?8 zzt@;NqNPX(WX(Ar8RhoV6DA46(*55`bJ|Zb+RU<>X=sRU5ENj_n3y8lvC6~c%QpJ( zCi*FUV084;`fs#axqP>JADS{V8EB|a*n2)Mq5g95N&MO6gNlugF!6HLGh2PN8zgQV zVN^VSl9!hUbQ0HA?Sjz>5BXj)q5(nbC?fuoV~{=@tZ&dT^a1h~h97HN$V-6ux6*%6 zh|LHB>YL&JcAbw17F0pl8I_$-MX=w2Pq1@yw{#Hlbu1bmm9V`A1*}k`vrvl!a|;G* zt+SQYh#iG6E>J%e<|zaLfuKl=yY9`*_n)%6%qr;$Dh>BBmXPTFkhT3>rZ$9e2#zA0 zzex2kDEx;$hnfHW&>a->j1r7E*CRN?KWy8`?F(sBi%pXMY!*BHN@F(LU zZLn*~pwAcrK3cV3)adsmQaQAu@C@?FTCR1)P<89ZEC^V2TRR!;i86#6@=ol0R}xat zJF9t|D_)fkXyJC7bZ;*67`Z*dl=XIeE8d>de1}nZ21Xz?tz+VW*o3Pys-m72mo}jKY_!; z(gR^z5ZyO}HEEu^5|gxFqo+$QA)U33$DUgani)d!^rPM;Km6>nZ~{oe(B|_sP9$ z`%L%R4r?6NJ*2hOk;*8M{fZNehm;EK8<^VN_4a&;z97D<%}vUd7;Wvk)FGZB&>3`MVjD1nANF-0_V zp5K^a@U8jNb*u@JJLt#N+t`w&bqj2_zuI{$h>MIzLB-AG3#uTU4gnhv$k%pB9IK1k zjRNDp)AL7g973+cFZMeuP?WlQm~dP$=p+#kYd@@KoD?GYIES*i_mkPkL&nijd*5ge zUCS+Q{N3(GG|t`b#X`H85ZYtS5O|9tZ8<1fkGut%gR~1CZ@-)n+Dz>-wm%3)ku`nj z0`JEr%hl&=#oO>xb5ZJX_hR6#CyCAwN&R&*U#`hW>o6=~*Nve{#T-DBTYAwhH8|FP z!D-j$fTL;+PMIrK1OxlLlNJ;H!7$QGxWd~W9)*X66ts#j$jaZdtVHNYgB%OGLz5mG zX?jTHhO-sN$dF||VYu*>#v{SAZR;CLB_Z6BICykO`17~bRhTw0R%k0A41{2MsC@ww zAKY;>XxIr!@+DHjrR`?S`Cdm*|hen@r~P1e5_PhtyE^OyIw|Y;_!tQ30@ICeL;$1f#Y-Gw4Uo$D>zst6gwwhPO4a*B z*Knit#$VMP+_x->=#3tSIV=6E`k*k+xA)5+^}cWNbFzF^x9^(MF@n*TYlUT!d1lmt zm<4SOf(G&-2*CdhRemh_vi)6);WaVCQj~uRAKQkvL3eG?$5R~dR0NKy{AiGBr@_^V z(f2idO{2xKUBaqes#Tlg!&8QvZzq~5u~Muo7g;=+FE3Vgkx1FkGLbbn{Ln>g%3vEL zkmX5>{Y*&*Cb_v*juN#JR{F_96g~@_+i38&S;zD6Yol3I6B5CvLX1aA1yi7UwLes* zcI~ttybP)7cnNH(Y!MG%IvE+`Mw666_0M4=g1Qlr(%*|9i-uwg&++vuh8--;%u0)M z=$P69O%)s{(c`OQD4Id(LGtOkHB!k**?jJ2J31Fu)4y>6+rWOUznkbO`L?2BNL9Y# zfA20GV9GEPNr{Q~0hn;iaum(KktVFvZuS$yKn=p{oHOxs=@aRM&G}i)MhW>Rl1yom zRkkWk36PwxWt9_O5@Y?g7}FsM{Oz+@x4&h-9sJGYZGVS|qL)?uL&nQ`ILn^xdcJ1& z{0n|a&GjnQYr{kM;tNcW^>VAjdtv6fSKpu1Z?8a2+EE}Ouk(L$xBB{9uVJ82F?--q znwpwg9}VML4xws?`|I#8EIK?c^r;jv z=I85FS)EO%s=ZKdfalI0oN{m##6sMW)}%(PTaEuL$OBH2w|0mF>pJvWYmQi8iWRBd zOWFmwEBcOtM#Z}P6=ZOQ45qwP-P%VB9uu)^<8%A7!jMPkcxsrI2-RiI7ig4 zpr2Bz2*G`Wl4d{Q{V#>BBiwm~)oPPC_;yC$R6crIK*-tvLFTb>VZ*$ti(@WnUERkn=Rw3q{Fmf(Nu~NBzOL?2 zo11xco%U7_kt^LR-zi#zeTP~hA#wUb`cTw3Gjf}Qx3jhTuZ*Vn*yW6VK3@KSrJhQO zK?>-)S^WdP09-{bMFc?ORW890!%e_r0mB1>2bcU47!`#~69|<385$Y_!en@OIFZQb zuE78qpHLYo9p3b=x;Vt{m3(+N1Ke8o%#_t_FGB!@c#16gf%4GWOFx^ilTOTfQax34 zgAsf$hNpQxE8vu`t*c8O!z%=rlbc|hYnoeFs0%^;PR~ni=q&%M0T(93{kYORYGT4# z8;>xxyrh)y?1JNTF1(Iai=$kydb6sg#?3&G%xtrmp`&Zx&S*Y!0dVDRAb^mv=Jy zP5M)Rbeq#?=t%FXV8p+X=D@DcV1*xv_;qwcL#@|I^{^ z065pv-aNd#04)y3?dAw*D8j?DKqiJu$;>3e!~64xi-V1=)@}BIaMhV(ehzf8`M9-E zp&;<4f4Xpf$dpeI89|htmZ_5%&2j}?M-Tt!Y())2cw0IV98xOZ; zINiVPe?AI+H1Xmt*P){)GZp}wn>!6fzK`SG56_)Z{}~U>N7lI6*H~yD;*H-xfyCQR zc*D1vqR&^okI9ndg1i~~Ptl&D9dyP5U27YQ=Xs`24l*{g$&2$rvZ$S={rNJ^)y8vJ zgm8e|6f0Hug%~*)4h{~VfI`QiJCzj6pRHi4k1`g;pyl-Se(y-*Xq#Nm`$pVU76zkN?`=6-u=%mNrG}FB_$^md7_e47 z+})jDui)chUB6fb1@)0L(x_pC|F5>OGf0hw6HmSQbGR6qTu0H~4-ZoV1$WmV6B`k& zhlR-&zNhjaQ*8~3-ym1A_mtMsxz;v39-Ch6(WIUc87l^})e|ihMp{B-7rs8|u+j$2 zU5VnY4n%~)Qu#+FNN_HGYir2A=%w@e;dJC$>tuR#qJ-`B$!*Z6)`Vn(E4Dmaj@W{S z`nZ)57TrieC}hP_5vy~E7nd+K)}f)j^{ndiaFc-7-F`I53ZSICK3@7<=YjdHoE09Y zhU&C6wP;WH`E^DMet;&cHvL39*1gO|+BmIKi10^S)3UPl%$U_~rvRUU45P05CJ{=esy1;dABj@Meb?NdDWMd;p{mS5lWRNp`goZu| zMA^uqePv<4ApfqkY4*5PliQO%N=*wJaWF+6k*C%!ytL=i!oz#_eE8h) z`FL}hE?WyxV9MXM!n9A3)_~~mylisF-j^ue|hHRBYp0T{RZPQPm`CC=Y;yv#jV4INSH-sR^HPU z5;S_5_w>9tE3KyQK&eTj#NTl{GM0z)^p*BDC^#ikUM)NY0{)rxc|4RYro<6!tbK2A zQvP>CaN%uiM&14rnF<~46a)mM85(Trfspn`SHOj#_^`dLgw{X;I5mA9ma!%Nx|y2~ z7}-yH`2CcUl7bk`PEUJSX|VtdzvOhhH%H%^+rNGlAjDVK({W&9LoBKW*y;)jazuCh z%-lRljyyGuc?Zw&d>V4l4hs#I|JVh)XyS93gZe3t=Of0hcB!cfO|Sm?$)No|SH74h z(_6K;zsJZ9P!+1hAM^)QB)w(ik053q`amIsLj!sx(7a91LMcb^2g}so1;Nmu;b#0> z{yqgpV#j!6j0ybH%==Nnfu~#L5|H#p!kGVrOusenzGM9%+s>xbpfgei4;El4mR9td z`IVy|>2F|C%<&|O`NU55l7*pdYI=GKuBR&i|HK$8 zM-0z3qr7RURMPkM_OsNYQoFVJ_iWP6qRkxiZOxJjzRSgdHe*Gs{K>w~U^Iv+GTOAL zU@%)gu52us$yirLCh;!X=Jl7M$q43toagSqxOWId{OruB)=D2a*=;uFVg5$D)BS<1 z-XnOn4$JY|e3|;g#XYyf!<)^9)+{HDTbg>UL$u8=Wto?G3n0X;)l{yh8`Hgd5SgAs zd2@>ZjO2+iF>l}8dX|;~n;ttwL;Q0LatJiafDGr`&8U-r$D?FmV4 zaceCV8yg=zJrG2EJzpJ}QMZXA;zh+p9}UKDsrz3);>43(C`e;Sk%VRKPbdgGwT*rW z8+2Gc%R_3bGV(mI+@rkg`fQ|b;No@hPcf1Nr+aY>xoyFuAuf@`j(VAG#Ek4!8ddpl zOPwQohXI=ZT!Mrj&bMDqK)5%ZaJtG89iiOh0XWtVk?P?Ud?28{qFbA>nf(3EzN&WL z+;-u;dwLhextJENk}k{G=}n-Mg{}8YM*C^4?Is*N+D>zY<>!Lv{3zh@M)7!Tm_EN{ z`;&XZjsMVDegdhUE@~Ixz9yz7ZcH!x%La&c0L2bfx`}KY9OS)G4@7knAWfFJg#%`s zd3#Oap74)tR0^68&zt+#F9yQ)U=zOx&yK`Yh>n5IZslGj76Czio&cCUibv!3^so8a zjOqt#tzNG^hQn*Wd_K7@67DAD9->zxRyYfwU_}{|)qecwaD6`6Ral%Hix;xb#x^xs z_ta75^85@CJC^0x1CTlT5rzplnNK7!%o}sI*iO|;9i;0b) z+DS<(i2)q<42+C~cz7)?pWAiqZ`;?Q#zAOKeYOAl*Iqnbhk|a1ZM^6vW4(&TP6}#b zCu*-dXIe+fb2q5T`5zC1?aymVmp@GB#eX~5*x))A zc_ggaXo1X6Tu<+DJSg+~jI^`Xff;tX$DaiKnHXa?yI65Uj$5OhFML}^{?uY4NJvO? z^XwFvZ8+Za@+FO;ymjql6*K$dcv$HlqH!UCqB_6~ar$X^3`D?hk?77LwNUERycwjT zDn#uJMPIWdAKBNFm>S{z@%T26$y9KSW`Z0{cLcmYn_%7{8f{h`_zyWGi>Pd|%EpZX zMN-n^fD#SepBlipZ(-?);uj2zSi29(*5fC>7({`f^({=zO2D8eVfj&tW)JbhGqPTX zDG&qemn#rFuQ3wtu8FNLTg<#?paiTfF4HLKxF|c*e-? zW2g|}tz7UuOS6noD#!-vaU7slubkWyn_((Pb!rOKi1{r`LAx=&B7x8unGyM~^k^ws z@*3SO8KGGGmH)g+z)zIGZH zC^Rmk85<9m7FWoEnP0y(sTK;FAY;hSj=&|r;k0#0j6#6+jg3Nh0`-rCsOL<_7zzQr z-!QVb(;+^jxB8L*9GJJ8?c8ak*w-AC3XY=jiPe^egQS5Kp0a5%wHSZBd_qa{tC-HZ z^ka8OI#tBXNeozK!LA|C)G^0th_--N37P+zjC=?Lv0|?#%6)hL4^?Ls6<4%v+u-g5 zcXtTx?(VLkaCdhLAvgrL-~obLaCZ+ z7m0IqdwUy*2ANTg^|wGLhfJ$B>c=S9L*R!E_%gnD1`P#I41=AM6}%reZMI@CagdM^ z5y87TM0(=iOY8d(hNPtFe2PabO>*>xTVyJ}&}0i$FJ=%E;hS1EyKWBKvl`dIilC&O zRaihU!`d}qEWnHGGO+$jYY*^0`}xAitI}yqd4@y#B#&mk&5MoHD=J3@`uZXq>=pjq z*_moQ)A=iVWNe+O*NlNu3*8cN{yH~f6tr9DJd?9^i1aK$0nTBR53~h)G7D4#`!Zz0 zSIPrW4lHy-YT~wQYjzD@tnYDbwky#VI5^o27I=#!(Y8= z*v|P z->m#&wDQo!Qr@p69s_PR@rJr^cd3iOFTrx|0=jdp;ucK;S% z{kKw4v4xGF9bt_k`8Nh?v}J0dg2niDA|lP@&gZl?04NXz>5hnhh3iOdL<56R7q^s8 zozD&}HU!>+jaj!Xh7o0Ho$!KvrGO5X82gER`dt>?P@C?vYmX!4ooxfT?{rXdx53dW zRL9&OXTAcbJC>d@9(osnEJLI)0pj)^kQDfs7w#V&xD`3lQDNfBz1bWu-afcif5Pzv zNHJz#zAh7k#Dj-wVn{?75B@tBhsOxQ6R}Ucg!98(-GyyXgo7Q^d#0jPiM{qev5$0n zZf8qAP0Dst%ErZUvrp!MwPT?xU5D@eHCIB>ANxbyIhPkx@Afgml#(=n9Me*I5KARz zy~%8DW}59V{P%Zxle{;ASQ@|yeCptHTHbQLo}1gb4n#SlqodJ;A2Q5)XQg(}YoQ$`M8mo5p ztNe6kIS8|sd861w+T7ptm7fPR2UdSM>K&i#d0fo&C0i*sdp&Hf-<|L*Eb>qsuhLFU z_UD})9ZMx)NCEJZslX?NkG?2BIGL}MD%5$cDQpz3aOLIYRjq?=ctliWWk>zAAM@UKf@0xCzKArh z&aB&UE-^438)N?@TaS7mEyI?VT%DiEaNf5!3luX@U_3D}m1h6)w0B@)zur<_)kJ=B zI-m(6~69!%q0tzsme9!}*k`Mi3mdw~+U#6rm#QD*Uk>Ff$0Ede0@CDp6sZlXAD z8}RJ1ftU{bcK(Y@3BG*ONSh;dn$wly#(Nto5@%|ZG#=x>KPTTFab9_)AYELS6kU5- z?SXw6@;(75Vxg7kWEV!+H8+d*0I!Wq(dszzk4GxCqWfMFm%0N1`yT#7R``t?uCcH; zc{*>;{!*JmslORL&@C@39CETeXb*U^tO+s&5WGY~|A7}S=hwHL=xgs6H~fo?j06(a zTy_goG=N~&LxCX`P@L}V?!JylLVhP2q)t~t7uoayG0D5A^)yz1Bc@`4?sd8Xy)QD< zoPa+5e#vq&ZJ%>vMdQ_JdHVh{L3NG*iExV-UH1pzU`S3*HeP@E`}f7l61PjY%f{7m z{haDWE)~1$cCGp4v9^X%=0D2zb-#}=iIARJ7c0*TaB~eEApxGUg7R9eje_U$UdC1d zTHsAqVIu9MvEtR$4QWow;|rX-$DLr{W53nKyE(>Cd?cv`!@R7!g!v6XSJC-mHR=9< zcDB+XGR(vK<^DD5BIqmkk_M|$Y+N)ei%)&P(4X;2qTRGRs&;z%^)5G^{k^fIk*m?s zW>q~PRv5Yc*ZpXAD(Ky7WCWKS^Zm8!BfdWz=`Eno&+|o5d0aa8+ggK*!E*5!Y5T{E z&4{LvQq|(QP^rqm1t8NnRLxf|^x*TEw2aaRLQd;-Ha80s2FDD)9ZL-Fp54v$4U--Q ziT9|TXojfU9?oNg{J6=O8h(|}9J;6Tu1fy?G@z{A@hkOmO>8-T1wBzzj^D-O3PdF0 z2y6Id$5988A;%tZ7;}W>?}zt~|IT;B z`l|wL%@cL22n8VKLighZSut ztzuQWSJY?H%ZE8NAgj6ebaQ|i4Kg()6A~gWdR1Y;wAZeYzLo+HtQceO7aPgz$Z{3P zQ0$GlyQ5sF)2ESR0`=na_3`rRKMdYK3H_KDAcf`Y z%be)*)91RP$&xGry)2-3y z8&F=J{GOwDPp#t>FmzUFs(h{5!Y2zzyCXlP@j z3t$}P=jZ?Z`yV7E5%*sb>c*r33gs|x5%cg=Y`lPgNPW9sRP`E#?!*sz*Lf`qF*r2C zPH!`xK$efE`n5LCe96I~A)t!#x1j->gk*hvhB}#X(f?XX$4dlpVv?`A#6*~AlQxZ+ zFczIW^rJ_j1=Qp$-~~7jo1=&j9R4_Y8|V{wy_VSqI_{+9g?v?JW_@~m^18nVR2i*} zjc=Ov{=N8hZB>2B$02UP$!(#%z2C=1odX3=B?F|OY=<{^YRU_^sQJ#sT^TTu+}Oz2 z=;;x_RLOQOj&6@xR9^?>1c3vRo(>XTtbL@ZR1-r{_EjWEZMF*7qyNN-K@d{TV1saW^k*`AM?v6Ax; z@%N;rJ{u`4U1_?I9P#}z2^u7ZZa1x;&OqBBree9@+7Rnpo1;e@?^YJ4(76k>6XU<1 zC1=LijR>tBW*Pa(IdG>Zhy&0kD>hlnsVp9Y#*U+^8YW3bF5(z+cvmzKVFgK9O6%c?5%vrR6kra2bA`H~O5 z4VnM%OBzKdj0j?)Xy-rQ!?-?{1TG`qI^VzDSy~EE9u_ z4|i|(-j>AL^}J}wv$O0un@;Bn`FUQf8|mwRpH50n2IB45cz7)yD{;|s>|eSay?!90 zoi8`t$xfTKJlx-3++5jR95%XzUW5dn=Y}91BrOKK5B&5vIk&V@zP)?BPZN0%z`k7J zBDFH^3Sk%VIOaU`bMRQZuM!Xs>+6-EEK+ZsIIqz?!=P1pKkj%S(AP&J6`a+bFH5w& zKV4o~5pv#n&auk?qr^_+`9JeXiUWMl5lYs7I`hOLnCBhlIuZeAlJVV`KR^rbWK*BoFy)UZrWwkqCM7vU8qx4B1WnSz`kT zJt!V`z-}6KH{9!}@h>6YBHHN#GrhOVnZN$R6X!niSi31(1o>JCDFYFsT>6q64P7*J zOkuN0E^dz+MRFyZc2KNOoTsHt$fjThJ_)^JTzk7rrLzCKv(1~v>r4!}gJRm{s5`?|ZYf*N{|Z{rnJ zCbE8b!qL+0>enOKuuCA&fn3AmeUFZgl?AiV35k<)GCTm8)V?fce_JL2L8^L&mW8t| zbEr{G845o&emRWLv3g5GdiA2NQQP#AcX$-!(EP@&EHdu`C~5BN833>vBHQYY|WyPmv1#nfQg$CpL*Ms zw-N`<;Hwc_xZx;Jn^(T9Xq zL_QiJ_kfF*!m*E-{z~1=-6zhFZUq=x1MUDC*RW$_L8jxbVSKzmfif~bniebKX(Mk3&$?a4oFq~IWv2UiAq2;sCdhc~{zR0yuMzgm zi4I9dG)o)N;T9ctClozgGbRvPm;Ky7_lZPk6{+>4l?jI?m-nl!Y5piTl%W1I!7_C7 zoTvJZ*3+OhPjq#)$C){kyT0*u+_7Ks=lAF!fJZ7G%QO-Q$UXSXxcj`(^NbhO{6<^|a@T910TZ*rcKJA~**_*yTzhv5U$L=PcTaSYYoBbL43AqRj&DTBfaq)L>sQifv8-V@ z8``N7I&^sl+QOu49QN?YA}MrEg6k{7OVyDJMod7W1c+LM)ciha+i)j%2+~JOZ{oz@ z^M|-PvST9Xti2Laz-2^zhSn`!(BNVBjtsaohM=dR)#W~9oYITk#cErF7PwQA3YE6| z`p~=CB?qTI#-~V7cYv#A3R+4YiOhoMh-@&;La?6a_l2TId!^=wEk<^c;)E;528AFn z7;XxB0>S?slX^gs|kZ z4q@qN`O`ap6fV-fZm=Z2&~wLDXLgDbumAcJ@i;8*~X+*EdC; zS|IRDEEo=(-G+HrdZ7zSuMdB?{~)z>jFa0nRiiNa?w=*24C!P;=}{DiLo$zhVa9bq z#po5G8x&9Eies$%9>P6!2oHj)HEKaeNsm)}no{Aptpw$)XV&bvYN)Fltjz2Cntmbn@sw(V zz*)!`B>2A-67p?>ODJ4~BEl^@iV$QT$S!h|La`ymP;Dt3JUdXnr^o-Rf`Fl|8PS& z>Hz&~^?Zgi)fHwQIs$|9Let=}-6F?{!19d=4*CB5y>dNxq9#Kusb^4*z_0~Hzjsux zvPjxm)x8tqiY_Cw+{rp|RMWokSLbBN2nHR$dg8SC{CsL9PvpIHr71O{`i3NPf|yLp zqP;(lpnaoRfLM(viD1C1WR+&mq%^4yGH3T}uWNuq*ug(Hgh+Sx?mBg1awWK`}7vs9k?BRZQu7NR;FR~^!RK) zgQEi5eyqlJSq2}uaF_4G1QQc@C9yl>8lsUq=z z>OB14BS2RYatU<-X&*io|f(n6hn@Mq^27U(_v_!bVFQ4x>%Ok8IalR^4K}O| z7t-RpICen^75bOO2X(WnI}J`?%aPj@5B#l!?+^drExD6dHEC zmk{X*%jpH(sUs@^zI`wmRbj6+fp->`D=I|cv4eAwDWZIFXk`Fg6jUo^fSxn$8tW$p zslrC_4RxlmqA~=R?YjSsUy(+U=E<7AM*8o2CDlsPoONH{8VvZ;SNky@8Z$=Lw;2;( zFbfGAXK|`})RuGVwJlM!q=ZVy$Pyk_WGL|Bcq|Q7*LH5n%GN9zJK+~tVE^D#8+6dL zBep!Lc*TYD^h0uA`m5$NJUMxfjnN(X;BS%$bWbsfiJ22+b;*MDt4K&ls^}`jnDV>O z5y;}|>nXKkNT~C*kEwR*8?~yqImkz2ZjjiI{Ixt<2Th@U!jJIr&d&%lGmM~h8kZfQ z0^T}=jLc+E;htYmZ{6$OL*n)$6S_ACGN>hI=7g5kxQb?Ubv<#@cDXznk#6ceB@gNl zSmsVbW%B$VPu2^BYl8Yi*`s6+kB-7Fu4bZVw{<`*ab$|}B^7qZCAhdAIKQ+EvyGTj ze;o}MDeOuJ6GKqzlohe3j@Ume*KatwiBY9sx06RVApqidVPQWtUOL7>uaM5pkUz?p zi3W&(A#-hMgJ&F8AT~Y@V4^d#vgj#V{)7Ks(b?o^X-kkshPD)m;9G^d&M(lWm+t0< zw3Z{JLVECgCeRIQC?`$JQ?=%Ou9zhMyZ@+v2?Ra?1fVx)fa7g53{BYD-d>XWe7(cZ z*%{qq6dO_#dKC^fs*#3p1nx*SM9^8c($|_JTpF2W^IL!648I3awKIPas2;WSXQijS zbWczB*L)-C(D{8T@z_T=XIdh&;Y(T^`mENi4B`-N=+w|iIHcAvZgN)vF8dAss@!4O zco(>?ZL2-Q|7H)!x6yWns4=w%T|c3sdtnX#RGXvBV{QJuUPdzuBNdn5ag^D`G+vA} zco53u)xhFmc3HfsPg9?f0}_U;ZZhUiRCRu#?^QeTFlcrSFV#rT;l||6fen`D&*lCj%DdFA|ZzSs$-QR(byT*yweBQ5W-L zd}A@!6NEf4FwbYJjdx2UbQ$_V2U~M@2A;sY;J_Mm`|tL2Vx?Kw`{SYZi`vJ|)W=EQ z2RO+0NieNBqY_rh&FC(qqm!F5E#Pe5D(}xq(>x>f-fwvaI(p`n8kZBtY9Z3V%fPD` z!9$iX*Ykf@lplK{uO}&ExH0QLNn-{1Xfm!J(9+Wr8k#+cZjsc49c~rUUX^0WNYjcuzR@DKa__22`pA98 zLb$1S>v}uefP;noW6;b(Ljx<=QdR~UiZc@M@&<6g;7a9+fe-=(g^9=4`a8I{ut?a* z6@!&~U!S1I7qni9K47SBlA7{{Cf z&OXcfvUyoFCyFt;E7XTx(Nv7$pREpmDivaJT|)au4UuSIPo( z<1U7$)8r{!%VMYwbA-|?JiV&;zZ3 zZ_5Te^&{{sX%3$5-BwemIbvO8X+f=Kh0+xw-j}Kd1~RuJcvSoSwZk4Je}Y~g%Yk%a zNRQb+_-|F~)`!+M!a>}D_GKUWA0gv*Iwl*PpWq|}~> zkDP4}eFGQQ`x=xo7Jbh zP{2<>lIX#Vm6kMR(&F!GZV4L*~d$lJAp9t@L<%YQZj5~-pHiYh8_(9px6IshoP z@w(4bRaJ%V0XX2Yva=2AEo0Nt(k>u^KJw9vXX+?0i9*L%c+b3Dt?Q}ZcvN{kQG;Nx zoC*VU8=kiLk1#1Gvgo0!LYT-ZxX^X}nqspg=0fM>DrOag#eK8-TT_*D1mRkp%#n$5 ziELhn7ftEMGHlJsUH}==XW6)t&f#M5`25t|y)$7h>Hpb;ktF_U=P_>medH3Y_*5mw zb=k2CO1Gejd!wJU>)Gh4%l$?LzKBRWP)j%C8#SePzlg|df)r#66&xr2;J|A)hyQHC#=c*XFS-F|otI_3Bve3Gu&R+3SYuyz{f$_Ms38R{WCb&nZ# zXh3{tpt0GPLPPa`TXUT&6{UI3M3pn?@zIH+1L+ar;mP6g$#JB9K1Bf< zY{cq3SVv>+lg-=)4-qjj5~M9HAGt}KmaUDQ0VOX_I5f-JUk@Y%C@UoumFmh$L4RJn zS~S!jxj%lKou01O53SfXQaJR4M0Jn-Clb%g3;!`fpO$IBKS`6V(wctkdM>#CR1LVfDgm@ z?oB&w8cVK-A5CXNk+rF5_u@gYemS_^Wu5^ z8BbXzQd%YVo2`?B#K6SVg#Xo3X|tm-z+DDHev?y-ym{^rfdt0{Z)ijfnQJEkQqWP& zjSY-@zrz9{01Lspb&coWPN zhKU7r?d>xKq9Z67p|HHRgKfq1oly`ctf_sWK6vR!*@GgOyO8>t>hm{k2=~j~U8Zt^ z;X2}mjX1@*wGm}rb8DD5$aWl8M$?6YeJs0x_rNbj-^++gllS07DH#)b({z0&psMAg-IUN^I+6ryrtfwnuiSYJVWF=tBy4=w_MH2OH z`6fvrs4FPY;O{kE6Rigkn{sHg9^Et`pj+Gr-t{^>KKp}TDL$!r@ z0^-Pu9Y%Gtf^Dvef{9EymWQaDaMn#{qeJ{kyLYr6OgfWff`AQsH@Fa9Gg}f`G7S6f zLr~K;@o^h`koM=>S%V%B%no=ulaP@@NUUw=Mv#SvcZihk}wXdgauz_Hp&*DYRbcyWq4WN`92dkBjRpX zgG#af=&7r_0t^Wtem!kc18Rp_iWmN-09aUDU0vPWZl(h7>j3})DjF)^_(J+lVh8hC z`}}#mxtCo)VfPh+%auYBzI9mbdPvA05<}uMQX=b%B)&e~;q}G<05O%@*?Gq+nuTe_pD^icz>8uOy6?8_7ojh>;K1*9_x+%7Gg`G9G&1 zz-lOko9q7Y-DI^dL(0+vwA6~MlO>kLPT)r77wt*Et{_s15bR2cLz_eJ?U8iU8UPA~ znCBE0?hN{P2fWV!Tp2J+0LN+mpFgOl_@$<^|2cvP#f@+I=VMP6h4pS;iU%@6UxB|8 zj!G&2?T>_mirF=_;+608s5uTkXk|s#M{;uWY~=p)w5emIEJY%MLqO=IUaXV*Eq495 z0 z*2zwg&`YGf-d~@clEkf^HZMo}<(Bv5`5$pjlbOGlfg?CBl60lRZA#dQblM%-?q8NN zQH&r^e{5_$JK8by=Jn$z=jSKjlWMSr8h(sKAp}~L&THa)6vMJ!j zlMYdki6j&WEoCA})9({a$N_x#X9jm08w4>FG&DwRMEKI5KXCx+eI&O}F4yY0S%W=+ z5C>pEWD_Rc3dVc6;4~d$?*(C3zVzC2Rat8m zB~U>z{T#ORmc+E?AZrfZ&r|}v8F3o&ZmaFCBI6ZhbDL6;9(lOY%ytZ^*I?$rRXQiI z4#K#g`H;}3OPa;!4!JbqnFjOl{(X8Ly(c*Rr*U1e2SF8{MWEi&JVl8SGTG%8wQp9x zB1D$ufgX(JVqc1pHJ~i+T5nwjLotX>^aDx-7yh$K3KnOqX1Obz65eONU*&DZxE+h8 zwZ{|gs8bB)hUL6?2}VRhjmQ%BK}9^tdPgKW40!2C4G@KQZ0J!WZ9~<{PLXCKurP21 zmggWJo~(J(SqVvTd+St&S^YzB4wxXZfpEmYYqilOFq=vcV8m( zs>yL?+aLEVGKL6cR%rXfluIGFA}D`M+Rquts`bTDkz-ri%znsiVE9(xry=8jQUppCr4`5WJ=vu_*VytEUkU|CWdRpS>2Wlg`&m z!m}^ujDqXq1Y!w#$VL)EJQj0koIBv>g0ZF<_ZREGKAY@3o<#qqCkZ&Pc!2L6B4X(GOK@9t zVey@{bvn?52{2lFa9Y2=x<=*0c7NKYZq!^~0dp;_#h9xY3>|KwtHGO`$mvpJ4oXu4 zhr`Cl?aMV$ z(MW?{5jgwi8IOQ=r)M&WR;tUL{Aff>3qMC2FF%dV#bHnNJy6&EW^bX#_w>2hzyon0 zYuhy!i-y*c)uh$;NZxl*l=Lxn-L^eF*Y{?<>W+{{v$M)MxMK;XbW-o31P2C2I)(0Nt^d@jGHIiyJ=tGdL0gLI#)XM6_290!+KaK_{0U2C(Ci?fK74D#&9b_?A87Rq2%x(P2KC|Rv$3_lr3DW zHtCaMN#j5R`rLrx=5Nr4uzp+=&!!KAhv|c_@y~IoVs)UG@rAGF8!Hhm4$dYoJA1F8 zc0EWk7A^^T8#6^cgSLllGsroLXOOMnSBK6bS?`)hBFlgukqcMr0hTj1d;xt1O znpynoC3f=luAyZPf|msC68QoXcQSai9RuoJAtVXZJ5rCsu?%G=m8+OIOOq-dSJ8%= zu4lB!R)mExQtDY4Vn`8PSW0!p*m~b!+)8vcyCH3h%ou=;TzRyuSU6XgQh$Hn(cNnx z2lJw`{FwtMY$4x@*cznbo*WyHvF{^br!UD$-^kxW2@PO){)PA#uMg+TUrT&fU?Dua zGL7sQ819qO;S#Mq)aITD@9Fsghe&d`pVXgFrj4vDH|A0yR+!33zP!JIpxI#1B-^cm zQAP~VpBaYDG)9Vcu_Kyh?=>0znxH$VRbKvwubteFrcKonf=d)I)Vk5LE0g)|pSa-y z7g(v~tEFQQpse%8CHJy65=mGe%jbr&NW-W>J+JdTR^1-p>u6bn>Ew`0%j&nV$b?VC zz)BB6JNSZDZFY}i@8}qKf2yaU0myQ60h?(Ht2N>}qIYU&C^8xv>m=(E(?Z>>jy?7J z{X!EDb+K~;-j8W0RTv}U93kQyN{POjWO~GNJ_Hk7gf*i#bOd&MV|yyJd`#^ust~bms?|E(X^T&{= zd{5aXigYPerBrpF-H2Iz<~#$;NVUT7l%LBqtLk4#Pie}?fX`HFl*sG0O>`hoEhSzP zJ0^!c69lrL?`o{?Lw9Pmn)UL$&NA|EzP5o9J@1$#C-()Z9A;qBC)XmKrGzP2 zkIe4xE$*;&StQq$3n%05!-(_`sa~yX_GVa_X*f78NM?DVYZ83KtUddC z&Xm3D7v_4qv~!X34S6YOw6Q;(D=8_Rou3a<$5W08*sL^kt9?BUV_^iTZ21N2n|_9< znS?&H;+`HhW!pl;&yaY*QKV6I+jekt3<1pztSI{8stNCc$yfF;T9pV$MoMD*uVtQ( z(6C83*3UONr(whW?dtzn0F_EGazpuC^tIkmMuSuEs!*5cy}VZ%tWZrM#GS&~u3i|P z=((nClK1vY4rXwKJK6NYIetJt_!R9zq$SbKs905;;+F%VyZe)=J~2($i&|(&D=?r;tAL?SpunN03&(zJO;+Opsy zk@cE#w;_Xct*v9js#?23I&t{(@3JNDR`J+8|7-k}o{W)TifcR5M!s0>-enza2g{zT zQ#+o(!liV&2WrG$u13A0CLe`<4-%oMJGcTIZ@={!hAwE^^@xjP?ZE|P645cSB92H10*wY4*Ixk2AW&n{7sjML%>Gj!0N&%KfoD|)w2 zS8Kl&%D0A|T}^41a2vD~TYy#mastYWgBT$9+3ke-gb*4cP6j;2fxWFz)!x_FeWV?0 zynG7=oU?jM8V1wvG|kPgHbLOG$zPRmzbg0B_y*8eMlF4zqb4V}s`hL2FO>(fK6QDq zotp$Ea1Xje{B)5PyJYW2iKuR(FPebuY<*Oi zbk%N7%EPpV`Uod~!Y6TmomMu1w#00TIb~WB*!!wX2t9KLD3qNn9sE_4u;(jhy-%gq zf&gv>5$k8ri_^zh28WfUl@%>5Eii!Y?%qE*=n2+=OV7*uSogc2rln1W1@2;Bx8?J2 zgUCBk4&ecmN^%H5+HU@f}-#&;~Z5H(Gw7A%ulcr%KHU&c1}qUCpTxYK7i%_ z$c=+0*EKdaUenYiP)(xK{ptFN>B9~gDgvrSh0b~OH9tH9^HQ+>6AAxocx+r;@A+iO zTHK`&sjtu-WJgYtYk6JWGS<#-dYmHg{J(!aQ1}}#{AJn+wb(>fnkRC#n^wcy4Tn{d z!?SH8=nk$SvWD5)QT-hjydHo2-?$l0d7bKT1p`R%16TLl6K5Pr6858#yvkD?`Yj4j^#Vlv_odH3q$z+j<3~V5sdae#I-HQ0Uni*zuQPFLt z1wGu*s*r^EGNc@%E%?I{M{K|?XduQ6fI7Ut-1WTC?w&x%OWXCD?CM7_p`)Qzi6eTc zFc+e0r}ga~E;XTKl?>4^@k5OWD@7?gfhaFQDux5;s3r(oMpCU6#hd`7H$ zz5&Mjz_T3J`?Smxk%ul@izJx&i?Z8m!zu8|>$8(_)?K9D$UkG&3-A&C!%i4`^VN1X zGzLXr?;}PubkiUPL}2=1HQ%A|`h;zoi#*#z7}gduvolV}98$KtGhMd>bj3d#HC}st zS~QyPUIGU-htOFIzY~FK?~6AA6BCoSuumxH6B$LWcsG5$1haQ%KyPBAB{u1;sFjr! zF3cn8KS)CWstmL)h(t*Ec$!6JTm`(-Cggni))79(Q<-M=n36?VbXBxrmx4f`*Y3|@(r^P8&k^(=K^ppA#RS2K*_H)TI+8?uq6 z)*it;u0y%c6zAsK-5;&h-?1aTS_GkF6=APiXZkF< ze(FifxqwIn8@hM$_H#_R9AGw4ace-F2-9h&r}mr(tLp$}T}z8PZA^>dGj!Mr59YS3 zQHO71c{u`wSQ8VM-Q7@p_(D4itA93O5CtN3{k4alAxKkxyY>A%H#%|Vn#V%+K1-+C z?)Pv)Yy0cL&DbqgBbjDO7YaYN_r0cI(ZF~S74zOU@YX`Bk}E0y$HD@b$)i zoK&zd>-|*h@V>rvm^rDhEmbgS|LtSoM@4sgo)cB}qr4SdV=mJd7nSxiEkE(}0i~?6 zEKJN0&|X?tSg3|zj`Y92+AAq(NlHp8D*n(mH`Gr766W%q36VJOw?}h;Yi#q->~+{r zS9fWvFDg+FM0(%S!i$ZOTUk^@wWOi0j)N;#D&yzpr>2IXso~(jtV~Eqcm?GF-0)U; zd3d5)zM7kp59nFIz`%%w8MQb=q_Xq!;sN$>BBF6$n@ej-f8O(@T1J3xFjGhybZ_;+ z%**R;YFgIPayy)uFqSq4*bsnD>(0)UXb3Pcdf#|!`*1$99o)UV%)*6XnXDD$GJ3yG z6)PX>$TN6sxKy7lwu-;b1`bXwL<=DK{JM$_!aT+;1~zJo^UF`CTXTyr18|-fFB2QD zb(><2J%v`r2A=Dqe_forKF0qsIcg54pjMm>+`Jm-@f~1cI$4>}wzaPi^DVMd_Qn6| zR9#aIqos^95)3N1cd%GbF16ZL+357CsO^OKNhua}U@6O+>cq&BEs*C*?&A`;1)f{o zy}`{NcfhHz*L%PAnb}LZeM~NOI#~4p8`fALq|J!d^Ld@MGMne(t;uZ^m z^t$qLTy6KiQkPIVn~RD!PV0Og6Zt^G_I7u_1SA6TwajT#dGG+(j!Kr}U*LFEI1N?N&k9*>T6kSYMytWm{5PdjY_Ge7B7LT9EM~7y2DqUqG&OhlPr!Uotm6 zFE^2e>3q2s3q_Gd=X@h*(@=eMM`kM98>!{ue`cR3BASW8Cd5=`5nAdIrsn(*xFgmO zuBpKP$56UX?6XQIAK$nqx_XZpCU4`WDw1+zw@tTTPcu1cB{!uNSAsC~x+M44LZN@T zU*8W+o8X!Q^Uo*+}mf&qK&CjjP%#Xwg1$0!MIdr_`QmcLh%fh3H z@CykkKoE$)t$Evkw$#)V>+gTQ+^g_| zZvoic%gMnvtzZjJgh;nb*yI`UCMyFyQLIl}GUs}~h(P`kQE+}t6(L@`$MJ`}33A~L zUzun))LYtH`nS#1L-1?d1Z?}1`ES?aGy^7>$9E_U7LuzB#6{s`mzdj)?bz|}vWZ8? zwvroW93j$s-Z3m)f&{{^YpZU#6Cjk8zhO^%t1f+Jy3|oX&f21>sR?9{x1>4waL8CZyxP3{!}d=vE`Ty; zu#k{Y$Kiki=QBs*7p;Nnyfq)^XYYUG!`>iSZ%^OBi2CSKbAaGjp`NT^Nv%Ok5htDZ zO;gt52w$i4;9wl6=8~n2PSWNWd<>+;pRYMpR=uoMf4ncmX8GNpjtmcrj=jD-1nQ`( z7iF91KJ>tGr_u;+PXCP;3A+2WJM}SUk}cv_@VHlD@^S1nKwX^>^_s?d|NKOREZkC* zLL!X$zI%03Z#4-JA!w;{;ATki4%=L*tD2g8{r!Py@B7V^$i?a5L_p@pSeIXQvsGDB z)B4yL5<3~dR9^n11he}N1c&mk$sUFU0-c=^k01fMPr&Vr46sy>6dj$Ikn(E-I)@cH z)uImu1_l7r0Goi|8ECSNj>9ZsHi=Q*$DEac^;48z!eYcr7BFe<`}y{qCZF)HTmr2 z+3$0yvt`sXnzX@N_ zuj!1J0Nek|QTtTf+Gd?p>lE74vle#OHTW#m>qE`lHssDB0ewury|PjT~t)0gKl$YarqO_R5)RSv~~s|uPs4MI(?WQ19MupYr)t(uVRU&3wG+sQ)@uXV<09} zA#L`r-*bBaDiiCNa%7~1(cknOPd;*%KLx*8_9X!=LQC$Sz}ez`%u$80&{tI97LU?j zEs`BY(M^h`hhD>K_xdH(iW(yyS1r%uVD~6I-ACNAw16vMZ|R z0R+w9`e>eu^_ShbDT5XMq^Z)?|Hsie#>dgNQ9QP7vr!w{Zrn7sZJUj`O=CBWZQHhO z+j{4D_rw17^X$yr7tZ;g&eyJ@Zy9``yQhtO?Pac986fEwc&LcsQIG|^80o0$fMk?& zOck7#$J$9jv0)8$N%#+}ZbXH!`JDc^>waf==t(E%3e!D7uV_+GSAZCxUI136K!hS4 zBi#d^Ls4yM+}P=V0l13jLd*%mE)Y7y>i%9otJ1opp$lV~!$x?xqq@=~3>@g73U#&s z5qd~umGjmDnZsRupL38VLrOQnu(|^dp=_Wl;#Uu863Xr}_M@pNcWb4Z;ruNVlc<1- ziHQs5AxIi*tre|Tn3qnVxQkXK6(VV_6Q@N?l=(#yhS>&+PPhWYBE8=c%+1eO=ll}C z6#wfcF|lnBwTs!wvbC>hzxGT@puY)DtbIhx{C}b8B{@BscQ6-2nNJD};7q^C@A~>M&iTEzZ zIh78jWQeu~c>bSWUM_AoPMw;JdgE{fh8cX-;!_jVUQ2vFCj=azn)zK>y_{SanZLBu zl)a4<%mMg6)Qk1FD53ovW#-YpQ+VJXutLvQ`8{oim64H(Bz!0rOKWRqhlgCef;bM` zLnf?@(TYTRrr(-P^v1%gHX+b*MC2zmb0@;kGL7O`)4J)Hn{ zfow`+zON7DmqTQD*l-I#`g(4%k_AvIhE!ZVJWLD^2a*7RQ^GgO&{trZ(Deb5u2)+k z@oYy3@oZ{YbQSs^H^~6b@A2_5jFelnVSH?C%MA{2o42gDy7!_Bq0=g41ekUG3<;*Y znwnqaB8WKv(dJuQohVgHNKgYSI(@%ploha4UMDIjF14TYA)yjEO}rCT&q8>PO#1p94%|OA{g}+&&*sH1)lw7xMdbUj zW$CKC+*~xf$M8{$yA2zsG50G{ecv!lOhgi1{~*-XnrkjuJx?KyhKFaWcAVhq{POoMKm9j5k=`?)a$zD`LH&E~-uZ0%19)g* zQFDow=zKC&T77%no};6=c;iR~IcGS2V}Tr4PGh5-sr$3&J?_pVU+URtjnNjB)a})* zwEWErH}yzC3YCe&kLTAaBiMk2RjeRK_{uHWEj7&4!4*R@qSl>8*- zw3lWFx$0e`q9B`e>gxgbWFD!Uq&y)Q?6w2ZUDJ)Uv?b zvvmB@-?AlUVfu=9e@1Y5hs#W7Qib6&dM(w8yAPo96I==_gbQc4akH0~n-qfNEtKzb4}45rV%g5BbD5?deN|fDpvVr7wzw;9AhuBy`9JH}YTS0StFj0np&iaWXL>uLQ7D z#TuK!As}+fy<=Ro0+r6y)z#3@5Fi+P^nct~TQYg-&QbRaMT4KtmEt>1YiqDsWE>uV z`4tNjCOa^2-Lp|+Xl!h|o}Q=@9yxOIMcn2qzWITfGVV;le$*k0F!}Ee#z;8$Q2yT8 zcK6GTVfqNbhq1hDxxd!7_;T-7|M0X;nIvJabV4hth;@LQO9${M9*?eP@5Zbjvjy!g z&w&9t9);nhVCMl%-NlE1cUyN!u1`;|nEl#NYFZjlqVsx51%U@-?GsM)&3PBEq70GW21Z@cR@cH7p z90>WL1mO`b`1$sI=rTH5&SI{u&Bxw8ab;zN7ohCqtO$%Vb;J5(!tAC8^-ONQrp%_f zS8Q%*ZrZ7&w>5am$0_FK0O{!_HZGly7ty1ZWEbW;lQdbprRr89eb$?*I2)4!=y(S+ zt7I5?VsWiDZ>Pxx-)Qr?=gw(Z51~rp!lBZ8?I$;KC$bn0f8<~augxYh?+N)p6gw;} z>bKLC``$j}#8nbI6#(?p1zWVQfD}BP(}swIXr;llR5mv{BJ#rKvTGLy+Y^Ht_1Zw` z^!@QA8Q@haFi8<1WD{n>qrx%yUl08K+9xjF;gj}xHE>>3mCqdYzT6(BKB2FXlD5+7 z+^A5HmHPW^t;N>Pj1$Pd;&Z>q5muW1FVOO=nEUNTgrv&0ZQNxu?h@rC!#7IWVa1pt zZoS1bbJvEF(%5>@_GwlBqg|Z!ym7F!rLNEPPys6J&h<{GHN%nSfpPV&+oXzfk#mP$ ziHUL5)$1+m^Wb z***Yal5J{lC%*Yu?EK(hq|3;5QiLG3GvPYUkCXbEFtxIDw>)U=_xjkWJhTUJO}~HF z&*u$_3u&x#n;9kskPA=nJ7EkMaACW{l1v7BQ!q+!W)nld2+;-ON)3!XuG6p+J6eXj zOFBAmb=TuwS}#WrWut2%FIvVHJtNBRQR`07`3iT4e*1u0yZ)Yi-~AC)>zsp?<6<+8 zuOS?S&jN*Rq8}uD=N;k8HH9*XillWzT|#trr8RbWl)*T5MNi!^4etcR>axjdttHHKwcmQN=~Y z$H&WnY$$N8?F+qaMfrGJVwxAgW%*G5oH1wdJPZvbU9^blrNmU8E_AzCled~3#>K^X zdpPvRblbbyrrahgcS_ngap++Da{ch|aDP92%5FZ{rzkU2!cmONa_@4l{#%_kOJ=#n zlJ++eJJ^2Ec3@y2so&G~+8WUal#ku)KlvOZKv~p(+#iMOOaC$I|5AHz&4qQ)Nw(|+ z4+!8BF)&0LD$EaUbUF=B514G3%7>i1wMWB9+em>A2?@uyYK!`&3>0#PTS=cce5!v{ zThA*jLhEgoy5E1WQALQ@FSid4j*eC~RNzN6J3a3l$P+qc3j+GY50=l#Pw&+~ndRfe z$v-MlP-6p+U}1=EHg>Ub2yAKzq@;dP^z;Oy5To#5XgxO|$WZhI;IhtC_77%m07~xT zALjpP3b9%Duk&e9h>;kX{F0KBAJzTu)wLV#pq-&R`JE4xgJ)x7V~dVL z5i}{ODo7nbSgsX5Yo<10J2Blc9b+svqK-f*?*@wgvEQJ|&myC}ni65ntpopy!25-U z=2wi>=ufRLH)8x$cnb|~%3 zKnx)vr_Fz5EBS2UAI5N(=NnW1PcTwa{mhB@)YO>5{DJ}|o@a`tiGi4OQX#*{!*AcN ziP#}Y)&XID{x&*6Q5jod=i65A7NnodbYa0PVk_s_)y74;>G>bRR4$SIaTmP~g#x6z z$M!To&C-ROY61VWL#LM5FcK!8MA~E0`_1!PvRk!_^DuSLtP6s?=Wx2Sd14A3HqqOM zz=puMt;HWH6e63FV!