From 9f950b1a8e7569558c3e2d5e40ef04c480b9c791 Mon Sep 17 00:00:00 2001 From: Benzy Dharmanayagam Date: Fri, 11 Jun 2021 15:29:58 +0530 Subject: [PATCH 001/279] Updated-5138946, 5138946, 5155963, 5155998 The following articles have been updated: Changes to Windows diagnostic data collection. Configure Windows diagnostic data in your organization. Windows 10 & Privacy Compliance --- ...s-to-windows-diagnostic-data-collection.md | 25 +++-- ...ws-diagnostic-data-in-your-organization.md | 93 +++++++++++++++---- .../windows-10-and-privacy-compliance.md | 90 ++++++++++++++---- 3 files changed, 166 insertions(+), 42 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 9514d43951..b277bb3b25 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -24,7 +24,7 @@ ms.date: 07/21/2020 Microsoft is committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. As part of this effort, we are moving our major products and services to a model where data sent back to Microsoft from customer devices will be classified as either **Required** or **Optional**. We believe this will provide our customers with a simpler experience – information should be easier to find, easier to understand, and easier to act upon through the tools we provide. -This topic is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas: +This article is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas: - [Taxonomy changes](#taxonomy-changes) - [Behavioral changes](#behaviorial-changes) @@ -36,7 +36,7 @@ This topic is meant for IT administrators and explains the changes Windows is ma In Windows 10, version 1903 and newer, you will see taxonomy updates in both the **Out-of-box-experience** (OOBE) and the **Diagnostics & feedback** privacy settings page. These changes are explained in the section named **Taxonomy** changes. -Additionally, in an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to more accurately reflect its behavior by changing it to **Diagnostic data off**. All of these changes are explained in the section named **Behavioral changes**. +Additionally, in an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to reflect its behavior more accurately by changing it to **Diagnostic data off**. All these changes are explained in the section named **Behavioral changes**. ## Taxonomy changes @@ -48,9 +48,9 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience > [!IMPORTANT] > No action is required for the taxonomy changes, and your existing settings will be maintained as part of this update. -## Behaviorial changes +## Behavioral changes -In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit crash dumps and logs**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**. +In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 10 device to limit crash dumps and logs](#configure-a-windows-10-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Additionally, you will see the following policy changes in an upcoming release of Windows 10: @@ -70,7 +70,7 @@ A final set of changes includes two new policies that can help you fine-tune dia - MDM policy: System/LimitDiagnosticLogCollection >[!Important] ->All of the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier. +>All the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier. ## Configure a Windows 10 device to limit crash dumps and logs @@ -88,4 +88,17 @@ Customers who use services that depend on Windows diagnostic data, such as Micro The following provides information on the current configurations: - [Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/device-policies#windows-diagnostic-data) -- [Desktop Analytics](/mem/configmgr/desktop-analytics/overview) \ No newline at end of file +- [Desktop Analytics](/mem/configmgr/desktop-analytics/overview) + +## New Windows diagnostic data processor configuration + +**Applies to** +- Windows 10 Edu, Pro, Enterprise editions, version 1809 with July 2021 update and newer + +Enterprise customers will now have a new option for controlling their Windows diagnostic data for their Azure Active Directory joined devices. + +Previously, enterprise customers had two options in managing their Windows diagnostic data: 1) allow Microsoft to be the [controller](/compliance/regulatory/gdpr#terminology) of that data and responsible for determining the purposes and means of the processing of Windows diagnostic data in order to improve the Windows 10 operating system and deliver analytical services, or 2) turn off diagnostic data flows altogether. + +Now, customers will have a third option that allows them to be the controller for their Windows diagnostic data, while still benefiting from the purposes that this data serves, such as quality of updates and device drivers. Under this approach, Microsoft will act as a data [processor](/compliance/regulatory/gdpr#terminology), processing Windows diagnostic data on behalf of the controller. + +This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration). diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index c5f2f8b2ce..b3cf4f88b5 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -22,22 +22,23 @@ ms.date: 10/13/2020 - Windows 10 Enterprise - Windows 10 Education +- Windows 10 Professional - Windows Server 2016 and newer -This article applies to Windows 10, Windows Server, Surface Hub, and HoloLens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers. +This article applies to Windows 10, Windows Server, Surface Hub, and HoloLens diagnostic data only. It describes the types of diagnostic data sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers. >[!IMPORTANT] >Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). -## Overview +## Overview -Microsoft collects Windows diagnostic data to solve problems and to keep Windows up to date, secure, and operating properly. It also helps us improve Windows and related Microsoft products and services and, for customers who have turned on the **Tailored experiences** setting, to provide more relevant tips and recommendations to enhance Microsoft and third-party products and services for the customer’s needs. +Microsoft collects Windows diagnostic data to solve problems and to keep Windows up to date, secure, and operating properly. It also helps us improve Windows and related Microsoft products and services and, for customers who have turned on the **Tailored experiences** setting, to provide more relevant tips and recommendations to enhance Microsoft and third-party products and services for each customer’s needs. For more information about how Windows diagnostic data is used, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy). ### Diagnostic data gives users a voice -Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit both consumer and enterprise customers. The following sections offer real examples of these benefits. +Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behave in the real world, focus on user priorities, and make informed decisions that benefit both consumer and enterprise customers. The following sections offer real examples of these benefits. ### _Improve app and driver quality_ @@ -73,7 +74,7 @@ Later in this document we provide further details about how to control what’s ### Data transmission -All diagnostic data is encrypted using TLS and uses certificate pinning during transfer from the device to the Microsoft data management services. +All diagnostic data is encrypted using Transport Layer Security (TLS) and uses certificate pinning during transfer from the device to the Microsoft data management services. ### Endpoints @@ -110,7 +111,7 @@ Here’s a summary of the types of data that is included with each setting: | --- | --- | --- | --- | --- | | **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.| | **Crash Metadata** | N/A | Yes | Yes | Yes | -| **Crash Dumps** | N/A | No | Triage dumps only

For more information about crash dumps, see [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). | Full memory dumps

For more information about crash dumps, see [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). | +| **Crash Dumps** | N/A | No | Triage dumps only

For more information about crash dumps, see [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). | Full memory dumps

For more information about crash dumps, see [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). | | **Diagnostic logs** | N/A | No | No | Yes | | **Data collection** | N/A | 100% | Sampling applies | Sampling applies | @@ -156,31 +157,31 @@ Required diagnostic data includes: ### Enhanced diagnostic data ->[!NOTE] +>[!NOTE] >We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information: - Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. - + - Operating system app events resulting from Microsoft apps and management tools that were downloaded from the Microsoft Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. - + - Device-specific events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. - + - All crash dump types, except for heap dumps and full dumps. For more information about crash dumps, see [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). - ### Optional diagnostic data +### Optional diagnostic data Optional diagnostic data, previously labeled as **Full**, includes more detailed information about your device and its settings, capabilities, and device health. Optional diagnostic data also includes data about the websites you browse, device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users. When you choose to send optional diagnostic data, required diagnostic data will always be included, and we collect the following additional information: - Additional data about the device, connectivity, and configuration, beyond that collected under required diagnostic data. - + - Status and logging information about the health of operating system and other system components beyond what is collected under required diagnostic data. - + - App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input. - + - Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer). - + - Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred). Crash data is never used for Tailored experiences. >[!Note] @@ -190,7 +191,7 @@ Optional diagnostic data, previously labeled as **Full**, includes more detailed Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization. ->[!IMPORTANT] +>[!IMPORTANT] >These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy or MDM. @@ -224,6 +225,66 @@ You can use Group Policy to set your organization’s diagnostic data setting: Use [Policy Configuration Service Provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy. +## Enable Windows diagnostic data processor configuration + +The Windows diagnostic data processor configuration enables you to be the controller, as defined by the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from your Windows devices that meet the configuration requirements. + +### Prerequisites + +The device must have Windows 10 Pro, Education or Enterprise edition, version 1809 with July 2021 update or newer. The device must also be joined to Azure Active Directory. + +The diagnostic data setting on the device should be set to Required diagnostic data or higher, and the following endpoints need to be reachable: + +- v10c.events.data.microsoft.com +- umwatsonc.events.data.microsoft.com +- kmwatsonc.events.data.microsoft.com +- settings-win.data.microsoft.com +- *.blob.core.windows.net + +### Enabling Windows diagnostic data processor configuration + +Use the instructions below to enable Windows diagnostic data processor configuration using a single setting, through Group Policy, or an MDM solution. + +In Group Policy, to enable Windows diagnostic data processor configuration, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. + +If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. To use an MDM solution, such as [Microsoft Intune](/mem/intune/configuration/custom-settings-windows-10), to deploy the Windows diagnostic data processor configuration to your supported devices, use the following custom OMA-URI setting configuration: + + - **Name:** System/AllowCommercialDataPipeline + - **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline + - **Data type:** Integer + +Under **Value**, use **1** to enable the service. + +If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. + +>[!Note] +> - If you have any additional policies that also enable you to be a controller of Windows diagnostic data, such as the services listed below, you will need to turn off all the applicable policies in order to stop being a controller for Windows diagnostic data. +> - Windows diagnostic data collected from a device before it was enabled with Windows diagnostic data processor configuration will be deleted when this configuration is enabled. +> - When you enable devices with the Windows diagnostic data processor configuration, users may continue to submit feedback through various channels such as Windows feedback hub or Edge feedback. However, the feedback data is not subject to the terms of the Windows diagnostic data processor configuration. If this is not desired, we recommend that you disable feedback using the available policies or application management solutions. + +You can also enable the Windows diagnostic data processor configuration by enrolling in services that use Windows diagnostic data. These services currently include Desktop Analytics, Update Compliance, Microsoft Managed Desktop, and Windows Update for Business. + +For information on these services and how to configure the group policies, refer to the following documentation: + +Desktop Analytics: + +- [Enable data sharing - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/enable-data-sharing) +- [Desktop Analytics data privacy - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/privacy) +- [Group policy settings - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/group-policy-settings) + +Update Compliance: + +- [Privacy in Update Compliance - Windows Deployment | Microsoft Docs](/windows/deployment/update/update-compliance-privacy) +- [Manually configuring devices for Update Compliance - Windows Deployment | Microsoft Docs](/windows/deployment/update/update-compliance-configuration-manual#required-policies) + +Microsoft Managed Desktop: + +- [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](/microsoft-365/managed-desktop/service-description/privacy-personal-data) + +Windows Update for Business: + +- [Windows Update for Business deployment service - Windows Deployment | Microsoft Docs](/windows/deployment/update/deployment-service-overview#how-to-enable-deployment-protections) + ## Limit optional diagnostic data for Desktop Analytics For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](/mem/configmgr/desktop-analytics/enable-data-sharing). diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index a33a9a416e..f0f78ca7f3 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -19,18 +19,17 @@ ms.date: 07/21/2020 # Windows 10 & Privacy Compliance:
A Guide for IT and Compliance Professionals Applies to: + - Windows 10 Enterprise - Windows 10 Education +- Windows 10 Professional - Windows Server 2016 and newer ## Overview ->[!IMPORTANT] ->Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md). - At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10. -Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. +Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 and our connected experiences. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR) @@ -45,11 +44,11 @@ When setting up a device, a user can configure their privacy settings. Those pri The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information. > [!NOTE] -> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | Description | Supporting Content | Privacy Statement | | --- | --- | --- | --- | -| Diagnostic Data |

Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.

Diagnostic data is categorized into the following:

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | +| Diagnostic Data |

Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.

Diagnostic data is categorized into the following:

| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | | Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | | Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) | | Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) | @@ -57,7 +56,7 @@ The following table provides an overview of the Windows 10 privacy settings pres | Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you choose to send. Tailored experiences include personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) | | Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | [Privacy statement](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | | Activity History/Timeline – Cloud Sync | If you want Windows Timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) | -| Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | +| Cortana |

Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content, and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.

| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

[Cortana integration in your business or enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) | ### 1.2 Data collection monitoring @@ -65,6 +64,8 @@ The following table provides an overview of the Windows 10 privacy settings pres An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. +> [!Note] +> If the Windows diagnostic data processor configuration is enabled, IT administrators should use the admin portal to fulfill data subject request to access or export Windows diagnostic data associated with a particular user’s use of a device. See [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). ## 2. Windows 10 data collection management @@ -81,14 +82,14 @@ Administrators can configure and control privacy settings across their organizat The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve connecting to Microsoft connected experiences. For more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Required diagnostic data | Security and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. For more information, see [Enabling the Windows diagnostic data processor configuration](#_238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration_). | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -111,24 +112,29 @@ You can use the following articles to learn more about Autopilot and how to use - https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot - https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process -#### _2.3.2 Managing connections from Windows components to Microsoft services_ +#### _2.3.2 Windows 10 connected experiences and essential services_ -Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components. +Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. -For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. +Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. -#### _2.3.3 Managing Windows 10 connections_ +Windows connected experiences and essential services transfer data to Microsoft network endpoints, and while an administrator may want to block these endpoints for their organization to meet specific compliance objectives, we recommend that you carefully assess the impact of turning off essential services. -Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives. +The article [Manage connection endpoints for Windows 10, version 20H2](/windows/privacy/manage-windows-20h2-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. -[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](./index.yml) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. +#### _2.3.3 Managing connections from Windows connected experiences to Microsoft services_ + +Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. + +For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. #### _2.3.4 Limited functionality baseline_ An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. >[!IMPORTANT] ->We recommend that you fully test any modifications to these settings before deploying them in your organization. +> - We recommend that you fully test any modifications to these settings before deploying them in your organization. +> - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying to ensure the Windows diagnostic setting is not turned off. #### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_ @@ -144,23 +150,58 @@ Windows 10, version 1809 and newer allows a user to delete diagnostic data colle An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. +>[!Note] +>If the Windows diagnostic data processor configuration is enabled, the Delete diagnostic data button will be disabled and the powershell cmdlet will not delete data collected under this configuration. IT administrators can instead delete diagnostic data collected by invoking a delete request from the admin portal. + +#### _2.3.8 Diagnostic data: Enabling the Windows diagnostic data processor configuration_ + +**Applies to:** + +- Windows 10 Enterprise, Pro, Education editions, version 1809 with July 2021 update and newer + +The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration). Diagnostic data does not include data processed by Microsoft with the use of essential services and connected experiences in Windows. + +The Windows diagnostic data collected from devices enabled with the Windows diagnostic data processor configuration may be associated with a specific AAD User ID or device ID. The Windows diagnostic data processor configuration provides you with controls that help respond to data subject requests (DSRs) to delete diagnostic data, at user account closure, for a specific AAD User ID. Additionally, you’re able to execute an export DSR for diagnostic data related to a specific AAD User ID. For more information, see [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). Microsoft also will accommodate a tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for Windows diagnostic data, but still wish to remain an Azure customer. + +We recommend that IT administrators who have enabled the Windows diagnostic data processor configuration consider the following: + +- Restrict user’s ability to sign-in with a Microsoft Account (MSA) using [Block Microsoft account group policy](/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts). +- Restrict user’s ability to submit feedback, as any feedback or additional logs submitted by the user are not managed by the Windows diagnostic data processor configuration option. The Feedback hub app can be removed using [PowerShell](/powershell/module/appx/remove-appxpackage) and block ability to submit feedback in Microsoft Edge using [Feedback group policy](/deployedge/microsoft-edge-policies#userfeedbackallowed). + +>[!Note] +>Tenant account closure will lead to the deletion of all data associated with that tenant. + +Specific services that depend on Windows diagnostic data will also result in the enterprise becoming controllers of their Windows diagnostic data. These services include Update Compliance, Desktop Analytics, and Microsoft Managed Devices. For more information, see [Related Windows product considerations](#5-related-windows-product-considerations). + +For more information on how Microsoft can help you honor rights and fulfill obligations under the GDPR when using Windows diagnostic data processor configurations, see [General Data Protection Regulation - Microsoft GDPR | Microsoft Docs](/compliance/regulatory/gdpr). ## 3. The process for exercising data subject rights This section discusses the different methods Microsoft provides for users and administrators to exercise data subject rights for data collected from a Windows 10 device. +For IT administrators who have devices using the Windows diagnostic data processor configuration, refer to the [Data Subject Requests for the GDPR and CCPA](/compliance/regulatory/gdpr-dsr-windows). Otherwise proceed to the sections below. + ### 3.1 Delete Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. +>[!Note] +>If the Windows diagnostic data processor configuration is being used, the Delete diagnostic data functionality will be disabled. IT administrators can delete diagnostic data associated with a user from the admin portal. + ### 3.2 View The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet. +>[!Note] +>If the Windows diagnostic data processor configuration is enabled, IT administrators can view the diagnostic data that is associated with a user from the admin portal. + ### 3.3 Export The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script. +>[!Note] +>If the Windows diagnostic data processor configuration is enabled, IT administrators can also export the diagnostic data that is associated with a user from the admin portal. + ### 3.4 Devices connected to a Microsoft account If a user signs in to a Windows experience or app on their device with their Microsoft account, they can view, delete, and export data associated with their Microsoft account on the [Privacy dashboard](https://account.microsoft.com/privacy). @@ -168,11 +209,10 @@ If a user signs in to a Windows experience or app on their device with their Mic ## 4. Cross-border data transfers -Microsoft complies with applicable law regarding the collection, use, and retention of personal information, including its transfer across borders +Microsoft complies with applicable law regarding the collection, use, and retention of personal information, including its transfer across borders. Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data. - ## 5. Related Windows product considerations The following sections provide details about how privacy data is collected and managed across related Windows products. @@ -181,23 +221,33 @@ The following sections provide details about how privacy data is collected and m Windows Server follows the same mechanisms as Windows 10 for handling of personal data. +>[!Note] +>The Windows diagnostic data processor configuration is not available for Windows Server. + ### 5.2 Surface Hub -[Surface Hub](/surface-hub/) is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. To delete the Windows diagnostic data sent to Microsoft for Surface Hub, you can use the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store +[Surface Hub](/surface-hub/) is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. To delete the Windows diagnostic data sent to Microsoft for Surface Hub, you can use the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store. >[!IMPORTANT] >Apps and services that run on Windows but are not considered part of Windows will manage data collection using their own controls. Please contact the publisher for further guidance on how to control the data collection and transmission of these apps and services. An administrator can configure privacy-related settings, such as choosing to only send required diagnostic data. Surface Hub does not support Group Policy for centralized management. However, administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, see [Manage settings with an MDM provider (Surface Hub)](/surface-hub/manage-settings-with-mdm-for-surface-hub). +>[!Note] +>The Windows diagnostic data processor configuration is not available for Surface Hub. + ### 5.3 Desktop Analytics -[Desktop Analytics](/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. +[Desktop Analytics](/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function. ### 5.4 Microsoft Managed Desktop [Microsoft Managed Desktop (MMD)](/microsoft-365/managed-desktop/service-description/?view=o365-worldwide) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services. +### 5.5 Update Compliance + +[Update Compliance](/windows/deployment/update/update-compliance-monitor) is a service that enables organizations to monitor security, quality and feature updates for Windows 10 Professional, Education, and Enterprise editions, and view a report of device and update issues related to compliance that need attention. Update Compliance uses Windows 10 diagnostic data for all its reporting. + ## Additional Resources * [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trust-center/privacy/gdpr-overview) From 1c91a7f11956210fe68a2d2ebc18b6a41b7006e3 Mon Sep 17 00:00:00 2001 From: Benzy Dharmanayagam Date: Fri, 11 Jun 2021 15:47:07 +0530 Subject: [PATCH 002/279] Fixed warnings --- .../changes-to-windows-diagnostic-data-collection.md | 2 +- windows/privacy/windows-10-and-privacy-compliance.md | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index b277bb3b25..113c415e29 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -27,7 +27,7 @@ Microsoft is committed to providing you with effective controls over your data a This article is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas: - [Taxonomy changes](#taxonomy-changes) -- [Behavioral changes](#behaviorial-changes) +- [Behavioral changes](#behavioral-changes) > [!NOTE] > You can test the behavioral changes now in Windows 10 Insider Preview build 19577 and later. diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index f0f78ca7f3..e5ce1e7e04 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -89,7 +89,7 @@ The following table provides an overview of the privacy settings discussed earli | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. For more information, see [Enabling the Windows diagnostic data processor configuration](#_238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration_). | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. For more information, see [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration). | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -109,8 +109,8 @@ If you want the ability to fully control and apply restrictions on data being se Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies. You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10: -- https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot -- https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process +- [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot) +- [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process) #### _2.3.2 Windows 10 connected experiences and essential services_ @@ -146,7 +146,7 @@ Windows 10, version 1803 and newer allows users to change their diagnostic data #### _2.3.7 Diagnostic data: Managing device-based data delete_ -Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. +Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData) PowerShell cmdlet. An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`. @@ -183,7 +183,7 @@ For IT administrators who have devices using the Windows diagnostic data process ### 3.1 Delete -Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet. +Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData) PowerShell cmdlet. >[!Note] >If the Windows diagnostic data processor configuration is being used, the Delete diagnostic data functionality will be disabled. IT administrators can delete diagnostic data associated with a user from the admin portal. @@ -242,7 +242,7 @@ An administrator can configure privacy-related settings, such as choosing to onl ### 5.4 Microsoft Managed Desktop -[Microsoft Managed Desktop (MMD)](/microsoft-365/managed-desktop/service-description/?view=o365-worldwide) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services. +[Microsoft Managed Desktop (MMD)](/microsoft-365/managed-desktop/service-description/) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services. ### 5.5 Update Compliance From 784a8bae51d4dc42bded73bbd540ad1123b56a61 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Sat, 12 Jun 2021 16:01:10 +0530 Subject: [PATCH 003/279] Updated --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 + .../policy-configuration-service-provider.md | 10 ++ .../mdm/policy-csp-admx-networklistmanager.md | 162 ++++++++++++++++++ windows/client-management/mdm/toc.yml | 2 + 4 files changed, 176 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-networklistmanager.md diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 6c81fd4df2..7d4bd55974 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -733,6 +733,8 @@ ms.date: 10/08/2020 - [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) - [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) - [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) +- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints) +- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname) - [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index fbe229c166..f04ef812f9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2573,6 +2573,16 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_NetworkListManager policies + +
+
+ ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints +
+
+ ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName +
+ ### ADMX_OfflineFiles policies
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md new file mode 100644 index 0000000000..3bcfab9825 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md @@ -0,0 +1,162 @@ +--- +title: Policy CSP - ADMX_NetworkListManager +description: Policy CSP - ADMX_NetworkListManager +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: NimishaSatapathy +ms.date: 06/11/2021 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_NetworkListManager + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_NetworkListManager policies + +
+
+ ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints +
+
+ ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName +
+ + +
+ + +**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Machine + +
+ + + +List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure* +- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints* +- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM* +- GP ADMX file name: *NetworkListManager.admx* + + + +
+ + +**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Machine + +
+ + + +The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks* +- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName* +- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM* +- GP ADMX file name: *NetworkListManager.admx* + + + diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 8680bff0db..d6032a06af 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -519,6 +519,8 @@ items: href: policy-csp-admx-netlogon.md - name: ADMX_NetworkConnections href: policy-csp-admx-networkconnections.md + - name: ADMX_NetworkListManager + href: policy-csp-admx-networklistmanager.md - name: ADMX_OfflineFiles href: policy-csp-admx-offlinefiles.md - name: ADMX_PeerToPeerCaching From 19b71ff2ef545a4831b2f79fa8f93db6dd696f93 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 14 Jun 2021 15:00:58 +0530 Subject: [PATCH 004/279] Update policies-in-policy-csp-admx-backed.md --- .../mdm/policies-in-policy-csp-admx-backed.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 7d4bd55974..557e212d5d 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -733,8 +733,8 @@ ms.date: 10/08/2020 - [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) - [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) - [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) -- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints) -- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admz-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname) +- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints) +- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname) - [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) From 4a407713ce5fa607cf7b10c333d37eb992800966 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 14 Jun 2021 13:59:58 +0100 Subject: [PATCH 005/279] Remove deploy data processor --- .openpublishing.redirection.json | 5 + .../deploy-data-processor-service-windows.md | 96 ------------------- 2 files changed, 5 insertions(+), 96 deletions(-) delete mode 100644 windows/privacy/deploy-data-processor-service-windows.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 4afc122348..cf0c97aa74 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18919,6 +18919,11 @@ "source_path": "windows/security/threat-protection/device-control/device-control-report.md", "redirect_url": "/microsoft-365/security/defender-endpoint/device-control-report", "redirect_document_id": false + }, + { + "source_path": "windows/privacy/deploy-data-processor-service-windows.md", + "redirect_url": "windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false } ] } diff --git a/windows/privacy/deploy-data-processor-service-windows.md b/windows/privacy/deploy-data-processor-service-windows.md deleted file mode 100644 index 01a6bbec79..0000000000 --- a/windows/privacy/deploy-data-processor-service-windows.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Technical Deployment of the data processor service for Windows Enterprise -description: Use this article to understand how to deploy and manage the data processor service for Windows Enterprise. -keywords: privacy, GDPR -ms.localizationpriority: high -ROBOTS: NOINDEX, NOFOLLOW -ms.prod: w10 -ms.topic: article -f1.keywords: -- NOCSH -ms.author: siosulli -author: dansimp -manager: dansimp -audience: itpro -ms.collection: -- GDPR -- M365-security-compliance ---- - -# Data processor service for Windows Enterprise Overview - ->[!NOTE] ->This topic is intended for participants in the data processor service for Windows Enterprise preview program and requires acceptance of specific terms of use. To learn -more about the program and agree to the terms of use, see [https://aka.ms/WindowsEnterprisePublicPreview](https://aka.ms/WindowsEnterprisePublicPreview). - -The privacy landscape keeps evolving, and with it, we make changes to our services to meet our customers’ needs. -The data processor service for Windows Enterprise empowers you to be in control of diagnostic data from Windows devices, and act as data controllers for that data, under the definition of the European Union General Data Protection Regulation (GDPR). - -The data processor service for Windows Enterprise will serve as a foundation for other Microsoft services that use Windows diagnostic data. - -The data processor service for Windows Enterprise offering enables you to store and manage your Windows diagnostic data in the cloud, on top of an end-to-end data platform designed and built with compliance in mind, to help you meet your compliance obligations. -Your data is routed and stored inside an enterprise compliance boundary, operating under a prescriptive and focused set of compliance requirements, in accordance with industry standards. - -The data processor service for Windows Enterprise provides you with controls that help respond to delete data subject requests (DSRs) on diagnostic data, at user account closure, for a specific Azure AD User ID. Additionally, you’re able to execute an export DSR for a specific Azure AD User ID. -Should you desire so, Microsoft will accommodate a data processor service for Windows Enterprise tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for diagnostic data, but still wish to remain an Azure customer. - ->[!Note] ->Tenant account closure will lead to the deletion of all data associated with that tenant. - -## Deployment of data processor service for Windows Enterprise -Use the instructions below to easily manage the data processor service for Windows Enterprise using a single setting, through Group Policy, or an MDM solution, in Windows 10, version 1809 or Windows Server 2019 and newer. - -### Prerequisites -#### Versions supported -The data processor service for Windows Enterprise is currently supported on Windows 10, version 1809, and newer versions. - -#### Network requirements -The following endpoints need to be reachable from devices enrolled into the data processor service for Windows Enterprise: - - login.live.com - - cy2.vortex.data.microsoft.com.akadns.net - - v10.events.data.microsoft.com - - v10.vortex-win.data.microsoft.com/collect/v1 - -For additional information, see the “device authentication” and “diagnostic data” sections in the endpoint articles for each respective Windows version: - -[Windows 10, version 1809 endpoints](./manage-windows-1809-endpoints.md) - -[Windows 10, version 1903 endpoints](./manage-windows-1903-endpoints.md) - -### Deploying data processor service for Windows Enterprise -You can use either Group Policy or an MDM solution to deploy the data processor service for Windows Enterprise to your supported devices. - -In Group Policy, to enable data collection through the data processor service for Windows Enterprise, go to **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. - -If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. - -To use an MDM solution, such as [Microsoft Intune](/intune/custom-settings-Windows-10), to deploy the data processor service for Windows Enterprise to your supported devices, use the following custom OMA-URI setting configuration: - -- **Name:** System/AllowCommercialDataPipeline -- **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline -- **Data type:** Integer - -Under **Value**, use **1** to enable the service. - -If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. - ->[!Note] ->Data collected from a device, before it was enrolled into the data processor service for Windows Enterprise, will not be moved into the enterprise compliance boundary. - -## Managing data processor service for Windows Enterprise -### Executing user-based data subject requests (DSRs) -To perform user-based DSRs, the data processor service for Windows Enterprise requires your organization to be reflected in Azure AD. - -If your environment is cloud-only and managed in Azure, or all your devices are Azure AD joined - you don’t need to take any further action. - -If your environment uses on-premises Active Directory to manage identities - Azure AD Connect synchronization is required, and your environment needs to be configured for hybrid Azure AD join. -To learn more, visit [How To: Plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) and [Azure AD Connect sync: Understand and customize synchronization](/azure/active-directory/hybrid/how-to-connect-sync-whatis). - -Once you have Azure AD join or hybrid Azure AD join in place, you can learn more about executing user-based DSRs, by visiting this [page](https://review.docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-windows?branch=siosulli-wps&view=o365-worldwide). - -## Geo-location -Windows Diagnostic Data collected through the data processor service for Windows Enterprise is hosted in our datacenter in the United States. \ No newline at end of file From 755b677cd9205fe7f0384eb0bbcae259be6349f3 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 14 Jun 2021 14:30:59 +0100 Subject: [PATCH 006/279] Create deploy-data-processor-service-windows.md --- .../deploy-data-processor-service-windows.md | 96 +++++++++++++++++++ 1 file changed, 96 insertions(+) create mode 100644 windows/privacy/deploy-data-processor-service-windows.md diff --git a/windows/privacy/deploy-data-processor-service-windows.md b/windows/privacy/deploy-data-processor-service-windows.md new file mode 100644 index 0000000000..01a6bbec79 --- /dev/null +++ b/windows/privacy/deploy-data-processor-service-windows.md @@ -0,0 +1,96 @@ +--- +title: Technical Deployment of the data processor service for Windows Enterprise +description: Use this article to understand how to deploy and manage the data processor service for Windows Enterprise. +keywords: privacy, GDPR +ms.localizationpriority: high +ROBOTS: NOINDEX, NOFOLLOW +ms.prod: w10 +ms.topic: article +f1.keywords: +- NOCSH +ms.author: siosulli +author: dansimp +manager: dansimp +audience: itpro +ms.collection: +- GDPR +- M365-security-compliance +--- + +# Data processor service for Windows Enterprise Overview + +>[!NOTE] +>This topic is intended for participants in the data processor service for Windows Enterprise preview program and requires acceptance of specific terms of use. To learn +more about the program and agree to the terms of use, see [https://aka.ms/WindowsEnterprisePublicPreview](https://aka.ms/WindowsEnterprisePublicPreview). + +The privacy landscape keeps evolving, and with it, we make changes to our services to meet our customers’ needs. +The data processor service for Windows Enterprise empowers you to be in control of diagnostic data from Windows devices, and act as data controllers for that data, under the definition of the European Union General Data Protection Regulation (GDPR). + +The data processor service for Windows Enterprise will serve as a foundation for other Microsoft services that use Windows diagnostic data. + +The data processor service for Windows Enterprise offering enables you to store and manage your Windows diagnostic data in the cloud, on top of an end-to-end data platform designed and built with compliance in mind, to help you meet your compliance obligations. +Your data is routed and stored inside an enterprise compliance boundary, operating under a prescriptive and focused set of compliance requirements, in accordance with industry standards. + +The data processor service for Windows Enterprise provides you with controls that help respond to delete data subject requests (DSRs) on diagnostic data, at user account closure, for a specific Azure AD User ID. Additionally, you’re able to execute an export DSR for a specific Azure AD User ID. +Should you desire so, Microsoft will accommodate a data processor service for Windows Enterprise tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for diagnostic data, but still wish to remain an Azure customer. + +>[!Note] +>Tenant account closure will lead to the deletion of all data associated with that tenant. + +## Deployment of data processor service for Windows Enterprise +Use the instructions below to easily manage the data processor service for Windows Enterprise using a single setting, through Group Policy, or an MDM solution, in Windows 10, version 1809 or Windows Server 2019 and newer. + +### Prerequisites +#### Versions supported +The data processor service for Windows Enterprise is currently supported on Windows 10, version 1809, and newer versions. + +#### Network requirements +The following endpoints need to be reachable from devices enrolled into the data processor service for Windows Enterprise: + + login.live.com + + cy2.vortex.data.microsoft.com.akadns.net + + v10.events.data.microsoft.com + + v10.vortex-win.data.microsoft.com/collect/v1 + +For additional information, see the “device authentication” and “diagnostic data” sections in the endpoint articles for each respective Windows version: + +[Windows 10, version 1809 endpoints](./manage-windows-1809-endpoints.md) + +[Windows 10, version 1903 endpoints](./manage-windows-1903-endpoints.md) + +### Deploying data processor service for Windows Enterprise +You can use either Group Policy or an MDM solution to deploy the data processor service for Windows Enterprise to your supported devices. + +In Group Policy, to enable data collection through the data processor service for Windows Enterprise, go to **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. + +If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. + +To use an MDM solution, such as [Microsoft Intune](/intune/custom-settings-Windows-10), to deploy the data processor service for Windows Enterprise to your supported devices, use the following custom OMA-URI setting configuration: + +- **Name:** System/AllowCommercialDataPipeline +- **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline +- **Data type:** Integer + +Under **Value**, use **1** to enable the service. + +If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. + +>[!Note] +>Data collected from a device, before it was enrolled into the data processor service for Windows Enterprise, will not be moved into the enterprise compliance boundary. + +## Managing data processor service for Windows Enterprise +### Executing user-based data subject requests (DSRs) +To perform user-based DSRs, the data processor service for Windows Enterprise requires your organization to be reflected in Azure AD. + +If your environment is cloud-only and managed in Azure, or all your devices are Azure AD joined - you don’t need to take any further action. + +If your environment uses on-premises Active Directory to manage identities - Azure AD Connect synchronization is required, and your environment needs to be configured for hybrid Azure AD join. +To learn more, visit [How To: Plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) and [Azure AD Connect sync: Understand and customize synchronization](/azure/active-directory/hybrid/how-to-connect-sync-whatis). + +Once you have Azure AD join or hybrid Azure AD join in place, you can learn more about executing user-based DSRs, by visiting this [page](https://review.docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-windows?branch=siosulli-wps&view=o365-worldwide). + +## Geo-location +Windows Diagnostic Data collected through the data processor service for Windows Enterprise is hosted in our datacenter in the United States. \ No newline at end of file From b60c53c79e1162fe17eb49cb21b2c7bf7adb6a47 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 14 Jun 2021 14:38:51 +0100 Subject: [PATCH 007/279] remove file v2 --- .openpublishing.redirection.json | 2 +- .../deploy-data-processor-service-windows.md | 96 ------------------- 2 files changed, 1 insertion(+), 97 deletions(-) delete mode 100644 windows/privacy/deploy-data-processor-service-windows.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index cf0c97aa74..25a371ea28 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18922,7 +18922,7 @@ }, { "source_path": "windows/privacy/deploy-data-processor-service-windows.md", - "redirect_url": "windows/privacy/windows-10-and-privacy-compliance", + "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false } ] diff --git a/windows/privacy/deploy-data-processor-service-windows.md b/windows/privacy/deploy-data-processor-service-windows.md deleted file mode 100644 index 01a6bbec79..0000000000 --- a/windows/privacy/deploy-data-processor-service-windows.md +++ /dev/null @@ -1,96 +0,0 @@ ---- -title: Technical Deployment of the data processor service for Windows Enterprise -description: Use this article to understand how to deploy and manage the data processor service for Windows Enterprise. -keywords: privacy, GDPR -ms.localizationpriority: high -ROBOTS: NOINDEX, NOFOLLOW -ms.prod: w10 -ms.topic: article -f1.keywords: -- NOCSH -ms.author: siosulli -author: dansimp -manager: dansimp -audience: itpro -ms.collection: -- GDPR -- M365-security-compliance ---- - -# Data processor service for Windows Enterprise Overview - ->[!NOTE] ->This topic is intended for participants in the data processor service for Windows Enterprise preview program and requires acceptance of specific terms of use. To learn -more about the program and agree to the terms of use, see [https://aka.ms/WindowsEnterprisePublicPreview](https://aka.ms/WindowsEnterprisePublicPreview). - -The privacy landscape keeps evolving, and with it, we make changes to our services to meet our customers’ needs. -The data processor service for Windows Enterprise empowers you to be in control of diagnostic data from Windows devices, and act as data controllers for that data, under the definition of the European Union General Data Protection Regulation (GDPR). - -The data processor service for Windows Enterprise will serve as a foundation for other Microsoft services that use Windows diagnostic data. - -The data processor service for Windows Enterprise offering enables you to store and manage your Windows diagnostic data in the cloud, on top of an end-to-end data platform designed and built with compliance in mind, to help you meet your compliance obligations. -Your data is routed and stored inside an enterprise compliance boundary, operating under a prescriptive and focused set of compliance requirements, in accordance with industry standards. - -The data processor service for Windows Enterprise provides you with controls that help respond to delete data subject requests (DSRs) on diagnostic data, at user account closure, for a specific Azure AD User ID. Additionally, you’re able to execute an export DSR for a specific Azure AD User ID. -Should you desire so, Microsoft will accommodate a data processor service for Windows Enterprise tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for diagnostic data, but still wish to remain an Azure customer. - ->[!Note] ->Tenant account closure will lead to the deletion of all data associated with that tenant. - -## Deployment of data processor service for Windows Enterprise -Use the instructions below to easily manage the data processor service for Windows Enterprise using a single setting, through Group Policy, or an MDM solution, in Windows 10, version 1809 or Windows Server 2019 and newer. - -### Prerequisites -#### Versions supported -The data processor service for Windows Enterprise is currently supported on Windows 10, version 1809, and newer versions. - -#### Network requirements -The following endpoints need to be reachable from devices enrolled into the data processor service for Windows Enterprise: - - login.live.com - - cy2.vortex.data.microsoft.com.akadns.net - - v10.events.data.microsoft.com - - v10.vortex-win.data.microsoft.com/collect/v1 - -For additional information, see the “device authentication” and “diagnostic data” sections in the endpoint articles for each respective Windows version: - -[Windows 10, version 1809 endpoints](./manage-windows-1809-endpoints.md) - -[Windows 10, version 1903 endpoints](./manage-windows-1903-endpoints.md) - -### Deploying data processor service for Windows Enterprise -You can use either Group Policy or an MDM solution to deploy the data processor service for Windows Enterprise to your supported devices. - -In Group Policy, to enable data collection through the data processor service for Windows Enterprise, go to **Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. - -If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. - -To use an MDM solution, such as [Microsoft Intune](/intune/custom-settings-Windows-10), to deploy the data processor service for Windows Enterprise to your supported devices, use the following custom OMA-URI setting configuration: - -- **Name:** System/AllowCommercialDataPipeline -- **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline -- **Data type:** Integer - -Under **Value**, use **1** to enable the service. - -If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. - ->[!Note] ->Data collected from a device, before it was enrolled into the data processor service for Windows Enterprise, will not be moved into the enterprise compliance boundary. - -## Managing data processor service for Windows Enterprise -### Executing user-based data subject requests (DSRs) -To perform user-based DSRs, the data processor service for Windows Enterprise requires your organization to be reflected in Azure AD. - -If your environment is cloud-only and managed in Azure, or all your devices are Azure AD joined - you don’t need to take any further action. - -If your environment uses on-premises Active Directory to manage identities - Azure AD Connect synchronization is required, and your environment needs to be configured for hybrid Azure AD join. -To learn more, visit [How To: Plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) and [Azure AD Connect sync: Understand and customize synchronization](/azure/active-directory/hybrid/how-to-connect-sync-whatis). - -Once you have Azure AD join or hybrid Azure AD join in place, you can learn more about executing user-based DSRs, by visiting this [page](https://review.docs.microsoft.com/microsoft-365/compliance/gdpr-dsr-windows?branch=siosulli-wps&view=o365-worldwide). - -## Geo-location -Windows Diagnostic Data collected through the data processor service for Windows Enterprise is hosted in our datacenter in the United States. \ No newline at end of file From 15a0beb8e5756f0faa8b3f0dffec0daeb27305ad Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 14 Jun 2021 14:43:27 +0100 Subject: [PATCH 008/279] remove public preview terms --- .openpublishing.redirection.json | 7 +- ...windows-enterprise-public-preview-terms.md | 324 ------------------ 2 files changed, 6 insertions(+), 325 deletions(-) delete mode 100644 windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 25a371ea28..1434fdccf8 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18924,6 +18924,11 @@ "source_path": "windows/privacy/deploy-data-processor-service-windows.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false - } + }, + { + "source_path": "data-processor-service-for-windows-enterprise-public-preview-terms.md", + "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + } ] } diff --git a/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md b/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md deleted file mode 100644 index 170bd2f449..0000000000 --- a/windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: Data processor service for Windows Enterprise public preview terms -description: Use this article to understand Windows public preview terms of service. -keywords: privacy, GDPR -ms.localizationpriority: high -ROBOTS: NOINDEX, NOFOLLOW -ms.prod: w10 -ms.topic: article -f1.keywords: -- NOCSH -ms.author: siosulli -author: dansimp -manager: dansimp -audience: itpro -ms.collection: -- GDPR -- M365-security-compliance ---- - -# Data processor service for Windows Enterprise public preview terms - -**These terms (“Terms”) must be read and accepted by a tenant admin with appropriate access rights and authority. By participating in this public preview, you: (a) agree to the following Terms, and (b) represent and warrant that you have such rights and authority.** - -These Terms govern your use of the preview described below (“**Preview**”). In order to access the Preview, you must be a current Microsoft Windows customer with an Azure Active Directory (“**AAD**”) subscription. The Preview consists of features and services that are in preview, beta, or other pre-release form for use with Windows and AAD. - - 1. **Definitions**. The following terms have the following meanings: - - 1. "**Customer Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through your use of Windows or AAD. - - 2. "**Feedback**" means, collectively, suggestions, comments, feedback, ideas, or know-how, in any form, that you or your users provide to Microsoft about Microsoft’s business, products, or services. - - 3. "**Personal Data**" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. - - 4. "**Preview Data**" means all data, including all text, sound, video, or image files that are provided to Microsoft by, or on behalf of, you through use of the Services. - - 5. "**Subprocessor**" means other processors used by Microsoft to process Personal Data. - -2. **Scope of Services**. The Preview is for a service that enables organizations to become controllers of Windows diagnostic data on supported versions of Windows, with Microsoft operating as processor of the data (collectively, the “**_Services_**”). You will collaborate with Microsoft in order to provide Microsoft the ability to enable the Services for you. To access the Services, you will need to configure participating Windows devices; Microsoft will assist you in such configuration via documentation or other communications. - -3. **Intellectual Property**. - - 1. **License Grant**. During the term of this Preview (“**Term**”), Microsoft grants you and authorized users in your tenant for Windows a non-exclusive, non-transferable, non-sublicensable right and license to access and use the Services in accordance with these Terms. - - 2. **Use Terms**. These Terms supersede any Microsoft terms and conditions or other agreement. You acknowledge that (i) the Services may not work correctly or in the manner that a commercial service may function; Microsoft may change the Services for the final, commercial version or choose not to release a commercial version; (ii) Microsoft may not provide support for the Services; (iii) the Online Services Terms (OST), including any obligations Microsoft may have regarding Customer Data, do not apply to the Services or Preview Data; (iv) Microsoft has no obligation to hold, export, or return Preview Data, except as described in these Terms; (v) Microsoft has no liability for the deletion of Preview Data, except as described in these Terms; and (vi) you may lose access to the Services and Preview Data after the Term. - - 3. **Acceptable Use**. Neither you, nor those that access the Services through you, may: (a) use the Services: (i) in a way prohibited by law, regulation, governmental order or decree; (ii) to violate the rights of others; (iii) to try to gain unauthorized access to or disrupt any service, device, data, account or network; (iv) to spam or distribute malware; or (v) in a way that could harm the Services or impair anyone else’s use of it; or (b) reverse engineer, decompile, disassemble, or work around any technical limitations in the Services, or use the Services to create a competing product. You are responsible for responding to any third-party request regarding your use of the Services or Preview Data, such as a request to take down Preview Data under the U.S. Digital Millennium Copyright Act or other applicable laws. - - 4. **Data Collection, Use and Location**. The Microsoft Privacy Statement https://privacy.microsoft.com/privacystatement applies to the collection, use and location of Preview Data. In the event of a conflict between Privacy Statement and the terms of these Terms, the terms of these Terms will control. - -4. **Confidentiality**. The following confidentiality terms apply to the Preview: - - 1. During the Term plus 5 years, the parties will hold in strictest confidence and not use or disclose to any third party any Confidential Information of the other party. “Confidential Information” means all non-public information a party designates in writing or orally as being confidential, or which under the circumstances of disclosure ought to be treated as confidential. Confidential Information includes information relating to:

- 1. a party’s released or unreleased software or hardware products;

- 2. a party’s source code;

- 3. a party’s product marketing or promotion;

- 4. a party’s business policies or practices;

- 5. a party’s customers or suppliers;

- 6. information received from others that a party must treat as confidential; and

- 7. information provided, obtained, or created by a party under these Terms, including: - * information in reports; - * the parties’ electronic or written correspondence, customer lists and customer information, regardless of source; - * Personal Data; and - * Transactional, sales, and marketing information. - - 2. A party will consult with the other if it questions what comprises Confidential Information. Confidential Information excludes information (i) known to a party before the disclosing party’s disclosure to the receiving party, (ii) information publicly available through no fault of the receiving party, (iii) received from a third party without breach of an obligation owed to the disclosing party, or (iv) independently developed by a party without reference to or use of the disclosing party’s Confidential Information. - - 3. Each party will employ security procedures to prevent disclosure of the other party’s Confidential Information to unauthorized third parties. The receiving party’s security procedures must include risk assessment and controls for:

- 1. system access;

- 2. system and application development and maintenance;

- 3. change management;

- 4. asset classification and control;

- 5. incident response, physical and environmental security;

- 6. disaster recovery/business continuity; and

- 7. employee training. - -5. **Data Protection.** - - **Generally**. To the extent Microsoft is a processor of Personal Data, the General Data Protection Regulation (GDPR) Terms in Attachment 1 govern that processing and the parties also agree to the following terms: - - 1. Processing Details: The parties agree that: - * The subject-matter of the processing is limited to Personal Data within the scope of the GDPR; - * The duration of the processing shall be for the duration of your right to use the Services and until all Personal Data is deleted or returned in accordance with your instructions or these Terms; - * The nature and purpose of the processing shall be to provide the Services pursuant to these Terms; - * The types of Personal Data processed by the Services include those expressly identified in Article 4 of the GDPR to the extent included by Preview Data; and - * The categories of data subjects are your representatives and end users, such as employees, contractors, collaborators, and customers. - - 2. Data Transfers: - * Preview Data and Personal Data that Microsoft processes on your behalf may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate. You appoint Microsoft to perform any such transfer of Preview Data and Personal Data to any such country and to store and process Preview Data and Personal Data to provide the Services. - * All transfers of Preview Data and Personal Data out of the European Union, European Economic Area, United Kingdom, and Switzerland to provide the Online Services shall be governed by the Standard Contractual Clauses in Attachment 2. - * Microsoft will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of Personal Data from the European Economic Area and Switzerland. All transfers of Personal Data to a third country or an international organization will be subject to appropriate safeguards as described in Article 46 of the GDPR and such transfers and safeguards will be documented according to Article 30(2) of the GDPR. - * In addition, Microsoft is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks and the commitments they entail. Microsoft agrees to notify you in the event that it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Shield principles. - -6. **No Support or Incident Response.** Microsoft will have no obligation under these Terms to correct any bugs, defects or errors in the Services or AAD, provide any updates, upgrades or new releases, or otherwise provide any technical support or maintenance for any Services or AAD. You will make reasonable efforts to promptly report to Microsoft any defects you find in the Services, as an aid to creating improved revisions of the Services. Microsoft will have no obligation under these Terms to provide you with incident response as part of the Services. - -7. **Term and Termination.** The term of the Preview begins when you accept these Terms and continues until: (a) either party terminates this Preview by providing the other party: (i) 2 days’ notice for any reason (or no reason), or (ii) notice of such party’s breach of these Terms and such party fails to cure within 15 days, or (b) upon the general availability of the Services. When the Term ends, you will no longer have access to the Services, and Microsoft will no longer have the rights to access Customer Data granted herein. Each party will, on request, return or destroy the other’s Confidential Information provided under the Preview. - -8. **Feedback.** Providing Feedback is voluntary. Microsoft is under no obligation to post or use any Feedback. By providing Feedback to Microsoft, you (and anyone providing Feedback through your use of the Preview) irrevocably and perpetually grant to Microsoft and its affiliates, under all of its (and their) owned or controlled intellectual property rights, a worldwide, non-exclusive, fully paid-up, royalty-free, transferable, sub-licensable right and license to make, use, reproduce, prepare derivative works based upon, distribute, publicly perform, publicly display, transmit, and otherwise commercialize the Feedback (including by combining or interfacing products, services or technologies that depend on or incorporate Feedback with other products, services or technologies of Microsoft or others), without attribution in any way and for any purpose. You warrant that (a) you will not provide Feedback that is subject to a license requiring Microsoft to license anything to third parties because Microsoft exercises any of the above rights in your Feedback; and (b) you own or otherwise control all of the rights to such Feedback and that no such Feedback is subject to any third-party rights (including any personality or publicity rights). - -9. **Representations and Warranties; Limitation of Liability.** - - 1. **By the Parties.** Each party represents and warrants to the other party that (a) it has all necessary rights, title, and authority to enter into and perform under these Terms; (b) its performance under these Terms will not breach any agreement with a third party; and (c) it will comply with any and all laws, rules, and regulations that are applicable to its performance under these Terms. - - 2. **Disclaimer.** EXCEPT AS OTHERWISE PROVIDED IN THESE TERMS AND TO THE EXTENT APPLICABLE LAW PERMITS, MICROSOFT (a) PROVIDES THE SERVICES AS-IS; (b) PROVIDES NO WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE; AND (c) DOES NOT GUARANTEE THAT THE SERVICES WILL BE AVAILABLE, UNINTERRUPTED, OR ERROR-FREE, OR THAT LOSS OF PREVIEW DATA WILL NOT OCCUR. - - 3. **Limitation of Liability.** Except as otherwise described in this Section 9, the only remedy either party has for claims relating to these Terms or participation in the Preview is to terminate these Terms or your participation in the Preview. NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY FOR ANY DAMAGES, INCLUDING DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR DAMAGES FOR LOST REVENUE, LOST PROFIT, LOST BUSINESS INFORMATION, OR BUSINESS INTERRUPTION, EVEN IF THE PARTY KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES. The limitations in this Section 9 do not apply to claims arising from any breach of confidentiality obligations under Section 4. - -10. **General.** - - 1. **Non-Exclusivity.** These Terms are nonexclusive. These Terms do not restrict either party from entering into the same or similar arrangement with any third party. - - 2. **Jurisdiction and Governing Law.** The laws of the State of Washington, excluding conflicts of law provisions, govern these Terms. If federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the federal courts in King County, Washington. If no federal jurisdiction exists, then each party consents to exclusive jurisdiction and venue in the Superior Court of King County, Washington. - - 3. **Force Majeure.** A party will not be liable for failure to perform an obligation under these Terms to the extent that failure is due to a cause beyond that party’s reasonable control, including natural disaster, war, civil disturbance, or governmental action. - - 4. **Attorneys’ fees.** If a party employs attorneys to enforce any rights arising out of or relating to these Terms, the prevailing party will be entitled to recover its reasonable attorneys’ fees, costs, and other expenses. - - 5. **Assignment**. You may not assign these Terms or delegate any of your rights or obligations under these Terms to a third party without Microsoft’s prior written consent. - - 6. **Entire Agreement.** These Terms are the entire agreement between the parties regarding its subject matter and replaces all prior agreements, communications, and representations between the parties regarding its subject matter. - - 7. **Survival.** Sections 3.b, 4, 7 (with respect to post-termination obligations), and 8-10 will survive these Terms’ expiration or termination.

- -

- Attachment 1: GDPR Terms
- -For purposes of these GDPR Terms, you and Microsoft agree that you are the controller of Personal Data and Microsoft is the processor of such data, except when you act as a processor of Personal Data, in which case Microsoft is a subprocessor. These GDPR Terms apply to the processing of Personal Data, within the scope of the GDPR, by Microsoft on your behalf. These GDPR Terms do not limit or reduce any data protection commitments Microsoft makes to you in other agreement between Microsoft and you. These GDPR Terms do not apply where Microsoft is a controller of Personal Data. - -**Relevant GDPR Obligations: Articles 28, 32, and 33** - -1. Microsoft shall not engage another processor without prior specific or your general written authorization. In the case of general written authorization, Microsoft shall inform you of any intended changes concerning the addition or replacement of other processors, thereby giving you the opportunity to object to such changes. (Article 28(2)) -2. Processing by Microsoft shall be governed by these GDPR Terms under European Union (hereafter “Union”) or Member State law and are binding on Microsoft with regard to you. The subject-matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data, the categories of data subjects and your obligations and rights are set forth in the Terms above, including these GDPR Terms. In particular, Microsoft shall: - - 1. process the Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by Union or Member State law to which Microsoft is subject; in such a case, Microsoft shall inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest; - - 2. ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; - - 3. take all measures required pursuant to Article 32 of the GDPR; - - 4. respect the conditions referred to in paragraphs 1 and 3 for engaging another processor; - - 5. taking into account the nature of the processing, assist you by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR; - - 6. assist you in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Microsoft; - - 7. at your choice, delete or return all the Personal Data to you after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the Personal Data; - - 8. make available to you all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you. - - 9. immediately inform you if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. (Article 28(3)) - -3. Where Microsoft engages another processor for carrying out specific processing activities on your behalf, the same data protection obligations as set out in these GDPR Terms shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where that other processor fails to fulfil its data protection obligations, Microsoft shall remain fully liable to you for the performance of that other processor's obligations. (Article 28(4)) - -4. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, you and Microsoft shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: - - 1. the pseudonymisation and encryption of Personal Data; - - 2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; - - 3. the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and - - 4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. (Article 32(1)) - -5. In assessing the appropriate level of security, account shall be taken of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed. (Article 32(2)) - -6. You and Microsoft shall take steps to ensure that any natural person acting under your authority or Microsoft’s who has access to Personal Data does not process them except on instructions from you, unless he or she is required to do so by Union or Member State law. (Article 32(4)) - -7. Microsoft shall notify you without undue delay after becoming aware of a personal data breach. (Article 33(2)). Such notification will include that information a processor must provide to a controller under Article 33(3) to the extent such information is reasonably available to Microsoft. - -

- Attachment 2 – The Standard Contractual Clauses (Processors)
- -In countries where regulatory approval is required for use of the Standard Contractual Clauses, the Standard Contractual Clauses cannot be relied upon under European Commission 2010/87/EU (of February 2010) to legitimize export of data from the country, unless Customer has the required regulatory approval. -Beginning May 25, 2018 and thereafter, references to various Articles from the Directive 95/46/EC in the Standard Contractual Clauses below will be treated as references to the relevant and appropriate Articles in the GDPR. -For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, Customer (as data exporter) and Microsoft Corporation (as data importer, whose signature appears below), each a “party,” together “the parties,” have agreed on the following Contractual Clauses (the “Clauses” or “Standard Contractual Clauses”) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1. - -**Clause 1: Definitions** - -1. 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; -1. 'the data exporter' means the controller who transfers the personal data; -1. 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC; -1. 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract; -1. 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established; -1. 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing. - -**Clause 2: Details of the transfer** - -The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 below which forms an integral part of the Clauses. - -**Clause 3: Third-party beneficiary clause** - -1. The data subject can enforce against the data exporter this Clause, Clause 4(2) to (9), Clause 5(1) to (5), and (7) to (10), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary. -2.1.exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. -1. The data subject can enforce against the subprocessor this Clause, Clause 5(1) to (5) and (7), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. -1. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law. - -**Clause 4: Obligations of the data exporter** - -The data exporter agrees and warrants: - -1. that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State; -1. that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses; -1. that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 below; -1. that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation; -1. that it will ensure compliance with the security measures; -1. that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC; -1. to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(2) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension; -1. to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information; -1. that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and -1. that it will ensure compliance with Clause 4(1) to (9). - -**Clause 5: Obligations of the data importer** - -The data importer agrees and warrants: - -1. to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; -1. that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; -1. that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred; -1. that it will promptly notify the data exporter about: - 1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation, - 1. any accidental or unauthorised access, and - 1. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so; -1. to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred; -1. at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority; -1. to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter; -1. that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent; -1. that the processing services by the subprocessor will be carried out in accordance with Clause 11; and -1. to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter. - -**Clause 6: Liability** - -1. The parties agree that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered. -1. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity. -The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities. -1. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses. - -**Clause 7: Mediation and jurisdiction** - -1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject: - 1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority; - 1. to refer the dispute to the courts in the Member State in which the data exporter is established. -1. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law. - -**Clause 8: Cooperation with supervisory authorities** - -1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law. -1. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law. -1. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (2). - -**Clause 9: Governing Law** - -The Clauses shall be governed by the law of the Member State in which the data exporter is established. - -**Clause 10: Variation of the contract** - -The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause. - -**Clause 11: Subprocessing** - -1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement. -1. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. -1. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established. -1. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority. - -**Clause 12: Obligation after the termination of personal data processing services** - -1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore. -1. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1. - -**Appendix 1 to the Standard Contractual Clauses** - -**Data exporter**: Customer is the data exporter. The data exporter is a user of the Services. - -**Data importer**: The data importer is MICROSOFT CORPORATION, a global producer of software and services. - -**Data subjects**: Data subjects include the data exporter’s representatives and end-users including employees, contractors, collaborators, and customers of the data exporter. Data subjects may also include individuals attempting to communicate or transfer personal information to users of the services provided by data importer. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following types of data subjects in the personal data: - -* Employees, contractors and temporary workers (current, former, prospective) of data exporter; -* Dependents of the above; -* Data exporter's collaborators/contact persons (natural persons) or employees, contractors or temporary workers of legal entity collaborators/contact persons (current, prospective, former); -* Users (e.g., customers, clients, patients, visitors, etc.) and other data subjects that are users of data exporter's services; -* Partners, stakeholders or individuals who actively collaborate, communicate or otherwise interact with employees of the data exporter and/or use communication tools such as apps and websites provided by the data exporter; -* Stakeholders or individuals who passively interact with data exporter (e.g., because they are the subject of an investigation, research or mentioned in documents or correspondence from or to the data exporter); -* Minors; or -* Professionals with professional privilege (e.g., doctors, lawyers, notaries, religious workers, etc.). - -**Categories of data**: The personal data transferred that is included in data processed by the Services. Microsoft acknowledges that, depending on Customer’s use of the Services, Customer may elect to include personal data from any of the following categories in the personal data: - -* Basic personal data (for example place of birth, street name and house number (address), postal code, city of residence, country of residence, mobile phone number, first name, last name, initials, email address, gender, date of birth), including basic personal data about family members and children; -* Authentication data (for example user name, password or PIN code, security question, audit trail); -* Contact information (for example addresses, email, phone numbers, social media identifiers; emergency contact details); -* Unique identification numbers and signatures (for example Social Security number, bank account number, passport and ID card number, driver's license number and vehicle registration data, IP addresses, employee number, student number, patient number, signature, unique identifier in tracking cookies or similar technology); -* Pseudonymous identifiers; -* Financial and insurance information (for example insurance number, bank account name and number, credit card name and number, invoice number, income, type of assurance, payment behavior, creditworthiness); -* Commercial Information (for example history of purchases, special offers, subscription information, payment history); -* Biometric Information (for example DNA, fingerprints and iris scans); -* Location data (for example, Cell ID, geo-location network data, location by start call/end of the call. Location data derived from use of wifi access points); -* Photos, video and audio; -* Internet activity (for example browsing history, search history, reading, television viewing, radio listening activities); -* Device identification (for example IMEI-number, SIM card number, MAC address); -* Profiling (for example based on observed criminal or anti-social behavior or pseudonymous profiles based on visited URLs, click streams, browsing logs, IP-addresses, domains, apps installed, or profiles based on marketing preferences); -* HR and recruitment data (for example declaration of employment status, recruitment information (such as curriculum vitae, employment history, education history details), job and position data, including worked hours, assessments and salary, work permit details, availability, terms of employment, tax details, payment details, insurance details and location and organizations); -* Education data (for example education history, current education, grades and results, highest degree achieved, learning disability); -* Citizenship and residency information (for example citizenship, naturalization status, marital status, nationality, immigration status, passport data, details of residency or work permit); -* Information processed for the performance of a task carried out in the public interest or in the exercise of an official authority; -* Special categories of data (for example racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person’s sex life or sexual orientation, or data relating to criminal convictions or offences); or -* Any other personal data identified in Article 4 of the GDPR. - -**Processing operations**: The personal data transferred will be subject to the following basic processing activities: - -1. **Duration and Object of Data Processing**. The duration of data processing shall be for the term of the Preview. The objective of the data processing is the performance of the Services. -1. **Scope and Purpose of Data Processing**. The scope and purpose of processing personal data is described in Section 5 of this agreement. The data importer operates a global network of data centers and management/support facilities, and processing may take place in any jurisdiction where data importer or its sub-processors operate such facilities. -1. **Customer Data and Personal Data Access**. For the term designated under the applicable volume licensing agreement data importer will at its election and as necessary under applicable law implementing Article 12(b) of the EU Data Protection Directive, either: (1) provide data exporter with the ability to correct, delete, or block Customer Data and personal data, or (2) make such corrections, deletions, or blockages on its behalf. -1. **Data Exporter’s Instructions**. For Online Services and Professional Services, data importer will only act upon data exporter’s instructions as conveyed by Microsoft. -1. **Preview Data and Personal Data Deletion or Return**. Upon expiration or termination of data exporter’s use of the Services, it may extract Customer Data and personal data and data importer will delete Customer Data and personal data, each in accordance with the terms of this agreement. - -**Subcontractors**: In accordance with the DPA, the data importer may hire other companies to provide limited services on data importer’s behalf, such as providing customer support. Any such subcontractors will be permitted to obtain Customer Data and personal data only to deliver the services the data importer has retained them to provide, and they are prohibited from using Customer Data and personal data for any other purpose. - -**Appendix 2 to the Standard Contractual Clauses** - -Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(4) and 5(3): - -1. **Personnel**. Data importer’s personnel will not process Preview Data or personal data without authorization. Personnel are obligated to maintain the confidentiality of any such Preview Data and personal data and this obligation continues even after their engagement ends. -2. **Data Privacy Contact**. The data privacy officer of the data importer can be reached at the following address:
Microsoft Corporation
Attn: Chief Privacy Officer
1 Microsoft Way
Redmond, WA 98052 USA -3. **Technical and Organization Measures**. The data importer has implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines intended to protect Preview Data and personal data, as defined in Attachment 1 of this agreement, against accidental loss, destruction, or alteration; unauthorized disclosure or access; or unlawful destruction as follows: The technical and organizational measures, internal controls, and information security routines set forth in Attachment 1 of this agreement are hereby incorporated into this Appendix 2 by this reference and are binding on the data importer as if they were set forth in this Appendix 2 in their entirety. From f00f9cc588b3790c897144e27cd5ea9c520ab2c2 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 14 Jun 2021 14:49:36 +0100 Subject: [PATCH 009/279] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 1434fdccf8..445d23b7ea 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18926,7 +18926,7 @@ "redirect_document_id": false }, { - "source_path": "data-processor-service-for-windows-enterprise-public-preview-terms.md", + "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false } From c307294265b743b49e0b295603929e96a82149ac Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 17 Jun 2021 13:29:36 +0100 Subject: [PATCH 010/279] Update policy-csp-system.md --- .../client-management/mdm/policy-csp-system.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 4d1e1393b7..536bae0e06 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -215,13 +215,20 @@ The following list shows the supported values: -This policy setting opts the device into the Windows enterprise data pipeline. +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. -If you enable this setting, data collected from the device will be opted into the Windows enterprise data pipeline. +To enable this behavior, you must complete two steps: -If you disable or don't configure this setting, all data from the device will be collected and processed in accordance with our policies for the Windows standard data pipeline. +- Enable this policy setting +- Join an Azure Active Directory account to the device -Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. This setting only applies to the Windows operating system and apps included with Windows, not third-party apps or services running on Windows 10. +Windows diagnostic data is collected when the **AllowTelemetry** policy setting is set to 1 – Required (Basic) or above. + +If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft’s privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing”. + +Configuring this setting does not change the Windows diagnostic data collection level set for the device or the operation of optional analytics processor services like Desktop Analytics and Update Compliance. + +See the documentation at https://aka.ms/ConfigureWWD for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. From 3017e669b01e2b77df0bfcf621039734caacc8d3 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 14:25:35 +0100 Subject: [PATCH 011/279] minor updates for DPSW --- .../changes-to-windows-diagnostic-data-collection.md | 1 + ...figure-windows-diagnostic-data-in-your-organization.md | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 113c415e29..38c0dfcce4 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -87,6 +87,7 @@ With the Enhanced diagnostic data level being split out into new policies, we're Customers who use services that depend on Windows diagnostic data, such as Microsoft Managed Desktop or Desktop Analytics, may be impacted by the behavioral changes when they are released. These services will be updated to address these changes and guidance will be published on how to configure them properly. The following provides information on the current configurations: + - [Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/device-policies#windows-diagnostic-data) - [Desktop Analytics](/mem/configmgr/desktop-analytics/overview) diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index b3cf4f88b5..2e8b46a246 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -66,7 +66,7 @@ Depending on the diagnostic data settings on the device, diagnostic data can be - Small payloads of structured information referred to as diagnostic data events, managed by the Connected User Experiences and Telemetry component. - - Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component. + - Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component. - Crash reporting and crash dumps, managed by [Windows Error Reporting](/windows/win32/wer/windows-error-reporting). @@ -120,7 +120,7 @@ Here’s a summary of the types of data that is included with each setting: This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows 10 Enterprise, and Windows 10 Education. If you choose this setting, devices in your organization will still be secure. ->[!NOTE] +>[!NOTE] > If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. ### Required diagnostic data @@ -247,7 +247,9 @@ Use the instructions below to enable Windows diagnostic data processor configura In Group Policy, to enable Windows diagnostic data processor configuration, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** and switch the **Allow commercial data pipeline** setting to **enabled**. -If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. To use an MDM solution, such as [Microsoft Intune](/mem/intune/configuration/custom-settings-windows-10), to deploy the Windows diagnostic data processor configuration to your supported devices, use the following custom OMA-URI setting configuration: +If you wish to disable, at any time, switch the same setting to **disabled**. The default state of the above setting is **disabled**. + +To use an MDM solution, such as [Microsoft Intune](/mem/intune/configuration/custom-settings-windows-10), to deploy the Windows diagnostic data processor configuration to your supported devices, use the following custom OMA-URI setting configuration: - **Name:** System/AllowCommercialDataPipeline - **OMA-URI:** ./Vendor/MSFT/Policy/Config/System/AllowCommercialDataPipeline From c6737199096ae32a6330abd04fc33755935886f0 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 14:48:37 +0100 Subject: [PATCH 012/279] Update configure-windows-diagnostic-data-in-your-organization.md --- ...configure-windows-diagnostic-data-in-your-organization.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 2e8b46a246..033030780e 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -231,7 +231,8 @@ The Windows diagnostic data processor configuration enables you to be the contro ### Prerequisites -The device must have Windows 10 Pro, Education or Enterprise edition, version 1809 with July 2021 update or newer. The device must also be joined to Azure Active Directory. +- The device must have Windows 10 Pro, Education or Enterprise edition, version 1809 with July 2021 update or newer. +- The device must be joined to Azure Active Directory. The diagnostic data setting on the device should be set to Required diagnostic data or higher, and the following endpoints need to be reachable: @@ -257,7 +258,7 @@ To use an MDM solution, such as [Microsoft Intune](/mem/intune/configuration/cus Under **Value**, use **1** to enable the service. -If you wish to disable, at any time, switch the same setting to **0** to disable. The default is **0**. +If you wish to disable, at any time, switch the same setting to **0**. The default value is **0**. >[!Note] > - If you have any additional policies that also enable you to be a controller of Windows diagnostic data, such as the services listed below, you will need to turn off all the applicable policies in order to stop being a controller for Windows diagnostic data. From c0911676bac82fb37ecce47c5823569b32c55e53 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 15:52:14 +0100 Subject: [PATCH 013/279] minor dpsw updates_2 --- .../changes-to-windows-diagnostic-data-collection.md | 2 +- windows/privacy/windows-10-and-privacy-compliance.md | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 38c0dfcce4..814dedb66d 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -102,4 +102,4 @@ Previously, enterprise customers had two options in managing their Windows diagn Now, customers will have a third option that allows them to be the controller for their Windows diagnostic data, while still benefiting from the purposes that this data serves, such as quality of updates and device drivers. Under this approach, Microsoft will act as a data [processor](/compliance/regulatory/gdpr#terminology), processing Windows diagnostic data on behalf of the controller. -This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration). +This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization](configure-windows-diagnostic-data-in-your-organization) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index e5ce1e7e04..c6fade565c 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -65,7 +65,7 @@ The following table provides an overview of the Windows 10 privacy settings pres An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. > [!Note] -> If the Windows diagnostic data processor configuration is enabled, IT administrators should use the admin portal to fulfill data subject request to access or export Windows diagnostic data associated with a particular user’s use of a device. See [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). +> If the Windows diagnostic data processor configuration is enabled, IT administrators should use the admin portal to fulfill data subject requests to access or export Windows diagnostic data associated with a particular user’s use of a device. See [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). ## 2. Windows 10 data collection management @@ -82,14 +82,14 @@ Administrators can configure and control privacy settings across their organizat The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft connected experiences. For more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve connecting to Microsoft connected experiences. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. For more information, see [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration). | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -108,7 +108,8 @@ If you want the ability to fully control and apply restrictions on data being se Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies. -You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10: +You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10: + - [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot) - [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process) From 81271f6350475aad223a2ae910817091c42bda69 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 16:00:25 +0100 Subject: [PATCH 014/279] Update changes-to-windows-diagnostic-data-collection.md --- .../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 814dedb66d..6d5194e8c5 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -102,4 +102,4 @@ Previously, enterprise customers had two options in managing their Windows diagn Now, customers will have a third option that allows them to be the controller for their Windows diagnostic data, while still benefiting from the purposes that this data serves, such as quality of updates and device drivers. Under this approach, Microsoft will act as a data [processor](/compliance/regulatory/gdpr#terminology), processing Windows diagnostic data on behalf of the controller. -This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization](configure-windows-diagnostic-data-in-your-organization) +This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [configure-windows-diagnostic-data-in-your-organization](configure-windows-diagnostic-data-in-your-organization.md) From ebdaba2b58dc25fc7c53b0af93826d17717fe56f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 16:20:19 +0100 Subject: [PATCH 015/279] minor_update --- .../changes-to-windows-diagnostic-data-collection.md | 2 +- windows/privacy/windows-10-and-privacy-compliance.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 6d5194e8c5..f582ab8f63 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -102,4 +102,4 @@ Previously, enterprise customers had two options in managing their Windows diagn Now, customers will have a third option that allows them to be the controller for their Windows diagnostic data, while still benefiting from the purposes that this data serves, such as quality of updates and device drivers. Under this approach, Microsoft will act as a data [processor](/compliance/regulatory/gdpr#terminology), processing Windows diagnostic data on behalf of the controller. -This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [configure-windows-diagnostic-data-in-your-organization](configure-windows-diagnostic-data-in-your-organization.md) +This new option will enable customers to use familiar tools to manage, export, or delete data to help them meet their compliance obligations. For example, using the Microsoft Azure portal, customers will have the means to respond to their own users’ requests, such as delete and export diagnostic data. Admins can easily enable the Windows diagnostic data processor configuration for Windows devices using group policy or mobile device management ([MDM](/windows/client-management/mdm/policy-csp-system)). For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index c6fade565c..7a44461fae 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -131,9 +131,10 @@ For more information, see [Manage connections from Windows operating system comp #### _2.3.4 Limited functionality baseline_ -An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. +An organization may want to minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. >[!IMPORTANT] + > - We recommend that you fully test any modifications to these settings before deploying them in your organization. > - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying to ensure the Windows diagnostic setting is not turned off. @@ -160,14 +161,14 @@ An administrator can disable a user’s ability to delete their device’s diagn - Windows 10 Enterprise, Pro, Education editions, version 1809 with July 2021 update and newer -The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration). Diagnostic data does not include data processed by Microsoft with the use of essential services and connected experiences in Windows. +The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Diagnostic data does not include data processed by Microsoft with the use of essential services and connected experiences in Windows. The Windows diagnostic data collected from devices enabled with the Windows diagnostic data processor configuration may be associated with a specific AAD User ID or device ID. The Windows diagnostic data processor configuration provides you with controls that help respond to data subject requests (DSRs) to delete diagnostic data, at user account closure, for a specific AAD User ID. Additionally, you’re able to execute an export DSR for diagnostic data related to a specific AAD User ID. For more information, see [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). Microsoft also will accommodate a tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for Windows diagnostic data, but still wish to remain an Azure customer. We recommend that IT administrators who have enabled the Windows diagnostic data processor configuration consider the following: - Restrict user’s ability to sign-in with a Microsoft Account (MSA) using [Block Microsoft account group policy](/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts). -- Restrict user’s ability to submit feedback, as any feedback or additional logs submitted by the user are not managed by the Windows diagnostic data processor configuration option. The Feedback hub app can be removed using [PowerShell](/powershell/module/appx/remove-appxpackage) and block ability to submit feedback in Microsoft Edge using [Feedback group policy](/deployedge/microsoft-edge-policies#userfeedbackallowed). +- Restrict user’s ability to submit feedback, as any feedback or additional logs submitted by the user are not managed by the Windows diagnostic data processor configuration option. The Feedback hub app can be removed using [PowerShell](/powershell/module/appx/remove-appxpackage) and you can block the ability to submit feedback in Microsoft Edge using [Feedback group policy](/deployedge/microsoft-edge-policies#userfeedbackallowed). >[!Note] >Tenant account closure will lead to the deletion of all data associated with that tenant. From 0e3e9a00129c3a331ec248982607271001cc853a Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 18 Jun 2021 16:34:21 +0100 Subject: [PATCH 016/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 7a44461fae..9d66846576 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -89,7 +89,7 @@ The following table provides an overview of the privacy settings discussed earli | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

Note: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | From 6b05bcc9a7d8dde988e85d7aec658654870d3472 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 21 Jun 2021 15:23:20 +0530 Subject: [PATCH 017/279] Update policy-csp-admx-networklistmanager.md --- .../mdm/policy-csp-admx-networklistmanager.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md index 3bcfab9825..2f0f6cead2 100644 --- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md @@ -24,17 +24,17 @@ manager: dansimp

- ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints + ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints
- ADMX_NetworkListManager/ConfiguredTLsAuthenticatedNetworkName + ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-**ADMX_NetworkListManager/AllowedTLsAuthenticatedEndpoints** +**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints** From aef01d2991f0620c8ae8e598e84f883119d275f8 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 21 Jun 2021 15:31:38 +0530 Subject: [PATCH 018/279] up --- .../client-management/mdm/policies-in-policy-csp-admx-backed.md | 2 +- .../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 557e212d5d..3cb809553f 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -733,7 +733,7 @@ ms.date: 10/08/2020 - [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) - [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) - [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) -- [ADMX_NetworkListManager-AllowedTlsAuthenticatedEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticatedendpoints) +- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints) - [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname) - [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md index 2f0f6cead2..40de373e96 100644 --- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md @@ -24,7 +24,7 @@ manager: dansimp
- ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints + ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName From c24b0d494a1fd3bc184899a90c17e7538289ba6e Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 12:40:01 +0100 Subject: [PATCH 019/279] Update policy-csp-system.md --- .../mdm/policy-csp-system.md | 89 ++++++++++++++++++- 1 file changed, 85 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 536bae0e06..36cad84743 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -28,6 +28,9 @@ manager: dansimp
System/AllowCommercialDataPipeline
+
+ System/AllowDesktopAnalyticsProcessing +
System/AllowDeviceNameInDiagnosticData
@@ -43,6 +46,9 @@ manager: dansimp
System/AllowLocation
+
+ System/AllowMicrosoftManagedDesktopProcessing +
System/AllowStorageCard
@@ -55,6 +61,9 @@ manager: dansimp
System/AllowUserToResetPhone
+
+ System/AllowWuFBCloudProcessing +
System/BootStartDriverInitialization
@@ -224,7 +233,7 @@ To enable this behavior, you must complete two steps: Windows diagnostic data is collected when the **AllowTelemetry** policy setting is set to 1 – Required (Basic) or above. -If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft’s privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like 'Allow Update Compliance Processing' or 'Allow Desktop Analytics Processing”. +If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft’s privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like Allow Update Compliance Processing or Allow Desktop Analytics Processing. Configuring this setting does not change the Windows diagnostic data collection level set for the device or the operation of optional analytics processor services like Desktop Analytics and Update Compliance. @@ -257,6 +266,28 @@ The following list shows the supported values:
+ +**System/AllowDesktopAnalyticsProcessing** + + + + +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms. + +To enable this behavior, you must complete three steps: + +- Enable this policy setting +- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Set the Configure the Commercial ID setting for your Desktop Analytics workspace + +This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. + +When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. + +If you disable or do not configure this policy setting, devices will not appear in Desktop Analytics. + +
+ **System/AllowDeviceNameInDiagnosticData** @@ -609,6 +640,27 @@ The following list shows the supported values:
+ +**System/AllowMicrosoftManagedDesktopProcessing** + + + + +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data. + +For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](privacy-personal-data.md). + +This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. + +When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. + +If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. + +>[!IMPORTANT] + +> You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices. + +
**System/AllowStorageCard** @@ -845,11 +897,18 @@ ADMX Info: -Allows IT admins to enable diagnostic data from this device to be processed by Update Compliance. -If you enable this setting, it enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. -If you disable or do not configure this policy setting, diagnostic data from this device will not be processed by Update Compliance. +To enable this behavior, you must complete three steps: + +- Enable this policy setting +- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Set the Configure the Commercial ID setting for your Update Compliance workspace + +When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. + +If you disable or do not configure this policy setting, devices will not appear in Update Compliance. @@ -932,6 +991,28 @@ The following list shows the supported values:
+ +**System/AllowWuFBCloudProcessing** + +
+ + + + +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. + +To enable this behavior, you must complete three steps: + +- Enable this policy setting +- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Join an Azure Active Directory account to the device + +When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. + +If you disable or do not configure this policy setting, devices enrolled to the Windows Update for Business deployment service will not be able to take advantage of some deployment service features. + +
+ **System/BootStartDriverInitialization** From 353358e8173321373e87b61fe44c76e11d657b1c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 12:46:24 +0100 Subject: [PATCH 020/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 36cad84743..c19189a66c 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -648,7 +648,7 @@ The following list shows the supported values: This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data. -For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](privacy-personal-data.md). +For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md). This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. From b235ebe8c8421df84a90173b6556e35becf7b33b Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 14:45:26 +0100 Subject: [PATCH 021/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index c19189a66c..149be2e826 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -277,7 +277,7 @@ This policy setting, in combination with the Allow Telemetry and Configure the C To enable this behavior, you must complete three steps: - Enable this policy setting -- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Set **AllowTelemetry** to 1 – Required (Basic) or above - Set the Configure the Commercial ID setting for your Desktop Analytics workspace This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. @@ -903,7 +903,7 @@ This policy setting, in combination with the Allow Telemetry and Configure the C To enable this behavior, you must complete three steps: - Enable this policy setting -- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Set **AllowTelemetry** to 1 – **Required (Basic)** or above - Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. @@ -1004,7 +1004,7 @@ This policy setting configures an Azure Active Directory joined device so that M To enable this behavior, you must complete three steps: - Enable this policy setting -- Set **AllowTelemetry** to 1 – Required (Basic) or above 1 +- Set **AllowTelemetry** to 1 – **Required (Basic)** or above - Join an Azure Active Directory account to the device When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. From d6af85097ef258da0393fe6fdf13a7a95b56fd55 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 21 Jun 2021 19:15:48 +0530 Subject: [PATCH 022/279] Update policy-csp-admx-networklistmanager.md --- .../client-management/mdm/policy-csp-admx-networklistmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md index 40de373e96..7d7619c1d7 100644 --- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md @@ -34,7 +34,7 @@ manager: dansimp
-**ADMX_NetworkListManager/AllowedTlsAuthenticatedEndpoints** +**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints**
From ccf432d723a0d0ac2ed36cd30de854d04075580a Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 21 Jun 2021 19:27:41 +0530 Subject: [PATCH 023/279] Update policy-csp-admx-networklistmanager.md --- .../mdm/policy-csp-admx-networklistmanager.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md index 7d7619c1d7..5901b7e3e1 100644 --- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-networklistmanager.md @@ -25,11 +25,9 @@ manager: dansimp
ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints -
ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName
-
@@ -99,7 +97,8 @@ ADMX Info:
-**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName** +**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName** +
From 7cc627275eb7ef939abb5f7a37dc94d2a5e978a5 Mon Sep 17 00:00:00 2001 From: Guillaume Bordier Date: Mon, 21 Jun 2021 17:13:49 +0200 Subject: [PATCH 024/279] changed screen capture to remove double quotes --- .../images/pinreset/allowlist.png | Bin 33880 -> 33638 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png b/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png index 097b1e036df4ddd9e2f4dd657f4a9aef2a97dc1c..5b1df9448e00e4ddc1e45396eba1bba735ef6533 100644 GIT binary patch literal 33638 zcma&N2UL?yyDl6XhzO{N3J6$UK|w^N6PgvJBLdPDq=pWmgeIc!DFUz3gb;c!iPS(s zKtw@GLQhBnp%Wk^0Rn{1AHVP0`|Pv#I{!J(S}ay(&CD}%&&)mdbzS%K!ProT?}W$+ z006-E^vT0#0KgFp0C0$QoQqR(BxT#1^Y4)VGoAYYIPT&C=f_c(dj|IafT~2^-B-sr zzj=I~So#A1f6f2-JM`A^*hK)~?atGO_nrsa(Z_hh&d%l@93VQfT-{7m`~3#-#-ZBQ zSJDm-Um61JYinF6&AW2Jq;yvDtrgzODyap zJV}KQ0O&h=3UcVu%)Mq-S2#R>z@@KaVi}D&~@MQ_U@UmLjY~l2lL0?JcgHD6190e z@u&0t%kL>ccAIe#RonhRp_-s|elgY$J0Li~veB0+6U>Wu#Hjq&lF2t?u%*Y8ZEv z^Pa~^r3-WdBKyRN6a05(#1LABdsSEVZ%?90O?^Bq;8V-iPJur4>?3v6gM16i2|RD| zQ+VoiG?!D|roAB#+nfpHwDO@_Zf7@U7bGLc1!J?q6=zaoYv+yXK2QLFi6?H)uuw$P zY8Q$pqqZ8 z{HktYIji<}Lg#f*^V#0RTiE znwzKAdsQ|&^3^0*BH?0w^I~WDEUR7_wK&qBbx36|3>zg7Bw~-k&G%M1A^XX4b!snY z#5-m|*J@j3OODwRhvBQ}*T?_^4J zWZ8>?L-hd)mJ%(wX%>+Dg>Xdw1Vu^Q%RXnAjOlN`RcLJw^X{ngwWw6X9|q)*|ha6#3?&Cs3Pg!nRt9N$UhG7C;%+IwwcIsz^URodR_ z*XTF4@n_9pO?NivDW5;TqF&6%!_0~dEs}9B6n6r<1Oh-hT1(8~MfTxV&6mt(1WX~+ z=GSc->_)Hfs^eb2>Z~7C!ojEy4Auu+923c_M{XK`?Y)fK#q z1)7(Ji`M!~#iMQx(i9dm4-p~33;ZeOL1P{vrGfCTa58+c+<%n67_v}pJ?B2HiEe_Y zgy+r+b&rv53@1EJNh|SLxH+cb{&xf;=uL|1la>q>J()nsfQ34LI2Q>VQKwRcYtTPt zN@t-*3x|1(6tU%dP5{8gN;U9eK~qzcZZtw77^~(yhBA-LB^(_wYJN&euGH&(Q2JrF ze!x)Gyw~U-2-^gGdd}tI5i|FR!Zf>QR2)n|Yczbd1)?BgS3a(68b??1-S5@{8+9<} zFM0=Nn#&%HJ#DtX##5;{(kvK;ZPI}47vk$qHiHB80ouUYD}=bFMS_m7lxkwJ?fg4? zZ*yO-EG4dO}S;FVA{zm9y28*C)1ly%%-37TwEf-5I54;!^@eCRx8DMFA&4o zLT=O5jVLnD+ym$H?e|&28sMj*-T~8S!|&|J8neLKSLtFF&Gmc330A-pX`xqz$1pko zK*F<>W8>TWO^^59Q%ns9dG+xg71YZWJPM}dON z{Bh*1A*~^&c>&Mh%GT!eA`)}YRKR2B89Upy>K4HXzcnKvA~yezMcA-2)Xek1AG3Vl zqggZ)l#5H?0bC#x+&aDFzvQ*1ZJ786Ir}@UiA^Ldd}o@9}1jPuv2& zwhzx8=+zy|ooTyY`PDxkjpJwN@)N zCcjgik?&lZ8#VKEh6mfSBhVNb;oR)_ONo9Q?;iQ>UZhXr2a_T#4}N?y(|A&%scOw` ztm!nzcn%+0k(Uo6OgNj1$Nhn1W*L=Daz;A8xW4CGCUF+jJ36?LSh=5z@0V=G8Mh@= zn8R%rV$g$zKrF754-s8C5896$_X8%cA|5G~jVlk5S!pO2?`r;vu*v}T&~q?Pz?ndX z9iq{HmaNsUs&TSMxuYS5y{FOSczD8cn=+!x*(xc); ze2xEOnd!CX9HR~mhPn@BrUiuRc&}Uzb*qTTB6f@2x{zFncJVfLt9kD9Da;BX*K}_o zN=(L1$$)q4J2dZ8=J|E zXib3Oh7A(0$ZD;F6tq|%FFtSDe9YH0UQQQN^NwpL%p44dhoIcPzZM$le7Ha~qV?Yy zOA$e4D+Ws>jQGyOKOnR!Z?dS@v4k;<_wWgq+C9X1+ItxT=DBNKqGSux6YxI4ZuCO@ zA?GcCM)ll1CpGUun_dt@aH$zj!+}(L0f3x4%b?)+nB$oB7lXV2SKTfpc;FF)iTaK- zx%HXH^4qM>h+VB?G)UZfGtbAzq)s)}r^Z87ML`E2bw36+L=jvE%N!;Y6AsJ=)TT1J zal=Je>sq&IE6g%2%PZdh6(b(C()k_S2p4G*=;)N)V~8l1%rgUPLxR>9nDLC8qqD>B z(!7QrC!uzNOd;KYYGlm1=@N>PN2hq^KHCOMEguGm#J@~(ZfPgzYEu@jwWn)8(yvmO?b;&7r@Iwc5r|yMURj4X@9iXw z=}Z_GUJrkr0M{D(1SRtr47!sCYm>_qTC_^@_DJ@fo~aHygQhNAsOL`%m~J2sf}4&> zdc9E7+@~Pp-T-FI6FT}es;-9t#_R;TLPIr}g^LV4;0VAcK<{KzbIkGPca#Tz2ajb6 z_pJNvFJqO*=V^!*yoG(ZQ}!XiqFMMMV7b1D*tox*Hi_}!0 zF4GBm$=g1s=`Xf|v|TzC50P}IOnQV0ymaf=^Da@j<0?LqqbxnTvvIqyfEHuz(P71% zN@Ec1jBtjdgmev$l5q{4-b(#vykRe4oFl!rFk&het-Ps$L069gtSfe95pL7ZT*^JS z=RK5P0&#w+(2lo!UH0f!G-X5~T(bvH1^|YTU562f=4iQGB>&ew8mj}Fzo5<8?HIC?nvO z%C|`8j<<+x37SJcp06JTOOwuzW?L_Td)-j`c)e*RQ`GavO?sGy5luh#W!h$4OG0wZ zFc!l=8pqkK!Kw7fh@epG>m287r>d%&!ey5&5r##98v1!Gi&0e1w5mnHT1SN6SN3MTl?K zDEk^g-L>;rzIwNBjpiGVF#AJC*O|%gY04I)t+uuAag8G53rB+tpLuf4f4(NS7`3FS zTQjL#=!Du%47EZSbw5LUhp-k$7t-9r>MP6leBcc0c}0Su>huYh$aAz0zDI^CF$Z>; zLH-bKCugI9-Pt(BD*G@o?;%T#6erM+BwGZOw7>L%{;h^Vl%=Zx03~PH3zhGGJ`l=O zn%gbh^11)Y^hMw~x!|w6 zD--!zUuknaFByX%I1D(OY&r@CMF1(xq9R%Oz^xzbJt{~6W9 z@2hL#F=i^sD|ijj1SP(?g&|Q$?(Iqi&j0pgG}I;O~nCm-86|rZREQ zoh^>N*{-IphblV!{KvcxlNP#k#xXI~AYe`lLp1Cl?*>#mK^4hF+>&fy^@+Ky547~X z4~(`{qVJB9!_-}u#IQNAGw?uinjU@7l(D2Y+_S+LuEqqO;T&e*eQyo-e@s|c2clxu z80D9PGzuO?j^uJe&%@I-SLnNgei}6aP+fWjmx*1`6urC7b+HoVVVDc!xzscIrm;De z0hQPBU;5i@>D@%bC9+lJL4C7B!zfxmB+@^X*jXY=tD_d%*1GuK&JmBvPWZ$i|2AbQ z0BCSx%o`Ht&3o+YVZn{ zx0dxrS?bS5wAZ*NC=qJa629oB;X~y^?XPOOkMF8@zmKUt;L}iFyQQ(K+x&5<`Oxt@ zQnfg{0jsOUHfPV}ZxaL|!Eiw)gP@jZDqvxk?1#;*cg>&&rYy22iAcn1V;8-l}g1*3g`dZv% zZL3`g!-^`QTaoUD6MGBJ*aXlCu~Qy*Jqf-b@HkjJdv$JBN}uTqRo*cur3b$Rwu(%> z^j`_Jw@+PG_ufCAp?d^iT=`fO;@!fCasMa$LFGQHzh`7%=Y<$F80?esS8P6Cb?*D; zSMK`O$jUwyqSIW*a7lgh6U*Yc8@&QSMLeu)mO_VFSp-&XvCetqTtl5;$#nGUWr*^* zTZEwO{LlR&qg~)e-vkD&%8s2uJqC4$=Ad$QY8z`UI~3BCXo#b|$Wh~%K5(}`vDRm?ErrWo zYdHhlgVMPlKD?0%w<~y5PxK*w7H|(MKI@&wrJI@%9~hwMSPm05o?RWdA~ZuOwC7tC zvZYd^;RBwgEHjT(X7`|h^ZuJoX`k$g-`E6r=-|K^;NV?y=W4Uy7K zYUqUv)`B6s_55eueoZ4uI5cGbElvCx1vfI>eJ#=|2aTv9Gl&*#Qq2`VxG)XEt|HP$ z$wxm#jSPLu$S{{`b|X${EUpaxyxyP#CCDhXn58vH;=GD2l$zRuQqA~64Vd9+we<*l z`AWHs!*fqm?-97{*?U~~*D!h;LphBBcWo6`AB%1Q*~V!YyLjZzgZmR5Z}8{2+p#Nl ze%@jMWyb*8gMB54h02?o;(Sra{bcuPQW%hO@4*iE+w^+52lX(Y#O)`_8qGGMTA!|U z3z(}TvpjNt&E&4y-cdCeFZmMzeexlT2FzD;w_hGRQyW)&fFBY;${GPv#k*l z!Z(c3hPi`3S4-RMxI;7pf4Em0%P`f(nu=G4)H=a+MUFDpxVmmw4t#0)tCci89Kn@} zhJlW`$4%GbA4OZqc$;4%EIw9c-WVw$@=*4-h3pUsjdhbzcI5_1b3X}wP&@l)Yy$8I z;FMCl=9)$%0+w>-2 z6J7PtM(OBo0n%C;xNt(_&aaTM!AxqMzUhIr_)v*b;AHG0X*8rr9D^f!EiN1h*xAb; z#^185!u(E9{3M{YYfR0KY~Gpg?(FpCwyy@iY5$8svaklCn_~rSWJ>n}ptSm~XXfu| z?t&RgJNklDb7)<2wIl|nqjt#0s3N-fgJF)i*{^kYQN88xSba%cHEE8>cC2r-(10Dw!4j+uX(kKd>? z*OU$JNElAAZv$O4ocH|fn;^#eOFZjk10O%PfOvpJcX#*LN_F+!AlJcmBL{Gyu{`QE zC>N-y&r&w}cBsm^M-hE~roz7?7DvuofsOW;%yjG3O>NkrLJNhx;a*oIhUjVR=NZ;l zq3;^&2`zACpar!382g*C(RvSFUUF?C)Yw}?{X5YiZ-T}*=&fvMtSnfKRm2cvZ_5t{ z_QY91Y{Lc_@q=nKi(Y6|y~z3$4b_YRl1=Lk1r9ta&ZV!EXXA^kQRo`cw>;GZyU@z4 z@C{2?1j=G|iQDer4pB|pN#9a%#%O2uvzCHQ<2wj4D4hW-Jb`?F7yuaNePrPM?P-nu zG-&Re^5-3rX{S_kc1SpF6D*Kk?0qiKq!&)cjQ&34S2Ayx#k^)(?`jG0j- z{1w$$3i)|_HaYOT6vmD)B*|ohzCppp=u}P^knz#{{6h0f9Xs%dyaGo+Fv#b_q#U!e zFNtPaTFlSw*VnVZs~HH(t1|X$eRYGb%PDJ-GLa$W_5IGxkt3+K1WOLt1~K{3q+5`Q zx6Nm?$dmN^{v$FyxG&b*we^Izg40W7#U6w7KQZPz6V96idZE^C z6YE>8gbLAH*p!goi+u5v7%3xD4pqtvN9)PkS;FHZNjdQ{cKA;ph^Uv}%`#TKE}cR$ ziz=Kct}9FEwdIdjQo_v31`>Jemf`m9jPboE7hk8!8n?z?lV(Bhq@}o0NnxHfNqfB? z@#DJKj1Ks)?N*F=vUNdmM0%yL9|3MQSS0LIphq}&X#b3dMpJc0(J$eowYi>~MD$GAe2S>z z>qV{<;zG$_tlN~_M+GM<2PU>vJYPn4LGfuzc4}dLKUpfpecd)3O#ZlO@%y)Bp%fP+ z)a2Q1TSpEihD8*cf5<2V4Ke5Dx98Wp6SO(4J-1FsFe@e-ohynZZ)KNOG&uK1vH$i_ zf79Nctaxv~)?R$;2u7KsbiFHJ&qD+b&Okg zwwX}WH(1kS>;;*6R{H672Y@&2ZhkLv*6-s*%(*)R`m~rPlbX@niBJyH*c&g<^v7C0 z$4eFr`byj(hZLR`Rq(79@2&opxSsaMj(;!-XS5go=w|@HDJu@;!FjY@Pec9*dvYKB z5#=})&i(faVqo@y2I((x@ko+77dIo8Cnxu7wdC*Yjqa%r^8f__@PWye+3ua)D897V_W$NTc2M|-8~)8ne3Z3U*S1dbfQmD3q(W@I2z{jrC$DS=$p$;4Mq4U$>A7lJ<)L6gT^|yyBHk_x@RT6a;YF6OvbM$l2St| z=bNRL+As+3Kxibod&=E0ddI9yWM<;d>Uf-WH?&wIlr`#jR$XZyRW;X78Go6MZef!+ zIurn~D42`v_kBB28d|$=D_EceOq9F;VQJp2(f4E5%*JRUQt?Nb8VF$2 z@|T?@f9Bw$r)=7CZS%8DNPVw1e@Yb=Kzl=oan84K4WEZwK@h35AZ!tG9^=Fo8 zDXzY>PWW-1IpvI$G!pfMZP4kr&t-|~P1mZfIUh_2Lef+bWJio(K>n-o-SD13M$O=V z%;)r7gS4@4jX_3BB-;Zkdw&gPsp0VrbA!G|SG{Yo?}5NxGOYsC4x`S0`CO$?_7u3Mj8CMa#YVKwd)>!aa)`!Bq1ZE2n0q9J&rlZe1e9`&|FXlS5< zTgmu@jgg6C-!qiGy(*bVzr(LzhSy|EKJ1W>QZ^cAgYtBSCooV6-X<h=x_9!tdsU z(y=-{X?L-5MPzj8p+AWPeaoD~@#Xw+0x%ufVdS}1eJCJ&0z%2~19_y)sIK&rzMKb9 zmfpF^e(=tMB7a8Onubb;*Zw4)R(1vM_$)%Oc1=?C_NnB!+RDptVQ;dRpo1gx?ktAp zp>;{S~b2b-gvU)gI zQ1%Fc0eK}8VaHd8dU92cC`cP|YhycNp;*Q8xoxu+OXfd_10^GMjgq&SAq1XQrB8ti z6g4l2w=n%NbhA#*Q{Qz?1pmx3vIeHpNDxX4Z~z}Bm)Eo~X)^H74?(sHq|w8jkw&!j zJ$I;bC>FIheH*RP_ii-CwdHF0EoI7ivUiY*u6G?rmUelD@Z!^d`>j7Y3#i1| z*;z&~Cu;#%>o(YKD*;&icmwoy*R4f;mAmU2rxC|*{+ZC_$N$|I+6-F9|7@E!f_6-N zuk#0p{BP~RvzVq9clsw!wdIAhKz_hQRjk!Tgxz$nc}Il=N!9G?n)%h0<;}slJ1RbY z|IK?ETR5-VRoM3|R+?))<@7x9o47+ggHeOTKSl_@raq6K<46{Ok}su`*Om{fSbbeB zQIa*{q(X3>H+@&uINlckxF5&KoZvjiW&gz{U8?0&cwo1SKwf}*=TVAspn8!tgi2J6 zP2kLsip}iXvNoo1C<;eQ={&FlKB&cmX=@G45C_xQjN0qI z*@9z_b37LA;&0S6;icRB3*Tloo>7blTmHMhs6dOs$2Xr=v@YV$`qX7HQ(rmGOA@W z5KFp7!MrY-g{C{12!6uJ;ZS)OawA~TbTZ?Z2nlGrI7HZD;7V6xzg>{}2mjZK+7Jqx zlzci}W(P7J8U!rQyI0%rq^s{%$a&f1d3wq-=fpCRTioeypt6tbU5cu$iljkBrl~45 z@_y#3EJ>9@;Wyj0;p5hU6?rKBCN9oRZXBd$(6=iu4VqheH|4uu`nn89BMc^l-u0`d ze{e=^H%Mi#3_g-b_f(Ur=v9##B6Ps9dQ1)dV~;2c-p0i9h1*`_dNpb;_mJ<>^}6{! z3XD5PoZdY+I{IpHuv7mllc82=m%Xb~n)9X5zxFoJVtR}!YTB^5h720Su?}y zhbK1HA(z!!-16jYklNcXE#8x6lLa$?QS1nI|4CbB^H}&%<49dRwfqtqvDeylLja!n zS7jLb3tnR7?f{8&ryLA)Y8dxq>fBW>@v<$j=qZJ7a|(N;gLHl>Mhb5D=Ub46>n;q}&WU z%R>rB2Zw@TGj>@oBa=mLTOK=>v~I(vR$JER;MjXhXha)I%1;!{;?=4)NQY@J8JrI> zCBYMUe3k#&)fQMzIxMBqE3 z;!r>5{!#J~0?FoP9kBq5S*068Pd5dQZ^fX~?ruiaI{^!YWl-2_{S|kUS+5X)J?|_mWZHdBXxQSA8{(R8Fv0H27)DW z%b+irQ5hl=zvabVIIRH@_seS=Lf}51IjIcW zhychK1FtE3gvVeI4YI%(84IJ6Ya1h;9}SpT?P&Q{q~;NXul~N&c8CUosRWb5OmH(RuE?pUyB1v+IyHS2T ze`aA_`R}XnRBBSUOLjOuylI038q;|W_hF`?Hi?OAD^xqI7uXQEGQPfDH*NtbpQc}& z==;wFzO;6@M20DJ&Yhm2HUB;8$iME)3`J7}g<9?iLBUKF?|Unr5lGbX6pwyz!SI&B zgqUVnLv>9}{^a@2bWk8rV?S!Yi75jtc8(ZWRq+%Hib>FD#{u}G{_{S+FZTv@7c@7$ z{mUtOxC{&easv`FF`*mt!{c%T^HtMJnPvT-g=~&eNa>q%;~=qMKGsDR2XTrBnzrdp z9P_EYJ!|4=m30c@dm#$>FvJm94odreTd6laRON(X8xi-ZGH~_!Yxj`sFsV-TQV2>D zw(a<6bn+y&u11g}ucCse17cPyo0TGWb7F%sLpO&19Y+!ZS> zU)Ije5(eixpB*B~48`YzTii>6iMAqs-QCjC$UnQwn0XvyU}HP9%nw6yXh`U*6iN4L zNjZ(o5h#2GSKl5~ourd11U$$cK=6}F-?Dn;8m{5uq3wt@bIz#2YT0zc%3DDKlD@ z*SokV#Q&(uT))XA4SS<@Fd^Te<;!*Ok4;(JxU1zvjr}XTbX`qSF6_~cneLyU$@O-J z$9OZQ9&DH!IG651x|7%_ev5+@5$UYh{8>_CujWoqxcWjt(r8E7#fS+-MNGI^K={pq z)SF`EydNLC4mM=iKBrvJSi?)9SO?{0ANl%Ebs&%p~)&m565%5Y$Ee|J0Gqy9~j2MDt|__ z?5j;>YCmq?UM&CJvcHb_9d(5JN?~E)=U%M?_0>+P?1vxY;^^ighD-|PDohRhF>ITI zMGgH})Lvzm&eKxMB-L1l$eFr3uq%Vek{btaS>K3)`&|R-_4oYz90pa9D+hH;rj{-WfWyI$8$12vHUVD9U+J9MZaupYP zU`b_sj-_mM;huOM#89sU@iC_>Xcyx?X?_MtgvnOZvI8e6ge#7)El2yYbC&E8#m^Mn zX76_5hnt&mNNmHjYfMLG%e#ZjYx^d9($%2Oq2F~>C>ZBo-y*$A%6A^!ACs6(+zg0fL6%$o5A>J?y51etz}-MxpFA|qx8uORIp zSxCxO+GDT1vF+dc-b+*Nl+a`2VW){3OR}Hs8<;hw1?)o8tF-2C-5ZF+o^|$c6Rw5{ zL@=IghM}0MTAk|DJxB-Xpn~kUIzs+z8^`#x*6q{Y+akHz2aWVkL-l|XSo?5Bgj^&p zR4XJq*lB=jeYN*d;&{mCd!~ek`^@V%(*Oz)Eg|#wfLs8bSW>c{f;WG9hj^&|qeqX_ z4t81jb3KeiXh|L|zMtqx3A4zV96YMX+bx{0uYZ z$WG9?b#S&xD}G@S0&}3rW)~;`BR9E|9LUYhFf`y0eq2+A-BGnmxquLe3Mfm9On^%cZ0m;QvOacG%iuRyr+7 z`00BX)aE^>@KBiZ?zSpDV6HgvMfv%Nu`yv9oNUj@5`FxbVoyG6;lXL}mxX$N@jD4X!ON)>&$a#b0Qc zMq~ZqnWf0g*?b_%`X8oEYv-up@If96jm0GbEkkS7LkQb!qP!2k4POXyVrrNyES8Gw zZ}NkonML z14W~+M6&278_5`7>dF%`#;=-TxAg&b*r((;=JH^vsT77oDW`CabE4(POBobdRBnm) z#LOKt%jxRONc!_c&93Vsg$_VjAvc01kaWXVDBt|UYL?}MN927E%kG;_TZA31`jkcW z7BA7i&Ebya-sGyIX?4bPEA|WNof7UDFtc=BqzUMn)!x!!A#i5Sjt;-^&fv2YJg7FS zp*XP%uUWh+KzC0tg^M6ev_R!UgWRt3#!@p3N)a2o;*GbFQkKtEdvrre(Sqg7SUhx1 z`bE8s69csN+^V}?w`JEbzGd_lJbphP{2(Vj(EWf1)ohXR3`X!IgWknBt6biXwv|>@ zdW1DnYb9Ro@Rd@T#-{jH>?FUrFS~_RlR7(|%b_d1*q|@s7l`JM{3(6y+S}!87>mh< zInQCwnWO7LKioSd=3FOZ!xe5&PtQDVsuD-^tC`-DropXW|F>zjtXzm|Ugg#CDFE3BuPJya4ZRf5?mc-T?8%zPv#l zEg+Xz>{z(1EH;ZIp|x2xz0U|9%+uN`ryvhXswb=^qLfXx8#t)UcJ}A#?xCS=sn#Qs z9qy%>%iBL!HLWyq%95rXgoIQs%MiuRaPU!4$be4}*)he!;7zIC9y!tin^?X%oW8R+ zof(-pxL(gqHIiBQ-K9?O$d}A0t_SbSK6|>V7cKUSv<_$W&FZHshGVVMK}ta-D$CH0 z1zAVJDT#y1E>MDu?uLkAN%^S+(05{NL-!Z9XJ4LM(1OJS#DG(JxZ*YQcuUL|2fE57 zFm3sP+(m0Cq=M(6kL#Vqlv)!`=9xO{++N`8j8!SS3V#TD*r4&fmjLmXgvzAV7792R zk&0d$@RZ54oULo|G&|-=YES5FA?w60td-rDJwPU!R{UsayeqY9ezo^EK_e|I{}ZqG z0E;QnX;&HQKD9a`@Di#-)h!Y_u2`Zi=pRG6Zc!uRNS_fPe}vvWH2H9zuk`1{&gOI? zA#?&vC(k}q=srquAw7a#f);fO2Y&88I{v-W_tym3+)bGFytczo@@^|(49?TbcRnmp zdFKZp zw!)jfNSt(+HS>&EQvWLQ!aFAaIXYUaHM09?gxf)s+^EiUw|AMFt9AW7frF{XvNwT7 zNTVItT+2R6vOQe8>@&$+EOP?m+hISQvBnsuh8>0$mfAXDKa~4)_gsP)Spe`68U=Qt`aC zj0*POiHCR$nL^klZsQ*A_SnRi{)fj65W>~$wtKrl_<*8wdr>zpBu8syrjy-NYevBm zy)|{+&RIlwiw3Y+(MWl#H;$r<7ZZPRJ`5h$ZZFW4$ zwDP=W;Q__l<*%B^6o!()2l@ozFjQo6GO^;zeg^GUBQ*zE|uH;eZE2R*kudo zQkWY$t0$}CVBdcNyf@cfk`3Y@8t~4?*-Z;RjV7t z&0K2ZV%~mP->S;6qdrtR=V#DRm+$)wY}b;7>vWqa@Xz+oqp2faFRYF5_;&|Vz|DNF zUB|`;jjSN|5K2A%J^rAZg=nv@UkYpA#wvUpkB4lg%#t>X`J`W{=>-`n5|)ajr}GZ! zhIpeG=@=WJ)-99%?72n84l89qOD}w}Kx(dj5l`5PJEuQ96JmILr{Rex)d2sX)rvTz z02_NuYMfV{^^`MN!8byJx4F>Y&J^Mx42@r=$$mEJ8wlH+_pP343G#KF5+25rvAE?Z zWjRUPaJZf+QBOd%;};PT{)^POc6m$#{lbl4Te8-bA!w2N`j?IDs8z+lvjwy)xeFm- zxVP}W%eCIdKaw5uakOhl?s;usLTaQd=#}UE!Ll4K!Xs#7c&7L@%YAw&OJuY{pO+c> zTeawyG$pGzwz$V+>1@SAnYo+BlO2W9X8y3zRpVz7;r{!NiL_b>CWKXF>03Wz&p)~U z!l{L97~<2~HL`xtU(_zS%*iZ^l$Y|MM|d>{B&JI=>|S<<6{%k}sP2VEw!gNWh%puX zY0;i*g~$SM0~B}&UA8&aL7LM^6ktR^L0Zvmer9d2tAlN zfb{w!L!oQ0ZR8gOYJ;m3NVXBhD0tT5`{C@@p#55py3!>@*eTI4Oh4pN9M=#Z?gf~$}?_UfMGzKhrF}Pg^A4h z`oOu!ah|Mtx7r15J(kFZIk2c`V@t+p*iDLylyBZv0m?ERw6e2b+`{pEj}vfrr5e?S zE!u7mmxzLCOJHgL`{^HSusa$hglv)ABn!jgzxB2ktI?D`UrtK)`i<}@=oyKa`sgAW z@+unC(Ig7C3`{W3R<{!P3W7klT3e!H_MG3|-CvI>I*BoEJFiF(x@tgo6?(Sgy4H}j z?MJK>30@J(uqK&W`f5cK(7rsibZ>D=jS;};i5@t)aM$+YhIv)T>Ohniwn`HYw!ocm zaCe9as|Glt=q@!|fJly{UfNTyNxQX!-Rb%r@^m_K?&56fk+u1nq#=5~Dr)769d5Ne zU|fXSu-U?iunW=6!Lzq)l_ZTAi5ndB^H?`1KFH4B$KPL{+ijD%A;W?L$8c3MT-#?0 zBT^9Lm^E|f@$R+0gS8j_kG0D(*QMYTIHe{?nex zykR34X%M;iz2e1pthmXqpypypiXd<8f`#F;$II1mxzNc%^(ARBE3$ZIF~oyBUrT*GQ)swWl=Ki`_BxPG&KbotDdyMf`)QPM)Er;c^w zYcIufk?6bGjRr}f=+YC&z}1*}dS_mDG*V8l*?=ARVh(R*(n>BgYXWB|BUZ_I>EUZ$ z(Ly$IlH1~6JjhFW%jUM)FNT-!mm(8y!ZHOdw?Du>?Owaf67fcDVl#i+dZXBDaiWRa zubpP#oibOwc-AR3pFw*oCwi2!>CE)1k><^*jjNm6{48~E%c;=2 zQ`BE}ZFhGLmh4AOSR(rk-8a$BuJ2pbwTQk?Ar*jz2B*_~+J@er^9VJO6Z{WwnkL1t zv*lZg)6Q8fqZMRV3{u=D$Vc(nff!z6Kbu3n_NHc;CZ_L7aD|y7a@(LV?>^02&G_x7B7cD|W zeF}_97%4k5Z$>f8vy~VcUSH8R6$H&?Zkkarz}y(HcU9m)jzL9gy{;YB_0b2GRzKrF zMpOn(`4VfOb69O#4%q~r$m1UeLvKX} z>_jd?xg(eUXc6+=BABEMTHG&H)W#P()XTmX*fFAEeiq~b(nVqFQsj`H$zqkLV$hFE zwtt6I#q3Jjci1XCl~WISKfpf;ndPD$r9ip#%`?W;8%@VEY!5^{7j0HD_P-Q{D7xl( zR17Ak<@G+J>?IXOP=_bDMVKNpH`v_pNifuj-5n_>vX*Uv6zUTh50}BC!i;?bbHlYp?H3yVLB*8aElMgXE-*=QAQYnXy?>e3 zxy%P>^z{awc7@zf(vS=_U4&SFJ9482#^dE;vchs46;ImJc6B$TYk;Tcpb4dnb;K{l zo#l@aw`J?Si>AvhMP}(qLffV_3Qq;Sgpo?~icB_JEwa zQYhNUtJoSXm)Jt}{t=o;HX3BrNMvx>6Wk4-x9Bk)fUmpxt&jv?!+#vdB>Y!e@uJbc zS#Hk0bG`nbIT#tvjnD6VJ**N|r`mW@OVCew@gh>$8K9%<*>x>L*}BpSiH|zM*fZr& zes2ntW(|jndc2O><($6!Pl+$(wn1{Ni$EMd1M?;tn{w#l`X4I))KkJHR>70YIEb_c zJv&bJTT^=lh(Gqf5Nl1R@K)w;0m$_2C(_3J3*tnP?b90EK7@0F@1kick<)v&beBT?8dtUM0{IAb{ zgfT$LjeizsJHGti8Dh}?Nk;u&2_pa0S^v*DC;!)^l+%z(j@3&nYn(ZZ9p^d4)v-I5 z%Y8Ml>8X4a(t^nvzN0aQTX}e8oM??^IEI8Y0`1Jr=lDHIwY~)IHz(!waxy6htIV6uM5mcvKdOT#GI#{ zuYr^g8$F|61gQ9J>^D9{B-rKmgSd#QX8Hfr3(8)*2lF%m63!K=ml<>m{ujyi&)Wad zbf2Epq*&TY$km$anBTh>C25qk#E%@0K<_lT4@--w_>T0Liqnj2HwTK%YA`usZy-wAdF&?v{M9oNn}mFSW;ULWQ7r#3P1sp< z5Edy@1%{0JgKF&=p>g9yJdLf?qC|3@!Sqz)jk#;W(dFQi{mxn!T-4V$PZ@^|mJuD|(tifk$@(NlUs_n+V)N=!i7 zQcdR(v8^D*oBQp;F-q6vZZ1MR}j9_#Hg z=6x4cKcrk=&u5IY`-gtqNsmkockbX9%T*4@l=}gGWcZKF(u&l;)c(7AMm?fM?|YB( z)+;z|B$*?OHvJeJX;VPb&7mHaAl*-vDeRG{f%&8(kV)@mQGZiHzn=K$e!;G0N7`Hh zT2>JiMY6QErVk$`AMB1w9M#XU&zZ#SLQ^9q@CpLGDJT549}~)#CEl8zYB=^5UHOhg zo1m#2_?}gxb)0B=F=d*O58ccF4CaO}@jnQUtNdUHaQ;;I>!9pO@x-zUdxc> zj&7Uwwz!$JWV{l*wUb3tm-?&y{=fFlGpwntYu8xWii(QBmTCp*Dxp_F zM5Rjah)9jpP(z7|fPlbOngl`-2%Si;0W5&D&v(T;k-EaBM`L6Th z{5W6!u`aHaxmM;{bB;0Y=NV)E%eBwtc%;>@4d@)xlos@$o)K;{a{A1efMAh$JQZB~ zM9FV==2$0QpebfUuFx zVO%Z=gfk=G`iI&muX>`{ZiaUBa3eWSGnt0-hIPLhR$c7oH&fKse5d z>DJ7#-U$xe+&^=5y_DY8YG!zOI7W7k&HTU|$B|0-yE(&Qvyaw1fhAbDP|q;@FnGHw z_N#WSkKI)6*We%!$Zy#;nVeO@#bR`zz&XO_)2k)@crpi;v7@wxTz1!aggY2q^?J)z z!WP_OcEb&yz%4|lhdhJG%+W)>^+7s2=sbNcjLsdjASu`k016y3BaHT_O_9&gWv+Iz zfZgJ_R5_mljtb1e7A#FwqgG=9QqN-xPEIyc{=32a0f@*IIoJB##!G>R8#Z4CHleYx=#VLo7j&x;Y{}<(6XSm(M2=@M z`y6WYyU`*jcw4{z8Lo9rh+hq?JI0Zax}u<*R8$L(*btI9-4+{Lfr_DEOo2^0l^o)beFtDws&kT>gm?YT2OXj*N|O#M=2Z|^TQkTgM^CUpq zoI>2{qQ>A$$gmta7_CG(N}a#g+TlI8yGm*&!FPW%$1EpOR zw~!}}L(k=+*tt7|L zZn6b;?VZnt+y|0@X3#;akX}yNg}PSCTkW%dxbL60vi`i&#fNbKkO~ffBxww ze=M`5`N(UN;Ib)T?{07Ojr{!l<&zJGWj4nkq%-aZC0?@e3Gjn__pi{Fv(5q}SUvT( za}f_E;`ly(+UZ?>Q4jFfa7XDVy2rRnhgrKFqszdKM#PIqJI&OOC+*E18Tz-!ZK|eD zev#F-kTFoRdqR#(sJf|9gRFk(gL8S&kv>fpS%Ne1tK2{-8R|^XnJnwUFNva;&l>oV@ksTUSVLG^?CQr7x`Q` z_@Ex+hT*-?O~;h_*KyMyZKvFNcEe}aCze{kK^IkF7c2aVR7QYxqa$4<6La^X9xx}8hx9rH-U^scCyI&U002U z#%t9CI!%f?Xe&Q>d$ltzK|`^+RowLQg|7%h}kgFa2#&dBXI!?(+RVVsmp^!EAS8gyuHE*c?| zK2IeTysutaQm2(cJivu_+Qo>?T*I)TH0A zH+9D!AztPQX%60|o*8G~RA{ZTNu+j;@t*oTVf$Y3kae3tgF%J1)1*{S<;n+Zqbz!j zZAtyI?51LaMv`bWc=1tdw|se5kt*4q%U>%u^vGkuB_t)An~Ehrg? zIpXu&uH<-(k#sWoNe%I-t>#zSji~Z*vxy(jT%HCd3F>F3^~SkUZ`%OxhSlD zx>z?8BM0(deb^0`=yV~-JN0MRP`CE0>*+fIvnTA;u%_9DZ1>Y=EKUQItXh(G#j*V9 z%I%1r&K2&Wq3cQpbAsJ2-LoR;DOClliN@{lhsO7v6~iy1*+%lpF5@!u`VfflT?LWPxgV9YddEPIXra>I&3xb`uT^LixGcPQtn@;Zfuq| zG>mbJ2?;^MC0%ee#EaQoC>&DY1!4_eGPr?L$?*A=b zQH+<)43*wHXpl@@HRe3Y+1pp96G8O=@f1oExVn$v<5HWA0xMR8PTT>q3C_?bA5OWj zk(dtxKqZSY9^RgHiWAVIJ;?G8c}rtvo4HS0b0lX^XI69kOen-@FdT3B zrI49D{kTqL9-yf*f3R{4C%(tK1%pK`-*D8q#qHcfkHc&_F6xU8o$3CI({sG_+uubd zy2cZo)WTuR2=YLBu+to%sJGqkhWh4EXgkbIN-a3`*YKrl5B`1l04CpX7Kl_CPX2>F z<^MkY@Z${Ln(h453qD*ibZJU}PZ!I7%&q-f+?;<+mjC9n3BjM*8g0>ipfkU?r0<9x z$ZZew2V^@E=%Js9hrv9Cf5TH|B@ViE-QXn;m5nRAy1I|2}S z?_czK`{l=Bf6sa(4+WG4Un{IOqg@)>BOo1C(lyo==OsAM_J05*9(+&alyMgsmekBN z#@eal86|(R=6s@)Z?sZq=Z)(`-QRPbUK#Uj!rR64^R*u4Kp3Y|iY0cnal*S$>t#HRUeaYJl zJ&`(XOO#4z4A05Y2khlg4}g?45FzX;rcOVboxf8C+0R{+3FkkK${zLl zmssPmSz4~NW~?Talw6A-i(3 z!E`yN;Hi#8&19QKR0>saa);sYRNfGP-~gfw!?WKnPMnCntRkjj^X1b^=yWLi(wWDA zn6V@5 z@DY8Sb;F}iHYaGZRdZmc*Dc1xrC9Ur!h;iK6-9U^alE=dmf=Bvo4>?c*RA5h7{ci$6i|fUeS9e6 z+t-klN~~4k9)pW8p4{6VzPTs<1X}|jiV^`EkDiLTgGQ5bYimCYw(ZdE_OFPO-gKvo z+qWlNf8ra{{{}JrWw-{3Eq1C?>~_&3NxCfiTFvseQhoBTWFc_4_7|y!8|ynZ_C*AC z<>H)J^PGs?SY2-s+?x;jtM^`VA8@Y_f45OwJ<$)C5f!z^@dKpD-rcC!X$HS9@%S9U zU#FECcgR|wWv5q_c~pR59piOW;(l2_LCYPL>#cM9fP{D`xFByq!p6YKd5#fNT z%zVV!c`)l@ZK}5qm$K~?<0OSV_j5oPxs?XTsrBTk6lvx>DLXYYM7{E%dXkq5_cA$F zP&j>?a;v3>a+X0DlZ;S@wMuRi3e@=lPOzRiNMiQIn8}kOq4gHN&TI*e)ys^yb<1|BbQdZ{*@a1Jg) zSf<}4BmMxHLfw=3HVSs@FrQg{7t$){7Wx<&{Up*V0~>pOuI#Ea0!fQ$wcQa5>qE@r zrF;V*)59lPE-r}8SG_;)vp8>yvEdWq_ZRDBP{{{22oh*5qfDN(wX(<#(xqM#OBsE) zVynU&CI@E~`Wcr7x}c@IMp`82=koD}SiTZ-^OWPZcT;D9fw3=}Wl34oj5JKC5xs?bEc-0LFN^|LZ=5F{J9;vEK_r@tqB7 z1TzJPi5D#tsC0c&c|%fIkAT5~E37U&Y%HCZiF-Cj5HS5?f&#udX+hotsmBG+KgufM z@_h8w+{CsMHhp1nYV+6$ed-FA+(7nq zckl%U8uWYI5EDa=hvcLV5)CCla}ry>ilf_)G!*)v-3-0{Af~^=<+0D1BFaq~tlBEY-sp5eRoA_V zCqf|dx*>EriT}#VMt#M+tw7L6GX;;FazNV!wOKb)=vA5?ot0bD^r^Csx5~>+3P9m) zvRKj(_cFAG!`UpRa-aS&`0utkHQOF+1CM{@=Oj$Lq9!OA!pqBO7B(u5LBZI$sAb_G^yC3 zn_Oopp>j4?!WeIrEIXMjx?687m#BogeHJU*iIc`VkE$QomVq!GopF`Wwbo?rNr&y$ zB357fhlYCTvRLt7$q6+e*uN80gw0yZrt9Ue4T!DHR_n#%77ia@p4Vh=$PVST2c9xF z-8!2p1dT&R0 z=M*%h;*8yk6y!T|FD;olAYabES!J8V<;scNyKU!Ljn z|87K~Xe^X`Yf8zGgw?1WfDLPW$c1W!Mk#(uszVeHr1+a_czKqyESX$Ry~;^De6WdW z=!yW&CRkPv=j0QXMG@eaqbDvhHAR%a{EEhJd8qCL9?ZxG|Iqo&9)Fw_A`q)tYoHIf z1pJg}_Rd4y6fXiU8U8__Bv$$CiE4K6$ZWrOE%2V@-u=?WX;{?91o3J=n=fd7YJPOo z!hGIJ$u@=MvUWWd_ptDa15ltgS&CT+b}!~xfIXBYUh7U3tDC>T4e7d8_w_wfZO%PM zgB@YcPCK93v(N=e zB@G%%O|*k<){4=^0pw96m*++xCb_w5NkzoMIv-k!4 z3IIOHoL6B@WofB-C*$uG?$$`*TV2OmtEaMj`ULm~vQn^3yR0(qQ_9&D6`)nhT)Mg< zCOF)CD5X63;^aX!4}L*+=0~`u6V*ftp`t>68nrEfbp; z#bU)f(RMGjCipVw%K`m1v8H5nV4LXH4NO{Xgrl% zKTrDcbWy{kV7cH+ZzxV=M6q)??qFn5({zVGLr)j%2`BdPp)QUR63Ma5y z?jcr-qPD2Jsq=UuVc!NN=PW;>hzaWE7Y9-oM8&JZz8fIqDS_O=E~=fq$ZJ4XhF}KC z>fk`sri87#7!CU+S~k<%w?4Z{FJ6)0q|obzMZtzu=PV?&tnGRRNk~ZkpS)MG zV_n#>`J5>A#>{@U2=*zX^D}ytlm1D&LgWYI+u>Cl^m;D4v@asgldy_yDVSEZ3?A*R zrXv2%R&IV#Exs}}dsoA?Nu9DGS*c(`z z_Dja~!~Ef*(BA7r`T5V1y?0mrN}~pu@VLaX9+3Yyar_QA$8Q)Rn1n#agDcZSwZ z1J3Y3=<4L;*`0EvaqoDq7buy!#uqj|HfABmhAN%R-K1~O$7A;WCiFAxK5j2tYO!r* z4YNd+2ftb_0qpvE&w$!{%}u8yI0EJmoeciPbbR;KfZrz*3if|D?K@`yH<$-x+Q1hn z5A;7&5qt987XzNghy9U(==A~&@b|{?ui!)5%`Ppjd-*>#=CrFsvrK!h_C$h9-tl20lsu_dRL`d!v&TSVqWK#1+b3*V@30kM;J^72hf>$+AqzVG9a zmVY+Em;YUt%_%swH^SyqD)TOHuCKHknrX+ZZj7F7uc<^KhK5cU4((4ddjLb1#I`Mh zY%Zv$ONSJE*$Ku@COWI%g-7KK)Kp}@JBuc*J%48?!dDI z4ozHG3Hl-gsU5HGW=Zuu0gNCc|J<6S9fHqs_iTHLOp-7nD|EE>3D{Xb!J7tX#N)El zDgc@AnI*ka#9I87mE=Pl(4a)JrVez)M(|3cb)n>SPtW+FeoiTTKVyBWasHNU{s9Q+ z+6V2t;{NNy`Hr!OJ+pz{?32)xnl+CEDG25^7~Cez;yRv@oMD%k_L{%i$@2kuIuuLk zjzqizIcaa~sM>6_#K6Jv17`TXqp5Ed#f{6TFDsB7z=@O{Jv!ew|MV#hU+0U0QLb z1a|zyNDk+l?pVMJ3KCy67SLFW^mWA*m<%|S@6!4&ZF+AP%x~Y<>G{?Zo&QL&x8~P_ zJ(Z}&u-Fmc4;#Xr#d}Q+h<%4y;FZ!==+^Y&7*nMRNWrc7;-BvZ$H7djjmqp-i-Bh& zhc%?0L9uI4n|^t*YZiQ`enYuvxl3Yk+wUavFe+||@n2^#7zFJ;CztCCykK(yI zNu81l!f*znl#P#E^y<^Xg|{6R;*X$?8%gRZ?7l#JHad~gEkC#JdKIBBGf;^(cK=M& z9Dd#`f##E^q9%?D4Se*e`(Q9-%L-f=BJm>-=6 z{1^iSk<#;~ZKit%;g^8S=+vjH=(qf1`1+D1vxbk{3?Q!R*`bk!4^6yH=8}7ek6d)G zhmue%R(&D%>bAqEgU`};%Z2ckF+E`?6cOpLStq@(B=m1dw8z`CRSgAE!vOYlIwdwH zVA0sDG4l;{=REl>S1~n|!<3A5kZ{pTM9BWIfw;3L{}-ApIqAxT74GdNa&CBr{0lO{ zzz`kvcXWZB!QD@GeW>?oAe#G8WQ~{(1QMRFllu`v5TsU)k2wnmC+FKlOyKc0NE*q& zi0nE2YO)Yp)VAL9d3^akP#t0L7FrH)Ny#^IEL$9YJL=s^$nP~>hWXOGZ6}G!5JC-H zMqg68v+8h_p;P$?@b+7;W*6pvy1As|*GM-*+T9%^H@F=Cj@`(TZD;iZli4PZ$&Gqk zD}ZV@sKS{2`><6YB~iGfsy$=}pZ(PwBjphk~cj z)syDi+8uX%mTjJA+y(64UT}5*_HWZbx0HxL+B)`SSy|ctZp(F)VGxm3YJuA@$^A5P znMyLaR0eB*eLJbGD!KF%I2KLVAzmZ;leq(|qh65YMLuh}L}>y)YggSswckuBsaF3b zw)JD;Whi96@@4g{nCON8y6VdW)o{Rf;zXO9tfE^RmpM|c?nOipD(Ks!J{iHo;_re& zcr~q*dcL>BCdW`?sQ4mXN$J^JYwHaQk&`f##q$JJ`~_6)OavKSc3IYCQ>f7*lH~hf zl+d_&-;{L>dpAZSp(g_3xAHE1Bi3cCqRIMQkY?b@5fsa&{KaM3Xp_cTZOqY?PSe~1 z7shm=hO`kiseuq}?0>9~^5PO6HRW0FHsR$ip9gQc(L3G1NPk^Jg^U(o{1A$@ znIB2IZe@IovcVnVGpqzT4J$Yo)uzN~DK-Fm$k}6jbJiQj&JT<}KwGsb{3a7f>MK;d z#QeUP*0tGXS*=>7uOVUhkJYi5!s+5{&5Wp_JZKX7l3g&DH|$)VU(ww}g3L^%^s>ZM zkYxD*Zq-p_+cNdUQIK~D!R@~6(yDVPCqdy^#F0iNM~^D=&L7aieul*`G+W6zcfEMo ztLiLDpJF84I*sil&>QdqV#9h}$wDDz)aT^~kQ9?EeN%*A4jh5v)GC5zdVA zbz!dFPjVf3Gzq)hmeVo!F+Y9tWZRPM81wTF@%gDE#Mz=qDt#+d z@aDA-h%T7a@Z7GMQk=`1f3Zm4jc8kZnn2+1!*PAMbb6zc_DD26`vRSwA_~|S(AcPr zXx{S;z$h$gH>9yUZn|PC=f7xvE$(RsbJ;@6%Vut0_|pK2OWvHX?YojiBOHXWd_5WvzXVk-1j(f6z>uyM$U^(i;TEmKWX;ggW zz6^V3%K_r>1#P1z2rsv`vOxPKwp-GxzDsK~oz!?Mt z8Fil{g~n!qJEXPmFEA&wtQU{e;`9w-$P@a*3hQPVM zTor+h-hbp~elAG=kjr$;vw!wC_o+qIa{KPV!cEHJ>onK7!LA)&r6DakT8Dl`s2ZZn zGN~nFq_bnJah&eNB*$p@mwy=99=ORWZk0css#Fmc7&xUS*kkm5rSmurb0cV^-XYeC zM!OKrBZtA{Cllg)PWmywJkppGCpRKs@E0ewH%cJI86C6d^Ej*odBL0`iD(X(m-Yd^ zA&>dL&`llBExKI@Vb8l?jo2fF9z$=fy}X??*my!tqBvMER9d9|(t@%7<7 zznCw-RpO;hRhN5=5v>D+Adttnnby+K7^Znzqc4LltHqAXuY0w@JK2AS?#jP6lv^)) zqh8Nw>yqQ(do8=X$e;EJn!iLvYcGnJ${JbL%V#^JHQiHM={FUxk|ic46^8p9di@SAfg% zS$)FVmGpKQ9L9Mo`!)nHYsI;O14Z#TvlQN~(p_(TA+-E-Tixy%hly{KeOVZYBKJ$@ zVc^mjH~>!Nm2AoA5udJ2cvTS93SH?R)$04ohhPuhdQ}Cla70h|uWMIYdSY}6|X*3hN z4bR~r*YWK}NSB^YFHL(9ZPy#IScF>JSw%w~DU%g7AN`k;7(p(5lU_lJ-F-khy4UX% z^j@EXT*Z7&5+GL1HwWcg6$pvCg4>u9zLz*-bZ@1c$*EY%+DA*RJrpYF6r3j7U}5%c zSu*)|vnqeYD$pIS%T-`PKdZr|f>-=TNY7nEavV<3_KV}X(pw8k@coj(BthzX|0^^V z`W1*3{lz{GXz)OBbZXTWeGMZez~R}K&kC1`RixsbXP=E4vy=M7>lLxZ_{KqpyZ7c| z`Z>jxu$(z<^Qp^9{qqB{hJDr>i(&MaRSoo7MFqz+?!GjUbnv$lzU`2`)V9hKVBU>A zLR~EEDg=S)R~5by_dUUlo{`vu5F0IV9?F8B7Kp_w$AH>9W!74To}Fio63R9ncCs~1 zt||`F;&`23&LWN)zg5kP96cLD$en*Um$_y=6k1fpA-{gl4k+HKUJsamn!@hrVCh>o z^g4dW(ikO|A*Qd>o0Zfe1z8U4FU2&qEo_^+kO@(ZS#e$aH&f{OtvfB06vXQ{6>cZy zli7D|?DqznsWPwjg7j&zSc15YiDHSrXFBWD>2v+wUWYhbg}=t5*U6X3@$s(79Airo zE+bWj#KgNHV)M&4rw?KzWkGS0yOp0X?(xBIXc$%ept9;bij<{z@6LV0%7rXE1iOg9 z@*1QwBZ)YRfMPcm!-_JK0mWAs`T7J5EfKNc*HmF4yOm?Fu+7d5aR7|HHtn656eu$@ zsWZFLiW*MHLNOp4#08A=oaS%n=cU}H60t@LM#zxuht)%ilUl|T8>bV3jS4;&GgW+6 zsF%)(yUutQ=I5EX>)!vHX;fiv3=`Ay_9 z{rbrMg4;zm<*ea_hx))lOqK39SytXFkd4t%>*~d_e4zn_s0|__q-~*#%_q?oN3~uo zhsjwPGs_wJ`YPU2#n93cqouX75O(Y*WK7v5>9^c=U}{i%osY-6VsX5(iquxh+!hR5 zJC~NBxm^m}a^;J+=3CC+zPJ54cU`&K61tcav`+47i;T}bDLM2Ex-qrV{a&Tm zlFZ00-5Vb;Ux>EvhUb4*;UW^17#{lpPLn?&R~5IdlTc2c%xe2zK`+Rlb}+F2#Qv4@ z*WXopc{0k)CQFb#XrIg8ISi*^?GRdiy6@6ZtX2}_#i!KrM%Fx(Q7aq zCGtxAr&VaL?(Avq8t$}@C&u1S+Su%s=8W!P1Qo7b9l{iHdTsp1a69a;IJsAsKZ)U& zCi;AQ=4O|XndHrRhndi`Ik;NS7{acoPN9;pw>=1G zr^d3jRUurtKJ0jI5BL1=2B4=iUOHylB_S8zvuXE^ulZV{=U3qCN_N|WqH3%iQI(%d zqCj7Eqwm&!(WY(W=OU)H?YNB#PS*qKXq&y*8gzQn$PBVj9=kytYe}CE6-jsOD(B6M zweG}|4P2V$gsTaI$LQPZ%w8G=pfB(Zj8}jN(HT47yS9izcrR~1De*K0 zDZBz&U9Sw(DrLz?A-7po4%fuZhP(PkYynKs2h=)J;KfW(_}oVS*QCe>N=~SmAH*6l z^Jpb?pY3|rtZ%pxaLpuFx&NGgfD9nA!)+gD~aKf1p8;MCP?yO)CX06ZC=OkX@t`Ovxx2 zZAPT<`WJ?Uus9lj(MXEzof2OvI@;K4>{8MP<_kth=NU zD;jJWYhh5(fM?Ik=t{PyMSzbTpPaeBi{~0usTfOa zaxJ_prQQ1`7G1oLq4$qHCI79@>2)?YN|B^(vtm3goDd_gQD35qJ%nHRi|AQ!x)Wc+2d@ARGE zzls`&-)99`D6uT7>=n+i4FIa&%6lV~Rja@2wQdU=_}r6YG^uni%R4fSH@<*L|HOP> zL#)^GczT@#x^ak;o^v5*z6&EVC}Rkve`o?%iqmO&{Gr@CdgVN{C_Gc8QtEoZivM)4 zk;8_g5V}g)e?xZsW=m9?`;UJwXIePdqFYazK|6S|g#b-vedhP2jzRb7Q zl4FKKRhzPEI@;(IgO&K(4!c_i5ev`8hG1VgmbC-u8bKRwZNx>J+{I-Kzw@Ws$$_#{ zxiaTvEpXP9jIdxg1o9YW_(cw};+qaUeZ;PJKz4U*n2ZsTLr&a>l);QDu2|J=HH}gT_xRTI&6fc9=@0lHt!O(mmFAu&9C~LU{cB3S8@H z+H#?|sgZpQuYfXg3>ScmdBg&%HPEs#7Wi?2&p+DquRlj(_KvwfJOw2l`N50C04uMA zGmF)cItKU~V3h^8>6*94SOOtxg|E)e@g!XZNLN?s0fuv@s)Y-lOr2kC>$WXB|84kO zv3a%6FH;Ly6Sm~cOjlD7eO$+T0Jbuq)X_oW8hm!7;a4czMz*ra94?`RoZynaKbOI$ zIYk)u2Glryi`TQO2vKrjt*w*9i?k?RV$fD3P+!J5lJ_PW1 zcl!16WZgOT%eI$-bULcV%El(cwjSh4!Cz z6tjOY`MdG{Q!!Lb?tX1}^M;~^aBT!bUYxxft})zD;fS}D2wQuLEQ?9nx7KNy>Q$G2 z+OXdX+cNb}8tdL4uD%V@4}AzwvQ3S#kHF0znb0LHj95|#H?&P8VLrf=>k>?@-g9o= z7)9=TYx})G2;LKaZxO$ z59U?hYTX#+rQY)1gQ7e}7sJVhsU%6@m*<+4X=cc;zNVH~%5GlTZna9k7yxko8lfzh zm1^y1qk4%s#H6RrmtvU|ll9#Wn4^%Td&i+W$$d{+Fb5P%m zmT>POhwtEm?w%RM3}tjrazd5)$5+*t0^K_-r_-6L(&uYG*K|(ogi|Dtxw!dY%cISA zHkG~PP!?Df6Qjk3;z!r^AA5CVy}#y8C)CsNPsffUb`!5dy?)BcI)oKpu)UkWoyml; zQ!lB7<@=&XpHTZ?&}EvB5OuGtocysp^RVE)wS$)8rIKd55B2ULUHg4o$B}d|_X-ke z-6YVF_9QS&Xq)7-U$imCV2CZJ_Gm>(wL^th2T12pg**H6iPp`K2~)T9DJVPfbNJp? zUeyQ&%1L4brog)$=lwI;d&r-H4me3mJR6g%&_8luFTi+Eu97lVue*FWGm&&?bP~%i z5^7|*yb}tk(@(4ES$%Lk-TTp7RZ?BH?>pO^@c}Vo=EpZ(#d8@pSB9wa@{d>2GCi_+ z0eN>_TwOhPHWoBSZqVOD=_GC+FZKT|EVjXan<@_t-7R(8+Puek`gjsFERp+xX3WtA zzo^eannTn1BWT%SA6U#dtRzc=`bHwch&_KzxUs%1*ORf~PhsyrBetM_XxgyxJ4v?0 z4bhhZ;sY-w!aa%;t%i3-idd@3S3l)Kn47wK*lhb1bw{yS+9q?t&$wvJZJkLGoRD(K zWlfE;zy&@@e35SS0^<4r2%?1FR~97^+uM+@>tMyIq@lvKITVZ0pu#M*?6Cd40@c*i zhL1SuEN4RLwj5>19+_y1SWr!Ilh&Fr%}getFO+=TV!&JSFA3*N?G%fJGgZX@x(`k_ z3WO`2A&y5KK0Z|KtncdLGODIuNhBNJ_(LSOkR^F z1W2&c8`?O#zXBD;I&%WQMJhqh-`1U93am~O zUi9yfg+56>Ytn3*?utM@Kq~%eCnz^jIIvKaC8sdFWT^Gm!jqIuwLSmrXGbfsgZN( zrBAS7;TVm2m7k?W!SyXC0FmuwM(OgMU0vl$o7>Nc70x4-;B^rMFp{%L{|Fqz)@#4Z z{0@<23{9<%f7~R^d|xvbg_SuJ9&rp^xesNK*5}$N9sA|_AAZ(vhbh*N`Uuf<_VwWK zy|kVcw+_$2Z71aPj_bQV+ZPOtR$@1qIFk#q>zcIVu6973QMo_UgN+i{+J*S1hYjB9w{h4pJP}+S_80~T; z#o<|-M`?Vxj(*GLR*=??PAYEF^iRk2cdLs*i2V!wMLkvctxQ;OL_&84$}-}5{JJg2 z^Q{W%J*p}DiME%|)9XsPV|M9vtOu$sQ-?w!L*~s!SyrQdGvE%V#gh7R-$K=Q{evNg z0C{iAu5XUOCzTfz)^ZRv;o%D+E5z}=Ed_NVUwnpem1`wmfOkdU`iCnm#g%+;snLu` zxW#x+@m`frTf~z#F#iTYX*irMfsN=8!7>-)p^fsjJslCm(L4GU5R@{x0<@DmzeRIq zQ6}w=LtzgApGO<-c5P(7J;RT$%eBQS+Q}B|UxYt=={QWPG|-(Z-pW+>X@*JM67uZC zUa{_?^b|M_e$lA;IDWtX?+g$4QV^w{^g3R~!KZJ^h}eKM##aZTtM=JI+ud;~_}HnP z)qvD++XVqhi8G*KoEQ|^b40bSDDZrFT>7EQ%zRyfDE#%R_6;GqVdph3j!z+xZ)Ei_ z=32RPykg74CR)OPMN_YOb28$@4VHL0%)|PV)eZ-^jSqSF<`yR${HZ83{a6Gup^!cQ zGl3f|Ur8RBh&_sXz=?5`F5%A#%*-J}vM8BPtJhx6hd-*&3NRt-)NM799%OB*>+x&U z*y0iOVoSz4oIs6Y6`TP218QqOtc~%gv*qkqN%+J=NUzh}66c5dr`7s?he7jUxjuu@ z#vS}@Pby?zqi6ob zs<&IL{Eea+#kkn4cdqg#%W=pXiT|d*_-$p|#!Uj=@Z>M_Qf8Aup`2Oj&21Sxdha+8rJ}Y1-qCVPzgbpU2@B5WPc=Q@3d@B|m#&0RVlu z>QRAM@}%$P@>6y-4mU2YaP3;aOBln;j)a{()c5ihWazXs4lTinN=sUB5eb6zHa%{e z%{)ppVWYzC@c;+it>dgXH7!fF%r|JUa#}hiFY$T!DTkRXrSgshTd#J-qPc`I8!EJp z+0(B!#-i8~yLm_GKc72N{2#3hh$(MsqtNipDDTY2$@|uV)AL1l%`Klu3l+NS6zaFH zTY$#HM<&B=KkLXZmTK8Zsp-xwP;!E=KBImri(XzEaRw>?^3-I=xDkHbgO%}e zFJ7bS*5il=&8z!=RM6!{LZto_^(>xCxq8>MBa6zpCM!dlIpSF0kQM)&czZ?6fc^?B zuVHP6_8Ckg(ARfSh$iKpm`2rwcIkt}87yd7`+RZTMiY4adX%5^BBstOl~IQ&w^wHEcPp9|%~10oC9^G9aLAuP1S zdJ5UkyymBB!D4+ev$-lN31=!aZoFz|AF*1fjVbUm)ET*}A)2yEc+Bt_)A>br2;&u$ zYD)V2*3fi&?z}@p>^W78P-cETy4X|3(lb25>^?8_(>wC@ZyUv!@H2B}mz43C%4$lU z!+lqh>2jGO)c`+;7rP8yOq(CM)kIvsFj^?Sw2n(JE4Je~0k|`j_D4_{|0%AK`WIKQ zYKrgaGrK>z@O#ACDXdVTWp_ZE2k@mbX#KSF4pw9h|o-Go0p($72`j`mb2UB1HH(EUbs8mOapfPWN2bB~$ddf*w)zu>B% zQ=+C)0zZGtl!rsjV4g3u3s5bYyW<<-gC=Sf&u`nwC$zLc>iBBwcIq{~Z-_@Z{37nD zoAp=;vau7oa>1=lIq=CXErxeKmyY24{rzS6aoReYT!18+k4cL|df)Lp zn^C;k>xud)k#&n=Lv>$&@!YELbn;0oJjaopOI#79D3&ExYRL@^ww(WPoZFov{QbZH zoe@cs?!HIxZ};R<)#UXv(9&}sW&}agl2k^_5hr$@BP8tQh1{V*yT`?5%FF4=UUIcU zL&d!TsJ7uB9Hp5IGGp(IC&PIPI+i!OH_cGFRwzTy9}^vHeD()B>js!6&w#b}Fi$NW zAh#@G9^aRE&seic3cSqq0W0P5%iFt?cEqE2eVNC#Vxd>p4tmJLP`v@q-n)C`=KKJ= z@C@v1v&ZEI->IsM6}8UVj)|<1l9QD_8I?Iu%{*yIeH?{p(6jX9aW#W_v5zm)@p(J7 zJ2HgWiIkCf(c3>|@G4h~#G8K-$^+c(%i_k+RU0q1u<&Z4y~a%UwQP<}S%>rqv!ukm z5I-v695N+C>;7?T`QhmUD^Q%N`?^(HC7%fl?*r{c!# z;!@67{kh8guK>CUufz-bRbwt~1pq`ZkQOWxORzT%S7P^6UM=*!OM)jDMKxM=u1OJ#Sv4-qF=~s^)B0TSTDzXB;UpE z@yN#N^d+RK32X6h%f;x)hKpn??|p3bvxe~&-QWml+Srd0Z?Sr&G^GyWc_Z&aOzxY+ zCGy1sw{o0Lic)YBxRzh(vIwm6zYV%dUuW zyau|WAmYis1Ti+G2lC?(@1%6LQ^Hx(=Ggs2u|UoYXQ+CHk9v%MW|EHZ*hC`cW z!gx+TGxk6>Ra8DOY5G&X0oJtQ=*m%6sIsbMc8GGsHo=ETE0ybba4|O0R>Mx!8~Oq=oc(zxxiV9Xct-u=s0*oTYGk2#N>h8D&}H(TN>hPsWSNmy zKEtAvzqZc)V&l-4e+E-`O_frQ0P<{sDr;02h5z5|P_NJ{IVT%C;8>hh^wWgv10{6@W}EI;55lsoi{-8Ko(%Gyg= z{^syWWiCliirFq>$T>9KGxDnaxltg|_f=kodXJwg@JKM`KqD{>#k|g$!uzt{@#Zam z3`k>pdSmSi?TTsTqt|u*F3#%S<)XAn?bf$h;tuSh8A(`?E1JFf0=r(er`}N&&~vdC zpI)~W=^*W~)4k~}E;~@x;Zu!-uMZq1YL(z9)#d3%dkufV9o#XLrj`fB;RZ4M2tUO> zO^c&wzSBI_rB9WWD~&@3;|q6&=+befzPV^03$O4jA3tC=#Texkl)$`RF1nFP4N>p} zJGHox92XCF_xndx@i#B+@JG*uq%q3x2F$x)J=YRcR^g07pB=m?g#9x5bJ78C1%WqN zQ~1Rk^*M{;NNIB_VZix>s+u!oEvCtT?!sKgVMzyhm{SJ*= zXjav&RIdnw!K%)YWM*3FC?8WKDWlYq%s>mKmiT^qA)2A39~0=xKU9gHFek&`1wL|Z zqq9#ddK0fRZ700#>R0M2;+0c(kXt)!nclUH#n{e}6xzcbU^dXZ%(`p-(CBM?g0%?l z1<6qp`=!2Jxu4PAzi>7v*Sny;61Ln17WdVId`UWN>VRLSf|KE19#k%@8qN&Ww~A|3 z9e+;z)5^3?Z~B6v1|@N%{Mn4w4fB{HSmS*N1s#+?rQ(3UAuhSgA4>k)96xN__=t^i zK&d)4P{tJLonwf>?ts`GUXs*k2rIBFLha`u#ZlUo^0s_tNgce_q~B52@x!gqtP-i| zXu?#P686r~aOeuZZE!qYt=F#6g6)*ymVRb_Ud9@v+atC92hE$EP$=jzcMi6~%UT~$ zFAI6DK0JHb)v{q@crA1>de|l3iVDRBo6MGazoUbI9ae@XQU+^2x&|9W)pwM0PF#m; z5RVO=?eHvr9b0Ef%{HtWPVlFie=?{Q!g1EG;T**Sz->Hut1Kx(9BM`d-~4e21wR6~ z=#?2drySMFetg)mMJ6B&{=^leq%#557neQ{(Oo6vS z9B^*26I-BZm=@jnO7ltCl^*6BMwU` zd2eJ$^?0K}&aOa2QzGo(Wbzzs-yKp&>ry(-OUn@z678iLJx!j-uY+Ca(1B-=TJ?vf13WGSqAt zEnY6(5=*?D*+>2j5@roFHCuhf&I?FrFKVZyr#DTxy1Fj)RUvb~E*R#!LAyqt!9%0Z z`XF6+o)O-IVG7^JCKCmnJ^_WA8VXE*q^E<1y~6^DAVsQ~)&re9vOKd=3G+aOE0&-l z93ZeN^uwb|PxEsYk(I^3Iq~I4YN*HGwcqZw62(2@?N6TRG9=Y0pvDx(&yc zHA?zgACv>NF>a3UqSyc;u}?rSZy`5SFl)}E*nx}MV3~n)z!SLUPrMUr2MRtAi_h+= z>jysvhn6R=67EnItT%2>vh)nfEW8P#rf?sxTNsS=;c}IresKJ^99- z(k)#w3^`*2zN!?cJx6?knfoYE$+!(r67iNFz_%vi7CyOq005a;Qeuc}TvqgmccQkc zPl1<2qUwn$d5;e@>yI!=Xk;dO zC=isF&M$0A%r8ENg|2JLjd^yw&<=8VZ53P~^CG0=sZZx2E@Zs;h8qLJJX&`Rc~HHA z&2AK5&(iKDnrG0Oie_*o%re5kmx9b(Up4gJo09V8ih*vxo{_^Zss`%d2cI`M3%b@X zKX^@}mcFzSE}b4UOAWUu`3B!hpWP=UeZA{8c3C*|(T7_t=K^fvxV(WVprN*0;lZgK z`rx`~OBqIi8TvgNf@eUM&*P{)&F)F{_4xaU)s`A%aBzM+K|9p;!-sX&`fK`yK*#?6 z511ks_8W)S{~+-CGnv#Zy5STPuQvJUZQ4V^h+cWQr)~Dl`;hLQcX*?!c*kbbwjzjG z1~O6IIa+ET_t&7?)eY+T#hcg4bZo#UHa*@S!OM`ltF z0n3U+?$o+;W?qaSDJ1Pa_vhm>hD^ub-`{!lTTtO1`S*Y4-~fQ=v%m9c0KiFGZbprJ z-0}F|Z?Gz8GJ!ZJ2L;VAR!eQ`|SVLwD&W#wz6RWW{i)hUHLxy2IRNL09B#Y z3*0y%j$|4Eb+eWbQunL{>2=ah8E)|_gtZZoqBwCPu4`eSnYd(t$d=9e&6M&yFRrQF zq#$5}BS5Jh+Z_z3K**Ra%o{b3Oe9ntrtsXpVPNO#?8 zz7Ajv-z;l3!Ae1cF;-mJW7mcK+MJ{!B14xp{*3A%{WD5G_2#@mq`-hLKOcD41C!Xo zMtJ!j$GQU!t~ikwLeT!IBj-s<5;^6S}0a`!D~o z#r#$|Ll|u41TWn@c0nwH@|fkpgnar!nFv|b{5^r|aed_J+jp1i!bqEmd}ek?eW4Th zV2MndqQ+XG=S_#dJbNRARasxnJf1XPRB7aWRH>EmBdjyi4P=kZr@icCwUvr3WXo-L z%_gMftQ~Z^5sg*u@y_P>>*ZP-fuq>X#OymkTwvYEUik2F2O7x5osfu}CA>@S>Otb< zl3ki~!n&h|QE+GN4(8eF_~-ETftOv+dP^;=$wQlAvo z1ZDU*PAr79o=s%b_w!-?4Wev@s{feiH>wHsyVPKWJ8@l0PLF^mV!X2f=N?Zi7W4J5 zJe(v9vUfA*ZYl>cXFCpR*akQzjYtSoqntr-#=Ce@JBYw|0*d^-h?O*TA<5H+za$vX zGS-E}@LmAQ9}PK}qH$5OYp`)>9eUuT>8ztO*T1^sSg}RPA&!|FGxhL&>v3b;oYBTNbr@+4|Cr?# zKqzYrABK!*fU1(-ru)4kKNE?@l8(M&9A-;oRfm zS8l1n?>71_uO0mTkM3(QqWtZDIY5}e9lihlTwWC}i!D-_Td((0d+STjfk@}#`{hEz z?!U$sve$Vuib2s-(A5hUB1oD?c#Y)`D4j7MIkYtx9y~3WVgy*|%x*SXXQ_n^&+3>l z&I4}4Hug*Jq24$YSJPuh)hr8wxgiEn<^l@h!vRE(n_n0%n&JDudFV9GZiZ0RVsKbZXZ->nC!>uG@x^onjNp^L&MB z{c9%bVkBuM!(U?G(SA`NR!8s-cm2CzGRj*1vePJi;STOvyly$XA9&*`kH`5D&dfQ& z<8;^J#Pi%2KjKAP(=%7DKZU%}9JWJ2GTV!L~dJ^xCaa==V=d_ye(6a&K@+g_&x~SW0TH( zsIMZsw}MvKYJ^!a&X}pUI+t-xczO*!tDGYW%4=NZVQTSEhcITw z=zyeu`lCOf>~}Y_h+;hk4T$Nqu0nfJW>0{X)biaLF1jaeH+K0eYpRmfR_ujTwYpF@ z{f#3P9#c#p4P9u@{F-Z8KjpGHAC2koW_1TeduC4#n0BzlB!+(0GiV~P)F^`1q=D*` z`0_0KqPj=fz}cV)u=xX*swHL^lftNoJJSE_vW#BHv_sva4;U+>415`=;k?U1AM}|p zM#0kQCyEN8-xn? z36kIKQ*nhItX6fHRxYd(MyUnZ3xNRqJ%Y^`)Z9WWW&0TJ$nRCd_EMz1eNGzx^@0C+ z=J^nRdvH;^zNNkDiOKh4Ipv<2r}0#(M7N;*Fx10U*ZaXTDU2qzL?U6-BHbK*s=H(QADoYfpp6mzU~M;Sb2 z`>4sPv%Z561da+YulX~|!2bvc6zSX>_$2k_B<@(HJnoJi@TFB{?b>FijBLCkw$JH4 z5pvvqitZp`?^`qxNZL72aYsC*?@z4gM)NQ9;vc20nAk_yDc_Xp^9aG+M2)@k;rr6%@Ha_sV z+B(ZW?%(M3{{W}|6TMoLay@VTzR5U=_s-Ol&MW5f!)NfS)>l@RHwR~L-tIG!{h!#C z`yN%Mf~^ktr9jwf43Y=Xk;sP&lgg>=vC;VyQ1)Q1^1-j4E5!t7-^uCI|I_PpqXoHGM&Ap+-dFB-4cl*AJ;v#;depml1{`~Knf`bM;ESene5J6;-b%yQs zL;jKo+fLPBt|jkV(!yF|Vxej_BG7HLhG5C@q6)s%V$SM!i9gf1Eg!`X8)|Cq)dimr z$hKE8kq9*_^6O$Z=3``~*0gUnRQ7nJKBEEjds39|?$tS6*y5St%Km_SjP1WC^3rwb z^j=NYo1Gv=JrSE!V*hhbA#g=eVxgcHmq}U3-a|$VgNflL^WMgF0g+dn|3ezM39>4j z-Q$vVdN@k&rNEdPx07`q{kmb>IjElbd6@Aq*R;R>ZQ9e@jY`kq)8F5A_VgsiI$d?I z8e^=E?raY}S72mkZY7Oy_0?!a=&m2^i0`5QP&2MO8A?^Fl^E<*5GzyhCX;@@V{rmw zg4*?oYfsF5LbFInteCvKJkm3*x@SfI41Q00Pdf>lXUV*)XkL{cYyT$2aBz_ zdkUNC7OL%(ydEhqZ?l(BPg|&YW=)$Vsp%dp+zK`iv!&5v@iSjnOKbK4LAIpUxg0sJ zGD?K?eELg<#T_wEdb|$3L1P2V5Rsmv6__!if@T}t#FWwSLLdCJEM?uldf>=Jen)Po zVbZ>=oqO)1vRh4^{jv@kdM)pp43O>kJk^l|bA)F#?2M0fe=&6ZnEr>yX)Kx>|jqqBQs_m)GMeFz0MehXRp78#=si%MQO3`jV4fs-pH`2U>GpDap<9s1N z%bts{oD^w-2{WWd6CKV_nC8}WGNq&JeAuM2GM-}@73Z+Tuf_59{a|&jTz>?Z>OV5K(z?-+=)zifB?FGy^=#2x z<>e;p9$8-q_rUt#83G!Ixqzv%Q<4^a)Y8}Z%+wLubia7>-ZuR^H`gxgXMFLBQ}~wa zbngDH`*dHv-rIqJf$#3QVQ05Cr;@IG`}PfXjlUQ&(fn540eeq-Yg$M{x-sUsNM`Ny zE1@7p_7%Sys|yYCZ!^e?E-v~mZbZMg)@-stN2}}9WeOG+Cr}L)N+bd@DbS_c1Aq9yNTEXO2OfVJ;7vVHlM&W~FWH^?QYX!!j)aPRjQkO)ur zt8m}J+P50|8v!HG#QP6gzSj%lM8{ZyO}_i(Z&!MDS5S+uyn@y;|8jEQE#~RCf0i>w zb{qFoYAfh*`V!G|YriD?+*qv_Vw%JvsMFNQPC~)!rxbnmeS}BY`^|f_)=-t~b%|i* zcRCD1cOCqe)7i?n?(D$QCKF0FTkXl0+P4mFEsTw*otZsKGK1K8?ya4?R<9j%*XRmn z7v?-YNrd?+Gx1R<%so?n$j(FRBgoa)%%H zi%*|e#P#y4&zI?Ea}dDe`ni=KewX%4oNZU;R4wAAxjw_;iUhgvLb6kUBTHFJ^Wy!& zqNHfOm`vq`2Ly!{U6abd4dvqE_zPVlL&Jq;G(Q9@hCJM6Q`v!X^vz*M$}b{as4}y{ z?}CC8&*u6jI0jv^b{>Fx{_qZ{8?mpkZ#FW~Ky6LGqM|{> z7j!JwhqL>pttW;^))AGgBvg|W6WGoxiD;U z?r?~OS8?HGhT0STrjO;%hGb2tgRiq0Ch>A$Wa0IF#KdQ`8Infy<{9XO`mlf+X_GZp zoti5~T3YKogip1y=JP6`%6s5kn~xuQk^?8^?k)r&$_BRI3{Sz?=40FLsr%0z2!0Ee zLdvtnj8sJXMSh8;=yANpT8`SDob5u&St*O+KWC=XKx1DVwDRs9zGhX{9hN{f1XCR6 z(|xMDxGxxuZYxUwrqA^4Ic3(=i_tZ$8uX7 zO}V|i+@fjw{KQH^bK>y(=dQN(&t6c7LgQgTProt@O2%N;ax~)FlqkpFSGq7Kr;3hh z{*qB`rm^=+bFrJaD`=*)W)1i75UFM2m1lDd7Ur~N`uRY?T>U!d#;4Y1-j#QOAo!U} zbsL~Tkw^@xHOwe?GR5gqGnZZ7mY}yVp7s1Ujc}_7R!I}+ zvM3nCxntUiQP38Mu*^@}&yxPr>gl*yMsj#TzxynG$*9+~Jw|oDk)7y@8o?_EyDsv6 zlCukt96S~+YLSs3H-!I^k*qOk3K9a{jAMOT$9q&_OtBNY+KxX2kJP7?!E|63 z9`aYHwwadUTXQE{o*rxoT<)VS6|8(C4lC8kkw3l+4=*^Ijw~j-?OGjo3IQfhX75sn*!3)0H&*cV&@@rPVYCRx~h|x#rTYfqNvmFoSe-Kjlh z2``WnA?XS0-~2{Q4g$FLbgq$ewDo<4}pN+WIc;o|>u_EsbU^ z6V-Xc1s``RAvR|9+# zmTm##7?Z?Dm{WtharFcSe8SBUz%-EPm8p)e2~e26es2d~u3~xL8I<3w+AF9RSp&6c zc4%VS%@7N*o;HTpf*!r#9WQz5=vYdK82=bG6A(xY3?TTF-I5pmm;!fSSZcghzf*8p znB&*HgjH~o;i(-$86%$gpe}HbEgr3bK!?fbPf780!L1fre^jIbfrDd=j})UEOKQ() zVMs3OrJGO9@oT0F6*Q{3=6xCIl=;c+`?lxDi>3~lXYKAu35QRfV1}@s4Gc4}N~!qG zya4-bj{2htN|yw;@bPsjj1psrs!;P2HnbuTe=)wv%B40_u=w5WpF_F!C2!7NQ{Km* z%D-1W!N*(Pu|u_XPJA7dwpIoq*wnDkznnrOJG{&bm!1FVfkz;ukU);X%^; zX54C62cljU4!0;Xs~?i7Ou9NlRHZ>u@OQzgnW~UXVRxgwnUhONmK#ls6kd^vM2CF| zZ;;nP$Ykc8s{cXa5^dH9p0)M7OX7oy2WfEN%nmNb-FW!0&u!(qp$R)v@gX+ti=#6l z+Cn8SIENeL41X=@To_05t&j1Kz7g|~?HOpW>+Ktmz6SoV7_BYsg2qGNp3R*7+Niib zh>>n=t)@iE*am?k=6T1k6E-SKI*aB9AO4M_Gfu!8gZCN&p0RQ_otVK(Fi2|7E3g!& zIZZyb9oxlx#I7I2f7+H9v%P)Ajv*TYl>U0e2~y!WVis`D5LgM_3lMY8$*NrP5n7&q zw@-C-aeii#O>-gH>IoQ}Ap7Xzs?Qb2peK4B(H|qs6nonp!Zn<5(W?=z&og_3e z)LJkuq#H3d^r7xC5JDD^jo0QD!3sQ1UPIu9T5FL)l*{BdW9N>jNn^c{TN43M#onUc z>U{%IvH0P{($cV{&cVQK_(6tg`O^{Q-cnCFl)`!_?a*WluM&>lVXMY5<~-|8z`8CS zNma}5zE_pTbDmbhzC%#P%k5517+eY0GB~#%>M$7VRPxryb|JpM2v&Ejl%oXGg@jfAI?La@d5oaI zsH|v^&>4XKNVyIjSJA)na-x*5Usubc?nYbK%FZFxKEcV01y)xfcXANZxV)G#ol$;P6wLkPrr+p&X8GH`Kd_>GLUfJvc$rX0rtBS3ghen z^W2uuVtKK2X}1233k!6muvkhRrB+v{R-~u2is4NSriuH|9{clz#hbNs6D!-cWo!3c z5z7$>`qE*c_2f=Fh=dShaFO;Tq^ig>zG|g~R@rOr7K^W%kP-ZaVzbXwy>2Pef%;lq zpL9zq`=v2qm&{B&Oj^5E{O6URvHOL`)+-vJ){~73?<#+E67BkJ=O@v?lJt1(3WkE{ z9mUB*Kl~<4sNKQLh4gw!R^puoP0M|?k1c4gQiBdt32+yA;P0E9nTgQK9e`r^nR zUwp(!9usgAul4Z=#Y@-BEy%z15psllvb%rj^p?Ma@z-(Ee4KbfrTs08=<61TjNb90 zA9#vIjGacX-r9ys|4b`6U2>u*MB{n@xUyuDF(6A-CuCV~dG~i~BQUMUszijs1P##M z8lx~41}9>+ zcc~eLIRuD`*GrG%g8QPJ25w-sA9NBcLOp*Y@H}y}?DU)^ z)$)TDlQ_J-awk9tJe$2~No`WikA+55Z-lovRHUH|9SI)y<5)T))O{`U35c_F5?2VC z;J}8~tM@P}ge)Of>Q7}SffM1C@LzsonDkk~9S5%J37!04JORs+j|d{S(CNJ4ivn)r z-HKhAxMaHpR-qbpAmK>9v)*jYQ zv!|*=s5PWF*4a#D$(~2-f`!#d3#bn5p|{^g??e^(#8{%3H(9N#09XrO;2S(;?YdW> zzi9jG5Y;bOZKOIiL`+gcV6x=Adsz%4sCMMT{p0KNAxk$S3 zruj2sA@(8U+h9Fp^C3m&GwhTHLPkYPD#Uz&yJ?C?rWR@7<8Hdbavr~s%(>$MGG=H& zr)IMfOP5wq-;{TjYnpYgpdm$578>MBND|p(kX0*@iQJm%k@1acqUZzsKvwd>i2=s1 zj^YzJI~((<6LS5dD?*FsP5!MIbANXpfBr{s&2(?HxcUCzZA86V;|U!he^vT#gn}irrrRi=({Do5?I1Vz96I? zP(u99?Y#O3{$-V^!c(HbIPx%#>8*x9-iR!U`d8ulQMrFg%gbDr{GY0G4n?+qPSG#2 zFOxw)1pXS~dHio9^VqYqQwULBFnlKG>s&YVBpaf{6ort$|$%$aA;f;iZT!FlP( z2l+K*f>msv*qyoiz>^5S#ea%KK=HpX9PT^wpYpIgdv3yX^8dNi8DpQnb;nel6k4&tHi{MjlQw2HBxdV-rk(=G(t^|E1sG4&D5;^VrdGDKR}Y zwNbAL#u#5ekXQBJ4S!@!CG5N&=_Tds<%T|`ajW(RKMcn$D6V)xd$yk=&FiPKg)Zwt zgii}5>3Cmw!6Tgx5RLzjjMym&fVvt_6mD;2H-lIbr7!`&d5xWYix1ZARfD5Yy~XUZ ze%v{(?UuKcafciM2{AHBpuyGOd)~Rnzh?_@vF<4T&gqyWs3p7O7-Oi~^3kKbQuAVL zn>U6st6gPN`+&Rqx8`@v0ifhWzG{U4cdwX_vF~evsZ{u9`2b;1T85L&r`q1!dWx}r zaBq`ma2&EK-bQr=D(*&}VoiJJ-wU34u`_?7-!*ou{UL3_&@1;Gdt8)}zC-%+Q1AAfXAD%tyWyd@x4B$n$S>PS3PI@#v%`eyXc0%Xm2-8>U_^I?;#03)C&sKbU$J;((YBmPajM=PwQ%JZ80sOBK&Z2$do?Fh#*GRTh5_>R=sX_D^O{p?kzdw$m`Uxl~mAYqhmGs?HDb- zo{_2u%+!D_mJFKcP2=?iX2-g4SVrtg={3|eRMNlsm5IW@aXhm1JBo?jTxoTe1#hUx1s)84&?D+jF?fDbd=h6I z?gX)eOy6d5wD)z;(Zoi(%-q^mhhM_7J+UIAu69D+7{*q!W3M-z~okTKd?uemh@3T>;|JB}m zhBcLTecz0V*Z`G5l&Yd2AfVC&1T3TU-lRrFYUq&AK?GDpK%_|^AiWcMq+>-&LJ1IR zLJutj2oNBIJR4@lYv!8gy5IYLKfUj9-1`#=Ig(w@z0Y&4_5c4?#F$}AhpgdP%lex) zYUqFz9VI1f6jxvMZ)EhH4D0Do@`%SNuUoEBPjdM9Qd|utHiRBV6?acjMC1h>7(UV5 z4+bsow45`7>ICu-%^sNg$wNa=@0QG%FAb(hGIv^L?f9~m<}tH*gYfHl&P&O*1a8^8 zE@$C`>F?+_heS|9rIXo(Y2?dke4?+8#iz;NmAQ1LoJHwG^5y)7Z6SUy&8t_3IXOw# zdKlKuSK1Ed@nlf}s~YEpUBily)f35ltq%J4xai8boKJ1KCkQ9(+> zu#=%Tyx#=&4l}HkRq!QAuluF4(GR9%NiKmAfy3q%EIg*;10s&nq8ei68}jQ(QK+vMqOlYao4pJeVg+*1bnr>~HBczN| zi=~+R*OK_g;qJt?X6^BV+xFheBP}-w%J#AXMTZUgP7_~U9?ZQ$kSbw~vvMO?$M=@X z@ANxfUukjZ-*{d199JzOZ?sEiI!bUy)0x;Z2?_CZg^XdA-Z(1NdG|ZVl;e@gj*7I1 zW`fYJ$D;(new={p3+Y4Jp1XVx>%{_{DjGggoHyD>K^4SZn9+IBMzl}E$An|wHpow3 zY|_XMam4awsx-m_v--K2yhGF4kYmStjX-Gus+%XgN&H)Zeh5B4rcaY+=?$d_i*H_K zC7Z#N)L&fY&4dJpYxeGg2PD!_|CQ&j4GrGrupF(5oHN!6@Bi>oN?3L<`1z3SXIB^N zjdI2WeecneJNG+MMz)(~`Z6A1*r?g=kE_|9fek|ze_dTdWJ>QGZt|`f3>J5+K2xaT zH$M?t17RXmD&!P^xG{p4Sf?T3T@hC3lxvcSX9S`?4{Fa>1`-M}QeW1W7Hgnl&$1>Q z`Z`#NToZw7H>#Q$p*6B@d_su10y^FIs_RVxleW74h;@y#x_FSu4!JrXFGmh)>Sl=C%7>A^1$R)`uo^C>G}AGDX$T7>=k; zsBACX7VH217aE(fI&`!LxZg{k}9tWQR@xx&Uj10E$=3|XueD%xLhrn;gWutk?7{VI+NZ0dFBl! zK@XOU=2}22SCued-0DRYoXt70Vy1Ulu`^YDz|E<%Pg1ix?)KK{Cf2A&5u)wI4Vpbu zLviNH=85WFYdx#)^P7WFc7io|kg4w{=MO=eE9J$pg ztJLBCeY9N0H2sMgelz}j)G?~z9Gxi&wxggycBXIl^b>?625X)&_W83E9Rr^HcH@nN z*Gg^N;U@&MsA+jHx(fy; z&km&4J_Wm*s~5I4MpRinCypSMhw|TV9|6QIGM+t{VEX8=$J@@ToXIna%_4kg?{Bs7Gp_Lv3cui(os_PA&+QE z+B-`7qkvVd&j&Aziryl6rwmC!q_Oj`1>X=oef`l3KZ-n-Y6wF@V`m)%L^bsOT`qLG z)j>e>Rm@iU=sB-M?QW@V*E96V+TpmWckL`gxm$^+&#||^zZrg^qjI2N^_?K;<;|v6 zNXkd|yw`092<#$G;R&vqE@2DMShZ^HPm|MqUE9G`cSS0zc@BJ%s(Hs6@eXO}LATlP zM|{Rhwgwt<^gFCmmeFYrIk3(sC9eq|Ue0_PRmUSWA^<#rMn`4&O4c4;zJ+ja zrAM#7hfxOznRko5vQHyzcMr$Ymrv3yifXzEiv0I4x_v@69zfigWxjwERAl2mNO$w* z5jJqsvkUyz>Z)}h1bcH+;}_$%Maz`HQ-$+SyB8zo&d)q=PDD%E=a)bDM!VnYqa}qs zlEt!w$T&vomiD?X_$9oh8J|jHZC_{@6mb~2E7s-b5qY^09nizv4ffS!OC4B97Lbvm zMx(Ymh57FdS35=2u_BUe52u;f^dChZj0(3I{(R`R;SNjDM3Yz9OgVd^py%?_7o6)? zl3llYf)&sy&%Qo-oFFKY=Q zn6^d{suf@Id*k%wDkZT->EhRhme7D>jZymE`F0^ajkc*^{L7}I2XwaXj~JJ!LK&;8eY5nJ7?ZcQ3mn3sPaR6Nf5ELVTiV*UW7OJjYljhJ zgF0^ojmSpX7kaEO&X3_G2LlaP>A@AnCNnNN3r)(JhGbclYD9HDWNpY${{6xWTFzL` z8HxU@Bh;p;AMfeODU*5xdglOzXTW*f-FAd|Czx}XGw860bEmwPp+zna+v3S~b1v>; z*BgX`Zdk^a_hVF=k!@X7{W`lh^IdVB#1!%MA8oMT`rg&Bl8TYI0+&E?vhU{jO9+*S z1kd;8!z65@hC6)P;)L8ND~wUuGd;lQVZL0PRJjO&F&-7{$ssFy48!ft>3spOv!x~C zWgZq<2j-y-VZ*R?GespQ&1q4@JE_)^=3f6O6<^U(U2FA9e%;J~W7m|X5GffMcKW8a zK_!SgO^o54Tyf&}!IYG8O2>Uuf15EE)7HStH2Rq094F;Hc9o=i+%S;k-D2TfvoOEv z0E=a9f}D5Uux>08B{h$1-l|jfNeg-1AR}nJLeB|JO&2j-UwHo-HU?Eb1JNlUBU9e# z|5^w2habR)4>=*I7@oBU@Lm<;|E}CkStSWnrKx{beoo3FpI8-koA~!YlvgXr5_yKD zLcdQ)7q`hhx0FMnr|0M2piCpA&r5&!UalQZ?LHfA$n6m|6G{})dL-h!NPW$(w=a|% zv->UiKJ{QQ2SZm!U$sqncV5Q9LaUsZ#aOoUsD@rEc$Cz4D|Um7dg_i1CNcojeKK$E zr_Sxe1IEAW+&+}_mgI1ZKXxEe!KQa6U0Q7%QZ;Q~>JHXaEon1qsss6pyDn1yIVKJR z#9n3T`zmGtW%qkdq8Es(hv>QU+qsO-UOfI?riV)Ysj#+taO6Y!-%rTDN9I-sT++gA z3qAT-fw=nAzr@)$YYuhk{7hi!hyjwMuKlQ+;p7t_Wddyf^tb#^k`90W28elU3)4j? zcT|x4bRD#V?LTJLuxJZDhWWoG3m6y#fePAhp*Z3Hs0{}M{w{#K4e;okmHL++t~Zb2 zFL@)fd?pxn#Du}#(u)5Q+D|Sj7 zH$1Jl+wgIK=R^=MLkj@K`}OK^UXc?WX+rYx2ET`}>T9Q%Ka~8=g+U4+Msh^WXcvrY z#ausgo&HB`*ZlZ7@q@qh;kM^t_I`Oaj30`Mt~%i@D?mt;uMMsCH^2nd8{(#)*hIv=)sFodQGVfIVVGAczBNHX$h8JQsGOb3n7kTNNC=^1%C#zr3T#IdU~H(O{|F=Z}v zdRDdE;{Z=ly6O4IqO3vB@kK$1X%o3`4mR%VwP7yL@ys+WSA((1*eFqTsNDVa4avL5 z;Uw&22<>nO+N(UTi3*QE9shwc3Ivhlw_bSc$`cjo^7esaZ3!Alj~fwYR1y3R!{HCz z^F7%StE;O8C-x2bN$U%z(>cW2NH1696r0q|1Ou-;Fx zansl{kU7LSv{G&_6rK!dlFeqTGzP@+JH|v{G0n6wu12_Y%PW#AM}1$EuDgOTDOJW9 z)?NR<3fdXIY^8SMa>Cj+93B-G`#>6FjeV6=FUP|R!#C=&G-oQll~@DI5vmpN)k-M| zpJBSj5NUdC6V~zpkTwI_ZOzo9^<2`9T|^|l#0wvQMKgAt{guN>XNcn1A&Fw8&AjUC zZ#$GMW&xFYvYVc48}3Uz?Y+tPdGrEJ~Y}e#9!@nIzj0pLL$SIT$9% z<{epxXf*X8pf7J8h;03%_A)~kXY)>5I_ZR4lvXc^J6cbUJ3~Ani2N?q;H-&Rw|9