}(p=&0zGoBo!$+hI1!-I)3MJ>$+<4gr2QMk+aKkQlrUx4T}x zio3g8=6AV7Ik~I|q4Ps;ut{}^=hel6%B!;G)*J4{6%K1I-)f#YAu8%^3VWBonTibK z43agqDwTh*u$W}bKs%FX>kXKy-iAgP6y#e0q~_HWf8uj`Iiv0m?g;@M&9^Torg%WW zGZVv)#+th6Y#)W5)Fz8?D0Zs4)T?k~zV?UZ^Vo&772nkcFWY6Wi#yAy_r}T*cbiq; zbE}4B>46_IhspV|B#-wigh#dhb*s$|+!?oY;0M#stJOMIcCq@=|v5>?S${YJC6B>MDO=VKjA7LuS zv9XPj<__OcHTJlXk(2XP_lxCrmUr2IT4D=h|L?Fd{u??z!YQhK%VWXL!aS>E>lU$y zAFXXc*ZWEnX6e^f=;L%%;M1(pkioT-s-^2xcRW5^aS{?+^8MVE=ex7~7QBZog&Z0g zXoU!ysQDOl4=CL+_;>e5lNos@A9WviFe@d0k4E9LTm{`Z^mTLyw&C&bih->`!vsG9 zlXkueH&@s08L?|yiroBm*thgpvK?DDkZAMW(=hQSmGg8iZG+f-hFjUyX!$ZI$^k^>hihpF|=EjM~rZx0>*@~)GLIAY&Ki+-{h&ycRgW`xrWAuyzaIPuSfHA`P>v@6|veG@A#@ZTT6{QCpWk% zqZk+%{NGRGeo5h`KD1;xAFA5C9c^{}LAD+YgKcSD5&XPkYu`9>-n64@$dikO}23piIYK$$EPI03PeM7_Fkc5SOB|~ZjGUUAm zU1lQm=z-@Lbp%Hi3%6oUEp2UM?3|!YuXaB}LvX2wGQjPX2j88pRc;nKfPh1yaqLMV z5RSkO283>u(#h_FcbF7>_?lJBsx|X)8_iEZIcC36-An}apX!x6dmeSCUoxc`Ei^!Io8SzSUbYoPn}5TZO2p_Ei*;!Z6u z$9IHtiei!4$cnf=#F>K1GhcArmIu0ezKE-o^o*JW>cVhDDQCkBdu_dpudJF+20 zQDTB@ZUp8SPg9KK6PVoYen43b>WW0MVU%MaN7vaFj>rB2PXHsu7`|IO!-$NX{{`4f z{Su$HBcZ-xzddX%O64Y^Dk3cpJ^kpG8~hFOESJuK6#D74!CTA!(^yH>vOp2~6*1~< zL0o&yWl*zstb9K~d))rVAF~o@5eZt@+SU+;2=xmcN(MhsNS~Ww+AS-_P8)?UV4}Sn zQ1$iouqZ?Z>?la@Q?*IU?B*vKQS_HWLX#!*6bU?32O%khOtdX6^RkLMfD?egKNsA$~5-kL#r@%qpR zRN;}0?KL8IUMej3S!08m3{zed^<^n8HO%37c4S7pwnGfdn=NRlqM|^!B zdL?LdWx2gu8Veb=&*+1*+U$Tieec#4#q#SW^;+jG_ZQZd!u0H z0Em3mE`K_AAwgMh3fo*^Fe^50wc3~A=mV(mzHBa#nG~fxEL6O|`q*!_nQ~~CeAyHP zhA^Ib7sHqdO)Jw2_&(fFMgdH&C;nSoqoS;NG<uZ{-x|Xo1L8n>R~1Z25Sq8CihD{J3Bi^$8QRb zAqv5vp~rzq5cDo7!+nHDP%3}jV5yz$?4SUJSRzei-ao|Jpsr=lnbyE4ryEIFM+!xR z*A;om+->PvgRcqibka0vQ6S8zU-a;l+SFt|v@2{sur8<%kI&qOATS`->0&nIWfFT0 z-J3I96ouDhL@ujW0Zzd=1WyQ7Pfx5goA&~L=U0!i6lmdr?)y|?=p%Z!1Big@$`8w% zC4o}fz(ucrQ(Kbak=kl(Jo(dS_zj1F;{%@m-kSzr$tn5m=jeuy1pX3TU-eutwT8V) z8l-0Gk=5$N8`Or{Mii+sTm=U>Yz?`olKsY#;#P_hDKJK~hLEoBHZVF(6(#@LGAYeO zcmoTmJ7|U*a8M%)#bd0#JzLvBTWX4DA?lGc8#xsBZ{B9L#ZyZ0FrZhoB*`XGIwchHqx|agRVJ*&~nHikV@dLRvJjl1v;OlHzvw*zw&9}i#Nd>Lr|gt&dcVw zh;GKbC8aztudPxWB!5-=4Wn7O8L;AVePJsXuk{DI&Oa4`hk6BmyqAeH92cxSJjRL2 zJ6LJ5Z%eYZw}dw8P1Fe&wo(N&}r@3kZgZj$PNiX2Xk zd7^@@Rv-i1*fUgLr$hW#wZ4wnVC|}V6%s)oz_J9;M1@|@*c@8(@+gFaIsxl3FjCkKs#`BMgM$K?vW zVQKz!)sKHR0A+1l9@*gBv3fcRk?pec@i7=ufNqs#;evqpM~eI&lmF!dW&B6%pMx#2 z59h?{p0+}fK=7?_z*MaAgY7Vxou-t5iHV7B%HP8R>={~OwZ`%^*gG!9YZOQ%{{`$h^_`w~H!(;EvIE_4o-hRtQ>`NSGS78^)QZRZyKF&MnB%gF zvgK-9TGj3}4(qO!X}oyTa0&+q78W2)tGcYLtgVe-65Zh~RuMM8KZkKD27q)-#Q>d~ z#dkRT{&0%Wogh|2e#pAuV->Ehu(fPa^!W7WZsCNM#x)A_3rZwH#tC4M;deLBalbC2 zTqU1Y?lvXwVL}u&5{y0hwG0EiSXK5>*g+VnYTsgQx7B^n1qOc*?}v8|pnl5&(P);?;AjClE#^{^a+Zf6ACfq5`R zTvAM!(pJ+g{Hrn~7!O`CcHrVdM{hzFAuIi?a;PO)TQ{U#r~K=qis1UgmQ58qwMPtb za9~;4lfUJnOTjdE<^)NbyX={tC)fZTB=b?rV%W_ zNIdYXf0lQV0c9b2PWln7o3)qcTmYD5?x%yGKG^(2A zW73nUV-b{3%Qk46DHavxdac|lqPIoW@|7z^*Tr7-_AJL}5syrjf2ViR0%`4USSSJv z0wJ0I4BOAe4bEm0mK-T{=j*!tm76Y)F=@vP#`~c`**2;DQyd&G(zL!O@#{5{I!@9m zXS;_?y)r#EC|vIL4GiW@?+IPwh|Ee*FHZZR#!`8*S)iXf!i+t=y(AxVy9;USfPKJqQ1kOH3l3nT-~MrU4Z*5U@cRM*^B) zLb|_ybaz92NW_O%LKGA5m16_8zg>TXiAhKbJi#vaZnA{d8hm#HAz_hVW`V(!zEAbS zs`qBWcgr)7x!c42=EnmNJgR_%ge0#xDJf2L`-lo?e%tel=_$|iepYs-I04l0zzdzx zHbH*Yz(>J3QEBOvxHweVtM1IzZ2v1iap|k}!ATqr-nNCS*q8_bfO2L(QI9m|vVXd` z!RPkmbsiHHsm9=XIH|kV=J~i_+d4bTrX&dXn5Vu224-U;_~Sr+18ab7#2GXRsHAf9 z^C2&|oa|m-VQTgr4GaJ(EI1?b=#ga7dBP-iYYVSh1K zyhVZirK-MQs@p2a%MY&QMs;-c519~zF`1{zuw`itD~uTWr7uwe4b&@apaNBL5u6>OBnZRntipW53RTk8rAAfwoIyr_I{p>Vkc82c27{E>N@o8PM zHbNW1Zo)#p&Lw42#>E;L_Ru;(`S#lx4$cRl1X41%Wq7GU2jrQ(ru8aRqAgcx(JIA9 zf5$y2?jNUA)?zJ2STtNh7>b8=ib0YppAKNxv?W@mClXd>WYG8q+K;wKY5MyuK8pxZ zN-!0&G#zB#gtcX9BZr7Sr4i#5Y%Y#`2X;n~v@-kIg_PfKhN=APsk=Ib*yIu2E8^^{ z*o$_!v~jM=)P0{002b7=;Yc$X-TNK*JV%I32mLqW+{EaXQRQvDEAba$YUqdg`G_H# z$T$Ui*4eqdx<1+V>hQ+Nm~K8ffJ4R0jOer5_L%4fk+4A!plBupdITu^N^!hWKujos zI#YJ~4jl$UUh9Djr4xSNmOMf9-?Ek3TOf(1nel|^4VW=_!HmHvNvSUdmUbm| z2E-nF#D6cdGFnb2O}^&+8&U`JvI;2CR$l*acpb3~46gyvr`2rW$~G;i7NlgMYTxiUnLD1F8?7Qd?s(KZx2LP?`oZ+*t(C%A!}zeVOXx3GCn?D zlxY;~zdf7;#^+;a(RH4`+{%8vh6c748U6+Nw$ZBovLhTsx~v;9MfCNBBy4RJ39XGp)#0)1)E3z@!|Ny3E=XOzOuS$NmJay zD1yn?Z;CWPPcZ+B9PlGpL2=+?Mm!HGl`j$%We6iSy0yya=MlTjU+#N_Ur|lAS$0r( z1h^k3<1~b@#G;op)=Po5lRFD}%O<1>Yb5LmrhDPi}lja@`KOZ8=>#`h_ zPNYi7&$3PN$6-=k8Av^-Av4#YCMe^jd(=h-caOlCJte_*;HoH0nFGS~cJ&m$<*BAZ z2l(^rj9pZdQBG|up*4cC3Vqg+cR-3`4R_QS1oFkUKdg?~3n zdJ(!-39`Pc4>EdGh7*GvN4#T4H+N1{?JFM=g^?G=*=9Qmt7E}qP6>U18TBv$+o4OX zLyX9zOV1<3g=r%j;(HukgtWmg+eB%d1YEaF53>EZO+wU2rSxf41VEUH94Ki zwPo?Wy4IX|p1WVHq>9z5O^?E9(-5)H;h0-N=k)Ll(epOOh=g5B7Kf-hxgpme>uL<> z3bxegw$73=I5nX;A*QWDJo&+HHIe#M4SxbllD)=oGXfRN&dI7>q{yfZ>i;aA1Xo$_ zfss&!h?VSlXa-ncJfBxbYHGadS7J#^lSusA`jhJ-|7~w*r-jlkq!P{?X#CjpG^Cm3 zjL$o5%efd%vuWd8e$R-2V(mohv~VN85MO&{lbKB{W&^Y}g1!Xc5|WZxyslP`=zW<| z5mnPtfPWgWeFD)YRk#PZ0c^yG@U2NnkpJA+x!F%g<}Vf=W~ZwY6RJC6E4nW>rawgT zaJ*h}a9URRIw&w0Ilo{K#6L|Z3}0R4yBJX;q_*8$^+ql7zH+A}IvsZhOVRnY`D!Ra zbTMXK6PkQC!-~XyBjL%jcUMW+ONt}4Cb~80_nxg$VFWvc-V8$tV1;ev2+Ni z^`=PoaR&E?hFH^GUBaZQ!1vLSg}uEHBM_tu#O#)8GIr60&s&*&qmcQ1o}fd9Hihm% z*8KN1y@vQ*iP69&YZ)&3A;I7p_I%LB5hNb=gFOFrPR0Jy|KWqJWrR^46WV_)?fF}+ z*~Lkgrh9$!dShv6jhva9SwYlT^w3v)6o|MhILcr~Q49!8VNo*jXf(1mSn>?2GPIf@ z@5}baLGQ~B&yDs;9=h9D@o#p=8J^)RteY8+r$2&M$%_&M0q_53z&3uk&m?@`

J=qpqn6Wz` z^rf*8U(Zq5N(kfefbfgivZ2H0HAYhO+2u}!tWFCbfxjql&(X#*zhkYE(n3f}OB(*m zm9iyXp_Hnt-)Bh!9(xV}$3^0ayuEz`l^;Yd-b6hykh;ppP`4I7(jQ>=Cp+IZUsGO? zJeWB-a|$^|uEYoiv4#xs#%=`lH`P@|YFyLqZa&ZQ<9B^*>v`UnltF#v#uyUa(u`9g zOK-t>Pyf8D=ulY?riEzA5N`@ z2eXBWx3PY}6rYA>0GK3AP6DtOq|PlEFlV5tM{c?~zaj=RoU7Vd+1c84+nak!VH(3#2*6Vf?H?R0%*;6bE$sA1%YX_AF(iO! zI7??{ihWnx#=l_-;?nVLY&vTyucf7V1K+LuehsF3vf6+A;EfolMH65R6O1zCnk|D-B6$HemPo}#$mAVVYZ9AJLERLOV=mV7SP)1EBdQTJzj00T}2`W zuk5qJYp2@ITXp>m*nnra)h$;dLdURhetw6+?ydy&H#4?kKaPyxFn-gaF8aydPc@aL z{1S;&gxuS#Nednf!Q!eQg;tkG*oyAiqa_@Fx1L$TObI`w;p!Fn74~s0%S`Vy6aEsf0mtD&=OE)U5Q2P4n)f zk97~1G@qp@@A^?Zimanr2axa8Ui(#6NvtzU@41&KMU)})@asS3cf7Hc7F0XRtd#3b zLs3LrS&x(x%3vtZ3us{F$jRsw{)$vzMUkYK73Jjb(71s!4WO9``?J@FlQE+3H3es0 z=uTJhSt*UdAbvx`A>~U!syw`SraSQKP%1Y*DaZMZa*x^;Eqz&aTP#tbMD(VOjg_6N z6%VZ$@2=w4L4#@^ zGg&jor^D>5Z$YCd!=(hSd7rKfdW^`X56%G}AJ2hfdOANk%7Khc@yVoO4|eLh{rLFsq}t~A zx0hy*fVjs(H(}7x$esDl00r+3G2*VgF+{C^!7co)%5+BwBcZOoxje7T$0fxrIW2~! zY7FskazOlYdAs%9^>Nq%fFHYlaZ3&dz8Kc?O#KL@Eh%Lv9a>#@l|aG2CRIaw)Ffjg(W0@iWxKT?;?CFR0t5Q zLlm~JScb1&@?|4vfh*Oblw#L3rZ)IHfAaIo__?St3Fd50iq5ItnHwQ5CTA}gQXI;1y~Lo&w_8mDrMsG%8UVnan70EY zsND2>Tc!2oHoCB)-hzG_sz@Rqp0hWHd|r*n^(`_dO(Ul$QBxPNvzQcSwkkAMhFbCe zu&Q-&;El9F0Yvp*&E(VW1O{h^sDnpTjQNm^_ zoT%287A0Fi5beWqOa6tpYU*kWPFmF0R@dL2^n~~7bZ*bXuzNHZ{?+fZRe!V9yS217 z$({r{N4ZIGYrMv{;O`jzu zN2$QZ>%F}sEbP<}bo%qna_wgvz_&kN1|4Q*t^?XmKbAxSvIuxSZqgihjqZxyrEAvH z_&9}ecXyc^R#Sv?HkYjR;lLW)fEVe}(q3w^m(Lyky7rveSghCo?JD27a596(^<}a1 z?WdhrS&~ga7dH{0_XKlfJ9x;!etZ87+NcIAjmfJ+iaS z#v>rN?;6y>M+wbvdBiw^HTcKH>ue*^@zY}>_rU@A)j0twou_N@wDI!2rJ+G9fBGI3 zsa&ho(8&r0rwnKB3xiZx{QFm0p-Q;<2o{SyHc_|IaU0eYd0s5`w!K#LIjtD)hkzg_ zZmo1}h<8ZgICI)UUM($U9}BgruHF23d?oOl+M{vK{3O_LDRv`a!@4i|N#h*}^az;~ zH(Je3_q}1uKGsb?+Hvg8t%HZO>5hmrj+dC=9j7~=`#aee76L>m9~a6sqhiAq|5|8h zri{5An!W%3COq7OmB(0eM+jd(;g3Q#2Ci zB@cf9-_1{}VOkYD9imoVquh;PBgP-7Xu>BXa6=DGjEM$z6sVOG_AA{P*}orp>lbD; zbmEn7-*HOB?9n=QmgENmMg%V(pK|vfCQZ*=~<^2oJ;E|th$3P>D-N+V3SDzyf47bYP%B}BMIT+v=F@@!hj2dHIcLSrSx zB?~1SfGyy8S@E;Et?mrS-Vl1fRz%P{a86h14isVd!^Gl|@V$Pyh%X`IEnWY!rndEc!LnEOQdR)FWpUnEtnJl#`9*0K$_cs-u-g?x0B)!>c3a(n}@lB2XZUEwWSD`o>Uzm1Az@=L!kR2COy;NhPiABjKo zh$&~)8Bx477T+}An``=^D2(3LKpCc-%I(wx+gR1?4fDWtJ~bKCHlRLZHIVF z@0r+2Se_(MqPO;1l~_$?w#GZLyLw5seG2bfgaaPe_x1JlupLa!O8v(ty@Op?RKfSX z+BwWZ0fELmqfW1TtLZ$J*uO+47nc4v?0jTX06eLRNt-kI&!5Y+=F`iM2hwbQFM?Xy zmt>*$<;+vApBVT-S?OsTO>UVMUNDx&r^f*CdJq_>clf@xwYTRR8&~LeejH1YR%&+C zv=#krXk&E<+w3?>Noh|2f~?;zf2*q$7GgAN-{xF>tvNv$1*kKkg_FK48Gf4AS@^E`W+ z&5+X5Zh#>8gN5zwUNJ!tqiTn?H1XR@beii@*s&OVb8U;Ky7DGN~UZwpUpsgyB@QAS%_s6%?Ssqjp z=|k~S^@_Cg)OO$3*yLnI2PF%QqpXPv!F=m4_Wyr`zCCXzLXmm9@Rz;T*Tz6iu+crG zrr_D1)!}JE@(g!s^2xQ)##9%gsVVstr;`u$RN3l!nHGaA*fnEfK$+p%`#; zt-&gS!3yi81hS-%vwQ5>^CUY6wcMHqQZWv3g&tx|RxB?sKRme2Wji0^@~yO(7xtrG zm~OT^E7Iidp2NPpc$WW@kVetgwJlh5Qw-MARn`mY#>0{P^~?Pnsk^AnW_YIIk6N(8 zE~-#TMHxm^zjlKSJ`oWTB4TMtvE(n?>pKV;X};8t)kndlCdbI2hEJ(Z8ErthZv;b74G#9JaO+{$e$&qGPn3t|Xnha@?bD zdmChBtD_x}va_-yl#pSMR_Jwb3h?@!_Y~aC)jbRx5bJHQVS?mc@4G+1tJaj%<2Gt4 zD}m^m{D1!jjA|9e^@2>ODK0Y==Li(iQvL(g)7337`H`=N@ zI#!H0Nre8WXsNhuul28Tu_Zh^SkGw#uYak2wV^$q-J1jXQ^_zXrPc08hLMrUESW*= z7|{q>*N?f>hF|}h+Ld{WA?^$oV*@V!ElhP8H0u;E5b`gSLCU}(!;68Sc%W(}+Q)t0 zh?2TZYWO{G&MrT3mTPG{_!@38+Z$|ett>25hIG^M>3Hls)un@a?ab6Q z&Z1UscaAZq?^MMtmOy72@mraI4f1<3Gbv&E)ae)*e1YjtL@G}aoITwnQf8Sc?WgHw zJnVq%BRRPaNqkD=%V7CB24$utbK(<}^cs1lOVuH-0oYNgRz&j`J=Zz@k}pFx)^rV8 zcMcFc&k1pWJ&v6%PUhjpU$slEP=M` zoX^K6@XWB=c-|^iJW}c_LVAD8T`9EzibFj>c>MQEGOrb7dnKuq2x=GGB0x4*=WUc_7VvJMy80-x8Cb`#<@_X+^aqA@!@17&H0cyLt5aSp9{#bC=``J zj8(RL_w@-x4QS*l*PNZ3iVgtYO#ZJAwp3O5`RBEhLKWquYuktSte-p-*$IxPfVG8g z3nt`=>hwDBNFyvFHhZyn4mcgU-s^_DFW^v-`TRfL079lY;LUitHfGa3VASDt{}}2P z^D5vacheu+7)l5fDNr?AAZ%;&o_??s0q%Qa01N^oVP74EPvmS8lca*)@0O-P+lJnO zhXaGO^H%qf*bGxs@vCorRlBsYZwKxAPfvEQNBKf;yPKcAXLm$XpVhy2!#6TlQ}G)w z_5{7Fdj}_T*cQ|lL(dVyo{K?+-IxvrQqLwC2RZ+o{A?~r1^Np^W= zA;JTkFh3sFieLRdtmj5#&;o9#4r>p zLBA)spYHA&Pz0Cjt&i#zH+TeuVdKZg!$U>u0s^`)!FJC#Nv^KQW}x@`hLFXZi+Cu% z4@(#ErTyE(_|e7+UDT`fYRC6q6|ocjQOV)rE?O7cV)W3Vl{gnN8bFV$z904-11xRo zx(Yos0qUgoC;&QU!_3K!22xLb1-ZA^HqI()Mw`%%b3xa#jGt@yR*CD!oUZfk{Ol|- z@+7U~>Qbnw4N5n;2J*wp%t}7I4A{@+=H@MUqDSYRfX(MttT8j7INt!A@HvNtgyiP& zrWbG9afnpglNcrh`kVI^2$R%Qn5=AU!D(PiFP-n5pSuypmY`iWY6(*o{k_wAn0l3; zy2opb--u%@sg-N+@Ca7hjxGQv38=ftaQ$Vwn;Z>H z-#+`#KeLVzQX6ms-mXc~g%Q1^o}j~j<0{oqD2rZY$LAN@xf*hSFN0I^o-S6LUY>(w3r3S!aH9Ywe3ov5k*DZRcjxDH+~{ZtA)%I#$LB5}GAsD^ zufEa!Y^gfGp#dkga?$$r#f#Isf|Tgwr}f^@YTX!L>PdVGLFtDv!fF zi74Supn$wMJWTd@ia&kWgno82tiM#8pz0fx2!_9!jrmilaqs?lWn3T&N=zgo#zx=j zr2N{Ym_M`8;`ll`+4;poQ%-xE80hLq35G7Ju6!N80XEWs^V9T2d*MtGXlrY$i8fch zYvHza6P{$Zm%iM+v_#g+`}7#rpYCF#2T9g)P8>%?VS_70O}?G)>#smZ0?mTRWq&8f zNnfPr<}=Pb>6%csOY( zG}bDI@#I8VN-xOyMc|xD8X~dTu6__O&zKV=y^JJTGpLoVVAptGW~F=tCO{{)0mJo* z5!7U=tJpvH0(U=yu_*S_WV$N*D=?v&mFETKALXVNHQ1YZpM9sNo)314X3laR)Wf_= zCzAvPa#O6qdm2-hc)W55wXEfonikW>xhiz-A09Ru?MYV;q>uLrfAa`9Y;GfrP0xw* zu_nl`5u`wdwEu;Njfb5;6NWLs3`e8NZEt^{q=vuXL1;V_o_WKj7(hk`pD@hXP6+HG z~zu&&{k+^+OVCNjB#bT4&o^r zcOQb531)E5yTb7zA-%wP9^T;2Kc7IbxEdj5#|4%zYv-sTP7YaOjXbEhas2)pRl)jw zgSO9#@MYHyQj(GZ0oNKj8Y{E&sEJ?sxj6-RAlD$FP=({H;Lq&pr`qRaLrsi)G-xu# zo&a)1T#a*nNdwCybKm~^!wWPwDIoxl5JOQO9O@`(qJ2!KGdKt8xuy#jM0 z$Kt}Gx>{+03ol5apn{R9)%jLUL5-6-1U|^)`DTCp^|7R+#Egcf{|6gquuRp8H!rW@ z?Q;I$>@KE{e*@6DUtCBYi-GhtuI`>|TUKbA0Uas((El>vI9 ziIe?*R?pX-` zM!SRg)Cqb4N2v7mPontp;QDy)=A6XB%Cos4Sj3gD@$Eps-{*BP_WBzSm4}N*Ra4RL zmX1J!RX7fImWai~HK02Sgy#0P9DTs5miecx3~{sj$j@(OVCvsZkb2wUwW z#0poZu%@dG8@6Nb@zJ_ETDeWF}r!`REb52Er7`94LLcv_~UnT zw_2SgUEJlL-&s_2v_FAeU48D-45#o#qZWDtngii*ZjH`ovKT+jVpyWcxiM&gY?;t< z=)T$2P~r$#F99xmm#nSPeX3xop~MvEWSe!!{xi$vLI^%Tm=BH zYB!-40~Ro^7@iRm5bU8k09hJKOSpgE3^c%!CE|%NF)$p?p3YX-OtIHLbP}Oj9iYHO z<8n6w($~UC6w^B=;Jm&&3Ze-)!RrgRJ>$>d#@nYm1Zvn(qmt;Q3uRAFLKs6#=S&-< zJ=>A;!P((@)$I5{est}?cZnNsv1Ajohgb+qqjzNzulw+K?S>zcFu1cGve6KMA3~zX z9UG0F4+QB13wgF}No+^GehE*QnwpxNoIE+PatMyBKc3x*tclw^82(ifb})Vug*|;N z0Hs`&%X?;C{i845C8S`?(1jQP8()h3>nS>m1Dw?( z(HE~m-0X4OgfUB%a`v*Mx9ZBa;~KMIB@=fN(mLtGffIHwno@d5!d!SHowU8X@p8i@ zX~Os)B_w~1vFDwj4NgZA~+{B0=jj+dq= zQaF4_mQQ#uCLP6@=w{iiKZkHdJ}T!@onU{yycx%}%-j=x$DbIjy7c=pw@E5cot9$Y zNkqq$ns3{!9Zg+jWqTg0<>&eWkii2& zpgmLpHnZ8RV?|Xemc!*BQd(?E0MMUO+!HpK7#5r^HD{!CI8|aM-0CFvWloGHb@P4Oq z1gN%v9s55pkp{5d5p+I~1&n$?^31~A900Ywzr9_#0qa3tUhmt3KR}y^$GyEgT3Z`9 zRCo&wg=HK1BdN@7Xitz2x~IdA*~v!~$}0iZKsFn=U7TVYA&wIwYI@fWLBCwv6{-;{ z@p!MoQ<#L^E^^Q`wL`(6KY2?XK)l|sy_z5{aJRto+n5dBX6%1458-YIamE05kH+ag z@Zk(<1^xiP*0QY)kEZk^)^_reo@bDni|gv@8XACA=k`i6_H^C>$VVwXPXkQtp`xjv zhA1MrPC(7B18dxzqd|u6puj(-S044B!UH@VVXpSUJStF~gRam^@sTS}&Pztx2Hb6F$wL zN^?;ndZGsEdR5sy8f6{SqYpoq*{6$(+iQ2CnxM*nk2NMg1-hM}Tbi-<9%cwh$n>%gf8> z@_C}s5WfH&DB0QBfGH;58JPfx@FoM)g|M)&mzS3h{3NK95d8EhY_1A7lRK^|M}@ZU zvE8I^n8p*tq+KaJg;g7dON8q_x^YkbbNyV(0?dgP1A|0Mo%DhJ zfF5t{fJ>n#b#a5I^zeKnyVrH7nk%dmpy~aicgR6x$4L^(B<7K>nFtTAIFSWB04<>{ zb&&v9NptFpFb*e=TKaFR`k;UU;~9DiJU{Y`09~IYR{It}*;9lT3kJ)UNf^@x#nGW@ z8IIfRJHsgsDtlDuL1bYCc!vBm0(YDq%cetPuh}L4+g}JP4i|3*eH&{gfQSr#I2fQn z=zyr}=y0su^cw=P975>$c7<>l|-z(G9Ak(Wcri> zVO@kahIKUu{WW@rq{-fZ5HRJ+%GRJ~3q1&%1PZ9k(N`Ci*bM)--6VY`O@=Z=cM+-@ zpe*X|*z%<4+f@vtz~T5akkiWe8}{LNuBBdVM6#>hKd;=ohs8^J&bg%Vs;=y@d^^3^ zIe`ERHXuz+av9zCbCuCUO+{tEUDR%+fs&EY*24ow_|%1`E(kbRfb{A1H-7$ifYJd( z!X-YgZ2Iy~cXk|ssjs}8Hh@j=7@mb8T4vhsk6rGv^$Zm5(611PmVz6Io{zaK8*)_6++tp9bcA$gVw=#sN)8L;u?2eFK++RR(JWP zgB`3gj1dfkkm~aCbPTtVkpjc&9hh~DOq&7Atkr@!kA93XA`)xTo6#=R#iYp%zG@#5 z^Ew_C4F?7|uQ?1SZot2&HAhju1oKPf5@+?#W86C4Jm?T6i47#DGTYq`u)J#8__UV2_p=^5^ zegRf{Y`fx*`opE_7|h>NqG>3*k+5Ret&Y|((Yh4Q=_{I$=v3>O85K0Lw7CowHSTuz z+HD+Vt=b8P+p6Y=NaDAWL5-C={eM5qVSvGrVU(8wrx4uS?};MNed-PZ#1V5fAr&ON zF|*~R#_K4t>8d*GCbZ=_Gm}_mEyMnpqu!KfJ)w|@gx!bNOQgFj`y)e=pqZY%ca7KY zGcY|JhXPkC0bnriry2bC@naLH#cKNmAPqgQ8%x zd$r5cSy@@x&F!IwRBD?F6p-YKIw}fKbT^1ZP&9Nu!`l9#1XACcM1)NG>*(snU~m&3z}rlP z^R5^0_M=`kvbqcN(7@5rSt>Ed0)MZjCP)$zWav;kjzZRKe$Km zCao{DBEVYAIPgX+&&dio$`*vVb-eDrF-< zxdwAEoGqjICX~f6n_`y2P9tQ~tCPSamVQCWg4Z{*{NnQ@VlJy?=?u2E*^8CcxR0>M zUBzNL2|-Pbl@ka?klhO>IhjgR6ly`siVnhLGdZB@R5xMA%?S!!W(k>lnE}pmx`GpR0 z!4x0!%NHTE-h&9{RfdT4P)0RzXAj@JRqH_Pu5r*pza#`bNy!tr46RdN$Y!b&m{%Qj zA^ha2t-|GhcOak6u2c$ea=};BimxGBv0Ww2FOx1Kq3tEAj(Slg&rm5{7iGVXCtc3l zUk*n~yrT&Zw6f$NYiCOPZeKbwWw56WI$X+&ib7DPajXL)0X@JI*b#rg<>t>?1{9dF zu8hJF&TTF%K&Qa-fb&z3lS2x0d0g*qB~Y||qZuKl!68{irq4d_AZ;j)M$3_=*S*FKp+ai<}H# ze*hHmRfN%9P7gE043bhN${eX33O7n1^mp*t@v*U;vAvr7aG~Ik?MGfZBGy|#H@QgF zK-CP(a~LAtK>>$Ib8rq70Y}jeb`YoHGQwAogVAX@8`)fx;a;ic~;s<$6bmVh~ejoihR1SS4y{{yMO!1@GD zX9lyyRK|B<1rtcrztK%Ps=1l{nFb-KBzWlkS`C3%2Q#sSw{D=~5l7acJMeK}qG<8H zV_#<43%216Mj*C%MCm?>@z1p?cMefgRL|%$-MOYs&kqsSDL|gpfdk52D1Vcu1s0|X zOkkFFjgM?HZVeAZM^WNh*nK~{r9WN=gk|BAtzciNh`qyr7d;Dd%+RJpi{3nN{p|Gz zXvnGa>S|3=aYoDO3Em$N&_n7tn2r&X-foEm zU~o6>$B%x0+dXeh3IPg4!a8abLp02aB}KP{{7qfv=O?o$0tKj?^YmWjzOf68`*r#I z``Fr^GyA_+c7%ChS#;`BWn>oF@1R9Od0^Lo?N?S*tZHk6BL-ykVX=^jsNywmN^ULV z@HRZ$xy>&v1^pKL@nhgKH&?*p@7C7ZvgX#p232AtbqUq!34W(H3>f*pN8<1PRPSm= zvwKH441!}*@W@|8ZVnFy8EvcoR5P+4HC*@oW&@)E`6R-A1oMHf0s^~;fUKOHBSG*U zxq@K>z{db^v;9!DfMMOs%PTuS&zCVbH~ZxDxSFAMdlKrKy^S3m9qk1nfzbCIqt3@tca1aXb$I&2}?K{OPPF z-mGMwBx8nQk=$Nf-hQS=D`==nnk+NKie3@12?errv$HY9s7)AL7ipK;tuOy?Wa&YZ(-N09 zjVf%fD|&(dc2{D75{=(@f;UQ-a3QALG$5+`Xap!tV1+NAvD@}Twe-gHT4keP5F-$r z!`;WWQfYWd_COC8g@5}pbC4c3DP)pwp$89g%21HF95E0Mi*`HQ?-_0HPysm##U=8aOa z4C-}mA0bO{5$1d|)RxU&#>DIV^VU0y-RkT11ti!sCbmCvOwE;fxUAW}(V4Lqm=x(p zz~@O8WWQ=7|8F+xBo|an652iU`HJo`Ocekd^N3UEYL5R|WMWFpA$g=j;bn>Z*IUa17sdaU0PZ=78W4eoRene|LW?hM=8}?AO6wQe{fbaNJ$5*8sS@X4Q!xZ-D&tM=>u2>cMH zPpbl&Xn)C)Z8ex>snTIb7Eh>G6XD>S7tLlo0IgRcURD-X=2TNfw+g@_~<8HEz%8Aucg;V zf9ib}|B}tJrh&oqV%BnVp^A}Cm)i@p&&RQa777vFew4U@PrG@u1W<|#n-6F*oHbjh zE%bLIpHB(|X|pxh7Y?;nG2I@zN&ws=s5N?sBlzwZzyjg1o``9&aRzK7Idq*zcTPn() z#xoGFl_Ez=no?B8;KRdTy!=123?#(QjxPz@94?%WrXqR+>T)lP22~5^jH~AH1E)Rk z`^}o@8)@?CiCpb^B1(2j7IeS|I?N+sxHz^|r&kIPXdD!`d^oGEb@(?*DOD z9-qLKvt6!YbuCkx2=Pv??$)VZUN=*ajDb$(guHVzB;!qfq;FIaSS8kWbxb>mHH5Sk+E4XSY_kz?MVaKoa~UR6a#o6+VNp!=h?vazLfP7vjg+&5!Aev{FIktOQR{3Q1}+xTWkyNB9USR}>CH(w z>LNN>VbOfdI%w1ZW)u2#rp+nIPmgNwM|z~Xyae|(q*1Kb!_SOj9r9uiJUNW8jMQ%o zM@=OlqeLxt;-Dy!v@(dm^j+FIK+OjhpCxPWnm=aSc& zjHdtDXDgwv?qQ|SW=`uqGT)6%p-mUTzu!Wl%z|f~2j!l33_h8&FJF~8e&6F<)f=)i zhLH_qT_%K?LZ!gVQMM@B|BEAkhtOxlatfbFa?Q}S1Y!6skFMS*(y%1;XkDk@PjGIlCL ze0;{=kp)*mJ=e4KU0rYCkB$16X)rG^y=v|{OY)!F1%W%5^y*R+tj(Ks#^ZG3^nvGYb~s;LMe<_TT*j|&t^R!`{(Sr-z|U*zbCv-PH>2;>JI_PbMp-Rj_>Yf& zIm!TxC;no!y{+BOR=*m;eoYQ3rTEay<<&I^V74X}?EwWJrg}z>O7okNg_{98BV~(r z`k)pTE(Lae$fN+-+x6~qPe<^mL&eo=m9!}VKaa!ZKF#hwvo@^ri;G^KufNv|61?*X zdNn=n`CczF3d1LEoYMTd=c_R3qE8;e#N4?aLt)Q<$xmQ7M{!JOD4@h%ZlN#es#&Yj zytmp_(lU*8d7Ub{Ah7bi0$A_?YP^by#aeyR%v`Gq+qdb@SO44Fm3H&{U+5!K;3Q-W z`RekJn&JUM14iIqq`1qjo>CwJa(=g3z(HO0yd8e}Jt;~nC>SUy%>uDo3yV@UtCi&^ zRD#UDcY+p)_y+fLgu-Wpa25d`(#%Zq_>9b~^j*C0F%jwz*1;`Rl~&*6QfV@BXKm-; z7n6k(4#R$zIrQg=?i*75UL`z8Qo59SRjLdEi68$NPVcUWq{-0ocrx6c-=JZ2b|BHn zGIK?qt|) zo2=og#mLT6EKCkBED4M$%T8??UOk!ZjfYs)V6%EkZTadD#=l&GGucEu=?ELO{~j6`H0h=`hQ%OuUr z+VQMb98FL;$}}$-^61>F#I&u}tApF@$Lr8z$VeO=#H*GXkc7~Null)w$HE1Z6WQMf z^<1koS87*0Toq)7#ORTgk+IV4>#eSiWg#pH$e3pga^S*3oHGXB`VBAbt+(oYGB)x> zjhAz9+}bt!HMl=cS}zya*|iCf%hk8Ov4s3poHl5@Py71x$phzAR~RYem{fN*!8|9Q zTc>5CqQXXG%{loeGLac8Rhbcue4i!}WaPbTj2sgy+g~j$T!f9+EJ>G_3xNH{C~Tru zc-T1mWK?+m*$7zDa+qOO{$j`?EJeJ@f5PoVD<@bfn#1?}5M2?ecK>&XJwlPs>IkFBB4^U)XF%O`AFYFLCuBFz@0sS`%yPqpDY2A*03%whc8~t=B)LB^ zDt6yx+gDJGfB#NSR-qaxMYxUTtlogrNWyj0HMOyJ&Pq!|`Jq)k+cY^~;$WpLfe%() zIz>guO9XppG4~gR==RiUy?c(dLS!_Ge~P#NQf}SJ0q14FXie_epf9{d zQu4Pu^W2^kXa2^gfN1)nZ1!++Uwk2o%Eq;QXbQ5=?Q`Jmf=V)Z~x)0+<5< z@~NM2pc;~Eqt!F$Fy4L>^!_#$+_ur@rpT+UXUNRV{P~ou@a=Eb3SgQK3@rVte0|b) zUfIf2(lhQ&w2dBdq?We$YKK&ZA3BuBm>8Xc1zIq9whEOzXx-@SX~Z{c_dH)cL}?`2 z?8w6KmYqRtWi}^>lfgMYU28C6w34(onJXps=jLOf#XKD(!-QbfnsiD{2gKqwgvm(H z9E!l|DAYk?;B7%n;%Y1RZ@afly%IZ8%;sQRfS+x1UU!7+125JKa2LtRF*=CwI(|*k zqoHTmJgRp)k5YRrG$z2(*-W<3&uZPio=_0LRQMwnD)F`_@rn8sZB87U3Yax z^>wV2*nYXm@9}~ks1Z4w*6;9To6G0a2RSf4&Ngm7ObNc7fP!bg`PwpSFlCF!oqs_* zKRYfNKSY(!l?3@cj}MMo_IJMnZtUMhH@CM+KY)8{R*RihgVRr=S?5A2Oia-00E(c; z%^t3Dlh4ZP;(OH4@-duN3<|7F!JF;&1}m9|xCz$7h4N#$^3Y2~T(Q^qy; zak#o~^8>}s{A0uaGtd9&9M-IMyjH)net?H(4A0V~Zr$ zo6=gV|M+;rjnhi(!@Z53P7&~-9iJb}V`$u~BoEIBBVjLiJ9D??12_m(!~6iUTF=2lp$ z@$)D5%Wq&I(DR(tv(n~BE_nlxC#my%c6W9Xfn@|IXV|9qMu#geL0{$pUMI{M&c!+SB__3nR#oU~U=DUlNQwONVZy!64`Qs`1wbj0Lp2PQfgxT+5 z&S1}!U-({V;P2?dNU{n<%j=WfLrP3Mt$8Vbw|0y1brNFfT&cu}QiFg_3$(}U#{+hc zRk^jKyyTn0=k=%inS+ytj824qzBU~*vuCr<5ZzWl@1ID6BfDhzxtnV7pAPi_ z+6$LPBbk~?d(kyyg|(F<&yOzy*FYETh4ejVS&22y^2CBOK&9XusFVL|uHsTjoplg) ziWCJOwsyppJPYwe2}Y|7Ygc&sGxqjj)k!_TpjzD;XwK#nBuOoB=l3HhY&}Klx^T4>1<(rF?Yszs&1~^WAkmM)mrErz5J)&M__nzoQvyY5L=Z& z>%nM2NCMba{m0ZzP+F%b*&dqhPsjTQ#_rvpvsuxLyGarM zFc~TW9~V{1;Ua~SGN9VE=`lU#L5GWNO}lg6%2q=IyCO=NHV<9S)wQ(`lf8}rs|7J1 z>O8TJI)wbmZbSd30W95ox~8sb(mS->Gg|PS;BI@q9{t-_Z_2qwu+Ao1^+KH%k3?0v z%?{t&qo>jBtKMngm5Kg3Y>)%(r$xbzg69@8bCy5x=+9@0IVUt|n83ubuAU zz8}wNw$&S?ypJyKaf)<={mVx#fFaezWp5;}i#d5ZBn(GK1Ga#&LQ&3pG3 zvp#K3>Lq;a-Su6wW%V`;w(_+5e6z%5R0G|gJin`-c6LNSt6kyWSOeynAR#vvD zwH4?TtX!}HUeo!`ne)GWzx>hz7w+SIODyJnhv*L${X&Pt+Fn?`e;v#KHV!ye|5z^x zj*hN3dS52~qh>@7--_Fw)OnTFnFwZI4RDG?$Q40xt*`EJ>?yrcZ`#>)=qAk z_Q@2go0;NswF#O8oVI>1$A^7=q!Ve?H8i!)ySKGWdR?6C>^H}yc@2f2Gg$OT?{I;$&bLkSrmbn-)&6@dgxov z0WNwyeuVKed|r2!fW-zVLA)m(^aip=T?&obvPqFrmvZm8U4xl@`>{(~dK4K8dyDrSH*3xHbF?=t_ewOjgMQI%9wi zggU()lnZ`UX$Mn7wIEqzwa*R|<5 zu8ggd_H%urbHobaV!Sk*#T+eb+b(dhI!N5Cf3V69x#MkNwD(rmm)Y6aAWOMe?Me+gW&~!e>oTgS&I@5PhM4n! zLTxuMo*cb&x0A^~I=FzNt!%KkHcFwCh<di}F|-F8aOrr(W@#^2$%mGh*eEBbqE^>B7|kV|RbH2m=J)noq@>`jA~xig zFx_2RSSDQ7mH;2Vvhq=d{SB5gIw&U_ddk^dX#_6q3mid;;&JrKHPvpUIWN%s2fv#ZNcnrAE-cDmhH zKtwW|JIil>`2KnfzU~WDAOw#q+5Jb3>{AR$2^AG!po2MTcYEjIp@zF3G3xO92SM_X zN}m=GfaF!#s$uA?g1ulIepONA1oRhWWZ?3?wJa^B_TlAd@1d$Q=xod``rZs41NkaB z?b~B?3#OcQsP#NQvUj850gd*d4;{BMb4=^BS`NHF#*sGvhX3%y3hov+1am{zgK>m&fz7nu4+;)x~rL`6h|e$K!EmOh|}i&#Wd z6ex-g%z}l5eGap4*L32!H+^`A#R|T5=LUD_>AmG~MpL9~$; z=AuFFYD-*FDVe^G@Ls8X6`Zf0FWr-#UwZ^+-6ag)5)0Gpw+dYK+=LmDsD~*J)+a=$ za(Wy}>R1H%-|xbS{oamdlfzMnkdWd+LoaY~bA`(7wz@&p)r{o-)Nc|8>oy8rAE>4G zGMC#z0FyCuc4tIUF_Bz*n&az7&KE&@X1*X8iHlg<%cICB{^iA$!;2&Uhm|6)E2PT+p3ru=GOc)de9ZmB~&dFNUG0T|iE9>hUn{K4yRp%&iVXjx*Wbb)8*yau+F?uQ%bn| zWq~XQ!agX5*FquZhu~SWS>=W~kbK8R!(pG9JN>tB+c-yE`Y8B>3L5DP8LWa`LC*Ro zY3!u-bH6eusSGr$T>ds3t0VJ^2{;(uswa6ZwK~b&GGuX>k+L{F7w6|mzgtx3Q-9gL zK-jbrUK+WOa?mU!?+5mC#;sbj&x7LP_G=BUK#m1iNhF(j44-?qGb6;5wDN=g#|Jw9 z&n#WrT&pC2;ads4r;cYz_|I3N^yT8zB6kdytwd)!T8DXjtp@p5u9a`brpmjaU0Eoj zDRrw`V?HV_vKWEx%ZOQ?|H}}NsR9_CJ3Z=^&`8_mF#JL#b%vokJ4RnX0E~LZITwr< zFLt=OYgvjE*r5i%bO%#(32a0d?;F~LFV>T2nFf7e3D+CIf)$CfXv0SyGtkfnm_*x{ zpIw7^OXW-MA0gir{~qyS#Rjs%elhYO=t0Ox@-E@hng3Ck+VCYev+Bpwj&4Y-aMJnf zVDQih3&aze0l1Y0jwLz=(IkwaG+r2zI-4%{Ha_8Wq~!5)349%GD1_Dz9Z|4+Pp2yx z9rNQlyl$g;^Mcpl=W^ZvYacGQb!8&f3Hi{7N%!c{dS5(*92gQz?%!(TPuk=k?HF#= zHWme;c_Xk$)nxw`;kI~}&K(3}ZJ29i%q=X|cvderL7kq_76t|=xGPYryHhs<`AR$h zt|qAkkrygwwP>M^PE1YQwmDFU_3tRZI|5&+q)0uc*qc&%dO8HZkgUMl05P+ETND{o zi1-oNtj(tomn6hlOP{E#i0A6WNamW1-2w3%{6giR2^$OspJ9?$wRW#M^CB z66EFijWt~F0rzQHS-Xv<6)X087nd5nM(u)x&@+TCult*U@W(CxPZVfqaRuVTVX<>- zYa4^>h4G0)rc}%{8|}s^qsC^A#cJ&bH6zEb6=VwFH0Y=R-Nr=E_8gd-`MmF*-d3EC zkB`efcfNN1+eP8~<4uL8ki(ybg^vxN-f1?$$&&Xct3^Ydy(~pFvs58xt&zH+>TJO( zejhz~03P-+u!L*}KtfF8pXw+l#fyT65Jp4_`kt{%_RkI$8X|@&+_-ze#@@%+XthF5 zs#7E}7<4;%IGAb}jsmIbq@PMZg~#N3@}~|SMz27xg^z)PRXVMtY_~+qt6@m^0B<@y zA;ID9NNM|6LEyQlwie~wZYT;9NG~ho@7HU z)7NNXXlWx~We9r?S@&Xhy;1+Cw5ZKt?ctB7XFDaOc%`~0;4d*Y*RE1N`FI+`9;F9u z;$UHgMLa)0>v#I$+VJrlfGumNKg?})J$CN)qs2-m*D+scIw|X^?T;7B+}!Fz%oucd z$Wi?Azga=6kLflz%JA^=T3lL+9@+(3WC7;Z{{B8R49xCze<&hA-IJs-u$y1oyr}mX zn|vB=`GbGsoHtQqtaw)}lg7!(1%3Xd+vojWnU#&tLc{*&O=DhVY6ajN*6a4UAN#is_Lc4{+G22DI6Q%r8zcUE=RmgjxkXUm-JnZHx=0h%rw zoTQYb9300fV}?H(`q1aCnt4GsKE>irKyHj&v9wgrVsFk( zxqtkPm4tOCS_@ST3XweDtvU{gH==mRQgJB-OY8#S;{3wVZPMYCXH#d&Z9`Z~R(+Z3 zGRIFy^W~?F`7~Uz7OK?2Huz_*T=;UGhT<8ro;fjd`zNw+apBzMuo)|1)gS+FQnK@(&bpiz3qCNOTv1&&Q+ZaqQ%Ojx>@wK?0(wx9b7m8_cU z@1`6bG-z>;&l@9ZkRKXqDqwee8BSV8=gSzfZE>hcCi(9S*v6p}wj+s=5kqxF)iyQ; zm;Dnp6yp7DrSiX)YB5sRDt61Xns^+9g&~GHMk0y!ZlK(_7gGQ0(NvYT;w1`jahC7j zb=9;=)sKTA+>K<<&(44hi_gPZ#)^%q^e*86^R*X|ocimK;W zrJitK0cj`TG*2k1k916c>M{I0S&h2LZAo7S2@8V*PoU^no-{9Yrn7oFz^fb`J?a(u z#OJF0PH=D&m2`i~1;D`sonPM8tL^~y1Ur%$`ps=r?mnM{z*diI4||VGmH!vKg(|Xt zzpHKl{1#}#ciS5{J_G~= zfC5#CTFOL8p`QV%vlL&?0qqyKFyGSOPGxfspo_G&bBF8(i6l@a$n23yVmo2R0}Dln ztDV`cktOfbmXjL<3`Jg%uOT}Hj)Kged%ocs%-ULNngw$>3Prh_C)lVsL`s@UX5ye` zgm&(BK>hdaYTX*^f=4c2vUYYNf`vZ6d$_4Ax1;e@d#)&gSbhguZy+Hd4U52mejHxN z%gqT+ZGt(rBv9h)QM6F*X+_1jOqB3HME$*sRotK=aHI*$%)P==Q|TOanLpqV<~rKi zQCQ&b0H&muA84YjQlycVmcH2PndV|I`pcgo5BViUvBZegh@%u;|!