lpYe6KI-{@F<2^VS@YY9zx+A2m~A8A1ANJ7XcNLqZJeXwPF(dmaZ3 zcSJ5kTjijXMA$+>-kj891N-?gCNvT3V2J^H&LJxMYJ8y(nDeVTE!U8ohFKZpRb5#njagM&4-BQ$CX*E4iL-ZF8doi%5Ea2CuyKbXP{<-V;y#)JoCm;HWY zQb!u>%F*(qdb_dpq_O0ita&ol_f3=QR2cn;o=!YOG8em`4$ErtVfil~6lxzA&Y8EF z!Q^f#$Ks=<_|V3sIoMt_3|)|7og?&g;i_hqqnPoeI8V8EGq;Mw0l`E!E}OmR)P> z?D51mVEvv~QLCh8LNNb|>o&Qz%Jn_m!M{Vc!(jRniIMa6mA)MFj2z^kaPK{ROFi8h z_#s%q?{v^A{}o3~&i5H8ibeKuXSBZCJ^yO64a^kt0+{=uIuv2>crFpzrrS=)e9=+$ zmBi!+WjyJC_6l^+D$Rv5yi%TZDmfh8wfv4r3T!gLEbDJQL|cV(%H|~wd(NiZnXK}* zO+x-KFC=s%S4o0cttoB^lZ(Wyd9(rb@3E1;PuNL{1;qCoz7qza^D5g{|&31&}gDu;{DiBTlLij#w;tBo?C%gJkN zsC#P?7)P`Z`rZOc)V>}U>f-AdlVdUMFRmeBPOp2E+y@)_wlv9+|7gpASpt!mRQ%G& z4}ZPF@o9;K-k8)kNHXQ}El_rt=?z)=?OOg^LjLSqi!(boi(zA>xm|q=o}JWBj~(c6 zD_fYsVQ0-l=N+Fn)FqSZ=ailqaWe?-oeI-+?0^ve+NS_kVez^3(CqE{Z(+5BB;?x0 zi)@(p%wg1aU&WA9BBy#kpFuwY)JK*{EB*|S(>|e+`>2iVrizn#w17EycUPIbj2VAo z6*lfN*ZPKtS01gL3)0@x_8B^Q9c~f;tmdJ@yp%O&M4VWn!>oyQ+i-O|ykw1RY?&uZ zU;nVN5qQ_daUc(ylO{;R_~F?9_a+R+ zhZZ=I1s@zqC*33Q;!L55~|PyZCK)azr46=;VUO^R-q=| zt1r@kB~}g|?bIq|#xeHOa0+X%1ci6mO-;UqXXw|fU6z+l!RoQoo|;)QHs>#OP-F)% zzRP-t8S-9r4Zq1=JDWQ!hR?Fc#7Z%08b(L>iWEa$>zQWdAWZ{K(%_(@3VGT=I$3YPaBE_UQ`J)Lor5VgjA3p_&OGs) zmxNA5YKN9jNB!r!a(PFAL+Viz_NaIS44zf-6zzP2?N-9}1ecH+(LLk^6q<9~vUh^D zeC@|UnJc4Pw~)6QkS|jCj_2{bv@GB?ta`A!a*4LurlqDZxaDlFc=sMWV4xJWRf%-1 zhCHvhHGK%~UM`V3QOsK<0U|5SW`#FN;zdZ1mN&dv<%U~;ptAu-L2sqPgVF1rbFi3Uw@=a39$)ck zY?G})d9s<8D0c~P%0)}xb5Hh8V45U%OYj(6hCb=5@vudP6h8j);(iDsD4E|G^s5bD zVb+hMxmwqXR>_Gy`fNe+s>Hycio^8E=m%O9*fEZVH1YMDX10~f)d{n4X9Ne!)NVeO z-ex`$$WfrHSJ}SfnN^7)o=|Sr*LK?#?IQ%T+47J3A-6JLY;GO7?Sb77AOzdE7$QT2 zqBUv^^w)6ae=c&nrhHu#C5+7kyaOZ?*>B}FBH6)Tr+Y9pmLwE>ceaB|zo;w%a0(~o z3!Aae4i1`|%~~p1C9_@Ds>2RFExck2l&8%Xqeuad8hClV9px6Tqf*3cXD{-2jkwh= ze?DH5t!rnnbCqj};Ircg`*_v(o;F1>qAy@q%}cDu;)|^srr%D@CyH$1f@q<8*WH+K zunI{7Qx9r?w#7F%dl7yW4H8x-qE^e9eP?qg4Hq3LD-n7P(yJNvQdZ`riJu!xvb?uGk!h8owj{ivlx4%=0greAL z58a=4%b)HSlPK_h8dv^f*O-424zYEXU{lS3SJ}v6CKGu)zc;;E^j^zQL8^OPMC@)o znj&i}M(;p|D`Miqa4_cS8bWHs&ICtOss0frs!8CiD9K};5E&ESL_?_HOBCRpI1o|J z(0_NMi8rZfs^P~S0+l-b5~1vTJ#7%1(pe-C-5qeQ_`O4aLS=D-Ric3PHc&q5t9mFmGJPnHUuYV|nuZrM$ zWj~?8?4r_e6Srl)-aSUI)$d%I&l?6^lPYsoD9n7_35qZXsBupb+qD;md-R%TmPojQQB44Y|R|N3_~7>~)`x(lpGec$Gnl!}*y4SJ`^u+ClNq_KdT&`il zr+bXI=L>JZ*ZJm_wt*i*-KjXy5YK3tng7y~Vchnoi*1jp@!_1bONsFEz69ZOwn^AN zsvg)~ag@N?>3wqFhb?<3DtZ4Tp_u;D-b2j4j(j~8|EC*ogtelC-N6XyX#YuCbMcAo zFRp*?U(o)D1JHu!03*U?$-JUs=eY>ua{qc~)6|>DRG^sO#LBelsgF$3>RrzUKKZa=3m~xF6=%m zYLp)I_rgIUvYzMHHYX`9Oef7N+7%qDRN;r)lOP)8nU!vuh<`_i_?kohD3K8yHVJAm z6W7Fi2s%SY1*E*?b_J@=0hA{^{ z^~9n*k0*2*UeF%Gp2|Iq*#iQT)-I>&+`XrCmRUcEJ0{SsW+Ry|W z-8BJGomU-(>OAR385Nj*)+M}qLCas%3NW4xakcGT2%ZiUf3SwK*l z&(a@`FB&+f5j*p=Q|Yt~0LiX-AX{9_Q`~%Xp~B;G9iJ+=U~h9ik=M2tX&?YdC_-*=xKx1j0$xzl4V2sTx`cIOjhjC5zHR29 zX2ee^i?hk0{{hqBr2vmFkAOi`hm__kr&7;*d0v_b4gnPT^cU;X!OKIqL$)5p#e9w- z^Ha?t|%w>Qb zmu&MmD?SPc6y3O1q*B9ED4z@IDV+q5cZGw0q7QuTMd!rzi@k^%y=CAvz!4i8lR zdJ_Vc!9R1ffU$Hx$l*xW-+Wko#+D+u|2#OqmN6%RUEW6JqOPsdgnTm#(A9f`MUpGj zQqpGzh7&bIetYqh$9C_++a&i)ET zm1V#_G>U5CQ>3_?ds}}cx?Gz$5W^1$#G+o;WIyb&#A4(Anm%&5um!pNBtGvGFnS)4xnk8B%o!=3rNqCuQt zY!(RV#~HVLMIIJ<{6P*#{ED6trZSEqF1%g|f^Q_*2g%3NOauM_bZF5sKldm(-^i|f zzQ1%3@|}=>O-E!J!6kC=K-CX7DUTd(w*)6v$HE?)vK;9lyk)7zQ5;@rd}|k+WOUW7 zlUyxz!&vyo9H}EZ-g;#k%%e$I^7(4exrhPE4$ImL5EA@>A$;D zk&dt8g_dg3p5{JdE){oWC*rPmW63!p3G9~VPK#7Pf3t+Nuo3*Gbv%cbjQ!7@876&o z?+PG&au@xGi04iePGcj?;zE>&e8V5@gPNXG-*4jBECrW*9*j^cf)Zyvc-V1?6RBW5In`>=r)em@es0WLM=B`fL#7Yw?sYe;W(rH=%kOiY)F77@ zVP7&WEC$p7g-($`flmmR{y+pY>#8@ozy8%}!W^JwxO6Qy&h$UdZ-bo#PdLKvVlC5C zQ85CbIsEIZh6H9HbIK~xe=shEX0f?NrC_ihjFP%X)NgOAa9NQB5_=Yziji;X;CL zX@U!nVeSvHDQrZ>=C{JB8!Gbb`UI)^y;_LtT1RVI&b$ekuUz3=-FGF`BhsU_&M|Nk zGk{C?cJzgW`P+&+jQ82Keg2)t(R_U(rAVpqwzEffo4Cu{8$CnAWt?`SckF>wEfMoB zG#5}-xZ1pYc>B0oii>4o&og3JY8$}xHfmX(3GVDg9!(L_go7Hsw`1Q(nfe#J{`%9y!fkDw+k1&Eox-$-#EQRzz zkI3D_5DG6W11Oza!MIx(@qbb_nCd|@CC8piR;exG7`*Esnr zuX!suOZ*0AWRP^o`QAm_mA`;^2bN+B`YJ3|AhyPRnafmIB_-%l^y?dPd1qp7eRwh} zK@uVQNwZv55bL`on0E(vkA32~*Avte!{CyOY~JEmIN3$q9VS*~f#P$0o0%I?vcYHRK6qu-g%~pI=Pm>5lScc^|dB=nY?y3vj;| zKD>o9&}8=9iL?DK(&3d*e^Y9M-?Dgs?*QU>??f%BePK*oYwe=}CFMmRYxo%;Prq(s zf&5|l{Yl#_GYkqEV`4^zyC}hpznG~e-R3CNT^EZ{ZQFS}zk6F}yCN~-jIv|y#CEqNrrBS;S*~($EEv#g(Al3 z^Wuq+joBB)8#H5g^8$aZlx-hYw+_Ycw1Jy~^a2F`wnT82vvfDU!TP z)6C?KK4u z9D@NUQzn~e!P>bd)>)GEG?c|*VpynUVTJBk9HV4!P52=E)8)0tm1np;TWs`)y~-{x zw*7AqsytRIg@_SpGRr8N6daJ1!nn7I9Uz^$@d@eaASfSJ@Kg1)KW%o^*R);-+(Ni* z+o+Y8-W)dXXzmskVCUC^|MNYcF&@Wm@3eH0eX$C&cc40*M;cuBnnM{wNH#BVG%0uA z)YtRdB`TmL-B0yCrqsZEcrZU!OFozWFlJ7vS4642qG&5NWlJC3g@SIYj6j@}1KbJS zPJ8pY-H9U&uWH<@apnL*ChcrCOLDHmK)_Z3#(StdO~BX+L@v245OEJd-4%Mu_mszHRRFoul^dRY&D=?mH>SV zursxLIXunDf4r1^yu?q(hm`2kej2+D&g2tW6QJzDb2hNDIW}@0uXs)Ix4_X#qC%M5 zVyzywdreLRgI*~zbx5MG_n7>bUOwTVw-rmQ!}bJ8+wBBQoV}5nQ(-ZM{*YduA883& zv$6;(kRW|^nL9<0O?#szwQtAL1hgxv@UDqV@-u#h@{K;xxRF`_=dM!cQ6c4S;-_g+ zuItj|{&GmXP8WGq)Tlje19N+NK{PfYvRrd$xm?oIRq1j+sdm`A$RH&3VWtdLtS?S0 zS&}%!T^xCMrtRi0-rL@y_5cwC`N@ZdkJ6*Mb0s7vckXIah(g9ggHG$_cO`6%DWrw< zU+_kSGV|6t?$C6{|NlT}QJdoi(k7gshqZIBQ-ZoPK7#lP9-~>b*`i!}i!=5v#R_%(p7_ zwgMlO^l}JOM|`f(%!9-|Ea@G0I0FO8#gQpxYxK1ZtPm%(+nyaJ8?8W1c9;wuG)`E= zVEhy@qVkPhxoWytbk9O3U++S8%UnvTQtyC7lyP?&W#I)qrn-TWq$ul{%G2HGlx9Dd zYO@`(cemdS?uvLn;)vic>?o8Zj2%(fExZ#vH27=Pn#V%0!VpAdFG*BPI>GM&-JiS(Ff6dS%c@I5_0E%C8V#V^@SB}aLUn6SqI!u z{&K@_?m0-TXQ_6{vrtHAE4c*csshSN%~BSNaG4odpPGaRX?Lw72WC(l0qTOuj7u_f zwn!=fQlo0U?rBua%1xu!B>^P`hR|c_9M`M)3uUlQy~E-fdJnAQbBpDF{MHBbj03m# zJC!|#CUofQ`95{9i!iRTZ-F{J6k~4qkjoavc5`^P_wLY6;zju{y4z(ea;!xCgUsno z<FKG zF?%4nCtpmOB-G93!uit1xG9Krd$r>h0fWeq{p9-NyR-M-5PuX{SE?azzLgWkqIYWz6HyjPOP20B zE_{l2lpL&WWo_yyVT!awHpu!bjHfY{WH(TQ?|ZGA3ofcy{QNj~_HzPgVV#ap(I!QF z4Bk3Lz1NZplBcI^BIGC|v2m(OMthI7&qo?=9uQLFqr@$d%9OQtje}@cE1DiCS{B6t z$ADg~pqdv%<3;1d=8B_o!kkX?R1oH51_kX}Z&pNJfYnm&(rj=Kvy(dl{A-=PpN7h@ zYxP-kfYNRC%O!IPDYt|S@i=*XW6Dyt$KjC-ls$4GY0@N19NnjnZ(bTl(WFx zLDrfhm~td(%uKE-7QWh%M0+0?IH*%)KirSLqxml8X}D5valB=>1GFaqEC#vOhDd=d z?KGBn<8nfu!)BttsTp_nSQKI;SCTk9gEr2uZ`y0yp3NF(ee>4q zlydkn-n#q0_bIbjuUKTNf+Ff}Uv6)aC))_StcP&gCr}#IFh(4H$0P6EZ%a-sKJJ@L z*y#Sj5mCPd2&8t}f!<1kIN6Zz3v;NiV8Ek&Xa7Lb=2)37%GKNh6VLS-Vbg4EsiwTS z+FpT0X-d?l+Q-UCT8`^Zqwd{aYdduyyQao;XQkaJB#xD?X%pO3p2Guni}GWnYo zZ_v}6-&2fHo5L$@ix{I$T9=s=cgpQLVNk7q+>2CuTf^m=Mn|tmUbAXl7es2Yx|(HA zvG!EE%J;FJbO`=(7H*K;u5IW>mLS0mbS>{>ORGfxVvNUWhZ76KbQ`go~J3ZT@#MkomdaEkxzP-KDpX!yx%Y#YrGD?!PwoEPA5Y>-+H)KXT ze6vDL9iBN=cb8v`l+_DN+#YXbU*F%}{6JpbRTF)Pzrz+3PrrXZnM-hTG}To2kG zMgM?&VM{Th#{HU|8kCMUPM7{wZx}cZ@4exQ(VaMi@u6o{%n-3;K0YJU7SjAWxZbh} zgLckjZ(7XL&PmMK|8;dF~*ZRvO znj1PF)M8LYEvu}#(sfBTW^T%%k9$;VMwpqaN15M)xbuu{VoA7K^?r~C%Oq7kMP>A! zR%(_G~!%k+^ zzA&MeYbv;xa+DJ75tt=@2t_xD(Ob(bDejdr^d*Hf*%wRD8}tOjcy{l4@NQKMAFonM zS(hjIjCWZo&G%XQLSj}IA+_PJ6QeMtf@*!FDExd=8$OG)=aT!5IR_Yjbi@A|D0!?&~(Y;jqnz-{xVK zr_`BVpZ65}?WKB)2w&GS$+@dCeGpdVA0kb6i-n8_p?*`TB-c+_&9bhHk;=cBxQ4*O?&GqR%7oOWh{@e21Wp!yG@a0~1Jtt-iSxVd z+J>JpC)Xpc%gl3lp)oHKh$DV$IiS^NFLGvpp1L%M)l%a8`*DS0Q=vId36jvLYfoYA z+&jf>lZ_KZS;aoMlH1ZjfS<%x3wBk2}(P(Uc6WBk{t@hR*eFs*{aLw=HF!-mENeqnf*o`a0y29#uO(R-89 zGpp!-Msn+~a?pGKbag!CyKppkU-1&90L+&TY?eoB8DN<%x!f)-I%cg=7QmcZ83fv4 zPSjEG=;$ar$Z-A?pdbhyyRh1VvMRr@(tqA*xEk^kuPyiROj3Hfv&p|r+@VM7qv^Kb z$Q@M?`4;leX(V< z7d~sgvM=Wb+UuZTv`;QLM_$?tYNk9Qh)xOe!ZHCXHI}@+=9<7NIc|-9Q0(5-OW$d- zse5mz-q-rA4LZ!1HBP-{oz2{1%Hv_Wo+%6sP}5 zmcyfu&PO%we_gZPp7KrVRY^AkL-gDd_mnu*B7@dS;&gJRm2}Uz$L#L`64--R#*w>T zq5EHQS2B=^LzJ7@QH;iU1Ay`N-w_EAsZNN#TKu Date: Mon, 21 Jun 2021 16:16:33 +0100 Subject: [PATCH 025/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 149be2e826..b879108731 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -231,13 +231,13 @@ To enable this behavior, you must complete two steps: - Enable this policy setting - Join an Azure Active Directory account to the device -Windows diagnostic data is collected when the **AllowTelemetry** policy setting is set to 1 – Required (Basic) or above. +Windows diagnostic data is collected when the Allow Telemetry policy setting is set to 1 – **Required (Basic)** or above. -If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft’s privacy statement at https://go.microsoft.com/fwlink/?LinkId=521839 unless you have enabled policies like Allow Update Compliance Processing or Allow Desktop Analytics Processing. +If you disable or do not configure this setting, Microsoft will be the controller of the Windows diagnostic data collected from the device and processed in accordance with Microsoft’s [privacy statement](https://go.microsoft.com/fwlink/?LinkId=521839) unless you have enabled policies like Allow Update Compliance Processing or Allow Desktop Analytics Processing. Configuring this setting does not change the Windows diagnostic data collection level set for the device or the operation of optional analytics processor services like Desktop Analytics and Update Compliance. -See the documentation at https://aka.ms/ConfigureWWD for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. +See the documentation at [ConfigureWWD](https://aka.ms/ConfigureWWD) for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. @@ -277,7 +277,7 @@ This policy setting, in combination with the Allow Telemetry and Configure the C To enable this behavior, you must complete three steps: - Enable this policy setting -- Set **AllowTelemetry** to 1 – Required (Basic) or above +- Set **AllowTelemetry** to 1 – **Required (Basic)** or above - Set the Configure the Commercial ID setting for your Desktop Analytics workspace This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. @@ -1764,8 +1764,7 @@ The following list shows the supported values: -This policy setting, in combination with the System/AllowTelemetry - policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. +This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior, you must complete two steps: @@ -1777,7 +1776,7 @@ To enable this behavior, you must complete two steps: When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics. -Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send Required (Basic) or Optional (Full) diagnostic data to Microsoft. +Enabling enhanced diagnostic data in the Allow Telemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send Required (Basic) or Optional (Full) diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. From 55f8acd57f9ba09b77f08b47e8fa612dbbc21e56 Mon Sep 17 00:00:00 2001 From: Guillaume Bordier Date: Mon, 21 Jun 2021 17:17:32 +0200 Subject: [PATCH 026/279] Update hello-feature-pin-reset.md removed double quotes from ConfigureWebSignInAllowedUrls proposed value. --- .../hello-for-business/hello-feature-pin-reset.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 6d1ae1fbd1..c772362fa2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -197,7 +197,7 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - **Description:** (Optional) List of domains that are allowed during PIN reset flows. - **OMA-URI:** ./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls - **Data type:** String - - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be "signin.contoso.com;portal.contoso.com" + - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be signin.contoso.com;portal.contoso.com (no double quotes) ![Custom Configuration for ConfigureWebSignInAllowedUrls policy](images/pinreset/allowlist.png) @@ -218,4 +218,4 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) From fbd691a0183bb23582c11491bef1c242689c1d6b Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:27:11 +0100 Subject: [PATCH 027/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index b879108731..7336fae115 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -272,7 +272,7 @@ The following list shows the supported values: -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms. To enable this behavior, you must complete three steps: @@ -898,7 +898,7 @@ ADMX Info: -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. To enable this behavior, you must complete three steps: From f18c6b40cad1b33dc34ec88253677dfe4068bcb5 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:35:32 +0100 Subject: [PATCH 028/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 7336fae115..68a2c05711 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -657,10 +657,10 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. >[!IMPORTANT] - -> You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices. +> You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices.

+ **System/AllowStorageCard** From 21f573f0e47e9e85938b128248927a49f433b529 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:40:42 +0100 Subject: [PATCH 029/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 68a2c05711..766e283570 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -56,7 +56,7 @@ manager: dansimp System/AllowTelemetry
- System/AllowUpdateComplianceProcessing + System/AllowUpdateComplianceProcessing
System/AllowUserToResetPhone @@ -801,7 +801,8 @@ The following list shows the supported values for Windows 8.1: In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. The following list shows the supported values for Windows 10 version 1809 and older, choose the value that is applicable to your OS version (older OS values are displayed in the brackets): -- 0 – **Off (Security)** This turns Windows diagnostic data off. + +- 0 – **Off (Security)** This turns Windows diagnostic data off. **Note**: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. - 1 – **Required (Basic)** Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. - 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows apps are used, how they perform, and advanced reliability data, such as limited crash dumps. @@ -854,7 +855,7 @@ ADMX Info:
-**System/AllowUpdateComplianceProcessing** +**System/AllowUpdateComplianceProcessing**
From cbad357f3183fc6e0ddb449aba1b72f50c11a548 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:40:52 +0100 Subject: [PATCH 030/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 766e283570..6443af10bb 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -657,6 +657,7 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. >[!IMPORTANT] + > You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices.
From 92a5cbe7b46044ad7c91c55d4f7de5a46bd74fec Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:43:33 +0100 Subject: [PATCH 031/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 6443af10bb..766e283570 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -657,7 +657,6 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. >[!IMPORTANT] - > You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices.
From 6490ee28f6d7c7c4d1a202416f8a4b44e3cc887e Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:47:56 +0100 Subject: [PATCH 032/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 766e283570..71b47496b8 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -657,8 +657,8 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. >[!IMPORTANT] -> You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices. +> You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices.
From 0f75888d9b2259f5e0de1dc080ba46e15b6ff8a5 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:52:05 +0100 Subject: [PATCH 033/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 71b47496b8..766e283570 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -657,8 +657,8 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable this policy setting, devices may not appear in Microsoft Managed Desktop. >[!IMPORTANT] - > You should not disable or make changes to this policy as that will severely impact the ability of Microsoft Managed Desktop to manage the devices. +
From 26809832d8713b27cfbff76bbec99d77a988873f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 16:58:23 +0100 Subject: [PATCH 034/279] Update policy-csp-system.md --- .../mdm/policy-csp-system.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 766e283570..74b876af4f 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -228,8 +228,8 @@ This policy setting configures an Azure Active Directory joined device so that M To enable this behavior, you must complete two steps: -- Enable this policy setting -- Join an Azure Active Directory account to the device + 1. Enable this policy setting + 2. Join an Azure Active Directory account to the device Windows diagnostic data is collected when the Allow Telemetry policy setting is set to 1 – **Required (Basic)** or above. @@ -276,9 +276,9 @@ This policy setting, in combination with the Allow Telemetry and Configure the C To enable this behavior, you must complete three steps: -- Enable this policy setting -- Set **AllowTelemetry** to 1 – **Required (Basic)** or above -- Set the Configure the Commercial ID setting for your Desktop Analytics workspace + 1. Enable this policy setting + 2. Set **AllowTelemetry** to 1 – **Required (Basic)** or above + 3. Set the Configure the Commercial ID setting for your Desktop Analytics workspace This setting has no effect on devices unless they are properly enrolled in Desktop Analytics. @@ -903,9 +903,9 @@ This policy setting, in combination with the Allow Telemetry and Configure the C To enable this behavior, you must complete three steps: -- Enable this policy setting -- Set **AllowTelemetry** to 1 – **Required (Basic)** or above -- Set the Configure the Commercial ID setting for your Update Compliance workspace + 1. Enable this policy setting + 2. Set **AllowTelemetry** to 1 – **Required (Basic)** or above + 3. Set the Configure the Commercial ID setting for your Update Compliance workspace When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. @@ -1004,9 +1004,9 @@ This policy setting configures an Azure Active Directory joined device so that M To enable this behavior, you must complete three steps: -- Enable this policy setting -- Set **AllowTelemetry** to 1 – **Required (Basic)** or above -- Join an Azure Active Directory account to the device + 1. Enable this policy setting + 2. Set **AllowTelemetry** to 1 – **Required (Basic)** or above + 3. Join an Azure Active Directory account to the device When these policies are configured, Windows diagnostic data collected from the device will be subject to Microsoft processor commitments. @@ -1769,8 +1769,8 @@ This policy setting, in combination with the Allow Telemetry policy setting, ena To enable this behavior, you must complete two steps: -- Enable this policy setting -- Set the **AllowTelemetry** level: + 1. Enable this policy setting + 2. Set the **AllowTelemetry** level: - For Windows 10 version 1809 and older: set **AllowTelemetry** to Enhanced. (**Note**: **Enhanced** is no longer an option for Windows Holographic, version 21H1) - For Windows 10 version 19H1 and later: set **AllowTelemetry** to Optional (Full) From ff1f1a9d6aad7464fa236d97408e0830397b2f7b Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 17:30:23 +0100 Subject: [PATCH 035/279] dpsw updates --- windows/client-management/mdm/policy-csp-system.md | 2 +- ...windows-diagnostic-data-in-your-organization.md | 14 +++++++------- .../privacy/windows-10-and-privacy-compliance.md | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 74b876af4f..2c16e189c8 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -648,7 +648,7 @@ The following list shows the supported values: This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data. -For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md). +For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md). This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 033030780e..e1399e402a 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -271,22 +271,22 @@ For information on these services and how to configure the group policies, refer Desktop Analytics: -- [Enable data sharing - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/enable-data-sharing) -- [Desktop Analytics data privacy - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/privacy) -- [Group policy settings - Configuration Manager | Microsoft Docs](/mem/configmgr/desktop-analytics/group-policy-settings) +- [Enable data sharing](/mem/configmgr/desktop-analytics/enable-data-sharing) +- [Desktop Analytics data privacy](/mem/configmgr/desktop-analytics/privacy) +- [Group policy settings](/mem/configmgr/desktop-analytics/group-policy-settings) Update Compliance: -- [Privacy in Update Compliance - Windows Deployment | Microsoft Docs](/windows/deployment/update/update-compliance-privacy) -- [Manually configuring devices for Update Compliance - Windows Deployment | Microsoft Docs](/windows/deployment/update/update-compliance-configuration-manual#required-policies) +- [Privacy in Update Compliance](/windows/deployment/update/update-compliance-privacy) +- [Manually configuring devices for Update Compliance](/windows/deployment/update/update-compliance-configuration-manual#required-policies) Microsoft Managed Desktop: -- [Privacy and personal data - Microsoft Managed Desktop | Microsoft Docs](/microsoft-365/managed-desktop/service-description/privacy-personal-data) +- [Privacy and personal data - Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/privacy-personal-data) Windows Update for Business: -- [Windows Update for Business deployment service - Windows Deployment | Microsoft Docs](/windows/deployment/update/deployment-service-overview#how-to-enable-deployment-protections) +- [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview#how-to-enable-deployment-protections) ## Limit optional diagnostic data for Desktop Analytics diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 9d66846576..b75beff331 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -175,7 +175,7 @@ We recommend that IT administrators who have enabled the Windows diagnostic data Specific services that depend on Windows diagnostic data will also result in the enterprise becoming controllers of their Windows diagnostic data. These services include Update Compliance, Desktop Analytics, and Microsoft Managed Devices. For more information, see [Related Windows product considerations](#5-related-windows-product-considerations). -For more information on how Microsoft can help you honor rights and fulfill obligations under the GDPR when using Windows diagnostic data processor configurations, see [General Data Protection Regulation - Microsoft GDPR | Microsoft Docs](/compliance/regulatory/gdpr). +For more information on how Microsoft can help you honor rights and fulfill obligations under the GDPR when using Windows diagnostic data processor configurations, see [General Data Protection Regulation Summary](/compliance/regulatory/gdpr). ## 3. The process for exercising data subject rights From 0a665b0078552a7d72dfd7b721edbc5700c5fde4 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 17:40:57 +0100 Subject: [PATCH 036/279] dpsw updates --- windows/client-management/mdm/policy-csp-system.md | 2 +- ...figure-windows-diagnostic-data-in-your-organization.md | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 2c16e189c8..934e125625 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -648,7 +648,7 @@ The following list shows the supported values: This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data. -For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data - Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md). +For customers who enroll into the Microsoft Managed Desktop service, this policy will be enabled by default to allow Microsoft to process data for operational and analytic needs. For more information, see [Privacy and personal data](/microsoft-365/managed-desktop/service-description/privacy-personal-data.md). This setting has no effect on devices unless they are properly enrolled in Microsoft Managed Desktop. diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index e1399e402a..25b389048a 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -271,9 +271,9 @@ For information on these services and how to configure the group policies, refer Desktop Analytics: -- [Enable data sharing](/mem/configmgr/desktop-analytics/enable-data-sharing) +- [Enable data sharing for Desktop Analytics](/mem/configmgr/desktop-analytics/enable-data-sharing) - [Desktop Analytics data privacy](/mem/configmgr/desktop-analytics/privacy) -- [Group policy settings](/mem/configmgr/desktop-analytics/group-policy-settings) +- [Group policy settings for Desktop Analytics](/mem/configmgr/desktop-analytics/group-policy-settings) Update Compliance: @@ -282,11 +282,11 @@ Update Compliance: Microsoft Managed Desktop: -- [Privacy and personal data - Microsoft Managed Desktop](/microsoft-365/managed-desktop/service-description/privacy-personal-data) +- [Privacy and personal data](/microsoft-365/managed-desktop/service-description/privacy-personal-data) Windows Update for Business: -- [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview#how-to-enable-deployment-protections) +- [How to enable deployment protections](/windows/deployment/update/deployment-service-overview#how-to-enable-deployment-protections) ## Limit optional diagnostic data for Desktop Analytics From 1f63e30538e368bba8f7804d7d131e3d0d940f8d Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 21 Jun 2021 17:53:58 +0100 Subject: [PATCH 037/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 934e125625..641739b466 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -237,7 +237,7 @@ If you disable or do not configure this setting, Microsoft will be the controlle Configuring this setting does not change the Windows diagnostic data collection level set for the device or the operation of optional analytics processor services like Desktop Analytics and Update Compliance. -See the documentation at [ConfigureWWD](https://aka.ms/ConfigureWWD) for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. +See the documentation at [ConfigureWDD](https://aka.ms/ConfigureWDD) for information on this and other policies that will result in Microsoft being the processor of Windows diagnostic data. From 665bbb05d938f640924b6f83e18e5dbc65f781f7 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 22 Jun 2021 16:03:34 +0100 Subject: [PATCH 038/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 641739b466..276a6d4d84 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -286,6 +286,14 @@ When these policies are configured, Windows diagnostic data collected from the d If you disable or do not configure this policy setting, devices will not appear in Desktop Analytics. +The following list shows the supported values: + +- 0 (default) – Disabled. +- 2 – Allowed. + + + +
From 012e0b3338d2ec20be7a95aa5852c7d4523cdffa Mon Sep 17 00:00:00 2001 From: Brian Delaney <68655382+briandelmsft@users.noreply.github.com> Date: Tue, 22 Jun 2021 11:52:02 -0400 Subject: [PATCH 039/279] Update event-4627.md resizing image to max the text to its right easier to read --- windows/security/threat-protection/auditing/event-4627.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index ff63c0c122..cf25e61624 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -21,7 +21,7 @@ ms.technology: mde - Windows Server 2016 -Event 4627 illustration +Event 4627 illustration ***Subcategory:*** [Audit Group Membership](audit-group-membership.md) From b2087ddf915607b1f00bc132598694ba6f7cac51 Mon Sep 17 00:00:00 2001 From: Brian Delaney <68655382+briandelmsft@users.noreply.github.com> Date: Tue, 22 Jun 2021 11:55:18 -0400 Subject: [PATCH 040/279] Update event-4627.md Updating image size to max text on its right easier to read and consistent with other events --- windows/security/threat-protection/auditing/event-4627.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index cf25e61624..0ae5e51990 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -21,7 +21,7 @@ ms.technology: mde - Windows Server 2016 -Event 4627 illustration +Event 4627 illustration ***Subcategory:*** [Audit Group Membership](audit-group-membership.md) From b56593cebea82935ccd06883cea9646c5ce6edd6 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Tue, 22 Jun 2021 10:48:28 -0700 Subject: [PATCH 041/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...system-components-to-microsoft-services.md | 42 +++++++------------ 1 file changed, 14 insertions(+), 28 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 822869ba60..f9382b3938 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -604,34 +604,20 @@ For a complete list of the Microsoft Edge policies, see [Microsoft Edge and priv | Policy | Group Policy Path | Registry Path | |----------------------------------|--------------------|---------------------------------------------| -| **SearchSuggestEnabled** | Computer Configuration/Administrative Templates/Windows Component/Microsoft Edge - Enable search suggestions | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: SearchSuggestEnabled Set to 0** | -| **AutofillAddressEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Enable AutoFill for addresses | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: AutofillAddressEnabled Set to 0** | -| **AutofillCreditCardEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Enable AutoFill for credit cards | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: AutofillCreditCardEnabled Set to 0** | -| **ConfigureDoNotTrack** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Configure Do Not Track | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Enabled**| **REG_DWORD name: ConfigureDoNotTrack Set to 1** | -| **PasswordManagerEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Password manager and protection-Enable saving passwords to the password manager | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: PasswordManagerEnabled Set to 0** | -| **DefaultSearchProviderEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Default search provider-Enable the default search provider | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: DefaultSearchProviderEnabled Set to 0** | -| **HideFirstRunExperience** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Hide the First-run experience and splash screen | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Enabled**| **REG_DWORD name: HideFirstRunExperience Set to 1** | -| **SmartScreenEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/SmartScreen settings-Configure Microsoft Defender SmartScreen | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: SmartScreenEnabled Set to 0** | -| **NewTabPageLocation** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Configure the new tab page URL | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Enabled-Value “about:blank”**| **REG_SZ name: NewTabPageLocation Set to about:blank** | -| **RestoreOnStartup** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Action to take on startup | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge | -| | **Set to Disabled**| **REG_DWORD name: RestoreOnStartup Set to 5** | -| **RestoreOnStartupURLs** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Sites to open when the browser starts | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\RestoreOnStartupURLs | -| | **Set to Disabled**| **REG_SZ name: 1 Set to about:blank** | -| **UpdateDefault** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Applications-Update policy override default | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate | -| | **Set to Enabled - 'Updates disabled'**| **REG_DWORD name: UpdateDefault Set to 0** | -| **AutoUpdateCheckPeriodMinutes** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Preferences- Auto-update check period override | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate | -| | **Set to Enabled - Set Value for Minutes between update checks to 0**| **REG_DWORD name: AutoUpdateCheckPeriodMinutes Set to 0** | -| **Experimentation and Configuration Service** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Preferences- Auto-update check period override | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate | -| | **Set to RestrictedMode**| **REG_DWORD name: ExperimentationAndConfigurationServiceControl Set to 0** | +| **SearchSuggestEnabled** | Computer Configuration/Administrative Templates/Windows Component/Microsoft Edge - Enable search suggestions
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: SearchSuggestEnabled Set to 0**| +| **AutofillAddressEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Enable AutoFill for addresses
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: AutofillAddressEnabled Set to 0**| +| **AutofillCreditCardEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Enable AutoFill for credit cards
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: AutofillCreditCardEnabled Set to 0**| +| **ConfigureDoNotTrack** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge - Configure Do Not Track
**Set to Enabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: ConfigureDoNotTrack Set to 1** | +| **PasswordManagerEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Password manager and protection-Enable saving passwords to the password manager
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: PasswordManagerEnabled Set to 0**| +| **DefaultSearchProviderEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Default search provider-Enable the default search provider
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: DefaultSearchProviderEnabled Set to 0**| +| **HideFirstRunExperience** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Hide the First-run experience and splash screen
**Set to Enabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: HideFirstRunExperience Set to 1**| +| **SmartScreenEnabled** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/SmartScreen settings-Configure Microsoft Defender SmartScreen
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: SmartScreenEnabled Set to 0**| +| **NewTabPageLocation** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Configure the new tab page URL
**Set to Enabled-Value “about:blank”**| HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_SZ name: NewTabPageLocation Set to about:blank**| +| **RestoreOnStartup** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Action to take on startup
**Set to Disabled** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge
**REG_DWORD name: RestoreOnStartup Set to 5**| +| **RestoreOnStartupURLs** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge/Startup, home page and new tab page- Sites to open when the browser starts
**Set to Disabled**| HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\RestoreOnStartupURLs
**REG_SZ name: 1 Set to about:blank**| +| **UpdateDefault** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Applications-Update policy override default
**Set to Enabled - 'Updates disabled'** | HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate
**REG_DWORD name: UpdateDefault Set to 0**| +| **AutoUpdateCheckPeriodMinutes** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Preferences- Auto-update check period override
**Set to Enabled - Set Value for Minutes between update checks to 0**| HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate
**REG_DWORD name: AutoUpdateCheckPeriodMinutes Set to 0**| +|**Experimentation and Configuration Service** | Computer Configurations/Administrative Templates/Windows Component/Microsoft Edge Update/Preferences- Auto-update check period override
**Set to RestrictedMode**| HKEY_LOCAL_MACHINE \SOFTWARE\Policies\Microsoft\Edge\EdgeUpdate
**REG_DWORD name: ExperimentationAndConfigurationServiceControl Set to 0**| ||| ### 14. Network Connection Status Indicator From c251aec0540803ac99ae0c0522123ad3054e4383 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 22 Jun 2021 12:26:53 -0700 Subject: [PATCH 042/279] Fixed the link to Managed Installer EA --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 99f5695221..2b7538b891 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -121,7 +121,7 @@ To create the WDAC policy, they build a reference server on their standard hardw As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. ## File rule precedence order -WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deploy-wdac-policies-with-managed-installer.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). +WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). ## More information about filepath rules From f7d9f560f4850071180dbf979c9fc3b70884532a Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 22 Jun 2021 14:42:40 -0700 Subject: [PATCH 043/279] Added the NTSATUS section --- .../event-tag-explanations.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index 2ae5aa34a4..a8d2a29659 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -120,3 +120,7 @@ The rule means trust anything signed by a certificate that chains to this root C | 19 | Microsoft ECC Devices Root CA 2017 | For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file. + +## NTSTATUS Values + +Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details. From 89ef49a2a467f46296f9a00b87e25e1582ca4814 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 22 Jun 2021 14:59:45 -0700 Subject: [PATCH 044/279] Updated the section name --- .../event-tag-explanations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index a8d2a29659..1d237cd396 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file. -## NTSTATUS Values +## Status Values Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details. From 67e7fb72ae34de3b0b10f7ee2aca1037f5565cc3 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Wed, 23 Jun 2021 11:35:43 -0700 Subject: [PATCH 045/279] Applied suggested edits --- .../select-types-of-rules-to-create.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 5f12576ef7..42fcb69ab3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -121,8 +121,8 @@ To create the WDAC policy, they build a reference server on their standard hardw As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. ## File rule precedence order -<<<<<<< HEAD -WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). + +WDAC has a built-in file rule conflict logic that translates to precedence order. It will first process all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). ## More information about filepath rules From 5185eba0fd5749e0a4ab5f5b8b6c4a98cc1735ec Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Wed, 23 Jun 2021 13:27:32 -0700 Subject: [PATCH 046/279] Updated Note for Disabled:Script Enforcment to select-types-of-rules-to-create and wdac-wizard-create-base-policy files. --- .../select-types-of-rules-to-create.md | 2 +- .../wdac-wizard-create-base-policy.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 42fcb69ab3..4fd6f8105d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -61,7 +61,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | +| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes) NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | | **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. | | **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | | **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 91ba9aeac7..2c5382e43b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -59,7 +59,7 @@ A description of each policy rule, beginning with the left-most column, is provi |------------ | ----------- | | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | -| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | +| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | |**[Hypervisor-protected code integrity (HVCI)](../device-guard/enable-virtualization-based-protection-of-code-integrity.md)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | From 227442b0184fa827a9b27a987f3e19846275dea2 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Wed, 23 Jun 2021 14:58:51 -0700 Subject: [PATCH 047/279] Included suggested edits to Status values section --- .../event-tag-explanations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index 1d237cd396..d19f762683 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -121,6 +121,6 @@ The rule means trust anything signed by a certificate that chains to this root C For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file. -## Status Values +## Status values -Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details. +Represents values that are used to communicate system information. They are of four types: success values, information values, warning values, and error values. Click on the [NTSATUS](/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55) link for information about common usage details. From b915fcd508c19e17ede088707e2fff4770a5c2ef Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 24 Jun 2021 10:55:29 +0100 Subject: [PATCH 048/279] Update policy-csp-system.md --- .../mdm/policy-csp-system.md | 96 ------------------- 1 file changed, 96 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 276a6d4d84..5437a4ae9e 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -125,10 +125,6 @@ manager: dansimp - - - - @@ -197,10 +193,6 @@ The following list shows the supported values: - - - - @@ -313,10 +305,6 @@ The following list shows the supported values: - - - - @@ -386,10 +374,6 @@ The following list shows the supported values: - - - - @@ -446,10 +430,6 @@ The following list shows the supported values: - - - - @@ -511,10 +491,6 @@ The following list shows the supported values: - - - - @@ -590,10 +566,6 @@ To verify if System/AllowFontProviders is set to true: - - - - @@ -686,10 +658,6 @@ If you disable this policy setting, devices may not appear in Microsoft Managed - - - - @@ -746,10 +714,6 @@ The following list shows the supported values: - - - - @@ -879,10 +843,6 @@ ADMX Info: - - - - @@ -957,10 +917,6 @@ The following list shows the supported values: - - - - @@ -1039,10 +995,6 @@ If you disable or do not configure this policy setting, devices enrolled to the - - - - @@ -1115,10 +1067,6 @@ ADMX Info: - - - - @@ -1189,10 +1137,6 @@ ADMX Info: - - - - @@ -1256,10 +1200,6 @@ The following list shows the supported values: - - - - @@ -1328,10 +1268,6 @@ The following list shows the supported values: - - - - @@ -1399,10 +1335,6 @@ ADMX Info: - - - - @@ -1470,10 +1402,6 @@ ADMX Info: - - - - @@ -1530,10 +1458,6 @@ ADMX Info: - - - - @@ -1612,10 +1536,6 @@ To validate on Desktop, do the following: - - - - @@ -1688,10 +1608,6 @@ ADMX Info: - - - - @@ -1746,10 +1662,6 @@ The following list shows the supported values: - - - - @@ -1820,10 +1732,6 @@ ADMX Info: - - - - @@ -1882,10 +1790,6 @@ ADMX Info: - - - - From 2cf7921e7559caccf3b41501d549254e522a586b Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 24 Jun 2021 11:00:58 +0100 Subject: [PATCH 049/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 5437a4ae9e..7b1b43d816 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -123,7 +123,7 @@ manager: dansimp - + @@ -191,7 +191,7 @@ The following list shows the supported values: - + @@ -1855,5 +1855,6 @@ Footnotes: - 8 - Available in Windows 10, version 2004. - 9 - Available in Windows 10, version 20H2. - 10 - Available in Windows 10, version 21H1. +- 11 - Also applies to Windows 10 Business. From dcb6afdeb3d9678cd3f309198fabefebce739a88 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 24 Jun 2021 11:12:11 +0100 Subject: [PATCH 050/279] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 7b1b43d816..2a6aaac456 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -191,7 +191,7 @@ The following list shows the supported values: - + From 61d096380db60f3105e32860f97ca5ba51f09567 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 24 Jun 2021 16:35:12 +0100 Subject: [PATCH 051/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index b75beff331..22f9a75bed 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -89,7 +89,7 @@ The following table provides an overview of the privacy settings discussed earli | [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

MDM: [Privacy/AllowInputPersonalization](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off | | [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

MDM: [Privacy/LetAppsAccessLocation](/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off | | [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

MDM: [Experience/AllFindMyDevice](/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off | -| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the recommended state to minimize data collection is not applicable. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | +| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

MDM: [System/AllowTelemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)

**Note**: If you are planning to configure devices, using the Windows diagnostic data processor configuration option, the state to minimize data collection is not recommended. See [Enabling the Windows diagnostic data processor configuration](#238-diagnostic-data-enabling-the-windows-diagnostic-data-processor-configuration) below for more information. | Required diagnostic data (Windows 10, version 1903 and later)

Server editions:
Enhanced diagnostic data | Security (Off) and block endpoints | | [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

MDM: [TextInput/AllowLinguisticDataCollection](/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | | Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off | | Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

MDM: [Privacy/DisableAdvertisingId](/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | @@ -161,7 +161,7 @@ An administrator can disable a user’s ability to delete their device’s diagn - Windows 10 Enterprise, Pro, Education editions, version 1809 with July 2021 update and newer -The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Diagnostic data does not include data processed by Microsoft with the use of essential services and connected experiences in Windows. +The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Windows diagnostic data does not include data processed by Microsoft in connection with providing the service based capabilities of essential services and connected experiences. The Windows diagnostic data collected from devices enabled with the Windows diagnostic data processor configuration may be associated with a specific AAD User ID or device ID. The Windows diagnostic data processor configuration provides you with controls that help respond to data subject requests (DSRs) to delete diagnostic data, at user account closure, for a specific AAD User ID. Additionally, you’re able to execute an export DSR for diagnostic data related to a specific AAD User ID. For more information, see [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). Microsoft also will accommodate a tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for Windows diagnostic data, but still wish to remain an Azure customer. @@ -173,7 +173,7 @@ We recommend that IT administrators who have enabled the Windows diagnostic data >[!Note] >Tenant account closure will lead to the deletion of all data associated with that tenant. -Specific services that depend on Windows diagnostic data will also result in the enterprise becoming controllers of their Windows diagnostic data. These services include Update Compliance, Desktop Analytics, and Microsoft Managed Devices. For more information, see [Related Windows product considerations](#5-related-windows-product-considerations). +Specific services that depend on Windows diagnostic data will also result in the enterprise becoming controllers of their Windows diagnostic data. These services include Update Compliance, Desktop Analytics, Windows Update for Business, and Microsoft Managed Desktop. For more information, see [Related Windows product considerations](#5-related-windows-product-considerations). For more information on how Microsoft can help you honor rights and fulfill obligations under the GDPR when using Windows diagnostic data processor configurations, see [General Data Protection Regulation Summary](/compliance/regulatory/gdpr). From 4e9d6926b6e6f04c67c7638a648df8894f9fabd7 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 24 Jun 2021 17:00:27 +0100 Subject: [PATCH 052/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 22f9a75bed..2b896c075b 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -115,7 +115,7 @@ You can use the following articles to learn more about Autopilot and how to use #### _2.3.2 Windows 10 connected experiences and essential services_ -Windows includes built-in apps, services, and features, that connect to the internet to provide enhanced experiences and additional capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. From 632d4d4b2e038cdc35f91db05f400eb21831feb8 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Thu, 24 Jun 2021 10:29:55 -0700 Subject: [PATCH 053/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md Replaced Windows Defender with Microsoft Defender Antivirus and added a GP section for Cloud Clipboard --- ...system-components-to-microsoft-services.md | 68 ++++++++++++------- 1 file changed, 42 insertions(+), 26 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 1dec9ad720..d046271409 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -27,13 +27,13 @@ ms.date: 5/21/2021 This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. +Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Microsoft Defender Antivirus are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. > [!IMPORTANT] > - The downloadable Windows 10, version 1903 scripts/settings can be used on Windows 10, version 1909 devices. > - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic) > - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. -> - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features. +> - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Microsoft Defender Antivirus. Accordingly, we do not recommend disabling any of these features. > - It is recommended that you restart a device after making configuration changes to it. > - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. @@ -48,7 +48,7 @@ We are always striving to improve our documentation and welcome your feedback. Y ## Management options for each setting -The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections +The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Microsoft Defender Antivirus diagnostic data and MSRT reporting, and turn off all of these connections ### Settings for Windows 10 Enterprise edition @@ -103,7 +103,7 @@ The following table lists management options for each setting, beginning with Wi | [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -131,7 +131,7 @@ See the following table for a summary of the management settings for Windows Ser | [18. Settings > Privacy](#bkmk-settingssection) | | | | | [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -148,7 +148,7 @@ See the following table for a summary of the management settings for Windows Ser | [14. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [19. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ### Settings for Windows Server 2016 Nano Server @@ -213,7 +213,7 @@ See the following table for a summary of the management settings for Windows Ser | [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | @@ -291,7 +291,7 @@ You can also apply the Group Policies using the following registry keys: > [!IMPORTANT] > Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Microsoft Defender Antivirus Firewall with Advanced Security** > **Microsoft Defender Antivirus Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. 2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. @@ -423,7 +423,7 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
**Set Value to: Disabled**| | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
**Set Value to: Enabled**
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
**Set Value to: Enabled**| -| Prevent managing Windows Defender SmartScreen | Choose whether employees can manage the Windows Defender SmartScreen in Internet Explorer.
**Set Value to: Enabled** and then set **Select Windows Defender SmartScreen mode** to **Off**.| +| Prevent managing Microsoft Defender Antivirus SmartScreen | Choose whether employees can manage the Microsoft Defender Antivirus SmartScreen in Internet Explorer.
**Set Value to: Enabled** and then set **Select Microsoft Defender Antivirus SmartScreen mode** to **Off**.| | Registry Key | Registry path | @@ -432,7 +432,7 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
REG_DWORD: AllowServicePoweredQSA
**Set Value to: 0**| | Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete
REG_SZ: AutoSuggest
Set Value to: **no** | | Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
REG_DWORD: PolicyDisableGeolocation
**Set Value to: 1** | -| Prevent managing Windows Defender SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
**Set Value to: 0** | +| Prevent managing Microsoft Defender Antivirus SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
**Set Value to: 0** | There are more Group Policy objects that are used by Internet Explorer: @@ -567,7 +567,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Configure Do Not Track | Choose whether employees can send Do Not Track headers.
**Set to Enabled** | | Configure Password Manager | Choose whether employees can save passwords locally on their devices.
**Set to Disabled** | | Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
**Set to Disabled** | -| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Windows Defender SmartScreen is turned on or off.
**Set to Disabled** | +| Configure Microsoft Defender Antivirus SmartScreen (Windows 10, version 1703) | Choose whether Microsoft Defender Antivirus SmartScreen is turned on or off.
**Set to Disabled** | | Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | | Configure Start pages | Choose the Start page for domain-joined devices.
**Enabled** and **Set this to <>** | | Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage.
**Set to: Enable** | @@ -583,7 +583,7 @@ Alternatively, you can configure the following Registry keys as described: | Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: **1** | | Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **No** | | Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: **0**| -| Configure Windows Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | +| Configure Microsoft Defender Antivirus SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | | Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: AllowWebContentOnNewTabPage
Value: **0** | | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
REG_SZ name: ProvisionedHomePages
Value: **<>**| | Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: PreventFirstRunPage
Value: **1**| @@ -594,13 +594,13 @@ For a complete list of the Microsoft Edge policies, see [Available policies for ### 13.2 Microsoft Edge Enterprise -For a complete list of the Microsoft Edge policies, see [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies). +For a complete list of the Microsoft Edge policies, see [Microsoft Edge and privacy: FAQ](https://docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies). > [!Important] -> - The following settings are applicable to Microsoft Edge version 77 or later. -> - For details on supported Operating Systems, see [Microsoft Edge supported Operating Systems](/deployedge/microsoft-edge-supported-operating-systems). -> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge, see [Configure Microsoft Edge policy settings on Windows](/deployedge/configure-microsoft-edge). -> - Devices must be domain joined for some of the policies to take effect. +> - The following settings are applicable to Microsoft Edge version 77 or later. +> - For details on supported Operating Systems see Microsoft Edge supported Operating Systems +> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge see Configure Microsoft Edge policy settings on Windows +> - Devices must be domain joined for some of the policies to take effect. | Policy | Group Policy Path | Registry Path | |----------------------------------|--------------------|---------------------------------------------| @@ -913,7 +913,7 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin - Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). -To turn off **Turn on Windows Defender SmartScreen to check web content (URLs) that Microsoft Store apps use**: +To turn off **Turn on Microsoft Defender Antivirus SmartScreen to check web content (URLs) that Microsoft Store apps use**: - Turn off the feature in the UI. @@ -1616,13 +1616,13 @@ To turn off **Connect to suggested open hotspots** and **Connect to networks sha When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee. -### 24. Windows Defender +### 24. Microsoft Defender Antivirus You can disconnect from the Microsoft Antimalware Protection Service. > [!IMPORTANT] -> **Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903** -> 1. Ensure Windows and Windows Defender are fully up to date. +> **Required Steps BEFORE setting the Microsoft Defender Antivirus Group Policy or RegKey on Windows 10 version 1903** +> 1. Ensure Windows and Microsoft Defender Antivirus are fully up to date. > 2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. - **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** @@ -1687,21 +1687,21 @@ You can turn off **Enhanced Notifications** as follows: - Create a new REG_DWORD registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** and enter the decimal value **1**. -### 24.1 Windows Defender SmartScreen +### 24.1 Microsoft Defender Antivirus SmartScreen -To disable Windows Defender SmartScreen: +To disable Microsoft Defender Antivirus SmartScreen: In Group Policy, configure: -- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** to be **Disabled** +- **Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus SmartScreen > Explorer > Configure Microsoft Defender Antivirus SmartScreen** to be **Disabled** -and- -- **Computer Configuration > Administrative Templates > Windows Components > File Explorer > Configure Windows Defender SmartScreen** : **Disable** +- **Computer Configuration > Administrative Templates > Windows Components > File Explorer > Configure Microsoft Defender Antivirus SmartScreen** : **Disable** -and- -- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations** +- **Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations** -OR- @@ -1930,6 +1930,22 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre - Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the **value to 0 (zero)**. +### 30. Cloud Clipboard + +Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access. Also, when this is allowed, a new clipboard item on the cloud is downloaded to a device so that user can paste on the device. + +Most restricted value is 0. + +ADMX Info: + +- GP English name: Allow Clipboard synchronization across devices
+- GP name: AllowCrossDeviceClipboard
+- GP path: System/OS Policies
+- GP ADMX file name: OSPolicy.admx
+ +The following list shows the supported values:
+0 – Not allowed. 1 (default) – Allowed.
+ ### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline From 730d0f752c3ed9916cb428f8c13931e30862f9a3 Mon Sep 17 00:00:00 2001 From: Tom Layson <83308464+TomLayson@users.noreply.github.com> Date: Thu, 24 Jun 2021 10:53:50 -0700 Subject: [PATCH 054/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md Added Services Config section and Menu links. --- ...erating-system-components-to-microsoft-services.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d046271409..a66e8d0a3a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -109,6 +109,8 @@ The following table lists management options for each setting, beginning with Wi | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | +| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ### Settings for Windows Server 2016 with Desktop Experience @@ -219,6 +221,8 @@ See the following table for a summary of the management settings for Windows Ser | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | | [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | +| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ## How to configure each setting @@ -1946,6 +1950,13 @@ ADMX Info: The following list shows the supported values:
0 – Not allowed. 1 (default) – Allowed.
+### 31. Services Configuration + +Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working. + +You can turn off Services Configuration by setting the following registry entries: + +Add a REG_DWORD value named **DisableOneSettingsDownloads** to **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DataCollection** and set the value to **1**. ### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline From d2ad0329efdd7535e79d3c84363e440bf9964527 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Thu, 24 Jun 2021 11:37:40 -0700 Subject: [PATCH 055/279] Add the missing period --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 4fd6f8105d..1652ad9cd5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -61,7 +61,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes) NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | +| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | | **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. | | **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | | **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | From 7ea8c78d51c31642b527fccf283cb9b4a12f6eb9 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 25 Jun 2021 07:25:19 +0530 Subject: [PATCH 056/279] removed symbols and pre word. as per user report #9717 . so I removed special symbols nas pre word . --- windows/deployment/windows-10-subscription-activation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 6861d74931..dfb7ea6b10 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -197,7 +197,7 @@ You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, a To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: ```console -cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43 +cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43 ``` The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v=ws.11)) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. @@ -280,4 +280,4 @@ Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscr [Connect domain-joined devices to Azure AD for Windows 10 experiences](/azure/active-directory/devices/hybrid-azuread-join-plan)
[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
-[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
\ No newline at end of file +[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
From 862685107a8767e4d07af0691a39146d429cdc76 Mon Sep 17 00:00:00 2001 From: Oscar Beaumont Date: Sun, 27 Jun 2021 02:48:57 +1000 Subject: [PATCH 057/279] fixed invalid MDM Federated enrollment example code The example is missing a closing s:Envelope tag. --- .../mdm/federated-authentication-device-enrollment.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 858a51a88b..27a1b064ae 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -119,6 +119,7 @@ The following example shows the discovery service request. + ``` The discovery response is in the XML format and includes the following fields: @@ -627,4 +628,4 @@ The following code shows sample provisioning XML (presented in the preceding pac - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. -- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. \ No newline at end of file +- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. From 379dda9fe220ac586f1746d9999918b7b240cc28 Mon Sep 17 00:00:00 2001 From: Oscar Beaumont Date: Mon, 28 Jun 2021 13:22:01 +1000 Subject: [PATCH 058/279] fixed broken XML & improved readability of examples --- ...erated-authentication-device-enrollment.md | 70 ++++++++----------- 1 file changed, 30 insertions(+), 40 deletions(-) diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 858a51a88b..fe3f5140fd 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -266,12 +266,10 @@ The following is an enrollment policy request example with a received security t https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - + B64EncodedSampleBinarySecurityToken @@ -410,12 +408,9 @@ The following example shows the enrollment web service request for federated aut https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - + B64EncodedSampleBinarySecurityToken @@ -518,21 +513,18 @@ The following example shows the enrollment web service response. xmlns="http://docs.oasis-open.org/ws-sx/ws-trust/200512"> - http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken + http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken - + + + ValueType="http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc" + EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary" + xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> B64EncodedSampleBinarySecurityToken - 0 - + 0 @@ -558,12 +550,12 @@ The following code shows sample provisioning XML (presented in the preceding pac - - + + - + @@ -581,8 +573,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -598,25 +589,24 @@ The following code shows sample provisioning XML (presented in the preceding pac - - - - + + + + + - - - - - - + + + + + - + ``` @@ -627,4 +617,4 @@ The following code shows sample provisioning XML (presented in the preceding pac - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. -- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. \ No newline at end of file +- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. From d74f41201939238b63d3182185543bf9eb5daad9 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 11:19:27 +0100 Subject: [PATCH 059/279] Update windows-diagnostic-data.md --- windows/privacy/windows-diagnostic-data.md | 36 +++++++++++----------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 68ebf78103..f80e09a6a4 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -28,7 +28,7 @@ Applies to: Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 20H2 required diagnostic events and fields](/windows/configuration/basic-level-windows-diagnostic-events-and-fields). -In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology - Cloud computing - Cloud services and devices: Data flow, data categories, and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. +In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944-1:2020 Information technology - Cloud computing - Cloud services and devices: Data flow, data categories, and data use](https://www.iso.org/standard/79573.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. The data covered in this article is grouped into the following types: @@ -41,7 +41,7 @@ The data covered in this article is grouped into the following types: - Inking, Typing, and Speech Utterance data ## Common data extensions -Most diagnostic events contain a header of common data. In each example, the info in parentheses provides the equivalent definition for ISO/IEC 19944:2017. +Most diagnostic events contain a header of common data. In each example, the info in parentheses provides the equivalent definition for ISO/IEC 19944-1:2020. **Data Use for Common data extensions** Header data supports the use of data associated with all diagnostic events. Therefore, Common data is used to [provide](#provide) Windows 10, and may be used to [improve](#improve), [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) Microsoft and third-party products and services, depending on the uses described in the **Data Use** statements for each data category. @@ -66,7 +66,7 @@ Information that is added to most diagnostic events, if relevant and available: ## Device, Connectivity, and Configuration data -This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.3 Connectivity data. +This type of data includes details about the device, its configuration and connectivity capabilities, and status. Device, Connectivity, and Configuration data is equivalent to ISO/IEC 19944-1:2020, 8.2.3.2.3 Connectivity data. ### Data Use for Device, Connectivity, and Configuration data @@ -178,7 +178,7 @@ If a user has enabled Tailored experiences on the device, [Pseudonymized](#pseud - Hashed IP address ## Product and Service Usage data -This type of data includes details about the usage of the device, operating system, applications, and services. Product and Service Usage data is equivalent to ISO/IEC 19944:2017, 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes details about the usage of the device, operating system, applications, and services. Product and Service Usage data is equivalent to ISO/IEC 19944-1:2020, 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Product and Service Usage data @@ -242,7 +242,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Login sessions and state ## Product and Service Performance data -This type of data includes details about the health of the device, operating system, apps, and drivers. Product and Service Performance data is equivalent to ISO/IEC 19944:2017 8.2.3.2.2 EUII Telemetry data. +This type of data includes details about the health of the device, operating system, apps, and drivers. Product and Service Performance data is equivalent to ISO/IEC 19944-1:2020 8.2.3.2.2 EUII Telemetry data. ### Data Use for Product and Service Performance data @@ -355,7 +355,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - License usage session ## Software Setup and Inventory data -This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a subtype of ISO/IEC 19944:2017 8.2.3.2.4 Observed Usage of the Service Capability. +This type of data includes software installation and update information on the device. Software Setup and Inventory Data is a subtype of ISO/IEC 19944-1:2020 8.2.3.2.4 Observed Usage of the Service Capability. ### Data Use for Software Setup and Inventory data @@ -397,7 +397,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Windows Insider build details ## Browsing History data -This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944:2017 8.2.3.2.8 Client-side browsing history. +This type of data includes details about web browsing in the Microsoft browsers. Browsing History data is equivalent to ISO/IEC 19944-1:2020 8.2.3.2.8 Client-side browsing history. ### Data Use for Browsing History data @@ -429,7 +429,7 @@ If a user has enabled Tailored experiences on the device, [pseudonymized](#pseud - Page title ## Inking Typing and Speech Utterance data -This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing, and Speech Utterance data is a subtype of ISO/IEC 19944:2017 8.2.3.2.1 End User Identifiable information. +This type of data gathers details about the voice, inking, and typing input features on the device. Inking, Typing, and Speech Utterance data is a subtype of ISO/IEC 19944-1:2020 8.2.3.2.1 End User Identifiable information. ### Data Use for Inking, Typing, and Speech Utterance data @@ -462,31 +462,31 @@ This type of data gathers details about the voice, inking, and typing input feat - Whether user is known to be a child - Confidence and success or failure of speech recognition -## ISO/IEC 19944:2017-specific terminology +## ISO/IEC 19944-1:2020-specific terminology -This section provides the ISO/IEC 19944:2017-specific definitions for use and de-identification qualifiers used in this article. +This section provides the ISO/IEC 19944-1:2020-specific definitions for use and de-identification qualifiers used in this article. ### Provide -ISO/IEC 19944:2017 Reference: **9.3.2 Provide** +ISO/IEC 19944-1:2020 Reference: **9.3.2 Provide** Use of a specified data category by a Microsoft product or service to protect and provide the described service, including, (i) troubleshoot and fix issues with the product or service or (ii) provide product or service updates. ### Improve -ISO/IEC 19944:2017 Reference: **9.3.3 Improve** +ISO/IEC 19944-1:2020 Reference: **9.3.3 Improve** Use of a specified data category to improve or increase the quality of a Microsoft product or service. Those improvements may be available to end users. ### Personalize -ISO/IEC 19944:2017 Reference: **9.3.4 Personalize** +ISO/IEC 19944-1:2020 Reference: **9.3.4 Personalize** Use of the specified data categories to create a customized experience for the end user in any Microsoft product or service. ### Recommend -ISO/IEC 19944:2017 Reference: **9.3.4 Personalize** +ISO/IEC 19944-1:2020 Reference: **9.3.4 Personalize** “Recommend” means use of the specified data categories to Personalize (9.3.4) the end user’s experience by recommending Microsoft products or services that can be accessed without the need to make a purchase or pay money. @@ -494,7 +494,7 @@ Use of the specified data categories give recommendations about Microsoft produc ### Offer -ISO/IEC 19944:2017 Reference: **9.3.5 Offer upgrades or upsell** +ISO/IEC 19944-1:2020 Reference: **9.3.5 Offer upgrades or upsell** Implies that the source of the data is Microsoft products and services, and the upgrades offered come from Microsoft products and services that are relevant to the context of the current capability. The target audience for the offer is Microsoft customers. @@ -502,14 +502,14 @@ Specifically, use of the specified data categories to make an offer or upsell ne ### Promote -ISO/IEC 19944:2017 Reference: **9.3.6 Market/advertise/promote** +ISO/IEC 19944-1:2020 Reference: **9.3.6 Market/advertise/promote** Use of the specified data categories to promote a product or service in or on a first-party Microsoft product or service. ### Data identification qualifiers -Here are the data identification qualifiers and the ISO/IEC 19944:2017 reference: +Here are the data identification qualifiers and the ISO/IEC 19944-1:2020 reference: - **Pseudonymized Data** 8.3.3 Pseudonymized data. Microsoft usage notes are as defined. - **Anonymized Data** 8.3.5 Anonymized data. Microsoft usage notes are as defined. -- **Aggregated Data** 8.3.6 Aggregated data. Microsoft usage notes are as defined. \ No newline at end of file +- **Aggregated Data** 8.3.6 Aggregated data. Microsoft usage notes are as defined. From 425f096d8d91f3562919cbe29bcb985d4d8b1e6c Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Mon, 28 Jun 2021 18:34:23 +0530 Subject: [PATCH 060/279] corrected link as per user report issue #9742, so i corrected the link. all event ids 560, 562 , ....... all comes under **audit object access** --- .../audit-audit-the-access-of-global-system-objects.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md index 4015f85f3f..55abcdd744 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md @@ -79,7 +79,7 @@ All auditing capabilities are integrated in Group Policy. You can configure, dep To audit attempts to access global system objects, you can use one of two security audit policy settings: - [Audit Kernel Object](../auditing/audit-kernel-object.md) in Advanced Security Audit Policy Settings\\Object Access -- [Audit object access](../auditing/basic-audit-object-access.md) under Security Settings\\Local Policies\\Audit Policy +- [Audit Object Access](../auditing/basic-audit-object-access.md) under Security Settings\\Local Policies\\Audit Policy If possible, use the Advanced Security Audit Policy option to reduce the number of unrelated audit events that you generate. @@ -92,7 +92,7 @@ If the [Audit Kernel Object](../auditing/audit-kernel-object.md) setting is conf | 4661 | A handle to an object was requested. | | 4663 | An attempt was made to access an object. | -If the [Audit Kernel Object](../auditing/audit-kernel-object.md) setting is configured, the following events are generated: +If the [Audit Object Access](../auditing/basic-audit-object-access.md) setting is configured, the following events are generated: | Event ID | Event message | | - | - | From 3cc91638b91f73efcb650ff26887737485d41420 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 15:43:30 +0100 Subject: [PATCH 061/279] Create essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 301 ++++++++++++++++++ 1 file changed, 301 insertions(+) create mode 100644 windows/privacy/essential-services-and-connected-experiences.md diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md new file mode 100644 index 0000000000..b19454a5ab --- /dev/null +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -0,0 +1,301 @@ +--- +title: Essential Services and Connected Experiences for Windows 10 +description: This article provides information to help IT on the essential services and connected experiences for Windows 10. +keywords: privacy, GDPR, compliance +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +audience: ITPro +author: sosulli +ms.author: sosulli +manager: dansimp +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 28/06/2021 +--- + +# Essential Services and Connected Experiences for Windows 10 + +Applies to: + +- Windows 10, version 1903 and later + +Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Required service data is collected to enables us provide these cloud-based connected experiences and it's crucial to help keep them secure, up to date and performing properly. Windows diagnostic data is separate from required service data.For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). + +Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. + +While you can control many of the connected experiences that are available to you and your organization, we recommend that you carefully assess the impact of turning off essential services. + +Windows connected experiences and essential services transfer data to Microsoft network endpoints. The article [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) provides details about the different ways to control traffic to these endpoints. Where applicable, each connected experience or essential service includes a link to the specific details on how to control that traffic. + +>[!Note] +>The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. + +## Windows 10 Essential Services + +
Pro check mark
Businesscheck mark
Enterprise check markPro check mark6
Businesscheck mark6
Enterprise check mark6Pro check mark5
Businesscheck mark5
Enterprise check mark5Pro check mark
Businesscheck mark
Enterprise check markPro check mark
Businesscheck mark
Enterprise check markPro check mark2
Businesscheck mark2
Enterprise check mark2Pro check mark
Businesscheck mark
Enterprise check markPro check mark
Businesscheck mark
Enterprise check markPro check mark
Businesscheck mark
Enterprise check markPro check mark6
Businesscheck mark6
Enterprise check mark6Pro check mark
Businesscheck mark
Enterprise check markPro check mark
Businesscheck mark
Enterprise check markPro check mark5
Businesscheck mark5
Enterprise check mark5Pro check mark4
Businesscheck mark4
Enterprise check mark4Pro check mark4
Businesscheck mark4
Enterprise check mark4Pro check mark5
Businesscheck mark5
Enterprise check mark5Pro check mark5
Businesscheck mark5
Enterprise check mark5Pro check mark3
Businesscheck mark3
Enterprise check mark3Pro check mark2
Businesscheck mark2
Enterprise check mark2Pro check mark
Businesscheck mark
Enterprise check markPro check mark4
Businesscheck mark4
Enterprise check mark4Pro check mark3
Businesscheck mark3
Enterprise check mark3Pro check mark
Businesscheck mark
Enterprise check markPro check mark6
Businesscheck mark6
Enterprise check mark6
Procheck markcheck mark11
Enterprise
Procheck mark6check mark611
Enterprise
Procheck mark611check mark6 11
Enterprise
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Essential ServiceDescription
Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

+

To turn it off, see Microsoft Account

Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
+If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

+

To turn it off, see Automatic Root Certificates Update

Configuration Service Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

+

To turn it off, see Services Configuration.

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

+

To turn it off, see Date and Time

Licensing

Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.

+

To turn it off, see License Manager and Software Protection Platform.

Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

+

To turn off Network Adapters, see Disable-NetAdapter

Setup Service Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

+

To customize the initial setup experience, see Customize Setup

Telemetry

Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.

+

To turn it off, see Telemetry Services.

Windows Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

+

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

+

To turn it off, see Windows Update

+ +**Windows 10 Connected Experiences** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Connected ExperienceDescription
Device metadata retrieval

When Windows 10 detects a new device, it queries an online service called the Windows Metadata and Internet Services (WMIS) for a metadata package for the device. If a device metadata package is available on WMIS, the Device Metadata Retrieval Client (DMRC) that runs on the local device downloads and installs the package.

+

To turn it off, see Device Metadata Retrieval.

Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

+

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

+

By default, devices running Windows 10 will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

+

To turn it off, see Delivery Optimization.

Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

+

To turn it off, see Speech Recognition.

Find My Device

Find My Device is a feature that can help users locate their Windows 10 device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

+

To turn it off, see Find My Device.

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

+

To turn it off, see Windows Insider Program.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

+

To turn it off, see Location Services.

Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

+

To turn it off, see Microsoft Store.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

+

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

+

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

+

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

+

To turn it off, see Microsoft Defender SmartScreen.

Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account(including OneDrive, SharePoint, and other Microsoft services), and the internet.

+

To turn it off, see Windows Search.

Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

+

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

+

To turn it off, see Windows Spotlight.

Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

+

Synchronization across devices only works when a user signs in with the same account.

+

To turn it off, see Activity History.

Settings Synchronization

With settings synchronization is turned on, a user's settings are synced across all Windows 10 devices when they sign in with the same account.

+

To turn it off, see Sync Your Settings

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

+

To turn it off, see Cloud Clipboard

OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

+

To turn off OneDrive, see OneDrive.

Font Streaming

Font Streaming enables Windows 10 devices to download fonts that are included in Windows but that are not stored on the local device on demand.

+

To turn it off, see Font Streaming.

+ +**Edge Essential Services and Connected Experiences** + +Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. + +You can find details on all of Edge's connected experiences and essential services [here](https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/). + +To turn off specific Edge feature, see [Microsoft Edge](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). + +**IE Essential Services and Connected Experiences** + +Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. + +Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Connected ExperiencesDescription
ActiveX Filtering

ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.

+

ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.

+

To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls.

Suggested SitesSuggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.
Address Bar and Search suggestionsWith search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information it will be sent to the default search provider.
Auto-complete feature for web addressesThe auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar.
Compatibility loggingThis feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed.
Compatibility ViewCompatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing.
Flip aheadFlip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website.
Web SlicesA Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices.
Accelerators

Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.

+

For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word.

Pinning websites to StartWhen a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has.
+ +**Related links** + +[Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) + +[Connected Experiences in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/connected-experiences) + +[Essential Services in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/essential-services) + +To view endpoints for Windows 10 Enterprise, see: + +- + +- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) + +- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints) + +- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints) + +- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1803-endpoints) + +- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1709-endpoints) + +To view endpoints for non-Enterprise Windows 10 editions, see: + +- Windows 10, version 20H2, connection endpoints for non-Enterprise editions + +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) + +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1903-non-enterprise-editions) + +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions) + +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1803-non-enterprise-editions) + +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1709-non-enterprise-editions) From 32b7cf8dbc6f55f3891acf7c5c0d695c4f4933ef Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 15:58:53 +0100 Subject: [PATCH 062/279] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 100 +++++++++--------- 1 file changed, 50 insertions(+), 50 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index b19454a5ab..ae5024d5d3 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -8,12 +8,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high audience: ITPro -author: sosulli -ms.author: sosulli +author: siosulli +ms.author: siosulli manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 28/06/2021 +ms.date: 6/28/2021 --- # Essential Services and Connected Experiences for Windows 10 @@ -46,54 +46,54 @@ Windows connected experiences and essential services transfer data to Microsoft Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

-

To turn it off, see Microsoft Account

+

To turn it off, see Microsoft Account

Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

-

To turn it off, see Automatic Root Certificates Update

+

To turn it off, see Automatic Root Certificates Update

Configuration Service Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.

+

To turn it off, see Services Configuration.

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time

+

To turn it off, see Date and Time

Licensing

Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.

-

To turn it off, see License Manager and Software Protection Platform.

+

To turn it off, see License Manager and Software Protection Platform.

Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

-

To turn off Network Adapters, see Disable-NetAdapter

+

To turn off Network Adapters, see Disable-NetAdapter

Setup Service Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

-

To customize the initial setup experience, see Customize Setup

+

To customize the initial setup experience, see Customize Setup

Telemetry

Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.

-

To turn it off, see Telemetry Services.

+

To turn it off, see Telemetry Services.

Windows Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Windows Update

+

To turn it off, see Windows Update

-**Windows 10 Connected Experiences** +## Windows 10 Connected Experiences @@ -106,105 +106,105 @@ If automatic updates are turned off, applications and websites may stop working +

To turn it off, see Device Metadata Retrieval.

+

To turn it off, see Delivery Optimization.

+

To turn it off, see Speech Recognition.

+

To turn it off, see Find My Device.

+

To turn it off, see Windows Insider Program.

+

To turn it off, see Location Services.

+

To turn it off, see Microsoft Store.

+

To turn it off, see Microsoft Defender Antivirus.

+

To turn it off, see Microsoft Defender SmartScreen.

+

To turn it off, see Windows Search.

+

To turn it off, see Windows Spotlight.

+

To turn it off, see Activity History.

+

To turn it off, see Sync Your Settings

+

To turn it off, see Cloud Clipboard

+

To turn off OneDrive, see OneDrive.

+

To turn it off, see Font Streaming.

Device metadata retrieval

When Windows 10 detects a new device, it queries an online service called the Windows Metadata and Internet Services (WMIS) for a metadata package for the device. If a device metadata package is available on WMIS, the Device Metadata Retrieval Client (DMRC) that runs on the local device downloads and installs the package.

-

To turn it off, see Device Metadata Retrieval.
Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

By default, devices running Windows 10 will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

-

To turn it off, see Delivery Optimization.
Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

-

To turn it off, see Speech Recognition.
Find My Device

Find My Device is a feature that can help users locate their Windows 10 device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

-

To turn it off, see Find My Device.
Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.
Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

-

To turn it off, see Location Services.
Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

-

To turn it off, see Microsoft Store.
Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.
Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

-

To turn it off, see Microsoft Defender SmartScreen.
Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account(including OneDrive, SharePoint, and other Microsoft services), and the internet.

-

To turn it off, see Windows Search.
Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

-

To turn it off, see Windows Spotlight.
Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.
Settings Synchronization

With settings synchronization is turned on, a user's settings are synced across all Windows 10 devices when they sign in with the same account.

-

To turn it off, see Sync Your Settings
Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

-

To turn it off, see Cloud Clipboard
OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

-

To turn off OneDrive, see OneDrive.
Font Streaming

Font Streaming enables Windows 10 devices to download fonts that are included in Windows but that are not stored on the local device on demand.

-

To turn it off, see Font Streaming.
-**Edge Essential Services and Connected Experiences** +## Edge Essential Services and Connected Experiences Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. -You can find details on all of Edge's connected experiences and essential services [here](https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/). +You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper/). -To turn off specific Edge feature, see [Microsoft Edge](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). +To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). -**IE Essential Services and Connected Experiences** +## IE Essential Services and Connected Experiences Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. -Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). +Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). @@ -264,38 +264,38 @@ Note: Apart from ActiveX Filtering, which is an essential service, all other fea
-**Related links** +## Related links -[Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows 10 operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services) -[Connected Experiences in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/connected-experiences) +- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences) -[Essential Services in Office.](https://docs.microsoft.com/en-us/deployoffice/privacy/essential-services) +- [Essential Services in Office.](/deployoffice/privacy/essential-services) To view endpoints for Windows 10 Enterprise, see: -- +- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints) -- [Manage connection endpoints for Windows 10, version 20H2](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-20h2-endpoints)[Manage connection endpoints for Windows 10, version 1909](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1909-endpoints) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints) -- [Manage connection endpoints for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) -- [Manage connection endpoints for Windows 10, version 1809](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints) -- [Manage connection endpoints for Windows 10, version 1803](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1803-endpoints) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints) -- [Manage connection endpoints for Windows 10, version 1709](https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1709-endpoints) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints) To view endpoints for non-Enterprise Windows 10 editions, see: -- Windows 10, version 20H2, connection endpoints for non-Enterprise editions +- Windows 10, version 20H2, connection endpoints for non-Enterprise editions -- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1909-non-enterprise-editions) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions) -- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1903-non-enterprise-editions) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions) -- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1809-non-enterprise-editions) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions) -- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1803-non-enterprise-editions) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions) -- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](https://docs.microsoft.com/en-us/windows/privacy/windows-endpoints-1709-non-enterprise-editions) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions) From 920a6be5544faecf7c71b35fcc58abb9d9d391fc Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 16:13:09 +0100 Subject: [PATCH 063/279] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 48 ++++++++----------- 1 file changed, 21 insertions(+), 27 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index ae5024d5d3..a6f49de021 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -198,13 +198,13 @@ Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. M You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper/). -To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services#13-microsoft-edge). +To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). ## IE Essential Services and Connected Experiences Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. -Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services#8-internet-explorer). +Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#8-internet-explorer). @@ -266,36 +266,30 @@ Note: Apart from ActiveX Filtering, which is an essential service, all other fea ## Related links -- [Manage connections from Windows 10 operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Manage connections from Windows 10 operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences) +- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences.md) -- [Essential Services in Office.](/deployoffice/privacy/essential-services) +- [Essential Services in Office.](/deployoffice/privacy/essential-services.md) + +## Other Windows 10 editions To view endpoints for Windows 10 Enterprise, see: -- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints) - -- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints) - -- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) - -- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints) - -- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints) - -- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints) +- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md) +- [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) To view endpoints for non-Enterprise Windows 10 editions, see: -- Windows 10, version 20H2, connection endpoints for non-Enterprise editions - -- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions) - -- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions) - -- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions) - -- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions) - -- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions) +- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](manage-windows-20h2-endpoints.md) +- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md.md) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) From f23a81195983e60ab45ed29453efc575f44485ea Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 16:29:50 +0100 Subject: [PATCH 064/279] Update essential-services-and-connected-experiences.md --- .../essential-services-and-connected-experiences.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index a6f49de021..effda1cdb9 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -46,28 +46,28 @@ Windows connected experiences and essential services transfer data to Microsoft +

To turn it off, see Microsoft Account

+

To turn it off, see Automatic Root Certificates Update

+

To turn it off, see Services Configuration.

+

To turn it off, see Date and Time

+

To turn it off, see License Manager and Software Protection Platform.

@@ -77,7 +77,7 @@ If automatic updates are turned off, applications and websites may stop working +

To customize the initial setup experience, see Customize Setup

From 14e116c6ffe6f80bd2ef37c544854d76a84dd00f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 16:35:40 +0100 Subject: [PATCH 065/279] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index effda1cdb9..eeb9953de7 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -46,13 +46,13 @@ Windows connected experiences and essential services transfer data to Microsoft +

To turn it off, see Microsoft Account

+

To turn it off, see Automatic Root Certificates Update

@@ -82,13 +82,13 @@ If automatic updates are turned off, applications and websites may stop working +

To turn it off, see Telemetry Services.

+

To turn it off, see Windows Update

Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

-

To turn it off, see Microsoft Account
Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

-

To turn it off, see Automatic Root Certificates Update
Configuration Service Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.
Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time
Licensing

Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.

-

To turn it off, see License Manager and Software Protection Platform.
Networking
Setup Service Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

-

To customize the initial setup experience, see Customize Setup
Telemetry
Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

-

To turn it off, see Microsoft Account
Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

-

To turn it off, see Automatic Root Certificates Update
Configuration Service Services Configuration
Telemetry

Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.

-

To turn it off, see Telemetry Services.
Windows Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Windows Update
@@ -106,88 +106,88 @@ If automatic updates are turned off, applications and websites may stop working Device metadata retrieval

When Windows 10 detects a new device, it queries an online service called the Windows Metadata and Internet Services (WMIS) for a metadata package for the device. If a device metadata package is available on WMIS, the Device Metadata Retrieval Client (DMRC) that runs on the local device downloads and installs the package.

-

To turn it off, see Device Metadata Retrieval.

+

To turn it off, see Device Metadata Retrieval.

Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

By default, devices running Windows 10 will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

-

To turn it off, see Delivery Optimization.

+

To turn it off, see Delivery Optimization.

Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

-

To turn it off, see Speech Recognition.

+

To turn it off, see Speech Recognition.

Find My Device

Find My Device is a feature that can help users locate their Windows 10 device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

-

To turn it off, see Find My Device.

+

To turn it off, see Find My Device.

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.

+

To turn it off, see Windows Insider Program.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

-

To turn it off, see Location Services.

+

To turn it off, see Location Services.

Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

-

To turn it off, see Microsoft Store.

+

To turn it off, see Microsoft Store.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.

+

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

-

To turn it off, see Microsoft Defender SmartScreen.

+

To turn it off, see Microsoft Defender SmartScreen.

Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account(including OneDrive, SharePoint, and other Microsoft services), and the internet.

-

To turn it off, see Windows Search.

+

To turn it off, see Windows Search.

Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

-

To turn it off, see Windows Spotlight.

+

To turn it off, see Windows Spotlight.

Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.

+

To turn it off, see Activity History.

Settings Synchronization

With settings synchronization is turned on, a user's settings are synced across all Windows 10 devices when they sign in with the same account.

-

To turn it off, see Sync Your Settings

+

To turn it off, see Sync Your Settings

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

-

To turn it off, see Cloud Clipboard

+

To turn it off, see Cloud Clipboard

OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

-

To turn off OneDrive, see OneDrive.

+

To turn off OneDrive, see OneDrive.

Font Streaming

Font Streaming enables Windows 10 devices to download fonts that are included in Windows but that are not stored on the local device on demand.

-

To turn it off, see Font Streaming.

+

To turn it off, see Font Streaming.

From 9463ad848deeff7a0933e11584528a307f57f1a5 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 16:49:51 +0100 Subject: [PATCH 066/279] Update essential-services-and-connected-experiences.md --- .../essential-services-and-connected-experiences.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index eeb9953de7..c0255242e2 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -72,8 +72,8 @@ If automatic updates are turned off, applications and websites may stop working Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

-

To turn off Network Adapters, see Disable-NetAdapter

- +

To turn off Network Adapters, see Disable-NetAdapter

+ Setup Service Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

@@ -167,7 +167,7 @@ If automatic updates are turned off, applications and websites may stop working Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.

+

To turn it off, see Activity History.

Settings Synchronization @@ -287,7 +287,7 @@ To view endpoints for Windows 10 Enterprise, see: To view endpoints for non-Enterprise Windows 10 editions, see: - [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](manage-windows-20h2-endpoints.md) -- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md.md) +- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) - [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) - [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) - [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) From 5133474ae4de73b40857afd285a5cf408e0d2686 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 28 Jun 2021 09:48:04 -0700 Subject: [PATCH 067/279] I added the Getting started with commandlets section. --- .../select-types-of-rules-to-create.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index b3aeeaf2ec..ee3192a969 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -27,6 +27,13 @@ ms.technology: mde Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. +## Getting started with commdlets +Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module | Microsoft Docs)](powershell/module/configci) support but do not have the module installed on the box. + +**Steps to install the module:** +- Install-Module "ConfigCI" +- Import-Module "ConfigCI" + ## Windows Defender Application Control policy rules To modify the policy rule options of an existing WDAC policy XML, use [Set-RuleOption](/powershell/module/configci/set-ruleoption). The following examples show how to use this cmdlet to add and remove a rule option on an existing WDAC policy: From 6243c7987c3dbc7c8594428897aff7ced287c61f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 18:26:32 +0100 Subject: [PATCH 068/279] Update essential-services-and-connected-experiences.md --- .../essential-services-and-connected-experiences.md | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index c0255242e2..d887a20743 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -18,15 +18,13 @@ ms.date: 6/28/2021 # Essential Services and Connected Experiences for Windows 10 -Applies to: +**Applies to:** - Windows 10, version 1903 and later -Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. Required service data is collected to enables us provide these cloud-based connected experiences and it's crucial to help keep them secure, up to date and performing properly. Windows diagnostic data is separate from required service data.For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). -Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. - -While you can control many of the connected experiences that are available to you and your organization, we recommend that you carefully assess the impact of turning off essential services. +Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. While you can control many of the connected experiences that are available to you and your organization, we recommend that you carefully assess the impact of turning off essential services. Windows connected experiences and essential services transfer data to Microsoft network endpoints. The article [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) provides details about the different ways to control traffic to these endpoints. Where applicable, each connected experience or essential service includes a link to the specific details on how to control that traffic. @@ -55,7 +53,6 @@ If automatic updates are turned off, applications and websites may stop working

To turn it off, see Automatic Root Certificates Update

-Configuration Service Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

To turn it off, see Services Configuration.

@@ -73,9 +70,9 @@ If automatic updates are turned off, applications and websites may stop working Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

To turn off Network Adapters, see Disable-NetAdapter

- -Setup Service Device setup +Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

To customize the initial setup experience, see Customize Setup

From 6c795d046171f634cb9ce4dcff38fa7af202ad1a Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 18:28:01 +0100 Subject: [PATCH 069/279] updates-dpsw --- .../privacy/essential-services-and-connected-experiences.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index d887a20743..6248a9e940 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -229,10 +229,6 @@ Note: Apart from ActiveX Filtering, which is an essential service, all other fea Auto-complete feature for web addresses The auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar. - - - - Compatibility logging This feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed. From 6d52b9b2c51d029a930e117fa7a3b71fca4af698 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 18:34:15 +0100 Subject: [PATCH 070/279] Update essential-services-and-connected-experiences.md --- windows/privacy/essential-services-and-connected-experiences.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 6248a9e940..1e45b7afda 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -53,6 +53,7 @@ If automatic updates are turned off, applications and websites may stop working

To turn it off, see Automatic Root Certificates Update

+Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

To turn it off, see Services Configuration.

From 69c8580b7110cb2a8743e7c3f037fcd51c0b5578 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 20:21:59 +0100 Subject: [PATCH 071/279] Update essential-services-and-connected-experiences.md --- ...essential-services-and-connected-experiences.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 1e45b7afda..adb832d45c 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -22,7 +22,11 @@ ms.date: 6/28/2021 - Windows 10, version 1903 and later -Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. + +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. + +Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. While you can control many of the connected experiences that are available to you and your organization, we recommend that you carefully assess the impact of turning off essential services. @@ -55,7 +59,7 @@ If automatic updates are turned off, applications and websites may stop working Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.

+

To turn it off, see Services Configuration.

Date and Time @@ -116,7 +120,7 @@ If automatic updates are turned off, applications and websites may stop working Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

-

To turn it off, see Speech Recognition.

+

To turn it off, see Speech Recognition.

Find My Device @@ -126,7 +130,7 @@ If automatic updates are turned off, applications and websites may stop working Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.

+

To turn it off, see Windows Insider Program.

Location services @@ -142,7 +146,7 @@ If automatic updates are turned off, applications and websites may stop working Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.

+

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen From 4d4b75f0bc10e3d9ce65b83fe68e68261f6f6b79 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 20:35:29 +0100 Subject: [PATCH 072/279] Update essential-services-and-connected-experiences.md --- .../privacy/essential-services-and-connected-experiences.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index adb832d45c..71770ac219 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -24,7 +24,7 @@ ms.date: 6/28/2021 Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). @@ -59,12 +59,12 @@ If automatic updates are turned off, applications and websites may stop working Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.

+

To turn it off, see Services Configuration.

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time

+

To turn it off, see Date and Time

Licensing From 213795e4ba375fb38d95579d5c2a46cbf3f77d7a Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 20:42:06 +0100 Subject: [PATCH 073/279] Update essential-services-and-connected-experiences.md --- ...tial-services-and-connected-experiences.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 71770ac219..3e9c11626f 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -24,7 +24,7 @@ ms.date: 6/28/2021 Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experience. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. +When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). @@ -48,23 +48,23 @@ Windows connected experiences and essential services transfer data to Microsoft Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

-

To turn it off, see Microsoft Account

+

To turn it off, see Microsoft Account.

Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

-

To turn it off, see Automatic Root Certificates Update

+

To turn it off, see Automatic Root Certificates Update.

Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.

+

To turn it off, see Services Configuration.

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time

+

To turn it off, see Date and Time

Licensing @@ -74,12 +74,12 @@ If automatic updates are turned off, applications and websites may stop working Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

-

To turn off Network Adapters, see Disable-NetAdapter

+

To turn off Network Adapters, see Disable-NetAdapter.

Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

-

To customize the initial setup experience, see Customize Setup

+

To customize the initial setup experience, see Customize Setup.

Telemetry @@ -90,7 +90,7 @@ If automatic updates are turned off, applications and websites may stop working Windows Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Windows Update

+

To turn it off, see Windows Update.

@@ -115,38 +115,38 @@ If automatic updates are turned off, applications and websites may stop working

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

By default, devices running Windows 10 will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

-

To turn it off, see Delivery Optimization.

+

To turn it off, see Delivery Optimization.

Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

-

To turn it off, see Speech Recognition.

+

To turn it off, see Speech Recognition.

Find My Device

Find My Device is a feature that can help users locate their Windows 10 device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

-

To turn it off, see Find My Device.

+

To turn it off, see Find My Device.

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.

+

To turn it off, see Windows Insider Program.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

-

To turn it off, see Location Services.

+

To turn it off, see Location Services.

Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

-

To turn it off, see Microsoft Store.

+

To turn it off, see Microsoft Store.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.

+

To turn it off, see Microsoft Defender Antivirus..

Microsoft Defender SmartScreen @@ -163,23 +163,23 @@ If automatic updates are turned off, applications and websites may stop working Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

-

To turn it off, see Windows Spotlight.

+

To turn it off, see Windows Spotlight.

Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.

+

To turn it off, see Activity History..

Settings Synchronization

With settings synchronization is turned on, a user's settings are synced across all Windows 10 devices when they sign in with the same account.

-

To turn it off, see Sync Your Settings

+

To turn it off, see Sync Your Settings.

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

-

To turn it off, see Cloud Clipboard

+

To turn it off, see Cloud Clipboard.

OneDrive From 7817b987f75462c82fc7d34787be04d87fddc23c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 28 Jun 2021 20:48:22 +0100 Subject: [PATCH 074/279] Update essential-services-and-connected-experiences.md --- .../essential-services-and-connected-experiences.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 3e9c11626f..edb5b8d8af 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -52,8 +52,8 @@ Windows connected experiences and essential services transfer data to Microsoft Certificates -

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.
-If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

+

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.

+

If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

To turn it off, see Automatic Root Certificates Update.

@@ -146,7 +146,7 @@ If automatic updates are turned off, applications and websites may stop working Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus..

+

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen @@ -169,7 +169,7 @@ If automatic updates are turned off, applications and websites may stop working Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History..

+

To turn it off, see Activity History.

Settings Synchronization From 6c2c743438e594ae16a330447e065e3a41ad08f5 Mon Sep 17 00:00:00 2001 From: Joe Davies Date: Mon, 28 Jun 2021 16:04:52 -0700 Subject: [PATCH 075/279] Removal of ransomware-malware article --- .openpublishing.redirection.json | 5 ++ windows/security/threat-protection/TOC.yml | 2 +- .../threat-protection/intelligence/TOC.yml | 2 +- .../intelligence/criteria.md | 2 +- .../intelligence/phishing-trends.md | 2 +- .../intelligence/ransomware-malware.md | 77 ------------------- .../intelligence/understanding-malware.md | 2 +- .../ltsc/whats-new-windows-10-2019.md | 1 - 8 files changed, 10 insertions(+), 83 deletions(-) delete mode 100644 windows/security/threat-protection/intelligence/ransomware-malware.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 8dbea776cc..25d94e8125 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18920,6 +18920,11 @@ "redirect_url": "/microsoft-365/security/defender-endpoint/device-control-report", "redirect_document_id": false }, + { + "source_path": "windows/security/threat-protection/intelligence/ransomware-malware.md", + "redirect_url": "/security/compass/human-operated-ransomware", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md", "redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows", diff --git a/windows/security/threat-protection/TOC.yml b/windows/security/threat-protection/TOC.yml index e310d0d993..60b48e0739 100644 --- a/windows/security/threat-protection/TOC.yml +++ b/windows/security/threat-protection/TOC.yml @@ -193,7 +193,7 @@ - name: Phishing href: intelligence/phishing.md - name: Ransomware - href: intelligence/ransomware-malware.md + href: /security/compass/human-operated-ransomware - name: Rootkits href: intelligence/rootkits-malware.md - name: Supply chain attacks diff --git a/windows/security/threat-protection/intelligence/TOC.yml b/windows/security/threat-protection/intelligence/TOC.yml index eb239b51c5..78fea4eba3 100644 --- a/windows/security/threat-protection/intelligence/TOC.yml +++ b/windows/security/threat-protection/intelligence/TOC.yml @@ -18,7 +18,7 @@ - name: Phishing trends and techniques href: phishing-trends.md - name: Ransomware - href: ransomware-malware.md + href: /security/compass/human-operated-ransomware - name: Rootkits href: rootkits-malware.md - name: Supply chain attacks diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md index 8f05e1c296..381dc66ce4 100644 --- a/windows/security/threat-protection/intelligence/criteria.md +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -62,7 +62,7 @@ Microsoft classifies most malicious software into one of the following categorie * **Password stealer:** A type of malware that gathers your personal information, such as usernames and passwords. It often works along with a keylogger, which collects and sends information about the keys you press and websites you visit. -* **Ransomware:** A type of malware that encrypts your files or makes other modifications that can prevent you from using your device. It then displays a ransom note that states you must pay money or perform other actions before you can use your device again. [See more information about ransomware](ransomware-malware.md). +* **Ransomware:** A type of malware that encrypts your files or makes other modifications that can prevent you from using your device. It then displays a ransom note that states you must pay money or perform other actions before you can use your device again. [See more information about ransomware](/security/compass/human-operated-ransomware). * **Rogue security software:** Malware that pretends to be security software but doesn't provide any protection. This type of malware usually displays alerts about nonexistent threats on your device. It also tries to convince you to pay for its services. diff --git a/windows/security/threat-protection/intelligence/phishing-trends.md b/windows/security/threat-protection/intelligence/phishing-trends.md index 9645672acd..1785d95a38 100644 --- a/windows/security/threat-protection/intelligence/phishing-trends.md +++ b/windows/security/threat-protection/intelligence/phishing-trends.md @@ -41,7 +41,7 @@ An attacker sends a fraudulent email requesting you to open or download a docume ## Phishing emails that deliver other threats -Phishing emails are often effective, so attackers sometimes use them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files. +Phishing emails are often effective, so attackers sometimes use them to distribute [ransomware](/security/compass/human-operated-ransomware) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files. We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites. These websites use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems. diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md deleted file mode 100644 index 5a04348f87..0000000000 --- a/windows/security/threat-protection/intelligence/ransomware-malware.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: Ransomware -ms.reviewer: -description: Learn how to protect your computer and network from ransomware attacks, which can stop you from accessing your files. -keywords: security, malware, ransomware, encryption, extortion, money, key, infection, prevention, tips, WDSI, MMPC, Microsoft Malware Protection Center, ransomware-as-a-service, ransom, ransomware downloader, protection, prevention, solution, exploit kits, backup, Cerber, Locky, WannaCry, WannaCrypt, Petya, Spora -ms.prod: m365-security -ms.mktglfcycl: secure -ms.sitesec: library -ms.localizationpriority: medium -ms.author: dansimp -author: dansimp -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -search.appverid: met150 -ms.technology: mde ---- -# Ransomware - -Ransomware is a type of malware that encrypts files and folders, preventing access to important files. Ransomware attempts to extort money from victims by asking for money, usually in form of cryptocurrencies, in exchange for the decryption key. But cybercriminals won't always follow through and unlock the files they encrypted. - -The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms especially susceptible to ransomware attacks. - -## How ransomware works - -Most ransomware infections start with: - -- Email messages with attachments that try to install ransomware. - -- Websites hosting [exploit kits](exploits-malware.md) that attempt to use vulnerabilities in web browsers and other software to install ransomware. - -Once ransomware infects a device, it starts encrypting files, folders, entire hard drive partitions using encryption algorithms like RSA or RC4. - -Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model where malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is big business at the expense of individuals and businesses. - -### Examples - -Sophisticated ransomware like **Spora**, **WannaCrypt** (also known as WannaCry), and **Petya** (also known as NotPetya) spread to other computers via network shares or exploits. - -- Spora drops ransomware copies in network shares. - -- WannaCrypt exploits the Server Message Block (SMB) vulnerability CVE-2017-0144 (also called EternalBlue) to infect other computers. - -- A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks. - -Older ransomware like **Reveton** (nicknamed "Police Trojan" or "Police ransomware") locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they're effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and a fine needs to be paid. - -Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files. - -**Bad Rabbit** ransomware was discovered attempting to spread across networks using hardcoded usernames and passwords in brute force attacks. - -## How to protect against ransomware - -Organizations can be targeted specifically by attackers, or they can be caught in the wide net cast by cybercriminal operations. Large organizations are high value targets because attackers can demand bigger ransoms. - -To provide the best protection against ransomware attacks, Microsoft recommends that you: - -- Back up important files regularly. Use the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite. - -- Apply the latest updates to your operating systems and apps. - -- Educate your employees so they can identify social engineering and spear-phishing attacks. - -- [Implement controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). It can stop ransomware from encrypting files and holding the files for ransom. - -For more general tips, see [prevent malware infection](prevent-malware-infection.md). - -## Human-operated ransomware - -Unlike auto-spreading ransomware like WannaCry or NotPetya, human-operated ransomware is the result of active and ongoing attacks that target an organization rather than a single device. Cybercriminals use their knowledge of common system and security misconfigurations and vulnerabilities to infiltrate the organization, navigate the enterprise network, adapt to the environment, and exploit its weaknesses as they go. - -Hallmarks of these human-operated ransomware attacks typically include credential theft and lateral movement and can result in deployment of ransomware payloads to high business impact resources that attackers choose. Once deployed, the attackers contact the organization with their ransom demands. - -The same primary prevention techniques described in this article should be implemented to prevent human-operated ransomware. For additional preventative measures against human-operated ransomware, see this [article](/security/compass/human-operated-ransomware). - -See [this blog post](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/) from the Microsoft 365 Defender Threat Intelligence Team for more information and attack chain analysis of actual human-operated ransomware attacks. diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md index 63477837e9..f98d44ceb7 100644 --- a/windows/security/threat-protection/intelligence/understanding-malware.md +++ b/windows/security/threat-protection/intelligence/understanding-malware.md @@ -32,7 +32,7 @@ There are many types of malware, including: - [Exploits and exploit kits](exploits-malware.md) - [Macro malware](macro-malware.md) - [Phishing](phishing.md) -- [Ransomware](ransomware-malware.md) +- [Ransomware](/security/compass/human-operated-ransomware) - [Rootkits](rootkits-malware.md) - [Supply chain attacks](supply-chain-malware.md) - [Tech support scams](support-scams.md) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index cd82d2c618..b9b73c1bcb 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -141,7 +141,6 @@ This also means you’ll see more links to other security apps within **Windows You can read more about ransomware mitigations and detection capability at: - [Averting ransomware epidemics in corporate networks with Microsoft Defender for Endpoint](https://blogs.technet.microsoft.com/mmpc/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/) -- [Ransomware security intelligence](/windows/security/threat-protection/intelligence/ransomware-malware) - [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/) Also see [New capabilities of Microsoft Defender for Endpoint further maximizing the effectiveness and robustness of endpoint security](https://blogs.windows.com/business/2018/04/17/new-capabilities-of-windows-defender-atp-further-maximizing-the-effectiveness-and-robustness-of-endpoint-security/#62FUJ3LuMXLQidVE.97) From 86c3b2f3618f0fc57c970fbef3ea98156e732255 Mon Sep 17 00:00:00 2001 From: Joe Davies Date: Mon, 28 Jun 2021 16:06:14 -0700 Subject: [PATCH 076/279] Update whats-new-windows-10-version-1703.md --- windows/whats-new/whats-new-windows-10-version-1703.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 2c639ff2a3..b05bba2289 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -150,7 +150,7 @@ New features for Microsoft Defender AV in Windows 10, version 1703 include: In Windows 10, version 1607, we [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment in version 1703 with [updated behavior monitoring and always-on real-time protection](/windows/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). -You can read more about ransomware mitigations and detection capability in Microsoft Defender AV in the [ransomware information topic](/windows/security/threat-protection/intelligence/ransomware-malware) and at the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). +You can read more about ransomware mitigations and detection capability in Microsoft Defender AV in the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). ### Device Guard and Credential Guard From f5fb120b36094e6a5ee3bcf57a2da0890a15cc62 Mon Sep 17 00:00:00 2001 From: Joe Davies Date: Mon, 28 Jun 2021 16:10:22 -0700 Subject: [PATCH 077/279] Update whats-new-windows-10-2019.md --- windows/whats-new/ltsc/whats-new-windows-10-2019.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index b9b73c1bcb..2b62e7fc98 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -36,7 +36,7 @@ The Windows 10 Enterprise LTSC 2019 release is an important release for LTSC use ## Microsoft Intune -Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. This includes support for features such as [Windows Autopilot](#windows-autopilot). However, note that Windows 10 Update Rings Device profiles do not support LTSC releases, therefore you should use [Policy configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update), WSUS, or Configuration Manager for patching. +Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. This includes support for features such as [Windows Autopilot](#windows-autopilot). However, note that Windows 10 Update Rings Device profiles do not support LTSC releases, therefore you should use [Policy configuration service provider](/windows/client-management/mdm/policy-csp-update), WSUS, or Configuration Manager for patching. ## Security From 31939be3bc76a31327092f1d4b8c7831ac0356ad Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 28 Jun 2021 17:41:55 -0700 Subject: [PATCH 078/279] Corrected note styles, adjusted layout, added punctuation, minor fixes --- .../hello-feature-pin-reset.md | 41 +++++++++++++------ .../threat-protection/auditing/event-4627.md | 15 ++++--- 2 files changed, 38 insertions(+), 18 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index c772362fa2..6d78a9e26b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -50,17 +50,17 @@ Destructive and non-destructive PIN reset use the same entry points for initiati For Azure AD joined devices: 1. If the PIN credential provider is not selected, expand the **Sign-in options** link, and select the PIN pad icon. -1. Click **I forgot my PIN** from the PIN credential provider -1. Select an authentication option from the list of presented options. This list will be based on the different authentication methods enabled in your tenant (i.e. Password, PIN, Security key) -1. Follow the instructions provided by the provisioning process +1. Click **I forgot my PIN** from the PIN credential provider. +1. Select an authentication option from the list of presented options. This list will be based on the different authentication methods enabled in your tenant (i.e., Password, PIN, Security key). +1. Follow the instructions provided by the provisioning process. 1. When finished, unlock your desktop using your newly created PIN. For Hybrid Azure AD joined devices: 1. If the PIN credential provider is not selected, expand the **Sign-in options** link, and select the PIN pad icon. -1. Click **I forgot my PIN** from the PIN credential provider +1. Click **I forgot my PIN** from the PIN credential provider. 1. Enter your password and press enter. -1. Follow the instructions provided by the provisioning process +1. Follow the instructions provided by the provisioning process. 1. When finished, unlock your desktop using your newly created PIN. > [!NOTE] @@ -94,13 +94,20 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se ### Connect Azure Active Directory with the PIN reset service 1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. + 1. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. + ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) + 1. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. + 1. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. - ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) - > [!NOTE] - > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. + + ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) + + > [!NOTE] + > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. + 1. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. > [!div class="mx-imgBorder"] @@ -122,7 +129,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 1. Set **Enable PIN recovery** to **Yes**. > [!NOTE] -> You can also setup PIN recovery using configuration profiles. +> You can also set up PIN recovery using configuration profiles. > > 1. Sign in to Endpoint Manager. > 1. Click **Devices** > **Configuration Profiles** > Create a new profile or edit an existing profile using the Identity Protection profile type. @@ -141,7 +148,7 @@ The PIN reset configuration for a user can be viewed by running [**dsregcmd /sta #### Sample User state Output for Destructive PIN Reset -``` +```console +----------------------------------------------------------------------+ | User State | +----------------------------------------------------------------------+ @@ -160,7 +167,7 @@ The PIN reset configuration for a user can be viewed by running [**dsregcmd /sta #### Sample User state Output for Non-Destructive PIN Reset -``` +```console +----------------------------------------------------------------------+ | User State | +----------------------------------------------------------------------+ @@ -189,21 +196,29 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au ### Configuring Policy Using Intune 1. Sign-in to [Endpoint Manager admin center](https://endpoint.microsoft.com/) using a Global administrator account. + 1. Click **Devices**. Click **Configuration profiles**. Click **Create profile**. + 1. For Platform select **Windows 10 and later** and for Profile type select **Templates**. In the list of templates that is loaded, select **Custom** and click Create. + 1. In the **Name** field type **Web Sign In Allowed URLs** and optionally provide a description for the configuration. Click Next. + 1. On the Configuration settings page, click **Add** to add a custom OMA-URI setting. Provide the following information for the custom settings + - **Name:** Web Sign In Allowed URLs - **Description:** (Optional) List of domains that are allowed during PIN reset flows. - **OMA-URI:** ./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls - **Data type:** String - - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be signin.contoso.com;portal.contoso.com (no double quotes) + - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be _signin.contoso.com;portal.contoso.com_ (without quotation marks) - ![Custom Configuration for ConfigureWebSignInAllowedUrls policy](images/pinreset/allowlist.png) + :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy" source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: 1. Click the Save button to save the custom configuration. + 1. On the Assignments page, use the Included groups and Excluded groups sections to define the groups of users or devices that should receive this policy. Once you have completed configuring groups click the Next button. + 1. On the Applicability rules page, click Next. + 1. Review the configuration that is shown on the Review + create page to make sure that it is accurate. Click create to save the profile and apply it to the configured groups. > [!NOTE] diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 0ae5e51990..8831845dfa 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -33,12 +33,14 @@ You must also enable the Success audit for [Audit Logon](audit-logon.md) subcate Multiple events are generated if the group membership information cannot fit in a single security audit event. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
***Event XML:*** -``` + +```xml - - @@ -86,7 +88,8 @@ Multiple events are generated if the group membership information cannot fit in - **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). +> [!NOTE] +> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon or invokes it. @@ -122,7 +125,8 @@ Multiple events are generated if the group membership information cannot fit in - **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). +> [!NOTE] +> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed. @@ -148,7 +152,8 @@ Multiple events are generated if the group membership information cannot fit in For 4627(S): Group membership information. -> **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). +> [!IMPORTANT] +> For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). - Typically this action is reported by the NULL SID account, so we recommend reporting all events with **“Subject\\Security ID”** not equal “**NULL SID**”. From f3348d35ac9613cb2b4142d1aaf6411cbd2c0032 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 28 Jun 2021 19:05:04 -0700 Subject: [PATCH 079/279] Acrolinx "multi-factor " --- .../hello-for-business/hello-feature-pin-reset.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 6d78a9e26b..154ea379e1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -23,7 +23,7 @@ ms.reviewer: - Windows 10, version 1709 or later -Windows Hello for Business provides the capability for users to reset forgotten PINs using the "I forgot my PIN link" from the Sign-in options page in Settings or from above the lock screen. User's are required to authenticate and complete multi-factor authentication to reset their PIN. +Windows Hello for Business provides the capability for users to reset forgotten PINs using the "I forgot my PIN link" from the Sign-in options page in Settings or from above the lock screen. User's are required to authenticate and complete multifactor authentication to reset their PIN. There are two forms of PIN reset called destructive and non-destructive. Destructive PIN reset is the default and does not require configuration. During a destructive PIN reset, the user's existing PIN and underlying credentials, including any keys or certificates added to their Windows Hello container, will be deleted from the client and a new logon key and PIN are provisioned. For non-destructive PIN reset, you must deploy the Microsoft PIN reset service and client policy to enable the PIN recovery feature. During a non-destructive PIN reset, the user's Windows Hello for Business container and keys are preserved, but the user's PIN that they use to authorize key usage is changed. @@ -79,7 +79,7 @@ Visit the [Windows Hello for Business Videos](./hello-videos.md) page and watch - Azure AD registered, Azure AD joined, and Hybrid Azure AD joined - Windows 10, version 1709 to 1809, **Enterprise Edition**. There is no licensing requirement for this feature since version 1903. -When non-destructive PIN reset is enabled on a client, a 256-bit AES key is generated locally and added to a user's Windows Hello for Business container and keys as the PIN reset protector. This PIN reset protector is encrypted using a public key retrieved from the Microsoft PIN reset service and then stored on the client for later use during PIN reset. After a user initiates a PIN reset, completes authentication to Azure, and completes multi-factor authentication, the encrypted PIN reset protector is sent to the Microsoft PIN reset service, decrypted, and returned to the client. The decrypted PIN reset protector is used to change the PIN used to authorize Windows Hello for Business keys and it is then cleared from memory. +When non-destructive PIN reset is enabled on a client, a 256-bit AES key is generated locally and added to a user's Windows Hello for Business container and keys as the PIN reset protector. This PIN reset protector is encrypted using a public key retrieved from the Microsoft PIN reset service and then stored on the client for later use during PIN reset. After a user initiates a PIN reset, completes authentication to Azure, and completes multifactor authentication, the encrypted PIN reset protector is sent to the Microsoft PIN reset service, decrypted, and returned to the client. The decrypted PIN reset protector is used to change the PIN used to authorize Windows Hello for Business keys and it is then cleared from memory. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. From bed8791d8c1c644bd1f85cba485d4244bcfc2b7d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 28 Jun 2021 19:07:34 -0700 Subject: [PATCH 080/279] Add option for lightbox view --- .../hello-for-business/hello-feature-pin-reset.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 154ea379e1..0ecc622ba4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -110,8 +110,7 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 1. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. - > [!div class="mx-imgBorder"] - > ![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) + :::image type="content" alt-text="PIN reset service permissions page" source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: ### Configure Windows devices to use PIN reset using Group Policy From 29f9abbe8a1f1765aa6cac4f6da234a27788fae3 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 28 Jun 2021 19:11:51 -0700 Subject: [PATCH 081/279] Indented list item and content in list items --- .../threat-protection/auditing/event-4627.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 8831845dfa..4a4fce1919 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -88,8 +88,8 @@ Multiple events are generated if the group membership information cannot fit in - **Security ID** \[Type = SID\]**:** SID of account that reported information about successful logon or invokes it. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> [!NOTE] -> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account that reported information about successful logon or invokes it. @@ -107,10 +107,10 @@ Multiple events are generated if the group membership information cannot fit in - **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.” -**Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field: +- **Logon Type** \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field: -| Logon Type | Logon Title | Description | -|------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Logon Type | Logon Title | Description | +|------------|-------------------|----------------------| | 2 | Interactive | A user logged on to this computer. | | 3 | Network | A user or computer logged on to this computer from the network. | | 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | @@ -125,8 +125,8 @@ Multiple events are generated if the group membership information cannot fit in - **Security ID** \[Type = SID\]**:** SID of account for which logon was performed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -> [!NOTE] -> A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). - **Account Name** \[Type = UnicodeString\]**:** the name of the account for which logon was performed. From 87b9f5377dcd60cc32db75e6c80bf096cfdf0728 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 29 Jun 2021 09:31:40 +0530 Subject: [PATCH 082/279] removed invalid link , added correct link as per user report issue #9747 , so I added correct link and removed invalid link --- windows/client-management/connect-to-remote-aadj-pc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 89776f9222..9de7a6f1c2 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -87,4 +87,4 @@ The table below lists the supported configurations for remotely connecting to an ## Related topics -[How to use Remote Desktop](https://support.microsoft.com/instantanswers/ff521c86-2803-4bc0-a5da-7df445788eb9/how-to-use-remote-desktop) \ No newline at end of file +[How to use Remote Desktop](https://support.microsoft.com/en-us/windows/how-to-use-remote-desktop-5fe128d5-8fb1-7a23-3b8a-41e636865e8c) From 4991d4fcf561c25e7dce64ef278f213db686ca64 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 29 Jun 2021 10:46:21 +0100 Subject: [PATCH 083/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...perating-system-components-to-microsoft-services.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 2e5dcae25d..e4aef3529a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -295,7 +295,7 @@ You can also apply the Group Policies using the following registry keys: > [!IMPORTANT] > Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. -1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Microsoft Defender Antivirus Firewall with Advanced Security** > **Microsoft Defender Antivirus Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. +1. Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**. 2. Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts. @@ -427,7 +427,7 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar.
**Set Value to: Disabled**| | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar.
**Set Value to: Enabled**
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
**Set Value to: Enabled**| -| Prevent managing Microsoft Defender Antivirus SmartScreen | Choose whether employees can manage the Microsoft Defender Antivirus SmartScreen in Internet Explorer.
**Set Value to: Enabled** and then set **Select Microsoft Defender Antivirus SmartScreen mode** to **Off**.| +| Prevent managing Microsoft Defender SmartScreen | Choose whether employees can manage the Microsoft Defender SmartScreen in Internet Explorer.
**Set Value to: Enabled** and then set **Select Windows Defender SmartScreen mode** to **Off**.| | Registry Key | Registry path | @@ -436,7 +436,7 @@ To turn off Insider Preview builds for Windows 10: | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
REG_DWORD: AllowServicePoweredQSA
**Set Value to: 0**| | Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete
REG_SZ: AutoSuggest
Set Value to: **no** | | Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
REG_DWORD: PolicyDisableGeolocation
**Set Value to: 1** | -| Prevent managing Microsoft Defender Antivirus SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
**Set Value to: 0** | +| Prevent managing Microsoft Defender SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
REG_DWORD: EnabledV9
**Set Value to: 0** | There are more Group Policy objects that are used by Internet Explorer: @@ -573,7 +573,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Configure Do Not Track | Choose whether employees can send Do Not Track headers.
**Set to Enabled** | | Configure Password Manager | Choose whether employees can save passwords locally on their devices.
**Set to Disabled** | | Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
**Set to Disabled** | -| Configure Microsoft Defender Antivirus SmartScreen (Windows 10, version 1703) | Choose whether Microsoft Defender Antivirus SmartScreen is turned on or off.
**Set to Disabled** | +| Configure Microsoft Defender SmartScreen (Windows 10, version 1703) | Choose whether Microsoft Defender SmartScreen is turned on or off.
**Set to Disabled** | | Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | | Configure Start pages | Choose the Start page for domain-joined devices.
**Enabled** and **Set this to <>** | | Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage.
**Set to: Enable** | @@ -589,7 +589,7 @@ Alternatively, you can configure the following Registry keys as described: | Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: **1** | | Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **No** | | Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: **0**| -| Configure Microsoft Defender Antivirus SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | +| Configure Microsoft Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | | Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: AllowWebContentOnNewTabPage
Value: **0** | | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
REG_SZ name: ProvisionedHomePages
Value: **<>**| | Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: PreventFirstRunPage
Value: **1**| From 7c1681a7cd620e9ac8eee39d242d162a951e8ec0 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 29 Jun 2021 11:08:19 +0100 Subject: [PATCH 084/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...ng-system-components-to-microsoft-services.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index e4aef3529a..da8ed579e1 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -573,7 +573,7 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Configure Do Not Track | Choose whether employees can send Do Not Track headers.
**Set to Enabled** | | Configure Password Manager | Choose whether employees can save passwords locally on their devices.
**Set to Disabled** | | Configure search suggestions in Address Bar | Choose whether the Address Bar shows search suggestions.
**Set to Disabled** | -| Configure Microsoft Defender SmartScreen (Windows 10, version 1703) | Choose whether Microsoft Defender SmartScreen is turned on or off.
**Set to Disabled** | +| Configure Windows Defender SmartScreen (Windows 10, version 1703) | Choose whether Microsoft Defender SmartScreen is turned on or off.
**Set to Disabled** | | Allow web content on New Tab page | Choose whether a new tab page appears.
**Set to Disabled** | | Configure Start pages | Choose the Start page for domain-joined devices.
**Enabled** and **Set this to <>** | | Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage.
**Set to: Enable** | @@ -589,7 +589,7 @@ Alternatively, you can configure the following Registry keys as described: | Configure Do Not Track | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: DoNotTrack
REG_DWORD: **1** | | Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_SZ name: FormSuggest Passwords
REG_SZ: **No** | | Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
REG_DWORD name: ShowSearchSuggestionsGlobal
Value: **0**| -| Configure Microsoft Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | +| Configure Windows Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
REG_DWORD name: EnabledV9
Value: **0** | | Allow web content on New Tab page | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
REG_DWORD name: AllowWebContentOnNewTabPage
Value: **0** | | Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
REG_SZ name: ProvisionedHomePages
Value: **<>**| | Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
REG_DWORD name: PreventFirstRunPage
Value: **1**| @@ -917,7 +917,7 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin - Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one). -To turn off **Turn on Microsoft Defender Antivirus SmartScreen to check web content (URLs) that Microsoft Store apps use**: +To turn off **Turn on Microsoft Defender SmartScreen to check web content (URLs) that Microsoft Store apps use**: - Turn off the feature in the UI. @@ -1691,21 +1691,21 @@ You can turn off **Enhanced Notifications** as follows: - Create a new REG_DWORD registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** and enter the decimal value **1**. -### 24.1 Microsoft Defender Antivirus SmartScreen +### 24.1 Microsoft Defender SmartScreen -To disable Microsoft Defender Antivirus SmartScreen: +To disable Microsoft Defender SmartScreen: In Group Policy, configure: -- **Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus SmartScreen > Explorer > Configure Microsoft Defender Antivirus SmartScreen** to be **Disabled** +- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** to be **Disabled** -and- -- **Computer Configuration > Administrative Templates > Windows Components > File Explorer > Configure Microsoft Defender Antivirus SmartScreen** : **Disable** +- **Computer Configuration > Administrative Templates > Windows Components > File Explorer > Configure Windows Defender SmartScreen** : **Disable** -and- -- **Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations** +- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations** -OR- From 54678d570858669b6ca439c703746fb1b8b40e1c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 29 Jun 2021 11:21:30 +0100 Subject: [PATCH 085/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index da8ed579e1..fcadb6f4e3 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1936,7 +1936,7 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre ### 30. Cloud Clipboard -Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access. Also, when this is allowed, a new clipboard item on the cloud is downloaded to a device so that user can paste on the device. +Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access it. Clipboard items in the cloud can be downloaded and pasted across your Windows 10 devices. Most restricted value is 0. From a2b22b9e83bfaab9faf72a0098df0be3f622455c Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 29 Jun 2021 17:41:56 +0530 Subject: [PATCH 086/279] typo correction as per user report issue #9750 , so I corrected word --- .../bitlocker/bitlocker-network-unlock-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml index 17c1035e0b..10287fc220 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml @@ -35,6 +35,6 @@ sections: BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it. Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is - not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network. + not available you will need to use the recovery key to unlock the computer if it can not be connected to the network. For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). From 0cff94693ae41c30ebb1b4924655ccdb51cd2942 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 29 Jun 2021 19:17:31 +0530 Subject: [PATCH 087/279] Update windows/client-management/connect-to-remote-aadj-pc.md thanks for pointing out. Today I forgotted to remove localisation. Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/client-management/connect-to-remote-aadj-pc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 9de7a6f1c2..275869bf99 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -87,4 +87,4 @@ The table below lists the supported configurations for remotely connecting to an ## Related topics -[How to use Remote Desktop](https://support.microsoft.com/en-us/windows/how-to-use-remote-desktop-5fe128d5-8fb1-7a23-3b8a-41e636865e8c) +[How to use Remote Desktop](https://support.microsoft.com/windows/how-to-use-remote-desktop-5fe128d5-8fb1-7a23-3b8a-41e636865e8c) From 72e5c293c3d9b20db903c059c860342b52af49dd Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 29 Jun 2021 09:36:42 -0700 Subject: [PATCH 088/279] hardware req --- windows/whats-new/windows-11-requirements.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index 8c87b2c454..54e1400de4 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -38,7 +38,7 @@ To install or upgrade to Windows 11, devices must meet the following minimum har - Internet connection: Internet connectivity is necessary to perform updates, and to download and use some features. - Windows 11 Home edition requires an Internet connection and a Microsoft Account to complete device setup on first use. -\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-10-specifications#primaryR5). +\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). Also see [Update on Windows 11 minimum system requirements] (https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). For information about tools to evaluate readiness, see [Determine eligibility](windows-11-plan.md#determine-eligibility). @@ -86,5 +86,6 @@ Some features in Windows 11 have requirements beyond those listed above. See the ## See also +[Windows minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview)
[Windows 11 overview](windows-11.md) From 931d5be5a65a7fbcb72d4c60a47169e82f46a617 Mon Sep 17 00:00:00 2001 From: Saurabh Koshta Date: Tue, 29 Jun 2021 11:51:33 -0500 Subject: [PATCH 089/279] Update bitlocker-csp.md https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5707 greg-lindsay commented on Dec 18, 2019 @lXbalanque I understand the issue :) I've confirmed that the MDM stack (Intune profile settings) currently supports only used space encryption. You can probably see that by going through all the settings that you've shown above. There is no available choice for "encrypt entire drive" or "full encryption" even though there are a lot of other settings. --- windows/client-management/mdm/bitlocker-csp.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index f19bba4d59..e9bd144485 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -172,6 +172,10 @@ If you want to disable this policy, use the following SyncML: ``` + +> [!NOTE] +> Currently only used space encryption is supported when using this CSP. + **EncryptionMethodByDriveType** @@ -1405,4 +1409,4 @@ The following example is provided to show proper format and should not be taken ``` - \ No newline at end of file + From 3fc77d46d66876d7ac2db48b7372f9fcf1f8c665 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 29 Jun 2021 13:21:18 -0700 Subject: [PATCH 090/279] fix link --- windows/whats-new/windows-11-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index 54e1400de4..368dd33786 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -38,7 +38,7 @@ To install or upgrade to Windows 11, devices must meet the following minimum har - Internet connection: Internet connectivity is necessary to perform updates, and to download and use some features. - Windows 11 Home edition requires an Internet connection and a Microsoft Account to complete device setup on first use. -\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). Also see [Update on Windows 11 minimum system requirements] (https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). +\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). Also see [Update on Windows 11 minimum system requirements](https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). For information about tools to evaluate readiness, see [Determine eligibility](windows-11-plan.md#determine-eligibility). From 64bd2ba149bd2ea66a52a83cecf73dfe73ed1d92 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 29 Jun 2021 13:29:24 -0700 Subject: [PATCH 091/279] udpate tree --- windows/client-management/mdm/euiccs-csp.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 9ce12f6be8..97ae6b939f 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -25,6 +25,10 @@ eUICCs --------IsActive --------PPR1Allowed --------PPR1AlreadySet +--------DownloadServers +------------ServerName +----------------DiscoveryState +----------------AutoEnable --------Profiles ------------ICCID ----------------ServerName From 4ff59a54710e1006b8474d21a7b9fc2885be990a Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 29 Jun 2021 13:31:11 -0700 Subject: [PATCH 092/279] formatting --- windows/whats-new/windows-11-requirements.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index 368dd33786..c6338640b5 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -38,7 +38,9 @@ To install or upgrade to Windows 11, devices must meet the following minimum har - Internet connection: Internet connectivity is necessary to perform updates, and to download and use some features. - Windows 11 Home edition requires an Internet connection and a Microsoft Account to complete device setup on first use. -\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). Also see [Update on Windows 11 minimum system requirements](https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). +\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). + +Also see [Update on Windows 11 minimum system requirements](https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). For information about tools to evaluate readiness, see [Determine eligibility](windows-11-plan.md#determine-eligibility). From 4b4f05d4f15dde1f5cae5e6c1db484e294da31b2 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 29 Jun 2021 13:58:01 -0700 Subject: [PATCH 093/279] Acrolinx "Multi-factor" --- windows/deployment/windows-10-subscription-activation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index dfb7ea6b10..f2dbfeb5b5 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -103,9 +103,9 @@ For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 E If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://www.microsoft.com/en-us/microsoft-365/blog/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) -#### Multi-factor authentication +#### Multifactor authentication -An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. +An issue has been identified with Hybrid Azure AD joined devices that have enabled [multifactor authentication](/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. To resolve this issue: From 17bdc36489d8f7199805cd308bb83c89acaf83fa Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 29 Jun 2021 13:59:33 -0700 Subject: [PATCH 094/279] Corrected note markup, spacing, punctuation --- windows/deployment/windows-10-subscription-activation.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index f2dbfeb5b5..af4d82ad1b 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -226,7 +226,8 @@ When you have the required Azure AD subscription, group-based licensing is the p If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. -Caution: Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE(Out Of Box Experience) +> [!CAUTION] +> Firmware-embedded Windows 10 activation happens automatically only when we go through OOBE (Out Of Box Experience). If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. From bbcb845f9e40aecc8d7abd57782d42440a53f689 Mon Sep 17 00:00:00 2001 From: lmqferreira Date: Tue, 29 Jun 2021 22:10:14 +0100 Subject: [PATCH 095/279] Update hello-hybrid-cert-whfb-settings-pki.md fixed typo on group name --- .../hello-for-business/hello-hybrid-cert-whfb-settings-pki.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 25a3d96332..98cb3003ec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -193,7 +193,7 @@ Sign-in to a certificate authority or management workstation with _Domain Admin 10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +11. On the **Security** tab, click **Add**. Type **Windows Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. 12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. From 644c15d06715e50ec31d0bccbd36c68ec8cf5c96 Mon Sep 17 00:00:00 2001 From: JackD Date: Tue, 29 Jun 2021 17:25:25 -0400 Subject: [PATCH 096/279] Add link to CSP in alignment with above CSPs Link missing to CSP documentation similar to other CSPs listed above. --- .../deployment/update/update-compliance-configuration-manual.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index 10b6032442..e15c04a0eb 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -47,7 +47,7 @@ Each MDM Policy links to its documentation in the CSP hierarchy, providing its e |**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |Integer | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | |**System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) |Integer |1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | |**System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) |Integer | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | -| **System/AllowUpdateComplianceProcessing** |Integer | 16 - Allowed | Enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. | +| **System/**[**AllowUpdateComplianceProcessing**](/windows/client-management/mdm/policy-csp-system#system-allowUpdateComplianceProcessing) |Integer | 16 - Allowed | Enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. | ### Group policies From 52aa9452f44e2eeb52338308e1ac2a3f3de9161f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 29 Jun 2021 17:16:49 -0700 Subject: [PATCH 097/279] Acrolinx: 16 instances of "Bitlocker" --- .../client-management/mdm/bitlocker-csp.md | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index e9bd144485..e3f6b2bd85 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -180,7 +180,7 @@ If you want to disable this policy, use the following SyncML: **EncryptionMethodByDriveType** -Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". +Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the BitLocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". @@ -208,7 +208,7 @@ ADMX Info:
  • GP English name: Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)
  • GP name: EncryptionMethodWithXts_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption
    • +
  • GP path: Windows Components/BitLocker Drive Encryption
  • GP ADMX file name: VolumeEncryption.admx
@@ -264,7 +264,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRequireStartupAuthentication** -This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup". +This setting is a direct mapping to the BitLocker Group Policy "Require additional authentication at startup".
@@ -293,7 +293,7 @@ ADMX Info:
  • GP English name: Require additional authentication at startup
  • GP name: ConfigureAdvancedStartup_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -372,7 +372,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesMinimumPINLength** -This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup". +This setting is a direct mapping to the BitLocker Group Policy "Configure minimum PIN length for startup".
@@ -401,7 +401,7 @@ ADMX Info:
  • GP English name:Configure minimum PIN length for startup
  • GP name: MinimumPINLength_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -448,7 +448,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryMessage** -This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" +This setting is a direct mapping to the BitLocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name). @@ -478,7 +478,7 @@ ADMX Info:
  • GP English name: Configure pre-boot recovery message and URL
  • GP name: PrebootRecoveryInfo_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -538,7 +538,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). +This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).
@@ -567,7 +567,7 @@ ADMX Info:
  • GP English name: Choose how BitLocker-protected operating system drives can be recovered
  • GP name: OSRecoveryUsage_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Operating System Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -635,7 +635,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRecoveryOptions** -This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). +This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().
@@ -664,7 +664,7 @@ ADMX Info:
  • GP English name: Choose how BitLocker-protected fixed drives can be recovered
  • GP name: FDVRecoveryUsage_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Fixed Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Fixed Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -741,7 +741,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). +This setting is a direct mapping to the BitLocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).
@@ -770,7 +770,7 @@ ADMX Info:
  • GP English name: Deny write access to fixed drives not protected by BitLocker
  • GP name: FDVDenyWriteAccess_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Fixed Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Fixed Drives
  • GP ADMX file name: VolumeEncryption.admx
@@ -810,7 +810,7 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete. **RemovableDrivesRequireEncryption** -This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). +This setting is a direct mapping to the BitLocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).
@@ -839,7 +839,7 @@ ADMX Info:
  • GP English name: Deny write access to removable drives not protected by BitLocker
  • GP name: RDVDenyWriteAccess_Name
    • -
  • GP path: Windows Components/Bitlocker Drive Encryption/Removeable Drives
    • +
  • GP path: Windows Components/BitLocker Drive Encryption/Removeable Drives
  • GP ADMX file name: VolumeEncryption.admx
From 6d8c5dd4bba6e9bf65ad57fd1ab0eb1fbef97b9c Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 29 Jun 2021 23:16:30 -0700 Subject: [PATCH 098/279] title --- windows/whats-new/windows-11-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index c6338640b5..6f7a2364b6 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -38,7 +38,7 @@ To install or upgrade to Windows 11, devices must meet the following minimum har - Internet connection: Internet connectivity is necessary to perform updates, and to download and use some features. - Windows 11 Home edition requires an Internet connection and a Microsoft Account to complete device setup on first use. -\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-11-specifications). +\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Windows 11 specifications](https://www.microsoft.com/windows/windows-11-specifications). Also see [Update on Windows 11 minimum system requirements](https://blogs.windows.com/windows-insider/2021/06/28/update-on-windows-11-minimum-system-requirements/). From 10aad7f0a310d68776dcfa95b9a4f9f490d8d854 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 29 Jun 2021 23:20:49 -0700 Subject: [PATCH 099/279] fix title --- windows/whats-new/windows-11-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md index 6f7a2364b6..aa0532e98d 100644 --- a/windows/whats-new/windows-11-requirements.md +++ b/windows/whats-new/windows-11-requirements.md @@ -19,7 +19,7 @@ ms.custom: seo-marvel-apr2020 **Applies to** -- Windows 11 +- Windows 11 This article lists the system requirements for Windows 11. Windows 11 is also supported on a virtual machine (VM). From 94a34870288fe792549bdf36e7cdd23aa80abc91 Mon Sep 17 00:00:00 2001 From: "Boris I. Bendovsky" Date: Wed, 30 Jun 2021 13:15:11 +0300 Subject: [PATCH 100/279] Fix typo --- windows/client-management/troubleshoot-tcpip-port-exhaust.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index e41c64b649..ca8551b1dd 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -90,7 +90,7 @@ If you suspect that the machine is in a state of port exhaustion: ![Screenshot of event id 4231 in Event Viewer](images/tcp-ts-19.png) -3. Collect a `netstat -anob output` from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. +3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. ![Screenshot of netstate command output](images/tcp-ts-20.png) @@ -196,4 +196,4 @@ goto loop - [Port Exhaustion and You!](/archive/blogs/askds/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend) - this article gives a detail on netstat states and how you can use netstat output to determine the port status -- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10) \ No newline at end of file +- [Detecting ephemeral port exhaustion](/archive/blogs/yongrhee/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10) From 780cd79c510cee80c6299ed39180ca0fc2981110 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 11:34:46 +0100 Subject: [PATCH 101/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 2b896c075b..cec31902a8 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -65,7 +65,7 @@ The following table provides an overview of the Windows 10 privacy settings pres An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information. > [!Note] -> If the Windows diagnostic data processor configuration is enabled, IT administrators should use the admin portal to fulfill data subject requests to access or export Windows diagnostic data associated with a particular user’s use of a device. See [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). +> If the Windows diagnostic data processor configuration is enabled, IT administrators should use the admin portal to fulfill data subject requests to access or export Windows diagnostic data associated with a particular user’s device usage. See [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). ## 2. Windows 10 data collection management @@ -134,7 +134,6 @@ For more information, see [Manage connections from Windows operating system comp An organization may want to minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization. >[!IMPORTANT] - > - We recommend that you fully test any modifications to these settings before deploying them in your organization. > - We also recommend that if you plan to enable the Windows diagnostic data processor configuration, adjust the limited configuration baseline before deploying to ensure the Windows diagnostic setting is not turned off. From 50787a11cc4a540861b8cb84c89cbaa601635322 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 11:39:49 +0100 Subject: [PATCH 102/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index cec31902a8..41228e335e 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -160,7 +160,7 @@ An administrator can disable a user’s ability to delete their device’s diagn - Windows 10 Enterprise, Pro, Education editions, version 1809 with July 2021 update and newer -The Windows diagnostic data processor configuration enables IT administrators to be the controller, under the definition of the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Windows diagnostic data does not include data processed by Microsoft in connection with providing the service based capabilities of essential services and connected experiences. +The Windows diagnostic data processor configuration enables IT administrators to be the controller, as defined by the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Windows diagnostic data does not include data processed by Microsoft in connection with providing the service based capabilities of essential services and connected experiences. The Windows diagnostic data collected from devices enabled with the Windows diagnostic data processor configuration may be associated with a specific AAD User ID or device ID. The Windows diagnostic data processor configuration provides you with controls that help respond to data subject requests (DSRs) to delete diagnostic data, at user account closure, for a specific AAD User ID. Additionally, you’re able to execute an export DSR for diagnostic data related to a specific AAD User ID. For more information, see [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). Microsoft also will accommodate a tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for Windows diagnostic data, but still wish to remain an Azure customer. From 1f240ce9030c321c989cf994b0f7f0ee66954b19 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 11:58:03 +0100 Subject: [PATCH 103/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index fcadb6f4e3..70fa555981 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -602,8 +602,8 @@ For a complete list of the Microsoft Edge policies, see [Microsoft Edge and priv > [!Important] > - The following settings are applicable to Microsoft Edge version 77 or later. -> - For details on supported Operating Systems see Microsoft Edge supported Operating Systems -> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge see Configure Microsoft Edge policy settings on Windows +> - For details on supported Operating Systems see [Microsoft Edge supported Operating Systems](/deployedge/microsoft-edge-supported-operating-systems). +> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge see [Configure Microsoft Edge policy settings on Windows](/deployedge/configure-microsoft-edge). > - Devices must be domain joined for some of the policies to take effect. | Policy | Group Policy Path | Registry Path | From f29a09e44a93a349e7d59c8f75aab7761d9b0f1d Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 13:54:30 +0100 Subject: [PATCH 104/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 70fa555981..a92f1c32cf 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -602,8 +602,8 @@ For a complete list of the Microsoft Edge policies, see [Microsoft Edge and priv > [!Important] > - The following settings are applicable to Microsoft Edge version 77 or later. -> - For details on supported Operating Systems see [Microsoft Edge supported Operating Systems](/deployedge/microsoft-edge-supported-operating-systems). -> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge see [Configure Microsoft Edge policy settings on Windows](/deployedge/configure-microsoft-edge). +> - For details on supported Operating Systems, see [Microsoft Edge supported Operating Systems](/deployedge/microsoft-edge-supported-operating-systems). +> - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge, see [Configure Microsoft Edge policy settings on Windows](/deployedge/configure-microsoft-edge). > - Devices must be domain joined for some of the policies to take effect. | Policy | Group Policy Path | Registry Path | From 4af1dd1bb58d923162ef3ed4bd2db31dd9b6f844 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 14:31:37 +0100 Subject: [PATCH 105/279] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a92f1c32cf..8e4e81d422 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -598,7 +598,7 @@ Alternatively, you can configure the following Registry keys as described: ### 13.2 Microsoft Edge Enterprise -For a complete list of the Microsoft Edge policies, see [Microsoft Edge and privacy: FAQ](https://docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies). +For a complete list of the Microsoft Edge policies, see [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies). > [!Important] > - The following settings are applicable to Microsoft Edge version 77 or later. From a5b85c2178031c86399f6e13ecad3228660e91e0 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Jun 2021 14:35:00 +0100 Subject: [PATCH 106/279] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 8e4e81d422..189ace9071 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -600,7 +600,7 @@ Alternatively, you can configure the following Registry keys as described: For a complete list of the Microsoft Edge policies, see [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies). -> [!Important] +> [!IMPORTANT] > - The following settings are applicable to Microsoft Edge version 77 or later. > - For details on supported Operating Systems, see [Microsoft Edge supported Operating Systems](/deployedge/microsoft-edge-supported-operating-systems). > - These policies require the Microsoft Edge administrative templates to be applied. For more information on administrative templates for Microsoft Edge, see [Configure Microsoft Edge policy settings on Windows](/deployedge/configure-microsoft-edge). From 025f819512f0a9fc772ffae451615af987a20de0 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 30 Jun 2021 20:18:05 +0530 Subject: [PATCH 107/279] Updated --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 - .../policy-configuration-service-provider.md | 22 +++--- ...er.md => policy-csp-networklistmanager.md} | 76 ++++++++++++------- windows/client-management/mdm/toc.yml | 2 + 4 files changed, 62 insertions(+), 40 deletions(-) rename windows/client-management/mdm/{policy-csp-admx-networklistmanager.md => policy-csp-networklistmanager.md} (53%) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 3cb809553f..6c81fd4df2 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -733,8 +733,6 @@ ms.date: 10/08/2020 - [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) - [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) - [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) -- [ADMX_NetworkListManager-AllowedTlsAuthenticationEndpoints](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-allowedtlsauthenticationendpoints) -- [ADMX_NetworkListManager-ConfiguredTLSAuthenticationNetworkName](./policy-csp-admx-networklistmanager.md#admx-networklistmanager-configuredtlsauthenticationnetworkname) - [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) - [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index f04ef812f9..57262a6ce7 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2573,16 +2573,6 @@ The following diagram shows the Policy configuration service provider in tree fo -### ADMX_NetworkListManager policies - -
-
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints -
-
- ADMX_NetworkListManager_ConfiguredTLSAuthenticationNetworkName -
- ### ADMX_OfflineFiles policies
@@ -7077,6 +7067,18 @@ The following diagram shows the Policy configuration service provider in tree fo
+### NetworkListManager policies + +
+
+ NetworkListManager/AllowedTlsAuthenticationEndpoints +
+
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName +
+
+
+ ### Notifications policies
diff --git a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md similarity index 53% rename from windows/client-management/mdm/policy-csp-admx-networklistmanager.md rename to windows/client-management/mdm/policy-csp-networklistmanager.md index 5901b7e3e1..d8d7be2137 100644 --- a/windows/client-management/mdm/policy-csp-admx-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,38 +1,40 @@ --- -title: Policy CSP - ADMX_NetworkListManager -description: Policy CSP - ADMX_NetworkListManager +title: Policy CSP - NetworkListManager +description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure. ms.author: dansimp -ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: NimishaSatapathy -ms.date: 06/11/2021 +author: nimishasatapathy +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- -# Policy CSP - ADMX_NetworkListManager +# Policy CSP - NetworkListManager + -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
-## ADMX_NetworkListManager policies +## NetworkListManager policies
- ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints -
- ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName + NetworkListManager/AllowedTlsAuthenticationEndpoints
+
+ NetworkListManager/ConfiguredTLSAuthenticationNetworkName +
+
+
-**ADMX_NetworkListManager/AllowedTlsAuthenticationEndpoints** +**NetworkListManager/AllowedTlsAuthenticationEndpoints**
@@ -46,11 +48,11 @@ manager: dansimp - + - + @@ -58,7 +60,7 @@ manager: dansimp - +
Procross markcheck mark
Businesscross markcheck mark
Enterprise
Educationcross markcheck mark
@@ -75,15 +77,15 @@ manager: dansimp -List of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. +This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: @@ -96,9 +98,11 @@ ADMX Info:
- -**ADMX_NetworkListManager/ConfiguredTLSAuthenticationNetworkName** +
+ + +**NetworkListManager/ConfiguredTLSAuthenticationNetworkName** @@ -112,11 +116,11 @@ ADMX Info: - + - + @@ -124,7 +128,7 @@ ADMX Info: - +
Procross markcheck mark
Businesscross markcheck mark
Enterprise
Educationcross markcheck mark
@@ -141,21 +145,37 @@ ADMX Info: -The string to be used to name the network authenticated against one of the endpoints listed in *NetworkListManager/AllowedTlsAuthenticationEndpoints* policy. +This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy. + > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: -- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks* +- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks* - GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName* - GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM* - GP ADMX file name: *NetworkListManager.admx* +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index d6032a06af..f9a7d7ef62 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -727,6 +727,8 @@ items: href: policy-csp-multitasking.md - name: NetworkIsolation href: policy-csp-networkisolation.md + - name: NetworkLinkManager + href: policy-csp-networklinkmanager.md - name: Notifications href: policy-csp-notifications.md - name: Power From 16c3429dde3ae20c6df12d1880ccd6ca53a2f4d3 Mon Sep 17 00:00:00 2001 From: Brent Kendall Date: Wed, 30 Jun 2021 10:21:55 -0700 Subject: [PATCH 108/279] Update system-guard-secure-launch-and-smm-protection.md Clarified that some Intel fTPMs (technically "integrated" TPMs) are now supported. Intel has had an integrated hardware TPM in its CPUs for a while. It is not usually enabled on. They call it Platform Trust Technology or PTT, and it meets the TPM 2.0 spec. OEMs can use this PTT instead of a discrete TPM. The Core i5-10310U is one of these Comet Lake chips with PTT. --- .../system-guard-secure-launch-and-smm-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 570641d7b7..161f4fd5cc 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -74,7 +74,7 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic |For Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon|Description| |--------|-----------| |64-bit CPU|A 64-bit computer with minimum 4 cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| -|Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs are not supported.| +|Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs are not supported, with the exception of Intel chips that support Platform Trust Technology (PTT), which is a type of integrated hardware TPM that meets the TPM 2.0 spec.| |Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them).| |SMM communication buffers| All SMM communication buffers must be implemented in EfiRuntimeServicesData ,EfiRuntimeServicesCode , EfiACPIMemoryNVS, or EfiReservedMemoryType memory types. | |SMM Page Tables| Must NOT contain any mappings to EfiConventionalMemory (e.g. no OS/VMM owned memory).
Must NOT contain any mappings to code sections within EfiRuntimeServicesCode.
Must NOT have execute and write permissions for the same page
Must allow ONLY that TSEG pages can be marked executable and the memory map must report TSEG EfiReservedMemoryType.
BIOS SMI handler must be implemented such that SMM page tables are locked on every SMM entry. | @@ -94,4 +94,4 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic |Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | > [!NOTE] -> For more details around AMD processors, see [Microsoft Security Blog: Force firmware code to be measured and attested by Secure Launch on Windows 10](https://www.microsoft.com/security/blog/2020/09/01/force-firmware-code-to-be-measured-and-attested-by-secure-launch-on-windows-10/). \ No newline at end of file +> For more details around AMD processors, see [Microsoft Security Blog: Force firmware code to be measured and attested by Secure Launch on Windows 10](https://www.microsoft.com/security/blog/2020/09/01/force-firmware-code-to-be-measured-and-attested-by-secure-launch-on-windows-10/). From a1f4a13defbba1e3dfcf717558f65b571115e66a Mon Sep 17 00:00:00 2001 From: mapalko Date: Wed, 30 Jun 2021 14:12:35 -0700 Subject: [PATCH 109/279] add note for hololens support --- windows/client-management/mdm/policy-csp-devicelock.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 7ab4c6bf71..a77a4a7b4f 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -757,7 +757,7 @@ PIN enforces the following behavior for desktop and mobile devices: - 1 - Digits only - 2 - Digits and lowercase letters are required - 3 - Digits, lowercase letters, and uppercase letters are required. Not supported in desktop Microsoft accounts and domain accounts. -- 4 - Digits, lowercase letters, uppercase letters, and special characters are required. Not supported in desktop. +- 4 - Digits, lowercase letters, uppercase letters, and special characters are required. Not supported in desktop or Hololens. The default value is 1. The following list shows the supported values and actual enforced values: From b937fdf6257ab9c4d561a044765925497305407c Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 30 Jun 2021 15:15:40 -0700 Subject: [PATCH 110/279] =?UTF-8?q?Acrolinx/branding:=20"Hololens"=20?= =?UTF-8?q?=C3=97=202?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- windows/client-management/mdm/policy-csp-devicelock.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index a77a4a7b4f..730e173e27 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -114,7 +114,7 @@ manager: dansimp > [!NOTE] -> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. +> Currently, this policy is supported only in HoloLens 2, HoloLens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Specifies whether the user must input a PIN or password when the device resumes from an idle state. @@ -757,7 +757,7 @@ PIN enforces the following behavior for desktop and mobile devices: - 1 - Digits only - 2 - Digits and lowercase letters are required - 3 - Digits, lowercase letters, and uppercase letters are required. Not supported in desktop Microsoft accounts and domain accounts. -- 4 - Digits, lowercase letters, uppercase letters, and special characters are required. Not supported in desktop or Hololens. +- 4 - Digits, lowercase letters, uppercase letters, and special characters are required. Not supported in desktop or HoloLens. The default value is 1. The following list shows the supported values and actual enforced values: @@ -1128,4 +1128,4 @@ Footnotes: - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. - \ No newline at end of file + From bbef9b3f23a7182467866c5df90bd7e1394425b6 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Wed, 30 Jun 2021 16:16:50 -0700 Subject: [PATCH 111/279] Update reqs-md-app-guard.md Removed reference to Internet Explorer as a system requirement --- .../microsoft-defender-application-guard/reqs-md-app-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index 0c9b491dc5..44f32cf759 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -40,6 +40,6 @@ Your environment needs the following software to run Microsoft Defender Applicat |Software|Description| |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with WDAG for Professional editions. | -|Browser|Microsoft Edge and Internet Explorer| +|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | +|Browser|Microsoft Edge| |Management system
(only for managed devices)|[Microsoft Intune](/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**-OR-**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| From 542eaaa383f9e87fcc1c2606bb8ffd70fcb8eb33 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 1 Jul 2021 16:14:08 +0530 Subject: [PATCH 112/279] typo correction as per user report #9766, so i corrected the word from **changed** to **cached** --- ...e-of-passwords-and-credentials-for-network-authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index b22b8e05fe..18fe88ca82 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -92,7 +92,7 @@ Overwriting the administrator's password does not help the attacker access data Enable the **Network access: Do not allow storage of passwords and credentials for network authentication** setting. -To limit the number of changed domain credentials that are stored on the computer, set the **cachedlogonscount** registry entry. By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. By default, all versions of the Windows operating system remember 10 cached logons, except Windows Server 2008 and later, which are set at 25. +To limit the number of cached domain credentials that are stored on the computer, set the **cachedlogonscount** registry entry. By default, the operating system caches the verifier for each unique user's ten most recent valid logons. This value can be set to any value between 0 and 50. By default, all versions of the Windows operating system remember 10 cached logons, except Windows Server 2008 and later, which are set at 25. When you try to log on to a domain from a Windows-based client device, and a domain controller is unavailable, you do not receive an error message. Therefore, you may not notice that you logged on with cached domain credentials. You can set a notification of logon that uses cached domain credentials with the ReportDC registry entry. From 2c2ab9127603dc37fb703b7b00db63c80dd47dd3 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 1 Jul 2021 12:40:28 +0100 Subject: [PATCH 113/279] update to remove connected experiences --- ...tial-services-and-connected-experiences.md | 293 ------------------ .../windows-10-and-privacy-compliance.md | 20 +- 2 files changed, 8 insertions(+), 305 deletions(-) delete mode 100644 windows/privacy/essential-services-and-connected-experiences.md diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md deleted file mode 100644 index edb5b8d8af..0000000000 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ /dev/null @@ -1,293 +0,0 @@ ---- -title: Essential Services and Connected Experiences for Windows 10 -description: This article provides information to help IT on the essential services and connected experiences for Windows 10. -keywords: privacy, GDPR, compliance -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -audience: ITPro -author: siosulli -ms.author: siosulli -manager: dansimp -ms.collection: M365-security-compliance -ms.topic: article -ms.date: 6/28/2021 ---- - -# Essential Services and Connected Experiences for Windows 10 - -**Applies to:** - -- Windows 10, version 1903 and later - -Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. - -When a connected experience is used, data is sent to and processed by Microsoft to provide that connected experiences. This data is crucial because this information enables us to deliver these cloud-based connected experiences. We refer to this data as required service data. Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected. - -Required service data is separate from Windows diagnostic data. For more information on Windows diagnostic data see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). - -Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. While you can control many of the connected experiences that are available to you and your organization, we recommend that you carefully assess the impact of turning off essential services. - -Windows connected experiences and essential services transfer data to Microsoft network endpoints. The article [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) provides details about the different ways to control traffic to these endpoints. Where applicable, each connected experience or essential service includes a link to the specific details on how to control that traffic. - ->[!Note] ->The information in this article describes the most common connected experiences and essential services. We will continue to update our list of connected experiences over time as Windows evolves. - -## Windows 10 Essential Services - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Essential ServiceDescription
Authentication

The authentication service is required to enable sign in to work or school accounts. It validates a user’s identity and provides access to multiple apps and system components like OneDrive and activity history. Using a work or school account to sign in to Windows 10 enables Microsoft to provide a consistent experience across your devices. If the authentication service is turned off, many apps and components may lose functionality and users may not be able to sign in.

-

To turn it off, see Microsoft Account.

Certificates

Certificates are digital files, stored on client devices, used to both encrypt data and verify the identity of an individual or organization. Trusted root certificates issued by a certification authority (CA), are stored in a certificate trust list (CTL). The Automatic Root Certificates Update mechanism contacts Windows Updates to update the CTL. If a new version of the CTL is identified, the list of trusted root certificates cached on the local device will be updated. Untrusted certificates are certificates that are publicly known to be fraudulent. Untrusted certificates are also stored in a list on the local device and updated by the Automatic Root Certificates Update mechanism.

-

If automatic updates are turned off, applications and websites may stop working because they did not receive an updated root certificate that the application uses. Additionally, the list of untrusted certificates will no longer be updated, which increases the attack vector on the device.

-

To turn it off, see Automatic Root Certificates Update.

Services Configuration

Services Configuration is used by Windows components and apps, such as the telemetry service, to dynamically update their configuration. If you turn off this service, apps using this service may stop working.

-

To turn it off, see Services Configuration.

Date and Time

The Windows Time service is used to synchronize and maintain the most accurate date and time on your devices. It is installed by default and starts automatically on devices that are part of a domain. It can be started manually on other devices. If this service is stopped, date and time synchronization will be unavailable and any services that explicitly depend on it will fail to start.

-

To turn it off, see Date and Time

Licensing

Licensing services are used for the activation of Windows, and apps purchased from the Microsoft Store. If you disable the Windows License Manager Service or the Software Protection Platform Service, it may prevent activation of genuine Windows as well as store applications.

-

To turn it off, see License Manager and Software Protection Platform.

Networking

Networking in Windows provides connectivity to and from your devices to the local intranet and internet. If you turn off networking, Windows 10 devices will lose network connectivity.

-

To turn off Network Adapters, see Disable-NetAdapter.

Device setup

The first time a user sets up a new device, the Windows out-of-box experience (OOBE) guides the user through the steps to accept the license agreement, connect to the internet, sign in to (or sign up for) a Microsoft account, and takes care of other important tasks. Most settings can also be changed after setup is completed.

-

To customize the initial setup experience, see Customize Setup.

Telemetry

Microsoft collects diagnostic data including error data about your device with the help of the telemetry service. Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 behaves in the real world, focus on user priorities, find, and fix problems, and improve services. This data allows Microsoft to improve the Windows experience. Setting diagnostic data to off means important information to help fix issues and improve quality will not be available to Microsoft.

-

To turn it off, see Telemetry Services.

Windows Update

Windows Update ensures devices are kept up to date and secure by downloading the latest updates and security patches for Windows. This service also enables users download apps from the Microsoft Store and keep them up to date.

-

Turning off Windows Update will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Windows Update.

- -## Windows 10 Connected Experiences - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Connected ExperienceDescription
Device metadata retrieval

When Windows 10 detects a new device, it queries an online service called the Windows Metadata and Internet Services (WMIS) for a metadata package for the device. If a device metadata package is available on WMIS, the Device Metadata Retrieval Client (DMRC) that runs on the local device downloads and installs the package.

-

To turn it off, see Device Metadata Retrieval.

Delivery optimization

Delivery Optimization is a cloud-managed, peer-to-peer client and a downloader service for Windows updates, upgrades, and applications to an organization's networked devices. Delivery Optimization allows devices to download updates from alternate sources (such as other peers on the network), in addition to Microsoft servers. This helps when you have a limited or unreliable Internet connection and reduces the bandwidth needed to keep all your organization's devices up to date.

-

If you have Delivery Optimization Peer-to-Peer option turned on, devices on your network may send and receive updates and apps to other devices on your local network, if you choose, or to devices on the Internet.

-

By default, devices running Windows 10 will only use Delivery Optimization to get and receive updates for devices and apps on your local network.

-

To turn it off, see Delivery Optimization.

Speech Recognition

Microsoft provides a cloud-based (online) speech recognition technology that allows users to write text by speaking or interact with this system using your voice. It functions by converting speech audio into transcribed text. Turning on the online speech recognition setting enables the use of Microsoft cloud-based speech recognition in Cortana, the Mixed Reality Portal, dictation in Windows from the software keyboard, supported Microsoft Store apps, and in other parts of Windows 10.

-

To turn it off, see Speech Recognition.

Find My Device

Find My Device is a feature that can help users locate their Windows 10 device if it's lost or stolen. This feature only works if a Microsoft account is used to logon to the device, the user is an administrator on the device and when location is turned on for the device. Users can find their device by logging in to https://account.microsoft.com/devices under the Find My Device tab.

-

To turn it off, see Find My Device.

Windows Insider Program

The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. Once you've registered for the program, you can run Insider Preview builds on as many devices as you want, each in the channel of your choice. Learn how to join the Windows Insider program by visiting the program’s website.

-

To turn it off, see Windows Insider Program.

Location services

The device location setting enables certain Windows features such as auto setting the time zone or Find My Device to function properly. When the device location setting is enabled, the Microsoft location service will use a combination of global positioning service (GPS), nearby wireless access points, cell towers, and IP address to determine the device’s location. Depending on the capabilities of the device, its location can be determined with varying degrees of accuracy and may in some cases be determined precisely.

-

To turn it off, see Location Services.

Microsoft Store

Microsoft Store enables users to purchase and download apps, games, and digital content. The Store also enables the developers of these apps to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to store apps in a power-efficient and dependable way. The Store can also revoke malicious apps.

-

To turn it off, see Microsoft Store.

Microsoft Defender Antivirus

Microsoft Defender Antivirus provides cloud-delivered protection against new and emerging threats for the devices in your organization.

-

Turning off Microsoft Defender Antivirus will potentially leave your Windows devices in a vulnerable state and more prone to security threats.

-

To turn it off, see Microsoft Defender Antivirus.

Microsoft Defender SmartScreen

Microsoft Defender SmartScreen is a feature of Windows, Internet Explorer, and Microsoft Edge. It helps protect users against phishing or malware websites and applications, and the downloading of potentially malicious files.

-

Turning off Microsoft Defender SmartScreen means you cannot block a website or warn users they may be accessing a malicious site.

-

To turn it off, see Microsoft Defender SmartScreen.

Windows Search

Windows Search lets users use the search box on the taskbar to find what they are looking for, whether it’s on their device, in the cloud, or on the web. Windows Search can provide results for items from the device (including apps, settings, and files), the users account(including OneDrive, SharePoint, and other Microsoft services), and the internet.

-

To turn it off, see Windows Search.

Windows Spotlight

Windows Spotlight displays new background images on the lock screen each day. Additionally, it provides feature suggestions, fun facts, and tips on the lock screen background.

-

Administrators can turn off Windows Spotlight features to prevent users from using the Windows Spotlight background.

-

To turn it off, see Windows Spotlight.

Activity History

Activity History shows a history of activities a user has performed and can even synchronize activities across multiple devices for the same user.

-

Synchronization across devices only works when a user signs in with the same account.

-

To turn it off, see Activity History.

Settings Synchronization

With settings synchronization is turned on, a user's settings are synced across all Windows 10 devices when they sign in with the same account.

-

To turn it off, see Sync Your Settings.

Cloud Clipboard

Cloud Clipboard enables users to copy images and text across all Windows 10 devices when they sign in with the same account. Users can paste from their clipboard history and also pin items.

-

To turn it off, see Cloud Clipboard.

OneDrive

OneDrive is a cloud storage system that allows you to save your files and photos, and access them from any device, anywhere.

-

To turn off OneDrive, see OneDrive.

Font Streaming

Font Streaming enables Windows 10 devices to download fonts that are included in Windows but that are not stored on the local device on demand.

-

To turn it off, see Font Streaming.

- -## Edge Essential Services and Connected Experiences - -Windows ships with Microsoft Edge and Internet Explorer on Windows 10 devices. Microsoft Edge is the default browser and is recommended for the best web browsing experience. - -You can find details on all of Edge's connected experiences and essential services [here](/microsoft-edge/privacy-whitepaper/). - -To turn off specific Edge feature, see [Microsoft Edge](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge). - -## IE Essential Services and Connected Experiences - -Internet Explorer shares many of the Windows essential services listed above. The following table provides more details on the essential services and connected experiences specific to Internet Explorer. - -Note: Apart from ActiveX Filtering, which is an essential service, all other features listed below are connected experiences. To turn off specific connected experiences, see [Internet Explorer](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#8-internet-explorer). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Connected ExperiencesDescription
ActiveX Filtering

ActiveX controls are small apps that allow websites to provide content such as videos and games, and let users interact with controls like toolbars and stock tickers. However, these apps can sometimes malfunction, and in some cases, they might be used to collect information from user devices, install software without a user's agreement, or be used to control a device remotely without user's permission.

-

ActiveX Filtering in Internet Explorer prevents sites from installing and using these apps. This can help keep users safer as they browse, but it can also affect the user experience of certain sites as interactive content might not work when ActiveX Filtering is on.

-

To further enhance security, Internet Explorer also allows you to block out-of-date ActiveX controls.

Suggested SitesSuggested Sites is an online experience that recommends websites, images, or videos a user might be interested in. When Suggested Sites is turned on, a user’s web browsing history is periodically sent to Microsoft.
Address Bar and Search suggestionsWith search suggestions enabled, users will be offered suggested search terms as they type in the Address Bar. As users type information it will be sent to the default search provider.
Auto-complete feature for web addressesThe auto-complete feature suggests possible matches when users are typing web addresses in the browser address bar.
Compatibility loggingThis feature is designed for use by developers and IT professionals to determine the compatibility of their websites with Internet Explorer. It is disabled by default and needs to be enabled to start logging Internet Explorer events in the Windows Event Viewer. These events describe failures that might have happened on the site and can include information about specific controls and webpages that failed.
Compatibility ViewCompatibility View helps make websites designed for older browsers look better when viewed in Internet Explorer. The compatibility view setting allows you to choose whether an employee can fix website display problems they encounter while browsing.
Flip aheadFlip ahead enables your users to flip through web content quickly by swiping across the page or by clicking forward. When flip ahead is turned on, web browsing history is periodically sent to Microsoft. If you turn off this setting your users will no longer be able swipe across a screen or click forward to go to the next pre-loaded page of a website.
Web SlicesA Web Slice enables users to subscribe to and automatically receive updates to content directly within a Web page. Disabling the RSS Feeds setting will turn off background synchronization for feeds and Web Slices.
Accelerators

Accelerators are menu options in Internet Explorer that help automate common browser-related tasks. In Internet Explorer, when you right-click selected text, Accelerators appear in the list of available options.

-

For example, if you select a word, you can use the "Translate with Bing" Accelerator to obtain a translation of that word.

Pinning websites to StartWhen a user pins a website to the Start menu, it displays as a tile similar to the way apps are displayed. Like Microsoft Store apps, website tiles might display updates if the website has been designed to do so. For example, an online email website might send updates to the tile indicating how many new messages a user has.
- -## Related links - -- [Manage connections from Windows 10 operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) - -- [Connected Experiences in Office.](/deployoffice/privacy/connected-experiences.md) - -- [Essential Services in Office.](/deployoffice/privacy/essential-services.md) - -## Other Windows 10 editions - -To view endpoints for Windows 10 Enterprise, see: - -- [Manage connection endpoints for Windows 10, version 20H2](manage-windows-20h2-endpoints.md) -- [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) -- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) -- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) -- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) -- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) -- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) - -To view endpoints for non-Enterprise Windows 10 editions, see: - -- [Windows 10, version 20H2, connection endpoints for non-Enterprise editions](manage-windows-20h2-endpoints.md) -- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) -- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) -- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) -- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) -- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) -- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 41228e335e..46785e5d17 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -29,7 +29,7 @@ Applies to: At Microsoft, we are committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10. -Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 and our connected experiences. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. +Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article. This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR) @@ -82,7 +82,7 @@ Administrators can configure and control privacy settings across their organizat The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set. > [!NOTE] -> This is not a complete list of settings that involve connecting to Microsoft connected experiences. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +> This is not a complete list of settings that involve connecting to Microsoft services. For a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). | Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection | |---|---|---|---| @@ -113,21 +113,17 @@ You can use the following articles to learn more about Autopilot and how to use - [Overview of Windows Autopilot](/windows/deployment/windows-Autopilot/windows-Autopilot) - [Windows Autopilot deployment process](/windows/deployment/windows-Autopilot/deployment-process) -#### _2.3.2 Windows 10 connected experiences and essential services_ +#### _2.3.2 Managing connections from Windows components to Microsoft services_ -Windows includes features that connect to the internet to provide enhanced experiences and additional service based capabilities. These are called “connected experiences”. For example, Microsoft Defender Antivirus is a connected experience that delivers updated protection to keep the devices in your organization secure. +Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components. -Connected experiences that are critical to the proper functioning of Windows are called “essential services”. For example, the Windows licensing service confirms that you are properly licensed to use Windows. +For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. -Windows connected experiences and essential services transfer data to Microsoft network endpoints, and while an administrator may want to block these endpoints for their organization to meet specific compliance objectives, we recommend that you carefully assess the impact of turning off essential services. +#### _2.3.3 Managing Windows 10 connections_ -The article [Manage connection endpoints for Windows 10, version 20H2](/windows/privacy/manage-windows-20h2-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. +Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives. -#### _2.3.3 Managing connections from Windows connected experiences to Microsoft services_ - -Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows connected experiences and essential services. - -For more information, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable. +[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the Windows Privacy site under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu. #### _2.3.4 Limited functionality baseline_ From 27d7a9cd02f932d40e6a5e722d6671092f8117e4 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Thu, 1 Jul 2021 18:01:38 +0530 Subject: [PATCH 114/279] Update windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-application-guard/reqs-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index 44f32cf759..18349a4197 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -40,6 +40,6 @@ Your environment needs the following software to run Microsoft Defender Applicat |Software|Description| |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | +|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition, version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | |Browser|Microsoft Edge| |Management system
(only for managed devices)|[Microsoft Intune](/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**-OR-**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| From 1b807b71c5ab488e6d9f8d7457e5d8831ce71d26 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 1 Jul 2021 14:03:40 +0100 Subject: [PATCH 115/279] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 846b85c807..be4d1a5f5b 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18926,8 +18926,6 @@ "redirect_document_id": false }, { - "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", - "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "source_path": "windows/security/threat-protection/intelligence/ransomware-malware.md", "redirect_url": "/security/compass/human-operated-ransomware", "redirect_document_id": false @@ -18937,5 +18935,10 @@ "redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows", "redirect_document_id": false } + { + "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", + "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", + "redirect_document_id": false + } ] } From 68bcf56182d52345bc0257da4648c2f806f061f2 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 1 Jul 2021 14:06:18 +0100 Subject: [PATCH 116/279] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index be4d1a5f5b..dc1dd3eca7 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18934,7 +18934,7 @@ "source_path": "windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md", "redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows", "redirect_document_id": false - } + }, { "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", From 6b4189fe304824b70c61b4681204524fb39eabd3 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Thu, 1 Jul 2021 08:24:35 -0700 Subject: [PATCH 117/279] Update reqs-md-app-guard.md --- .../microsoft-defender-application-guard/reqs-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index 18349a4197..8bf5dfc2f6 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -40,6 +40,6 @@ Your environment needs the following software to run Microsoft Defender Applicat |Software|Description| |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
Windows 10 Professional edition, version 1803 or higher
Windows 10 Professional for Workstations edition, version 1803 or higher
Windows 10 Professional Education edition, version 1803 or higher
Windows 10 Education edition, version 1903 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | +|Operating system|Windows 10 Enterprise edition, version 1805 or higher
Windows 10 Professional edition, version 1805 or higher
Windows 10 Professional for Workstations edition, version 1805 or higher
Windows 10 Professional Education edition, version 1805 or higher
Windows 10 Education edition, version 1805 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | |Browser|Microsoft Edge| |Management system
(only for managed devices)|[Microsoft Intune](/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**-OR-**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| From 974b5a5b213a9aba86d1aae0b77b1efbb0ebdea9 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 1 Jul 2021 21:33:13 +0530 Subject: [PATCH 118/279] typo correction as per user report issue #9768 , so i corrected **sevices** to **services** Also i conformed this article is applies to Windows 11 too --- .../applocker/configure-the-application-identity-service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md index 610728b4d6..86e25cc2f6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md @@ -46,7 +46,7 @@ Membership in the local **Administrators** group, or equivalent, is the minimum 2. Click the **Services** tab, right-click **AppIDSvc**, and then click **Start Service**. 3. Verify that the status for the Application Identity service is **Running**. -Starting with Windows 10, the Application Identity service is now a protected process. Because of this, you can no longer manually set the service **Startup type** to **Automatic** by using the Sevices snap-in. Try either of these methods instead: +Starting with Windows 10, the Application Identity service is now a protected process. Because of this, you can no longer manually set the service **Startup type** to **Automatic** by using the Services snap-in. Try either of these methods instead: - Open an elevated command prompt or PowerShell session and type: From c11057d4b61000ca78fa04542873e6a5d725d98d Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 1 Jul 2021 17:05:14 +0100 Subject: [PATCH 119/279] Update windows-10-and-privacy-compliance.md --- windows/privacy/windows-10-and-privacy-compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md index 46785e5d17..cfe581ed04 100644 --- a/windows/privacy/windows-10-and-privacy-compliance.md +++ b/windows/privacy/windows-10-and-privacy-compliance.md @@ -156,7 +156,7 @@ An administrator can disable a user’s ability to delete their device’s diagn - Windows 10 Enterprise, Pro, Education editions, version 1809 with July 2021 update and newer -The Windows diagnostic data processor configuration enables IT administrators to be the controller, as defined by the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Windows diagnostic data does not include data processed by Microsoft in connection with providing the service based capabilities of essential services and connected experiences. +The Windows diagnostic data processor configuration enables IT administrators to be the controller, as defined by the European Union General Data Protection Regulation (GDPR), for the Windows diagnostic data collected from Windows 10 devices that are Azure Active Directory (AAD) joined and meet the configuration requirements. For more information, see [Enable Windows diagnostic data processor configuration](configure-windows-diagnostic-data-in-your-organization.md#enable-windows-diagnostic-data-processor-configuration) in [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). Windows diagnostic data does not include data processed by Microsoft in connection with providing service-based capabilities. The Windows diagnostic data collected from devices enabled with the Windows diagnostic data processor configuration may be associated with a specific AAD User ID or device ID. The Windows diagnostic data processor configuration provides you with controls that help respond to data subject requests (DSRs) to delete diagnostic data, at user account closure, for a specific AAD User ID. Additionally, you’re able to execute an export DSR for diagnostic data related to a specific AAD User ID. For more information, see [The process for exercising data subject rights](#3-the-process-for-exercising-data-subject-rights). Microsoft also will accommodate a tenant account closure, either because you decide to close your Azure or Azure AD tenant account, or because you decide you no longer wish to be the data controller for Windows diagnostic data, but still wish to remain an Azure customer. From 0c5bca15f4e3f1a61081ba329beb61a8572808a6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 1 Jul 2021 09:50:54 -0700 Subject: [PATCH 120/279] Update reqs-md-app-guard.md --- .../reqs-md-app-guard.md | 28 ++++++++++--------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index 8bf5dfc2f6..6c335a409f 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 02/11/2020 +ms.date: 07/01/2021 ms.reviewer: manager: dansimp ms.custom: asr @@ -25,21 +25,23 @@ The threat landscape is continually evolving. While hackers are busy developing > Given the technological complexity, the security promise of Microsoft Defender Application Guard (MDAG) may not hold true on VMs and in VDI environments. Hence, MDAG is currently not officially supported on VMs and in VDI environments. However, for testing and automation purposes on non-production machines, you may enable MDAG on a VM by enabling Hyper-V nested virtualization on the host. ## Hardware requirements -Your environment needs the following hardware to run Microsoft Defender Application Guard. -|Hardware|Description| +Your environment must have the following hardware to run Microsoft Defender Application Guard. + +| Hardware | Description | |--------|-----------| -|64-bit CPU|A 64-bit computer with minimum 4 cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| -|CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**-AND-**

One of the following virtualization extensions for VBS:

VT-x (Intel)

**-OR-**

AMD-V| -|Hardware memory|Microsoft requires a minimum of 8GB RAM| -|Hard disk|5 GB free space, solid state disk (SSD) recommended| -|Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| +| 64-bit CPU|A 64-bit computer with minimum 4 cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| +| CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

**AND**

One of the following virtualization extensions for VBS:
VT-x (Intel)
**OR**
AMD-V | +| Hardware memory | Microsoft requires a minimum of 8GB RAM | +| Hard disk | 5 GB free space, solid state disk (SSD) recommended | +| Input/Output Memory Management Unit (IOMMU) support| Not required, but strongly recommended | ## Software requirements -Your environment needs the following software to run Microsoft Defender Application Guard. -|Software|Description| + Your environment must have the following software to run Microsoft Defender Application Guard. + +| Software | Description | |--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1805 or higher
Windows 10 Professional edition, version 1805 or higher
Windows 10 Professional for Workstations edition, version 1805 or higher
Windows 10 Professional Education edition, version 1805 or higher
Windows 10 Education edition, version 1805 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | -|Browser|Microsoft Edge| -|Management system
(only for managed devices)|[Microsoft Intune](/intune/)

**-OR-**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**-OR-**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**-OR-**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| +| Operating system | Windows 10 Enterprise edition, version 1805 or higher
Windows 10 Professional edition, version 1805 or higher
Windows 10 Professional for Workstations edition, version 1805 or higher
Windows 10 Professional Education edition, version 1805 or higher
Windows 10 Education edition, version 1805 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | +| Browser | Microsoft Edge | +| Management system
(only for managed devices)| [Microsoft Intune](/intune/)

**OR**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**OR**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**OR**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. | From e34a92f88a10af53856b753b775b2bbca415266f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 1 Jul 2021 09:52:41 -0700 Subject: [PATCH 121/279] Update configure-the-application-identity-service.md --- .../applocker/configure-the-application-identity-service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md index 86e25cc2f6..83c7422028 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/02/2018 +ms.date: 07/01/2021 ms.technology: mde --- From 24a79df6c5320bc8da53ba92af570b68a761d4db Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 1 Jul 2021 09:53:39 -0700 Subject: [PATCH 122/279] Update network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md --- ...e-of-passwords-and-credentials-for-network-authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index 18fe88ca82..8cdbdc9908 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -14,7 +14,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: 07/01/2021 ms.technology: mde --- From 7a6aac68889f4fc06748e6f110749369ee86acd2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 1 Jul 2021 09:55:20 -0700 Subject: [PATCH 123/279] Update system-guard-secure-launch-and-smm-protection.md --- .../system-guard-secure-launch-and-smm-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 161f4fd5cc..093a5713c8 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dansimp -ms.date: 12/28/2020 +ms.date: 07/01/2021 ms.reviewer: manager: dansimp ms.author: dansimp From 65a9dbe20edd26f69af0083803c10263abfce039 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 1 Jul 2021 11:08:09 -0700 Subject: [PATCH 124/279] Update system-guard-secure-launch-and-smm-protection.md --- .../system-guard-secure-launch-and-smm-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 570641d7b7..12930a5921 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dansimp -ms.date: 12/28/2020 +ms.date: 07/01/2021 ms.reviewer: manager: dansimp ms.author: dansimp @@ -38,7 +38,7 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) 2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. - ![Secure Launch Group Policy](images/secure-launch-group-policy.png) + ![Secure Launch Configuration](images/secure-launch-group-policy.png) ### Windows Security Center @@ -64,7 +64,7 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Windows Security Center](images/secure-launch-msinfo.png) +![Verifying Secure Launch is running in the Windows Security Center](images/secure-launch-msinfo.png) > [!NOTE] > To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../../identity-protection/credential-guard/credential-guard-requirements.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). From 62a35d4bd272e9f029889ccbac808b56d8637234 Mon Sep 17 00:00:00 2001 From: Paul Huijbregts <30799281+pahuijbr@users.noreply.github.com> Date: Thu, 1 Jul 2021 11:28:16 -0700 Subject: [PATCH 125/279] Update defender-csp.md @denisebmsft some additions --- windows/client-management/mdm/defender-csp.md | 44 ++++++++++++++++--- 1 file changed, 39 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 97561119e4..15b3e6a372 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -62,6 +62,7 @@ Defender --------PlatformUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) --------EngineUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) --------SignaturesUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) +--------DisableGradualRelease (Added with the 4.18.2106.5 Defender platform release) ----Scan ----UpdateSignature ----OfflineScan (Added in Windows 10 version 1803) @@ -524,8 +525,7 @@ More details: - [Microsoft Defender Antivirus diagnostic data](/microsoft-365/security/defender-endpoint/collect-diagnostic-data) - [Collect investigation package from devices](/microsoft-365/security/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices) -**Configuration/PlatformUpdatesChannel** - +**Configuration/PlatformUpdatesChannel** Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. @@ -549,8 +549,12 @@ Valid values are: - 3: Current Channel (Staged) - 4: Current Channel (Broad) -**Configuration/EngineUpdatesChannel** +More details: +- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) +- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) + +**Configuration/EngineUpdatesChannel** Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. @@ -574,8 +578,12 @@ Valid values are: - 3 - Current Channel (Staged) - 4 - Current Channel (Broad) -**Configuration/SignaturesUpdatesChannel** +More details: +- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) +- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) + +**Configuration/DefinitionUpdatesChannel** Enable this policy to specify when devices receive daily Microsoft Defender definition updates during the daily gradual rollout. Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). @@ -590,6 +598,32 @@ Valid Values are: - 3: Current Channel (Staged) - 4: Current Channel (Broad) +More details: + +- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) +- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) + +**Configuration/DisableGradualRelease** +Enable this policy to disable gradual rollout of monthly and daily Defender updates. +Devices will be offered all Defender updates after the gradual release cycle completes. Best for datacenter machines that only receive limited updates. + +Note: This setting applies to both monthly as well as daily Defender updates and will override any previously configured channel selections for platform and engine updates. + +If you disable or do not configure this policy, the device will remain in Current Channel (Default) unless specified otherwise in specific channels for platform and engine updates. Stay up to date automatically during the gradual release cycle. Suitable for most devices. + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +• 1 – Enabled. +• 0 (default) – Not Configured. + +More details: + +- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) +- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) + **Scan** Node that can be used to start a Windows Defender scan on a device. @@ -611,4 +645,4 @@ Supported operations are Get and Execute. ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file +[Configuration service provider reference](configuration-service-provider-reference.md) From d35efcdadfc0bee35b3d35eb9dff74abff3c12a5 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 1 Jul 2021 11:50:54 -0700 Subject: [PATCH 126/279] Update defender-csp.md --- windows/client-management/mdm/defender-csp.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 15b3e6a372..c66d28ae30 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -604,10 +604,11 @@ More details: - [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) **Configuration/DisableGradualRelease** -Enable this policy to disable gradual rollout of monthly and daily Defender updates. -Devices will be offered all Defender updates after the gradual release cycle completes. Best for datacenter machines that only receive limited updates. +Enable this policy to disable gradual rollout of monthly and daily Microsoft Defender updates. +Devices will be offered all Microsoft Defender updates after the gradual release cycle completes. This is best for datacenters that only receive limited updates. -Note: This setting applies to both monthly as well as daily Defender updates and will override any previously configured channel selections for platform and engine updates. +> [!NOTE] +> This setting applies to both monthly as well as daily Microsoft Defender updates and will override any previously configured channel selections for platform and engine updates. If you disable or do not configure this policy, the device will remain in Current Channel (Default) unless specified otherwise in specific channels for platform and engine updates. Stay up to date automatically during the gradual release cycle. Suitable for most devices. From 541a2983257d2da96a6d354c7e712de92e95392d Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 1 Jul 2021 11:52:15 -0700 Subject: [PATCH 127/279] Update windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index ee3192a969..e99b5ddafe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -28,7 +28,7 @@ ms.technology: mde Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. ## Getting started with commdlets -Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module | Microsoft Docs)](powershell/module/configci) support but do not have the module installed on the box. +Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module)](powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. **Steps to install the module:** - Install-Module "ConfigCI" From c2ce37df79e3beb031ad86a038b38be6d6ac11ad Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 1 Jul 2021 15:19:56 -0700 Subject: [PATCH 128/279] Fix broken note The asterisks were rendered in preview. --- .../audit-audit-the-access-of-global-system-objects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md index 4015f85f3f..9f9a154800 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md @@ -98,7 +98,7 @@ If the [Audit Kernel Object](../auditing/audit-kernel-object.md) setting is conf | - | - | | 560 | Access was granted to an already existing object. | | 562 | A handle to an object was closed. | -| 563 | An attempt was made to open an object with the intent to delete it.
**Note: **This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile() | +| 563 | An attempt was made to open an object with the intent to delete it.
**Note:** This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile() | | 564 | A protected object was deleted. | | 565 | Access was granted to an already existing object type. | | 567 | A permission associated with a handle was used.
**Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | From c1999346b7134f8aaac64d67c825f641c5963ef2 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 2 Jul 2021 11:19:22 +0100 Subject: [PATCH 129/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...erating-system-components-to-microsoft-services.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 189ace9071..50a249906b 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -42,7 +42,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] > - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. > - During update or upgrade of Windows, egress traffic may occur. -To use Microsoft Intune cloud-based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm.md). +To use Microsoft Intune cloud-based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**. @@ -1293,7 +1293,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co ### 18.16 Feedback & diagnostics -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization). To change how frequently **Windows should ask for my feedback**: @@ -1876,11 +1876,9 @@ For a comprehensive list of Delivery Optimization Policies, see [Delivery Optimi - Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **99 (Ninety-nine)**. - For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684). -For IT Professionals, information about Delivery Optimization is available here: [Delivery Optimization for Windows 10 updates] -(https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization). +For IT Professionals, information about Delivery Optimization is available here: [Delivery Optimization for Windows 10 updates](/windows/deployment/update/waas-delivery-optimization). ### 29. Windows Update @@ -1948,7 +1946,8 @@ ADMX Info: - GP ADMX file name: OSPolicy.admx
The following list shows the supported values:
-0 – Not allowed. 1 (default) – Allowed.
+ - 0 – Not allowed
+ - 1 (default) – Allowed
### 31. Services Configuration From 68c9a286072a4b5ddc68d983ad9b1d3f3737c4ef Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 2 Jul 2021 11:24:57 +0100 Subject: [PATCH 130/279] Update manage-connections-from-windows-operating-system-components-to-microsoft-services.md --- ...ndows-operating-system-components-to-microsoft-services.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 50a249906b..d55e34120b 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -42,7 +42,7 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] > - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. > - During update or upgrade of Windows, egress traffic may occur. -To use Microsoft Intune cloud-based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](./manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). +To use Microsoft Intune cloud-based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm.md). We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**. @@ -1293,7 +1293,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co ### 18.16 Feedback & diagnostics -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization). +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To change how frequently **Windows should ask for my feedback**: From d03e2338d4aba5636a3ef3f09f08f432ae88e006 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 2 Jul 2021 11:41:19 +0100 Subject: [PATCH 131/279] Update policy-csp-system.md --- .../mdm/policy-csp-system.md | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 2a6aaac456..446f7de318 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -216,7 +216,7 @@ The following list shows the supported values: -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering). To enable this behavior, you must complete two steps: @@ -264,7 +264,7 @@ The following list shows the supported values: -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor for Windows diagnostic data collected from the device, subject to the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering). To enable this behavior, you must complete three steps: @@ -303,7 +303,7 @@ The following list shows the supported values: Pro - check mark5 + check mark5 11 Enterprise @@ -372,7 +372,7 @@ The following list shows the supported values: Pro - check mark + check mark11 Enterprise @@ -428,7 +428,7 @@ The following list shows the supported values: Pro - check mark + check mark11 Enterprise @@ -489,7 +489,7 @@ The following list shows the supported values: Pro - check mark2 + check mark2 11 Enterprise @@ -564,7 +564,7 @@ To verify if System/AllowFontProviders is set to true: Pro - check mark + check mark11 Enterprise @@ -656,7 +656,7 @@ If you disable this policy setting, devices may not appear in Microsoft Managed Pro - check mark + check mark11 Enterprise @@ -712,7 +712,7 @@ The following list shows the supported values: Pro - check mark + check mark11 Enterprise @@ -841,7 +841,7 @@ ADMX Info: Pro - check mark6 + check mark6 11 Enterprise @@ -867,7 +867,7 @@ ADMX Info: -This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting, in combination with the Allow Telemetry and Configure the Commercial ID policy settings, enables organizations to configure the device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering). To enable this behavior, you must complete three steps: @@ -915,7 +915,7 @@ The following list shows the supported values: Pro - check mark + check mark11 Enterprise @@ -964,7 +964,7 @@ The following list shows the supported values: -This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the Product Terms. +This policy setting configures an Azure Active Directory joined device so that Microsoft is the processor of the Windows diagnostic data collected from the device, subject to the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering). To enable this behavior, you must complete three steps: @@ -993,7 +993,7 @@ If you disable or do not configure this policy setting, devices enrolled to the Pro - check mark + check mark11 Enterprise @@ -1065,7 +1065,7 @@ ADMX Info: Pro - check mark5 + check mark5 11 Enterprise @@ -1135,7 +1135,7 @@ ADMX Info: Pro - check mark4 + check mark4 11 Enterprise @@ -1198,7 +1198,7 @@ The following list shows the supported values: Pro - check mark4 + check mark4 11 Enterprise @@ -1266,7 +1266,7 @@ The following list shows the supported values: Pro - check mark5 + check mark5 11 Enterprise @@ -1333,7 +1333,7 @@ ADMX Info: Pro - check mark5 + check mark5 11 Enterprise @@ -1400,7 +1400,7 @@ ADMX Info: Pro - check mark3 + check mark3 11 Enterprise @@ -1456,7 +1456,7 @@ ADMX Info: Pro - check mark2 + check mark2 11 Enterprise @@ -1534,7 +1534,7 @@ To validate on Desktop, do the following: Pro - check mark + check mark 11 Enterprise @@ -1606,7 +1606,7 @@ ADMX Info: Pro - check mark4 + check mark4 11 Enterprise @@ -1660,7 +1660,7 @@ The following list shows the supported values: Pro - check mark3 + check mark3 11 Enterprise @@ -1730,7 +1730,7 @@ ADMX Info: Pro - check mark + check mark 11 Enterprise @@ -1788,7 +1788,7 @@ ADMX Info: Pro - check mark6 + check mark6 11 Enterprise From 67223e7719814809d217487105a21aaf2d6250dd Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Fri, 2 Jul 2021 09:36:53 -0700 Subject: [PATCH 132/279] Update reqs-md-app-guard.md --- .../microsoft-defender-application-guard/reqs-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md index 6c335a409f..a54f8667cd 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard.md @@ -42,6 +42,6 @@ Your environment must have the following hardware to run Microsoft Defender Appl | Software | Description | |--------|-----------| -| Operating system | Windows 10 Enterprise edition, version 1805 or higher
Windows 10 Professional edition, version 1805 or higher
Windows 10 Professional for Workstations edition, version 1805 or higher
Windows 10 Professional Education edition, version 1805 or higher
Windows 10 Education edition, version 1805 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | +| Operating system | Windows 10 Enterprise edition, version 1809 or higher
Windows 10 Professional edition, version 1809 or higher
Windows 10 Professional for Workstations edition, version 1809 or higher
Windows 10 Professional Education edition, version 1809 or higher
Windows 10 Education edition, version 1809 or higher
Professional editions are only supported for non-managed devices; Intune or any other 3rd party mobile device management (MDM) solutions are not supported with MDAG for Professional editions. | | Browser | Microsoft Edge | | Management system
(only for managed devices)| [Microsoft Intune](/intune/)

**OR**

[Microsoft Endpoint Configuration Manager](/configmgr/)

**OR**

[Group Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753298(v=ws.11))

**OR**

Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. | From d98ebe6e68ebf891177a768ecdc307d9cfd1f31c Mon Sep 17 00:00:00 2001 From: tramcrazy <81013186+tramcrazy@users.noreply.github.com> Date: Fri, 2 Jul 2021 18:48:00 +0100 Subject: [PATCH 133/279] Add capital letter Minor capitalisation fix --- windows/whats-new/windows-11-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md index 17d61a7125..5af0900b7e 100644 --- a/windows/whats-new/windows-11-plan.md +++ b/windows/whats-new/windows-11-plan.md @@ -39,7 +39,7 @@ If you are looking for ways to optimize your approach to deploying Windows 11, o As a first step, you will need to know which of your current devices meet the Windows 11 hardware requirements. Most devices purchased in the last 18-24 months will be compatible with Windows 11. Verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md) to ensure it is compatible. -Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. end-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.  +Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. End-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.  Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as Endpoint analytics and Update Compliance. This capability will be available when Windows 11 is generally available. Microsoft is also working with software publishing partners to facilitate adding Windows 11 device support into their solutions. From 1ca2ae82bbaad95d17957f9c9e3331a0aa0c8b56 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 2 Jul 2021 15:13:33 -0700 Subject: [PATCH 134/279] Applied proper "> [!NOTE]" style --- .../mdm/policy-csp-system.md | 29 ++++++++++++++----- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 446f7de318..a16101aa46 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -774,12 +774,19 @@ In Windows 10, you can configure this policy setting to decide what level of dia The following list shows the supported values for Windows 10 version 1809 and older, choose the value that is applicable to your OS version (older OS values are displayed in the brackets): -- 0 – **Off (Security)** This turns Windows diagnostic data off. - **Note**: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. -- 1 – **Required (Basic)** Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. -- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows apps are used, how they perform, and advanced reliability data, such as limited crash dumps. - **Note**: **Enhanced** is no longer an option for Windows Holographic, version 21H1. -- 3 – **Optional (Full)** Sends the same data as a value of 2, plus additional data necessary to identify and fix problems with devices such as enhanced error logs. +- 0 – **Off (Security)** This turns Windows diagnostic data off. + + > [!NOTE] + > This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. + +- 1 – **Required (Basic)** Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. + +- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows apps are used, how they perform, and advanced reliability data, such as limited crash dumps. + + > [!NOTE] + > **Enhanced** is no longer an option for Windows Holographic, version 21H1. + +- 3 – **Optional (Full)** Sends the same data as a value of 2, plus additional data necessary to identify and fix problems with devices such as enhanced error logs. Most restrictive value is 0. @@ -1689,9 +1696,15 @@ This policy setting, in combination with the Allow Telemetry policy setting, ena To enable this behavior, you must complete two steps: - 1. Enable this policy setting + 1. Enable this policy setting. + 2. Set the **AllowTelemetry** level: - - For Windows 10 version 1809 and older: set **AllowTelemetry** to Enhanced. (**Note**: **Enhanced** is no longer an option for Windows Holographic, version 21H1) + + - For Windows 10 version 1809 and older: set **AllowTelemetry** to Enhanced. + + > [!NOTE] + > **Enhanced** is no longer an option for Windows Holographic, version 21H1. + - For Windows 10 version 19H1 and later: set **AllowTelemetry** to Optional (Full) From 510f2a2891edb668452b6be08ac22866b997e30a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 2 Jul 2021 17:05:34 -0700 Subject: [PATCH 135/279] Adjusted placement of some notes --- ...system-components-to-microsoft-services.md | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index d55e34120b..aad2616468 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -634,9 +634,8 @@ You can turn off NCSI by doing one of the following: - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** - -> [!NOTE] -> After you apply this policy, you must restart the device for the policy setting to take effect. + > [!NOTE] + > After you apply this policy, you must restart the device for the policy setting to take effect. -or- @@ -692,8 +691,9 @@ To remove the News app: - Right-click the app in Start, and then click **Uninstall**. -or- -> [!IMPORTANT] -> If you have any issues with these commands, restart the system and try the scripts again. + + > [!IMPORTANT] + > If you have any issues with the following commands, restart the system and try the scripts again. - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** @@ -863,11 +863,11 @@ Use Settings > Privacy to configure some settings that may be important to yo To turn off **Let apps use advertising ID to make ads more interesting to you based on your app usage (turning this off will reset your ID)**: -> [!NOTE] -> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - - Turn off the feature in the UI. + > [!NOTE] + > When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + -or- - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. @@ -900,11 +900,11 @@ To turn off **Let Windows track app launches to improve Start and search results To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: -> [!NOTE] -> When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - - Turn off the feature in the UI. + > [!NOTE] + > When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. + -or- - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**. @@ -1295,11 +1295,10 @@ To turn off **Let your apps use your trusted devices (hardware you've already co In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). -To change how frequently **Windows should ask for my feedback**: - > [!NOTE] > Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device. +To change how frequently **Windows should ask for my feedback**: - To change from **Automatically (Recommended)**, use the drop-down list in the UI. @@ -1579,11 +1578,11 @@ You can control if your settings are synchronized: To turn off Messaging cloud sync: -> [!NOTE] -> There is no Group Policy corresponding to this registry key. - - Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**. + > [!NOTE] + > There is no Group Policy corresponding to this registry key. + ### 22. Teredo You can disable Teredo by using Group Policy or by using the netsh.exe command. For more info on Teredo, see [Internet Protocol Version 6, Teredo, and Related Technologies](/previous-versions/windows/it-pro/windows-vista/cc722030(v=ws.10)). @@ -1674,8 +1673,8 @@ You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: - Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. -> [!NOTE] -> There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. + > [!NOTE] + > There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. You can turn off **Enhanced Notifications** as follows: From 3c5c4e12aeb8282e8ec4500bcb3e9aca6d69dbd1 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 2 Jul 2021 17:13:46 -0700 Subject: [PATCH 136/279] Removed extra indentation of notes --- windows/client-management/mdm/policy-csp-system.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index a16101aa46..f199fbc4c1 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -776,15 +776,15 @@ The following list shows the supported values for Windows 10 version 1809 and ol - 0 – **Off (Security)** This turns Windows diagnostic data off. - > [!NOTE] - > This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. + > [!NOTE] + > This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. - 1 – **Required (Basic)** Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. - 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows apps are used, how they perform, and advanced reliability data, such as limited crash dumps. - > [!NOTE] - > **Enhanced** is no longer an option for Windows Holographic, version 21H1. + > [!NOTE] + > **Enhanced** is no longer an option for Windows Holographic, version 21H1. - 3 – **Optional (Full)** Sends the same data as a value of 2, plus additional data necessary to identify and fix problems with devices such as enhanced error logs. From aa62b6e5391931a44bc607367692416ddee2e5f3 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sun, 4 Jul 2021 21:04:33 +0530 Subject: [PATCH 137/279] added MECM and WSUS links are added as per user feedback #9778 , so i added below two links **https://docs.microsoft.com/mem/configmgr/** **https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus** --- windows/whats-new/windows-11-prepare.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 5ccbff2c5b..a1176e6d14 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -33,12 +33,12 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### On-premises solutions -- If you use Windows Server Update Service (WSUS), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Windows Server Update Service (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. > [!NOTE] > During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture. -- If you use Microsoft Endpoint Configuration Manager, you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. > [!NOTE] > Configuration Manager will prompt you to accept the End User License Agreement on behalf of the users in your organization. From 410525fef1cb81c15a0176ab0393acefb2d8922d Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Mon, 5 Jul 2021 13:08:19 +0530 Subject: [PATCH 138/279] Update windows/whats-new/windows-11-prepare.md accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/whats-new/windows-11-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index a1176e6d14..81b9b3d6a9 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -33,7 +33,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### On-premises solutions -- If you use [Windows Server Update Service (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Windows Server Update Service (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. > [!NOTE] > During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture. From cc5d8b7d7692fe93b019054569af3d6c085cb3b8 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Mon, 5 Jul 2021 13:08:55 +0530 Subject: [PATCH 139/279] Update windows/whats-new/windows-11-prepare.md accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/whats-new/windows-11-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 81b9b3d6a9..b114202776 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -38,7 +38,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil > [!NOTE] > During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture. -- If you use [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. +- If you use [Microsoft Endpoint Configuration Manager](/mem/configmgr/), you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. > [!NOTE] > Configuration Manager will prompt you to accept the End User License Agreement on behalf of the users in your organization. From 89376c584e3f9f9033c72ef457bc412fb255d826 Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Tue, 6 Jul 2021 11:29:26 -0700 Subject: [PATCH 140/279] Updated the URL link as recommended. --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index ee3192a969..744330910a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -28,7 +28,7 @@ ms.technology: mde Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. ## Getting started with commdlets -Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module | Microsoft Docs)](powershell/module/configci) support but do not have the module installed on the box. +Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module | Microsoft Docs)](powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. **Steps to install the module:** - Install-Module "ConfigCI" From 785e2c786be3c060af11a6e2fcbbfba018d7b9ef Mon Sep 17 00:00:00 2001 From: Kenichi Maruyama <25722430+kemaruya@users.noreply.github.com> Date: Wed, 7 Jul 2021 17:41:33 +0900 Subject: [PATCH 141/279] Removed from the list by checking Windows 10 version 2004 Removed from the list by checking Windows 10 version 2004 --- windows/application-management/apps-in-windows-10.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index d8cddab78d..c2b3c2e3bb 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -49,7 +49,7 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, 1 | Microsoft.GetHelp | [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | x | x | x | x | x | No | | Microsoft.Getstarted | [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | x | x | x | x | x | No | | Microsoft.HEIFImageExtension | [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | | x | x | x | x | No | -| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Messaging | [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | x | x | x | x | | No | | Microsoft.Microsoft3DViewer | [Mixed Reality Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | x | x | x | x | x | No | | Microsoft.MicrosoftOfficeHub | [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | x | x | x | x | x | Yes | | Microsoft.MicrosoftSolitaireCollection | [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | x | x | x | x | x | Yes | @@ -57,10 +57,10 @@ Here are the provisioned Windows apps in Windows 10 versions 1803, 1809, 1903, 1 | Microsoft.MixedReality.Portal | [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | | x | x | x | x | No | | Microsoft.MSPaint | [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | x | x | x | x | x | No | | Microsoft.Office.OneNote | [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | x | x | x | x | x | Yes | -| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | x | No | -| Microsoft.Outlook.DesktopIntegrationServices | | | | | x | x | | +| Microsoft.OneConnect | [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | | No | +| Microsoft.Outlook.DesktopIntegrationServices | | | | | x | | | | Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | x | No | -| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | x | No | +| Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | x | x | x | x | | No | | Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | x | x | x | x | No | | Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | x | No | | Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | x | No | From a8fccf0b71550c18ead87d7152f418e551f7746f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Jul 2021 21:32:51 -0700 Subject: [PATCH 142/279] Fix approximately 21 links --- .../ltsc/whats-new-windows-10-2019.md | 73 +++++++++++-------- 1 file changed, 43 insertions(+), 30 deletions(-) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 2b62e7fc98..d71b6e5778 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -52,9 +52,11 @@ The [Microsoft Defender for Endpoint](/windows/security/threat-protection/index) ##### Attack surface reduction -Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access](/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). - - This feature can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. - - When an app is blocked, it will appear in a recently blocked apps list, which you can get to by clicking **Manage settings** under the **Ransomware protection** heading. Click **Allow an app through Controlled folder access**. After the prompt, click the **+** button and choose **Recently blocked apps**. Select any of the apps to add them to the allowed list. You can also browse for an app from this page. +Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access]/microsoft-365/security/defender-endpoint/enable-controlled-folders). + +- This feature can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. + +- When an app is blocked, it will appear in a recently blocked apps list, which you can get to by clicking **Manage settings** under the **Ransomware protection** heading. Click **Allow an app through Controlled folder access**. After the prompt, click the **+** button and choose **Recently blocked apps**. Select any of the apps to add them to the allowed list. You can also browse for an app from this page. ###### Windows Defender Firewall @@ -74,34 +76,42 @@ But these protections can also be configured separately. And, unlike HVCI, code Endpoint detection and response is improved. Enterprise customers can now take advantage of the entire Windows security stack with Microsoft Defender Antivirus **detections** and Device Guard **blocks** being surfaced in the Microsoft Defender for Endpoint portal. - Windows Defender is now called Microsoft Defender Antivirus and now shares detection status between M365 services and interoperates with Microsoft Defender for Endpoint. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/utilize-microsoft-cloud-protection-microsoft-defender-antivirus). - - We've also [increased the breadth of the documentation library for enterprise security admins](/windows/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). The new library includes information on: -- [Deploying and enabling AV protection](/windows/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus) -- [Managing updates](/windows/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) -- [Reporting](/windows/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus) -- [Configuring features](/windows/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features) -- [Troubleshooting](/windows/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus) +Windows Defender is now called Microsoft Defender Antivirus and now shares detection status between M365 services and interoperates with Microsoft Defender for Endpoint. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus). - Some of the highlights of the new library include [Evaluation guide for Microsoft Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) and [Deployment guide for Microsoft Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus). +We've also [increased the breadth of the documentation library for enterprise security admins](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows). The new library includes information on: - New features for Microsoft Defender AV in Windows 10 Enterprise LTSC 2019 include: -- [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus) -- [The ability to specify the level of cloud-protection](/windows/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus) -- [Microsoft Defender Antivirus protection in the Windows Defender Security Center app](/windows/threat-protection/microsoft-defender-antivirus/windows-defender-security-center-antivirus) +- [Deploying and enabling AV protection](/microsoft-365/security/defender-endpoint/deploy-microsoft-defender-antivirus) +- [Managing updates](/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus) +- [Reporting](/microsoft-365/security/defender-endpoint/report-monitor-microsoft-defender-antivirus) +- [Configuring features](/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features) +- [Troubleshooting](/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus) - We've [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment with [updated behavior monitoring and always-on real-time protection](/windows/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). +Some of the highlights of the new library include [Evaluation guide for Microsoft Defender AV](/microsoft-365/security/defender-endpoint/evaluate-microsoft-defender-antivirus) and [Deployment guide for Microsoft Defender AV in a virtual desktop infrastructure environment](/microsoft-365/security/defender-endpoint/deployment-vdi-microsoft-defender-antivirus). - **Endpoint detection and response** is also enhanced. New **detection** capabilities include: -- [Use the threat intelligence API to create custom alerts](/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. - - [Custom detection](/windows/security/threat-protection/windows-defender-atp/overview-custom-detections). With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. - - Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks. - - Upgraded detections of ransomware and other advanced attacks. - - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed. +New features for Microsoft Defender AV in Windows 10 Enterprise LTSC 2019 include: - **Threat response** is improved when an attack is detected, enabling immediate action by security teams to contain a breach: - - [Take response actions on a machine](/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by isolating machines or collecting an investigation package. - - [Take response actions on a file](/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by stopping and quarantining files or blocking a file. +- [Updates to how the Block at First Sight feature can be configured](/microsoft-365/security/defender-endpoint/configure-block-at-first-sight-microsoft-defender-antivirus) +- [The ability to specify the level of cloud-protection](/microsoft-365/security/defender-endpoint/specify-cloud-protection-level-microsoft-defender-antivirus) +- [Microsoft Defender Antivirus protection in the Windows Defender Security Center app](/microsoft-365/security/defender-endpoint/microsoft-defender-security-center-antivirus) + +We've [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment with [updated behavior monitoring and always-on real-time protection](/microsoft-365/security/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus). + +**Endpoint detection and response** is also enhanced. New **detection** capabilities include: + +- [Use the threat intelligence API to create custom alerts](/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. + +- [Custom detection](/microsoft-365/security/defender-endpoint/overview-custom-detections). With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. + +- Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks. + +- Upgraded detections of ransomware and other advanced attacks. + +- Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed. + +**Threat response** is improved when an attack is detected, enabling immediate action by security teams to contain a breach: + +- [Take response actions on a machine](/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by isolating machines or collecting an investigation package. +- [Take response actions on a file](/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by stopping and quarantining files or blocking a file. Additional capabilities have been added to help you gain a holistic view on **investigations** include: @@ -139,7 +149,8 @@ We’re continuing to work on how other security apps you’ve installed show up This also means you’ll see more links to other security apps within **Windows Security**. For example, if you open the **Firewall & network protection** section, you’ll see the firewall apps that are running on your device under each firewall type, which includes domain, private, and public networks). -You can read more about ransomware mitigations and detection capability at: +You can read more about ransomware mitigations and detection capability at: + - [Averting ransomware epidemics in corporate networks with Microsoft Defender for Endpoint](https://blogs.technet.microsoft.com/mmpc/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/) - [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/) @@ -147,7 +158,9 @@ Also see [New capabilities of Microsoft Defender for Endpoint further maximizing Get a quick, but in-depth overview of Microsoft Defender for Endpoint for Windows 10: [Defender for Endpoint](/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). + ### Information protection @@ -203,7 +216,7 @@ Improvements have been added are to Windows Hello for Business and Credential Gu New features in Windows Hello enable a better device lock experience, using multifactor unlock with new location and user proximity signals. Using Bluetooth signals, you can configure your Windows 10 device to automatically lock when you walk away from it, or to prevent others from accessing the device when you are not present. -New features in [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification.md) include: +New features in [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification) include: - You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). @@ -283,7 +296,7 @@ We’ve continued to work on the **Current threats** area in [Virus & threat pr [Windows Autopilot](/windows/deployment/windows-autopilot/windows-autopilot) is a deployment tool introduced with Windows 10, version 1709 and is also available for Windows 10 Enterprise LTSC 2019 (and later versions). Windows Autopilot provides a modern device lifecycle management service powered by the cloud to deliver a zero touch experience for deploying Windows 10. -Windows Autopilot is currently available with Surface, Dell, HP, and Lenovo. Other OEM partners such as Panasonic, and Acer will support Autopilot soon. Check the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog) or this article for updated information. +Windows Autopilot is currently available with Surface, Dell, HP, and Lenovo. Other OEM partners such as Panasonic, and Acer will support Autopilot soon. Check the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/bg-p/Windows10Blog) or this article for updated information. Using Intune, Autopilot now enables locking the device during provisioning during the Windows Out Of Box Experience (OOBE) until policies and settings for the device get provisioned, thereby ensuring that by the time the user gets to the desktop, the device is secured and configured correctly. @@ -548,7 +561,7 @@ For more info, see [Implement server-side support for mobile application managem ### MDM diagnostics -In Windows 10 Enterprise LTSC 2019, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. +In Windows 10 Enterprise LTSC 2019, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](/message-analyzer/microsoft-message-analyzer-operating-guide) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. ### Application Virtualization for Windows (App-V) From e8703c15359d6dddde7dd4c673e2924559385f2f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Jul 2021 21:52:10 -0700 Subject: [PATCH 143/279] Marked up all destinations as code to... ...prevent some from being treated as hyperlinks by the build and to provide consistent appearance of all --- .../privacy/manage-windows-1809-endpoints.md | 156 +++++++++--------- 1 file changed, 78 insertions(+), 78 deletions(-) diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 3da8139a20..20573d11ec 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -55,8 +55,8 @@ If you [turn off traffic to this endpoint](manage-connections-from-windows-opera | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| explorer | HTTP | tile-service.weather.microsoft.com | -| | HTTP | blob.weather.microsoft.com | +| explorer | HTTP | `tile-service.weather.microsoft.com` | +| | HTTP | `blob.weather.microsoft.com` | The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -65,7 +65,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | cdn.onenote.net/livetile/?Language=en-US | +| | HTTPS | `cdn.onenote.net/livetile/?Language=en-US` | The following endpoints are used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -75,7 +75,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| | | HTTPS | wildcard.twimg.com | -| svchost.exe | | oem.twimg.com/windows/tile.xml | +| svchost.exe | | `oem.twimg.com/windows/tile.xml` | The following endpoint is used for Facebook updates. To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -84,7 +84,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | star-mini.c10r.facebook.com | +| | | `star-mini.c10r.facebook.com` | The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -102,7 +102,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | TLS v1.2 | candycrushsoda.king.com | +| | TLS v1.2 | `candycrushsoda.king.com` | The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -118,17 +118,17 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |----------------|----------|------------| -| system32\AppHostRegistrationVerifier.exe | HTTPS | mediaredirect.microsoft.com | +| system32\AppHostRegistrationVerifier.exe | HTTPS | `mediaredirect.microsoft.com` | The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | wbd.ms | -| | HTTPS | int.whiteboard.microsoft.com | -| | HTTPS | whiteboard.microsoft.com | -| | HTTP / HTTPS | whiteboard.ms | +| | HTTPS | `wbd.ms` | +| | HTTPS | `int.whiteboard.microsoft.com` | +| | HTTPS | `whiteboard.microsoft.com` | +| | HTTP / HTTPS | `whiteboard.ms` | ## Cortana and Search @@ -137,28 +137,28 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| searchui | HTTPS |store-images.s-microsoft.com | +| searchui | HTTPS | `store-images.s-microsoft.com` | The following endpoint is used to update Cortana greetings, tips, and Live Tiles. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| backgroundtaskhost | HTTPS | www.bing.com/client | +| backgroundtaskhost | HTTPS | `www.bing.com/client` | The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| backgroundtaskhost | HTTPS | www.bing.com/proactive | +| backgroundtaskhost | HTTPS | `www.bing.com/proactive` | The following endpoint is used by Cortana to report diagnostic and diagnostic data information. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| searchui
backgroundtaskhost | HTTPS | www.bing.com/threshold/xls.aspx | +| searchui
backgroundtaskhost | HTTPS | `www.bing.com/threshold/xls.aspx` | ## Certificates @@ -171,7 +171,7 @@ If traffic to this endpoint is turned off, Windows no longer automatically downl | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTP | ctldl.windowsupdate.com | +| svchost | HTTP | `ctldl.windowsupdate.com` | ## Device authentication @@ -180,7 +180,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | login.live.com/ppsecure | +| | HTTPS | `login.live.com/ppsecure` | ## Device metadata @@ -189,8 +189,8 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | dmd.metaservices.microsoft.com.akadns.net | -| | HTTP | dmd.metaservices.microsoft.com | +| | | `dmd.metaservices.microsoft.com.akadns.net` | +| | HTTP | `dmd.metaservices.microsoft.com` | ## Diagnostic Data @@ -199,22 +199,22 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | | cy2.vortex.data.microsoft.com.akadns.net | +| svchost | | `cy2.vortex.data.microsoft.com.akadns.net` | The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | v10.vortex-win.data.microsoft.com/collect/v1 | +| svchost | HTTPS | `v10.vortex-win.data.microsoft.com/collect/v1` | The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| wermgr | | watson.telemetry.microsoft.com | -| | TLS v1.2 | modern.watson.data.microsoft.com.akadns.net | +| wermgr | | `watson.telemetry.microsoft.com` | +| | TLS v1.2 | `modern.watson.data.microsoft.com.akadns.net` | ## Font streaming @@ -223,8 +223,8 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | | fs.microsoft.com | -| | | fs.microsoft.com/fs/windows/config.json | +| svchost | | `fs.microsoft.com` | +| | | `fs.microsoft.com/fs/windows/config.json` | ## Licensing @@ -233,7 +233,7 @@ To turn off traffic for this endpoint, disable the Windows License Manager Servi | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| licensemanager | HTTPS | licensing.mp.microsoft.com/v7.0/licenses/content | +| licensemanager | HTTPS | `licensing.mp.microsoft.com/v7.0/licenses/content` | ## Location @@ -242,8 +242,8 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTP | location-inference-westus.cloudapp.net | -| | HTTPS | inference.location.live.net | +| | HTTP | `location-inference-westus.cloudapp.net` | +| | HTTPS | `inference.location.live.net` | ## Maps @@ -252,7 +252,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | *g.akamaiedge.net | +| svchost | HTTPS | `*g.akamaiedge.net` | ## Microsoft account @@ -261,11 +261,11 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | login.msa.akadns6.net | -| | | login.live.com | -| | | account.live.com | -| system32\Auth.Host.exe | HTTPS | auth.gfx.ms | -| | | us.configsvc1.live.com.akadns.net | +| | | `login.msa.akadns6.net` | +| | | `login.live.com` | +| | | `account.live.com` | +| system32\Auth.Host.exe | HTTPS | `auth.gfx.ms` | +| | | `us.configsvc1.live.com.akadns.net` | ## Microsoft Store @@ -274,32 +274,32 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | *.wns.windows.com | +| | HTTPS | `*.wns.windows.com` | The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTP | storecatalogrevocation.storequality.microsoft.com | +| | HTTP | `storecatalogrevocation.storequality.microsoft.com` | The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net | -| backgroundtransferhost | HTTPS | store-images.microsoft.com | +| | HTTPS | `img-prod-cms-rt-microsoft-com.akamaized.net` | +| backgroundtransferhost | HTTPS | `store-images.microsoft.com` | The following endpoints are used to communicate with Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTP | storeedgefd.dsx.mp.microsoft.com | -| | HTTP \ HTTPS | pti.store.microsoft.com | -||TLS v1.2|cy2.\*.md.mp.microsoft.com.\*.| -| svchost | HTTPS | displaycatalog.mp.microsoft.com | +| | HTTP | `storeedgefd.dsx.mp.microsoft.com` | +| | HTTP \ HTTPS | `pti.store.microsoft.com` | +||TLS v1.2| `cy2.*.md.mp.microsoft.com.*.` | +| svchost | HTTPS | `displaycatalog.mp.microsoft.com` | ## Network Connection Status Indicator (NCSI) @@ -308,7 +308,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTP | www.msftconnecttest.com/connecttest.txt | +| | HTTP | `www.msftconnecttest.com/connecttest.txt` | ## Office @@ -318,13 +318,13 @@ If you turn off traffic for these endpoints, users won't be able to save documen | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | *.a-msedge.net | -| hxstr | | *.c-msedge.net | -| | | *.e-msedge.net | -| | | *.s-msedge.net | -| | HTTPS | ocos-office365-s2s.msedge.net | -| | HTTPS | nexusrules.officeapps.live.com | -| | HTTPS | officeclient.microsoft.com | +| | | `*.a-msedge.net` | +| hxstr | | `*.c-msedge.net` | +| | | `*.e-msedge.net` | +| | | `*.s-msedge.net` | +| | HTTPS | `ocos-office365-s2s.msedge.net` | +| | HTTPS | `nexusrules.officeapps.live.com` | +| | HTTPS | `officeclient.microsoft.com` | The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. @@ -338,14 +338,14 @@ The following endpoint is OfficeHub traffic used to get the metadata of Office a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -|Windows Apps\Microsoft.Windows.Photos|HTTPS|client-office365-tas.msedge.net| +|Windows Apps\Microsoft.Windows.Photos|HTTPS| `client-office365-tas.msedge.net` | The following endpoint is used to connect the Office To-Do app to it's cloud service. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| |HTTPS|to-do.microsoft.com| +| |HTTPS| `to-do.microsoft.com` | ## OneDrive @@ -354,14 +354,14 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction | +| onedrive | HTTP \ HTTPS | `g.live.com/1rewlive5skydrive/ODSUProduction` | The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| onedrive | HTTPS | oneclient.sfx.ms | +| onedrive | HTTPS | `oneclient.sfx.ms` | ## Settings @@ -370,21 +370,21 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| dmclient | | cy2.settings.data.microsoft.com.akadns.net | +| dmclient | | `cy2.settings.data.microsoft.com.akadns.net` | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| dmclient | HTTPS | settings.data.microsoft.com | +| dmclient | HTTPS | `settings.data.microsoft.com` | The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as Windows Connected User Experiences and Telemetry component and Windows Insider Program use it. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | settings-win.data.microsoft.com | +| svchost | HTTPS | `settings-win.data.microsoft.com` | ## Skype @@ -392,9 +392,9 @@ The following endpoint is used to retrieve Skype configuration values. To turn o | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -|microsoft.windowscommunicationsapps.exe | HTTPS | config.edge.skype.com | -| | HTTPS | browser.pipe.aria.microsoft.com | -| | | skypeecs-prod-usw-0-b.cloudapp.net | +|microsoft.windowscommunicationsapps.exe | HTTPS | `config.edge.skype.com` | +| | HTTPS | `browser.pipe.aria.microsoft.com` | +| | | `skypeecs-prod-usw-0-b.cloudapp.net` | ## Windows Defender @@ -403,24 +403,24 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | wdcp.microsoft.com | +| | | `wdcp.microsoft.com` | The following endpoints are used for Windows Defender definition updates. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), definitions will not be updated. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | | definitionupdates.microsoft.com | -|MpCmdRun.exe|HTTPS|go.microsoft.com | +| | | `definitionupdates.microsoft.com` | +|MpCmdRun.exe|HTTPS| `go.microsoft.com` | The following endpoints are used for Windows Defender Smartscreen reporting and notifications. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | ars.smartscreen.microsoft.com | -| | HTTPS | unitedstates.smartscreen-prod.microsoft.com | -| | | smartscreen-sn3p.smartscreen.microsoft.com | +| | HTTPS | `ars.smartscreen.microsoft.com` | +| | HTTPS | `unitedstates.smartscreen-prod.microsoft.com` | +| | | `smartscreen-sn3p.smartscreen.microsoft.com` | ## Windows Spotlight @@ -429,11 +429,11 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| backgroundtaskhost | HTTPS | arc.msn.com | -| backgroundtaskhost | | g.msn.com.nsatc.net | -| |TLS v1.2| *.search.msn.com | -| | HTTPS | ris.api.iris.microsoft.com | -| | HTTPS | query.prod.cms.rt.microsoft.com | +| backgroundtaskhost | HTTPS | `arc.msn.com` | +| backgroundtaskhost | | `g.msn.com.nsatc.net` | +| |TLS v1.2| `*.search.msn.com` | +| | HTTPS | `ris.api.iris.microsoft.com` | +| | HTTPS | `query.prod.cms.rt.microsoft.com` | ## Windows Update @@ -442,23 +442,23 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | *.prod.do.dsp.mp.microsoft.com | +| svchost | HTTPS | `*.prod.do.dsp.mp.microsoft.com` | The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTP | *.windowsupdate.com | -| svchost | HTTP | *.dl.delivery.mp.microsoft.com | +| svchost | HTTP | `*.windowsupdate.com` | +| svchost | HTTP | `*.dl.delivery.mp.microsoft.com` | The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | *.update.microsoft.com | -| svchost | HTTPS | *.delivery.mp.microsoft.com | +| svchost | HTTPS | `*.update.microsoft.com` | +| svchost | HTTPS | `*.delivery.mp.microsoft.com` | These are dependent on enabling: - [Device authentication](manage-windows-1809-endpoints.md#device-authentication) @@ -469,7 +469,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| svchost | HTTPS | tsfe.trafficshaping.dsp.mp.microsoft.com | +| svchost | HTTPS | `tsfe.trafficshaping.dsp.mp.microsoft.com` | ## Microsoft forward link redirection service (FWLink) @@ -480,7 +480,7 @@ If you disable this endpoint, Windows Defender won't be able to update its malwa | Source process | Protocol | Destination | |----------------|:--------:|------------| -|Various|HTTPS|go.microsoft.com| +|Various|HTTPS| `go.microsoft.com` | ## Other Windows 10 editions From e11dd22df9ed88e0008cff32f0b9abf6b544cc16 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Jul 2021 21:55:32 -0700 Subject: [PATCH 144/279] Marked up names of malware families to... ...prevent the build from making all of these hyperlinks. --- .../threat-protection/intelligence/macro-malware.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md index 5bf655b20c..625498e600 100644 --- a/windows/security/threat-protection/intelligence/macro-malware.md +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -28,12 +28,12 @@ Macro malware was fairly common several years ago because macros ran automatical We've seen macro malware download threats from the following families: -* [Ransom:MSIL/Swappa](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) -* [Ransom:Win32/Teerac](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Teerac&threatId=-2147277789) -* [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) -* [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) -* [Win32/Fynloski](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) -* [Worm:Win32/Gamarue](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) +* [`Ransom:MSIL/Swappa`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) +* [`Ransom:Win32/Teerac`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Teerac&threatId=-2147277789) +* [`TrojanDownloader:Win32/Chanitor`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) +* [`TrojanSpy:Win32/Ursnif`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) +* [`Win32/Fynloski`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) +* [`Worm:Win32/Gamarue`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) ## How to protect against macro malware From 99b706288fa99be39691885e57c0e4adf8b07861 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 7 Jul 2021 21:59:29 -0700 Subject: [PATCH 145/279] Corrected font weight of table headings Table headings are bold by default. Adding formatting for bold results in a lighter weight font than is standard. --- .../overview-of-threat-mitigations-in-windows-10.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 8c5b01b506..8791e49d7f 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -20,7 +20,7 @@ ms.technology: mde This topic provides an overview of some of the software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. For information about related types of protection offered by Microsoft, see [Related topics](#related-topics). -| **Section** | **Contents** | +| Section | Contents | |--------------|-------------------------| | [The security threat landscape](#threat-landscape) | Describes the current nature of the security threat landscape, and outlines how Windows 10 is designed to mitigate software exploits and similar threats. | | [Windows 10 mitigations that you can configure](#windows-10-mitigations-that-you-can-configure) | Provides tables of configurable threat mitigations with links to more information. Product features such as Device Guard appear in [Table 1](#windows-10-mitigations-that-you-can-configure), and memory protection options such as Data Execution Prevention appear in [Table 2](#table-2). | @@ -118,7 +118,7 @@ Data Execution Prevention (DEP) does exactly that, by substantially reducing the 1. Open Task Manager: Press Ctrl+Alt+Del and select **Task Manager**, or search the Start screen. -2. Click **More Details** (if necessary), and then click the **Details** tab. +2. Click **More Details** (if necessary), and then click the **Details** tab. 3. Right-click any column heading, and then click **Select Columns**. @@ -311,9 +311,9 @@ The following table lists EMET features in relation to Windows 10 features. - - + + From 18f4d2fc1b258cf6d1616bc330487cb190a709cd Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Thu, 8 Jul 2021 09:00:07 -0700 Subject: [PATCH 146/279] Update select-types-of-rules-to-create.md --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index ff505c8beb..29cd125c84 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -29,7 +29,7 @@ Windows Defender Application Control (WDAC) can control what runs on Windows 10 ## Getting started with commdlets -Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module)](powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. +Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. **Steps to install the module:** - Install-Module "ConfigCI" From 744476aef5b44394e05c7426c5fadbece2a1e643 Mon Sep 17 00:00:00 2001 From: Marty Hernandez Avedon Date: Fri, 9 Jul 2021 10:12:28 -0400 Subject: [PATCH 147/279] pruning dead link The 'More information' link for the ebook currently redirects to an unrelated marketing page --- windows/security/threat-protection/intelligence/phishing.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 55d1b756ed..1f997dac95 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -99,4 +99,3 @@ If you feel you've been a victim of a phishing attack: - [Protect yourself from phishing](https://support.microsoft.com/help/4033787/windows-protect-yourself-from-phishing) - [Phishing trends](phishing-trends.md) -- [Microsoft e-book on preventing social engineering attacks](https://info.microsoft.com/Protectyourweakestlink.html?ls=social), especially in enterprise environments. \ No newline at end of file From 42de6f1f5288d164f0fc07e071ca322a5d6bc746 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 9 Jul 2021 21:39:42 +0530 Subject: [PATCH 148/279] fixed typo error as per user report #9790 , so I have corrected the word **Havens** to **Hagens** --- .../password-must-meet-complexity-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index c40865f9da..adc677996b 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -31,7 +31,7 @@ The **Passwords must meet complexity requirements** policy setting determines wh 1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive. The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Havens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password. + The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password. 2. The password contains characters from three of the following categories: From ffb89f17259a2f487ae6d5753ecd12955793bb62 Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Fri, 9 Jul 2021 10:14:47 -0700 Subject: [PATCH 149/279] Update configuration-service-provider-reference.md Fixed HotSpot CSP support to contain Professional, Business, Education and Enterprise. Reflecting the right applicability. --- .../mdm/configuration-service-provider-reference.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 4f9dd3d9da..4dc856f036 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -1270,10 +1270,10 @@ Additional lists: - - - - + + + +
Specific EMET featuresHow these EMET features map
-to Windows 10 features		Specific EMET featuresHow these EMET features map
+to Windows 10 features
cross markcross markcross markcross markcross markcheck markcheck markcheck markcheck mark check mark
From 6978fbd3101b634aefa66ad434e49be7b8ae0b5a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 11:43:41 -0700 Subject: [PATCH 150/279] Corrected bad links --- .../overview-of-threat-mitigations-in-windows-10.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 8791e49d7f..f98634584d 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -25,7 +25,7 @@ This topic provides an overview of some of the software and firmware threats fac | [The security threat landscape](#threat-landscape) | Describes the current nature of the security threat landscape, and outlines how Windows 10 is designed to mitigate software exploits and similar threats. | | [Windows 10 mitigations that you can configure](#windows-10-mitigations-that-you-can-configure) | Provides tables of configurable threat mitigations with links to more information. Product features such as Device Guard appear in [Table 1](#windows-10-mitigations-that-you-can-configure), and memory protection options such as Data Execution Prevention appear in [Table 2](#table-2). | | [Mitigations that are built in to Windows 10](#mitigations-that-are-built-in-to-windows-10) | Provides descriptions of Windows 10 mitigations that require no configuration—they are built into the operating system. For example, heap protections and kernel pool protections are built into Windows 10. | -| [Understanding Windows 10 in relation to the Enhanced Mitigation Experience Toolkit](#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Describes how mitigations in the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/kb/2458544) correspond to features built into Windows 10 and how to convert EMET settings into mitigation policies for Windows 10. | +| [Understanding Windows 10 in relation to the Enhanced Mitigation Experience Toolkit](#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Describes how mitigations in the [Enhanced Mitigation Experience Toolkit (EMET)](https://www.microsoft.com/download/details.aspx?id=48240) correspond to features built into Windows 10 and how to convert EMET settings into mitigation policies for Windows 10. | This topic focuses on pre-breach mitigations aimed at device protection and threat resistance. These protections work with other security defenses in Windows 10, as shown in the following illustration: @@ -435,7 +435,7 @@ Examples: Set-ProcessMitigation -Name notepad.exe -Enable SEHOP -Disable MandatoryASLR,DEPATL ``` -- **Convert Attack surface reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET's Attack surface reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy, as described in [Deploy Device Guard: deploy code integrity policies](/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies). This will enable protections on Windows 10 equivalent to EMET's ASR protections. +- **Convert Attack surface reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET's Attack surface reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy, as described in [Deploy Device Guard: deploy code integrity policies](/windows/device-security/device-guard/deploy-windows-defender-application-control). This will enable protections on Windows 10 equivalent to EMET's ASR protections. - **Convert Certificate Trust settings to enterprise certificate pinning rules**: If you have an EMET "Certificate Trust" XML file (pinning rules file), you can also use ConvertTo-ProcessMitigationPolicy to convert the pinning rules file into an enterprise certificate pinning rules file. Then you can finish enabling that file as described in [Enterprise Certificate Pinning](/windows/access-protection/enterprise-certificate-pinning). For example: From 8b304f43626766aa909719130b3d5ec4fea5c64b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:26:47 -0700 Subject: [PATCH 151/279] Fixed bad link for WIP for business --- windows/whats-new/whats-new-windows-10-version-1709.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md index 6386e1bddd..128c447ff4 100644 --- a/windows/whats-new/whats-new-windows-10-version-1709.md +++ b/windows/whats-new/whats-new-windows-10-version-1709.md @@ -52,7 +52,7 @@ WUfB now has additional controls available to manage Windows Insider Program enr ### Windows Insider Program for Business -You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](/windows/deployment/update/waas-windows-insider-for-business#getting-started-with-windows-insider-program-for-business). +You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://insider.windows.com/for-business). ## Administration From 770e693e789c6d3646829e91274a7fc27fe23fcd Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:27:39 -0700 Subject: [PATCH 152/279] Fixed bad links for ARSO and Remote Desktop with Biometrics --- windows/whats-new/whats-new-windows-10-version-1903.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 82419adcf5..371bf97c95 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -54,7 +54,7 @@ SetupDiag is a command-line tool that can help diagnose why a Windows 10 update ## Servicing - [**Delivery Optimization**](/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Manager content coming soon! -- [**Automatic Restart Sign-on (ARSO)**](/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. - **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. @@ -132,7 +132,7 @@ This new feature is displayed under the Device Security page with the string “ - [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. - [Streamlined Windows Hello PIN reset experience](/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. - Sign-in with [Password-less](/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! -- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. +- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Security management From 50b4b72e0413c266ae8cdfab6463a9abcf9fe47e Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:36:16 -0700 Subject: [PATCH 153/279] Added backticks to destinations that I missed on the previous pass --- windows/privacy/manage-windows-1809-endpoints.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 20573d11ec..eb5e4f6104 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -74,7 +74,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| | HTTPS | wildcard.twimg.com | +| | HTTPS | `wildcard.twimg.com` | | svchost.exe | | `oem.twimg.com/windows/tile.xml` | The following endpoint is used for Facebook updates. @@ -93,7 +93,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| WindowsApps\Microsoft.Windows.Photos | HTTPS | evoke-windowsservices-tas.msedge.net | +| WindowsApps\Microsoft.Windows.Photos | HTTPS | `evoke-windowsservices-tas.msedge.net` | The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). @@ -111,7 +111,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com | +| system32\AppHostRegistrationVerifier.exe | HTTPS | `wallet.microsoft.com` | The following endpoint is used by the Groove Music app for update HTTP handler status. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app. @@ -332,7 +332,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| -| system32\Auth.Host.exe | HTTPS | outlook.office365.com | +| system32\Auth.Host.exe | HTTPS | `outlook.office365.com` | The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them. From c5df76c96eb4fc5fb1cf4ddc04114a7f659dd072 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:41:54 -0700 Subject: [PATCH 154/279] Removed useless backticks I don't know why I thought these would be helpful. I also don't know why these links weren't working when I tested them earlier, before the backticks. --- .../threat-protection/intelligence/macro-malware.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md index 625498e600..5bf655b20c 100644 --- a/windows/security/threat-protection/intelligence/macro-malware.md +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -28,12 +28,12 @@ Macro malware was fairly common several years ago because macros ran automatical We've seen macro malware download threats from the following families: -* [`Ransom:MSIL/Swappa`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) -* [`Ransom:Win32/Teerac`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Teerac&threatId=-2147277789) -* [`TrojanDownloader:Win32/Chanitor`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) -* [`TrojanSpy:Win32/Ursnif`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) -* [`Win32/Fynloski`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) -* [`Worm:Win32/Gamarue`](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) +* [Ransom:MSIL/Swappa](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) +* [Ransom:Win32/Teerac](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Teerac&threatId=-2147277789) +* [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) +* [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) +* [Win32/Fynloski](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) +* [Worm:Win32/Gamarue](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) ## How to protect against macro malware From b714910dffbd7673ffc9f7d02c94566efbd2f036 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:46:21 -0700 Subject: [PATCH 155/279] Deleted apparent garbage character --- windows/whats-new/ltsc/whats-new-windows-10-2019.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index d71b6e5778..d9d11ffcb6 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -263,7 +263,7 @@ The new [security baseline for Windows 10 version 1803](/windows/security/threat #### SMBLoris vulnerability -An issue, known as “SMBLoris�?, which could result in denial of service, has been addressed. +An issue, known as _SMBLoris_, which could result in denial of service, has been addressed. #### Windows Security Center From 60d1d12590786d805ef5b518b23fcb8d6503cfcf Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 9 Jul 2021 12:48:15 -0700 Subject: [PATCH 156/279] Deleted apparent garbage character --- windows/whats-new/whats-new-windows-10-version-1709.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md index 128c447ff4..80fd32b4a9 100644 --- a/windows/whats-new/whats-new-windows-10-version-1709.md +++ b/windows/whats-new/whats-new-windows-10-version-1709.md @@ -119,7 +119,7 @@ The minimum PIN length is being changed from 6 to 4, with a default of 6. For mo Microsoft has released new [Windows security baselines](/windows/device-security/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](/windows/device-security/security-compliance-toolkit-10). ### SMBLoris vulnerability -An issue, known as “SMBLoris�?, which could result in denial of service, has been addressed. +An issue, known as _SMBLoris_, which could result in denial of service, has been addressed. ## Windows Analytics From 061c07a4bc3658368ff7152de2bc9532b265d910 Mon Sep 17 00:00:00 2001 From: Maggie Dakeva Date: Fri, 9 Jul 2021 15:38:31 -0700 Subject: [PATCH 157/279] Update enroll-a-windows-10-device-automatically-using-group-policy.md Removing a note since it's not accurate. The note below which states that Device credential is supported for Co-management and Azure Virtual Desktop is accurate. --- ...oll-a-windows-10-device-automatically-using-group-policy.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 775e72cacd..1274fdb476 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -117,9 +117,6 @@ Requirements: 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - > [!NOTE] - > **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. From 551d62f8d74e9ba3ab19cbe963b610673c5c563b Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Fri, 9 Jul 2021 17:05:29 -0700 Subject: [PATCH 158/279] Update diagnose-mdm-failures-in-windows-10.md Removed Windows Mobile specific content "Field Medic" section --- .../diagnose-mdm-failures-in-windows-10.md | 68 ------------------- 1 file changed, 68 deletions(-) diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 3bd7186d4f..6043b61d8c 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -133,74 +133,6 @@ Example: Export the Debug logs ``` -**To collect logs manually** - -1. Download and install the [Field Medic]( https://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store. -2. Open the Field Medic app and then click on **Advanced**. - - ![field medic screenshot 2](images/diagnose-mdm-failures2.png) - -3. Click on **Choose with ETW provider to use**. - - ![field medic screenshot 3](images/diagnose-mdm-failures3.png) - -4. Check **Enterprise** and un-check the rest. - - ![field medic screenshot 4](images/diagnose-mdm-failures4.png) - -5. In the app, click on **Start Logging** and then perform the operation that you want to troubleshoot. - - ![field medic screenshot 5](images/diagnose-mdm-failures2.png) - -6. When the operation is done, click on **Stop Logging**. - - ![field medic screenshot 6](images/diagnose-mdm-failures5.png) - -7. Save the logs. They will be stored in the Field Medic log location on the device. -8. You can send the logs via email by attaching the files from **Documents > Field Medic > Reports > ...** folder. - - ![device documents folder](images/diagnose-mdm-failures6.png)![device folder screenshot 7](images/diagnose-mdm-failures7.png)![device folder screenshot 8](images/diagnose-mdm-failures8.png) - -The following table contains a list of common providers and their corresponding GUIDs. - -| GUID | Provider Name | -|--------------------------------------|--------------------------------------------------------| -| 099614a5-5dd7-4788-8bc9-e29f43db28fc | Microsoft-Windows-LDAP-Client | -| 0f67e49f-fe51-4e9f-b490-6f2948cc6027 | Microsoft-Windows-Kernel-Processor-Power | -| 0ff1c24b-7f05-45c0-abdc-3c8521be4f62 | Microsoft-Windows-Mobile-Broadband-Experience-SmsApi | -| 10e4f0e0-9686-4e62-b2d6-fd010eb976d3 | Microsoft-WindowsPhone-Shell-Events | -| 1e39b4ce-d1e6-46ce-b65b-5ab05d6cc266 | Microsoft-Windows-Networking-RealTimeCommunication | -| 22a7b160-f6e8-46b9-8e0b-a51989c85c66 | Microsoft-WindowsPhone-Bluetooth-AG | -| 2f94e1cc-a8c5-4fe7-a1c3-53d7bda8e73e | Microsoft-WindowsPhone-ConfigManager2 | -| 331c3b3a-2005-44c2-ac5e-77220c37d6b4 | Microsoft-Windows-Kernel-Power | -| 33693e1d-246a-471b-83be-3e75f47a832d | Microsoft-Windows-BTH-BTHUSB | -| 3742be72-99a9-42e6-9fd5-c01a330e3625 | Microsoft-WindowsPhone-PhoneAudio | -| 3b9602ff-e09b-4c6c-bc19-1a3dfa8f2250 | Microsoft-WindowsPhone-OmaDm-Client-Provider | -| 3da494e4-0fe2-415C-b895-fb5265c5c83b | Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider | -| 3f471139-acb7-4a01-b7a7-ff5da4ba2d43 | Microsoft-Windows-AppXDeployment-Server | -| 4180c4f7-e238-5519-338f-ec214f0b49aa | Microsoft.Windows.ResourceManager | -| 4637124c-1d40-4b4d-892f-2aaecf24ff06 | Microsoft-Windows-WinJson | -| 4d13548f-c7b8-4174-bb7a-d7f64bf22d29 | Microsoft-WindowsPhone-LocationServiceProvider | -| 4eacb4d0-263b-4b93-8cd6-778a278e5642 | Microsoft-Windows-GenericRoaming | -| 4f386063-ef17-4629-863c-d71597af743d | Microsoft-WindowsPhone-NotificationService | -| 55404e71-4db9-4deb-a5f5-8f86e46dde56 | Microsoft-Windows-Winsock-NameResolution | -| 59819d0a-adaf-46b2-8d7c-990bc39c7c15 | Microsoft-Windows-Battery | -| 5c103042-7e75-4629-a748-bdfa67607fac | Microsoft-WindowsPhone-Power | -| 69c1c3f1-2b5c-41d0-a14a-c7ca5130640e | Microsoft-WindowsPhone-Cortana | -| 6ad52b32-d609-4be9-ae07-ce8dae937e39 | Microsoft-Windows-RPC | -| 7263516b-6eb0-477b-b64f-17b91d29f239 | Microsoft-WindowsPhone-BatterySense | -| 7dd42a49-5329-4832-8dfd-43d979153a88 | Microsoft-Windows-Kernel-Network | -| ae4bd3be-f36f-45b6-8d21-bdd6fb832853 | Microsoft-Windows-Audio | -| daa6a96b-f3e7-4d4d-a0d6-31a350e6a445 | Microsoft-Windows-WLAN-Driver | -| 4d13548f-c7b8-4174-bb7a-d7f64bf22d29 | Microsoft-WindowsPhone-LocationServiceProvider | -| 74e106b7-00be-4a55-b707-7ab58d6a9e90 | Microsoft-WindowsPhone-Shell-OOBE | -| cbda4dbf-8d5d-4f69-9578-be14aa540d22 | Microsoft-Windows-AppLocker | -| e595f735-b42a-494b-afcd-b68666945cd3 | Microsoft-Windows-Firewall | -| e5fc4a0f-7198-492f-9b0f-88fdcbfded48 | Microsoft-Windows Networking VPN | -| e5c16d49-2464-4382-bb20-97a4b5465db9 | Microsoft-Windows-WiFiNetworkManager | - - --> - ## Collect logs remotely from Windows 10 Holographic For holographic already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md). From 00d2ef396b1bcb34f2b70bf5dcfb72b763a6d403 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 10 Jul 2021 17:22:22 +0530 Subject: [PATCH 159/279] Update windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../password-must-meet-complexity-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index adc677996b..2167a3d000 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -31,7 +31,7 @@ The **Passwords must meet complexity requirements** policy setting determines wh 1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive. The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "havens" as a substring anywhere in the password. + The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password. 2. The password contains characters from three of the following categories: From 269c72b0590e8e4deaa754a5cd70f138ed212ebc Mon Sep 17 00:00:00 2001 From: Kim Klein Date: Mon, 12 Jul 2021 10:50:43 -0700 Subject: [PATCH 160/279] Corrected cmdlet misspellings --- .../select-types-of-rules-to-create.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 29cd125c84..33529a500c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -27,9 +27,9 @@ ms.technology: mde Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. -## Getting started with commdlets +## Getting started with cmdlets -Some of the [SKUs](feature-availability.md) that support our PowerShell commandlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. +Some of the [SKUs](feature-availability.md) that support our PowerShell cmdlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. **Steps to install the module:** - Install-Module "ConfigCI" From 77ed05c3409eb6a5ea1d4305dd3db2f8adb14aa8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 12 Jul 2021 12:23:32 -0700 Subject: [PATCH 161/279] Update select-types-of-rules-to-create.md --- .../select-types-of-rules-to-create.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 33529a500c..e6b9a0016a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -14,7 +14,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 03/04/2020 +ms.date: 07/12/2021 ms.technology: mde --- @@ -31,7 +31,7 @@ Windows Defender Application Control (WDAC) can control what runs on Windows 10 Some of the [SKUs](feature-availability.md) that support our PowerShell cmdlets [(ConfigCI Module)](/powershell/module/configci/?view=windowsserver2019-ps) support but do not have the module installed on the box. -**Steps to install the module:** +### Steps to install the module - Install-Module "ConfigCI" - Import-Module "ConfigCI" @@ -54,7 +54,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru > [!NOTE] > We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. To allow these applications, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode. -**Table 1. Windows Defender Application Control policy - policy rule options** +### Table 1. Windows Defender Application Control policy - policy rule options | Rule option | Description | |------------ | ----------- | @@ -96,7 +96,7 @@ File rule levels allow administrators to specify the level at which they want to Each file rule level has its benefit and disadvantage. Use Table 2 to select the appropriate protection level for your available administrative resources and Windows Defender Application Control deployment scenario. -**Table 2. Windows Defender Application Control policy - file rule levels** +### Table 2. Windows Defender Application Control policy - file rule levels | Rule level | Description | |----------- | ----------- | @@ -172,7 +172,7 @@ File name rule levels let you specify file attributes to base a rule on. File na Use Table 3 to select the appropriate file name level for your use cases. For instance, an LOB or production application and its binaries may all share the same product name. This option lets you easily create targeted policies based on the Product Name filename rule level. -**Table 3. Windows Defender Application Control policy - filename levels** +### Table 3. Windows Defender Application Control policy - filename levels | Rule level | Description | |----------- | ----------- | From d30945490824ae56b5d8f7aae799c0e70b923ba9 Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Mon, 12 Jul 2021 15:11:40 -0700 Subject: [PATCH 162/279] Update configuration-service-provider-reference.md Corrected support of UEFI CSP. Professional cross mark -> Check mark --- .../mdm/configuration-service-provider-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 4dc856f036..a780da0495 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2156,7 +2156,7 @@ Additional lists: cross mark - cross mark + check mark check mark4 check mark4 check mark4 From a5cabf972ee453c68bb15477aaafaa5ba71010b0 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 12 Jul 2021 22:04:04 -0700 Subject: [PATCH 163/279] Changes to raise the Acrolinx score This work is so that sync PR https://github.com/MicrosoftDocs/windows-docs-pr/pull/5382 can be merged. --- ...sword-must-meet-complexity-requirements.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 2167a3d000..1a74bf2b3a 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -28,10 +28,10 @@ Describes the best practices, location, values, and security considerations for The **Passwords must meet complexity requirements** policy setting determines whether passwords must meet a series of strong-password guidelines. When enabled, this setting requires passwords to meet the following requirements: -1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks are not case-sensitive. +1. Passwords may not contain the user's samAccountName (Account Name) value or entire displayName (Full Name value). Both checks aren't case-sensitive. - The samAccountName is checked in its entirety only to determine whether it is part of the password. If the samAccountName is fewer than three characters long, this check is skipped. - The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens are not checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it is ignored. Therefore, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password. + The samAccountName is checked in its entirety only to determine whether it's part of the password. If the samAccountName is fewer than three characters long, this check is skipped. + The displayName is parsed for delimiters: commas, periods, dashes or hyphens, underscores, spaces, pound signs, and tabs. If any of these delimiters are found, the displayName is split and all parsed sections (tokens) are confirmed not to be included in the password. Tokens that are shorter than three characters are ignored, and substrings of the tokens aren't checked. For example, the name "Erin M. Hagens" is split into three tokens: "Erin", "M", and "Hagens". Because the second token is only one character long, it's ignored. So, this user could not have a password that included either "erin" or "hagens" as a substring anywhere in the password. 2. The password contains characters from three of the following categories: @@ -47,7 +47,7 @@ Complexity requirements are enforced when passwords are changed or created. The rules that are included in the Windows Server password complexity requirements are part of Passfilt.dll, and they cannot be directly modified. -When enabled, the default Passfilt.dll may cause some additional Help Desk calls for locked-out accounts because users aren't used to passwords that contain characters that aren't in the alphabet. But this policy setting is liberal enough that all users should get used to it. +When enabled, the default Passfilt.dll may cause some more Help Desk calls for locked-out accounts, because users are used to passwords that contain only characters that are in the alphabet. But this policy setting is liberal enough that all users should get used to it. Additional settings that can be included in a custom Passfilt.dll are the use of non–upper-row characters. To type upper-row characters, you hold the SHIFT key and press one of any of the keys on the number row of the keyboard (from 1 through 9 and 0). @@ -64,7 +64,7 @@ Additional settings that can be included in a custom Passfilt.dll are the use of Set **Passwords must meet complexity requirements** to Enabled. This policy setting, combined with a minimum password length of 8, ensures that there are at least 218,340,105,584,896 different possibilities for a single password. This setting makes a brute force attack difficult, but still not impossible. -The use of ALT key character combinations can greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements can result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add additional complexity to the password.) +The use of ALT key character combinations may greatly enhance the complexity of a password. However, requiring all users in an organization to adhere to such stringent password requirements might result in unhappy users and an over-worked Help Desk. Consider implementing a requirement in your organization to use ALT characters in the range from 0128 through 0159 as part of all administrator passwords. (ALT characters outside of that range can represent standard alphanumeric characters that do not add more complexity to the password.) Passwords that contain only alphanumeric characters are easy to compromise by using publicly available tools. To prevent this, passwords should contain additional characters and meet complexity requirements. @@ -74,16 +74,16 @@ Passwords that contain only alphanumeric characters are easy to compromise by us ### Default values -The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. +The following table lists the actual and effective default policy values. Default values are also listed on the policy's property page. | Server type or Group Policy Object (GPO) | Default value | -| - | - | -| Default domain policy| Enabled| -| Default domain controller policy| Enabled| -| Stand-alone server default settings | Disabled| -| Domain controller effective default settings | Enabled| -| Member server effective default settings | Enabled| -| Effective GPO default settings on client computers | Disabled| +|---|---| +| Default domain policy | Enabled | +| Default domain controller policy | Enabled | +| Stand-alone server default settings | Disabled | +| Domain controller effective default settings | Enabled | +| Member server effective default settings | Enabled| +| Effective GPO default settings on client computers | Disabled | ## Security considerations @@ -91,21 +91,21 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Passwords that contain only alphanumeric characters are extremely easy to discover with several publicly available tools. +Passwords that contain only alphanumeric characters are easy to discover with several publicly available tools. ### Countermeasure -Configure the **Passwords must meet complexity requirements** policy setting to Enabled and advise users to use a variety of characters in their passwords. +Configure the **Passwords must meet complexity requirements** policy setting to _Enabled_ and advise users to use a variety of characters in their passwords. -When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it is difficult (but not impossible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.) +When combined with a [Minimum password length](minimum-password-length.md) of 8, this policy setting ensures that the number of different possibilities for a single password is so great that it's difficult (but possible) for a brute force attack to succeed. (If the Minimum password length policy setting is increased, the average amount of time necessary for a successful attack also increases.) ### Potential impact -If the default password complexity configuration is retained, additional Help Desk calls for locked-out accounts could occur because users might not be accustomed to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to comply with the complexity requirement with minimal difficulty. +If the default configuration for password complexity is kept, more Help Desk calls for locked-out accounts could occur because users might not be used to passwords that contain non-alphabetical characters, or they might have problems entering passwords that contain accented characters or symbols on keyboards with different layouts. However, all users should be able to follow the complexity requirement with minimal difficulty. -If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password does not contain common dictionary words or fragments. +If your organization has more stringent security requirements, you can create a custom version of the Passfilt.dll file that allows the use of arbitrarily complex password strength rules. For example, a custom password filter might require the use of non-upper-row symbols. (Upper-row symbols are those symbols that require you to press and hold the SHIFT key and then press any of the keys on the number row of the keyboard, from 1 through 9 and 0.) A custom password filter might also perform a dictionary check to verify that the proposed password doesn't contain common dictionary words or fragments. -The use of ALT key character combinations can greatly enhance the complexity of a password. However, such stringent password requirements can result in additional Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that would not add additional complexity to the password.) +The use of ALT key character combinations may greatly enhance the complexity of a password. However, such stringent password requirements might result in more Help Desk requests. Alternatively, your organization could consider a requirement for all administrator passwords to use ALT characters in the 0128–0159 range. (ALT characters outside of this range can represent standard alphanumeric characters that wouldn't add more complexity to the password.) ## Related articles From 1e90e9f4c81e499d996cfaa5e30825b0c964b236 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 13 Jul 2021 22:03:30 +0530 Subject: [PATCH 164/279] Updated --- .../mdm/policy-csp-networklistmanager.md | 17 ++++++++--------- windows/client-management/mdm/toc.yml | 4 ++-- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index d8d7be2137..13da8d30a4 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -1,13 +1,13 @@ --- title: Policy CSP - NetworkListManager description: The Policy CSP - NetworkListManager setting creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure. -ms.author: dansimp +ms.author: v-nsatapathy ms.topic: article ms.prod: w10 ms.technology: windows author: nimishasatapathy ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 7/10/2021 ms.reviewer: manager: dansimp --- @@ -15,7 +15,6 @@ manager: dansimp # Policy CSP - NetworkListManager -