~`hQmz*ti8;kG6MG zL?zI6cf-A4*Rob~`8{jqlv@3H|4m^rUlIm_>*)~&i-Lg0f(;Pw*?K!75F##Ho>B$L z9O#AHEq`$q8`!CLnz_y zZ#qk6@ri(o^GQz}@_qm|FJN;z)xdN)54>F#=I0H+5CL7st4EiY(?G&(Z0z{#Y~GR` zD1i|c76x|LWK=+X(`fzh@UWmb+Ug2Fd^QEx@f0=u71VY*v4a#o({hEi*oYL`q)Qw^ zO0cg`>smIg`jKiKf`^r|i33>(QYT$%*kQ~c%Z1Tp+6=eAJX!nJzgjnYjLfo%D1=A@ z0jVyNlq~F>TNu)GY2VqFNM}fQ-Gplw`hH6az#c`;22Dkdcw=>WQwdXRax|GOh;;Uj z;oVM%qkM-2d)c!faQp$~)k|FPoujQJE6Rh%yicaPAa6-wy2dhO!{VlX1@&W3ifY?Iy)rEBWy$`Kg{Kr3 zXw0s!(=F!tH;yDQA&j79)tVtE-!Qwl`gTm67aRXK^0le?7i%8jbNriXIea#E6;CzV zg$q>&87`jr;XP^6l*0-H-&6`0wZAeF!(XYBZ8~U-&R(I?D=#=ipX8u~21OkuOTA zjF#(NnQvyH;inj0`9x9ljmYnq((_DTm7-LweuSU7MHBgcMaX3u2m`O+#)0trGhdlV zU4>Z8OvaF58uWKhJVv8yEP<^i9lF$5?p#fLKdE?v!_Z(-ky7n3A7^1)S>3?YWm>@RX`%V`?1d%Mmdce` zo&VjYF2<~r>Z}$jG-~y^V`rt>V3&vk6b(WIPx8uNn+xMb=7rEgXp_5qs!khzUX_Hpo8&L2HbvO8gM@+mmKkxEz zw&HraNJ&jCAtnYu5efLcFvzcgl7wDV!}OFCsMYO%|89X*Pelb?%pY)Y@PdK@Komtr zL{uqP%}2ySz5!AE(SWgWqCib^^8<4W@g_R>;D%YN zgNSSxDf}?iyLXR%AvoFKzJxd&YK2~92Cr!3fTqI2Sf5rz1UCW-V~G5Mx)~TNA+~RV zI7BA!NDs)}H(7qTC&~@n;4~eF(Zc>hKBk?jvLgv>z0wRpYdf-F@$2X`cxTT#S$eFz z;b@8U$2^FK71rw9+(Lu3-h%K|BOZ7<6vBw-sG zTj7D+nh^SiE0%axx^?Y2ky8U zbr>bT_R{wDHo)Sj)d%@~>OTx2YBV-Dv9hw-t+zQoUgXH6P4oNy3Z^+iir~WujdXVI z_&~<{1;3?1Di+Sq&**yl;tJHbWM#juu%u_^i%MQE4jS@cJmHKqaPm4rip?KqewvKK z7mlT{;(o@e^QcXx>ZGuH!8&s9{L<^UMT7hJm4<3J2+Am3=Sn+H(O&J2ABV9#x(OQ4 zq?e8}`o7w6i)0kDtuvXkdvoGV`wOO6KQF`6e&u&DeYfV#ws}cpj(cRjCGBk+0&3B*nt2R^wrAjZ5Xch{BU9ur| zTo0998&!G_ReB2{d&(K|QtxbeKmHcnUJHBA@6q-C$4C$pTqc0uVf?T<-Zh(OY#{z> zu#Gvn5iQbJO^>Saq2kx@tVT^)vY+{uVw7e^Wg1)Fs;x=c6wGGSCA5hK|AY1U5b`A= zSnM{07pgr-URdw{39=I*#|U=cM+g-oOxL@rEB05PPXl7i zJ57Gj?NfkXrAP)L1tdAZgdmmKcr?O;7<2SuZD(R0zQiHLfZ6l6JzfntchpUmIW>H} zd%|kW?fOgm4Gur%EW+h&2Qwh^PfeP1#Y7a6y04yfj(`5v(I~2ZpyAAtR9GxK@<@|3 z@Mk)d!~E3#X{Lj{Tn*>b{`GUnW0Io?$9dbz&it1(5RVqz7&T=XrtPI})Mv3}mnPNuv!ud)y8iTA^=@C$)Mw4#TPY;0sD#|DaIx`6Ge=mp1K=fw+ z$l-eeTJq4OBm}ohc`agl9<#jlE$A)NfxOjXt0EmbQ&R{xy-FxazJI&Ha2^NjL-EcF zL==nB{-AdkfQa(wO{Yp7e0vJ|QL{KPpQ6QSN~QDGB82wg^Q=wtpZE=gjxN!SM{P7c zx}B4RaxfiXF4hf;ye4eE6~MN=FeQOO8*hIY23iG6BubjLEDx8Ic;XEkH5SJKCNQF$kyXctrS6{Ptfs9LK-p{aKv=ToQ3ydM0r{^hLJA`X zhyUa09lPuNzW43ewv#4ltj5`K8Z>Co*lcV!R%6??oyN9p+qVAK=li?I{RZ}fJ;pWG zT63P~aj;O)5m5RzlIzh-6DXn*-8`;E+MOPUttA($m2H%#{_*6hm>2num08%whO@$> zS96@enTOLa>hhNrX+(mlb;5)1`bW!6UqlqsNzvhJrw5Q2X?p=ej31|V{QR2du1<$oFJAtt_SMAKCNT{ysr!lwUSM_wU1 zf!XQ&S3-E3-ZaNFC1892CzUskgN+})3C$G-v3D2P8B=AbFr|JRJzkE>gwJpfVgNvh zr>$=Oun1#}?0>YOT88!2o;YKeFU7%>sire9m*1FX4y_>DVB)U0or zwMi&rv%Z2)_Ahz0v8+EmzecQyC=^Pt9D`Ez6fE}OprHc)Kq2T0g%Czm>OZ|A)W%Q6 zj_c_q%^^@##Gn|6VJ*q{x${I%7jvc7yXC>yEJ^>G@RpgbX_WClh^hqFu)dwdzL?sl zr!5-eN-dICRlxNfGP6U!nMDfhiDtj%$Eb#8JIiLh<$*1_wh-QRlB0R2hxWQ{+4k5{ z@0#(a-lJEYu-ta?`6ym{hJ-I~nYZ|2@p(bnO*>(mA?K~|tigS^MGmhwXPSu<2G5}= z7iZ=gq7YKp2AA_|%q%mGCpQYO(!=4!-?3S;Ckv-u^6pluAokMHuM2bo-6>DypQ2KG zEweMSPxx_*w(KV~BI)%B|Md3efPMf^bj#;m_E%LTvqt_bhK-I_lORa6RRtrLm+Ni$ zeg1y~8seK&N&s-=9|!fw)$DB&%TiTmY)FS(cGtJSRo4xP_tSXc{-ItF?{qjiVnZoP zhf_|6Ekbu1S&JoNLj}pmQAr!`$PGpakp-nXpkv)sY2a+R!Q;B<^8G-S4Boz3D{mSs z8z2J#xJ@y1bo4I#u9qo)3;?OI*5OG=3GM;LU~s+D4?KBTY%DA^TO5ypw+oGVOK)BQv-*z&ig)z ze#Jrqs)C=B+}hOk?B<@ZjLY%|uZx>3-+47;aN0zcEHI?{qvheJQDJ3nzT9YLad$D) zmTnRz@N)K^^-0Cb{T6lkzO5?w@jUy=BUeYFE7duru?Uc12zRhwK04njD@xFV={t{> zS)=+lK6KC(YREX^=YylBnTqEZXCvQ9KQ}*%4jYl3h>8;qY%Zc9w`a$0Jw zCAKCelPX-V-tg@eOAFh3ws|4>6Palzn2RgRL5?g6w5pEv4W!|6c%;N(VIk|pI2SeM zPA|u7dJw8i+9;^Vw=0e7i>ne zfl0$A=pY(3nQfe?^lIqFK*RVLWX8EfK$Z}jI%TivQ*Q*shf6b?WlS9Ml#FG3A~jV_#yCmY44!kstt_{f_+kCkv;F;DQYAID z=~b?BrP8u8dbUfQq!H>UV(B(-=HBA@-&&m+k9Ye8bxGLdF_(?w#Ec0w3a!k#|00m| z9eo7ce$9&#J8=@1wt``T?Q2vx8yU$kshZEhWQR8MeDl@iT^}9ohH6#n9w9kDtESZ% z{nWD4_A+WJE0`ERt;0N9Bvw|TRpb2bKpzQ%##lCQ%1PTmkTE=L z)lp&qf($yHm7mdF_Aja=8$|ofebIt zw0V^k1ovRYdfN5LBPrC*=0DvQ8LGLJeE6)%SdKCCR=phgOGqCNnJ(ov9)e8+>hzRb z(kCUv(;wi?0i=I9oj53<3QD?QpSPI7;bxCi1}1-}fD5B?l6H>7RQ5YIGc|NG5P4aydd2IE+>m$^AYl*e33ax&NsZ1)yrPQhPJQrlR0UERx#e|%Y#@rf9c zN9PwI%Y;0<0+PBi4ODs&VUmL`uh8AAWn4CGkEff?oK0C$Qv5^?w)GCKKkE8t5lIx65^w8q` z3h|xWlh3N!;>bntxw^8r`R(^|Y689a=?KL4Mh>Sr>_ps;gGX-~+LA(jw0Ayn^Sqjx ztL2v}fo`-Zj-~ri-H*}R!Khlc3mc6Z70?%yEBG~H5_|%5e3z%GuD#@eY#VFqw>|&O z6esfnrG=TfHanoDs&3(c$WHh7W>)UQ^-=aa)f1`1@Jj+{e9VRC-qfn>4 zM2PQse=>ho4h#0~P&fN+Iz~rF2Us|lEm{#}p;Mr{v28zgHx_2-Xo|P2istox+io=; zknnr=)IHb-5FQYgMvs}n6&nJFOxim2j_ML}pL_Aa5k4Xo?z7wZ@82mh6cln^cgTUg zfGiP@j)GFnpL6l)C09|~t}`{cm72Y@#S4mAmT>#x?@Y^&Hdx>MOO-qo8uEXcsj5!i z-C25S-`>T;xuyO#w;?4ulZYhzsS!5sGctUB3#mLu*DjJ{z;W>!ww^x?S3FUFxmKxa ze(q7lb1rR1F5A~9E}d&>U(lyFliQW!8k_N%ytA5QcG%MEy8&*zcF+WGldI+V^PdUO zo5!k5XWa~@6*%2rYlsT9F5oY=MWhURM5~+LNyqf3^-7^7FPS}F%L@9efbu#$TCF|p zPQdV!Uys!!B@iPFJl12acax(of8P z1CM|*W#R2AK@2Z}rYGQo_8?$rxdO`#k)xq%KW%m;ixU1V4YzeS{UG%!Y^5i|!5ePt z#^i!yl8%pcdqM4^Qy|)>J;&wpAropb5Q@evpV)%0=A!D0%;*14JE)TE0Ze_~LX_a` zD3@s^ufjnAHOqRCdfCuroN*b9c}0;+M(mO=uchLFbP}+mfo_OYuQx^RI^p$3QBC}W zW}_Cxu6#Tjzj2Qok(LTyM~OJeG~!f#Pw{RG1XQ3?chmI1Vg$ch66p!xwNR^(S-+-J z`+V{6js+`k7v=1cD=LEB8YkMaXuw?cdVrB{r2^F&^{cUuDkr*Fnmzk>fqg znjClZzJ|IarYr&7n>Ow-YAF^t{-5g`noZ$y4`Rei9MoCW2n)!WtARl#$7G~NFkPkn zpy$!HulNYJm6r-_I%;5aNB z86o|B7!Y^{5$$%(x9HxQBuc4MW7#ZT(5PMxK#cDnAO1pJGPo;;vbH;3ypDN49kh2_os_W1<3jG zA~h7)@}e+l*4_aVA-PO}OHvYACi+9ND z)ph=JjSP(MH7O6itM_gdQhyCx&nL4ef}z5KruzU9`MD`Jh)$j}jx1?5rh@^&S^hVe zgv)L2)RSQ0o~0%aE!C4CW2*nS4W?9{wC7I%WhN;2f1ersl3|MEh_9nsJ}Wd=FSCom z41p5@2yM8W<7Pe1Cb;$bgC2TX-=ap+C!(0{CVq-(5tu;ht!IEyUE~V`Us$sc22Dgb zWwgQQ9!=m_psd{AAr#YE(3wg_V&swt3K>2-;z20})8aG7#N3 ziD#X@!x~Sljh|`ua6bH?=bLFJI2-@py*2LUz@7pReCWo-dc4!0%xHs45o>CjfXHux z>ZshW`-o-gz11l6DaVED7|B4$4T;I``%l7nV*74x`lWn7ZL6a5BKFH{HpI7JTnsq&<}-LCo5PXI*vncQ|D4_%ONN`fr)$z&F0CJL zNr*`y+@|S874!T7$6H9~>f=uTXa=v#@6FNDs&eJAAJ!S2ErZ@kuC6C5C5W)(2Jy48 zd+#CgdFvE}N!E*F$wjb5iQWyarupmMiwn1^a{TnJ54XDQi_<{oo}u7L4Ql@A=*Rcx zfv=HBdj z*d0_HEG)i%-dszYO%){qboP@#$e^&$r09Th`dZSr)etFwieaZalW`PRTH+PD?Al-V zqt4NQ0az`C?(CG|GDAT_gwWH8mPSU=ib3$Rhn8o|5`bFxv$WuIQEn`i-VNHUlhUl#ikap4#kS|?NLVjkZks9&y zWq1XmD2va&xqT>Na^_rfhsCGFZV5I?M&e0UFEbn;A3k~ZUS7#Sv^pz(U1EG>vmO}i zM|pf)9#1^JhQB+MYKF-BdY)!L=}WBs*ue0AmtApSXbF&{0s~>XQZMmLKi&KUf*$MH z>$f*8V!OmG!x(=AM7&^=mUW**{}U{vtUUhGK-l9F$lsF1Kevqg&r`yBA?_oQsgrRd>e6^VN%;T>2rmdae>`FD z$$$U7n-Q+5l2)11Y;YXPj6y|S{-CC-z7g+sCo*0pjze0eH~+Q&9Az1MYJD}q`6fWG zMslEVg5)RWn4hb;^{Yx2hs7c_k!-DAG*&=I2MLhyD}Fej+8Y6CTpzq|&gV$Y_QyAO zdvhlVWqy$UKJ15!L~+M>+3ZvQc^)a*2eKc zoBNk>#iO<53Ak&+wTY&=iQs<#K4=_9$e@@1wZ^` zdr!z6V8()9dUhx2DvA3eTG-jy15zKjK6fR8FrsASCY&4{=NA`-3uY|#@r7KsYruBqVNCR%Xd2S%}PFR9$;{~+xVj+f{! z5>ETm7CM@$?d@hDE7O?)_lZ+kXSD|-nw#rS4031a&d*a_TMWc=ijTist>3#xNo=Fnka|3Ua}X~p zvP-gjl!>4DUWNTfmigJ+*$BVEB15*$YV~1lt!)v>SKR?#>z9Kw5Ekk=`NFzj4UdTO zv>f#rvR-6NdO@mIw_<3Yp11<4Dt)7p{y%Bm58&%2UHEN&PtVK@sw#s zlB9n8p#0^EjmduWUvbf2j>4?#XT6DHcBIKYLgpN5=?+KPKiv+SzyAsez0k@|acPNL zvaVxa;40VZprbw=Ze~l`3bi&PTlgE_lc{~)Q5i<+#%80VE{SV79XBC_=&@`p!25*g z>0H2a##*9A6=wzP#oXLd5AkZbURfO6_C=@&8s|-yg!aidvdP3w?lVS32GQl57v2; ztf4LM-S5a?vE?n;^9!>!nq6G}e6Q#>Rwyo}(`j|I)9uS_Ox3VWNPc?%5`)hF{rhel zCMu~hHA%1_9=G~0H?>K?Is$z;^tKSr=G|UQ7AZS`z;y!n~rsKUeC8m?Y5Qm z<;OSm4q2P-s?N=cyV*nPz(G|;jT>M{NG{0RTGvt87Qp26=e~4ob(M>XsjbIYRthwwZZcI$aS5@Yz;@R+HBRdHEB~nff{;MsWk2orbaMk& zQ#OReIYPouS?;^Q{D9sMUWi%}zF$M}KzT@&S$7o^kiC9_XNWkFfgZ9x9&9c*+IXhs zogNpQg663*Q$?sf0D%2inoBrAZyjuuPCE_MGlOgVs`?^1eww6UqVt(;sBF%kYf7%K z&!!q01Qjq!qq%t$ioar2D{hLbZ1U+Zr!YMj_0cv2g#fskIR2e9r^852Krj5YKCl11 z`8d#g^~w62>&q9<`<_JDLZ4f`g{_Uc>-c|&-qbfANr-GzH;uPnMn1y6pV{1g)W2El zzKZ*4QJSm#Sb+)>osyGur#}FN8m)iL`0A2|a2X1tDP#VvZ7Z|H(Q-63qY6DoNC<3g zC>95Y8{bd6Y*BKb^-)#kO{5+K8iNhR5v=~9!RWYeZXs=ALC-r?+|W>0*Pc^T*ibRe z9|smOZ5mJrtZO1+U|=3D)_K2uyB>Hk3mTU_3|KioEg%cp7=QV|v=Ju99cr#Dh_UI+)b$z#_ zq$;J{cIOt;u12N^t7!M4T7ckrY=+9sxS2pLcl6Xw@FIa)evMdKR?wn8Y#96sT`{NUth!?PF%N890fVIQG4RGXnA$dq z4q)!kuxGix3c;jqZ+Z>CLq()&)x)9FNi5fBDQD>fE8ps?*##VS>UaG~JnGAUo#Op1 z%UcD3Z~O#X{1N$dLE>VWcW%*}`=VY*#g1~bmAle1<9qijb_eY?m1t6{7-)@-|e?|IITdp2(u(S8jk9E46 zG?Jlh7;^t5(V3)#dVL1#KJ4_c1D&%Ubr+7W)|+dK%G7C|g8xdZ zY5V55?ysB!uJ_xpo`i{n_IXQz^np0wlDdNQ27CW#{k*l&JV~92jY{Gh#f^|54qtOQ zJxgdS2lhF8xMGt!4=xXt+RaoTRw_V->E!g=Qp-rB$G1q1^z#h})6vrIe|vW8AuG1J zgpkbUAxc{|p7ZU|Zno`Ux$Lh2)U4X;;Jk03Ro|&buL?S@dBZCnC`W1zPqj6WEiYqZm6$Kgj8ubzk3P~Ouru{OIfHP6MC@bM=mwjzVKI=|D>)RZn{WV|XZ z0iN;HIaSQ8tg+usZsOt3ox#YA^CCqlVKldpeA9$@NQoWIn9NKOG80RZWne)1Yo;o6 z^FFh#{esr&6&D!!-+AuDiHY!+XA~k5QA(22(C=OD70iQicrf8oFePbrk5gIVUP&Nn zM7!D%!lpQPEOO?_wA9lrZbK-!8N|_Gnq_*Z(f--m6pH<#SU+Q!LPm9NRmkgO*47zd zu;&$z8@IIkLCLxY-%6V53;(h$jPQ$it=7LbQf4h5& zi!G0Cgl;2h-%Rus#p z#{Gidw8Ihu;^IwK%b^&eR`3XLP{a9F9kyp^J>Pq!LPLLo-b=rZ63`zhm4%s^oJi68 zG)-jua7eZ?0q#0kZsyKLd_$wSe@l|lD>NHt%BNf_msq&C|5hh@HJ9h*jame4GJ8Mj zY+cA#k$r9t+hI}D?F}@P@e-Uwe^d!P@4`%uyQ7{7I$ZAntvg}xZsUq?%!lerk$OS> z)ABl)JEUu~^RIDP9}Fz)j{Sl6DX15l&2|kfEV|4I`6L4N?>qCkeySZh;IoQ5`MrY% zhC7?D{Whm`=2G^$nY>B<}2JP^aDj@3gxF#^?cH3PxyB@`TM$gfAu6L|wYj-Y+x|F}nmdR~%+LZ;0FDo^1LA$8S zRu8L-Hu*(`^NFhBGn~~Wg{7hVy#7=#Zic-syNqtRR+^1+kurVf5t18OrcFyx#4=2- z@tRkA{oP0JR1w=R1s0?opVKOnR=`U3_wTA)!-w#2BpxEpIS>*)LUW*;#h5f6)cG?Y z3se#+7X)(DOs^mOt>XlBTsMHA=|~NW_4(zVaCHSFPZWe&5Z_j+mMr~$mLymi3^=}; znt=P}TYQKd=eEXKcE4Ufuh;%P+eETCxImMg3pPgP$2ookn~C+sU$*5rPcv(3?POr& zY{ipnq@d{fVMB+P66q}Ohxu+u$t!xns_fd@SmSoap=Ia_k?*P;tLXJa9N?~q14A?#>%Heb`B%(uD8l2`r8_|Z zU0r&t8br-ot&C z^JSq`0=j&x>@9{tpL=s-b9d!~sZM%`aKG16@3Ft`$Iq&Kxjm`i*Wbpg13Yzxxw#TS z63$Ogp@*VV|Ka$uGwNHrP#mq6YnS6tl53Y;prNo2_brS<^MYbCe+!PZ*`12oBakR! zpk9WBTiaMZJgm{BWS(1EYd`E81Pv2ZFE{12h_N6FXnGC~P&rG8pG(VtU5jMqQW}{* z@9q7|dTbo-_7X1BZhtCE68j5k9XD+fbWJ8k?*J%TiyftF`lnhtfDPgb|WHvnMm zoR}mKRlMx0f$CMm9UDr!zOIpx`AEpbLuG|#TUr_@m;8}~v%Zj$l#!OEE#8YsfOVu$ zVH2S6b#=UR%r|Uobg-rv=;_e_k0@8xf8ZMAtgxvqpp}psGC{QM^A*~=tyIbC8NWou z!APDn6{Qfdu#T6b-APgM;n+#Rsxk%#HHIL}oie&ofXL@T`TWGtDnX=eZD`20bO~Tf z)dJLubein<-^1ODKZ8)H1U=I=V|CO2eP)a2$jI>~V0l+Jwa=Q&8n^a?7B)}Y%^-h> zsL9KlxWoRtkRbKUT_g~qv(|3bXH)awvgvd@SqmGS^ml<;8GnF%B)I^x?=iyh_ik45 z)w;^c&v$owgQTA|+1YU2Jc{=qeY6F#O|RIlOKsr|nDeU+w`+(W5TLRI=_JMvdj&bw z$3WyXI{LC0$ZJ>>#^`|mR?li)#gx7QK2&a+;;5#W5PB3X zZm1PKhgB3x$pi{6c#F^Z$$!|S6t<<>cXm=n_p_a zEys3bdY#M=`;8kZ(e9s*|8&a`A5Gk~zy|%5X-`YYAOr*Zypt3aRx%r37{#qBQKD-Q z-)~2=beCg!qPxxDi|=<{WpfEIbT|SC8ruoT;+aDt$b5x+2b9*6eZXq?{F)BQyqsnf8d*tWlVxEcBT+rS#t8C>a6B@zuD{vfL$~$yvn7~cf-nrA!eq;$iB?EE&4>TP#E}LsSE-nbh=`O~oJ5lXBYIADPKpAFD56tS z>!KZw)!%io|Avk>KObCxu*rM7XEvd|C%zx>Zj(c48%LUA;a!-6@#!1%W@6;ZGYH&GIkwtB76@<>7% zDc?|!q5Kq3*szZGvbRSdBO}1sOsppRyb$@hT;jQ2Sz<=$NF7Nu;r$>}65ajQY41egXcE%=9jBnwzxj@Pr3-)Cw?RW=z0M5Zq$cI!i!T9LISM@ zgZq|-G$D*aD&s2cX0MYyv(|C1)0KOG?bGeLYiKYv@5nya9}pyqbhqB>bXq4TxK3Q- zvV4=UMR;C83=nGohKJyv&%9h*=;o+QU(T-Qt*z=T@2$r3jWRx!$NPJ&77r$tsm;Mb z#QE~Z#!M9Y-4eG97P$K+nf7_VnHqIu4aaHRS-E`xYO*k^WaP2d;bgI3zyKi0_g^nR z_4h+Ls1+xZ8J*u3as8P72l}TFRErhTW?c2vtKq3qaPSHk7!tA2EY@9sZ#467F|&X2 zl}z~^QwTrv-S4fK#eE6n_9IzxF+%I2ockMBGAi2W0#yusndFaPf!Hj?JutdD#BZ&J znkQ+Gf#OPSbP1E==SWw8B3P&0LtSb||9Z?4z(CzgbA60@zuD+|cH}qw$5yrm6wVwL zDu5?TUPT2Rr$yq+A^`t9D0B{I@AA99zaJlunCI9Bw6Ms?$UxP`gG#t;ey66s9!mj_ zhzI~zZMoDafR}MvpzVG8*=kkDEb9S zq0?fEKJA~P#t<110ez)hs{Dfo&u^{SAHQo;ycHc!Zpv)l0DXswECMY;ytmg0H&-i% zyz#Kw+^9BzKCyv)dQn$xijd(g_zRr8~fyW>p zN^Y*ue|-laQet))x`dmx4|=#BC)fxfKq^N^PcLRrqG6&^e7vC62Wh56Gw)MJmdNn< z=bL;W(w(ypBbq8}YT;nv9BYDUVkG%K*YpZ81QDPtEA17_b?k2?EO; zwZN)UnjmII(f|0sQR?5gAW;(3`A6}+mxgu@1X7KsNx{#D;BYWDCy2VCb^gJmk(UXE z#+RI)@r}oF76V-xtH8j+)rSrY4o&+vef|BN%-EPnUNmjDn8N27h|Ob)zJc{Ya>=r0 zTq<9quDPKO5{uaScU>I{Vgq!72r{Cn7TGq~I|h21Q62993{1HjXPr@zvPtmp-X6P2 z6dT(FBH98cj?F@7|2Hs`$oY<%wPeZENP+@R zh3~WOqX`w2WG~+WEtV2BaygqXxx0w6_PeTd zBCRsP$KQgY_Eq1GK_;3$`@Bph>_B3u#p&5Hqd^V4@YI@`nC52uj#Kz5WVc1Xu|>Zt zHBGNp=->KH_`*o#1kC{`UP6EL(Hd6(|F7DCK0~xAhj{x0&tvQVgjM-(wvrHeuvA{Y zsSz(uCsjGcuRW0WGDkgy5v40J8)+xaX@x0R=e7Zc=AA6=L#$Xfr2ILA+>6gA!AA8$ zXreHTt>g&9weUF|tv0%2LR{8LDGxB03epMi3a^!!olkok@5NWP-Nu`^`1mAfe7pk9 zC!^S*JpIkPhhg?%TOO|Yg5SPv$H@t_IML^omJSTAZW`6=r<+=wo7-IO&8)7juPiLh zuP*@cX}G1;)z$g=g4yGflatV}Fkgb#*H_;le*JdMjvwt2)nHhJF)0#FQ2F3xRi`K{}`K@8LZ|4N{dGu9}#WV80qX>Vwnt!UD} zK6^KiBV)oA=obKr&P6Pu0o@T9f|ZdeLEp0@3Zaw?o0l$43dBk%Uky zfeqL=6uB`O`gupvzw^a}geQWD9;TliOB0ctuCB*31$TFMy+Npl?F^=t5X2U7bR0C( zu&8yu4`3)t7{f14767RoQ1B{70$tnlX4m7??jPS7YQt0ziDd9jPQc*5e-QCH8`#NwNbCwTL$Lcjb3;4DEnK)i*@hhm_HIW`TQ(6VUl@b zBr_2!eP|4oU-h*V_Gk}?kiVys4#D5ent!Y9-HJhHA2ovczJ>Dq!ro=U0!3z%iejJ) z*V%`htoj7aRSgcs!e0Y2j&u&B8@b>6(j&38#q3O-!oF$+TA@NUgslRbV`UWg7co{U zYj7hj-#tG|Pk#IRD1$%m^OP?*lE z^LHCW3$r$7aySOOAVs&7G)_vBVw^)8WW01YLb2FXjU|dOD}MxM?-yo>cCUSVKvS@T zP5}R$nTd(ma+Uk3+qmTRFQ<5IcN|<|BDe|sEr^4_jhVdrN$x!`l2}z zqv@0^V(G%5!*rf+M|Y+!cm_`&T#Yh!7K;i0*Dd&u<_=a2W@+f|Ia=$W=aZWgaQ{;j zBS5{Z(ysn6(Bm!Co<@?lUM^Xt7KwPS{v2~)GF76IW1pDB(u-yazl7aRsAK7GarBVt zWGHkT8K7pfyu*q3S@e~3vL)ls?%Ut9a9+RVU&=~Er1)%e%e$?^tNARh6^|EY=isuT z5n+7p55RU}8wfTjD=7huTLn5(C<4Na)a2yUjEs!5w76l)S+-sB>pLKN-PZ>tGcY(9 zlSPIE^jc`TeIa4>Qb@JU8#HXzTkgwr-%kb_PJu=6M5ZJuA-;CIJ+|#1shgPKtM!O` zWN934C+=&sLsWTSW#jc6mStih2q>T0Lm z?!g{~MAP#VPEx#1t38KpknTeJD+#?yrl5OdbO9Nk$J3RG;H$csnc3%77iZP^Ai$?> zcik@AADz59xy5cCCw%)N;B{&#<`INeM}+;-aGI{7x+_m(U2Eb5!TAn(rf1vy zd7Xp<#pS&Kp+@9rXX@%`YFXP+(C)71s^^&NVq08M*4kd@Z=F|{D!;ld%aFNy)$?Of zSJUhqpDbpft25Z}$3e%9#Fm~c;Zahc6@<9FwVRNp`Web21gG^-QZ%^VEuJ5qsiVf* zj<8Msy&evshYQ{~Rb4{jp>R}Fx?uJ>emo3sR5{{UO0uUZ5nSlHm)NWal5*FSX#=e? zdq}>@%-UZ`3nLn77IP%dFgArZc1E^bDLmP!GL8#=7WU3=_Vjr)dc7!lJ_oXkNCfVv z(?5;2+v(=|1lvJmZAa-Ms7$e4)+*w{Bl+PnGt2O-51S~lV4~I%{7x~F^1t444|2j2 zG&a)Doe3G2AT0~rqy&0Z4?Q4Cqi^q^@7~=S4M(iIPb(W2f|k__=I1q>N!V-@tHr}u zhOy`I55Ns6&SoJzlxcXVYx3f@&nKFp03Tcz#LiK9mQ4kkq#kk#Rtx0-Ce)*(i)phF z;-7uXy#F;wtw&H(D6c@ z;Fqq&Dlqs0NVV;=gNrt!&euz|K|EE zE*4sP-2IQLnf3Mr_)^>3k%)iEp5x;cpXZ(LSvngXKuiNL0`s_07Ho-;w5{M0L&kz3 z8v**1-GK|NL`2#7nP{GSWu9~%s?mn6|oe@G#1n7VIRV&tIf`OGOYN2ybSCt`HKHn4`a?N9STnRSWO>EL zqrZv5;Dnaiz8L&C__4UoB#glgp<;1_AtZz|0eesf(a{l{c9lbHy2>#SN1q}R`6W}f z#2}d@)H?UKn<=-Pk6)ml=#-Bd@J&E`Mbuil_~UBafG00z){o9(^opM&1RspeLW*Qb z)omn%!xK%^Hjiftf^g$X*)I3-gg53~@_^gyp4^=j37{BIUZTL|BHaq~fKFv2gVl}* zlo0R_nh|b}{+fvP)ekE0kHE`yH#R@7HE0lxEVAd0S`wXp6rsa!AuTivQ@V$_c0IPw@Y^3Op! zy1GjY5-UIncP4JjVm@Rn{u-lMrAdyZdmPlEUNY5@0{*|R5@i_mPcu4*5)8Z&=rZtw zzILFjhHeYzCUM-?uccp1#y@VRSn*U{w3VK=FjWfDTXcYCZCfvnk4r98{k|g?A8g&i z89RK$Ni0rguI>ZN_T28uhUJKbz?;3>F^XR~UAaK4 zt&xG{+w!dhVEt)xIu-Z++&VgPm9*nI>duk|WaW7PUn^6#t=;RrrKzb&rQ**u9~X%A z1R$3HV{?er2$ZM*s7okGI20s0ru=(Zz!fU+ZCkJJf~Bk0;ZRPu)2pGH#T!Tm*3T|} zxoUSrXg;{vFMEAB_y0tRMh$xIjrt^uk#wTE9Z@E^NB&teZFe{`Nx??m`zYWR9ryb5 z-2K#7B$ovo!rD}-J*nbln}jvgf{)NQMnOp~H`|l~D8Nzj$JJG6c4_Tya8h6%@9unE z`^&aICxPv^%3^0%E6?jY1*@O)jTM>p%^vfm%EZLPQw)II-qonQ)tiQ#ZedW+)Y2nX z1->_7y~Axj6wnw0J?wOT7kFPHe&^cae`f#+2B>NIw|n}e5riB8^lJrrWqtit089cr ztGD*|^X5-ZPYBxDJ-e+`DsI5I@ zvw|#mo~hkR2; zd}Xf-N%EWBB%!Ua3Rr`!=}_~mhuwI4wJWO$(S<{7m-n+KTx~z{yFM}jpU4_*2J>3L zXUj3ThtHJ+$&{baK>~@lZ44AmP=dhi?0E#kY%=x&S}{33l4Cyj6OBFoq`bL5{tyXA zoO-?Hm|L7e)Ib-rX1+>yKvH=bBicy=fs^AlMOhY0ui%rUtXc*o$>`4#Vg+4aYX83k z<;$|FM^{fQVmo|-{$-1PP1P{>Du_;yDzZ;GQ;<{o5`Och_7j(O`euWutF!h0=Qe)R zlZ1eJ=f)~Rcq*7k6*s(-#M71GOhcEKJohaCP)2sAd^zwA@=F$z+Cm>b;w}RZpIvxkiMX!=k~tF2qJxASPYJw>MHu zKBRsO1)?!jwC-(40pyY46ywb#c?3NALPGEfcTGxXxYl=ecIr$fd&+=8A1Qw<#5j=h z0mfXP=F>Y8%RH`Yq)j%r13xD-`S!o)bhw&b=Q4LZ?EqOaE>x5U3S;+2aYpspu}$WG zwYfOoiTcZ4$iDBGtmEwzxA*7;Me2H$X0HyMV2fX+mRP&%5*VbRmuYjR+GDd=(4 zuNo%!aW?C&4v0Sr@k{G;KrY6|xsy$<)}UAqyyor8%PJ+h7*qg>g95w`cyXCE|B!uy zx66)Mw#Gj>UdF~?z#jE^TCCW7n~%lL(RVL2>60oTpfp)GkIMIlCq{Mx=wHI%zJP_u z%+&Pc=t!gfs4PC-5C|R(4w8yaY&JW%060orkD6j&K2HJ*1%-`+1DQ%qNy*N^q5aSH z3qL>c!JAfLr{C29qz{}hl@HED=)p)?nHwx@S4pa-u#v_fReBRB`k!EQ>l~1*={{-; z^usZ7fa9Npz|9-(5f0b5On*O2LwjPLS4;AIZ2HsjPV5(ao#eskuj>JB4aQ#sk;G#~ zB;H=6eIQ$vy*A2|4q$;T$hVpHtG}ERRZ+0HzO9FWy70MO4_4vHaP+(mzWzWz!E>Z5 zAY%E8;#o^>vV|&)Sx-TdIxM5p%q%2CeQ>w-)zvZ0N3e?uO2H3xDq0ZbNfr}=XvaYa zKE>M|9=GY|BSjIK9>m&J#BWQ}>1tHp%$Zs;8P{%}zW_MWx9V5js*}cw9|To+lI1tl z`}saT^+^lyd1%z%^N5`+_WH`Ly&`d=EZc*H%?WI`@b9x6?6PU~uHq68(6IknV3cF( ztlz#*max@SlEmba7pl5}EWtvxp$)}gCuvwiL}glW(}8OwKX8p?w5cF-KQm8B4h@W7 z&(C9kkhCpIN*%}cWd4|wnX976@k(4Vr? zw?dD`XOm(&_WBj-MmxdP$_lSoC7*8C zdIVKH?o0~udNK5ubAdIPVOzdKLQv&H2`|c7gV|-Ln{0UdQ_?8UT#~`_^Ya7yjJ&+O zc$B~du)LzeLZ1zGIu604xzWRB-(UiH8X1)m; z(Zn~G*fq=KMoR-7Lhe0?VvLXi+uRxa-5pGKSP6MNf|PJ3SiMKetEqmB{;_hXDjLNl zqES7YEG-6z*k~EKsHjL}uOZhY-73<|_BT~P2 z`5<@2lm^ezsHu4`*WyvgUPnO4VMBNEi>f{rI9!y>J%BfXv(D@~g~U~Yf6LY1SwwzU z5Nqa%{e-ddfe$$4;rHpv(Y(B1+=e=^9*u^M-NG>%IrYd1T4aN-7hagCvMeGnI7p6T zP-9Snr*&_3a8%XEaA*R1!4dZik=|M~&-(_hjqy2Cq36`QP7@BJVQoHFD#W{N*IV2= zkqBOsjE0PZqNsOzFohHs&gTCZQjHa|lL^dz zB3OQw$j%*IF#DNKDYV2T%WDd~QQSa~kBuZ;F-^RL>kT?bvIn~Z>*UN+rd72Q{fick zhbuEg8ua(?P$j=Hv(~1%Z*#Nnh9!iYPZJej*jx!vDd<&PeB^}Fi(59Zu(({iIL-24 zn1>^RR-F5`L>+H@Sme>)p7IGh~#BE#B;ntnJsD#W`vde)m@>F^7xPEthV8oF@ zj1@Z};vaTR$H5cI--#}YQEpU+^GCRM`e=rC$9A!U{{>-Lul%Y);G?K1)AOU23HKr@Zvu z#UFHJj;=#_ARSqM)uur^U?(|9{gajjBp>Wdl2KOv8Um8SdsmVXJ3*U zg?aXNqy1^0- z=Sv!1>(EzWQ6>;|1UQZgJpfk0;$VRaNN&J#$wH;%|96T(XJp$Wj1LF>StmP{h0kMS z+7|A^40%L0nf7JaB^xoAxl%(jT)alcl7!L|X@X~wBDp7vAT6)~VBSQlS9J8GVpRBq z40B0Tb8T1t0J~bo?-C8Y#7ZNAX4?{@YLF- z#0z@2du*%O{6#T0fYFlWbd9i!l|k{hMn8kTPShvNANl$5z)Q=JA6(YlUR_>D90Dr_ z!_J)AOH_kGreYi?cWwn1BR17ek%&W(JyyBm=RN8`1-B!W)J+mRBL&NbK$)*LhkaJt;mbSx z>0nDJq}&OfJiSMn(4O0yc5be14}21EWX{xF_+fG;sO2+^KhK$Kq7t{O&-OeM!jIIh z{|&TlQ?lQ?a>2JMZt5W#mBgf^hV||{kB`)K300gBCF0rvq8k(5_q(u_p@kDPhi*gI zVZ$b(sAg}_DEmc7yWDda&oSbRho0d881iJHveo_WdeX?jM>jE8A2HT`z7-KtVvJTz zCLeyg5hEHaD^T4zJ5-vgKFq_tQ03wTh#u|65a@on{^!+KDbhJ7T0)%Oz)&tiOip~q zD)c5}e#98IHZ?ujGH;67&OMMnb@R|bqb48z&^xg@)8^Zd?yWBJ>fzLHCw3)yNe89BDn7>eti^420uaq?U#%PkjTEmfu4bW_pYS9zPzB~bvh(+eWjCa7a&!G=H?bOG??`p zv_2=_c|544qyUJmL$%|A)Td&J0X@SkL*;L36>3(Nmekb|BXV*K@;X!nDu&wnx7&NC zk45SZOrM8Xz0WkKE3Wm`FyMnIBU^53%hFqs{y8 z?v~waPVMaVGwhvqzuL?7-JTedJ07q!2)1AnFt9|2pzDT+&Ay2C`D{@`_90w!(oxD> zybZhLa($9fsj}SnuQyazd18#F!H!39fxBy0l3q6n7g{i#fsF93YW{{?bb5+O#_ zw%hY+#f1&ofrds)wA;x*C7uubhjx81*-md!46Dsk{V#`j?`ye%q59jkwt=zb1;q28 z_@Bf7QmYNPX7Tax^T~%sMqXGy_Jow=qj*j&E@4V$EWRF>GnVr%^Oomo@{o>q#gN@G zW#fkbDoIZv+@CXVl@O@ZcQ0%#Zv?z5kj%&emESlGH8p1zwYsh6i0E-ESGQWdGrs_; zkWt@i*lc!h-RCsGO60osI~iT|+#2U!d|>Z?vJfj_vGOW^?e~thY7c40I@BrtZOm9E ziKi}KnY`5B=d6egX$g0-w-&Rds$)tI9$dGs>hdw21c(1l>}4;&H$_d47Q-{Up{YC; z!K>CKJj6r-#>znr26Z&dWPEU{fRFYE*rqET*q^g8+(`V>&Lce8JAxw)#%Z35f%{f=^YcL#Z z`N!HeEn>L6g$3LYRxOEF`sYkwZXtlk0Ki6lHv|Hf&9vJi3HL_tByB z*!c4P9xhfbE6HAIj@8hZ_ch7(|kLCq3a>HbKf0i#tI}bwKST2um z8{LfQIf$r8@2~ad-_gmFlaqiAzW9%jjdnly3aTNnlCm&G&qJlI2grVrh#YK^=TOs9 zW9A^d`5x});jr$lqC$w%LTBbMd2>)4j;Bse?DNR_@yd#&L?a)okge2Fvwf4y=W#CR zeM{i?+k_m+#B>L!=pBQsMoUt;dxB#;?i^h;MSY*b=_Y84EzJNTz2{!UgrB?JMxE1` zkzt7}2tW~IVqiEjy^8}Vlr2-bPG9Kyx|`)?-X@0)LJSNT+8!BE!;PMekGI(1p!@UX zJzT<8!@?=ZiAufJwt|A=_qUgFjmqVI7*c&JD|(2xTGK%!BqWGWz(lrK4baUn?(FPL zF--j(`S%Zl%3DGiIqw5dAlR>WJgv66gXor79Y4_Ay*@~u$jUE{k4)Wb+Y#@3bw5{57enro zk`CJipOE*h6v**AZZ?m+n74x$>(?R9NCjU%)x`=bDUHEUG^U;2%(yJD(m3eVKF<%x z6=r7_^RzN*Rv;}B*V(0d7=CQ-%--g{?pjV3c=$h+2X(xP!54zxyZuoj&=^h{P0KaP zT3okQf1wihi%|(auK8e#nbxX=gpzC8hdogDp!)3sQZ97P}h=m=||{ypaN*5#J4WJiG`Z+cEupKnagQ0jI?KpAH${ z!d>%xcQl$Dn!N1vL7)5ss@SOG;`a6Q?BjG9p(48)N=Uq5kO}BG^9}qRu&-b5KNR?O zP;)G<@_qK+wV_A}^#HB0D2*nhzqpx3|A`#GqcFf8g#-f^o7nqGw`zToC$@u-~sQ$m&=O4$DHbbh7u4s|JG|fB(1?B zhB(($Qwu2mIJFd#laUcQIXOQEK)hm=*@AvVBoL_NxT!fg=Q}&W?h#V=7aJb{%LYiW zu%G#*K!I+A{3-@>3@hlc(Y3a^>icrPCiHRBeS3eu*5c%%qJl`F23Rx zCYKp>DoSGhG|hImdhPw)a~TfmKQco8#}JVV|8kbE$!ihmHyWzIS3y{B`RwEjYp^WLh%Cd)wV!~k?XbZ zG$355gsD2LLdzgLAmfe341SLFe|`{xH2v7@e5kL_4G9U!lMAyB2@OpZss;s2-01mH zI-GxcGeEW;45Xa5o+RTV$xcsU$jyuvz){suBWa-%{wh!pd>nwRwP8}1OO;GuyoP0& zpy$6M2`rDR_un-W52kg^whh{y;yyiX5XfJ@v0{YW!vzxew0 z*RM6^`zQ+=iTJbRf@2LMMMk89NYWr~h4ZHvIVcbbI=axQd#OH_fx=j-9j7$Q&C#^y zc5?cdWrb(XKK+FFbId3qM#&W#E|4;9OtElJ+;+8m8b3(p(B=poeZ7Q>=w9;29}*rW zO$HLs3vl`DyJco+7@K%Hk33h>2D=@gT`XrvmX819Bz}1g3w{m82(mX2xrI3Uvk$>= zz22n?;=#st+f=-69Q^#inyUcC!s?xZeYmqQJ4t|p14ARuxY**fv%6cAn``Li#+lFw z;G~JU>?!tqe+xW{-R6rOuo~1L#cw9J1T#$(84}h13Z{2w2z<&xGsC?Vs$}0?y{k1go_gZTE~kz!eY_F4ykCM#$vB{Mx*a$#y7kt50* zUS@NJp7q1mP5V0yNix#H6*%%5Zp-|(6YriTkT!9-KN$Lat&4{HRO#DHlihO1>C6Pc zVFY$oH1VTL732M1oCaw2ZsV8#cdC*u$YnNFH-`~;Rg!|J>!YfHh@vJMe9 z%@V_;PTM)$Pp%d3?i(j4Q)L*HI?D>^BFh7b@UeJi{9*{UH{`WtWuIAC&bJ35jg5^7 z5Fv=r$oL;mm+FD0LrGrV=y76r7*fN=)>>jzHrc}0`IEJwnS|HU>MhK(a(lY_{7h*w z1tP;eVXqh#Ka_}m;X0tyRJp)Qy!&_rzrXaun}oH6@#*p|XX>C5RXW>Ol@yY`H^?5A z_<{d)O{{+~ErKs<53yUdLwJMVk1K76xf~)Qh3=VdzDw#nht8d#TKiebEyRrR(acN- z2>6WTb_=g8Hn=Th?%!Y6MckDyh=+uh2zm1haz{x*Gj;jhq}22n2^XA3jpE}b_xk&w zoe9-A-RZPg%@Or%_w)z{96hZ2pqJtYa5FQbBD?@EG>AzV85t`mK*$YYZ~=Z4(NJ_Z z{yv<)NJZRi|NZ1x-s{n5?N@ZzPK-gPS7BA{)^%gKe;_1;Gl;Ht>}T1qlHl{>aq$Si z<{ONelnRdP$&>qez=5>j-amZ6@_KD4w9)C-K2fz6&FL02chAIr^7bH9QC`kPAP*ew z`v>&!2;Lf>=7-72A)uKFXzlFu>+gTKdq6j6O9JqiE`ass`S}?Thh8k!LNlwC&*@ZZ zVC0yOq)@6l0$RO_F^ik)>wjZo64>pITTm?+*V|`j%!$M97wg&aBJlUgDJk1583(N3 zC%N-PO+#H>;>izyjhL34tgfLEY6%2A#(X6tArVj8B%nZ9TU!%)J5nMS^bIco{5lI& z`rY6Uks8=ZXzH%E=e_M@_75)P3#!&9N$p+e#(Ns?&9?f-AYzSRvv->75V}K?Kx%GV zOdsfK{fmu zW_gd%oW1@48%vYL(2eElmDT@!q&Fw<)v~o~#hn~!9d0D=bp8ZJM6#Qd!b$xkMaRAe#Z2fW8c z0JXFw^*W!&+q32cz1j6hYIPo}x6c!KtdM}fpX+hn=o5{l}(vYqpWS+ ztP6G3JDs(~#KbHuX@kKZfX)!o4gv$hvL`4WE^BMz<8`9Ftqp*rfXv)u0rZSOehJ{C0t_(l=wvv!xRf3LQdyB?BSdgL zpId6E3znd3huH%6|XemVsgfvftGF{ky)E{i%O_frjbm>x9`G zh}0w`OmA&{qM|b01Q{XtHjXxbs!-P7CpM2qr@k$x?xi`mu~%MPy=IMP^Qexf45My(M?6p2o8^l7HY}7K0MdY z{$}yTO2i~TVyu$c)7{LfrMzY7@1t1Ia{bkN?