@@ -48,11 +47,11 @@ manager: dansimp Pro - check mark + check mark Business - check mark + check mark Enterprise @@ -60,7 +59,7 @@ manager: dansimp Education - check mark + check mark @@ -116,11 +115,11 @@ ADMX Info: Pro - check mark + check mark Business - check mark + check mark Enterprise @@ -128,7 +127,7 @@ ADMX Info: Education - check mark + check mark diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index f9a7d7ef62..0b96b10953 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -727,8 +727,8 @@ items: href: policy-csp-multitasking.md - name: NetworkIsolation href: policy-csp-networkisolation.md - - name: NetworkLinkManager - href: policy-csp-networklinkmanager.md + - name: NetworkListManager + href: policy-csp-networklistmanager.md - name: Notifications href: policy-csp-notifications.md - name: Power From 6d86539e91a7d9ff4a09cc75250d80242928fde3 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 13 Jul 2021 22:14:57 +0530 Subject: [PATCH 165/279] Update toc.yml --- windows/client-management/mdm/toc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 0b96b10953..51a0630b08 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -728,7 +728,7 @@ items: - name: NetworkIsolation href: policy-csp-networkisolation.md - name: NetworkListManager - href: policy-csp-networklistmanager.md + href: policy-csp-networklistmanager.md - name: Notifications href: policy-csp-notifications.md - name: Power From 94b4379cd2804c471a49451ffe7d129e50934136 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 13 Jul 2021 23:18:17 +0530 Subject: [PATCH 166/279] Update policy-csp-networklistmanager.md --- .../mdm/policy-csp-networklistmanager.md | 47 +------------------ 1 file changed, 1 insertion(+), 46 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-networklistmanager.md b/windows/client-management/mdm/policy-csp-networklistmanager.md index 13da8d30a4..4328d1b831 100644 --- a/windows/client-management/mdm/policy-csp-networklistmanager.md +++ b/windows/client-management/mdm/policy-csp-networklistmanager.md @@ -78,23 +78,6 @@ manager: dansimp This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated. - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Creates a new MDM policy that allows admins to configure a list of URIs of HTTPS endpoints that are considered secure* -- GP name: *NetworkListManager/AllowedTlsAuthenticationEndpoints* -- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM* -- GP ADMX file name: *NetworkListManager.admx* - - -
@@ -144,37 +127,9 @@ ADMX Info: -This policy setting provides The string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy. +This policy setting provides the string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy. - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Creates a new MDM policy that allows admins to configure a name for TLS authenticated networks* -- GP name: *NetworkListManager/ConfiguredTLSAuthenticationNetworkName* -- GP path: *OS\Core\STACK\MobCon-Mobile Connectivity\Connection Awareness\NLM* -- GP ADMX file name: *NetworkListManager.admx* - - -
-Footnotes: - -- 1 - Available in Windows 10, version 1607. -- 2 - Available in Windows 10, version 1703. -- 3 - Available in Windows 10, version 1709. -- 4 - Available in Windows 10, version 1803. -- 5 - Available in Windows 10, version 1809. -- 6 - Available in Windows 10, version 1903. -- 7 - Available in Windows 10, version 1909. -- 8 - Available in Windows 10, version 2004. - From 1fcd7ee99724df028de45624a918fee8c48578ef Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 13 Jul 2021 10:55:15 -0700 Subject: [PATCH 167/279] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index dc1dd3eca7..2f10e7426d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -17957,27 +17957,27 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration", + "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-configuration-manager.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-configuration-manager", + "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-configuration-manager", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-group-policy-objects.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-group-policy-objects", + "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-group-policy-objects", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-intune.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-intune", + "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-intune", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-atp-post-migration-other-tools.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/manage-endpoint-post-migration-other-tools", + "redirect_url": "/microsoft-365/security/defender-endpoint/manage-atp-post-migration-other-tools", "redirect_document_id": false }, { @@ -18022,22 +18022,22 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-migration.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-migration", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-migration", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-onboard.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-onboard", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-onboard", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-prepare.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-prepare", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-prepare", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/mcafee-to-microsoft-defender-setup", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-setup", "redirect_document_id": false }, { @@ -18367,22 +18367,22 @@ }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-migration.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-migration", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-migration", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-onboard.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-onboard", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-onboard", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-prepare.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-prepare", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-prepare", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/microsoft-defender-atp/symantec-to-microsoft-defender-atp-setup.md", - "redirect_url": "/microsoft-365/security/defender-endpoint/symantec-to-microsoft-defender-endpoint-setup", + "redirect_url": "/microsoft-365/security/defender-endpoint/switch-to-microsoft-defender-setup", "redirect_document_id": false }, { From b8bbf43577e4f6dd818235c4db3c3350cba97b0e Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 13 Jul 2021 12:03:19 -0700 Subject: [PATCH 168/279] updating check marks --- .../mdm/configuration-service-provider-reference.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index a780da0495..c22595460c 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -1270,10 +1270,10 @@ Additional lists: cross mark - check mark - check mark - check mark - check mark + check mark + check mark + check mark + check mark check mark From e9582816ae06af226dd38472e52c4c45e602bf4c Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 13 Jul 2021 12:34:00 -0700 Subject: [PATCH 169/279] updating UEFI too --- .../mdm/configuration-service-provider-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index c22595460c..cce8060fe3 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2156,7 +2156,7 @@ Additional lists: cross mark - check mark + check mark check mark4 check mark4 check mark4 From 7d71012f2c43aeac083218ec17953e311d4f8ad8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 13 Jul 2021 13:24:31 -0700 Subject: [PATCH 170/279] Update select-types-of-rules-to-create.md --- .../select-types-of-rules-to-create.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 5f12576ef7..a05bd37d01 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -14,7 +14,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 03/04/2020 +ms.date: 07/13/2021 ms.technology: mde --- @@ -121,7 +121,7 @@ To create the WDAC policy, they build a reference server on their standard hardw As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. ## File rule precedence order -<<<<<<< HEAD + WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). ## More information about filepath rules From eb90c7fec69f8f95879d5886da983516b58d029b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 13 Jul 2021 13:24:49 -0700 Subject: [PATCH 171/279] Update windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index a05bd37d01..0f5ed1558b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -122,7 +122,7 @@ As part of normal operations, they will eventually install software updates, or ## File rule precedence order -WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). +WDAC has a built-in file rule conflict logic that translates to precedence order. It will first process all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). ## More information about filepath rules From 39a975e9dc090d4c264258237b627d227a7ffa5d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 13 Jul 2021 13:25:19 -0700 Subject: [PATCH 172/279] Update event-tag-explanations.md --- .../event-tag-explanations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index d19f762683..9eb35220b5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -14,7 +14,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 8/27/2020 +ms.date: 07/13/2021 ms.technology: mde --- From 40ce58718de251c57979f41d87ae4f77a6c617c3 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 13 Jul 2021 18:51:12 -0700 Subject: [PATCH 173/279] Applied proper >[!NOTE] style and made other formatting changes --- ...erated-authentication-device-enrollment.md | 33 +++++++++++-------- 1 file changed, 20 insertions(+), 13 deletions(-) diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 19f9e8481a..5a31b4587a 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -152,7 +152,7 @@ The following are the explicit requirements for the server. The enrollment client issues an HTTPS request as follows: -``` +```http AuthenticationServiceUrl?appru=&login_hint= ``` @@ -235,16 +235,18 @@ Policy service is optional. By default, if no policies are specified, the minimu This web service implements the X.509 Certificate Enrollment Policy Protocol (MS-XCEP) specification that allows customizing certificate enrollment to match different security needs of enterprises at different times (cryptographic agility). The service processes the GetPolicies message from the client, authenticates the client, and returns matching enrollment policies in the GetPoliciesResponse message. -For Federated authentication policy, The security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows: +For Federated authentication policy, the security token credential is provided in a request message using the <wsse:BinarySecurityToken> element \[WSS\]. The security token is retrieved as described in the discovery response section. The authentication information is as follows: - wsse:Security: The enrollment client implements the <wsse:Security> element defined in \[WSS\] section 5. The <wsse:Security> element must be a child of the <s:Header> element. - wsse:BinarySecurityToken: The enrollment client implements the <wsse:BinarySecurityToken> element defined in \[WSS\] section 6.3. The <wsse:BinarySecurityToken> element must be included as a child of the <wsse:Security> element in the SOAP header. As was described in the discovery response section, the inclusion of the <wsse:BinarySecurityToken> element is opaque to the enrollment client, and the client does not interpret the string, and the inclusion of the element is agreed upon by the security token authentication server (as identified in the <AuthenticationServiceUrl> element of <DiscoveryResponse> and the enterprise server. -The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element. wsse:BinarySecurityToken/attributes/ValueType: The <wsse:BinarySecurityToken> ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken". +The <wsse:BinarySecurityToken> element contains a base64-encoded string. The enrollment client uses the security token received from the authentication server and base64-encodes the token to populate the <wsse:BinarySecurityToken> element. -wsse:BinarySecurityToken/attributes/EncodingType: The <wsse:BinarySecurityToken> EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary". +- wsse:BinarySecurityToken/attributes/ValueType: The `` ValueType attribute must be "http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentUserToken". + +- wsse:BinarySecurityToken/attributes/EncodingType: The `` EncodingType attribute must be "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\#base64binary". The following is an enrollment policy request example with a received security token as client credential. @@ -381,7 +383,7 @@ This web service implements the MS-WSTEP protocol. It processes the RequestSecur The RequestSecurityToken (RST) must have the user credential and a certificate request. The user credential in an RST SOAP envelope is the same as in GetPolicies, and can vary depending on whether the authentication policy is OnPremise or Federated. The BinarySecurityToken in an RST SOAP body contains a Base64-encoded PKCS\#10 certificate request, which is generated by the client based on the enrollment policy. The client could have requested an enrollment policy by using MS-XCEP before requesting a certificate using MS-WSTEP. If the PKCS\#10 certificate request is accepted by the certification authority (CA) (the key length, hashing algorithm, and so on match the certificate template), the client can enroll successfully. -Note that the RequestSecurityToken will use a custom TokenType (http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section. +Note that the RequestSecurityToken will use a custom TokenType (`http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken`), because our enrollment token is more than an X.509 v3 certificate. For more details, see the Response section. The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. @@ -611,11 +613,16 @@ The following code shows sample provisioning XML (presented in the preceding pac ``` -**Notes** - -- <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. -- In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. -- Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. -- The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. -- Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. -- CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. +> [!NOTE] +> +> - <Parm name> and <characteristic type=> elements in the w7 APPLICATION CSP XML are case sensitive and must be all uppercase. +> +> - In w7 APPLICATION characteristic, both CLIENT and APPSRV credentials should be provided in XML. +> +> - Detailed descriptions of these settings are located in the [Enterprise settings, policies and app management](windows-mdm-enterprise-settings.md) section of this document. +> +> - The **PrivateKeyContainer** characteristic is required and must be present in the Enrollment provisioning XML by the enrollment. Other important settings are the **PROVIDER-ID**, **NAME**, and **ADDR** parameter elements, which need to contain the unique ID and NAME of your DM provider and the address where the device can connect for configuration provisioning. The ID and NAME can be arbitrary values, but they must be unique. +> +> - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. +> +> - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. From ce6231a2037e7b1204b74d603d41a2c97be2cf44 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 13 Jul 2021 20:59:31 -0700 Subject: [PATCH 174/279] Removed unnecessary indentation in code; added missing --- ...erated-authentication-device-enrollment.md | 575 +++++++++--------- 1 file changed, 288 insertions(+), 287 deletions(-) diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 5a31b4587a..3a32b79699 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -89,37 +89,37 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc The following example shows the discovery service request. ```xml - - - - - http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover - - urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc - - - - - - user@contoso.com - 3 - 3.0 - WindowsPhone - 10.0.0.0 - - OnPremise - Federated - - - - - + + + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover + + urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://ENROLLTEST.CONTOSO.COM/EnrollmentServer/Discovery.svc + + + + + + user@contoso.com + 3 + 3.0 + WindowsPhone + 10.0.0.0 + + OnPremise + Federated + + + + + ``` The discovery response is in the XML format and includes the following fields: @@ -196,37 +196,37 @@ The server has to send a POST to a redirect URL of the form ms-app://string (the The following example shows a response received from the discovery web service which requires authentication via WAB. ```xml - - - - http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse - - - d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8 - - urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 - - - - - Federated - 3.0 - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - https://portal.manage.contoso.com/LoginRedirect.aspx - - - - - + + + + http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse + + + d9eb2fdd-e38a-46ee-bd93-aea9dc86a3b8 + + urn:uuid: 748132ec-a575-4329-b01b-6171a9cf8478 + + + + + Federated + 3.0 + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + https://portal.manage.contoso.com/LoginRedirect.aspx + + + + + ``` ## Enrollment policy web service @@ -251,44 +251,44 @@ The <wsse:BinarySecurityToken> element contains a base64-encoded string. T The following is an enrollment policy request example with a received security token as client credential. ```xml - - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies - - urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - - B64EncodedSampleBinarySecurityToken - - - - - - - - - - - - - + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies + + urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://enrolltest.contoso.com/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + + B64EncodedSampleBinarySecurityToken + + + + + + + + + + + + + ``` After the user is authenticated, the web service retrieves the certificate template that the user should enroll with and creates enrollment policies based on the certificate template properties. A sample of the response can be found on MSDN. @@ -301,80 +301,80 @@ MS-XCEP supports very flexible enrollment policies using various Complex Types a The following snippet shows the policy web service response. ```xml - - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse - - urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598 - - - - - - - - - - - 0 - - - CEPUnitTest - 3 - - 1209600 - 172800 - - - true - false - - - 2048 - - - - - - - - 101 - 0 - - - - - - - 0 - - - - - - - + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse + + urn:uuid: 69960163-adad-4a72-82d2-bb0e5cff5598 + + + + + + + + + + + 0 - - - 1.3.14.3.2.29 - 1 - 0 - szOID_OIWSEC_sha1RSASign - - - - - + + CEPUnitTest + 3 + + 1209600 + 172800 + + + true + false + + + 2048 + + + + + + + + 101 + 0 + + + + + + + 0 + + + + + + + + + + + 1.3.14.3.2.29 + 1 + 0 + szOID_OIWSEC_sha1RSASign + + + + + ``` ## Enrollment web service @@ -393,83 +393,84 @@ The RST may also specify a number of AdditionalContext items, such as DeviceType The following example shows the enrollment web service request for federated authentication. ```xml - - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep - - urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749 - - http://www.w3.org/2005/08/addressing/anonymous - - - https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC - - - - B64EncodedSampleBinarySecurityToken - - - - - - - http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken - - - http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue - - - DER format PKCS#10 certificate request in Base64 encoding Insterted Here - - - - 4 - - - 10.0.9999.0 - - - MY_WINDOWS_DEVICE - - - FF:FF:FF:FF:FF:FF - - - CC:CC:CC:CC:CC:CC - - 49015420323756 - - - 30215420323756 - - - Full - - - CIMClient_Windows - - - 10.0.9999.0 - - - 7BA748C8-703E-4DF2-A74A-92984117346A - - - True - - - - + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep + + urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749 + + http://www.w3.org/2005/08/addressing/anonymous + + + https://enrolltest.contoso.com:443/ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC + + + + B64EncodedSampleBinarySecurityToken + + + + + + + http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken + + + http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue + + + DER format PKCS#10 certificate request in Base64 encoding Insterted Here + + + + 4 + + + 10.0.9999.0 + + + MY_WINDOWS_DEVICE + + + FF:FF:FF:FF:FF:FF + + + CC:CC:CC:CC:CC:CC + + 49015420323756 + + + 30215420323756 + + + Full + + + CIMClient_Windows + + + 10.0.9999.0 + + + 7BA748C8-703E-4DF2-A74A-92984117346A + + + True + + + + + ``` After validating the request, the web service looks up the assigned certificate template for the client, update it if needed, sends the PKCS\#10 requests to the CA, processes the response from the CA, constructs an OMA Client Provisioning XML format, and returns it in the RequestSecurityTokenResponse (RSTR). @@ -495,43 +496,43 @@ Here is a sample RSTR message and a sample of OMA client provisioning XML within The following example shows the enrollment web service response. ```xml - - - - http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep - - urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab - - - 2012-08-02T00:32:59.420Z - 2012-08-02T00:37:59.420Z - - - - - - - - http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken - - - - - B64EncodedSampleBinarySecurityToken - - - 0 - - - - + + + + http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RSTRC/wstep + + urn:uuid:81a5419a-496b-474f-a627-5cdd33eed8ab + + + 2012-08-02T00:32:59.420Z + 2012-08-02T00:37:59.420Z + + + + + + + + http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken + + + + + B64EncodedSampleBinarySecurityToken + + + 0 + + + + ``` The following code shows sample provisioning XML (presented in the preceding package as a security token): From 6dbf6d1cee21a1ad1cf2924d7f6462672785379c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 14 Jul 2021 11:54:45 +0100 Subject: [PATCH 175/279] Update changes-to-windows-diagnostic-data-collection.md --- .../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index f582ab8f63..5064e1663c 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -72,7 +72,7 @@ A final set of changes includes two new policies that can help you fine-tune dia >[!Important] >All the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier. -## Configure a Windows 10 device to limit crash dumps and logs +## Configure a Windows 11 device to limit crash dumps and logs With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of crash dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them: From baac5ccf496c86c12b65c9a57fd44009f1ee6e40 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 14 Jul 2021 11:57:45 +0100 Subject: [PATCH 176/279] Update changes-to-windows-diagnostic-data-collection.md --- .../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 5064e1663c..86e8ebcf13 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -50,7 +50,7 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience ## Behavioral changes -In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 10 device to limit crash dumps and logs](#configure-a-windows-10-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). +In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see [Configure a Windows 11 device to limit crash dumps and logs](#configure-a-windows-11-device-to-limit-crash-dumps-and-logs). For more information on services that rely on Enhanced diagnostic data, see [Services that rely on Enhanced diagnostic data](#services-that-rely-on-enhanced-diagnostic-data). Additionally, you will see the following policy changes in an upcoming release of Windows 10: From 32cbdb5c1447644f8f8fd730b0eea74da2864ced Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 14 Jul 2021 18:09:46 +0530 Subject: [PATCH 177/279] Updated --- windows/client-management/mdm/toc.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 51a0630b08..1d385366fb 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -519,8 +519,6 @@ items: href: policy-csp-admx-netlogon.md - name: ADMX_NetworkConnections href: policy-csp-admx-networkconnections.md - - name: ADMX_NetworkListManager - href: policy-csp-admx-networklistmanager.md - name: ADMX_OfflineFiles href: policy-csp-admx-offlinefiles.md - name: ADMX_PeerToPeerCaching From 2d5392a9db828752bdcd0a95e4b2eeffe1ffe47b Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 14 Jul 2021 09:19:45 -0700 Subject: [PATCH 178/279] clarification --- windows/deployment/upgrade/setupdiag.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index da30d6f337..98e9be1e49 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -49,7 +49,7 @@ When run by Windows Setup, the following [parameters](#parameters) are used: - /Output:%windir%\logs\SetupDiag\SetupDiagResults.xml - /RegPath:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupDiag\Results -The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. +The resulting SetupDiag analysis can be found at **%WinDir%\Logs\SetupDiag\SetupDiagResults.xml** and in the registry under **HKLM\SYSTEM\Setup\SetupDiag\Results**. Please note that this is not the same as the default registry path when SetupDiag is run manually. When SetupDiag is run manually, and the /RegPath parameter is not specificed, data is stored in the registry at HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag. > [!IMPORTANT] > When SetupDiag indicates that there were multiple failures, the last failure in the log file is typically the fatal error, not the first one. From 704bc15a2b571da34792e3f3353c947663eadb1d Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 14 Jul 2021 12:48:35 -0700 Subject: [PATCH 179/279] add link --- windows/deployment/deploy-whats-new.md | 8 ++++---- windows/whats-new/windows-11.md | 7 +++++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index d2e0935b7d..6c5df77f39 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -35,12 +35,12 @@ Check out the following new articles about Windows 11: - [Plan for Windows 11](/windows/whats-new/windows-11-plan) - [Prepare for Windows 11](/windows/whats-new/windows-11-prepare) +The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available.
+ [SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
-The [Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/adk-install) is available.
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
VPN support is added to [Windows Autopilot](#windows-autopilot)
An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).
-The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.
The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.
## The Modern Desktop Deployment Center @@ -186,9 +186,9 @@ For the latest information about MDT, see the [MDT release notes](/mem/configmgr The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. -Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](/windows-hardware/get-started/adk-install). +Download the Windows ADK and Windows PE add-on for Windows 11 [here](/windows-hardware/get-started/adk-install). -For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). +For information about what's new in the ADK, see [What's new in the Windows ADK](/windows-hardware/get-started/what-s-new-in-kits-and-tools). Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). diff --git a/windows/whats-new/windows-11.md b/windows/whats-new/windows-11.md index 260967a467..2d7eae37a6 100644 --- a/windows/whats-new/windows-11.md +++ b/windows/whats-new/windows-11.md @@ -1,7 +1,6 @@ --- title: Windows 11 overview description: Overview of Windows 11 -ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C ms.reviewer: manager: laurawi ms.audience: itpro @@ -83,4 +82,8 @@ When Windows 11 reaches general availability, important servicing-related announ [Windows 11 requirements](windows-11-requirements.md)
[Plan for Windows 11](windows-11-plan.md)
-[Prepare for Windows 11](windows-11-prepare.md) \ No newline at end of file +[Prepare for Windows 11](windows-11-prepare.md) + +## Also see + +[What's new in Windows 11](/windows-hardware/get-started/what-s-new-in-windows)
\ No newline at end of file From cfdbcd4f76f95b3ae1fe71d4c1602c4f8e0135ee Mon Sep 17 00:00:00 2001 From: Barak Manor Date: Wed, 14 Jul 2021 13:09:58 -0700 Subject: [PATCH 180/279] Creating a new page for Device Installation under Client Management --- ...eviceInstallation_ApplyLayered_Policy2.png | Bin 0 -> 83277 bytes ...eviceInstallation_ApplyLayered_policy1.png | Bin 0 -> 245699 bytes ...Installation_DM_Printer_Compatible_Ids.png | Bin 0 -> 42744 bytes ...ceInstallation_DM_Printer_Hardware_Ids.png | Bin 0 -> 37272 bytes ...eviceInstallation_DM_Printer_by_device.png | Bin 0 -> 123239 bytes ...Installation_DM_Printer_details_screen.png | Bin 0 -> 33695 bytes .../images/DeviceInstallation_DM_USB_HWID.png | Bin 0 -> 43507 bytes ...eviceInstallation_DM_USB_by_connection.png | Bin 0 -> 206435 bytes ...tion_DM_USB_by_connection_and_layering.png | Bin 0 -> 207551 bytes ...tallation_DM_USB_by_connection_blocked.png | Bin 0 -> 98870 bytes .../DeviceInstallation_DM_USB_by_device.png | Bin 0 -> 47760 bytes ...ation_GPO_allow_device_id_list_printer.png | Bin 0 -> 20306 bytes ...tallation_GPO_allow_device_id_list_usb.png | Bin 0 -> 46437 bytes ...iceInstallation_GPO_prevent_class_list.png | Bin 0 -> 26422 bytes ...ion_GPO_prevent_device_id_list_printer.png | Bin 0 -> 28667 bytes ...llation_GPO_prevent_device_id_list_usb.png | Bin 0 -> 26746 bytes .../DeviceInstallation_USB_properties.png | Bin 0 -> 27834 bytes .../images/DeviceInstallation_flowchart.png | Bin 0 -> 67266 bytes ...ge-device-installtion-with-group-policy.md | 543 ++++++++++++++++++ 19 files changed, 543 insertions(+) create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png create mode 100644 windows/client-management/images/DeviceInstallation_ApplyLayered_policy1.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Compatible_Ids.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_Hardware_Ids.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_by_device.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_Printer_details_screen.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_HWID.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_and_layering.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_connection_blocked.png create mode 100644 windows/client-management/images/DeviceInstallation_DM_USB_by_device.png create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_printer.png create mode 100644 windows/client-management/images/DeviceInstallation_GPO_allow_device_id_list_usb.png create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_class_list.png create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_printer.png create mode 100644 windows/client-management/images/DeviceInstallation_GPO_prevent_device_id_list_usb.png create mode 100644 windows/client-management/images/DeviceInstallation_USB_properties.png create mode 100644 windows/client-management/images/DeviceInstallation_flowchart.png create mode 100644 windows/client-management/manage-device-installtion-with-group-policy.md diff --git a/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png b/windows/client-management/images/DeviceInstallation_ApplyLayered_Policy2.png new file mode 100644 index 0000000000000000000000000000000000000000..8cf3edaff44944fd0528b44534075a8faafb8897 GIT binary patch literal 83277 zcmeFZcT`hb7cYuO5fwo>s7Q?(6&2~dC03BGprEvf^xjKo@z@XrBE1voNR>_?5RqOZ zHPj#w5~-0;LI_D-Eay9C-1ogP-o1a^`_J8DFtYYyXRkTen)Nr=O88xUO|ByXN7&fd zxU}xvGGt?8H)mrzuyg1js|O!=c%AjJ&)ZP*23u*r&?4*RfcuhZ0aLzp|cGmr2 zk2{aN+1P}`e*Eo&FRa_Lu`zSCZe710V7Wr)j5~o%{z?mNyZL9#arT&!u-m|Ww*J;% z9^Qy?{aR&ak>_xJEhc#1MB+YNDe}*XVO?96aj^2?x1_SCs*t^Eb9_W{QTa6c
    *u$JawRcl_1|NgXTjna#nnmS`H;Ngk)T$P1v9B&MTghQDDC)+jt{Eo$z6j z7;+m##efr5-8(KxR<2C$+AIbKF3hSoh2UhUrd>C*ObwJLBht|G7a)SC&Dq_ovGC;ukH)z%Q&v3a6o&guc`B@4)Psx77DA~oth$qnAIL%T=c_J$v; z^rEKTiImhF_abMAAy*$GlZbHgmho-qi&f3)4tM<4M8~X>`$UJ8_5#q%z>Y&#kXE-> zzk-pT`1@+!zk;cy5L_OWrT` zus;o~YmE-UsUe}X?YUKU=vDtvZn4^T^Orms`)=LmAUdcNc9yJigT zxGXPi?xXE3VU{o@W?Qz@BMFYvPKjS2Ic8f(uXWzeaG&;N^G&A�-{o2r)$7ZH>9D_w$)Q{we6ibUFgUYg+ zD4E-qox^(H>%YrrJv6Y(h89I6fnBYUH21kmg#4t!WcUTg2HDRO;RJE}^pR?&R4C)d zg#O18OhWO;LD!s%)Y6BfHF!q=ZT2y(*;5DzzkQIp$7AXKAVISvYUVt#+@bDN>FtE$h`GJc2tMDn2IYQB!`KA?U!Cqjj2z<8ZrHf>z z^+WZ8Pee4eHjbTnqoNGi&vuu?1yU5{VSx%LhaTI{(y|}d`D)L34gOj156%2>-4EwB z`PE|cc=3O#nUh&rDccyZ{)DMnJGfYN^ysDz49&OgdEO3bcm(0<;P8>@6u4TAg&O?v zi`Gxa$Lc(-T~*C#G|8@)8^nb@YNglO)FY(N2Mkm1@I-3LDAOg(*)y?-Y5s-ZIp!4) zP&Xoh=OX<%xNay&6jGxkI)p-juJ<>P z98t728kshOmLxSYGlO@m%7jSjR&zO{6KJ!Z`z*AvL3k-hSKv}X)qoe_s`@MEI`Jv3`l!aP!h-TP)992_?o_ zrlvIYp!O)ecnYrJ`Zfu1iG-ruQ$~o0CJMB_i9qSQHHM`1qL>;;;+pe<(U2fM@9;UI z9+I-N+mvlnD%D~zH=7P?{>vDikol=CC29WcfaK1TgYTTHtF(*|CGFG1tJo^6SX0&F#aplV6N}#zWYjStMq2yS^CPI77kTs*qA*P{} zepT{X13I1(N-50=1P?2lW75?{^ZQ8s84c&TfSNt82TZ!Cj3WG#z^cxXY<#_E_Cnq| zw$l~Be?gB|5T9_E%d78F^m6Gbq*X*`o%8C6Kh9bA%}d)wFKa;FNdpbuY$D<}_;&Gw zxuMh@QN|Zcmxtf2dR2vP3?;|rb8nXn4mMiSJl5_pD(3FGi^hXVLfi|oX=GDNQnVYi znntYfCW?&9x=dc|NYF|2Pkmo<-kX}XQ7SY%z7XzhM$cS{9)2u>L5aR+tc+J`4kgPL zH5_gz+A=?^5hZllC{H)q+8tdYoUc#~o+S40>!+6(8yLVFF0&upmDJiDgla*QE@w+- z#0hFx#I0kGcJ35$*z|Vlc&$(IBRw)rO6zxTBDd=;`Q>+u}p{wehX|(U!3yU`IpV%d{!SXj$TI39hkzV`=F#j;b@) zY&7xT&oXB-TL_|TH}g$!6V}H%4|~nb-L5D=K1$(}?@7l=@|ci#phZEkE&`(_x3+$= zSJN9NOWUW{vKO$oa~5jdp`p@W(la;pSH&wc;h~HB*y@UJulfj=rk5mCa$|j%xA~*j zVx_r4yjmX6y*9YA7i!vz77_$Cy7jCFy`~FvydFG_=)CaD~ea>?^om#OO>WK+D^!f+F(@sQqWFe(QJu8u% zm(@E`Aw*E&Jgw4*j=tHUr(*SHs+sbpaFmv+PJVUD;j+K>MwYRotHpVLtoI`#~Z3H^@O5sIGEBfy2i0j`U? zw!?>1KX0XNLX?0+Oj-=f&!j$6v;V9w?V;75)^tAKwPRU}H-C`eIgzv9Yi;G}CS>q1 zyN~uh!GX9g8CN>hFr`Voq2OL8dN1%;T_-2Tae(IZoOFS&Aa@xi! zy|ksVazwyNLe|ENX2|ToA3V65TUKTukp>neVi5A4{U^RawT^9eedF2h)gph+x{UvF zwx;C;pk`FUK(d^Q5f%c{AzXvZJ!al|i$8~uTcT`c(eQ-d`j7K~>Tfqy;yB^Gr1}RUN@Z4M* z@x$^-C29NCb5r__i)Lr~Xg0fGS0?dv_AMRNb)2;F#;hut20=>@17Tu70Rff)0xA0w z;)2IgV_?+jFtQ}T@&eP#DQj$-&HJ+ea2{x#6FTZ+)Dx3@)oG!n~tygDoO0s@(Zzo}8dgGOUvupAj zgiPglagoRPmBdO&h|3n?YL%k>xM%0pKT|a4@6`H?@#!UtmH2gZU%_b@mvt>!j(d0F zirZn@x|XEW%ao}QdxCz<$U@glyP%yQLpF0^fR^AgvGYm@>noS?z%O;x$zAh0&bnCk zG4bGJD$}?6u$^k3oho{~>K;zXvM~6{WsA`5Jg_VYY4)b#PhaMr#OhPF7WxtNV>Lu( zQjtr;l|Nkpv9;rawEF?N0XL#bP!-}2VnzV5&B)@o6;R@2)X8kdea5c9+kS5&d{Z)| zbGnT);Z%`cYj08PcDgumjCA()q^Aj=?Z)wyTBcf7 zVZEVl6R9E3;Vq?=Etrn=$LZT*9fX#_OhucHc0I$jrmLB>M5VIoOUp7(NHA*!gDVZa zaT?4IZ?Z_%6$*m%q=LxPlkS^65=LnZj6znNef+AT5@yS;-;7Xi<8}}=P$fmNX7w~7>C&F-_XY=&U>E%5m@9ByS@J`ixX85ehnsC} zL72NJdkqPS6Gqs0PDL<6=IFd@&^&jgYpN>@(Kx?yx4B>ozxD1G%DNrjmm#S;4mh^d zKl~R#e1RxtD2&~uuW1K?d-#fF$<^25X~!+n=FjL(%>!?wmR!;bibR*$f>S$65iIez zzcByh3`&&klZQ09>!cWCzJ)m{N(aOWenX$<>(7Y6`NM#saI`2Z7x*$z62d3ZO?{h) z-+Z}GIn=Hg6|!f2QCO0`KN~-I?Ya54N~1sI?wD$He;dfgPdICK7YuO8Ji#AA4!gU* zlYg9G&~tmEUe;c+Ydw}|Gu&AzvkoLKOcY6Wj#u*GvmP-m{HGU)=Ubzv$q43nT0#Dl z7y==*_tFI=m$ThD>yL}(9-pl9iz^ zgchNiQRod-eragRluA3Kcw%8CH3HgbXWuLDHG2n+^4>$4CsHOp@r={FD|=ti@Eeux z@mUbQ%jI0YmZ6k2b}F9eYMBp(%1@@+S;~HPW2WC%C<`as% zbYwC^fm`^>CHMw9R>Vl3C}0>9Xdj^q*>ksPPD|bml$<#{>NwNOEMs0IC21NFBof*x zITIGgKP<~SU%iCzIxX$L<3;6uQyTN`WJPXsH;f};<4hGkE`ch(8*g{-KxZn&Ja#Uq+IIEa>Y=u z7Z8Qo%+p9h0Mk;>Rfn4jJM-M%5HY+@;9h>x3x#4!i)u69hXyXdRwsaYM>aigUT1{b z_XEO$@;e(5aKnRI@RxP2z(wV#1XJQ~$B>QfN{fhHnPL#7w>8;A#=Zb-I>pZ!A#;0l<+sCkVh(6$` z!7yDUg&aQV*Ug_pc_H?x8f&>Mciat=p`Ow&*Wn@m!}b{~*)N~=?yrQy8|gI+9y@$z zG(#*bEF&Z1Yu+P{#+)PB8W8d9GNgW~Ku~NF48NJY5woP%wP=)&pBk_9`ap__5Rkv& zhVqQil_EKC*(JXvN_Ky`y>Suie|?azzlVLJ9*2`9<7oDHe>B*2E@F?N&U=wQOrXOy`sTIY1j6UYCKN@tRC-X>cN`_1=a%cJMJSl-dyO_k$u@Kpq zn`lsPJ{o`w%8SapLY?RpuFRj}S&x*87}xg>N2L%+A7K`9lNj#z+VAp#LATLo?Lgm7 zz=S{U?XEx+Ixym%_QMC3kCN>YFEgCpi0^klp(nI}bsP<}ue>_C3pyX9P4`u>`Rz6} zMrepzD3Zc5Z?T7Rr|FkFjwz?kR~dJho)~Eg zyA|!iTstAj*+@_~L44oY=+j4HR1G#yMZ6!FmIl~laXrz+otm$TY$c-32dIZ!GwOp*6~L`4bkn)ImDO&o)ug^f2dXjp)5`XnJUXV;`k^7tF?)2U zeGWCP-1Hsk+qM+XNoOxF$njTIs-3og8xOtI%+ z=sB!RPL10mIFz-|0vicP%Z-NEn2Me)E(gV;RhJSqW--ju5hQUkWN4+o3l~;!Gpw)Z zbKJvzzTosB^S+dx=^I*!V#iZD(p2sE8kH~DO5A{>F1Y*p>rnFaDjbc%VAoC0*kz#l z->?!D^|S1M7MIed-(iznEm<2aIKdJZUl4$quZiR{IO>Vyc(*f3)VKSLqbnqG?u z={1*X14W$^;gvUz%S`6osWM&6ZunbkiMZ30`JL8%U~`DVQxHXKg$Q2z@}h?ga@sfknD zMs(0EUZT>WSp1I1q+ND({w-R{W+n1oVQAJG{U( z@~(OOXt+sFj+RN+rlYkD0bSu4AM7-7huU)45xKD)ilh_XdM)b_7i!>RO3osPXm|)d zZOZd4l+mu^)%Re3P3?%_oM|{~DRE6?$vU|eo3A+14US96N4SOAPfX3$#pU#zJPi7F z5-&}O8pp{#kaF*yPSu4bz5OEW-YFQy4Rv>zU!A(X`|J--@`(tPiiEq%)vL@i&jMdx z=~8)a+paSJh~j-)*Z*+K^+KPscz1o8=_*WFiz1!VXU8bC3=nElzi2KPv3l$_{et`p zXvwzv`Isx)81(Tj%PFex-HALpkGL|h5;aiDYtt=!Pp2?y;)#53PzC){p0w?oDSPx< zT>&!Sfb*m0o(!$}$mWD!ruo1mH|ao6Av5qa%)hdC3r-SNfTylZMW-w#IfX<(no0KM zrR)ct0dqneRx!c=w+WZDZTu6+{;p-wrO;!c)VdSp!Eeqx>##{2vq~@dYZkYta>FLi zWqO*xOq$AN=nRT-dD*pAd#x>{o)2kR9rT#iY!oz0o`H-6q(;;`7Mj;Fj^US5-J|&t z8E1}xyt0G01|}EE%M9YmBs9)kaO9AHUq)YZ5u-ug{3^Z)YcLu zlM&3#p>u!{#iQ=i@fvjpVdGVRKp8$W=q!Dr&E$sjg*vNSZX)oNkQS7DJX6g1zF+?t z_bNu2h}b{OifACvz$X7~H0_42CE96h&|i$&#kzeC)}M1TaSYqbRmSsyUUB>DPNQf)Ra9zaX6DN22pONu&}A#s)Hv#nDIX?&N>JL@<&C0B z>1c-%$v&|*phI)Z)$i^^>;|Ug9wjI#&LGl!jRa*QKUi|%I!e?xfpKG((v^a=4OxI_ zSJQx(=jH+A8qmLU2d)?IS*xE=UaQcR1lLO}a$^AbeOo&4yQ!dau^`VPxxSs(d)J3f zC(GI9>572WPiuZ6r*bpuQKhpwQe*2}%UI$VjH>zW;q<64Ns zrnhvNz~OIX-s_a63qhNeJ0TTgP2+J#H}dQtK@RZN4DQQ2PB*6%33WZ}kmksGMq1c@sd9i6nmJBOn;PVD7+Khs6#KT7En40V{YP^&d`94VIF(Q&%W5H7M7 ztJMcOs)nayP2+q|R8KGs3&%QiQ@NtHJ}RVsPx7$)SPM?tGAX&@M@vI|i` z#BNtvVh@)dGu50{&M)KlS$uFTAX^S6qlKSgzS6r$|L!I<=~Cq!~L*CVuLXa`&=| z#RmaZ`gZBjx1cc+CWca0b>PDd%#+y5vLwIn?M7?oYNk@{Hr1fsf4+=!zp;+xM`b2H zy0|eiTTsFKB{8*AeTdt7*nbc;npNB~;>7IHX@ZaMP1ru~qQ9MV8MMxd_^1rh8MWrB zfed~bhREEEH4$ayJ@;#2&1s%BMh`Ui7JRQ!sg-1?8~F!n00G3gl(DSmkOH2U)l=7|O8(NR#VD);9)WzbyB zc-?AOUsIs@j}Wiams%%hUTVR1w7Twxu^C$|1e&XgxO@Q=t~cO@$g^D=UP~@$b8UEn zbI0^0MI7k1n@hck04v47PEDQ9cHb#5_wJKt+4F3CiZu33M3cV0rI0uYA@J^)L7FV~ znW(&en$m@QeMCGbpG4Q|Xp>~Dr6ktU|9OP)g%h_yd$y7mc-BvYr#Rertd;2@&Ym{pnzc9g zkL@#?!JXe)Us83nbiOybFw9z<4|V|A9+3&LAo@MFHrJXr)>(I@&h-=*eT({>x%F^* z8{SbzU%5LBF?^0NF(I8DxL*ysuDU#(4fNtveZAFgO85*TSvBC4NW$Fkmq(mDLrY&y zAYg@)8uD{#s>PWBh&QIMte!2jz$#h@4&8 zhuq$Ew)L6s8w3+BDyvIr>~aX$`0TP!R7hM?(_63gCkXR8n?!w`mNp}=^%X5;|FvSO z1wu|vuG1F_5d}1?`ccPL0kLN8jSt)!7mSfqLMpxP_K=`E>Rx-Kb6inblj%luJ_XiQ zs!r-;j-miRtA?8zb(?=x2#Vk;wJG;Gy%NuM#EtvJMDEs7Qqpvo1u0iYBLEdycVq< z6xA6$+(0g+J}&nsVQh*0BFa;fX8<&tyW8#587(-Jjyz1b`L@V6N_y4d#WZ%Ftd9{H zx3)|Tq*y3Fv1EE1NpMm6;und>QbP_GJvXeNDlzo0gStojbLl#1KTNOkVam*r8dZWd zxy$in)PUOIZE2uGW#gdp#L5dANV4*+WgI@~kZNd0l3GrcQ2#i&Yk1z$2+nj_S_dKf zguoI}UD8OH!8|klmNBza6$%{@t#VGEgtWN+sD6Vq3^2=&VMy#`5JA~F6h+3+pgEcs#Qm2m|puh7!8#B(PnbxJT` z;~3ZT;EO#7)$Y^1ln)UFwn>{xs))*IC-NihhZ!-$(@?4&1(qPJjF5&4Nt49DO#4a^ z?<9=HRSLfN5-O@gRjpk|9hTdKpe{#*h<^J=tdrenkwXChPgYiH>e5yP0wwv^NG(5OfP0`Y=ZuTIvnwk}I zQtll+<<5sP*{K24Ljq2*ZEyFTkjjZ-tiDE5!HRHHtOVc1ou165WL4Dl)}02vt~n&m z#1Kw{o{Yt`mGpUqQDW{!Z^$v+9#sXDPT6-upIr{0w-YqI*wKg4>N(%6(iqZ+5#;il z8m_fyzv>F^yjrh1i>;Ic;M8=W)TGCw&LH!vZhFQu;XlEUd<`1J_#~|$n;zE%>FjKC ziV8pHuaH=vNow(asD5#xNjw&1+siMi9V_x?SI6o2#u8cme8rV*NmadT->aL1lA}lS z_}loo9hB5hT`B0IB2PI5GwwZb0V*_KHd4D)lx|PTD&DR+-o< z=WExkt|Z~wsFx(whIcHN;}ap+{>Q}8ewet-DZeA|=Th}i1s$5b3WDc6g9`m1`^$eu z!d6rzIVIBJX8Y19jKe*|e)70r5Ax`JzxhaBd@~0?cX(XjW6y-|nD0pCtN#A}%_rV} zmW|H1hThbOLTQ&aITc4V60T4?ld2*_vq)BwK zZ%jc28%f>CwM?y2cO{@dquEu)ZN*ncO6su}_Dr@WL|k!7idCrHI<@i2JKL``L8#A^ zS2L%0QBWHS4n=h=mMq5+f-S`Q9`gr1RlFQ@vTW26kmnLROBx#XDJh+K&RMR{qeFKambu2HB8ZnnZVQ6X!(< zZ8R0y`kF_^Yxqv|!3|myNEu3g5xg_YLB<7*rG$0=(2yP{b{wR#F zu|2+|wCs^CV-+{$HT|@c8tWyql^OiKIgD(zlw)2uCQ5kZcv`x<)q&sPw0NRT+-A?6 z#fD)?dxL!ZTr#grVC&PdP-E4wfGqn+P8FfR+kko$|FHlNt8Nq#D+H2GCBKNW@`x4U9 zl!NpG4KflaQHXa#LknVPj|f)KA-$G{cNQ+`kHlrZ)=H<`aiV==fCg$`MEL26;M@G^^Ny8y-x$`>+9ug zUx@v_SGp1Q-mlLN|KH8d*MLU9DcGUkUnppQU0Yig>mIVK z$$eH8{rKQ0*p8rhJoe`k9*$h%^ z=u?$r?Jj(3X%UKr;h}3t*ecj-A&JpoHG5PK0u4aqr6%eQ`+Qp+h9O+1N*7VX+Iqxq zXbG-SzgMa6Lw0~glZwuUihV%qI(+3bYeBh3O4i7{=?dK;@s>RGQJUuoy!&5yd5`5E zJt|{2t6e?2M$>rM@D*j2ogbybB@FqTx_;00t##p5ZiNXz@o<85b}`{J_<3qXFg=fYqm6$gSh91M3s$*ki-hwAHytX zLozdl86j2yvmqQ>|01WTzNLD;=9t_c7%-DLm;`3Z>YsZEdG8TaDnx4&6Br_t3@6pP zq_=OUXYG6ZT`yJb-u{nECFC2sSAX`!+&nayZ`ynfA-?#EGe7sZ#FM& zjAd#K6@&&ebr{)${Zr(sJlII++q~v)qxVz69Xcb=l&w|d(oy3GGaF)Mih>&=-?7l4 zBI=p4R*l0s&Qm+FJM0Nibf*N#0eQbDFO1$G1_-FwOgq=1aCO+H{V!2@aUA@{%gMt8 z)5G1D@oxRed-{WN0TwI4C#NIT?gp5U_ktBlRtJ2LwGX#T2mka9X?l-)yJTH*(K*O+ zK#n|hBa=4&$k>O{{F>$~X9coIESskvBXnM#Dw&%6J5boLaB}0x9 zqsF9ghC_~idvIRW1uTQ{(IAV#{lTbIQIc))+WPlsq!0L*|JeHbjBcH>OM?F{Oiij z)-I5{x6_@&Zl9jh1Ce_hJQVt$TR*+hPs8-7ycKB9+`}-ZVE9o?=(en$BqOm%u7r9B z`-Mj$mb+~MS+>&S>;KNE*!7q_RND)&X++<8Aha)$s$b2%sj+XSq|e3|AB3hDH`e;E-U z3dso$ZRsh$!6e`mN{Wqx?6T~oA!>#yEd~Q zeM$YCjBG`VS-Nh}U{Hu3UU%3JqLn*;&QA5ieePzjdl(G=$!*oDX#z=egar1)XgU?E>{hA2-k-$m zht$B z6a~5%iLzK_caxRmYz+SO*I%g3xwf|{j4s4pc-~0iW+HtIriF!7KEa%vf7@h!2Xuwr zcH#a@diNfCg@+8Ufgg8561DInE~3EOx6NWE7MJ!)_6C!DdPDNgZP>sSbA+fLt)LF~ zF8Ea+)%23n&sA;wqr}Jjl;=q3v+eO&dZ_p8D=`;QPZ|~$Spd6SQWv7v9cO)q@h8?S zcf<7MhBkX9?Ox?x0+A8Y;u)g$ol~!J^-|K?0fhHx>N#y=z&3%cC$8g$dk)MQPvL}A zcf4dcUl0$=fz2LE;7sNf^XacXLc5o#CKHnZH!p!OtGh`Ca~qyhyIxzMlYt^-Yf3$@ zEg11p`5(z;U;00X0#;ythvF`d^T<)JjJm(1mjnl!jKMpXu{pY-H*0vyL!FsTr&hOa zQH3t1op&%v`%%l$Af`WzE%>Ztr z^56i-_xsrX8yI->vPEq7vZwFVaIyNyLJ5FYk9@WvZ5USadJ9l4B3*TQ_Q&ytA6Hc5 zab*b($Od8P&Roi0JOa$6A;fUq)?dqV2iSrt-4>p^ivrzu58RQogqrZEq{j_M5K)2UQ*usn3WPBF{%4WClm1S_ z0Geoo@?d?9W{cfGdpQJ^CB52pL10_b;V{#9r5tuo+KTwFyj(JV@D8=yHrc`ELT_UF zWZSKexU4bMEg+e3%N!xJww~25EDNoQPFg0HC`MDPQIWcw=9`oGcX*akSkWmlXuc)RK#J)4xpi=F&FaV zY>SS;YTJGTOo~j!54f3hT?KX~r4T-O;~xCjkg@AgzaZZxwAO8P%j_nJ-s1rG2Z{dp z4RI1DR0tb1vi0pwBOaJNx&>Pi~pc&s}@2k-7PaJ@PLdQPelu-T6pGii1+6cf+ejvy4a- z`Ud_befrd+8n^29SJqk4)%w=e&_Rs^y6n9E;zJ36V_>O!K(R%yT)p70R*@O2f^wnj z-Ev$sP1GS+XVImN#2m+1`3hL(I$1Dc=gJ9XNNkE+iXQ*u$J;R`S3TRzA@48*-${8? zV|RJw&6fUk6EzIv@X1<;g?dN7eJ{DdG;$k!|1&*xsNOi+o>nO^88qrtl~Usfd{;&1 zOLj<5lrEv2jD#eqO&mG^{Ny^aV2r3-HIW(HGA?QEFRP?PzW$Sh;3M46^n7pKpt0S$ z+=g;2bEqm=8+dI7dOjkNjzBnz^XBhtQNu-ws23A5>*t8?s=c=_&n;UW=5b z9ay0Mdd%k2#5Y|D>+Yv!N*8BBn0k6;I;7Ff841!CxessrZN-nHLVb-qOgi@(U_V0{ zX!G}!xrR0<3{&KXoNJhX!t@WX)$Db*XpzYLHR)fe>?wB4*K>NOD_oM9y7!>%ES1V` zJ=8$6^d^+1@sMOhpdpr_&lP;we_)F^r?43-|9B!~tajzYi@J)KN+6)cV z@uoLLPrJR`JFga1;V%z*zZh$^Y_VEh+wE^8d7{?B7^|O#K(wsAG518iUd_MJcmWKc zo-0ESQq}BeMFEMn2CFmqa|vd>^xp5R9iyFPloLc*-G@zAsw>~km^1)xlXyo&X5ur@ zhBz!40-$f8F^?ExcvUZ&R=tP;VJB(D0`mZ8dEt6!p^E{(G)3`vZAO+G*bCIsDvtO_ zk9^2|HULtv*>qeQeAb^R$w(8Z#mQgB!9P>zoePE^8t-E>vakm6)H~)P87_^YbhT4z zfJzbRocekcqmPH9cJEHpR>@%G-^WpoTeOIRsa;i5AOk=8Ci6Su&BfER^^5uGDcvu1 zQgT>bG)Rr(E|WUIG#i4^s?lG3*5}$%7`4pp8M$=tne>!Ant`**7k_Odex>;fbbEO^ zgGm?DV@`L)rsPfR@m#)naS>v}ssm{aMypgCmr;Mn-ocwCAm)Cyr-8BjvsYw{n#k3d zZ@*7Husy|V>^MFl0Sp`?>KFo%(TbL3(hL2L0)93{k>I_6*mf9$Z$OE)GqC;IjAtYt zlT<6Gu($b?FWuc)&V2Xo{*wp%{o}&qS0W{Or*eiH1N-=XIt{kF`+>K%JDDoqmRPp>wlAmU#N~bUyVsQ@G`>8N&&~KJbKe4c|NHGo>y8650 zY5o#7b~rq)ofB-H8?D_~Dy=Obccc-`42c{cl5`5TTS7bRbwyZ4BK=|SJ$HNgBU9Z4 zveze^Y4X3{@ZM7TpWN?5AUC#d4Yi@KXRzyC9(8(li<&o-!lmp@h{&_@Q-liPp#R)y{)3|M z#Y0$iFeBk#reAl`%ozl>t;IO+;zbG84$Fz`N)Jf?!fIC$@sl&lmsvo52?iz;WJ-TVZXsJvS z{W)D)beb7mv&+Zd-#L&q`A#aEN1`ST_U;d5XP)F8&aMUYX_`2gQo=Yp+CF|Kq`Esz zOidME{z=)*%%UP4Be#^_;>#8_Ja7oheE(t3wfS{VidQ=!^dH zpLHh}gBIoS4DW8&ZNPyf`xK zB$;L*xb|f;H_J;RiFdd`t10-yZifn_JBb1q3q;0T%*kWdigsYuy=@$+qFgCm3qF`b(Vv%na}U zkG)~*Sc1K9mYQ4QFp}$wx>F?eN6Fypfya&0xYq^QeYn>jdokmg`Md79JT=KYcF8<$ zxH}&?o=4Y=b1kD^0@r1Lo-Jg-8t_XR4=Aqs*&xu?8s5s)Wk7By4~z4@PWP`0yh)Xz z0Y=@fj2L{JN<{GtB}We?3r7&Ng=bULC5}w^=gwd73L=N{DpZWpry0r;aoO`(#=o__ zfa4$Y(6Qw3!g*2o4kr=R%gx3qIJ?jj(Rn59K>4*?WuE8J5J@O{<{kf&Qx)`g(Jn9F z5MHEL8V!Bn@v;JblK~E)lmQo(%wtb3z~f|3zVA8`ZdPgunkgN>)AVlFz#MD^RFn^2 z=@ySFup66%f+uV(@a6fj$+5zxs}KQ1EONXZ&~89R8M@rF}paF8}lTRIak* zK~HP<_ZJ>f3Y2?&Qos-OU^c1f&Pt~u@A%fq)>o3wQ*NVf*~sdf*);iqfYn@<=-%3} zms{#zg^Z3p-fnB3SxOpbo{7DvH~7$YyICXHGQ4cZu}CBA@=-zl=pK3dI5*({nj(7e zT4V^JNMMFOk|=kjrloFmaa&amWF<0jTJ5)BzgPR0U?;kVEw38Mfw1fQBM~TZf%srT z(agxs1Im@iHAslbd=Y{t^34@DY}BhDJQG^s2hH38oXA(<8L*ZE?mV1deYK3PZ+0~Yk>d%dGR%g?R+ z>17}3MhaBk-3vvJ z1vvNwyS;gpo>ifr_u;^+qaD92^T5DAn1EE6SgBOAc^qW0YR8gXvgF+S)y~w{{+fHiN5Qe8JGKg3@P?jVYHF(dPo5rM^6~X`?EVLbe!(K} zjEDT^lh>4f>%gl&|D~jb|E^vAQ*}7~KT)Om?^Tcg+xt^=zy7=W!#d^{l@YY2{JT&# zpibW$Vq`DZL%WEVqMNvbJN+kteuWE`g2}8C+Ju=YD%Z`P0fre|)jd zJWa{-NoV#bOF4eMh)t8#y!%Sn7-^)EU@$ZmWBNh5L(Mt+OWFk;xr-?s3ctsb``36} z>FMc?wD-BWw-E*LbQ;BZm)s-iT<<;u(t8f&ZI2YpUyR_Fl?%Z~vvPk>NPQmLt55y* z@+>sRU}(78aNe{>spfj@OW6eHi4vxr_+-qWT!X25)}Xy$t+R^z+lv*Cn^j1ET^)ke z=9tQ>qrRv@t{yX>So85e!E9p9^RKIiIc zIboTE78~})sEZaEmymzq6~o!hNjIxw-U9|r%b&bd`!V+hBa8n-wXIL1ZkxhlhE9S( zhO#x`PW280=k!QOqKIAx98l)y?p~G`L|Gg08Oqa3(NB@n8tMSR%!lq}Yd9Wxza8cJ zu)r}j;N}%Y$#A7tGO~Ycp40>2Y99@)%r$pnMp6`PLjh{&YeT+0sI!^PofBukj8BG- zQXj1)i}+Ad(9Dp}%2;{Ik5lo(RhgOBhqMPB`;6_>MGZ2BHw9;QUggCv z!0(!YN*>!hihhPXCF?E4T|Vahn7bltkDYZ~3Ak571JZhVQ;t3Yap-+nleu|JK3qkr zYVCY_i~O8d8_=OK`g>-F)yu6@@IxgY<{cJ@oifQ3^XhAMYuK(7zZV%M-9$;B7h>AK zebzAeKi-$^oHuT^9>xrfoMCL&3K*zw#k~?9cVeY}!UB-JIX-#T4}4&p4uCn($1L47 z+b0f<@)d(?d^zPZrY{RTZ;QHH$>ZPPhet%V^K-~$=;q29vP+Y`ALLRk9TYTEuJiM| zihWm2lQaAfFW|k$G)_@->b3I0eU$s4l?|Qt0 zHlYuG1}$}i|FYknxY^xqu`-9Nrd4-(WQos|nQt>P3nUM@L?N=|)Mv5bnu$bkQmq{`mZ+4%hMYN}KTZyYQS;1!&em z30dAm2Q?(CsQB!qpxhfcfRxOIar>gA@RLlZNG<|aq2ig}FPJiW%~oUY)hhN(xwmNQ zLx-i$uS|A->f^uM&9&*E<&xSx&8?CjKg997-am3gqng3mqxCDPo}fMwSA8S@rYp9w zAt-gvahE|OIq#M+x6q?<0iZNRT+w&8^;lI@Lui@XME)Y7cXhro`SMMYou!W=Be>_t z+GoI&1?rm}A-N$@a-hmV7t-3$5cVb+lSRj6ge1_&J!n$!Rxv=AT=!g;|NXJ)UxzrEI3-}%n^*4p_6S!wV6JkMRO>$>kZnnN{N zCpoS;k7BYffM_drW0X~Vx4N|I;~#GsLyv)5gR)CXpdF7i?o@Jl2EHU5$H5>P8A8k6 zRkszk$J|TphWHPTlsPvQZ)>`p{QH|eCvnolmP5OuG}Hy z@n=a*LvwSSpB-bg%59Pab8&RqQm#3wxKAGKOFNu>*wf90zIf{P0d-Q6A$o5{iE5#7 zu+DYxXuu^?rAj#N!h1gBLR%f{yQb~;%evk?a{fBq9L&8V#yxmyBwKZduKH{vU6a)M z>tZXF@A@BPQW}Z$5+*ShQ>C=7wt0W+atk8|PCFQHC)cm}VFU;A+WfjFQD@;{t>SD<2T_k*6-uyAtC)jHNXD# z6n7)ZVX4s9pb4sit&}x4cf01cTiC_0FxIeJf{$_CDL_Z$Of0l8tP!nrw2i++aTk<% z%6R2^)u&LdYJie$cNzJ34CWeH_XNXTdrzhZhmuym~v3pI!Pr=+KoYRNv!G0Vf}Og zX96bs`_s+|autX?4kRsqO<=N8-7^YH9?Gv5MbC$sb-kA{DJ+?awXuX+Xn~?bTbmgl z4BmH`{ymI0rf}eKvCGTX}Gl>*g>5i0XafHkpYRXuri-lVpeVtWjKxvGYQJ5V7;wA>4j`*!Y`U z_pRCm+x`p%orb6_v_a}v{K(3HM_Ecl2ANh1gjU#2EHJ9*JoxQ!pJ>4VUHg<0tK3X$ z7?JC3!Q+zK$pO2z2iZsI(?1g43~O$%h)GSxB4fbXF%1}}Lf&H9y-Z-?`3nG>9Tqf5j0(zRz~&?vwK*x&HGb+6&yO&9bKl}8uyaXF4t%41Id(|4R1Ba9nOoEt zR`rgK4b7Le|8HT;{~v$bKMQ6f3^EXzC4!`sX6TMhxx^ZuOt`)bQrWAI?YGYK@o-d2@+eG+N_QDu|lZ3>GR9rVxCfN zZ~DW4Eju>zSBZ-I5But{u9R}bX50`J{T!iN>{r}izE7I|HpR&hCuP|DFl0&NZHAVx1n!fK7EYQUIIQ^H03DN)^jFoZanSJ z-F!*zABVdK1kTn>DROP&@Uo#~A8e*b0Hf}dbsO<7=U$Rd;9)&y29~4e#91Z9yjHg@ zre0gHs%n5YGFnT4@}(3%QFIwX9scNE<%9HojFl)wVLS!TVoD7yI_~z-NxHsmofjIA z;9to;*xjm7V5RR`b+9z8tyi^hEc>~I!+*Mkqb;0$2IP3CDFs&pGv~6Db{ZKa6nr*w zvO>=b^?S^B#l>SEMMc*~HdH)Ab7~O$3WqaPBPIMP>ur)8l6If64hMU#RO2j%^7N>h zho|JZkH_@a-wyhEFG@Ql9^AM5e{^$3HV4%G_y)=bDjqnf$idB7fUli!X=aF@0J5@p z#f^6E_|^nCGmT5;e^vz^MnD>x!9S6xe^s#;{|9Xhx$K3tsE8Jhly)kdivi=e748EV*G@QTxVLz zu)F#Nk1uN~?Ux_uc>YVD{=7!#TijAwnWyNW!z=uD!?uD302bsgN+Zb{8f>hr5`|Zj zh8?Vi-8W`cf8@AEm>c_Ef4c3AS5~{L(Lbcn!$+a;M0`ApO{v)4uWdmD#}N~Ly|9xrzW5hb{QaHYw`wCexA8H+BWwdX z;ri$#RevToJGsA@+c-VksUm1(G@?W*=+G$~0t0~C<&Wap1Ik`O8*t8HQQ&QH7uT*v zWMv>)5R@zbRMXHgd6W+OKFe?U3Ep}-%XlD+fNwE_&M}AG3q5aJ_4^ON!NqF&V>j#G z@VnNH@FdnBi%D~q<=-K7tLTZ8;{KwheU;lGfk`<$r!J01&TgB1ScV5Ane6DN-y9Al zwbo;QGlg}$4hE{UF!Fi$f7*mBKsjr%r=O=zb7q zSjC<;YupGL^tq(Y_)j#H=8wPAW|`@_W>3n_IxB$LjksL9U<++#0Faruqx$f?jo_He z18&{FL!Asit077PQIMD(Va0`x7_R7MRS1FEzLN8~nO^H#-FmvrkuAVM=-W^l6)`%tu8jQs7WN|G2kIKi$9MZdeYFFs2{^Tl&Cad@G5y?aa1KdwB;d z=3JQ^MGpaI3VXWM;aTd_d?QTISr$Y$!uAIAh+EgX2s6YA(VNSPPuls?d{kO{8>0Zl zn+3G;uc*Y=`uFnxv)iPoz!=9cSvMbVFR|Y$-H>W~=g!NlsEmPlA@am_L-rz>h?6uy z2rhlio^a`5pnqn=D#t(2<7$@yU|GZtZU4K4s3^_ge}ITTmof|Jw-0D45e{^dii(6aeja*&!w1|?rh1IT zej{VR=f%Es6-kqFn}{s&XFY?16PU?Tudd3iWlVZ*5_~9L!uDepOo>{RbqE&xLGv8^ zXDaknFZ5i|A&4$akN80fJ+FGL5n`YE6F}cZnNhU|fEj~!K8IV@XT-$I_McVB(NPB^ zHGivJq-=hk`tNRk`wo})|A#t}{<+9BG^bS#6V)H;&F2e875Sqh2c8LBpNkd z{>ZvOO<<+=3r!TkPd~k+q~y|hI|msa)(Z}Z-b4SBb;d#K2dr^gR_-U2d@kz`nzJk4 zPHLR*0UAakbED#W`T`4+c2{3BL`s;HTBc}vc?)dr$4zq)s^_0;?YW(ZWU zp3441<`4xuY7o+51jq>kmJvHCu3v!9{qcA%2k3{MyQnbQc!(rqKcTgoXB^&4F5x!5 zIQ~O5eDiOEH?tSfbgs?Y_#<3jWGUEh+t$cBNZ5nn-L8MmFHY7j=1;;yTZY!2y7dDLH3r8g)JuA>6y+R3Dna`U<11qO zUg}feYEa5hMu`owj#NZ|-WzCluhOrcd@=_v2WM`5zwm>LyyFTyRf@Qi73b4Rw?yC#&kiLgr%=vm|6@w?eA?i)!u7feZ)$nARCI$A&(kv z_UdBinBH5C13Zl`&|q+f7Xrh7p)-uqR)l8Vg~dsc%5+j%=I4-wg!pkuvwlKwxC=u< zXoZ$24j)M?k#sH|Z9eOobyM;;jwvIVpkYjaNRj12q4L`5lP2}?(#?Ra{v@k`xK{$%SFs($FQ*eZ{MsrQ>pCHEJit8pBr4jztTLP z3OTfy+puplR_(U-WTiZyEh$8@floB)YU`G&WKzDUUUv5LJq>LzSUKTAD8mz+Qh<<{l7#2xI;s2LPAc z7Sontw&QRc0C}}J9u6RXVNS$v$~Qoji*knbQ?bg?<2(OQGS9mm3Y13*hl@jJh4fv0 zf72UtYB&TF`|6x(U&rLLgFq6|2~FjX`pj1=lgdWEHU*o0(}=>1%azc0JczX4dHE zgZ4QMDP5r(HP?!C9flQynwSQ43!xa? zYjlH|;?%2WyikjJG zjwO5@r{)`zWS6eanGWau#l0^8EuOX9ePXY*Ue4-m(pR(Qhi0W->3+CA%^i6CNA`ZD zg0X|7u+oueRo~k3%26?l09(ZkBwr}K@)p6ySa7Sj>Hw6*u0gICwR$i*mQPw0IR7n{5Eiy%u+m({k8dg2>1$bmIiPtzsFtT92=| zVX}GN_7?L2CDjf*`4G)TqlKIB!3!Nc@(1(=H>-ejL?fR~(hZqxY0(NGkjuuhD%`Q7 z6`qAQf+>AD=js{=UnIh;iTrFW(YEq}j;t6*q23QdfJ)3{hq(Hc%f0%ox`dQ-T-Kvl zbmypmb5EVskB$c6F#w}>7*O7U)IY8QcHal|zpK>3>krtN$@u)C0LH+^oMe@`TrQvV z7p8v6@F_hh1I`T}$gIKTJ2q!*VPPDGw!q*xDUj(*L1 zKEgccs5UHD?G=%)T-Yju8qNd(a;BK!Ji>WXj^AD7SI&T2$=j#210MGtlYp+ck;4)A zXO@mmT&OcdQxEjhRluZ5{A|c{dxmGG$j2a8wK;*`!cjHnv;D8y2HxXA$-~=*BnTS{ zMYmKa`;&$bc}?Ct#xdp(lL!>bFEk{91qY5ZNk=i-{6xABr~m!=lj$!y-=DcN42D1B zoxMGgk~KvYX=m9q?#Wbn%%QlTq3L$OGVfZla9=BnPr_h6dg-~o&McEDQdc?aSf1r* zq99Cxxu3cksM}zna^9-~HI_?tzs3>GQXVq*2--RIK`|U9$5P^d)hX~qnufqx%G7!Q zxk=uxuG||3dmlgK@CF#nWU?d>O6evEJVN?=I2E$1oRS5)9c0uy?Ymrcmg8reCEIk0;+ zPvS`%U(WD|t1PeA^5Bk~W@DI>alq+GqM~aeRM%>|475=r#w?#xg1S)oF`BC+ z$Nu?AzaodxlJo{K6fQ4d@7z1yyKBt51?E?6Y-n|Jx0EVPK>D2YgxHRVy*AF(i_$W} z_>C&v8(5XJEd#YrwkLuR-UlpKYh`2FEIzr>+nc>uAQ5s)ObGaAhJvALLg-kOB!KH%u-QX?;!NGlM*!2f~smpu_wXS=q^{TJy zt0SrtH->Gco;o{}?<5DE`PJ9`{qzVn0aCZq^|U%W=NQV=<)rlYHDbPWzqd)i`7y!l z_4@@XG@R$HXkLpbb(G-J6m;ZZ-d>hF@Xu*Rv;UBFk<%U*@HM{=9gBW6JlnB zuIQwR-xwD{pyD7WqZYosdpA?62tz#vBaofxPrM2$+!Yh}+us*?K;`B5 zDq~3|e307r`3sbD20^<;L*!#LOZT5-FO7Rm5|lOu?SB|``7wU{hRo`fj+A31=0)Wl z?pyj&5+F9TqoHVAy_CDSX#FoLTgt4Eam{X`sm^#na2TENa{Ct2$?)4Re{?Zj+`BRa z<~w*W3pncz0=fj*fItA3~qofTv@z@0~{%<{Wpr^&)Hv1rm4M|=Ejr2wi zzm(Q)sNX1O4=E%5A&l0oX(sF;-?cd$-~$wV8HVXDmguWBfnGez3h=Jb0CAX|mitKQ z;TtW{lRqVMDqOvGmE;9(ovPYDk%YgN&AgT!CkkI{h+osVBilX~FkOs*Y+-dpH14PzlZ{+l8|O2*=U#jw{iA8jGcg6^ysUf4 z<1xl~f_VqWmpRY#JL#B>2U7T)!8lfpc|5+FO?WrYVv%x!<-Mw~HkW_i&corxh1sSv z8Q+5@qutjvG9JWHd)cB4b0}`s9n}Qty}i&4zpU-cRkn{{vkVg(sM)?%@6n}>Ju6Xo zmeR`TKIW*(R;-&}88BPW%BWJx>KYA7%>RsZyZzX_vV({G?kOey!fDA(CS$Mr2a}Ie*2u zjeg^{aYA`T`9dP3k-eZgYsYKdd!3AUVaS=W$k=2>^ZgxO1=<+zD?xNL5T+5bo^ zeWNxQcS??V1Im(R)hR39_N3t*>S7$6ALkc5fiFgLnJfU~!Tprx9R*eewq=QSSjAsr zNY)_kWx552Hay@4O0GG37)?WBrPU+_1|rVM#fx50#ktn+w{O~4ZRPhs^tOa2qd-U@|s%)u=9w&H|w(ekZh%0ga<)b+rbxtkZ*+KMMbqRrgc+!x~QoCwZ)rIcHvcWUn zprYbc`X)z~Tac4)Gr8L-kAh{>^Xkq8V>aB(oFm0K;5DX>?u{ePk>$;5x0MH?5}VS` zkHVMN!V}?BPJ%;*+Ve#-!IX0!ROcYi=YI>2yQ_2F1w4G^lulnB77%kMZ$7 zQ4E^N+Q}bwasi*u8<{C(k0FTU;1eG;G;(ngsdUq>Uh-$|RS!L^BdUP=@U_D@Mw$zD zk3c&3lA|2qOBCK^t5w0*F~q8aZvG|;c`gbR*|I0Ky1x-TM-7v2n!W*|^6%uWrk9rB zOVXg=dbr8!VlxqmJxgcpj~8t>J-y7tyY}Rs#XY21{k5<58>3tu?dsE#uHb^nb#0^S zx%VIU@UUp6K#x?2-Ryh8O%+aPQba(uX6~6H)*<7yp{LFPK+~LP+IRf-xEbDpX1MYw zV`|bhbe-_FQcWK)S)uKb{s%aPtU>&=^DcnBaRk7F7=$iQ(HVuSTU_9XA=?d5gOpw! zPxlKwpwn)iDamtF*PdLtrxf^=8QEa(4>W~bRXNm5zSG-iRk)}2{-m2=WqNw4TM}dA zh_FBjcUVADZjYTv#v^nHN>PtrC(^r z`TLuKBu|01Nz=Qeln$(cBcp*6twE^|%5x`J%2BfgFDkZ|;CKKS!y}GFbto(#sXU8W zYR@0qqCb%&7O~o(fvrxUHOaQn7$THmh|bOzYW3` z*DE-5UVWyjAbUm(0hq;sb{^fZ;-!85(~HrWl3lm_yatYU{?s=D5dSv$K%nQ3;m9fj zQ-px*+fxP!>g{X{f5^{;edrHGMoZb++eaYUIW7gytL>Qv7O8`>O)NsoW9czcK)t>- ze|76jdt>j=_uH5TMBgL=n$%z&@24VCx542zF%hA-XOuAV{WUMl$wAr}od-b%kr~ZI zj1klvDdLq?t2yNhAPMpfa%wazko$t~zfozP4p2cR2hvl37N+%!(Z=XCKg)irm3qG z(bXmeAJF?|t{XeMq0<@)b@EqNE3g3#=GZV67ThP*TpN07+6_a_y(bSFx>keaZO11M zavU7sV79q$Y^P2n32qt0gy|XPTrV0pV$H1YmW}YKmGf4% zS&-)RHT-Lt4uGvj*$sCG&d_PjLzK-RqsxGi+mnCx{mIVFDn%X>HZGDd)j{QBy{Jf) z*L^{Vzpr$s7iaxs0nrn>f3LQOrMspZ4fBznqZ5whQ5wGHOGG#d=XTj|Wnrz7w?DG; ztZK%M#Iw-CE1>n0rsafjfqNs1Ln{U@DwgSB%t^BZLH|@UkSWGrWqI(0HEsQdD0FQ_ z)WljoWf&%nGdJCj4f5Xvv1wpJ%z96{FRSK)9B7ls%G5Wxu_XPbS*RwI&{6bt9s?1^ zh${Iy^6U8-5H1iz!`n$F>4cbQ9iGglz^KlS7_!yF*bHY(~?fR&0TQ|xTWI>!9QO3+9LNca7LGxAcLEhb`BVL0* zOfeVz(QbAOxY+^?&FlQ1%+^)6L*n!t4Okd*KY@dJXF*xDFBD*PUZ(=w)=*1De7B1E z-)w5zgg52~Co0Om6q)X5dh-ZFbE$jAm|A8C8Q-h305a{zKUwS;_)rPjR zZURr{aQ@`_{#%Ohe_j9>40!yvcKC0&)Sp6mt(Yb`J$yykP}*ND9Y6Wf(4QEr=iEx| z>J}F?=;3fv&v4Vo(6OIL_Fz)+!;zZ`5QNcBC4G+ipA_uRUX;&H%n+cse3pOjFUxo4qQPYY(5&v zstjO9a}N|pt8VIGKK5JoN&%#dmV4XgBm@0Vo?JEJJJBei+`dM3IhgrGN*Urv;iRKz zeYl8M{w1oWVOJfSvQts}7Q5cr%(|z2JxuqOL&OQzF!aixixsXcj1>|^&abc#oNrev zb7UZL|J0M6KKT>!f6l!Q0>d18ZHyH)el*PU6l<5g=r*j@v~WZNs`<9Ne~HV4rT-=* zRQ_?HkNW;N8Oe|RYipa>6Xi7peT%EN(M1w_u{z`!j!1XDrwnpOW%!wIiF z_8epz47xq?_-JU_uJdrI&~=TnT0IwOU=q)H5tcCp@7GxzqglZAymiR124xDAEG9 z`!3cyG?aP$C#&}*;u|+uAp8T}qdKr?)1hYcl#0BivYIzCCg@y7#zp?#&4)=?T7~m_O3LI#}i+0<;bY>-| zNbvigxxOo(uDXsZ2tqqXD2=RZ9ClcPmH#2RV!*N&HPVfQcTBYRMY-QrPFq46KH;{r zfVqUluC7H?Jt3dQm^OlKv}MwO#_&rwRNSjhroi6uw25fB7EzWIM-Ded%(1^0(*jsb zUP;?S+0~Oaac>LOrf=siw9T@>-zX1U6%qCYIwTw(W=dc^1yvFxq@?WR?N4UC4#kGY3Zo^#y{sq7Oho!ErxFnT{WtOZ?8Aw=5NZB2C|0E^V)9XDq z<XJD0)gj&OLZjz2BS^tWZX|IwOtL4HDL_vbvoi$p+5EjqSV zeFpfHg@1QG{nH!&biMyY;QV(_8}M1cWBot&9sZ1m|MzZ7`=8Im{GVr!7VN)RmVeUw z!42eY=Uo`^@(*7p5B4YbU>~Q57l40@?jEc$9$Y$)?{@&t2`I_HN7WZJ@O<46p>^VZ2 z+$S@|P77~2K6`5&=O_lfy`q>IenBqw?K{DTyY@NiYolaYH?7@Xs+?L^v?T5R38oud z-$}m~V@ZSgDF1`Jd;7;+!e)vTT^qRUMx(KmxW{TSw!b?%I#Sack8-pxRu(l~@sa{c zl*u>HPY1P&RASXrjxiql=$>fI6NA{O0LH;%*u}Nm{=eLCjEn(MLO4VcQqHRMV&wk# z!9LM|d9oBsOd$kp6pKiOuSrp%F)?Mb!oFVqhF)M)ub&}OKxlEZh<`)}F1)?ZB)hXz znOSI2d7x9Wfy|~p;^MEc7>p6vs}lnQKT?f$#Lw6vFn`~oI#xwwV20K32`}FK2MTz! z83vPAS@_R+K)%h`SVQ%-H(dr5!tIOUoSzv#HNgueCI?KqUcI2wq+%$SM z7Fr*@C}oU|SncPSMOu=%z%x-{lMNfkkpptMx(7wCD$}(y|5)|r^A{A9WXSe@o0?bI zNsxR{4v808CtvmU&#+RyUg+IV7xaz)5NlBbjLk#4Q`F__IS?L_lN691z>R`42W(;Xn_J*eA2%VO7m82LWbv>y_xWxG`O^5Nd4k9N{BlHmFPc=F zIn$W6kwgPs4pxtp|5joQL7y77(6<~OAmhDR=xE<<%oOrUDDA$OaHuV8u5*a4eE-&P ze%jJYB|-k1rHBt@M89QuW|=2ax|Sot5IVZ}2Q1!`P@wvN~BI179}Mtf(JLOmSOQHi`y z-(r$O(0lpW#gP?jxOn_wYyJI9?Q1h4)M=4J1>srEHQBtuX9Y5kx^X4P2xa~A+-5bN z`3H9+3T=r~CT14G*ZK*xlx+XTjd_bws8x}9H3j!_1kDeAw0qMB|Dp+}*3k_!^y;(2 z4$L<$|@%cdKXY;?>tIzTJjVEs);kr(cgU<5oG=H?P0XPujFEC+xJqq758h%jjY;V6J z7PTd^M1115Bv8(QQNg&q_411+RmS5^86;wycGksZNYP~n_Xq-lu*`e**_k5-2uk9t zNRJPHfwau_+|Ua{o<|BS%g)6sz0&VK%sq9UbmCX@XLia4gT(O#-T~6*@=ZciV_^@* zyTxpCcZDh^J`1WBNaMUBu(mCJuX4d6Lov?Zq};ZZmY}1`ag}c$aPOS|`oWF$KAXTUmj1Yx+nXE9#(k<$>dP&4l30!P(f|S9KW|u|kgM zXCWrXz1Ah^J9g88yPgt9LaP^Uz~p8}OH|@!zirhmNI&g{KnhcwxA-Rq$(joRit8iu zA2Tk&UUYGUAa}I-HiECjJacMz=Trt(RI2FT9m&K-O3P)toT=F$J=-|=D7`BZPu_Ur zl<~QH*L|u2;fu$nY@;00UeZ3(h~!y)i+wj3PT}%f57*SO#;da{&6B?i z^0E!Qq!X=2eOkzCEPV~lMx`sE5S0NrgoO)Yb(+GNZ4#0z$5rcv+Wej1(hE!f;HR6u zyW#0O0a=G;ZQ&L-ni_r+pA_I*^scTUT9j_dpPn!aQ{y(Iwa+->o@qo&%?we}dWwqU zffsHKNYv+j2zM3A)=R4g+oRmursxc6AE5?N264a)pGY0+3TFMl#ulT7cO;fE!K+tRgCqizLGb3z zS^RI#CQyR;D9UH*VkXmAa65sIdvP7Ag>W?HwvQH$$}D?^XZP2@zC3H~vgEinYG1eE z9)+yJcX(*EC^~;Fd^TcNyT629T?ab>o2UuNEwnwlulUhjr(vaMbUl1q^rcs_ zaLa0jU`5Yo)6gEK^{b9(5|zqYA?_*qmva<{Ty4`&QYyN`=};=IdEdM2jT`sntN`!^ z+~iCre0$WR<`0JB-FoF@i3$=-l3}_{fmCc4SGPKT_Cqh2yy4*?Rfvz=5+2R+@ z!r$!6o=CcH0{HJKCX@VVW?78d~t#)UQJ;M|sSlJxuo;2HYlH&qi?im&n zsyPR5)^uS?9E0yW`ZjcfIb*mUeH1Z;o|N9C3zPAxXC02eOH2FAX~Om9vU#%MK%EmM zS8j}Nr=~2hL_+`v>ZGtOb}5%75+9(tPv- zw%X3>i6PB5fszzIaHNulB&jxU_&F#QO7HU4(n^{rHmRr-$ccl*zA@ck3S*lSg5 ze8$O*Bh1e_SW=8c@FOvAdEenu^SS0ahiX5E3di2*=lUfhJ=jh8+YYx!U8vr{Q`Zj- zE3wSZipT{DJ-95y*ozr`W5GXcFtduJze*U=qyApR>proA@E+iKog{s-Hkp1%2PB@D zG%1j)rzl)G!}r!l-g#t6-lVlra>G$!esu2n{xRi_Z+TV`3Yu4=G87m?wnuh<=sfM( z!+STKFGO5qICm>9!NEKIZa1xWpv1kc=7W_|>5`5y51ukGxDOG@JXZb{IrZv*xp5d7 zkoJxq)<3t{O^R2_#;%?7VE@zs$PuFYPPn5np^6+rpGKa{1$vJ5I4;0zcUmngey`+c z(aUq^IqMfT7(DyuReUVu9aUU*YYcOIhh~$^!4=D1Rv(`EUQyO4i!{*A_X9VyJ^G#G zK2b!1%7L>Oq6itMv$#}^4u&dlyZ(WNB1gdDmvg=|pB(2WZ_f#LHOGcNho290q<%+a zZhSU{&QHqo_?E@dT0!1UaYAHQd4&6%^qI3ZAj7jTsg5|jL)aO^x8hvj&5hF=6}5%e zEqlPAk?H=A+)p3|Rbk$lleNI__3;`t2qk*EBnXoD6_U*}zEhp?HmOaa2KDQ0KuSop z8WoqQB5t-gsg&%PZA-*d%YET%M!bOgxWAD5SU!`5NVBc)Lw-6DGPheaFVDeqK{i?Zsl?r^ z@!5&b{IBz{?i@(uFw+qT`n?N|-2W^gDbc=+QMbyi?lsPn)?Ig6>#gyuzf0{>$Tz`e z`%1q%H7q$=P^l^+4>-mbO`hE`B-)_RVV<&XjF@qynQe6yzhm}*ui&=Oq~h!E_qUdY?@&CXK1ECOwY)U$p0mhcio z8Lg96;M*Im^hx)zSXWtFo^TvCnx3w(jfX;j8;r~HSq!U_rV;5fK@sYRB{vw?=*cW~ zUrNyFn5v2C$`R2D+w7u^7!QR;X!@PH>)I(|=s(;H(Tz5KNCoSqzC`D8&e8htIQb4l zN9QsA()Sxvq9dfUC+SfAU1pDI3K=+O+jMV=Z!pDG>JkrQaUQW zo^#J1tE#q1$xLYkb5#?5xNZ_svV7Y z=F>c5FyTovg8{vhg`?7_xYHH!^uxy%Kg><@S0)vTFq>RGk*>AbG?yzAe6~zp(rmt| zPSmWn8=cwN-4Kv(h=eW_PJVJ(sn_G*pD4-IT>f~>c(lGYVf4^m35AtT3YTh=?{7&y zS)J$5e+#BvAXb&I{_K+hI zxdM3NHz`9q6_=&%D|vDF@^E%AcUc0q>qM7Tx#r6rXO@0`;{iPUTc21nBk3f~eV!e5 zN2P;g8Q0rfjI@8(%{i&xdCZ2!1@Wg?#;!w$B~+z`nePPo9HRlJ{-}}dtP{Sm?Q}Bx z4bZU!!3{e%VFR`b@3ou(nwa?rt+^S-4kkJ#(Uxp#IDe?n7#1|)&U7kIs@HKFlXZFI zJIF>uli7RJ!Bkb=J#iUZt6mO~>9&iBc|B^P{`#gSP$0zmhOA_k5m!Eq)p+iVQ|8oe z*8f6dN9awxbB9&+$9rY0R~za_w<-`$bIOJhT`}34XU5Ac^<6?%!pBREOTDnB=t~`P zcY*h5ojUqiIow1me>tJWsWDaA!1@e=V(hny0L7%ja~eqpuL>qB)FEUmTre5B&m@*| zyTJJHXSV#mj|$vmVE-gp#+H%#B-eqM(m3akAn5qH;f43>-KvYrL-CIX= z%hFAkUkupGo{23+V$IB?M?A|9&me$giu z^sRqqhOT?94LPeDw>ceTPgyqWT{nl_Y#*c zu}iB?cufykEczF9;3Bndpz4?WuEH5lJ0C?*u)afx8c<>nU#_)^1_qDB7fYvLg*Y4; z)pXv5PJDrP2kQ^KbSyPn7US6jQ6?Dj)r74@sPUYe^U#E-@!^#-Wl0#cI_yA9`pkV; zJvBj6BfgGT3?U@BXY5ua>pNu(K3_WeDHxOeecF|(69pJ?%Pl0U5Y{y^$mF;WR3yYU zWbA&uBr34}tw_LFpm5MJ>Xw|?X#NM4`W&De)2rC55c?Y9Ro?MZW9xQbprc;hhP_X( zQ`?H^3PkQ6r>c=i<~Mq4c+&Ej&OVWl9y69Ag{OdJxl~BF`Kt2JPaxr$Pny>|(4Zks zczAR87;sDZd9vY0 zDFe;Lt-47^jmmfa6JHCOCgU=(&&Wu7Y5VpllcEY6i$;V)Y~2nznxz1~iGS(WbxO?p zvx1|rp#*x~t&nfB8rm)x`RMWaCss2k2Z74d(*=`iMm?BGX6Nk0L;^-k$TYW7(+YdX zwLZQDfv_G~RKoq1k1WQycfvjG*A<-|rJ+SyB8@fbpA1vi#Nb`6iZ)m#kY_%#d6M2Mj)4hnjl zyJ^+Bk>lD=pMSL5$4`TvYWh#ZTfjE4Epl^1i7zf30)rk7Pw@JNX5}{`Lt^Us-s*uC z{2lxEd@S-Qo=;ACtwt{ztB-Z~juNMZO7$Sj`~9=4aDpiz8i6Bx_~d}`R>ILM+jQ?v z-7qkTbGdWEnslG3daV)PI-PddUBVHaU&f@ zfev@F+v$yX1Ch&T7S?Pc7P&;QADwv9-}w|qHOdHc$7u4Etz5-%@U}V2{zkO=D(mES z%|!TP?A-L0yn-2LpK_(y#z_S(KRr2(WTVk~PXc;xPO9(L!nKCDUZb>$Y{m7DHaD1^ z(w%xL%QE&edArWL$JPvW8<%0{GK0cSaKFr)vC?5p&O?_;DmkTv>cONKU#^j_z7O55 zd`!-1-ex*2e3VrRtJ7MIN`V;XwGHKb5j}e6yE^oZ@;_1aAubU~X#D3JEGe47eo?+l zcYyKfC7$gstBHw{WV3|CA$|gFS8)76-f8z2#{BdX2HmJxXDau^iGHdXeq>0T<$)|q zOY+N&Jc5QOvYW6RR!c4Lo&(nx6EOT6pkLiK9+#Mgbs2=B{DzPp+jV|9K6jzSv`K=@ zMC0Y>Ym1S!i5#&nJl*4ZvBHl(6guJRLD8RI@_W2n)uC1cmT*P2kf1&dQZ?iKaRd3Y z`?ormfw{Uh8$I-+ro(57rj_2kiW<-*S50u-FxyXb&Q|Z6y!!t8&UJEI%J&x5-()*E9U>9oXE4qw$t!5d`LDOg z6_x!TSyJ>8BvF)A75n^hXN60&kU|m8ZYKWrNhe$T&c(WJdJx*Q=zCD^9n&5H2K8PG z`nB%L2h06C8DHB=-=~E?e?u}#J9atQ9Q1?*UVVG1g-b8SOk`^LO@5)AvuTLD4ZdKO zLH+fk`shDOsA_NY73ZqtSE~v_UXkBF>J`3&InV>(#h*rwh0`J{82^M!T#W$PsGftWFB4_Nu>mes!_5J<<8`(^X-UJhS!A z{1NXt9lmvF+tj*o=b92%w3G*7U{$_rj2%@QH&tM3Dm|;qF?_*KXl(U;66s!U9#WDP zXKWS*OE9Vi!`jqrDh>YJvuqf+q4T&E?#pH}gST0>d#+0W0z47C(@WRTBLi4q(8thO zc>eax+eGr6m+%pY-zYNOL-fG>Nyx1x(n!KfkO+irCNlZ zGLp%|mn8DlF7tY%m5C|g{EuAO1w%LgP9S!*AKc|&ysPIdtgR9Rhpsy9@CUt0@lsd?#H*7iGRj#l z(`G9pO-K#URXn%`LJy}UjwMx|Tm@FiD9Se$RXBb{@rQe4Yot5ltI&7pFmpao^7Voz zAxcl0?+_~-?nlfCob@06RXTSpOZDz=_xdwEV*b#&&0nc&`>TDX%DAGQ{<|;tEX`i@ zQ0`y)@Jiz8mkUU=>?x`H@n#+Ul`RjS(@J8KSK^C zMhVik1#+y~6uuBNaKD&)dWq&{1~EIDPaByp7YC2l-aH!$y^Z3dm_ZOhaFcD_88={;f6v#(DH7RQOc2PSMQ@f=$ux$2Pa9O!2_3Fm$|P;WMWL@c~SBhgHN>xBQ#I8t_-iZ!Pq=XKEkXXh_8wn60 zgoqGAXQYLeL`6heA|(U}5TwNrLWGcnBm{l|=RM!~opavztZ%K4KUgeQNbYApH}~Gx zzOHLO2=9O&b%;2dx2k!mZSM9;;+89Crw!jh2AoY<(pWPvddlR>tOMU`W>~C|Gt%W( z?Xvc5ruzu*BQaGOm`wvSh*`3T$o2ESv~1&v`D|z2@LrmCDE?0(?Bdy*`qiD@AB_k{ zWnh2!Qj|CJimy>q0qFWEUhD+xbVXqAQhmew$z5`}E^&(GmGCv$c&;oArUSUPf>?3j zFe#Xs48Vrj+@m?NH*Zo!*4geoRR53`{sZOJX1UPXe{77|tq<$0% zOuF-y@*m_3e%rM1tVYe@xRqNfp{ke`C=CnAga#XL#a-Rdc@Uja8J+HZU})3SGy+}q+`HsA0$T#y$uI?a){ z0pRJKeio_d#m<+(XziC-@d-pHom_7vGH!}KgV8t zyH4V+f0_I?{@nsECzt#4#>&=zYx6xOvY+k&wyei4^#1-{Qo{=riYPu^Iw!RVV~I9< zc-(+nFZLYjG=kuAdDC#hR|{Nz-^4Nr7I+9%SBTc4Ph<3-dv-t$v>jXjkWk0|M~w}? z%zYZ;U-iJ+r@-wkzf; zwK1^YmkAu$c}Qs7`{l-(Z^>P_cw0rU+edkO{^3t|YSX8Ejv=NmHwrF|`)=RFUwd#; zba4Bs67e4!>#w-sJUZ9*Yn#QPnlwDwM>=`oao;J?uBO}yPcpVdDi4RT_z_YL^Ral) zW$n+b`GI$Y5yCR@0?9zu9An&^kp((2bNkx%V{BcTg#sM;_+Q5|)N%jGYWh5pQY2cl5nAULhZTg+31Cjl1)8z)}Fvcn@v`oLYe5i2X!-*&K2xq%h zLR58>6Lpm@ZaXb5PfJ4JT^aqw^Wci=B;~t6q*#3-+(VZ`vBIlG6q(g5t~Oh>Vn>=% zDDaX-IMOYZ6V1tcnX9-9i=I0UFWZl-T{20Vrz=qE;6uT)OSBn&_9S#=O42$}#B&}M z3|Y}cCblZhFvs2YtEyB{h?ACCig9@eA-Cf!huRDWy@%wl@_U`6P~}-=RmwFf`r@9A zyWsT_IQxJ!dZa^Z`$0?$&|5rKKl#LtUOsiJ?TKn&`;Tj-5)P~; z(zJGjbYsl^fMhadm=db`VoN(S?pX5m!j{|`-u8I>jSkb%bb6+DNrz`_zV`zq^W1!0 zN?v<}uHuc#a&TN)RO;(l7iuzk+QS*7htB#$e~}e>B3pWjkmmuVAp}qV0GEDjFYU=a zq6d-$XO>o%2r8+-k_Nu}6+EcPzpdTgwby7)t z$0DsWh8K6*o>||Q!V$t6YH9m&^cB{W3i;LD__#hp#`lnUR}ZNVbTUZrok-ajBGme% zw2)qQ(d$5UWGg2wNU1b_!e#VzF{Y|lNd0xo!kvs}v`g}XscPFC>8S+ZAme=bIS_~F zOsuGTel4%Ve*QQg_KH`F!Igy1kw7Z;Aq1<6gZVC_(F)f=6K622*mLrDiRDzgiRfUD`#bg+9JG|u-q z&zWS_S=6j+q?y({l~z7a>8_(!;;Mu?(!v@b3Pbjo-z*v#J%76M(lcGo`$;egjN^Us z!`zQ6&ysJc_3BjU5Z2Al@)Mue>|}#cR|$glC3zh0a#rDVOnZ#2q4o|owg^^h+348j z$ysR_oX5uwG5q@kb}Wx}Nd6e3WkMP}3qX=4pvr48vn(H3CXfml0MF+Yl+H|Da>t(a zgIvpU*%0_JIPjaR>@2#Tp785cA3oj8HA-?9-a*fdbl2<~uk$&RRTP{C(sv7wsSJUf zNMoo;$i;u~9xSQgT}jk%alT{k-w&5cH@?VQ=$RVN3%@NDZL`5ySfwmC2Oi`Xzb`2e-I(2cu~` zu+VmmH~Ah5^glORk?AHKT8R{da}Dg*%)}(#0y_xw2WE2FU*pT*T}rJ!?l5!o zHV3I^+q>^Y$bpmT6JS8}ba_L|5ET{-R>R3Bw4Jr+Ec1PHu(O_lgyFnD-nMAdHZHFU zFLh68ijU{5uqiX8Xu;N#fA-)OE5i%visBo0GKN8iIK*20SAE>7cr|>cvQEUdQC{QVzB?R`>9MGa)r2L; ziG%I;t>g{nP1usT=LvFb8eQLi%oAhgb7k52=dwwmlPd2p(DEP9!JRg31=_D zGKf|mPZ-yZ*VZ7EBit%|gk!!M@SvF!!t>XiLX4dQjHdM;y0dnDbs+k4yJ)}u{A}A;`H(}G z$(*3TZWvHwCKt+tukRE$>IR3vDBss1K@+jH33d~sF0-DcV3Lv{sLGH*wjCK*F%5pn9p>9% zXY1qVnS5mQn8E%0ipkGgHkN4c+2+QHJ$jc()L?(bCn4m%N)~$Xe!JbA{p(r1*(fo# zr3H~ypoho~s*7;cLYGI{rT9ERx5n`Jt>1X#Pf<-1f*Nn)741@;mabNFaFYBKu-JIb zBPI2C%1+#Bj;zdgn-wqtr-Zq@rS%2c5y{m!BUl|jPl&R%bc|e$8|K;Y7WF%0q;aR6 z*0`T|W|gFL-bX{-hLlU+)85VBH41_=sIY_PG#zc8NcXUUGJp*OSE z)}u+pPIy9ytcIeD7;>$xtI%Bq0Q7^Q7JhVeT1p%uJH6Q2KgWcheqCky^PagR<*r~z z@`AQKpRUvGtQ&+(;uq2@NGSYeqBO=aVg8c%+~}QUO-vjAqPVUnwSR7T&}gPUludD$ z740}LIP7^i*QgNQWI%&_Sd7Uvr7lz#3x^Jf(oD)-B3F%^CFucftA(NpcP-x%NtV=j zBAdi_Nkzul*Hd^+WZp;Cno^00B0pwF+tKyX?w;K`b{f$4Kogg!$(I?HF1G=X|G`9{ zx0~u!OJ`AL)v#;g8S?RjP1oQxqt4fCpl1mgFCbkLA0E6&3gP_m3w;S(5IkSE=}>ue z=j)IL->MtnMtVt?BJ1U%b1<_+6`kc7d_2qN@1$C2l6Y!2N8|p!har( zZc5#ofhRfg8=TAUn+&(b%xwY0rTvVCqlM8nu;dv5EBAPVf->Zq!U3|>a2>kME-}43 z6mJyW6)vwd3AujcD5V~gTz{MBl>%m^3{DyVGtwm<9Q)T{BGgP%2qC>VVkAIQWI=jg zDKM1S{`{BP>l7>d#EL& zlCOt5eZ!iRP;IkB4JTyJEUv6dh@Z(@HFHIFDHs;4Krv@+;S1(jmcv9|qrFgcB?^_4%qg)f2_*A{bbr{M&LEK7c*6ZAz(cGqN2IAGp%C6oGOS&+ypRu( z3OFc;to%7|s%!>5Qwbu$&Q)54nMNl)TH+%V-d%V4Pw4PjMX{wna%tywUnL+80L>OK z)l7DO`y-dVuzB3jyfUB9=dP^^fjpkQh>3xxVM?ScqP}MB0$FJw_bsUa0aeg<9oUH^ zTPikZdgD|#c`2kQ%N1STfJ?D@`xiasn^i&(CAXZ7beczq$L{Phm{|Vd-rbE%bI<>G zQ`nh3p7k~*i@oYTBg#xa>_DAP%QkKCWsOY`1)yB0`UWt2d(!>up+7n5pHx2ok~9_e zHp15tX7j|)X}0^PNhz7!)&B*0+Tr-kq{(e^DVH`rx<1ra*D>+>&*ZG7qRa|tcIt_r zHf?ukwZhrgUjFr&*i@k%TARLIp83N`1DM>ni~f4)2yBM%J~qEebq$kk!EAGXXQ`N9 z3JHGBUN;{$pI}AR5Lcy)wN-x@Om%IAXR~Nuivhy3opb*+3S5uU+dcoc;PT#a^#XXr zaee&+{+@fCZ^Iym``LXio%NRpK)3=h*7bX;+tQz$(Qsk@Q!Kjq(NDA6-Zq3110Ki4 zAJW94ZP4;!Uc-0Xob96JGs3-&n?2a5z=!)8PXcCkB@1!Wj@O0dp1d* z_m}Fcv4CVI>o~qMWAf$X^@UL4&Ojewf%I97ni2oWPTRd?naEEv>=?y)McT*A7do!>X%<5)qX}9-DoJB)g zEo8nh64{UBC}EV>y{qd*Sg)p+gcobak(#V zX;{4Vn5*!V`0-!mi-mo^Y>)2Ede*F1jB#}G2i^dm*w4VtoP*NORZcJMdaT;#z%d>y ze(oSKz4}pOgmY>_`S6FaM=im zAP63VcML{$uBJ!_PlQh`5Zme`S{dy=z{1qp;Gb=_DLN|7E3r#{x=yF?8u_;y z(8%3k7I;Az$7SBal+>T!5n4z})FS_HNhVj{2?@EoeNvV6ono>u9 z)R5fo#|v$uOqr^UR?N$uO1yV4@X6$PCE&fhAy7;Tr*qwtH=&$DuBjo& zPAZ@u+54w)P{zO)O6jZ>QVX;ii4j$S@tt@^U65$0gW5?7grA;tTkD=JZnlh<{$^_J zpseB43u8sA+RR4RzglY)R%=Jmad+S-@o6KoOMI^YVyDnCCso@@Y;#2#G;2nmN#T1A z!A^22gwqb-A;IavijR=Sp=gPSJjXSs=vxW#(z3>c&f#OWgYb@74MYfwah8X;w7R>! zuFuOoXt>z`ZFOWmr_*8BD^(V}7pL3q>&^;M*(^P?3OuAlJ!YQwpfM;%zE-PEpz74T zwx~T10-!+xv5)~@OX$UZ6*mW&PnMaiD``Tp??smzB|1HITNjHeKJ)F*wrJ6D#|9?1 zouvr=h{&4KvqMDzUTbzxZR{bT&}05>6NxXuUyCC%5fxKaG{qtlyw5k+(fxDNXESEb z)ss4dNnjb&ybvx?MW&hiA4gS=ED@gYB2>RHS1jL`zw_@gd~rwEj{X}D&M&sc!wp}r zdd?O{!wsDFwsV?qseA=|^}l_=%fgIprOW5ARnBxeEITbB)_ zo9xX!0PE@p#4{fi@;wJ&*lZfA6Jk`#iuTQ2g!aY4tvU2pYw7KU?&26r>9{mj-e<{R z(8{K^VJLaOEFo#32Sy3yO{|z98E7T#FL75s6vD**TEQ|>rtQnF;~t`DMdfg~6FWEZ z;<)M~J3;xU?p=eGKvbpE@XnAZ9bxfGX*w(V2{FwTD{$6p0&|jA$yTrH)?wk3H( zB##OwtcI#m@-Rcs>_e7fVH?o&ja7Nul8#zzsO8#eL#?1(-Ok(tWLL&6b~noe-4ki7 zb+--_Y$c=>BzTH#vUEpFNZx?2@F&9r2lupCx5t#p=8%MCfdi}1`ZE!09q$DjCMD96 zHR}3<;SKAZR}9qbSi&Fgc^6v|eq_F94@{DK ziQuV&6a@FeQ=$UeB#E5Ll(r~O%Gyf!`uX+q1_OfhlL8<{zpuR}{XSCD%kiKpU^JwM zSuvTRg$5+qpo7Ut8xklNasYE7Vgp9hdw~IXI$$? z^+Ake?F6r7Glnh$R4piHz@JmsjH9#Knz)nAu!Lp411rRHMTC9xoRnC!af9DF+Ufts zT?B1&*An;Y#8fmP9tHvSu*`9{oFD`=Iwxk2~z|sf9$!!ttb7#Cz zxwn4LTOCD`?wj-W?V_LbMzYTKi<=-8m-qE;cHTghL;nX=9y#4X;;x2UN@>m{U=V=S zPENxZyf(A3wT4U86xm^5s09KS6P?t#*<&#*XleAp7h@8up zo|s$Jt(q(qlnYP;7Z{c%w*giEU=CFU@q9mOcFvUM14wr)z>Shq?S6Wp3Dy1r#tYaC zxnwq?(rq)OCN+O>yX^N`Vq}BYR%M;i(UuB9-7nA#1Ay zS6Q(-u0lvrZTuMSI#SU#^QJL1iK^(+Y_}$R_LGZeO51D|Mg4-ob7rXz^_W_%)xo)- z;}?E@lHV}w{^Eq`cB+l5FBj0!Yn#=Htv-B`{o}&dn`1l6W=d8rsO*vzY8{9hq|bMi zQUyG0uSU5(VXdptXwCQr5bOf(FzLq}ptasLd)^WRK^Qq=KFkv5#$h`hGbjxthayi| zJv#u zcX3o)5ky*yiz>zY{9UC^H$i|sPz?Amx3Yb~p>)lm-)5BLeNCA=6iu;^xZHI4bE46> zJWWtDYvfIlc^Nu1X3ldiao`w2!XfC1A28$1 z_#|_(Ep>)Z$Af3qnK3?e`P;i@m{d${)|-wtt&{PP+P@uazYFPd!5#21&9sg`)pIU` zHJ1kaEw9Tv*X4&?r#{|Ngdr({_(N#(l93x|O*RsAO$P|ffUk-GqT*o+2H353X`N~t ze~m@F{TpU_C^cu=TVXfLZDk&j``$^hsQZ%}cl2x+s((vU?;*ytVBdv6IY6sutK4^- z^q{;=-fv>7(A>%^`%#i)a-?i}IQpaT{8dcR6}h$v=w>;`?=P$>IudQ_UXeRZ8>!!R z9HQ_o$038!mzPxw)oF<#A-ej5{59p77I}w%Sbi&e_uU&6`n|+GSL|zx=z>u4W!Kus z=|1R*+dp4_r5a*{E;*TYy`TH#`b;U-GIsE%dk1pBa<4kN*9%d3@L2O%@LU9H-vQYL z7Dq-?WhgzHR#>kj6Ry6sNb|bJX3HGLT=)zVw@3l5od7yYL_8d1di(zqa#Hr0|AeIm z`Hz;sAyYGjm9V%Sfrnx|dTkczhe|anUj!zMLjs23Hc>fd`~}S2Sfz1;A>Ii4QFN=X zo9vi8%RD7!MqJ%M+Xv2%E@z_>Q<5rmsqo-B1hZ>{n~)&_rhZ|7%6{e5pf zEZA)=pVAor(QPgE&o8<+U`@ITxR4?(Imzyv0|P*xLYp-i{WwiNlw*^7*u`iMy zHn=)#pkcP6(fW)&tfFo$QK>1Sy27o0l{))lZll@r&H+{`)?jB72UXcdRK*2`c+3j- zvH~?Zq4fzgZ@L*LPtp45;W~XbCxtm{H}8ovwU$R#K8=TY%(_DsdG~O<;kY20EkvIl z)R8_~d5Kh13k)vr$Y$Wo$cZ=HabEiqBt!4cK6lLai${=tXD!&(V``x744k5|FC(gI z_3KTBwbU5E0;5QsLkTS6pF^oedeNOFV(3J8^Tbbn)vjeo5`1mHCYM3dUw`2CNCD0E3e80` zkMQ(#~d=2S<0e+|;$bXYd5CMEPZZO zkM*R9I~`pY%&@gfeOH*ninja9Gpmr#R!iu{Dwfb=&M9+d0G>7)`H;p+9c4xX%$5&> zt+n$13Vy;7w+kAA?e5Zt`Q*cQ6I0-z=N&cO&MztbdZ%n-TkHw~3`d85+qG$LMi{Y! z7-PtP!N3gXH@?ss0~IP!cg@2F^nXa(eBq^M2tPh;NpUz2CQ)*8Hhw)~E!7{bC{v7K zRDy^>u-!G6G(GWRa^d8f$#@#KDlSspX4txfyY)vFD%eAO1ueyjb~0!2o?_tc!J6!T z3-esPv;-%mL~2wiQhMvvF1bRwZZOSKI<>?0rWsOPQBAVTTAZUXW?Zza{p|<#ry#p(l^^j{4fDVZuarRx9Q?jFAzjEA?}T!h74a?boT#%vAn3koUQ5fZuM zoQ8kH>*yl>Wu)K(-xgQKGHTK#(-U2LUsHjFolckz{W9&l=QMpKzpA7@q( z$M1B`z@**k+#{5H6loS~(H4Vv?zohgeS*XispB-b1s>nH1gCQa0(82D!Vv8}@3YFw zsNB`q$OL128w^;}J6Ut)rE{pIgVMDdx8u>p&8uYNlfF^ixCrBYIq=@bi0$CP|XOiZSxDtc(o$^m|@2M+G<^Fglvp_`}a4KJJ#nUouXxdfCiz zZL7A}A?>=byyJda!5eXTXY4KM0D1&v*>Km59LM<#3)VT8@D-VK|E_6Ng2TLxIs3Sb z-7iY5iks_jM}#>O#SQM_3eHV@0^69j;F%gP>R9YcbH=x)9zw#EPLX2{$*z6Nal_EB zr&FY_ec*cVk{VyMO4}Q+-bE`CH~C6~46>pbH_hbT1m&9>XI>@y2)x}b*vdNmln%<< zx&<=i&Vr|9H-k}}yB;7_-;^9t; z(WI=S(PuX%VYXGIh_A52S%4k5tf%aW#N0gTw>=q6X-97_xjW4WGrm62en`_R8_-V0 zU0tL@UvBY!7;mULmi?tvYUdo|1%yBhx#LyeQN>|;r8gP5nKeJk8m!!=_tz@IL}NNO zVl1*Ld5N8Ke*~WW$tV2Qp|8v=JJOU5t2>kMn^4u6e0(^Mn$d1Idj4Z62Vu#Vz zw|)~G8PWWqXX^C8lDVsn&%F{_hSD>yhTh(Y%;l%d1GO)=FFeWP@zR8Nsgu`f`5f671_*Mw2k#&aMa11wtlO3 zsPTO2o23Fgj&zb;V#*v>GXsFmVlXw|P>GnT8<(Q^&@lha0JadcExy{m22E z(MT;ZcWOMxNc_9hb2TuQeFYRJ1N?f=%w>mHz%DZsApQ02CZ8ZZ&pP5)NtA{(`>rk& z4*`1<{v>ugY}TBP4Bp0H-2k%k1tw7m1+2~*0D5G1aKfN@TuPv@C56R=)z@B<3c8=q z318{RSow;4SCNMY8S+-1wx}?(7F%RSZac?w`b}pmd-($1{9)LsK7cRW^yygZ>Yg&c z-^=f)fQal*)tE3%X&q)wDzY1u&qi~l>CWYo(6KOM`No;*Mxu$LetfQ~r^ENw_qkqx z;!>0_InpSBRf@Wwl6&1ZPVG2v@Y=ImC-U8m7d}Kc9SJ}+{VA&(%@p)7uifw_L%zyn) z&1-5H{m$AIXdPxI9!_-NKP+U*1E-_RxCWrg`kCqyB2-advL1`){@vbDq$8zAeyJs^ z=B6&v$^4Io*Fpe!8&bp%GFbZl7GPJ@Lx*hgIto2n9rANgILhtmwHawzWVoQS0rg}t zys`G7t3C=ufW2C*R~;4YpW5Z7_+wuPdCPm;s@h*Z{*bM$u& z3BnFPdWX^c@>qAEEBth2<%E!pXy_ZmL%VB&qc@}3H&L?=V0 z3ZH}$(n7nLXWOjYVjcy%^nld*5@1!db-2n!XkMW)eJu|A6MEK)9{;Hi9{Y;S`Io}k z{(#E1{k=4sKeilq)$sgC4s2AElY7Q@G2-N1UeS2h9!gmBz|wleVj+A@f)R;|S9la) zyA2h#x)R`Z$Zj1>$;st-8o9n;`?$)5vc5wcxqCY9pJGg*h09r8JLEL~DJuRND5Firl#PpZZe&Ut}2b>6R}!=1FoM z8XK8H%gtFOO#Kbd3f#w$skCH*syD0jyv*r>PKJEW4>Yyd!~dF-+gR}by}EULlg5A0 zlA*x^+VdV4*Jccw_R5YMqe7d{O8g!;Mt@lT@1E&RRO1ER3olZVXzlJc6LyO~ymD(@ zX#8r?q@QtW#|c>~dpMPl!tUFoJ(D?FMtiG$ES}_gYqPWzERqLDWjr z1K(G*9=HFd1eU2+qX!sdm!*G%`OUDqF7K1h)rYYoFDCo2mMm1NT-Fii1$V7D&`!iv zRkUutjI%_pbCzP!!t8(^I9@Wh6igJBADARGmn9^F+ zNTSutV5?#VayB~DyzS&#h4qV6Z=SoqM2BCQT*7mG7xt&1TX3^0>-gat#zWEZV+N5q zfg#MEa;dmI(=h`<+ViAun)|^#XVu_Ga^gn5$#5$^(j3i2KF#G1TgEH4J20kLD4hhI zq4{=)CI9xa!5)Xl9P(KAlG{i020Iybi{_}d%@1T6fI33>Ak(K3YmN@#-R40jxrfAC ziRiA5a_4IH*MzHmSu2B0&SLM5vm>3QH%K(idRx;E8lzW08BJuD_>}3f%FdFie)5wq zpS`xRjzpnC(lY^nLD15$V&2_4j2|6eVhtV0w=h)fqrUq&Dk*E>Fx9M&pI?0U3Hg8s zU6#pABcGN{cM=)sk>=?bB7BI?&ULQyYENhcAGZozYql*6XlzjI zPBw2{yJfn2E%@51hQ}BQ4&E=j{q-_Q#PfmzOp8gTo^rw; z7wFV($w%8z+wM!%a{$~sGOF;ll&)O{gx@G->`FNoHT1N$l4Xp!FIto+g(Ur-E zIT2?@wX?)uxRAov(im%PkmTJ!FR#uRIrBMj^F3I$NWBVINqbr(9syJDqAltLDDDCY9e-uy5!-k#h7EA zhNA~oWm^<42=uUdoAuB3eqaCqI6%vsGBdt3`e)WNgW+EGE?)z5hn7?jto<X z2y)v6>&fC?D=h1pc96e{aL{$h;F;NSfR@y!XC&!~enu{tSFCc(u-_))zTz6+rBb%2 zLiT}e)g28;t}Z9C5vqU!F*!EFq+UK|L6k(=bI2wmq@#9CvBf_gO*fQ~ee74$OQN0y6ZsWtzPlm1FSrP1gbN0&t#4%}3(36841CAfPFg`To_kuvhviK4 zZiL|cv)YxHtjYtAwLvp&T^4Qjk-L1_#AqktZp3t^JUiGv*LIpa zm4J87gjJo%dV4}#ZZ}-5bKm;ogyc(Q^i`eHrD?6myppp~?$S63mf1)14l^9>wc5OC z+kjRvapRaH5}GwEsB{iA=}%$UD&8NUR^eFVmJ`F zBk6OLpFj+8jUo z+x;(1P_NzniS9F#K|?n|fbUx9ozcW2xJNIv_T1CDKH?s3d^ zu-J;Rdis8#H21^x%1STru&nk!JS2BDONJuo#aVIzDA1^q5mtsGg50thab+Ouwn&+7 zy(ZOj_?f33|20gHuPw8~&(ve>fwClukR?%ev$S18i)&UNUy~*r7p({G?)@

    zUnGA7MVudRZhWl@Nl;XKt5;1a(FG z(Lc`{k2=5fG_1v2889rswRWXjjM>+Je#xK9Ha8S3rk#`LGcS0!q-#5}Dy|Bu-(L*a zCz4GSFj3;*Dmz}WBmJqz7ki2bf|m&|Wldq5SG{(8XPZ-_u z>pZ&KhX2)#Jj_z*U}KkE=tWtw$00Or;CQM4oOm({k@MU?;C$i?aOR1&WW^ z)$6>`Ss8C+__K=MebADYT;}F?+zyD_C`WNpY`}M!8p=EX9KMi2pWsg_! z%C#_~Y0sN*VRc?hSnrN+3Z3u5<~w=w+pK!vq5qIh7B_eCdiWcv3Arnyx3UsfHcIE4 zMaa^Ekh}E%M5DAI{KH2+%L_t@#!2FLXH~`W%>2^tvd6bOt1=f_90*&r-86g+vp)G4 zzNnD?994cmdp@Rs7j)ca>EVIm5{8)s=Gli$=VAL}PLi+Do^FU7(kmM4Q~$1$FXVYu zki}2Bj`0tVbSef94~p9!{)B5hmT2;D@-ghDOa&P8M8es(#Lh06{o{T1LO0TEN1`L%3$ehjlQi2($`ITWz${L- z5P3Ju+j+-`ob(o2QtIj0DZLYb)vDB=xq6YTINk5)O0^xH^(dD?rLazzC+RCr(`N-Z?mjD>C(%^)K}@jA`JvO%Mm? zOv10D7vqg8diiSj;zp%YUxE9W`7>~v(Cy!wQpLd8$A#Y|e|?9*`Lf<#boY_$^hWcq zHCX+ek|Ph^&RcNHeg`EIhgJ0TP{jLPT(z4dt0$%b%JsKTjbZ$F{{F&!#!Z!OOJ?~j zOW2$*C5E72jfX%2b@YSG58Gy6%}(8r3!ZhwpAR6+O6%gIp@dr~;hmDjQPD9Hg1QJ5 zAUEf9N^i{fH6Nr0%j$KoqC=&J?8N66$HfbdH?))8Wp1#1nH#L{v@Q9w&F=8)YgB?1 zYM)%Un{OvGa?Mq;79@epWpu~Q+6#ocB}4MoQ67#i(_|ZwS>5C(=s?Ue6aYpoNwifp zJXIXww!@^fxR=r)MtnEVN*2XB5Fkh5{{`X%4*zPxwgbj1bg~4(MGxjL!bM|c=O_vF zu_tLh>eIj%o^3S=P=D}$^?ud5c+M1`T-T0sKHS}V0`ur@cUfeUROq~L>MzMoK}?-U z9YMakw-oizWz?XA1{M3EZenehR#%BNMiL9&0WuZbB-4PW4Qyvm-)c;m*08GVs`I#Q z_De?UXJ{rJ3@*1ca?gV9D|1iBv`Fi|yUHS17&^y8=DcU)JP6^l)8`@2#m{KG>u&~!uU3*z<)6d~a(QZ0X!!SFJ2}^PZ|1F|tLE;*@^Lpf0^D41yZ&80C z?;OrM_vbalSO~_59(I!rjTv8d>TRAENPaJ67@d7VcWy|xG&*8M(FaWR0_E|T4tP7H zE?OEpF56fp%oi%tF@_a6636n%9JeoAWKdB&SPoT`O;vzc`mW&m3W?YRj-Sg6<4e$)IKcT*W?J|}*l$TjqY4@E^bC^lpU?zxo(Lyo#nt(URQPZk@_9FEC`*)an8fW*;` z6h=k!xqb6(#VMtCeW&S#NYiL?ltRB51KV~#g2a&d&~B*qJz0Hs_RbLu*!p8RT+fs; zP>z{ACyj>;^Pa|wMpM*iFh|MqosPb+N4)RKgmF&CA#*cP`MBV)XvJ0thmh?hLZp>f6l*#bWF|;-*Z?=Zc#HMCBZpM&RA;ZC+Bo`^CapXf;fLQ4~4mq!cE-6y$M-#5fSR zOUbvw*h@Df*KEcpPGMO3$qg~NnARUe+Qgq_p3Y&K%y_I`ZF3xjO@~8ur%#jXotRh*^>YJJ2ujBYskY=()LvOovVV3b!6#$pp zi1B~|6GC!XqK+r;VQW_?Z(+;kBc2*8>&#y(XVTCk*C_(fUgroihDm$~KSGmfoSK7M zLH1X!C^#E@Z#A8I0Si9!r^IGYRuQVO*Y{6lygFFI$BVRqg;~-#-#zErJoy!>qxKmw zpetqr@HAYK$HVha1WjpBL4pveic=L5A5Y&P?KVmH*%&%=F{qg@n^~nDSpl<~8DU{c zM^mD1i`1>S9-^}AfLfN2MZvF`mnX^*2+{6~d9<=pnWCAh< zM1TgV1jKoYu^pzYUCjH@AgI<#Nd;roZpL9+lUC+Iht6_(+pXSHHuKE~wu{X}%1D=Q zH=!Fbg=9uZx5;fYc}uY`#;>z5rUE)(;jf0C0%R4bu_8n;?nPkFOUwSfQYX^^BZ_Fo zAsge*d(LJy%Zx;)?QCJV$&Ol3gOaipdZPaQchCR%;>bnJok7h*$E{L_25fT2OMCZ6 zDCdXliT?PTjwIH7=1BM?A<-S=mZ4%HzxFji&C~A3U?l(%!Tz9SqP{WECAr zCb}(kwfKc61&m&E?gd;}B8Kz}+F@O0A-+CJHet2h7^2~DJEQw=_!HG@dIchMoW8_J z|54k`YD9&4XMGNcrVn6u4mtqj-+;$!02Tl{r+$35$F(UF-7F#=!#kk_zmVd7=F>#{Fo?!W_GjJd3iI{g(sXR?T={ZLxpV+(gO=I3oc0r=d zzSGK^gE<{-c>B5l=7HU zsExD$lMv9OivX{ce^Ab&T4wgz6Sr>mQagkQ z`!5Q-$p-*^+xwHV4Hp02;U$AOD(IxA<_Rf(l3yt|XX3Ii?nXYEoQ3>z2!@HPjN>p- zL5LN6rQUuI0>dTG#}DsKDP{h1-ov*Ii`T(@Horb8-%#JpiL!Gqkb?cL?(kW9=C-Ac z8u8sMCMTzh|EyC_cO9{Mbw<`myvNioUCG_uJtxvfll?wQ=YA5eySyfMehlN6{S&QS zd-l56?ec^FMSGXN&^lQkNBogIo+4ibAJMa|?p*|LrR|6dIT z@k*~vGS&}|=tEvv+?~6wzPod6xq2NFl6RSj9bMN77@Oq0wr;c`4IVyPvO0r1J{h&R zzv45thF8oB^OZt+kkMdO+r8I+e*Ej!c8Q$at6w%={nqeroY#AdqE$O`0IV_jq&Q9{ z@^$M7*M89+e#}$yo1EO8dmCtv{Ga_^kN!hfr#H=kj)h|yNuIWFFWFp=kj!zfd9UR+ z+vV64hpe|q4`1?)cd_@`ZZ>b``INYkvQsv&1$wi zYb=TbXGRht9dg^^Ar)lCZF4iDXp%~IH?bd9$F+Hrbp=}nC%k2B{s@5Z4YRd(kO zv;TT7Wxu(rFL6p#eK?$8RUry|>E-rBHoGJ9+2da8I;~*j16WTHDx(BrJzTkiaw%Xa zZ4%mM%{U8o7+}1sk&`=he!aUlKK%9GMcH_ZPMM34Up9IBXip7*^PO72ZB7bi?ZW-q z9&P;WSe9TIb?cI_?|MSXSg!QbHl1G+xpBWLz4#W4E{+LmjLwYA@I{0a^*(jT^OVL2`+F;!^iQEU^_qvOH*7j67|t1N*y048Q7ppl8dxQ23IZz z7*fv`b)J#f<1{>YF_v+aQ)cDf$F0DXo|gBt+wE)qKla``tjVlj7iO$uWkxK6QY;ju zDhNo84V9LFlt@=;(m{H+jSLDRgd!!NR3Sj5_e4bvouP!#LR3mj0t5&FlMwh;g7eP1 z_j&g@`<%1Sb)E0}KK@ZLJUnf!^;`GvF1EPkr>~X<&iMLQyFQ~-&CTImieCeLOk6B8 zK5axlCbDC#km9mDW>&a1xY)A$E^1uIr+c%&P2B%LR`u#yi2~!R4@Q67p!BQBO^DDA ze7fam&jXX;zzZIbk@bikxBc5S;%?>*8s@V!o_n3^De*3y&K)|~A{iC!L32@y(od&5 z4#QkjcFwrSWLwM38YiDh^$N-A<4$(G!k5Mys_)H9K+}~}`iWJZz#O02Sc3f5%B3>1 z^nk#b6zoL5>CSkzUrcuwuHt`f{pR~7!_NJvvzpcEL|n6f zpET8xZCg|Hx=LCo11CDFArmYB_TTK*pUJGWMeB!Gh0{9M60HO+8VZi+-nD-23pDm-ePMTHADlxn2;caRn+qJiJTbFNdMj!qgQW?~}Qr+eH|pz!hZi2!sw zI_i(eqbef9end1<@X&2BjG&!?b@MGK>1IP0B2es(@ts- z5~>|`h!!~a#&)H2Xy}tTBY9--b0s%I`uppAd+eSmzqrqriLbWXFyOPGk8%+7Q7oXh z-qbPmJ0+()*?j5MAd#4@|Cu1)K5wO!(F1XGx*RlRYWImt-*p1G zKMAaU2a4q^f7b{6^T*%l$hK!!pL=mbfvAvpOH3&6MywnlD_l%DL>8J_v2_xPb|&i6XzUHEx2LQ!u4R^1Nw_rw&aJcJu{%Q z4AxGxI^Qh;>@KH=gk?x!Rj0!^<@9d7)2el;663{9OW+hTck(qxD8D;n&?C=>k|ViV z{9TRVUb%;z-?J$5Tl%9Nr`P<$KX{zaeOByy<;XOBvZh74GnG|t-oJ2+h!+XMHx}xz z*vy6%FU$N%ZFelfacw-aUxuqev);@3U0yq!4~OewZ>*cRpS-&LOGX~znP-NUtM}vG zLptx$b$)VR&o$l`D=(rjnZ(>K5FE1sh{c`tsn#s`^2~8}OGKbt%jVGoBhbm*S_5g! z4j>)6V(!)$fp>&=Ee5&izN4A3Ra_4-X)S2bf1zp3(i)qof5MEVgkE@pGnhCLr9d$+ zA}FdNCM99X4Vnr_e-F5*nF?%(zPdfz@tctLviIG&4%qYLsY(zBtSHRCBeIE+U68{V zgDj1%8@!Fg&f0e8eI>k&NsDp3{BX~#UnP;R)amvU-tMo-vVdu9t;|F-KU|>B0*O?q zzagR7*Tcwee7M|$*OX~NTZ?0m%EU`kI-VRc(8wQ%Jh+QV$6UHUAV*jg&9JMcM)ty_ z7{zLOc4@hNdf8R$%%g%*;|-iGsI(ih>20ZWjoV0V2p-Mzm_UV@zEBeoc*5UT)JgH} z94cqFTn^p$n{t0WyPk-!&#jLLl`Z74qohz`E%SgK)r_}#%12=sP_yJuoe^|L$sLmEt2*BGUYyRx}opNwlIxI8d$K7zlJ zaUM!!&(AJV2IW^MBej-c^?V}L-cCu*pp&8W>Q2ysX}>ha2(k$cFk|jQUO$?PFLxD1 zK(Bk7V@;%{W3xxbe{YFj>p?8PfB3!it8fOz<2+9tqk5z{jc;`{{O@B z@7({yy$!bbyJ_@x!@|$U95AiE9eMLLzaJPUXr+AAu;k7R?8#}fzxoN5vVHdY;==W$ zt=kluv8o?^ZwPXaH~y(8@Hup2Hn6zxaxL3(z}jSgoBz2aJ8Rg#$~1{Uh^*54Lb?UZJRYs|e^8M(v>7`!ty zUQ%lvtv9?(eTfcCg0Wt#x{-^$#oO7mFQMp~6klv{7L+0>9%P*j;07!=e^rJCfgODh_|k;y<0>cMZ$W z>~cu547Z{T9Mn3rrKkZfD6tzDJ-FqAw$JkPbQQ-nPsiN5Co*a5ZIO0Fb~<6+lh7pQ z-0!(!)Wi5=-##XqmWGZXM=}MM!#a z(>4lQ6;=t+i?kzpujJ;_il)}g7qc+J@+ULO9#Y;&&-R_a=N?(zQB2oZ%%59&>P|bPFbh|1wjz@zN)s9L{(fSC@?phZ5r=%an%8+3H+4^1r|e#3 z+J8)0^#YXD;QiN1yn4R&%7oCK^GH($<&PLkagJdz56AW{uh=G7G|+k5fvyQ-ERV4& zizsV1P?%z!%%bO6N=HQ}O`V9am%k7RL76-cPm%9m=H_U1!5itxXjGBXBNEMqP& z!y1bhy#~iplCTqxvKh(&wcE01>z?$^30(pG3e)4Y=*19f%`!>za`G*uawlSWDGeD- zRI*tNi(wKUVM7T{S*=QTZQ*(CJnzPc6UfM6f;TL7V*cdPQ!-J}t(LTPxy8rMXU%KR zq_5fdLG=JyW0Fi`3n`(28BvWp;B$PV;=F~ueYo|TX&c9{y0z3c|h~jZ7s7c67HC%g@c3Lz54O6j_t- zRIVuagAi)-Qz74L^|Pckw+5!(?1hRVERs_rm3bxmu}|H7LSeEm^f!kB1x9l&N$VBE zqSQpvsCLyE@0N&V+ySiwuTOh2)1?ERrAg?*uHDVWweg8iPfjhCiplnre14}~Mn|qu zE5}!yHvOcr_a#odiIVA66U;xo#3>E7Zu4^E+sNOV4vuc#Rb|)axj1nvfX4Zy7JDKf zJ{6^2c2AiPe$79~hxN@w>7GWu%=K^UR7!+)D|L9k$GtdvQJ@V$qT1wOX9W zFN2Y(eS(U=bNJ6r6g)ds!*pQqM9NL6|?TfQOMhKp1e15+{*4vzs&-l5Qa+kJR=YrEt)kZiLzYFdJwtqo5?^Nx_!?3R2tc>M?Xu}jC`~9_~ zw!V(Ikc=DQ5UtDa)+QebKUKVxY>Llmdvj=tN(ee59(9!}rr0x6x2bz$uWL|IXxuCNnNVSFP9&$k5FWXPw^I7UQS!`>_Ziv`mW}UyoV`f=vz8Y9w zEu~#0YZ-f5)za~$^y72jF%7Ovf%WtETf2b{`d^-Li;sg=%>9H4 z(b|b;*Uw({rA$*^Jlu}Ul0C9nvAn|J{cPTm{jsz`i6~8(PhVv_vag@@`mCR!X35~n@9pd$}rgcH+>+)ap;MuUNY@@vlCgFD8}`I(zzw;(dwqoU1I z_75}AHN1vGM&$KRi)_7dwTTzS8i%KPz67)*O)W`Nvr~&fd0r9rbH2a3CpWLjH|Ssn zB;zW_zeNq)KMs`Oy^8AMkjS%W5+*_!4NAt>(}4&Cdpb(t*1I)ClU|dBSj~Yd|Q-|N37lhCii25U>WA5N-+AkIJae!npWPyx6b|;O zanUCnG!6sK{i_Wi0Cm)O9d?Kr28!7sL|}BG7`Wzpru^C1C;1}J+jLB>91uxk4L=9S zH0vCLXI_L$HK0H8J*>e+*!{LqMe3qtAL0_ey+9da8A*J@@J;-s&@Pdul>CGDoqMKy zbAkDslF6W?)f;!@pZeNsa1fsI%P!|fkj+uetzNm(($`~a3PlCv z^^12z9t48z5b~chhBEff;+mIE?k_ZPxmeD;-2_j`X(-C|(uNxcXwC)IaEuMECRc|7 zMw1$flxIJd6erYF6OsQiBFNOYNW8kN_#rpI+;0;w9pABW=51da4VmuWEgGid>J1~k`%raIHd66 zW2AOUw^3qbQh|7J=4Ceo0DV=5>s(h5qGHF=xkI}KJ>@YOeZ^l3@@+fnUdC$dQGPW9 zy&0G)Pd;s$LTxxTSd!)EA5qjG3O%8G!KxwqPOusb5psCN!!}F7@cnnYF&aG;Wb4FF+mh->24_YweUcxMLz@vHO#oSac3#7q49O zK0$Z5i0;Z|}C_id$SP{^Z`io}J6Jhqo?Qp3Z2QU3(v*;3q@7Re|-Wf3ldI zFzp~6<(6SQd!jaS7^5^b;7a$dJ>?D@vSvS9^*HUt6IA0S`p~VgTin5uwQegm?F^Ia zwF<0$%Qq24cZe*vb#1UUwgJ}2Ps`#J1O8!km0ZwA^Up&lu-ymQdi_U}dW&yvV|_d% zOntTOeZ8EYc#Y${x*0lQH+BZ{6DY2HUk4+_;u{8nVt^JMvmq z6S5;OBYPZ!N4C1<)uy+%Oz*&@jHUhL`gAdWndMNRV`2%suqI*2PD%;k`$i+UcEdr- zzcU`pnpuh)VV*Fa_t#|wiIyo=XZzo+ihxqoib(s0{iTUx?9#cngQX7KlEj5GUiMRj z*%}!?Ud^zN|E`yr?=M=He!8a3BU`p@w?4qZ&-3Bk!{ZUMQjgiRo^e8lx8xz(^%1mZ z9s2ZdgwXt&5vR>A+xy^s=RKEY=YRuO2HJ3b(5fRoEoQ8ZoU;klb7(`SobhrguF5D6 zZFtg&lup|6+%Et@XvzvQAB49}-YKJ~p-Hv@(PBPb_9Hz7g50s+zz$CU_B$V@HQ(tZ zhTE6nB)NR7^H$q$`G0X#T%^QC0A0OgE8kG61TC+ZDVI=SFVaK=iisycA{qBHKyiCj zVfu6N=I+ur8hR%pmme!-LO)8C;?~Z}?$4lyO?ywgl3pBO&LmRQwTKS9d)BE*q4mb-KwkH{)z(Z@ft8jMUQogE~KHSkxt9gkHgpVTpER z2+~+)wMi`ve(M*d(Z{1QNiEMdObVT(8 z?J8t}{bKj41?%c_V9nT|=>%VBK-44s?|9$2?|(Oshnj9SjgJ_CW%(?5YpR<9tTd+N z5ZCcK>Z@M5Dl0o8L9xxWgtc(7zuaNv(+L%)Fc+MJ`~f}{gQ{V#Ei_!B7LtSxg<_}0 z_mHLtwu*V)%E|p_xuHz!vW5s85Q452WgptWQv-Na0-xS0xjwd$C#r@#t`ALZZEjBJx2@g=YBMP`3zL^T~d~uKK&{^cLRKF zS1xpA2T)g@7cV1+@gj^B@+)c2>WC4k2<2nx$Q!bm1WzF_1hD*NuIVfhrgz#)MsT=r zkM(BDvT3EAn|DYg-qA=d`T=qlq+Fjk);(>=4&2?1TzYu^eXoth!k4ASK#d5==bXfM zy4DZ#0bsLdmGb%32zI1?WaaYQjEtmRM`3<@Mp>PsCifSo+|UKHo*KCmy_Ztb+j5p7 z2gF)f`Y8`Lw;VZZh=p>+{9i|q<3|^6x|7k8LD}ZkR4Kg?M~%1v`YS6JNuiulux`iv zr*lcbwFT>K@VJ3*Ajled_YmZNe8G$_?%*BwKNZF;sQY)|Cg+L}Hz9oshB2;2 zB7JW@aX9Mh{6K?}B{f{m=}-Of(0#DfcxL=|VQB88+Ktqazkgk@iB%sJ>R4~n)~a>! zT(VvEF9#J4aCwtCWTSY@OWB>`w}Tnqzx~shkH6<)HwoM$Z|L-&;*)Eo9vlEtpvWzN zC<-dcVZGR;EmzWppC05o-p;+$i`FH1HHOHPdo1P+SPi;mba!9YM?P54L@|PHSn33l z?16Req?PO82;tO%SBrT#XCs0NEogwk&JhV|*p2ZYwH zx}}_VWdEI4WR;5s9FA_t~7F0J&<*?F#E zk5gG+9DaG(Py4=^(qmT&fkIpi3t`&!+eMX{(!uZ|Z+Ku?KUKVqSrF@XO3T1tB_H;% zceL;Tz!M1h`pRDklPk773zV3>a^poRvX1>oe?J=SW`2yG#uWYB7jpiLbnoHtnu$N= zwx+?c0R@*q!NwTyoW%zHA=Bb`yQ9IunxH9o!liC_M76)z~3ITl!Py-oDfA1WV=|9>eteJ&6+jm_)M@Z5tKHni1t`sWb z@xUq2u=AR;rm~#*F!Wnqt%1ukL5TNC*wB}@+KTik`l)ZyisD^zYx}q52-% zEzgL9beu_RZORPY#*(%pZ(!7j5o8tm0Hyn`KPh_CYYnkF@x2~Tk(=GTwQP7`l%dT( zz$o6M9@yAq=U;nFUz%AS{b+c1z$@d-#aytvkx6M=TN%v%(LmnCxZ;U&X$OVVDU#vz zS^3Zbr8F(s^e3VZmQ3T?Dk^Fy)X(Gp7C!>zPI3B5RaRdjY&ly zrLBXiwpG}4IqffI>UwG-+s))n@@fePb@^Sjv*~}J4z@OrelAVXBRqRokMR2Ch4c}% zMvoWRe%Cf4*?17#An&Xo{8#(R-lLq)X8}ATB-DF z%-FE`YJC+ua1Q;9_fGjp{j*~{{XeuqbC8vlHG7W^kL3)`MNYgBfXC| zm$xb+q4uAiIxKVd6|v9$^z@ksUQTg5nJ|%~I6H2ZbMpDo-IBW#SF%OfoU&9a@ukfI zirY8%6+jt=-{WQd*ktjsAg^O7MB{B*Lf`gQ zvObA1;HPbG=Z3MLA&GzA;OrfiRNFB-Zd{=AuykL0czu#n16cb}^`Y>zWxGkEHlCyn zDO)d#$S-aTKK0OIaWL&{2fbfClT?VpA*=!UQ6UhxL-b%g;A7CZrU7={_+9(<5N17+ zWSW{zCtGFL?cUf*cjYLm&1N<0{d_Sk-tgR#zZF#~RHXve*d6(E&wcQSKTB>n+QdCD zzQRcUz?N-AC$2z?nEGB!cb@6e9^Pl1Hc&86K(4wY>fggccGWa>L%&su8C-=GJADeU z?Z_ehs@XQU=7FJB`jW~r6p+uBlo3Ai>}Br5mIL1kLz%$R)e*JgEg$H7q{e~dT-yfQ zT_ZNCRE_xQE>GJQ$^3I?BgM0x?9egDh_uA%ZDKMq1}s&HN6cN^uA1i;7mlydrfN&X zOh38?upLg7eR80#{}LUZhXd}N1(UtTBWD!(`V*~yWb3yoYL|&VG19f5 zm0UyfFSPAg4FAM%y6v>M0=g+i22Rj?e9b#I(HXOd+iLV;Sh3%b*B~sxdvqL6-qBH- zwJWpARwZ?f)(6QDJ#;RC$5NRBR*%1Ta8~GD0B#ge`_WgryTlyQip4wGi^N*A9Wm;3 z2%wiO3l(QCTIAkT<5^y$elKq@fuk>E!a@(kZ)yhSJ^9)BqqFN67sTMT(zLt7*pw6) zT{;_Tg(03Tu^Dzhh3au;o$P6m$wCK`G&AkZ)p${BxfQCfWpHbpG7h@kJ3#v}>%&*` zyN2J3fmn|5YX34#Cc4jnR(G;_)&-9<2(cFaou%MjXxQ*Ys}ch|_!BW-6Cudo*|o3K0fI%g%B&)Lp9mf>+U0SPKW2vi%s@sbK#uXdEZEME1{RGdx{jD;!4;|A&*{7 z{zzk07}k(xnWa^8iB3`2j3&B>EQWyuHXV@QtUFdcQ+vs@KLP{3VW&cd=-FPJh`s;5 z|9jrgoui`0sctmZp~JLALHd~Di-gbx-5Dv+5!UhGHH705c=aISG`}Gn{*Q*R>Q~SZ zPV*UAFPrz%!2(dtTtl)QqUR^0z`Bu!d#Vd6!HyArC0GnpcAkjUhH}q`q^o=S!l+zp zex}-2GY)L$ti(RrN~zrze;c}a(I8O#hMALk3+t}z^WKS@ z);(74M+-EnZ%V|6rFj#HqnOjc=VN3!liom%*B}?pBq2llxd!+ zyXgsT4mY5&SD$!O(%tj*kt*0$l1z>LujXn&y5ercTGco6w0KrJMe5Htex`+`Q@GBt zTQgh2Y*(;=8e03ZadFVYN5PAAM|$%&s5o2F0nuR9ar+FQVkq*u&S|O7oX9xW6>o22 z!76Oxww+I~?K6eqBH4m!$rO;C_Ca$wlN~H)8uaZa!YT_QMqNlP+jujcjoY_{U^|Dq z>5?oB`>0dy1OUWULQ~Y4taAaf^)Ip#2Vq~LF6&8m%1ug>0(yk3jcE0!YL}n^I_}{% zpB?!n(_5ooUaw0V{MLR4lbD>9htj|#^0}repk*!8Lqg7#O%!R@Y3IzEq9y;dBe3VUvTtB|Cq6Rykfqs_r;-%07up;p@45c<^Se*)&fga# zcVF#Vx(kiaO3~|=-(`_E#vs#!eHdpcs-7!Km=!p#KZ}%Ij5X85v6OOe?p}5a6LLPR z!?0b^TCmBahEK28{VN~D@H-!=AiczQ}X3_Gh9+4yA*y1=iUI}oG==g+0&Me zrTrRmY&mijz?^eAN9NWKS2Y0l`WoM+5uINdUUJOa+eXp!?o`&9g&9I@yf2kYNBvgl z4UF-r?b_!ir^i_5lE(EH@!?=j)yD@vxhm3gRaEe5aH7BMX!8>~*Szi#gJa4}y-3!v zXWuOjha;u4o|+(tjD^Z|C^6%YiX36K1 zw!mIZF*2TgtW|rKQ-lf%l>3+~QX7@ZCPLr$%g&6_bRlU?`QwvNBc!G{g;0?TygW#D ze5D)$$r~@W5C=qo^;){9pr$I~qS4eXh$9Bh>biNgus2~XjedvkLcf_T6_F9`{~*>! zXSgVLakT)pkHX(IH1OKanbW^@ErTXh?JS7e3mUP z>B7o#`uig=8`!Lj40!r&ik z^CLPJzkHS)1k8um>2KA0Qgx8Wd9%VAvOotGpu-5WdHe7`yO>&|OpMvXWg#VV5AhAJ z*hP=QYI=xU-f-mF_{s8gT<+;NG_QlqFyKJ%WU1etOF(r7&T`?Y-eO|cOs7s|T)C0X zGP4ZrS}gCQY#&`>?%U!fj!Fy{X+;mir&+4ckHHf(j1R0Y^h5smp{X;Vi1627S0`s6k2mtQQWa0odpeY8*@#BXBPkKc7Y-O z1|9SQWUJTC2q{~w%*v`0_xlRm+lUtf7@qYm;T7EVvu9YLy{R>6hjpI!N^cVqxaapn z=k`{4IZPwTj&lXrx_22)2W|_}P7OH<^k|#Kytm$~{OePd_+%I(;n9Vo7eI?z!`wh3 z;WeoRm>?OX&HKm-Wd4Y~7RV~M2s(-YQ?Rexg0l%0wykff%|hUuCci1fJN^G7S~K2( zqxdt*=iLBay+8gBYrci+ui2PWJLe1Uum1(YZuJBJc-BUi_gnQ6zJJK2ydXGO>0Ayn zE%xgw0YxYQlK_I22f!9L82aPDV0eG}5gMKKp?}KZuiR*hqq(?zxzset!P&}0yw*VZ zjhKQeTT`^-Fs9O;;zew0-a&PG=qF4o*ZLOhemW7Byf6qVavKX@IRnJp2g9tYbkfr} zJ&j5FNmJqO%U5KRw(Y}{+(;3d{Iw&EttCQ6O1v3MtnRXY>fTOHwqbrz z039M3lHK|;BdwmMnpCf^HtO7w=P|{*03I@FG)uT`;D|2@0^|7ySMW*R{gXS$N^RR1 zu_?R7X8ViO`Cx2WjrDW^9X=W{2>b1d(rS))ng`FHSqe+HT7Qvt&)X-eaIoaLQBYr3 zDf(e@!EaEOCiHvADUMzhU}B!j3A-?j_eP#d09JEa0oEM4Xiod-w4sW*p+V;Kmu_tZ zR`Un8*L!WPC~itZ=UUl7Pri+5Z$MTa&CF@$G+z%DxrnziDs> z9vDloZqxoAWZYmY(GuvqDF>PFlATGs#wSR|)p=#bhNA{wCl**AJZq@ZMhf8>U#m@| zL-Pw6gTWV1Y5p`2Cze{Jmh{D6rsfpljAe81CuTFd^zMm$O7E5PoPYC zY1ZK35;9_#rP6iTMm9TEE74%BJ6FTlL7s{VT*TpWXF4b6XWT=Hq0Sl zf+B3MBFbT&veAzygiU)z|1!_V%?meB8tQ7|V$29Uad%W&FYp;>tAK*AZOdh+j-$$R zE*e_zoG%vsJ`_xA9#hx86?PJ9)v}5-MKz{XxiTiF8o4`A?HS(pF?RWrhsZyxc06Kku*Hm%c z7(B-*gjG;IO&0aXg7{de;N(>31AZLPE$W#oocai_nhbthJN*FT%pgGWFWS~NNw z5YGLp$ds(lZYJ|*r(OvZKifVRy?OLD`QFG8K|&G*DJn!jxR{dMo7bQDgP?|Hx3!a_ z>O<+gr}DOb<5zF!eO6~4T@6(_raaO7m)>XR>A&o6fT#tT^nBL)sKX(CtSX8GS^%V(d>KBhCk7a@s|jjG@vX*v0A&m z(9%NbP$!xDk9c~Xz?7AXrT69Fe!@k2HpfWxjTT8h0lns|PS>=Mb{~}c@iMEUD_#$4 zt)y%Q%fpa=l?e(mayol@-tiM_V0AqF1bqFMk>_{^``>B@OIJN# z>xvs2TjGZnO`N?GZOY5JqI_#uGRbxq&WPw$IJb@4x`*7tI2WYdU-rW~xa?1_`KyYe zl%+$|<&mui#d=ljo*a zs^3qjeiz!d@0tWqO?!I7g5@STXIZ{%V!uu~AKN{FB=1`Y_F^%enRKRAR0JaMq3b;SB4XGgUKMzL)t-O3Vy_Qw%t+K zKtz$(-qk?-=-Z9Xyt=i#SJig78Rn%Iq;%+rpZ0RhK=tbBUki+NAmdMW)a%4H?*+tEPz%8Mb7q-7 zyn$G8HF0Ed1UHmO5sLU?O{tliw4*Dhw+S9E<9%|YH{~FS)efKV;yOsFju&4o;xAL} zo$en3K)1N}gS~_0jAW%)P$&6!huTtHU+-w(&aAga5Y2NR-scR?tkFK6OLLU6)QAwK zyZB#n*tSeLZn03>5L^v!5K zWx9h{0?Bt+9v~#%_HpzDU zG6zcl@DdNV3_@aTtJApzA4;|Y=i`QP#OM4Q>k0O3b4Z%o_?_FDnfGF9WdMq%Yw{}yb7^+;5G25S*1=;J|;@M1>Y^V6|wYqoSTo$peu?jX($`))TE ze=}M}eUFkqByOOPI=dM+bv%t#Hh$)2KN0y{u{3)| zXpXt)fF$%^M8#D7p~<Fj zAE=9pd&zCqMxB=`1&2r5wB$xtwDvOD`--zGipL2YD@nR%Y2Q*%jqE6)rc*bhGGv_O zY#*Q_`SaIaI}3R3QI<#E-ST9N_>A| z8K!qHb0J>=M7T)vBV4l9o>*Hism%?1Y&Lur{IYT;rf$wUKr`16dq}&_oD{lxRO)x1 zvc)v00*+h`|QEU?w(1c z4zm$bGbTMr zmH3*TX*tY`i5uRvokrs58cvCUXxsc#oxQc5PEn*}oiCzeBtBQcT>809JMsRkER+R8 zQ0f-a$_&=s$L1sfcnVThwX)Z5?_nbxqJ~bk5!5*bH=aj=#{cx$H|w=mQm1y4J4(-A ziGS#+?OuBS1$E#-g4Udq4p*vmE-x*MhfOAYvFO41>C?@~l?Ax1SsTPiLTBtm0rqPF z{hh_uLn{i2NAo?Rg@(Ris(*Tn%uo+neymG0jFgGr>HYYZ*6?clw(wk}ucN2H`Kf@L z(#s<(nVGMRJIn@ls*0K!AG&gQ%QznDET5sXWbjEUp!!D!YPH|rxG|}!xps_-?Ob5_ zn5Nlj2ouFP;#zw>QpKXNYcI6CHbvD>+|@kWNL?2*$+&IS$r9I!yrlC|k(2M_LYvNUEE&-@ghkwLCF^kIdK3SN z7h^9y9^TRucpD4P&?-fQjCk<<1m;>beDkvN(lUHU%tUMA(~e$(RF_Eaay3A2RQc4z zGn8k6RIdBgs#^F4rrbAsT$qYMXo3(dvFM_+^R+=XURiI7m9zZPy)54xpUQ$n;T~ob z>eae7rY0BsbJ?U+kW_ zsm=w9d`V*4^{;^Nk@h(2=%t>cv-{L;0GqcRPKF!+GyIi~(>C>M{l3C+$TI}=vMIo@ zpXy0#wu_}E!)}Nc{f$TaarE(zGNia|`PjqxtcK3OurjhiH-pK;#sQW;yrCm-GJF&8 zThUWieMt)IO#fla_^Eeertt$h_&t_ia=et58v3J~)1KR!$Bx#3w42`%&8J|vOoOZ@ zCD?>>)=i_Vd({^nNcv*)q8T^;&-$KJOr{LUoE$^`3PzET*rB>}8`Vc!s2qJMNYg;7^iJ{k z7EKDlC zuQ%Vj)uazCD>gB}fr%2v*TDHw_N?5Wa8wS*DQI4KNn5Cv&jtYbol^iHr$CEBnYk(* z_7(u=K6OO1Ay15PxPX=y(s+o`jBTK<6i#q1CHqxbC;K54BN#|J`^PEwiyx}nzj4af z4(~74bp1W@utmJ^p!)Y~ZfprdWA$mkp6xFX+T|(jL^&|67jJ;d9>>F`CZ#xf*-dQb z&8$yE!MzzV)j4V5tTMVp_U%k{?K5pTFYWe1em^)>5Cg@19TiuE$KzJIpXCQ9O)O{k zc-QBSjOO~09sDwPlcut_5rl{o%ekF-ERfBRSS}lIgz3i_^HAd)w@)k_v0+CAaAS?q zy;$ynS~Ek2J5`dSx#7u!xzYYd+(3hohvGMIi(I4Rr)!Be-KNnci~i;!>ic!$d;Y);v8nnK{CU5?HRlI1YQP?@ z@90HqFE4*PP9NNWJpC!w0JRyLiAYudL$VLU~-Ig!BUK^AH!{sevLGCKmP|_{w)SpPzzwTev#bawGKvD>zUcv{xn7} zFDGZF4VszrOs`*DgGvsBMaE4p7roB()ae?!Hylp&G&*uXJ3U3~i>T4Zy~E$z%0>4BF`s(4s)Ar?_zkV2Yvo2cQswdVb`SXB|S;#I5Q$n;A{ZjEmDAvinmD~%3PE@&BloL}W{wjxM z=7jf5q8x8D8_lC76ZBdFugA>IR5-6?#z*g)V&1UHVpCG^IA1Q>w=vac+l+Vxr>VwZK z{wJH4&%J3n335?+5vht#CjnwAAh5>2-nYVXdET3v zMTOCb+N=-xlN0&I%m~x{pJAKVKN=JQ=d)nBT_Zn(z2GJO3E%Vk5qWxzUIuh*J#y62 zlTREqMEKI}wHvR`fV-Oc!L-{_V z=)SqrTeblRUT5Rk)SZ@h4Un#|DRXob3qk6mVXZul@~Wk z+o1;KUrnM+9OOEyBV=Y|Fr?d)rgK<(#$-6*28;nw6rD9BP`%g zxMq7{xM5_qAHG)5HUwZhK!GxYC*0>TfP-Z=7J{x&Ib>kZvqOis?0fvmYEw*swrdck zmF`&G^!t+LUxsVo6qzF#pKq@8w?aL@cJG&;s}7P1r&Yp7RnXDH{-fH-W!)8eYG$sN zWqOo{KMhf*=r^K1flQoNtNStpk&o8&ImY=3>lTfB!;7_w8lFAykH{z-&X$0n=W02< zeawNo>oOrQ{AArrkA}Skm+)TOL8@Ge{cHub@mU!N`dbQfvUBI7aY7r_1MqzJ7Sx3p z2zSHxDW)o=84gsO75X*KQRX8PL}{9TOMS`L8!1x6m^3X{73`rS2>(`+Nr6&kOss{BxIu=XcH3b4Zi!+n z9>dx4Ep+u|&9%iUOVTujfwV2ei@sQar0JW|#-sEXbrLS9DfW$)pVuk4Yy;# z1&}&W^z;$*$CTD$J`(#wdUZf=v&p`0r^G$e!t%meBZa1ZeAj1NPq05A@%9JVr(=0` zW=g|}nn!$%B1xc`ru-A>^WTOB_S(F*qr=msfYWO2+WXW{n&pVg0!TUIhFs`QAbLREOhvE!w45CKh3{(=T#mf{@w;} zzwDFM+G-!VHZg3T{?fnk+T+>IEtfTc9kP03!nUP?MeQTLL@i;~hRuN7ofm)G45%RW zVdT<_0ytn1Fy_Cai=e&tzHlvdo2H4UR_*TRl zQF9&zx9|d=;_Q}pzk)|=mUNQC9EvdT zrW67vBKR@0S zs$Wx6s!Y1407D2}7o}81-wwsEn$-BcQQxYj{WelH*0^Phm{IMrrI7 zKhFM}eA&FAh4#T|qpKRBnt-mb*yRWXbOm`tTP2UKa1DZgAt&peQMPw(HZRQY#NVR% z|1RknJ@Vny3zXM{RcSQL4PCUiJ{`ZEPVxh4zxcgChx4-$ol1d$R>{anX3M<^ze@Y5s11Z z_f%wQ{__t7WF7yffBtBg*d%Xw?V2|EYlu?faTPbDQQ1V$p^Fj~hFFT7O%^njj$oP& z<`aMqfq(+POugrRU<-9UO}F`gZh~R-B}%n7ko52JZQ1-9^8XZf?a^$eX*_2-Gq&4y zRgD^2biz`!H7>284c*eD7nccjE21idgi@6vO=zc8jY`tAB~2AY-6c`#e(R`9;ubU* zS`155*C2wp?w2rojx)P^&YrV#_WS3{_vZcbz306=&oAHe{+=ID$7nNXsq>Wq&aEk! z?lSB=9419#L@5%RG#?5_1EgE5S-eDU(EZg#hU6|cQ)y3Z=D|8b(^aCwPGojY$Q$HQ zfV_*Kx1LhWgZL+dELuy|R%DV2WFY)4`=*pac2%M#6;T(oMIlR@zXzxHrUDc)aJEH9 zgOoz{=QsWZIa?I6ItPG4W(QEnaNeTKxo)TMf#wg-WIO?JCh&_qK=I=wl{eXl_&x+POF$#u0a9nUXTU~f`!Oi^juct#vqlw= z{JNV5O-3ecWu7_=Wax13v_|@VjR%yU`FJr94tx8)Op+67eF(@~{fR{Q&$%u@Gml?M z#Wn#YPeXHa8L8CIsUcu1i1bL}MM%=Gf?Ahw(sS7PFzH$HC8D%R`nFYCF?#l%Bx)x) z!ZsONl8^s)66egu&1peq(+YXVl74@Nd$eiAdVYF(y{3PL-x=?=dyI^eJN+tys`P`R zLfz)o4rTWk&8p4RRs?@F&s4Ows8z0@mhFbpJP)L$r&`%_ethZb8NhE7hPMq_K1yv2 z?73Ts;3RN`FNCMKCd0-E{M_s=jnvJ~d-UMGv_npVm8Fp<5YcxtR{2L(@IRoeTpp(q z5)x9k3+R4cCY4H^ljAX+kHk~ZUMi1k*O>2!M53gqsHh14v|(l@=#ue^GwX z(0LLS5D)+#Ld23tXRVJ9p;hc2UYf`^80u?p->WcPKRkT(w_C6_?u1dP!x0oOd6Yd_&tcd1j-Fd{e&9y0+{fXTI&B-4 zA89&I7*hfjVyulVEW^n=zg?-UXJ=O-VT!s)j)i8}9*oH^V^~?1L@I};y@3|wA&l!U z?x5n^l-6zI6~V#}YNW~a)r3>Fkb~K3AJlDCeaVyBiQYrg+XnqKL0eEI_6fX*%&*by zbjIm6qoZwNp*Bh83N95+6H_|!kHl`1S5j(n^=o}-g3HS{{aTSqFU;gPKJfyh5`0#! zZoxqLPlDRHT0C;aO9rfGWOMcyp~(2^dQP-km>ky z7S%e47E-bZWkk5yuC`z^H@zO-l)vI8%g@pxgx#XZZN)JKln`y$p z7rB*cqW&manrc82$@I8lI`X>+1pNi2e4_VoR5MK|R2T(Tmk)}!QWL0+Zk|<4L#VA1 zcn2tazAlY+l#7VPd5+Cyb@970>+9>Y7z_s7UP)DzjNUX>hvcMlJfY5!9@M(v)LQ8h zrVDfet9+sQFh*0cC-D^iE#$L2vxu1>a?tc>mhTJ{!N$;eR*!E&Ayv39iVgg3p+y?l z(Q146BFQmH(VNkPoM>ufJ!c~fI}X&}!&F@^-RB*={yIyAHAN{8nNG`!Ojr%%(I_Wi ziSA0*8CEY4WYaesH1hmbmoh&=IVKOsR zOiNV_$gvuB)C?7x56a4}9z)M|VBn3pY311ZO-uV$Get7ur``SV%)bVIdQWFpp~IQ_ zcGw?+gJ+NhMg{RXTySORRa@f$Xfe~`y5sR(tr6vE76fITas&E3P z-kP3J$cq@%IjKgRd|tiRIwVxdY*6>)@G~DAU(X2jw@Gy*X|yr4lGo&8@MR@Qa;w+k?s#E(laoHsL+q0@-z3A zc^J~#VAC$eFn{ehL80cFJJp{v=+`SGG%s9nKitAqoWrkP8<`3c<9ZMkne(Plp_fm!AtYm?EAO=#Il+k7!~m{qr~i0<{CAvkpd&L zIJwkMbPCwe{1IWLm3eb%#Fw{z+>0Up;n&lP3GiLO zQprX*hSxyQfkQ}M$2v1>@PtN%5()4gNB2L3V~Sk5hn6Qk1+AVkx$GhDbD0}>2y3Hi z+#(12gTB68QHtl^vs(o3YvVXsLR&S`^71a@H1c3E1>MyoS|MAmbyu zWldO7!1e3;Xbc9!yL3M~I_>$EN2`;pzPFmM9kkred*xb}+9enF-NV!;ecAyJ9Xv=W zZ@WDa(OM+y2lNilW zy$_#IIn7b*LKzQo<&ULuocpeON*(>SLlvwaYJ{#BsTy7o67TI*G*HsF!1mHxHR$XR z<3_spyQthYcM|d)<7>Cv?EnDq+lqAMu3?1McV2<99UZNcj augbE$8qmAtF1(bKoIh)0$vkuAr+)yG=fb4` literal 0 HcmV?d00001 diff --git a/windows/client-management/images/DeviceInstallation_ApplyLayered_policy1.png b/windows/client-management/images/DeviceInstallation_ApplyLayered_policy1.png new file mode 100644 index 0000000000000000000000000000000000000000..0d2fc8db83b78153ac6c1e1c881045577ac9f198 GIT binary patch literal 245699 zcmd43cT`j9_b<#i#Q_xsM5M_e0@9^70Trb;fzXR|X@NjO4>*HV>AgofgeD*)bd}zv z1_%KO(g`t?1PJAg-{1Y+!I}4uyY5=|eeYR|l|ypQd7izWT|aw2CrVF8^%@Ne4HXsD zHFdS8`czcZT~t)R9RB_r<(r3W1_G3ipS<-|pHNkgux(KO`Niq6_G2ol+W0FcHosE- zr}k7c^`@d?kNE!gQ~V0Sfr{$9SpDf^LqDtS(<`sc9dZxPL&Vy=UFjZIGX9cuw-0bd zj`^|SqvTsv$jR>1X-26r2Z-3a(;DlJZ;T=Df)Cy}h}CWC+%mdf{SpE)ntS>aV^_b4 zu$REItoM3mG%2oloJG>Pf1bAvFq!PYlkDH&qol~o%e%Il!`r#PKQX#I)8gwf{zv1G z1NYv+=g$eW4Z?|P>wTE^%-EGCouc56Gq!Fo#BAqv6`gWPpr*ruXXB6+WBb(@<~on_ z;4OBlN8(>PhN(V3EYZp=fYrLsy;rvi*x)`o>{SA`{Y>=;L>tj*c8ThR?NWzLM$B!} z%ikEB+2Br&n?dNgIj}tR7@R2wfgkLwyY>fFrLhMRx7AOz)po3-%TWBZY%+g@hK8Er z(fC=h^s#2-=*!QQ40lZT`*jD5s}GZg9t6wIdYlOVMB(rYi33j$d;6zS zZZm(FBY>&hZRSM zS219{l9vp((FhSqh0Pddar==R*#M`%Z~J~0!=O6BUMX2*$(_xQ>-}3$Z_;UYbxxs-ew*coz-Yv*z zo`M{+j>A|v+!Ov?&i+1Lw3e3}0vcqd;6=#L>xw3Gb94Hs*tu;!eMU)bc*wx zS1T|zc-A_9)JuEK@IW+y4YnrAEn19DWmXkq`{DN&1-0Ib-+vm2F;I*Akt{6+d7uK84_cKMk5Z%V|LOx_`oxrk0qgHr8OQ*o#NEUMh!gHX;sd_DMdMP%JaiylkFFN(-7 z%yE)QI8+V5D_bM3UOBa*9(A2JT$Q_vJIPU2-eDkx&x^wR{xMY!p@=(PWmZ2fZAR<% zYoyeH(h+~%RH%lnLBA(Iov`RbH@5pW;To?7uLia;_J56};}-??`N`go%0CrDdLXug zwyya*qu{)6hm$*V>1CpiJ2?b_Z=#shofaLNFehqE{* zN-_;{;L8r-!+FAzeALTRk!qhJ6X}>Gi1pqm9siXn>90pZB7>j5+>t$wl=4Tl`u2;C z{3^EQju-R&fg4mAUe*?b4@*xm4#(Ib%}^u;JQ4V!(V?r zmwTc_yLMq%6%fTLYCA*I;8y8W&&I6MhE=``uY;s2Gct;TUWg9g;eRp)_MlzkV{p_PkG$P_Q>Pid55W@Af2Eza)t#w7v$vfD;EFH?oOOaJ=?Tqy8f6rWBS$K<% zkeyn?#{Pt}bhDdF0ZZ~#ivTbRu)E}1pD55pO?0HbA*rbvg{(e}80$E@6BT2=rcxww zb4qhe4@Pjgqy}BnRJGfk;&}nPAYczvj*pMQZGYq% zxXTtD<4(E_)0@JE-%Dgm`{V|xpCw_p^UcT%i!PZ%cp&3Usq9!pweLR}9$oND%2 zp{(!gu}`ev-vG9TFvs4*$iXbuOY|(3K)MUFd}}j6nPFMKr-mIpHs)OO9=%G8iKt+I zOjl#lq?8;pP%lC`++pBm1RMCX&2C&_e0pJ=qK@Ox! zu3pZ<>vJ?G*Q6^zNZ7{B;XUnvoOC4)5{9J96e}K%Gc(5Vh~g%x)vm~n|;JZ3Gpc5!Mg7lM!3+asxQE5A+Ll+y7o+OhsK zFjc?jPzNVaXnjQ>IG#ml(O1_}Q`R!GW^~++Ux6JY@kIk?{w#m6a%Cay`0Rq#zv}0; zrm$Ey+@PmqK8wq_D{}0yK^NrHlGo}6{ymmmg^eP9KCdZqSGz!i0$m==zbs$bB_j!e zy9{QyG;m_&sJmBoHU7BCC=kKT&2mls!xp`2|GiA))0k74?bEN@YWPwS$F{mIF03!I zYvr2S%l*suZhnidF#Jou80%`E3b{{83Ukm(HVcbfM3#ImYuBnUhM|%(Gm1y$w_eBW zUHP?ZOFv4>&PVKS>CkAC^fJb2CEjDyD{vE)kdkvGDR~D&Z=smxO<-A6fOe>ckR}^4 zNNBS$Pe?n0yCdZ91$`i!>$~9p-I+AMo@07I_m!txd*5EB_#-ulKT4>OCMRybODZsX zUXSss;oTfM7gG=EX+!!HP2T+bKx-3QQNY1Sw29WI$FR)#!eslCUj?k5od^?3hzu#7 zBf+*dc1pZk2ywRr2pmMdcU!8l7NN`1d$4gWX8AXJ(=q;+jL}sHdWZQsdmFCtrQpwPcSx-aNSV+SFNp|-S;#5qj_6~esw<~ zR~8U*MGsup!?D!4iL5`b`hi6f!>{(X8ioXPx3VqgImH3ECKX7`YaF{J6|Jd*v$GyJ zUY^Gl*C*e1mA8u(NDJU=7D!U(r0ajPh3YLJ=JAsp4MziY_s%-kQN<|tAj>;}*y3%! zT}J=ya$^HJ^nS_qT*K($;b$aIS9f4qF}+pLQqevsper*o#jf=mn5YpVXh|3_f3c}u zBYCAbD=N_Fl3u_0 zu#-=$gN|A)KcR9j?4V&44Q)GaZGY0^+`@f(D}AAo{30i=)ZjSTMs$y%klw^-EgH%P z+AwwGj$l@8;j!aK6L#tcdJzV4HML@Lg%$SNA8FsH!4v{Lrlx3O1F>}_zYR0_chvZV zn2{bjRl)-o(6F;JNqr37Jqpk9Hz%|lNsA#JZkXl<;e6t+TE9?2jDaj3N$+FBgN3J) z8LyE=g!ATOy-y}X9*)T`3d)F8U1v4N-08FT6?q*gqA25>$; zT4f@oPYeQ-uvfNT!|P-fm$(q|t$z)+p8} z`F`{1?|VGBl(@37-F27RYARB5etnA;z&*sGvh&4jIkJ&LEq^bZnDW!9sb0?+EGfQ zC-|>>1-CJJ_M3wN2mY8;ojwhirs1@4Zf-_RR;H%KLc&u@d@8yz`Y@d`XLv6{^;T(g z*Gh%wZHnC+Qh4J5Qn~b^IA%|OVjk{nzV{56X3BlKkt0%S^5)uDWT1SB!RQ5p{K_#^ zgn5VJ#ivBalCdnwH%coyxw$E+jwx6_2TtW=3>~aION%%2aIaAkZ{*LDd;iEw3tI9A z0PyK9{l*4e$D+tt9PP%sXXIe@(A14Bd*xaUr@V#d{m*O!K9-jmtTN@mYptM)!eS#1 zmSb@hacHI#Pr=OGt4_D^iWLq)fobN9(*-{@iAw(|(5_;%v1A$XR6pGy$7OCh$j05a zVmrXXt1k1;=^NLY5YO5#7#^w@UiVY3I%Th`gJLtq8eUljhTkL3(|*^jDnCr5^hE85 zAAZAdcvQ49Nv6Qpu)e&!$RIH$1 zXY1i>)D|_1Xc`nvs!lPo-PAJ=3au^1rX`CH$O2k9G+Wnxqu$_#$pRcbO2GjSv13vC z$FaW=`mly7ImRb;84SiXilaA$0IStjccIg#{6WI8pCc73o;EDYbEm#yPBJ`mfQvxu zkUg{d0)W|rE_-Mwza;-M)Z@auU#2jNJFffS<{Fys8%pl9k*qLt!EJX&aCj<)Zkcz8Yb?S`_L z>+##69G?%7ZR2V4LM^@>+#a|Y?iLdF*AJg>GONe9Ke3Q|&dXmhoid`Lu1&aKs%8Y@ zLG{~Cg9JR38Z&a8m(49a;X{*BkX6$=??+5mx{kQ@wF?X+H>cJzr`;3&3XHBv1UNu! zRO*a=N>mgNa~&!@bbAT|6buk@R})u^ij`aL=3~;o+aQdnQU5^^J&DD>6)$u_gs#>3 z5o|GMr;F!ptz-;7&3|tdz_wW*-6nF=ch(^tkaN{(P&=CZiK+cX+l0k78?xCbl6AgA zb;0jQ)_<$m$-#b9ig}hC-Fh_eW_LWTY8RX4Ugt14sM4B6SHnsuiCeSwv&=)EL_Z{* zys6u08m3>|&w1$Nc0RtPygR+XCnh1*Lk(h19WVIFn4sZIxMS+5O_1S_>Ye2yRwj&n z5Zfr1a4OS#k`5YTWl4>-%kd7Gk#nYwLQQch*d;L6}?>{qEKeH%6?h9Tq zp?+E%23+UMF<~OSkxspi@Qf)vtTcuJ%BKnLp28NkJo#b32Z|o?t_VTqiJ>QNyz`5~ zb!xYwRJ%MD_gNULZDmGCxBlkQtKXWI!dbt1!^jreQtET}c<4bk)74wgq+PuN^@eA=*(HbA7p8F{& zY{W33`pYZXOiLQ2t(jxIV={VgA{w;0`~tWg0XySsI7n1sq4G(Otjb;HQ$|s%3U9n; zQPL-u=QWDD+@_|`ywuO7NttpM^pVYj_$SMXNVyZ)s6RI?FMb>3S|rs%h84s zL(bMh?y*dn(r6D7=DkNZwCYK%YYG9+8fbsV)|d=YF9RZGh6A-fXpC3TA3?MzB} z-2jk^c;A0BlRs+dXRjCEv}e!ew&>COS=$)jN3<{n1KMn80-GE7>)A)CS>pH|*{=zR z!A!i8!GbI)clyr2O+smMnuh0PyKz{mUO`f6D?LAm1JnL)eqoExf?bQ-Mo6HR!;VAU zj-v#*zg{G?8vzVLx}$=<^VP!_qUq33;>dwS6nI#uTv4_f#$2?fIv)xQxb zUQMffufMtH$>ziwA&<5qWEZ6Qz^A28tRj9d$M|?p<-A8Hjdi=IFeqk=mgKY;TE`4^ zG+I*T%B+V}kNZGoI*c5yOdG3&F3oV4@f~ ztO-HQBShbJ>Fwb>uwpY~*bjF_L*`cU*`=uad^!y<6Bi}Z7*zWU6Wc*?20+fZvl|EP zab0|Qf>F2p}|(r>QQe}(l$r#RpX}P{igbQC6AD7Sj_{1mNu8` z!DAi>?(uSP+18y!i9)&92^YY_c5lC1=780!J8y5I!GbahZRO-#h$OLLayfWQwD@>1 zpz8MWhJAWNj@S=MPxazbxp^3}fwVvHF@jA{wSD=1reuY-3T-QQRN`ax0f}YI6MtXY z(~tsqf9!Umv6a#vx*jZvr=8;V3-a*^jeK{})=&e-A-ShH)uaLWwRX+)g=|G=Wis{w zvjZS3TO1|aiqLGQNGB1?&EHcd5itl8n1sfk*1wvZxF(})f#1rBM zn!MNDX~cCt&iK5P;R~ddxtE#4FYc(7%oQ)EAE)$@51%7%>^Pd|UYTvHf8~JAe*Ol9%QmNBs!)zhX(earp&XQ#aF9 z&B_jgoN1PeB)m1#%KTpJ`uoWEoFVoj6#rTOU)Z@{)YHFS|1cG*N3MTx{-Yc~|Ihp0 z|3Z)bd!+AYLVy1AF`EB(J?1ktsNY_{{JpA!8#WrNUE6l5^c&A^57@x5lXgIkHx>V z$6PyRzDUA-Yq88p_hkkwR$)A!pF5SI+(mh{EI8EYAy zT9ZU%n}MNR0(Jw3a@al&)sMkn$3z6 zzbAdOd?B2$vfbK)G}kb^B%PMtoRKFyg&e&Z`U8C~Po7v93}mQGAWR+tbbF&}R}#C8 zL_2ojN6)_YJnDf;rT;LNVYxE{mXa~au&IFe4Rfe&{TJaUt&HsK!5dLp35In;&JvK> z2c=*uI|nm>1iKR@6l3pcC?#_uM6e1zN=;oO!_mK4n4-zzVl4wrA|Nu7nXLDGL_sZA z*X10voFPjV+o|eM#~1VF((yuz#jtmwMvRZhilwPjql__o`%og2`Xt3qEa-mJc)j8_ zVYYd+cW)6Isd^&2_}s3Q99X0tanY0f9C)C@C{*g5Ko7PTkW&PHI0(0QXF6 zLtpHlV-qg}ZW%vdFU@?q>gmsYBbo&TtZH0uUw>m-v)R8MvWyfaBd5*GkMA4~Y7(O= zz6zxKd6OJ0^!jFW4S4K}car((jZYMx9an;7eD%_d4ewO%f_5yB_at$^j}rrGp9M^! z9<)E6-uM+EXu3YBSyeHnq`Q3@F_|#(B8H^*s8u*MX707!MPu+bszHx}W(n6;Q@9jYkKd7tHmv15OI2}2?{Z*n)rSz-_tCytd)?z@Q)xxbWwxvtU`6HLtt z1=R(c=j5K2E7F)v)HR3J?h{q^(^4xP4nj7OHc=~V($MQqun@)y!;;E$)^vaFuSDiG zm?F$X<|VgJxp|XTmI!b4JUImfOBYPpH5i1mtuasR+|roTdqJh96GllkK@OviV+w(VgFes8$xpDFj;dK`5?Vp)TMcolM)$@fdm7H0MY zb*=3-T-;ItW);CX@(%gAbO>N*%$+lzzw*rI1M15vM-84nXk2LRPvs`Wa@%PkcTa=* z8H8KtmtV%7``gCg6U_fAB)Z2E>}4$JyiE6u8!i@+U)~bZ=M<)30JA3T?=;?yzbW)j zGY5PwsN=Ujs^Ce;QxVtwwK{16R6_o^{(J6AajEfMz|=~#QHu9>e2uS}K6NJu1zy!{ z9w_rkQ)+U}aWJxL;j|Vrum}L&_kvx4yXTaaXb&5o4(HKK`Nqxzb5GVq)2dy32Tp2P z%$IH4g7c7}2u-Jt!2Lcia-jZOvkQ126_pAr#e^wHzRju=_qeG^%f|_DALM=W=9Z%O zz=^?7@yqsI<7J@*u8oJ~L5xVTB>P=J@j#i}Eeoqf8qa3{6P#dbhC>ki#jgzoB(cId zQ-cASj@EuB3h14SFuA`W0yFDv@@~(lQ04WUHON1XVK3d$1%9%f?d8zznGrem=HU`6 z;Taa=QPK_a(vITr+rX=zx%>dx+;)!<=#uR&FWDBnF%|9cxuNPRCt)?4MU-oM<7swc zZi=B`t)RHNqoKY5oI@wER`3ge05XU&eTLM%mEIsj$JnM@PPQ<$HN`E@a}g_BW~nVe zriJ4B^ImnE`;(`pysTn63Xq^hTRUCtq15xW!Ls`gK4h(~srQiVEmvbN8n{P~g~S|O z1l}blrIh_*am3)sR{bhf%fYR|Mf+^yNv}X=W%P2RTS0uiL3M5NXx)xM5A;q%msor* zUApP%aJ5N#R{NAr&Y;$+CJX_;`-3-^D4f=aq$E0NS{ijZ>+W?$dEb@y*0sLaqY}2* z>U2=1O>OjYo>*G(c8>}Fk)Ze7WM3@3+Da!t_BU7NH3}G&2MB03Yq7Olm1rY2l_nkO zFV|<5YF5?r9Q%(CEHYf6<5hr5)N7fwAXnRu1dU%RLi=KUR-|FC?L?y(W8bDu7STY9 z#j*OQ3F1=@g@B;>!{6*QyR!=F0mVt97&t0Fq z6df5axo%SlIRkZVQv>UgV@_}QplAXwq2hMS-ON6|@wu>?@qQ=A;)Z?bNM(;vqg?D> z<)%kriDpC7S9|D#`lOuPzO}ronWlETd-p8!YZAb__B(AC!;MFrRf#v&wo_cUy9z&u z@nv<=$47RQKIIuO(FFX(AHp&`3C_ukl1$xKrW-p*o$ek`JE1{#Syu)wE7T2TiBGay zEbLD8)Rk!C)QwLD;5|mw0kPilOPaY8EcLtS^f?gre#lQY#AeR&^t_4eP?oc>qOL+rOGd#< z#D!Btz)W8~_!gap*{ zL!_{)i^;N?2R`Q)XT`h~dWrf``ze0!0uzEI*OXO&WlxiLenu0pNAZ%&_KGgpn*#FO zamBzd0lu1{GEN>w{njLqO@7iCh#nrP4LH zawDRXCS9{Nzl;zkfqEZLxYLvm*U-CT3UoAMPH)i|7f%f+l6K@RWk#_MOkDpn;pyHz zf<5<7{+83kpZG);du4zja(vZaK(VCx_IF*!^1SL(72x8AmxiU6(ky>{P}5BD?Xu2c z^qB1~+2z*ZAf&osdF2wtYS0^zSgiM>X8P9^qOKk zOK)}OnU55+YClm@6~VNWGafkdrggmr@6>Hx69PD;oW`o>juA!pW26ne%(T9z-(K>c zb|Qj`*DLS+Az!ZTO)feK;(*NCZz5+^rL4$*(Z_Wcb)dw{lY+)c>I8M6BTqB-9{*KY zMjh~A8OuvI1-=r^;mLIv?=ksS+KXu>9o!u6M^CM!(>5Wc;)|)?qc+*Rz@4U|$8qvI zGOmnNZ|SfK?AUR}FG2J=N#8E?jZo={j4F_F^73mM`2X24B=o$xfDZ2Y@E`WA7z3+91OkQqYAvV5ur2}eLEG^tLgs_^N%>~Y$@(*yF=om zCKW%-jw(Y&NAbuWB*SL-j~1=>;f7&I-ywx*vmZO&K6KTd7BiLoGvQ*7i)EGOnfmm- zO~jbW&RK?Y{JcQzL@1F?fj%2`Ga}MEPOZ1)X-SgC4;imSEM;aJX|H8sDlRuhx-Ig0 z4doBR>`RhJRx{jQlY)uyt!T50mVxTU{46zSvdKkEz^L+F8qZ|_Gw|-cPQFdHsV2C0 zqjn?NA-fW#@Emk8Yy4pU_z7E2Y8DUVuC@|1!gw6RB!VN62*)Mv;RRzJ2(4S|5tU z05Lk0E;_`)co`^Q)hXCRNK(c2*rpkZUAqF7H$!F?oH8)7( z=45anK3QbbXQN36qa%^8r-tCo1t$SVW!Km+(`Y|quetaBg+S5{rUGrCBL_glJ_$p* z`Gg_8h=M%4Q5EDYLkGWT|Nb2aGCyD;C zi+uTUtT|V1s&%K_h##LKwReyr<=uVL6`I|k=zL%xmd|?BpXCH5&y1oW@}_z}pb+on z{;7s$8lC)I-3a^`uJnA-147>M9U8-Vq=jf97>1cT4xeG#PjMb7T&dEjGiJI)f8Gz^ zHP_~m4(uSeY(dCFbd>q+k*gbNgC#x(utC#mfA>^@NFKZuC4_)t%@|C4q9?d;q1rC$OoaYY^B93%*>+X5K6x$LRne4 znf*Qb@t)!=?$5`2XV+*QJCr2s5v#$$EUh|-i>fB|Z(dLUECuo|5My=H76>Lsjat1$ zcbqJZHn*L#u5Ly3RNwI3C{EubE(GGI+}i}YV=1jBmVv&T#1V3E0s68<$2blgVe0Jm z&42Gy*ImvGfma$4TwCqq(@N7?x4AcR{j?3p?m>PF)Z_zj?tBEC1BGJaz0-nb%`{x? z!;p*TXQXBY{Jc0=zWGuPw-Y2leot|pOjZSFtK9>;y1I&czYsybZN%G9c$NuceV0~u zI?QX)tZ-&I0SVmTrJcYj$9EK=+ghxraQ+-p9zzRI$FSO+REk(W03m_+_TCfO{d8;S z6GQ{e!o&7u@o!UO%i=HK;LZcX5zNEwNmZK&};W;8W8?GTggOoR@n5V&*4Y$VYUTk_tooZ ze_kGn4v*kCu)+i=IW{uo1pWm)$CHN1$31-!U^4mgG-YP(x*Lr~6s;$)z?Q8zcRGgl zGNh(jMaZP=R19%jG$eR?-XSdp-7r{r(ilj(gV|Af0W_{UKN~x5NV_PzTL0#6mOz(# z&{XB&UOE2E2*D(LmH|YyJET=-iD4>bq*fA@D3&C10&HIXh3VG%wErY$a}}jEB_nk! z_;>=g*=WXO<(CgE)yajU3*!~d5FKX+H4t;xVx$VdD_X%b7Pxq@qYP>BN0=VrI_^Lp zAp+wbzG&pl#L@MROylw(jt-^F9vP{J#}w|@ogDndOekajUv8HVU>r%_8f<}( zXYrY-DB+WRRS5Yrt$1&>d$TDuaMQ3JqE)M5X3ChC#O2rx|N3s0mi_i5?hNYqYn^4w zuunfh98BImMgl`X4iP|sgKm-F=LpzIkty?LH`B1j^NA`NA4+%enyhz;DZ#Dh>K@XE z8@aS(gQ2C(TFX?+Sc86fW%}HGXTGWVl+rp{hISG7j~-pQ4pl{XFW|;;mHABI7Ms0_ zW^EJcRi#zM3UsIL1A#sTl)Dl5cnItr#0KhO!_1Xv^^cV2i1$`LGN$k?FN|rU(Tr=_ zuO4sCN5a?{@w0BxfI3dAOq~gT#pf2AXRj3$H^|uld7Y zVfc2EGiJf3)Sn|B9IS!}IjTQ84O&Nq)S%5~DTN5vpg7+!8FYNGvys%p^S`cuTO7!= zm>u~SXKW!$+{>DFevp=;?fA9oN|6WB#<46HR zW*{!xaixS$e27NdpfodeYHn^QN50}+@;!P-?z%Seu*M^KigC#E*^v_X1-IZ}baT$G z?W}i#b_~}zYz{Ve4MWD!?(NmIyBP7;34El?`unC4^A>slrw?~&B3-@V)aL|$1w6(0 zK*--ZuWvPuYk*?mU-#!>=QY6iz{T?BR7=+3Y50uqx!fLPF=ALlryn&G?N{B=s*O0` z7p(zmHjz3)s?b;3_w6ug`oJ(`s1rv%y0*@#cdMD5vO-IqCJ30!ImIa|T&<$9Rj-E> zS!FLj;B(x1XQrM-sy)}P{|j{;CQ072W;%I_=w-LHR12eM8?aV3*vm2~@#vJfQP}mq zjgMBZ^C}6ooL7t{pSPMK7SBn5W`*@g(uU78dUO(J@Vp*71H+&3Vx|YGZ%A7$*PHTp z%>vJwOqV=sNes=}JK_S}3TH83l`{Z6Ut{BQ^rV<~2syhc&XkEJ6Nzvp3^x>S! zETRE?9;BbVm3|I6t^jUXa_$JUcc9#>g+#Jb>wr6_O~CU->GS7^hU4db56^3>Zy*8= zTrdH`Zm6o^#7)1gE2)$wt40s@nQF9l;4qCvXn$LCF5l`Q21#PZ5b;5V2#*~x0q`kI z95{xfj>xS>dr7+F>Q|-_G57{dsFt_VR9G zFKirFQIm;k39OOTQ3|L&@;+6@xh^8Gj53A_lrbzSbcIW2K3019ZX+K>rapq5*eM?)+~Gb?gZJ3;!r ze%>+LL#*Uj7&rfKv7(i>FFj3qAB(fgH3Iz~_r4E}9|L_GZdHs$noXK-g?S#sh?=U27E)xC0cJ{6;{Y5|@Ys z6W%miB0ckgPD2^_Xv#*l4WG@)^5$I1ZYQAkETCn($#Kzd`5Fce_Z(g+ z=@wp5Kr|W+F|TG6FzTB!wsvoW!%9QWg)r@VZTLx?_LB7`akg-A+#T(+cYL;#K-y|N zO(CuOOvh|AYa0uRR~Qt#7@A&DHkyK;ojE}QKc)v)qV=EXMhAUipMLZ3j>Q4K`M|Q> z5Yg1w=8|_l+@^%WowxPWn4?|EjT=N5hgE?&+I{V;-)ukxyrqH3tN%LKJiNay&~udY zpM(0Kb(xQckD$4AXPkK;;hQ#@zKJ)uO3^( zP>=HrpnGu-NH{R)w|2RJpw)>oGNAfP$TRR(WAL5olPLc)4xo}ILWx`~yF(7}n8baH z^zSISb?ATff{Y{#j%V_C|>xMavEJ8FfeIH3oBplRYb(~o_%v-XBzch_q-av zF7rU9a(T8Pej`%pxF~Kd&#cC7&)QDTYJNW_&fUB*i!d&hZt_v4GK>X zX6)iO4)ELtn;#P*VN8Wdv(XFbuOUF)H2&{?o9+6dz zfL}Fsh9Ff~?y!v29)#iKEZjXNKpz|JAoF7cX*tE9Igp&ARyLeVHtBPsTFm-wX7x?A znM6H2_fz9&*B4gB8gqtpzn_}+Che$#DVkod3{k0V;=hlQ?>G4yCbw<*TF@A}` zC)HNo&19RlnSahs+$wjcWhbs#EfSG&Ov~}>hn+C|XVJ9}`Eudcw_spv z-26wI0aaF%-EvQ?I^g5lYX+TnMgXV5Y%(P9AU9+TSL>8HHBTR^+zeeJl>V2l%8vyt zvo3zdT~>NNx4t`l4V|HQ{+2~MPVQW^xMxvS}Tv!crQV9)QX872?h(*kbsAX6Mm z4h3!Tnc|C3p7PK@^vEBF7A((2FW9v8EmM-@ zYP7)F*_GzugWWB8NT4@<6hf|9JiLsVTafvd1Ux@l8l?aQFpjgrhLlAirL!pDsOhc) z#xY=@k#5m>)vFDU`rb@NL1xyJ^3ByV0K>PePU4#_y^Zw{r1`xVAS|}69G&P)2Dhwz zu4>lSVxGi3;|M_j@z53NW~g^oQ-`rndo}tTYNm$RbAsjn$Bp_3o}5<}yYc#3sD79USG>M8sy^mu|{pzK=>N{h?u z2<(VU&$FsgW}_A7K`x#V5pp~l4l-w}YGSjU z!V3yR$yb4wEA_F%isCT1s-Z#RQVw*c&+#3-DFZwzlQ{vy!R(*g6QRL-yaZj~7}EVs?d#K4&O-L8ztJfj2(j_dD2 zsxMmP$>@LL-f3TEkRUsKz^d%hYlcd|!NF!V1$FyYQ?pLQ*2j(Eo_eF*5gWuV2Hi>b zLindDliDZM?Z+-#fYXyR-eA{qWFnoVie`Ak@N_j%N|X}U z`)t2U>lxjirND%zz5!rzLru_gMAPa}CKm$ZlWk?y;!~CLFP4d%7fd(|rU?c3FSPp8 z$M<$GdHzeKSzM}bI2nhdn;{iIU4;!ljNDwMg?vP(TX*FNPttpqdNGS}7l*@FKx}OW z5Pvdt+6=|F4Dl;#3R~x!-((`lcd?4ynrq>{buDtj;@bP0J^p)zPb>~}DWnr?`6~!tCzeU*kg*l>A=p(X$)*)K+ zA^pt`v=9&z(PUF8y|AacKBLZiNALkprJh|6M~YgIV6V#4<0n4{IR8OuH@uY9xxJ(< zw}3z(D*bx?0lhhx@rVY@cMg2AYn$WPfU;`zegH-4L;XNtaW{I0PSY53ll_}|L({qw=B z3`Lv9|F|e9-?!rwph*WcP`w57aZLE2vMy{4}q|4*e&&46bow4x#ibK9|3hQUoB>SoLF)PYy7={}3} zO+JJutXESdX1&FVZyKg4 zcUZzRx{OHu2bTHZyTu}c{R_v%WmAeHV=w=gg|x{^F`$p1BHbCCVEMg11BiKFTg4D= z^y~w5vk+<;7YIQs9U?9UZEsVLm~w^98{NhR_g06K{T^03NfkX|6MNbPOT3EOxuPk^ zochw^(Zf6OGPxs$WvIMIHTx>DB=zu$P-JEMLS>Ki5^{X`(^YS`r^%ulQdb(IUbkYM zXbmndfrQC0HRv)e+vmjF%;Sk#SGPeXMRtCbu$$(Tqd+Q_>_8{V zivzlbXIh^3{;HYwJ-wOU@LL~?m78|=D}H%lDzD`3b>%;Mda`;mC7igEu^*rorpzwG z)K4$ZwNviI4HUXWr56iXRI*H0Ao^lB(N&O4jkdpcF1$UM%DGXxY6%b(Yc*E2wMWFE zJwhJ!4xrD9mWipZkV=cANM_%M)ym<%>uOiq%9p={UY{lq3m2+77tZ~nd%5WMTe{tI z->?G_)_*0^=m%||A_pwPnSre@jiT8m8TtSs!J*Z8mUt zr-Ya+Don!)wf<9!E2@ZAJuZW@r!KmPk&9Z~&8QgJZGD&%cSVuR$Ii|aT=~)sy_-a9 z$dmf$;Pi5pB0XF2_e8sgs#sQIPj(8bh&y`U|y$#1Be zWwK&Xknk3{x9$3e{r+QqoBnkXgl4N{{`N9uBXeAF(wc@iL$-yL9mlM^XxtRHRl0^w zg=RdePjPh2jthfuh>49{Y&F_)=*$f$ko?snw^wy`;QUTN8rq;Oyy&Y|O*vk-1uRl? zivC%mO|@E_L0qE;Qa5s}wilpx<`v)IH;U)^aO9|li5MM(qAMXU=^6YiR_1&nf&wRf z<)zJ_SK~;hZux}&+06Jr#YHEQ@-hUuq$nHqB$>B%8xBrppe$x{(Bt+nc&p1P`Vu1w*3@+bN?+_BybcW)(oB1W~cn17E#0gy?CU3hvA7bOh+$gHlQ z+xFVMQ=f3B6~3wW+N1#Qt>l^q*Oj)Olr!cu;#5PGxqA>Q%5sy zO-oC$&v~;R@axqn?dX|?=*1js%-Jfhdq;51@X+Qul5UhDpvF=#jd7eXF zc0eY}*SY`H@Dp=nNp(3|E;6fbTCp*Dp^{CYBBbh<%5CrAZL~0mQTx(1Lx;3I+aOYj zxK{X+fK64LShA3=S2-i(4#!HxdSHg=lNUBn(VDN00ydP5;36hlS;Mls zXIHAauP6yqHU>X(=RqR_%z~H1+qZ<|wQ+unx)=K94JpaSuU(;<1_ma_pVXs>-*>2Q z+qQoDe`tHlsJ6B*dbGW@OZ66tTPaZ51SwDo1nZ?Omf{4L7BAZ1PK{#03GSXCA-Jb4 zR@~h#1PxXs1PJmDz54sV@!p3w#>*%4Bxj$!m(986y6C~l0M&}zUX*{Trf%#}I3@?% zRx1;}o04=aBGKaWOEofEDVnoougwy35pgR^%9yEAI9Xh%*vh%jG})mkbqM9^tcvl0 z($j^XH`3;^&L%4oe}9}zM@Q&y-Sx}tXZ*el&Xx7h8gHc!FJcVN*7W1JV->p*hYc$@ z(X6GAdrVKW^R~q&CUku;BfkH5HR?y6WBK9mMx3$yyYz5zv)z0K*Z2`#BRB zmp8woKX8rnLK&XaTjLE4#PxVq-jo?^8*3 zb_(XU`S4IxDdcMQJL<|?kMho66&nG z+aD%f@g&nyBHCFoW|cekz~B^Z@O3SPRj6$jMYSNwpYo5NVR(NPevlQZ-<~KvSZyhf zPJkJiFDkY8T;+5wj|Ofu=AOJqH&uwMV!755D7iOUa^}2yj*m{jLWf*~uD+9q=)&`S zlgn3=EvIrwOyRt-&zM3x-v)Ltsx==!Mjp|?yeGo9R6nC}{wz94Aj((_r3v6K5+ZRNpZP( zlN3C&PE$F-##=iFGmzly8CE$cFg%XQKIUkPbH=2p2Q&3LN5b9|Xwol{HF%g|*-odQ zn-Y=lo(DjkgDPs@t%LXzkM76@&igc$rm z?n?tNA_&iDlBZWLk%mlWPpzBtUNq*uryPU6TfTntU@v2!Ih6{`iky$yydW_){fW48`UavZxxWi`DT_8&)3>nqpWY?ABTlMt&4B-p`H__(r?*93Yu z*5~xzfge$QHKW+t@e_T&R?IF0%&2v%y&Z9EDl9wx7g@i}G$0-z57el^wc)oKyeZuZ4@Bs-E9VZ)7un~dd>w$2Vh8K8yiqWwgIKfG*>aW$$+|Ub?BiA=8m5?ZN8P)`rhfKj;yF@d`+?X ziM`awc*+^=k>f@aEF?Iemz9bJymrE9Rf@f*D`=&_bT{<(1pz=Ip&L=GN&DCkpBaP? zf(ro_&0aRIXWxAMo zmX)A4W=d=fzQdzxZ(^ea6jaXS3B=v%;{**4J0Eg+UZDKp)|5#Vy36Ri7}1PEh+y{f zI|K8za6*N0sm?}MQ#YR)D6B2S5@yhpwJkGlAz@ZH|A(kgec@T#FVs!Gas|ipP(SFI zBz+gRhVNWE=zpytAPb4e!q=R64oHzQERLL_pQt*kNaH2Xi}jJ&mA%H5Xyg09`2K9w ziH>CTQw%67-V|VL@=N-9x45rVbt|=ZXe;=5MDy~{rY^t9Blo(Q|srN>|>k1oM$`6m0B zhTW?EF;lXaeNRYcUdzF;jU&fu!?B(Y->k$@`vdH7qVLGB$1~%Pr3=GF%}j1P?Nv<0 zwy6%+X2bRzGlW{z4@m#Up?!py-q zj*@ssZJ{Gf6z&r^7%ieonCAX+&)fW}M&Cn$R1eLohVEYF1?Yu}>=t#oqFb7d zA6v$NCj!FxzX6!uFw-*dgK?8|AiCY+Rhj%QCoL<$pVbIZ7X*^Zz7^b!Wn8)HkimXD z9YBvdPUt%dMOJIh$x2R;8|*k8>y&vZLXvpM*jZ6`+ca#EigUXno8zg2TD&LCnvMcHcbo9gNFAbi}2 zUbT+1Nz!Wj;Nt?et(wUe=h%p{J6pk0&aa&bm2k=$No|q%t|}#a5UZVP_nmkpow6oE z?R!|H)DnpIYqo*r2QB!e{7#ra%G_;yL-h9_jE?xnl2*qo3`xN;aq`aTt06rTGdLF= zwMT-KPt8~chX6Sv%)Zk5tLmRMgsRrwXblWtY2uy;2^m;nSD1F>Q)AIp8a^d2ZAa9N zHlv_1w0TZKB!Poy1M2narB?F<6@1(hZGjguVv=rRG;Rm571m>Tv?b>wycebz>`DD{ zUxUFrH8sX)f6ysW^tIN-0qVA^oMJ))r1al1Pfv2jP0P;~tm8S;zm_5d2A7@;6|Pv; zCVyFn@2uovpc$#|Sy^x$p%mIj?t@s?xx@l5QC{Ml1VhWV@(cR^S{lIn0MoWvuXt^+A#ok2{`pl%23KP zw?+KU>|$1_aY>}!rT`ju29{Jdddy7E01ku#FG1a9Uupvm-%Qle$#eTQ&hM}bUsM|| z%XgHzXQ79z-&RaaNZ>91!zuJqRyQ=O(ct%zmxUwhT00BN_eQ)1`86G0=2UZKfuByf zU7_G3#^}iBBRC2oDN=Q*N!7dv>t7czaxrQQgLLbgr|m6Y(` zp7$wL{B!EL%UK<(l(G45xw}Bj3lY} zSnp@nd)REJr&*GC?5-7Sx=>Ev8i?K*blMEgE#5fPlWm1=9h`33|8LZDL?b4P_Q zAVJ|*UR-x(jPFA)p`F+G&Bs64l80{$tGx$l(8G5m08&(F#Lj7ViXDF?LAAz1ExQf0 zvU7;2!)Xs?GnE@DGgm8pH(Ef&b%NBen{DNX`WUd9BKmTee(VtI$T+g7rCo$cN^kvCoNmfNH!dIR^<*bD&1 z=BWA~_(DY*;P~`N5^fpj=O0?g_peqxTIP_uNyWIm#u;N(wvZQ$mOFo_Za~)AOoeahLq!wN1PkUIF9s=KXKZI+Pa_9UZ3im`m)6WfClI0GxS z@2$V&C)TIbY}D_NN>h&u?D%hU{5%J*0Rq6_VHW+0GX;2!M5U=cLEoYC+E)0nctPeH zGY!=QVa!eStBXoQm4D#-(`g;hEZL!Al5HR}>k`zJFx?~dl^e&Uur2umi;W zw0@}?15Q4-fZNa-KEw)4x7srU>7`N-)tFbu$U=kdqJzP_7b}A>i>mS@*Wa7HmwSBB zsHpO>vOOp;P2-NjT>+}549c$YX}2lH-@-~KqnRzNq~cp&GGII}u+Y~t=DPh-Kh~-- z;n8^mwvDWo6qD~5u(sFpG~;n@cyEY@WDZLTcC(L9fX}b$Uqxll00pdFh+m0*mA|Xe4(~=kw|dmd_^)#r*cVX3qbYcn=DC`oh@bJ5xy;&fwlZT zjF2T>juD_dzM5y|b%$XoyVW;)rtxSzmK#*;8;vK97-95Y&1ut?Q-uX_=6K6AB&fbe zTRIuVsDE8%a>pT)qC{=c-jjf%h)l|eZBgSH8MwG;cz>q2yGO}O?a7Qo#C|P0o^tDV zo$BR#2QOL%tIr}JO(}hQtvIWIElHnsLgY(b*<7!6yXxm$8?l0l<{>lwHDR)kO~v8= zgzHbK@~WgKPwK^-);x%+%oD;VYORcXlj@HRJ$*t#lP6gF`-X>e@WqWwEBnt*HJNvo zdPdHl>*8RkGnDo~8N_hkW4^fns0Rr#`+EFA&m1ORE@XdnfL(GvTA2-joILtb5bDY5 zrQ4b?BUO~SDGabhnx`&6d=B%a2&4Pof*}e06=L%v!x{kxlmnp&7N@ShAM5m=AyMj+ z)dM+_4}AMty@6=gWg(DtC`GHjC^tUO>Xi-!FL0iDs5QODr%CMjx<(#{UH058wHGm4 zk`0A(TiA8?F)N-Ysfd-JYluJ@FIECS%c@x&ZnH}~C1FMK?=$YzTL3|~xnrHCb!iSMf1Xrlx^)c8Pljkv?Oez{7z zRZqU*$iSz5>aWkA;L%Bof7eX=UvyaS$qf>n|v4{qPACgC;P1Zz;-OsaYE zp6gd<)Ti98%A;H)A|d_#jK6M+$rOS_^8N*poAYn@@=6UQ!nR?sLrd7-;u~JwU$MWr zypQ=2S~9mp5_MXe!5Ot4`+CW>Qg9`u;h(V{hTjDAz9Sg3p-YYBP|`L-Zenv5mDEvt z$y{}%uVQOVX0215xP5i#NErEZsKE{nh5zzUcv&v#z<^o3TQ}WA##2RBeeA68*e8{p z@4&K{w|3~t#BwJEBQvz9hIY4o(o;yuLb3@cR?`0rr8Q5 zVA-i63u827mNPT*kE*;M`$JrNS-B*n=Lu@RN}zisMz52jek*>jQatylOG;1vH7+s{ zmnxXjdO+^|aj^ifs`IbJ|9&{<25+5-o}^VZvHQS1yV}%HH?Ks?bA3zZ^#SPgUNQ|e zhq(?u5g^-@PYJmTv<(9b6Ye=f6VoL3ExsB#AJwd12UIOQJC7%K*bj(~R_PTWIp8GB z6cC{Ijz{Q6q7&CL#T};dh{T$dt+bx})th5>_1$Ilo2%Qwan+NvlCAo^p%Iy3r8FT8 z%A6APCbN>@-*vNXt^}I6>vO+XRyhIP+MlB8 zrPui^0lAko4iP=i%BGC-Y^+7%KVcgg^4D8FuXu(w+QFEz7@0%~&k8%tsZy97ZVzaO zc`}kD>NsC9VK>kL;J8RZ8Xq0L%yY;=c(RUrAvf(w;;v6&=fz)3*5m{kIC|os<~0tT~gg8WyGFYta23>iU$$flbn)adt&idk(bFXZpt zK~!rA+_kg2A6$jt61(={gkuvf_~G|7QjRNmbUpqm;Ud2JvI4%`m?7W|1&7ymCgStloR(OvW?@p33(Le(OB5@A2xu{|ft`!w3K0nMVQ5#`5KFm-t4OsYiV3)hi37Vei#h zd;qY0(aKT8Nz8d%1E39xKC85~RR_KciWd|yv)Wr_pOMt71a#Uz+evM;y{NgQ67RgP zZHq)57r)z9PUXao6d8b}j%IHW1^!-yFVD+tC!WNMxfT(xJ_X~+p@DfR_~F^N-(z_6 zcDL)?cQ{zWR?Pq^8J+M}nx6hN!c+v>v^gwQHhCsgf6)7H(g<8}>}Tt89Cr+l*dPJ} zan>ImE5a)$N?}YYR!bo_nX0v0Lq${jxB5H%ASt8X?{5y7fn;PTAq4iKe6xcoJGdAV zq>ob!L2U6n35f3sXtVne7VD-G;}ReLb{&X(b)j8n8&y!E{l;wyZ4r!@>d<5|J z+G|WApe7-|s^=ek;9~lk$sR4>N8`5DSQuQ5x2W*nI+Q(Y?~Oqy3$1l1JfO zM00~n{osb4O`WvQ?my53aIvRF^0B{-Jh71Te>r2)GO-bSj%MMpfBmL<+nI@LB!P?tm|jAu`c@Bob|##n98;Og5-Wv_MfU#?rl zqKjyf=7Hphxe&sS&5z9L=~s>AnfdH!nYRkf zZAy$g_Ofo0Ph~#KI%%-~M9p2d{7h=vsZh`dpSJ!fd;_2K+#Ok<>yHwUtTg4VaBa;R zd1gfw^s4UcH~+jiha}kSnuDmf&zc~4aYqhgmG-IS6_3h8#x=cVyeo8jq)zKX&sY@x zJP&U&SMc#oW#H4|J)OT#YdP1ItiNFH5wBHm&7UBxj_%E+g~nEJ7SavB)=FWN=Wx=v z&--<}lV6|Pr;4YWMO{NWoOiiG_Y zl5bLM`(NDnPlO|DFGQL{Og6KL;bwv#`XRF*ZwV#!52e;RK1l*3LyO022e#EP;BG9JbeMaANo{b8G?r{dRBUh@Ivz0d%5A3?gT*hC{>u(ab8uD;sGX057H~#b zKGuEobIilUsDP9ns@{`CC{70C7a%@f6Uxq`7~9fYip!RcYeVo?BR83SL+Z0lRx7+A z6?Iict;4aM0rt}<_V|~}bmEWlGVft63O+@;=#=CQTN#0LI#Ma!*2keM$lj+wRA530Wd?KanO{g> zb01Rh!j2CtpSIVK6(tN)A{b*COwy+;5V1~D=F^Suix8g6E9DjP zBwQZ~)x#O3`q1#4GN%~|n;SE<-?6OBJ_sM8)1c5rU3IzvBQ!{Yl~FCrsT-46`~c%J zwseq?*4}EthWGmKT#9oo@&M!aWaRYF$N`YT)xm6YH7`JcSsJRT$=Bz42zTOZ0Oh@guJh#s0Ye}+rVJSi1cTBG