*AwyJ}G=i)hy-)51S*DtvFytmTFnN-hzxbL*E!0K+9@<{}rj}q>HaI z0k4VF#){Sc?2~uWtRpycTxW@ce}+As1gBZKI^F+Z=t2J;7I6@!3aaczwh6SH?i7SJAc_`fYrOaQFB#;$k&_Rd#Y zns0fm*&^WMKf`Uy0K?O}vCn$e?W_-7RoLpO5+UD6m67237VXt0!MrzVj2#jVO+-vVAr>)d(I6dZ zrOc$2QP3w?VHKP&b`LVX5QqV?qF0C7DjbK4Q1(?;r<$~d0@jdTM?nhlL878UZoH%d zu!i!?@yM%v)x%J}iX;DkV6GlWBW>G&&kf$B{%b54R)Wp}ETM)cjSV~kr!ar!i29bK zyL&fX5v+*d(Zn^?J0X5+(5pd0iU?aAW?Uxq8i}eF9HYs&XA8k4EzN%I!BPJqR=V(4hL_mrS z7w^wcQ0qSV8yO;RDso$%)n)9avZdr|0RQzAhCgH0nXKI9SQx!hq(ck!LVi2 zCXfZ+`QQEKFNNr*z1yhSddDRyGVR~jq;!afLE&^vw1{Rqoyh@#+7{D|=y3<=hD8ZLMcvO=1=0I4bZVmIM{ylPuCLdOOtc+ zw(~YoI(f7-D+|)_?hpwSnl}8@TVYJ4svOL(z-=z*_uNoW@cVb&ubRAyx^3Lei(vRz zVCIAnI=QiN;@AO8t`V6RH!}>ax0J-oOBj$8Odewa`@`7Z_z`uU-?N>{F#g;<}N?BKW}ZM zP<98>&vHkBJ#PSL^x<4U*hCoGC`WMY_@X4a*9hVKZ!cG6pT2)M8KApeUQ@lAhe_?| z;4f4AM@o6l(ZYNVv#E{nyA0q}vaq1-)jZ-g3mYA5;8EBk|460&p@o6_nZ}@mz2}K< z#_!!FM3ZFUQ}a_0Q&;a;w{q7dhJMFe0!2U=RyB6O$WKUTuwt*V@e5UAOnVZEWMxTZ zRx~a0vzbN-6kptm{ok2K2TFX5g`>pNU&tM$$@C(t87YY71!f+o8a zci>s%^I#7V0#rA{_v_THtu3MVt60cGU^)^M6r@pQ03<#1Y#zeIwgP<2k^N}kk+xiC zTq#omvP#OLwrceL-yJn)y~lZiho)p#iQ{cq~-!z*{yRR zKrZeZA0N$Fh(HgHJQ_CNU+Lo6La#JC*GVQ{hB*ebNzB-FE5|~2f*zZAMQ3ECdlRRdPcQ@5 zvY72c^^RMReb5Z9PR#9*PPGB-0c83bTLBMy9;%)j;1d$6B-uKA^k8teBJwKy5spS&22r)yYfC3P)<->%hoNN!*GU?> z@^l7kEaKY@n;w=wfk4!nqyniyf~@P@-gH)g3a#L1vHQOXB39CcpiICPb?*Rn3pVeU z-k>XkvXn+pN6XTTb4m5*)^5tOyQlc3Iw}P(c;XxM=G5GYHjmQk&PCfeh+GPi)~p!% zChIxuerV{oPQW&Upj7+~va26TFu)LkmI5x|Q3*&sjm^%U-PqVzTbWs&4_QQ&WEUpJ znw(l^NGCZtvGz!WL9qzotNe$8+CqDvdXVUc^)DlNn`(9hY~2IVf-p$nuptDT zjN)Kg#Ht-3Ss?Qw<@gKPvA5xGJ&yQEZ>2KOsS+8sOuk~lgefH|Y)Z-Zq*da@3>_hc zPCZT4+wbHh!hbea?ii@Ir;uh3o3eNEfaS+G^!pMk#eE5-;qD`uyDj-)|K4xOcr}43 zOfpoR`S4^hOMVs+qbV{QBKh~)gWtyYju z&fde|=i?rpNBsaREB0-Ec*q26!Dnqe2zf0heBWTEjhM>>eOtWY)bo}xA-VU~_bv)U zgj^Q9F6u=QkDt_9qbR43av%-#LT)K|E(Ex>G>6G3ZryaIuqsXO>6;YD+ zZA60dGW^7rP}v1$vq;Qsl^OG+w}%cL9_mvBF-Iyc^`GPG&|eWnJ(){xp7rItPa-3D zrNnw``;|Q_&01F<45HM=2488AK<-5ud8#U5V&vFb7Dwzs{bh5?$$mT!WLM!*DRID9 z;r;!++OYfYW>`+@M!(~b&zysb7Cel%aBf6Aj^+Vsu;Pj_W;R1~MPc`wwoiX>4i{lC zbNX82L%YHHd3EQ)>#L5og^9|3a%;LlqI$3j!cJHqGj$Prcj$6 z-bgAPE$y|77A3!8IYq|k4^PM5P!8{@?S}L*@8}eQAe|C+V94B>VW8?I-G{E>neAK* zNa_7^~||Q=TYKO0Fz>+ z9n_C9Nk!y(>yJ~K33j2_@t%=#kZFbetALIdgN##R@#_k?Cc44T?HxU?miWpA|NWUH zhF`UYU05D9zI`XP+eu2Z&zJ*@XV9xYtD}jx8j20g6|%X(Wwdp;F$Ot{{89`N*#qC) zUIyjwwLSIcGE!7>+0*1v6RPM>w)8{MXOCa|`}-{+K0Cvqmnhfpm}n09^yDdSZ38E+ zPU5Sih>ql22TcKIo2g(dN|b*;a?#LO0;N{3oO@|R-5=T>_tg8Tw%5Kkx0jEuIbB(A zr|!c4#1bz>GVBeK6UZbhTu843$$mj$3jZ4pW%LX!5`WE(jSp7czPe_R>?l=kp;+j^ zh+D3vMR7N9wHKN9Ec)MO6=J8M{BQ*KGe{PlYYNC2;6?axO9r!ORGV>n=s1k{SCkP- znu92b4od_FNDPfaL&+Fo&67l4x*24>If)S|p3Q`Obm5_kwOIuXrcF|!^ zPc=sNwm|Q}Nm*R8ZtpMgNTjJF|?dC0#$LP`I2s2yQtiWix?9MtQjM~$zwk0`&3N-64B{lfkp~qW&d`_5^ zttu?`3?FJRH-C$IE85Hq%JYZM-9Rs#n_}|S8g(}^7AaPN7TZ}ylZQ`0!revq@et$Znmic$l`%AFUmA7b)AaQH)FKk0fQz^`WEIvN+B z6re_?%KJ9fi_YvILUTdz?#5v3;&->~`DbkaqgoL^PL5`Z?hgOfmO#OL-4yGhIJy<9 zBBLn}$3EzXfrdcjEoWZ3{!t;lJjTsHm(jDPmLt@`jYvvvB@p=7u8*L&f%sGzEpi>{ zx6xNEH{=Vye0HSb6oYzUp+>mQkeaWE%6XC}T8ou`-y&f8#N0K>sfr9!2CREv%iK~K zz>_qtwZd2x7TMnCi#U zoRX2)i5U9Ku!mG**{Rb%L2-Z+eghK+^O%)9+{g?4skm_@i6KI{WNId#x6~#%bPze% zruf_Vjn&_{KK>K8Q&U(jhY-4VALc4f#NSWalDNvD$Q$fST!fE#8b>%&Lg~!NV{`v~ zYzc|Y)V&)U-CbSl0!*KglkWql z5p+?7F5y136ASK~FoNNwhd|FvM4o$kLC%p`N#a;YFjbMpij`B7l7jaT0i}qtik!NJ z=_DfO+HB)*_Vve(12xv|uev%cnLQFj^AH#+m>lUvrxE=CgfPp9R0gswn1CC|)h)6$ zTX-lbN8p30as3FX+Q0VqQP`BKv;mAC{KGwhD9~tVUF@#M2YW_)27FMc$ zm}dxz>?tWdx-DYAl--c9gE)ez<%BC#LsFJ@YfhufBa0VNEAE%^OwW5KJ;xD@K#kiyvx99;Q+(qx-P8oyMHrWK zmt`X&P)deIU&_Mk)Mi^bvlTN&=(s$T2QfOi%`3*A9F_4bLz&8eWsGotIOm~S>k<)X z1@-4meaZ}egT6IRL>}S(ct667^)!<~3I$wA;#fee=FH+E0$r4_FUEHEOEWE#^E@(e z2@;XDU@uJu@&#Jp6mTP(&PV-3Yow!am%kYt&KOtKY-?%XogJ$^HEbx@;=N`%s8D29bY)EP$oYP2WUh)8;P0gsJAE+}0M z+hX}llb%xv{Lr%!laV#7Fj;fvHv_Sg9^i-flrg^7j$lSc1Ii>s#51BI<ee7?-laf zuJm%W6wmeFYU1u~ywh8}lmYt0ao~&mmgf4(OvB1bhwq*NJ8q266&GSC4$lH9vK%LR zE+`^odi1z`s*f3X2}Tx&xGOqP}tv~8NqH!^(mM#bO8$i0Acn4_7JlJBW+ ztO%c+Cq8fI!r(6;Tknphv*Y68+Dkcx#tJ?k0#koqLafd9c3}$XluZ3gi^%;kR!V!` zKiF`{1mh;&0fO_{u%c`i8F{EUVYoLh}hd|Oc<$?A(7N+bN`BF=+^xX0No>5`O^H_ z+{xY<7e7A|I$UE=Cs6@NRabLkYUxBLuX>trX@Ovxt9{IVx{w^MOwuS~iIb5-`=?5qvr9AD+TY(lyldkiInF@H+o) z@LQO(zy&IDhvk1AWSWtdmmF3`M#kok_w2vcP+N!2-2%n}tS?Wz2?1y%KV41ozD4|X zn&O2TqFfG}Q{}9GqnROXJ)1-4wP80`J+tUcYV!ttvW~V5bK_T>xVBnH`l=WVZwgBf zX@G#ya){!M!hrCnlU4*m-qa9_1dnP1Dmf9xKP^MY;WF+A`L8^XSAQ?-Z(`-f_VyJE zm)F#fTT4r&Y~o|mGEW0-bq&NnwqFk0c~`y=jF@jWjMv0Xrs7uT={z_HylHz?Ypv^;2 zB6WaS8tm%oYHXa}j!8+ykc_0gNfw~6)kjQJodhiO1S8?jzR=RbJ;CN>Wn}@rXmli` zZMk&HjygZFtP2Cz3k#W008DlRL-ehB(w(^QFle^g0F~5KfK`|+ z64_UnA=9wl{;X39J#boPV^Ig+gU4}CL_5F1i%0CTq8&M;M~EgK`M*gE1{q0>_fnmU z3}TSj;RU%~vp>7vJO)gqNsilWkda4d*ae@@KFJ|!PVt$PHifciB?*HW*9j+FqLXWa zdv5S#hgTRyW;(8dhFK$j_u-mh#}1peE!;N=>`e7oYiCTJl2Xm7K|E`11VZNFZ31F~ zS|TP;WOhB@Eat!Ytr{oEW|uH7I>d&CFv}>ZQ!Kps2VG@8dW3fE62TVM)6R`I(ADkd z-t$BI3$0G)xh%632WBGzF1{}lpQ&XakPLt#zL)B&@z6B2?Wa%er(F~(l1G4FmWFxcmYI1d*tO?+d` zKw?RvCg6#T7h`38X^Lx=oPcC^Z^!TK-&|fm&&MnI`^=t8szG-}cbwyt8IV75y3%62 z@=yJw|DMzpVSM>g&l%Re}nvQWq8`SGW!)0K~}Z?nTHN|SPeW{vgI^<#f+ zVX)Xrv%PMUt+u1%C7@jeL}kv-&b)kl4(lCD%gab_;w2Ec0xtXVV6YGyaw6x@;cC+(bbcg_qO9SfP*InZ8wiYj%3*dqyog zCDoa?jt)(~doM%HW?6=nF0YaKJ7QBblGBqz>+iP9b>D5o#dmYxmJEU2em1w$vC{kQ z#@YIr03RbD1AyuPbg+Pjc?W>a2z~fUNJ!x3`u#`(qysHH5J<0=Tm4Q>PPzWiW!>FE z8R~|H8-OaHv!mns`r0u)Ik^#_Q=1WTeoB^&B@_7f;2F~Mw(*(?P6Q&f9q5#Dd@nj5 zG^+HTUY}g_&Veiq0LC#lH&;^#!o+k05b*www@0cq;Q$z*LciS|(BBRW6d%foiS`8r z-S?fY5hEqU#mBdr4pspJ7~7d&%$_8eq}&*1J3Agv*SLDug&P=mKx8*i2@8eZW`qQQ zaN!`o$IGq7MFQ^N=4P%>ygv6#pCk@W4-Ue7Dc$`=K_-JhTBIh}?RfUH;}r1M@L2bP z_o^;0hxX?ja-|{_>wY_O@V~_er>3TZw-3vrZ9onyZ7UnBo+diKX9>_r1-kesxW7Ct z*O)2hb3$NP77HOFueaOH>;s$aC=`@}5n#i?drd~{(NJ3S2>eSPBN|oQ?$_eiV<&k? z-wBVx@w15^aTk$qEdhHteKWALzd`5AV&24WgF*iK(Ue&j*-X8qtoG+lF16qj6~jom zaJfd64!qU+@?_2Txrhhn9a}e+d0Jz5pk`^CNjHV) zf-%d@;Js`0Glyle5`L!fe_RX=9tjR+0;6e!Ig72vC&hn|vHN$1Q>z|5pU5KlLgSqs zYshs1ZCLW|3QY;u46Q-q&3%m;g>7-3`#TRCurh2`Nn{C| zn9WR8$^j|?4&_TJ?yQ~7l}dDTp!wPED&OK{#%QFy*`aVFw&{~^nKgqWC6C&a%%H}| zmwxmVLDtBhd>w8tO`CC@Qn7!2mHZ;*BjMuY{hX`b@p2+`$nh5l0c}gY_Vl*!A2>!W zG*z97hhOmRGO3RJF!%__A17--i_~epo-wagfu{?TEbPB`>-gT9;OW1yu3RXZ?RyT@ zC(g^N-v%Sk&%=W#SmXQTys5akUs_rkACGCIu)6n*PDoD1xT=Wv|K}k(-!0YU%;A}a?eUoK|ui!(bwEGUt8Jyr&O58<}3MD23W6MTwLzF1^glZ zKvuW6w+9CWdHeWGku@SnSHpjjLa<7>`~X^8u`o2sQb2Uklc`fFX(Pc`Sy~E#Q4N@> zH#}(N*)l6vnlGYaV$yR`JiVR( zY!Jb|l+be+yCs&eXAg{tsi~ZtoEIWsru{Sq%0z{M_=1Lx4t~8F+yrg%7=6aZ#+E(< zq=>>>0ij+{mulwbG-+hKPCuX{muw{;ptM-ib3*XGTd0LmnIPrt@|}$z4iV5NivkJ^ z`;kOTuK{!QljhUKBk~semGNoK#)kdn&(8pW2nm(^j64bfactxt3#-q2V(u$U1ZD%* zBamJ}++@r087#;v;Pv&&R!+*tbu=H4za-Id%ZrEvR#&qw21yo*sF;#C#gca94fRFI z9rj6JWzmXFA7OhbvD+AQa${kytgW?sji9Bgbs0ZJjE8!6%9HtA8tJ=@rSFu?kO`>_ z%__oIRu4`5i(JQ_+gP$&AQn$_df1N!u5PR>MVz(Bh-N@?V*enhL|v z_(!CxeV(?hMga>4K77G_bH{f$LO9Kf6H+836lQuRSP>6_ga6)|--mS*YW&~4yX+_2 zEVtArn;9!!0J9bW6k(L0BTc9gel~BgwUPgJvZBuKj22p=bEN6W=@MJ^~2g@i@ySl(gaU!#9> z5ss3M>9ZGNg@`YG`}kE|DAllR&d%;OH)n(pv7~Kfs%7NpWz18vwhC-a+hf&0-6m)M zN}*p=&o|0F4c3>|YflR&vd|6=dlr{*Px9=0MU0`}3cZ8pR#;0r3+c?19OF_QoHXqB zg9q~rT2Kw9pk3;0m z$H%Lkm1YNkXhl|o?j0itMbB?-xSOrp%vGuT(a})B#)VGOZ(J)l;!8x@*j-Z2*RwET zT;Kis_x<|WUIU*z@7r+UAY7Zb>`f$~A3{N6;hB5nf`Mt@i$qfWr zYjJEXXyM?dShTI{_Fvn)Xt#9swLaMg912*`vTwsuxt~NJ3X=U{J7T~ALwJCs6A6Ud6_ zz|Fx$nj20mAtuVWKSew}J`S89<#X>1!ua;>yubg-l#WbD(I+A2X~{Bohl`on)Xep^ zUrC6Nj8x=xlUn!#;vq;(SpVhanUWP~_7bJ3B@3MZ9#YTt%YDeisC+)JuWtt+!|p4S zFf}zbGuxe=#aUDY0!qAz9r-azdfzFRi+fql?^ZIeDEhyeVhE_*;n8{oA7%>7EE&#>xDA`4}>R<*BK_T@gF2^eKX1L$ez@E-C!d zuih%m8PT;Q&)Gesqtiga8Nuf&h=PLQ*Lkz`iqCX%Ce_0 z`uQsQ{R)*ZDoKz+;d-6-*ySbtEHp|bTleAoT;>9c!IbP?S@XAq32M|vw-C>#(h{1^ zF=lu%QK`1Jhp>?R(gW&gf%SLxotb<{A2}DKZ10n+;M!P+b(_lXC=ck8n@VJszLzf# z7pon*T3Xy7(02FWibZ{1v*b*9<@W~d?9nKk+T}4y7WS-{@fx#yb3(!>Y*A( zLxkvN1nr=p^Qto%Y9#?E1uY+YYlZv%O1( zDTr(f)cJAUZvO-lP&N!IYx&@#mxrD|Q zv?1&}@vyhA0;asSP4CC#U>~X{JPw5~bh!j%@HKJc^60m&^}SjFF<}>|JUFoAB(v*FUj%sOW+z*`)@U2$=av_nd@>g%d+0gp-`(mZZLY7-t9;g6 zd5%mTbMoGs#sL9R*H*lk!}WUIo4CBKn^XG4JSoG^+rF}TI&^ZkV09FXP zB{Aonnzfn&@F7`QSxHF1Zjy4ipDoV;ZHY$t5~Ws@ z@Jh3v`>Ch4f&ZhhnU}wag85xlWjnK^l(tOB!u{INew%uE$sk>YWdHFVBiswTVh%r| zxAK4d;#{WoJGMDV-7SRrdUj*Ve7r<2#jovdJHKjsr`A^7X|ff4Q_}Y?@Da8f%m>e< zj?yj1^`jQSM%LEbLtA3_iCBQA?op7rz3Dt@d|Xv&8)t^B2v~>{G`0cCB?G=De0)68 z@Q5zg_uoraVu@04Q{t8Gk@__>IdTY*2zK^%Wo2cMsEa%Jt}lN(Z)Zn$M;4q~-Orx8 zx&n`e2@M^(=l7dR{azAT^=mWifWCdL)$KvTt8szlqONcH=g%^krPcIZ`J?*i8@Gd$=|;VReGF!RDtgm+VvK`zBmYXeNR7@GmgQJFWr?Do-t69 z)@saS3P4hPMR}QoK9k|S*TBuc^5KPTlh`Gu1`3#~96>KyN2NH~{B?Y?pA3?kF1LrZ zfPx%9HOb5CMWfquZgG~0JDZocst;n@)?O@t131AqGTsmHFMuu!DE&ROG^VU4}AV`3E)V*io}U=aJXG~7N_Z+KO+bz?D!^f5sSP1mh`*JhCsOTnLsqW1e8b0jr zqMkvl=N~FL<@JOgz;k$Re!dO3q*kaQ)q1wg_^-=)E+GM$IpT`X=+l4cEKsc9rVi5r^w;TP$r7WYRH2>1+na1})|zf^Yj;v7 zXbIJq|Bt7CV5t0i-}m9L)6TZ0CTsF!+s4Gnw(Ta{c1^a836pKtgvp-zzuuqk@4g?y z##-09j`KLzZYn$eq}}BRqs0;P2SUCd#dHc;TUz2{W2*!1oD=vqP7)rMtD#7btj(c< zxJ5G%=Ut#|5ur?8XK`UnYOP2veDUi7Z{jtL9))Jv zMq5e3F9x2?%`7g62;iB8*!SQHh$wD({tX@&*YxU{h*9x79T=XBrUqJ)V7|6P*k&!+ zz$1cDHwl&FHIa7a=C&H0HcMAj&7GrU(52S1!uSQY!XG37C|e^%J(oYha4u6Bi?fKB zh>G`?R`(C%0pHZsYBL)>TWx#&rV+NP%H@O!SWGgHJtyB_;5}Hmv%4E20#b{Ot-<)a zLI_A)E*e0y7ZzOZpv{Ut^K*Px_{2ELY*lG3CT=45%j>p7nxj@u!2fxt2U=fWfPWtt z-sZy)~M zE*O~rSw00!VRq{+F|`f><}`E$UXbsqnwn*cR*ek}JLbS;*4Nj!R=*p_o+)~IJ`W9n za@DIA0TdX>aUW+%s;jGirldUIXvgf%o-%_@0yT5g_g%GC^mq0raP4E_#!IPI8oV)k+}(md#5xHPle;qM|+25uHKa#zrg z_^TwAT^wG{Oq7mb{q&TYmbh;*|lZFT6FPOIzpWl={IjWuU-I*OX`@&R~_sNvD5r^q`SRElP|Z(K|f&;;mBb*kXNj*tFuDjLNgUqCR;U6U^75Re4HQuvYt zjxa5$7tO-^hFwkW;qpw|1EnKbdTJH-d?a6aKO>7!<3X4f3G<%2v9ZGZlzr6%YeW&V zKlbDLYWMXhAc@LI2L-C`5N{-Ip8s%L^AeqwbjS5fAR>~+&QzU znQ~TH+kYD8#b8=lxn4=Ow(4c@Cc{u`oD>i|=CKump$gmM(6OMFFDr*>62B+sF&PsZ z4pqzOcV;M;>()_Jo|KcHZ{!SDmfzN&xwszeg;+u_5)ptaTS}E6{hQ<4y(v}p!-=v@ zp-&I18T%gr1L6QRmE&$FE7@V!_(pT&`3~+TRtJL?3*D7%?M{-t3Mi1m(^U7L17Zj` z5FvNb;)KP_Px}7Q;mQDs1&1&bL=5}HLD_FNTZP@`!foS0;LZ-)Vn8Q&ot6z+`-yN! zks;~G0%OF_QaKs@sYKo*U$70tAHaKwr*!-jr_S_G1Y3&Srchb&_->t%XU_KeeSaaR zv&-uh_KATiDi@Ce*q$*Ul90g%<0OmLb@cbe_@$L4<({EN%U`>r_m>B_8T?Zye?!W+h;FFmK6gwPFROH?I1n0SSZh7(ihe09(}U*>QJm0bAVp`MiyG z&yVpE!qd3CQh~zuQy9G1=*w5sUf>1sS98LpL}Ce<&t<-Tz4e z9-gFv=1=Q*CwaQT_#%d5h?gCxYGE4txLTNP^T?vR;oiXvKl)AE$gE@#63?(0V5?;~ zsUf0fO5kaXA#ojkNW=t^pjkjdc4;$~0?;J;yLqioVah+hiysE`yHK``H^qCiOY3AgxCKk!lL_;nyyy$-)RA3TJ!^2>lH5R5`A zW-sh`B}oLoW$I3>Ao&Rk`{-kLbNlURx!2=?eKUVqC4z=b1FA-K&~PPKiM%?K?EU0~ zM)KlG{AHFxn6W)HR5~m5<|PPj#Ynic?T^Z34^3CdWa zYMelg*!oR{RgJD7{fZ`nCbA$yM4rf?Utpu?x+H#l*weUa`3_?@aK;jD?~ zIiLp3{z-Or##n*(+#}ij&Qpjo4Ss7x#ivqGE?Ky)W~pe}$sp8^OXjS!YayS;<;MI$ zsvf?h4x1xW7D|YUOf+ptjw0&!L=9!A#nUpZ;Pq*Z!|F3SbSmsi4<&cxR=gL45^p>Y z9vY=r{35zvg2f|G#&D1!r8)g9kY7YCM#}Dk%vP{)OZB=b389G-ia4^uE&& zUZHP^EwgF4wbTeh7|Ieq)f`6+$z_Dn+z@XN#Rp4t6n)|dJwof1rgl+6_v_N1ACd36 z?`Wd1dJT)23dPX}%O)nJ&5ljMA(6Z+T}TD4RMqI;6b#EMuT`;5nDC2{@wo~<(SYgv z%*GHwoLI|=pAcwND#-}{5wKgRs)?B`KzZRgKv(6&$`}rh`u)#1BM&edJ>L=2v`6>< z1aM2&)f+_HA_Cr+^!a>Eq~=Al)^5L>h9@2M%XZCn>Dq>Ajbh^J-`wh{nO7&{v$?6b zKVQxMWhVGub7ipvk<+xFg?>hc!f940t}Vxt10i~UEqB*~bQ}xTOP;1-r}NU~NZCioMxEzHDAz=?iM3j728qO0t;;qh-`fk9Zz-I@FjGu!)oMso(lLbCQ0IlVrGDsEB4`By& zxtBK0>O{z;p3eloAW~8g&22*fjgB25QKBEvSi{gZUA_Mg`qitiBFL~YQy6>W9RAMm zS`sOlevcLJ)_wI-9TO#okIH!I3}U3$!3rhznKB z)d;Ty+l7RVqhXOfs1O4|(&C&6B3#qEIBog-dugojIiTzBFr{kkJ%bK*eaKR{frcSw z#cfC$MGDOBGj=t1De14Xm9{Q>tOzw}1k#3VZ8H}6nr=x76VgE^`S!Uun63=PP?K_U zGUZ4AXFUSGga1GB&7}xU>xujN0)Ee&_{-l2JW(NB1wKfwilk9JBteBJ3)N{P_TMpG z_2r{?a{^UA*9EpMGp!nAbmS8+GXlA&?ulU4I)nAqg>9&clH`MP(=$Z1%%UC5c##Fz z&u4~Uqo#hgoXiRrzDg!Hc%~>LEcMOx7wJ>x!?|?^Tx%80GEyPfXa@mA1R4w@c(21y z#7Egad8)$2DoOu4tQ<%yM1}`O$i%Bv-XnsZ2WcOpuCMZo)u}6OkYTF@2Fk*g0-~*> zC2Nqt3>PSA5kY+M&$n7}S6KdBk@-MksZ3rc=+DEM#Z0EF1mOv$@1)^;RUeB*E_Qk7)+FNS z?;cb#2@s>Q)s?mD8aq$PR>Vr^btG*uG|7fU8P^^zj1{g$87RYe%NJ3EC~iwWKRF&_ znUWNvOlowBb!Gx_(hP(iqM7+^C~vvENrGR#_&KppxTg4i22G@XvN1a6`vngM9yXT>5?(!S426tvkrX*w_@J@^96?bkZK_B(`3Fw;p3EHl`2_5H8yS67|Jg5`@UbcPz zB*(i*i?*!qWnr1{i_}+8=u*I4zZPiLu>Q|V8mR(@Q6Fav>pj026(68I{d zkVU2%1vQ}g6WS#tASNl~8Z0-Z%Sq(y-4lsR5)Pp8vEaoH)v?^|sM|qqDUrY^pDmy^ zrVNCYzr$4$vB;?!J1L5RVI-n6H(5LSZ=psDmhi*{^!6xrc6MQyUT%-&eQ!R5LHckB zog>J=@cdmWU!Neh`To;c_5w_RonZEJnb% z5P_D_95oc8?-V(+4E8Lx$TJNS$1Jtkw=JP=w5Y(*vC^VCWPO@164kIQ#H(V*5Q!t0 zgHDa{5N0bPdL5Dm*m(0~4Z=jx3&D!(0Y+8w5m-01pIDk^vbBW*+qe`ke&S@NLN`0| zPvjco=!ECbZoiIbeyl#EMDSne8$>T4~aT}V0&ypB6X8p#+_>xWY=-(_dF#V8u_(@+4M~S0S zWPbe*X-{U32R&wj9s{nc5xj`+lyR1CBpsmXy}X4{5rc7EmJ8WtxFF*}|A-PmjXyk~ z7oDFPCUJpW#b~+oeh-z zQsgF*0PRT)ozV$*s@+}*3P%X|4(OWHKCQQSP?$GFCW1xBU#A$?>SiIRl{1rAtoHoj z44aVUt0-?4R_p{EJbeb6TJnCI!fC9+Bm$0VghH;DlUR7j`4I0NjLs>3Qi3qWT9xwE zPjK7~Fxzi9d3FaZtJxY}Sqe;JoskdRLJjN^h%B@;d;<{DJGU-EsL@ne3V-S7^QA{B z0z9@7LGMRc{z(1vosfh|%nVS(&(R-KIOBZY-2r~4=uyyuUsg}5pavQS*$#CIT(F@G zG$xi72FmE&Z#OP64YdjLzkCi|fkKV<6$%L5gF^k1V29_bq4SJPua1i# zL)bh>f1-<(i%J=!yF%&|(-ohQm8(U=vDcy2K8EOvQy2U*lVQkmx13Ei4ynYr86iS3 z>a?I-E>ud^h~0-Lb?Q@s+&-<&%Af$n*dl?D_LETmB<+F;B=U^XzQ{MV=%?_9P(lWB zF~rEwM7uuf6x#AC@n4dpEHF7?;Eg>i$hN3}G$LuCz-wG9Ca?3CkzpEo1i=+7anSz% z(DiZmG|Cxz!sU}lflPmCp<@%#HH)EPK|`#vP~rddJzj@Mmeb%L>;;GxgK!B z0ld1$fpsX?rwlnjq83Mxi}O{#Nk~h1S`75~+?nSw7_^%0 zhc&M!gS~#)y2XzW$Vmw30`lv6U~Ss2c&qZaY?UD>hWH7Lssl~S#^6JO&cFgcYYS&G zTATINp+%?#COEl}G$7SUJ!JUYOWUed3ppPQjPX`-?Z!>vx=)m@TwHyPGoAw4Fa=8M zMq%YsP>Bw`P68feR*yBr8d3eUS}C`U5r_gQJR%=gunr?yNx)7X9>4Lov{|GZ8O_7L z5SY*TCQl1KUZcOjiAaX;11=Q7De!_|V|}JjHeDF{vBUAmUzTFp+cQ3|OZ;^(0<$pM z5TQafrawHzLf->bO6F$LkPTggXU3F*gS5|#sUq-6gxXK01kRXel2&4t2-9l$WhY!d z$yM#V&<)(c6miW&*+zuQ+j3dDJT()@*Kptmsgf6MK0YHjZtQs_Zsz0^U@vYk=sy_F zh>#Ci|7sooLH`x^pU!hj2SF~-O^^)rB3g~!miAlj$Xsx<&4~Dl-)s3jus{{zxcGL6 z+)-1}c@F-t%EhZavlM~088&zrWk}H|9^R}QR%^**;pW-!CA2#4=ty}VYw_St&3Nv4 zQ(vG}woIBIl!MM>x&$d_A%dNp+3?pW(kgq8|UbsH~NtVS@-?^YHEORU@ zc4>@bH$1oJUMkF<28dUy*{(KyrKUG1`w|vTw9@3*nX8u6$6qJlQrp>ReP~WE@e*F} z{NtHM+MwxSM0Tw?teGZ3cx=x9i}B$s6crAJC0 zA>b7~v|^;6gPsaCg>!*Z}I}wSO%RY>7fw032 zH+Cmqz5?EpWKF(u1Z|ValsBoux@6-FXpD>Om)Y=3g+g%k(V&9C4@-+}2E@ zti~D3^O@V$@>NM)PmQ6l`wuP5W)FYN&zM#4bu)_a_QE>l4fA84&wq(2aciqPV9NuxCUr$N*HLH-1jKYf z;YT{lOZ#THZ&z>kzre?-YgB|y7Sve?v!qBt2E;^sOS^f_l_i>ko;voso>AfFPvgKNx zy7SFwzeUljgJ`g}4NG`$+1N^LTGDI{TPH#8>fv8<(d5eJoljlT_bltB)g(V{S#L%e z0iP&`$3KvL{$%o(iS*;OLeYZM<>7OG0T<*l*|%@H;== zs@I-9saUOZzj`eA5$^Aiod|`svb=;rvO|hZvc$y=oA1tZYP=Dd#L--<7gd%cG9E+N z!|N^}Ki$`ua>)GV3q2@;+T?y$7y@LgGn3=f9gb}DH8?L*aZ~hUy3mL{X`bge-akWr z#`J!>d$#7Xy-N}GJ{qbg^X~=xOy`J^PtS4wZfAckj$TrKM%zSfWhQ0h`0N^6C^-l# zwCGoZaH69H5`B0NHx8|dbNJP0C2m*SzJDC|exPzOeG@a7+gdpPd)CT)WB4(~ofy+& zTI_!C_x-Jwi_t*WK;3y)Z4V&Rpnak3C=I9~=zb`&<_#0`=H6V*W@iggd&T`3n1j=_ zCxHidyHF+c7@Qz~79aNW^P>TJOO6DelLS}mj0RVe$|T^zm5@xuhifY<6Gqb(YhS$K z07F*Kl@uxSM@J^C(BkCX`8+j7UYeSC7-=P4t*zZTpZA~aej)x>~O6JK*GQ z3P(L~ZY=jL+p(~+*uZW77>~(Xw%-tmJ~YL)WxOzS8TJ%s98t= z(IDwyzS-J;WqocME{%=h_c@XqxG^QvSL^-~Sf?bRrJqV9ZKxW3UirKV?6>1cW00@z zGw|?3wR_H;>$F*b#-eVE9gf;R$EI|eUjTH0MBC|R^D{!ty&K5S0uvXBh2?H!bXVWj z217j55I>#ZciQxUHWo}_jo7Sv=dGuW;$i*P_`GZT=tOSz0(}QV>DO*ZVtmta6PDb_ zxX0Dz&YydSw|@vSNq$#buS)mSr}%zAPXWBN`R^LN z?$X*S-oxLU7wc}vM_90Mp@Gy`SXjd&Bf~>OLgEE^Jv}{CNsyG}R{m`!ZWuGi^3L69 zX_|I+mseL;K&9w%t%3i^OhG_EKw@Iz%F0T!^|FA+l_AjbxC0B&g@6^0j5?qW?r~Hs zL>&7NCmb%kTCcveuqiq-pNxt+Tle3uvU$-#W|=6i+HVP2sb2R3q2~%@cGA?hU%Te%1DO;riNOZU-XkUd?6LMK% zjZ?rGx7e;Y-Hul?X0>o}G-2VS`1UyIZTxE7oef8nod7Tn&*yI<()#+EvJcSuc!S}Qr|<4e)49c z+HHJ$-j$qozBLPzT=MDpM8Wv)A?KC1``-f9pB$6)cXP zzqc((MtdE4x=LUjf#b}*WUkmZ@#3|HB8~NU`LNmO_&QP8fa-U@UTFRmsJ-ji5&&eh zqPxdO$F{2tFg6ACm-qc+wgE@C$trvxolT>zEUAv zt)Cqee~Z_}@xPm_UzuM{RJGgoFsz?R_TB34gCbviO9kPF34_~0{{c@v;rD89vy!NP z%}t7P_&mK#Ts8!0#46OnpZ~Te#w+Ef^?J`AwTz@z6Sh2gUs&2-K&h&X141?ZzxSvf zKD;Flp6xoU&VQsBv}h{7x273vo|QJ5|Ni%O+)G1Cx7lE{e}6!)t;njuth=OiyC*+2 zLH2hOSRW-o!~M<^M3sO2rRXof!c8QL^iU~WB5B7gu{P8~I?MZIR#at@!`l0+Jm;!k-eFT3ba$t@Ib5r{!a&1$=K9n5hkl zRG>ka(r7U8AOIOyr zxZ7^>^M5_t?=EXDLHuI7efV11&d)&kmL~Y>nIC7M<}tJYpTiT)*ED@wdHdeg?)aE_)ju0y;eIGy|{kxc`GZ*uvhrYO02kQouIA#P+_` z`Zv2PO69v7O56QvpO1{Y6o4of5yeD0+TyZB_lC;Gu@;sXIZek~Tu4?Z;Kp!oaQC@M zQn$`pTX(gga4QmSHJbVZ>mn1h)3hoJ26NS{f}*+kzmO7OM7jZd=FRihieZ!YyTQ1y zmzRB%;jP}3Agwnas9e({6M?DcU(?&yH>hiE^HoiSYu2L=^*tml(LyxS%wPRk`z@W1 zN{&Nb!*$e3Q%D(|*K#tyu1fa)+Z2-2Juf)%OhMuAdtv0IqdUbG05`UD?e%S;QSwqV z^7FCa#bPEUelPp|fTTE=`jf|cAOX|Wbg^*O?{a9>8n+ghBtzIDTkSS_oT(4Z1wV$j zt|C&-mLE}2i&l$jxt+P0?#CI+M$#SbJock95hJDj?{WRx0i#$ze&5`&DZn7Z%{F9A z?zj%OKa;V%4i-5zI6X>|;1S?$?c&PWIVsiO20D+lgV+}p*+({)A? zZbdmR!W~-oRO`w#nQ=O>H4C~p|Mdj0;^|W(LqpDG)08&rhx`Hp_;uE;+Dy0?0~fMs z2B{i=?AK?14*6ih5}VkpprLrfeO-Y^rJo7!__(!JkL#;I@LNf7F?O2TM*Baq%M*m6 zk*lZoU|?R3ez*&JdWPqe-MpRa%h4_K?)(J(m@gNfn^Luegc3s(!Si(WP5~mp#)&K- z|Ep~$wj$smB`^PRSnJn4II+$(Q`^MAOlFbx14Rg{+a1omCC*~eMjrmx93_HVi{?|m zuTcf+C8FCpkSCg^rhIvRQixTw+3s=n@W7HMd%kgv2k9*D{_joszgLwjyJegCR`(XH zl$0gTu7q)9_J>(*@$(*4W-zACV%2U>C&8)j;H3EG%ooSYF77-VLIpH)J3@)erGrrg zKsNqBTP7umUZCi%6WaYQY_0iIyWVSXVp-n(FCQPVzYIGs$!3T5+1z2+ONX95Z;^4) zv_bDpNA+`eoB)5FpjoZ`ihgf=D%XYoE!PJdtCJu#0!la=?de;I>@OhcmB5Tpt0Y2> z0!P=;+>G6k;Bh44X~|(L0Np2TPRR{i{{ikOoo*f{56}1339JsbT`Mvt_kLW3kuk3U_yX1didre}%5)$B@<8 zX4U#lE3LLG$+Hg;IGv7_I?Zv zg)CYDVmlBw{ zR?;nFZRUW_W6L7vtNks(U;K2^tRL(C`HcndGwj}LL71lD4Xmex8p z&$z%kzIvX+Vd~b&PB1&lLxH0EDxaH8!cQ6?k$he$ch)+?iOY$I2c&Z>=cT1Uqypaf9f^gi_G0W zq;7?(xFD!q>z*$r(Ee8>AX)fm(CY^C2DJA2-eCi}&^Z0XWETC70cZnpVGYV+jlYiUzc=Gm&haXgeOp#W~5 zE9hDJq^;3bTPrPKpPRS&vQ9ANi* z-Pvlt((<{s*y6B~126IO_r^2LpPFOIySuNMS-SmTG%l%u=UZG%jKu#U9|jou1$K!u zb8}GDPf>y&XTW{w(FHXXD+LH?Ov%a19#aBuZSn=qKY+klt$zDu@S|WPuUF<@JGJd6 zujg@WAozTmp;~6Jyd-{(%w>f{@o%thg+WA2OHI#~q6_$j+4|V%aMS`w->7w3?Zz2t zehNMQJ({okqr2ZMDw-E0BE{sqxPx7lj(&tjFVjLd&Gxitt|$<*%d z?l_{aLFW^|Q-lI_5H-Vx#q({@v3u<{tVQb7B!+@ZM9J4@N99?CEIq~yes6ZWi683g zTy}PV8eERo_w6-Y5{Zi9EC}?xaSj-G0e88_@rZoc4xcxV(Q|`(o^MA(eF4lAH4ROE zclV|V3keV2=JuxZ>ss~X0<}UG+qI2~j#a6N22O|l$7o*dw_a0kS;=Du|LrpWr+-Tv z)&|MR56x~*f3F1G_iSbxyC%%16_I0!!P~VNNvB7q1%B^0r@wHq5C8h!on8j)U|TPh zl?WCvBPb|;&e*K?8{CcXb<24N*y1Y98mK#e?PbF~#L=mT?547H4SOGL9Z$}8HDL`B zA(LHAf9Ocoah zM=zkOhsCtE^MbzF@Af?wQv7>&FnJWCOEp?%gY%knXHK|e3)J1DWZ-K@9C~b=ZZH_L zj_&^!VD?o0ri6Y%$|}e#S<>e1RKEBBKi3t!2P*a};z)xi$pXzW69HQkr=-8`Yw0u) z)_3nUj}i(AI)782(AaKsBfOt*CFFl7O|f>f-#D1D$kbn|(P{UadLcfZHc+jQQ&g@_ ztHHl7{Yjm1#mUBpfk|>SW7$Dq^?e`+CTsWCzx9b!Mno{eztib=N1);RQ2s2;m9X30 zqx#9^`L?j3vSA#!?no4A7bsmIBj~ofZN5xpy}aHS$=t z&>>)e2m@F-a4zroabFUJs*187RIerHNdzFI(TJgV3gZOd;Pu2zO*uRUVlVWikC~*8 zQ`GYQ_mEfUBPk6b!ITZmzYOBN5EVj%RhhF>I+6Q#Mj+zT@0%ojfiN$B-+! zE)6VN`;BM4P3w45kw_pOk)W2yDu!HNE zhfPr_Tf(zJY{bhamnc#$n;n1v-}2vFlOYLy>qnM);(W811WJHrMB$lc>wJBDas_<< z2pj^tQAQ=55G3K-QB|`>{M>ejHc~>ui8u{0fgOBSUJ7N}x})O32>;t5yOnQ@Q>9uL<(4&XrZI8!6BapV!iY`xq6N3v zwMwH_y`p(WF-62y>8!u$)JTn>BmiqJ#3;0U6z5 zokoM>PL@DcJ_akXS>-^FN^=~WAQ|VfAo=P0{}~5>cj%yuqm4xIB8?U(gFJq-}NAjf>iz8oWw$Vjc7u zxHx=>r6JL+S5DssP6tIL4gJfL12H$htq$a~?ItwJ%AY^q4w4i_L`9i%dzG%c_&!m( z7@IV;7tC5O+ePmIJr01|n~s(?P!Z`3@HV_I*7}9|%>!!}0E&Pf(km;!1ZEIioRkCH zWPvHBF`vw=lpNi7&Gfviw4CPy=|A5ab93f~yS_6l5i;~i)r7-jrVODU=+?mxZnWq0 zeV)ObX^DAoJ~*CmDpIR@5EpN0X~mb5$Pw;+Vj?cMLe}Bp=5F(Seb8;S>xcG&t0|#; z`vnsWYMbvvj(|+;KY@f~5AefHGJ-O1go*BRb%930^?(*DVhlhd&}D(hj*%m$NkbK( zbn{z)*6AKLDl2lE6)9f8jdgrr!QTcS3 zv^M!-oaT`S!ICL2;>(MlzpmPFDkEXWa+l83hKEDZ6JDW2MT$^~bJJ*d;w;H-2ZGFK zDFc}(Oo|pq&WJxxGomF6wlatdpB8@6xgaxK*!f9gPD5zdHV#RgGu0nQb2##U*uq~X zX`x=by4e$^jEwQ=-&VF>gRgecc!2@i;G?4u6u0o6dfQPkM;%*EwG}( z99n^d)D<%{e0JwsQcyCmUPz)Q!S81lDV4=x4*#2-v6EH?8Rye-h{j z1M~N)kL1{|tw0wMHYk%7{~ngdWXkT#88OaxpeESO?sww`Ulg`U+8a5Zp*{gc+pc26 zhiCdXWSoh_8s9A!59^{maY)C|W8|1LMw`n&SO1kmP#$*5V$9qJP{J2}*XLQEowHeL zgqDf9!$^3Paf9q`=`X~;wDsUwc`Lp*mGQQfd7aR$KKxZ(lBV;cR?XaC(leQxV-6On zPe5S4^b-S-<|tRK+Ldxd;l49OdcN3`aG6APY+lH?a>5xWU#CHB1J~$(v*<9ejk-Tu z!u&RFZiA84aZ!gO9+kCT?~B} zSEQt+PY$5lu%C8OJ7Cf-;Xc~>s6*7FWZR<79v&s*jq%*8>jl*W&%%w)%ZYn(h`aNS zwocyA;HI!XmAG@;x~+|m{qYkWN*>0JH4Ns`+Wn2pk5YLWGDoIWX}}|zWNgAPD4ln_ zBUw?BB1lGghYyK8rpa4J7U4w(#z92I42^RjgOArFttGf@I}oeGv#_Sn=dGF3wLnb1 z4o&>Bo+Ck@Nm=v1p+xvuAqm796oVpU8veU5i}mCJ0+EWRHDJ&y=|m0uM}L-u2F&X6 zTBu6CW-k7Ugda6zl*~=U6K=7rb-Dq~SEeL;o!n2>h=?O#FI*WG7TfsKL%EVmJ(eHwH9s) z4s9S*60DjxY0NYy>V>mNSL{5bOEVSRQI6 z-<_}Ia5TM#RB=Xd(3*milaO=^glNr8FW<$7;)mB7nn2=xbYn)%cui)NnXQ>&W}#Mv zuG~LO+5nmJ|NBu!yV1i@1qJsyV9V=xb)qI3HZ{x+ph#}0L=F5rN&XR};F9?TEdm9( z4T4c)gi)C}!Yp{6lFf?ICAnc!?hNA&Ckx{#@6nE3u0CVxBDml?8AA=?MY54O)N&no84 zc(sGEL(Zs|8ZB+Z?Tk?{p@WU6j=D4PyU$r;5QsNt!-v5o&W!pgUz}@=~Wj&$)JGhtE4Z6kxmcJc)P|^E;g{`kjf) z>Je1l${XW0YlkJw0ZI`s;vBE$%y&cP@sAM}q)sac-q+j0MGNq@E%%-bG_nu%+`Za` zocSM$qAr|MXxR@1b8>m9QPE7-EL`!$%GE4XWonsHii+9-F+tn_H7lVw{6T7eW8Hmr+-jd$7aGYK=-i$bbkh#h3Nn$s=P*pTH6^E9Hx^GYsz8_a(%*el>D>zS&wIu6GplL18I{ZY$Sx#XSuZmsS=o^dm{0 z-e?T{VR%-V8_g^f5@;@?^qC(2;a$Ye5@=da+-os|k~wv!v2*iz?l8Ah9Nkwh`0&yI zd-!GxcS zWF;R_CfuvDKkmg0|1y{V?Av27qaeUoz^;bagtDVpXSq8K!;ZC_<%Is<%{cKtLc@!= z(a;nTbp;QCI{J`v)(V#ccG-hs4e4AqC|Q6i0^HAOzZiRR#A7<>I?u1p7F>H=x;AB2 z5}cm~VP;hKC(tV18m|umG!WBo(gami9}RtX>)ye>#*mNpK9YJ zzgWk|#r%4k9^YyguOW=M;e#DVKPCOvR9BypHuYk&<%0+oOzPj*Uewfo%hq3l`W8=* z@IH#27zu@ca>{WUa4?pF!^wa_65H87@LpNzRbHEyinkl&TMy~Hv-JY|0u;pp1hZZo zxewNuNLpBsD;Kwx5b8$S4w6PyjzM9CQ*MA;jKL)WOi)X-fjcUKd+R@I7B?Qj2G zZJM4a*sJ#pZcak76}`(AmYAvgbd?&5^6GXMri!05AKDU?Ds+MV8%b3hPm6ynnhCwr ztM#Z{DS2_Z0XH?M%J(e@qP4XZ@M5-q9aO>UHxf>w4pY)s(fXzaEP{9G(k85}tV&Bu ziSoCb{$iqY+x_osl?Kk%kYNK159(M0xE*-!Ku8A>hixW8OUBchi4!X?)|u;b`TMDY zBel*uQ-jUmH%V$815*X0Zlj-lcJ3BG5s*RXP{!H8Y!kF{>!Ztwi8stwRMCRDejrSS`)IYtxrfI4dIj;8IteS)3L&{DwgnJ-$ zzH0G%#9HTut%`gjp87jkF+Z#Ps*DHqisAIUSJK}8^%9QOB%yOBBIEj*%;1Cikrcs< z4o3$1)`9bjk%tQ?wWXycvfk0DVQn?YvBUODvO+m;baNr3$@3Iq%M~wU6h~XHki z6e2Q+wfdXe+tb?2bXdvTCPl*t|BnhAm4;%F`h_bEHR6kO{FgkaX2Cg) zm!iD5xX{TlTKt3jNNO4#t&qZBJ2vqvk0?