    >L-d)eTm~Ht~9Cb`bUJl8ja+5YVjB9wS z;c=ncX*+Cyy&k-dzb-ct(yV49O?kB(>e@N#4^Jyl-@C|>a6Q;v#6$|p2>U(1%;^;U zJZD#481a-?nLrFBXfBehT6*?NgZ4%9Z8% zwy+fa!sQBpck?@^GO$wA(<&C~} z#@>_H`Uw`VLunS2Lmwt87x736o3|X?{4PlBpaB`7eF4d7OWs6vr80s+QlER!1K><%9-bkQ%|-kx&pHmsS?$L=$@gozJllbD)+H5MV{|t?o~;ri^TT z`Pj2kwdo3HULC0~XsnWE4m6dPbxw)2uzrvmouW|M+5UQggQ7f@gV!1x_Y)IVOO7-F zlu%K+5VXR|$&J7fx=gDinyZ-j_Zp)puHm?+c`qlo)NUb@aZrNL^zG{ z4j|Uiy;=U-KzU`Kr1w+Yx^%Otlf*&}A={)nAg8-Hv!E5DBsw!+#FkUWg{O+m!u z{e7E=%D_|cn-64;ncYtK?LK3t8CJizS!zosWn6Z*Q%kZH(E98+zR*N~9TWtaBDdro zJ#(hx6TPqDpsD}Cr*g}&o0Au#RcBy8dDZWXjo5N3Od~}LFlBj)SQJDMGqS%>s-4QU z>DsEFT0Wc?@-cdIh_+_YS#wRf5EkFH=ghv^&T*k) zxXoTHVevMz>)zTxpQ~fyO;y+|;(^m-hInwZ1<&WJJ*wIb?=7fl8mBHPG5%T3l z$OF5K@(;;_Hf4h4bAhDsTp)$8AQZ2UNddT{+_IZVD=#yqzT#Qy-n#wD=;7Qd{X6c7Qgw!S3<&h zK6HGa6*go+@g<)who;6QN95-0fO>sVwuCo7jkb!^mQYE%kH~F(!ym4cT`LjOO6a1$ z!g?6qok>@_X_LBiJ3WApX`s~Y$4G~zxk=1#{!HEP3SKJ4(oteMcuoXLk^p|rzIxl! zmG;+X7$33`!1%_^a_Y-m8Be!{pm?y8ckx?+NOM5^L6ffIF_Az+Hwi0Nj0| zCoPX_obn_a{+Nf&Y^kfIXNhHoVffgs zG20*)sw2rv`R4hY($1zGjU?v*I?W!YO}w(!E z^nrN7UmmOFY7f3wO<-Gi@@w2KP1oMVgl8QbO=G_9!U6&rjTI&%KFn4=+SE%aWH>YH z@u(l9Ta=UuxqOAR>UMIlBlsvt}Y*b}~3eASbuI&GDMJg+kq5G+Z zF^VJiJcYZ#+}m1bV;BcZY!!1vz{QU~aK@1(0iX7`0mcOJ`qx`JwZFPE&+W+~dg3rb z_!rN;hs`)iWk9O*H0tOr!!l*;1mD+!&ieo>9G+D&yPb-0?4!)r9ew9iJvl~Jp-{Dp zb-Gaot(~gR1eDN9O_vXMm+-%vjOlCiBgZ=Nd1vU(v0bKb{ZEwbZj=w;^|@bJJTT|D zl%s59Pz!Oz8b<=F= zt%`XF_~6<{m96RzCF-9+1orTcy6bnPK&rU>1)S1OCLlgqJWPxp2h8u;>wdmMYAft8 zsWbXiC&uUIaMS@QYG`9dqs{U6GC;0>@|BjyR-2G>!Y@KV!lAq&I4RINoVWDVeQzlJ zBvjwtHW-@KYSbr)$3m2HtQzcxBv~;FOW&S9^{ayCL?wNjTA5DS#{qMuQb3wQlfU5iEk$AQ;g)7IV<23@mEH{=|%>hnYgYO}rXau|TH zV4|PelC>cU{*98?sX>Q&;BpBmoigL{c(z!DT8y^dd=zrc+;@72Q^(!51)f0=Ctll` zMi6Ft-;Lq8s&_R*9=o>&HxF3ruJqQ2-)0}8prsX;t_mU6!kT#-o^%i-B4?>`L)e?A0;0=pi3`zwhH9VBk3)Rk*)&9EK8T8cgW-$Ek9sEez$FPP{bh&7!} zg(A@xu}M^{`DW=$*U3V**TCr0(CJZsA2UfZ@v`(mDt+wEAC?EDS+~tj$6q*90)$btjYY^;O~jI>fr=!+(&dE6P*>bvcf+2E zzQd!OH}>iu@Y~r4g{4L&Q3mMZTXZu~JC8R)2s0V&%&C_Y*T~{nzyjGX_B?W*Cu|B_ zVtcpvTdlmzah`6m^b>6uGOA6l$-1zmDF@uD+i_^*f+YXO_Trdr@?_+--LdCOZXqSa zjPnOclR`E?wzh?JF&R*#wf*36p)|U|pjyxG&^d2%y}i=VPJa;@u6KMPY1apk(N=UhuajAJ&FA!#@Q&K#P)2V1d9^4(KYcMZ*Va3!U&>C|n+wPK~!W!*$^@aC@uCHOZEmg}T`jmG$ekHOH^#g{BO5QKilkByg$W@ae@< zrAiRJlKX05rBkh=fAw*9vbn%iXtJ1dttUxxs%DD0#u*~djCwJ-PgCu5Nd$i_j++lo zk(WfIO=wZ`bnVC^>FhaCYYVz@s{`hR(v3Q#eNDLaH9kiCK~@yg1{hlSma2_?mND;CfL z>`AwVvG1Yy4bjc)W#6x~k65SozeRTLM|mCY929+xIZ(+MB>s6w5vjHl6>XE%j)huu zjzZ#L9bT7Vy9ZHlL`obKvLjjC;T9@H(9v-xV~(ruwkTxcHWwtsc$60%^^L0JN?;Kd z)e6Hqe~52_Q5J16b*%s&QiJ5(0qFsygfZI3kQ{SE38HpGFM+oCzj{ivJCn)_f#PH` zyoDYDOb1TG&yQi2wTbvzXZ@qEjn1Pf?tm5rUwxTQ>tdH)r`uOV<@9*^Gmdn2hV_y2 zuYL)T0xRnT=b9_hUwdr0wjp-ye&fT+=@%g)=em}i-1*wx7IpyPhz}9-rNH+^&a$t8 z7QrY_W?p9XR$s&0_fnt0DGS3mmf&`@(2G<0skk2oQA@YTL5}I%Sg}`Am+@iy6}!$g zA1i6y)9}&V69cD_e--1u=M$FT)Q>_Vr0A94?b77mwVmqYP;AJ!xSmUWmbu@LKJ+Mc zL>w?Z(X88!D^<6vgvR(CB9v)>p#j@RV%yw3ZZWGj6{focaz(p6%#-pXT2Y&%!fn8s zmYvT|v2>QqB57MVO;4U2kf!5yX}E@oFPFGHt#~URd70v;rTX=a%4I z#?q3s&j<47MGL-GzYQeTQvf+7q6#1&)Au+`L1`A1DZzRd!qi7L^{9JV^|XPArYlv- zs8#9&FGZ-DJ#``kOq#cpK~9qeK4!?V8=qLhYOjPaT70k5G|W z>r)-^F|;ONmrB#6Mgv~j(~h>1FCJz!um_Y^&e2JA4}PqA+w1ciEi!zBlUZWy*6bYP zunv@M3&K>h=9d1Qn?kB+l1oc`9exPuIG_#X6?J!z_^Y<|RI%NcMJpLV7H2||C*9kDekcZD@ zKu5IoflI;VWZ(Uur1j3?TA#8$(h4`3LxAKwta#9opygF(lZojFkZwi4nC7>TA$aVd z3jt*SZxe4LC<-k#u=MzpFxi%DkMuKJzfjotFs0jYCCsn6XprRwcT|n|$HY80?LUw6 zyU!@nPF2;hda^Z2CD~|$S7Quuuq?(dp6iqDHyGTColTT^{h>}Btn$7 zu{v#%IwP7(JC#(?G>bNt)z0aV*6pZs&JITJz2B6x^eD8qlec7xVh%z}=M$B+G1jkB zEr1pAm?s<@>bJ9ae2zR;$E-50l64h69#Tcc0ky2zL3RFS)81w`Fm31Wr@v zrwZ3JoV0!Ub4{M+IHa^9@7%^Ua=s6bKUf5YvC`dy0+V30JH3=>uMNLW_}I3s|68*= zO>U&fGruKX9wX|W*TFDDYkIF4LMT8np!zIW3=ER7+bXYw)|T_WDBN*gHQJ5jXnZaH zX)|)|PV6Oz5@HXdKCOW+xeQgw+nG8V)i#=A3d{9aZ=I_l=s8rE+j!1**UFyWVyJVnw2|R@(M2~qx&_C4e8s|S8?D}zPL$?Jfa(6hx5ue_HDV93wLrO z``aPPQ3||ZaA1DY396MCLiFazRz0RL74Q8XeHiP@lky^5WP2nK+Ztw}najw7Tbw`qiP{Y?z zHF)kxcRBTzw>1;x+@qYN_j$7xY(T|4qLV3^|vhShEwGGog|qsC{ptto0uidY7~ z!o?V9>t&sY0n*rrX4uZH4(iOvXx>;Ml%sZ3l#^?|SLyR_v+R}Ax*RL0VLT8j^@J&* zb&HKZ65ZLK6nvMTEBFjg$&BoGXqnD)gvsk?=Wg&!OA%`tunm~(!Az-ohv4${&y##I z!{wX{v-!IF%CU4j#8+(otET*?%x~oEEElRZz}4Mysl?*H=GW$_r7ywFg2qmb&t^7U zI>Eh!u@`2dL67n(h?- zV-yN|D1+IuzbH7;xSiiMu0wC>{dVjS}43PRfT@T*@izLgIW0&Ofcn z8!z7s&KDj{GgJ|3zMn!T>55sntIXQIA-Jw}D^<4u`w5tW_VCbR%k4R9e%$imc8hWK z#8AkYn@m}JenFVVCoZ$75BfL$d^L~gt{)oN(>84T-M7FkY*MAgq~HS?vjgN?08%}f zlJHrW!%)kAzvFul;2&D{iz}g83Bi~3o55Z5CT==k4r4CHR=Qxb?~@xs4t5SMpMkvZ z7#5&OZOJ#CocdvY@*qDD+MO>(bw$5fV2n_n`f}Qr9_GihT8gdZ6iZ!mIM8&VQSPd% zG`$ZpyXGrg**?M^NvzcmSz^^ojq-LrsC0;ozFtI9a8WXKQJc1`Zqot`j=hFZqcn+K z*{pFpMCqQ!5c!02=F)m5)t3NfmXTw8p;&z|kqYP~2 zw0n`23)C5J$}hMb6h(9=E!nU59?&A+d3;Z2SvEU)ufN_p!^X^u`82GzS|Y*;qmXj? z2){Y(kC$jEskQ{U*2=t9$USai!@pKK6bM-W`VeIR%yG|=^-r^P7rG9lPwq;K5K$sV z%q(6?@O+O?DD`h}T8{wOv}4tH>a~m^5iv4nj6zVb!gpYtuD|FLfmZiPI+BD$i^$`K zE4(Jf7Mjm?0nzgwt!IXK&x{uPjViTNp_XDLf5$5efCyz|jNr*k<(8M^jK~>`uM*`I z2y&0?-sVVxMQ1r2dUl}i!PI~~+RRBCl0dar+xW z4?lj|gWQr(A@jRrxZov4PxCqt8|yseGNfq3C#5Q5YYmaHm0GDvHTks-iNa=wk(Hp>g*(YWK~Kf-^pzS*0n@3AIE;2+<&<8 z_VfMyhLBZY7XxA&=icce&@AR|^H%ZprynANCY$J=T^h*YeX!pV0#)KwTL5VR>)YYn zmn}N*n5Ib1<)E3UL4aQ@R0}em)T1)cq2O3f^Dd+Eow$ z)X;mm>?$V?8*LJFm#%&0q=72 zOwDqrwEiu(&*&J9Lr{IMc}ZpQtw%UzetS|%`TnsFtjM_8$4;`uiwl7 zxf^N$7O;#XH&@+*90lQ5l7e;#KADtEy%>Uxd$|W)%A3uLoa^i%4^|8VX^f4^H-1MZ zWpsql^h_n(M{?%ZpBwDs=#;Cu)~$Rwzk!@Z7^W$ifrPJ7Xh6b#>1n7aHeHG`;3anZ zUo(o}8hi9YQMKA!!?{7VW$S3?VN%tvW*K|8NYwamD-qp50JOO&eDWwc+EgabxjvZ% z9z$HR$aUNGDIrC0yRx>h<_tXx-Cgq7d3oja18j2ch+*n6--RLE%g#zkt+sUyU*h5} z(mTZC0v;DTjGOyQRYe9hvQrh=Gf=SPOiv!^!HO@+pq5^>O&^_pFP&U+-h-pPc>{pC z#`xXRL2;8z+z6fWur_zo%Yu&Ml)N67pxmY}piTE;S&zbFnvUB%6&Rp^r0YCWxxHu5 z;$n8HA4hjKY%9&mJqKE-az>C;vt(%*H8R`19^n^d2Us<)I$Dd|O6vS=I&}ivwDfbKjVJinFDg?=gtka3maHvwsEDB@vRYI$xXb4-U#|7_^o;aO3MPYTEnmQ7r}*%nkC^5G>%pY=6nhZlQkzsZgr$E2>J?H69c5|_k>4!U}dSqyk* zK$QhXEPq842rb`V zyqse`x06WI>*i&zluIRZxmrk73bY}ao`-zM5+Pf%-NvAj-R>NL03|sSj|R&{WjL=; zYYiRL7Dc8mLY_`lP_bMMSw{M-WH zg>P7hQul6iyhU9suTzJZ>lVLqx@Qn`sl>RkQLW@Rjru)xx#?AP24Hjzr`AG;Py5@0 z1R+smc~IW=k%5*(QtqJTZ;g^P_cOxUQ|fP- z9gRqx^Ie>@3vE?3IS)QH&f$cHJMS89Cy)1p^BW$q)0Mei&b%6)sXhDo`pc z%6sSmRWuH;;;-nFBiMFy0!^i5L;r#`!j_{>ab$`X=d+%F-F|6r40SgL;4-*PltiB~GSb`AE}$1kMstOd3Dm zkT3sHdivz_-pNl|=(%@R|6l7#ThuXNrfa3(Ueu?=AgIKUwG?&G6ob z(SbfEe;u25@<0{GR={;bf0g>3W($d#N>!q@Fk$^)Rhr=DU4b*PsHXv;GOszSU0NIc0~u)gHvUDTGh0AUoAHy2peP!%o6NHSdI7Y~EDT+Jx`3 z4~w09mvfeX$SM6{TJrA=0!s;qR1Z_W(`*Hnu}>SJM>*F!c*gBLQ=ur!W$S#?C z<-QIjPb0XJBPy~Jfi5WpZ1+7N_}nyVZqy3w@Tgt+pM^bV%Engo)zHHQ8G4IbL{rw^ zLbWeIii8fGZ-{kTbDR5Iuz#BTs-;KSD6?_8=yqqjjU9XfIactNarG#os;O|D;XX@r zwt@M5eNR_yW0wqRj4bAvH-hY4r1Si+0MYhdCG~GS`OlS)qNae;@z^P;T4|ayhELAf zTxh8QDlJ8qweUe0Lo=4zdOgj{;&X%6s=|s6sn)<4zrQJU|7C}LF%<%a(H)Y>3xJ+w z`q5UHZ`ttU7KD!fa-91-3S#>IDzq}FDE`1MR^r8*+A?wtClfGY&0I!gl4nYDTh*lb zj7axlb&zW3eq%N$@lqo0v(CVq4`ls~W3Yvovb~1ZErgoHZ~yM1bFb7A%YLd`ApxRM zJ5bx_I8)IqcPR;mzI_u5d)Ns;x*7nayXBTN=aewJb&(@2GR*k(R&tgw6Bk^^yIyDP zI@0R%**oCRNDu$K(!8Rcux;$)!zyE*r?|}pe&%cr0s4tKM2$bwb$}u@5geVxI>I@)9Y|uzj0n-K*S3BSItvaAm^nm(y}7}Nk&{f{z3&R*E77_B! zIE6j46VJk;fg?-(4|diDU$Lf4VwRJes^kaahW}k06&A58cKwMfv$cHiD!p4Uw+ zXWFKbUwg<|L^b=DNKChN>5c23&f4MtKsxUP=*g6;HM}bSH3=h^x>fY%)ezx`LVgPn zKB?~o#7)dJ)PwV%i~cDZ^SxRc@0`~GF8YPS?%{3R)B zPGpuo6HU=jP97u@$}?NZ|la-sqqKvnJ@g|;UBw&rDlbYwYiN$M5SM6HR= zCeZ_d?0!+wKb;&b*f*82rtkaeD z{txn+-gBhS2uI<=))Sk@cUPWiA6v3aE`LZe$vP~C>T{N2W%4Jyi+&s>y|=VVG$vsH z$cTiPtQrKf;eGr<_$@ctX*Qnp3_R)u9PbP-^0~zsX4FYG^PaX?d&)UDhFp^o+?yqo zv_t@{K|6%QwX^ASgN+w%iL1m`ot}`L*QRQ<{_!(kp7XB&G$(0!ICj*uU~E2OT3aMJ z%>?#EfGS79;$<_S%M$o|!&`u%!2&nGA4$(A{@yUKW$ihK$tjG(3AqUHr(`D8dlpe@ zG`9s=iwwqz<`=eKrc5wv6s#H{;{Kw3+2}D=(d4=ol*c+Fj5R2*ZVMDUdjOV(9r+Gta zW-2hBxPHWtRL(bZtXHND*6}e}(Gz%~-;lCYV*r_2?%TfC!CKuO6d$JlwEQKs+vJD% zAkuZ}m<4dE8c0XYE%obAquBAsrVFrAjqhrBI3^zL!4}Lo|Qhy zn&{7+;3c%BE(I5Rh&K|w+E>=4tN**N&%P!;{VkTi#$QCY_JK`Z4ain;blmJsEU&e> z+xvlGjG^ujqOdexANPpmnz{l?2HG)6M(%Dm-~NDlq-^XBxjXcBGEpn-3a0-a^APO$ z6yAjo9`qoaoty))GM{r;|(Kx zA3MElc9VVqT`R9w3lK^(G2B@HrlQgv-=fSP;;nhhi-vpp;`*GtwYQ`~u+NHVIxmZm zMA!NMi>ElMz+5>*ul?U_k4(R}_~fBpo;KYez| zBhRd2VxPcwjf>msz}oMR*^S%H<+jMfbr*8c9}43bKd61MLb$IQIxUIX>1`RRu|v$5 z?urKO{RKM8S7FhPXJ%v>6(}foqL0pUc2VRFiPexbmvJg@b*igF8-}RL5AtY7*d+DM z2CayU(e1+Q24OCdUE`0T&FVXDV1kugEmNV33wmM6)VZphj-at^!x-!CPYP`luj^r} zwCG8|0v-NR0Fw{HR9}7C2OJRF*cYY1IWsFqg+Epl$d%b^4duwOT9+0jKYH?QzY*bj z-aAeCwe~egn8ZeYRrzk1!whVE%X+ylaiB`xv3QQ8cJm0LWu%NdLCk2<4Te<1fOxIOa za#@C;Hq~humzM6kn^`xPovhA;H9GV5Vz2KX)01%hQLiY&D113pmTZ8&J>j|L990#Y zfjupV_8N~qM{057ccz=zOqe1ul*%iZ+hHURF9zbW68DixD9ZK;L?_x}>PW2vl4DjQ zGh&rkGW~)?ie-*XF;O;vD@j?-{F)v4wRQtJh*jNCzj((r82(=HM7Fzfo93ptF{0mQLBY z6{*ef%okP?M|xMhCZ^sP!K__W2`!0sv*Ph3tJnF}BNTS7s3(do8A zvQ0eRs`VU8Q?b&yjHFLqM~HC9D;P@MGKO2*MC2|*m-UV;9ZtWXUV7m#6cvT^>MbTLy1(Ri=bfj^4a1Q zE0u=Dg2S((`>Su?6Ac6yYBj@DOUBj!ITpV4~Ogyq&y1O4#>1WmR1ODjP#|S;KiQG_S zc~WPqI%g_u0YSYQx+v@WTaK~)vR~1HB!?yKEW;|kGypsmw|ga)l!Nyg7*0~OVrNi z^hbqiQX($lZb~igyh??udzpG0=G(8{I->MQU4FF92ptr;SMnZ!^N$|!KQ7W0EOhlZ zuW>}6N6#IL@ z`d+4fr-Q%AYXk?)6^)uF5TRr{RDQY<{bP6gw>jQ~Kjb8B8WW0^B7;6h_G3R)Pi$#0 zo_6g63w_AIu%cy~@RJgsT@@p#?fE2PK37W`hj%UY`JOo(Ai3r8rclT@BtHTeVjgTU zYTZ1gV%~9XF_FFU3y8@y`K?T_ovtNl^-M>F5?(8qE~gjN2ISN#TCypBktH&12>wJhgcPVfF9oDkr;a z2%sKGK^1Mm~eR!_TBaH_D*YIp+FQk{jV<5N31ydJ*#zBVw5NBDvg64`SA& zO&WJ%=;ZDvX4XUpxc=IT3?lwQ#bUR+ol1Yvd=%)2>wleBguojJYb>td%Si2+W4&? zDj_kDH+tkY-MU#llie1VM~PF(sd+X$JXF=bh!NPRJxaUM$1Ou=|7)eYxz;bv-SKXy ziS7iP#tW-exP6!SdO9hZkmumVksusSn_-ChG9JOL|b zS<)50@Y1ypilHrG2j}$r_(l(+a_IBKhBHhnb1%!-UtCbKxB|BvGWHix|MxRYx%F!yB2r2vsOwDbGz{kheuLo1_d_bzL z(F1M>#hBGfoZ%Y%`9U8?mX@9?EKWS}rtJ_3FG&9rJ)mNGv{MZpE-vl<PvsV0?ABQztz)NaGCn><)iHPVT-}#wLPl>l~88uh?jkV^-t<_1y5JR z8zyHC7DnPB{obtumI+*1PWsf60vE zRQ=RrDxi{7L;K9dK>uA3?xeSkYo?<;U!&L~0I1F18Dx~F_qpw${S=X!M|;BtlR!s!bd<(1z2D) zSyM9LbL8M=CyJIl&-H`{(fp0+00tUGgM2u%#xm=FxN`0~oUdU8qQ6X+Pe~^08mBV{x_)m4ms-wcJ zJD=Pt_z2v(1eHV2Dl<*r(vKhWRl8^n=|-SU!P@#f=Hg%E1NCo8_bmC+gl z%Y2yo?~gL}+*1}6zTJXfGs54j*1{=e`6^#o!ZlWnbhSwpDOVvEmxQ~wu2C*f2bXFh z0?N9@w}_&&Q*iPI+}mjzr(^-qI!(sWX6DCuI+rAk46L=6Es+N?jS8q=?!^ubdKuFOy{bB&a5MdBA%1SjU8@;DsYIVF$-wRX9XM*9WD?Cq1{sN&N-_ z`JO`1b~60)^mh-|rc}NZ+bWuIF@A)9U@st|DmPTW9#z}3KbS8Ktfu$WS(A&I%2w8$ zORPJz2!#k)JkdO^YF`)9*>%30aGIZd66Vk>j!E04ZJ7Vji8opyK_i)#c@w`0u2p!+ z^CM<_1a}ncrS6@+;RfgL%z`h#EN-_`m12R< z6gB^IwdVvA&tF-{H{$kEhL^6&E22du)Bb+6&bn4)+z%DU4`Xc5PF`x_o`%yB?0sh7 z!D6wB%%#wsujxG)9PL9t@U+HWsbZHU%e-c5v9sK-8{`Z(*wT zdUGO+jBoo_bJGI*HeR(ocRojbl$$E1kiH9LeN7KM^)ezSckrFAigIG7i!p%Q?$>y? zqt#;mC5cepX40;C zrv>Bh_$&;DVZg4gX+(J3dop|owpZJEsOQ_KUyS*9rtR&w3e702s7SXyUmun@(EZ}q zIS^xMxcA|>v089zy{TuQb-aQV^Sl!J3d>X1Lt7Bp!Pl+tKu;#9#*%PDPxoJr{m~(pe#7-5;%N9xyZ^J9VI6wCn!1K#O9_ zgDu;HMNCjZ7nL^Z=tX_|L8h@@iI2OA6}y=_<16(7q}jr4n(W%z(_R$~3~ zhv`zf6X(@B`xcD0gL$7-*iUnA2-X3weL!d#;aw1bNZ(zU2cC5a-)Tr+gC%*KARSXlQ*t{XjAv$`FW&hpA`hkefdm)kn?jbzL z^)yRFh}l5)FN_EbZN%tiifEK&(Ado2_EiD1O7WSC{oI^oA7jOTqQ?&BWMO@wc&)e4 zth809pVO`R>W^_8`|}sM(k=RwX_+pn061}s68~p*=^bo|AXVCAHF{)cr&vC6q3;DH zCPZ*^ljLLcIW`$&2VzU>F?tDS#DL1k*ZXQ((-p66%yIVKO3tEHJ30S!<(~M10nlE` zFzx61jMvtp19e@?mRRc5Zc09k@lHkpD@?Ts^gnzpvo_&3{VwVT)8ljcSZ%=+mIV=7 zD%9Jd5xOyi6t2V;gegntIfp2N$qTYj4 zN_%EBsjv5qi+)Kz!$Dip8Hg}-!5?bFsBxTbVCpClkOy>!!9LXN;X%C(ms+hBVr)}K z>-O@rclOZMuRO5XNyl&65}*-pC#%j@xLf+(@1AUJuL68MR~pw~8XLAh^Z1QU{vb({HuJ@@ zR0t&v6tkA@sl1)quw09v6ciF#(rz_fagdDw_W=;5Md)(rO^B3M*4t>cnibPU-P7fZ z*V?U4QDiX*@D)jAK<+kjK2ZXZ(Z{GQTDN-=XM3~X{^Xt~2?ax~MZ#~f>iJEGTO>C- zTaJw3sW0Da%DHVs zE5Tc7a@Bmkf|eu{8V7Iu8_MKviYOX7;io~`qvHYuF*+=qlT&Au86sD2K+9v!2)@zN z;@&Y0TT^=xsfI&$%xPGZVzuvbjQ0YP4&|ZB4q}jB0fF{nrlSIBibp$WxuQ?ad%ht< z6m!{M_jyQJLwS$Cnsfz(?}=yxWl9%(c;NMZpe!KBFGN8)4yhOfERkbC5fR_jQ2s7| z-TQNss4o{Chx7Em-LGbY5n~T`)?N4gM;(%L{W!}^`&p|kGIM_O4{}|H?NE4^@M)GG z1ttm`8UXqd&rem*jCR~<+52qy$ai*D`1l779Y@8nD`cXdr^2@J#HnRF%PVLZuvg|( zVWH34D6??3RbXfa)du!=o!vl2SPI$!WHpANld7brU zwkmVY=snrecSPoVVW3S}&pVOJ6F!ww3Ijnt3dcIU)-r+i6_`_hL|^)EytAui&Gxu~ zevCgP(e7CcazJSWgejYeY7KkVSKrWRzr$-5Ewi#YR>|iT3z>BqPZW<1)PygE1Jk@c zD7GZCxMYkJ5n|5Y8oj+(C`PQ9B}l)IIwnZ9A1X4wKTmcqT4U}xR_(bAUPbjqW$ABc&;EkvPm=1nU+Rh2Xo+{f z#ax7jFGUj*5gPM$&5VydFhFH{A9w+G-+)xuUQo9&d*E6la|{e<7vs%cxqtMA$NHY{ zOtOE#%Q7qd#Re;_?6v2%2o<@_m_y)hHmjN8i^Lo*RtDi~>Mz>mD$tzV6=%uIUs=Yn#(Z)Vp)U zggNh+Yv8Tk-jN}qtmHn$7T1y(lgd)0jDcjvq4g{t?|sOoK7{J-_~fI7d}YwcaORi_ zxKkur>dxc+lMj}CJoE7AwDW+UDp&Wfih{P!pfMsWk=RP>5W@f775(;j(j!e?AsokyHHTxbf%z3SU_*+ zj_d<;{%oFDZfDxDnr`mxylg5mPNkgS8p-X}OR(0Jxjg>~?+$Gf>iYyBa|2lFQiMWE zmgp1(g<217`M(^UhG&F=suR7Aa4yuh*8Ws@XSTikF4qTplLfg0v!i!QJUYs4y$(1a z75643ms%{-A~5TvdPP#b9sI5y_RqC_<*g4HS=I*(b zww~UbzKSPh7sXH<^jnMVn4qe<1>jvKf_8XL`krrgZ>_)gxNvKeegs)HbWTsv<;F#{ zJxRwBCvf$+uJzr{xw5%O>IE`Z4t(Icm{5Vqj*_@T7!CKGdsL(Ft$lA3EJ_dC?Hpz% z?e!oeoYWnr0DonMsS8I1^+jv6?y*2T@Tw1BElXHQ#<1CD|Lo+~x0Cf`P8+zoh1V}e z(C1CUcUEo9CUB{ZH@Gs5RSRYksB7qRo{2Rt>lS z10)?4ww~TvRrf(rDqIVt{Sem`paP&<#h@KBj_hbPN>NFG)0bj4N-gob zF^De0|R?;9rr<7lJ3w_t?VgLa%GQw^VAAU43y=UHU5B%T9^m+AeZwd z*6g*soDNO$1rks3H!w_L)(g$Ae9RFrU;{BvU*N&^+Sb+}%* z^}$dr(ye>MrG}Z%MHIn*y}u^9nucipiME5B3ZECS*r&u<<|%X$qLpL z2H!hQViPEQ`O7HJRygP^f;$PSwyum9G4b1u!lEMO%cSa)X)s0a{K_3yku>%?#J#D6 zobHH8{0ChE&wvxDvbA*R4eaQ7%TFP$a&h%(FGexgAeBhl0A;2j-JbL?Dz0IGk%_MS zHm6_gZOrSkWUL9{Oi(aVeaIj*rjLr`E1W`HG+X}i$PlgO!@F?g_^y7Y2+^yz)9xJ6 zPU9#DI4&?#>58Of-z9W{+W2MVBKEzJr7C0Vvk2gK6qYSYVD%Z`%L5FU{D=qkz|4qg z+{&vWmQ_m&R22W~?E3HW7$O!VVJz6G>VEsulfL}%E*l=C__X)2M*;;OcLW&@uC#j2 zpSljq`aKu_L5>u*D%&nkae0)ty5$k|iw3&RslOEYGXCHV#$joqzCKY zlDp_vGvwt2#pv3FggM18MUtE$Ts$H;1F!FjEM1r9|akl#Q|{(y}WOyPEdmozS}rl)~k&BR0lB_ zCM{Mp4NB`2qaKxH4tbq7xC~`H0TZ6x?iC#=;P4}bQbJpZedJtLWYkWO!?IcqR%;I7 zEwJz`sfg&r!bZ+9n)lmwy3ejV|C9}Pu}+z4U9+g^HBD}!2aE+0LU;L@k%$s5DMorc z6pOtf(F2w4y3yRqmV}=^1%qke(&)e)TYV*!68#LPsPJZhJq4YR=LQHhH6QZKwV!?> z_mE}+&Rw}_>)OBUd3I$`(lQ#qUuYC_^SaJZs=R}y85v>Ze7p`wsTrA2~Dn}YMsynX_z{!=@XBSiaJj8nq)kw8(QJX!XIkxH>jVk zdSk=-;$tJdg%3(!F)W<7^s5+fXw(BkgJ4vr*W0W)51nv7vZraQOFT8xe&+v4Zy2#j zdK76ZBP~+S{W=*z33H@tUy=-F0+vn<_fAWOBV`o;AWQtYWo`&lcO*8^wdh~$j9t|P zJ~eAv{gB1g2bzNzp~gzKrF7qmwD{76-s}FFbrc+MY*oevTDe)yuTL0D18};Z$lu>l z_{-GYT9%8*q^JWhrYZ=Uk-l6ZCRjaqnSW2Bw)e|h+dG*BC8b+l-Ru*3f-UAY=Uz;> zbSJ?pB$$gF#n*AQWVV=zl5Goj8I zr;qju*)m)*Y`(>|ZQi809h^SKU0ze}*cY@E8l_(_2&y^n>V@Pjk@88eu$S^eMDT+t zL1QM(Qz=D2ZVg9Yz8B?7P?IBJwW31%qYT4Dk{WaCGgV%K#ID*JUdS<0{V8{Cf|G+& zH!J4tThEe%ZN1L+f~pd`>f2#;T`P`@dO>Yx7k|M|t4RBmd5*NVxfux8-5F;$Rtm z{BkMy@BE20%s>h(GtxaQUYD0>M3c`nTU1nZ`6)%)cPmkmy8ly~f-b0kpKSKK(vPgZ z>$<}IPzhU0B!X1~q4)$+njCNLm&MRdzZ*;@12)#(O~u*0&B?ggTZ)ECj6x;xQ%Ff_ zEs39j`Avm@OV<*wN^VvgheZ)5-5go*vK70hnbXMFQi`yZmyE~=Y$kmRBh2`JBv%6P z9!jg76@Vle;>PH}V*FWgkzjj&oPyrG(-9uT)77U&vlbCVi6&udTM6vT-_>f_qL;)% zUuS&q@=R=A<#u1EY3_xQjs}PN_c8Ry1awEdllG{t#?#u!XUl3APbU`~8nI_kjDZOm zboF$p{5|(nNG2rML=KoyR#4|5UNcf=a8tV@+~}%iZ(!ZXQETe@b*OWkm>+IzwVW|s zn;}2UC*>l)4CgDu4%xU+2iL~46>^hpgKv5*yyPqe@V+4FdU|=EPles_YS{~HFEAGL zytiD6>tRN&YZ<;ApD*bWzW$S@StBXpA%>hzQZmn2sWT>qAHQmq)Fc4@2T6qT45Ciau;1}@OM4M1Yr?maoz5XZXlOd`CR}j)3{~V& zl?`hms=j(`*Y-QB!ZZxpYZj1`4@CYaeoVcN{UB`e9#^YElE^Ra0wO6Vtv`GvO|jqu z`ZK>@{&_Om?_>z$a=tJbb{Hed`;V+xsoi|WR=uGFSJ4g6ubK-a9rIofvm)bMj<5PO zEykKhR&pEHC>B~PBU)W3>?%|*C)+f~WJr;vX8FY3wQ+`H8mJ5I3cN}9GKD5$nURG8 z!dA*%KS?snKw)d1LrNBJ#62%FFYYcFct|T;y=)9`8V7bp#T%C~3X5QSK69ReZlBW$ zI2sIiciw7M)q3-a<)CJBcVs+mdB^Y6v$PkoH+*m)K1XFE&@}KxfXkK!A@+F*L3zZD zZ-aQb$7?|Wx*Db$b?do*qlwt=pxig-xr=1mKAQ0nRCtJA&C3y)Gj}jf@#rM_9uaai z{1)|N=kcytX4e$iGL&dS>J*?dwuKnsGAL0@r~h}-lP}{QhM4Q9_C*QQ1;;cu2mOYfBrf!KL23lPwN!$@ZKLLShgZ+uzmGLwj%eGE9LB-6h&G8ib-Js#s<9i z?l{lgKxSVZkyUyeMT9oDjqCS19&>j*WO7fB1X3@@d)m0i9Hge^bByAtKOS6#-r6|# z=HF8NB6%FOC@A!FN5Y$Hy$r&!lAJG17my1XS5=;E$b@c}UQOYI235hxGcn~mx;$oZ z;^i6=-r~>jI(<#w`5XL+Bnz7>Luz7jo6Erb?N}(OIIHZ=2R7Wq>&;D_SZKz}X%5@S zFQgQi8xXS31->4{E1Ej1j%*dLMm{JBU+1$Ob}OWu?_8X#Z3n@2_KuL8zOKW2gh`k1 zO{~(Z+nC8YDQ+Amz?BM{5Ob}i{S>1wl)2>>susmm5+HwU1yaVUTsIGjh~2R&9?$c=4(^JTkbWQn`?SZ%;DylwVMvrsA8%yVXXd z6QW|&8;4J}dShiP9|>=0otp`i|=pzE1dZ!DbRG4^_3?z0Mya3;42d zxLti;>84rEJyMJAA*j=V91g8ezT$HlRwMgUdnB?D_XW~q3j8q>bCX>zqRF91djJAC z5pz`%t9=|6m!6=Q#}G2tXg(E!_c7v~EfD7v==-rAh?enjSS zQ2*U?)^d4SUcY+lzb`mgk9OR-NgM4LZt>dzZ){FtqZ)|``g)>5Bc14=g@}fli)z6*`*zye%Dih6cwpLtv3yzU~+kTzI*$h zQaMPh-PXuYu?EG>>RvVD`L}}Vk69*EPiR$Z)6mJAW>^=WC*-4Hv%)aXYtvRZFKa^a zFxgzy73p$0;xM=VbGKo4U)j{Sq-DQTFWBF3Gww2tZ-z~%{g(mi&GDJ1Jp)(jp+CC(^ z@WkLvEu+lL+1e=%vg(~#$i=M6pt=4r)#?c)jw}*ZAYpm0Tw)0Xh#)PmjcW-uv_&D4 z_FWvJK#yyjW;5O36AvrX0m`91`VJ38hPFZQY&=>m65t*7d=H2@qC&oVW5NY>ne+uL z^r@htS3E=#5dPjIKh0KLe&WXmqbop4-|Jt}e~y&C(7&V~j{6jsrRbzunM*d+4Jca; zq|vT9FbSJl>X;8a<1LKo9AUHtXg8CObF%(XPV-oBB#TLhr%XVo$AgtwFz|#E-68b- z!k|{S<2jaEZ6ODc!1`N|3}jn{B?}heuZ8$Ym}Ks`$jYXJ56zNjh@p1^hJT z?Ax7N*n9*?@p-83aHVLYe@6Ja&69a8DDUaz_Qx@1g|zl|fLXuX@E}qs{^%bEZo%bdxDlm>g_m>{>Rm0R0u^9y_EifhV(B7UzZ6k33w z8>-3DC^gMmqU%_}p_|j~|kIuRYD1*$B+4cAWZAvez-WUTwZ& z3B&Q=qh~?u7a>_PPiJ*HiV@vn(rMj>&1O{fa~2?zL$PCW9w%Zi;m0xUh$fa#yf4S z`WR(4d*wY&3Gzk!yk__)k23%iy8{{dpt^MkIe0%h#|Lg6)($F!pya9f{69{(--^tokEf z@06W6!g1!C_wpp=wCt}gB<}dx|GM-)4`}xE(OLgLx8djiQaJy|$rLp5Fvj=Lj$1Y3 zJf&5_!H~99T<-hZ(BMbI=6`RUtxv^}6vY2)^H2S{))kCl^3rF$yxwh*;yQWtmhr@MANW9aa($&m_6{g= z7J?J5gqw)xT4HL26~=Ht!OWVp0YDKY%@GoM0o5f?2(Du9hCW z+<%TO+96y|U>lOG0K8@AF`;kQYoTO?El2HoOpjz7a(;{>VcP$6oBzB+zz4q_{-%WJ z;NTa4yOaLjQ?TI$d$Yq@fHpFH@HO{5T|))0R6*evn!l`a$A2#RfA?D$kE!kS?HIIM z^K?Us{l0}6Q6isfG-D{4x7u8MOzW!I!y$<4wg-zg7`9koIyDg_fq|j18@VwgdNcKQ zkyV*%2s;m3!(b7)D7ia%(#vJ&J`vsPJm1i?=@J#YW{vq~Gr!NVC4-;E5dSZ4>Oaqr z!b2YREC2~`Qpb~f#_vWMFjefA(d^{tu>ZM;*UDx6Jw~cp&Ve4>QpUQrEQh3Sa;~ra zhdA51c;gF(S-mL|%Ji3Gbh0QP zivF$%rI2eSl`UT)9p3uOtkm4NLkT5;>^~3k?>!v~5~$*}lM}jg*m6{eO6ILxJ{ZF2 zyWby-*qJ5@o=}r$@$t)_=ZHb~>b^MWy5DELmzpEEKUFdIb6(T?k(4&6xlnEyN{O~~ z)9=bhY~m2v#p%*rqpGPfuNXoat)iz}c;X=smixu{?&;xR#c;60om?;jGU*SHAjIa{ zgD*@aQP%us6NChNkVaOM>=GbR^{|O@S1$`mU#j|A^JSL$`W<=e)*mm2aQ^Gj-~I!l zygTkbALbYvCul!@akFnO!ZOHC`lvwnms6E`UV&r+HHsr&^^2~?-*``Za}|uz zc>YOySvWm2&`OGsG)0FB*~6LH+90|||J8V%!=D-g8kzO#$H7MTPS?zODoaz!i&7yU zSw#PGBcUc|l$!IRi`)Y+j+XvGdmIxleExF>$e%v=F%(ra$-$WTvt!94q&sc=*CG-+ z2iI2vbrWDu(p*Q)P5!|MonOf1z&golxWT9Wzi$5f@#bXLv1B<$_nSte`fnQmo(k`y zSgi}ag7o4G{W^Mlp>8K}W=cMiHJ}36s_X5cNmu)28AjKXGF7+C66}mKF2YU9MZ6iW z)Mizd%Oq6!weIkSxLn8w*OQCO4VxwQU2{w%?0Mh{4BpqK~*mj>5LcX6k6vl2U zf$YJvMb80u5n)E{UYm)jN~TtWyX+Q;wzu3m3AuKlcpn5|@Kgm-4?1Pq&zG=@u#pfq znT)oj{IGdMZ9_jr1!v|iL)Htdb)i_C%D(?4kZhFUGV{JK9y zvqpTeA&JRw^QFtMb0|gTG~8jaL6x$@go@=QqgtE5udJ<)flplbHoxNOxc(S|O*!@b_|t7w<-z0;wlAyKP?NF#TwY>PWYl;1J+Z(Vvp;)b zX5w`@$F6eXwn8a*eNCPU44gUH2}qx$JmAoOKJ)C93sd3wR`QXq;rt7$H`E#k22iOH z0~qIRSffutqffc5{2lq{Xr6#&LICJIi}OrLo+;tJC3`w5T-GzHf$Q!Ml4=FkWuhV zV0WsF6B$z^T#qxZV1^DxFD{7Ljl3o>twMbM&NyXpX<>l}Iz|vNp|E&N3PpK#cN;HS zJW(n5)Ab>3Em9`~a1eq|KoQ{N5x{6$aKN7HYdHIl>gtvbvrtrP$sD%XSF2fy+w;8F zUgshuw2YLnEjE`=XB4dHy~w9MlN-AvjR>VyG&8I#vQddh#7~a0U0@$gtk+ptO0t@0 zh)|ro>6LV`+)KVWeb!sxd-arra~m(=_jsG~WBfsRxT|Gs0!c9Pqz2*$9{XQ;Z>5@l z-}$db>oq@o;Yci^vgE)UD*htE-`Zg&(^sN(dQPhOaNwN5eP(mS%Ej=^+6;Z?8~ctb zk`tzHn5#R8nXRse!~(MD5-RWc8`yB~?z4T?Iap(7W}dNGfnD9pfeVX_Oh(HFl5T=^NjEHbM)jBdJM2b0~EDMqBvW4*3D zg5JEfuMnJNw&-ZwB$fTrsxd`GWO!YcPPM8w)3BB^a_SB`_(q*7R22iHYunw;R4F&4 zt3a*kf7Wr%3|Iy|IPQ*#ctIZu{7zDV`A0`yd_sN?v;SK%r~!?U6GA-`3zEjrX$?#3 zt{E1&78f0kZj6k2U-)E+nN8-%#!c{vb_ze!)AB>dmIe-q)?ThJ#_~uuitd)-Xg&{5G;Uw8XC%j2>4YEU&824ToxP6}Ruo7+w10nA!iC+A@*Rh#v7u z+}kU$FP}!5g_xwUgHULjDw(-ecQ#X*J|qidq(Xc1!L)DbOU{OzGZQ)NKE+NtDalm> z@_v#C^%%ai66D>@9dd0)L-k{IIOR1yyNf4B`k0r&=|KE%jSujM7z`!HM*`laiYU}}cH&B6*v&{m zqlrcCRCwji;f1T4wWokL^qtc(6I&?^9duJtT1*RJ*|%l=)iI2{gF`bWIK@HIaT5aI zrQd4sLp976_TR}C0op1@qxf?UL*NQ-e_JvAbCE_ebh1G1d{D_ZuKj`wa`p#{XGwI^ zskMKoM%)r1)wF@z_<^*H@cTsfe2@faOz*j3-ka~cYp=m;`~B6%ct<)vITWldgW4ZW2T z-?+e86?jeA=y#lzgIvJKe(d^^AX3Rk03kro-FDN?82tXw$mb9^KI^;J58Lc`5b}JB zf?-&X=KTn&;O0n947OglHma^fy(oF}WJ>GN6q zmeFLLg@G<&IM6OJCk6HvC)N*&Ey&D6!raAE5*IrQEOYPh+`S%cowjM_nR%Dv08B8g zAq$Oxu(3yPOx0O_s-p2|>qyZO&x&7j6dS|celJ!|$#=sAy)k(Is| zGIR2+yeaK|aW9JzUmC|d(C)j>yQ2zx;fn-qRGJYCi$%EZbwYWE6W|t6Tw(s+Z<|yz zG*pV@xN>=R^4L~O4NB-yha!_&fA1^R2P%GcorP0!_F?lS?kH<{!6=uL58YOi z)scqNy8-;wJtA>0)S4$ZRGl8t_b67RgSwbJZQ9TELpnz??rW=k82Ma9L$vt7wb?#C zSz|+P;eWp>2%+^TW_^6szeOLT0^yk2MJQZmn{UKq9cd~#nYDX)&NDKzKq_YoL&{4h zLEHw%C+kTmucz^oEj;Hq6un=Tk!+0jj1ZvjYWZ%Wo=Pf;S)^RnMy6x8GY0q%GH`!$ zvuY@EM`Fh+^R(A;x+@S39&+QMR{h z9GwOxy929}y}o@Xs_#?jJiUO90ydb;-^t%x(HO$*wq-!sqXwZK*TG6gdj9u$q7I*k zfrkkZYrfxC^Qwe;VL*LMcPK&xDa$dhRV^%}?!ET|%84M1ScdYbH#D?#4bL0n>eu?7 zqL5Qh16x#ElumlwcMgD_;Yq!^%EVc@Q1jX<6PGPZn5)lC$_*gogdoTf?p*AG(5Q7; zWJK0(lW##?=deW}Y$BB)sHZ|?>f0PcSRdD#TyB|Dh8l{lj8?PT0(G7vCR%f>|8C7l z=o@}(oSx<~hSte-x!^dKCihQr;y5XC2o1!toi%8TL^^P(MN#~neDOHig(05_k!Er} zpBPc>;TN!+Xfj4%P5wrcd4K~qzd`7SYZFCKiBhuF2$|3-7DaCC(Y=~il2t@)tzh9J zQeCQdtJgMXAvQotGQkQNc>d^EPXF~qA~%-niDC-#^+zj0W%UjxW)Wp#BrrTCG~71h z8&!Oc9F{9+QBLiezgdjMO1p=p+>(zZAb!OMdo6r9-C!5$wYIkQ+dESz=r?S6J8sWI zNkX^%r=6pfEt7n+cfd(nJI{hkX=;L(uKH9um7ayMGdIL?2FI(xSn;S^(cWwKg+`*K zh8~Bz_=vTu8%|DcL;7S+E22-xSOGbf*7yZ*V#N?dn-%=t?y0(wD;K=cyqM?4D{WZp;z#D}(mVm@Pr(UfTe-;T$d)Me<>9!A(I?To_>%racGtKp!S_{Lt&ZN&s z%@vcaz+?uzpop?_Z+FGyT}dRVQx3dvUKj$d!Y5(VpQP_%FDQQpk;|r}_$KygPx9^E zUUEe15RN>lFmnM|FCI1BE+<`(hj6kVIke;}3wV>vHcZ2< z;^@tjUViz-<{A(RDq=eMGF!OkGgK^pubcij_Uw+FCN9Pbks7vR#Y0{OtTQjMch0%5 zx(_LD0LMzFHJRazgv*c_{Z%;<6g;!^sI5rkkV0I3J4HxW{r%SHcRio{>eG_5-*#0` z*1AiKgZ}eNIh@w6tEpMqP^Fq&X84$38S~d0ByBY1TY2_DhsV3=@+2HJQL#T)7{uOt zI=c6T(^0$@06LGl>~2u<3OuwKhRouMu4?V|F2^yj8<9WtN40JTrSVezV%J&L`H4Y@c8_-!>G1FKnA;XWoktr6R%niw_nBPH zf7qy&^F^LlvI7?ID~q-h3?+jEe} zGH>inu&@Y&wLHy?C;L(310vS$H{eDD-x?#_+b6f^4>f4@#4#@+mowr*$a#zCVS}>K z{%!`NXIm>xgkc7Bf~(~Njo5_uKwR#WSY%m0YE7;*`7%B-RR{1RJIMLRCfD0mKMD5! zi6?*b&f=Wzl+K;Q87k! z1#B(LBe-G>Oa3}!JZt=U;34e$i1!ic(SW77^J(?$k#Y@$$Ijz=LS#IyOGLU=HllWH zpu*pK`?%G-AN^bQNE;E7W|UxDYJ^$@Z1nvxZ%Ui#qKHE*{fhSF+#~<>Y;6V-TX*>0 z+CyaCjQbp}j>`UGGoHe9!6&?K5Cip@U|89BmTL=LR7K+o3#dVm(OY&SKAK$NOJl8r`9LKTN8v)|%z8!4U{ag0|; zab73AkB~k6Ps4)ay$x0cs0!caUsbZTcQgoZ%Gfu2yD?DqEL?E-yvij#5@@o= zdYn`V^`y(u)fRKuO3!l=79SNU9(_4d^v8U}{7{+{)fQ_!X&|n$JDAgylW=i(4LRR` z+O)9sEI3a@8_GrPoNI$lmKb{rTO$pUyPy}|h*M$X)7x8{cTh|MLd=h16pNJvO&a{*eWCp_PG_-#GcJ-RAeFgZ8<@l9K81)S~(Rx;x1alHJ$(ya=_nRFb>v>Ge99f4vmvwFe-*!hM zSiG4~1c^aK1$73hsr<(+C$dc=k``huQNnXrjjiUs#n~8VKdOu#U;nFlU0(?&RTo;e zfO9Cz;&Uy1>|S%^I91$-X9q(eFi-k&!i2~EurDgM&F*b1mrtJ19Vkq(R+?usMpgfv8&;IhjmnD7(Nrh zT=Oz)R?5X|&y0eAW)-p09P5+N^M;T~!R6igrbtx19oBe6!1io=^2siz_fC;_<}45o>pGTBe=kc?Q!+lL0V1U()Ck{qecnnw{FlTG~j{P}gw zNiRa|FY-rWl`LU2ZrfU%+soW+Nd*gLrWK2FTWES*G*OyM@2fcUg^+hKq{itr<3)1OSLg zu5|zrxfY-_kK%*q_E0EI=S-nUq>m(&e2b^wnd59D>9-?Miva&8O|?B6;+6WiUa?%6 zLPt@gWgd6Ar^yFA!SUx}0a?du>R_F{ob#3&En$%Vo%CmfXd7=7rkrx&C}=u9#EIHDP&AaC_~$x zQ-rjh^4sk5i6uFJTTX5&3(nlD2wre`nt)FA{IsEgJS(zBz6c-%;$b}PWny;@hm*R% z`IjxSl+O&an=Zc)l4|_w*z(^@V85rUzH5ub$_4wEwd_4b$E?YIPx0EqtV>uTx7d)! zb|~2g^)jR?u;9ltuh9A>-THl@MwNLnGgo2`Ifyq z8cnvVD1iw{5P@%UT(CxKzYhcZUDk z2=qT5ZhNw`y3zW4=QL0E3w9KH)0E+A^>YV3c4jiLpev0xp7hB8tYF#`XIF~<#!is4 z7{+R`j#;~+W@4Rhay;Y=qrqjEf6Y!(P@L=7R2K-+!VWYz_`w4<7M~B`tnBDa&KexX zV)kAJt*BU(VfhPMH~?iL?=RyS<|4`EOBd7o<|sDzz1l^6&g->!W<8bZsSgY;?fzoe zHX+EskjlL&;9(57S~XOA=uuVH0`_Hxi7v&6g}A}zC+0-iX8Hr zpH>z(EcQ5{q$dRo>|%)R%fqN}MExD$t#c#2j0_jf8MAdd8PY;!oRW_1GW|rfIfD%R z!TKRfr*4If&sB&(5?tTyC+!q};__Gi$>J^ zhPC8OWadbh@y^&W2iLu$yE&}1A1!Pv$_4MsOnusx%pF? z$au_Kx;(!bZF59|OK5w??*k{R+NOGQ`x%dK)t4y0e)GAo9)a8u8?>kKr;dnj=i6A@ zEJS07Zq(MHXTCE>g!!JS z-kkP|%;8nWL20K)%w>moX_V4W=iPI*(6Y?>zGx<8(Z~hkthna%?0!n^4M)BZi^7go zdrl)?b&zo$?PPq-c{0{;YulQ$Rns{mD=cD2@!sjBi~`qdWuU?n10d!n zDQu{fqY5S8FbFvJVchT<@bfB(=_1m3$+v|*6# zq^NZmYLLyXC*e$z)vy@rDe>jKAm&UUy9!p65zgL6G(faAk4AmwlqcQQw?e(hPgOKD z%Td{{46Kr3ON{hfXfSB^#$s-H`ga!Onqv4)&CaA)g27{4 zR1S*@nH-7>p3Zo5->|rLZMcjaFe#vvW0bK1)R4kNTiO4_?mQ4pAauj_w8{lOj8e_( z>vFnUYI*e-2muSW=m83bxw)6Cv#)LFPN3AUj)qId`J=DU{7ac8XzUu7gd~u6LeO5W ziZM%y+Cn1gd6`vrNL$hIpJ))nuwI~CKylwcox&dJmDtF@=jf0^?*{9tI_pmAqw%|t zEy9@)=+K=NEENRChGQLBjlfS6hW$SGWuk^YS3`MDk}P(F?sFl|9`_F}eo2Nt-U6@C zCV;x5%v+o3*Cg=g?ZasMJQv3HWE3sS7-y#vn zv+-4^JNJ(OX*q5GWG&&-_B;=R*o~wMQ#XvcYWc-@E1{k-7x-&eXwGCkWc{`WDlk}=d7DD)&517cNj0PDAzdm3D;|%j}I(MKsVZPQjKk= zc8Xtj?m2?ki)#2esQR{-$-8dscziiE|M1-D_%( zWH*r2hI94w1cKia5B4oYy^a=BAAckN^i&~#`It5>vuu0vuIwFI1IVCN4mi#N<_>**$ zRI1Kv0^yb6T}Mt;FE3l3T>GCdxyVES|4;wBc1sf-fJtO%W7*_7)u4>}XmQrS0op)( zZLgo+Kl~ufx#*`bw{+6Y%IZ}r+@-YQ)%s!KTx7T1>WXv-kDTIe8RPY3xQqx=)ad;T zBKaIIslp=Vi?m+!p#_0o+}y!&!PRFAm1;lvq|)X-o(T2>E_~zxlbeqmq(9amB0e8$ z*(<#gr!2k+1`x)-ld*-Xmkyz0W2K|h}{M0l(TTyAOp$iTd4F`AI~oKsdm z`E3y3K7)6A_fY`0YTY0aq4SVkrOb!r-aR5}F$tZrPdb$}(72N#WYqSPtN+<)0PEKG z$1>5+pFe619xr2itw`VKgeZy~Hz95Gj46E7O`U3{Ex5 z$ZF&i3)}5=(b(;Z&OUmY>b5GVqK^Re9_p}7rzcVHwYu`w+3oVEuLd zQK{r?HFMat=YipI^;YdK{dV>ux2mQq9C*L>f zLjW(aPO}Lqf)Nh^Dmc##(>hlu;~k9`8p5>pPz9pRd&1N5%=$B4RCwNt;aZE*mp&mw z^;1!FOs+qYIuJ$gO?+AoDZ6c?>QSd;yDFZv*xS=(x2EpJ%Qt z0JSD{x9{=lbk*!QqW$ zr7cM{{WtU<3ZI0#W!spDC_oqQTUAw7<4&ofelZNJNyocjMDRAqVz4TJV-5fw;OBFgHAfU@W4V`k69}gt7OKIsXC3E z8sclApS>-kNNGFG@gu(*F*S!qG{I;eeeY}Y6FbHa$@FZsp>RufLmn_bSqR%wR`Wqr zFIpcB&esm|H-M|G4D^I$SvL5gb)*>!UPn>dkIrj@0;{JZ&Z6}{g^yoatpRlj@xui$ zBQ9RFB8SYM^F;$Yga~|+2kaW~MH_D01P81TO5KHm8XoSAXqyn53C(NLUX4MbKcjxJ zFUfv9dMvqB*To_Dqwh*cMi0LOc^T@*gx)IJY#Bk=nFbG@Mk4Iol$Zv#zq^c zQ>A0>3xHgPOzuK^ooF{~lwf7Kpwd8mG?Pf-79_i`J=zP&tNx}`US5Ntc;V#~<``x_ zSs}5SGgdFF8cp!$V2Ytu6f2obz>$CDXMZvj%-ZDcKJ~$B$8r%2Ev|pugQ5$*=%hOG`PJPCVD%0cuIiUrhFF7|))XfRc;=!n_jG~P z)V@7cpl{d~MMsT}i9h_X+9n;FN%E1RF}&HZ43t~xxK-}dsQ=tSY; z_hVhZ?wxfeA-kjXc7U|wqdpJ}oT@S>P==n5Q!!4SExn>xQ~Tn!)_Gt>|C0uY>$mz{ z_h3NH3}#>U4%=Td=Bu633MvaA*tp%mQ-G$(7cX?=V%gfKJ<^PW@Mu zZ?>K@{LfQH3|aw?^L*d?8!^QHs^v;LWI1E{L>0)xRDS}oA*dNa4%E>hq5%paOBvXC z-7r;&NLES+%0{c<4)76HY3FlA+0(B)&5>Qd`t9_kf))upjTizqmruRnS3EJhB|n2O#2TLI zHzc#*N5vHy7b^TI<}F}02c@i?b(SxT-3+we6VzBZUO(@N963oNo_Vf4R5F#PKsi)A{=f0Re*S+JQ<(3 zeL$J{{p>MCUbNrmJrQ#iLVe$UHk;=2ty_$%&1WoWl;6Jl+m^k4RDzFT>?jc7)Zk0X-tVZ4m<`2C$G8qaFAiINGx2u)i5*9SI za~;~QPvs>?$R?ujv;HiL67)&8Ne$*Lfpc};<{(nT-d=&BAN}GYI4W8>=(c-eWc2|m3HZk+ZJHmhLA`I0~nx^FwS1SjK zuY&_xZy zKQh4Q|LvKk;`0IgT+W)s8~W(L#wqSr2Ov9q`g$3+GBF^-;$zSYfBBH*){}h`pbL@$ z03MM4(`5ScP{k{(>5vT#S@Z@<=zjv$KW|3OasGS0@tiKI&gcB9&OWE3BMiwrr=M+{ zZ;JF}aMK6Owj}C1D^0I{+^b>q>QmKT_Ck@hn6x^V5)x{7!+tMYU41?7Zc411$s#qU zQ8nv6G&nOjTNVt~_=;Pb2^O>;H@(W!U&LgxLiZubVTnMLUh0Y9q+0>d__~dH(Kc}$;k>iI zB32Af))Vcqo9he5KPn2OT7+d4N+=c5UWCMPvQ=r6{xz&|Vs0YX64Occcw<~uxfqnz zcle2HG9gaE5f^$|?(*yV${T{UHwf(mR zoVcU16PEg0HC8jtB_rt2ZE2YQMD7vU|Ij4f$}XAJnCN4ufG7w>6fplAml~MN!2qb3 zoFg(dV`z=NYq0Fz(fiqlxDJ1~_ z5?CzRb-g^TLn&<`WA>{f_>6MZwuw?YE?UGFvytxJU;p832sZ0FOjRAZ&XRnmMc8eS zF#n|ci*XQ)ej`!UGwb!A((0>T z;j0U^LFZegoryOTqI@>LX2vbAZl5-I&Y#L+m(&7jfEd^wA~U4U1>q9?*j z4Th+v5uM$9Zkz{JIlNe>j~i?>ne`Gd;-XK^p><5C=?__b;jq@3eKy_^;Yc0Yl1}E( ztSZzh97@W-cAIUo`A!MQ`$$uWD?}Q|1@LnOZG6!`^LP0j{us)G{>)LC=;54MNAHS1 zl-k{=7_ao|RwXNt)mu?jZytdQ7@bE(*4CLoL^T#(oSygj~|UEv8q0#_D5zqF8Xqx*gfimXGSTvngKuUWnCTDQtBOS5frv=A{lrP(^yh}f{z=p-8v&S z2MV1M!CPgfn3Gz&=?W968t{|Jr;p~HGjh6yksbFNKy2oom*xJMZ;zB0=9HvP%on+j z%Uae%s1ID6x(_4Y=!Y~bzsbC{1xwHs2Bf(zF+W*B#W&zBQt=3oOl9ox_AjAUrQi}r zgy5!UTdYId8Dpf_mTcpxn4%S$yP;kOv?rij1<+?hvc^7Fld;f!i)RXre0a3u)vpzs zoaY-H&iR$wq06(SxqpSHmVn5e{aI+DF-hTWlbL!l{mVeH4Hr7_m}275jV>BUOqW-BbE{I}d{MhkhRah9 z)N#gdv8RJacC@f`xq$_5kvqVhk@VdBr%|Ru3W*^`nD#Q7jFn4 zrkf5-ydXxlUIW->K(gSVg09`N44^|yemE%O5wUF|MWhe=O$`3+vQC3O9+|c`?*@!i z?b}A`>49NkOBCJ73vB&>gE_{t1-%mYwowGAEn!wBk=?4vg1UCa5$PDs2W#i{jgM;O z`!uyc?-p*6t}R7uZ1ewE4oQGUhHl46YvYPbYA!<{kk(qTOta<+(cUS)@piAnjC%~XXFWMw^U zUlINUITKXi+yc7JTbWTk?8$og4N?w)LOo4m=`a7(K_MNHn=x z@_T6X!9`gL*C7h+8e|vcD@_9`zMd^#9_WA%w(^{eiSZ^Vys=7tMmX~Gdmy`epC^wi z5^a^O_*F0tjaH-M>+dLnCc~NnC`^y!PFBbx8jrKyHLDn!JR9F5{{bv9^2m-I2v!DW zfF-uP0W2~7KbLq&H9!^!3jMT0a*67*S@cu#PFv#&n161fd->ZRo>+Fh4c{Zm;iA(sf4HNTE`0n7s938V zGQIK6ugB!D<06>nnDtC9g#!rd0{)@dk9@3%-sOO~tnr)C160KayigVd)0t*~AtoJi z1|wXI?f*fRO`mOffb4O*h>U3T<3@CDRg{ekuB@Poon}IL+i${ zKV&Pq&u^_QK?S|9ep?Jz^o0Nn);P||WZ=Z9Lvm);hXrQ^IN$rXrw)AWnDTF5&15R7 zJZJ1DZvZCW2*2N-d9yMqVo0yK5^4ncnY=L3p*ChL-Lz)fv!8Yg;eK$&`@^H`j`jvi zZ<&dCY&jVAt>Ms(`1KyJm}!BB8^h65ZaZ*jv?PT6F+yeOVx6}>W zrA^kTt5)@p<E+R0 z0w5Y@?eAKyb1K8X#x0DC@c+C%P<;dn5?D=Kbk23!;&|p0h5(B3s!J>?L=0b?Z`)r{ z?eTn2-$W|^^Y>9(H(#={hUVlUPbs?q{-DyWe;OkADh;S;;Lx{1D2(JTfbi?wz`NA( z10sLi_i(;<<J9oFX=y0U4Q-=cf_AB&CK#%-3l;#>~L{!(Iw}&rrdb)AGiJej@F_V z$34%sc#$%n>)K@vQl)E#?X7JeL~t!<*uH=`(78Id;x=Nv_O_Be4FnDt_->wgQT;FC zDR8Bi8vnnrMJqopI{9w8``HfX6=3$tm;;)$w1qg0k2I*a1uxt(PVdiqZQ{R4G$CxS z?!?&u?nR(rIhg=}lAH!Exo*wb-MA+G?&8Pxs)h(K0$>vbWuWZm@}2JAyuciq(TV+$ z5c%_Cef6)gc&$9Q1uy^cDBi-@!Ry;@2r%d@?IFKl;EdztSTZKP_WjYX zS2#}Y+TVY0o4nioZ%T62&A%`6i1C$3wYTKm-$C{gofB^!0@95ojB#s_axuPFMj;m@K+8mbqvDhVjB#n4x){^O$nyW8p|u`YKvP+9Ac&1@Bj zz31EZ`2EER5h2b1{8&un1OcWb&1Pezp_0P?cD=iQU$5bZN-!5~wlZ!!(`U;2RW&xf ztcKTK`iw~Y%hLaS>0f>oPL~%Lp3hPK2XM2l*2PvMzZ(L6`&XAWr+%x$Nu5>?xx7(_ zT^rh5MqCmmRQ72r#7=LW*WU(4@ufJWlEL|*X!gS0%lDM*>W zU_l7rev>F!@@ph8t8oCW|NjHYKSL$R&H7Meri!u61t%q)=Ruk#`Ei=5xOHQa-lvJe zx}O9S_}SyX`J;f?06Y5#P8BuL!*EWm|h`&ZG~fD59?eOUm5bRL-}YA;oEUdJ~OH~E*ECD!%~EQ zEZ}~ptI6OCIf7qA5`o!F1B1a+Zy0W@m@aZz*0&fP+vgyG)+W^XZg_H?#9bo$<2!M) zoH~6Zp=l<2KIZX70*)64-0s-dDbcrwuOgP=S&b_q>PUc#e}$Hpmeiuu8pehgUbP&| za%GC2F)}&u%v!Db>^yRA`cw7#^Pv8Id&z;rc#wmR5gh^Ot;mkef*a7v@* zbj>Y>8)>DVX&90c6TJ~ea7CbAsV@F&B*m1Y#Es|55!F%0r*a_x{M#eq?pL_T;)m!F z3i^#-cXi`Tq{!Ce1aI6vVzQB-5WV7)C1?=~w*&@|7)&X7iZQm~ku+T<*_;5=ZYqZe z(oucu%fc?Qrhf)nti+Vl=UGqwUytO^m+!9Ma(;A60-IAiX3bw62rxLRo=0qUUQ)Q@ z&1hxE{d|s6lPl12N!6BAJ3dXPy4FfNy~2@J(NXK{eXx?1`si`kO-|lkX{INg90t$X z@hg^>Wfd4GUru-N89t{-$eiU2v108Pp zZ7|l-MPVgsZo}aez&pBsX^GpLqkDBfsrvu*esAA$rmAXuK_QFK9t`1drBO66f-A}S zgv}n?Ig%U)3AV{kMP6-D-rS{$25TnU%BEvo8pr;!pKX%#8Qg+h;`_1ytuC`FTxXI{ zHMB!T& ze&y(%w4eK#a=^=2s7HY@g8!&ZMX-tBSVB$$#{r|OnDgeF$Z}NzBMr=TZ1Fwv#bDQr(5SZ6%HCsEfJX)8%jqI`mB1UY*8O-`o_=xRaJ-COm_i| zqNLMj)BFhmUR|$3!1qOS1ON>1meafTNKwNKxe4sN4Ivq5-YMOVwFlP%W{r|#zsa&B zTr*4ZOc4Q1$6)WISG}t{yQmBc9T2k60mZJHOCEq+0a;~blK%e5#GwNR5pu>bMT4tt zPMI`5h9I}@oZ#>ok+@0owO#7}-fc1ik&pJ4+CQT;K}VX^t{W<6?L+~OCeI*s%d-dm zr>*k(EzQp&x|0Op;vFUO@HP{(Hs>ZU`Kr9utZ6t5z2E46!ehF4K5^Uh8@GsLE`4eD zCD-VRgs}bA(!=zS{1BQW(XnD38&lKva)9!U1=O}gT-t2qNS7kd#%y#7Z0{9Kdxjj! zj_vc?&$5>z1aID-a@?BjMZ7kIZkUQjF_8UxzKQ9wdo@25)a1FQVq({K?OOZcSjV@t zs-?6?9GImrNKe&!X`fY;`vd4JdiZJUuRf#MPTUdWVqo`y;$lmaSs}15<_W5=C?Ivs zYP~I=#>be@9BS{uSfl7TaK?Y~zA@0@0CpRr;=j2(Zv&U~NlMDd@gtpIQCldU^92z~ z-lj*r<%ts5%_4f0^kzdPI5}LsHOe6-ocj7o9*#Y7`1mQZl;N1N@JM0@9Z(}>74aFT z_n7>e8S=-(zFtkkn}(mhLUWo#`_;uZUN)WG4<4!T%zTwx8<(}c9Q(g757Ffk(dNNg zKN=W98?>0%kfg(cO zlt9rKR@UCPBRM|PoLK}GV?S&gR7&<S>;K&Vb9OiN0|uDn?)m|Pv^q5 ziQ*>A$&vr92=a(#U6%NysO_xCCDhv6ds>$)58&*)5Sj2tR5ms~doR}dWMGX-+A=i%HKJP%=HUjSQB%;hhT&86t(j#_F<@OejunG1S$}j`_0ew3%L&CEoA>jSyH0zG4Dv=|JiU05U4F29<6%KT>4&73~<%l}p#O4RytS^@Ev*>swdl8Qdb_I^N|9ZXx z=u-9i*}#nryqYDD?tuwqd_%iII``R!*7&oaQ~6=K0Y~RvanMOBU0popxeUGx<5AxQc0mN1+*Dbcv)4*98G=>-GB9DjGhw?GaF>=W@H8Q zL~N$XbOU)Gj(i^_%_>bHQ40kkhTIQDvk#!}(WfYdbrite7AXw(&+@80d^=)MU=Mfl z4y9XE!dHbJa9d6#Hrq3-Er)VFpm6*u2$1gMLL8D*sxIDmtTy%f%q-AUUKnP{P+V6G z)5}O%;}!B?oU77*qEPMLbazbmwQv?GOx)1oT*sh!@T~Lp7l4E2Yz)BKS{R>DhaBb}%#lE6Gk__4phu77RRE1MYWQh~B~yM*xqDDqyXGn7l5C&Bh3wV@$jZ;kopW?Yq~`dtV?5%JL-t`53QVTMup^=|tJ2 zN}RS6orSGj{CS9u8UUxS+CzQH%UydWrM#ve#%VM$@cTwyiAhU!A(ep@UqgVY7)5SM z>oUEAs4&_o(MGeOwpY;)o_8}v0Z`Cocf)1pQ~Uum3;t;PQS|mi3T-1 zM?@ys(%%*sF)KwFMA>+qPV}oBOMV2f4@K*hC#=f~g0g$2AL?bUN0YZ@?A|+oek%UG&fx7WV%nkyeDSk#eBCCq9Uh@qhVYDc%`Q@QtChoCrWEuoX%VV z1<5qs=(u8KqX#4F@lY4QuN0G)aUVZm%*@=~l3k!M^}^G*3T(d4yu zF;ry@DA_^dpVM3y9d_@JXC^N{4Wf6^`@`VN!$5KL$g2+etL{aDR5EOCTG%8HdCQ^? zH{Ex`@ZtQ$AC}sQc!D|f4GmCxjyYRnM}g}xRQbbkZ^sJEnv>1KGy?MFWT5X5hl9#yg=fHG)H=Us}oZYjR=xoYbv3uk;cTiMzCcmGRUp^q$vv}*LzLUFVW5ZA4qh2WE^FKp7l zK)hvujR!!O)e?*66iwF9d zVCNg%ymt3YdAI#Nx!_~h+Zcyn!dp0nm70?e>wk^ita$`Ne7v}E?StEQ27s`4Eeqi} zAB`fr#?3a6@F)r*>d2*TsAE>Iy|rz>%r@?fDX_0Ta+`@DPnLh{q+k)LRyCb%S<|;t`O*T3 zQQ~;|W^6vWAy>J^%fL0if8cB^N5n3!+2~B)h(P%8rA_lQqqY*gTV8p?(2}?}{x|jt zn0$deHC%Jr{M$@<^SMfJc}Q@@G$$t&P>I-1%W6z_%aam(bL8335>T?EFPCb>nnb_* zCPYHq5|e8{yX=##8k`5GcmbNYv3npi^?QWwe*4%n1&PB=l12#iV|pUpAJe_8ZE5)h z4DyE+^_Wb7J)eHFhOV!aEk@PE4~E^27C*Vpj3xLYjf<=rzrb^zl|cJox8u#dR^z}c zZ$5(mj5!_l9&-JHG;DN}pRzMPq&D4Xb<+W8j^fYQ>HKZ`4zmMqd(g8_-bk0AOY&sI zD?PM~q3iLa0Y>+5i?y9tKR=H^X)MjYSe(7YcEAcqHkRL)rl137={)) z~2Wz8z;X+ws-L8K9zUtTyqHGf%Bxgal8JQtfK zjFXyQaLCaP>#>Z0t?=TG;LXN*$)v3{-u_wEZ9Q@VgdY_!M)&+5V|0J5FbekGFmE)1 zRu_D2Dfwt-R;K#F^-HbZnNppxB`Mv-se>YeejbE5y|uQ!z7w|J*s0^H+_@;V>ci0dSBawk39 z2mrY0=#3O=`#4I1gzgu|_f~Hn%!i?}40Dv_DD7CpwN**;@oXgnx^H3tyFk7K5nQ|0 zC6&s;7M+*zNaAu5`%tx={nMqj@i#?D+F($cYuHL9F{Grl6rZNd=s~V;h(U{3Vy<_L zYYI{_>dUvb5?jkJMc;U3nR`YcG8Q9QH;suZ{<7-rm%lUe9CyxoDM_I z-%uV>$!o}(@A)W=moai8q@MmMzAx-uybUUGNuiJoC)D8x!hcMh;{|~{gfFwBgDX}@ z(*MTCW~lc7stwCpw32GyJbVk%*>}XKOch2V4*F$`kC;3p6rLqqQE7t2a!1}<*?=Ba z0sx2owHg(OdEd0qlVa$%I=h%V^KsSAmyfSbL8!-*+d^&IeplySy@M zeFh2k_pRa(8#K{o#v--GBl36l$ld-+;-cz>WT&qkR)(}Nec^>6jvQ)^O49H(RE&>? zbEZYG*w&6_S%m8X589zVP9>5nCQ0@kyq$1|vE$XdzqTAaGTzPVK|FlATq@&K4#X50R~{hI#754}l!Sbh-`Rg&xO^?d#p5hJKzS&u z9(DVqIx8)mxu)8Lxef1Y@uleR-^I*R-c^-n?^*Jsqj0?XXK%@fYh!@5!&y`MgEWJLE_P?J`u{`rMZ*e&A6mK5a9-NqRoEv*9 zk;b@pL;Ftlr}v}3k1c#d0GhRzsHg{{G>KIzr_BP3x;^qaa%j5pAf9K8JR~ckMuxfj zh5l073+=L-3A?MnNj#RvxyuEcrIv}*eYC6@OGR&R(Fc)?KjY7gw>e>%IC1?E)1@M# zU4iUiP71_d7K^eYWevnS$Wb zY+}~#3%blNJt_X%LzmUI;&tSa*90*sM@JW_uoYi}k_R2to`Cv0MdE=hC2 zi)dBH2ep@Z{T&gzPloo(z}PmjV^)bKm?LhDpU&`54|Lam)R!M!)4Jtxx>`Kp5=t4_{T zY1*sNJ816%_7wHtW4Y&vtEl`@dr9g zGUCSbo4JTxL3zj6gk1xKa^$M+-xc(`xLLYVN{$T#ka#DLX(D?Vr^(xnU~H`I9q#%v1|*#V-Zb zaTSf^N{2UUg#0zes;i&JTPe0=){g~r)7`gpsI!M3h;ZT1kuOBY81xUnw6~t5isnDf zAkoRUXZr#$g-1P3G=taj-j12}&zNcT(V+99IA+>?d_5bgr>p(rFU!X(~lrK_-L24 zi_p~>t~2yO-szhWsS~`6ts9mRu$9K0&eJyW*5e`?#Jp4b`N~Ld19b7x5>Mc~*DgR~ zs^0|VV(L>L`Y`>GCJ|Kil6~^tXLGW3LlKsr>X{-JY41%Xy>3sIY>6=QE^qA2ct|>+ z&&S3f2mYdreJ>o&l&OXbu@-+Z8F%}5x3Wb4z~&l(F_2;Gls9O0XeyZMigU;cLm_+C ze{l9Cb1wm?**VgpwnOg=&@G3Z_Bf3bV}+dI%Srn>v18110&A3!(x`WnpJzNQ15l}7 z)-T7GC_jq*W@V!fu9rs>LfJTEh5xEG843~6ZYarNlrF$ymwI!#b*@NQgy#%1Wp19A zg($f?Wv-?RJ{v{E*@L@Ld!z$C6as_G*#*P055Nf<`CqFU%K5(eWPi<0w|Qa*>W!wn z*Y+Fn7Xx#K&AGT0XiI(%;q`Dj3Eb@Q_0q3hEJHua>~6)HFxyR3nzTbqq82tfA$wB5 zxu0j>BXh^=T6Rvg^*1WE9@AHMVe=d6uJl$+$okkvbRx1o5vZsdXDhvCe^E%N*F1wn zMsCA>MbJ=Zlgj98(I~t;N~N1J$mo}?Vo(u|`^o0)#_cQKLA)*g)AVNJiPlqg56yl6 z@}d?$N#FJ#ao+o<9(c?9K~l>d-Y5nYCG4Oh^CrmDPY;!rXr~!kJ*>Yka7OGH4zmB`ojHPc?jIOOot3a z_m_UnZ1y{n%+B49lYILUkB!9%UupX%qEp$~6Tt^|#I{?mVP{rPpD)Pd=QYz;oGlqd zHxt-oA;NBE1k?N1d6WenO|PUXF%4Uxj2^_xs&FEeWAO*C1p1eSqlkX^b6tErs*sH*%@R4G_I;O71=uC8gYdf1UT75F2Udk@FD(ftoH>f`g0IE_+G|&VTp)IOskwak5|i{L{bG(XknRc{Rt{tzxy8uP2J}vIBhSNNt#fllI4trS(gGmI-(0GFn`rS(XQovkyiDqdTh&;R9 zbu2^+#v$o|ekFhOtau`YxDh1dvhuICGDO-$o9bXC+0!sAJEk4*b**PCW;V{#dSz`F zYBs6RWy`krF&!Xp6=D8bb4+oP;}(r_nin)Q^FBypf|*jjkBfi>(ObG)V?TJY!lguY z9-U;w<=_oLw8QeWU+kvz+;c%Sga&$NfNm z%#90!%{`9!sA*HZyBo4r=EXB|G-1-=b|kv`ABv#Dvtrk@lq1d} zk3^?W#tMo?neZ_Xn7%@4)kymFsU>(MnaT%1d=-8;o}xSiG+(Q+K=+t2Vy>G-5+3 z5@EWkdpUh%vP^4*Sy=H;;wXJ%1dE$2VHQ3ae?566B=2HGT1R{6aI)2HbM1j9ZosNX zN&nZ~U)KBY{amU&t2pY*JgYYGG$YyY;mgm~kF>V7119oTUFawh%D0QE5kiY?uaUP4 zSYCo}xvbAMxSBicpR36M<4H0Dib;AeC&fhrkM3VJmIGQZVCAW+Q*7Ox^V1)xf%AvH zg81iL=V1A%dCz9!DY=D1t}nnCr#RE5j!ZK?y9i$wqY1y0rp2QgBEO}ZeFJQM^KNL= zpdF2anB!i<2EA$Bf=|&L8!IzZRA%AL`we*v4X`I;K!8#b+3{zq43cADy8H1C5%~Lb z6+qiVOK4SVP(+&C@1xmVL|xune_6g`@Kews1pDt1rmUsXc%)B_7EorVIV|~i z{ivd5dHp}yJUs5+%~;&Ge5l?(?C1|eNGr<$;Y3{F1><+tjQ2PBxXimhns+nhm+D8g z4-^>=I8C`nmJzZNL=Ec(Y0=ql9q7j)hW(Kzk_A+3}E5oRoq&1 z&>p-?-f>gG z=)0x+KnhJE6CTC0m^wlSNhG|iC>c}Jb}crs$V6Oz%%qzG+T1VRj=J_bP<oA=heUz%z~EI=NAP6cmt7x6lc|!nbA8jcqsw9Ze_@ISxa{ogI!*0Ko@DabLf4DH#{C_xm>$s@8c8?nq6%i4TZloKL?(XiAE=lQB zTDrTtyCjuvq#L9=2ACmdc=zD_ocn&BbI$v|pR@lEnVCK8z4nT0t@Zs~Kkhv2iTtPT zUxQ>bUiHl|(;Vub;I_p#Je>P^XoIq!UfJ5xzN?h=;cpkw$CDo8L5Q~?Vr}L2`#z9pSEaNC*^mbv82Ks zLPM5LNY+o(2|pZGF%1K2QdcG(>VE1l(Ye4Fdi*oNTS#Vcx_?x+oqAfx-hg;?3vWrO zH)uVL4F)!gg6vY@jCeVctOsMlYA7ZlntSmX6s4K(?U`jv$6;f#*{6eFEQ+N(L3qHxudP>$&*!^N*NU5UumTwFeoer-G>vDvk=gxxLk5s_@qCTfcq%kh!M6%qWAGQQGAWGR_=E$EKgNFT) z<`H4$(>ON|tu3@Fa|h*W*Cgg0(94!g-ef#J6j0$oA`Mw5OA_QV_mtJTD}CJE{2Kh8 zJ!})109+{liA?XXCC}P5Lrf+y7n&269joW#vavK;@@Yo5aPMNg=d)@Lh%s0dmh>yr zli1%VJ>eClszXeCiN#vH;qs<#kR1+!gjIi{m&-5C*E)Cx=ErEQ%Tp5bcSh0SnQg?Y z&?kIrU3|li>UcioO5>0W5oreb-qQ1bNAwxF8^at&t>@R)^`Kn(Gc6kwe!GH4a`@i- zv&YUb`5H)T2k$tnk+HtS#QuhiU@a6;^#R+9QWSylwqagQ29E}&hXnLmpjLC09INXv z)Ptf#f*b8M1A+1B1bgDDLs45LKhgu$nImCNO2AlipcnkM ze3K6JyLs(t)tOo}C;s=^1uP(X`>XI{)<0>FT9|4_Pi>zc_6f?jgviS&U6fpf(WDE9 zdPnxonPoG9;Q`uw-$!j};bItNhL^5+GlXBIJ%Kl!g*iM>q4G2XEB7u4S>yqUgks~CvF;sbxhluMg*3ve28bp9jwfe89w9qtDT|J-rU|Iuz@-1mpW~-^2 zPI~Pfl_uw!;t$Y!rGNLggtth9kD`qpSJjM5IVsldpb@>d^@qb1Xg#Vg7OwMWUby#K z0m#S5!d+eEN_75lMKb^(M}*Q7gmh+#Ag(QbIWe@2Uz2^kaoVy5B9gsuF-@zN#vH*m z;3Zv(!Ju^cV;xB|1FR^91+OMmXfaFx?vdSmZ#^yOV~eJyUNnuHDK*dJEZd5AW~q7y zG>Q2r1M>tz<;enWN=a_CuFe?1Z={;=Mcq47LzY%<%>u1`V5KofZQgy|-9|dOTzR)I zdnrGM5u~6p+R?Yq{x!F7lxkm3IapP$GwGx;8kZxl=JlbG572f^m&%#K7y8-Tk@g7d2c$U6f8m};68fZ#BF}31jqqJG}=?p%zKB; zr5J+Xjr5N<=zZBC7zy5eIl3w%CM0{Tp%pxOfYQ3AsA(hJXqeJ5nK0&B|4vNyt3{^= zpvmcmCtXZ|0p6&)Y(fF1bq=OXI>pq$uBEnSK77>=*>#)ZE0*2loQ=!w4svg8ORacF z9nO^GJA=E}s2RJ|!ZNuzg;9 zk;8byj2E25FV@izYq+z2>y38Et7NF4Ht^C^cq=5yw+0R7_QbXHbEZk$^lA_vd-3i& zl@+fjVT>l>_I4)PUb$y&co4tr+}CS48_(U`3k0gx5qlzF(%sLFY?Ahdj=-u$brkS- zl(i)dUs`5qqnDe%L#M;HV_GNlH=7aD2xl?B8Fkr=gMx|rg8$3m@keN@p8V7sV^PQ`W+C|Eyx(5)y0Aky4n*yKOhrm~UY;95Jq(F_4HF!DXn& z^r5CodjWMi3s-m`Q`YGP3HZuq*L(p5I#1PL4;JwB#&*UVYF-TCk@e-stQ8kCeu7u) zB>xdiKkw)|4l6L*4U$TQQSO1G#`hHwf#PG|Ozj1VFWek3$fW$+!A3q}(?p(httBe} z^I5&==?y4ftwEqfdN|V-7*@x|t)(tyn{!tXaPe}`DBh3SOz$eP!uPOShMii3w!2Hb zLELKSX}=nrpwr15{|GlG%%#{c zAwwxyPxy^<7{|tXCBzH;YH7HVor4_snu1p~Hctq{MDN}8`{N$rH2fy#Q6Ga6Qy^Pn z?R|mKkeYbXYeS_(x0b)z6RMF5tHQhUEoqa@SZA)mYZt8E!wsD_eai3%?`C=TwqHwx zjQFPQ5^gH?dWQaywc4G1`%UE3A|-(cl)1HqA1Nx1>&w4)J)O@BORVL~nqEkCEC{Z0wxMf1%C zU|X{z#!Gy_CuxW~$K7`?rkZG%anI2O;o8jkbF)9ss-GnFgd|vdek~s64J-Xx#Q>F! zDK>Wf9M%om$sS$DTz@+IMUyU_Jfmp0-g?IG^Sxf z=|!EDzY2*V`IjTFy&Y$+`visYtTQgR^sf(pUzK_qR<57dapwmwl0VrEM@tVUik&Wa zNhQiHRa>}Xw`G;Doku=s(m@=QkGK~ z^-)l}?<7hr!~~3#7{2Wq6fQ$R0_hRvLM5UHZtI834uUMKwEF2FNaD$Y4ev@9C;ngiScaU`KEjLRDT`lm( zzxIZuEWI)VCVYezP9P0^x67=T3+pd%4X@a>%uzN6%w8^F6m6G;f_2=Hi$Eo{z0<#L zr!CKW!h&ykeo%*{_qI6=u````Hg8J3 zUgBWaDY;K?eHK}jnjAF1dS&-GYqzhBH;<})2XIP`Z>cwte+lFQH1)z&T{Si$=xu1d zj7^#FSxCt_^2?>FBzQ@>QK5GEd?KoGDd068{jq!NK7aJ3(OAYVWr-l~YHi7l{r zbY)tS>#hxl6CF%V4$M#gu>#b@f%yo6DMExKmw3luPs8xh7-|aSL6XA<4$a=umfH|B`kCMvv z^Pfz7$@jO5$pV2!J1k`a zn3<6@(6P0O&XyftVhk@|m2`NWr7Zw1QlQF4?A1U%K z+*`}kHFGzKM}@A^l+1qxRBLb9$kU?~^>)TvKBiq1l^fJ!&E=Lg677J~AljX;xaQ|-dxQmcCqbpfa?H|rBUHmf` z@xLutJ9*@(mGLcz0h}RIK;3Zdjdj&(C7a2c$g1P3R=~=C)-}|Y?%PiFiPi6X!Y@cBr zJ_kvkV@Li1Y`s|OQ#LJ!&7uTEH{L14hCk2R;})1>M-v^et5KivC9?eE$!BYfr^gQI zmkYtT@w#yW!PN|8@64#{BD~IX?5TK;U3$4TqEi4{DF3z3cgIWbcx{@&Gu;I-n5{b^ z4x>C5L7RbuUWrF-H`Y}z$A9JMAZhIc-Sz-k^&h6q>oih48oS3FAishytM7M!mEuy( zBlr-An4OpM!rZy;4%;y@YBRmfkdTmiUK|Q}&3K#AYy`rnctek!?+Wf{d2QP9XTpH1 z%KysCin&Kd-eQdc`f;CM_yMnssm4(E9N^+72vn&=K3n{!2z{8a+qHk!n_v^b1sMnk z4|m7tg`|5lvUv8Ls_G^>YI_M0UI&_{yNV|6&V`ks6Q0VIWAZ(ZS=r2h`K~y*T>|I) zP-gtg!_Vc}UkeBbNxu7x2>b$nDR_y3Ryo{+>65tyw*%~}cBI{J|5R^r@jHGg+0~^? zD_gmLKU3jHY!UF)vA$GF1%b=uPv%ei1e$Cu*osmFK2PUMI~D|*QKaD!<~QALk)?RZ zNZwvPLdZ|JXxZkmr_$m*`HIr_4mdqC@sIT%8Bbz9Tv*VDCY=Nj0%u6&od^gq2uk^I zO7aU6;9G{-_3c3eol_k8N$x)-BB=(|B-@s;z?Z`hMxGPILty^L3FQqFCH)@HVz6=p zV7+01jLPN{3f#bY-2L%I`8VfF1V*d>lHX`Yt#*_-)|!fVZGQ3zY&_qHs`&Fsgz#Ng z@;|15e!cKso!{&Jq#^RgSC0_TF#t8jUmt}3kmdnA+y69Tc@enU2ghm;Iq-dt5Y}HG zl79%luZgGs<^}kLDqA>jo`jB$VdB(9+OP!VC>5eivx*7_5E-9Kh78(k2RH*MArk4} zRU?rekXiumL^E>(p5Jf%a8;K+5aL+0gPrE4krt*Vye2^NCTGOa#E+S|Yv)=kDs?v4 zg9A|2dTY~D<9KREX1!T!<1)tCK^Pm^^e*7 z!tP-D`atQ+ed2Wa+Ou9&8N;g?m9aU?O@>IBft9MF|UD(?~&BvTx*Jc+l*9l+5oWo5HXu2%J<9H*G zy7jf%qi!+~Bmo(gY~*LQyG`pV`|m{{f1iH~0YMqC7WQ0J=2d`JDlK-+2_rJ#0S&C@ zgFVu=N5N%mN0Cx1Mto^dug^ZAJDo0QK+Obd?E$zQScns5H!|&h15eYh#%@ z2$-1DKbb>qVh9+Qw7O+iRY+DNDEWzRBj)*0DiGi2rx{7@d(dcw?q6-@@5jO)&;OdO z;9hD~83^0Kk2;{yyAG}Nb~q&0&(ph>`*2e+Y6cl;w|sWfn>XAsa=Uql{xsj$>+{#Q zZxdCx-be3$!QDW6W&nszzCRY3;d0c2XXD3{%&WE}wHX6$t-Z43Lcd_93WGC7z43i6 zp!m4PTaa+p?DDDtI1QTR&3)@gDG7Nzz644-t^iX!(6Vbmw|i=?2mah=3TeN1df3$z z&EMDi*Z=z7{*joO=QK#68FPLLnb6Us4%nEqa{V@+UA=pqE6B<>*)uAYn}{sLc@d;N z$x+>%!`;B%(&r!aOSy|L;eV(*a}Na;Q%{G_di|g^G8M0#46Q6P!`g2BDnTf1R0sWH z%QiLM7Zb^zYXLDG=ZDqC!hcDFcnE$o&{l#E8cYazTbNBJK~#^-TSAlZ_afxqBIM?X zHM^wv2ukp?S%{1Sk0=QMLbgJo4bY3Jd@pw>tUa#0Ae52VpHAa@GK|Gx=uI zcwZAujh%N)JJUsr2ZJ^UU;196jN!kU8Xt)<#EEd^5^0XJXc};Ul7BBe>*IKlT*smp zOu)y-z1Dh`n}-KIv|YRU_^7Y-f2gYUaAhKa*QLH2V6C7DVC|`C>9xE-RS~3Kl6+sHwF?5S@M9=$!oZIX-MJ2pa4r5ZG5kg z#eQ+4bz0`PM?`e+e9`>HK)&dL3Iw2Qd)7bTu!L-{U}}ug3YJ$OGZl#-?4;1MY3j}j z;<87?pqPKL56E%;Vmbsy-c8Yb_0Z`go zwL{+O+qj&i_$^&lcrpEI16{KD7iF%LDyi-D;gpHZjcotx=2y`ZNpl0~jMadm`#MGB zpCT!#W!_vK#O0Z8VqUF|z+B*g#(^JV2b$^V@G;p3f+=l6QRr5heg8(^TkH`Z5x`bL zra-o-p$=bdHoo8GHI4f1+Qxn_N>i>!t!WzT$hbkQB?D&@OwZ!4cGsU)$7o6~1*PqMhUUv7*{DBCAQy%|MH3c1BQ^a+% z8;kTEe8MF_>UpgR7V`!#L1T?j@FQQ&e`MTIEP-Q>F(l^MqW9~RM=vcIGwG2E z<`u|F_t=WGkDJykv)OetYV3I8jF#i}>GrB`tACzVs1#I3oQx9L!D?=c>0JmGhDst0 zA4Rfh-?BnpQ&@3|WA+$wYA39a%JXrD)AzmUMPByW?(aljKe3>a2c8rSW;e(MF?a{g z;~C*O`-6cv?mrH4WS~!ZXQ{Bbx0hTAx{PK_FlC2wU6AxzIhM{Pn;6#1)~M)PHdU=O z(p4JTDs`NcqI0U4-AvamuQom_rhROf3U95%Qlskgw&FlXg8z+aN3nI0ETr=T%EjZj+S)qse@(P5seiTGQPni|j_$84Tu z+_k)M|NRxwkLPTNrQ<&eGye%t8$vTEt=aJgY|eh}v_wi%=}*q-ORLQ9gqgb*iM}i8 z3HL0bqaQn!$5eJKA|MOGahQ8+g+tGvF#JZosNU>304YDB5>Z*APqRKZbB*d&E3eMx z)=2`|M0h+p+n&-&dBI^TahL{-Zdx+Fw(62TDf{P7fMrgff3ww|q^B+3AT2dwc-AtG z;kpDR@ZtQAE4=?zUYIB-Md|;ax+6ZUcA5G#SO)MwoWi;o*gE_sqo|pi(}Yvv&iyMz z6OeBxr2z7cd3xW>iS5=WI#ETxAgx}gBjh@JSYw4Nxy7qdVZBPSo?6AviBs9$%@>>g z{!M$;&%eG6Tx}Qu=J+=ewz^iuNVZHvip={c`iBE38P{g=fHfJ~!O+rUQsH^XFe|+x zdk4GS=F^)MLg67h0NLD@F(TwA{VRZ}-)CtD6M2h5U$K@{b2n0XMuoV)nCU26E2Cfp zXY$JVC=>*P41%d7ud)ce{wGK%iuv(+wO&VwZc6SqKbDAL(_Pgfnh8D0VIN zZj!Zy96FKNDx{_27AvvXU@q_ABr@}6ziJ!jhFIL37?;?3{}ui&GqB)Wu4VD<)_|Hw-RwK>(Usn zC`S6P0<|mFZ(*t1++vBZ+6h)6$uljYv)>ugFdzW<|2$-jJEUARj)<}in^Sh zis#8mf9&zf{)_}U^7xgyURCFb$8t{AK~B$C`d_9G{+pBo6Pmx-CKs2@HMpmwbcBek zDtoCLh}Of#hzn4kmglB~C$H7`tKW9Y;J#au!9*7SmQ((iqB%;BV8yPGj#Wzr>FFfUi?})%N;>dnQ5QlPheL4PY4|_Yss50pT%A=JYFR z3~lAxicY4sulMF@4+XS;_DKN%GN2%Aagsd>-LPX{P(945hzoc5J_ES;;c!Cc9Kn>!U8O@#o|?pCS&H;!2dhZ{&57mc8C9`H8@jm?Xg~$1TVkqP~SW=P7 zg%d)S+ze)7^9#NQDOH4z)X;HY%tsEk6!s@hJA`rGNTfv7X369={n^IyiV4ZTBX1aSM0Ugq*bybFiZDNmA}(4cSr1&qV54epspZ%h*acL~R>&_&O8cVglG z@y)p2T80JMT&2r))l9IwS8QSl2tJDo53O+1NrlDYgllbFl5u}kp{+i^DmO4E#h4dZ zjLiouF4I5RJ2&%!80!@zTzyNWbmk)(#^H~M(eR{!?R(Xo-|h+~6Q3(U9xg z+0DM*9fLn~u_vsfT&rDI{R7;8cGE-8U(F1D-k*b!sUCaOsad&qAp+scb3nP_^_8gn zKgp0Ubg4ds_O#;iG4L2sZFS4B*7I2(R&tpdQ>^Ht#dG-MR|TGVK^-%X^cv!H)Ce z9=BcM4($eVnLAIJ>Il>P7Mdj6d{dMYaw7`2 zaO%lo-wl>^^$k7A6yb95sIz&g8=$FOl%3F^DIMYa$imL<-JpY-7i$UaE62U`xc&Pg z&i^uau$YqK1>=neHU+l*c0;c?cxu+YZ#ndx@o$eiIPX?b-g6bs$?2ZObm+o@6Obl4 zheP0_)2u7hr$vf*1ntV%dMdoY)_U?-K1PQk$SPN*MCL4Y!3Py4nAm)KFGJ7ZBDV`K zVcF|D46E%slb6C;OYTJts9F(B+PI-#+r%;?G~pdP@9IMoOD7M@z;~rv8^CoX7-W~xe;Lm8J})g!ksfd zPS+HgzoL-w{BSC;Rj_io`~SgMucc?tYKm>u7^l3q5^?23gGAs++&tilDH6kxm`@U| zhQ!>ujGZ9yS)bUgCDpHdhUBDg@P-FQd0zEeV(yM&4y`9`Que&oO0Quyb26Br&{G8S zsYdJ0bOA8ff@k&m*SVZpm)Muc1F$b`%uglC`6eP}9*`YwqvZ(?CfoLKO?ex19h1}#xd^&93FhkGbw@WTbR$*ekc=36Z6_<&=4C7SZyg9K%Ra-teJ6VtI)2j~+QA-cGJUP3ebR`hg?FIQw zm6*io6jbhOnWnQ0HDQ3ZEKR^tcHC&4>wlC_Fv(}XXuQsCg1rUdchaRxS<;j{?P92(HB}A(1vtK``sQ*2W)LJ zrvvuMR(IC)?pCTp*6S#wBi!3fWR`G=?==L-p+|WzR^h3WC@EPdqNz!Mq_5qqV8?}O zNJAa=w9Z`!CnCXo%+Yh8+i)I++*YPt^7Fz<$%Z|5Gf%TVn~7?Gxyv(E(l>g);ze|M zU!{PlD=3-8lZZ?Jh-rMlwsj8{@hxL-lob7mQ z-D(Wer=sOocu&;NJijTMrt7d?fU4>@G{C|bJ-P6CJT}z{7+u>VZQ;bhC0@>sHFw2Xa3EWxqMw2WqQ%OD-817i~<_-5=qc zj&ooHKGT`Aw2X!Qg5v32*j0$&HPiW}+WeN+;$*sPZ%78PLK6^Z(UyVDMqqQ;B=RYd zh-aHs?l-Nr*OKYrXK0ei9Hl-vt{j+O5YJAiKS ztAo|&h`j0}^Ywz4tH zGx9sPSZBV9Vx60;;uR^Z(IlMS&c2G!P_0@)gB{ zKgrd;8Q>w&8nrPg^?dfn56GML=T&D(ZX&Bv`-6JZPZy^u!R%V zbOkfNW+ocPD`5tvv*n35H~0lJkqfiy1`BHCHHJMEYvRJm>-Iy?B$fFCaRMyYzM(io zm|ci()Mz++Zm=GI6ZBhRy1vaKWY|{9)4pqtA-2y>NfCARc&HAr?fYY@e}BxU(XWT_H2>1 zRBx0$ZQ6lspRhHYPJ)S^{F`^QOXAJ;#ApGh?&F~oUr5~~u8Hnd3VC|H=O!l?%ox{r zvEK?0#gJr^Fi%I=l56_#cHv1w<~g_r*^{dsg2_K_4=$njc0Jg*31CnZ>;#ESp`5=D zlse}#u9~-Z{mTGDHC?~(O@*7(kI@js;&FZC-UdFTm!0i$n|={C0#=Lvq?)Zi!l~x) zqW^(v?ya*u0s6k%wF)|sYPJ?=W##Gp;-NS-LX5w-AW4r{rw;1;l^p zx;X;_qIG_mX z+~!L#x6D+rf2w<$e$*(7a|4)6#MX~H(fJ4$jMiwUyz~#&0}$snY~AcKH@~N*6EfW~ zGj^X6!NubQPusJsT}$GcdLONPP|@?6>tf-ZcELk-iCJQ%3!sSE6T4+x?)khNHdra#ISmWAbV_>uD#T8*dBHc7l|kVXL(i$}doOTe{OZ4vwO! z%Hwb(C=|>H?syC4xUT zW~sF4cVF{NQ7Imd#_!yO0s7N}{kqi%Yq3}MN zg_LhieDCvkTtD3jGVBRbR>+)O-ZFPD}J6(HYz zW>FG+Ows+#J9$5w-N?1QGHCb7USb>o)IR(#pmyk403uswO-lXcrP`hBEGxs+bN!~? zhW{C6cCRB?d;e!$!stA zI3sBMC~nh$SmF)ezE-5~+o?e$<+2Y&e2Q1Xe(u-@O6?O_CN&bn7IFB7Uk9p(CIO_f z6im%u`tjX>%*@L@HFA(Ne~U|OzuY<_FqlOEFr`FVxc0o&%jzIGpFgmDzum(gIqw&Y z^iR8+pMe1{-sF|WHHofEo0o+_W5R}e6G^q+wSYBJVvsUaffw2`?sWLI*o(oF+tdgT zCFkQN9~13%UcsmsA=iJx%9QWx@(9d%=t~TT&GsT^4;c*Y6vtsiF%BCpx@Zir{)!NT zs8wi(U_K_L@mrtd7NybN1Rq^f_P`=2}iG60^>#2l@5Ff?L!I z`4ipPw+ZI6mP$h2Kssf`R_%O$e`;2x?=P?v3N(yYZ5ezWiyJg251op*u&@Xary^(U zxW#RixJDlF7z4nh$ZIyEv55aWj!c9#sO-PQS%NliK=!7#UAiJB27)LeC8qs?z0G)_ zCC|A$F$?zW^5H)+%WAiIXe1tu$uz9EY%?G&K(=O{8`Ah&c}`gRx31SWJagYZywjYu zk(juc(E)PGQeBh&IrEcI3^&+xpjG2Hm6KU#IcRR*p!Iof>rq1DW)CvE6p9%^oHmut)|9BswQU$dPC0g?D?Qh(4lUkw6mQdldEc$S?@Rf^7Wdt=#W}%CFy=N{*?Gdh*#GHb@KFnH+mHm7+MO@^eeUWlN0fu+ zK&$#$@pT4!SN}}rA9-JJ5iaKEa!jVA*~Vy=qyk`+VyF2-qpN`3i`O`60Hrb-wKs!e z1_OJ33z+}nIzj9Eb!J<8DAy}MX4*|q@bfVx-ME4V@zXMVboHfRr?k{sK1u-Se^cNc z|bX!59cH3D9n#+7LH$yR}XZ=d9J+)ai@u{ia91<)GuMnv^Us70|6OCe>UP zZ-!H$j82vgceA&w|9KeM@Y9X|s|>s~$a<8bm+BdyW|xURz$ZO+?>uAv`gR<_poSg1 z*HLmnLc{S{(GMv0ZkHlC^=i&me3`1>sjUsdO4*8M6TE69r|i?3OgA}E;MoCI9WExk z?6z|R79Jj{7IIqKOB%WCnc5xgIFsH3zOumzfqBhyS-gXf7I=iBD7eI%36--Tx|UA^ z3kq6(HsVTfCDXP8t6EN}UNM`FAx~%;Bm|n)b7>Oh6(i2){F=Z|;v)#a#W~#qgFV0s zStyuY?s<2R>9@CFu0=O4qpL%DhUup?$fRw$@GePcqe6XrZ9SzuTr!Rvzkl9}QPivN z66^45Cn28lAnjtX>E{6w-u}wz8u}@v$(oOoQ>H5DcG^Svx<-8Ivi92jG2G+8AU2fl zF+c?f0~VaZ?6fxly`RwlpJuc8=eFNIV7^U@34*6mb{TozKjk~$aWSaO-H{#sg&Yn8 z3IR-@zxRDmVh1a1hAFe?QXFl^u)CTIwjb8o7oI0~z8T*6;Y$Su`%XO!I9zg%BlGc8l>((7szdl>4rL!G5{OD9 ziGvwOGVq9k@sWrERr2Y@;%ri9^~HZU4R4Wb#OiDIXBqlOiT?=8Agh0)r%b*noG%=# z{Yyf+{hf^FURb>Fa>yNr>F6Bh$CZ^zgf_xGir)`ImTHMaiB?1$|U45|?i5bH6~kHC=Vy#N>a`KGUezuX*; z*DHrEqQ2wJIDLF^7-Y)x>)|K8f-5oYh`!!3l;f+@GvCknL5k_`=ULuWxowet+r(NR zmW85qOqmk**rDexnolV;*lUHnsUQfm8mtmuYgwaEztU(%`?!2`Hekj>S{w0mn(xvf zT(Lq-v1@&35puNZax1K@E6*MgAz|(=XLZ-y;^i^bI=H>8_j_ojx@k>KS0Te7s8TO& zU!oSmeBd?Y)-I+?FoZIlzkkDdS!IGp%AA@ks`F(%!vEq%j{IZu28{(*#t%2FUd;`d zpL@!HYuZXQr;U39=JKIefKlywR`j0Ky`Q^;d@Q zkFwl%w`U}wQA-=`6r-LpT{G#N6h7@@8&%-&1(C(GuNl+pzIUo!3|_W@&sgy@Fi{L) zuF9Xr2gGx9n|ZI06e0YrOQbTmW5L@Dr?d%H&#p_r!tuC|^xCHD@7~mD7lgfY^_B#3 z<|-{1r^N0PEOa@022W~7EokwQoLDVQm>F{vMLjj3r+|1Bjh_w#)e>YNE|{Du;I9N& z?U}oAzFJwi&@qGq<~=ZJynbM)k!wcJPb-9S!qkI^0ZQRP2D22;~^nz z;0+$e=ym+H-}~bGFmu_daGW~NS=5xhPydQ5Q=J=X^Ad#R@Jv#bS#z}T&~UzbUJf;) zMjcx7KEg7!_fTfLF|8f4iW)P@Sk+Y~c!{Bb}?)o}|rZ70A&ZXZIsw5f!4NR4bO>Kh<$eLl)@ z2m+DT?M(=cT6xe7+lmJZoEBJP3cXjb0^2Pwl76>ZFeSN0 znSw18;GSLuVD6^2G@CzaJHOvl`SQf?LIfcaP5d8hYfzDQrih0J4zJ*_)62g|V5Dd8 zzsz9UuM8MS;L+c6y9U$rN!P0=-s;OzGw?*|uJAw5sNXJ-htp2^njQ(rC=>Zkn;8Rv zi0`EB8AASp1nIx&(r4eifn+`J3nz{zY}sQY?1doC8JuCkpgfeg1qVF6Yv8MZ4aU@; zHzWv&toIG!O(5zTP)52#^UvVc4w2lSH?RpeKbX_VbjSF!fd$9+@1}f0Y1-KTraUmXUuIA^eQr#p2x-G4X1uX2$Qc zqgXEu2W5)ig5rSt`|%z%JYEJMpfQvx~Z=+R$ZOI{~QRjM= zqU$j5$hEx@zrlKmlhf%SvGMM5Jz`?DGqBqexXO|J)cALfy8ncy5p=TTGyj)5{Ez!W zK!BGc(jFJ4T+rp}unj6GeDA|37HsqG4b%0qvoQC~M#b#f%1UbkLr6y~Jalg1PnXEP@&O5SP(#d=l8kX!;va90l;}-uQ}(sKrw{ z&d3h)5p~fhFOj!Rf9;urqe!C z#%gxWVJE~{H<^9(k?8I})7K+>F&7Zj9=ZLE0?TX>JKu8;BoPZeGDuSGE_cKmHZS=0fgUGB_X7Z~WXYw>jDLVglw)of8{g@;M z?!Vr8Nz%saEM-$~m%Mwp)F39j0UXP|H~oy`zgO%Z@DtjOZ`vZfPAR;Z!MTl7xRxYl z4niobB#X%}!55AYya=`OebA!bE~w=txFNVi4-?d}qWvZ+-r$TKo5M~DA7{_m5F5fZ zS*TnnPl=@f?;0{vZz^;0X%wV%=^TGi&*=`LfroZm=#S?M0z72$*6Yb(6E6cj_uf-0 zM@n8R^0j*Wo=qLOCgU!!T(zmAFIqur0!xed zc2^qn;jAk9g>>m{*o!zxRtrZ&BfUraobUT67-VN`Dy_!S5+f?~1E~)j1;5M8OU4}D zGZX*3kS_;7MJpJW4c5}pL1V(v!DM1$PQ6ZvAn7%9%jsuvJM1Kl11f*+|^cu?O!Lfd(s@LGu8ZFZ35 zO!>Ee-dQ4sc+enILoU0_#D<>yr=x6&_0wtanh{@SiNU(_SYI_clZ6z0GdHq|Ygr_qF0g^zz4m;x{7kVP#!hU40f3ub2 z0mlZ>#{64@e~bNQ?QJX$arm?@DwC#8Tot*&VL<3U+c~4?*9k(s*0y3q_o26^pbj%K z5>FLP)#sL33~BQPkC;2*!3n+q_%TgXJ=kf2i1rnPP2`JCyF#YmSCMzO z5uXtdPCv~SWqPJOvfidjZAUl_(t9q<_kjkL-rt~h;YmA0 zeN^%##0AQZAdd28&HmsTynlYves^;oX5%5mE9kIb)u2$M9PRy8UWc58;)wr*?G_p% zN;2a#N?T51HJiJF%Z|LVRnYkLJVB0pvPddxTH`@z*LRQ~YlA&}|1uEDSsWgERipM@ zyEP6)fXzulmEm?nmlSGI=HbUf)+xYP;l8y01__9lxN+nHlo%DYJ)i+F5xpmbBS13N zm+TqRy`?tJleh>$FAl{%RHi*Z=vaLY&eN3gnz0mge}QoJ@VOnwX8g;G^otfT7{(|y z;igO|1QHyCd(aj%rNU#qQw4O1Rpgym0@hY4U3=8->D|e}tguBKR6;!ZkOynId-f6M zsq7h2KAJBXf~)4RAUIBn+Z0X>h5e}W*+t_{ah0Z0g}CEIXf1&X`C;6>W8$e?VwiNU zpG7(L7p$I}nq09(S^Z{b>$&CmH2?ZUu?TZVIfsm4Ml=6|TmVw4IAX|=sW-$F4StU; zc2WUKKwHNRQ_n~XyrsC_xE19s550pHtF=n{b*x03G(sT@BHU-^Pf+#lu4hCZPus9V zD$0OoP&l?DUvPYZB*|-E4ST-y60X-zXeI+yV!7tf$ zNh6-|4O9OdW1!H^9vq@F0&O#^HfD7zW^=q~N%IJ&pm-pt#tAQ=KzuY%DW|%qi(_Bh zp4wcNP-H~GmDC@f6Yklyg@Ryg-qXldt@28XV-=xI1uict zY07hQdUSNMjMc}qv<9s;3Veh)h$?q8b=dRFY0o~dI7eZ*YIw(}u?h&k&cpyxv@iac@3CbiXsBevWVGqF| z8M#a4APSk7>im`7p*^7Q{&-gi80J%XJ#k1oMO1UQKp%Ej@*K_k3rLj~i5Q4*h_h(9 z(`71FCd5ox7!sO<2nl2h-fSx;)grk$wFy0KQ-D=Tl{Vq%8Y$VIzA0mhOQy-yh+ebB zcLg4dy0UJ+E#J8iA6Z9#M;N*qwPKZ7ghid?@D_7fX{cE)SR96+;=#WfkB<17!2J#$ ziST>PA|XWLo{jTnrTJ_4xgjxn3PcFuRUp(9$U0uNniUF2D+WRye*|sR@%Yf*2T?F^ z#i08xIgsQxOgL0k4>e2FiAD4a+QpoqrCVWpSg%Uo_SCJa8d%+M6x63(CDCgfJ)K!M zaijSwFYIf~cJxPFsMVT%k>s}z!GgP_{b0GhnRj$t#+BGPBN_}~uwaW@N*UGzZ^4>OHH~1tU78T#i^b84~bSCL<8fEh2K(m&Fedl>8uO zcJOe=>s-t`R`)D<=2ygRU&KeF#-QNg^;4<$UUWO}IH;3-4PqdJpFXZ^eAmyw!9VV? zv;AqB$`SX4ja{HXc9*nWgCU`qX1pH1nuB*PDO@&~ah8?u0RAY$zbS&~JfOGu|o zDJ0lx^oR5c1q^!J2bDM1Izo21yWg!pY0&YWrhLxUvRio7D!nb+7)oMVOrP@qQ1+ft zO?KPfH}(!UqNubeARr(`q(hM2q@#2qU23HF#7-~Lq9R@CMS2ZUL4t(dB|w1CLkKNE z2ua?cXYX_NGu~&6=Ug8$-~-{x%(~{9<^P)tmbyB6ey-{Z%L3uPImzlEK%jmlNFrx; zR=60osKuofP4_F$)&JqUq5q5f&iZLw=(Ztc?_KOtR;b47dvoC-to%xQNN%9_1|nwp zumd`T&E~3rw&B!UNO!@kIg9D#f_Moz7=NeSb)P>Q;~VUPsS~E&c%b0jcN!}tO!lhu zTA^#V-Bv_6)pFba&GAq`|8nB$T!gga_L`wXslusp{8hs>nc^|JsV{xWj zw{A-yi;0j=xbRS9I1Bu^{ud5?f8kCki8NfL68?t)08W)hq*cILEtPTi)9-EVewZJQ z*IPAFy^E~%P|lwnmjWp9?eAVN+!eqn8bKX|F;Qp|?}vqhF#})P8`msjFXW}~FqQzt zmOgBg8XB}q6JCw$g(A*4d5r~8uH?1&@J9w0jy12n5<|LgP-CE&+o%BUiOqr-V|}6e zu`^-8PwiIqHYmRq3Y0z$Z`xli;PhenOmR3h26Go`4sW!;7YN`j-eY-|y|3>E`J;P{ z(DZUR@xn3IH?ooEXlx^SmoDDYk>^}GBnUkq;~fPlwgK_OS<>|<3>fd(w)K8!A#Evv zf4VZgs!Ls863+|U+Wbsz)NdKP=B#Wx!PEKn-HE{2A8(EhI@1J@YU9tEUjzluD@6v8 z*gcv1s6RD1u#NmM4u`NN`Y@1h<{L=hJvsOxkhzk$+R{-~m=LmcO9?KQH67c8zEHax zSsPyGnvpv>I)9;~p=H`N*s|F}-^457(^6raxr4{Ur6y}tuxb560;|*GoAt6c&|UsK zE3sShX^I|=c9}Nt5dYPj!tL~-`wBtfiu4RN@<__kN~c;LEcva^Y*P0S7;y+z8q($+ z;=bYf$rjb-8p5RWdqc{Vf60z5YRD-L6m^1Q!Gyt~UTf0d~765_T6-YBC(!`zBD7374190(D%0?O9j7qC_tTF$-xDjdb|Ej1mu@d`=uPkJlWRa&He=tIO2RK>R3=!1=uS zjK-|3>h)8&QW|YYxWfb<4CFlK-01FeWIHhOS&QZ3%EZNInfOP$c(rA$L8Prdrx55l zr7(^83*>Ey^un(Ymid<4hEMVe>K@2LUjLTmahyY)Y7W}wmKs!!NOA1N$bOor-au;h zW5w1sSL-t3NE=9=EWn^r{ISKCLwk*Bbw9VSCl58$g9p$nU-8;vc1lb}b6H^SdUtI2 zkEs5>8`Dc=4S2i$y1`FgVe-BzE4=(F)l-;OG1Jl6O8l@)1g zn5g|~QJa6fcPFJeu}~@rME_j^rhfQqCO1;_aAk;FpSB5#lp&F-xq;;62koyAwD*xH z%zj#=>pyt~zsQ-jrl?qMNRdA*k_q2v)ebL%@~h|-6p{+c8(x^g zf}SZS?@jI$*~La$yM%+_-62n_vV{5k{Hne~uc8hpic)2pa&Tyw?PwYP3L^2+I(G(E zx>Ugv9rl~dSl#wee&k`?z-J0HXIv?JbR?X2Mf({zq zN|BB(V7VLyy_PQ2f%PPrH=@5d zlMJi%m=Xy~XP1m|i(|BMj%#XRtg5;}){xLV0oWMmbb#0DG;{bgugE*CnOAvLv!?Pv zd;q)qaXu}YWwfyQ`>lHW;iTWsH!X==pX!;?K%?@})!_=}=(yzG3S8EF-jJ>XkC$MZ z34ho`$_2kC{Ak9tDM&i!iH?KqKIQoCWU7 zTY0Z*Ub3@eZF+-va2kKYJxWUQaH0S2*2)?OAwAU6YvzQpRiN+dQ?P(Y3G@dk zyssSLt63&7&jN{2Nc)496{pweUL>tBE_Vi|wpZpc;LaJXe`HoH~ zD}MiM2nSzarcrJtAZhj5abW?}m-Bgh-{)$Fe%15eLW5NYm(mmQmi`v{4qj(QgV-zB z;~saCRUCrdnM_uf*!FP))V@@X8qGv{O}PF&bvbbL#T-)t{_=qQ7K9nPkxpRQ49z;Y z!OXpQXD$abT5I;=9?7 zHrLNG1uH=({SS6rnK8`)dhPpK-lB-Zq)0Pch{bERJL?Djie8fqBKCAWn&M-kAy0b| z>5TK?yWu{)QdSqr9d?`|1s#*&FKz8mPgRKD;2;9Asr@#HF)jzDWe5|&qP7MoVpNAD!Hii1` z)#6oWuNRZMLGIP3;^W@)R4%NI37r~fjJdL+S)%fBL9E^iUjMLsx|*={Ye2xj43G1+@duT1qF` zfcF;C^XA*-H9qONH^v*g()HlA9O?HbFrV;<>q#pGDXtNy;G654Znl^5bmL#OUosdt zCr;ihdD5*T&s_g$^ni0I?6UrRh=ec2h<=out{gs5$+xleI&b0)OkW6BX@~mqS8(+L9i;YdDMQDTef>iy_%r zN+~^Gr$0AgSXK*yY(&KAb|vMGtW*_sEEwa+co28*AFJA}){l{RQ)GzF9S3<*;-m7Z z0RjvtpEhEF$%KI&x>_v(TdMX{G~b8gM0e3@mG_4=W!!^}`9#;+A+OvzOi`(3G$q?R z*n??kZE4Xv{FdzYAlC~~-lMX2_ls#SMT_#U&HR94y;|?(xAwM}wOHz;g+Dg@dZv@4 z?cH(KtE1EFU`hx|spp>F=zwyo#O?2P{t}JeH(inlsR3Nx{I&avdt8^8IOHOw@`>$t z+rg;bTF=FN4`su^jN{y8yS0=Ia5Os%*RDVS-=bz*ECKV>>4yLv3o( zvrpod*Q^pwU;#)Jc^BqZF(Y{o=1^s1 zekZMM(#xiJv$arjc*o!(p6>U|$x1;KCNqG}d|kRd7ywEWZTAF;F|DLL73<>tXqeZU z$>T2JoYIFwZ9OL<1qX=nUk}yPEW9R`cy2WYOj(262VUt? z)J@CJ`D}td_QNMog&YnTmA~K0>}oxk#OuvPbf%+IIgO=(f_OuQ9GLsNF39=cnYTkY zTy8%`@VU@edTg=Co)$s&Yh50*u)L!sz9zj8A1H`>XNQo6;q9U+lh);;ylz|*JR1?O z=_&4WnUH2q`F{O(w&j)yTtGnrSNMC%sU}20L|#Uq8IZbtR!FY8afb@B0g z&xv8`s&qFjbkQj--r>1*wRQ1VD+kXQh;(8L@mgNpgz)_ra1)zOa^Noc`{$Wn0ZauXlmgX#+y8w!n+uZ?YPA3rY3zAvGG0Y zN+qQLVtq2yu)S`tRk!^Na7Th07)0oc-oJfgmFQL|BT1_v8Wd+apQatJHTN9cIxkc) znil{sO?dy{#OkPyX`!D$R079K-lfd}L$)`UYnu+FLl;8+oT79;?!F!-^CMfZ-AlB9 zP#W{&U1=LAWmQ-|`1p0}_gzjX6Euc-l;0fw-k07otb%XEE&O^Vw?@4P4DUY3GNr^f zhAYVO<`#QKJit!l+&ha9!iKS>E+9>fMtC z#vgOm_XiX?BdpxbC&U23I8hDHYg=_(c0HD%GDwPy*0+`#&6)Fm+-lVL!!x3?e%W`u zd4FEanP6_@sCe@<;;C-V11rY6`g`y?a>VcS>#WTne!z=!7%Ho$tAetXJ}8-~;j9?_ zTVUYL#fXVKnjxJkPN(m6D508rgN0_Wtfw+IIsyU?ek{Q&%7C`sBylz!1NMO~pX84t zf{$XoDS_$D)g=l~YLv&t=xA zJ0E~<6lt95KWsMrh``Lm{atTIzT9PmloY+>*Cr<%>t>bZEyoNyeTJZ>2%arsjSobm>R(CCEGRv-rLrmJ6!FF-O*I_ zwII0Gs^-AtMP@1YzZWQ`r($J9e3eeUoAtgZHWWRqARUi@RTFn0qrL6hw5`7b4V0b;aKLt>=;>WjmH1 zDWCd{;ffW#@~SMs`;Op*+6Br9gFLQ%=+o=^!X7?GeGse1gS)qr62p|7RE&|hAp3YX_NgvO zA-vk84_gJ3Ap+jZpTlbecK)p7#^L}k7-4)<1c*2K(A1Ww&fK)tunEUC5*5&Nf}iTIY&a*LEw+Ta;M&9MrMlIz&%cgSO3wqqy;L@!8fH$xkT+!g{bLoDfAst z_0%<3oP@wb#p}C81Dm9Lxx02as5kqKksAN!2VS_JW52ZK{1ZoZ>Eoog9ad9-TWH60 zC$7+`WX>i5NG?aUjkkmlk=rFqQ&X#nGmynsc2+a^0U39@780E_zUgMrZKN$*4)f@? zke{^#W7CELfSW;z&@%dN|Cx8S=i!bfQVm47Q>$vX3X3t_H8DH~Kq~hEX8R<>Z;yzc ze17g{zD^ydq5D!2hx#vVIlSNeF0T(+5lfkFpJp*QHnLg2fr$1<-G@BcuJ_dVuq?Bile_sdBP_!cz0Gu4=yn~ZEBm?3Rqr!N&FF(CLp{vh_ z%aCxT`;|KE83q~{d;fD0Yty$+S6;TWIuXD|ngPpjM9Kh@=+ z56ixTuKCIR1c%Cx0DRLw&emg26@<8~UGqhUdPzKI_|(fe6qy~*r6@Q@TFPYEd>Lys zy>+6lVR!BVz3B9zFGgkuhww}|5z?}?rAvRQIx9*07UGZeO|VMA!Qb(LRzI7;hSJa- zewNJ&;#r#l^>|-NkO_cTvsoW-K`%+jv>v`-vT;fHrRxz1qVDEZF!p`P#WZA#UIJtDJ*9o=g}3r2Cgt{OuZ zb!OR5o%6cvTF|j-*oD$_gq|s^SLwzlkCWO}jfox3rw{Uel?NUM2v|1@sjnHZU!E{n ztn*_+Hr?3Xe-=t<4>|e1*Hb>U?gXptkdrq(XE>FocYZpP9a(;HFF+U~fA^$k;Gvoq zV!NME`zf8XYuSHVr&w_ZNN9kHwBJ~`P&H(qS|nhB_JYpI zjlG)mGTf-dmca#E=e?#pL~rGEC8dgfb7(Mzp}TS^3u^mXyej>0Z@#f2YJb9HNo`~A zg+kr5cXMPYaAPPWYy%U$|C4F`pPYQ`_MBa}(j6zNd!Jk_U4r646+%5aPY!LItD_8i zjqyVzyOwMS@A4~2A(ZnKPXN^>fp+f^UtOyG;3qSk?w^$MUxk^Vp1`+x;eTS$e|%+Mpe>}Ue^Wc?(GxRT z@)smJMlIe9wNNn*yl`J|x&|GUO_Xw$Ws%Q1nQ99EkV-AQ911TOX8f-uSJ~^}9gh`5 z+LdlURQLd(@AvH-o;?OCct2yj_WW+B6dA5#jJF%^d!rH)oT)-anBM~@+pK1*|w^{ZkKUTB6JaOg8!Bmd7g{=BU^N zCH)8{0PEff96l||BYkD&i$o3oPJ|d6=R{TJZr8*7o-?8YH_#7*swN*>{TQFW-*Wxb zV2pR7NXBo~?qKmlP7WS+VPqb3-oTON+@n$j*e=4=9!|;35{MY`1Hm7@sVGlg zsD4P0GsvJ-Ave`TQ#qDvS`SGjeg$~%P!h7f){|Y%!vTkrMg;O?{61hK?KeCbB9&EJ zKt~5enshV~vaOk;o*Qm*K{WK!KK7r0Bw}zu)p*uY%h-i)Ag*55PjVF`Qak_7_H=m` zE!bQ4lz$%P&Xw3RJM5(TkW9s!;Nh|caVqc-1TmSM4kdUX!1J&Zf>G|&;UeiS+!?cQ zw<~VEB9QUXNyLNW&+oKVo@e;=F%EKG`0Zg9_F2ob<(T<1yQdhQGvaSCIL1Js-gJGo zH*GN;ylAF#H36=paMXDf&-enzU6`9+y)L5K;u^6ol{6cW!6nOEJhI%me3^4N;x;M) zyyYm9`E@>VZMQ>u;KKqS+h(gTuYg~Ze@LJ9N`t;hJKVg81d7%b*w+L47byaY0*i5SRv$B2rG7(*E>8QWF^MLi^woy@oi?0d!&SA ze?LcI?OtKTcI!XrueVU4i_LzWwJkRs(CY&5Oc6a^N~Qn(-A37aS-Bb1@^@<;xE{w` zc8mu5%1qCe!Shpo_z6ko#ZIp^Wp5tZFXT@X?s?2sR>%)eIZ3D%=4&-CP=>eb$rXNv zNUxxGy}z2%rDn|O_94BXE_-}~bTRK-IL6@jlqf1I&yGxtbZZos>9(w|q*ZzgeqV}{2@j7a%q!*`tF@|aRTH|1&BP{2hjU8n4Of->;? zIVFXE`Py-Y<$kW?4{UE9iSKVRA0`!zGW&P@xPva+`}**seFeNvl3m{{L}-eSu=om^ zYqkO^mC!hlquF?Cx^SK=lajqRDdP(?TbZqhmj5NzrCfuSj3j*<`9Zkl#?x+lkGx=uOkKuIbRyh~sg$Dt)L9?fr0c0XwOX&`vHE;ojux3iT;))Rbm|ED58F4=~ zfm$5-B>`fZ03uyw23S~L-u$MyW4IlWLS#y8*kVa7f-_}t9G@Tgipl;6Klc-ea&b~$CcUq+O#G!X}T2b|jE?Gj#**P+{TO*~pZveaF1=%;=NqED8Y zYso`5w2#~i#|P-!TF0Jnh4176dU$WzQBGeye~R_?=Jy<6r)qkQ(_uX8laHrgiPXAD z3a098T~9^27HO1~LyledE-k-*4zPWK;oC#iKX;>di5}=O$kjwJi0S^7f=giQq=P{D zlJXTfidJJQfqmAsv2(k7JDZw2@45p#!%dcr`d`zZh+biuSe*H%G??>3FVN@3d0l;& zv5jWI!cJ?YlKltzN>z0#t`FUx`R7R&U5E0SIAJOZ`)wrqR_XDdX5woH`Y_T(#)G`- zW8^zR|61kWN|leAJl|4MrroU1retn%*6HSL+mBa%+IN2buA?<1HNLBPRIP51ecnlV z<#xy-daE1;Mzq%%ZmGZ=CedR9BHl}ailrjyZl%8asIPKG_)(VMvF#0D2y8u#=jTrm zTI{*{R!rXZTvaVy2u|ld*y1#V)9zezxMK=)3Jxmm_o@>)E7Xn*m!rM}^L1!7VRYT7*RG<2@Acu^b9@(;O3oGsv8iZI7 z?06c50m9l(L_$DtK|QUMD;$G_uw>jH;Zq3qz%E3{i)fiGHgg=1f^6)*eme=858k;|<R*n6ax5ynh)Vb}~c68+?fLgXx^#vBn?@rci=6SZ>O~L_wK4e{Uxm+wGIXM+lEfZQ`LkN=00 z4diTyITR@aD=5Bu|2YHl@x0)zmBq24S62MVZEnrb2l1DY(bb11uf{**bB`h^Y}kbR z$-qeMS3h$oH1=(J_i7D>MD;?6x8bE$wg#coorKpsqk+FCN%x!%b7J-^+(a7r*0+Qa{>Q++B zDKp%NjPj7q4|uIn@JNSsV4%#Qf|;icpF8BTo@YhW<}R5EG~_d|=xTz9W?V~n^PGga4-YyJ{8M95;dl{ zF%=cU?AK%pr?9d~ni_w4XkSxW(pnJ&4^>^mp8B6(EQ2%4pXx?_9RJTakpbn@5ywi> z%QSBs6;L!#RI?P`G|{?}ifxQgUS?x8>vcPgUK^^k%zl zuoeNx*CmA4hCR6`ssvK1_rI=NJOuyf6%KDHp)XEPg*&}prZ-6#bAE14@fR;kyiYF0aKoJh$8N2aOnCE*I8`S zlOs@m@)Y)*MZC6qqWBt%R=iw+O>60%dvyTnZhfTH|ADV?A_ON=h0NM1>EPB6BGwHz z*B$81ix@~AH)EPko+yAGv~O&VlyGlGC!__8As);<5(y*U4l$mF<1dZ#|F;$BKgG~@ z*8dIR(#H7c{Hb@Pi`P@nKVsutWs2B3Wwf*67dtAPOcs+ zQ+7XQ%jh|2XRW%gD|EWfHQSxfg@>#*LQcIUwVs$O%eR8BSoB`Q({q z73{fSrYDfNG&;t1LafMlg0AxY={f4vs7{C|*=GA6pN(O8|IzIV>qhQ%OxSjh-|UZ5 z-TF;a=f?hz>+)OXIo4qi zwT}*H(fZI*bi3Hb2iGVepL-|~XE7G&iU6I#^%_$n%0oc^s>ePaY=YThbH zn}N+wYPr<4YEVyoxQ;#(fLq?#y4&zjkoP>#e=tDvEE zl@gwzh{UGiLKODQLKH+*DP?o3W9ls%(lE7ob%fDB7CEPaIY;Q^;8m)0f(}yalSF>C zLdPZf)JkN8$3(O&)28(sw(!vNnVU^7fpQ$uPgA?czCLTN!F|Q#oK7$BpV0ZDoKfjy ze#*vx(<*{76k>nFLs5=W>H04P@4xSEi{6?LLr8hvL|#bVWj8JMC!&fq#Meyn40A05 zpJXAQJeabK63l2Qay;BBKJ~bR)&I9b*->maevdC1%@I__kEjs_MX>(;7nc0m$u!P|*stk5M%!(;$<%94i@lOKQ#t6T|H;?y1>;(&QN49RX8uZrOAc}3bNR5`Q#@}f zi`gmN$-W`TZTx!658%lqh5~hWm&d{h!X^$zys7wAh&_C-0PdZNwEi zbgQQf{l%BaRd&DRR?>{{X`5B!^qN$sV%8qnDLq%2?JrDcO>*x-=l#7_> zp5m`E=Z!qN;m$qk)!6`1WpcP8L)jd`m4tjndfWnt#%gd^iGMy?KMszP!1HJz>~%Sv z&blT#QqqcXQfr)(n#j?3EFU;POUh?C@Ox1H04|+b=xj8_ubED-znggJMj(;XRF9fcgUsYo0mP3-G#`}n8*xt3A>PX#ZnGQGQT6ds7-_SqGgx3ZR#x7kSz_o#a%wnRbZ zE+TGBeG)>(b7ux0yo{`XQgGbIanc;*>d`_|!QrQVg;=s~955p#tDn9FiW}46p(p>h z&l}(U|3k*U5x3EX+=BDZ^`h?FZ)>^kJrHPehYsP#Xw9}b7YfLZoIK%TN z{g5BRA8HTiB}_Tz@aDW}h6kokm8xFgKV78gJlY=>&w5*+|5dR)Td9^;MoDT3aPgzjYn~!Q(T6#2SL3&+g;vHK4}$*EvPX=HnAzMYm;=DD?O+@4 zQll#tV+cN$FS_gi52ABZ^fvgqkZOE z=`3P;{yUXlg#stx10%1w|g&$v&ep94>+P&?e#OIK_0Z#&IgB>31hSY6^EPvMRi zzlPb-`Z>DZ%cA#c;|PlGm%^6LG7P=?!3ukI|2g|sm?S6~*3H3GJtTYibw z3SqZI9CL*3uwO0y+e^IQI&N11_ABgLbRzp0b%*lTwhMfBawD|)&mP&sx#!a8-eS%H zf#*h_(q8OYr*`s=Fnthef_m884D{LnDUOzpR93X5y&a1Q+P0b&R_T$pc{EV~%)b69 z+ayij{oe?O1+U~^cwBa?zO z7u5}(yi}Cebz^lXeP$ubalC*LT49fV8%CDy-cx#ML5<$4cpf%71cj!P8+kEH8vsD6 z$56B9j~q(?sz!lt%q6MP`jG+W;v>5Yb$#mP2~KR4;9RqBMJa7X@uz+}clapo7TD~s z#Uq8N_Y3Yvf@=l=svw9q2I6U{hKQrkwo) zba;n#n70B52kh4Gi5DTZzFs(Z-=6WzcDzjz(bQWAe2@Ga0gnk#D3}x#I|l3hZ9FW*Omz)`@?s;RHhKA$wFFaz;QHj}%Zc;Yb- zm*x8qmN2Lfl{{>*g*P`w#yt8I(5aWWn{ah z$*~GTQg_YrEw>7*Z>hesXex$ZEat8S%ZnBMbY_2Y1dfST-%DB4F zW``65V5T3UJ!H(VtK8 zRah)mp+I8vI~R+(&j&AsE=G3l&JZ@IowEhOCtiCKS4WB>a(lu0LmM;xRC<4ed%baq zizG;2k{NO!h0S&rlXJC)*+3epFD7UubWE+~aBxp;aw`q+^(WEHmU*+01u8JtUqP!= zWL&PSt8=^Xr@#6edGU8b{Z3R_xJf;=2?}TeR_!MC0L7u!?6oND5IS$#SEMC0I3(|2 zT!HV$0h=xgnptcc~nibEZMyHZ1tFtsxBz*wj~30qOEw$t}C-yC|E+|j)9 zY`PCZygM1JshyLl@Zkq1vPyYz(*iBp%dXsMA(^1c@BSr4ykjhPUHUeJP_eMk9n!B5=6QsdMF8Tfc9?ckLK)t%~v1KXWAkH|Zoyp3A z)`UE$E}rBWtr!h)2;UIrXFoKnEX|s77-Fknj~Xk2`Mb;i6m@*nthKa%Nyq>#1sd(E zh&i`!@Xod1qpLSNKJmgf`Hem8x#bvV&E049ijKi5%hh-@+^Uk0$QXJTU$Kern-2B3 zV!+S4PZg0ei$$WhDt)Y~A1dWKp}&nEjv-5d*Kv6WrF;1h^51<0~J+cqJT8y+W9QqxV=icRkU|QqMa^hSzhW6LO$9eE6r~@Yc++R zwO}ei`LOxQe|^;xH1)JbWg5i1R7TAo78TzZ6CK}_Blz@lDR+peOxhphVT#T~D=F0J zsu4QL>WAOKtp@Fc@KqNzg`j19W+X5mA`)YHAkEE)p?NW99d0159Ak)4k8_sj`7d%K zr}vtEUcD2u8%a3>7;f3VS5A*4fyR?4Q3UT?Dh$M$qY>QfNl&hd!S}$4895 zvRsG|e>B)`&n1NdsHCRj7HWl2I18DP3Uf4n;u9je79LGHxIfnSzTN@-d7^ErP#8rp zg+6LTj`axFqYrN+GywwPSP@KuENx{3gmzzW2w3;;L$tn;CA3>5+@m9p?biu)~;a@;7*_#g1-+fkmZ(uQx>QMucr~Q6-DpQg_Cq$SQQ0z4P4H_oYs1?&j4`xO*t`r4NR$b!n{BIXud5X6kvS- z`tbt8{F0HA`IpM&-}U^Ed-?p0`;-;pZ{F3_nC1Oy6lr!|)QeJ+TiFhuH zcIII5n(v7%c!<03qlt20jI4Lp?5nO@{%MZRn&I;4AziVe>XXT3#?0=}(66NiiR~9L zq8@Mb=0Co2XcT@HjFehps$faBmlX!Zd+wE3xmA81}T`?>+m zPZ+dSazN`tW{X5Vn7Le#ibrlTy+4uK*Sz*6E+np6+Yb(3v?Hk~#kLHCP}iR6!<6oe zgqmXrn+r*AoZu=MftRO1M(X2z7PW!fd=DuuFEjc~Wb~*0kR5v=HX`1Zc#T|Sa5Pz- zt~eeBSL`bOp*f~8eM=^bwhi$k$7S)O^x zAMxVe|5b#0{=p@7#yNH^9|PYSg9^=E z0w3~o4@ZI%KGBEN82AJ8G|9J^vpkdpULvfn+$!kvcr7Ej#bh#Vp0sCe4)v6NYE))Q z&oq=Nb}E>gmcU`TK=Cz&i2G}MMVJ-Cyn$?uFF(2-XD1!ro|SQ^5vk)k)1ky$85_y0 zc5+gM_J?7o1bQ`6FJuA)g8w5ZE*cYf1nZ!?HvdEU!@Xo{HcybmXr*SYELF zT$QC#=Mu$*w1^r>=>F~fDd%WbN?Il!*Aeu_SE>x#r8kVdn@a5bnw5k)NViAu!f+R& zK1S@GZP_G9{6Pngf}#1C0A&E>#iq`n5xw_27~)x6(uY0@C3H*$OpgGKNB?&~L-4IQ z_uGF18W3&aFHH!ZQiFXp?XTzmh`O#5q34P0YsG>*y&tdVw7!>|P)(I_;ndc@-E+#I z;iG(TA)>=+yaRFx5L9#e%mqK|{J>V-O3;%($i@aq0ZN&O{W9Ryoo?ZF#$}VDXMBVc z6antw3*LbHT7(Uu&PfZ#Z>HEvE*wlf*b0EqH=J!cNpRPaVzZ3(pYAaVJz4&*d2V9- zbnfw%O5Ae(+%@2SGIt$qI3eZI?EAca*++nqEXjUMHuQBOv~)1q#P5iuB(XF-@MJ#(xEVU;X)sKB6@l{{}2< zz%@+YXE#A1YZEWPj8s`aR4hu+P3MU99Mme@)pM~Z3`dNLhL;gTx;2@eLf-Yx)|d_&mVyie6Gy$%RyJ)Py|J!VX-nSBjKMJhrG({ihP0pZO)tLZkYcN&*EZP(WX5u2>t z)PgY;&Xh}onO{IqeoYcCIdkk@9aH#gD^Zi_J+mk0G6;jK*J4p_vRIX|=O+!BCcus1Sn^&hzj|?{kELb3pv>QVyi|2lAcB ziwW57KeNe-VIx&^-r`HfsP_Wj>SkI!@vKnXL3-zsib(8MFFN?zWhpeCdH-KS0l$5^ zPIKZRXGL};P--Fp6Z=xk*gh)|_WEkpp}Zu$b7(5XL9gUX^h&d-7mEO-p$jfI?0(!2 zxWjj*ZPG!N8Y76gBV5f+Ye}Rj;hBBx z`W4ee3jX{4ae;9#3~XAk6qD0Q(%dh1`MSDPQdrVmaF_KI)Gz~pg(tEUaL^Qe3Wjs5Q%@H+1)3IrssC4FJ{ zY}l>;8oA1l@1aG}ep{J+pcc!T+f0%-Zyc1_xua9f%gGt~pd%)9QOD0wH z32_GzUi6~b^`QuMZ5Nf;Eg3;6ZJS5Py*BQ2ZclU$v{UUB%lzT*0eUaxk&RXwxgw#* zsE|JDMY5%p!2#`2(BfxU1!C;U79&0xFVH|PrT?s{Wd!D_|r#BxI`I%&9WX>_h9OL?5x9+N+e@^?Mms+FAFP1fz?{#*M z(|wdm7K&7h=DMeycW?;|fr10ci|9o&l#GYs zQ`$XIS8Nf6(OGPwO6&Dsn$H>OoCJVYEk3i{Z}=IS=J`e}caHWc=wJO~n%{vQvF~jW zVi&o(3!zIUt^a;hmmKxk7y)tm*~;#hqapq&xmx0tu~Ww3&w|wYS?XADpjg;VvYX6> zHI2vsp0wL_GEeaXsXREeZGdIRb#^+^sReAO+K9C0Yt-yIvf{_rXF19NVzuf>uMf1G zkUegNZLIViNXk$-$< zFgmJld*bE}Jc~p`b}YnOXD*M2J7ZVoQWD7JU$Gugh%H%bflPDi7hf*rN3+Q^@oG|u) z%VK~odQ^Jw%7KVkoInFG`2xZ<076~yXBs1o^}nVu=B@hi0q+3*m6pK<#hrR(%X5Vt z$lzOP<{k{yMHmCweCv-e#@_y@dW4rRZg~&rw3iw|=&dnXjdhVc8?SP$MI4>{-><&? zuj37jBD{+Kzm7MQ~K-4QsEh>j&vvemb3ivhwbVFM6V%T8Oo7-hEehMpG$595|959?ml8o z^FQ+@24d65g_!kLmL)s&RMKw?jL0ca7lL8uxJ@0t_YIhtQ%Kj#eoP7<3JK&p&yGDV zlZ21$*ko56mvOyf-`-ut$*7x*(oe_P(mh)gk~-JmXwGKS7@ca`8u$TazDt80tR#Bjg$RNg}WM*+7L~a|P2b)e$B%v@$GCEna=W@yH?X+CnR%-VpUc zSUx`C2@8;Cg`O{upPRZ*Thp-^4^6ULpWJmmxk_FSZcZ>H{Q?oiw}<>~U2JndgQmhga1L`;<` z9rzdl{c*y9Gi~*JCzq8e!smt3c(R_ie^$FOE()hH6r(J2!am{6HRw#e_Bhl%EtnOx z{CNGsa_wfwT!ZU}tESa8q6?uK(iAtjEt@_pyH}Xc(>~q0DZv@Oa6HRsa+hfPeATCe z8;~1mNAc#we@%95RGQ`S+a_H)kUeZRnGH9nbEKgW_fVbn#~EsWFaB7<36}E)Z2+#2 zyiTuaHQu1TsIbPmw~u!P7QGgK)(sGC z-%7B^hvG$YpJ6-xgSQ$?m*&0Tt#I?iccRY!BVs+4@t?