(`>R18}E`Qyt8EhdyLsMSRgJ1do5p|AH zfq!4T&bIBzw(Xki$u=h2_GH_hY)`iBCf8(lzrX*zYu#S-qP2QatEjR4DSzZ#uNPlgm=~XCr+|agZYCION%#@HTWGWn(~U5m&99rH{HQbQj+&S9!u5=}}`6 z8cwWk?1({kWwVy8w4%=OLT!)Vwj4GF20J@DKq$qEzeDngjI!xS)M4z-^>Nx*o+>A~ zHxCXD2AY+uc(K&cZ^%SPSgG=|#cn#X3Zegtm!FP31yLAs0~=ztLDKj|`?U)fO?33@ zpKJXpceWX>jACjf8B}$0nFl3P7WW@qC3fz-m9)V4>v6nriXrK&67M z_Xa2}sy%82!h3ppdXha z!;+=x-K?t1zxf=2f4^cD>cA|D)B zsnfr!ti+SwW%@k#=R@i0e{iGRI%gu8igUMB=#wnzNFsYxk>ZB)C8U-yc@ z^#ah*&~R`7cu+2Yj9rq*1Vk#FwyX8-*ZRe}lu7-BF|Uh}NkxO?Zv*5l_S^f{=iwf} zNY$&O16ll1N@*nSkBr6NT3rR8TWc`spHO{%eOvW!>+2rhhJPbF-cQItLhJTavVD!`Yv=2RSWHwD#T)p2 ziHi?0)@^lv_*!Ksx_No$a65ZhTAtW${tI8R*OTEV#zQe>!I|5Pl9T(~D-&Ala2`1i zdyU2CLb`t--uAxn|B05ErNfuD(c1^<8$m_d(=-H2OV>Tw+S zo5|xdw2)u2$PUXY1Xkl;h&6w8qu0+^3eqdb`y)AQh3tr#8K&&SNd|*%g)+8Hd4=us z^KS2RjXXWRH(u{FrXTe2;Yd53u-*;$PZ0KDKpB>MVGdveu^;Fs;o_HKPm zmb;7l<5q{$8*m=?PE%2Qe(ZeC0Dj}789jg$^?CkoF$2Z75$xM_{71?`ud@SSsO{F@ z7<`_sm>eWQKS>GsrSr1zBQf;oX3>9GdiVkTQwQ86z!SHIhGwl`d((?|1ghZWA1qr!rU?-357NZ5RKpmh?361)Y4O#S8D}e;ayq+KgR@p_0_g9 z{?_u2Fh)nYIPo@io&~wo>o(26Q(_9l73@$F-5~e+ep(wS_WsGA@px>is>5#JpYlpg zO@&JKKb92y#` z`vqbD1c2GA^E>o7m9w+5&Mz*Sv@YGR1Z~eRlEygRjmdR0B28Pyp(Z#-xAy@c44`ft(*TA^36OYDakQ55Ug=nS!u%$`NK8!p%-nTGHF| z9yzccxHiAG?sg$QpIIS1&>^x0g;c~sD8%PY@^q;KMSx*9)h%;;& z8XD<6DPrII&$sKhmlsG#ND+s<`T6#ga?8$UF(-R4vCyPlqx z-rC$_-{Et^0Mg^l|8eX$fN1@u+m)`JAS58<|8IX72+Td38&eY;!jmAtTH4tB==J-U z@&6YeIxNv&KpJiwFMWJ^J`#CC{`K7I|Fyf$P&Q~aTW*a59A=p!Gpue zo($x=m>2k5-VJRB#>9ba1pDK2b5$$reBQ^w%+A_xPbu+dKP5<%u(L`$!D|@58#%Z5 z_j6cT^kW;DAX!fLx7U=WMXABTU{ut^60;*{Wa6C6%(Vuq1>ql6mhJ>G5tfxU{AnJa z%dws8sM|7nUrG0q!b1N2jNGx5Wg^#|c5lKv`63SOo*&b9^W(r!y-%*-J^pG-vE8Yv z^f&L-Y{6P&WKT<~aGjn2gM%nISl{-8`NX)ojpPVr5cree#AFazPMpvK^^uW?ThEg{ zafUqT{Oz0j&fV>uL8p_dwzjsgaDX@&OV)o_%^#;d1*yz zqq8EISXcm?3On>BYvjx;TD+q=diwEINnP+ zS;xgr^&=xJgR1Z%%#%Vto0m@ETSmu0=-xz2!<#P?6GGP*N)GEBtYm*F<%UFFY^R3b z&D!e&zT9|Tnnp5l1ka%(+&`)~@R2+o=i?+rL4Z`J1DM)9*Y0M7Uha*?yUR{-ue;yE z$Ns@4gafmQ2~*ZMFo32Bq(OL4pr#SIWp3zoA7Sd07C9H8hRtNKC}VDx2yMKv?u~}_tCrFL6dh&@AI!GNeCh0S zTQF<5!)ovku!mQlprnB2X1|k|n+a8qBnqF*wzz9n)*TRO<-_fHN{5P>QL720ogaM003&!h!++@^rcZUf$4Ac0$`2(k;b0DK_9 zMqy!K=batDK!?0P&YGw2xlWsT1;6Ysz9J)iyXe;M_^_mn2n77mbAjnj&t6(SRezWLtl&fQ{G zy@rJqcpRXk0~0X7T6?m+Qmw73rq)#aW``}aOD72wxz!7m6BB@#-k=Bg!xa>eI+o#% zW%nD$3%Nd;>4Bf5p7Z>_bg2{tC^=jSoIvNCz1uA5xV3V2%So1G#}(a(O7^db%&Xwk z{-XV7E4djKRmH;Ezt&$>(ayo&cF_tgg*~v6)`~fZgk0|Ta^7HMEm++i9r%gZaf zygu;Y$S5dG*M6G;`RYgubp4fOyR9}@nuMuo&&zcIK621FD+dRuJ;z^;C$pppaQu+P z!(}*5zd%6$-2Qh}%!+P=@=8dwHaBbA#eI$Rek4VYabd`AO=vcMlPJMU@zQ5iRY{n^ z0jr6T0;i{?&q}LM$QI1=IWkw7_cU-IHgw9rX-J&g;&XR(cLS|(*y@6`B^Bawm?)j{ z6YQZAG(hqmJooC=(|>ymv)`z%cySFjY#AU+o9wsM@6_kv5)xwYyyoi7!o!V*L8_?o zYX^+$$lKn;^sSYZaJ&fe$Uso~nMIM!@&@3naoVlB{M(l(ugc3a0K6P3qGV_RZca~+ zgeAIr2S-z7JPZbpJZ+$>q9(qBiRptNPs(p({;zj=OU*6(4D>hfNRM~O9$(1B`NKzM zrkBWYT$5FRV%pc;D;y#m3o~uI!~d(1!-fo*@OA6j&;4QEOeb{;%d}3f`xvkc00>Fp zbpTM?VL$l#hD^N3xhO@<)8+ZrvV5FcY(f>ikQYdCvECN?$c;9f8~8aY1|2*g#^>$r zcD1>-vgG^EW#EI3E8FXQZE$2JuRFl_as4vS=S5QSY4=PW-xz6Fulr|JN9E)C(nkFV zp#TpHV*yV@Ij>^$yC$Z7p@AaWYNxdV8Z(aFM$cVZ@5{$~*ZXUU+;$e%W=Bl;&8^8UWeKyB}-%Kd~l;-hIb7NrI zas3eHL%tSTU72e(dVxy_spX38UB`HZ%RtkNMxV3kLkA}*@%zBk!e+XO~ z>Mz@g5U&J=_4pTs+cdP|PP%n|Jd2(`c-*AcoOQQ6XL()Zv*j^HrXvql0REe|fnGgr zX7wM`6t7>GQ4}CkdAv@yKu2S+h+MJ?@<8KHV_EO(10R!(K4|mE$OtjN2MYC0IahjY z>C%Mey_=g=N+l2`u~cBiM@0o7$%w-K{{=Vj@$rG|#y+^f4e%Uy6tSDv7lvo$;n6lQ zsGB>>OY1#3AxaqI01qBSH%ZcHlwjrgSNh4pzHZfs=kf~Z9UJCo%E4TIH&w$SvYnqc zhCdPCd>a7t=$NctGl<24Y#fN*BKm&5Tj!Ng<1aiko8jJX*ZRG%U?8&ji8RHkY)~nZ zF5LaNvjG$bNsZ{L_4iG#^6_z+X`1|g&oEO&J^@TfjP&$?FqRYzITmoDxnFNjO;7*P zGX?G4MP8fvZ94Bcgw!HGhln)x*NigQ$;AVr2{aNE9D2zASFW;(+UE9Jf%_^$p_aC) zs*)ChimB3R4C{9T)o{!DAIY!P_rOw3XwXwlCS7q8Y`$h&#q^Rw&VLie!o!m*>sA4*z+McjBFz2j3D< z7NfJ3h28wh(_YR>Eom{y8?9T4OPn=lHMMJ2!=M*WWX|t*Z)&fR_(1=)7wp0eJrphY zC%+Z%)CVY^s$iQk={Q^Kg|KC2D-N9((38+j0En+8yNzoY;7rhBhQTx!lu>M_%E};x z%uV-vXYQ^l!j@MoV;PWO(8RDf66|o@0OdYM3AkX=Yhx9V%!T%bGX3SLTpSHLTH%n1GV=dB#PESxhO`_Bi*oms;#6g(0Y z9u9`URx0f^64;Z&ITRfooyw}Jxv`=WrR~&G`V0HRrrv5F#+;-C_#ZWDK+aux(zv;- z)XdcU@As+cjhw>2azVfVN$tO>E_30HNT{n~Hmg$QE{x+0O0NQjx!Qb3e@pm!g+)}q z&7V2C(gL~6T5-D-iHTV~&y}q>Y|S?vXL04o>`X$+@Feqq%^p`100v&I-%0toC_@q- zS37OT*D^C63Qg>T(#-UG&sCreqAy#&hR2VdXgCDbc%#Mc=;%lqYM}q< zZ=V0>w_gDU5kNCDVYs`3`i86C0Vo&bS*}}nLolb1!>I2VrzQ@vICRir@i0=a@A+t z+zD)igXgZbR08>qIKG zrK(G#bF|#CoYq6;>u!CO7M-yT;5EDE;y?PnZL|Y|D${UL6ZE`M;@n0Zd0Qsdj_`pIr3s6ryu~9!ciC zt$L85syw3F@s7W;OJfgzdjo$(Gg(E!?$E^K>IzTU_dI*IwuD*eISwlwlLFfU3F=nY&f7a;38gQR|kzA4EaYd_u zeD(-75~)otKKC_O5CXolq2u}uOJeeU{AYE`6FLZ=B0AHVPMvSMSnv}l%Ghw8%1+%J zJ0u=hr%vvbZQ@>inI3+6-ggI1Zm`i)w{EXtq9XLsd+PNhB-*JkX@Tyy(nLM!1W{3+ zMF!Jsr1@HtQ&tViBcVhw?<9H`)v!Is5PytWJI@mB*v1(grbOARrF$ejbPdoxso^pJ z^aR?zF-(&%)*dgRbu*TG34YDrZ|o!4bMzG;da?}g3rnSX}J0dORJkR`@o7FT_)!CY{Ha3qem4eX(^ zYgQbvSjqU6k^Wlwx&78HH=-mO(=MRw_-Fs?Ysmb!8Nn=4rs&{7;9?F>*dgA{#Y>Hl zj`JLl7$EPWbLv><)#2`U``y61U)bhxQ@En3)uW5Sp{voQsa29k2+E%_Yim+cKOE5n znaib`o;98lJ*5pTdPIcg;Vt`wR$vwS!!05J(w>QIV=W||A zb{B{A4*x-nH3V27=I9BGy&+r1;Gac*M2WD$32?4J4t|s4KuvElZf*qaHHO`=E8@Tg zgGtjVq4~{0p<<&z81aEd?3i<%;wa_|WRB8d2kpQF;;!;|8*vA}qm;U@)+iKhgNZRN zwrqtRg}u0ENDS2J?#LwIN5@`AivRf-CDU#r+qs_$gN$9&TJtu?Y55~l&r|JogHVNw zqF=X=Us~RW9Z4rc5Z{S_oHG1xSo#ZAAVF@Wr3FOWys6VbA#0bV(jy_pV z?{82>M*iB*3-ZpR^+K{7Tmax<_`f;pm}JK9vr|IOpT@1)eVNY;?mD`n*fDb470J7> z%577|d0i}I!9GchF4MbE4j=h&Cr7BiTk;#F3B7TIYG<*`VmG!BeQ3r3f+%Ovw6U;W zLKyd^j>xOY-rp#C?*A>w1_dSVcgmy9z8UH|CP6$-qY|R2Kxbh}_cQ7s7V0tZrjRix zCq(VXoMdC=Bo(^qvd2X~dLE(Q{ukg83?}c4$`(D`wu>=-xm+VlQ-RHZ&grwf!sP#fGhm{ zTqJC4Np*yh&F1ib!9TR5Ye<>CQRFZnHPKhUy;-{w0Vc^Y3!Wh&5MwY$gZZ7j&{xzY zh#`P&H+3vb`Pa5*)N?cM+M80DdX+l)9Znh+vaLVGfw12V!d{w3R3jv^%*|-p5aJez zQY7%^tx$_HI2i=03!wTpFd$A4XaeI;VuNEB&6GNH5p~{;YhEIgRp1L;I66y8^s12O_XSsw-!Aq)zF4vN_~ zpmGp|s-Q$t41JO`qZ#O5HoA;7n*{v#xWR=O8&&)yv1Ka_3mEj;h%+_LbnQhv_yRF>4Zqelm&N=KVvuA4&lvnEWW8+c}eI zx1V)VXjllEIGL7zRhTi7hGA$YeF|}CEV;s6Vf6sqRqYKiPG!nJ0Zx&L6g<<^Bw}WW z!@1%GvF<6XEL2lW{&7qsfoq)vkik6DFLHroZc0ZH#9MhP0X}Elhn3TKI#QzO5bA95a!4N+ewHwKmwKe175SaC7q8bZLf_xtdO3j9l{2$HD5-wX>s8HciT!>0dU zNAy@+Uc#>uR>o)?^18_4OgqKhfhfbbak5!We2+Z6MRYC4K_H_ zQk78G*DB4<=(Hj`G|*X0%;4V*=d3LwldE+97lPn<`Amf1E|@5!8z9zEPQbyeaZXad zUGpkwa`LJ-E$x-&(AeHccr85fvQf=lqGaP?$C|5k*8#CWiCY81VOp|Ov$L~&(l!?^F81L{AQ_XL z9T$hhML4Y28g`T56x}JWpn!#e5#Z6(!npxSLYLXt?*WGH5!jE(WhoOaJ+RNWN$xLB znnQecPL(}$#nU87LiNyvrfE2@qQC}L@KMMRWoNE+k|qSeMNpqq`f zBC7JUj|r!1`M$K_;kyajlPDq~Y2y!5Va}@vlR#u~#M({zLtw zK3uT*X?pgm2*}}-LSW6zT4#Vz>)%3g(Xd(q+A$VCoCPDt;j1qEa!)%)+}d!Q>%8KDzQzF|7_^cPI<{&6-)FZn{^ zGQ0ZqnN6~5H?u$zu6JQ>0U6;s*WR?bjWV*moURUnwM%k!z)aF>YtQ)r?NQs-+`6Od zqFt8K!FxfT?&nlKf<{v8aYo>FP@PIc(aEOyp67eKA&n`xQgr7LBTpb1 zFSks3nmppu6OUDyd8aY}ZnqOV#eFUVFSDHe(WA8fzjGqh2U!LTJrkV4@K6T|;oz&A+wosau zvU2~MS8H2%U>#=M1y7q)|I*3|c%IYEUjTyP1iwPI$dQTVVrXdzlL`nq@9*z#fVOY$ zf22p*`^U$DP#Z88ns48RM@FcanQwrFQk~{7#V^P2VCG^hyGX5l0IoL}JUDKMV0vQA z_x-tG$-ZIzyIbedUVXuf3jZcby(tt4yd#zqPqjk7HKyfO!#UDj1OzzzcDLvG?F+n4 zy9#sqX)Yv#qK~r5+y-AI^ zGI>~X%cd-Wz0cx#VK7-wVhW;ra*0Ru*$Te)u%FUZ6==80E1WQAd;?u{$V$)REn@6zgO#G(pbYAK9u6zY;feeaBe-%E5)twQpZp@V^k zB@PaD^1`$^>H4bQ6p2pl-~XM74F8>pf(UCW@W)fKHJ(dhvryXiZ z`17isO=Yi(6WK*|a!G$F&m=@buXZA&#FeX-bK(SA0QV)3I^f{o@M(d%JsR9faGw1 z<+Gm%U=e^mB(OHNkJeF~Ob75o6EfB;f7X$Kg_dukhF1;iQNA`^viM~Z>gXq|SvUh51_eh-8F3^`#J9S(1BL|rqsjPJZv z!vTkTc%CBTB7W5Ui@zj7<$W(sB2U1>PX!o>!00*Cb+dK`<72^|DSv?=yA^4((3y=n z2CRxpUFM}t4iJ6|jKPVOyp<%Tx_~0|MMiBBRTEx3VjJVkF`VN;DOwWWV5K>BZL?Y8 z74;F_I9pFr)Dv{)KgE{;ld4cl7e|gDZEMwhg%UyTO zk_4ytI=w%e4Y8lKy-`f1Yt_sb4{M?LhU1xtRn zBz>`w7g(>Fz59yBaO1c_n*2p0B|-7w(*eqLVSQx{sHEW-*8S!%QOT?za+SE$+kbDw z^7W};gV@eCu23~|rmVrR%B7_Al{K*g zNv|xD0Yh0cUbvzw&wsZTPFxIVu`{xNO--OA#}V$M!7DU3+9Q$tvxClumC@GObH8@lmM~EGTwXGRlNkLJYD? zLP1elP7l4THmZBhoT^}ihllehDpjb}4+gQ2(9yy7;+QbUfh~b2rtINwz z0*h_}G*Q6HE1>>krKc9j=S={eMi)i~(zHO*2dfC$Qcg+=S{Dx=pNfi#XEY#pH&u<+ z&fflbJKq)+74>GYImj|h)z;3d(eon=(PlXe3KBd|Jx%jsv%~J;7V})Arq=i0?R@*4 z|I5zjMPJV-*8?I;I8u;Cmxp@0^+QyCegGg{j*p4i>hhx!;6V5CBi%DLKTA3elg$5f zAQgA--dwiXecCwUujmmWUnJ`D%adldqOR^5Fb#0l{P4fk;+GysdW(0fUPI~T>ME_j z82LK5_PZ}KNba@H%v5*SIU>fvNcDN)HFPnv8eTuDYOUV5f7V}@@_z!p9ZcGq(@+##T$KE77Hk)Nxhs{P+Vi`|tQE_Ie&JI{4A zB_uFtqNJ}mx}W~aT*rnagd{-B%bcK)pv-#%p6cAPC;hAUnN55${4L*ykGkHKUw1t1 z85UQIY!>FzPuuNm2KFBVJ1g-zY71LyPmft&J_ir2st((!@Fh?q3byah=pD@rtIi)= z0^yIBt*mU<*O$Qwv%@hlG4u=!t+s1FX}MwiSV#V}+O7XST8IVJ7rdNeASvJBzq_Cj z@~@91^@WFrKgmTwa9mm8bN6{TazloG$_>kX`h46r(0{dgt(iP*qtpClKRT2NvXcOK z4ZV3^QLG2<+q4bjzIeVO*m_9)1V3Y^zR&6d6H`IwV}z?>2-%3}_{b7X(9l#gH*=7Y8PDVjC=ub<0aU=6 z>S`cAbddNF-l@YY?A7}=C0FJH?kRuOJ_~c>;`9?TUsF%7)9(Wc9J~k-UvPq{?*IzH zTc?DcyU%?ibtd@zgB`A&EoaZr1pamR@`{CpKiBQNc234*cSdk~Rd;1^dDhsb?oN0TzS_zskuRfd<{CE12%JzH5Gp*0h&mvTC zFbKb$@_($ai?rI=*lcupHa0Z;1LTRoN5R*xls5@9C|I@g5GZJ<*H>YJQ3>Bjl72fI1)sd;+W2k=U&(HGCIEV{XFu z^;(dNkM`&~c7i(ur-AHQfa=eV5%b4n_V6M1S7VahQ(|f;vPMExA{Z&=Z(d`!_j9ox zB0)?{Oy;G27eQ9mpKp(L>An53;1s*3r?}|o3p+bsV^nzoM@=RpNI!o3sQ;Vm`?v-e zxCib*KtM`qBhUy55$zMDAuGdU{)GrnAoN`#?C#s-o4CzNNQyCYDaKj-t$V?YUizIw&sy zg;s7tfq)0jyZ5-%iif+xz_Oy3WSl9#PPhlK-BdfK1^9N>8C9`Gdq{ zrR6ebYHHYXjkxx$tef0qq(=Z7?LY*+;D_hiYg=chVoWT4Ha9MwPX{xf``h0iT_@9$ z;c+G6Bd?vFWyPD>yJNN|wVh9dElt0l?r$J>jS3w$SLVb7ZIDdYNq35$;Yu_vVJR&xT@9v>?v!q&WX>$ z9{ht;C>0Xo)!rU#2Tf^cV}g#8Y?urZ=6^TERj1bpC43H8a06B!;s_NZ71bgr%09rE z{!odB<%Mb)_KXY<`L*n+q8xvIye-Vn|Cf38`uljZJNg)F5bGKn@)B;)>7h5R+0N%F z8KS2&-h}&fcjCtQL+DMGR4tb~-yl(w=olXhpC~EW@t?dFbrT5!DzL8E)_N9kGs_&7 zBX9_&)IT!VSW#*}g1vF`E0<2wuDTisYY6c38~T7G>>eJf>FAtYUn4K`u-7&=-gUU1 z8+w3}5({{#Q6^^MW|nSsC87DxEpKKjo%RhGJY7N0SrobXb<;6YZf|b>E-w$6Iws=z zNzZe{ihzpNphSDv%(29`zR~sav=X9=BrJsvJ~%eVf*odJq#zfPIt!}WFRa@X&6-I1ZLn(o&H0^V08+q2_Gk8YfvJTJ@3EwGU^a3vaK z>XnN_A8*JYHn9i@XKJ$jhtCbcZ;ao{gf)4ADRT;)rt!1^2oAV4x(_W326*sgPUkm% z5qFz6&8${dXek9E0gWF&X7>LXe2rweKE!V43a0&HLVf}kI68uG9Q50r_E*OM-!YKM zvwL_wQTn&Q$WS0s;az=<>V(-LM|K zd;k;_DxgiC5}jVCP0k3s4;Eu8D8zsY5VTp^J1R}V>45T5CXMycgG2WzGcyS<^bud^ zIjWXo-it{|jT|1DDp4q*5u^zlLTjd^1e1S?PA(MvMZUA}q}LR7G1zSaA- zz2P996R+^Sb7OTK%q)fGFi@oI_V%{Cs}F3t&HMU6=>0`hYbbUoIdWS>>W7!UQ3hOr z-dlX8j-fNdx1*nu>)_-9zCUA8{J#I)yTJ9MMEiaB4@p+O&4uUaS2UX*Eo!~?L64w* z3Z~g(iyOd){#kKxfGlLp#`DYv3I_QKoyQlQH|5>wMLF{AhEh8~@oJ~t`{Nd~oE-Fn zh@xOA(C0r7t{$wZnTbVKQkIE{QASQK=t~%MIKOmfn$vYpO$lakQgT9@(FYYkmhJF* zuy$~`E)WaP)XC()%PC1TGmwj?+Bz_vl%OuoQ#ACM93GF-v7m}?G)l~?-6{T6X(w;z zo!P-Sq7Qcucj)NRPg+Kr7!UwrsYDHueCVUb-p4iy8Rb4c(_2yt8lxaubZ%|4(`vy) zf-4LO+@3v72T()6@2dlV5X{cbt{C_e;^KO~KRYRbKm~(p&=;fNxlrl7%1F#br!^Ea~ih)nUZQ%1C!>Y7V{!p-_t7^L~4imzN(H7(M(?M!x16f8woFA{ zyaT}N*(IJ;m)$VJD$pPEqY^3Y^SGzXcz-+o4z{&?b{uP?Q^U*8Kk#SSZzgc?16=Gl zEbQ|8Lx?20*RhMbgsa-(OP?yK&h3rEZgq7wAg9}lUoj$68jT}b-2jxyDV^SLNQPNM z&mrZ`iL8k@?6`~I_1U3`kqR|63^c7Qoaa{d&P|QjkrYa~b?z6|w$}e#o;vbUk(3xl zuNRw>tDYQo*cQ3wtz7?3OLX5|d28BlcDd1E-gE)q9~uD?m7JX12NQq(I6-my9ZZl^ z*~Gz&2%oTI!5YLKl#zp#nShv(&q=hdun;bp;?PA)-;d>F>HnV&SQLgK0p$+`UvOxK zQGFBTMoRM$iRQXw<>xlNv^c%AS3))Tuu2bJ1qG_&*EHYV+bX#l82BRAK0(GL6BOde z#l#ypDQ|RLgt@mH5-9?p4VwXiu~-d2I5TpCK1YnlUa_TeEXI~!sn)XNoQ6$AmY{;oW)kz{X0W?>6j2g_C*BsCuvV5r8&#zNYH;DPm_ zse!SFd$|gq;*_Vhw|fGAb0CM=-Dy=6EcUp}DM*y7eTv+*CD5_KH?QK5$L}TIx2G@L zabjq)vA)`52d`DGQ?KNHwaSy_i-ll`OnW50FOo?d*Z_QBl>bB2DXvE#A?-tx;w8 zHE%}{BVS|vgRkp7m_Scpov#Cc*p!H(YE>B;Xrv@Zz633R_NN|m+D+-bdQr+mrm?ck zxB9lXHx=)y$On}sdEQeJ@={IHP)Tq>wY_@ zt;FGU!zL?w?eu=USf!zAy(YlLgL<)D`wg@Mp-nB#Ob`VyNW|+6gtbKyJByrUL`a*l zstSwm*Hfyz-LGlr=)kLxyz&AAMVzc)n?|?m+_6oMAm5-mc{(_`S^yubxWpfE$(+_k zv(3&ldrQOhg(dI(o3Uzd+&QB;KO(`|P;@5B?vKX}66(!VVTcaT52#(T1R-5tf$mJ3 zb3pxGlR|f1W#e|a3d@j{kWlaZcY1kw86dm)eZKt7$;oMNZwE@=hldAfBmzqZ2Vj*E zdbi)G!EUmKNnAYb82g-%N7+DKQ$wr6c_Xgn&vIZ-|K~QSiHWMB;`PPFCa|Z0iGd|1 z@ytKHluR+0G-6FRfuNXsa%$=B{1a+=W_qpp!{+$J^sM=Zm(&B>wb_f;^H!USU9q>} zPMn?zxR`-&drezCH6vr(-l50CYja1~D}JlJD5=Pl@W2`}YwZx#nzoi}Q&UH0$MEow zez(ujY+&%y!c~c`{NuwTX!Ol!!Jr9wQOy)Xr~4J~SP8fXk-J!Lu4-sV#OpMqE|P5Y zmqLMg-U)7?iQa3ZQ=VfQUI6rr=87Z%< zh4xM!+vi|s2eNfL-6=Zi8nk=$)$*|?k4QW`JXG;{mNr(g@v*_Q0V%|IKI_AQpt8*m zjWf-%uFmS0{e+!wI(#R~Eg*w%va&m0yJ8>|z>XxZ&yBR0>xa+4amoJ4ylReVke z>3e^$ya{?^6EyDSmH_jox3@PikpjQ*{+r_tEFR=v2?a*pN|7O;m2btq^KXd;2dlAG zXjHt~eo*#|*YHDIJiLnj~d9nVOF!A|%I~f1wtq>;egeU$?`c zwYjg*apECiW)>Fl@$tckPiIwiDs?ab9~vo%xG!vUR61R})oud{?CkV(4Jb_kb?~Yq z&>*)38siD9w-n8(saR)(V3YfX>Ng(z0T9VE^wQ5uX!q1-|7h8{sF5G``Ws9}`szU@ z6EZX5%*o2pg(2(BDte&yfD=njPVVyJLh$XPvC(Mn*@d}zd2CwbdbFV_t3tM+iJ~r_ zgf3jE(tCrC?P?qU6u-@j1(G)?VJemvzjm&Co$rUde9UxS{Cda31h7$c3^B4g8)H9M z-&{X2F$tNT=qLy^4uS4(Z_cab2NFptRawrDv@*X*HY)^zKwpnkP=@grI{>x)Alfc? ztD8f;Ikg3eW6DnKKt3$GDm0}eJRHA311P1laB;M7a5)y$o?Kk!FLBMjrFU z4ZXO^$)f!8YF`@{AihW|0px(w-&i9tCY6LC7qcK>kPRiP{^VVT<-)bFa}FyubF3!@ ziUh!kGRCj7VmdCCe$V3P=g$XUUS1K|NsJsi4*LV`b_q%f@(5BqRNvT}8I%_h9v+s% z?F3x2U|s|f9Ys~DH5%YU`wGnXHhBD-n+x+-2JLRmCCxcwM+Ce+iz72nF4ENZYccoo z^(oi7io=R0u!Y6d_f>U0LCe`^1rP)9_gezf5RiNexEW6iq$1Qc$xHj zgh_J~ySwbn4SFMab9-5uR?g-2uZ~)VO8s(3X3(=RC2Ya}=`v=LDH^Jx3D^8kZqh_rn2TY;^?TyU+&X*ai z8>Wh?Vm`NS@!{}y=dw(19pEUaDF$B8qP(r#%WJ%W1IGImDuUv7K`zk`_=UPw`>Cnv z5MvNpW@h#hBAqHj1!0&NS2l7JZyUOjggSL;!b?KoKu|p~!@il&c29mR{MysjYf-k6 zp`qXi50j)hivd?!Jy)ytii-C3=Ba5tZ>Vrd%8`ueIL1^;EYR)GwNq`qnw--oB4Lw? zrS&^(!P0+DPixv+d;M zlz=|D4{Sz>lIBY7c^!?XoSayqK;k@QWMu5Z9{Wj1Kyvr3M@K{e3yC0H=^D&@1L9zJ zWH6|GAVZJ|AnfpHep3*3ALSK`b90G_i7fJdzY)ekG(nP*^?-qi2asuYRO*nLQ(FO# z1z9F#NsDit1r@rbHFUb!rf2p|(qsnh7nRTvtqLJ<1w+-WNY+$KzTECk8y-mFtyhq- z#9W1d<`OS+OFfj2337!Il&wIZmu^6DfU8KR>m$>oQ%^QI69xynW`+2sf*L_J=&+NI zd<&tQm=1kfeuO4y1NJ1|6{H>R{%5i99}8B+Tw9&YH?YWbWcvnb;SwkWZ6&F&MEjh8 zaK*tC_>$G|A^ycH$*%#Jz;1<0(g`SUNErUH8#P{xyS40!t&cryb(kClivFFI{i5VC z=2^Nup+!+RZpo5jNz7ZMplSH8^1-Zv@IOPt$A^bXHQ?Rpa1dyN_@K%ar#DD)YM?jM zLKMoeaw2t7k?R6U^N94$xiG|0G5Dy&&jALuL5`#%XnZsnJM>!_to<;AO?X%w1^pH< z?C;2)il!LlYg(}%>xVm&gmK}{U_ zj=M!_#&-sVBqAV@=6jWadqiJ?ftrOn%w6UIeU zg_#wmj5>WUK*6KfGkOy&%fD%i&4PjoAJd|}SxIClOsz0QOUHKN6D>svww5cWQA-%y zlXus$R2u&mO^za%+N(kav4&=CNuCoB+}XFNV1t8V9IhLNAAO%*0=%vbNIo`&!D1wt zV^mAwFjS~e>d((7lGdxxZ5qkX*k)39Zfj)V>D%{nQ+AWRmxNfdw>Ojv=U~~TY5MVd z>H0yP5!JGNR0Clt9TLFQGBURU!@|N$S#fckcXM;WND*}V@4t@6$YfA*;1E`Kl`|n> z8zHcaR8>_)MF$?vR{)CuJ{A@hKE5|_z&v|?zP|uBq;Q$4$e5kt%Xj__NIKh`}s36H1r-fTNUeSzP{~ujc^w*AE>nQBM7NkDk+uos4nY17njG z)-#Hhv-f5*&QAA+%FbY%Wtbwc11wMv=Fc~3I#r5dFCq+S_{U_GFg}_OV)#t2PKLsXAFB{9Tt~?Ym_X*8W%qlE=;mXS%jr!4OOFu zIzWcr{i!vpmAb4kOSZ@-mH?hEr3!OMN;izNDvyl=g#rg25Ns`Lxp12D3bewL!C}Ce z5twg`mY(%!5F8KJtVO36;jt>zYBg*m$hyw-N|r^*cvF5U83j-oD()937Qw=Dr@WD% zU%%FYS7|0^Jd!->RwqE_qwb#!(SN$E)%(^B9COsG#l??8202CYZi_JY4-AvEX69@| zVru05=Te73SG9K@R?tH6g|v^_U<(G z;~N?*+9EUeF4QkL(7p50Z~UP=FQQ#wIQLT2Ild{(a*g+LC3&pU0kA|D2(6#FIg&7ZkW6(@fGsD;(;j0g#}UVbd8i;3Lo?vH%(ggRN@v zRm{V)?GS(s@-A+7(hI-7Asb>!hEQNahpq63RZuF(?|_j`BETBZ@WHR#WM;V*KtI z$?-HmK4Hc2ac1OH0T-%x51;aC37DRRTpr*AKA+EKvpGDjNHV+J=+{fo+|Z^|U=maa zEHEHaSs!XGm^4$ys7xUS)ddp~k7U;;Q$luN6CM1** zqfyIsTKp56UuuX#8etTZc08Hyw8mqIOBGC|0Gkr~=>V;e4nhUiC%KjeFo|3?W#S{9 z98dv9?@Atf6r*&ljL=Adsr0Fbju^B+8OW6+_&G5+$U*`>!P^diwE?yu*r23IH|0ZU zL_DybA65z*C4dRUI3l7cET|f;5m>Hd17Vy)=0#?tp&A7MbFs&d95E0zMwZN}jupCIU6@~!7il7@%3@Dfa+FvmJ$d+QfKnu4Q&Rwnm zYYgx3h7;5(WMUrWnAQiW5U=|J4Z%MF5Ro67Qdb#y>zlh|09+WdEv8tj(ki6XC#pX# zQ(A=?+#nVx1Ia20049Jic&!frR;3&di0~6UL7oJF1=d4p=mY|uV#-X%iRjcISS3;l zwMwvD)p!XUDKx5cVZ|dC%)k||M*=M(1+Ky?-=Ii1O}uxnh7>+17^$u}3@JL?&=_Q6 zHBhRgGQ6Vck?K&&`L8~|Ab!|D&^kJhk6J0gLIZ^-6%Ry*mw}Pb0;o9=_urp4W2Ks< zS(>Gp^b-aNV6?#a3=TX;$_OOYBDn@BVS0oP4JM6DiH$0JpPU%@QZe3l9qcQmKp~vK zrzqe#My1gLP(U&*4unTDV1*LqMJgsX+5m$nAd;9GB_IijRs}f^u_mw`Pt8a8?0@{& z2?x-UPiG+_1O--VaE02tf0D2VggbJ}- z!WWDA_^@NjNX6C?`JzlmzAFPgP-=BjrA8(P1%!E*vW=#g&tri>BZb)-TesMP5eo1_ zeTpBd5vi{*=K&1Hvpc9dm`Y0SBpCE~YM0;PQU(hTY6^A7wZp~=76O$i_{gL}Y}Mgl*jS_hfKUL|p-v>k&%fp5 zV{-73Ng*|y3-um=dbJ`JipVF#RC%!6rW-;kf#|p{02N3Fz6-#D!-l~`!{tm;KjAth zfoaAi1ld5oN|6}yf-q_cX|Pf?f-;i;hCI&^uQGzB!4J9r#WW`kcZq;Iovav_2Rkr^ zBtY_07VtFVVm#Cka8qTYsxu92sAMSy^KJ^&=+xi_v_Qe0{}+r4iM4D>?AYfKoIt=B z3WAza6>>cfIFxcR3xq|r1polG8sk^|3W(6~1#G!YNJfF^5C&QV`VltzK~}(&aX*z8 zuto{M35I=Y$rkQLQUQdY4l^wZ2tb9wOy1StCra4CWsXz9K#Uad`v!ge!Wc#*rIZ>v z*b_riJkF@Ga^hQ^#H1kI4B$Le|W~Z1tL{1(URHz7~R1tEi zLXB5DXsCsiTqe057e)z4Os$p4WKyMqDdNLa07eidwN}Lw;Q)YC6!_dL>x<uK5Nf0Tr5h7x66;iA11LKq?LH44~+ME~Ii9xiTKl z+0?^S9+wF}l}b6a;Ja^V6t1N1Lhcxu0O8Lxp||OfRH7u$A;F%IGF%?6pTV9|DOh8e zAT@}tR7oE`zQrNIUnWyPA`lWBR7fDG1r%voEV#grtmlT_LE43QX$|z6>2-bIt~Hec zM5n?7AcrgTGJKCDi1KL457+A8!a$`|$|*P`k;tIFB9UZzoD-4&0~jzqSse|Oit3?{ z64kimYB5}FAaFpLsbxH5MX7cKY&DfN(bWy(QS779bQ8YXazj*d=?>)Qm0KvIyx zw9J1bg1X=;kPcvyrff?5CWO=L^3%96XK6C0Fo&H`GC2vc=&y}PzvL->R~!q z&VZKj`vjO5G)fQ`+=2m|%7qdOv=`P8(u-POM~NLgaA5Kajfsf~>WgiP$4AGo1Am~; zr_uyi5AvrHq=?eJUoPp?Dh!9FmYjhqY1PwJmO>vVMFo-pmaBDQIrf>QS(>F^9{p57 z0+0^B_$3Exuz}>%qgK2d2{q9}0r4%RTEQG0sOs;|tFOA&RCA@J>e5(8nrJY$u`vF@ z<>1n+OPtAGm?>a7k}Aok1;ARo26t-7ILsDc9%&H%su}DiAehk+VoC&4wg$}ZG8Hi1 z*@N_e$ymVQ;+F~37^%`KL=pfA0v;b`8n`PIi(qz{1qr`eB9#amj9{Sfc)XsT9{dHW z4#~vi0(8cFz6Gdk^mL3Jx#^I_PR`?0fp6yWY7n2FpdC>9u12=;%9+MmF8h^ zoC3`Hqy`&f!R?DnRile~O`0aD~8=Og7~sCk;&=UrhbPb$_H4fFWIl63cCxfyj?f zpv(kSDQas-V34O!GG*pc3L;&L+vCAC7)a$4=j~p^h@31ilk6Y_&F_q%y>CHb}2!wq!&yFQk9mf zICxN=z!>F$0*e*UzHkd7Vc|dQT#pJ0+~1buFN3i_NSSb0Ts8D8wU!zmsL=-R{-MDF z0kH_A7~N9B`T6oxeP?NwX6ak>69x(7kWF=8wRUP!1fv1}gVJFK3{4`LptGm#US~rJ zXE1fL>tb(J*l=AWuOq3mFtq$$U`ORO5vvU*O|WXftkG%-xk%>a;_}7DjeGa*b#rqo zFD^-rOPK5%qFY!GboIcL#1ZfT9)P_DS3FV46n;)_d$w%*Y{REluU`Yx|C_Rb0VS5< zm9bK}n9Jv~Ibi%j0FgvI3le_KM71n_s;p80NEjL#g8no*#F7Z{>NTwjwY9Vt7Z&AZ zWp=eSlXeKngl1%**W2B#uBuX}(W=zM>Ckg&>DlE~^WN>^oQfzN&a0-+U*duTi%hbVVA}XpIzyUwOY~~6u(g*i+;*>cEhHuZnFy*5n z#R6$kKOtp4l$dk__YE>-F=<)J+P-!N1J7#vVMN;2dhhLopIpE-HLP%KgMgo@7IF&B>@77rVvKmZ;}u` zOsYt51%X3!U^WZCCx6z`pz1qIvouTJrl0tm1iUXbSldh% zM<$2qo*KGvpVrFN_{%oLRq*R42h#*2H<2U_NpA`|Lt8Sf+cNEj%l&)H!kY3U#(N4h z@==7y*QO9%qYXWED%j6&a&i(|{N(2GFiuz+7#HW}Lk=)rjB;5NNWk{JT&chR@U5gv z)Hey#;kXcMVq_EtC2@jEB9jS3JPsFFBofWON%)o1^okc~Sq_KO)6=7nYo34R6?<#< z-mcN^j{dHWUWH6K+&|FT*g#@kHU4muP-ot|^Ys^-&jp{R)3ML4lXF<4+X?O39bo_f}N2z`y|JDg>jR=ubbYhky7X zH>5xyp->CKz;j}fC6UUhXOLW;fC>q$(Gt@Ufu~@WoLiuN)@-1(x&nPFRE`A^_frIgRGPr`zB$Ef%p;0C|wBU#wAx3M!7~7Dspj2Oexx1yc3*1ym zrX>HcRAMoPF%U(l#6yfshXCYFnYjewi7`+CH(aGE{G}IYhe(A#^q%(ruV1H`suvWM zEG}k^imzb%AqA>D&|lO52;s-Wwi_G9 zTfRbEfq3fsHvn29IrZ&4u91P6bzx#*?a%|=+@0NrApV| zKW=JjTi?`4?UR7RgLX-=V@3);uPZRAYqK;{cH%8HObBh;tsXFCf)j#Jt{|8^r0)LE3SI@VX9> zkT2kH{X9I*pFKai?DX0Ur)aa!v`j{*8I4BV`-&S zEYaw+*REZwudg5I>CMm1;f_vZ-MPmbo0RYb3Xw!45DH+{5{qZwB>b8Qniy1f>IZpL zUweDIOscw^a=W^+O(N73=9OnX$m4SbfHQ~t`|u`@gocny0TV}uh9t+FKjZ5+IXuee zikzL?OG~Pf5-&06u7r-beCdXVyH8YPY*l4lXGdRNZjoArs;lZ7>RVxoyM8^5$q{2S zQ7F&PEplbJga?O8`NGlu;i#~4ZjP=#UjB8p%?Sxte*4>3%}lKaJ31@!awhxx^3v}` zhK4)Z+TXvOe*0D$*aYEc&w&vz&Y5)fbhUD_xpe!ol29Kyd?Gieq@liDDp55xwxy-r zS143fRaI?m9i^q^PEIZix(lBt86V?1J9&kkIR{#un3#Cx%$exu=;_7WnVFd`E-sFa zjsVf2rnDK09{%*ac=cm>J~KkwX5H_$in^*IG{ zXliT+Ir#bcH8eC($wGoJyzs)=vuA}uVQph7gwfLN-l>S}A6 zZr-@#>ERc2>P&4z>y11221h2L{#m(2)eX&o!C@|*KG}K2-2=nalVEBn{eN(sW<1nU z{Lmr?Gt=GC)z8z{&V~+ld|%&~k&)HV@C0Xq?e6G&{P2;)_#_@z^yz0?{`BX+-$=bD zl1{x&E-Eauw{>t~I1cyr!*3T?PYWCSoZO;GCbz7-CO#n<OE-8-fmkTBu(UfHb>UP{D70)zVMRlABlN=CS8rDpSNC`HLyMdZixi6#8JW38 z#umv}u0xOL9vE`-^7HTw_;CHk;)-g%2rmhP!u;~CxP3rnbx10ZoDK-~argD|@NH>o z@9!Djz3YHnreQIKhY#x;7+6$QH3`HT>b2W{PV=XH1%@im(k#u=x9O(~5~fY(-roLu z_cIF%D>|6SErkLnP6^c_~EOS2&1*GkiG5}@5DCMKZ8wHlP2SyEQgsFoukPcFv~@)77>TT>%-x|vEO;7^Qs zI?|Cw8y|75I4c)a)zrY`?#(+luiOam_V4ZJIeOs8^-I^hTs`4uQEnkPloG}MUHg38 zy}LSk{k%`LxAow;jzA-QLoN=CgJ18s5*J^bne~r9{^?p`vYnN+r;ArzP2-ne?6`X~ zt-rbTZcSQdPUm~zD zv%Z>qJ=p(rYeUPKQz3`;?VlJKjtD(dUR*ReI^yl_v2DxN(tF~sCP7N&Gtt3Y4qO%L9C`<={t87_3^i*ZSW zmH?1bm{UNvaVW^nhsqkBFnDk`y{5c+a%95N#DZ>X=U`(U8XQQF`@=p+yS-)OhMQL} z@mLcF_UufEiB60?Z)&K=92=%yl~|Y$)GP7HAH4DI<-`=@lZFu?;p{Qy*I#VEb@gU|U*Kzh z{X2(+&$v~oz(7Swv57Y3*5*cL(CEf`MxYfSEA}`G)Zobe!#pMz)S#`gb!>1H9Gf<7 zPEEbz>E)A^ohy?o9q5i%u3k5{u!@aK=;`fOkOvzBD^(ic883EzB>tBl6g<%CDE4u7 ziHnHJN`CJx%#?hfJ4klZf|#=g_(I$ zOk87iwS>)bw6b<_a=vuw%He}Yni`tpV-x=R=f6SU0m&rAB;2{4`pE|$Hvot#sXXxY z9<@krcw9d+A}TgE{-5u>*WKA;VPpov*Qs=LGn<=9S8gU>-TKMrpl@}RwR?8$_3`mD zGqcDqDDw3SaQE=KcKzn(o3`ZS=IaRJ(Jy&^NsLK{6np`g&z=nDYsr@`B_t(Yi0^9Y zIC(@*DNz~d8OL5oNKeb!^w}3M?5G~@H2Cx7S(>F;`cC==Bv@Ejl$V!NzWA$0l71rg zE0-rKD5%JMP%=EoBc}GFLokK`NYDsNJ8L48lZmqa09B70(eJ72@l$*KJmf@Fw-IBmWIaT2M?e#x65L&m@gE} zZh<;W(21aBK?hn}TVWC{%&Q#iWsMH@huzPgG$QUITabul(p|LD;R z5s~J4h9~wPA~ae{1H-)g>FGCb`MJ6kJjgh_Yd3hp%pK(A-P7D+XKDs_6QdmS&-(xX z=?zIlK~$ohtZiTlPdFbp+&4s;U%G_IC~HH5&F{aLbL(c&y)>i42ML+1y13Br$nlAx z5iof*VuhN`Gv2jdIy`Q&|7h-wdq_su8(H7IatC_Wp}mLi-%bZ(%f`m$;KBV?HkPBK z!$v0zx*FTghn_tj8g}DivX>JhIVL*L(@oCjfWyJU?8CR;yqSFY!L2*CCYFSTNV|UZ z4=+AzXKrX?s^3~yfe58sz`C4pKG4hMMoK)P6mR(8?Ss3v!B2OFO-`q?>_iIrf?SwNs8tv=AduS3$UsoqEL!nfTR`%=PT?gIP*Tp?QJ=64rzJ$#YOib?F zx>+j~OE|2ttUFgPnVr=8^3%^Qp1)9CRP17FH`3j6WcQwl{sE*=p4fk2xT_lq zqY+Ck$HjwveuO|6FmT_q59*47&yJUr3U z$FQ(ujgEp~ZOzRGy1KlboNpzk5Gt*gtwUII&76pZf|KB5)c5%!YI()-m!n@?#aHP{o8lK%;XK^@5fh2 zxe5vOG*~7OnIG3L$;g30P@z&bG&BH^aC35QYid>s#0*QD!H#aZPz)e}&*cF~5DJAn z0e|)|wO=hgx&9XoD# z!oZc`;_l?J6kMn{BDD*WcdS)lhGG@_2V+L(aXsM|SPJ zbMY%zj5v6(7@oi``Qg0> z2RnL;GjdKII0!~VQPu-H6QfJ<(d^;A-P<;?hX$fTg2B?gcm39po%_HXj}8fTvNe_S zm}1T-!iQeT@wq2TVQopiow0e#o3v7PgfBOt^(#zU1`Db13Ox4%2^{l+duzA z${S}5^*Y;`jdZs`zFG<2oo<(zdK>I@H(Pr2nQ)Cr40bAeX!z)!y^y9t!25E;dLeUM zI5DV zhp)5Cy(?FW?%gvzdX!MB%W|?UPo9KK5AWPD+S?5c{pm*^@F&K=T$>mkurW8uOTSl; zk?vw+4W4_x*vcLrO1W_U`2M}Ok}oz^mLL3jdt^xPP)EDHxoLZCP57yR>z9*tD!IM2 z#o_&Xn(J#IosogwwA33GCWhdkUa$b;Bf~VxsdL1BM1BM(PzV8#2?hyDBoTVpSe_3F z2B1}vo%6-UO>e#S24`gS@Q&>@1zB>=CseCuD5TWjKv!5>@+%bh(9!B zdi)q*!j9&K_ul$PM`QhIZ?DKxr({f~t-k){$f&!?$*%{#2wf)QT;sWp-8|wd7O@Ap24Wv~fmD0}GFx1yur&81x7w_2g`KAv)0)Tpa z-~PtxYVPQSy`^`=IYqdjzoT6jG#MA(iDsH&>ky?@{S z6G!dbof|saa4~eq&d6;0r<*?cc)hK?U37GGMn*>F{q&T?Bp4!{ZS4EoI;DIefCM35 z01U+C^TblX2(uvJ*GSVKf$Bui(ACw|;P}fQ{}B=p-cZ$Y0U7c8yf z+}xd8x9SuM=HSqmpMTCA8&^v3=gwfKx;fY#*uHJY=bu#<CEdH;t8=2!!P@G9zbdR!zPW@?UiNq8#iqEdi!o~ zZ{LZrNmsh_aPMGWYln%R9@yy2(LrZhtBT@$jYMc`VPbsz==*QK(NJDdl#}P{;z_9R z0xDOA&Cacxj_luAoSi|aB%INq#F%rYCyyOFxSKyQT9Ti+ZR3U=Uw)n(6J3~-0d_5O zWQ3~M!5up}bi*-uQ^& zi9=z5e*Il7iP7h_eD=}Tn>XIRog4 zmpKXM*UhU}wtV_2fDLCGTabXGm9>z~=8sS8-M)RGy`#Ug)6dmSz+%a`yd!(}8XY~h zYumQ$2k8W%O}l%0_pTkx$#J28M|ZH>we#z+&=3wApPMmt5H-nODKmxv!n_FWW z6tjxMPKu03zi}NPB3S?4?jA=E9Dx?ED=j|0=j%-$y%!N22(5hQ=8b*3b|=OsNbsR} z_z3XR0luI=dI$H6b+@+FR_xri_3-|E-tKN1g*^NIedslSfMO%gB}PRzS5uTrTCPI87chy7_Sb6Ng1v%O#^{r#uJ}enx$VM zeFG9qOiW5jN+{oHkN{nUa{M0H!du?gE;x5JW+U(T`kVo(UFW@`5vr9ulJ86RUnAgLJd$0C!+C&!u02^RjQ5HbNKcL3vY_&8s3 z4^#NZW^=)KWsQ$PA&?6169ljU>?)N)Nu{IFqJjPq{5nnsW-h{?>VR8|RAR`OEQ%I! zSaQHB5N~Ld2`MX8Isu=3F;F3d6k>rw%vZ}L7}Aij*c={pdIpsS5Fn_DkwHYLWkMcI zV;n9Yp9zQ%hr?qsry7eAvPQ1PLe?VQB<^}TB^FRiYy0-?I~p6C0X>cmjP!N%=w##< zxH{C=*-Jhh$Gr*U23d>5cn{F_jxG@0^nP5wRK`T;lwvX2Mmj#5L+!T)ofP^eXd1YM zq#Da*Y8LyOjmv(%{B8QbG=64jmVPqy4M;FDGMfHynX+Gj{tx?!0?Z|{`w9fS{=pv7 zw$YJ$f8#Cx@GbnU6h2I?r@gSVHKV8fL0iL(u7(>ubyqvelG@8tT1u`JrYCWkeGmhm z!Ui$O2>_-gs2EuAI2VZ&`@j@}=MNTG^DG`03=J^UM!Doku5cH!!xK4vp9&ZNTY+T3 zkV>n6=;(Ogpp-9Eilu-Mz_6e|f)p&5S&;Cnq#3Q**4B36!iD>3_X=|gQsOVBUcH&0 zl~+_yc<*jnTwL7E)LWngpl?E@22@S~b~_l6YU}_{xFwWfEdkSoEs%i&7;ozZ3XOMy zS4orvPYiY<4h+#Jh4{f2FsQjms-jLlqW1Iz0}=uQ_7KPk2q_2CQ-OPf03URQPg4`i z@#zGR78tZr1x|!Y6PR*CE_|_Wl7n}20iNUvabdK0>qsaJ<;mnu6;dG4D#%k2Buc#C zT_jfvWq3D9d<*Zfj<_NjBt-c@7|H<*v7nrko7$p&y1tYsD2AV6e1`JWPYPdA40*wo zCzdmLqUiwB4qy-hloNV9xIu<+rJ|5o;Ga~!z*I@7icriEPE{Y6l0S9w0E7Wy0`o*t z>X-#;J5KP2wgU%8jQ8)Cs1Z-D!`u9m2SEUuppI*hDhL3BkTfKCA>q>gV+L=p+u-Qo zryy`+0Yrc+Br?XrCnr40kUon)weRPn<(%Y-dxj_JZa(%dUR;R^vYT#D$ek()cml&+ z%0~u8{n1#en_}uGXaFz>efooG5CTXNa1&KXVDN#vaHVPl{tzAd1*k4Km;$_?EIuhh zhV69-27tF~c!G+{C%1eB7Ra$`fvSUeAxCNx9wt-xAgl1Gk@?22cKHT}D|9#)U_7ql z=?0&O_h`PLMpUwsd?}Ue&?FC11_w)sPaOQ^G1et=mV?ep2?wNyr2)83^qw|;X6NNunkArbK!SmRL1AGb)iI{~30Sw3ONiq+q`AP*oHWiY< zV;p|JjTZ@!Yj7WCq$X!qNQneQ@E@`z2R=FaD6|%f#Z^^R&5cc?gF{0-eWU$@wUrgsH zEtP@w!`C1wOuD2Vi$RH%Q-A?H!9j8BAct~@z}|Z32?02&sfcVf{`dwwAwke#>IzmS zIH-_9Fmc3)P3A?VEChr=U*_&PKqkWv0K7zznjxH~CTgJXar zrToW5Gs8@?0PMv_egYhaT2pSSrf>!Kq~u`$QV2qr!XMrO_XuB26&O;3D=?%(T_>gZ zy~uQ$JT)2@Yo>FAWWma&+!Qlq1XaT6q$meRIh6=x2YHPNwLCHl9DwwPG{FZ%O_hWS zJix;en3AgQo4P|7@C4?Pb!5q~C)G4!Ew*~W4NUph_fBM#H8%83LP(Al@d(_k(705x zz(ZUmmFX}~Mfrd-P>l{ez?M@X;hI)h!&MV31sV}zAq?^H0?ly=UU^9|q)a(L2c|uL zBnD|viVbck9#wr{j2s|$vPNTK9Z!c?8XSxd;sxuC3_Ky#O)9bKLJAavdpaGKSizQQ zKwTjgNNiAu572=cQ8lF`Gc9B)-}1)Z!ls^^`IX~x90n8v{Dq{w3k>c_kq$iJ7A^^O z)k1f`KGc=EMLB+X3=(6){0DW^BCdQ&ZrD?X#Wk%$Sm31CrxodE%1}GX(1Dp+hDSS0 zFqKa)shFi%`qk1mAVFVWzo4LiGFX2SAOUjLBBfkGKD>}CG(54AOFn_pN!9qtp9XG_ zFB>Qb0DlsdLZgN0K#tTx1hYROM_PrBz>g}y?uP(V2cv3r8aaMhk5?SR{6xY4e0K6f zkkB(aBv8vC3XohV#xa#zty;qu3P2!OMAT*u5Jatmh#Hv!Z+gn%%BA=P0^a|079{+N zNuhvA2lt(C&;sCDrCQG8PJOGa+KRVSky5F{%|+1WvGis)Q`zqxVl!hwxD&a zi=)nO?62w?Zy02?j`3@HCL4zMr5)oXoy>Nwwqi&$szVKv+^XU6ZlS!Sccgxl-!vg9 z=^Ah6C^Kui+nMrSzP5|2sOlSUV+uF~Ds1hk=w{XpOPeQDkVw@4w}mMy>lv>ZW^use z>Yae-P~e(DVQ$kfQ-`t}hC4Xgie7Hxn5?po2M)N_k4WHJ)z61(!>ANI!CgBff{<{l zg(=Rn=ZHMn-olQO6&cvcVcz|qCm7PgOqyPcx~hP#j#lqA1pw4JSi)F7jlNo6Nj zms!_8BtwuUIC=yK?iP1UcJomyQv=*Iu7uo++9$vhvhL(*>PCbeTou&4l_l>JquOC^ zD@$5C%!jOj%X*ki6H+Ju$QiCs00`eOCWb4Np@XXiH%J4D-N{qej|(Ps=s|raq}DG% zjpO3i)KIRaG~qVNd{E-Z24TaFaC+HjRoQQ%JL6 zT++f)l=ZT}(a4h5jtD^lkUJE3RD~YYc0(9&gL+i-u|X5S6RzdGtN|&4f`KF}dsq`H z)HW#xZW)&rG!Km_5IE`v`RzIS&= z{p|VyX5$dMb5dH_J=r`afkx~WqWVc?OOWiM*%5xb7WOR+?p{_VaHhGgcQV8-p2+}fRxI+CR-!Hs zkQ5XiJj?TEOnm(w^Q zFYIPFPAI8n{h4xOKeMBEaCmsQv9YnEql21}VHlsCnrCU2z5xk(dU`)8kf4!kvDHo> zrAk5|_#u~T#bC@s$t2`EP$;O9T*9DIiDWV!UObGyQox7;=>Q=B3;@7@cLW#8@G=ZQ z8xlEb-0O7YDs7yPMu8U)V^(Rf8zGSlzrKg?06D0V;CC2+2gvYbbjS+7i&currAlh8 zPN5QTxEvN6q$z`<2>7!fF8>+`nr)gN5-6BXsgPkUAqb8DFM|QC;>qzREfg>Lh@w!tp;W2?w*E{UI5MXa|x z`=LenduC@gGUB$nr)+V%^s!ycJEmtpwU2+-IBcs+%DZL}Zy280?s@GatLSy+XCc-H zMnQYMFTZCHwAC^0Gl%#M^n?#>{JX}1A6uUO+#%w9lYkFQ{kOWrerOr>fmJl*^`+<4b=Hw@7zXd~zxJ;A>A#-v z+3c41mT|}@4l(apoZI4d8Ord9ZR}>o#lIg5z$LVa`rP)y7Q5K3&dKYnqal&cos&1w zlU_e|>MQT-AK6}bM=xlTee9=<#P=-EZ+5%<4}*|(7Li|jUU^GDa5Ft-gY~(Op~@y9 zpW0pcoB?byn>un=nKk2vA z`^qMV3+qfzf9V|efl2TVkBjdb1b`3K1Q6v@8;E-r!b3zT8(cqifQASKA#8F<+Uj}f zPse;VyI%avG5$TXFlY{t-iH>En;40k?Bh3Bormk!&dIMI_S)}v`)ki@e>v>8)#cJ= zCy>wi&m5CJb4vNl<haUa^8UuPKsjsAxIsr9ze`-ATM{e(aGfNp$h zANPS()cclEpE@SJZ*}1V+t`mCF1~9XwZSI#bGx`VkDuDgNczks26Ft+G-AC)6y*Mq z**W0dUN<&7B)qF10=GV=CwyWX^P@5-D#f4Jod@1v8%6QQRuNyiCcR@E^0v`wP%Ws- zo5o?EIK-{DKDXU1aSJ2%U8CSFZprVOorSpT?PEcs-Z2e-&*JO``wJhLL$5jep=mH& zzi>q-AjZYiHS#lLSIwVodH+R0N8X1nX<*A9AbcTV}tGHQ!m{C?k?ZyyiZ;eHvi z-sBVmU1^6TtV9yP)LeF^566NsI0yZLzM4K=f83V z{>ml!BeS#b8Jvc`xzRTE1LN>dtuFw-XMA?M`?WXqLqBIEZ?H>v+c@H2NX|d>L!s-< zDB*vXpEYt_wL=fxw&A)QUoT>{~1D{2wPsz5Ah2FU@iV80ryg{sKMmd!Ecos zZ(V`}QhtX*)Txt?YNf;MfvVBAd{$>+d-?6!g4B_odP0L&W=oV>2#V`NAejgt1c?@? zTplw1?C)PZ@G(aCACv-T3|AfX{T47my~WUI0a}QK_^UgySS%C@*=+Xga-&}ZVRd+f z$tDD)QX{PbY2`?ZKb`@7>fx$=;_jZ$YL3qBJ(Jz%eXqkmtKa!{tJnRGoN+XQ&?G`9 z&fIx{p1s7X@HxBO-?@~}H_lx~uUqQWFxRGZu~q3a&b6z|a@JbrzT{N;lx4;-5)+m|l0t$56|@F}N;XPv57Srsm`C|F`y`nY5L3j696wv|gQi=VJ5Txpi| ztbNH7*7*=-o?-TLULA|9%a_;`EoYQ3rdQESa##Cw)9kAk(5s&CZeHq8xX9wc<91n3 z+2^db%3N)eyU6sxGj7!jE%TppZCGSkG~YaTfkoca9u44l#BVa;^H(w&=G!-{bZK2;Te-rfy&F{DMo>vy5`uq13gE+EsQHYh9X_S(h)hDtpeOZLUEU_&i}> zwbH5-u8-T5t+FY3(!Okg-u>UYRIjxye$uAkIYt@C2g5D5m&fc+R$PjaA9h zE={W(>X+KpEwQa#>(K?Zn{QJ~v#46>-nGoRb)ik=a=UU6$m8^~<DthTFp%C_=*@)LHIs~jp<{%E|)p?tMN z@fwFBU~sH~M#U=ok|%A-UZhw5#;W{j(}HKsOP(;zf7zw+X;4?|%vBcme&by9JFm)RruSA^ zW;_jj$|&tOF6B?t3)Wa=!L5ZSuRZUWyT<%3^aW7z)vgWmOtW7N?p|z>z1$}M8TYzn zwq;8gHH#Syix^Fd92*uh>XtF8p;D{u%R!{Tlx+XU>zW@Ze+Udw{&SlDf3CnQ%}QQ$ zXd5C}vf z5nN}_N%%Dov>B)&G$HU5NWkleU|x|TogB~tcuEm!cr``8?CJB`p>CTO;OH2MI|xu0g+ zxH52fxmOp>qWm#><0_w_c~0Fl+g6%g`$GT8Wr6GkeiL)t2IqQ>&@38hmW?#4W}0&^ z_`sFs(hqlO)-8*?#}~UpsXA!B12nhx1(uCZy7Vvc8KU`*)BIVGJI#7vkvo&-JwkJ8 zp;=Zz-D&2XG=J$_KM~EenP%O*#I0wpb@dA8miboY%bl8OR<$(!viTlkG>-|I%OuUV zcLAewg>(Bdr;hpbws{U6PX-HC_;G0FZ8S?#0**s8=MkD|3%KXGjxF#Ur#W=foNx&j z`;I;4+B?s+n`YNcvu~N})Jd~%rrCnKjpoovv+I1!dxB1MKqkoRa=t4gh zRAi3lAkC$R=Gy(3M?bEneamA`U2A+te&au~$fllVRs&(6)gE&hrO^kW{EvBY=6JGj zi#S6g_R*XNmUxXn=G491y^jXrEvjjTMGG7nX(w`NmNoMo+i8{!D|{ztP6Km2Cuod8 zng@&KFhXOD%yAr;$LRTlTAxjT)ER_B>|Uw!#_Y+_2EOlLlh6 zZ^jB>T@Qhm1&rf1GAyGxchRgH7PxiKqc<;fZl#%(E^+Ikx%MpzVA6~$X_mDMoLc7C z*Mt0Vc$XoX>nP225;HU+{3Pp3)$w~W$l-^|e?|)bZSGs-Iy%RGU=COLGEUomt5LB7dud|A~L7JaKr3t`+vx zf3!~9=9Drl(BZwUwD@Qj7})XaUy{kC1z-m7kdBL=2hGwf{R-$`mK#-8R!(`7^nd&& z;opMV^~v$Q)`B6OQv^idSFe?dG=s6;C`h- zf|Gy=ZvM%`N1N*#y4yR%5BKcDTPSk5d_F#I8L)v+EE0%>vmoJ@P0(hbjsF4? zK(}D#zz6{}6SpqtToX%2zwqGngZ9wOo~V-Xkis#$s|}8~nva~mvC}>zr+H9?5F`B3 z>LamVTos43A^#e*@2c=Ar@DpiT?>7OX;uwjn=ZF)c;2Ob`yHfTiQb6iufKz6w&gUN zs>L4NbLj0Wz(TTYTw>R-oYAuCa+BMJ&%NN09Z(O^`eS~J;1E^pQ zAO!oqrM}#i{#+Wpk7ig+bM3;}Ikw<3IJeL&%4m#+xjvmV_cqLSwTsS7(%irvZCw;0 zrZGAJP5@w_*>^nVIkM1a9D^e3Hku>0+5rGyH!z5fdF^Vi3-_uWTdUXvWmKyQWhejGdT?z!Q$_9cr< zvKE-+(F}9um=&+}>0Ry7HP5zozEi_I=eqC7^PTDzGwPQ7cua3tLT_GX-#X39?ORvc zHLtR3c*4H+!x+J_EcCQR{#ug z3u)%%YrWc^a&1`cP`d55<}abWa}3gd%1pYzt zU*w3JY(^sgRc@H;*f^J7zs$Yuud%$Z^U(^YiX}D$&v@25q{F*zfq|jJ%Mbt?fI$EZ z4!oHeAwW98?3;vH`jyZ(AmPxVLtw@J#B5gRsu(9c3KBGGqyl&kAOWv6;^~w<xrXGd|00{$KJ!S?*3W=0CHV!@_9$z7oQ#+pu zg%}u6Ab~Fw%z}hpJmGm{CP*M(CID0*H=Tr;q=AhbVlq!X=z8;bz|qjm&@#U3{l4HL zW=O%H@##w`*%eZ?+AsF{Zw=z@Dp5oWvb{OvRDhi7(IT6Y6|T)sI5#Xa%U^An{kDIn zR}<39KyRMu{PYs%)u8tIW*Ibt%%_|i7nzp+#;tXQS@v^|6)UWYo^Y&RWL>?`s%nj6 z)218fpV6#8`n32Dp^X>$uXr`nPNc7LsDI_u@N(<&=iFNtT2;)ks#?HkUF6b6GcQ?a zU%ALC&!H2Y$VaaSxBMfx^GWN%KlpSkHpze7p=!Qq-g4WrC!On-SQXPw+y@IDeC8Nt zy&BxVD+~QOboe>XmZjDuE9}Z?MmZ}yJ5~ks(#-P~I@hdnshwkhrEVn3LX;<}>d;2`|$~B(-bFCX!c?~XLw9}5} zVIX8$1t#V)mv)+2@iLF5rS6UM?8{boG|s12EMSx`U{um93+B)(Xf~zu-J5ClH8e{o zQvDqFUK$vYR*f{Ba3ZM6GTZ)&B6+hur`}@G|{kiBxujc378kSfT{Uxv? zbQFCRKe*~x^3r2h!Q7v3oQqciLz>XSxypR&k%*0uF{kGAJ+bG=&$w>tEe zPx*(z^>26@|2ay2hnr7b&>_z&Nz-`M9qZ=d(LMaEOM`854|^Bt>c&h_7u=Q!7c zwYP}=WAQ>d2)u1RyhlIsv0zQQ!4Sh1rAx&ktAbVbB~MtD{LZN^WRTc@L-+ofu~*z0f8$gKkPKiOM&R@|{3^zO z62C*U@1!{bsB6dXl+5Zd(z9*^+`G`ZeW61G==Kt$^hJ8N<{!D_+^jp6NjzbljTfic zS3~U{W3&K@o=F{C#yxd3*|6nAimKy;`AU~9pkY7CF>3f!D=@(DmfP{kw z59a6RtJP{SUVl1fD+v++A$;>q0(g;|pF&@iBZ4gxHVt*(k#SO4?XK!!XT9y4 z=U`)F7Zh}w#}j}UR4UD(Lq|>p1ZAZ^xP9%0iJpP}(c@B~$kfnCz~QDOCNU=_`CJ|a z4@4pnKm~ya^DIdCH4vqf6iy(C!U<}v4liKkBUH~p_OW@sSwsJ@N_yKl?dX-E&(BnC z39E2;FzR@#`BKgBqzbtvK6uLLnr$OGoILRK-teuFUFX^8&)(H9Ip%*J*|Rrpc!N*n z!RW3u9@0-9eAVpAC#Nf3w7T(jKTUU1uLlQb|ZAGgkV zhMu=MaqOeehS*7T=wjcWEU*64J?EL@Nrx^mKRwg(SEu}U{Hi_*Y1(?B?+^6sXH9N_ zW8W3lKLctGUgzFaqhq&4;Q2>J&aUL~J(t;ka;bd$#N7{kn|EJ;d`H)Zw6E2>^INmr zcTe>{Z(F&-xM0Dtw2x2seRjHQTSWI~AuTW1`MDJ~~ym{BYv>i0(Z%rJux3&N+N@xp^KS zrNySXFL}3ay+Lfcruw~q=Wm^=Hbo7888x`!bo-0OcV972-xA)vJ$iUY?AROb)gK0T ztPAd0cI?g{-I_j(VlURqe#*Xfg?;tM*LCk-QvNw&;yK^WKZK1gvn~7Gsovjs0}v{D zBWmp96w${?yjT2MXvc2-{Z#vg)2)XS$G-?`UvnVgMYG#qCk%ZN)4wjH@kzsLFFRyz zi5u8-zQ;TtU6rHHBf6fm$yo!KA*d&G2)*l`@w&sUFQZy_T$g+l&s%Jq^`u$Gw#fD` zLaGlZ4Zh`Fx4^jYG2?=bF(aue0PLr-v{>YxvAKB zP4t{|&C70eyDzf0o@@U!y!C05YcJ6=wj}m_9MQTvdE|Yc%CExP^R&c)nErpzbKmwT zdcoq(OZ4omS48hbj=vwvUTU8IN55g!kt&RUnPuQV56gH(r0Y4S6SqOo-D#3p=~as<1u;%n460o8t3Ep zX1y~d@H1kk?&XZewT{*EPuwvr(j^IyO|I(mz_NcjrCk}*ec+n@2lJ~3QbzRdO4ps~ zeA+VmNyl2e=x#*@mMvfG-+yq=o_*8r6TrQ9_dXK?L%Ox?u>*%Jj7*SLw|D2RijvY} zhYpVn4FgC3IRYx+lLQDsC>G6vgkL)0XHC#@(;(qtD?%gV@7-WV;UZMaL3VL@K3OA1 z*ZU8p^n2DJV4DKDYl*}&b0Dr_5P*bb_|19yqP_Z&V}bfr{rJDwXPIUbC(|T56Z$;L zQ9>{B&r`eK*F)M z_xUKY8l5UZS0~XrpQ2BKt2`=E@+7iLXX_`o*AvL%de5g`>6t3RtwaO$qL-sJhPR%y zc<@PNZ>j{v4Wc87-A7Ue&vYT%BIMtJwx@8Ox6OURD(eNOa^o`O-i6Geg5iVjpYBK; zK>;P0jgrR>Ms!>qLTBqyOb4>RueQ3Qu+IYHJ8fT*z_l9v)w%8o!>o@ljGtkngBj?r z0S)?v$hieQZko39I^VG#?Y+)9H;%kpky}0TXhfT$JHorr{KTz^D?;R0g5pL|1wscB23~b8p;=d~@#zd1LGOE}JESuM8?Q2; z6n>59laShTLxf`m+H#Szklsae9RI%TG){9Fr@8)kJV|qBlgy;K!_Q%wOCQa-bG}mp z&EURK9bsII4&P?l7KlIey%$s?-x8c}beDI!6P@isQT^!4xDlUDl&VF>8H$%}?mupD z^Y5oR%*qMRR^(idUJq>fBy!*i8~GOL&bFal7ut^97){_HmkQ!C2OUr9cgt4X=OLd$ z?MLpp2_wWmy>pLTAB`A5t~Dq{i1uEdv@b(?8QMR)mYWt3dYNedEomGd8Rw!+QN8x1 zL?HC3R`fTonge&#VI#<~7R7SV)`ao3Hu=vu*Dj+sEMRobb?l=#4a{*I0LOer*E~iK z&1snCObYgUUVo7MAuvSw&UF48*Exg^$J!P<=U4MhIizQ3{^l0@lW$B(KWhH z8EJMmnP*$jse0tyfYyf&EHf>cGLGbiAi(pf0ACd&ON^Z(G+OvSBrv=lf`loY0Gae}4ge8>oleX&?-Zf;p!Swn4> zI?&Z)aO^~TbBq4*6U?!3_QWKI#g>S~GMP*u5O6pgxXvy&`gITn3Gj~s36J6gxWXJF z!>9V88aA?t$?<*Azw31NiG=#&i7h)KDtAX!9FHw$T&ucL(F-8K>P+&=Ly@kn$ly}X z?~jGQVV@SzjCLiDIaOk_GNKLn77!+hgNg0vALiHoZgDMc2z?q{9?wKOFLXb5JSD0F z?TPAgFVbFSBZ%nPfIbRse%2!GS(95n%}DS1_{&B~?u9DbbpD^LZiM%uPtUg77bDPb z|4IxhJ`3-B!7A%{s|OC{=;U4DpKNZ0x1j^)8xCG*^e$3u53NfcMQ=IfZaQ6mM~==9 zp!0*s_%_$41{vOB|H=CH^Cy#DbGQ%KV4Y9#N4_OzyV09Y8P6MCJ3C3dcd9FJD8-G(zYpN71)zH<}kAE%lgx6G#Pjkn8{A5ZD|v-uU*5&|sg=gm@& z-&a^wpr^RKqI4Q@_46>4^#Z;Ks9ANrQQ zS6ru}X6TY-hdvDof2b;#iA*dHuz9=|$nnl3q! z$^m=#CG*rT&UHDLqQB8|pSCZ?AMBoHpA(}EA!Q*=#F1;m&pB7_Eh4t0p(9zy;tu!k z&}unK{rhMkqi+s<=#{_$r&jbi6eEI;`xHRVs%Z0 z2b0U61e6AM5?kZig1U(hT+`pQyb{$)Yz-`S%9h(b5Iu7w#vxk?x_#(ke`GiDv2Wpl z3mw;3L})#RxcWKBwh_H|cK8|Ve5WR2$1U|*M(r}YMt}q~N5BJg^B6x+{!Tc`e@^rN&lPyFZ9nZ~&02>}yDH+yb?w$Oeg4J7v8c|AZN&bN zhO_m=j_}@>OtanVbO%z=D(eP}i)Iw^zsNtZzCT!=F2fjFIQ2h4FZ;kFqe-g6pD^MF zkpL3#O9L3&!QcRp0N2^sdX|1w^bJTbHa4a{T%N`T|HmMK?2B;uSC9b4m`*i5 zqwp3<2$hvp=;;{@3=H8959%5sA|k)~>g%d1Fz8FBYrk#V_Pm^YTofI;ap}sTJ^Q3W z(ViVUo9i1|8X6Tcxl*nGNWdmZ1SG*ntIdLhUo?@+ioOLBD4YNca|wV17D81_WEq|5 zd#~dQmz3x_`RQ`8#npD#>~W8be(yVVarsRG0@+7gd&W4$xdk1+*!`CEm35wlVg2ZD zo@HS0IaQ!PTBg5kpZjHCLv$N@+dgw^XcHK$Z~K*<>O!BKY56NXKcWlmjT!c>MNZ}D z&rZ32b}N3;{QmRydB1hY^KM7mV*8)bOAhZs`z{VVbt2iL32jZ7aI8TAP3Wn^NuP#v zyl9oP^u(>-yH$pcqqk4htvPY=Y&T(cmt&sBbuU35`BcP?p_k3?Z93bL#6jx){EY7D}3LtDtZL1J$d;~t^)iH;B<$=T= z03XP?{f1O(wdfuu0IoI09Ei)a8k@W-q%f=}oZN#xu-jYM{hwjMC zO3^cR1y9)){w=8U6brrT-!k9e-ZJxShbF>2pLjwq;p@a6dO7;|Om*ZKde#2k>t02H zz3BI@MJIBRMJ+O|MT;$RpYd#bf?oWD(e-zI@;zz@mkNYm0ac=xjS>zgw)vJS_e4~r z459ZKmp*d5lGID=4b6*hCw7O{{88`ng$`nGRC{n8I&p>doc^@~S6LQ$XnWF#cMDo; zbnC!XflD=d#WruLc|Of^eBr4{zcIAVH{;?U@pWYFoc$M%RuEsMBY-+Kw__V^j6cUH^6Mu)INN1ki4I)nTNk3hPV|~b@$(jUUa(4k$|Tjg zljETv;Bk3k?p7Y ziN66<=qEmQyZer5-0e|fXJCPEzSO5c{@niXpemhR8dvYqKwt&&!r@4hOMPivVuMTC z-)(OH#jVn=j(8)m{aNeWkWu2mU1FJ8{!06X1@x{tj(D*O2@jYwr%CJvkih5zseVre z3;T!e#sg7iB=X;6df#H_vBmWMCDtwb9uSsAX!XIX`{PEEhlsc?^hH2<;t;X*Z1-b3 zFIt!DcHBa%=`HgaQ(tfY82m%)`$Of4zh8G6oWtl`OE3PwBfU|k6H|ly!>#IINQV&~ zMs;9nke{Vl`jyZ(Ai>Pcthl(C^8G2iL!hiJ@hz~3bFwA}1! zh#zT=ooI@Z4YLP)GZYJp4!k-0)iZFOCFX_-c&lS<_y zBV+gPKj3ot)D_J2kdROxA3qNdug=bHCy6sz+*Sx>Fp7o1 z^Kce=!K3aOr;5j|@@(o*$QarX+3nYXzDOAQt7nBn6WV-P{NaU(ut5~qfsC@z>j52$ z3?4jbU$*BS3gaNxCUjYjb|em)q$@0Q(at2cdlUM*chl464^H(Xu*~eM&=-l!Pa+4x z#*kwjI(%34SI=tjw<$;Og>;w|BIgElW&#~AMSnfj5Y&tgB#u8tzxT9jX1o|#=A&n= z@>bgxE^;e<+^Z^j97S{@uNK5;La(~yL;8#wbe@UqOVLLmjp0Mcy&i43FmQSZ{l+2h zqgW=r6TRr$wbr9;rFG$vJHj*-+7i*Y_tIGS2%^^@k52T@h(3%!^wXYqtv+6i0+`68 z2Ca+dz82K(*^W;4;U!6L`4(+Y?2Be1mpXKI92w>kYppU~3u;Xv(AVkcdG9uwaqbh2 zWgkU!*cK7t{bSZm zkxwOh+pX-gGo2SE5y;KE1HJCwwEe2cxf#9WQu$VJPn-lD&qU9=x6)j@*Pa;(?niqg z^Nyd(ejp_5%aBVa`io!F=izNxljvOLVBR>*rZE{no9~s~de5JN!r2lCU9S zeQ1+=HPXM$`#QSazaB;Opc6NlTOyiF(?x#Gh|!1^xwg>U`@Vx+d%lBRX4p)Ruv7OB z;~CMXxQph}PIGCcc#cc+T<50wP7RA3YiJfZC#ng<2(ft zsBwOF&Yq=T3H?k#0ziBv-eEw;9vdvFDoiNPi_E_hly}3w^lo7BP2Y?J$Na0_8J7dj z1=+N>mdRCO=-bMNuM1@g`J)x2OmvAvhTk*bwM-BMP}7lHDnZT=K%>Q{ zs%dpPl^VZB5aDCg02KgK5C{YS5@t_a{-x8u1qr0aVz)?xcg?FBl{2F5Mdoyxgr}RH z&-2R}vAo`HezVghW5^`FBs`~MNQVs1WvsHy`b)H6jIXqB}T)>Sn+QhYoBJ+z7frO#-sT!;iJC`=v!u9@=hr0Pd?qtOtLp!lYN*X zdoM-ttpC7LrzYBo>_3H1Y`83c#<}u?^W!gi)-N*8c|D5xo1noZw$<-Pu{OjDKa3Us z{?zaiyM_g}b-xW9dM8o*M&!h%tCCmT>;B}^{I|f)SH0Wcjpnbgu3TbTv@TBg);Z?J z%c{Sg9$IEz^l_r((-Z~xEHx|KbXD`u^V}7dC2yRact3`};j(hAYu&u#x4(|%{>h`_iv{MOzO~!etnB=Y96zw0{Ofe(D7mH=#EtRpZx1ybSc>wKlWt` zbI%RlJEv;j^esO(hQ3bf`{F|9Uz{JjWO4oM5Mi2)HbyZ&i(;=f%6ZzR^oy(NH^Rr? zixWKISpSrB<6AL;r8X5$Ik#-SgCF+`a+q&gFJh??g|$>fgH5_`#>~tY>X=Hbf2l#l7UW zmiIr8>OFi*^i{&>N8#a`@28VZHOMvX|OqzaG{1&)9+IT#H|DtK1Mj_UXBf zkI!{3v(8^luiA5u_=8W~TDyYz#@UPLjem?1e3C5s$Jt>}j3?YXKEJ5?IFkKV*yu9L zqE~`@UOPWA&ouiFr~CeRs^@u^`VZsyFM72+?a}a;sImDDCC_+OeGt-Unbd33%Q$$TE~rIxnBBK2=U<-2ZAE;^a;+Uc54lE?pXVd(V) z)_i&y&AJ?#_*;!m@(lHu<{81Jc}7hs{txy2PKLmYZ>9Vn*uHt5O~oqfyjSe+Z1lL% zB%we84CP>Ekh|59pP#{~PVp>An5AD2{ro@z5H6mU+-nk>VQh`411WltY8;7&k$3rFA0PINrmh;TRE%FBK!Vhv%K#E)KV1H$)4zX{pjJbVf)*7jbbKw! zZ5}l7iE)U&=XtHxC_3NfYOCJGrV}ac$C4X&hi3X`c8wyWA5*;4rWEF?mF78Mv#xQd zqnTGP_86oYRxflJSmimk)`v+ms$b^VzsRv?E*&3jHqU*4M(?26x6gO#qgk}!9r{hG zmbi7zck7$yF+A6M5+CYh-9dBeoA2EH7^7v5b7G_en(4lR)bN34O zp@nY4G{-?2y&vxl@6wAmeYdMy=F~RFvU-kH!%~-inr$~e)yp3ITWJ>cj|WUH^BSh< zm%&ePtneA7nbs`z99rPgOEa#T%jlf%-1C@2`)a42CB{{+*tf4WF8h1P*xoE;T8@72 zHuwy^e}Q@PBFDZLPxBob&}Zi)Yc0wan-o4~QwI`Q?%7YXuA^DjEOF_4%&u_(qjiNx zKh3CO4x@9P+YrsZhvqayeiAzHm~Hjrjy0>C>S#v!iyi8p^c}!^s#@1S=G3*owGYDM z4NUD@7P<8;cJE(c*Yq2g_SJ?(&sbKi(98cSMd#9rUh^M#+_dZ&+lKd}<;RQBSNG6r zM&BZvo+mxo^BsEUFhI`DI34pEkS#_gmeund8bFMHi<8+7qu+&3;#1zti(fc3=s1Gj zidC(38(ihsJJ+J|G3%BkAPuV~5Cu-hx_N>7AdS&QqxayG9Be!1cude-nKZBQIaUR0 ztnWW>llG)_#wxcKFjiLk4g((eG`j!D)rrtP^u-nF99yVM&tnk9q<&=plV;llHt1aY z`W3G2b1cef2KjT$iWl2eFK5()93Hc-nqyT3%{|Ylb&m6Q@LZR+Z}U9ow#S^?7C3ze z&v$J7K}>E2I+O99KlZ?Fi|jiVI&=chcj$i1p%-|W+bC94tJbAXy-Pt>X0>xoYgf`+ z=9?8QvaO)m)-HBwn{Qb>*R0?PpMGcsXy18`?ep#G;1KJmb^Zjp8C)1ISq zt((CBo$uaDvu^@3agH-6ZOc6J-GOm~hg@gpj^DY)Tbj-DGTvJLz4f2sm7g=$P~}W?tjN_ z-S}WQ4;KEYm(fe3x6XBHUEtU>&#rQ@V-3wPYl&OqBG*=$UE^H0UYb)6j2rWuyJlz( z#WPAi%`-G)nr8%~_&?S6yBGrhJAM96Ug}u?oKx{j*0=s{mH3rgVgp+XL$_M1QAve( zk0TN!P(%GR&(7Ji^edsCA4r%oslg9hX>zdkk$ePyBdQf4l@O_TNWnykF{EST6Hf>+ zm~B#>8sLF!>P>35BXFb#$6mOQ=*DfdEW=2>uNzwLJUb@-LnKEl5xS2-QvbgT8f5h@x)h#b?#WW;gp?EAzYC;+59v zn?3BE)#rAr=6d}o522GmS5_FNF0v?m!Q#$eZ0C8y#QCU=*aXVFgHU1nRh zz^dp;=elLq1`;0zng6bH@ymLbUo^V@5~FCPS;o`$g^ToVEjLbk*|}tu@x3R^GhTM9 zn0xg4vy3vR>|BG4RSuQQ?JCzgRz7E&`Gmoh-#g~4HNUgU==N{v1uIPNueHltZuVfU zL*Y~Q1xtluSKAiOH@yF+Q|+6s zO4iuqLS75>Z@=JDwmx?3k1o}}wJLhTDD!#S!sqQuK(HW<)t0$S&9c^#g?TjRo$*Iux?@rup$C-g5qO)pq%k-N+y@4fJDdV$t8UuJw`?D6Bt zi;OZ~4jO*at&Mj4!ILhHYaDA9ndCs4&;(D~&-@#8>XZ|35!Ybq2{FG(Jv*sDkn`J#~mh+5x9%%9t z7KLjpN*}i@f7-qlu4^pHpRucc*0y?$dC?Q5h0j_Q{?_vTTGLyrEixXr%zVk_?h978 zR~p@Z+&TwD`m}xi^HyoAjZ+ty=d5xlf6^{@wb9)t4DY>UTl~05#&b@kkK5B0*7U4%1MS4U<(7p@&2t~ODF)dtHN5k@UCtV#)Zf@-uK`W7$ESiU zv9DPO=+VA$k$nT8h!wV#&~u?_D5=iiwN{zm$ulJOKk|&|(>x=){~bSJQ?Qy*H{Y^) zj!6l?p;dMjPuP_{ZCCQFeF=2!XYGrgwk?1`V3|qw5|i9Dc9qaspuRIShvFIPG0iio z^FQ*8YW|NrqZt30pR-Q;gXN`{kDdPOVbA@pQ5`(3oSfUI26@bQ(1!~J4`wIqS^D+R z&jlm^LZCnbSupTbBb`Env}&XfBFQ8^1QEX~kYESFMLH(ZjN{|e@v8=<0vq_)Vk6Bs zxF}^ZxTWKA`D9L*sI!(e_zabA2*fb8?uZ%~bO1QyxD*7!Nj`j;FbfiXee^FN0kn$( z31mY~-O_4Q6iyhI5K__s3=YsaP(HW{aa^5NICAD}#CD$>TLN-U_+7OKyt2zF>6m}& zVXrvbv)7G%RIZXSk_XxaFxhJ@4p4Zs)B+ubH@qTezP! z_l`01zi1qE#USYN$$;b&K5^#3i6*|05FQe=K9y+X6?4)fUf(NG-}AhQU#vsum6Pu0 zPPm-4J#)#}`+~k_lz~T-d0+zgz+J0TNk%>w;A-f7em^7FDlAdYC+wtWkWIijE5Eb* z>0WvP(fi!a9`cPj;uEur5n>U3(ZDav)a#UuUznNid2|1GNYltO%GfK~+&kLRH`dJS zyoFDUnQx4q+c_uzmWEgC3C}nqpIDo~7!&tUbDs#ipg1E>TurOsizb2bxJX{n#=cOm zSV+^vJId56!q_|9*!S#lw_ux)*pu!-`kuiSfe{BCJk0~n9;ADp^a!y%dvPx#@Pz;Q z-OeHUAt^`w6Zg7A9dx^}-zEBxd(1KKgri>Z!26uBr@sG1!@v}ft#RPRBW_W8K5<8# z&KbL%xAjRhbdI$2jkEMm0Z9d?8>8MY_F`sz29`;E(n?|^2&=$^BX&WqVb@IDBK2IMEmC$e zPJ!Z`bO}A~5V*_S)7a-csMFWhrw+J8AMs8+_enY7byd&v z+P7KX>-x9(gwORuJ~M^(9~c5dlo^RoJR`gRHCqJU*K@yq-1U;7_YD*8n|iL7Pr9TS zLHXS-+n>It@0x7lb=A`U)^W!K1J}z2KG%P!{>-S+f9C&C-|u7y{O`*1-Ryt$@TqJ2 zykZWypL2=4(lpEws*p^j76`DNfQNNziY5(`Z+_0wEd2`T=LZtBlr08EnVK}v04D(K z*NKo0>@F^$9MMU7kf=j2TshHOF5&iQR6O#`W}QSS6-x!=8wD`cM_ zy6Pg41OiYWD&Vb<2&526Fh~I=i-kW+m|br4E2V!65(u>dup^-msbwN)S@2Ylca?bG zUJV40Xz@t^YNULvQpV$O6-ph4 zi_x!u&s8bqGO1W3R9r$V(C{=0KA$~2${CU( zU5}8*0%WAt4s*CeQqGukQY;x)iJ4sHxJseqb9rjHOd%0-C&!RNri9MKoB+8oM@IN; z7Iawwj}KKA@&!;YrBuXbO{!E1=w&Q67evhyiIpl1hz0tiLN3)Pq%t8_%$tN>C{ar$ zMJ%xvTpXrwoG)cEp*#w%Tq_=8_D}LBNBI-ba+7kA2oWMcaZ)KXmO`mkYIQ0#AyvXC zgoILsT&?4aWgISFDpTkP1k#o(R04rW%n|FPDmhOq6NqFYF^mZ+l?nB ziB=&M^H>T24{E^_$i@Xqz>Uz*69TDNhlT}8D8Ue4A%USri(m|ap#v&HDcBfa3B%I> zQ_2?WMPX^%ZO13CMSR=jD#3BJlC=p2H(6|!r1PEE7P$0R2H#!0m76>_PF61EN3D}^_A}&iS z7ODAswNL=sE|oxs5imJp<3l|%?zlq8)~RJ0wNfgVsdPxJ)^R1O5sp}_K@$QwbU2w7 zP4FZ<1+Lnp0u6AaQVnA9gkV9kK@;U#wv?EpswqcI8ICTHNJV0~Ktw_78=sPA|350&Sb91SVZh!%}&(4-P?Oozv3aycdAei8(7YH+6BTzp<5*R`dNGX*e01V)# zLsFqgA(5(Na_m3*;qtGMra%Ivi7=x8g9Ga(fCPd(&mVvBHWfgo#^1Mq8;n9Q2VoKd z2fk?8h*^a+V?uJjR1IKN&hL8)y1=K4hkuJD#?vNI!C5fov zr%;36sR9et$=u~Sbu2P5NO0Ry>6|P)k7R6JkR^dk!Hpp}L?q)veIa+8FMeHz z8A^!jHT{!h2m^(I0ziQ&hQd=!iG`{=BnT3PT2tXc@{}k1q;jEHriLO;CCF3b6hMXm z2B2uriy?oIKbZZHJKzE8DpP5xVt{2il@7EN$=H)jZJHrjDo3gccwm8l5QS`LDgdqv zc>o_UfCTWAgNR6l(5V5|j8ZA!OyLhQf}9``9iT!i8W5pEp_0l}fEb{NINA^7sapJK zJWWt)%4a%jTw1a=RE_Y0P*M)ih|{eJEelslKER-m6oVUN1&KghEldXw?^3a#A*f_k zQZ>~_Kr zH+aAlL%?i>eZD{AWWP5<;2F{Xy9`;V0)rKAbULX@ zho{Vk836;LfHFV;aKn|az%^t`rc5i55^p8|Zj5c9gi4$yn7lYSHNH&Bbx=*N8fAt@QC z5%6?fWPpXVh%cY|DN#(NjIoLe$&^z$@?}$YAq0a`L;C{e$NwRU1lNONwPvc_;UAR_ z01AjMl;Xluq5u}Cadn`aR58Q~HD4mffgvamw6#_(mf+3QAh1w1l`pVJg{2BCRYC#~ z8WI53!7v5!)Jl~Wl7R6CMrn*l!2!)b1w4R2us9b|3%|`uLj7%45o)bgjrV8x7GwPJ zgZSalJd-Kefs=Af^Ry3OC#;m@B2ogMaSKh!BvlBSk}1BTo|sPpQY>|y7I>!e0M97- zH$1HvGk8WYlK(?}zmp;GztiXMWC#ojfb|F3lXL)sGEhAonEZRFs8e3EG)un<`dNSk zm;<5fQcM*Lu4+Qfhq*(eXdCKIRq(QO?7N70OWB(^P~_co*RH?Fzqjmc!7X3jSUF4? z8Xe3yFpT5*S^xNnu+t&UjV;va2O~q{ke*zMzcEmP^`S!o?$oj(sYo5@cgEArUkCHO zL@HoU{{Dp*9IP#14ioX%aJ9F#80hciuqUKau}I7Vgdh}g1tLC&$DRcVzjT`FBh-{Z zF-fHAe8Z34!VYQ%B7I;+oI3fRnv=+&Q`R08j0!o;ln;cYc=|3yGr~}g=>U)31*YiH z@H3*!2tR%6`&_4)N)x-tYEiiWPu~Tm$^kzi==HlPW~j>0fE;HYwJJL8ocj@B8zQPX9Tl>AP6} zaizdHqcvyze3ZY5{ayZ#5*2{-{FhD&Lc zHZAWdNDK@=z9kAu4&O-QN1}%X`@a0YpcyFu&(bW-($57XP&ffQ$iWB(D=DF!L}*Z@ zs2uD`RtxT^N8->#JYprH!AMU*1pD51H zftjGGuG-Cs4hTUk;sJsX2su1H3qXQU%;O1WLBcG}(k#u=EX~p^&C)FWTA637L@ z*k)G}8a6_sa!J)d*CmbcuDCap7(9)}!_mkYGPUBYG}6o+Nz*eu)7{hTW_Ppc zn%;X7h9EpZcy9~dd+)sms$dI16-*US-h1=a=Y4vgaet9fD3VRGcSmZHRhai-FcBFU z85tSh2h{sinrNyY|Jlej%a?9mzlOQi`qe8A?b~fznrSGql1*pgkOWE2NJ=)FPmv@L z1VIo4K@dZfAtVXh5P0G@a|3a^QB=u2Xm31ZX3nUctE~3KYfSl{&9-#jhl)VJS!?_qfr4)(^Y@7%g^ zXU5cd@C1m#+*ym4Em@~Ze0qeo#=1#kKdY;JuzUNKQ^yW3oI5L%h%(=XB;@ibNCK9M znu8={a%qwTf*=TjAP8cJGKeK1;2R_Xp*1h{7=Mf^C1Z^ti844*pCMlWv+VVr; zwj+^-)$!W-*~a-&;{v&Uq2974Q@ggRXko1Jj3+fSPx7@qmjs(F96R;M=G~rQ$$2Rn zj=lN%TRmO9pL{f|zP1T1zx&pQZOvVW_8)ua%@00$f8^i)?Gqc~eUI;_Du=n%M>hp}HQIq+Ool~5w zCUr*nd)tDyl}ovNHl6WZrpj6>foiO)qgP1C-IDUow%%+?MxMX*$nub>eOSp4?X&Lo zj-Z-v8D>74g9%6ypHy9CK$Km#C593Zq&o*u8FC2e5@84t>28MZP6Wudnx~fABnK&e?nIwbnjciZgQ<>N@qQD^G>#&;GH58jxIAhB?6i z<;&Z?CCBZ>tODmm6Df=Z^_7)}L*rM=9^@&oF#~;l50BC6q(YKr^601G>9WdBijOm& zbX)0(MZ64|h&g`0An1dwG>O4CRTWkY+q-;dEMj&4=v0gndw7vsNv?u_u5u@sI_2_H zRpLkVdXP%)%l}>m0>hU0Fx1?yi}_~1Co)V?UnmkdVA;QjdW951Zl74Jlg=Cn8@nQ6 z_`*M$YK8bfkaB6`eX~4#E%Uvpwo^2E?F`|2=?^l;`ZSdp)-wDfS>XOwfKm1tt5!57 zX(|vee%wf6u!V4q;}-)&-HuL8e3-uk5#$H@Q`JPNzgD1a9B|qbLwnneUgK~-a=2Y< z43YXW%q{^=&9KrFa?3WLvJVv&A$TjSi?mElF>l$b&$XH|yHeg68qSlP?bQn!T9IEY zeIrxnL|s!?#*}D&S@WpL^6B>yiwic~qN|z}UBNS!e>R-~99{ry!@c0IURDgDv;y^I zn!kjKPhyHmo4xG+aWdtL&B;V1FCJPRZ970?=G&iTU8$0cAp5_8E`^yH zk0-3u2y&3-gyke;772I4uQu9sY;msjHg+4UFPU~bMAi7$iUFJO4puBVs1Wp*gTyFd zpwnv;+-L!zn(sbOt#LV@I~2!A&#!d6jV2ClBW(G>Y6^|=sC7RUVm;g{BWrO787Ifs zzZ_cEcv`wvp(vOa|0mL>NC!41ydQ3ThR0$d|8|e{2W-_{R(tfaq-RBO*|p*N#lWox zQ6y4}Y%sr};``Rs*46d(asW@}rvdl4df1x9XuYPA_RdVXQVQEBYDt+fH1m_MC!BB< z+LQ3awvVIm`n>xEG2NVXB@!4fmws4#{RZFqKl8>+v<)&OarNOxgN*ze0Dinq2;<&+ z-obbi$PAd2c)<+)5%XbwTQPfNAhRl|v1%k-SzWrx)-=~ev&d6j^Dq*Qtc;dR&0H~S zU$?PRf^tsQJE|{Id48`w9uzX-b*JV;R@n3+oy32AyrYc)VKyE_=We`t^PoCH!uvSX zKnzESSSI+zKj&P`iePIdrmOj-aZ6%br_H0!$N3}fJ--wy#Kt|ORpCQkrD~0oWnGGJ z-;{C$7sZsJpSg6wwwQS{;?