#x9^Tszhaxx{R^hkQ6-&x3 zUc8m7f8_-6Tr3px)P6@1Bw)@~ct|hd1;gpAqrlY@HsYV>aC=*C-~I7i_5XP8wF@V9 z@DFCKOBar6W-aN{MIyj`huKh&=GYy`oi(|cxA0ZwxuNcdnVFldL3rH-^x`@yOS&Bv zuYnEZ^tS|x-JgJ2As{@uH6OTkecq~#OBQ?WolP6=B`+Q>4mbk3n}~3)$oJjmqDhbr zuywwFB1lcRnnf+HcA>)U3_R6#9CfBH#y!LA_nGAd1HCKoIzHpTKb34%T}-G|aq{Mnd)dx=Ql3mwGYeuMk5&5%t3yFbbZUU!Y~ zefp;s{?UT*(avN$BF4Xw%MshWm)@!~+q(0dsvRM%4^^4vpabhd{gysSQ`E77w~Lkz z{-5zg-~iN8M|n&pPHO(+di(p4zbk#g_Vd5LB>wR^5-v8k7aF`|+KHUNAwiznb>5x7 zdCwt1!-uVmOVh0W9pvX{hPX$PRR~q_ZjVe#_$w?88G+@=S0t%G3gE@Pls#{ zyqxp9YWf)FtIPs}q>roeubr}eFXPV`gO2gC5U)iio?u1&Lvxe)5XY%q zz!(CgkYCFIP7yVKw!DNfr*0c63^EXV{pA>(lV&S_{T9GVFGh-yiI${H)(iHopZ$XY z#~m0D)cN?h8w$uNCs(nKVH~OXn?@jh{R`{0alp$5w;RU_<32D)psDO>jVcGr!q$83<=4G$C#=0=O^(ZF zu59ns-nGdNn*s&>%%3c+Qb>FnqRhisx2dL?HId`eWYr4JQR>)|vJIj1iZB(CaF&1Z!3NRoGL*a z+;)a%t|f(+kXu#l>G%Go0pYOkddK+2pb>JXR2&BjKjN-~F4KT!OS{Auyqmb^(WRa< zfHLk3jIcA|TZQNk5k@E`Hw;@PlB;jWP{?k&%Qk3w*Y1PIdrv~6Sy?`*>xZ`7TKaq zoiFnjW636^m5iM8)L@dX9bc;7#DJaNeq*-CX%4V&u-5_Zf(c1Pru822K=c>XpBqRS z%CBB|7weE402#{(FL4egbc~NlnNxwUpK4~-FuJrvJfz_faEblS9m02;9J;~{9bD6nTxec)DZ_Aq5&un*IL4;_a_JtPr>MM%twtMmM zMl~`et>oSG!%{r<&#pE2a+u5hhdKj~k>22p)XxRXNcXDq96VlR%q-IY#x@4QoS;VS z0_rAr_t0hjMsgB{1Iq{sc+CS}taPhP_?55shnf^}G&AJ0WN8jnT5&v6Wh%bmAX#|-(3i-7 zIO0h#=b|59KYq1B8vuq{8b;xW=V1_&*0A-@8OqG3D!T4XTwPNZT2~@2{xmB(q8Rgb((oUdjlq3jSH-)v^4mBi4jGH ze2_s4Uvx&qLlN4w8!k-WeH~vCnYDt4pK(vp`?fKs62#}k*t_Iu%dXx5H8bt1O0Hf3*B5T4kovdq)<6M zAVr(*_3wJ;sUp(klPn{Q%M={I9TZp}56dTWI$_FWzE2789zk$5C8{F)el9FEpOhT= zUR~291egapU=#-5&#Iax6R{uJz0LE2oSp5Z0HYcqV_#tFdY#2gg#$9Hytoe^PvD8T zoI&Ut-+`&Qn4yzRM4FdFMtSl+1W2WaoK3|C+tq<2tt`}D-RIPHs`K^jqwf+P@G@>0 z)YpMb%1zVGWN@3Is$=y&{Xm9J>V5Yy&}Gt8>k~#M1nLcoDMjF)16=Hpg_oFzkvv2fEU7Ah9EY_)daD1cVIHD#(cRU zRGG|oIi-Gx)?ic?>mX4oBUQFm*I3x~03fV$FRIv-oMax!- zi-T9Vx+*!G>jIfb#{1j(eoVJigSj-`V%z2Thx=WBFl(zdoTmsAq$~Vtmtf`B8?wRH zSNTZu)Lr?J+hP*8xGlTS#=nGTdGj32LUbTaytO;v1eI<7Y@o~#x|zKPUBK@6GXnzC z8K$KYD&e3YyD7bqlg{F|XCQsn$=sP$Rb)BxZO+&_~YGV|OmwWl7m* zuzP)gKYSO(D1>#^5D7JJ**iu(g3!kv{JgStX%cf2?{3G>W@=eK@s}Ym>%dc_-P@&m z@&OkOrTh4qZRvg}C-j%!CA>Cj91qzG+5xJUu;D!tvW_4pJU@&1aRWGy9B}6mNcJNJ z=4A+0a+IoNk(Gq9$f|Yiz+}`sv4CM~&+w~bk$jHKdycs4?ifEHaw8Z!y!+d(g(9DY zw?z((9i#4(D0-j=yDzTD$RqNx*$vUJ8*7)MF0cNBOXSGPB z95UrVWC%=LEwd2^#fI;QN$RPw?;JczkyNpocG>Rnz`(=IYqAVF^6e!u`i;{_5Ta%* zAvAto{2AO0E|rL<5;nUxrmZxx82J;Up3C`2@5E`ZXC9UpQ#FS!qt>VRJL3(+8BQ+q zpvmx%@c*@Xo2uvcy~N|U&8~*oxqE$)q;4EJPOYDRNV$8NBt>M}5@1_Cp=1J6zoZP> z-N#A^jWrwkkCT`uDPccztxs8Gg}P8i^c@noP-0xSu^;#9Ajlp#8RkcyBtuth`IXg z5fKbbzH0VwTWzy3+2j9c^sMgqaY;x8on(ZGqatu96Pm;y#;%;1303%w!!3@+10KQO ztozSmf;|ikp4mB#h#6y5shtSByPI@{aa~z9B_R(Bv$zKSR92N7P{s)l(L3{jP+E2%bpBqz8ISTCL8PiS)A4(N&`P zC+2ecoll-Ap#|Q6kR!BDYk}Kg0gFc)nngNU`UP^#lr`kgiKa7Opqh)rG(D;qAlL>} z#YhP}m{oqXum7<8ZlyJ!(DveSr!|Frns2V})!S!z$+*FR{jrMAq(Qg=nXNfbTC7mi zcJ_X|wax5W08wK^_sb@Amg>};K>NuGL6afKa@r5=Oi7}`l|mbsD*mo3r}Zr2&1!4P z2#seV%oOz$^wasNP@|SbyX0~Il!ZDe&w9W?wq$^Ndu=d3&|eX{%31YAJj1y_?_RN` z3BvSbC1)Hx$C)_M3&hbJ2L9s=8Zn`yPcfu za1YLO+q*LLSn6Bb{5!X4kSI9+@%D>P(A;s0nCZG3=S?s%N`wSspJw6Sp{1FDem|rI zx`&At$uEvyW&`=T+_N~p7X4O~(G32I{qYW`@#hCVP^#^|>)0!A>y9_zrVH!i2-{G~ zh-FB!;>aDD^XQDPwYyW-$t}b--R^xdA(GYaa=72zsw1&gG&-2FwI}x3NjA{T^rwZz zBNE*eF(iWPEWUXns?S_9YeJm8_Y4)&4(jv1YJ)#O7mcBwOmVh{6twVeR1B=dW z{i2wRL+RziCXx}S^2*Sbh^k;1uX15J!Kla(g18=cuMIkzhLY}CnKV9J+HPjWwY zLP_?ltaw6>V!k~iHaQy2dzNyx487}&L|HxaJs5r;gztaOM+|}PaT8Z)Lu|6q`E#XO z4TkYfq0dh%{v;k(3sDwIqG@izBl)aAp&hMa)O|W*o@fRKtx5lzm`jGaz}$S>o}4kz zJG|P0@*BKVe73T%o}>jWjGdoG#fxZ85Vsk|^kEqdVTGc_yk2PPlF^nCn)gnk?=!e@1VovuYm7FQ?HM7Z)k6;aQu8R#hPZVoM;42P#nM%XK8aQ&m(xl|>I{){%-(v*W zD^W;7WnsFV%QRDZS&j{AlC?axE!Ant_kX3sx2dVZ0CqE4Rry|7l|9jc)JJG7kBOmu z>HUZz6Sa8Qnv2(ze;^a-`IIkAQkd6FtTuK0EDZaU^iQXBKSq$g_v{vfrRcGb6JJR~ zOVGd%FRZnNsi22dGqpW-zc&{O5n9VAV=c2g4e(y3*bHC6{(4v^_R>V z7iZo&Ly^|a5ls{75A{hwS42pD%clC|!N8XOzLs-59eT!hea}wsuN@vchoaOPVdBgk zcdC`kDLa#bT*dZ!+C9ai7a`bIl+sl~InxQ7p^6q<$$b3T& zlW-0bZ_}KXYkIuvE_{ygl^P;Lo2*(x=^^)@pe&Cegtsg0)5CPwvId0IO>(4I-LM!- z@kDdgoHPN(Z%+BRirUzHpz=1k+DS)>y5CA8%xJ6T4;i)?aWQQ@nYCsL`mLWt{Ohg& zcR$AQ$=HZj(zVE@F*7rhzPD1;zTuGANda(+tA6dhtd`)$`HEh$4X+pL>u=Frt*NU4 zYMPGHC1vWUBSDk&=S}zQye}o74nZXr3*~QTTAh1sd`f)#2mKb-wwg&lF4!>+!4{8# zwbX!NmM{xJE6tjO6;3d5{VHEo7@^Tp{6*OpmCBcMg@=1nX9X%d2*kg zuo|yhLcyH97XZsY}eiDDB z!w0+*6tq=(&au=Iwm`h6MRyt+)TEzIy61W*$zXcuza3J)F75ZUofq4StA(U1SHs9C z#?9;Q4a{%d*m^P=-fpTk=}psWaah?5Q9dxLH0C*EbBKeW=c27UuD-J|FfahN&aUV$ zN5w=0AGxhpF-&D)q>m*|(r+vaAs3F8ZO`6NW)+BrO_&-AkNaqc{Q|O$XIxdY6V3jM zcE>M&9o=y6v`9{o_t%2Rl;Cj5?xdc|0KBTV8Ac(fL~Q`B+7?WQ@vbprMl zTIi#tf|T3>iJDbO6hE;)x$b?3!buYOy`@#y25Q^Z1&3>gzhd3VI!J~rn$ODHBlQ({ z#?hhryW0#1X=#FD&kc{CE{X1w%k4l-#MA@)*6$x`=8`N=D4!o;liizQ50J$tMC+;B zhrGb*-iw#|J3WIv54Ue1Cs2O07`wfp(c?4UZ(%j3&KM&lQ$Nnh4A13*5M+I8WT>}o zMB5+sM@?;Umtev#T-gsHMYGTHxRvnJoGl~Z%u?%J#r6@D>{d2JsZpyhf|F*aTi^xd z*C3kL-rc(+UTwbe!@>0^vQ+sbln8&8M~ULYo`qLAFSQZ0O^^pBc>FA*apk3-&$uu4 z2%jpRcXisF0F{)-O#H2|TBCIRg5``jSK2UDER>p-oAL*1vRhq!)BC1DaOPuMmwJ?N zcVYtMm02<5m7DI<#Y4}KfJpb zmJZb7@f2pS7V#jS6gO=M z)xb{ey?uS!ceU?^;hWZk+byZ6eT!Eg5ee>1_k6siz9XblJd24feDajT+WKRku_pKY z@V*NasC;R(69w)xUoVs|-;Vsb-Vu9(JIe`56}GT`TJ^{#VBS|_a|QlMGz7-myNZ#? zT+5KW?0HDZNQDwiv-*_)*rL8AC>J&sw%7+@mkS=#{AkJAv8d2 z1KExBFh4xF z2&Gb-$Jl8MjaJR?8fKpn)LFxuUi?e0-Teg78o=+p#pW<48Bg+RMt1F?i)YN?6Qc(- zVuEKF@eQ81v6W*CEnxPwAM$0o})iCp^+dCz?icpFd_b(BAuP{BEx%7gmZM;hxSjF#O1%(+*l>b zQ4f;|);ID~fWRGW4?$z2Kt#Fa%-YsGLbp;sJcMaWiyWyrcw_agwqpznjDA6vR(h&m zgSI4C02>3+muYC>J>3Y?nB<%QWjoL2I`nqgSptQ&v%~Y+Rb9^;!@gTkzPIxqb&tKF zUNthv$_)2lUqkvXHk(0!JCpY_YHHZ^X>lST)SR~^r8(CDz?_?-$K3}0+*{tDiIY?% zbW=(SjU+;n zm+n!l^-#dUWW-Q9sA<}+Ze)0%$r{4-IR?0~)LW~v;ObEUsvt}uha7VUXipIc*QAqAhr1VOh(i6+1T!GV^!|L8&K0~&~s8U0=$PQXP1PK z21a0w9WsYRUrV5faPiW0p}Q?ulHAhJK7k&UuQLfI_FK>;pqQR*(`k`%iWc4Hd}5xF zdP7^yFMnaEX?!d4N9OHsta|RFv-84$Iz37QwsD0W3>D`j09xG1Y>++@19ADx83^>Y z*G)h0r6LQ zQBl2!@_r=#;{0yq14G5KF5s)U=jeaUz@$5C+A*RHSS|(@$M`j8PY=73CR z{K3ye6^@248^8)KNG6(jqNtyl^%T9;SlmBcaxh8W-u<>|V?Xg^L&uNAYNA~-am8X# zLH)D1*XGkk6}6}&Tn{43w(g~wrn`e_G4F$lH$f&M;`;P!anecRIHEk7%#-maA10W@ z@e&A@q4wtIq#DN+>EwH|R0}Mor`~WoYFTWIKYms#p1GH4!cpcdXOcWJ(QgbA8OqyR z0(s|1xy%^#q@-HuI5mtNM;;WN#szQInDMF~maX;Pk03%$#$lAfI_n z3IV}n-WbrqKs*N5 zhqEW2ot2D8=^ekEix9dzSzL`$>S;7mcJS6rSiZWR>ighAQ$95TTew}Bf%L=O)Zl%2 zF2+NJ#9^jswMgJj9h8=a23sY7Kfi+ZZOuMAj55wLbpOub2xaRB6E?O+s#neaRfxho zS6(4BTWDP+FO4#6BRVQl*mBZFlK5M<;R7x4?`cpuHQsds^{ioHoy-0?l2+E{N=SZt zDMg69m9@Ig0-|e<7TEn0?TSXaC2#69q#vDCuPDz1`-x==Or-X%99hVk4(Qt&zujV$3!rR%0MYT=9$_ zeusnjzN@QeumeR+bN>3AZ!M}|{Ja>JQw<3Ove6SKBJuQS@jHdFV?iSpwsw65v_O15 zk{2+6JJSA#2^?F~jV;Mv-vlbE2-JcnFKsCxJoThxNz-dY2dxxSQwt;RY5-FjO{{7H z!Kh=zL&=MQGf0+2HtYk-m*8w6KR24XtL#ycxw#ecUq2QCOQ{0K`Uc;%?skIomilRh zJ@>L3LM!;k!$Z~WtR(0dM7eqo9vLrd5*metcYAv~(77JZ6MWi?6KHcIJ?S&13qwfJ z66~U3 zcd2`RZ?yI6?opV@^xkg0_@GHO{tIAg(D+5OPUov~mbxswe~PY__m?hZL{pgj8(%!( zuR0-RF(`_iP6+Cv>Y|7d;3;WYaOh}dg@8=)Wu$;dk~6m zw}R`kiNd<1uVtqCio^Z+>_z?jsI>IdNM)N>kIDiea&WCLNR2@Tp>fv1(**XH`QK^} zSI!CnGYw!-&2CgTs+1WFL=*?3ZOTCd>+Vmb*4mOD1Fq2F+x|+=)a*^1)p;Y}2Q)?6 z&J&C?&T!WGy}Rv#5tCdN6=@o9qohjPLrJ~C0alM*liA5btuYpEX@svZS{fL93Jzu| z2gQ}rJW28@5JT}+^63~qo%CtstxqK5x(oW+l*U%oalvMfQ&A6rxJe)o*a&zp!TMOG z6dJGU&x!OF6TuF$6=O?z#!dH|LeHXS!JXh=ULW*w+6PgqQ%;;q=#Xf*)pxE0d7rC# zUS#K*e>CJmwv=Ba+<1<@v%w z00vUf73yw42>-EFs!LbaM`}P~HMQ8Y)q4;G?X`ft(t<$-`W#NeUlk_6iC62T-i7e5BZ{U_n&sQ4(?750WReSY9F!|tE%i!&;fFXZrO*uaQP zsmAiffAt`{*biV|>am&G6BL#|?g6MM#n2~UyX9hQ2G11`o2OH}3EgHnm-ODTV`x1X z6D787uPgDKDWho?Z%r)8 zLY$Nry;~B{?sV}Q7RS6h%T6Css!@6u{aR4pt()tqeC$rUx>Lx$VzoLwpNxt_3ga$q z+x4eF3Wm(JT1c7zJsG{_^lT?@J$r!?=(kFNBJa+yP55pa7oC1TSi=<8lO+NLzZ$=5 zsY^0{4)Qq~K7aKmu?94`#@4m$*XZuHJ;mpIzSl*U z_al%fpyXwX<&?vGoVxhU<}~VAB-z1|46~ZjOYv1vAPsb8VUV*{P`HE z<7mM#?jltk1#HBvua}{%L$Le{+!61V!=Fy#uVsXQLFMmEVFEF34<7nheEg8rQBQXO7;C?lkY7@A;RpucP1euFWyU0a?uI;Mc$EPvxi~@%P~}?f_s!E&{t19tcD?ZZ zrW0jS{>JSh;`DC&KPhY{)aeciM)U9Y05kVdXSaziaKCvX>?LDZkYjRtoD|onK;^%`5orR&s%Q@)lk$sJH7}l$P{WzkT@ul~ zUBA1waF7n%h7RvnVP5$*aj^Mo8z2S7O*!~-Jc=cw<;VlOF^AqPkg3JH0_T$qpLt%#t`dW~@NgP&mL2J{qh+_F-*21&LhhZ`dUYQJ4aSKCSIM1= z2JQZSxL-N%-E{j)B%TW_W$Vv&UG$Bv`E^YX)y_U~2P(!yd}A2h_(|TPW-t2j!5^2z zU$23>^}kX^-uVG|aR6JSS7snH$99FhzoM+@oFSEmJ$zxKuS*uL^&>(3li00_J@O~e zH)CPt#4S9R-jOo$IeV&0;m+j0J#28GWjMY1N6r^GWbpNqE63&huOr;;m^rv#%c~!n zSG&`C#OHJFUU?D?s)i{F&JLV?uo)$Eh&nO5b&cxbz--`qdF@fc;rQT9pZ(t&-iI4M z^6|YbrahP6OUVE2jqu)017v2(F%kk*1G(Vm*B_H|b$#IPk$Y4s^_ z)8V6N+uTyOE~9F_S#cF2$wHC|3EhLm=|Ea^%Xaa>hOGVItYsrSJi1;%J4@WNr>SYj z-2Z85zFa-pXSFri&5hHCR`1UN@Xrq_062_AQAf)WqcwJu8=NM`H~kiGnM6kLH2!;( zm0BQMO9j*IG8*S5+N(`YsRnGO-VjwbJkJIMiOKIhIq3Tt-0i1iRyW=<2d?Wq;Rkh= zzi!NWBd}zisrEIhhg>NIq1hO)Ga|5bnYn%%_d&XO1J%TNwF-e>sN)%T(kUW-Wo8kR4VPLoqha+kgM2@cQpDwXgOQ0mjc>A31fYV{=<2XPiw-P=7pN z%8!zNK zChopU7VdGY-BG%kMk10u7!9r%L*_mQF3V_BV;0v*9#IM1{5}g?w++Wb;v(`_vk1-1 zx_Oq}G|AnVyH*Wj1#jaAeOlZ2u?|iaDj$5SCUT72KyIH89&cBVqzM$OxCIl=bNrKI zeV6zSINhcj-8oy12b|*lbCU0gga|vd-OyPU-hrvRJC~`bJS|I}k$!?1*MwL5r!Pl> z@a{$dc!qbufRWp}UtMpX8*R=B-wbSQJQNPW7m|{?su7*- zTtI@|GhaiaEbiNxqZ?*>8o(}6#{pi?`-(m1tj z&(_+#gXA)u9{j9u`1uB%_PlON5TtD}v)veDOV2w>z+N<`B(I#J@F5wvU@#kRlAUtI zo#MoQn#D?+fzqx9&lV)Qzzq1(=&pJK+FjK@hUq^W=pi+5n!V6bau&$KVN8o5jY8=w z`3awa5)R7Rg*Ex&k%@LUPnuwb8a;|1T!x*>Cp~Sp#|sK~>|(%+V?4)ew;w>ha*u{P zJe8jvB^^wu?Rot(N2kPG={D+NokNLuxf4~Z(X@o-T$y9^)I!u`NXwvE(}c2fG!x^O zM#;}Kg})tsnxes{?jfE0$XF>&-QWX>hg#)>QgRU>b3g)8+kLeiK;Z_LfpwJH_V&4N zWlayl0UlU4p48U6WsbCLxq|sukk=YW94a-9&}1}=tY=MkR(c^A^FU<59UnMrilvl> z9=EndUu`&^2=2={@aS`K6kVy8FvD^UQI%E5?fX@Tx37ZYXc1`%5wwo0j}Budk^RSw zlSI2Vr&}tzX^iLB$QF zlQ*LF#Q-N6{2#&FF_3G_e&#jr7_G^YIqk8!-U<(D(4l-BbwbApw0*VoBRnIbV69TE zro1Ri)jW+METCFwO?Cw)|gZTf4r+ssi~B8slq`M*+1V1NPhsqP_3Q1z@!1ZKu$_3BsJDg&2Sb=uOJt~pu_c7D!Lopz_+l+n@p56)_h_kBPnYaRX4;ii)rZUT1>DmyJ%aF; z4Tx|@v?5qTN!S2=t38}l$<8=f0EvdbjE5xvyxvaCjeF0P!j9JBzgja1Ip#L)uuUH< z$PV&;MRCvp;4}-#()Zz*Zz;m;3lyzN=HVwxYz`Jf-pta8+AiZd-qQ<8nQD)jY~pt6 z`|2gi?ZN>sy;*B1Bg+FwdK}C|sj@ZpAhK7>g7cne;^36AMmXKAs1=dg-81NW-d*vu zk9Kj!#}60&4a9C3-oV^pqd&&$Xr&hyUz4UtLb7s0A7pA6t*1?8tpF?*_3{f9J>y4p ze9<-%j+wp=>=Lo2x;MF%&S%A0jw5I6?`O5&QTxeW_ndz_5?nLJUvqeD^$TZil_6Jm z)6ZDla~LtqC5vMpH*!(8HajU&aTuBMC?V%|%@?+LrqyEx3^?5&#p;9;@g-0qEDnL+ zYSguL%O8vU(r~&hH${t$v8Q@#ZxoI~JUr8VAqmo53$>T>qDw4bkJspt;AzsEag}Fz zXq*|qZ)Jx93Uu*FhBJXg)zY}k!W(Ph)eY3N5N-Owog8%9w06@*^{TssS`pf!tOdq5 zov+Xo#+2GK86lr%L86a@b*Rp|D7_sW>~oou$BYXOVAm7cEttH+nBRW#z`=#AnPE;u zt_CS{J|fQ@)mrHWuGa23WEuOr6*ZKlPQ$Mh-8Dm1j1kmUmnO-N$=AK}?REk)ELzm$RY+J(XG3{8YoRx5r}^X}8eArI zBa9<X^HgAB2kiN4v=)dS}U4Gd7((J@>Q5`49`O9rJFT6m2H z!7d9dp<7h;17p4oe}O7fW>L_wQ_d8Z)*k*&M?(wm-y-!*!TLfpve=%Bq#} zW2KlMh-rD4N>1zVNnO&-{iyv9ES=2Gr#BR)!3*v)Z=ia$d3FpXSY+#jXts$|!nOZV z#Noy}y$Pq^wQ1+&y;6m>u;s{>H&EHIFSB$K5(*4NArWIGLv_*E-z&e&{@Z{oh=J|r8EK;rn2uK-wd?TE|<@S)EC`T!HzGDej%=?|pbfLl;% zI0Twlusc3%ut617YtRM)S^RCLm;|w`P&p1*w@$S4^z$@WbYN(G+I@5|%=hP34~M|bD;aSnG=uMUBZl@9yfClM%3Ty3-#9{q-IBtKtiyfhkb zZ@Hr&m6?2^=*>KX`l@X1O5!GUo3k%q?WaX8!pfdCZ+KxW=Y^-_6QW*(v^Q4*?7UWY z`qR_B?E0w0`z%+LLREep@s(p8>1GCg`B2X6^_@JZWTyi*pTV-{nN1&vBn3Vp9J@$) za2YamUCFI0XdpzcKXyQx`OO=54|}f;%!Ijx_lP(0E=0?*=k2cdkk5+AUNKT*zTMiX zEU5n5PKd72`0{63+=SDPKa_Z7Lg!g=Y2~_Jae?mgPzmwg$3AU*TCNAd&Mmddp;RyG zbd=dpAjKcxbWAFt(1SYwsIOgcFQ19D*AOTNo^Bn_5-~jUIh9$GxM()_VZhWK-n5v* zMs2fH+W9@_kfgN5)zao+(H=$-23)yd3&+Xl)!*tWW3899U9QR6N0`QhQ%!0*1glW; zG9m8HIj#JdRjO%d1%)1R(aSQLuW&YINLSg8iD}QbzFtXop0S@YYfMj1K@Fv%&(RXc{q0%8@uSjU z{Z4)s(&Dik$zuvNjQ+cV<&~t3zs}|*t-xnf&*JBT0&m>U$*N9EdF_X`(3U9x#DBiWc zH9utiI~#LturR$5=UVn9#FZO}ykqZ4HKDUDC_l0j#RAJ8M#jp&9=g4C39r4n9Kk9l z5U`#KmTmRSe|(CU!k6Y5anomL`1P)+Sjef0G2Xl4sTm7MEleZ*0n)wuTW^q^bo6g2 zvb8HSjIV)jT-Jv5#{lHQ9-fI-3=fkJm>9f!XQrOsU2eiBSh?oGxIXumN7ES1?I5hk zm41z$>m^s>)xNCqr;67;7qQ`em0J&WO=P<7;BzmT6IT)^T^VUCbw8M$mVnKYBx=%H zb@~x6$~*p`^i}H9^{GOui6c0ow#BjKfpdSbdu&COk4=l$^KzA!EZ_M}(}lhbOz|W; z(TGb8Xsp^p-i;4ZonR;G@%P*Lv7ed@?SfNWw(5UE{A!pcr%A3B$Zu`69bDxUicXtV z>x8E>8Gti5x{j=U^u{R??|Uk7hln=TJTd6x*Cmw%JNguLfq92%g#^F;u>Nd&uYS+G zAIJqo-kl%XKxSj2kH*$tgp(zoSh&1~#A{oAT}9@dB-2YjFr%Sgesu}Vrv;TtMV`?bcKd2`IqlUdRLo?r zk_o5A>nUr6>+&RT#=WZqm#LR?^Q@Lje%Pm{=dl6^!LX>s%tA*I z`QVW6_1SF6D(cIu$1FlcFAK>-+Ru{dU(T?SLV)RB1e z1bn!ZOeJTGbk!%G{t~8ZHcy@x>y0lOp%r7yt1~VEnij1+6}^+A9oEhr_seoy0itmh z+MZpNO$5%3dJxoi%-;~QSi48RN=;HfcH_$gBD)qE6=`knA91xz6|NE%e*cy;)i~eQ z9_i=AW}6oKLgmg`-``Rv)*xZMSfYp7B)hM41JFW8)ejmUp58d*Cd^aof10Q^~+n`ZDU@^1k$6vLEBU6C5w# zfmS0X9>jC%Kc~V-|0`1@ioyly=2b)}9slRyBC1ch{1HdL%XkQ$bP9^Tnyr`hrfU~UInh-AqoDTMD1Rt0Fp{^o$G7#jg;O>`SI^X=9_GqC@+J9DBWEY zlT`f0ocGm84PO;$#Hgqh~z<+3hcYvi)|wh}Xd`+knm2Ie{yKj}}6 z`h^y>0TXJ-Q~TFb6enzY&t__6!D4)mpAI&d$!=|HpGang9@J&jhlK)nJEgwK6P3z= zRox(;eu=n*?^l&q_+mcULt^`rm?`_cS2&%LdW(_ufRpaIVhtli@eYrt4&4`Snj8QH zYM@U0WodXeW+ol)C}jLZa^Y&@?T^zDoy@{Cy7EvM)$0uzp(QHy%kB>b281!N_EpU| zlFei-I;Fw;d)pIlsRYI`OYuh(s3QUg-!aJ=-nnon5W0xGr$X0*>H=U6+#`ytpkaj3 zJ%tol85zUD=4G1QuO_D*CfS}Xa3f@tTk*fuxih5Q z8gm%W*JgWx%Zx+Sv5S$P`7t!$lEcfC4YJ|ECeQdwwWp0tQISrrfixZ_P=gt3bM|4i ziJM7IAE#X~z(%{ioCTWONc(J6QF*-EZLN1~p5jb1eof-~7{|-~b~!lfRY0lEVGkS2 z_jxK6|IjR3yusJZ$64Y{F|d68mD;Axyb79nub_bc&bWsKT&Tgf_IaPX>;3cCXLGba z2w~@8;b7I?F7hwTJ=PGoJ1rt~I8ECnByf!6yRy&5CB4uppIw&S_celIZfxdTX&ym4 zo&&94coTsYKXGmO*_cDBRrE|mj`&V=u)O*RcJ0>XFzfi6Dw^qs;O*g^5@Yf9r2K|B z4#vSYl zWXK=(6ieG7*GlmXd0dmcj~_ZYmbZ!!jr-H}c%3y^$*}=qWGiQ+t3THgDgJp=(4f<) zh$P|G9!8|uxIK9RX-RC`s<$a}Q~UMqm77Sdo5Q?|{;0PN?Zc7hUvo8w^P)1K5eX?X z3I5-l>QCw2r+f(cO8Qt?-ozLEZjDWt(50A$*7j$$t@WIQ=ybwwHcJ;v3;$91hCP?j zOgz+KG=H^fd3SmWoIE9r#9m8h7{UAoZ>_>D+#{z+#`758fl3>pFJ;G+Q=^#z%NQv|g(mP1+pcF$3 zA%rBfz&qi;)?Rz>ao!K-ocV!)8AF|!^Qrf9UDr?j#EV_eFK!aOX}#>@F2cg@5R4n` zM>?diO!KCUfaQw4>jh?0caZ_(Ue6C)2M_V2jVjrMv>|k1KVWQWZZw(yOXr0%?Gw#J zq!+)j%{+QJjt-d~*#u6NRM>@JRE+LkNfJYn^s*aL%nN5VVc^BcQIhy9oO>XSk#Kx_ z2;y$!1&Ohe%HbQ~#R3xhrcB54p!t17kXq~}zIA^!SMp<|Bz9aY+Z{3VZ$CiuUJvv> zdQW(kA%hSB6X|kS=N9cc@X$G1{!sQC2C?t}A3_++HYN_MQZK)%Tconxvm~p;g;u$e z!A*H$DoO3HvS#Se|6SnjZ`op8u~dO`=kr_t9jc+eM1gq*o894XC{?ecF=?nB=+A9j z(eUyqD{E>@9QIMQc5=`EZCPDxT^mK=3uP@gDmL{mOj78&eE5ivD9c^shqfAYg}=25Zv2t+Uan-P|>(D*K67E z9XY%i9V!8)6ed=v5EWM2?xG2t8+QI%qm`F+n;X zH0|S4I!s|M4ol#-JG|43V%`t1T*so>B5s5@?o?+u!9olHaDt0r>CeqK3($aNNc(C; z(DX6SXNt9b2pl!#^sWqx5xuunOmvEZmpjX!Y)TJ1AB%AdfEym}0|)pxpX35K?HU55 z&YI)jcvP0OWKZ=SNp4D0r!vX!-xSewcJj%<*)q#u1zz^4#Bf&v1>?=TJ7(oNW-rw~ z8DW8Q22>T1YuA>WXncM*@;}z7sVQsb#?GRAg%go0UMJ%6KLF9n&o;hUOJ%=}$-lG7 z5J5bKN_mf8HFpY&^jpxUDi?&V;IyVbnf3i^iHo z%f4M&@>t>y@bQ&*Yfy3Wcb^NXr?q$K{Cmq*vbkydHV+WRHTJg6@cJZ6HUXK{vx&V0 zpDJch;mmX%OR!X`xw?`CtWB#4d(-hGoDce+*~DcV`|`^BJz%sEja<}LA3Oze1J3pp zWu>(nP+whp+ncu5cy3Liaxu$gp8%(Din5)kKT{#L+L&h-fHq#H(g7+Nt|>~OtYoC8 zKU2A3{zhxVD#q!&(l|NQ`??=kdOo0`qzd3fBQ-BDzqe?C&0fNK36A`A4~IVs-0PDM zF4oPX2;vt`kp3@eB)Om%A0LmDSedad1=bX>J9~6ldhoUK9nm7dw(6p73o{km**&_l z1w7Is6UTt&mGVvI#9GW)q&c-z3`O>(a>q{VEnz;>Nnlr^YiRhWb?NfvH`u!W>GCy6 zZb`kI&|(fRt0W)a@%g@&-GfZhM&I zgI>C*kF9RWXVDec>rVC~F`#n2V0LI7Fm}k7FU+{CjR8syyIy3Mv2|ipl0IrB;wEG9 z@GG%yXTaOGGG_q2%~XA;Hf;QanAAzM7fG%QuRoI3DBVKUMIQcum`s*%PbdX2b^v;N z=?+d-D4Zuxu!dYbbYKehv3Y4_&15S-TE~TE&RjEnrfbBW3;%m_@R)+@yvWc z;~l&9GV^aEF`kK2I?B3L8D$XSlkb%`2=xx=^bo?w0Tj6=DIfgpoBj2&Eg zQb+0FuLtes4YK>ujm8~xCx4G+PZslm#Nfb?orkX5=H8(PCAm<>Rz$KoGupVjoh|q{ww~!%?^4qAZFp`n|8*Z? z)TLabB5B#{n&)0AUUOL>e>+J!bJ;<^g<#^qn(2F}E-VVBA#qP1KtQJ4&8UiYDH8_R z6=A` zx4P$`@e%lBa|qzL{1fKivKLulFoe5pS!0~7CtsL6eZBYO^2GFzxn<}Z5De=@?gFV? zEI`(`a$#+Y2Y}o}oX_~$RYTa*xrOXm%uUJ7UG6;<$h+{ z{!&+`lyjFp$(DcC{_u2M976i`+3Clrx=}dYLl3&zq>-aV_LAY-b^jd9Tk&OMk~YUUK&rR_%(&Y=H{KdAR4296b{EmPpVH0^X{tB& z(RtF;`D{^EE$Swv4xM6Fsux@PES;!oR(^S=)&;aKGynAGn#Z$Qv-$Nv^7@w#27qN} zorEzxj&4XCm~@3#bch);8wU6&x6=9m@w`c^4;B`QXv?6INrR?*CFK7?Fv*-?tmd(y zQ^RZ2LxGP22-lYO{BVIEcYr&8vWAhc_M2eisM%wxYJM(Q=L~zQ=r6t!Tlmk;?fEqz z_F+3|hwJ0*xf#>Q8G(`$<%CFzw}andXI+U!fNIRP0(93cJWw7QS^e`IkXAHz7Br`;(!5Ugicl;eL^8Eq*wGs# zq)aa!A8C#EcY*q+OCc1$px1~LbUbHj=LugupB^w@Z3mv-__2D~aH?Wy$dstapW(Q+ z_@yGc_#6Q#o`IF4mu`P^B`+JpN8{H1c~ZdWUs4kG^b`aOYW&6lCDbr1?sh>LKDLmo zqI-II!Vk0&{NPHu2k2g0AVY_Gkx$P?)FEqu0RS+ks$*?;O%?h)SMje{C5M~daT;S% zWfWRDe*+G0D&SYAiJwBmevP)U6~Q3j$I!aRYf;*<-tKHlhk!7DF_EtEo}MGnPnfBUhgh%}-41N@yVA|(>eIDr z;c$)|AZy0$`G1;&ilE*x_Tkhfb{PsslZ5-eq=%d@ z2-AwV@d{FbW$yBf@4OV&G1`5E`~$?`)hR~oX$_mf;liCt*WJf#8xZBk- z{PW-1+Rx>DRen!wzc5?GF7yEsJ!#Mj1uf48^rcYb6!-&F^_JSdgZNR8{ws)|)V?Q* z-t);LAv#c>$$xBGU7>-!J$9n^82k$$JIfE7iwBiO`A;7FeDeg^^MAEy@m@}vDtKsQ zm76~N!Jt}M1T_Fcehj$7KgqNyuZAjqy-cgOvxhkr3*5O2Qh*(k8;MN6T$P^o zfY=%(af9f&`S)W5&!zgR;9S@mqcb7D05PbGB4(K&=>zPSeZ?g_pU&-dl@H#kr1~$5XZsODTZJ{>33JJ49S8VAMU>>$+&wt8ZIO4W110 zySm7oFODkm6$V%KM)!+#s>acv!%raf+<9m?WO1Mu{K+y=>IOdG^Th9$V9C&0LcGf{ z$Mn%l+CeYBtEc}KmOf|gg3k1uvS#g>OK~lS2sNvA9AGA=M1qf4&xR64yMEH?`8+vm z(}&C;z1S*q5*u6q%>&5k^k|eXOY#1fqfcec>GRxG_9|omydcG7y!}$T$eJ-cQW-bG z(zhRy=gXGwN`3uVNX*Y=6Fp>T>hmqj1iglbs9M#z@#v|@+~#wW0+7J~Evi(18}J5i z9`#d@;~#^Trhdl5zap)^teJp7sK7y_8jBMSbSUu8B)&vsrCFxfZP|X#>m42g?1<_b z!>JXEBzN2w@tefD=?&|kz0KW+>7iqTusQXc6`6shJgZ}zHS)g!dFMYP=JSSdRZSg! z4B?mAc`iKiHs>+<;%2|ol=3&`>UoQt!=hQ+T|>GW64ekIJ*7RZp5*?UEye@=nRoS= z?R?%)y$w#^i-p9*@|pE20$x#@kbr40UC0TAK=X;$#k)Pvg)cUIk^~k{_b6-eOt%?>Ug3jRbcktK$Y$$gf>4#|Ghtu^VUIS7!w(DbeOciIo4wu zvM_~G>;KU{*)Z}AG%tDCSb6xC_Xr_8Jg zYXZC-`f7~?&2ujfyH3qplev*^M!GG(xN0_hzK*EIp8Ez03qgP0cGJ%-#vMn{1g_O< z7_pvjW_cE#aVJ8~lA0>UXHfI;MZaPz@>+^RTTWkO)9=Dj`30(a zfJMXM!lF@6;7{|8l|V76na^c%4M&2o$HkzEHS&vq{Ni|O^D}WbAP7zMS%N^ zoVar7S-i>_>z*&aFySX)h534Jg$ay2jrea?n1;3Kg%ck_{3`GoZs(2AO0x{5iwiHK zV~n>#fupP02I9J-})&7>ndxcf;oJvxE)KL(}+TH%Gc%#$~7 z@mIsTvIbZLk__o|g#+inVp6ma(U5A8(6EYzM^F#FR}IEvB|O6pwu#07UV>@Dnh$FF|`kbRkZdEl!mD z#DxfLTgl-DOMnH!qO$)UL4&-jPBHknkTdL*jO^hcz83-s>-Y=4u7X@X=A zgxbS2`%wZ|j2TB=CZy z#(tY=H%@6|x+le*$X$nt1N2}dr~0HV2dy+fsleYzBJvQS0TgY{Nrp$OJPI>c{#DM& zXz8gisHR_ECkf*ezTWI#;&{ev2UK;G_fF%1{IdM&ej&Cg$?7oF(Zj+zhMF3G+23>Z z`6GR9nv7l@25Q>`&D^yFQd>z7N%i1rwpjCBpr*6$rh*sFJA7tcRzFbf4V!fcRNv+a zxKnzyk!iMamQ?svGepq*c(!0qq`W8K zm3Li1gRLmVYv%foZAGmHviCV5F>#)`^_Benm$GE5iQL}hdWwE;^fC)txMm@&^q86T zPMp$E{ac|2!A!ht1PBZgl+S)rGy;A<~zj^^X@xR^Jmca5eul0 zBipj+W8f2%B>wWjpETP{cpTq1WTfA`rIjW!;Qc1)%XLm!$#Gv+vHWV4NpToO%~@dQqH{8O4rt|@MuvXvZXPU8nf>qsJjU%#5U zw^!}#Bk54Rg4Lh!Y=sN>R+VHQzpE)6yTu}>zlFI^qJ5Ufhb5Q-0119aLddsqrv{`D z+8xagi^!yd{?1;`A4AqGsUe2a$zYj4FQ+8`Ad+Ie@i1s(xFeu7sZL z93f8hlWZsbl1cdif*jy5k;726EBB6$rdqgZvqS#X0%W6Ez^p9JpykYoJvA|+8C@xN!g^Z${k zG}yz`^Q%;Grjqjk%lQZIX$qkAuZ|Yn)1yr!&Rsfp0Ba6WVf$xb|Mf#_VD@ui=0OMR zYPJL9Xe=}FB6-@YHX!hpAn$Los;ayHO7`}lDEC9e)_Qlj6cRlbr8qbG{QG(u59E)* z8Ki#6pj^&B`;mHA{Ly)8#0K70gu2gK)N4s%TPt6KH}+4#d>*FO_xgJ_84_TI{w%hC zZnP2aEXMw0xVcFw*`^ymm*XgKlWybOvhmZYlWbXu3-TODOYpw_{^rGB1FS*$BYPh{ z*7Az~DDFl4a~n@H`?Q_$yC2RSMnv1-&cD9ru&kv1ZSI*5QaZp6Xw2r5pEXg>&5Q5z zGkQuqkM-N5XzVIK(R<8=N#o}$&!BV5&Rsp*x4`qh_-7k9xPcUb@-k_vE<*X8(|IMp zvNJDwv;{As8&_BngeN{b-oR|re;QjmVMR}M(mvln9S()!g+{0z2NgAf4+(XS?JEzXy z+)Zf`b@?6#pf6-Fp^ZXo8BRF9vWzBGU6Lw!K1cF6exAhLW9d(&u|ofZ3Syak?Obr)UY`x7HSQ0t;BJb3mVF}fep#tf?CXu^ z3#>)VDj)TS*W1Ep{KG%G#Z@Ma3(d<<8syAU*3nph#>MHEMK3)ZrYj2VE>z66&UBNy zj=6yVR!RT4wq+GU17FKQ55*aRjloZ~ZJIJ4@*XV>193sqBNmra`15l-PO?%S*7$y; zb>GVUj!$MzK`_wNF#j4~kBk|wP-HbA|H@hs_J>9iTzGq2+={7vkjpT8q;o|ev0F=A zh8!6bQ7G%Z$VKPW{P44l1?8y5bWW1L^$!&&K7D15s4jl}K=sdwt4>zCm7IYIL!Pu> zqBdy0Et?wwoIU@y%i`X}YgC-ClAW4=(33NYmX9*}-W5VUVRJ~D(pt4!z?dRmIMU8u zxU)UREd$pB=PW;-v=ykAlS6oXD7Jj3&bBdVJV=p`=9EMxW#=@hBy|K{)B9YJhD~iv z&KPv%0XKfRs~Ei`FhuA4w~h*wGDOYo`N8GJ|8O9w5I{X%Elra+32p`nU1qs}rftD-1?QflB}u^@r9(G%@z_o2&+Hd99(H!Qv*x zLyO_~drR_14E_&#WEnIfzmY`IRzJ3ZXtuLV?g++SB|MmqT+OO$ST}kT22xa2ko#il z3f$W;osJ-%yKpt)pYp^M>Y%;Z5e(An%5* z^p|e&2O}#_7LvOkbhj~SW22)6b)Hd2jEkp~%6E4qW{2pAMk03&GwbHB^zT&B2}IS= z`uXq-D}P)OPQY{Pj@B>0=l|Op?HgVzsTbW*-7((wd8vZ(2qm68`itC zV>b`~N29z?bkntATo_&&en9MwdWhcHq+g;qtvO>e+fR26_d$;4JD_=%a=YP6P24Y4 zlY-8LvPwbh(Igri+jSTAG8&>6Ae;Tzn0!n1u~DPMEB^INE;EPwd`Swh0sq?G+;&%H z^T3QO>jk0Sb%K5Lj`)CG_xc;BxD2<<)?&o*J>qfe`;utH*FL9m5x?iM4^rkLJreJg zw*)C4jMy9!wN%pxJSa}{5uJ}+e2ERVQk zFFG(g-gmJX+NBx#a8+HVg5)rL+M7;tC}Z!j^ehJ}xLc{Bfn4mAkEA^2fuz@a)>F=3 zVsvd|p`MJqc9;%=fDyBVZI24Y7yWvxl&Q3{?N&**P(2=h(L~$v*I9|R)l3x))3f)) z;yx>dY=91};a9mCT_Z3G3IZWTO|XH@?Gawalzv?)i2<=MpL)}zOhZ%!jk* zrVB>iU7!UCX+Qr8mdwZP<+IW72)pUOoH+Hi6<3vc%?_zR8rdu_sYOMzso_it;&Z6wTzTr~5p1h+?K99(Yu#tT@?q0vi*c z@Y9DII?2?1Y3gedNF2A=e{99{tFzKKacJ~`AyvBT9eVw2{;9-Bre-qOjJ=G0^HSor zhpU5i#i9IEPY=!BZ-eN$*IBtMm4(DS0>hVA^vYbGC7|zUEM49b2eT3zj>t5zFBxT6FUgbn&LJ!g>cUF zYGSUCXMj4 zuHwW3dI7R;lS||!JLlo<%IaX&u1VU&n{h_%m)*AyJm_G8S2n0&Uamtx5ZiyQ_b%G^ zsKKFgxz*M33^tXy#ONy@&$!L)^+{gg9(u2~0~Osr$(>1WawawK{0G_3aB8uYCExUt(YkI=L0t5W0jH2Rp(YzT~tzL@m(U{*> z`yN#<68%N=%|>&RxHkA^D=hxDGpjz{Lzxb(=MMGF^6R`V*W6I6zD}Z%*zUt}>c5UvHM@zLRH$Zje-uY8_`o*Pthr^;|ZvUvAc~c28Bi%*Wx zDhXHiW=L6;Cwa&Id3X7n#m`Wc1Gozyq zAZK`}6c;DwFYjgy&0(=H=x%1>a62N(ervM&#*>9n8SIT3E*U~V93iS(Ul{8{fMI=P zf{zS4in*ATDwR{6vIKAFYliAc>-M_mvF0<+VM7vOXwS50~i?A33 zrz7-Ao=_soHIusV^-Z~|vwlwJkEL&2)8$m-8yMyW{z;vUP;5oe>wJxG;hvNZK{)0f z{qhY$2Tsz**}<^C~rFb-OUGP zQraS^Y#mW$bwf$P=6qw6Zi9;Io8l_G@I+jShWhu@5=A2`LIbwC+wTswVa2^;aN@l_ z`@Ror`_YjKEUu^Tf-#lM=6ahPhb~Qzd50?ucK(M)6j;8$oR25W!U<1+;Dm@%4D@t( zKL+OCAvzlPcM^$s$NQ=3>@IY+DP-ZYqqb7YT@H@r2F%O7mTrFEP`?d1s! zkl$ph-X>kYlCr^qUTP?*dPnzeYyWDaX349CGE48mHykN9odbL*l?ClQi7gEK-cP*g zRk*sXmCaBibHa^wG}-#o>rV7p78d;o_v>a1dBuyZZ1gwz1&a17z#{KgA~5j|)TJoT zU;7fo+p)Y)5vI@HI!F;PYVM<$ty8BuDlWwzmp=bs-7BK(lU#Pjz#on`>Q<9rO{_DM zFC`YWIG6HTOpSbocc^>GIH>_PCs7u1i%JwUUtiOtJ|Y=u%pjFtcy+c~ ze!7vE!TB~LU&hR05+ta!Sto`S=qH|FjH)zB-E^Dj{2Pq+*9Yl1*(YwuS2DP7dq_~K zVOezYz%Z`iuAcUu>RbKX?8eBo>Rf+^fH%)KHA_ZJx4vt5|D0^^vnZA~ z_he_K@*rn>nL$r9y=ze$$aM4!L&M;iHZqrD-qXiB+wX8|h*6P~yZ?U3w_Hh!qL_GA zviZnA>P^A60)7c(?KRh#f2qD$Cp=5;)m0lwY^UfBqN>Q)|HCo(N7E6T^8lf(nezSY zb5r`n(E8LvMzkH~>Vnj_j2@PN(|57FZ(v|6)FSDF6}w*gvc5inn`8=pi#>7nlG;qJ=8E9VUp#$NL7L9NZNT)i-o!(L!m zwdIu?4K;$=4!0TiX3)3;q>#@#MN^76L9oqObkBGip104d}Aek zv<$45KE|lOOdR2-pt~pV{DaeFPDMz-vBtV&2_26UXLoy8cjN~(Ny_ePsr@DHeEKM7 z^Y&bJ=FuW8l%m=Mbev!y?jDu6>NGRnu+zWTF-(WJ-;#)FgL}6<>z0=@LuSUqMw(XDGoGnoWkpuNH^L_j2&!rT)w)Q&C8W|dXU=K38tE=pnN4by#q($nJU zu1tbU<66a>Q+mGpT%PI*t<2b#i~>x1mn6I1z z{3%#;XPMR2R_|N<>)$sRhaKN7z4zCpOr=h>G)^}pyUAbB$LB4P%X2cb$Fx!W9i~yV ziMs5mtUIju=v452GIbp9qS#4F`-_aH@HBEqVE5Hg^#Vq#-f)#!te9_^Tk<8W;Ap?M zfQ_bEorS_MOMZazCDtbK=7lJB73{J7l@rdv|0jHiHpe_bRAH8Hfd>{*mm9KBW5{fV zrUzwCkP&y2)eIa-9q*S@2Y7*-kgxa;G2KEAo8?MQcM9O6uHbQz!INkbwd}RE->Vh9 z3Wq+Q!Ws|@sL2&t$wf?tp96Xk-`xG!P7HfIw{+@7YJ5C9C2Meoks{;eBFITMp0a6g zH-Y>lNdW$y;8`%?o*=s$baxloD#5-8BCr#wFPFOw~9M$%=C}sNFe# zT_Tpp_0XE15SAB4fE|L^XJtL%VbUwU`C^W@IyN$QbT?HZi(a=2a+E5`N2)Dz*EVW& zaBD`C`_&$iR&>{lf-3Np+37AamBFTp&Em^*O$ITzohiDzr9KdFb0!YVJpKq@-m)2K zgd%!sDCcbK{;+1H64>hw8YSbXf3Wu3^n3i|qb{2I92qt~MA6QcA^Gm>m1u`_U>$%& zt9SsLllK8}s5G8ijIECDTDa$rUT4Z(ev)dG*(&^j+mBhSlrN(rfHRVn1RGrjHam86 z`tW$4np>xee{0X@7hb-V`L?1y=tYnu>wdjicW0cDVt680%=IJPtDP`?If5~`FPmI6 z{T=EOKI3ZD+OZ-n3)uoWnH1EHq(5U4sFdWd5`DW3(|ny_gZ#tX6upN2<1rs6oRNDKR^Gmgdn+wsb2Jv=Wo106BSwRaig>Oj`Z9h~9?Y|kI;i??o&razSf!|{R`}rw%aN*u{OeWIS>`%|qhD|4$ z?mw+*Vm7mnAf$IzhdZ9uI5I4X8uZb0%%JI&u^qKW`T*IbK%b+|%805d_pY9R5a0Ul z<&yB*P1!Y7W^qGXhLvH52lq=7e$wj&-h~?_!T|5xaV$z5UeGHcslEpJ282VRQUv9- zXRUJ{U4G#Jj*Xb}-Ht@dCO=89vrg^ zqfmp%7X4E49$nb`c3-5@GHj=E_`WzjuV59wfM!ZiqylaExVg0U>g5t+|Ky!fR`k#4 zkeE6tpJ9XQwI8oDoWij3YYr>Q9H)110vt|DFIyY*NC($Z3FoR)Kj=_=HO zErqNKu2zh?*4xCppGd5jZcj03E=k$a!k)8blQvi*=+DCZ+)iaca1khUZf=p~Wt}f3 zFVt_RPQIfb>hY>WxEXzyw0FPIlv;lKR1b7pDRXjFJSK4G$)>g0Ym`v?J(>i`)TBAd zQHxYwJv8C%)V=pBKycA)6_T}s-+qe5fYsWlh2A*iO;6Posuk3tMxl1W$ogy6Dj=uO zM82$wk=8Ma1JlH?YN8s7fN=Z)lZgMzamRR)9Hib{@ZH~EjeAM|H?Jn0@e_SiOGuU&$VxideE5TqHoBxTm zQ#USz(}!Wy#v|C#mI8Dv^X{wXX`4WYtLZ(SEgkseRTE&OI5m%$=4ocWTa8G?fsoPn+~kTayaGi-BqU1GK9OpAKudBqP^0 zd3ih8OZFq}H3`?h zWR`C4b$TA@aQyXWjl!ipMWz>ZX%(P9NuM>v`9YAzd5V;u4}LWB@|kwOy`ITLj$su}`4gM%53xvpHTIVuaa zo9WbD5PJXkX`@fKGZ>*xG#3!|gNJE_!Yx?cG|KVz^w)yp?qtxwsj`bio_ByW#rJM2 zbGlyWi4^*x{pvImkj@c4J9P-zg0<$oJ`RT1b@)t!v{!)Xwb1VzRAwy>tG_*e0*igQ z+~rv^Jm<{{8sG2ujVGhmny5S%7Y<65|4!fSmR=m*N*~?1I>R+r*TCc~PezEeCMFy{d9>bU02*v zoM`kj9%EXQ2DeH2c{lp@`(2l2i&E_zvk`zfnefHGgLdY_`=jJfP_>VM?d(TU9J*S) zBqkdVaUl>*L-uBATbUZ8tnn{Tcdypc9mdd+#sIU}Bu=5jW{ZpTyR~pOu?RX@vZf^D zXu-!Q=%hh!5g2CYww)zd>@H4EcD{R*m$bapYI8LHu&JjH}Sq5PJlNYQv4 zirf{k*u)U~#Ov`OPfl6~g!f{N^iyRy8|PrtgW;$({r&s)SIQ@M5^=hXK25dfMm^1W4CSrL^1ho-I zVSrvgE16~z1aE!yj8Bk(Zre?h&)p;XEZ&sA!Fe2Weo{m9L;ud;ABs)+0zC;?%wBt3 z>*lrni&G(hT&NX3KEK`@lUivep-eBL^TkY`AkC=u|)Vns|@xZ#s|Pcy&Hke$GDq0rO{JbKsABVuX+r_9PnSCFBK2G7 zXc<_2SNcpnlt(0pJU~*TroCvfWSLrBN$i*>?cLh8@T!Lu1TB1X@Q~xwc-`$!HQa|X z%PDKhZN9p58rF>95zbM2rDiXBzm1ysq~AU(VB&=DV|3uNIa6}~#p_|-M*5xh&gEjp zfsyIX+z8nqE`YYAJDh0SmL5koJCxj=&K-ec0XNXq(A;^wJ5)UxodPf=%J+EDxFfd%CmCQ=z*2fdTt}XOGM%_Www;A z_9F;Aa_Mrs@2GE+DOpWA%zcTivso>u(fMw(lxs`%Uins$0Lrgxi3D?;nt+EiX@Cw- zK079rA!#kuz=qf*qvUJ8wlI@6BY$)!DNOy;K>q6Xy_U0qmdEJ7nbofvac!)ID_G@- z(m!cC6Xdj>SD`y`+1Lb<2!$LSgt>4~xLcF(=&C~ob-#Hao<7=#rxn0Bg-o^-mohS^+Ds^@m+x^{rR_Bh8mDv4x z#f=;2rs;E4=1)i`lbZLLNtXyicS)TC@Zt=M*dbI+ClGD<0NpvU^q>sD0GYwYzz)vN zGcUQMqKym}RwifCznd*q#15+#@xoU!CboRjh3uvRQ5%H=eJg1*Ztxvl&aJImZ~#Og zx)w91Ow406XW8IA#p#K7pkY*${0)`*93JF=een7*DYxfC-xfIo^>Jj+womK>RLkoJ z@%+10-tjBRj>a>Nlvd-qmuB6bppb(3=sSqha)*#5d(*AM`)eZW*CyawO6CqB5B3`G zKEV1@h#NurhL<8JugV?)X@ zxdvQ0W&UJ!&Wq-*<_85uX*N@QqKze<{=*%*T(`q9+ohY zoX!2(;#amU1;@=vwk>oM{k+3FOWJ>koRFJNb}YeTS%Ph~rfc^6Wqnz3+!G$)#N zbaV{+&2tI+%g-ZVWAl+@X%pv5$+HiPQcTO{CC9SE~$D@NiS`B zKQhi@@gq>Zs~1I;2CZY6IZwGp&&88dh7*K_*^C$#RQn;_xzLmvNB|0UN0!zleTNH$ zV%GmS`AFlG41p?6;o_w6w=sG9aZ5Nq*g=2X%T{uNOzD^F$PRq@0=bJL0FyBRAej77@g4Ml_b3PlHJvB}Z!7 zmD^TqRniFLa&2yVQ;TML70sbs?a9!}KMPb1cX^2CKm?O9>=(YQQEim2 z;tJM8@O5QeTqr zB;_2~Aw{=}R@!c?poO16NJKk-de+9+ro+{WJmRP5=Z38aXug7QbHvMRMwo6uqh8;4 zY~&Hmt_G38aPM{v|DtPt#{yJ3w)&WKPI}8z^mpnBVQe!k%nh0DbS!#^aR;;}vDl#2 zq~T%H)8x$V+8qo1CF$jP#OfhPa0s_<<$l(wJ+Ex{JFWGRDo6n zX}_yv!L-X>`Adfr;DUn^_uC9$YY_XgFm$7x;dBfEVp{H9^Lv$cJYY(CW{Q@Vl|c6Z z%>+kw_D;4rS+{B1N*+W^Wb3vyV>SBi>$ze?p$$398+F4T0x|6HcACHcXPa$jP#8$P zE)iaO_zfK1;Hw4GuW<^WuJ=@iaY<^ExY`}Y9AX7b4q5W2YIeZ1ODb6K;?bZn%6X4> zlJ+(=*=(~TM<##a)WbCm-GD3Oj*{Q~HH^JK&2Z!0c#Y;(Ye*!5PJ)XjsjB>ppf&zv z!mFnkFlYzd<|LokO_pSH7WDb8=*(3sLpjbX)`{(?cNN8fL307TNh=sfJ=n^u5Zr%g z=s5X?H?_|r8-rNnu0JTo1rg}!XHEmB%!C7&OT0*Q6ojjt;BiC5m~U}twL5*TKKCk8 zbsnjvUHTd!(}+LW#&TwQ#JL{Zrc3o>#?qjCfO#1kWWv4VY}DUu`sZznVxMiQ4#*nO z~- zWzaEl^v@Q8BPreSc+#uY-X9eTVB>q1U({<-FZ4q13uhM>AGaC<$fA@ggzU*n#BGM@ z3IJK;4Zu#jB=#~fzEvj$k&EN=VEeND-`i6~ay}3-u9ieyC;QW--70^MUo$d>=wFQ| zESbtEXPKEXS;E8gB*V$bq=oHA&S#7J#@^%Vx-Dos(~Val+{U@@j6EWOxGbv)d#VTz zg-13nLE2E#G8H>Xp$%$vwGC8@Lmy>&6*U6VtZS6>*B3*zwKA|a?#HoOHy35(d%e<5 zR3i$L)O6(S`1brniW9VbeA&wP-G_IC;FJ*MY8u}^kVc`6c)OqJ-CNp2I>MHAejc6L zlD4APo4^ixb8_5c=i0ED&RM9m=JZYv@~dmhZ}*J-sa3xKPq9bfj%)S}f`d5zjP+x0 zp!ZI0RqRL^c(b%X7jmJQaX$rSizt_%Krl1_R~n{ubkkn7lOk<_oZY(kEDmu@c5jEZGAm~FQ_O^N3Zezx}GPKhAP{-IV*lN>ld{Z zQ>}dJhVozNTApS`(#}U_EbNC&ovre`@<-tbz^<#i z#(J`uVc9)>cxxm;sl$3sJ=~;XlRh6dCX?p?OO@-nmCF;t8x9sOB45!Zr)$@V{ zw(*5a8?UoRzRKmcO=^6NJ^5<^W~s^$fU!o19P_+jS&O9C6IEJGh%o2QSFU>b;TA|^ zY$?p+nWmO!lmL#)pueVru=Ge+w$zvn?WMBXc=z*xPx}1fCcDKU0lar7Ng(mmt4ngn zfzQTy+sw&(z>Tu$s0{O`64QQFnZ!V25ffoB?0fWsLrzi+;94{`6OG{LO2sEbwU)kh zh_+z-Grz1$q_z^slQyMO*&@glRcLq2iJp3Y=a3wQCl{C4f9k&%HeYJxf8JEpUB&rY zmV{q%wBR8+-*G5QZ_}MvBOUj;rqAEg0p;p*0Qk<`YP>5{kX3544s3gX%j7brqyQ%4 zlG2W|#3LoH6oKwMHzbxhn8Nv%QMFYi?;D_OPB77e{C4uc{f2o+H|}r%dGELt!Spbd z>O9FwCsX-uy*5X}G^pS;qejwQnN0z92T^AB2|I23s)9MBruTD`tPo8 zQeQU2)unj6#U1$i!DFX&=dgz4HZM!>MJvZ}#Fnh8i8#gu6qPc1iron6SNMtFVs0A- zs2`%A`@L>XrKboV;|saHMot-#;b`#C7Yk4Wo|ot|P5L>rwd9F3d6 zYyKBJh;T5XJ$ye57&K`|MKW0EdDbE|?&+Lh8yrF|n{RtI&-7;ty5_ay(YNs^%}junCUMw-`0K=z@QXP3&(ox1A$XY*RcM;$0vgTo%gu z>zn!c8t{d*z%$h9uAAG+oN0hvdOz?+J=QLup(=PSgZste&eU=>#&<5dVA%;@$<$Oj zG>dyFAP#uQ)B%m0VGa;u4y%kxc81jW8V=q^(Vi3d1mwKiGWthUm&mLB)0No4%xp&dc z_|3a^w9>s6PPc?3zy0+mld@g~7Hcfu6b3PF&-^DfdAv@j`g@ReT^B=JnuENy)nWT? z^EuO}cPBh)zy66MG-%G~g6Z>=;=F|wmA>O^5C)RUU-4a}xNpC!b`~r*IS1{u(vhLP z@r3s`5KASPTEH>`C6R{^_3U;$N4Lfq3q-B*`@wlgDe2<%L!M);?v%+L_aY;})r(7A z!OCxxD%Bg^v!Ei*`&aqMP#zCw`tvYtS80|J`q{?8}5VbCWn?Tbs*92wo0o0>J zT(2;xOnke7iK{6m>%pLc@lXe4)lh*9yW9+SQDwEcN;yWzUQ67Vl@oIzt9Cd#u2EuL zYlTM>WF=h&mBcd>6>F4JO4P&MGJe&G%4fPA{Z19De$0>n0QGa!b_~mW8EgrBh((kxFgG`VvU((5FvDtxs1%c29d3 zO6EG9AB_G}2yi>b3qn6Q%k5cuHVRE=h-AlFF_08edQ@mCp{< zb}!_pd|&X^kPv_yr#3_s8;u_=8+l`9hOE6#)awoVz>wOVX;tvqU)kS>d>c4Bo$Z!? zpg7vF-vAVcBc(cm=m+LuD!ZuHi<0b!a&l(jnR$3;^HTWSkaZ;unRx?BOcer0-m6EI zH-@k*+Pk+XXdw#fyE@|c>%UAwSOz}X0x$`he@Ul_w(rB6a9?gLhNRw@$)2Nv1I})Z zVX5N*cZQ6E`R}2|2it%I49_<$TTQzx6$N`j}XUURwv8 zBll-x@|L#kzO9WR#c?O@(mjq9U-;skNa3H?$L-LLZfF08w)YHc>S^14v0^16D$)@Y zln&A%pdwX@G*POJCIqB+P*Hjl1f)yvgx*6`I-w{X0z_(n5F#an5E9-M{NK;*{p@}0 z{k;1<_WFR!KvtQVHEU+B-+5kNr*~gdHj7k+orfgW3?74B3kGVZA3>Xim{rvS0`fE= z$bP<9(ZjSgIBMFO3QBp7M`S1JL{@flIv#bkHoXPNoRKheJ;omV4LQp@GJi`65FmU^ zUS+fP@BhR%{1gvlQ+YKkI2O6tSeS00^r&mGJWZk&eBRx3%hK%QKtnlCzd)FWcs8i8 zD|GL2^!BFbD0KddMkU)uKa#V%KUgHst3`Y8dhP9Xr^Hz>zbH8kKNTD?&txy*3w_GX;edg4nm6Y1^zX{-2) zP1>IrEb`*ajE0&9-aiqE+&RTF*Uo6cy0N=3;C3H)!Cc3$7DKhcm)!hZQi5okE=2*N z9^SdPwCpi1Kp(n1RmL_HQr@2q=AQ!=9~n0UnQ-1{0&=dS4t`_qY{o%s$YRF9WuMg1 z`BEu(ai@u6*h2&;r$*J%J#uku!r3HFCn&oHA(jD^*Q?rD73+jfu|G*%!Z(*m6(ugB z{IX1O4ZU{O385b_jna_e+7jVacM~s2qAuNl*z#0f6(mr#K4GF#xb$0*R;6Rz?fYbA zOj#A|d04H*JXH16RMc8@{&kXYvv`!x12Yr;n@3BHJW3t8dwe;PFdOm~@;fQF_Xngp zD;UbPS~}le$?~60;Bb+9o>6!AUMi?NYHV#_jB}PM;0dwx5w^RBWSXx(TSuPFuL_4x z7bb+)+b zlcGAN1#uwz4XQt5Dc-|qm4BnTEYCgTbez;#EPYPU7y*wNQ+~|{q67bv_GImXWAjGP zscdU0B5rVzQMq{+kKo$1yU$JwLUGT%&7g>a+4r6374g5CPf4&@Tmiix9tmQ6=_q)~ zZ&wUcci(8bQ|nZr20sh;9|3`L(iswLCNDh?c(uj9)38Yh?URu-EqYE&aEie88*lu$ z1-QG+qskWD^l{XMq*g34tepp9(@eLBGi}f&X>5ufoLmf20k_x_Bfch>;8yS{QSULQ zr=mDl*mNd(RAs_PEyC5{=2xw2_-<_ee@IXyW)fSS%3Fy{&?|#f#m~i8=t@ z2BKq(SIXq*n8rLNtqv4MTD7MF?8%moIw6k&n0@?~$9SyVIgZiDMNJ@$V?M2q9ffjS zYj4pR==QVLw4L_2oWfG(mhX7rIgnlPPwC%&HV3$Glzpw5+YPM23y1S+lY5osc!5kR zrq6=)5QC7qX&!$e|0So5t$C2I!Mu{EHmqa(lZ-jg+{R+Dyzs%R*# zELX_7EkS&69W47uS}if548ZTNS%l)FbZ37(A%=_B-5(QT&%X&>^zJ;fV0w-*z=Vdz z%80$pHnp+rgx9_kxv}mygW@%Ry}RTe9GA{?FzkVdO?z@a_b3k)+d=aLUjL26wt-;w z?-&)}ss5a&AaO?GVqg-GOUIBpjHFpOxjypWWIBz$#7fTy_Br6U7Xc{Y&f7CW-LI!6 z0@oZrycmvy2Y+Wko}ul&!P^%o5NL7*xpaE6)!}H=hnsHzwa1i5ys($CeYLQdff`zzVFMn__)CjquRTQ$Z<_-_-1 z{(P|6Plq3IR!~;1taxDDWZ!MvKk_t87Y8KT#IG1-Q zR~6jrv(*Z+O6F9lNvT!op`z;zTjw%;f7TQaBwKwqzXzOiM9^X@Rw}>465!$$L07i@6nPK3FwsvtH&J%spb>lB4*! z3E|T9$Sia{HapLu<)u~#=3^2l_)iukAVpT@>X}FtZYGxM!IHUSlGIba3FX%V)cx_1 z=O;zh2P}W1A0-Y|xk+)hjmb0NKc z+#mj12v8?AwA5bjG|sJZ{r$CaqUo>|{QE$6=m0sB)#S2pfNI|E&JZ=7gj#Ex1+-BpsR!8pe37?$&gep9{`H)%c<{U*uL5rdhFjv1NPpq9_CiM z69#ls1`p?>Hq&QStZ!mlW?gSIZaEM|!kTcdTKy>|-h(b`V*nFndsjh$BrZnnWB%GW z;XpMuY?dBuWQ9QeX7iQWISzgXT-gXXNRy#&=O8MZ>~Ee2-eHKwkb`{BJ8cgFey4EJ zdhqw6I+@|4&dBP`n+F;jvRKz_J zZ)}vhGIrni>*A@qYo~zerYUi0#E|~r>3SO1j2U==rS)J(Q8}VzON$k} zi*FiJE?B7?$yd3HGb?^*Q;y;tCA-hHYF6h6a41tpTu-t}Xkn$NA0y&0pQG zY1LiNC9Yg3oY(01T$s3Q36GG*T1uXfQYEm}^0ZB>e^fQYUv>UVok+bRP7qL}F|`zC zw?(Dr(W5axKb;Ny_NHIsLdF7D9-qC7L)=Nn88dP+Hb zH9qPb-L7%z-lKBd+CDqCBv0J-;CQk%TcVVi?)P#cKe2%wEEo)=%NC)fp6cIQ%P5G@Qt6V#UCr|%l&{Xahoj)!^Q3J zu4j1NHpg~n8Sg#pFjiQCP7*z~TKmeN$kjRNl9AcOm!CHGS@_k05sJ5U?Pq_U=50MK z;q9r;vF!?|U#i!Ve~xB%ZdaI^As*{9Ii>I}SEN&Zr~^tHoxSW6-rLfLS#1A(r8I|4 zE{0EGDwk4V4#j{())rsJ12!O&*~X=MRSox8ShxWfyI8hz`t!yOT48}qKYfgO!uozz z%WCtp1q?6WSZ_-|wv!_bNumQnRDRA2qUF{y9998-VZf7F`t2xaFfgBe$)&urhTQ<;R@LOCE zV5xyss76~=dz~AMD|!&lmSei8QUMIum}>;pom49VI7QPV9(}oYO*-|ob@#|}Z_SNZ za@z!=0{xzq50EH~O(xl0mrKs>WAL$G1Q!Hpm;rFx&p)q-f0xMuD^N&!w{y-GA0s~_ zpE3*w;4L1r^N)nTFjku0(sRjHtpq8qaeVg6op*H-7xVV6GJeeQvx}EW+bCuq<-?58KM+|4%eE?}Ppm*+U-cBH^-rqeZTIZVc$E06-C4&Ydq6^uiL^Pl&W+I?*!C zj#!o&7N2Qt=s-EjLWxTKbQ;)mkt*40^gS;x7_$n@QoM`yY*gQDvWPts08dk00SsHw~6Y0FWO;9=|@PUZhl70T&9;y3HHsS zPO-U*!_gzdmH*i8Xailmv!$J# zNt=zUe%s@L*Q*{g;jGc6AK8)K5#ui2_MzjCzEL`|zm9(6_WQ$dW8-pw^Z~*zRfp?S zrzIrg>-?2;lIMExl6dh4AgyE-W2p9`-`s%Y#?rjH;f+_J6FmmFij`q`z!Lx>2|5`1 zqMTc?Rsdl2VnnEE9W=VH7+7viWP`3`X)E4shgDlBu$ornE!-&NDCT$Fvx#hc-X!s& zi6~jD#aWeS7(7MsG84o0GaGDP~ z_1C?=d2;RIoF~_Dn(IF-xPfZW+zJkx`=}>zd(Nhh+anBA@g(lFn|!zJi(GX>%=0j1 zK7jVkw#}P#+CaDC*vrM8`%X7WkK(G^@oz26uNV{4#$-W_}pxnSP!*=BAFY>>t=Uk&(g1I69q) zI~zHyR{7V39`07%Tl|_CEZuea|D6p#;r?q&%>=c~?vTz(e4X%2KeVxo$;nT)v~j+O za6eXGx*J_gNIm`P%1E4;Xb(jCXPUtDUSYnHiZe-G z0t`yzk{CzfNb5}>0-N#6E(4L zxZx``Epl!DY=AV#nsEoUZ8_op{Gj6lhPqt8U{MQg^*B2PBsaMXJSzYlX7jTvSZ*P9 z-yk=x2*}hm(^dj5NQ?NPV?0M(b#3#g<-*3#hfW4D2x4#hNXkuS`u}hPuWmEs{=A%| zZ=+_cDCv*5Ie3kmTj+hxVkN6^zxlb&$3d}F3CWu@DC&pea@jAffzW#}pVhpy~YHo6JkADCReWwNHt$}ViYcpSN`z~Nj3)Z;*Qrp$oMd@ zn8O4(u=%hfUK)?O(HOnR>E7Qg%+QCe6_b}zT+MIn0>Tmg3YIL5z&)jC&ANgilgj1k z>^bm#TZ7i(oLAY+(Chv@WgNwu3WJHsri0GPa^_RP)Ej#Pka2IrV-DJ2!Uxwfj8frn zEX0u^bE?@(zYR>7;+|VnY~-3_LG1>G`~W(W`YGsDfJ@8$1{eQW?5MRS=4Tv-19EQI ztx0`8H{5jIjz5YSY)nv#gACi;_?`&2x)^ngM$KldHsiuTiJ8aiv{Wy0kS`X!k>0Z5 zfh#BQ`V4#rYAy97i0_ zj6;spXcXzX-7mZmw=`~0%s3Uy7?L6%|9sH!ar@FqTbSgCVLI~5gBrb12)~ch>gIRx z)$MAy=3=E$&bUXCd;7RBDf{K+{>oddhibv}lgF4{iHSTKb0+zjsKhsy3|B&$b%n>G z%TZ6o9^xK#F!uF8WKkuJ+s!Tdv;Q5)6=tFZ@DL^w38L3MS}4mAt6&A^OZ^kRn=R38 zz_oK#t2O~GlhdfSwpKZ!7FekQw?U?vyMOq^xCBiEvWAKr)aC|Pn1c0gH{VfFFnt_& zCCwed!)|&F`c}%XJuQ0r*VPHi-Pz63!9Ri*N5B?rtwRki@myG&cy_2~_r#6;ZRJ;G z_CGp;j7lEf&h;Sd*%k3iBtBDP7}c?gP2gYOph|~t-^EARPl3Ar9{|}berk5KyeHYJ zFn6;V#!BQThe(axNwb&KXRI{!7M>I8H;Md z#LBq0IsxdZcYd|pU3Y~0x==S#hn2DEu-Y>kP3mFh!v$j)-4wW$fiN=>eOhp*@#o?e zElt-g=)nE_Q&<^v07oc+|EX%vGoRxVz?lEe(Zg7ZES^<(v?IGOZ_sV5ceJ+N2=D2h zRHjl-(2%z<4%KZhO8+YPT=?Ol)Jb3Ao4WY}8t`Z51dSas#9L-#yvaG&Z5y)Kgqh7k zlb25eC2=8#%EB@m7D*bl`DHRc%V?BvRp#i95fZ2^kQ=`x( zZvJNux0Ooj#CXCE6D+sXJmmL9p$%U%V@*5~w02^($7{Y-({3=MsbDDIW;`>jC+G#^ zH~mo|v{-S*d!Vv=HU=$T*oB_0qXv_Q+TgJ6K(fyJJ->Av$CV0#*$w&**Vrur0fx&6 z+4Uh2!s}gd=JXRlx&&X7nPSb|mVaFTH=&Pn-uXcC1 zX*B64v!|(6U`|hBgH~V6LmG>dnVeqw_8Zv`-Xd-T(Cj^UP)eI`tAd2A+)9?np&M81 z>I7610%=#E_?csPZ5yc2e#?_za*7#aYF8rOrX9|jK0aADT;4SF9r{P#$Vw$?nYcI3 zJre#^!+j_Ha*FHB^5tXPM`^xZ$~4`c;g<~L0;IWOe6!DkV$C~RMPHb zN8Z!+*cuh2SKl@yyk3+{J16(v8y_NLznV3X>*1yh3t@R!Y>;`z?nCgXk@Fhk$F4;+ z=P+=_#}lOkopJdcOLpap@vnwqTp4jeY%S?Ps(SHS#+2vj*~1r;tSnz4G(u(lo-><( zEE4JcRta*$&ye~zKNXCw8pqB`c1_Bp#^(4}ekw6lepM79D-nQd)ES>w(7Ez*D*@hArSC(&fvbE#k-AqN8}OZ9E%)KzeL?*2WqmVv zxUkC>JR=%fY5oDlA8s27`ABd{u)H)bM)XUG7v*SzkKpnr*vyMx_P28Nu*j)^rB}rr zh->5W`x4!cr@Kf`6qHM_vjph8n@|sTVoKC+OlTvUIo_e&V&M0fSgouzy{o;`${PIj z^Z2;5fxScE_67jl&cb(Zc%=pFN;$=1)jrR^xvU1Ykbp;gmE=)r$~mjx7>_6PDdJEm(yzaTh=Qy>66xyv1^Jvj5gE_}%lM?}@*qlC;F#rF=Q8Ja^l#Vx3EGcg}R4~6|!AM+#+ zX4y&S``|yQvVF@SE!g-iwsJimn&cie-xSSNS*+#BIHzit*zS9O@gw9>DG-yuTY9U& zczJ6>z!?qa{b#2Xs`h7|rSYzAS8T7AA@E^h#nE3SI!ZYD$CsRu9$@n!{Hin2VT<=B zV}3>BW*Xd-V`K7})bTlj8c8J~(g#0cl+Pa4*wUcY8t91rKPGX-=V#iTaB>~Z2jw$O z%mn3q88jF*4vV#9GM`QDtkkSCu?k#dxA$$liix);1n#%Y$Yk8ent4HThz=YhTTg8= z9mSauVb&4Y(>KFUCCU;ewFgMJ5NbPWA&}RS+`*n+a}+;ct7`x{d*iOmF^kRaG#|XXKjmOqV%qN|@XU_U7fPb*sMehnaPY=j56^R@9YQ_d_U>&!Y1!-7 zrMay9eBz~ch^6o4%d*mi862VZn{@}h^CQ`2XZD&H5tOZ0@M-QTzjHL#pQer_Z1rJM zYebO>I1Gy&^!bdUvcrIq`j7Pv7zki+rS8qB?xBRK3@+%9!QET$H zpABXQ1`0Et*nrSo7}T7;!izXyIuEDJa)j@~!l5C%)87o~;baSnTH9Wt#f6HUTrGMF zPj}9_Zj`5X8-KtaO1VvJRUH&Nt=A02*M@FAU#U;WQ8-oNSGZ z=Q~j*YDIo2^sFIl3>qP3cd=%`E&o*Isgq3{V|9J|~ox3exZ2_`>cz&@F5R z%j&F2R4za(zFr8v?_1)Q5faS-w`fx;4FC*U@(UL89X#JYT8zB!WuYGMw2CLlO?ZoR z`AObSl_6)HPPjx-%XH7W-GX0+xxW{#?Lgc{w|lR2a8-RP<*nU}#RF) zqvdT~SpH0UUN=#7j@@Fq>Paw6SW+s&tza_|x#TN9F6bDR6|XavuTppe6FG3`5g$P2 z;)$pL8?A^PJZtDQ+9IqzKdOsX^@H28s#N21>MRzVMn-hb;2XOi(;;b>Dn@dRZxsZ8 z1~90I_lqx~THCgLd(U}4${cjTRB=wttoEc~FB=H&8HjfTYRq66j4L(@D)=M7(A67jAv|nnys4hx*Z)L)N5{sLebF7~>HE{?W_-7rxMsY8waudZ`V=XAy&EPk1W0SY zJq{Q^T*y!0NZu%IsvMA_l%j^KeP2Yc6gv7=-X!@Nj_v0`2kO@4y*bMJ_%o`uC<)fF zc;{Njn?8OlBa?`4kJ)mz&KqQ>vstPcC}d!Ft~mQp4cnj0Cd_y1T0ybf|Dd>^y$LdF zfGuoike|%F<)@a&}W5|~<*QkQ{j^`O_90mJq(xohulIZC4I^y{}Q z`LLJc#>kA)j%$`Ct9m2KvCc>Dct^PW^op$9e!eu>Pb74`bVM)2IdDxWDmMhUXw0nh zAn7p9bEZ<`9Gytr@Lw3Hg^Ar0$?y$tx+YLF!p090KSKIoDvLa;A4l3bHQ0t>0=L~= zC;tvMy4OxpbXK|VHk+vI`(>k;OJVmHT6t=0FDoQkem^4Q#X+9%+}i*Wl1pKyP#6f` z0Nc2FZC#!6@3A+dfOJ=e9{z*)?$k~RMTe3Gj7vqM_tC!Qf{JW_={1XiXiK5GfkVdj za%rvRR=SzV_DZ$s9a!BxL#SgVGt73}=ar<->-AVWUKSOcTmMXET&Q(MLe${Y~I@ z{~>TU=krFQJVg<$XWCY!dgV*N9q=4JYvQg89O14UyPdI>1MlefF4NBc?q=Kl7+Gpto3U{pMOA%NnrFBj z%r@R8k}*PLQtI)%pXPnLlw)tEvo!d@URA%4`gtr>u%1q`{-(PW3QB-IMr14~+|-(Y zS$rPAesEpO**W#DS<83#pM}DhBw#9hg6~p^ZkAr@gJWdy@eQ7L=-1o+tuap&A{6Eb zJjXBFLRpPESsw*gG~Zp8T>B(CWkCK!?t|uFYBo%Q76YpaLv>pQ6^K@xNP?=|aHqBP z?A1=gdQkZ>#S4sL(k)`Qtk3E8JYzDp>jkDP+(=G^r+| zqHUa7Cb4D0YM;o#m?-7mJ-T+s=_=0*<`+Iz-Usc#nha5P@XZ(p4bjL-mm8^ zd@sTpS3uB%Zi}$p863%k%OKiupu|tP4K157mQDT?GEkdw=^I?(#y#x}2ar>vGZ6iQ zETo<5#G)RU2e47sUfc?;9@Mi$CsU$6D1A&WdJtFPhJV3D-K~@GlAWK<-IEXrp0p z)1csE0V0U%=w8b@gZRtQT_rkj<@2z&X`81$X>;V3?|5ROv-WQ#8l5NA-1_5XYyHR) ztqtF_g46ca?EU$o`jc=4*lQ;6Ya(7_)*A3HXYI0VdXMSvO(ByE7@KSkKDsMA1~S>j z64z!rY1ViWGS4(gxI3(Zl)8~*{V8`TM;b zxju2CBW!EvuFGR_4DAeAf;`{mOv)iVvw+vPA>&UlMx{iN;(GA};0QpXj- zPIdgxnm$ngxbs#9l;L(JRuki^(I-xT8VQ>wu-9u#%uf&X{sS#OL1oM~zDRWQvwrE0 z(+96*k@KTm>e>dVsO$KLB3^Zg;A!Jl=jh9vjszViD zSNVMH>f2xOJdchie%oujT z*OWr^tiR+6uMS74RPsm!HhN%-IljkfN8!zT@x%ur)rA* zF6X}^dCHCn6zxQnCu9nB@OrZ-osnqB}MlA(>O_4Sdq+_O8%(ih6z)fZB z5>v$-^LhMRwACL`JGqok0LLg47QBQ9wKg8ordjx}mOa*T850|dz#0Gs5438j6>GOT9O2v3S7WkZ4(ou zvu%7mP+K2m*A%!OIBwQ+?Zw^Vg>-%KoPOPrrOr>=vWcU99REke=~kY%p4%Vq_Zh(Z z9aZogzRhyE=+ohvlFKvlS0CNxtyx8Ci;0A)spydRmAvr|3+1is7*M|D_%r16^23ag zw^*=}E-%2DDi&yB<3`WW&7==1%ulPyPCmt#9(0uBxACCv0)c#W&I#{WY$D)JHC&)Q zZTxm58{uS0zEciZ17~`7su?NtJju!P4mL>(E@|l`Fv`&)+_IY;sAC>_JU{!&;zo%@ z=iT_1a&u{QcPkz9|2t0_0ct&2?QP)S3il72le8t;qIq2osox#Sxv?~HsN9ekhEV9> z-bNXE46eW@{ml2z7!fuJ$b6V(T#V4@-gsFbSs^K%Lb^)Rl>n&!zTHWmUmt7=&_Gjo z-J4QUNMEH(2zSkjHZUr^B+hw?@@Pf{hjjYWN4F~6n^Jcxlh$MtXMhTMXIrf*LZ2vP z#{B;)P6|k#d)AB*=EUg9WM83o=4MMfBR-o<9374O*=r^jAj3i?c>|s>4kC46jPA8>zq1{;EN`tqT`qHeKsDry{< zHeNt0RnAM0wj|W*H>=1@&nIRO$v@mXq}RVg0(Mu{<{UkW4qf1RL2$pT+Ef?#4W^8Y zL7=Pnj5&LDj4k*a23g#!9)+lm=C9Jon=)T~eUJpn@5J2wiy>VR>$giJ>4H>Dgj-7s z2Xmbc+K$(vuK^v0{&>{F*!csJ8l3c@dOdI-3Gtr>1bn(JB65PWZbCIAh0o1TY@#_O znp>b2aG`hlUVn|nJm({&?q3Brbq6F0!EesBLoEPN9`~lS=Po-vXn#9;W#dX~93d(D#%(O6-BItKt6wF6RbByvG5`U)&q4B7vy9(s|5 z|9dX%wG(h1d^rPw18`#>aY`A<=rE7os|ig4q}_LxdS^!8<+vVP8cz?tL~4=YCA<~Q zb>lFwcc>ptYa!2r-*zPYmQ9?b_DG=s1K)6TAZ#AwUqxt|3)NTLirEDs8yAe&gY=rP zwaB)C_5pbzfB*fr(P0_dbtr$iG&v7#d4CEKy%Nfsejyr|KGZj#0~M9o-DM9jg|7?l zx9Nmr7(7(mrv314<2^-*Qby@dk5L@f*=XG*hg$64*x1Sp{@q9oD!9i{DbLkP)y3MN zoImnD9jb?T_gsdBDcs*ozGXg2ZW+M6FGU0DP3j<#<}01kJTRlT8gN)s-%z5&4TLL( z#=sE)t042C!bR#xa*YR|Pj>G_2Ot9|7ZiRR4laL-H)|v=wvv6EaOY@-0{=-ZaCkr( zBc;Z2*&iIEI=NE541Z2B3}6!E^#*NKk@TBDh$2Yy1kIb_XI%!s6!g~rEiWl&3cvdy z`Reb`$;p#I?3lXApPPWWs87kgs5hYb%zEhOe)u`?<3i6v-!DcVIhHd$4jtyl`-0NW z7y@hU+az&Ty2UEiCP#KEJaV=BwSmKs*OdIRub+TOJRmJ*J6zsKdp=727Z@_Xk6@n_ z=z$DMCclr~rXK!j-P~!X+ysTIMZ!~Z$G*Nl{2KKa)a}iW{~iDJKi{FDc|CHOIZ{PT z5)j_B(*kKIfo-j<{xM{*r{g5#Dghz3>jId+UU5R7qapqSi~j4YfBqe(|JT^(KR%Z` z`cFyy$EQzK@7!bUt^R32i3*ubWIuJ;7{{v|K_P5${l}kC|ML_L{OSMYQvhxI@E}nr zayJmQMlSnTdI8PWI!b5w96I-)lFR=jvE=}RokJfG57sX$9z=uB&gE~0=HoL0ewQj< zQZx$qeZZgy%vkO)wJ|#=jE6&O;C}*5p95Oy;%st9A%^+yt6M(v;i%bP zjT+y~eQ2%!_uo+WspZ0H)Z*o4*rxc|CqKl)2t@4o4JYf+XXAYJ+w2k*EW-ncLSTRL zx*PqgMtdMv<;@U*;d`0i{E-boX<<|SXWW7|yUT(2dY5<6{q#c>-rpyAO2wuIM=i3; zeAU)|PSW*<@Uti9S9*$n89Dnib`rn^CQMC}mOz)=x&Qteb^p!v`}d}7#4o~WJc*NI zEh+#cejJGFyKE-e?~lMKQp)=^aG1q$SlPrpQVHzP%r!^e+T!vj5L$%h2nW9|(_6rI z7+XH(Qj(MCI^8_nRapBlOitpDVRvTr=YXULhC0F7oATE<4&{@7pFH-L%xmAAdq9C@ z${*}+xdMH_9vOAuw}(YhAVh%(Ok7WJ@fc<=aD9@FU9v_kxHm%j%(VK{@1upj^?QXp zCVzUDzYclF83?I9r1YbRa+~x&a~~v%JqSboi*WN1UVtP1r-)lzYpAI6_tV$d9Et)T_SrWnz4Ho!A6G1Sa; zp0_7&#T}Rw09~SS^^FK%EJi`><@|A4x$b(?HMc8%t5hn1M$cuS302w&_HIUl z3FC7xoL{uyuUNoq4Llno_0kMmxy6oU(;RY;ro5YcQ9VZU zCorVaSwfs*VkSF%b^M2Y~Os8#FF zzh207lU+<}=eY#xL!^(NbZxKFZ>dgTPzF|ABcy@5nmu96whY4LCtnphB!-XTS@viz z$D8e0O*x?a$J2IcKT&P#H}TvwUrQz-V@}nmmG6F>G;NoM*|T9MY1)gyU;R!US~~`+ zHOJ1*98d@dRP4kYtT}XMX6B+(IQU9MO>Uj^scN=v~+Ym&{xNf?_561LDP7Z_Ol{A6uicSCb^3#na|zUrF8 zcbJ>xPLB$=yJN2sg@MqrAM9)HM4{By!L;6g$C13ITn4~g=9FvzEZ&H83^_IISU;s2 zbao3?3wX|WES#LKG5ewP(Tk&O?3)A9|CCmmgJ28HqmbYoyz+J zH?b*uz?^Ob%XGfLP%pBG8xW_T>&P>P#T8=MaA9Cz3OP|L2uJeVShRRf`L<(dfl&0OpshE zNGat4_PJVz$d}9DE}7P~yHWQ)2OtMqAD6KgR-8M=Jo!aAUw^On`N52~zCR}9@PdJuILL-0}uU;a96Frs!n z85`Uc)~CN_^Q^JvKI#$MA=g`Qkz!ZLRO$Qi)q%OMG;LD%m=j2DV!Z*VpZ=rk$DR#t zy8E@^Wuw0ANW-xbI|RCfIqNLjZyO!N!!lsI6$~i0aFAxvW2Y)xTB6ctO}BN5(^0F# zE<}+5b_n^{*}SHNFEv=Gu95uBp_W+B3p&OKry}-`NL#v;NsFPeHn`>Miv(?IAJBBK z;xQ`-<7eHyh!b$<#y4h7DTF%C+*30&URi-QH-ELB&K@Y6VeWng0VO zDQB~}P2`IZ$I?W$deN5nCaVkV!QBRDE9VJ$w$1%!kT^CE`X=rR`g*V$0(_a>#&=krudLNYG#b=tlG64Z75+yVQUKaol zkt3{MKEia>-9~pxcx>g9g;6h!_DEcts&>1S>7PIcr(;yALH2Ri!h{?<7hnYagB@#r zI1>1&xTm@;Md?6&3D^Z4T=Ndnk6<75R4}dgXN{P>?{{(37e0-0d?@(R`H3+iv{lmn zRp(l$gTi#L+#BCzwjqY%qw`m>GsDH~V82HS@+4Qf)oYH6M}Uk|=U}aOeU)X!g;D(v z2G7b+D+fU8CjmD<;gp*qZv*ziMhbC}SnS7; zp8$EZ>M`#%;qrkvReKIkfG|1B?u=h?ZcM3j2vy@675UQfI!ocSUEq~?>O7(}fK3ms zpZV@%`)J^2*wvs4H|UBPDw zm8d*H>Q$=^{C{GJ#44Jf!#&tHeT*?%tqQ=>d{LL3V6;Xyt{$~S_Dx@{vh_ertTImB&Z_05QSHpAYoHfA@p zD)o9NEWUvi{_GLZgCa_#LFP)IZR@v@+^83l^B9D9l*NI&ml~UwW;Bi#4u6s~REX7U zE}JJ72Y-ItfVW(%C%ezOv!iqUsy1c)?eCdpL@e&snuHNHST#a6J;R4)&Y49+L^C?c zue`CTq{hB2K6{q$c@cj8s!firaSMB&+nqR|@;{>k@2HSE663U*Sg#Lm9z(vkOh1Xq zK{956)tvXgt=*IyKn$Fnc!nPPsCs8C{Rez%u zWQ;9{q8z$jIaU%G#nIjgmQ5;2TG<1VJf({{-vq+h z@d8FC8@B!yWGgBR{FfeExx9rldaL2*pagO1vt4$s%$Dy3(Ym(u51OVX%zYKI>02|` zXlODU%;fUupZTpku(-G}jhni#vE%{go-@Pk`*Co`BSM$%on2P?=eMoew};;a0C6P?eKv2}Ge*c5Zc8NDeX=zN=)<^D_??HglXG>o^{}Dlk3VL;6@a~58o=rKin`uU%9{C z?`zQJNErmkjr;*WwYE3}AxxT(1X!%K&P9iK&V3|=?ym7tDnjaeS@H`U=|qIimo~^x za8{)-T5}s)owt(v(ynPIQ&^xWQlU z*v~5OYg&N$rks>R$ZMVs7;(u%xf#Ed!e#J$sxQTRs?klqZL}1i=2tQ=0(LV%)1hyj zR`r1$v2NKg8cpn^ILyq+&cu||EvD!#>ZX+rr}pjzB^Y^?I3};0=2&`Z55_in4X}{Y z^j+lSm(I^n8e7iK^<93@?LF$VQ2>1+;FuEyvu&--5NzttNE}#>9gC|d73i_gm>5OW zYGEoYtJAh7QNs%y3C2Ztd#z3CIx(>e_?2=0N7^Q$_tOgD7*R@|Nvii);ihW9(1<|Y zLG#M6iwMHoG&;_;=UIzW|BjSJ)Qf;8Hxz}29HqV|Dn0=^ws#{h%u0qD&Pi$&)bf+@=jtBAa`YarjmE$D>Q9$6W&y<%P1H7U zn2*liRwu>HY$R-Zj-kWr*t((C3C{Hf^%am8gyXiRw5{vMa6le=q$pu1CUgo|*5olC z1K#UXE)V=&!fkoma{KH(<0L|C1!*~N)qys7*)&=%&beaFuJW8xH(8;ILURy*jQhrJ zv~9c&u>QW&aUDb;)Cf3UXw-b#1mEFQb46+u>L7w*5FG>nJHiDg%#nRD>6-XT4h>4#iSyJK`epfbGOu{`JN3 z+VlHb4}^E{AD~ZMTI`YM*=Kt)_M5kb^YKc=jTa)N?3`33Ttu?|`3`mSPKZYAWZPLIUa zX3T!jn50R%;+ZO)UIzsX0?)Wji`Gf?I9(`~kANt)**fkregltL%kcQE3io^W5#!Q~ zmYkobqB3`^4Xl#LJ8-`M1n>0q`bW#(<9Ronp8Cu<_ivH8GHNucQTNnZd=ZjOqfG~> zxH6Q#@BNA07!r$Bpi_kO0QUi=2#<3JhLU$(Jk1! zzx_fiSgij|4b^Y0=U-!JaE#^zT>GXk&dqdCXku6t_h;iDZcw6A>2=L^E$KOI_KQM5 z3cFtPgqoI{bKD?B?zwUJO1S4Q6s0yK+HVyBOy=`4-L2BDEX?=ir{B;5+=pn?UitW# z91l2e6KOq~&aiPdO*rJ~!0N#QYU1Gj)vd08e)P!ZRyGhCGbE0ec~|yP_~MZZvQH|g z;LgTkvG^yDo1g47bBHQ_=8R$Z+-&`-`m6BE=WX!s{7zGXT=A6@n*(#`2ioF{SFxBW zYH*V8sXcP=Q+0YTapI^=yUP*nCEvx`jwJ@rbOqVh+(JgzBeHKr(Ay6f$EPQ!w+riS zH7|bF)VH;eL|m>cL@!s~R83j}PezMJA?zp57r$QA$!4W=y2oo5?Xj1{`ia_N>jZWJ zd;vUjPe!U1*87_;G!Nz<){juhZdwvh&KPan9iuaH~zWz-7+=VK6x}Qk7yvMnD z=)EvkH3@@2{&ZZE7OrK$RC|YT);4+63CI0m{tkdd=31p5gV7^}=PC?GNs!4-G;Ekk9qZ z;AZiB#VOyg^z%I-LkTN)GVh#FWyN&ENk0-m5q+KWUn@}>62=N53Obpu-=tRIqq^aR z-?yWZhBzKe&e)6PRmodhej3{Iz*HI>@3REr%C7?pVNtV&lFZw|zvvo3NZKB;5TEZEG~jr!Ggs;Y(drHQ67Nidw8@!m-& zI^Y7hxx6RcvZjM?=4S9#B<>-pGXNF8vtnWsx9LwXSLwxs8zyu*ewuHGnx(&=ehAX- z`F7m_&fR^NbS2&r_OVRIfJ#omspM1$2q33~lO&!Bh2CL*p4iE!;*%J56>DmYj;~1l zjP_tAL^^3=>IYcmC|+WzyY@}m;66d7DD_6vyO*$iPW3TI8HKqz+VXirqpse&GHePm z*B!AsQ}f_BY={#$oL_^;>y{BYcKO1Xwrw=$g~R3jyf3c13WNG{k}J0cBBYZ(*P@T7 zyaGHr6higHLLH)e=%^VCuQn_`T{->ON-t@eC(W~0?wIEF05*C4fCu*+>X4N{A~5z^ zGs#%d1@e1RpbmE(@;TR5%m&U}@}F^jNUH(ug06 zTVY3BoL^QRoZ;d}6{Bt8OC5~PB<>1-AEzH##)Ws{shT)~&SdOpoD5vYIXk>->w}kz z7*NIhs-g0VLy?bhak1*)&KPx>9o!A5GVqeFdL<=rFFxSt;x7TbAF;@*H?IaIHgOR8 z_~HY5j{BgM?|hEqmRVK0QHYm?S6qDdW3?|HcI^UX!jG8P;Xk7oGu*u{y59xg=ckP; zCu^H^U`-4@j@doiPVZg6tu3b*!D7z&)3@SQmT!4Rj(kuXwl5}#tbmtednL{csExDaoNbq#GoL7}BC7q??iM?nXg6q??f#Vup|y1{el@YutN3_rCAv`Mt;UzUv=3 zWR5k9b***9_d3td3F!>?OCwn;w-3hZ`4`30F>IVXp`$Ca)c|-_2)RnrVlqzA|7z;) zla_gU-D74~LQ{WkQv&v9fr2)$q|HfpWu7Nwu&%^ybVQf;cT|0Zy3~o#PKMI1D*Z?+ z-~JAB?SGY__XXPL4NH)yNjg~JdZJ_N5L_a>rbh?wJKzU(UKg!(9Y{G_+STUjOatXO z*19CiOvahrd5qWu)fkS;b#e7>ltdO#>gi~wdDU%P9vpA7rGX7 zYps-%3-dX1Ur1wgrsNrJoYyYN<*DU(qxt3nHpe;TCa|AZhReDWYa>ultvj~mmM{9C z%<&y zcOFs>T`C+-jKq7o`0z&db0ikK1xOp}m|G5wOn-znB=FnX?q5!QhHe=Ud$F0p_;z#i z$@I-9HpQfo32PPeCUg&EVU`b=2ET@cJUe)c4LRC~@O#zqo)phVMi-sFs%7v!AGyPd6tu3O zy=ZE_#vpX}PgNTb5dx^%w(-P&s@i@`={=K0vuwYC^Q`WpdAMt00@%XzccOXQF)4Y} zPFP#RnJ|`^_Ue|=8AngyTlFZi<>VFCQc1=b?Z6GqV3*F@AEmhzUbG)Fl&O{IjW(35 z3@GIXilw&lAPWpas*OI4iDiR-Ro+6*<&IWR6rbcgH=hJNffMtE=8hi_c!;zU1a?Oyu2Ojs8_sTB*Y&-mO%>{k#Pr zKYF4B*eA1y>aG2<>bkrZYMvD6hz<>xyoLWu2)CjHIjHFz-~esR^J#AxPg5l!$_kAW z(959o@A5Xunc0D(vNL=076rrY(mNhHK!cQ$BJ`_(geuk8warm*b4U4!=SXIkm@VW@ zykX}jHX{F&r+}_*#`3T;o>Iy9c?}tM4;Z`&_0dp%)I$U11POa!t!wJr_4(Zk`XQmF z-kg;c^1He@#^1M!{3~EK06{W_9RaVmkGs0q-1PV0@?tkhy>kF-K zHuivPbvlpOlrGN+b#fO23s~K*7s1#XOWBY@4~FmAEePrgL*LI?=m>A`Hcl;ofGiv% zBpOX2dPc0cFa!VduCrF28Y`TGXP@qbA|MhI7L9)jPrENHe6LUQX^C3DIb0QYi75KZ zusrXYO=xytE$$X>{&DQOlJItc{nYq~fklKVHgH{P03b+wYvzfbS>1ku$Ox!;9&v?X zCH5A=(hiQcs+867nz|9WVi~sv1VAT}xeLv2RO&FcZeP4WL|^7p82JYd9@I;EmJrn1 zxI--Y?A#%>OJGd=7+0b^Lvb?j*&`%tK_W4XbN|zC$)ByNPe>ABQc)~%J>a$X7b*v^ z=~M0*NWSl5KDpyC(v-|!dG2hnucJRUjqPXkkzwolo93^wj5}*bF^K_u=EyB-8!liG z5x@N7>jZ9g>P>!#obLo$Wn4q}ll!-Q=Tk;Ne4WuxS7XrPJ>Hnhm^s-RldVbmcraOe zGWWAH>#s6Q8wK zn|m7@CcCoft+fB_C%iDv?Arw(nQxXWaZ88=jU<+B@HIW_sUhZWCsaPEie8|f9@Dyc zHo}9vn$}KQo_=_`B}uzo$vjkxZ@^xz2e) z(m3JxS){61;v;Hg#&LS{yu-fq#NVt;j)HSNIDZ+coF!2axn2T&C2l~|+?~zH)n%kA zTiZUt3D0SnJbk-WQNPmxb~70KEFz<~cPSj$<01v`6HiE}de(>6CHvy;tHdmSlK?2< z3vN(~=~EiryR#1}4dl|rf<1hK9PG4uM{JCo7Yx_7TDX6~Qb(MW4HjjcPE1>TOl6&P zc51EZC}bz$s$SfqrD2aNOw<^6Z{UYyH=BQFvq-CsX+1mH27>i;)1P4`bI z*>UqTf8Fd54;MQtpG%?m5l8hr)dCf4h&SiO%w(Td#}1{bvi6$X;dJn0>*vnXT;ov}9p`)@{lZ|2RGZmgX&N zLKpwAmdZF=H~hsXx!3^D(5v1!Hg)a_sX4SL@O~|vk-EtiG{JF({NKEg~tAeIHkCDw_CqRTUZ$$mt_!y^Gt8dlPLnd`bEs4g50Fie2Arw8-)?Y)dU)@xi4Zo$qhS9uf*M?x zSsP3x-)*}@+FehtZS+}~*d;R?*haWLL7`sq?VFVWI9FdUY5!DDfAz$ypCe4&DY|G# zd;8saN~dcaM)#rlucOBK6RQ_7@zO4)vA*_I{A(DYXd};z$v_=iOMwsbC04VfMA0k1 zi+Rw)O&v1Frn811#~zPK(N@HLp%$P3Y;<%QFUfv>S~|5{MeEpnYyet-seRD(wbS)d zzi)5hIX1E40)|1GeX^as%u@Aj;|<`o=rELt0e=B@MUC@fym`#Dc(1XbRVZtwmk-12 z*{@NZhxq`$WugOKJTIl6#PC2&zrkU9c0%h!yu0?l+C1X?)Q~)>R9y3WvwU zk)PC&T8O%XW^ebE4}5cM%^jxow1@L~W4)p1B}j?~w$z@St`OHI-c zt2Lf7MK05sV#{4Ja+AxC-XeQY&&s&mi#W+^`rh8*5YGeMIuVU_#i_RV9kMd5Bshg# zYY0dRwKe?d3(3dJqCJu~uso-;ms)Y3_2(@Er>(EeR`<+7B$zA!kq#Q)nEL}k{znjtsGUb!qyP!0EU?AfJj0C?ltR7gR~*@s)XZYi zgFoY1;k#%=G3(gWQW-Pjd2jzT+^3aRGKJKet`|{ny+Cm#j=6BzpGymK+F_Us`@PE#hAkOD0Blw5?w3W5hk65b3t!W(j&cM?8eD3hnGK0P$Jio%Xj@c*O`fn{e zcZr7%TItiCVfaXc;XrrbgfxCyJ?qe@c&dNezr3{8MR$~UwBd@|svQL^;vLItaKE%P zkELt7&#D%9SgBVwbO7At7CjBA_wZPz>Bsl5my-Ytu+bx>(*j@%wxy9*_0SG-7-W9> zdL!&Pkb~{De%a{gn@HH;*q!21_oC+}`{Na24@N!hDr>y`4})IrN`-Y>s;pL6y`7M; zq`vlX_3+sKlbeB48(F<)WNOKQmsKJfBqvaE*<07-~%hRlP zC+XrpB`ndTEB}88($291s*}(9z|w?Du}StK8A<+=0J6tt*;XO=L^^=|X*xkA|boqR!*ziX z8PX(3oq)R-{f&G`J>wqai`U4L-FzV5J{DAOpH>GqlX0Ns*EQVk>EfB5s0|Ef)Yn(F zq|-UvW-M`6U~1o;E8ktf6bTxI%+4ExZEJuwQbFrRbawCsF7o4dy_bl%uL%LMGscIT zooRQ)SHzE-j-sy~H=gF6{S-*m1!v{KqGnEQKLBu;Z8YSgjz)*oC&P$I{0Pzzhq5_@!qw*2(XM7LkX@>uzXNbo^G%OD((F;tSHP%QQ)NLOz z-g4Zr|9m)*Vx5KbIEq8|~hT>D+7 z;T4jRpIrIja>&l_C&m&!;4;wN>wLQhy4=T3)A|Z6ZIOHlvS6~W@47V*%KWw*={e9p zNs)c(6uec#kg3C7v=1YB_0*Mt9JRV$(*4kuQN%a0*wIes`p!lK9`woV*&uHW2ZtDH zHWO%w{uWe74r%I4F`4sH+hm!9494ym>M<42enc-HhLGm5p~!6xZc+4=sips!O&HLg z?j2`}5hXBR)1wmqc)q6619+z1{}j1ORGIUOFey2DZ+T)w21z+d4D5gal9f6`uPuRN zE0{y$mf)_-E?>kaIGx|m%%$AXty+WLy7& zZJ_7r<>xe)04e$h!d<;bH;q2QpqF-O+~-~ZUXnXQ|0cR7@~0^VQXNR?l$n+7(wK`U zb71xTHluIFwHyJbfYk>=KS6Vq&`${b_L-^@$PKInWw7VR-$N?l>V6-4*Z$^b|NTFN zf7`+X{!PyQ*YExhqU+Z=VP|{pk|eDM&+~r3#92%ZTHzFbievtHVo?Gy5SZ?xfTG)o z6@Lc6dsdGc`j5{^YIqPN1*c#6@TEb25vJStz0rP6PkjwfxY(8~KkwjL7dU;-;O9Gr zyZh%;m5+Q`;U2o@$Ha&eiCq^A@wxc!{t3K^-uJ8x=cjo(2MQR=kI55w#9AvbV|5?7 zPqYEss-9fQ+^GNG+7ZO`N1s6r2m<;4ItR+b2NdtA**`lnItsY?Dt1}8#hkIRj4(mpL@=|9g%_*u>W!?W(#)|1KeoS@dj zTI{DUlLB7eUU^+%T9QqEzJ?t;XA6^3r)PA4ZW}#$_D!f_%!qGvv2J_QtV0EA{$4th z%)TfzxBX%Bd+5k3wSOSKQt?tk>l1k&()DufUZu(f+Z2~5ykk?VU&t{mwVZW7b#K{0 znO9@~^MY~+sN(#k_Ha}L3e#}*sBlq++2$3+eaymFRW(-Ca;q>_jbyeeo{_xby@CdT zmr8S02l*;2D)QTV&doA2R__6yuzInkJuduw5If&{1?N?nH}s!h!u+xZUv@r9q=fsy6az-P{)0+Ng; z>KwEgo{8fE+Rbfe*VA=S;haWN^NPAa2R%J%TwgpacQ60Vf1H4u>Nn>PYO8lS%wZ!P z_5q+!`L_0)buJet!zU`>xD@Fh#*jzLEgM*8HD!Ha+J?k^T>o&(0zsP>#&nj7yd zH7EZ@4IdpcSSo4#dMM)xh8=&#vNsr2y#4pLXibvk=0 zIKNWM^mfi}_kGV=z+Ta>)NTwH2@4TUB{5`9<&MqBL+1J1b{00oJ@J^AK)FvHh7IVY zOXu!X6szQ7zlB#yCEk>QihO*m{2%?q>i`0Ej}br0G2+sR0%YHHC;;Ir^krhBh_CBp zEbnffx-F18TsfKb6`<{nm_<*jR{E9VlvD9nW+zIDT!bVd+ca6n^TugH6}!+`8f+?$ zxpm%jYigvw(+xL$VIpjsbUGjhd3`WLchWE)eFX5#`Q6a`K+$(YiGJx=@#!jhw~TuOf2j8%%cG<^V+2@ie`9P2v4yeUD^jTx<(H^SNo$H> zAC>C|b4L4lBlyE$TOx%l(hN5Q#juL4Dj7-TDS{a4zG0Z1Fs=j6v2rqgwoag)7I6+h zYxDTyvZr#TWtp_%(1)0E&+!(1sZ_APn-mjiob}mlSYYxW((n4q)4Z<~DT_ycJUI+J zc`JK_(rQhT^G326k^Qz^{qsrn>~diwXhA;*oKbEZzgd=*)Zlv(KEc}?MCBGv*`sA| z|6VgmL$B24yG^vFV1HJPH~69b#sDKd%dWz_&BVGWu-7R_mAZQ-JR%>HG88u2NGRXgW-kf%O? zw-!__L2BE;jmilq*B$x8CU2&_g9`y#TzxXP^V}66cEMyD$ZrSh8>h=C;hNBOq$E@0q$^?jzqhpa*-<+_o{~I6pV?9%Omr*xQ)@ zPGn8XFlbIJ3|e4Lk}Nki!0@C5l52jbRqvBFx7Xzgyoy@aUVHLq0aLMinU(@AAVUc^ z;67(*g~V5b`Oj%Lftg%s#pN#8FTQvQOxi1(8(k@-3ocA~I_i+#%ik{)8~&oHgvuR` zE|evcsHtaqQLMCo^!n$OD@=fPd~0d3>$_>#Inz(r7A&Ync@#j6ogLPGIs)7|OiL&5 z^TezEIunlFTu;?SHpc^d(4GlR#;p=zA#-$M`Ym;rk2_kGb9RJwXs6n{&yTykK1}v$ zm-{sShT;>wKKu#wp!_95_NWx-kv@+BvDVVyxySO5*K)B+l(Jgk3vDAmM@8ooev^Nc zCjE68`vzizfITh)O2E5DY42f0pv&!eb&MUq;;!)O->{K2&-Mbrt#YvAn=&zL*U_` zHkyn*7)|&j1yPwAp{>n7VfUC|US9GY9EaK+K=wGm0|EriQ*p)zk7}D4O>95mQ@_`Q z*q_zf(=Q0?_tJFSwNeg z8RDo@Nb-Z=rt)_rxI0MhBkRqyu?VV&jg8SH?==_h30qz>VvIxkOh~3Q1OXZ`qY~KL z+M^$x^wK{1Zhb__FPrcG6=dh> z@SbyAj?s->W9p-OQz$T2sHx9Sls}o6aiRe(;yDw6o9e0RC+m&okH(o@RnC60Ctaa0 z{>}G&&+}%zherH>S;)H*b^OOuqBrmVY|6b?bkkRNFe}km^c%wE{$(KOjx8>>C(GOd z^nRp(ElQgAfOaLt`0$YoeSfR{hB3QV#25+J=SWhD3BW&4*$v=P(-V7*SnuU)SAFmn z5#T|Yw(4oUaYDz=Kc__GT)iG|NE$NERBTt)Y7OMSP(kn$F3*2Q&F$WB8`}VBL?|18 zH)lFO6X>@(UtrRL+k7kHXYixn_**u@%P1uVIOKp(b0bgWJ+k3?@5k@vYY%3io``ST z`V9iCi?;5OzbAxghu{1LoD`tu64b<0!s}sdVOu@#xo0DDVQ|hqiUDufC1N7SzgjK6 z;zWV}ZR%c&1n*gC`|im_w=8NPh8YAv78n3_7tFU%ZRl_@O|R+_dDs=6h813~gX?@9 z+0t4WOuq&afCrPLw1TCccdOF%4+>A=C>|r-Ya!oR1*XH+I$vd`ok|Dn{2_`uFg+3y zUuk!^Y4BA^c4x{165R#civZwv#Bn|m!uH2)Q@ozk+Tm_llzrtTrS5ii^)Ha+=wY6< zQy|J)w5SY|Icjz6?}LX?KhjWKZ4vI2qv@z<3ZlAW>u25P+Gb8$tC8G?kYHYUmY2+Y z7&<`VCc>E4G9M0q+SM2~>twk}QMsK-y}WvOvSqaIfibMX@ehZ~_|tSBf4u63P_-`! z!rd3RD7G!0K{@jA`+X>}D3Zx9*KSB@mg}!>U1cnvQ`{CcK`Bh>MqWDk{{U01nusO! zj4!Vt#m;3|%ku9%aKZ0sxUsE%Efi`P0cQ%8jo-MCsD~F&m0Bndr5$`ZMr`VOO##<4 z@j^caR?WML9x*9EaI&aEkxjeCPH%SXRdR(iAT?oWx*cIJl9Df6IABP6Z;33uZ%KNe zo>}7>udGc(uZ1%pib;ShL2f6yu4w)oAg}6*B;i+L1zAA`c8fDyl4TOe>iC#)-A8h;IQ(v2qXP27C zF8+1r`>URGS}Gb8EY3y{aZ6c6xN!lGW{0^fXCd9SNpm~ES@>k%rG=g*DW2~9re+Ta zYx62Kvp`5BaOp9xg(D5)5Ot9;oU(dlRuo56@Alkcu8iF3IIBu4CYxyTd zvTLt)IHXxbDluXwTIm*7gB{gi@_dzYvAQwlf&K+x5^E2c3VG+mHEc@kVKQ~GxG(E6 zXkwagWcocBxeq~&66MS}S-$xIkeV=m<|q=4^HO9C+r3-@qBUQY)sMRjC|Gd3+WLB` z@{6)cI*i{pdd#F9#(~xtRSj!EisY;C zXR<``yt8s2W=H(yi|l7LjPTV|>ai(*G#C$4jCwcBp7a)?^lGW$b(V&0WH+5L)%I#2V z1TI3}?$Mx#7}Y*g-3rb2W)wNgo8yfzdukA&4n#To1a`%5Fm;~s_U*KANzxR2XsL{- zV@Obx&0C(|OoR-_(M3YD=!7UDL~Y|HBNLk_41#YJhSte*H8O}5;6-FyOez#%Jsgj> z8S!7PH}70fb^SEIyr+!qdGZk0+N!u}-m#OaQ{=PTM^9^X5{L8t?J%p!vKhC<)xV3#7&UV7j%NiSir`6+)GrEf6^m~;W z0tDL8L_bAq95tsTOibPPgj?wZ)DgR|w?%VV}8Te>1^@lzBwH1tz7 zL6fD$IemSIYtIQCNm=E+h!>p3R5WI)6f4nki`3U=@hmAa-oPmPxFMVO@Y}+Uqvk@X4l@Squc2E? zZVcNSq5WzG$Os;V8wcLk0MDI1ri5hgsRBg*?CQfSmgq>^=NxI?S(J)t{J>MMCkokj z4&fQUHv)q`x%P>fD>hU*9#jIgRxVKkHk!A{M;tpFxK1r}1kzz50bG_L&>yq|?s))hTbW&MC2Nhid^A6I!)MUZZ%92z+&uqnL&X zP{RpRG~JePp(U7mCr+F5Mgtk6mSFaL!OmZPKkm9=x)q$$NmdJj+w79nzw+dH?`w%D zu@d)zWGzKjYnk`5HGQ}rpAd$&SxHGy?Y-~HW z$2a*PMoT&+at=_e1Qj9<#NJ9C#JwNV~@fPvE-2A9j_Spre-Y!ESjU%yBU#B96 zqh_RT6OK~neys=vauJI#Mu~N2O)Q7dXoX#GT(iK=4vJXzo3gDWmnPB}vBdM`lgwPx zI-PQxw%AP?er06>HH_?PJu*;*ZsV-wPhpC4CE3n%g|OAN7H_%Nv-F0oor)a_*5{r} zxPGr=fx`yyT%g%-U*aI9`_tLt13y1mYRDn|hPkebZ5a8OyXKZS;nC|)07^c6Lwx|X zJZZf-?5H%lBJw9#bYQD{6VpP0uXfm*RAlKn_3^JVWd3%rwQ_j1iLjzThE1Nu2O)5% zdt}M+=lud_Xga{vf@nMn2}025-`kx%M@C2%`5pg3W@|KaclVSv~EAEw639vnBf0>E@ULjjm`fq_8Qr^xJBM3Rs zEhoK38LP0z8U`C#*rS)w{SnNVhT9t+V^^@lM}fmfAe&J1GA;+ zR{DKgF?3@L^pFqcI*eVIt_HF8Ma-+f(M&k~{uHh@z~NA!DxEA5)*PVm(U+?|K|<6cY_eMoG2jfjxQ zkkU!#eF}Tf#ukOAJ`@xEa(zvh1YF!lyjCI|bg_ z5_F)-l<8*D&q{;r60{}lUrwSUw|O#EBPe2La1uX@+I+x0Vd}jYqSccjlM3uCWNqp0 z?b{ZAMNjK=O_+xJag$>bYIC&DZ$v}TJS7g zC&g-q*W*>U-DO$tug;sZ(XuE}Z`|+FNTYwY+GmeaP`w%O{Cm(b4*R&xO?sKqw=6&a zh%YlDd$)mwL#LIrZEa}u@TG~cRmAIWhQOA%s4Tps5u*t;=8#2{=~|D{zz@IPR~ z2z)rLqc2tz)^uz@1_)Dff|4DZv%3^Q4)YBxCg=$OG;lBlfCth6=I{h1JCIsCq|iyQh+B(dp(^QFg0 zlQ&-dk5FQU#%)C#kl?D5hJ)=HLb=wvFt)+A1tF;DcW$mWXjWm%yxBW;s13nn9dmeV z@@#`V%1@qY#7A_Y#8P2lh!P$aYAo{56K)7Z5~{{}mC1nzGNc-|ww~EG<6`G|n?efB zkP1}@{Y0ekA0}OD37&ODXevUpy1`kC4_0oZ`_txj>FiAI|2pA2_Hk=5+VLun6YoLi z@S7ilpVQV-jFd;uJo(iwKJ;5U(53`TUntD!+Z+1#7YVtM-`-XQst!!d`!3rlsRxIP zqoVk~(}LVyGD(79DT?5R03I@1|NuM zF%B35h%JgsHn9hnjrio$3!v6tS_2;~NdBTmHH$&g;CSq09vki0Mi3(Twt7}G4kPoP zEpB3L?@IbCH?;GYD@N^5s5Po&veWTl+~t^mXBf+rNIvUyy2rW5$o*Ej`{z+_R?0Q= zX{D*n+-5^Sl5Xxd9=k?bo-Gxl+1zPAsj8BzcHxFVAL!ALO^qD%ygo>EC(cKV$y#`H z!7&cN9WS{8irXJ&gsn;cWYqOU;itLn%z={iMwYyO_{1Zy=o$cOmINro|G0ydYBNu+ ze)t`wX^`b64GHDFQw(S(@J=w=S#OqSktJCE)L7EuV7qM5owx{2pkLE0Ztl-fFj{eb zR?ncAIGdvMG6r!br+@a4+}=w7COae_DvLSm6dhk?Qvyut&ldHG5fJBdA0611}g_w{CCW;#kj=(mU7&f^BlD_W7 z$_hvKR;89*)q&%DSaYg|@DjlXC;`Jpi}*z+M;0uy@T>jH0^E>P6^tvgYg;}&#d=dn zZDm=OfI_xDC#<7i-~VlI*{$#zkgnVO+>Nb%*m|bm3r}5gQ}~6?0#L=i^DzY^2;y$! z;mZQImtL3uWVn{y7$4NnWEAFHTa|aJ$Y+;*O$&n*x;~R}PKbO}Bg;&CL;I>J$%`b_ zsKj*Fc;a+ z9WWGEM*MJgOr#~7-CUPqXRFymK+b6J)>TcLt#6IVpDZ&f1J1F8Z8h1qEwi(krl_Ct zFByN@gQbSRh1gRI8cq$ZjP?p;OSoZ9yp&b|`OG;HEik?U(Man#OU!hqDr7R?BMJJc zX!=_|Kbz@&PnPNK?EaKESLo<6%RAQ4ab(x!4-212Qem=sdmf53yiT05J_LXOo#2H_+WWvxY$y zxm7Yhul>&X6^#Kjao36Gq9=f|hU{wM@XI-e$-gvJ9Sr4$d{p6SV&F7tbIybGh^$)Ll0$jlMhBlZR+}ESd>(jH%n*Q<)url|CDvb zC1^Vslcsvef{oSaO&L_v#&Rtt<9gD>Dcl;^W7q3?iDG6&YxIspGQgdVm+H)HV1ny=XZeW(J*q0df#K5oNFbjrh#h zKw>kz@neU7BOp~OGoFEGY+EimX`EFM@nLx40|24flm5wNawQX;H>J4 z_o&Oe)}dRJslm~tLO>LH$*vhYh^NPX+B;|z^QnslWWypL!p9qU0SWr96K||{%P4-$ zIcf^5jTx}@ywO#IY2&${QeSsV%^LxMr7D}mG&>uEwuW4TSt2}$H1d^x_zh8m z92-lkDu+!DQ1Ea?@kz^4*L=HcJXrRk#g5}Ut&C*3l-W5mfp%t>LwaIvok2&ziu2&S z)1MK+M~yh&=O6ZWCOq{e@X@Vna@I!cLLA=0f%$6JsF0q{1LB1HuM}Cpwl?5sG}C#R zBq!hf0a`{Z@V}v^fh{m#?*Pv~%#}1KCmgFIY&2Rj83Yt~x|&V%AQT0)d_#xhENHwX zySQXCRgX7k4ivO^$GowKw{XYo&&BoTBLYQQDB%5s%3kwU|15f_4m(|WC^Ey+i@w}C zsi+xW3d2%^nw}TF;1b6(_!y9ziwDjdcIWCi{B10C%LA+jW<4|&%d!@kWCjW&Xi7+D z1yeOaq4pt|?}9{1-1?D}U@BvJpTpY;&m}2~o;TMaA*Sfvf})R5%474J6WaphDD7r2 zH6I=4;n^LWvE<~O+vTplq1qu^Dr#A1gK$G%eL>l%c^LC|Pil8DWA3B68$;{(uw5nB z%7e77oK7GLT}>GXD#ND+{S@K|@Ud}i0{fSa$R4i}pMN%Fv>Ss6%m=zF+Ba`>@99;K z-mU`~Iwsu`tx8yJ{CsVa90>eqXS}7$Xmdm(SVSVDcQR{J9-yLNrrFDa-1Nr8xiw4M zO~!oa@^K%weAe&#-p2VM5Q}hzRIXU?BY4ZTqR;n^D>N4870|F1Mmf(Si&byJ$mXx3 zX;;7{Px7~;BY6^Dj*toVf~O97Ttf7{CZC3VR_hx|1{@^S_}>l^a$75(%#eRLNCu?N6 znxHa@3{5-HNfbrRcN+(SCg_y<0Dnm%;4dk>H0u?Rp%fl<=Bu1I!(4oix(Sr+)7cp5 zTJ;sBcOGVp-Vo9@sGTxF@?T@ngH+&E4K^YvHOlnZ%3!X-B_gng2R3%2$Ez!?79wm& z^&G#JfM}p4ttVAQTc=L5<=Vv#|1jLXelOIn&Z z_=?ey6i#BnGB8iE2xgh(7=WZ*{bxZGryambO){05TYF&0oV^d0+r(`?^rEr1^qC*a z)_pgr*omgm@vE5(7yDYIYEnwo8;n?xJv?D=o($%`kuyyDm7s9|o{>kv3!_=2aUly| zoh7^yIeP-#5y3te%h>KFSEVO9Iz#mYSYz2GSmWi?(I`iY80>M?jm}!}=_+p%u-&8c zad};|V%y=WVKKwxYzE8f{sRK$QJW@4-A5bsfvt8ZdLRGg%N9>-c~AThYF1lNj}%gs zk6k})I>RzVl`v2H=8yCS9Iqy6x9->3Krzc9u@bXEQ?}|h7TGDPw+1KQsFqA#CDe?y zQejPL#0L9Q@qKwcj?$Iy)VNT)pD|~JC7&k>llv^q-5t)K$KVL1S&xJXOgFh`8b4I5 z+}x7}GT6zo=+^PqWRJoGn<_mRS^C#q>&I>0tuG@?g>VR3ZBql;FHDu{)zubp8LsgIi9*Zt8TB_y1;KUxwH+Je@iW&?A%fUXzXJk##`RLMEB<@CwlD3jP(2|n z>)%n-;%{q7W}iRyDwQ>FzSb>-9ZTkZS+Arvux1<*sH8HRsnn7D!tj4YQ7ivOQJ)S} zlUajWNHi_?bZAQ3fi&c1>QNsxd!R#6#ChN37=VS1lw`a51~0eD*w0>TqfpBg)El%i z{b+AY@^Gis1p56ccIt57Jdnek6&dOT+EZQWingGJ2o{Jr^hMOul+XS-V#fX^Odp8I zHW@DVeQtGeS|Ic;AluSRni1Ii-=Jx#4WGA6i|EQRpg^jS;Nf*Sk*x_(@IE=a&{b)4 zQt&sLmx!n%HZXnce=%_u(4P;WcrE z(&Jmu>$jy11Bf*ys~<&(ml$F1`z|qeKv?tWPA;8s2;kqIKK9e{vxIchp>mImPtQ8I z&Z3Tve@J-D|0}Lp$;ald&6s&aul-G{IN$=Z^0nB_DyI3B}20qujV{O31wn=X6jteTW28!Uy1 zjdFec`s?na_a7K;ecy^Nhg3CA(R4aP{V&XaD|=f)>6G>GhJ^d4m+voyJn>&=4-a@( zRBkxIlc4qKx%+%H1e_SF5v#+cqr)|i$CI3^?Ic3L$LboF@a_BSxCFx6{ph-_lC;9F zkm*HO`zYYJ=V$(-@dvi`+{Yj`aegfIf$>1>oq$U}#4i)%z`Eu`;J8=M1kB=)RhE5vCI*8GI&nVR z!g&Rc%bB^x62AVG`bp%U#@52iXnQjAf!YkDLgdpCl~3e9Rc?kFtVYKxU^u$0O=Snc zdBViwoo3lh3?1ZTxmz`6C@%a6SEB7ahOKpvZS`+{a!^c&u&nvkcU2wEd(U^K$Supv zSc!<%U)h|5RN5^#r24Qmu5eIUQ5e_#KB3fuzeRlhb+Pw(qk2}%(zRn$^Ub!aW5>2K z*jIQBA1ICN?}->cBl77aaRRQ32f&NJ&Yg1L>-cMn_4(Z9bA6j$9g^zwgC_05=$F*D zo|kg}1tI@^bBKs$qEfsKfCZ^S)@YO<)^iibw3_`|N0o_$`1SMKf2G>|`O)V=Sqw7F z=1x!z%|7#Tt;YwwEsjpA($SKOL?pK^63ig~I{azgKL2;D^=p|&fE@gv#}wJs4r4vG z^W&X$R-eU4X^BrWJBcjE=1T)l(T`1&& z_-^l??5RQMM&qlu8+X9MP*hCI*@T{BPhn|GLFpx;*Hj;N_>*w}xb^QthCcGMUai9h z8jJ921+HEZ(FHV_TagK8ruaHB^!-ma9W5-Om&#Jt@bWk&r2r8>HMZ^U$YrO zJX{}NzF_a$>uoVefPW6IA|HF{y1?#zW09w9_`3$)xVE9rVEK)8BA0q+gdg=lp_BSU zY1=4xuN-UT^QX6nOyXlDOjl7;kD-K=#y^j?M^A1OyB0mISCGr;cYU)F{7xIGp<|E| zGd!#!%M@)mT`R*(VeX^>0w=l}`d^iE-pJy+fe4Q;2&FrJmZZLH1+8W`FMMP{FBVzN z^3v(~ZJ-CcbM0YbWj~ESBBJ-GagLs~xSMMu_?f&a)Hu*0v`77OZi5d{q8r_d$55MzKLY%?ex%v_L z>cmXFeE*$)zMF207o8qFO?Iz!l|3#|+YWuBmoqo(K4$9XrLN5V(mdA7LQF^&@__VS>+c%urZ1F#K}=D{=7`RYi40tE^i!`3T@ z#w=x9u+|&j+rW+rH0|$19HBmBP_He@Sj#!&A7FzqE0YEA>YBLtd^=Wt$+f3)C125%`6y+b zI;C0T7@JPTQ8?01=f%Ra%u?e>) zSeei+vb?Y@t?;iPI%98BArFZK-_!Af6u~jnl+}o!Uhua}kRyJqYMXQnOI`eB|IVBvmKxQ1HM;2{5_aIdL?@#FC|=G)bR zjQMTq$@r6^mH9~=HnW$tzwg70KaHe|fwoy2y`<8&HHJeQX+EY)}Z@ zy>~z_73igVeP@btM_jDP?49^qd+j(M4q|tOpVn5=7X@9%Tl=cuLPYKNeZwf!yEQmVBYfEaUUIE@b3eG?TX(ajB-c6aR*n zp{g{{$&4$yA|bFByjn<%bz-fNQ6+q3J&V0W^P7dSh<%_X2bX6eg)LM?I=Y1;&#g$; z;i-dSj-fSk)_6#>bKPrMoh|o@nypW<%SNK^vPsfQArxagQ~w`n?;X|D_N{@U9z{g3 zpd!+2fYJq#PDBtyn)FTt>7hukNvxoPpj4@$BZOWhl&CbRL0YIm2sIFp5&{WH-p1d( z=bU@Tc;k&XF8?r4*x75Xx#pVdo8LF5F{0U%Kcd<0v&V{x2{|H*++Smk+){9HTj2=q4WlBFyH>IK~gBq+5AB9rF zol@4}(1o|pxYkz7^#pdMl^SM3J?2T>)bICRh&M2VFk))p~a(QH$P$sGxj#&Y!76D6jD{d|s-j`ENvVR2t#QL66aX3Vo=Ork(rz z{B}i{7zI_6iOOz8O*cOx8=zFc;l&6g!q_{_ugXT>g_{z z`8f*bOsEP#x4jP-N^<1;4sUI08Dgd{CDgX5&n}{>R0qpf6VfE%elC9i-Xhgtz<+Px zn}F%w+PvL@lkFaLA8|yX z_~LIEcJT+dT6blcfuz(d_3UqIVGL}j5aC1M-+zfHD(c{)GMmh+V47$-AW9C3K82e+j5fbtQoh9r}0+=braE zDj2kQeGN_+ zb-%}cC(TpzW@s-e*`(Wv;v@w@wIaQidlk}aa~|e+?7nb)DN1_mDA*vxnLCO__=?ug zI1CBfD}zKDFY`;WA#)Lo%K474NIWx!&y5P+*UYL-iYOHuXQt2Kro{Wy%&=NCTTY?`mT* zvZs+_-`*MrJlw2-=a0=?WFBR?*m0M!p|Z+G;bJO}dqtB^TUTUKJbK`Qbwd+nl_w@5 zP-{gis5`RhsFfig62KHi$9^N+-UYa z+bu!Bax2yZ^lB9J=9S5amas`-V{-x*@kJ7@+J8J+c$xVnd~8};;O6;ALu>O7*5X3- zIvP^RuX1~OoW->Cx>j(PkVdh(h5VfZK17L38Rz``2oeqsl2v!3fWc1>YiL9tU^lMK_)1t5y3FfIIbY@LBeS87Rv|+}VZ&IK>%E z{XV%~)C2{J*f04^)%$8<^=U);%OUHhyp|{wEV>lwn0K^uXutT8$qoiAPvt-VyG)2$ zaD%gFI;?bFLNZ4e)4y&q|MZE;ch<^aJcCh7xunj@cd^oC*MR=CS#WmF=Jj&v-@$*qzRPpkU?5#jdn7l3rRJE%w3^FHAWoow zWr3)-_hEqB!_B?MIqZl!4O=@mS7iP=IQglsHzc?--;mNRgYCYFFXnc;t-u%U#S6au zxQQHHKO(0--2Yo`qfv+zzYw8N5I)I;OnF<*=<=3jC(0R~O`IxpceZf~7xp++1l61U zOjRJntnp|rPUv@5E9RL`6+0x1^;(|r*Wh(-8i?4bA;TVpUHKV^W8FJ+wG?yov0^!# z-ZjDad^wLXe6!*U>|(;p1?I8sR#ku2CRH>wK|I};E*h7SgcZ_MV`Po?wa9(d`zm*g z5<|B0>c=qk^Eo>T&`X^qUo#Gja#cNyk7)YWtmLCRvUPq5b!$sL&Tl3ft?tbCTsE^x z;F?o6o3GFSk%(VO@w8&ISuV6*^C zoX~<}^P>+h9N#+16Kf{9rpG_mwP$gH(n^VS$&nt zpHcuHnz&zPE+uQoLcbo8cyXmFy;9wwE+!{{I;J+OKI`Tru;nDn%IeQfk(cqs>~tG#tPPh}uX*{VJkvKM!^+6(I?dEkppF zX|*;mYvZQE;&Rfwb#x5RN|bmh!Mj|62~^kNt@JW80e>+Uwq6!%t>8>|)qiO*7%1GX zy1p8ZNm6Z{rzK1HsyB&%1(}gNxyxgN;VKJd(AD;x1S+2msAdW z-*pJMhqLZ=ZcuT|m%V1wde_QPqro&WsAevFPyVxM0dc8r;JcQ${SzQ0TIF95boB8v z)`-(GVEBv63&#eh<&%9 z05!&;wvzW_#OmDHPsO|Axbjk+Q@?vGrc|Q!Y7q%)xa-~t>ee%j9GAH>luI)VApIR< zJ8*ubfq{6Ruk5jvaNK4Rh0EQ?fH65o3w_16Z{1WCKR3{MQ+aTsuiPlwxgeeMvCuCl zOKSv~qc+a8Lj-?`X;$V6$3o!eJ$KJ%iBof1e524~q^;vk2ZyqwFR~cfxR)g!=p^fP zOb%)@RW~0WI?*sKw)LfLo_?&Btmg6<~eeK3E24Oz$#)wsx2 zQwO4NFif!w(oBTEa(Q4`>Dq&?xs_%FGE|-_^`EHEKCmAUO50ZMuV@1J(c;gw`^cY)hLPXFF2}O_yAruPGGDo9WiRUqeedwKWHmcTXArP1=Dp zJv9O5;7nBw_nE;f>$v!@`AHY%9A38YiwfKnpSvEH;xn>m2A)c3vs@${t5K<%uj2Dm3z_Z3+y5D)`ziW# zR^?TuXRz5V7wpy35zi}YOh!y_jmYjM;*^(D>F3Eh$1Z4CcYJUL%GP8dIB*R&d_Lm9 zi`oK_D>NMN0i8>a4JwRdW3AedLnt-NEZ%0+lLHotvmefR9Ua}*vUsZYChw^K zRQ)AEQl@-)&COs#=)^ETBmM#E+c)eDvCsG(F}cO@$%18-Aj5n=Lou-}jJmb+wBbZe z9WmjO*?s@CA~?s}c!z?`X35E-U7-kH|CKPAsWs0JDT$mtxmGLEYEn2Q)zOFWn3PZFl5G~dt>YC`xJs`A)MdcYCZWi-6t?z-c_$Y zH@O!zSQAEB&m?6LgVOTmp2>dbd+>BbpBKX+EqHe%|IP#_G|V_LCt)7?9>i>%njr~k zJSJhp>bF)(;lhfO7w0Mq*TbmFHl>xcs;VMZ#zc}I6t=@aLT2D}wgRVg3WgEMu*Smc z7turWo^@sbyhTaYOxUwJLEB1!PL%fCBVoWATD0PLBT&rBpIdqYf(zP66iU%e0>=V@ zo#&6~Pt{f6BwAH2tTa$`VNq)O&Nf2Kt#+nKkER5qL|hp`NIK7KsEs1L0#8!YMQC_{ zWk{E(7*&7h6Bw)-ab`Ja2-AKDx<U@5DiDm27P@SUQ2VJz4C9_LVAkLy$`#5<~IO>B#wnHU##(5KH=u?iAWYX)8p?rzLXG5O@OPuW(le^lE=U{#%FpU@K` zmM;wU;g^GJ3ZAkdI4j|B&JdaqOZo)Zk2YQ`58L7Bgw0RrQ|+cbG!>C2 z{$#Hnc0~+-hM3nU>WjaWF%1$f@SWx%T1(5CZ@V$;ihm`%ceSGg)e^wZ&nFVYrikIn zU>hB5cMl$|OV3;k@;FYIxKJEbKfx~^nrcQ(CwY|O=|H&NS_Ab`Y;lVkP5Op!S@4i> zNfnEhE?aM*)DXUeEox5Oz!2`BJWS>xnmoj+8Yz_&K227{5fdWYSTs59Gyb&AneC~c zF>b@0&A*S@FqWAC#L*1+hJx8+rb~(x`C*?|;ELq%(t0ozT(ok&ptkl7vTF*~-H13p zgh8{xA8*j27O2ll35#>%h>rx=9oK!|jM8!JZtXHdzA}23wA|yWp4k{WP7RiDqbljbkNLxJp46a}>icGQ5fQx3OPB_awSp(B!PrK=Kl=4bCc64dpVgP> zn7SDZw@l+=?UseB5s~ndTDV37nxL(sCr(_THP$J>QeD>@74SE#x9Neeo2KolD$6@^ zQM-G?YjQ6BfNHWd6^0ulYtow|XMBYX8HeviHLhDvFTP)|Dx7i74A$Ev>u<0B3;?ZL z4Sqvl750NKZ<6&Q;p|@fzV{2J&2*c)l@b>3(|q5x)TNi7P|`CyIgMG0IYd*s7dT3T z0_Ek#&ID_Xp($mHp`%i7>1wp83yqMj?iCBUx-hn4{= z$JvD3<8xQ&H82!3({1QgPMLD@_cZ04P`uSi6LL_=JvG2#LpTyTK`3rD zSuG-e1_Zt@7ELhgiGAC(*<1uanu+`=>Ut(OUq3Q=2?+zXNxSLXw!v0VokLQq9!q^9 zd2jqzts1GTD*?axVJrS|p=*8RElA>DHO_ari*V6JSEO@HjmPk7J6K1jAMSxJ8l@{# z`vD^U4TOqYg{@S2f}pF9mP8$uxts}K^gNFDqVd2h>_=l|)d(SSodwLQo8ON96rF}O^sj_L~LHbFd3=H4CmmdvZn1fQ0p}i{A z*QbH}>M_3c6EQZ+v1!r_DH-0~BU4A4is9q*WOzl9X5c3nDjMToUiDtyx zDJ-YpHisVqH1->OsV=*T)*5Kr^QBAC>jW8d9v3hq|2e9p(ZQ(K>FHY^y5&zh#bJbQ z`l2aCyXmcPSsi0?a)4idHQ+PecRGTOVKG@VuX6S!(~pK_!l2QwL>3HVNtD253N)93 zH9T^QmI)gzh{NQKOxF=371$NIoj2gNJHd^vKl_ZTH|E@SlqV;T)-Vcd#-EU44uuZC zF2`i+QMxZ+gCRD#c#_zaY4`RQvm$F3+SPQJ}TPX$<-##>YN%{v0J5mbCHSf#oJiZ9IX zwd>#tfDh5CLwHKILtol?fhxX@e#YrRx!(&;xLhv{C=xQJRQBE(6(+indi(rua_}>Yz8NMiOv~Z=OsO!R}^?m?M1IE>^8gY@w}?57)ERf6M0ub znwi?i=v&9VE2;7>;c`Is_}S=D+Ep}mp5S_!{gAM>)*aT?LtihSpsX!v)(~dfB2mqZ zruAjYH*z|q7rtkOTCk;q{fC+HI>SftI?0dI8fb~Z@ZYB>k=ME{`q1CNmrUp{kUzmn zGIZ^C?>?ZPZUN1Neyym*WVO(QOK3;mtxJp$=&^!f6GRsx=jVk!g)79!ZPxmr=mLU- zQZKZ&9DlL_om_sfRNts2QAktDXY`Ed15_UX_jdOeN8zu#RSc6mgV8>Rzo`$LPZ}R>4lZLjMKwGW_2O#-zP@LF~RTK