>bQm9uT6u)}KC*fGBCK)+ICsbRhQ-Be!Snl7@Bw0Aye z|Fc?VtO8r&J4$X&-KvXZN+bW^$>X0@;yJ-oH0i=!5 z=(pk=p1__*V#LmfYb}%uf6&~pvbjdM$SZlQC9Bv1VmxQcg?GcIP?JZ4FjIOwe0^zr zcd;_D5V&%=KQt#_%vo_!olFVx##KU z3f|0U>+ku^?x@C`iS}H9cX>CJ6Z9%hW@jUsf39<3Ycn?Hn2C{4@S#c#j+zwx+IwI}o z&<=qc=X~VQ_>gX(<1pT1ed}*uYYtD>jroCV$9SZ*_R}|eGy9(;{YoybVpJtAhbiaU{L;V8~D6RfmisaV~)^{H~ zpTE+3DjRy=qfL%PG@Fqypfw`S@3J2retQWI-OSZY3zySV3Z80Eb^?YvFI0?z%wN|t_v|AXxQXET3VfbEGS$NYE-Y7S~ zXu#$Dy6*dG*U9qNQSRN$8o#-^bewhSB&terd@q%_lKu^9hLp`6GsG{@QW#2@R!djU`qMj-KPjr#paGqbH!9@3gS&gN)dVHC#>k z(HqO0^zap`*v|<^*#W?hZPXXi@ou3$BqKz<0{ry8Oj@^J=nBvvRL+2VRILT>f?x1`tXC<@>FQUO#wzLMVm6)7?$`BCVjc5`|m~3Hl`+i)+X2FEM z1zL;~U{o3*1T)OOw&0VuD(Pw> z0Cym^R>Bu^2{>rKV<{Dic)qZ!w@<%}HOC^&ISf5uGOQeV4i;nh&r@zbv!uiu_^MJN zYVQdwq%2a`zY^O>k#wyL{5hBLR=7$S9ljDDj#wcF_E`szf9@Z;uN$2oOKnrqI<4VXUb*Qjx4CpwDC%oB ztS~pBx6k;!prBu0Z^_wyU@9o}PqbWhQCGgNW#74iO z;7i4NU5z7?DfEX_P$`D~Tgf(JUb^q{4v(j1 z){eyvA+xQuAB{5TJKf|Zgq#*wYH+3_T8ZTl*X#})D6 zHo{w`ryW0pH`i)ph+{@sA6OCZL?SLhIkNzguW@pafN(o$0^K0cTM zS9K9w^e=2lYUjXX(OC}`p1^d(^(VjgLsW-+pZl4bQFc@v;INK3S@R!eh6xY8kzX6< zM7gRSQ&woGU5C#7Jfn@yG31B~upbPeRlalY$SU@`u&`yYD=N8N4JC3IjePkPIt&+g z-Y@}@l!G{u`uGL-;bOi!^Ti~b?DV3}-@jetZj5vu;Rux&mU-mO8=vnKQG*BeQ&eb#0*@vSpU)ybWDb88BNXNOB)Wgl zE~_2Mb${V>cXsQw;J5jX(rbVA^zvKZ=Uw`Gt5ggyJ=^MS$O@qeqfaIR1d z5(e>zHg#uS^r1GTP<-6>WB|Ut1yX*_-pBaX2wcIfE2?jk-hKru8@f~+BO5QLOFTHZ zanD~Tacf9Ru#iXr2rw6Cv>wg2kQ#v9SyL2ZZZ?v}uX+}4j{5e7xaiC_m)RyFxlm=h z!}<6w&&SJAEBLI}i{aG?E@NRYWRcSPQ0vLfe#It%ty#TEJBEUcM5Y&r)-gUBHJMIT zfnEL2?IpGxQN)N_N(ea+uJeCuSw@0*(`G+IzyMa@=<6Skh;TFPb>pN3pDLY?L*a|`2siKxw!Mly=wp$W`=eL`gs+aCvKYDt4 z_U0J|miMLm*IX03paw8kAK{D@(#QW|^dx2$Jby)isE#jcSjy5?O&;IlzP_t)zuqg` zI1iZ9UQ_EcwPp#m`i5iV&Bz=%XRWs3q-1sB9f_M6Jn!IaGjW?4t4fdFJ%M1kN=!4v9Q!|bg)*E8~sr=A+X-zf~*kju60~^BH?#t&zHsz zQf~qYWJJ*U%aLfL{mH6{1mY0qP}k0KLW%B*#EoKaZ}Xtt-R9F;FHNH<9XHF}&|@XV zxS=L5E7QJB%U-X+SMqiQ;7zc+m&2V2CJi5^zEtHc&e9;ZylK5Mg%aQ@TWZjT1(R*b zOC*a0#!$&`2(uih7$NxQMjxi~x&wpR=Q##l)f|seVr^dk4MEa$>fAunbJbUjl?|ys zJ3hTap70ek%0$R*OnhXp`OOuw?jPFZ7m|q|S#ksI`-kB^OXa%Xh zU7P&t&o8C`PF^U;5a(YT&z`OvEgY_kvGqg~S0*9Amzemza2p$>RVsz)WY@*a8_uxv zXb9?VamEAigC(3|8M{W-m>3Np2N&cIyhBQ8{Kue|MIkxR227k9vX}{%@*z5J>_1!Q z&5Odh1}`^K0G(z9eXO1gy4S>*`S&kbEes$Zs*y5dp4q&knhZ`si_~~Cu%EF=@R)ho zyQYp(s^=oGV81%pW6OkdP*N=waM(p|HuhO8r(#G(2Ep%MUWbo56f`Sikbh{L-e?rQ z_y4uFkOY`mS1)3=UO#NgdG5;S|D|Nr`gCq(P;*_6fdPN)vq~+wmhpni=E1L-cYfeL z&%2_E?JVZ+@1FVH5Zx(YygA_EPh|fTyd7LOhl?3MJkXAEX=355_|+r!_OXHOJOpG( z|I`$5)S=oW%8WlnQUD8;7yHL^Od|4OacFZZZux09Fy=XgN44gsVUL9$5yN?Y4{ODB zMqQ!0yVaL5-B^a?qDovPee4C)NhUP)bU{d+fz)k^(ng;6(b2CQp@4-DIX0aG6(-nlpovu+1f*? zCrc6rfp5y6a37_9@?yeUPDjIV@6nLo+{$lU1x8hGpo>?qP1QZo6_qrQ;BXI;F7oZ1 z!#`%_e20ixQobaVn^dtJfPw;?PakS@Cb}Zr-u#sKwZ7=_+XO?-*Un^m>68@;w)2At+FtW9?MYeVjl>l*3z!;(H zs_xV&3~NU4iKaEdb6{W_PNibY4}+k9=Wm+xOP8pEC=0j`&&nc(avx@B_-#we>UJlH zH_iuMcDt~Kk7;Uv^y>~JZ!&`f15Z*lSah}3MO|0F=Z{*Qyjzi*i0plJrxvmPI ztMWhXpsr+(p{Cs1taiBW`arrLbb&r~bX!-Q7K(t^7Q#Vx#Myy`43C zvz2xW?Z!7(wM)+K9_{_Dw{bxp`#r^|w7;}CA0RF+9&}wB)QIwQ{I%#*HfaNh6mW3= zqTbkbzhg71FAO*jUd8r8OC%@IJ4Ah>kiBVatIc2oE6&5csmk@**4y1w7xTaFB?`0^IA8}7 z8-Sf>Gqj^r8AX!@pF9x=SXgu8TBq6`UHertU2J6^RAQPnCMI8;h7=sG-df-Ah&n;W zR8LTJO%L%=SQ)_&bqP~TgrksT2Eyu9R%-3bo1cR9jjyY)rFM zp_V+H%FFEg_KS^;t=0c%qO|35{4%?6K&w>LWhrr~j#jI<(SM5$XxhD;6LHQc#hwDv zJxa>F{rLYDyT}(az}@JYn8uC|geXM>~v(Ox6MQx{fl&F6c4mP~$nJ}%i*Rd#pO zu~iA);vOn_et0>@n&ilsQSUHShD?t_sLl|F$rFLUN0QHatzH&%7(}oSoDp=6UxEhw z;eZ}8%~~-=`Zh%tj>A}!Zg*^>;4NX)1j#4i*tih1OB7509Rnz>_NV4#?qf;@IO2)L z%KsPwsS9!TEuG`%ON<6E6#L;8(MPGiL-t?l$g692hPK2;T2FNDUD+9GQhtrmZYUfQ znibW(Kd30_QBitF%LEi6nCHuMoH}8`(|g>_=zl=34(qnCou!+-bL*wqm*YvGi8$|F zALSI49%P!zeFtEC%dC(H9N-f}_p$hQJ^f5DK-kE`Al3wjj2aGM&^EXa8tJ&kj3>kF z{h;8(!rt*Grz_vcOJOARf;J}gfh-T5_HVwOFEr0YtvlTalj|vhzEFoRPR6Fb#2f1sHq3Yk?K)xjKlF8mRb zBa-cW`QyqXL^!(?325G6~L4AY4WTj36T#h*Abb0rB(F6aI&<9!WA!6D{bMe`)>J@;dR`1#F!f7A2Em>?U;t znt849*M<`-VR&KQrJ`rMOM2_1N>91Y zDn{i^)Uyjm$mz2l{AkON>#&PmrAe>ZJas3721^A+mf4xn`8T(V62PUSZhXnx!-cte z58Ci}MWCoigRieleNpz0m(LTet*t8rIDXB|=orpSOc9DpIq`k4aIhr*e~AY@9F4Gz zq=r~5l4(!i=;vk|)y3BzYPt+$(tyR~ zivjclfP&0JeBD3#PWThqMa2%v#DgECU7xIFNZgB?Dp%gZCGF2RO_y{*f^nw^vt6*R zMfF^HdA+ww-5&6G1)*`_0jRPlCkG2@F4%%Z0!&wX8CMg_cQeMFrpj8bmO@P#1H-Jg z?Y8fZjc@Z@RvtGU_1oc7f;e>=T$i#j=;{C5H#`y(K{&l!CgM7G{|rlFSLfvT4U;oE=PRvj zb2LJT2w4y6r#ltL@*9~1rq_!I0g`lWf=*{+&PzWUJ`c3&StsSx6hUwor>`9BH3Js4;B7EauRahkw>GMxDZESapTtqo(eE}EUw ztj{@LO1BsccOPu9o;rHbeYICHc+OR_^Zls>sMo)+RV5|afJ=Z+&r98|FQyRTb=5G< zINu80o_+_0679~!eUYSAEz+yDLcvV0{f`SzIk$Hnm`)_p)|xj5SZAG?TC$Lwg06>( zXSTIVe`=~ESWw9bX3)on5d^LNUC=s0q_)lh5^2*Z;^^;UpQh>YQxwz%1e||f-mT>- zYV@#OYpxvFgB!W8EFzX!-69_jN|xE^)g1?KBg>ucXJV+7UYb9b1>JSH{I>OO*zXIU3L)xR1>q;$E#})Sw=z{qBz`Le_*q9*#y$ z6(8m<_!n7>T?k~dXSf)YjO)+B5dpTZjnY3a*=H)NQ9caO=>BybLK|r>VVa)Dr)_5S z$p>=xBqYw+Siqm2HogM3d@%4R*HW5*P9Sr00<*VAjUUpp#4qRJz|ewEeD)Q;qKI#J zeU#O^#Yt4*`v*;Sg+Iw$J!NK;?`N^@P|Pq^7G zAe0^uO55dQ1}S-sy$(ey|Pmf?qOz;Ig6R~cCzCUuID(5GV4cl)+?yD`EM88&f zu*WT<$gcjRir~qEN>Ef(d&*;VSqAEVf;-B`;msyJd~JYrQHcp(KlY0;uquc(15cb> zZmW6di)Ai8v7N5q3udq&$QKyZh7rvTp3Wz%BqKhwJ+_y3!GsWVf+x0BgGt_-y)84c zARdh(Xxoq?$F4$u%w%?@5$T7~_Bi#ew*|E$&w(?>KcSoV1vN%3tuAcM_r@md&Mzhe zhpbHeLZEf`+7;RxdN!U|fRmSQH(aejzi%g&vH#5e$&}C9Ma7Jqs7F5jp`<}a*#-BV zDgEX=F4+F=fY&@dH;eugHw^dC=baP@@p31lvo+I$N89EfzA!4;uT4;3$hNguzo5c^ z#RGnKCH@0nQPRvFP734g-2xQ8tq&uDEc&*UGMQ{1;gGoJs1I(w-rm$$-#k0w zRAIAY8Ee#2nn*F!Qw#D6s=9V`PC(DgcUyZsm~n)84%GL^u92}X1btcGuKoUPTN%Q zyBg!&0W%);usxBN@y|EfF&j285$aMS%>Yxgfidc4uLr1LhBD5SH)h34=CqBV1v%Mp zrDcMB#^HmaUuZCE$(dW^ow<)N-{GF{iu_=DFE2%eP9ybOxh?M2vSm|S=w$JsRo;e;dXBTTN-p9_5V1(he1IC>FW;<~>yTb1zk!6I5u zs=+$FEaU2n{9Gmh89LUgyJK<*x!`CyYIP7eb*jy@^6{{E&3)ba!AMhKp&cTX7oQSE z27B$DY>qw};Wlh=AAoVn$1ynA+IDOhH2Zp794rk>-ut_`fnf&`EiEmko#CjNB@80& z8-qd%`~)il+9YLw_IH3kH%tL_!_X5db5C1+pClmQ!s;5{hn`{uEd5@ZR3W_xy5r6k z0}7idXwO;s?5lcL7Q4*e<-)lJ-6Bis?P)D_exYgS#QNrVfJ6dDwo9B!CeM0XZ08Tw zmR9%8U+kIwEDW#1fhGV6l!$$FsU%DC?ML-^ zq>7$*+gsA# z3GTFV=xuJka&viXibed^ZG8x<7h0%YYSiTIB9X}`Xs`1)$!8@-NKsMo_1)EWskWwO zv2iN{oXJrrgsSbqi0MXqoB6-`(`yUo1xK z*Iw7}w8XvFvDxACM0vm6Qyx3Y=PFo54ze{?0p^GOHIb}{hrIt`u|qiUNaa<1ZgYf; zgH8zn+qfIGj&qS4_iHJ}5*}M*%cl`UjCV+(R-fe$?0d8Iq3AwmQ&7p~wVe2&P|BiUi|iEhMiUq8dsWXT)2MnF7K`l! zzeG^TkM|_#;SfY7&+F9T^+yZ(Fg6Ccw+u|Ij^h6!UoI3;X&_oB`d%3BbQR5>BJ88N z1b=IGGn~}v-z~I)h&nv~bY+S>=W9*!p+{^J96joBozxce2wOb>=<=H4_9$p%_ALAUj=YC4;I0QJ<^GX5eI z?{Nxt*JQ2@z7KA8P)0jN5$IS`1F|+cf(ce==yZ*A+`{%eu5&!NOnx+a%z8Bb`d#RE zahjNiv&I18ZS$wL56Ni4gM(%8F%!`i$^YPmcq?b6kQKe$EpR8aU?8c)kA}tW&g$!; z(Kn{Lm*VPbZyJ~f-iRb^d~hH47>5ap*Uf8qG**{)9M)++ag5)Q0yZrMM=Y+E)71qi zytv0bDJN6q#1CVBkCUI!)k#7npotVUE8%1fu3IZ@|L6Y1_<^?tF^2 z8GSo1s9&7rA(i-Nq!3wkRaLhc-p9oz`iM+F3GRsrp>P?~Xd*4cnPbol;RzaKP)R2{ z%%>%5vkYsaoe~~DoKyKXdU?+lOdE3kgV@`dJ27G;U49F0mrEVx>**jrdS|h33J&}g zm$}1ftQKJN(yQ+%cl$r^^=7d@R>uqL)u^le4zwPWQu$al^>F3>=)7PysQ63W#dzxl z<^4bcYcKX=Zw!GO z{d^SQ>d4oKD>ndsY zT?;oi7eCdP%{qoYH{MT4UhkuZg2wqjr*m-Hf05hRsI7T9sE})uH#+qKl%|rKx`wix z*UzugICnmvV(0GX2p{&E{-vEbdF(;QlyD`B`DMazxdgbpEP zWBs|NDt_Q`TTT&z8m9M+x{u^_Ze9c&rpNXtAyiSEJJ;lbDF>2FnU2?SFIu=}_v}>e zY-dU+;0i%6>e+4fLAMgwbcvinmA^epd9OYP-uj|yI?)B6^=6dQc>NtT6D4WWU;bnd zx`YPZExQeWt&Xvq2sjvOOwX1fF~P-5j8FR4$1`Hdql9sR4LP{Hmv&|AS+>11b=#GA z8u%l+_*X-2`44}J^t>@u=v-kl{IiNsiX80_pD4or-NN^<`-+}^U8OUJ*=n2Jo};6P zh==sLl~!{*Q*NlY2H&rcQyAT?CM}_m#my742XS=51z*3~{mf=VjRHeh9t}`%>o)pZ z9@sY|^b{#&d1CAIw9o^8XicDS#I%v!pE`yx74D@Q){+#qT?9_&%&GSCCbNtmVrX`LZgURoFcPJ`l5emn4#1D_z{7!drQdA8< z9L+?GI^|~MFVO}J8_!U)6}Kygd+5Zxz3*<`p@w#>^r+Oits60i(&J{~~Tk>V)iiVc*8f{HB)w>Zx7 zu45x;VL%$F&F83HIJxKbgF-j+3aie}?CzgP8LM~H>S_CjqN(mdSKsmUwTo&sj_cP0 zg=~Ls7`(c=InMVx-&<%2SVyE)648sG9rmzc1BGcN{g8#F}hJV#|C{uPFJ0NjnA20iT#C1!b&STOb z9rYS+df^HER^HKawwaozdd)1F%~}pKl*Lo(o|XaMZnb#!D`IfrlEaJTtfJ>$ziYoF zY;EaTqos=lT-nRYs;jEv*6^TCC>T0K9qzH%mUVU2qhG7|>{$V*v&A*PtY9a&FoPq7 ztVp-~*LY0gat5m;b*_SQNU1`|w;z83>&O~D#C!d-*WP?{6w5#b_G9w9b{`;~@vMu5 zG@(C|=3%C8+L~GOd8wg}+jf8YuWZeUVGu~Tw(ewSc{{?2V()XH|MiK=z~idl$vjrm zEzmlDFM82z-b|YZK|TpmYE^f$wY(;eSw4(03B!u}9}r~S2LqVaEXiY~{uq`ZD9^L; z?UptQVC-=}l(N2-HF|@~vd;AIJ`(tzW#PylU#(@;`tzF`32=JqL|z{1!6(ineVv-2 zR~j=@6iN@-l9+dL8d|o%_zfdLGB-qk^=0uqjM1vrQ}@u&Ke6GS>_Ubl@G#1ljDq5f z5@)jJR<@_KJt6e@4M*Z4OV!J#alaGPsg!uedv#KMs9Uzyy?dfj?!ITHDv{aGW~I(j zu?gGo+yo8`0#_dO@__1sf9S)Gi}PqtLjNf!F7nz?EZ4ZcQ!)$|`KGJ%yy=f$5GNFPKp^~y09xKV!K^e8V$`~x+w6-^bQ!!AWjnuio`yV0tNAe5R2)cg!&hc;(kA}n287ckor{5 z+>>ZPRV2ZtWy5B>!5l@2>sET;d$y-q9S=P6mk~fR8F_sQWJkHzcyW$}c${A+ zblLuEW9yCP2AZz^NXW^_!G+?OY0cC;`W<;gBt;y86NL`JmAU!yzW36Z%J@7+N8$~= zZ7cP5^W3Oseg3kw)9t4BKzCz`;3vtts-ry{l|3**>`cILm~g1)mxbX_)*}^g7e;P9GGCqU~1&tw)zLa7#+AB9nTxnbePzwuQgVpgHz@(Ut(DC6}!!;!h1H7oI zwmIKde)qG$=j55yd36U%)U7ifzgYB^m|C2s{uGn@)Sq#p+4tqvnGmG5Z zgZvSCrF^$p6q3D@gUSQ2nO=$Fr=R9M{d6ziVR_+CSjbu;KCCDc8k)6ywS1HG^5K1D z&}pl{@3G@tsz%qfX~}Eo{cXCYox|v%^QSKX<@t;Wj8E=u|6oK0FzQ1?ZTJM-(Riz3 znCLd6v}u_?ou#Id5`Kn)N|1~vRrDT5>&0+GP)*9Iz4?+Ms47A(uHr{p&o-?H1Kcby zy%jL_<`O?a%xP#9GAw>s7_(hl$AEv{?X^37EEIHG+e^gAYw2;1%C$B2g+8yBsH_ZC zZf~#G3bjfaeRnA=nCN0l44bV6atAL#t(tv21YCISD!K>3+)5aH29N#(+pInl7~uQc zO&s`$6Rr%2ffb6&)#&Mf8O_g>FCZ8yMTE*)REo?AxAlfa1S?7mi;iDAELF6mS0YsT z7?T|)_?;c`bBA?moDX-XkJW7;nnis{d58?*^MgCgl5F^7kjc&agwFXOB+a$7ZXH#$gexIbE^5NY?MFLe-6S$y z?pCK{uj4rNTdelsvgi9L-0)iK`#tfcvsgn~q2~MP?bf@?VfsO;L1v=Vi zaA8qpT0h&suiq-=WSA>dJd!T>Jw9x^aK%9=HL1)!FfN{Q=ef)3g=`~HHNV%Z)aR$W zwGz&TLEVXK@{R6+1&K^ISZP3^Rlg9t(}fR zi4cW8&I!DCN9z1oylt_X=Y`;(AeyD}`eBs23Y?g4tH?K|p{uFp+xv#>X)-mh{Y9)p zBR8dC?<0o@P0cYfO3K>mYUVvk`Y>`6$REoo>PTsl5DR|AhsOgbs6w8K1v`=HKeF%( zhwm1)8fzE_UYTwVMT*ky8S85W`0a)cVCAf*%(hk>{tgZqLSDo3uwnq&#Qag@vR>u= z0hmWj+c!M9-3CN`U;=F+`G<_mjzS$vz$qz#Xfjxua(L_XdtQ`+4EzgW!+_4JQcsCW z%gHU_gJPfaU3z|@Se$KhM;!Cdh{M-DrSSwP0`#j55@nfkWntH6JY!DzTkrz5u;Y1 z4mA=|0=ICC_4&cBo10t@feZbD7XySqyq$+xXap5+oBabTAL-R_5};QFGrm;G=}rbH zsl84dMv^^s#>?Ce&9;^vzM_7=^QR*1jYfHQ)q?CDd`e<*=Pe{Kt_Y4%MDwvS@|gj7 zG(a`Bi!QDH=3Rb#*rE@%_QVk!eoEL^-F(A}vna$XT*3n|4)xFp|MuQ|Adw4*P8A+} z7(#TAj22D**B9upp#yk*%P#su2b%1j@EH#O4te^EPkGnOm*|)*H)qYc@RvTfmxhN# z-7lj+PFmY#C&e{N`Vc#uS!`uw{wx;;X8V1*)q4&+1dq7pO2MK}Zc)F_)6BJkFE%&2 z*avH-(z9`F7y*CXZCpsl*FtobFYCe?ynR1KSm}itGPveiUCPe((sKRsmI<{_N)nNY ztP`=t9Gqg`a{ZXGYeGrK>VOxX6}82M_2XVX;MhUX0HpVgznqYn;oP9+*kE;ai%pby zuer?(l87sc8SkCU`~8FjOWo*S6Kv>zf}Ly%O65l936mnZB1F%>ue~!s$*jK`G-k&9 z3#vU^6S&6BQfQSX3?;98rlx$xc;hL@JzkI!Oi0@DXl2+*6MX$-uVd@Hc52qDe7~6K^8YJYZ`?O1s-@ z<}N+rF;OTY8MsDIw5=EY@N zd+YGt%$=uhpL%%SZ85^1)O%c?4T|314d0m!ePY`r2%51`S08P?t-U|{UosHzc~$l4 z$nMMkYn?FfL8Yz?-cjh8Hp&+#dys1P93l5@K2Oo>&CjGGP4tXKQ4 zk9W=cSjERg&302#87<)mwqT*22Uc9^M^oRr@nKoz?uvR%-kbQtH+!hE@U zkX+|G{c(rM3LCedIfbm@L1#bZzuHH%&TZ^WRkF&*(t)j_-|z4${sG=Ay(lU?lQsl( zsHOQ;CGNW=gC0u*14-4MXEcqEmUGZgSpZ?y;+d5fbTFMo&q33rG2h;+0*>RW^jE&V zILF@>jaZRS@0RnU1UYA_%=!u{uE{mYtGCCCj9a{?x<{eIbP|G=2yd%;<=WUi$vV`? zuwy834LZ1RWC4 znn2~V#(>XrN)#Z2Cg-2sQIx}(l9C=<8eQj9&mYbHe+wYpodGXugEeHt4qex1qBxLs2!gV=+Hq?b{ca&VTV^&_S1VY ze)f=nWp+uppre@Er!>+$hPj}Np|M2cn_KP8Jp?ll+u~{rPGC_p|};ejn{aLTJgD3-xth+`A$JPv=gvrX4nO zKc`&{>K#+$n9AnbR%^7fsWn#~T}_`g;J1ekJoXIsq-yZHnw+AQn{ZCVIo~UI#$n## z<-OnDSi8rsDHL!qB(HjZw3)ydG(A2N652uffP&MaW%RXrz4?sig_OKJ4mN(4qzIm- zl>eWePE@a(9%Q4{08M|&! zv#yT6_w?Y`N-jpYo5}I&(71jyq#;i?+U8*p_B5Zep*l$A;YsJQfqq|q$zZ0=k6bpo zZo$LWeI5S-fNuYx&!o386&;%5TY{G=VHZ^2OO-JGpl+0d+?WK7fH`#;jiX&1QP7>I zg1h%3F_lrtYwnfDeE-XBQt`1%=j7koaC`1oUh|6Xu$te7s!$R7+(HBowNid!rzR%h zabqgKAs->9_5DvZQ!Jms_LrH={Y3rE7A!14X&#g+ml691wxSXcD<1ClWumd{h&>lx zjokrd#uc^I8Lv>Vn~QzS<+Ecq1cXPjPbb~SX0%TqA((~(`H_~sNj*6>k|QsVdfU~Q zuFOGu!v1L-MO_>k0pWe9PXVmfUS-xS%-PuDE$Fz9bisqu@hMZbo=F zxFP=#hs=bq#E!~E`-b}+U0Z#)(eLQ6J7-P zYhqvIizIpYmJ2X20?0ZDO)#7>bz$#-CLI4Hbd*|}SWBBlr_}i??W=CRf_!&ONkMj_ zP>rDGz8z@c*O`e@!>+a8WlbZc)^FHORLufZYhK=Rhm_y#-r#W4P=3|E=aiF5MkHgp z!o$zO5HmLPqvCq`Z}(BxoiAYvjuz9?ZK(va)?p)zN*_A`i`YDX_vi%Zmy0t03bsJ% z2Z;yOI4O^|%x#3@!-W}*Qs^L1H=<2&Kol{8L>(t5quE|w}a>s-gK zh-x1<+}7}kN_cnYD1KBMxKPB86(+P*7@?+3UlkKjbUGGhS3!)MZ~n% zv+TmN*6ZtZRsZgMR@GifeFKYzS8VI`kHoY!lpqz=JLIzjRb`y69Og-WA=cowes+I; zf5QEcL2RcHL<31n+a zg5Z|AN?a5lj~x&Am$fm(ZUuf}9|>(Ejwb}RKY%fSQz^A8HN^?pPk&J7yH)F!+dP3Ju`DsjCP0T$1wEEOW-F!0 zeh&EhGM4&&Dom4Od|Z1hhF%;Q>NVeN;J$elQ%K4l?Sta09Os+T2G%@xCJ*nf_f^yR z@os0E{k)zf_ghsy!I2>fd-gA0`Y6qT2k%TG731AGp_MVgE*Xwynm)gb9#CV`AJ=Ww zCS++mUnl}vi z{r#QFX`s^p1Gq-=$k`~@Hg=)q(`hlZ*-rPo$NqM@zYu@AkjTfg(MFz$yxkpV9zi|& zie5BwBxv^gBd6wz#IH8Td4m!S_XmBqy$gYByUzMg#z{NTkNQrga|ZHWrN+mE(;KGo zINn54gJT&bTl_DN8ol-dFP0+a=H^&thb{PI2(W?Ze@hW4@Aeuu-!dr~pq5^|VeUyh zU~buNL(JSoKzsg8HS1Kl{O){yO-Tx^R=>x<(HK@*`dC80NAbCkoCr6Vg3wA6tSRxc zLdbDvo7YF7uiTj?IW^W2}O|M21qPI|61k!!nXY#NFYE-p=5?uk>vFE! zOSbd0-T93|nd@R>la9Q>MU`3gwK?=LRkg=Cc7CUt9-JO32+KK@T^z3+PLY7D@`gL# zpVfwZQ1Q+FjE!Z2X%8bdIQw$UrUe= z|A$EY-zM5c8Diyxn~eet6278)xt#VfEM!K#&P-?qyJE>slXg>1UD=nL=`9>>t-0qC z=i~X^6R$uEm8QN*D)~@Z_7LoHe7%IhyP0JEPM#15QHUK`6EVc=sLy`nd6H|zB+;Ry z#oKj%7$j#2Q*8foFh=Ds_%f0NP+O&8s3fl5j$TV;Bw|o`2yRU&H$r-W837V&++{fFS08w<$)F}LRO+PHRQl({PGlIYB_~b zc^=UAw1fJ>5)iiG`f_=u43FgtR`?>1EZAYRT}vT&*Bkftl3q1iHkKpN^2@`2a>=0% zFOaQ$q}v|#PD8TlN2Giz`2&9`D7<49RH=@5&nrG?pc9soAP~w6OyV7L{rRP!-�n z@T>TMtJvrmTa2;nYvn-RU|QT1K;Xq)?8*I7Bg5>M)+hfunaq2L69Ivx3Go1+yqCB- zeiu`p4x_p0LNu7;YmR8LbyAvjzlU~&9%I*)-s|B91kC&3F{rMre5mv?CwhuLW^Kq_ z+Nb(J9;@q;K_`w5g;ZFl9d@|MR=8zq$u6oSee##;hFuE;M4>uuXqhDye@Zh-*H{$N z7YjgXp2d0!8t&ROj63hYFx+h4D?s_uiLy@M-|1fedR=EP%t793GgKo5$`cd-BQuG$HdG z$C0~Sy-hN?XZSfchZ&@TzAxr06naOQ!in#vA67+{n3<(smj2RjcDs9kF+D7fA~xdb+PIPEi4nevX>dctp2Y>yh+-)RyZ_f0aFN`` z`b6J8mRMn~i*1XGs1vcajA*w0ptt#*aB+n}DteuFB+bzc*MG z=ynZA84;t6Z@G^K-5cGf%Jg_YT|(+Bw^w#x=KBY{%PD+bewn+4#gNCSnwa$ef3kqY zjh=p0?t(Ovz77Y%BxA-_AggBmTPA*^!sM4#u5lJoazCwu<`Dv+PJVT1Ned_Mr2Vtc z-}!qz#)r3)I=8};t1M;v(*EqkXWRVLtUXg6K)>*qO;=J;@ z+ke1BklSV<;6mi`TS@cj1`Llb=m|&DXN#VyU9u_gMxp!2%$PChFEV5sE?gq)Psvu^ zX#amQUvQCZ#I`+Iy`UEpWXFCjo?cP+OrvJvU_=Uwcx+SMJcTIb&{@f4{zFAN!Q1tL zfh_*jhIJ3ZNBTwpfg`P)U4W^MQ1W@*?*~45OvIs6LyM2jp;x}KHMuq(90?}!%2mT5 znIn(ri2QDqJSAxT$KTo}hNwjvrQ-c#oif8;U+Fm?-A|0N4?KTReSF z@{zCi7U`5=zbF6g)LlU~BgH~Zeq$wQR+gz=nvq9xovh>BxEu&nJoI%b^(HPhz1+Wx z`o;3`Q*x7WeH^1_%R^hHBxke9*qR@M9L^nwcDdcb9`_F1nZZey?El=(AT~uNh&t4N z8Fu508B1+?q`tH~I$6aqUC%uJE~BcHOJI7B-EyerVE0;&o0lgbrR))4#QPH}%1Y`5 zrjP0zuW_d^$pt-NMw!-)H_nI6cGn)@M3NG!ioIb)ld9A;>JWmW;X3#{88$oE$O2Ikyucny@I=GrYf19RSg4;$G8jmo3_F zz_Q>#K9F%0_as%+8GcV=Y0%z?4B4>sMtwbEw&+$45DKveIMcBsNK+`uFCI%$;7l18SZFK% zknkA%UY-I51^9Zn|25aFfL-a=I}(jFbbiW%^&9ABo$Yj@&D_2l0iIB+KP8WHwLd0*#v_vL$$Hn#a_1xUt;h_y187V1k%xiadffEV}if^iVdW(~jlT%Yc z9>&HX-Fv8^;Z=Ob!t-!=S?nOVf5-gHL255XcyWWPc59K_3Z(HV$6lbu%Gi40bS(3X z!lJPC^mu7D^t-B>X+G-_MHw4Eu?^dVxC`kKd9$aDyYW@R^`5{1#SlA1+7tGJ$;s+f zW&OHrg^@f~R?0RcID|VB&e_>nG$BzAFYI2YNSG>Qf=c{M2Z ziup%XDzfVx^{UKje|lvVeD;LFx+iNfxis{T4vVd=Ev+mpfhzNjwDGnQg^25hfxFIQ zBhO1Xqq}DJ3qm3y{RYR~OW1n(Bc!u$A$*iZK1nULwM0du{w*!SNfOr9?CKSCiQkGX zQrHF&W2t3v|GkKFNPfhwpnSndGSv#Qpks9e9^B8!vtuW)p2+Ld#i8Db8P}I?6JeAP zHIAYdzS6_BjmXq69hF}js8w$RoaOaEos_=hXYxDDf8})DK@;kiB2xn(j7GXsbuH(H{LhU`|%*BUzzZp zo}NIVc|R_4H~xf-huW^JxELRc9*6|q*V$!K+Q5!ibLGCgk&{!Y{Pu0<4cx~LS};Lt zzI{tOc;Z7(%~8tI#`^Cj{7c__h9M{U6N~blE=$wg=%`^9+?}}j6N$E;YG)=2G6(HT zL3)ZO)L|trbv{WC!(*0LK3ku{|+E@JVhEzJ-fw9HSd&M&>!*U(7|?_rFh5LoNP z3iiB}wY2;-l*%g;P7FJrx3!(GDapt%SnCSG_D>UV5r%c)*|uD5U7c=kk3b(Pp?6j% z8~w_G+v)C@o3_orr|KQHsWDn_H#q>Gs%H2IuJGSMUJw~1_7Jy$sLS-@0@W|2diB%Z zWihiHXrHRGazELA7~)}VnZ{(laNnvJ6`!hZvrHRto7yeW*$exkzA(d|>)iSXp>7^x)qB{`Lu&NjPpcU&iIuE6AXUjwZ`{!Ai_uVf5DoCCdy!!|g z2G0YAhZP}RKayV>B7_mLYkxQC2TEk1tfGkTL|;LKOYPE8b>J6{BmECSr1jUv#r_cX zdd_)f(z13K+B`L%wpB|u+pZv!&LUGZSBU8{dBB4g>`)@NvBhsTFIeQ{JJ!^9G?!6r zW7|;Ou)mk5Tb!3&^1YxUk7ELFZ|~k}20{?_C7s{tI)ZoUa>XADG+sAjGE_jD>jf|n zASb4zUoFT_FDx#W+>gYjiiHd8+df_IiSVb)cuB@%MJ(ba=y#u$l{Nj|{fUuJNe6l~ zP87#uhyVS}nz$ZYb9am8Rv-DjGrtu#y-6&-@5L=Y8`3S#tlxWQdEjex1ba8%15m00 z>)f9W+8=c-s%%GU_ATm~uZ9yS`d?eipg?IevrC!_YV6l`DuA?y`e7^8wgcU$Vg`ak zH&vojYc@nW(=l13!K9QfX!aw?bTCoK%)Tcgw^u8F8?!YROvG|X z5x^ulhZ#g#(?wd_wa0rQtV>k7@DpaRy_gl@Qc8vXd*ZYJcTT$zc--b1FKm{z91q2F zI6Q7IVPK_7OH1*X6v6F)dnM$4PVFHhDgwY9C6T+ToSY3HpT0Ri2$Q6J4sRuOb+S2# zb9c1d`fyOY{JzS3tSwb(6-^wg9Q}WfT_RGHR?zI&n7W=$Cdv0fL9J=sC`*L<3vyn{ z-9it$lB&y{JAvTPG8>jx`gV6~v1A{J-V1XU?d&W(Mj<*}6uf!A+g)?slUFmfbzZuZ z{`yt2WkIRjMc};l3WgqJAE(;I(UFUbt83jJ70m+<$3sc46)I_)bZxcKPl(OI8qteyJn)R3S_G(ci&%Aly`(6AG zBG(z##u^$>HZRJAo^pKr$Xrm!ZdKSgp{_rpXh zHN{<9?dZ&1BPq~GjmFK*UG8^ycvx7-l8K@m2qbKVXe6TXSgbxwqBJb5tlil^?0l4; z2D~aqRTwWUDgtH^Y{N&<@O_Aa|K(=={8QjjBiY{q0TCK)KEy%6NeQxl&fwIT#SL56-H}U4hRZSh+;#@?`(J{^Gx%r<< z+NxwvWcGgjT16W($43|i1$1tp8eZK8*Br6KEeUa8aBy%P#)kw418S6u?%zldq#yA2 z23myja7NV6=tQyL)c>WC|GHU~eqA69z8h157No?zOg;~!uap0I_BCE(;;U&pp#S-(^-xk!`sM z7-H#Z==|XLAe!Alt>KQd?3x`?R%yco5B<-K{EIcIbdA19Mc&@I#d4n}BNE6;K`arqB&;;qsAJ9`e}c~X++=ae zPovmPewdY*WDEz*jr!Ab{CC5$7`+!-oTSE)mV46A;v#z2zq4f%W_fF=z0>n2BMyT9 z(1vZSYGGj^D~t9Y?&|*)@YHJ;cRQ$9nf1>AO5FXRXh%W)^qqWjZRY)3o$*=uoad9C zS+&j@-#*GznYoM~{J!8QDQIw_CbB*Is#{KFJMea>QYLaF{gqJKFuLr{lRyzD*XGZ_ zjx|=^;WR?xOe%mLkIS?s`BA1>8V5B+}x}eGY<0)8Kt^e)&9gG0x8wP zu)K3Y&3R|r^&y8ryiE5W3M=wLP<@$lE~k!sy8GV`+uo%`MR;QmA#wQ+`VS)yhC_wb z4LRL6Mr(C>Hd=|+^-rYOZVIls=SK#tyni7BRE*nQ(??8IVLubMoJ} zA)Y)(>GS#3z^ALFmHc^~<=+l1iKI9d?wamHCJH636Xp1gAdKJ{8v1E$;@s%8(^#K= z3~ghQTQu`c$*7x1Qv}I&Q`c@otW$sbuW%{P#JCN5@1S-U!l9J=EmjVjnez7YD`PZP z_0s!b=zY_%QA~>Jz?-8^c%#f6Ki9|kO3>tyL4~0b2cl=M+z$~V>l{v}NaFJMXR4%t zG<~tveFQ+;G-&J!L(1r#&p*|Z)83~mmmR#qM#ivtl{So`S_14riC?~S68?KViw#pJ zA{`Wht62orh!KbJ@C0{GA%?&Brz|+xU5j zHr{HXjvqIKU9;|TTj_ppEjR0r68jofo_&MmC2Z4?>3LH|NO-pxb&o9f=mbY8gO`AS z0O+Xwkf}FD27iL6HXuvdkcm%7SZr{5Jo!KWhYS$1fZE;|9$iNd#)?=UyE$XReK?9U zn2he=f@R5k+Tr}*cL7!Q%J>?7wkB~~omgA8*ApcLjm=rLuy@pGxWDf=BT{ZXe4|z*<-FP>G+AX;p@dWw|0fruHP+6 z$C@YhpY~0%+qu^y3EdRg7Qc4VGj{Hqz-vK~JuY7lw~q@|ggy?=ZuLC8!VZPp_p{v-jQvANsraPtj+e?rbqo-42!C!E^e?=ho*x*@1 zaRzp5#=xx#lEQdTILT=bnXT1A({8TD`}gGrV#3g1w6ov8wGt;sN8x1K3jWR7@&C#} zzdEiYLU6Q$RAU_$4p)Tgpm(1FJ;Lr9fTW6Hb9-;T@k^__K`2VvT>lZZN>$5AD0t_Zd~?zUu>~y ze%`;7<>L1~^z*;LT5R-mnae2{jai&`zT47JQb-rv?1@NCt+kpjH)VAjpPS)wyX?z{ z-u}+wKmEwUA{S~KNh-Wn{pGzPlWId@?zjbp3QIx?ukDg8)YYxKFyTAf_9y-q6{I=8 z6yc=5S5)9Q?d|PdD+$2eoK)V^U>h$jN5Rb~dLN>6JjaL;yO2a)r{nxb)p7wx4{s;? z$LDBaQScPln|L8ilu59KPBeR7^&sM#a?F>O8mX-u-*R^Rd|v~L}bM0R-7 zlw24`E~O!NEB>`o67OO8R!<^Oq|a}u$Ntz_A^NsF`7BPt-J^e>UG47r_(UJI!Np?Z| zO)Ku^=`#xoEN03LpGw9VeeUi@?m0vBk?>BVI_AAFl0Qxmr5Y8Y6SevW8EZko_NRfU z;hS~_J-KzxhL8Tbj7>OO%J1H(cP_M*0V(ZNX?u_n>J9r^5z8dBEPHjM!}l72Az zNAMtkocV?1_-2G2BfuOog6uWRW+W5yFf69ow|>3CdvWXCb;>vaXV!)&4eh!7x8({OtNhl?dr(b`LngQsI2O|;_Oi=OvZ8n<^d zm;5$_dwflJR3AR%i#W4i`1Xgl7ME~6I6*!T{kI$M81JlOvC#uRe*Bn$2Qr(!Mak3S zic#3Juic;sNotJw$}`5jrjHh5GUS-TLh3=H5bXtS;LnfIyXmO@Jxd+hT>+t4XCiTM zvOWZGR&BU6q+M{o{mhdeSX@LYk!{{T*lrIJu}1HXtgqM+(+8a2no)IrNa@Anr1VD6 z3OH%!hBwnne`LHO0Hg4TdyMFU>=^P(wYC3M{mSgP*z$2MCe%_ zhoOm8E})EZfHYt9Pp-+!x?Kky;4T~tEulLSNKAV}k7H;oZ}3QPKaoLg8hjzp$7hc{ zJ+gq4_BIIc#zyYKy2B@#k+ZPaouz^R3}dOu^%RUwMy_Ds1LQ63{~RP{Hnt|m-M3m= zvtYV@Fadud8cEalGNR6qxR3f+O^rZ>O&w?0DC9E{L#Fb#Ur~~OjWQj+*rM5`##M|UEaQi=9crMgy78Lp|Z6rF6MNttp?$HlLS3V`-{_^&O zS*u^%)A6+!zO`jCi)iLj%}C*W2Fl4qhjQQfA`Ffcf752tl%IJEmc8qZT;efCVc#rx&od7&^0 z|IZlhnqcj6WaI8l02ALw6DpMyY4By42X8^ppID=-vEKw&&MHDW8w^*Q-h$dXI`)$G z@%I8Z4uxNL;)&<(r($vj?33tO_{p_i>_`YK01UT7wYY*Zo1ljhIVMGG^x zrH3Zq%O;dZ$D6SD=a8xMO`z~bj}ZY*3M!jRgH|BPNureWigauRjhMV^!7j;>=hQkD z?$KP8MOCdl6ktRLG6tIA|>_v6? zqhNI{Uct$D#P<)nvcDEw*~UT~Oui2g43;_8S9FzqjC+Ehq9EQkjK_kM%#m_USf{^n zO4~xjutU%k*gGmL*R?i^sIWTy7Vs_vkXOqPb0oRti$Hqn^X}&zBhU0(!aZMJ63?z0CGF){TZ8~B%l2l$@F>FswPVej}t3Y?NY!*0ngY^+HRoZ z?3h6OgQ$xOFQ)Hlgd{B=mm6g`lQb3-r4<#=YEmNe`KxrrO#-P-q7`7+e`)q(=hv@5 z&W%sY*RKC$6ni^jkI|gyH#)O>+mWag|7!To#)OO3)zwFrBj9@S2hy-zZh0bv8r%ul zF2`EyyC;5VO$J;pP72mc2bLdX-&d0$w%n*Y)XxvWk$}!efp)Ju2`mh1VMrdfAJ%Jx zl+fOF6io6qMjWcJDeRYY*UL@z;{vwLce{|7BK6{ch>WhsOF8th%8%}&krTs17VW89 za0T^zM&53W)dHMnvDux-)dQkQK*SpGoVpbl*%A{I0nlGgS+s*OkeZTmY!C8*Y5hh_ z$I~r&cqiHQz8h>n453Qt5dRgno)9cno7TzI$9 z4q^+7ImtS*geaB@D!&RobDZq&GiTx;bse4NPn&xtoa~#`R?_MOs?+;+d<_=kd0^u2 z#5Q3dQwr#g{)bapMnuKDVK4+`71%)~`kopYjdS755D*f!oc)voK}1r=!OB>hkR#>$ zMLk*3U`grtTWUxjz@=YMqiRAu&$YfGAXrMa&4k*}?GQP&;7s5scxvHd&q}n}tpNpY zdvsO`WX^TrsM10;52%fr3oo*6dpI|76eA+oqR?XjRqOXFF@VI&l=N8C-;OODU zhkimQ9X?ZMPsiB=lVL$nhEITcUGJWsJF6hD<0r4JtpOAZ>AUY|q0Lu4LBES+A}{L- zD!fJx)AT6P9L$DFiwe5OtjEXjh5A0PDu-XZtRts+#ubt&m;1K$vYP`SF)%&!l*$6-6ASj*LY`I?wk{gE3m7}RocKb#$TpZt8x0qFKgd;$jd^L?DRE&wAv z-5%l4t;618Oz|TFrqAO=mt}TlW-*a6y~ZFc9BqWaoxMH3gFi^%VQ{7Bhw`v!bdNev z&4iuziBEPK**4!X)P6K=-x-l6e&rpvzuA%HeOmT#G5y}Px}s%uD?(@Ru{xVh11G6s zPFy{ZI2Y@;+5@<`xw(0!xwO;<#2H-Pi%K1`f{_2 z`_+k`T9JCw<=UW-5Y5-`Y`a%qLpLXjrtPJPskDZ-Pnczgk6$qS&2qN5WA_@##vT*c zIkF+jTq@GT8z*6GnMvnFUQ*I`TzvO|)B>>h&Mn+QI?a2JuUK0hXP}eOIu11^1S03@e z;OPN!89<^1@S}2B{G@-E{@f5D>y&_1-QX99?f1Svg-X1$(}j8XS)?2s9LzXgpY5*D zDawLJ;4RpPeuGy!?gs`r5*J%_^mQ)u@5jB-nAf-t#IVJ6MT)#^rMP z0qPAf`XBoDCtn=4eppyrcaH(*>s<&Q)BOgM$Sxq~EG&FQM2SbCCnqO>FcHzKv-2`s z?S|n=D(o zbGS1ayMUt&XSx^V#PUx`xG*N`7<^=E$%ay1oNh&|4WDDG@|r0^VdJe2vWyARUQ1u= zZ!Qic(v*a+FRL})-vO*%_q#uEPED@6mhGYER9_I8~oF!rRarY;!Zq8=bFSdU| zSTOw~yVq6DXvlXTz(D_3kFt!Y{~AH4PSEG?+HlZNN{$kWxyDAX(f+ywAxFNzs~X*ephj+w z{RY8EJzPSNQif86d+k%eMBkqRs*U}p3_SON^u35Rhc5+IX?U(M^fmqfAf>teb7?IJ z9EoE&Tg|sL8O&Z)Zs#eb0a;uWrSJ)s$lYuOoeaot_rBXG6TUr`@Gvolw}F!o9V~wo zum!&9eX#dsaD{R2pYW7=r(cA$_g~(-p{WSaI&BcKYo84Z909ZL_0j#|QF&;(otyy% z)gACOtOf%@8)WWuk^D-DeIw2Bp6~S9lB4--?MRq{Uywveo?K*gH{Z*>=yEHp)!kyI zx6}Kot1OC2NbNIhpwYH9SX%Kb9}MKjtWPj1euZRXk@4(@Fr}MYS&{R9+ITr4c)DLX z@(f(MP(Jn5R6zY^3zOYRB{z8hNm*t__RNytU_1r$y_g^@|&9} z4#IqN`p_^*C3hu=B@aeRG}(d#kr3(pSGzTh4Z1mgzX;cql6ihTae+vR=*s~NeHGviY(k&n$ zFowcK9wG@K1$|Xj#6ZyxE66iAfqbvNViS}f0Xs_t(YaJ0XkfXxxj&bd^v#~vLS&3B);7@xNm9!s`1 zCjmEmLKO4g=a&OAAZZmOxQ2v77^=`k1xG_d+!vN9@s05fvd9j*u%l#>E^ZJOmDj-> zx1`yO&oNFeggSL|)8B5l-qXwwQvqw0;Kk|`T~GVKI-7>yF`m=RMpRjGmPxAj(YqiSTCuUeL3_va!l z-9vKyA&6T{znih7r`43p+#Xo>Us0NXVuH@j`hD`*@I({2N^ zoZAPPqaP#=wz{nmYT;Op2+IPp!#O{fuYLIbUKNM`p42QJhFs$d`hID~3z;>}A(7yAz(ddglK9}2)PE;!XPdUZK z^22h7oIXe-$K*tE^a0~WoMsZ^fr8ZUFZ}sq;XB;87?7ztQ7?z&%sVf-^MlYer6^QL zCd<3jO^$IS%+8ONv3^NVOrXqEeHbZC*&8s=ndZW$ml_^?`wTjii!1AhJL{qTQ%yqk zha+yF7Jr#Z{?A{3 zz|Lr9B}i%#aNY+w+nPdlD{ybx+Wk?aD8<pOb?crTWdztKg9p zad9-BOyvo-zd!}tM7Tzvt^5r>7%xJpZar-cAprqRlmc8b&}M@c6aETx$(GZlhOB$! zB3`#(5E@Og;|qV9?P|qbitm|r=LL$~*XiBy{E@Hx{{AO;Y%Jo)seUCNIMy*jKkJ1LU7Zpg zE!4Z5|LC5r+|sZ2=)BPU@WDk%39BU~E$yJdkq!4CQ2no=4JL#a)r&(#|o*D*vT_GAOSG$|>mTSG(R zt5@?n^V%sXsidS8`&LIg2Zv%Ujg^l#ONQ7p)8FIsOiUW9g-^oqMH4GkMfJe=*W&gh zix(Fo6xJNNa09~242oO`yF(d zIX@>b-x%HS%FVsu+O4s(c`>s``aZ@`pBy0~dlU2lm>G6(R#LK}?vLld1GT1#-jFDlaw)XI!08&uJpB+ooRBdT;~hTGEdoZrA&;aCu!feXlKZ4B43bUI24e{ zyk<8T7eTK={?tDHT$6$iy><9SJX%lq@)&~+{7)we*LVqx=Y`mBZXZcJLV|_A@M@_S zj0FLy__ES(O{G-d;ghCB3JxeNin=l;Y$Z?$!Q+L$qH?xZPNEvH=kvi0XGgCfp!)U= zO_^3&bAd2W&j%!E6D2s*hlgZ;j4j+SVWyMgC#MW1T&z?W#g2kal!YRys%PbiIM{+BFv@GxOnE0uE|06_*8e8`!QH9g7KW6p=WC6%EE|@CK zhQu|4XmNh5&ilL+qqI+lP@o_POZxVO+5VW`wY_=ZX(if4@7jw-&JJkDmk8%TN5;+$ zhT(MhFr0kz7bC=CG8s?SWel^^tb@n(J6Rq_j*&4Go`3j)M}@5|Enq|pkKT*oTg13Ka}Fpv9?v;x&FP#W=E9>%82o2*wj(tpJsp_in^ zu?i$K{qC`b`B!V!@7@f1}X<3zX5@bwSHG{DHOn60DH!;HAmQ+%S!dXIg^#1Nk_c;6agTvdAD~ z*L%M=6gb{W8u~m#%Rc?K(zW5{IlLUXP7(vG7P5*T96}<83AOq;x7w*Nq$W+J28({2 zA1yW!eZ+e4g;|T6M2V#RKz{9FD1Cdi?P>e5;l#1Egsmu$g?@z}1T#Fb->-(9r<~t> zJY#V5nEsj0Ed%JOe=^8k%Dk9hfWLbX$4z{u)s_^e$WUWDe*#4H6vCe+6Cw_WM~g`u zywBs9=5z#f=T{xzwrLO*X-Q=BvUaV+#~F%y)^Baj(@PH*OIv-wM zS^ugH7NGm6cuG!1H#t2WZ1{;BMZauo%M9sG+3&O9AAuW#Tq3ot79m?!O^q{vKd`8T zxfE1&rQ5JkqAE_%$p8MKkR$lmfQMIRBG+Nihfmw*dNsR~?~wEzv#MrwdT%z zDE9wE6;+E0?sYBBa!0MK-^{Dat5Evl_tk94kffj>i1+Nz&0tLObMVrx^auBmL5`NG zxrH8&o_r*;r4!RIeb?WC6~;1hp}Ozi|B1GI029${qsxQH?b-Ijp7$LuGzxlhR+fGx zaz6w;m~A;)8K!IGJ!;g@6}J8vK9=2cJG6ZJBoc|Y4&;2!+qT}pdZ~={i91?6Z?;CD zw!}RkbTZxJL^l57>?}S$9%$K^D5E;bj}N-ajY41tM*@F!Nl36oiP&TPc4G##RNfN6 z8pPV0x82r1uCZMN9c((BY!Z*D85=II6J46Tkcaa5QlstRd@aiM?AYwxDfGdpCtM3O z7P?jD{XcdcqJLKW$f^$$@v_yd6KHT)PiJrdAj;KB*?p&Xi+#ywpi#qPl>b&#AmW;pS*oHdtGsdR zd)LUMkWy~Hz6BI(t-xCttq&-fwG%QDIA_SH^ z*YEP?62Tc$N`3w$_PFCE2jhAH(1m}|_o^=~J&aQlo^5clG&Ect@j9;ry*=pVO#sw) ziJm1fU8e7Sy_;|N_{oze;F&gY4!Rgr>8VpeRK$N&G+h_SvK`(OQ3>>HteP7$AnAH^ za$QCVydg@H(3jG1THf?=J~0gyW*qYril&($LUGmKc+{d-?r6%BztniM;sU1ULH*mU z(RO1OxxppR8-FL(=`RV1ST_cjiNAG#iKo`}peKDQz5A4~{e`x+HZUg=pa%j$$we2Q zQX6~#eN}aJ1SvQAdY$vZTzl6NpyZ3%?3YZ2epN(v&^A^mMCczV4WgmmeH zn``ZowoltN2z9#8df?nMvA09ezlAGk5^O$|G~MvuZTMuQKOu&u9zuofk$35MEVhD2 zVkf=<(|8=%7xvMJHPPrd3~@V*K~d`~_wYL(HI>NQqX^{tsTGb&V$uC)+LxthuV%0! z1w}}3&|=d=&v~dQt5L!@n@-KKOP6u?wSO-$`2I$_y98>s93Oi zMYnnK!{tU?FVZ-3;R9P-qSfFuw*ampA0fx5CsF(!oYn8RECybAAI0>7mk$I5CbYVr%?9&o;1IOkayjRO)&_-4NnASoHbEOc&dPwA#)qU?n= zr4)SBaMY-ui_@r&@u|n)aL9G5t3c3c(Z#44&@<6Pkf2k5(xpc8sDe=8duXn85>P=k zyKz$``Gq+>-oimig(WMd*MlKR-MhvFAJ~ceP^vGLE zJOq{bdLct8A1)=C;5o&2{n_=KprTfPuwpOGE-boRR)yGOr!K7GGJjujNEp-xQDj2& zLD)a!KHc+)VmtA@d5mPh18O%X2k8wQo@g3C!R5X@%k+Lu9L^!`fpn)SWf!#=BS!Cg z^t4SK{!KX=gJ$TsH1eiqr~-ltyqpROHNM0R0!|{12pc4-yVo}y4m$Yd<(hHFhhSU3 znN1j?z7y)fbZZ>qI<-2AG_p6enZ9Bp?e9D45sBSE z+4O6YM!cxE)uaYKFi5;)@09wkFyf-c60_oQJN1{QXWtZGBL{g zuo#%o7+${3Vl-l$!DvbO=C8Mc@stD-pzL5kKv0ekMNy=rz)My3V^CM2vc}wpFt9*u z1qWhiyhM++!m#8#2sJTH%JHdQh)Qo<2}jYbc|7V{H-VW_UiLm>xMVcOd()+9$SjSl zqY_#26#wc7-w^`^_l)S#8Ik7`E7BdZa{_Lukt?R_+z}0{HS0gastEaIKJf#iaR}8Y zWYp(U7StiA;H}IwFAf-CtBs14QL=e`W-O0Kmlw-?>k!2FXg2_-an~QZDd(v06Q^R( zl^7xRtIVxU2R6R!NY3}%JE}Z}HLtEGGXXYehHc75A-EF(2AYWsv^3#- ziBG#&e!vshajr=-?nBh}A+Nr{Nv6(F9IQVzB5pz5p2=(pq1>Eg?q;~~8 zr{=-(tr8{7;rN$9#<7F-3Q88S1lX`xcZ+wV5MFFD<9g%XNRg{!e;4P&neWa+g}HKs zCHjqqoedGdI;c}&^*ig49MKP*Cgb^G0I(N>*u3>1r^j0(@2lNrf&4-waE{St<3Aml@;Lu4MEUN%Z z0EK{han?|O98(m@OJt#|vvH*lpqv`_V7vo5dz@D_@t0y+b#^o@Oa}M2SC=ctnQZzk zSocI0J z_EWKHfP5RfyfB*4t2$q#5hn5xybj4m1SI}xL`K{W&z^CJ@OqOnM9m}PQWLhC#eGID z$2A=Fr>(oSgLtp{Udp7?<}Uj`px!b*S4KS3pol+nxv(q-o+4000TxdQX!!>!;^eO~ U=E{X?aNv)ul%iy*xPjmQ0eC(AivR!s diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png b/windows/security/threat-protection/microsoft-defender-antivirus/images/GPO1-SupportLogLocationDefender.png deleted file mode 100644 index f93b4ad4dc9f9f1005b8c0286de731f04f166b31..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 143101 zcmb5W2UwE*`!|ePT6vpoD@(iUE=x^QbEmYeT;*PfckY2&h~@w+D=SkgOLJ0g+~x)m zZD{U=q9UT10}*f|vL3ug{eI8;zR&Z2uj5dU>*C@&&+$1w=lS*7EmK3u?T5Al007Aw z*RPlZ0OAn3k7eJw8Q;P!reR8wYCY7{ld|H^nSjk$-}y)~5pI^O7lxdIf?j3) zE*vBv;+TN>8Npav{xO}frZe_sd6-x~&?O@Lq~TdK;OxdLe_u+w<=LnIy#WBmv<(3V ze%1q}Mcly&Bvg2JbRaBfs}%n!WpD(Tnj@43fbJw>&ZTo|RPx{&m=wey1U95TYBio?W% z`}_Od{8?|5--G6>zgHqox4VmoCpGATFuYh1X)cdk&WVKmYU*s1Z|OO(-BaIrmYKJJ zuq6~a1Pe+b=Z@rTj<6u>JCOXIK5nHKZ@xGty;7KT9>cs{#OCg(_D8_IV+r{#?JAwm zygF3}J`7*~a&-`drgx`m<{l+=-qO2SukwKgC7Q=_l1K?plR4ZRCFothpB=vsMBlf* zZ{WCJA%z`gCLmipY(S5dkgZSYt$FU11eCBz?;Az?eJ-9djKQC|4A5bDM=FnGBC_A=R;LXV z7>RnvB=gMWQ>I3<8R|dB6q{zLR zo+wtQtovFAlxdoHTquI{1|d`JZOp<(YzF6ehI+MQq+ngXd*E6AxCua^pip&csa_T8i zX^a_6v7gW%zhh?gw`!lu`J+nXsuA$&!Kxz~Nj#8Nf1~f+zA9iKYQqftbw#Mze>>P# z>%yOk-F9Ajd$0&3>m#C?9)9kW7QeNy5_CZhA~vrysQiSM{Z7KRso!aWC~aP5Y;|bB z^Txrt$#Xe9e**QcroZi4?LDIL~ra!gnVaJig52mZGUfb(73JiE5qM#`Jo9h;;X zn}*#1NUlbGYLc?@T39O;fw#NYIHa5%rXWkZ<&fBQw8-<8i%Ft{v-`6+&!hd>Vq(`z%G5D=H%~S*?u}O^m;X=r(_TUBwXgW?*{CM(~!AcBw;&%?u*$&BN}4+ z516@qvChi|=Hw4}uD^4au`MLM52{q~CKk!w?hicJ@PxLibF!Zk>PzhTOeei938s3H zT$=|>Ahe!0#aRW{tT_{Nwl(S}LB6f)nS62R`frjC*clv zDW#vC1bn*g0gy9T)6?gqi12311l{Fv1R=TKnO3UU&*38}eZ@)>eM>;UxPtLA+2?=Z!bb7yz6j2_gdD{B-LI_#wXnp!}(jvqEc zmPSuFq~$4;dU9B5&bw=hR(<`M#yg;>P)xGx#INNCoV9S<3XrBw5n(Q=vuYTfy))^3_L*qEOz3c0zjfFPFlx9YQwImRS=~`? z)$_h7S$QR^v!9q*obz`3cl_63=@BE+2dR?T*lJlf8{$2am)Lx9*#lp}j@hNmhlq%3RSfO8UcDh8vTQRZVB)W6Fz7 z({e;i(8`5+Pzzs(gM-z+B}h!QPmRG|<4U6b$6l~uyqLY#Bx%K+$am^F7^CUV+kK7=)Qk2kk@r3 z=9G8BTa5(9-9O$oj!3t9cPe(_j6HxXw8!9K2aiO-YQD_;Ll3NHd zd*#m6{1KEol6<u<#DIfXr1DiX3Ko+uw3cDM&5r5#uwOU-ThNeg;wFE$ghU~FVd^O8I^x&J05`7y)=muq=CNH15^jM4i~lq_?ISl3p(CWa zkaCoRW9%gCuG!DsjF@Q4XaQ7R#I4YXob06X>fd)iTg&ckHxvsvO@vLS1+UkB_xAQ) z{+NhsS1~CegspeRkr~rB)k9{PJ~Iye2rvE-de=r2^!HVItK*dDeL=a(EQN7s$q1TR zP+$aH?}_8~a@W`sVJl;wKO?AX%k{(6;*(~Pi+mu6(aP~Q31M!>aVJ%RAAFw%-yfB` zZ4h6w{yEUArt~KAHcJyUJg=$Yv>a5l9vwUrFBcZYpXv>sEm46dCLt5qA7ogDoBr(| za4Pq;XoHIx{yos2))!00&-+X@H8e!jbI8n2hn;I|X{p&KDA??*2e1HCO_?Fef=Ru?(Go|y8jPrdii5e;uvTo&-@a8IOsf(0mRf6qR*A{)*xhZMoKGMDa-7i-VEu#>kAlZ``=7>} z!DlV(E4|3v^;$e7WU zCs4;R!cEhYRtwF7tFM4-U5(FQjwruJ5_ov-$Xs3ZLZ6>*pYnTuJTC}724~*-!d2<$ z5~IDw&{r>-n3`f>@@avumFoi5yGnm3zX#rpL&ftKKi|eJz;eC&qmW=0&lSHzU*H2D zGout=R*9v_3FzC7B!$2A)qKzAo~7 z&9{~7e*g-~t7&F}rIh8)YMae6t*2gVrz*=|J+{80z72+;O=F6EqUt%3;Mpqd>g=RP zov}RbT-N2N4n#{L_f?++rTk8IDodT7WwA_VlJmpx0uY>)q6h242j>TKfK&&;lF#~- zfEz|$_9s%S($i+~^e_yoQ*OqkGLoe4l6LISlmQMXlBHl z>08N5jTYIY^VRUpmUL91_16M0H8E$M&%&1+(F@zvx zwka{W{~#Wk>BKU`=Qg8|Z}}5^y_HWxD%8i-by?+|4jIx1sZxkBa^pkV;t;=C+4$xSnTqPZ zM@h+d67T|~+&~oYJY38V%~}S@(UzdS^8D|>HvW|pyC-z-&Ac}?n2=hrft3*0MrJ)8 z_!^TvCHLbP9O@p7peb(c`1bOH4Tex)oTlj7lN3Z2kWN15%+$?)QwkH}-F1f67 zK6l}>iZ}OLjnj&_(QgXNG|KjI@dQ`Nh;IH6^O zNlLS`xx1(8voUvea2i=0_alJ%l>rCX_!h;HaPn1TW_^mlq7x{wGpShMsyn$7WBSK&YXj(EE8{{N^+UE9>I?#ovNIVuP-E%{wypduN*n7i$l=0Gd_UrLI zq3gAuL%G!|o=gjsnV#HqVx#m;+WP8PW2AD8k0`FHZvK!{X%ptjqxBOTaX?G>tb+n-ekVIKIoSo86v~2JcyU$&y)Ix7k{rrFe1I# zBjS$pHZ9xq*}a(sFD@)`%pgga_+4UIkO z^39)pYlE2!!>O_5Me^r>q-f5;AU4=3&%v+Os)wl5Lvn&+oPzUfYdlbd@ksH&weH_z z;>>Esm|FEiMMj4VF3n5-T)k$?Q9!9A-|7B>cm*f8w}ns%@ChM(<_Xq5a) zn@8MC8Kpi;9>K~;*O`BvjvOyN=@fn=`Cam}q_~b%eQH*`<2>uDG&s;LJbVOFK9reY zVr=Rr3S1kD#H@Xf2JKw)JmD)7zejU-;b)a2Jq=$BaBsqIbdgyyI2sGAd?egBv@_8I zSv-w8v|^YreY6BKfGSbD9A z6qn&g2QI&J!u{|C@g_8eIU_Ii_?~HpbyAg8lHwM=9`7Ar$Ql(C_f<}Nm=#PQVKf4z zq}!_`G^%OOwxxs9Cc0gU6x{a2ORSny1I{xk8WvYQn`NWa(*{O7X>+UwKPfd>^I-M~ z_)Vsu)iR@H^jjoj;3v`nG~XNr1k5pKm%ACLnb%9;;>5IdwbS=Lrt2KjN1Xit?>f@M zOh?{O!L7YMDTUAa5*=j{a^vGy@w>S$>S2&4C6epI7fL1bhF)*y55KU+c8DSA^>S+s z;)K4wOd}N>0RlW!)i&nZTLHaiF3{A?69)@ktnT1C%E75Iq0PNeQ1w8|vqvW(NycKA zshts$pAf6-2++C|mY3`d%0IvK-C~`l$N$48?Tq1Z@|Jt|%wf{VR^vUG$%Nlw+&=pH zv`jD+H6h4Dh6EN2Bl%qzHd=1R%BYL@@j0-kUuy8^e2>Q_!`)rkZGSF7?|m7WSP<$I zo4Sk6nN(T+XjA7@a=!yPVB}6VQc3PQzo3WwvHXcOrwo@T1jo5?NbbaXJdnKy{CUpgohG00 znBp}7sh+KRW~fm%9ReR80uC6C?(3)KrWSs=f9csaaC^Axlg2ADFChNwE-+;MaLKlT zp~Ynh4&ffNwGf8Bcg{B_P+_T>g#~>~!pqgqcX-!kSj(+<%k1rGS&xK{qJg>sv*kt> zx5#OAQGIz9cps;bXib|Hx8~TpGqYMmsrS~NN{-0GT<@4W1o5qd$xH78TiaH?8|~4( z!&DaM3O%q zWR$23OTsge0uGD>sixwXaDTgp_yOS(au5p@8S=ab%HfOW;hC!{E4lv2NYk*P(>G80 z-ctQ=^*!J2WD?j#jn`bnoy)420&7Z9(QUL2db>xQgp;x;IyN#5xm zNFNoHUy(7jiCO{GNKYlK8BOSNKecbl9uE^b4|&>|9(!KfWr03U`DuTbv{=(8|27&7^32O?b1&VWJP;1=p|-7F}yP+$OBU4OdUfVR-oMcA+8 zzxFv13*XKbE>9j_z`?87Dv@|gLZEE`7jP)VtJ0vXIQX24A6(}T`S{Sj5M&AJv0a1|BU5 zLxx848FY}YfHf*>d2esK*)_~y19R=lmo39UDAf*A$cS6c0UjcL8Q*5|E)4kR@cy1% zf2+FX5+2Ou=Gt?nR7`69gA8Dl&$PCdpxgC7_Ib=mb?I98-=9F#n1g2nZ48yv_>*#$735RAOhEgFg;tD%6M{uI4RY z9;IN|u4g5i-c+{5H|naxz81<+ER65|+_pGN0LjP(D76K~#aH&1x9A zafA0P(=^z@{ZnFf7(DJ3xCNnIRXLiG+-ebzVm}UfCe~nTk zBLz$Wxoe;GtUm8TT5Yc8H^=;ME$eu=;Jfs8AHj4c7FC3jWOx*tmnfq2rTC7Q=R|GK ziHx~4ibYJ{RQON&Hv9RDn3!GvMZ_LmoGb6z{a=s9{s8`xZNTB_|Bb-;pOd`D7T=as z%Ja?xoJH6plc+_gxtUoU>Sv7h&3|RK{~}L3&L_*p*{c=k# zGOx@*8D;*x%uJE}8>sfza-LGz)ZjMHEkWe-Wq|70=U2yyLRVx8tQKC;K(*uDE12)p zlW7)ZmyWZL#Q%WlfJq@m{o5+AwKl{<`ybAMZAh%EXM&4D@Rb-YzcrR4aZVZvxR z#N4UtS6?5to< zK+O>^L1h13JirF~mU!`w+UXN}+&fK8ZWxQn?4b9znjtPpJB5~c0|PHwhb$&$yNZa~ z`r11<@J7lORw*2`vNn7D^kmmD;_3Cp+xVaOTH9$CKsoZum#jCbTQ}k3a|Wq3b_Qz7 z`mA?>-Fx*aCx=ipcCNdO>p=@ch^b9CyyH0`=-rtowCy_mZqV|Ft`rhQIu}(8|ZG}8Es8=fjnX^?kDNjtSH>xm)DII zk`8xmM$!plkN4bAM_Kl^%ggUhuK22C$i3UQ)MzJNT5+*^d!?_hxs91_e*Q)V0OG6a zuueEkw|2>In|en`i1kely=J|>Vsgln?7CWPkvoJw-QNKnfXDi)};cj9TLkIh--@ey`Gbwj>Yk z&9^;RH(b$N!CInp_aUqhe9WauW*B0;+9dM_^i6A3_IVa$4P}ho9&UZ&^rX7uR@A@g z-qbOnTs)8j_$)qs{p``{_~g{HZsEtat|haDm}Z+g^LbL-AMyNe)JM%@l^1Vi`ei3$ zLVHCz(#L}!r7}&|G!E|=90>Mu{)4f4Z>1*fx3Ib)Xhl{b@x04U?9w?eHw7oho{Sh1 z(VM8&!+nEe;uA5}`R?}#Zt|>^-wN)!WX1qeCRK;l{6m2$U*{gSYaZ88vP{(XkHK4K zX1HZ~UHyGaaqu-5U~DP->I7G^} z$gWDV8l*;StJW)CO&+`Dta@_`^7F;9S~ZkQyb3%rkOJ2^_%RY_DTp%2vB%e(t+Sf$ zR5;6a;+YVUeIXRVhbO$`Pwru{wJXbTcrQm_Ef<1J|H&$s=536dC>(c<1VH}eYvrS< z3KuVEZ{3ak&AGZn>Px%%)yR%4a+V3%YIyMbXZ*f4%k1J?)m_jpD0#BPifz;|=F-7N zJB1&~7~Oq&Rc)VVhtA#ULq;~h!mo&GyuFupk<>6Bk=F7#J@~y<3O58YAJ#5Dl$~l*tx$ro4_^0QDL>T2G_Yx3i5!w~zRAPf~=6b%7w zJRW`x*KgEcVdjS^jL9QA>G`jzxBO?XRc}5LQs-uFURoV#jxnS zzSfh-STB~zwoY|NX4iPrkyWzA^!UU6pNW+mpJ|Mww@pDtRdN6Ee1&%+zMV2Y=7~V2 zH&onx6b{vy1-KXADh*bSY+$sVgsN$V7%=;>277nJj-om3`08ru_D7YC_0fS8j{ho1 zNs8*9&pWA~2QLv|?1C%veIrV#autLiv@eUc?mrw{DRp26-=DnpMDPk4{((m+z_UjM zw~CkpY^Jr->&g*!Eo(T^qai)ljCljL3tky$(G{XIeINdSXZ~PR95$h1FhfKd$K{I7 z3=vDM;j_WCqVFqi42RhH=|4q>ayn5tk)_u4Rj!osxv=F>9vcid=7}aXu;&|sEjc!9 z3{JVXxU}xq0&8wKqwfBtzX4(;Szo+ObEiu}2Vq~i-$>3DX{%gQ;+cCn%ef!nRv!`& z<;vC3)6e&>M8(}DLG*by<&w)Ci3dlulvp({3zzm5lkRe!3`{EL7JnV+r=UCegsStf ze%Ly6IIL&)ubZ;E%~etG@Bw z#<9Uc(+f#unl3A|%$Wu7dD*$$)`9qHp~O=o^ZVs2i>|FGl1#&lm+{o&{6kK-#e3x) zDLM7a@U~rn0xm)jQs?B4#0O3Ywt47Fdm5<*;R6!~fxU5Z9Thqb<3VmMtdM_kiu+?g zz`?`k=Vi$7>C1<>L-m2RtOw13taKb^BHb{M6enxRqyukvor%OOOodfU=mmQ*Rnq4T zCv2%CLNXO`$kx?Yx_e1Wv-VZ1(h=?xKZOIoDP=+h_Q+{9SG+b5B!+#zqJ}$}*3VUi z4|o({%+E&G5O_B=`qmLy4pjzu&DBnOH^-Q;KiXN}m^diC0 zyy}5w|EQ7emt$bIec0j#s*7&8vytk~v+tYuP3v@m(gn341KcF z(`D(SI0vTZS_Rl*B+L|Z+lsk+vE$C?Iz zT!$0y`Tc4U(-#-1a^7L+{Izc@#UlYTp`eAp_)fI#hgTdt?H3vZL@XW! zIEr!Pr~}x7E(-|Ru)K9J6K}ovm8W}_Fx4vE>EBnKz{0@#Xco{vGOp*HW3f$^KBeQW zkGLSpM%I%r69;@dt;Jl9FM-jnjc4-zUk+e$gi(Sq~rHuH}W(&)9PV%`e-R-!cnNam|! zn*Xda01)u~S@@(6y+s9C_Ejal#`k2tB%eXSgG=CapOtzR&P+bd(mp(VPMGw2UX8cX zozDZir0(7Juu=2FU^@n_p@W_VCwJ=y0}CYtt73RHxs)_gPV0T`OqlVJ%G)u%zqyH$ zirp)r>FbSrNN{hovO@WibDvy_#U?E?o)R8N$fzgSA6 zwCTp_pChDqS0%3oSycv2qdyOTO8z9qrnW{qM%q~>dIgwtMC31yM!F5Z>7N=yRIWeC zAtkX6Utk~B4ru7==zM*`Xt}>6cm|q?Y%O^e8X8(53@AatWEeuo$2KfXw8*0f!aNf# zF`#fE1n_u)xv`PW<#5ib7qvIr6_7hv<_YO0iXkC8*NU+W1)V+Guijaz=`bE*l{rLH z`MGdm`0)1J(qBxqYMZ94W3ou)wa*hjtn=Jl;xVCWyc4XIK(v=j^iXf^lxOuJ3(&RZ ztg1jtXHNR7w+Q$~6-^S3M(_&qz6n!L+s8fAl%8v4rHV|yk9|V3AYb?JClxb{BXpwm zgB@eYw}T-`Wiip<&l@2{J(#zJdC_(!m+tpM9G0}(@lF}^=Z*rJwKg^Ut~n8`dC^%0 zFz{p7i9OpaPHO1<*}8UR=e)+!vxP^y-ADJS%iYN7eUQ6HR&>wvuAZR`PMc6)5KeIvTwd?*Zu2`0DueIwgRS0MTYrWl)U)(m~C(rmVIBbW4 zE||q)0ReZ8Q8#@;@80|<@@QEbAc$j%vT`*3x3;lB?O^d=V7ZprIf#-!QgY<4(#fq= zBr*HS7XR|bAz{9b1zS_jEK*$wlFG|b)6Mkx7AEyc7zEhH=N7XuzXsBvdI6yQMJQL* zU7AZ9@)g{zdHlYvCP^zv`@2xM#(Z+NStO=mLhyglf<}^nsAfQHp60%aibfL{y1?75 z`%HyJZs&b$y9kwcJgE^T@i*kG<4oxx17t~%atCHp-wN4+1SvZSV?zo|6qkZTK-I>_ zsiB$PMbFWcEq6TvBtw`N-_h^r=H%Z3U9>8%{f_}I{QehXgXezTkH7!@BS?f2GMy$Q z#q7iU_^*H2dq3YlzE3~Ikk64>&?`Kwp%rCW5?^Lq1YYZR3va#lzp71aYqkQS>gW*vJ`P2|Kez>1Bw;Y5lkHd&S};2>@;*8R z|G}taEyo(pC)vX%P3*B{W{F^UiUBDI3k+3l;Uk~Zu*rLA{MK?8-)Fv77Y5LStU8-Dlmejvab{aJogMrU zk6zy(MjNU*p?flVA`CPXK`XM~miK%Ri5g{ifVq$R#RyjK38 z?+K*p`Rx;|!jzPDxZF#9hRZ7nwr*?=Bzkh`bky4QAgTTP&UlYM5CcT-!7tq=ywkO= z&R0mV^jMpIh}yGZh=i`t8DRS;gBIiotxOsUdh7lgfaP}ZS3G#u($`1Ji^D&R4HiQX ze(CLv8n#P_BkBR?AP(P%8q8Vie6ROb1xwj2HA+WOXPB66l?OHcu8wpEL7|-=O{BJa zkk{C;#=)7D<4ccbOXxF49mD}s_M?BzKhm8{bR{1mPcVX<-it%=?0Ogu)mO2X-+mEy~ga250|WkT^(qxd_SmjuWBfCyOZIp?Bi8fPHOdS0qk*F@%)1j z3OtxmnLS(|1esbR7;G6nUl2Cev4*)fS!-kZVM4+Q?C5Z_76=tqXSUQF!e$mj>{RXv zD>`3r(v{mG-n6I5a2Id$m|^;QXJ_hUxc>`rg6_v&Vo%nC0h1)@>Yk%*-~32IlBsqD z5K$Y?46X-htptaFJmxt%Ue&Nlw2Kl2!A{>79zR{PzjG(*7-uN$#RiGRojkMD?jK*p z@j%$XuM~9bLCjJB)@aUt&cQa8)-^uLV`ICcWj40^#}nDA59RL$lpRVMHE@j*A9_0S zWgSc0d|aLvlO`}Pss@&mAr3S$*Rr7E^I_VmMza&`&ZEaP$pT8UB{SI>F{|SaE|L5L z^S*?l0*n2WUl~FmB#z{--x1nv6YLp6QB}tuonc2b-+5)`)~8#tNJAzjY1Izk`3LMY zt(2}4{L&|L16I(sWl+T#ckM)R#!MrCHL+YAmL6qzV%UVkA8Q17C+%}t(5O?n*l}rePr$N67$@d)c ztP%lCIi*wB?B#4VMTn-Gh+CMobK`*nr@2?pu|lHM9x2*alzAOp+G5OUr;Oe~eEN;m zUUJ(d(xH_v({TDOB?IWPh2ONXZULWu2b_<3Z6>(oQtfDv{lx`ky_iHsr~uwM6gx~0 zD%WoAf=D(-ACoDCI(Rs}mg=YFYG4^|y`{$FsYb0)N?DWi*l-++DcT+lB zIpdqocP(b%Qub!q+=}rGtB*y4Rf>D5zolta!UO(bbXgQxQLnifr2)fV#JAR%WYbOM zDf;QxZV=t}Vr;SxqnPXN_mERpuSQo@6Y~n>_epLrS{Tsp(PDu8ai{T1mwgkltDM^m z7ShqZ`q+JIr9=B9y$h-4^>WW#qEV_Fv--M04^JakELJFMNv9{v#QpmVD7Hn<;~bf- zl2OIPeP&wJ)aUyS)e5kDPry5gyX3mQCzAu;nke6;Nat^&Lzg_KuD&|6r5tVqt?QSu zZq?~^IhJU#e602lA_N;qf69LG=^}OaAR`%4YF|a}%RS$f@{wGSSqF6MA?}*R+%?9L zMf1_;V)ATr6kr`7oAfIF#<2vIq-NdW8DUxbl>G;xt@wWY&~@0Bxu(Z3pWI}c$CfF( z$M%|HWK|EhCvizA8SEU885l8G=ub;_Zy(G2+O<*58nIhQutoCX0%_#_X>=7M)6Q+K z2dv2cjyQ6_8#*a5T}^dp3nOEwE9fEj;Kw%`i@!}h(nsE(%g}Mfn*hPnn@o3>Rkpc? zT`L|9&-T?;PqV7!+h;GSxHxdN3(B?PLvuSiB~Mq5TBcpR=A$qJO1?9F9YPA~CzN?W zOEUSdk8VwA%{OuTlA{LBy&2P0XF{qPT5}&)nrKYZ!Y+BtzEF7TAZ}NNJ{r_&%(z=T zjDw}p z`NlRzlFHv?!bhnPKi^T)@*w37As1MMOxchLZ9lj$%D8bjtvMKZCh7bEqm!tat*s^e z(@Ej8C^Cl0jWhcLkEdI-V6i3N6h2b~NM6t5FRxAVZ&Wq&zNelFie+m9OSSbmbLECs zN*t_C9Rn;_0mmnT5w#>uEB|{jZ_eR+FK6r4h7kNs50X<0l}o#3ro5~DO#Dkz=Rgw) z1@s+=(H%Q{vR7fGhx@kBI`(_#7Ae9UXS2qk_9q5N*pqc;w;bP&ubacH{7v1hZqFUo zA@$N*aXYG8DVZbiTz&rsVQ(!^iXoj=ptL2s_GMWQA@-V72rSut1U$E1NM&?AJ2skL zcsoAim}tWS^O=15Jk)mU+WCl2Yb>ExiI^BtL9&gsVg`?XPQ(u$Yah*IAx!-5(@0s7 zVUfhaT^6P~Ly$hN5{VogKhCNNX5Qa_-iST;+lZ!B6KAqM!a)AHuu82{O3C#9#GMd9 z!D-;g2?s|9Yo)$W$iPfG%tGDK#fQ9B-=AVw=|QfW#&_bpO8k>K(1$ZVv3ZCZ&;oz| z!YQ$Uy0FC-c^IR1di}&!X?-KEwxXGP`=qR({k9lL-UvvH|tRTyC^a0{7OcpVZobf>2H4P5%xEB7r}c5$j+ zI|AWQMDrOcF0n~;?~$||2+4_k{ASpi)Uzv9ufG!72&s=5XP>68JnxqRG)J#>e8gGF z#WP~!#O3FB+tQbW;U?TB{?2CPKMB9~ok9xW`X49X8pnD(#0PmtetMRbWTxOX6~AYj z$?%;7$io1y@PGl_)+!P5KdGIQ--n5P**P(*lL4q?^8L$G;WsRVWhuI9-m?eos6;KV z_ptaOtZABi?#ccR0X6(V~F; zIfM2~dhnr8$zm!fbqHrj{ZbE{(xJ$mpLnQ7blLh3g=hQX|DJGx0DH3M8;9nN#xQTa zXJ>DSUkTfY$@~s%oQ`mI6ndvuHKexwi6FJP1^2F=A@>fSHEr3j)AVOxRZ;de3i;O=i4T6L z>8C(5jPz{Tj!GE&g)2&@=QaAi zWTi!4>auR&v}Ryx+lv-Oun@+A}zG=r~^$!Ec0JYS-z=yxp5j| z`Wx22eo1`#U@?nEuKA2s-QH1U8;{{u_2;}zQcjMBC|U{G_)_OD0~lnRVpSHVKt)RH zNgCfjwHa4=<1QmX z4rch?s3|2P>h0@XFj!^&R+!gXcvb}I*0l0j$`e$VRgU_f_6x`}*K6lz zrWAC13I*-o{(6e+9*Ne>z~&Isn*C%P@k;VLQ@oq4L6sWlQH{o74P0MEfi2lRMRE?~ zm)22bnO2)YTis08$k9hhE()RYMP&Vt8F#A`nxng^Hi`3Wf)c<|_!~Jbc$oJ5zagj4 z8EPM|=ii~96&|UJm~gD<71I~5MA$trCT_~N0sX+-igT*CS^VTxdl|bb8v}KM-q^X* z1VR#`L6Kso>}dBM(!DZ_1<9POD^3i1a|ipwn>?`7l|AfSN_v@(oMP>1#`ksVfSJVx zW|c6x4h5GuzI}@{i`H-}MG>rxH=)>%(*7+PZMbw`l}U zyqHz>xv)%_bVpl7fez4aLA>kd=0cJ?kkhxo(9X(#?7r~4zK}`2a|>_P;#zVq%+SIBD2s(sxYAG{Gkc z9q7Ka?(?=291FRvJ6_$u`|>^Eo$<|BT#QF`KTdQi9F_vTv`Xi? zJy3F%9*psJb(xV6BV~_{c=}$AUXSN_C#^)ResEqa?5NrSb%ZA--I+f$+#LtPx};^S*a!hK4Xa)6eah_UKx~Ll z)zAWrK8UruOr9dSM`qxB9v0f-JKVeX%N*0fFb+vyArCkYC+gb4=1;TTGM)~UJZQ)m=?e~+%Ry6W|$Zh?5E~W1`RQ-Pp@U?YU z94;Sx(xPua{ZRFG5h>md@6jczB`NMxjsbQ)`@Vld zv)UE2mxJkr?ae1`1y96UA>3q(Iqv0V>z3otAL%OnQ-RwUAU@~Wo{Ps+y$qHXjOU4_ zkXzcX&Mi$%H~vRqhsBGP{IK^o6pgm8PPtMr?c;>Ro#tdM4qP`pxGjf(5uIBPg?U{l zx?NshYwOXaUYL1ZFFD1Bx88pDBFH^%ilCa~S}Bj!n_JGQoBl`m0?r9-eIwrxv%;8N zvUFhe6soPxl)MeUi{J5EW$ohQCDL-yB+ie#JZCh}9^G4*D69gkZ!p2No0Ly*hpx3# z?>`3IGBzd-7yg*-z^KWm|91Gy|Cy>i$$J$-u(J$mMC?lGn<=fq;u>6=3D zeSdngJ@DA8vwe?bqzB#q3s}5bD+zguxm)4kDmcwqDO*#(l9(PmUo0gDTOr$O28h!KH&eGEhOlsnCDRoyxBYYqI9r{`|YvsqEmD zfe$!)c8l4}CnFVWdX(}v1vCD~H%enJr|i+m#jyIAEAQY0!2XJn;+LPFL-gD) zk*|}4CkminU?TcDj7<&Co@GgF&AqvE=Z=S8ltl;WG!(0LgWB!OPPbbb>B+KPo5pb| ze1#sR;XlK+q7#A2#jA(#^?8r){ey}czHd~D&9yn7pga6Yf@Pf!()CM-dtub2fAWYB zNkc+br$hPZ+sGfrTPCL6U|S&S5FrJ*KQnbgY^uJFLA!0!cXLaL8&oZ7DU}%Xdm37; zi;s@EI(+zr>bLt5fC%=V`0lqqvCyNCViG!q^>@X>1%T~7@1eo0;`LOIs*owz-mp9? zC5yKqYH~|{FFi=H!px942#hTRS8MXLzP?%C-@5V-T8;iqh^+(cF0}lIa@{!55#Adk z=lR?&c5Na@dUk)$mPUY4DM7nxEx0>5!&EV4dw5cTYb~rj=g76cgVf-n zmsT0UuvkUiM@$$QTBO#ytd>4C3ImIJGYx$w>@~g*G=g z!@eXOpYR(kE+=g;%@pB3#QE!rP5YU?N{swl)9yoq>91|5dbZJ}4@2<_;&k3uS zoJ*rOcUh-tR!Cuuhst6#CABn9?KysCNjtQv?Ha70x`g<@I6LdGrrW;%V_^_p1|Vr* z&`699MFpi)5Re$4G-H6IG>U>ssdR&MY~+S)z%T&GksEB3(hP=D14jJ51H7*5j_0|b z`{y6mbsQdt$G&lX&+`-S_v^D!d7tS}P^njYlAK4;UBxdGeR61p4(K%2DP&s%Dv<|6*J)pE)Kp;v~UV4533 z@GIZ|5@I2(McL%KzfHd1EA971^uR;SGk@8hTcv@2nEBsF-?o3=86Dqo@xXoQw2u4l zzgrAvGzV_^q$V@0`*$oc_`9D=OG1Dy+nFzefR%I9CMUWvP4-r?zXd`-$)!e6nhRxW zpfH%_Dxg1=k$ab-w%3rW`+SY2=B<;NOJ4lnPc-hms}PdhaZQK)<8krtBD%4^NnfqM z;&cm{yTjNyN%!U)BKOqA&L+IOMbMIw_-9Qv9#mk-4dxns}Q}lb{fHryS5sTwPM$WBuzl8t{*LUg|2cHe! z(VcZ05IV~qm+GS_XZt3FurP~V-q6k5y1jR+4`uew`bqQFy8J;k9KoNf9Oag5hkrXh z^S(>&jU)d)x`%-$U*EYDHJUI|oI*%S(=2Um z4xc6SQlZKbYJ=IMV&wNH=>iWm(+7gQZZ_Tg9DPSiJ6>Gr#6jOS-^U6WFA_ZKTh-od zwOvie*$O-*6e$52CykV%WnFu>ZCR%XQ(uH|NCy>=8&+piv3^NCMl6CZMY3iUK>vAr zBXUQ*swoBKHe`1Q1=-ahI^&V1dyj+R#NYJ?b`t*9>D3nW`{@ELK6wCV<&&GItmWR_ zj<@@)I0{7;GaR{_IR3&AS-%Clwk8&+as(pnB z?o{t}>kSe2bPWr)e+V?045PDh$qPy1;c<41GFJYs1iD{=Wy@ZLwi19lT z)Ui{*UzqW+K2CCO1&;Hi$;t$j*J2Ul1eAjH==cBL^4EbbNYyYwaQn^V!SK#h`o&~e zcks%i-dvx7+kWhVi9-Q1akZ^VoJl=;^Q75#UJKqx3Uh!-1w!DiLDz)rd~Nc0q`TQy zf$uH)-MBrogZcRjbje@npFtoHcfeeXI`{L&amBI9)7I!9q2c&vYMFP$&I);C+kSm2 z)gUQ1YZKXQQh7?|1d!O)PKL3PnF2I2dBB_ELHa8XAf%!ohxW7(6V0s_|8xBr)>pkJthK;bGM$E zoo#hsC_WxgCFol;-!9vCr9#OQ^V4O>doSe>ayuC4+D8Ws2*5;e$^H<3HoOp9xhnkf z&?p_xsMrBNN<=+6QYhM%r$!K?&@?3|)61&H+uC-9Hb{0L|~dk>a_Pe(Nm)@PB54 z^})L~x)e5O$^32E#FI77~M45CTyRUYll}rpXwLF z7ofJW@EOG$#`4=yRXN>=ez=*BY5Rg99OW>;`2&rv8>sT`hD{R)&n_U=3I zWe~7e1ziTr@wl)cjQ&~!)nUoL0qyGeMtb8B^eG5Z|jS z1NiAgmJrZ_pv3mrBc^Fh@Q?kas!xs2-`&!dr=;XVI84a~Pv_-yAu9?=%qTKpn**Fs zAUzJsE%e4($o5wunUu=$*3%wJg`YM>*TW?q0RjKvV5qTX%5mZ~BrL!#N4PT>-@3rF zmu1jhRsJW9g)nfP&OcNph_f@H}!eSwZO{)Jm!Lolu66licJ#24H4PrD6=yLHgNoC$S6SR75u*3e&t zXDo`uHTMkr<{;M~)tX2j+hp6zAvn9=DoV%Sxq{Hecg4Oi#kFx!`y(cFVyD~@2&DMwmd}x6# z#+v)gla}91_m_q|*$5r3x*xE#K8y$Ihi%122XKQhN;TCN6Ac~i4*AoV_V5p&$QDE^ zvJIWxK8uNdm#kUvBXT?RLcq_oO%A%yqwIAO?zfF=*Wcpi<-tjl{M{ej@{wz|Qu0m9 z0@z?Q&O}YEOVv{HoXVh#?1fvJUTbSJ{k7m?nNh}?4T>qd!(zL_B4y!VAQh-i8W`wm zHUX?i5sRWs{Z9RS#Z<+1e>2yw8xG?s8Z@tT$$l6~Q zw$FqfyFHUTgZU+)+YCgf1qPT>BbKvOLouAp;9|j4$1YhGK}nZwPoU6S@-`(Kmg34C zjTqgJF>aDo#yVsXVg(Kcu$6zc)KS0Onw*mOKAusEi%=Mow(&xwdg*bm|J3s$0Np@2 zOx3)fnfP7GJ#4MMLJ4Zm{d4iW1-Ct?qmJ&7g+qt5U1IcuYOp@7DD6?hMw*9`C8;aR-6&n?!TMmOV7WIV&>6uwv&~ggJX9JA^AW zcKj%B=#yqu5pTElVu0kIv`F2~rds@rXom;8T?>PSi1F0F80VTSH~PAqs6Isi1x_5@ z@~tcpxs^bl0`yOmE}o2<@RCnGx<$xmI(Fr~^^ihno3G1-j624yE?>_Y+#U}OFR&l9 zOikvun6c&5rv}IP%UWrQY!UBeyrE~?$1Luft6Qm~bpU46c7uKQ>0LVlWFdS`aqj@q z>%)?L=2|>rkxT#HYSm}se;=R?_GG6%IQSIMEZIM}L5?f>OcLa1O~(Fg1D2T<7?dwJ z(~}TZSSml`eatS0x+A{MTI#sTXD7B{I~@)W35r?j^uLU zOm8-zP;Eo?Bux}82Af?w><*H~CoUrjK<-vG$z+Ir7B14_2wk0+b=qXqDK*JQIj3H~ zNVq%@SMBh(NM30^H*}lBos$3>U{xTkOCbvEEkbh|0>JCVW@hJ;4i2FBH|mzK;Ki_T zq&`3HEIbp?g?en5xu$wQuiINuz(WyBf+_S?5wp`e zx~Xj60ZkzT*-Po)Rqi0E%iVXZmR4xwKQL!bSSK-83wD6RmZ|J1^mU@uVx6S1&gUB{ zZUXaHF)YG_A=9Yk;yGqB>M9FR`pPrfSR z!F71eQ&ApDd>%DmB=t~2-KB$p&|q?d00LJTT;_XY-MdE*fXCrnWdYyVJ$&cOCHEJ# z&Q^^lc!xcfHBATp1H$W+G4?!DIJhqMnc*^OORcSkI{e^BXc%9~jKdLn=c zOw4r*7+R9wY3{xhfA0FA?->(X+AfNd{5Gx!uw;*pJR6=O%b)EU!LDSt)ErmHK~rXX zxhV=Ci2h6I-cH-Ey&c(m!lj2ZxreJXd;)&GP?l?DPUtAs6v9PxbCOZA1qnvu5^*yX zWlf%-xtZhb@_=(|y5YRYRiz9o^egxb;Ph(PFIrA}W&b~M^xwQN@!|haNfMKmI{C}h z#ZcBUkxZ5Sur-)j;ItlWrc}BFQtK&qNfZlzHrn@pQPJ+c1It-r3eN71OiCZdG&{ijb%2ig_tD=tBkAOGj-CrfFiNgc2Yz-4%*6Y5>58y`HCdQrjHEz_)ICB+XZbBrpLSCPylXxE=AN~FmU~uj_ zEzd38qSny1xG6TB&hKI0Qm%|&yc@pGyI5H89_8c81NT#$vA5TWGBY`2|3J1-)V(KP zVh9fOZ5G+SxB*7kQ=NP2<4ww4uuX2&=%o##uoyA-3Z_E8FX}W$?DIrFdkJOCCra*fzr-YHF<0Al zKiRs0_V29W2y^z|71W~xQRB~r+)_gj@qeG=G z6|%kS5JPawexh7hwi>Mb@Z2X(DR&MjH#k@3WNh}4DFgX(yapdzY#~HV)vUt)1rmRt z=r3kdRV?dD)*Sq#^wK{#XJBuga^Y!DvPvTO4FhIuak1R%exk*CT+b(s&LYofLs8Yx zctA&0igGn`iCuV%j*hFYdpvp|ePy@~t`R*@u6=z&ItS6>VXuesv7Ih>FyhwlEj-VJ zoA1zux>B({>A?b?@p8z5+L5Z~n>e#ebIv3vTki?5bvwswrD_nV7^G(0-6QrGE=-E| zhJxf_cif-V0P@HuFdUJ*GUuPur+1Ctf$m|HTD0ax&4ivTuiCqblU0Ci7qGB@R#@~C zTRgG2sArO*FZD7lpk_utljGQm{iC!e_uZu%x|J~rj;{|(np6!Il^do{^q)bnfB2-d z(`(u+FLR1ADts*4$VR{bqU-oXUo7{gu&`lE6FcR#1NPJmvTq~Pk@RXJ`HQJf7=ITdysGkjU_=