    kvkJD` zyBWwPe7BTWf6nPPy0B zY6((i)$M1{HH7sC`&@zJ0av`N^X8wjLSh8S{C8++Nxz2`8YG)h1AWKGT{V5mKGoSb z9r)S}UThe01v##u99`P%buFqzmCLzQmCK8mQScexSytjG{}RYb3cf`9&_{9!E0u%v zcPouGc`xw^2J&(<)>c4vgrM&Qq%RdTuX8XDS6L0|fo^OxBQ7BthF1S|ajodvXQX+9>v~2yS zqyZY-;KOsKIWYU(3gAtr_Nm`hm26v`3&QxaZXWO@G9f1q*}bD-;R(4#Oge7L&h9k>#Y9l)_QJCDKzsIV*@B#7G{)HNj?K54ZCq zKI2o;3lsKJEn|E*5xbZ~&t^#JynxmDFUYduE!hh)u~Na`_t_rM@AZP8otsa%DO4eA zuvO=rzK#{5WuEkNS9(Z|joYL&?nPp2Zg%FM1;{43=I^#-eg7wTOuTmGrf=WuAdOQf*-0w3xd^s#b^eQ3b4@@snbiudqWQgg3a!!6@w1og@yc872EIo|5?|7L zun$aJfuNIndM}jhG;gjzECa&L)qBy{JCvTrEo}~e7`Tv@rv(HIgZwv%w8OPT@6(Ia z!W=UEB*>X$zmH0Z#^ZM26I9Z2yId4~?|h5gQbH+wT4pzm(21F5>QDaJ_CgNsV~8Nu zj|^O)QTW(6NYomUj-RhV>k)5>2WJ|v3eSO6a1#PnLH^GwD4xJqdX3d9D1}=8XgT!N zGcj@Rg+SuG2uG#WLF(U>emE;t<5URzkRhpzWJ$;79*<44K97`?;8S*8*bB4Wgg|gnFE^HkVTaXswTa_*@9Up@s2IAd{p``y zF3)m{xBohH;<;)l=;YU+NWY9@GtdG3iRE4H9);yzIWGT^D&W6}cW4C04Ln*K|MW82 z`PluF2%~L@XWwLnBiE{R_KGR)KBct|{jlh_lzL^Cj-RC$o6BkwrUDuPc>_i1-i<#) z^Z>Xe*Z*NqeNY!*6Dla!yLNKeHZH5gNbZ5R9moD5l1-o9Ddp)jMDzHOPdHwZj%80#(a9*WoJcAR~#;O-3pv=(O zHGITN3|!QX*6W%rQV0OBUJh61{4*ADVRr=H_PnTOn5o|H6fl%Z2t4b$bMocZ>lf$z z`UjSsyVJRHt~HJ8zp3FS2o>!pP4JNqNZHkUU;E*-NFHhoL?v-02fK>JDO`;?C>-NCg)(<^$E4c*8$@Tr#9`EtXx|Qx1(T8!W?ol=L8%oxyqs*@sMP$Q*1h z7kuyFoYH+>edWd8d~+!MpPj{Vd&PlSTCWx;lD$oveMf^1i1Z%#GBlAk@-CQX#FexK zX?Xwgj!B=9$T+Z#w#af!ue1RW)5+D7RN~{4wUK0uZq{s3r@?ru@h)bv&1EB=e(T&g z$hscY_b>a}CQwZOq;kMG(APSXw{Tg+(3VTO?nPARJDP;s@s>k(^@r)*8YDPM3eJG{ zlfcTmWWQmRHMs8MdWLiz^FzY7M8-gN);M^#9=*zHbwaq5wx*!PWfRu4StbFMcCGpD z!wC1DeY|AYfb&)8N79Bi+GkSI8ivBGgS8VoTLuQK5uz*t3IE!FBP= zK5D0aXpDNN@?dj~2O&9pGP0u!%!fqShRzTY_vA)X={vh@ql<=%DCxeda9j4tAc(=x#<{Bf&STx%=Y3}bEGWO}1hRGk?K}`K z0y;C2)*5Ja|ExINux5gWbML1Ti`k*(c6z9bEeZJgg%M zDQO}1-vL4H*5Wy)Z7ZJvww2P(p*W#l(TA$Xh?t|mk;puU`DxI$15Jph;llg0p5}kP z&Z@7MeAz&KVjGyG7#N%{EA(Kq0aanyy{S7MHak3?D4j=piqkOtr0yohEV{mUWf&f! zhb?2oRiWsh{GmADsu@@Za?wC|7u15|3XL@w0;Zh|P7{L0t)!1S!XkUz3(ZV)@NW7L zeCub>&Cg$UxNQs@lYx>O(f+Wf59>2)dao2j`DZ+;iUN zo!k#H1P%c1oB9jJaK*ZFH3)k>5-EPXI9QKaVM5<|(b2Es@>-GUp8GwZXf&q#+eI&fJ|kdtL`cCYU30?FvN3A!gYVjBjv~-~IK)PJU9I2KM!xl=r$CNG zOSP9&T6Hks8KN`S zqhZF##H1vD=;Flm2+76>RI#{jI!s2BZEVnc66j3G8c=hB5Ykq7ia`L$lV-rnK6TSl zkmfYg=^BDQeLlE*5*z;gRp*ZGxgKS*Ou$_Rzo8gqC!;4$S@0K$Nmn! zLiNg97B53UYNxfRKuHecU-d2_N-~R|^9KlT6QKI>w5ihpY2V12(=j98gIORkIgc`2 z%Hef>iajE3{=j`78?1<=j8Ch2l%L>uKONyp9A05v>Dmz2yZj!iJ}) zoVSb=LWaGYr%itg_VVAq!?7MrY-F_HylnPVyxVTGi$J+-zahZsO^g;>a3GJEQrYsN z4Ku!J5L5Vr#>(Wq*(`0jZ=t!NVx{{UjyXAkV9kc317JMq@bz8#zIX{(;t%WGu~On>Ah%i zFDKb8bRdp)#0LJmCeVKju2Bt{evTL*Z3{7&3t$`k1PYusYiF~zwdyf8?*Tt8AoS;4 zgJsjfABq(J3ncT{mDmK@X;v$Q-V>z~pEbcD%@lBUzR=va_Ka0f-cXkec zZT5|Z%WM|^@K@NE&t8N_-vyKQw~pH+l^c2QNXUuPMjW9XZ!s`SfSGrC__AnTze@MHa71M4R&lhmQdFk^!3se^2*Sp5vxt0BQ;?Kkop~S41PooElI|}aeFv!DuONq zy~#rUULX4)C{T`bp_cju)nff6iSoUHMgUP4DVu|c1f%qZxE6F~N`o?fDORTe0>3 zi*k=DtA1+8xcW20@z-w{?Bg5yV;=So1G>RjYiN)J@BxyUyUm9sFaO8GA7l?D9|1ht zG-c^zDetSzjycb2CE1y^HWF@n_q7A8d*~geug_+wC%$Gr?lfk)yJ{|V9w>Y1UMFA# zUrvH`TCbFX_Y%Oju)u@*&$p#ruMEk$nOtYea+TCs3YJRnmXmx)u+H7Cf4nEp^z|3; zpu3$^--MS zAGRAC`+y?u+lQvjm}k5FJxkf6BK2}L!jW+~`&Yf0t_zv<%8wnbY8ks20ga9SLo6)qDgr8MuTn1v zIo|F}240x^V4$3To~M7p2R3GHqf+MitzwXpcNrh>MIS4-$aU~`f4=UTojGtK(Ad8z z)zQ2o60f&r7pUqsiuzaoTgdjXcZ^qe34Z2F4iP)OZq8a|qZ}1h3`{XoBj=HGtWj^|;jW_zIKJb>QoXXLntt+*vkx!gExJuRvNIQB71rP*Q4hJLx0s(;3eEoXWBPsHsyJ&NtjUJS*|LO+^Bj&l!ac|;C z(wxIN|1}xFx6>ftZE`<#%Uvn5{yBN%a>|P+BsrD_D=OI#gs5L=@AaJ$y3j6C#-Gf} zergYa9}c2+8(8{E8P=t@dqfZ6m~a92Y@hVLA5vaxYB%ep)FswUh0{#r5!bS$Q))JO zG!==SBND@+$=rpwQlo1FUFz=M+s>C)vW+*NT96nwlVRUPQ&BJt@!I~{pc)2!wL^~O z+^(%xbBXyh$Q$~{tp4-1HW~m;V?I?DvrOrnQAVjKpwM;+^d$+u1o&@Vo4V<}`65b> zzMTKg$Mb;8w>RoJy6^J^C6ydC=fhh0h-Zka;hoPFbbeXMyu@d#3A4g4nG}T_O5={w zD0%*R-J|%k90ge-lXnMHs+6`g+N_wE&;?rRs>TjY^Uxi9$!kr&H;&-ZM0Y`Jj@>lJ zu>wAbSii%#^6hJab;kGW>R;bA-P&nylV8iU8T0TEa*0=XI%L(n6=n`T-xsLyBcnJ8|dU>oamQ`B#!z6rK}``x+-*CZ-@sCBG{bOWV~KXWYls2#F;Y z6SL=Nw6O{AvtQYe;f?4K=WxrDy5rf+@L5XZKeiGA=uY|_ArOF}q~B?LM<75_JEF4Z z$xAz9cD-Cu%>l~_LcJ*lP%j=l5LV2igy@p$gTFqRPD4pLaH^f^5dJW2~%?eaFrtw$93`RbMor zTsu1*Ue>!JEj1)b94Kz`2FSQ8c)qyvV8tnXO$kQn=RlN8iq~G>{D)klnMMhwb5c3U z2jp4GB^BXs@&yY-Qz4OinLk*9gSql%EXF>MHy54vI&}y&EN-Scxd!lm#69`+hHBK- z*b_0b!4j=mEo5g*yOwm#VxcH**<}5vPzwA0=XJyv6|cVy`x)*EK<(I618qJ*!FD_N zM+By8i&jDf3Yr@6e0w+9bq)WSS@vb>j7l9*q8j@y^tn z5WO2BRg#agz8t7DB8kIo#0wDz!j3D2g^dIYE6V|nt)gk#VpgUn1`xy14tZBCWPD~% z5HraJl@4v6zv2}FeH?%#f z{8Oh|dpEacRI3Du?|V_>F{4>!0^l!Q`O(;wi2x^F?ao88%iDdShVUTIOo(|nX>epd z-f{N0(&iGS7DdL5Gy73UfG zo9RX6DhArW?T3vE{cr$<$GoX z@v(u!#iTV)n%QPVS7FbYR4M*0&ez8o?R&(4{yUL7+{cOeC2~N5?MRZEwBYT64F84M zuQ4U`_Z->_8ez1N+gS&#h5qw(mwC2p$1t8LM6jMwF8A?^jJ#RW8{ZdZg{y!Ts3#?} zecaMEzp@ZjKD4A7*a!44bBTW=ViW7TCY8f%Wg}aCz0F$VY+GLX6cjGy6J}r-+HphIK zf@uTcB(C6kxA#Bk$WZu>W7;_frCZnOTED`bWs7i0+-n0>|2<3~fLrf(2lBPgE9>j? zkk-vPNKYp@a;c~>9ru%*W&0?6_JDNy8Y zW!|{iBae_rpjD0yIZL}K$*hWM9vtX~b{;N15XiK>>cR3M>r~d_mADiDUO=bg7NPo_ zaG6c|_G{WIz2}|pC1W@RQSe7QMCcD2A^L7V1Q?yq+lmCvs#&ZTI%{BYbkTagvpQ}K zQ;L?3@;c7RJzY|tOuC_{=buR{f=hl=$upwSj*=6%e=L>(5x|y}h+X%24yh_3+epwE z&UI=P8Q%)1EzjYrp~4!Vh-0Krb0Dp9)J_iPBH#yOyoB4 zNGaCC-Umf5Je2j{)(JM>sr5OnTw%tJq~9zP?{Xkkh+Ep4dlM(~ep$?J1_uXbXHsu1 zeGsN4Ck8iwAQ?#q>}i0u+OLKyHdv7w{C*B-Jz)6J`TPOXGwcyvfJ^OMU#g_;vw+$v zR^wiRN!`hOK;*Nm=j(J_Bu&;JFCv8V(dNn3J&`xdi5HGMPWWIkY?$l)c8@l;;%#5g zQiXyV2Vs`O|Hq-vcMUM3*}l_4R{R8EFVB?mff|48PLLq2jvGWZ}f4{H|<;C4d2)M{inxcS005KkNxO-_weF1l?# z`3pngst@{^{IeTe62Cah*gQDr%XLqIIeY= zxw&!PP)P6gag)6uqE`2RXDX*|K+W$-ziZy=zx`v$>K$iOoXw^f^^3%nx6g*&%gA1R zdj()!|1M68Zd|o{m_Kzretf*=QMSsQ(ZwWndxYqzn9ffuReyEzAxKW}$~x(@9|C?7 z^-gy7`1^L~%^!sugL_85W&C0?B78L{z~JOLq!i89tEJYq&6n&f`_kEZ`S2Z9x?v$z zUkdR-F!AfRd2EW;F?=y`@zTR-=^Ala;{g+krZpDfy}qcc&6q!>^8Wah%%p?cllyp8 zbg+1I>FLEJUj^Flg2T~aUV!G%w4-RgU9o<;2V*tbAdCM z?U#LCog&)L7X-L(Ba_P}9d(cbj+?IHaCRk^eH@Wu- zrtw0kib5aR*{eg#jp7&7K=f6ty;=~H($OGL`tMnb0I&|)`9)L>U3pZlE(YpLYoqP3fy_r$NgRexwWR_suae;t9*hI!}? z!8b0JZ#}cTncQrcSSj(?6gWM)2pf7WPsJ5;XHV_zp2T>5?nr!*6jtmQF>Bm#=fxcd zZYzTcL!#}w>aQ!cv%Q48SInObH@^Z=(vQ{0O^y*wLwg%X6N^R{%YbIMsG#;_JF$Cc zV+zcsuNCpeXcjnR0@CD&>>=>zlI`D6F6`oeda4{)L;tluAh2WTLUDp@bN0I2#+d$! zb|!!6dHtns1_4b+FLf(2s9-|(D+;2Q-Dz~yLTf*1t=cQqit-(n9okkesV|bcSVqs- zVkPVEgBY)yql!Ppy~6sL}nGDp91N{O1-a`z^Ibr1a4lZ?%Y;apQj8t zVGI)1RHpne#NL*je^MmW=%!X-PMvR%9h7S_!;P38VH%T1_58m{{Ug%3QT{85%`gUy z+&$ri76Te*oC1I!WwRdnD>s1jXcXtuO(zwrhAZhkG14LB0b@hi*8NoN?ipGMbFQ#- zg^Wc?wT5-a8BgO$wfHbopJ7N#fJ4bxyzilhtU^s=|!IM+Cg?u9`!mS2M ze)VN8SvDaKpYNcTW&~BO6_H^1`hJbWC8ogMT=OYhZW++v>%(Tq$Ojg_-)Z&dVT)3c z_S&&?p7k+|g2)1Lgnr!w@y_~Z<;nAc{etXWE)N(Xn77&KTffBK|67w?t_a{iA=%g4 zUZ*)28qKQbtO}Sy645$(T`baDW8*_{1CrXN!Vf*KxVu#w1Uuo>2gJ|iE$N&R;t(3Q zZmtG0SZx73Y@eaU7aCn>ucvnXxHo5PZMegKX9HE^dp1p8r1N{+T0QHT3;7~qKRWdc z-8yNrGGzwvap>}Ev48IN!2Adu%#YQd`Ds8+PT**c1;S*HWFP)%DaVY0QnQ3$Tsn{$ zZ|f4)Dx53JJ{QRfB=;X&{TRDyjN=TqI?tGUTH4j)43SFcS}OlEZu}Z$U_8;CTN#VC zTVwq&2_GHPqvxiDVVk9{Fe3*7OSo)AKaDM#qx? z#;UiEnN=()p1SWp;rT>xM$E*jdqrXpSM)TU_jY%#gPWL`Yha*CA#-m!#Aq{j3e+do zhO6UvaWc%VJ6390@Z=P|ItDXoG!{eX-hQRyS1Ix@Yk1}XR2ewUD)b@Y;hu=d*lN7a zyvWwOJfRcz2`^iorYLVEo3O;q7gV|_vS?k`DI_`#@2raD^Xn`-AKi31Z-l8qxJxX$ zPP6G2t;0>PTC>iu9cD@Y7cdxwn8Q zTxJ`_VIeL4wpLZK;3~DKvTnPrljym*mDy%vatsyqs%gEEKz-53xBWd}bO!xhJr6|0 zBgZf)3Z>r((wmvEf3QO!A-JY~09XAV7{ADsft_M|4k>VXt8kK|zjyUsWnRFiVjwXO z%ZAzC^6zL3Qx(vQyd`!-c$vavt{9tB`K4$aT>jEohRtV!qnc(OopaO;6p3`K zDS6SO|5xwqLfVl)`229&*Sp!grK}3=+pUe~?m2DyUUxJk#i;1{#yIikD6H?u$Ef-E z0U_g)+hkWya1s8Uv;MypiD|-Y773=gjoJG6%)c*NQq&9E8Kj(Dijbgb^jSmPeSM9< zxTY0rR5t<#C?vtKC0p2%HHzGT@dcA(;CtGXvv(W+ufD6P5?5kXw@sq1qro^B)uVnf z<4-bnR`W7DfV=;zAk0M_yXSI=I)AI%|BPhy_@DYZ{~DFz;pcMy`thLEC!h@bAOBK* z?O%`mKR;%v;(O4&vn(dpeC?B||N5MCptJ{&YPbhnTUybDgX}4D0t5FcQ4C15x zbHJ|h9L(iX5kLy>uAI%EO(e4MB8TS6R`}Yu-0{%e%+jj#BrHm#w zgU|lE9FO0TgEa`bDsYM|6}jFh)Zo1FZ^H|TI4H0KHNL3-;A&Qvjb@GH+GH)nL0nGG zxwrETl?QxOtc~CSx+VU8F|W$OvsFpfT^D<2XQgsMBW-anI&UEVw?|N!_Q}pDi*+BU z)8`q;B^EbL6L7=%k;UgHq-+7L4zXJ74OUaErXz5z$W48rC(??ax%NW)y*B^`Q+lTE zit6}9vy$k@fDZjCI{PJ1NfiDr5O666vZl+##)GBurrrpm9x}u>UTlCT%aJVv~OnxV@wTquVmn9p6N<<+AVHg#d!bH zpz&!hNuj$J{NC)`xf&5X?i4Nb`3eBF=8lhk5%Y9$MG%G`qx3CLApF}|uAAHg505x5 zI2Ifo!&lAfJQ{W28EveP1h6(p$GzhmK9^2-z9Ebx9idz;^&W;8bX2fBI@a8gDB)ijhdbvf969fe_Al-3 zz83JzUB@)6Od`o_NI9C6EY!%=YdC1ugXgxTA}JcfhLIK}mYf~w_(J8x&2a8ZzAx^6 zi!hqvce^$`@o1j(mR;Uo?JAH*XW;=m&3-{U`h=)f#deX;dI!m5d!`9};jy1OftYOk8T;4><&7t;CUVD2PK zXi-vNniDinM39gA82WtGzL$QA#o5B=XD%r`hVOGqlQ;ziDMsQs6sv2l52ya95=(KSWSRwI~&J`u9eiTEvH<@0uC`o!I7h z9rWX9cUqM7$zIv>bB$Ua!_luFz1|XBawJ2Ddo_i=*1otW+-6M|ym_pAF`;&Hp_4;s z3{j=%75VV}rA1So;hAa*)-g$#XaVxASZjKe2SI@U9_wA|LBg|N_w`1RfLMp=_roGB zY>5S;OJhmyEmZ{q*L|-hjQtv!kCNCp$Z`DTe=o6nTkK;}gz3(tTPyz)w&gVJ7Sk-AWIr~aI@8o zz)e+M*JPynWJW^IuuJg6>7GZ!&uc7i2LC#&uk z+;ZxE5@CsO6(xPZf~ECu+eVv2`dgDMUwKdVebG|R+&P^+1zXGWgu(vtgB}3F&U80v zIZvkB>{8Fee5K82uaw;n#Q3%1(rSmY6v4rJ4Z_XyQY%g($R3z8H{4MPv{5Jdj;Cr=$g%1_mb4!%cVwF9eE(2vxP{XcJ>7%u0cei$(TZ|@n z2cFnBI;EMkDwKwZeV6m}n#{d^n|s^|q?zqpUA)cspjc%iZA07tCsR4Db`ZieFlJ8q z(Hf@r9kfaBLHlAh@Re&Vs94YzricIzn=S_7A;cj^1WB>5nB`B?IO z=fk_d!~rEawrAAXLVS?_m2g_%Vab-N4sOwpW1TR&PyouD54qxAdv{vrxrDk>1fWE+ zZ~yjg?6n8f>A~4+s@h>vrB_`W5H0`4D=E;H^pD~f(*DUVZ67;G6?oy43RZ+7$V-%^ zC3?6CCFlR)>^;DmTDP@r)P<-BDyWE53m{!VdJ_x1SLq_XOP3N*Q4tHEl+aP>E!2cw zlwO0hKoUS|qy(e{giyXWthIrC&iVdtpFh{SmVlUl>2S1Aeb}s<-rGb=gu6v`De4!&>As)FQosE!+syhTp=y#F}vc;=^`~!X%>k z>Ch3aGfyd9lsLFuthqx(X9WyR}HU5m(MU0Drqi565cl>h&`E89VRv&lWJ~-v|ao=l% zaD%I^CSAt!teRR3FWv5Gm@8X0fzPN_Z0ShmJy2EgBnA~YC$Qoc@!`e@P3o;z9gCNB4D`0Q$953I9klq>{2n)^KITy>GBiz^fu zoi!r&6oc!%%jcg~YgTE5)DJC_PEv?>feQ-qcM20HKZAT7C8dKd#TV>ZonJJug?JI> zyyK8KgMgZEMW0@|4%yHs62=PJii(S>)SDQXU_u<~G4LA`)UmqB&@WB+6Cc6yd6JV? zhTr{_n2#xo`)`%!h3|ZfL3A~KS;k43DLlpbVcyu%MN2G`f6$!|<~GJ2wsq3-`wMl! z3V1*r|D>cOU|^Dxk|H2hej_KxiqnYv7Hwfjt}2!B4eFrO>rgc{#ehzOHm@gx?Q`NN zc6RmzZj4pzFcYhv|3JKzo%M|?*N$Y-I5^*@3Aqwm?!0i~=b5`w`KT2~Nk0Q);s-vq zk+<)>p0*EH3vqmO7X({X0c9>sbiBKb;}=z(k=)pCnSa_D_mv$kX|ZyJH=P! z0wvQ)XCo*hZ;jrW^Cz8g#mxY8 z^d~!!bJn4y3nha%u0r+b;AYE?nHX_R5L5NtvzA{YenH53`So3j9t&?O$=Xf6wtpoC zRrj)e&QYFZuhmvR6oq0{jD6PrL$sj!^*|%2l zpI@JR*11D|TgywQqgxKSC0Thzd8f1aCd`nD zt}rw?vq)LXbg3(v_VFrHjyr7L)!UfaEr}*~IKY`z2qNy!h{4kvee9L*oJhR<40&$< za?CRWnp~1n+oZj02iCC2Yk{V?!94y(Ynr=tQ$cH!X>y8Q59f_)AgM>|+7@FOARk z6H%YDaNE*5s2%vG?JzcMH?%9@>3_I4Py8tT{Sy>B6N(?I<<0a9WAiMppjk6{>VR?(O;86TkAQ(MDWKd>>Ew=l!i7RzPyS7z8+5(YO|D+7MCS33*$s zM@ZM-s?E{+Zq*k--|h~tGIs5J4+Mk^q9MxP^*F2EZS_u{=!M5t)f|g4Ibo7@V*7hL z*;m&8SrN3#KqPSG5EIaS@Tq9u4%ka{un7c;i_$iHXuZO&vcI#DUA=OaV)cO%^X=yxwIt|Xq|g;|2i=SE5uf_P20saigSFoI zJ6E6<*G6{gyv#h?_}v$ZY~_~e!OAQnix_87zmv$^lXr)%6!teNYN}={WUqb57FN~E zDEZ1FUpZjOHD$zHqM3%J@0#@-8L4)ANKp6j)MR%st9*E}G%vBTFVSEe)C)m<3g@?T z+{cyJIjnxfd4Km;N-40s*GOqkL;#6&k%i2uL+!+)g7c=)^odn~S~hV#|M*>Vj z7haR9=Sty#hZkct-95jE6!8;u9dvrel~-inwKtiMH>C2v!9^rQ(mGq?hvPpU^?Bgp zTUM_n;!$O#EpY;ScVX%^Bg5gx1RQT@=hL*=`Yj%>3JK&@(jlH zUf;TdQJ~$88rjxFvl33|Dwu`XDhF6Pi$?(7 zq+(_y0_ymazk_><&%%(GGh#vKk!O4QrnRg?!sfCLdZl3AiS3S!M*yRf5*wQx|1diD zZV&kqqV#&&W6ige0F^p*9onkE9uXcX(Q8_o$}(^G^gE@NaEw8LfP{Ii4e?la_Sg^= zCvDYiEGf3ne;;ck3jox)0ZC&C|2hvcGA5AmS`G57fBF9Yp6>L%)ZePJD2o^Q;^OCb z<~fNe*MYV5I;niK_)}usCx2=F4Y-izu9F2@`DAW!PHw9Xm*|Zc1y!F3A3T=Lo$3;g zcz8+tG5H}j+#gjFbH%Qa900zCU+?HYxOxruD8}c_8jb`#a(7qO_n8aj^L|~{Sqb`h zopyuk#>%RB=rUtG+AuKfZM~|WYC;#!YA7S$>8`(94mSjyV>2070W9wNICdKVTQ!lk zy=bbCk~_BY%|9qUVvK-$nN8bAFbv&L)j@Ykt6Lc^jx5EpJt&RuVOv^$l4lq%pnq`s zAmi1X)YlBq*mv?TxR3P2?>sYfTdePj$~s_* z5H|5EN)2OVC_2+wqYuK&3Q^7o5CvvK?fcI-8a3);V@KyLijM_+upa@F^w7abWN`pa z143w9Jj<+`jn|6xvtCp`1bCfFtBJz`VU-vR*27*|%36Ok^5XT0^fAl3YATyF+F2Bh zvGP3p9CT=f&;8jZ!u=+ELXd~(mii5JF*}YA{v!$K1p4BR`JVMEUxZyXv{JIe1 z$2l)R9KGuDHC26!X%AKekWiuobBjYs%eY06eX6T0D%!`P(08L}GBx4m^RFbhl(}$@ zP9*lOm13WL%JO@Iuf3+EgL;DbT_R*|Ac0?chZps|4qL17(@vZsOCuMXIo^KtVdaku zpEWFNnt*00%;lzw*WE)W|4f?X3p|W`GV{uI8;#~%U*grC_L=q7jl~U@`|0cF=6;G) z+Tl_vEMxt9?6s;*LCni^m(;0omm$_8@lj4(Q9s7G;aR6VQ!)`yMJu+zdMq6)@ahyN zZYhdwz#vw44Lfe@{#P~SO5xsBvU8c0#YGhfv#F!EC$L(5mu`q(QBaJ>mGE$myoJv) z@}2M0Q?{2R+>rTooRdw8A6X*qRW)?-V1pzh+XS}Hv+smr+tRN`E$izQ4ROY{=|{J# zsGo1(q6i)vu>X!YZ5pk+iFOe7FMX$aoC*9!s`b4I%f(^2c5 z5FdOxj6Y!NjAx$zOdO2T>>-K}PlxhI+|h@6R_`|Nn(Cv{dS`1-#_~UW3{uM#qG(BD z%i!X+==0MYvm6(-y;VBs8jAW5ceOncsq@}6u1bc}MoHt`cSzPeT_WX*fF_2uR7w^T zHYMtN!_6;3AZt^;whNmwl&^^!md1UI2~VPxyWRJ2_CY`a@CZ@wW-+ymZQ~PJ{QiB^ z1SnQ*uVJkGT3f%k-;rkANY|&3>73|I*1NmpAA(wlXEbUdz@2B0V7V#GwQZVZy{)G?Gl#bK zVjL-~R9_9tD!7H6DI;Vtu7`KT5VTM>uhD4d)D^l3oMytr!3Y0EPWp%*->H!EM#A1Y zy<^aVpQ=o>e5cR@o9|C&ZI@iU`qn{0Gj{t-=bKhCU4s!|F(2e$C%Z710f4wcchrDK zhJFAQJ>@?rd0{1X0x%8>eJiqSN)Z3iV2^#aQhE1QosilK3 z)Z--S4nMxd&OKEW34se(Gn3Luh9|;|8NI(hu;A{;0F!gvStzZo-NobY93*}We)+1T zkd2^XC{8E$vgIl`vNp$kBy()&LpBQ9&YhiszoT~NY|e$OV{U!7&Bd;t(-&P-Cd*6y z`0hvs$<=XEm5L?mrzFYEc`{9aH!a!Yq=yT=H4EKzBW8_QdGiv9DLnt%34d!@i}7+0~Uy%;DR_ymy;^Wl|$~6rEsfp!D_I%dXqg;JiUs&e-7- zCt5&e;4S}~qAmX*`Xn%_?hjyT*>%oik29Thix6u^qR8#J^1bgW>Zd#OS{oQFQ)GkG z#xdus3yJGTLu*;pn4SM+-{vqtCCX8=Nd2VL-N@x{FB&v2M7w@LFH*7(yj~W^%cv_8 z&7iSRqch&R24+xCiB!D{T<&PxtLEtSnW4scvWEm8mDbe@qoSuzun&X=x!ti>S%2lt zqejNxS2TO3e`IrM@=YGNudZ8z;~SE*%ZEg`3ecf}j4V+>wcP`v*Zlic{y@G6RWcPa zDLT9=^i$MC)NSRTxmK_;L~qTDq*v_&1yn;5>@mfBHrbaoe5$3cJ-l!V`+yGrM8WI|%Of)U^n*No z+NvPMYE6q@F*Rawbc5an(puiCwo`YT11=^r@kxlyIozM`VFV;t+ zk7L#oz~+i8kU!G^=b)10Cn5~cXgHL2%TNF7>6_m-+V38yAN z%BbqHn@xqi^`9@@Kf{~pZu{b@!|$jWV?yeH!#XcLx4lCn?aYfdQ>9|PDZ+<((a^~I z$VnY*jvQ)X1GlC3kQ$PSde>B@`r3~3GFr?_!HM%eH|~pE#`6BfeCGI#RD` z<=UB-2$6w+FlFOyOegXnEB5FPX-)rp4LsKTxhp88+%bO^V(4~jj(vQqxYmFU1eE2) zA?4r1c2(S*ZM$M0z!o1C70Db&jBZFC1Zkv&_N>9**j5iafNgD?D$-{tu5`8gcFSOi zAX{G{Fq|BlSrn|p?G$AtJUpef-R@uUtsE>)iDZ!saSlbPRyGLPU8+oZ!#FLz4zERT z>9B*voPo5wTrHYTqO;ja1GDSNQ4am|YfYA5G$y-dKN*?Nm;KEF!`~10turbsvJd&8 z2VeJ9h7n)L;B$E5XL*VZ4EP9{f>H_fR9)rU_9mz=<*(b*JZY0$lpOI#aO8|xe?JAU-BZ>lKZ05jc#36R(U6ophxU=_%QX3d!suDq&!Zu`{waG`(321JyED+^LEm zM0a%dzf9C3m29clFK@nhUrF)fq{s<4D3mhwunt(^ht4Xr9_h`TT5(@aN_v}XeX+dE z105(KXSF76Fv2nMfm*w|8NfGR$}uCQ7S;)KRNmcEP65mZyC&ws-lbO((+(cuyiA|1 zia+1PcI);v0mr1?Q+^U5A1m&Jk{*qf-m0pJ7#+Vwx(QO!bDanw!N~BB&pbXl%Rg4I zhQ&)ra>jZ^C{7bR&2Lni(Go3vo~ksVf1&S~lBwezniilxKO2Fa3l~FjcfK?B7oV$5 zyjEHA*gB+G(DkI^U#a6BGMVc!q4l1kNtL6EoJ)GvCIL0eBPG+| zXfcKx$Uu4h8A|n19lbF+kEq=VqYARmv{^H~0&~;K(d&v=KW0WUNizJM7$xOpn_e@u zxgHhUaiWT)FPLY$qEFI?9_d{JXA~6|&F#Aj1n4i>!aAkb?szG-aXX)Hd--K6AN5?i za(mBu$&}f#lm3c)82b~uSwU^qkGx8kqDFLSZfVo55o6ZiI81VJy_wHbBC9LZY(dpy} zvvYgNG+bB!{Twiue2Hj~tVN8SUpahyRW_JuwIL!uw`%FazY2M`e-H2err2Cg%;%YH zx87MB-O_|?i0pKkLN-vrT*aq`0%oe*eF&9i{ZQP_4rX(CfMRj3y>>kW{Gg7N8+1q?y{Cah=}q5ne`FB{2IxPa^zgQx)emkY@lMXhB(=mrMFr;;PNm{W|Punip5_Wh4&69&z4@HRZE0e zK7bOd2G6^TU+T;JmmbFxOGgz4Qg!(=4h|cXvjf6E34U@HkHd|;bDcy@4;`is23#D! zir{deR$PW9SA5SA81}B_aqfDd!>ZW#rw6kP#Lw?Yk3eU(Tf$~G$5;X%Lj5t>u*Il^ z%^hNewCkS&7=P`CkV$PI0b*i?`BVJ*LTyP09ZzBIEZ6x{0x~jJ>^Njna}@))xU)LG z-+47IN2i}=%-249btygbpQcGe)7k@YH^%pLhd$}eOt5gfDzdS~=E6Wnpx6ZC$o~GK z$h;RZA@KWq^;^Med${b@d@>YTw$+e2b2x5cZ4R5^9gEW zza`6jouidmFRqZ@{G%?CD^pESHIa%s=ZN)Oi;kaCFCeKh<$;Rx-~ekCtBtL@rWxvoAT-h zW)ECKd;2T7kTQUAu@M$?ebQIn6G_Xi{68h_-vVL_;6vjP@s+px)2r<7vD*%zdtO-1 zqg1B)d+jkWQxQ+u7olaGz0segf8b+52dYr%8GwZH+?zyX4 zdU^`oK974nHV;rX`A(?m>1deSMkuTzb_|PI<8kwHicUnkW#=xq+iRnuNgiGrdloN( ziCey;BMdhDTRvz0Y^;Q`{$2&o8qJ#uo`VvejQPtDIjkaXnTp0WO&OP<@zB>a$?nz} z;7>LeFap--Q_&b^-DrC=S@?|Xc7b}s#G7F%pQ+Z|$zIy*;b@d|&P|u2Azrjek+Uks znr>N~z3OXoST6~uQZos2(*)4QXTh5&BV{%eX7WyV+h2PG&fn*Sb09Vt$$Kj$ojx@K zPpjT831l=+SUGG2B(-Zg`)kN1IVx~9Z0BS71;)3Or|O6D3(ekHYb}3{Z&~I96*zY- zz0UsEl>JxEz#h6urM8`V>!1zFEA8pglb>Rl`5;egT`I@s({300;3}Bx0nF=sf9l&* z`_WAMUQ16yu1(hl$A9(Ffn!iF016h4)xgH7RFBUUj*}BE8yQZUm6~O^Tv}UFYx`O) z<*x3x)@I%xW<}U+MN1pxzWg!JWitCD2@bGLhEr9CrW@HR#dFcWl&;e(=hSZIeECvV za5G{1G7+v>F4)jI5DapJ@#zQ;r(q#a987zJ=SkOgyti?++~#qK8>j% z?5E(eJS+#9dJvoOLgS+AiS@z@`gURV;nZ+=dhx^?OhbsG8EXeexf%BKmnuKOfkzKB zL4TS|@|9PYQO@^`KK1wKZ0jt2IJ}narR+35+;ts3QIF?~#%6X>`v^v;wtRct8^&gp zZ{PyAFV{7z;NZ`ZklM5<@L^^|JQx0lxUzczB+x zQm3{Z62R!9$P#~SxHjC_{w!LJc|Dn0wUEat&NifTS0FawymBEQAJ^gJdM4!h^$Wz) z4gfYr__v+q7eF4^wo&u-zaBU4I8FD_vpzOY)u$}6#6U2GqA{eQpC=x@oa=Pt>&rGo zIf-9?s0)aFg3Wc*k4RTg{%FKSrK$&neXv^z+jDIIT z^;tyGnC%>Hfge;B_{zl(I4h)*t4fH6?);5kvyaye-v}uweQz%fOy<_I=&(joePXN5 zh+=Bmq4pfxkIDsmJyZ3GC%-fucI@A&J^SWfJD3+eJ)iijU%$(YS&2SHpy&g@Gpz{C zW42AUZ0BsERe9e=1n-qFAmwmy`H`r2r_@?t4uAfUF{-su*MQduP#)gLf6~uJr8;Go zJn4x~%YPIF4A@%ipbq+W?0JHjqc1$!aA)c0{PkC^#T_dx#y@Qgix z8xNLa>|TR9MYFq{gwL_BNEvtWhtb7eLpt8&eXHhn*UsP^kR-5}93WqYK97j}(THkH zH13o+X2zY%V4c?kH2%wO%vCs#&-%oyi4T>0jts}XQ7VCym(<{gOBB^`?ag@C{Wahj zsnmP*zT#U-vDVad72_MAsO2$XIjvPu%$(iZDBf4=vURJ{gI3;`4T})dsjtgb)x4Q)pWvF+NWoi zeLN{EX(v9HdMO18I`3bqZX=Q)fk2Q12>|#5B1F5I?gH4^rE9F(B-KswxmKzqyccKR zM(KXiYBhVnd6CZY3iRXstE2{t{HIH~c3Q`bQ;;2g#YL)V0^&UB!n$9a&-bqhWaUl* zdi&Aq>nvV~2pLWe!l`Ib{Kf@A#R2%D$Q*PyNrmsTlvj5?d*4Nr>*_tbZ_-`loY}&9 z z0Qoi)5XT~a&9}-U;KU^b1F_rIuuvwg(gKNF)V>ZGt0EHz)y&l(zE$WK@W@2zVs5p+A4)^S>tc#aV*+lbC11D!fN66dGI3~i1Qc1~f^gEg z$SX3LiikR68^*MnLj`a2WP}t&Cx6O?P!F$dq8*iywWi+GId`Ag^N8lh(v&)Uiin!h z^OW($=n)H{KXff72=!ePiN8E#Izv-#37P7}5^XZt_+mAdd&n9Ma>eL1Ej%n?!}L_= z`tO7W$@b2cIga^Aq}9@k?BBv)duXkc$$Cs{f%tu z6z{$?U`=~8H|~mRB2j6CpEDwx#WOI*?{+1B-=BhJIZ1J>dhdiSJ8Xh1uF!HJgx)}; z^x3!W*)q#R4#?q8WxfRap_-!QCjC_=4r!ttkBWrM`$Q zPvMvG0RQm~6Nho-`NZbhEjGwWR?||KQDM|3Zp3e~AIc%K?gQD#$_SfjH(Vd~PEG*5 z2h0NJ@=7QB^+7uS)-RBvr~ee|`4K3lCyl1*RyZuFTSw=ydtv4+TpH*R}O(Q0|QULNwNW5d|cAoQjNzwnMuvwTOv+~%2ZvQ{Fqx*n$@6LJriaqAFxSRaAFa=gHeMu@&}%n3HFMW4um-+&Nn3 zhm$S$!wb4E*W!Qw2#=@9E|gwzdk4|4rxGF;lKWwvnzX9O-LXMwKL--;LR7~arKnTf zk7`79>%&RiW9($t{^XvXb7*&~F-XaM=O*U@l9pjM1QXQ{n*HF2hX*G50 z+1*O3%hlQT(&wW3#Bup}r|-mgnfs1C(!{5p>cfyK)2Wjjq?2*`ZfS~WGxde1Gg;+N zMD-mJvyX#s`A>u!j9CfFk&N-tdY7Ca#=7_YSb+I1C2Z9CYk>2hd709)A_VWk9CUr7 zNpJpZ0>{5b2^lLRX~>8_>Xg!CN;;`f{0lT-v^R`~d^l=1*FH<{^~P2)yEHP2&4nR~ z9$_5ib-I0C4w5NX`i<%;uMErC_aTbll)B>YgbuHvQA2$Wa|l#Lig=&S?&iD}TVzSV z^yB)QdZ;{PONZOQ|P4@Q4G%nIs{S8iRUoNgIFwlsD} zXoRn@!-W9-WLr4s{w4imE8x~lB0u0%S;Qu$+dQ0*Xo!wavd07H=-pEFpjwtxvyrvMtrCqM%Uft;2(FWIhrEXs?Nz`jcp@*9m~kFH?5 zOU$w61*Y>W!vjk(HvEDB<*|KhvMapbC2!TJ<)2vHr%}JD^u@b%mUs>{3W6qCp-S~3n4=yp#`MS5 zq|va7fTaC%EXX01bA3L;Y-h)n?*-iBjaK3xha zihTTc8vHNkr(P-9EW+5>EU&DE_w_fl1h!v@&9vhn#X%P)t=x|`o4ygX#xUz+wjd=Y zjXOL08sJ`D1)zCJo^Ev|Wo~uDJ;yfQ%kkJyTHK?K&G(W&rd2ctuq)#o6e6IzMb{eW zie~F?x9z)9r#@CCmNd(X38fDPz2y=Xtd`hARzl0StsVy5zN{~?1nE=oYj$WQFvIv5 zn~5y@Cs_%lZWyY40z!GG<)e}$12#b*OtvbG#p2XDV1>q}9Y;-dG$vlS+{)+lMj`~W zNmvW*bfcA|ibk&{^?KKwefZ|Pj|jECV1QSLXh)l?d(kjxz-7S<+Ojc!Q2$wm{UQ1V5W&hJ@0t~+jTM<)_aQ76 zWb|rk6{3okrDGb8vUwI0aC5!3_Bh*WiYWF<7XV)7*Yjyt zf^Do)z6rcHN9L5&CsE+QuizN^9qm*n@Z1#9D(ZnYVQ#!v{x0@y){Zcd;kF~e5S+;D(vCkd0ayPp z5tZU*om@WhL`D9bWB?aFY*X4^nvW?@D&HW`d#z>#{$*?lt$b#2<*2LdM0%`s^Ep`m z&OA)^k6Lm0sKfqkdNMdxy07mWSNrNNl;fB|(c+7?}Hy-VzVCG$%Lt~P#g^hzxXb;~a*nEv*0UpiZ1a?PFQ_HKmG`pc8^Z{F*w z+ChW3t?@)=!HC)j8WdPIcpXy}%-3bx|PT zxHTi9n|gR%b{#`fBc$2p+_twoGx99>@1LrFK(C)z8x|L)ET4m%O9y31Ka+TIPv_L$ zL16PYvA<*9d(Pz1;19M&vX{W;^%v`DiqD<~23-2lgor6f*ZJHUd%NQWYH53Z>*>N` z-FsvBOZUZ3>kXR*#^VjL>^Xw7srYA5U~iAtR#Hu-mf`oRb98*5#v&B99xo-ly0OCa zF00LlAtI`KNsx6yqcnx)Ev0=h-2$b~NjqMC3FO?36a5QiZ^s~gj>Z*+5L10CXlm7X zA}>e7F9|)IG3Y!~COIjYCUN!9@O^f3ucq;#QhI)5+B{{CPBC;sC(N7orRAVGGd!7! z|AKD4sav;m^D{POP`cItZOyU{F4c)Y2DQyS$u9=PyTz<7pOdp^{KSy5a}>C(jk`|L z71c+SEA$w`T{G{w+RK=8z=wLEL-(TYB#Q4gUrS04ZHn^cSte%Al-&lOvUKQ6S-7hW z#gDkK%C7s;>ia|G&YOn*9R2n+e!?j;f9+A%@#5qGXq_{nu+SWK#1{3xn@SYE-%RyDJ#BW^xBq9vLiq<CS+vua-@Pt_NV=VhtT3m~2;gc!VPZH08Np9v=xvs^`yDmh3`EsS4B;EA?yL7{}Rr5b6H=u^q>Aww$ zko$L?hbz+ZM+0}a-3YU~q)O~bX5taDOZTD45?B4!7ox5qO@!C~brtvi90Pb%+izyX zk!)Bp<4DR}N(zxdZzgQ#uKotaXrCuB(F~T2+0!;26Y|XcC}yc;SI@(VBr;nN{B*xy+5E`TOQ@IGDd5{c=$edjixIYg zX>I(sxrtf8ibF-f?ks5Cg;=to;tmLFE6%UJ;!>q)l3%?RCrO+?=hFuWf~d)PW%bqx zc{M7X8w-VW$hOXSk*WE24P#$7e=c+SEVP^x`yT0e=<`0J198s0hu>P}ZuVSZGjoJR zvuR|pjZ0gnh$*e$x%d`16u|d_)%;n_b_mePc_Et_gG2xPSt7tEbie5Qk0Ew_NzIdu z#V#$yH5yo(7}e8<-ir)#7KEg2%wk?^LSm1dO}GPM4aN`ueE}YXPlg3P-pbI(Me(Vw z6QFTsHAG&@8WrrFu(>9Zuo(*STSlXs6|lvfq1Uh-UzH}T-8k&RRQr{XvNL?ipKzg! zAFKV=eZg&Ycbj$FrsR{sN#n%I9TzCqo+pSuP9hpl#g5D|@J?)gvl1g<&mCg3xo-T7 z97^_i;3c4y!}O&_QJqZ` ze+x5*@Au7L;Gy96{KjA=z^plF&B?xsU8aJZ+!J7UE%#`Lp~z9p#4-sS)?fn< z9s%htYr8A{LkB#vx^7{Ty43aR!GD)k_VQgBK zaH6i0C{2kYo+4xN&2}8LD?6hf2uKTQqoD)Ne`_v2Gn_tEbdVR%HTH_!?MYAIqh60X zKQ#0#JQoiDE8IMyOvv=+!CFB^_I>X@{C9fV|5z(gin~^XGOk|p4BTp^{#ai8L5fS> z)bHL%nUA*ftnWQjzqL2Csg-M=Bo~r>=L>Ivk_ib6>$&xB(06J#=6~2&D;fH z>&Yii&6uN>j#|7du27=bdTnhvjFpqTRJ%VG>$-po@)?qO;|-8rHh%WmsJ!W*ew-LZ z$AU>onn7O+WAfANs%XtBu3eyX!+#9>5J#1?jR&MJnQ;F2nK5Rj?HH2$!X}$6K4)Bd z&&kG2l094Tf}akNS=&imFA?@GfbmwPmtI#}@p97;oo*$B_vw600tE1wOd_Ds5Gk*X z(tZa=um;px*Q$-)oS%?l=SO1%*Gq8M1hO}m(tWoJ(b7JJG})DUTLQ%mcwcg{T1OaP zvVLjz1<;H2*2MiW0LDu-=97R&_OD;zYU1BNw*m&z&HecwGR;h)tvDXA%bVsGa) z{7sj?)X?Cykma5-B5$>7Va~9gQz9><5R5kL9dd2Jw{V1Qys(k>lV*2*t>GL{Epntp zDr|<;_@-Irl3^G+=t%TFCwcf0DC6%qEh5RCk)gdQ-SB+rU<%D22f@-GuqKHZ2!@FW z4xQV0T0hgg)*|2Go1@#Fw|Uf5wmsdqJ&k!ImC=Fo3@)BC@1GKh+{^H9baz%TD<9iB zT$9BBQZ)UGdXaL6-hc@SC3#T^^l-XDO~-%uije9a4GZj$%jq_LL=BXQrwOQX(DqJ5 zW4Y$g0#lu=rSL2VcWo({eS01+v5@zipIe!14C_Kre!HqW;YXP0Ov#y=g%NkXBy^?z zn(z&8`d)j#$w7``D+LFrDxniSAeuIvRbrDL!;VN@nRxRfg+;TvCta#}5>*9PHv5#p zJjyK}D#-zrc_T=_{@nk`Mv<|!r&5yNf*5Hd6slJ;LV}nfvjYX*)RGu zS-13`3PGdzqEeDl69zF(P%z%BbwFQaRmyaX$AIZjwS+EqYv^n=k>FOB+9{hK_Pd`n zXWLeGX0p#+zR!yp3Kl1&B;Oe}F~7CkglaEUe7)oWYXbNo{-Na?7LXQ&Do=T+#69fv za1p1?@p5!_2P;PfSD2IdloKiov_-%y^w}Oc0+&yY5^)}hjL++P2j>q^kzP=x(N}CJ zC;F`p-6FgfHX&BrfBVeSgK@hQS7@<3ZqSbqF^#YZlbq#E@mtI zJA%xhs-mMP3knQsQd}u44iK0~zLcAG&4^qON$x1b-4a_HHxTn%q4MdB7g%63fSE=h zvd*Y&SBNN&I=EmXi}}H}879RZh99~%D^rs4|1<@AAuL+4Z(K%AKPcFi-k)#2VAO$st5s7FT&cb)PWx&2ec^ZG9F~& zDN0Kzb_;g6RWJfOr4{DC98)56?w^tnM216WdT%AYfcps8Xi>wt*W)flT%djI>Co6Y zn2T(o<$d{(FI3`4QDM|9K2pTmYEZJ7`l1l!Ht>+zCTN7yP16H=aUjF|vN(Io&sB?? z#6MiJwP=WAN1W8)w@NRsa1#N{;8|~45b@VInSGpzbgxaRV9LHygA<>EKL~D&do|wG z-fnN9ORN&$)va_?#Nqg3m}qkT+RY|5!7jjUByLX6MR-|;`EA!=SA5+SqkgGauH8hUQ5($pNY|9vA`?2<+$pb36LrRzN76Ezsg`uB%`RkX_de9bxGUS z2ZB=A-#?D&PKYC13t?SBgI9Xc0XogN#P(PQ(qJHu>|z4oXhzoNy_>cVPjk-~3&`4xHk9 zZMJ+Z0&gXbk9YD@G4-Di5*v4(bG+j>|JlqblNS_xML5`i?PuQo7XpQ{#-t#342Q*X zPaVlF{8=^4=2~fuENpYjsbHyg%Gn-l|CL?1)o9#g01g@_HS;GvKgIuW{A$V_x&UYp2}xpT2+iV zZqW(lh1Xk(jE19QC3w)AqXTp}?W7r&D^wD8W}|CfBV z``Y9F_W_+qB%dzex?UaY2do%f!TK}g$Wv1|N@CTDslsQ{`9C7TYlPXEaATXpVMn-{ zfi3!86oR~8T7-U(Jj&}fwYra?*oZu{?T8EhjqlFU67MR`kR*EL))EPFqhUwiD1)E& z^+|=H@AM9Zd(U2zMoQW4u5hmwUNKM(rM?wp<0^ zIp6Doj1O$;`&0TEj8t)S$C8|0{d7p+at^72720m<)KS!6?vBZ0X|`-cAzpi0`F^(E zBGIv@(C~;63Inmpy^!fbmxOB>ApXwMn4pwe2nxn3DWR)BryU8EjG;l}88>EnE z&L=C3V?!^w8`O^YH{EcF&OZJv9TA-ks8i?#uoRGYL~T+;~41*=L4PR#H|zW)lH=koA`a z?YGxfhO>o{W{D*AQqR~4yGTy&t?n#eG^kFsNEDIFxl=@j6XZ zQINg`x7%i>PgN{ve=%5aPe|=^Q*GWA!FniDn?X5^fN~T!m|cJx?8cU>i{kg{?-;+} zCj%SwTkKiN0Ndh%S+EpsQXoq|afZDzS>!vhbCkMLy~3-;LOReKKtu*`{a@}qgA;$? z2z!Zc!I4}K&{f@gV(?2-@f=mhp+QO_9zJUU)U7lg2Gh%#kAc84l_pG=S#nQkCp;o- z#MCDX&c;81Rdz1}`fxRNP)>D|0W~Z0tcBq{5tyz*GTX;mJlUi*QL^jvn zqUdpH$~$vW`3@YvO3;e9WaYV)GBp4iN!07FEN(U$T&{b65C%T-RtEA1+;P_p_PbGp z@Q>?a-kO1dVfykjFDfdkRy?M(GjFFHSj`Djtw@NeS-|X!#b(g}WPO+;LoKlfHR?OZ z>qF?*ClE{vp_+Yy@}8pa^o=n`5TM;7MmYl{xD^(ZpwS_X3j+VW&N40i-*lMK=F_B9 z@gRNf`XrM(;UfiT6}f*qD}j}Qwa$#_5ZGx9v`Wl_u_<~36sl?REO*4g%3VoA`mNDT zqri6>AeoF&1jQdi4ryEfO!Z3gAiG>3vFFp*OFeYnWOsD_7Zwt~#yEzLUt&EazFhFzY( z+14(3uYvzd-%jT@sr48sui6~WpKW&!+;xKZ%mu9zrbdYk;0KB6CE*|Y`r;J!ns6z` z5euc9npb>43rY99z=i5{Q;5&9dol`|?7JCLlj}JOS#QnK&R8Xsj`%8@LI}DLCNPRv z{WFHJi$eP!Q+%NoL7xmjcqXwWGOp)$MHE*X&IS+$D@8h0AIWpJY*@K_Zd6sk zkDYHyB-5aLAZJ^Nc|IYcw|bC&{hQA$vwBS?eJ(g~%iLtyDW{@F-))w-IJem_R$o!G zHI4Gv-suP0fzt%?vffq?3F=#vouhH1WozqYYGNO>h@I4cL*Sci5ok38VhvF0{>N3+ z$w|p{#*(WN)apBKT7y;#!rwjF%00RoP(8tE+mgnL7XfcaZK_(s1X$sd^U*8%8aS7) zZbzRpv2%k5@BYGjvlj~zZw4@=9QZo+u-5-GHLPxi)!^X`XTO;6kdrt=>G-)vKB(0B z{OjYXQ;OqC(1y->)r1%wBRhFbx7bLPa-WKj7Z0a&4NMaHa5-yRAF@|U%d(l1-wRMO z-TYIeJiC&WYj2m)XhjNg7>yM0W%rnGgQUuJ8UX>DSc&mc_huK#Uk5&gdAWaKDN?Iu zA~WZ_qEwxn#ij%V8=1B?u2o1cxy$6trG)Kz)Nl40jrR3xw`v*~!!1YX-uk(j6XnLK z0p>eeqElHIC41d@`K9Pkg;1=$Yejh*u&TNhbhfU(Ezg}C{y((6c_5T;_dl+^h!#;1 z6%m7!eaRA)Vk}|oYxaGekzGnkp{$Kv80*-_z6;sLIy1}|vS-E;vX13@>-{|G{ds=> z{_a0CbkB8P_qCmKUgverxogzcddE&tS@;hB(?5XoA?*9U7PkxOn7-ICe^t1-M`7lV#becvA& z-IZTZPexl(KU#Upx@lVxqW8r5;F)k=?H zr=@^;r0vW3sxR?z#U9bog&vUdpyR}2izmW|5*-F^Jv{bAOYXD?_AK?8^KwVO&Zyok z%c$&G+7jFs5{&bYc)UVk@Pk_=dG75bjjcX;vN^eQxIA^9p8lGe-Ib7pito=%oPoTK zhsJO0MXkYYZmWtftj#8@zai9Y7)gpal#3cC6%+bNSU#hVc_wkaeTAyh$(Rt8%(#AQ zp}hS3J66o)@Qv{w*3ibPKIio-P%x1cKHsBR!;IIZxKx$A6JziBpDW6Fp?y z@Rb00AmMOMsHnPuRD^}ccgUhu1EHMm{*G+BWSu&2wmr=-$buAY!1F)M!VUcGfuo+PO@;~3}Wq1zKUj5D+l zoTWW62r1SyR_wcD+$T+#EnP?6zII02Udd>v*GB)6n@qlrYq-SBwYE&YM|7766TZ@8 zo)P$gamRSKl&(D%Z_uW6gxiN2Y^u~WEPui)M$c6>c%VLE`CFI^gD?L!@8;k$Sc)PS zEH7kHJBaCpzrf_I-2lv^Zt&fL1B9hKZaM$gR`)tjJ;YlkMC$t5Sn}txON&coUiFWe zcGnVXMWcO;dG@3ZMW~K7z}?rhw6t7^QAsW)By>2BdTTsFm%>X2EE8kOu;LD_jwMDV z(t_PqiOr=Pv-O(VmG9rNukK!0%W8TleS2qcI9I2?3SEkeP;A}CkhN^$W6v~Cv*zaC zP2jO24L%&>#KgSIb;l1rvsiIv#%bd=rY?xeVzWcZw<{kelC zmcf^C#95~WHy>tPWTtGd9S=>4I|{qn4fF2^_fSp+ZTOWk_&Xy_YtjNuw7J(tuY359 zNsx2P#VA#FXE0jX{RKtv4|2 z72Erfa5W{7-eTB>CTHG{(pLhXP`+fvAm#frV#5w1*Sn-1>uFRcUI}3-ZKpjM+8P=(2Gk+Ba27ZZE_n!CeS>L`&7`g+ZH4i<|~=vXx4= zShrp*Ze*>_9q(wxD%g$4=C%9$uwSRSGI( zwNpI15Xx{8Jk zOg(4Zx-Wx4mUBz0FGE@h_a`7dK#peLHO* z8GEKbvS%tdF|VgA+LKOTyyac<>YJgCutd2k;rM(WdN2qfzSJ{QfW14al(kOLnA@Oz z4_(;sYU9580tpE<9!q5&DKv)9ve7>t$t%$EGWa9%QXc#k*q=d8FjRRY5Uj{YaIkE( z$xIXxj4vbP5d;{fEUo561kHRMQMv`)aXpqC8rSl#Qh&_|>xgeCSzYnmOBuS}x7T$o z!I%1k4~ax=Cj@yau=tjh?$pSffF#DL$(iQ!Ei&te_V%x|+?VoiUM%-B3f4 zxeK2&>O56Fvla5J?BRCl8_GeG;y9R*kiRsu8#H8O%mC(e5! zz18y+wNzFSZjTsTdDOZ^&)IwzFkHBU{^XXh@)8wr$L*Yei`ebA5t5;%pB@@mRtCDj9U~{kqPC@SSh$jX`ios78Dv44n zGt9QR4Tpko5U>#oFGVPfILEp}PRw!nn}geR>b+_W44ywpm6eq?j%}J&Y}F;KdEU$% zC0x?|S!^q=kx3VnS110Sp%cC?=(67|KH!J=<%|H5)CfZ=R=uZt@;(*R10&Vv94owc zSKpzUoTA))lthfP(Yi<}vQ=WXRz6{T0xt2L$XPoK`xMBMgH@I-8t;wAVSBW_zU zHH$;iiyROfD#*1vGh%i2HE*&HV#Uc`+0&m% zc(l?rH}^n3`6}x(X;>h`C>q2KTBXnpPid5&FLSCsF(ejSfrbl;q_?CaVYjN-ME;mlWP|Nr^KWED@a{w7D_3)R+PnCtCha|R)=Ormu9+wcUlMI4TB@=i$wArVYJ*e`u~o^cQBCOT*p3b zylXHjakpI4c%f?y`R)7X*8Zn00vwau?%MA@Xg6racAja0^1a|f7ku0E6D<@?PwWHD z-tIn*D;_{t9(|p-Ta_`Br&V5)XQ+%J8)W}bA?JKBYKgE3rG0#9Zc(dzjGvqwQOrPM z61O1l2+SJh++fWq)jjn-=+b-Cvcn06oZ^8iGbc5lpA&nThpKim49un>S0+t!A^7S< zrWs%AS9^n&Brc=JACpaG#jj7cOq{9h$=isd zRC?6FuV!}ZCBw_i)t^BNx2|&auP!zP~&u2(KvY=oZmeTzP^XL~=+(4s&XMUjaj8 z_%Wqr}Eix3vsB`B7`(bVK zc5+dfeN9#JtLK1Gt@Nnlq^%}b*dab8I|-n%jE@x4`Uipo3y4fh9={7o;1x=(eeBc~(#$a5fMJ$!V8h86y z1brAhEp9SOa(N&y6^ zEuSMn+izT(oXv7d#SB3BjC^O!w3*L~67g$(LN!l)*B>CwwC=`QZltbo?bJOmI@4lhe58psOuFXT@R_Uo(8F^LpD8+nyx#n{hh< zA(vIMJxNV9ekhyHonaP*=6tK5r;B|H7Ob!2D31JsiB|USYZP)wKl|9mlJQ5ax(n7R zk%^-^6m0Z zL@#yuo|zt@FX{P+>HECy}IE}jNYb7A8}Z{$brCX#5*}=-70HgnuX%aVI?Bfj4ToLMui*tox z7{o#_k>SzQNlnM{S>3#X98K$`2jy|m?Tb1+N=1VoDq8~q^j+2dJ;etb(XY$)l4peZ zevzR=(5{HtV40zw{>)7-^RP+sXL_BIHoo|>{#s#hCq8QySsEZ9=o(iT<*_-%%BQv0 zx9G31+^gr>qwMNti8ml$e!{Ym8BxGP5yJ|ad6cwL?kDTj*9i)wem}$F_q}ic*KLeB z>JHV-61k*s<&V{6VhV(YYj{p>^1!@*=_|~OEDzE=BAAVNqaDM;WbDeFIK%LKdx@C~ zu%F5GPUXkK!9xyHsjrEPzCQ^t@AcdKc!x$POmF{Jj!cZEKq7X?q&$bub;j5~ew*Sw z%g7?wCUT@Y9XgV85yp9G76OW73CT6b_v%^Xeu1>r1Jn0izzfrGKcRb!rSH2Ap00Hb zIBuu>z8AIODm`rIpLZpUondJ0l5)WfVebhEafA~o!qpF21WVGE1*d-ljDsyVLjpdWd1*qjc)?El? zxdfG29;^*b-Wt&~~c#CZ94;UF+P_PMb(eDbp!#w&RiGKuqeEOM#F zDY?Y3`$#jxmwvTtra=7LKUY8yAepliHcTwNuwNYP!DeQ!Lfk1l)J@QHUX(}01WGl- zyR&+2?c(_!_Vk53t|l5s9MCQ+?sj))bzW)hgCZ(NACON+gYL&xdr89rItc}FtB|(i zlWebMq%A1cqTW7<-lDO_#F?Z^_Di8=mOD!8goBYzDmO&mV{==Y+u0bnw-0lye{Wz{ zwEBgb^HMCcW4q~5paT17hnx*(x;Zg2`}rvWk?Zb@y2Hm+WpQ4s6}Cv&82+tu$eC`P z+3quY)Ax2k*i5~GHax$^3nyJjJhe69#WI=b<6KA4dI+EGkT%NbfpF7$j&^XJCW>Q8 zA&;t(Uph>J*1q9y3X<`yWY3EE<=ojlu^uHa^c7DLa>~{H6Ew}9wmaMFuN}XgB;~m{ zd@E0|n4nMId|e&oRHtT8dDkG@?2p?i#kEd8m@cFHI;?df9M9uO>Es_SprRTiZ7xqP z_V??SScdLatrqOH`qgf|ms+<=jfr8TJ$H`K87>3(kx!nSx1i!ON8Cg4l=E3*%BDFH ze3p9FcJ0Rl$kbOwvR(I8;`v9)EIJuC64UStZl3!_e-6BW=B^jNc2;``otKS$is)D* z%nQ=w4tz5K_^+&m&CZDJu~1x+=LMivac-%)fz;v5Q)wP>0)ZQuZlPvjx9Q4j5TcHG zigGTm$N#f7sHhmv9Yjh}QDNQ_ZwkK3%cd)*U_aK9z{19V%l3wef3k+ANVH3lbQGW! z2GepbEkH2Uf7{WyauDD{Mb*V$_DDLp$Hsv$eJPlL%&xV90XIj#nfS}k$9wH}xCm8F z8Ehk}f0FRfrNU=5=wEm6{=P%@#8E0=Hd9W~-#Z2*rQj3W$S)2ltu; zrHVBG8ObjRCzYs+5C?{{hJC^JYpmZbfsFD4Jp zzilp#+1rvC=3D!Ana8$$$asiv7e5I*7BGD~TT0Xc_nMMls#vbijV>iWa_O8F|L%Fn zAz-BbXLZay|1vo>40BEmxvYBI-vcc9cSM;xZphIpA{uphQ+RW zS|%rG<@LCIE$bTYnI*7U;nLUL#mF6Dx-V@DM2*4vu4TFQ$xNCq$x@+A8}pk}PH@WK z{Y>=B^!6Q&+3w??kMW~$RI~W6$jqP$3?@pQ419YXM`5&rOlXSy{BvY(uF|-(W?$cy zEh?1Mpw?uhc$TGblj;DJ6#mY~TeRxREkS1D)=W;IjKzVX7>xGTMUx8PCnvcSNx zFw3DjWC7&_0K3`e`yyPAnv>Tno!mZ4$I@w3HkLe>v`xn9Ci6L-{zd~smY|Iie9sA( z*6In9q;Yo_g{5LcO@r$~M(tEfr1q!V%J1%2tv2~^ zqiU3~i%A^>52vh^g&YqZ5BJYhy5msG0+;6$<+%860n;@5pLvD+qk9yrMO!)(#@K0Z zQ(yFklm39fMgtug!xWOcAl(D$tiY`ph;$sQYOeZG<9)YI`N+mVYp7BkKAE!BhVv5Z zJT5XDw$wNu+NXTN_&m+V+L=FZ-2g~e<>?WR-8dq;`Uj|bZq3}!n`gSzSjw*aduu3+ zGLt4#N}vx;LJ`ho8r>l<6=>`hrAM^yFurdY92?73xjk$7)H;hlT~@o)nk(PixofZa zXHnx!SaZe~!<7@;Q;em8XQav7X5u)YI$pi8V_i>FjRse5#`Il!d)vX|yH$e>9F4)$ zUs;`B8QGz{Z3|{*bO2xzZJa#f7Rh{4fYL=%b+#iV90El>RajyisDhQk zlnK+K*WhnU1< znr>9axDzd4>ys@J#RHvoQ`k8We#5#CuCd|y*Y27oaV(DhiU%92< z9|VGN9jV{h+rbiv$S3A%W@a`SkwpmsI>zm41_R8rJiW0`n}#1W{2EGO!=fw;YW0bq z-kwB~Ra&=^$PcgI$Qjx$Cg>`jTM~Lu-{k5coAz~{q}z%oZsa_)d_qkmowVh2ACvFC zn5mmf+?dhY?zk|7DDZ+5CHZjPri!XH(s+k-pUw>clrh@tdHmmlC6r zT;lR92KpW2;n27?(DV< zAG6HIS;kSY?_k6s_h)lay$3XyxQ?zl-D+-Myp7SL3f*$gB~{&IIBX?qz{nqM<5bb@ zy@WCwfO)S@b64{r9f=WVf{6veZh(i`#%oX{2Cc|(WU0TK2jhwZG8S7D5(mn zd8*h(j8-e*joT)BxkX@r{3%y@7w$*ZBX->S_xP(5`3)qV#VUq^m=@JzJ$xO>Bx)WB zy`9bMEK$S}&yq&Y?W3NQ9w`d|*Uf4=vC%BLv}^s{_o2pVduDAfkVjRIuioq^E=-Cx z%Ml}_Vfy@m@TN5Xrdy>>-1?TPt*XMhcSXV6#k@bS+W-e-`)}{8CE|RojOYbzMNrNi zW7*WYn;aJ%pLbe}o?Bzdx_{RsY+BhHKU^@S^KkmM6coS~wSuejJA@LD`Zx=E7h9iC z6;Uj&X^tQGTy@yv`9EDzH|DxwtgXZ0>JqIK3bH4L%Vw#{13i}b1eKAazC^<$vLgMZ z@_3oe{X{Li?J3b}GA})WFh%APv6!}GaW79U4|TEwpWqpsCWR<=Fz8KC4Ay}6h@q@r zA7C_&cYWW0BuYi&mbeS#4oL_BkAO%rWeZD7tmE7-?&|LBv$M6LkSTEdQ%MJ`jg4L6 zfaSah87SB};DZ$h#Ot0CG`jk;n1JyuQ_XSNWcr_^c?d6j_t=KJM7DXJajj!xr6*ig zYq1DK+pMdukn9>O0rd=>d)+W?q>$X-_a;V85Hoocb{_p>K9n0SsnVYQe79ER^u2rO zYBv%te_K^(6_}i3SR&7>T5go<`8}#h!!qdP-J1{B-MCSb2u)SH_g#R%aN(9Ys05nhzn@aIdePo*tD2qZS_!t= zPOh z4mbidbX0!S1;@CsWvOEfoaT>+nwJL1iGFK;r3^@dd*0azfXh)=pD7+H|IH{1Og}dJ zrN<)dz3|>*>UPK|#lO z6k*<`JW*ny6wDxIwcC|_HB*D1I6S^zlgp+!HJGT1Ma*5 zXGD&^A4mDoy|?S$HYhKI!uPjeWB;>wGh|Np>Gm#C{|G3s53H&sG zV@+5o%Sl5s4WcS+i=d}%hbs?)F~ese-)xg%(6EFKJ7!#uaTU7W&kUhB^3p5hD6VI&C`GF_;XLz@W?}i46@$;DrtiSev1dDxwlP06xV~#>YwM(CD_(>s z{Bjoiu5ufn?MMG6UPe$$^M+s>Swlk4>@yE^u$t7`&RWuxZLk}wr!S)TzYa7}f4lsu zMfSM3GcB7wD-5M&U}zEdLN^~j;}Bw*oBxtI%!#Mci90Bj&AYyA0n~L4Qbi1;UVv<; zTz=ptZ!L}^mGCq>U>le9p+O~2yFt~XAJ-8j18?FKT|9S-^elI9i`ch+*irk1+kfmXSpw({x(ZiuQ15IXICwq=@U2T9nU8GX8i1a zhS3M!RQ8q*I>-&l1>2x;l&w49B($E+){FE-kc=uinf3#Yrhb(3^<`pW>Q`ekB{F+N zvf0*!Tk8SXM@PHYw4iB@yWV6=&U?7p$F*TiPKbud>Vphq&w%HIpDT5CduaGhJ(nmzV`;2!GD`2DrfStiW3LELUg*t^=E z3R|uy?Gd@~&On(B^r}YQe*8JDz9q}8?ZY%z?}_eGtQCHPr=dCx}~Ph6x3G zI^ZI6_4ahAf4>b!?LGc42+CUoBc436A&v~Z8_gmMDs$p^$t0>7MJ#w|Vw1EWu*=^! z2EIO9nY2|7tPr@L7$0+&BFUMZ8Uc~G)0*H=i%khg%8j8IELGrk3>cXsyQIZ83R9Ng ztB?!Nb1e)&B0X+uOPfqB+e=U>%JBUjb>SYKKj%k4$bp-LV6Agg^a^&^UumuJu75e( zD>Ejg+YFsiOymJW4guRE8qvJBFX13=T={@Rzvv>#fE1{V4q4O`Ij6moLoXba)Tx!9 z>kPtmxuX)}oXYUei*bFqIs$-vc*{m4lGZ5}yBd|CCHBGzj^w_`#R*L8r_+bKm}(Hn zmkg*?_ISrRcqD8URBZuj81BSY>1KK^36g7P{1#c9055q7)(SAj0DhPelS*wBGD#df zt-bNx&!X7TBBuU{%H4yCQGk^~-yUH;^fF^}uX#m4fr{#Nx^dm-Lr z!(}932kz=6i*_2Tw@*D|k#epFTtaCEoM%N5&s)YHH%nVdV9bclzsXIN{?4nKEz8j4ZNa18E25BCXB>d2@^X1`|FYq{kzxi?iFh5*jcxQ-RtuMkcdSz+yL z*@Vjtpp3giS`z22gg7r*f$HHuwYQQipzHcLR&L*g>4JgdE$d40BYr(+zFyr*tx%t- zKBcAL+T^KQTU45$F%xclld>7REwK*j;H&ZhPKC1Z$Xb$$ouQKx%=Zg`6~MW*c0Uz$6}dv!*Lk#_VM+nZ zGDGQC+lOdz71urQ@8QjY+0S?(DfVH;;K?QSKPM9K zff@ihm8X;UrRVQNiwX*w)h9_W)Fesx;ytCH9ez@CwMp(qwQHlWQNR6hnZ1(TkP}f% zkYD+Uo&&9D{S4a9QP`m|kyPb-$)s^P!)z=ff;F`N5#`|l=gaTP9 zx@%%4_0ro}tECD*t((0EUBji0>cTO0%sW|6b33{)>t#`k?kaRqw4DHO>LO z|I-jqZ}+b|0pR&}LsX0iAx#Lusr}Kzw^8a&Uuk~A?vV)W`H07i2yEzX6vDRkk(V0@G1%w^mEub zu8U_uLlc@eR`q)IF27TK?`8hq&QMWl{T`qx6TBv`_W;mC73(Jq9FzRR%DsvU%cMaVb|l$2+|jE8F~#oxcJC z7dTH_jk;&0S;ann%qc8BSNiFbAs#be>ZGTLC?25_o{C{dDE*m=2KaA}$$P%xG}Er2&&a zNhWr<9==}TwXOdM3y+*9BkQro#m3>+WgP48pbGqV$zDKI715)i!(%+?GKt1`Gmt_j zi^S&Xn$<7vg)il#BIeDyH=60l6h!AK)OI@)qKVbVJ z_9`WkNq>|6PN8LGQtL)Duo*o#_{${{-W5aV<1~Hja!cw!15BsO?1G^m@!@@EV>+Qi zb;+84uL{uNsxZkG;ytVVy`#aEwm6mbFE0rd0(^ohMLgpRX=Q8vR~7$#Qa*2!W|CXE zU_1a;E_!E%z(4(^Y<|(KZ$ zX@T?Q(uq87N#6q~Tcs19QUZf0ZSNNn3x+CRHNFK6VIaQylNUUgJ?G#Wj%cBplRyOq^0Bpenmt-U+WS|kv<{k%cNMr zEuqbJFTGCf#_gY4k2^@={3*R^a-IrBVdCa2X*_zQ(^x+X^mXbey5;HI4GAVpILTAv z7d8W$TQ|{t_I}NS#+N6+2Fh&=Ha6OnH!Mu79`x?4g&UZS87n!~oNtzLE zp07`>1@9ww1Nk2HNJ&fQ(Jr(!d7ohF+kf#D?=M!r?wyJfs=u}gu?1w z^rence#P>eDNZWgj_69_ze@I4FTb@dV&lk(P8h@YNc#Kp&hDW1YOzPaDd^l6+6J|_ zzAQgYG>!f!kgaarj{SHV`-*@IEU28C=M%~i*bGHxTJeMVbXJCK`A{e0;hlPS|1xkqNkBeEEQa>F)ZKPJehr(Ol(jexSKQ%h4)7bM>}~XAZPwGsheC7(Q6aLnqHktJieI zVG2wa`qNSVg~C=#-?dt9*Q$+Fz(x{{dl1vYaw6`38NYqayX|19Z% zoC85+@(h|Y2A+lU_JyPqiUGnX_a#<{?XP@$;Zpp7bN`Q*T~WEXXsHjzu}0Ip9AUQ- zgTy;nnhVz84-LY)wj@z5zU`Odn*Fm!?sP$xph7vQI6M|ULcgA659 z>AJx#o}Tae?bnPH(zc(STN1a^iLUs71>bcvkG=eX8Ta!I?8GUi3nB4X_xt&q4FPPQ z-m*2O1Ok${nxS8jWIe#K_&fs?Qu+h zfBrfxbE#f6z?}T8(m01ifrm@?^K5Iyu_33dpSfpXh1p!_hA?%z{{i`%$b!IaOqxnwJiH5lU zc-YNAyWs+OJa|kUgmlER#jVpgA?GS>!@D6|nuPMmmb$eWFqs9H@HhQ!d z9e)L2IxmuH!yd1tDgIU?8He4~Rjc2lUSO4+*YY$99|rK2D6<>(b7nf~pNL+VI7RFw z7|@LFpZwnkcO4vN{m!IN+K!|j0{} zDkr9|^+wEzom~EYZi{O0D|-JN;|;k26*mU-T2EcN`qr-Qi}`Z3$G3Oh(1X1Y`;a*~ z&Z?;=GqR;eSSm&GGTSu9D>UE3N`PhT0#-JgCNYesI5m)tS9714*dy?_{`~njM}fim zM``u}@ll|g2(Hw~fUT1mC241WDy(<5e~pflz!Y?WQ{*KXSfJ%k9w9BP`o3w#3$~pB z67t^5rP0O4103+Gqc>?;TyVl4j4$xF&m@kKtQOZYA2*{bCA~4^H`tKuB?%^6xEDs$ zffV(|!(Po>>3v}1+mjP6Et#3Z3uOnJsFBe^Ku5~B4=e6jp=DvYbFFSb;!XTa9BW}r zVv7=9z=l7Fz4FL?^8MwvfeVu9bRO|ALb_(8V7jpgGdg>oEvq+J+`+|a& z{LQuxoxdp}2Sg1W%`bquoamUvZ@$)uN88&uU01W_GWC7FHn9>=3z3JO16?I|Cyjjw^>9o^U1L)J zQUbsi`tFsr%4dEr-M(9`ZNVtB=93QAPTJK3k@=xiQxDGGu%rvhk6)qVk2c18SRi&r zic$^v`1ovX#!|Vx69=oHYSlI1;X?X`l5(3Ov{^q4TXd?xL)xjrL^G0I3cg3Hzsqxf z|Aj*M;|bB+?orG9M|1wi{^v!lAE%j~7|B+bq-^j+B)@U%5(Uy6UF^)Y#t!F-d)_TE zl*rccFOYC67tUj--Mz;VX%ot@@NjpB_)1I0j8rZW=i#+9Vz#JRw3@vt!GsOJSVIcj z7;y{V#XC1+E`vyu7?$s^Imm3e6j4zU%T zh@*Nw>g+T37n$P4_r9h3&Ib+J8d{AQWMUe{XGL+B!*hJjF=prUJ z1pZ-K{r7h&s(%Pa0Vk#)^yYDfLP!6y8L6fZ1Zs*RI6kDMp)~vOJ8DwD?b7$(59n)u zne8U2zX?t{H;fn_AW#q4?;0Ma7Pu=jmMS0I&)717zMeac@jTe9>;$6vj-|E|=LozBA*MZ6Q{X;R3U)2nlt;LIK zdQyLrjv97mj!&Rv_I)<~1$j^bzz&cBfJf&1>;{DxemFD-pLC>as9kbL{+(o(ir4P{ zd+7gs7k!?;_E$vpajKSO-=m!mDrch(s9JwrCXfDaE(V?dslKiCyZZKDU-}PZ@Yi4d ze{F`Z=*6upfW3Hv-NoauV*0_;Qy5XFCJ>V$$Mr8=`wY{Lx+jI)lzsTX&YOO3MepvF zKG~YUUG2OII=XOz(q!`~q(`@--myigJc;_t;bI$7VkRtq4DH`9!&HEf9dW<^#e{OQ zQa67Ed_JevkQsK?uEvD2yllEK)a$6NASo!X{s2jyD~y!@)XSwf!Y^4J$u6n+tItaD z=#y!2BNm3_O*)hY?YY0khpORd7U;Yv%k{$CCX~|^Ee_oZ0~RUvxPL;s~jrBl}0&4&*<*{S$*HVpaStrVK;#AE7 z9@WejD_WN(0H_OOh|oFh&dqY8NtH@T-Vi|B`|Glf$~f~? zxtgIxPh`lHN07zN$BxgXqJnJ!?Vf~vASB=kZVU5tP>*D<9-Qn#!<%1^*N_}oNLP!> zI)|;ywZk=P?R|prZvD@Z`jc=6SY_M%knmi-o1T!)7A!ixpJ-~AFi-AeZ8M1Xu$h!> zii>|IcvHeoW=X;$bjl#Jr2Z;1eby>ym?1LzyN5-}6O*EtWl&rC4PJsZ(D&)5X$iG!BW`720WG>K zEVL4hY^;%u7Ze%pHRA435x1!fD`TU_WAE-IVH={?$(ygjg;Y7D|Lz`DCq6<2ZmUYT z8pb7EtMe&q{t{A(J?KdOwZ?d2%1{NXkNMoB9#B>??y_a)H?Wkgrv#jyw-X)$!=)%* z9<#$>8|^bHD-qFr=e1XEpeoamU7r7%s1&dF^l$BmIWN%eiEW&2hykJ0ignltJMNa4 zGmua_g%`5RTXdhYt+8oPi}(Gg4n7maa<)}s5Qj#7!Em<1>XfEq^fs9c$L9}R`#Ao3+2&PYE&@VFef}5?k8Jo6!Geb50h)uS1-e=A38h|fQDI3qd)5z zL{I+fXrrRBd723p)+?v08i-VEK9#Hd6}~$;Z0pA8&4gWtp-PW4WM`WXQv;@6zTSt! zNX3KxS(=`j@R3g5wX`wMyp0)nin*A&lGDu+f2}V+DXdE>E4PvbgmdzrW+M{?0snx_LH>A;urP@We@{&2mt48);dyEJDmJPCQe<0d7U5g~s6UkfVh zW2~>BZUw|ByMq3<%1{9JezaD|Xl3xT3QjAtgWBE5U*YIWnShADb&4r3|f+#ZHW_81}BF*xnc@VJas z-?KRwO)5mcb}IP|s?oq|e6x)mEe!khEuL8Vx$9T1>h0CGA@$BpNyOT>S7_fQ-SUS2 z(_Nmp_PR>biWB+gXRltzhS4tAI@vsXPt3ERZ)MtOa*hnqj(_78dhTGsj+p6pd)1p( zJnYSf=1xQotBnA-rIzu`qTTwUb@kWL95tgX^zpsXxjXn z3tJ_GS7P@tGP2EmA zs4&6}!pQ&XN5hQ87%-c$iW&U{^?OxP!K9YU#(4nXiQ7AG6;i>*$2=dP*RJTh{8mpy zN8f$E-`ppc)LE!(cVoy=H4`uB3Vvn@faU+a0v@gQEAh|CU*G;np`)6apd62RH8MM> z8SD)}|MMj0%LdLbwcs~K#Ag%CPE8njPBVD3Cp)N2Zi+j#r(!Q-=6|yZrlKD}hL;AY4>~1#SKv{Hy{p z6KcbG)5^#gNSl=?=F&tw!87cBpG}ZHr>}@?8O=9@t%4ZO-J@y7pU>vIC<=&@oaVI; zcOi#H1kh?g9Q;Fkd)2h%7`TMzEBr*{M@hl~rJ@k=N7f z+r7af9#nTPkKOK_2U}DC0XThdRwxFP=)bqMo_qOiNhWyh^EogTx+V_b?nfpMSxgu1 zlsd8uPJO$x=I;LO6139{yEfndZ7MzNuNcOIp)EZ7nK!<@6dvfrIk}$iQQPU)J?*_d zY&F2iXB9UN3Gt>ZltZ_F*?4aem;6LAf2(skGg&*wO{9I2Wd#LVhz!JcS=V0k%*A^zb;Nq=Z%6+)#94b`&-zQ}_c}|F)|d%Bp1{GKpl+q$xiLkQ)CbOo ztG@Tn-t)iZ7}~%vwMj?SKD}E$60|k&!7Yv7c9D)RR~L~+f)aa2DZZ1!QeRIdceyT< zV+mo+i=g^EptupAFCfuS_$PI^R&^-5uV8c{M#*ajllI=ervY^HWZ-tWj&lM;%boBf z;VxbevND0%3lgq1g=YTkDsWq)ji!GRIyOG0prEp3G3fa>j)9zgA^jH)#MhP_aC3PF zjl8ATIOgP!(HS35NB1wry%)NEyk0@J^d6^~D`};l(lYzgB$(&dwE)&x>mM7I&7|ne zDbNNrlU6Iy2Ie4W2WY+q`2sjjfk78YNe0mYrp%E{93U~G#Ux^8=d_cK3o7JA`*S4T z+xdPeptToeG}B|Srdn@xS(QgbG;cA)r8%!19%sh2>I+<3Hxk}qmgUOMSf51#YkjNG zyNLDgejRE2s=+HkU9+HdtQ%;y0z@v8haPL>v@$(^LZ+Aox3!E6ilyn)CKV5TjWhG@ zan{ob&^&f83w_k=97h9)gF>w%hT4<1pwwujdiQE)WK@zh19G*<-L{13ZsU~fOUwwf zW39+eYpow<^DVsCGYC=cPO$eKgNl&=CO$$&o;HgLO#x-dAB*c>m33Q!s2v9(jw=W; z$nneXbKwfA24l-SiV#cxqu^y>$v%MfT!b30WTEqRrWqys>$i8Z&W|>yoW;R29X~tl zhhO^4y9f!-MmS@k>vo@>`{GQ-HYoO&I3GsZvMU()yI;MB?FJx$?L}Vz<~IVm9Ke_A zu55IGxMn+N#ggMjsyo%UJ}DJ2R?T75Q{2cM5Z{kV2-!gXJ2f3FTbFLJ;3o04H8!|+ zG@8-HMTTjx$*|VqOCeiwAV&PC?s{x&n(Cbnbpnb$*0yeYs1*XUXbRqzYLA$kfno&g+ zg@yVqKKBm2fh`!R4S-hzsM$23SaF46zQ_*flG%a^6MS|{gNl~{bZ~WESBuJevtp0f zrwd61o~A=t{mx(XxVI90JkwKKnqP(62qXvnZz`Zw;m@qB#YG}f;-$8^=>BAE(UXuU zmL0I-Gbw58`_OMbUJ<%x!23rsJZQj!usOI7jv=0_#0HywMO(@jh5&o<4^mZZa#$wO zc#MDv%Y$Ybd;~qjq&o!`k0%;^&hy>mdZfWD>oPD-;w%KCBVp8E9>H4&kh!C=#C!va zdakn0O|TIX{;&)6!~?e@_0%l}bLGugtU@1s8pCt3A4})Tb;!I4*oriORx!V5<(EmV zS8**3uHIzT$fRWRxq7Jm;-RItwgcOcTE_?NC-thT1*l5^Mm$vY8bO|1@2quyi3`}h zp#34CVcw8?2 zUEyf7agsQ{xj05Kb$y|;s%5fE-IDh!z2kgiM6seKOt@#_^mJs=ljfdNs>7Pj<0ry} zx1t+U!VF_E3{d@GUD#kXBt#V5U9*cLF%)EUHDW*$bT~z~Wjh zp5M*27jqAj=n;(~2w8(+k)h*RP)T*E-PgnQWf@Hvw4g~3OZ-TMf~qtK-H#2$kJ8>= z$~Vs$PN0`w9w0K*(XHe^B^h@P3Q4?lJP3+6dL@5Kx=+?!KOU~dD2E}30BTfmX8Fu# z-x*Eiq*9up$4!Fip`Q5I5>GDnSgA8*RdYUK2%yd9)qY!G>y#+jw2}~hms}Y7sT_ec zq9n^EF>R|y$!h{uSlm`cD|mFVUSb7!whc1-pqq)_En;G`py_7v$+lrbH^mw7Nx{%W zPR6iVL%GIH4--3XbdBcVT4fn^`6xDqZs>IV95~OOO=p=lC|EO7$rhzuzMs_ZQOM@7 zT(LTLpv$6r<{Jz{dOxpTq21Njax8VB9#jXrc|_29uX1&)d-)OSm*v5I5Vj>FN}!FF zo**y47Z0ZQu6gNB;a2aZ(DC8bYq#e}wJXqRp){?UJ9joit8FRZuVAa~Kofz8?PnG{ zlo3>FdsuDBetvmui=FH4Lq~%Fbs!W~ACy^m@x{`fMf%bT6K1e98#^Pp)G1(%Kek^9 zYvY6-HjTwABlgs&d+ok&wx5Fz<&DzCQng52Q2YC(<9fq!2lvzto+&CO50jrN&(+^a zgWNToBWFhZQRlFKeR1xqjZe#I$VhmyRbW`B$>OJT{LgO;$p!ydp4=illqMYyer2N<4@N5@PVfOokKAXvAxCUVFrM->%L?Yq;oLC+k0!sbPl7 zG;b+3bL_6%htUgL3ew(j`j*;a-|BqKSgg6HT;7OV`n-~t=U%XT{rpUsax(IKuz&L3!k%?<)V9*@KwX5z@`xD zw%uv@A7ek3ZxhSDN8j9_%g*Z^VOJgvPmLhYpUd9;VV78Gbef5PPpiw;d?s>_y-0=$ NaY+Z-_kaHF{{Z1Ofye*= literal 0 HcmV?d00001 diff --git a/windows/client-management/images/DeviceInstallation_DM_Printer_Compatible_Ids.png b/windows/client-management/images/DeviceInstallation_DM_Printer_Compatible_Ids.png new file mode 100644 index 0000000000000000000000000000000000000000..2cf226b674d9126c01ac0046d80dce739f320008 GIT binary patch literal 42744 zcma%icRbr&^nY}tN*^t)Qd&h-QB>6m)oN`@?NxizQkz7Js+zTTYHzV)CZ$zdj1mN? zJ!8a(L?XXvpXd7N_#1@iNWKZBZo-H^1oqFA2zah>f=2GQ&_PZMdR*HP7X$WisQh=ZXn_h}8A z9x_GO_%cm+!hBbORYZ09`EV2o?9N%3+y9zkyM>uaU56ro ze1I|u1fl=nV0sG#YbDR%;dX9vd)bT=#`pU>B3Q|-KEf}AkNgLIXu>VrmY0{YSOGb5 zack?UpfnbnE)*Ew+8QwH?r+@xGwKGp^?A!(%wY|(M<0%VMEHg{EW}mxgS;|W5x2kx z6VNXF%mEF7m9l554PV*Y@n57bBn5MDCi)+E5zluNEFQL+$LiQ}aE{}y5ltLr@QjRxE@3%xVspI51@TaPGtW17}%n?AE-n>2B|`PiYa>VdZa z-eU*vjdJUgyes`ewRux}@>1QnuP|#86h{!!CA7W_P`^@lu`E17X;(UOE@=xhML5(onkt9Exz^t^~xG#EqZXWr2%nQ8h-}^ z&QPD^akp;-JUhenCwJLHUg_+gj%841BG~@)&Hr`n^hrHO69%P%ez}u2K?{ejK3K#_ zli0iFrxnheqCRo?R@|7mSjp}e>G=2pKO^uRM^nW^>k5khR$t)JUhRSzp%^l%vb;!2t-&o6 z+btT_c$`hQ*%e21Mc=^iqbv4m#`1S@<-))_n&VGv483NKFZ=x!_mT{& zMorc{M>V>vfhd%jEEXekyYMr{uBK7QYs*X#6)HJn{;>0?<2lk?`*THvsGl=*;%#nA z&1`V<@IlpR++*AIHY0=(;I*g2ov#K1zvr{VZsL?zXkP`}zu$|+2ia~5A?JDnynivgYG)gZ5KS z2`pwe+5Z zi_qW8{halDkN{=ZDe?dtA{Oe|A4|gfP6+Mg z9&qDD#2NkLoK(5ObnhN4CqK|`Q+(MwO}=13#_4qq&BsRcw*!aYC2eYpM_+-n>_1IZ zm&EX&XodC@epPU&nl)r4`AcVvzNJ#zBSodw?-$(zJ%#OAC;3VEDa(`WxPp%Vq&{Up`NUh-o@* zXP+&Zwt4cgRF@wDtq53lop8`UEKAV;WzzbBo^NrPpfXYKAJa$|X$KKgY`M(~kXoGS zGU2p=PI~2nA$$wnp2S=a%RMpgW`t0dtSZ(@_OUG>NVmX9y-Vc+@B<4Y!2S8nDmmYE z;g!;24hjw(;Ay{BYjA71C7?HH2Kt3Ve_f!Y0hd{gPFz?FpNnguWt!%{CrpAQ*B~b= zpH)n-dCyfOcyA8A$!RGbe>9=D|IFM%=nWXwMW{hG0ant=MQH4OIHQa|$s29<2uz7c zm;;3;t{YtGya=f5`EmA^0MDTooOY}x&cE?2*hqcW>y;`@MBR1G!)zd6U0HJ9*+JAJ zK&)cemRUc8kR;=)va3!SNr!&P6pw!~k16$YCuw7ZHSARu(_~C{@|==heYs**c6iO4 zJaxOXdGJ+ldCeYKMS!#2L!@8p!$+iBzz7S9bkFrh%iy!JY+HjwS}YrRW6EMC*HVYv z2yQ>CkYsp}#?jm_a?c-DDd+`(R&Hhc3M_FQ27bnLemFPN>u4=EcONc$b-8gh(3vFm z(muuD}V?08Z_SV+2{u7YDU&8psG+1J-{Xt(z8ttx)9N4H{B8{rldrAuKgjV}R!S%V1hRTxPdDg%74o!cVvlIAk?O4s^ zznpIRYQe z`4Y&Q$I+0{vR(Is?yW9*s7ulS$5t%N6<4$F^#rs{j&LU*xhCUNQRadBqqcrwEmobQ z|741+2hQ?@_szHana7D0W{GY2nVB_IDtm2`Jttg}>Y)Ceml~y{xG}!7;yUM|`{rRP z79M?^O-M>;%j-?knq{v>a-gl@k(quvUKB5ZxP$TCJS$0=QmvjSgK9Ck9*`YHjz}D` zw&@G36%t2Yi#+Zx@%tV0?uOlPzXJK)u6f}uCsfOe1Ne96301p=Umi;_HH6^S`L%nB z2LjNfe&NixWiy{PHE8N}R96<-Et3DYTO2(`qBj$)E@WaGt=LB^v%8?*zq>S0U>>{9 zI{kuK3q;71ahk!UrO)t%_8+|uSbi%TU7)4y9uPsWD(}o+6Fobbi<-B^>?Kc_W3bRn z@0O=tDJa*bAM790EmXz3$WR)%xtAtW%(+b`B}u1 zrqN*21Grt7>5PkhgHR8?a0g!kmUAqwm(@6yJ>G1#dEql(fUnv?{wNT@I6@G(9Dmnc zOdwvcpN6Zn42^ES&-c`ik8$A3wj+;ZGPC|ko@JT9=MK%*BTeKD-&chM9U&KlU5 zXI2RZY_aKp2GG&t0eqCYrQJ$FVUDuM*@flh{lcjgTPf9Ur?|6Ghc?Xx0*jed^KvHq z##rPV;hqRxqj1w)-8~yxJ0Bx+HBsMC}_Jj5})6 z>Pr%ccUVTV?*42_-GaZZW*^>SbgJU2d*3gW<^!779G_Jm3nOWVY?4$X;sn!Npr!2-6QHHA07R5uj=$mvJbn_}tu-m3Sp$!zww=(irdgxD?SNxJ1)_;pEC zO$0=(bF~ZW=FBuNWBB*=?mX4uyO)QD-XKx7s z9F)&0)rfPxKdO8C3QYqEP{{H*FvNGRs<_ZQv)aFx!ZE)3E_tE+RnZRrrpvuOcF+Fk zpG`tz1q`z&C47WaqWP0n0Sw`CV<1uk+-F|PTEuZzt9i0@DDzW)`uvUe=r%sjzB4Xc zuFXqP=;6bxD$CTf>kh6Jrf0UQu)Us4Pj%ire4^vapfNj@PDa^$rcWa%Gdmh*H{wg& z-Yy>+-o*4Go;R!h>?4r(YCDB3}UU$e5c6{z%yXAKWu76<@@?``zGyc-K0pF z)%5ode-TwYo|D!OHfC%oUCon;@#693(5VBB3G!v{OB>b$!7k5nakS6(2r1f$*y)u# z+PDqEZZGNz-93?Z;at!2AEcJLUgT{Z$nu0Y<(fxQ#C7SD2qBZ>`~@p0Ypuy~fAMSz}2;@O3^2@<a*2ruZ9*qa+40t#PL?;s=G2gg4tWCpHby`RzIn-?aiK{%660MPF!R?!tv!l#Kf&D z`fzdZL-=?XCj+M6rcCkplSJNNOR=6<9!cIeiY3UnXb?zJ_8mTNSEXDz8j`ouZ*%&R z>qx;Rzrul+sNhO?oRDXfR&Ne%p;7Og9jdyY@7${!_77@r#c(oJ-6T3WUTbW9;4`J| zxWYD?hX0I-sT1noO^9R(K&E`~uA4?uDz)~S65sVT9MEu?MxEnqb3b=WaOBNqIZd=IRh5r=7=S~aNj+K|@+ zSDu-WUg~W_SJf<@5vLO+xjR}-N120H8i_d(Kxdr_OTtvb^U05k%-A}9gVl2j{^$}( zJ!KJW?Qb=;O5^LlSkmfO$FIDV-mHKJe~C9dfs9O1$@=z$+_T+dL6=Oiw55q5D$-V{#In6^tC3_kA| zZbp3HvfWOPYxlr>(J9oJkb5w>wdD=pZIC%W8nmW=CXk{;#6Rnwn&@hqZ!l2fqU~o_N)znU%gA9eXM zOJ<2cJ(eHa5|4R(Ux04(i{tcQZU@8%oyR=8AWfh{GzB(&yfJY@LQgq^-u>VUBHQELG zRek7blufJb6idu7H(A)YOP&hRO@wU ztXvf58c4(qOmlugyJ5Jcp%c!>GONP&@E7^4`|_!B2GXW*`NQTpKXY7v^qxM&4k8Zr z_3FU}HrtdM=Xq8H6b3AKp?;44@WeL-6okR z&wOX`^WDw`zOB+RP1EW9(JNf8SHr%p1gZ|S2D&B7W2!wcgZ|UP~q!2 zDyVSy2TY(dlDc%^#M1wz0QdtQh|}(WH~|s?iK3{j@zkS(z1=wf)eOj=yz*uLHc?SY z|C6QwWlz9A(%)vqxBjIg;2)`zZtfsaL0a^GVUdNPlN==mniGbDem$#&pXA4~ z=$}?#`cvcV!?r&;Y#90zTK+U<3ORXFx~X1ylIDE`{2|Cu6h$F#X3P+X;Udzf<#z`% zrI)uXB%LR!J1|tD1p337`8LWK<TI@+UoT@%#mmwC7JV`L+LHNQOCxDd40`>HNQZ z@K#^tdi4Py(79Ln&Q3HgJhLgkx!L?qm|FGi<1sX0Mdp$rOE4iJVCf@avgjQR_W?gLvo7 z%2Vm>tqL~85q%J;5RL@pzz33d4NWT=)KPm4d+De|-j4K6@^|elkhbP9Vb5pc(JC(O zm8K9q0I>d%Q9h}Pb*?kyVA|Kn4fIcqp6wJ$;dJ8ko7L~_xt!JE~E9l ziwnrMLd$`+r*j%@7LBbGkA750hRd5U z>wV*`=Xd^v&G2)UEZ+wu-Rt{HekreS#bXm+?l#Shjz2pbda~O8XlzgQbb_o?N{5f+p#V0+zk#)Oo^Sxj=Mg{O8!s4 zci(`(fTJMat43=J$%~aUj_)@XI;o`Iybg5uz!bRsgKsfLl12czF!Ilud_fq#_bUso znP}}?a`%0pqngPk@vC*91H$gvGGikb@153|y_EC3pBmj>EvHRb<#%tVo!LqU$(nc% zJ`f6s9%k^ee<bh>)BQeutf>0Sa?ybfy=`3Yp0BR zL1Ce~eO#gwzVYj9u^pS6)P60(Q!2j`pS5_369A|j6I_4H#fNbI&M3JJ1?uJgzF{KB zDP637TSLVm;#10x)qCOVJj(sZK#g-MW;%k1?Bjh1`y1ps5i)`rUkr@u_u%V4!tU(0 zTi;|1a3$>CtC$daRQs6pLVVYGF8$f4cfdv!ZJnuRfVS(e#d8{Znb4m2!E_+_bbhC4 z3}Lyih1B#}##>Z~7Ay~h4ab`|Rft)<7a>Q=*w{s?xV_9$v{(~I78T}Ij9d7bd^|FB z4bzx#9@A)j)aCFjX3CM96XjXi%RMv|lPK}kGUE+4)Tzc~#}1>sK~vwT7SL1N}+atPP}*r>1@QxL=HNw_Xyk`B!;Lgu|%C{Ny%W3&co@u!bS&K1IM-FJpzDnD39Gf>1=SUJ3_L!C5b+XLGX?8Ej4d?I>ry6I z!72mpfj6gcjD!Nau;imVx+zKXFHGMIdS;eW?tbF~w<%MuD~sbCw)!#&DcZezxqXF=Db)y_a;t=B|ebS#~V^8({?|ys?tn38#luq`q1rzkQ;$4=__{ z?Qc)&&SE6I`C7&WaZ@2?&&hKYZ{>HCC!Mef5(G=M^z$alN!XYbU+TraebRFk)@;sW zHHN6kdStF@04`hBSlYexu4(AXl4sL2i=N&!tnY>uXZ-AJyt_8N5M01okWTjPq1P(R zWz;wzfNgM)fF@W}m0PmZy)YqEH(XDv&xAVHAX*A+CS&@)?E78|wBpt->Rb8J?2P@9 zchR;vAJJeM4|hdy?&fZd<)C~NWgQmPFZE={c{c1Q9!R8}&gpMd_^rcYtrjDlFX#T?wuDg*sklrUhY$Eazw1n+jk3<()}i_VC)erHjO~fHJ%6jH*cWN;>d^QgQ=p zT-NtJ>nQW`(o*>GSdkSOcs?)I`!(IJG)uJho82?z~zCNspZqV zKkE^6;p@CgE9^{iKP@JtNQbvKi;4SFiCaxDiFMQ>AIFVno($8v*RPb{&3>L!bUn!p zRJW^xaLICcwl2piut_EUYaf{MGvdI@&_f=l&US21+uh?y`rMe8bY9hrqI|t!n!IG# zMI#bQh<7a+y>gc$?LjG`Z}UseUbs&-tc*`X6~2+Mx1%{R>JQ}o4)4ym^zCr4@KQrd z%DK4r@%hTX14XTOMS0b>FYDX&wpC7JPdn+{1iR( z@)4#?D>&X*stTA2wHrWv4oEK~8D{W<-m>EDk^bk~s*XNd`s zR~CcH*!5M%utfp57*>ahoehVYges3_llZ+I^Ag2+xOWiuk+Ceq8)Faz?$|n<-=~2ze*=`P(*_G{lYq@W2M8h!MXi(uJstz zvDt%C@Y#i+4Fa}ZvSBFZx|TajyX3aGr0Y}?4?ARzEx~ehNg{vn$5uR9(W*QpaL9xm zn+6Mc6i0l7o3M{0?m$?T ziT=f3S9aU?=>Y}|Gq~py&aNhaIO74c%8P=4u$}8Y^dHlT0_Bf>%JF~yPU(^0xnRNy z3*8Yo71;k2m**9{y8N(Ed>tcJHa(fqrfAL5F+*W_6!hZxrq`#9Nio;e}< z!_4m;k!9aJ(&Hk>-DKyOi*kh6fRe{=#6#sc_$(H_AHU7oR2>J)^`ckJb(*#e5DM6| z%f|6vw(;5<%b_QF5J%3GKn%^;R%{(FX4JP4iR0jUu{6)kDanayn+R~o;y1}6O!s?% zXW(mNY?*p2eS7Tx+c@dp$0!6q001K_2J-lp)I0au7ONmY@2q61d$4%d{=?7IYrj(H zIZj7{hkVepkj+qN?EARmP)L0IX)^q2aL>WfiJ8Gdb78EgG|)})c9@)D!i9j2D8kK3 zr5>sgsl-Vws*wFY_xz(!e-95oD**7Cz!daa-Glon z^k0L<>J(Gc?1>>78{N0RHIq28sD$Wpa^%s;^PIbFa#M=w7Ih4>n$x3MkKeZc zkwId{i~}zq`|H_+VTA{fh{d+5^Hd)>5${z@qx6jakM-&h{$mUbus;iWZw_Sl2LSZW zqv%=cxTqrmwB`RAxWyLi|34mn5t>h4!HW8SOu4uh41X<6rl6Cal%l8>?Xl3w$Z*$jWo>V;ImvtY*RKj!}(AzgXhFqc+bBO~1C)I)$E(d+p7!d_d2~SU7@3yAX z@%BbsjL}TDLw(sf&aoO4{9fk;@-t|Ph}NexK!oRqx0XFoChse9&8 zG)9tj>D4Q7m-^;ClBX(V+h^26LKb+R+|hgF(W)IfUpu~|rZ&+So!->!#JOwP3zwrx zGX(I%e`5!VUWLn%xTRaSo>IPPz&4M>rO9n%%76w1D|{0+(qu`mXSmA2p4hD{hfL34 zPi&hhvu5QdRhY)(_7V^`?A9D=o@Ly;p2`*{`G8^8{=G;{UgV{NG!F@rmt147dC<~#b9vl;4|r0DGDCtQ z4jS@xR+j+Z{GI?lOz!FLZhRG3@!Ibm|CO-d-bi{VF3uZRf2BMWGi<(siWmwj-P%9= zo_lN-IY1*Rns**qmMgJ29;J$)WqXAhynKD7)*CDNwnkk`lx3hZA##HGa*a@P3%w-~ z*PHGkv2==ynWpZXH8ErQ3P7M zK&BNJJtGYWy2|T8_IIr^eH} za{d!DYn&uMS78K6)W3PXb*l=7AZ>c1(dGmjypPMEtwL*#;!p)#B=s6C0---_zTlEN zdOx|eYAWqD-QM+SL+051)Lbzshf_5s*|`IX|j zii&K0^Ec(K0T$+J*}j(Y8v-AjP0LmL8p}-NaJAo{ZGJ;lkykzXm|t!k004tQBZZp1 zNrJ|t+@BdIJ74?shqa%a^=)A+3DK_-OjP%$7QqvNYpI@lPV1iT>%i&tm*M4Sb~>R> zm~z|hHNWRS)q*S|50=nJPE44-knviCQ%wG;64|xBwQuO&0`%Z*z64vRQoCZ-Mtg4dVq}*Ag~Gy zoSzW>KL5R1j(00p=xV5OjjOD1W4HoyMOwjPYT=&Om!SLs`5MukX?DuE^#Ku?JJvqF zpR#M9^h07jQhl-l+*)#sb;j|`mQgiAqRyLH;G&ImE1^eX zd=)}QP`std>tOs@X)Gm^^1AR~9Xz5zIWz~pE+iv72Q?@w`rv*IH}H|Jm*4cd5NxCr z3b!p3rVwbQ%V*NQXfe4Y@h?m*J89v<`#@=I%*jZ0^G{=0A8IF1Q~<;mwQcumQ-J8{ z--20uloA>dSEb4vSR<1E(+_11(P-3DU5J0N=%eg#aJ^~=&43!4K7f1t{v;>#@sWQ- zdG$&{>!UdlV>H?n*V{tgpIP4c)p6g=L$(Bt(vIxS){4-1=c*DnLGFg!oY@-4#V&B& zUq(g<87<0`C}@*EZS3!U_&H`wIe3H|rJNy#Idc_IUS_gw&G77>k=e@i4i_5<7(qd_8tDIue zJ2J0l3k{$MQv#(iG%%$k1Pp5Yez7?X!ORr)%@hi;@sS6jpWoLDJ*djKk4vh zd)}+*VEPEVm($Xrk^U&FZiEyHom@p@ju9Js2(v?aY1!QxF|V|VVb?;$k?L06$Puss zrGc(DvnfQGf*Law29%1f6Z8@OgBpwC+=cLcIczOSK?lNibRN6X-uEkA z*g=2ovpVoDv*WcA@was9xqaG;A{wUaZqJbA^@Dm!q^uK6;TClB@TvcOcf;jjiG>e* z#@{b9LmaYwUblNT8$VVwUGlUN^|Xe7O)|$4?1k0hiS#~}2y6VOUVX^JqwFVfOJsW? zMZ@SPk7Gpdwep1SKL};Z?AbNY`MzH6;h+2?L)duzfo{!<#*X`|MD;bF(^NGqo*ojN zk5i9OdtY{#O#XPt9@`dRx(f~gu2d9u zw1iQ90I?UBNp+$~Os?ibNIx{>Ks$=kt^3QM0S#klQ;)haY;v`47gINqoh?^C0-5qI z%mf`!0>5dnQi#{3Td{G5(z19&R@F$Zd1n0xBlyt6YmJ;3)98S|DQ()i$l&FNEnLPv z^w<%XcA2Vd(^y12cAcsm(m-Yg&S;nu*0{ZlXzw+@D}MrRgPpC@dM$MGneal8Jx!mw z1pvOFyV_se@j2Z>e3Enz(yN^i@x{$nH&+&vLHZVUwUH0FGkzv`l2k}+U<&;vRu5o1 zl_BL}Tq`;C$?bDtuwFF7ek$OX%*(8Yrgej6DQP7S?ccO|x@|co|Iurgeg%D%!qh6! zw?#xv%7D7O3D@Zg2BZ;Z zQ!chwC+G1=d*7}!DV9g7DwwJHZqI*UWN_aAd?>IsT#vO5L^rRQ(x>k~ygcgZb)a;D z+sKna4uTQ)y>14+M%%-n5oVkbPzf)8C-6l*I14-V`k&-DdY&uU)GsyjxEo3?$plf% z!NVGqje*l%e!b}!=Ryc+uh5H5oENdZE9X{NI&iVV2opA^4kv> zZ*Cgl?b^oT)d%$h*l^{B|Xs#Yc zBjobt+CN3pz8k`gdVO_^=>_7Tn>S3{rqNDYWkNirynKHY6ogj(+W9l$dy!ZC5~};P z=vswV6YAyzR^s6jC0g?9?6JWW8yoR{WGClSeojCCS-GBCGJGRJ_?d%P{1x<<5MC$8 zohALy7Dk4PC9VaM$3o{sj#hS`(6zo^C0yvNL*c*b>cv}rV8`63X1I%6&bGXF+=0HL z9r#U8J!=;s3D*g zKwHQLyul;m&q_3Ns;AZKA{^G4w@zzBj7Ek`eHrxE^C92B9P&yBl5bGHYlLxLs~h=p zo|2mh@_IX_VGKHU@$y?Y2G3}q(mvE{OgL3kjZAH1WFDiu;Z}tatit1~$*xU98k8K0 z#KzuCg?aVJXUi9os2!#N|HIp9TCV=)pRYR@pFVR$g{_AdJL#+h?niAglms-lKjN8c zbq*c0?k6=HkX~N16UNks)vsY|XE9}K9lOg|m*r9P zhRZ=(Db~fO29{kgzgDh4fqw2J zRg!(~#H1Bar^frP&{CacRKr*lg;=&_4zwOKVdxU3d@fyWu&n7F9dzZ@z0#QC6ruUZ zt=@KFG1~8iP+mEaEjBgvy8n@Wp(#{X zDk+Q@1s-#A!z@ZSfj9fE``_>@rE4`7Hx^U)W7m$|_{&jcN!g@XWmc;Dd_aIN35mt- zV#pP(wilBvHxW(#BG z7M$lK4-8nBtA)9^RKUu$o}M^-@3T6}Qxibhz0&$~3-w^q%aa*(ysr?|DK~X=%fDIH z7;|BTx+|>7N^AJz8ALtoNvWee=nz(cuW*wi>mPW{^SDmM`U45l2M4%bVHgaH#U4ER z)pydXL+&4Oek+;tZyRQdr3MV|8*Q@1BKGG&8N@M4EiC)oyfmEm)-U!ApJhx9O!kCM z*3#>eSP#|Xz3t2XH=avTWX-uRKQub6Z8jo;HHR$dnA*9c!*r}t;@<7fzY9XauL zCD~grT6YAmu3DLjtuJf3^&eHk=+FGu6T0#9}lEz9{MuWy#{`$Wgbkk1{7deV^$AAOdXS`~gcOJPC5={>dWVbf! zVVZLD&kexCh)o7JpWxO&v@ofqm3lfG`rmLgC_4Ed>YLFhb@KZuTz^p#oF4WuS1-@6 zuOTzl?Un2Z(oM&cxPZ#~x(DY&Wd7nE#vZM&Paq7X=hXH0FX$m7$8_s2x^f43o{L%t zh?V&ldt&={$+Kbp`!eHy5R-tvu@onQ_&07K%k6J8MK|}qsLh`hN(EI|gS2S=Ks;xK z0JqNniJhSP4-C584?P(%k0*z4m6`_CHn1@{KKYaNZS=oz1}YqTlB2}%ALR2dEc4(G z4MD#K&-~d)j{gn#?*}SxX)c7XoHW#y|G&|x|H2|3oFHh_@QDBVp^p9GkDU0w-Y`39 z_&*^QInf7?CdP+0IZybIch6C^HH%mGU?n|0simZ`m$fN0L0v7xu#@-Lj1{6eNpW?G z8U=B(*@G6IL0d>-zWby4|I=U|LH74Xt{zPs zO8kzF?YxJ`$glC(cdMfD!PQ`&s1UB~rLeCj-|Uqp^aIT!#JMtMPm79-*==dwl+}2D zGPedaId^-?rr*j}qX2&~ zYP#+C?eXLer(=_bamW9RnOA2fO5ry>>SS^mkK{|n8)RfkV5Ze>ZiShD)E6Ihi_XBu z(q1>F1(Sm-R%X24$oE8G0h1IQ*dc_tiYd7MG`5`2rIPcTV zv!Xslm889G5bU@Dc%8nNxOnuAz_u>zTqv{!o=DcU|AtwAXzfr3x$h!T^Ek8L|G7s9&6j?4b z0jj-!>bkcyZy-!`@D6o6y^nW$o{37psEm3lCzrdVh|;v*4&7R{Ti|cSPV!ZiCrIIY zfHz)Jzd}lY#Wz(nSS0Ji0}K#Uzr1thuXRWMxiNESma)}`6efdx+CKqIdY|n<7Hupc z`uQdEL26wgm-*el!wl56sXOaJB#Eij+F=rk#TC>blG23G(Kc)!eURp@6E zhVw2u;u{r%ebi#oe{)5)ULHwsaDRi?OJCfDJ~&G`CNK8lyG-ky?!!Q)Kw&R})Q?ML zDwpqpMku-&Ddn=s>Kx8E%uKX@50 z>X?MY|45{Us06;}{l+SYk$iIpLG7~)F^P+yr^V*i@mi?GDoc-FumYd-wiqsC)^Zox zN-P04n0fYm`;idIu&m;L7sm?TVFl?0Qlq)}&@eZA%vkd3 ztZVlrjmfuCym|)wa?Zw>@!_~hszM2JFVuuk;l}#I7g3UL=R#VeKnEj`p7!<+fkC6L zM$zbtK0p5~*`6zP-n9`+?_bxYC+!@Ut$bZKed;|589c$x^X{glXZ}$-Or^-$i{4HO zetLf7uI2N}e^-0m%+YUC<64RGVkzc7gW52;pzGBunm45=O#3TTOgC7fBJ#{T)b}I~ zbyNS5zp-`#273eEGj~y~^L~^+iaUVciS+e3hGH@NqPws95 zlbgMswCLRTVG0EQuaX~XCw;hZ z`tk{_N>B1kx9efBqknn63wy1=^!#sh;)lEO-4Ff*2nM}+w!6EV!+bKv9l>GJZX-eR zKdJR2g;Va{!TsCyW!gW-=I}ptb#+63;sdE|oe<~CYH%y3y?b3?rabzlx+$*BSXbZQ zLp4i=8G*kad8^%g^CFkDW65R;2gUSE9|TOhY>x6Zx=;luFEGw);6%OuZJc&T>ozZZ zYh~;y)&XUCul)*k-+FIa-FxOX@1+w-$DWe@hnTjvGVPA8@bCD^A-x&|V)Cwlu1_b|u@WhPek zVsY~{11F(eMHoNa^>|6PLhaxQ#B~MrPdNJUPz8iL;F0m95djp+)`E%s~rxYJUEt@!bny zkhAWbF}5Chu4ufKU^RJveLT~q_valb#w&e_{4MwDdljVsxQf%u0pLCFSzrO!c6N`Dn17y&?-r-Yxi~!H-|mt{9vh^X?dAV`d+K<@UcR@ zxr2!py|Biaj8tNbxkn#yOK8Szdilj-B)C39Hmd_|Sul9{MCeABZpz$+kT>kexs&jN zI%u~XWtlQ1XC$4Y#>>6yR6;vuD7hOsvl-h8dze1*M(<{WAg}MVjL-JW>FUz^VYj#1 zkUcKVm%4&^pgWShK)(FLMjc+J$J^mOo|#SF$s0KJu2br1a+T|k_`@&vNkOZ(yi2SN zYifOsYc}(j>e(qF6VW)A=!s}L^_z$$!hSk~K$#hy5af#-=FWcjt-7;jqnJu*`PK=o zoA4u7LN9{Us~F7006bpMJbngRhk<&LhSIl(ZdSTG@dG5ebrNj`Kg#&wh2AcXbGRdC z6>vnWus{#N@+Y4J>(Ue|)qU{Yn`tYq%jpWuEJ5B=I(sG-rraW>lW#j^aRx(vn{VlR zTM41+w@5Ycg5|95xD?FK;YH2_X3$Rh7K(5z+wV2L$m)>g)sryJiiuXS<2($J26c3{ zBW8Gx^`$}k-4ICJzMSm>p@^W4S)!m{77L$T+#Bq_v-6aLVp0RZ5V##Kr{0{G#JS#Yk z4)Lb=toP$UtnWXKTOUeCWHsv?hk`d##q#%Q(jJ31j-~t0uGyvRPZ3se`00DzH$6gE zt-NP4+<;yOWzjCx>h)O9&~==rL=GH#mz9ph`}i)9rHA+U=xf>9I;+k*5YV*cxZHLh z-&+`{b=j^5BW1j3i#bABzQ1;|PetsW!ExS+HJibXOj+)VvnaE0 zm$tfnmbW%Xc6m9@U~GN0%s(~aAS*9x*aW)ihoCVw5DC1;IED4l>Z^4^2}yT|D>@o* zqc4Zd7uEq42`r(jLF-&!sd0EU%~`FLkvN?nH4^TZKVL84LG4DI?OLNs?MR za$?DRDNs|ksFCx$$!*~2m#3&(TAMw@-ks=o0r-pUqP*Js5tzS}C&?*-(qn4#2Ht`F zRL-Sj=3_1~7M>Z8q><$9jBYH})5#k%u%t!jC?=%ZTv^qy5## zyzaoILcP+?g>WtOrHZZJKGgDJj}>PPnIeIb?cS`J5uRZ;(-wv(i{t#q8I~VJgji69z=8zkqNwhKZc*& zb%XDMn2SO+PNg|tqJBa@c#16~GBUC(;`dX$g+j09z%sT@*-gV(c` z=LCu!70RzE;{21IG1TuSg!O+7Mju^B`bg|8)?J{EW9H}7r zaKK@uIj2_o@p5`Au4BAHM=18~P&*g11pA{~$q!sSuDqi|mrM_Q#0#z|_VVb5*^m!! zY!=^B_;6@h$K>h!BC^~YBn2j^z{=q$;iaXc!2VEL_@xcH^%>m+dYy%(h)gLFxWqoV|5il;8I+ zI*5RPh>`*dqYNM*T>=uKG>CL}x3n~(sDO00v~+iUP!NXhk)f1sq=uZ~J_F-7e)qi2 zz32Fk%*=lFvt#YG-)rr)-n(pt7j+yX^zl9MzcANGHvWXbjBAX4b?whPO*EZ;fF#7%faEH8b zF0#89N!u{49@xG5y@oz=_xZc|`3T+qB6J;(>sI454fq6#Snsr~ls;G+5zZ!-KfG5UV5j18)RzR zBe8D*WlUuVDKKlEW1~xmH4riO)%o%9EO&}&a0=S&4@Ba8m)%7-%!X3mYc033yc~}E zaI=poJ7Sg+)-+yybI$TRF{%G18zdv*NS<+uH9IDz)LJ9m^Qq9ImPr&fA4@;y)Noqd zY`Zd-qqY$(5HcfI8=T$%R2eY-c!aimd3ojhyE-J}v!7bHrkW60^dRxA_kXe+t_QA_3&X*R@l6K+H&6&xT>50H#_3{!LPNc6aAK_8YNKXDgX-ir*3 z{4B~W-TN?dZ9&>JdQjNh=o=0QeHg71wYFwWnrybD1Iv?7_sUauBUy0nmZAgJ_T8xT zc?+X75pHhdz}qc`JP~Mbik7b4URU8waRTUSu4&-=3b8^+hEhcD>o&U7A%&}0do8O> zv{%5}Qq2qL9rv<@UApt}cxB>ci+%&RVY;vvYgdBXYc~m_}GyxOF)bVH`nhxdUpJr z!^RH)nS)8*9WQ)f7yL)a*hO5UCh~J>1KFtYX2krW3kPp7H&%O8*1bq6v$7)E90d{m ziT6c7jKnj?h3LicgYq4M`f(9QwAiw0j?K;*yO3y<0Yk=uw&0i4$EZ)H`C%*}H}Ynl z+&`n~#!9;PRP8QL$4cyRPuxS`)V@SLDYo6N?jWIgrT$>YGS(fas90x`v5lxU|0-72|1d7(Uq#4L=A`4FS?Xjn#uk6a4JVSp!jP@ zAa9=)`;(jqH_4AbHxzDj@y5l_pPes|ly1xwaP6n(I@%cUGpeG4fzb=17%$22ywk9+ ze{irD)`oHuD-!)zv=i_%Xrl3d#1X+A-eg zt!q)7J&&*ZYhHiNZh6kHUkUxIp(ricdp0-MX)j&C|E%8*u5U*#C17`o`a!Gw0(7ay zJ>5aKh33)n7KuA`owZK<#?{xgxbH9NdO#z;uy0>w-UV}4e8i<23qaQ)V-VZB^xohN zdLDBg?7t=U0VhCT>;e0Z|DURL7j)2Pt8bHkZ2B4M4-bkKC>8MQ*N)HhoczGrXudfR zGKEq$eVO{i*fCr0rJ0}KtSGwH0EjtabJFzem+xxk$IZ`PY#u~1)OXNNmyhIXi#h-- zFpOU;Wv-#$8X4G!C;F#7H5_}74)uM#2MhnsY|P3g5xOvY^FcDri}U!BQWE3w@qlIo z+!i>fDFb*s&=2OU=8GYNSJ8SHBpYgBX(`Es{!>Qhz{SzGsQHA=@$ZH@Ok;52lKgAViy#k1_tJKJy2SL( zXxmunh5gv+@uc#Qsm=>~j{W(!VL)kTvLx4eOcjiO~Fg_T}_Qu3#tJwP|Z)ClR;o;`qp_bGL9$ z(E51404DX@uVhfqVAuP-i+a}?{{>Pb(I%rx!|x@Hw&tWqjt$}s;6Wv`Z#>{`FdNMU ze8WfS>7w3eWB!7)7YxXnk4uSdtoiAsdy=9ImP%{(33f9Umd9eZv`>yjviD+rOMexp z#yD?=7yJAq!=)`-iKyVSHV|ORXwBCYwL{$)H!No}pVNgY^CcGkXlt9?_99g844)Ye z5&Jpr3bhA}#l4e{8{Wh&4yc2DlplG-+&CLuYxeoHx|q98K(W?r#)?-sY{BD@qO?k* zz>}!aW%4JVmb`80pjHVyVt&xM1tzB|w3L0}9JLciGP*~3VLme3v}Jg!dupqN!D@WB zaKS~TOvIm?A>(J}5#!QmTg^|82xhyBi7!ucJv?qg6K);;Y&f(+ot20N`@AFtk_tcp z8o>s=uH8YkM5y0FuX{_JQ)V^r*;|FpFK+e_2`gY}N-b5?8}2=Cx9Ae}EF%*Cu{7sS zjtcOzaF%1yOARCVq7QaC#-2r zp7>U9{~tlVM{Sx0oTa;ssupyjrgKy0%1tY;NP`5b$_`QM&GzEAH0|CAS|FgJCkmY| zqK?e*xC7J3s3A;^SAb z@OrsEwfe0@#%5#ZfRl|cZD`(iWEu)bN+ySC#Yy(0*s1I-*vFm4^-1j z*BjbiXY`-Bv|IF<WbyL8dU0%z|K)%9ekDT~HS2n3%%4buT^QrZz>s6z{NJQ-tOr`$^cdGvR_qti9^n>{}#@ttYy;Qgctiq z<937>2o%1qqCrhhTVWRe@~A3;|NiKnPZg5%eV}xpBG&Az^|i*3{e|Y0NZaVw$G!A> z!@8x1E(-_UJMd*fqVv;avAHFjeu>}Q?1}h_iVohd&4Sx}61;q-kt!RdQcQf-4v@gMG;pY9#Q6r#lDVH^ZG?9?~cev z2~inqA_dVl3EOa*?lT!3l?+vo_*+8p301#-fxUr|MrVLkNg#MFAS1`LxE$`g&M3+Zj*3nYYhC5tkLaR z7AnY|iNC($t*=__<0l!{9D&Pwh}2Lt$rwGTK6nEXmzXdolF4jw-{pw=O$?k6sXuyp zDxtnx)>wg~vLFJdK(&iDw4>1I)YtEosIPRHPkpaPgw?g^F2zhgD0QJmM*L3r0VP~3 z;i%rl=9Q@4M3|}Hde1UxRSF0Ay@e${U*}%i6DCAaEi=UT=S4IM&%8!MC&k=_t~%j? zNS8k2F=soR=;&qV*z2G?M&G@p_=^#mUWoNB(*h(;Lq963~f8#v1Xbce6Qw+i7tzvJ@|i#<_-_&-RByy)4i==0P({LNLI63*6HBI%;J>MYBXn(W%3R@L2Dd*BfQK~qGJEpnQlzYo!yIrG-{0-ytR7( zC6k&@K1roYX#2$4^^&e^b(@!$FH=^UVBoma%ryDQQi=ipc#&?)w+NcJw=Yo%YYa>o zWh%>OT&`M1<7a8H-AB5)>idFtZnCZ_FLq8gRQ>m%rxikB=5hT=J0|ebn43ND)|KSKyI7q$chv4 zFlN`Tq>i89(j>hnVkMdS(d!)5N^2Eo&j1=0@9wqrI3<6-k@HNLL&D*`CU$H6FWS6s z5*=-__~@ZzHzdj&SYM3xi|SO-ok;lUJz$&bw|m#p$oB~1ldzl^M2oP2WN4l|jaN7^ zdJ~j(B-GM!@kPniQIhSs%bX*F>XYnL)8aG|ZV7?);SpTi(_jCAGrRS>=2K!8?whY;XgG>?m2Qi10 zaX}N;pdnT5Z;GK5%KN9q@~nt#&VS}i=3RJoAQv+#Y8yv2&qXtA)}Si`Jx_KDtagud zQy0bZ*L13@nE^!!DR_-LGhu;=ooaEU5vAbH}anL-zwK`&-LOhG9LGz47X z2Pcb@9bPS?$%di(iWL$hHof(RfhqXwa%-Nho*ZzWXI(DA95Nqkk9N0?_uKyPrx6a< zOG+PcR6Q;JqS+K$ zU8_DQU*w;N6+rHA9}oPS_&6u^eENH>1%2!5UnxR~*OpdHZDk4CUih85gf4o#$J(T} z%Tu|_Tran0BO!s6&nG+EsaS#Nl@+MM@!@G;AV1dsliBri+~#1+$*++2jG)HMV0F3L zq$h&oOMkQLEQz!IUhrV3hi59?^|H0(5IMFc(S&-SnTA}VO2HE0AN&kRNfDC!G2e*q zm7vbq_dN~eRZdbTREE8$Z8pq6AnK}8>`0%jA1nIv2K+RdPi}aEvz?3O*kp}Cl?Er} z?!BiqYa?Qe@Z2pK85@3_oJKDuu8ng2CikZF#Lr_f^r3{x?mtMDY}FZ;3Mf!cZYNLs zVPjAI5(q^P681a0te9E;L239~e``qRn0v}P^THJNJ<{M^Eq-tVZm+kV3rr<%=x|L1 zuU&reRIkUci=obU)I0=#E4xPwAD}ssSIpc(32ko8ic*cKh5^6I&qU#~j`(62!nxs{?rfQ0c z+#0spmt?{pv%FwqaB7vgOOum(UeB&LKK9-qCKewoKlp4{tvjgV%*eJ=YH6W0#a#HL z^vzaTt~Jx!<$d>?P5Qa^lQT6rO34zdX7AeO^E`d|8|dbUaB95>PU@!P=s5L%H&SIj?M20-y0BBkGC4N1~q&5)ZgNMJFy)a+&@Tmoth|=unL4(em_(0epWDZ z&hp4-TUAy{Qx+ASw(coiG|3fofLA>4lAlpxelm;?8i{H^?RZQ%4Ym21^bLH4HMp#p zogubR%3j-N-v@tAy=&VC!p9b`_-2X;Ia(}2cbt1CKDV%O&@rtYtc_Nh_flMZ((VQSm;++%VlX=nV=R7@FI4HMep>^{rX%C0}Z)h3wr>{tK6_FItmzj4t9~`a>^$&k@`9PNz^k4SiT_89MynqDK z=NiocC*vnBky#*{u2Cj*pg#%;!t(|CQRTF7dsN+hFmsaRRowxPW;UJ7W}CA zrzqOo)N9SrNp=&;LT*iN6Hi3tNBjI@3D3;)P#UyLdkcJQ-~EJ}Z1s&K^FB7sxVsVe zy7n*V33j$gvxaNN4a&ZoS}6_thHShgi!meJH!MrfsqLV9PpRpyE7czjkH&C$)LrBjtD6#G;7ya-`>{`(sjt#3UJ zPPdJa`7fi476H$LH}`|utOfnXwzTHjvG&&)Y%qqOuXLW-SNR>qo?ob*K_zC@pR;0C z@w|;6%xrSH21>ee{FV!Sq;wxd4O$0Aivo^}G1D|yfI^c_NHNE>nrZyn{c(oI97j7j z=Z4g@ydNL>?wLBjLQvw7=Y6U5AEE@y#~%d^wIgf%4{LT-cIxDI{m@B#YQ{~QwTfY~ z8QY(kBM}xf=X{!kL6RHJqp|uck-7y$%{nU3p-LoYkdAKhcFY4^656=4^&2-+CR~a< znZE0>exwk-b(sm_>ul?!EsS`g`H~b{@`3!7?KOav^hhT^rO#_CW?6(aJtgujV71;a z*gIk70X(47T?O(V!aJ^;@rBEe4}P^-enTNY?*b>dnwv@o7jeD+vW7^xM^qnuc10ux zYTjT8@t;ihf|pb|7TcZNaSB!H8C7-H0DJ(Ahr=Ha&XAkjQ?V&`qi9t@k0&N4>FG%Y z+kEpl8yBrIM@wCd%p~%rm1Y=kSaX&a41Gi12s&@oH8U+)8o@)$Gy- zf|WA+ap_IxXQGD+y#!2Y*wQ{ODGU?b)vv_>UXdD{b1m`2-rMe=`OuBD2W406PXdSeE9jjPvi)7qK{t?KeLU{sZ~pkXg=W5q}%{P>5JYQj>r>u z=5cy-tdJkra6CT+(pu{eJesbl!-k@Ij2Lhr9oVVQy=^L3N#qfQ1a%H*?ga^A6Oi2-l@KBuHVg7n!frOXgD=AKoEk8O7anaQ%?~L(k4)q={YqViHMaXOT!jDdge{lV*!cbYyYV4 z%EDN{$IG`CQxTtFBSBh8p0#E{S29Jc$@9v9a|hti7<$4i9l=ELmh4&@G+SktUlO{4 zw@^3*`1ff>YiyvgJ2O@Qyp%lb{^S_S2e(ChU(w`^Ia21dpASMw+>-T-Fd@3H6t}p- zOB8w!t)V19BagSpyD6d-j3K2-g9r8Z{NZyPh=bjb?U&D0Nt0c3jNl$X-5muykZfXF z7F!{h+ykl>?jh&}cgy19zIvf0WX|}lx+B~3aq)+&+FM>fA7{xP%ZE{E^sn&d0+xk% z)eZ6FFPCUK23}&#p2wLbvS{XQ{@N7)({#}l1*wZZ3Dq&#??zJCsGs%;@C_$NnGsyq zZYce#P`8=vfEZ3jc2n*x5Lll$SlBLFRg23Uvu_1G`ixYjKhbk}U?-{)#!Pp!tbE@f zf8g!A(hpx5YHsTDdm1#+rhn4ar0?R{9kiyV5Ck+@&U?TCJeqfJ9`|l_5argy7?3FC z)$J4%7aWCEA+j6qDyw_fhYdntE08lz@V&*|AdOy1b2Zl1acJs&3I*Fk!#{1m;fyK1 z)h1#D*yn7FqSD!t04)Z7;9iSE7@f1Jel_@HTAOM`gj^jv7(eBy;q2jSp6H9z+E)bV zm5~bu6{O%lZmi0}Cb8KMD)>1Yr)K3%Hy18;LFgEwZ}fpSeSQ7N(AKdUJU$W?O^9<* z`m^=(M%5yqKzv+KEQFTEd(a^#L25SD*w5QVI@IeGg)e*kXDiHfrV3Yb;cxf>QI{AN z+6tDC*P0n13lw4BT7Ir}ojm)K zTw3r|?Jl%Y&e^Rc9t~I>yHH;XBeS^@SHFNWVI?2UeS};Gn>!X%9g+smbfSA!s^ddu z7c_L4fFlF4SJ)~acl{`RRykJUM6}{qS^nAH;ZS@6D}Cd;U+hX6rceC5bX-Y;d!|u8 zw=>ClO7S%YX7Y40)D1YmR1+%>7H4udr2(MKgW{Cvf3}5%oxq~UlI@^OQg zp6pl^`~*7#M{Y>I(Mm>dU^=^Sz#AUmgU%p>m@z9y>$9Ec0?rVZ!S2L^NtL;;2R4+= z##D3UWfXy`J3p!{Uod_vt8s6Vo2spp?qA=#eyb`SCA1Uc?TF{w}rlxc)ZpW5_i7U+H}oX_Q{DrMuxiGHFLcGi{$U-Mb@ zfvW;u5Otg6rMvS{5UoW;1v698tjDlxy8lsl<^u#>&U+2Wy}Q39wq)H(~^Wk7`m3andSbMB3>uxf|v75;oNag?0MFnREEGJ6B$c>6Q?z zV}WF}mrqjwUI*$(G`-({p3ST^>=28YIufG>y0+K=L{*-CzDl0(4>GS;k0+0}x9fjI zW9D9FKmb=IfFwAyik`2s)NEVhe3rd!S+m)tBRDHV2?LHN_>{3LlYiEpo6iJHq-t0- zp~freY?t29>+1;s_~0)JWCR&QB+wvkjT7sW#URgZbbMsM;t8V`<^bm3A^sTZ!5iY} z;yHh*0{;&`nq3~dHVM-wDHyMBZzufTwcfW&by}aUq zM1@xeu#S!Bc8dxCpfADwaE9{PYBN}%Y>%SZ;Gj(tKf};gb4=_ z*%Qe^8L+t7w(*Ji^-(zdo37?u;v%C|PJUIj*~k@UQcWC@mVZJc#3G(zUhBJb}hXLj_*b!ns}dvQvfs zlprOWi+afmrFV1%6`eLww0AsYKg)&Pt(4h=Ia)?APoKGP0?-)w%u@Aip`>FUP+L0e zI{xh+mDPTUa*vo=s*k!PTreCLSjHoI{i6onN?>iZ#>ZBd#^@fc5fqUfpQGHjn#Lb% zeiA_zZ=a-7DvreIEX$z2W zFRcS}Lv0Nbp1izwJyY(apbk z@1TtxrZD~0&>et{TAyt{EFtOuB7*)#swIhME(fj2o|I|Wq_xcQKBIY^K?}1U<>{u@ z;lnSk^;>vJ>6M7i1HiTy8>l~cDgAg-v ziOe>2KGrnvPK`jdVh-LmIFq^uj7){N@jX_Ghp{*JI$iwlU8f`mZK@&1kCPi4g&ohV z*QlKOp^SJ(9R8|wE&*L<0EMBw5+B5aO@%9V`A`^0sIX;+xuuQy_E67e$g!@U1NtD| zMG%~HNcLUr{EhQJgZG*%T|K{HBTF78H8) zuB9cqzmZ*m4@~7K%j^73uW8JAfANbMYoiuhiVb3xEIEen=UD#aQORMWoragRy|w;_ z@G({Ss2_*I=tPmqIjK8bd>U*s8BY|`fyGnKQV*chM7&De!)Y6Tf%t66J2J=QO*<2v z{vq3&R8jc$h#V0rA|hGC3?%}7Uho=UQ13R1BHUEP!mHj+A(E4=0XsnMqa7gMHEFVvlQ+GcN2R$VB(3Q^#gAe+zndWydaq4ctB6;Mq;Ti<>)kOth^81 zPl&0$`}d7xmT~RK+H6Hj3MjLc+Sepb^M5ET%_s%F7nYp>Aut}cRVmw@q<$&e@#FYi zz6XG^DHWR=v#hRL!hSx{=??nhu};Th3J5H9^3M#Nc;uzz=w{Gop5@8GTYV~)Uo3n) z|HqT9xFC@h(Q-Yhb29-iD+RcbOFwyUb(to^u5`&cLW z@pWq`i^F=AVR&OwK@XnAp)|PH3(21M8(Cm|G6(=+tCB;i0GWu-KN0IXAA05Tn%c5H z=C7?et?dlRl5oVCUtptj<%e@KI&j>g@SJ7b?)!L#!bHXVrFj z{GqGA7H;`;OUJF=uyLmStINHJCqdtGS~aJg2HP|lH{Ml~E&A7F#6qiQtF&%BDhxL> zbPz0^!{u!j3)R}bR7*B#xL~Q)mPRf?8}BzP+xU-Cw#cVazEaHQQEv`2)p}$W8|If* z_g<${B|@;Pwf!NiF3dk-W&36AC;f!tU5kZoXq|qO22smHA~vU{!xo!+N8h}YOwGC& zgYS6znC9Uo-w&!_vXT4cn-)no`cL<ju2lDGs~)qn zZn!5=`93!tY1~%UAC!3RmqsswAAjRJ$I$Xzqj%fLHG7m+EaiEB?GX`R?C)oPN%+$> z6DF+U^a}~Rl-HTFQzE}eU5lM)$?bZ9L0g!$jlYe~>}5ZhT#(^yj-x|usBZlKq}2Ie z0vTB7SPHv~sdbLFsOW#DMX=9m&GCWJXhKC2R7vu_RAnQ5eU)24w#XhGZ&q${JD~V_ zEt~&z!0Yk6C2Lql9lRDDv&M>x;W+*`^OPRNW#}2CANDsj@h_$EkLzHefMA-AOXpei zqRYP+p)j#~$)9=v5dzXmo%q1lAE5tI`E~8K^OZyEU!+w3jeRWA@WB7g1yy%|=7J*p zafWpH-sut=ChxB$ee@b?OPFW=vkhQ`61^9{{Ud?b{&pK((LtYU&ifCzEY%ESw{+=@#u1s|aVQvEV4Gl4S zAGrm87Pb49PA!M1Fkv$1b)R{CzAFHG_8kkIu~Vp%kJVj&V2P)AXLOYsFz=Y5OU@_O zHZ}^U3MU2%Sk)eFW&M|7eJTv~iGIt>-c#eb9QWcrE)qk0779 zP3DXGL`R)*w=^^1GV+oXPC|9w@nq+%vYed>T5sJl0Cqe(ZuN2bLOZNsT%q_a1iLs& za<*uNy=^-m!XK{<6YA991;qM`xdN#279JMVz|xl43;+Ws#7l}kLPw48un>thjz1n- zQ??<+?3|p0(A|-sMPnNB1KD@GABUNNm@>uA#nB*KBkhvtf;V(C_s*n7JYIj13LsB( zQ?jbc#%H#NlEr*6WN>PMQ2BUioyr@ic4srIUz~;tgAykIzFxj(V(j=ck9lb8W`Blh zbyUBXDdzJmcTuqiQZ|gTxPyEcq&8%41|`x4^g)ep@b0LqLDJ{ z`J*SdB2vCNmN?sdoq5!Y?SzA3pIjjo*86svbB`_jW?se}-S}}G65;G;53E=UwVkkr zbI3X&Qa4=JWnIgpyeC6shlqnW#=TC28V$K8pHZ=S_J2LF=p~%&FY$NgWYzW!^Vfrx z2u#t`8Mvg=Fb|~=8aMm5-CXx-{IFO$|7H04lO*6qvq5O3Jy(P@o;;$?W(7x8=?oSx zutU&)LS4oT=s_(aA5gTDz{aO#F@>g#lm$zU1^bYeDysipB|_#y8y23qEYzK5`CQQ9lL%lr7eT{i|6N?P^Y8TG}? zlwiL$pG{S3uuUqVZjemizO5g!(D5;3G@{!;jH9~@b`SZ@SlNSBNv<8^9kRz(xoOYCVH^3n*FG|KlnEb3k;2_@_Pu~*>jle7U`l_EoT) z&r}s|XRCtCx~F+F1DiWh$(^g+CIQG%FooA{&A@oy`|}75*yV)Y+u#HZzc5FR zH|kPs-DQUOB~;H5>sPIF9Aq*pPW}_vQ-`bz8u+ObEk#BW!)i-4eGKV*rXu4*+fpW1 z`9`F0>=v0)=;0q-Rh12n-Wsdqt*_!cu}r}c^8RH-+02UpiAHYU6f+AngQEdcEE#`r zasWrdV}J_=91=^-X5B8ol3&xxm!!;Y7^{eDTPu0B=E zjn6R%T3iY1(yhJwS7hZ@&!zU0xL zTE=deCtvpFp^2uK6a?1M)=CCRL`w>(T3 zpjSNm&SjTF!E#_kp77dHx|?Ix-Q(%^v)EpN8fw=w&F1?LzTCf8O-X>JCHN<~R@6mY z2+z*%BU|aq@E#+_+G=5q6ot(|LfC#ZyH+2}L2JB8o+#*L(Ztt{ikWsBl`0xr3Bp`> ziQPD(EDClJZMg16XHWaixNClB_hraL#+-DO!xXvdGvmcW&X;m;!W<$1?%@^oOr*NX zMp^Bwo#PFgAJlde>Z|Q6b78Mrt>bZpI;RZkElh&)G&CmpNUz%w(V{%>t0)#ey59O-nTOU zt)l->M(c6OuT2mo*#>GmBKjsQI=b5bYPYrW?|GvPrvA0pds;%&| zYkTByL-a?f_hBNf`dO_R)v?tR#jb$bVL^=yo)Yg*^-xF&aA){-EvwKbWQT&uTLQci%DYNSWGa z@u-5sf-c{zxTjGwbl@$169*}FCmuTYn04~>rug350On(*n=(q4)>ySwRnk(73b(U} z8S$1P*-|Z+gxJcuC{FX2j+NQgkD%@JXB{8FTv5+%s4RZ4HQ#;cl0OsvHVQw9y3*0^ z8gLpC_L2Bgx))<9BJ0sV>ohUb9Ws5Q?s5^@9u9ruo3X_-z)NMiPY19HsBRo|>$m>e zAvkHBR7E*)%~cm}2tnNqSak%9DGIF$`Ig{@vU4ROh*|^SV6DTx=j(LBpvUSRdvb~? zNb!?@sI?bcytel?{Nzkb(P-#P(1ax@x@BNOrF+$vZ=bFw<=A!Gt%im?$j|WC4!jQb zp85X*x)uK)LN}lx;yn+cC*B*fD*^W&_xP8KygVfC{Zr3;KEaaz0UlQQ^tR@&ooHXt zith}?Nd=r=0!47G;C07LUQnY-mAu- zHGDfk!Tpt#ya5kO%jDj&{{IS@X_{sM5d!~Elgj>>)3xNiFa{hyb_4ayBQL{m^%#{g zpIacywiv-wWuK&cwxncfyQ}NR!f6)auipK77c>tK0kT%?+b74PA3t;YGuoi3XQ}0c zvyruBJp^!PP*u|uK{tXr4)sI@{a;mb1$j=5#w)IK=*)_$PP-PL92T`!L@J0q^hP#= z+YDR|2z!_MJZYWVr>u4g6>0(FL5mQz+4d3|x;(+xt`kuMma-iDq+qpAzjepPO6F8y z4Mw3xL?q)?rA_)NmLI>eKmD^0ZTEqb)5%I*@}G|Vx6hme8rUzgU&)V9rvW%nCr5ae zI}@tbX(qn{q|(ICE50_0fo;jB&M%(VA64V;B#-UTr7S(CReW$40E7C^Rk>C60!@rt z8mUMbdfgB=yQ3nz4Qr-2foX%Rl_~i?Lmdycw!Ta;iW{ZPymTE&Fm7_}mWJxERlW>I z^q{f~cY625CHkeTO+00^h=XS`wbk}(NIcCI>-Aj9>aXuH#`HW_<)Vt4tp_uVZjely zPRyw*rIaxgx8f) zG_A~PUnd`NcsDr-`OwNdxDa{CPs-X+0Pu{RwV=wtkpS9$N>(5HX- zCr~xmIAuwn4)q0Kkks@9Cx0z&tM=&4x=$a}u@jx+GPemuN$lA2_ux^e`K8{XY3`Va z=6(2?heWgY*AFJ&vg%&9>6Ih)aOD znBRS5Y4Ty?I;Ar+RO?f#nB$tzb-%uoQe8$};Kd&u)==!uX_ zz3*MhC8KN>Hvc7KOgE!-&pa1d9+6Z`><}3F#Nk@CoyXb}=0=e-fOx*2pGn>Z8T9^W zcy{FQWdw0A>h;Z((jXuiMx3>H(4hQ3p@&B03B-!W9C?>~+4|q;1CQb+K5)yUGOQ*q z>lnFZR?7@zqq&O{!v2LoXwzNk@_lZb{1*Z_vj5*AkoXBZG)0R1fhk=;u{0dV@nzH8 zc!jte;V+$EJL@hB+V7Qzr?#mf4& z31T?RL!~xixnfGXYCGy(tyKO$Vc`aMnHYv(iCe?lF38knNR6Mq<4;2|`6N7F#>gBz zAe}V8oc~ZW8VH!0vDy%8Ma{KZtc-6=H@H;#p1EH<5;;Qtw%pumpF625fxGWLIws9*ZFK+!9< z;{T(~e@k2kqhIqc*7g7WM|P0$z00mMzXmQ)LtTzXa2Dpk5<@?h{0V;LbNfs7{t&wO z!ddMd`ZY4Zfukfj<`fd*Y9o&R63tTf_dF6`ocH+4RegJZ*}q5wthVs3<{RA)^dn$F z9v&X|hafa^{Cj_Wus3qU(2?oCVPHKSa#i|o!TMf~w&|Du`yT$Ue_gm1nTkYvCqX3S zchHI#Bm-O@2L0)eZU9)B5dQx>&I(eV;pO(ZA4ZK44B_Iefl zDVnlnLw|=P4gELRdKe)8`J2nOyuAE^3H`N<4zI8oq`F~fBx6EZP* z?pl$lClQ#qMKGy3W@e&Of6y&ny*60G2ebP1bahi+C>TV9R~clA7d*6t-@a=h5vp_TT~lr_UPOWs0<_% zFenlMjH;Qt#gDDYd>W+#i!YX&MXE+2Dl5~ z&P-x&+5~dm78v}17!u%M(tu1#0#>WlaBm?1{aGd)5n$f*d;HN0X$V?+0v4?(WL_#P z8gH9T1Bw?Y@PX#-5F#-5dDf-DbER{||rr z!z+h)H1G23H9F;w4c}$1#-3DCXV>^zBqID4MiR2`8!mNpJRsbI2f?PFUcN4XF|%m( zjN?4)e5+w+3atY{k=M5ZH6~Ve+jx5|JHCVcmveI6 zs!p@Y#RX0{5!g2{(1@9W+DG&*)B$=6bE~kr&zm=Jib}#jmkPq!xdA81kP}OWF=p82_LT%h zXV!rELC|A0S9A+y0yVsT_7Go0WS}!yK_v;q;?wsrS7E#~GYPM)bte+Xg!ev$oyuXh zoX25;@F_UN| z((Hoib?OH?e!LD*w7>;GFiMLJxV@$y3*#@S_91 zkA7(+1h~=A+qLIESWJWfo62k zXw!vTiV`q5@qI#!E;7xqMKu(ie!04}2EPXuuo}7AfRk`}!zoDi^+Le$+Z%2&S0Wyg z=V!%JEc1>Svyvbs$nqAWAgpKTy1~ji*z*q1E5@``J%{$$kt^D>j>&;Ch1>JC;&(sY z2Fi&$J13>~0bEXtAD~m^ke9Zi03vyK=kiksaFGZuKsoXp4u?+#w=Zz1VSD--74=h0>3drTv z=4K^ABu?Q>SbDYL%BcJZ#~R5CUXALPLhJs3oN7t?k>QDL8*w-sBgjl4yxZL}kfeKj zV03dxmc3^A-pZtyabLgu99>l&SrrrZ6yOC1eig5DJ#WYPakcE8_KO&5-M(Z|tg5Q| zyCJeCRFKmtTZN*vI7k+1-Dix70O(+hz?cH*8lGmZHzkO~;ZsvH{~7^XRg)vgsA6eOrU6g4#U@ID@fwZ)mc0S9VkN75+je6>#Tl~cMI z66{>D?=-%>k~u117y1#lMPhB(48#DUt0r-sG*2=6{^M3~^@;iiV{!C%5J32+2;&i5 z@|Xq1+s4VtQ$^`ZA|wa~e*dTNPhKy#yN<8($nb9$V3u6`7}3vFr{4-_HU5qZ-8>cd z7>K-ZcAXYe&-fRi_rdhh$Bf-0bjj;@{woV8183mkUw|&sZa0FuYA3rT%Sk$C9E_12 zc7w#IlM|d0EYAc*(8=J%+Ta%Hp-$;lj!3U5GatC+;*X};^De1ic)`^)mLqC!37>zt zkM;fvnL!Fl^t-UMBUir#!4~KHK4UhmeEd}xmwl2N$*5{cwYTWz$P5G#QkuEDYh-=K z7w4v$BDqvhB)f21N<|PiN7OCcO5nc7zj8sg7JFykUuv0>0wbv{iYffiA4D_^$w^63 zFaz(u`)ku?W$z}LWReU8M!kOl==6Xso}|BjaMJEd+w^pX@-S{Ex+s<}udE<1VVzY= zfRWhA)TYY>Yzjy7N7^?tQ;)<0{g!HerVrkT<~)E6*?fh57J)Bycc5(`Ia{JXz;%V8hYDN{Sk(d#Pj5Cqt~a{e zc1Qp+EqV6I#Vc|S?&=kNMTrQ0hv~0^m!LN?5rN>hwvB)^zIKwbpt?fFft$zgs7M3) z`UZNZpQ?k=4Iqgf_A7TzelN;Ic~vJ4}fTmVi{i?T>z4gR@%aFebUEUSArf*l9c#-A-vDq zVY|ngNz0Tt;w&GSLROKzZh91LxoeZh4&sRVyW1xXn`NQ%A+htw$9;n-ATtjS2X_mN z);&X|)64SK?K^oX4to&+%f9<5b9ySEZ@?o~2%+iy_M^$^eJcm|3HOgz+7tk@6{@^E zF3J}Dmmot%jxi*sUm;5II)?WP4(eJi4L5y1b%?<$ zqUxC(7M)P9-IxaNNvN3AyRi=_Ij93zd7b ztzmRHs3Vr7S#B08N7%^C45O%!-MHN_Gq+=A=5B@=-;e6?ef<9T{kz9L*B+nGb$#A9 zuU*&kHP{=>Vew|)=L&jf9g4R2fGV9TCTfd>39jikM^A4cBm)Fi2=JfCOB<%uy-hgi zJJEaEEPx(~e1rI68Tl2%nLl71gM)?)SkvmxO<^X}`lwx2f0cjSnj^5}%U@DqE0&VZ ze5KL;&4ON|zaBn1S9}rhPj}k%=ny<-Hv(8mFTKj9D@6~sS<)4n=q7MHD5Wtg3YI17 zfX7RcEl}gpc_aPM#2*g+020;bqSHlVFa&bHVA*V?8@}Y*2!r4>Q5@VlZ`H{9p?>_n zOX(gxZi(lC48BgKeczs$s${iiJ5JUFZ=Awg1oj{M6kNYfw3GwP)_6&)t=iw6e>^<2 zcpapbTFtOWm54ks{q7Lcz!Ts$fWhiVB91Af@aQMi+pMp}09{7&`2(sC{JPJq_dj=% zZEZ(j>e#-6@i?CAPxqho9y8@fb?d#>dbZcN<;kZH@vFZ$PnURu!|L64#%+T^{s(J? zpS?UxI3?Kr;i4*GpkX0eTE(F`>(fG0)-y%%XR`H6Hg=L0ydYDBOv&Ut)}Z zdD1>`E@}^@v}9|n$Oizq-ur>v&$bv%Gif=d9O}Q?=1)2mvvOODuQ+4Fe0U^^`w``@ zbpM)#|(3fufGif!PlCuDCio~a(Ie2 zv-+t)xg5zYpJK-7+)DSn8|V`2?eYW2*R3)V)zt6y!m{ni$;vMRP-X~Y!yJ8BNm7(` zDr99Zu)EqbI;!v%!jbu9a|I&y-N=1zNxeSx7+-^a!X^29Al^c|`rg89g~?r3HA=f4 z0ImZ;=WA=~5OU$oMF(sG_c@Yr=T^iCP{hA~gh=e9H-0MI;^YoF?3le)TDx^LtKqOF z$a1aQGdR_MhM_3)G4WqOE|%2KW@83?67HEWt){o}KL*A31y?@NAZs44>;mmhw4QD0 zITTjMEQUd+J8AEHGe=2u7K>Z?>x=Ys)vv|+O&h~4W#Q#|`CBUA)obn!Ea=0~_s!#Y z7(hK{_mrA@H<|QQaAK=i8ISVAi?>P8D)+i8R9+}$y)cId+GwTjQN^Zx!Zj;wx`KO4 z>htCp+awDuceSp%7G*lUlznhYy-`6?eCuH#!@O_zODQ}a(!E6Ine`DFGXBTiYjV8HHkPg#n3@aKGC#T85z^- zNh;iydSmd}$Z;3;M)8({++2q7ho>2DVu0wR$74v)C&om+uq&OfUJvPv&YsOOAC$FK)t`*6oP zegW?!8=BqaY#14e-4QY~^q2?;bj9aQWn(E=<<3c=ZR5g!oGuTgmtC!LokHib?z-vC zTC;P~`G5r-q{Pmx+SYdE0iF|pF!suR^epM%x@EPI8|6{KK*FWl%Ftz)vC-&r3#9w4 z;~{4ULc5mLK0)R00Wx8kdjEm+WFVBbs=19aFUem87v)#3qoXf7ZPNcu{%;cHcgwd+ z3gqJhL%fJO&_*}-Zs2#dRBulJPprDU93K2EYorvFfyk==C*CNgdxHFLwp6@6&j6>2KwX3AN)s;_I!4=3_CBaw_aj z?*VetORvxel@aJ%U$%mFs67DsU5B`J9sf*0&(sA_>F}?8B@NF%&YnKFxQlzCZf2lCx4n)@Li*aPP$oQ+3D_WbiAhiVrF#rxxVZyHCIB7PsN`hj$v>DRMs z@2l>9-b#k_R>$G=+Z}J5o-U2b_|H-vH$^R7@{nHI2+*IxMv`qu{!bo%#;ZolZ4(F0 z&lj8y*Ido@P{iwR1E(}UOo{_$3h0d5KCp~smhG!wPjPG8lcD#W$~G6;<^Hdg<-ll1 z0cXs2><8y_7{I-)r(CrVKn$x^TgQ!l7n({=8UR9D+OOX#p`6nrt!))|!r%x7+(EU%FLUa%aM1cPKhljLtky;1l*2ob-wgH}2I%}iZWU3D^2@d~n z2~@KbQ>OFfjV(EM=aassYpPS@ZdJZ_&B+(X|g;cB}5* zRc!P$+2q@i_d|v7hOLiOLLEc5ep3>(HMh}dMbI4Tf$y76PK*C`IkawXv^jcxh%;9J z2>l&V!BM;+uFUFNd6~2E;kC%~VYYvKmlKXm2hnZ<9CrJ3>gM%p>mu`9Wt4r_ zrOXher;LCsle5%!*3NFdsCjVyy!obV_Jcb|mZP^GT)*ncldlFQCDy>Bx7GR9BJQ(E z9=UCuGnp{)QxZeI2FAXIfb4+8=EW0bTUa3omM0+nB0g zvZyKAJ#uNZLeg(qGq@A56o8a(e&kMF+BplPTP8CK@C=+3zsAFkK^8ykKtaXo=94vm zdId1_V`>(M5`g$)v%cNOy>jubs~`un@}fp8S&4Q>cKtb9N>n&TE;fL^%&~|mjC6w% za@PiXJ_16T4@!q-UIw-<$XSZP5*4WiAg;sejz5U!!BQA;ib5d$Lu~d>R6UW{h_vN9g;RP(AQ5dht9L6NSnpY)&?5t&FRgxeeIkI^!X($N2UwI!5qRw7d9a$BM>Kqs0r!tLN=p6 zZg{s>pNa5Q3nLxpbAPgeK|hrO>j*0#bKK@$-JV?TLygD!`a;Cqcrm)snt$AA%n9Ei zzEbNH@FnO}1RV*EI(t%#v#}+cvovUz&)f*Eh`8&h> z<}Ge{3! zZ^rWucV-w>IfYec7lG@hrf-0?{KZo@cFt3$v%-Fqnq~F{Be;1ip|PbY1dh)ncF1%K z&*8TvZtOF8=DZ^^y}mqm9^5BOoVql)|0vJ-HGgxMK9ZOkaITvZlsP_jg9G+SDz!jQ zNyDs={n4%!42`*I?3Hd#J%4j`qBpD?_PQl@*hh#YnXZPnxoa+96j^Mk{vv0BkA=Ei z_xOyxJc3u9li3N;*;oUF-#j9hOYwwPQ>A1Fl$q=2nIUX zOmMHKI$c!19O6l&qvGKIvP4&Fc!L%Ws>+-UCcx(itrWRuwZH*Y&In}h=%g%Z5BqYhvbip{?)Qo|Y>=oaP0DII z>V)qhH2bCUl)%nm1)&xKx~z!VA-ckMz*ESE z98C8$uYc^98V9e7P)8{zroy2_j&!`D570 zd2Lt*sd8w0xI41W+q+)&Rt~s$4_CNQ&h1-h*6=we!!jdW;#ssv)A89IZ!A@k@>c!* zd`~qtXy`-pw#!MxUuj*E+loRa!3|7W&MaU-Lz=gSyL({8UUFEK^NIL)qbkguF(Gi{ zxR~cf7A9pq*mi6eCY!FZngzWt&B?60X%&Ajw+9r?q$6Ka2u(z^oZJH|&0tbwjD?Ak z?VP7p6=XvRnG#S9rC#FCB?jIvxE(OnLqO~x>`Q}uo~yn2^9!$7`ErexqvBkkpw~25 zsSkV7B&}KR4&P3>(*c5Mt}Uq*X6PPfq$QlGds%N&`+;5;G!qS_FsoLO>Z7wQ`V^%< z4bt!)m@fB2_-a$K)P2;-IQLtOlsitXCcYR3sk}+nc(V*AA%>b(Sg?8WCKn-mu=atEy8j3v9WU4hi zR^o>1T#^vZQ<-bc+H;~+2!J0pR2jJPE`YBM?yx47iaIyn``fFR5u4VwZ_(h+91d#$ z)~dn+e4&2R6n!5)U$3C?8j&+x+ZNI6*L`!-CImmA0ORx@z>$Oj2lr2z(Tusi&(YkU zdxl9MzzqkNrJ{$l=%vTzH-`34*40vKj}*EEBF!|fUSJi~{^j-=YEh+rky9jUhwoc( z;S^BJg)?pbo%VbOTq+4-Dao4i=te1)SAjnFu_Bn=T-$W?=Q5soX!SFT$f;%2oHQYK zTFWylgv>!!%Lg&0EbQHQ|D7V2<(d;Od;C!z7ppSOxqaQ7=Z=EPI3WHBR#v;I0r=3! z>qP3U^k8WQ_BAe7a$0^4YX-z~NtZ!Nr z!KmUHZZ_F41gO56F+LU6+W|#8jgcYOd;Q-7-|#Fg)5~&Gj8OC#4S7fVR8t zv*iz5X%w%%+9Mvr*9XbqaKU* zP(&PG0}W8M#{%o}VC6Wrg{-q8V!PcppcF>=K_JVDo1kuSv1mpWpLLvi=j1p$a1x!fBOHGL^zym3QizU*S1a$l|R%2XJu4u{RGMx`=2lrBUr zt9!1%p;9wsWq}*TfS4gRiP6tp*)*J%I(X~ytJT2OxhOi%c#xeh5k5CeiOQ5i`qTup zK6GJ-s1z;Yx&yk!11F=`W7Wn1I(A{y?+U9%L)}nmy z^l-_SvN!C)prF=0Ci#sS1qrK%Qq*1s5`ykNzN(rxM!Ao3cQ;HrP>5r=--8C$9a&5K z^gF*seB=2(xhfTBDId7*@pe#_siWmLpk&m5m_4m%`f<8OQaZH3tv8}!OD88d(%Fk@ zE6jdxlhyyH`VhWBVxu~97iO-8dt_Sk;STf59@uzJG&Zc0J(snY1%CfQO(Vi|S2BG0 zryodd`9wv`2L9OVeY2yF!7De*TOYOEH$ rDk)=K|)1B1q2CcLieqm{GInZV?$lG6MQEC007%vy*m#907hZj zKl(TmEoRRNgr_+Sz7KV^03|)=muP{b&bJJ10RZ3NtYq6`v@pvvJ#$|GKp>p{XMoRb zIsyP6B=6q2_2`8S?tt~9)ll#>iMs5E5Df7Y(KvG&{^1UyCMiZXxo>_!o{7Y-U;>ZukY=kcP6-p?+KA?J^xutb>S`GN|l9Pat89|%+c~E3CrxAi14-%n|Jit$^oaRoA1<>c?{u_a?3rFHj_{}^Si_u(bT!@ zfc1}L!J+a@?e*W$yLWvb1nYs`DDtU@6JB!>@Q5xah^%4fDPQ9$%1e&+y3*j{Kfy-9 zE2VQ4z->!wABsX3v--1#O->nDa$kLJ+1VQ|g^kC)b=3%*8BWSLe-=>f=dD z+obvx#rg9e)3a->10+1dQv&;vb%3p%oopOb z&~FS0L#9I)0-$Y%E|I1-V8^i~As{5nVLt$U5S>oJP{Bp%>Mu49K!H2IvOy=hT8fKa zq@?$aH-Q?Z#(YUS2VdQE2ysf&%usgeYgT;PY_&KD}SY`TqBJU zsJ@+#2O;mr6XbQeh6@)ofiiWa6Y5eEIm;{WO#Q6B7|N`Csmr{9q&`Kc1Lwv(NBk4} zK}T<-5$t|9RH65@r+-NT50py$j;ROH#J;?X}6nxI0Cu;9a&nJBM1FQOR zO}bY^y8MUk9RR%wVX!*$>qmzLcla8V6)+r@edLQeJzY-gP>4ec`8M6J7rp)lLt&+R z-)+eY-w~$!Vi)Ruqhe0b3%aJDaj+zD?)>?Wo14!y@}c_{*5M^r+2nrEAMz9;N%h_x zT^i)9^W;ubC+^pa?mJa=?AE4yK|{=^j?$~>@|W4Qv^KIzhx`}o z`Z-TQXwLx=1Mj)7IxMg$4hp>f$Sic2S=N-&RpdLRrYu^EfzCV2_q!?ulV7X)&L*9| zp<-J0WY`9j?9nvuHd@w-wn#AS3TWDStLn*tvKTEVHT(FZ+Gc806`q+zFHLlT^ayx1 zkk=-;$`aHSUQ|-HF`0;4Odxj+EzNADJ4d&Fv(FbvtEx)$OvVSLt5cFxoqBwK%dIF) zUc;i^7p>E(ri|G8xkK@Y;UXNizqReH)C1Ae7jLe%2rR>>;D`?z78v9BW$G zHXZ#xNs`R^2X%mumfVaGJM~v^T|w|Ku`DrTw$I1!uj!st+1gCqU5mC7i|P-YfWe zd!nGyH6wT9Phrwr;>!{h3o9Sm?1uAi{R&Y+OYQZ3-zx9w23Ifam8r^d68Lh%5_MdHB{pxY)wSiTA!9#5zAB+j0)tdl?1C7C*xQgjt|Ov95> zrncREuGWb(G(gsB8sx@=6m&W05Pf$xuBC3g~TdHz(2tWD^4UX$Un zT9!y|0$l_D4oq3cJ>zMUN#$T&QDp$Q$ykSc;|%2hGJfVWWBhzf&r((a)@^X1y3*L9 z%n8Lb+Vu4m+|GjW6A~d9cd3fp|AKsuKgh-NRnwK8H}2IV3x;Y3X4;-VH=X77dXEg@ z%Y~bVzI;TRx|d8!S+1Ud-vw)47St{vTlUyIIO2&7bW`X~H1p7S>V-!GaJi#l95Ds<}=GeAiSKAPFE%e&Ju z7!9KoPn=CrMm=g*lAQXMOXzag)(O_;b}vc5m54|i@g~k1ge)390RN^|rrmUEK3(e( zJpRt|lBxIbv(F8MBTS>lyLW&dQqN$B_9d=1D}dkVeiA^g0p2QkN0<#UZx_&wN<^Pi zVZ8Ati2=ZqTqEp|byTQR@ds^hpMo z)SA7$fZ60rDc*lFZ6L`W$qHaOO5+!?HuUbnpVxVhN;(Ew&^1nXx$pjNc@N)g<#oO} z8J1_^m7cq9YC+`8h;V&#dN3F|lUiLfZ~7cN9VTk$FW>y-z6)m2xyxx=kUMo5eJ~)! zS>9cq=sD>X{a~~{%<~&5=vy!c%2I~;$GQnwoo8^<=7}2Vl=D2U@Fu!qvTa|3D{MYF z{z@uQZcEib?43Q&UT^^c(h4Naw>Y->)w%1+&nJ0~`dDOSY^tJy#`_!b41l@!?rMWt z$JO~JkFM-R22HZ7E)(eDZ{QxH%wIG2Ascm0pFF4JM!zFaPT^CpZ(*8<%B*jN#=R2r3JYuHm{e$ zf&KPAU8bwm${A$tOUcu(_E(bJ3@d-J+hnRnlCgC5^RIpy@GbShXG*Z28|A*0)lS0+ zQlUu)Q!Y5eNw&*=_|y71$!RR+jeFKIMR6l(C@ABL`CE)S;AxgiAoenHPmCJ0TuJUo zhb=mzXwBN}_TAbVt?I8Mru%fbY1BI{%<5{WN}D!$BO1^R(3#dKr@;IM-))_D(W$#l zK{^+=Ysw~X_>kKp=BvC8P_*;hfA#bpc)pQGL(BYjYKOC(kFhCF-> z2i>+&AV^`qS%Q%0YwlC-*?9Q@0PFf! zu_=#zYzVu9O0{JUKsA$3;MKy!xm8C@M^8YCq>8Uqbb|}!W~#i;mqXi{yWNSsqPcMnlutgovz8V0?XA+wwoGCjcyiqQK;LIBlH_uvv-Es| z{k)`fJwEv1NP|#^uhG(Txv<#S8Ov@VcQvWUi4whnjTy3}JY+Z2qaF#GBpQx-*whEc zD;+IrPH>AMA+|X3(i{^f&h<1}J}IrRZ-YJxOi#aoC8a6NC*SaypBvihs@D)zDaCpu z24J~MBDM|+sf}(^@TEssK{2WzlI%5le)7dI$&Bi3x0|BBy6xUmzc5VMA~`sRV=?-} zuMhP998PV8w)NzSeei+yw)xO{^RxRXig)B}4S32#IuQqZ1s}aEpPuj5=Gjyd4AA_x zl?ET0uYa^o9UvgRVT-PAZd>|!D@rDKgQp@puF%npVZK^r5IJ1Fe3Ei9;GW@Q*UO;f zCw+;HUZ|l|g9lh~{gj>nAS4;2VOg8yuHcb4p%CynQ0s--x@o3XhW6dbH@vZJE5)`a z7+ia$pcz^N_yEuh{B}b>zJN4# zf{&D}x2+oQHZG&T2Fcr~`*V5x-SN(hxwtp|!a&sxGsOr+a}NCZkd4D41bTO9$*~bv!)R5a=G!_g4Q2np@TopYaGOWi(?T) zxR`w6Fa>>UD9Zt7*vZW%$xlOC8(>53$UpwuLEZPR#kdOr5(?dZ=$09W#=IF0sR4ew z$J$fXA6ibTdLFSlG9fuJF|qZV17@b)5L|CHbFaBe$EEJ!*$#4z>P+g(!J++ozB=R; zkjKG!Ov#y zo9sRI=MCZad}TFr@fcRU;kxG2U2@dTFb3x46)lo`)U9qI5Tq1T;;QY)`B6yH+}+%+ z2UxgK^lUdRgLCmwk!#^S=BOLT+Sb-4!hj}1tZMJW2-a5m!4@7>snHPR71A!gGsO%DE z+u+OA%Y0c0+FXWJ2`%W19;VE*#-5*k^uAGrYW}iVEG@L1#s8ds?pv5uWNJTo6{?X? zCxA?^lFJ*& ze|&vr+fR|0bw~%nYqj~ah56An>Kiv~Ro@MjcM=p~``Xs{Nb*K_+gx&~#^ousgNSlR z{noE5U%$$S_5XZvdVnxd+H)TBT#|g2pXfDSbz?$>#?&Fv)%b#kEaYWD1P0;acF z*Xjd0xi4Fz(fETr69sm?QTO4m&#|s}tLldJiTIVTvg~g`FG-#gQP*wsYKIcrFM}fA zm~3sq-?vHj{rD~z=Nzr!98KjwfnT&{yt*`RHR@S#Q`D}SDxsp#?#iVks95T|aMNl3 zw;R|Q%8!!wd52Ym1Si?US{tTrpp#~()(8z1P;1oV(+g>7FIK(h%4+j|`e$PgXoH2} zagjSmNg=;Ku`p?!sJ$@RKrk^;sqvA!PB z6^PKAp}lMM25gm#!e&OA?0W9HGX&C)TlRXIx#xSz?Uq{!+x7R*3zDV9;tA9+{NRA- zbXi4YMAd4k*mps=eOvdpLSoYEZA-^3{kc)!=@O2L5EV*(<-&zVsV{zDKKH1vip(7z zdEiDBc-@3MDtb}ai#z<&Vz7QsW3YFk=2V$45Ca*i6^cj~OpQg?*J|DKi8WC*y8DfE zowT03i$%F3k~ngZf;%_la7|**yPcGch6bx7yH;rnkO{J#in(WMiuoD}*8~==^!n#s z@ST&#%r~iktb9tzztBej-5kYXs@K|vy(EY)nE)ZVe?I66_VL9qiDog<0Qz@1E3RvQ zIOtei!e#NMFx_)q;2%qIw}AH=J)+=at2otKf*&^_?OV(1P7CfE_=F^!P=9MsWEYPZj_glP2WW)dx=fR+-HhE58+638@ylr}4gD^uzO0@>M-N&8Ak$eFU6m3Vb=DW-EVkdBIi ziHOWZ0c{N7J{N{Ib)u@SyJ>p7oaP%1UVwu4m+}wpqg5wi3tqMJcBaR5wC?r1%v@Mf z8by-$YMpdTpPk@|eX`V8gq`FELkA~$B0G$Ma6i8@m&*eD^o-26_Ko4mQ`M$AJ3rcO zTnFafWBsDo?!v*=t`8f);{#%IOJY?b>2S7q&p4^lySuaHG}_E#58xo^eyegCf=ajR zYOut&UqY*1a_&j%FhVD_!B!2?5>5c z+WoQ^*Ogd??YcihBX{;*Hueua0S-vB8IRRPcja6b96*wf$Vz&2U}?PgPw<)*Ae+=T2+i;v&cmBpn3f=erj{ZMCQ z&(uO_Qq0cel&fHp@cbl0y1Nrcf@rh*=?3rpT^H1?=9uwyg?o6mXrAGC{`em;T@Oi} zw7u)10&*tg3~vw#G-Cc3w--$ONI4-r75@N=*KdvYe0YGE6xbrI9c>R#Vqi5BUre30 zuK_AYsN}feK2mJCUN0WJ)O9Xsbcvs|vzsrCRlFtg`MZrUy<= zDHr!ILC`)gX^YuxdEWngOf&G?@9W zS;$4q$`5Vvy8)@cZ3qn|RPEp>>q*Q=!;6uIDRvF%`}5D&7Zx;1|CAfp-Hteb$#`ZM z1jQAMMZ?t;vZ_~>ROa}sO9;<~h+kA$f`=DM5j!<2GSr6TM4;&hUXHfQzX_cSyn$Q# zByQ1b*IR93oN}YgB-V~zFn6FqoAX~2H@?I(PHY7O6dpp9eK((3Hc-f)^l=w>8ENJ zZAm$Ilkz-fJhzy&!3r0y?~`p!%u=eyWxHlHOm{OhDxNNV4(Lq3EDfp@et}x65g{M= zEF3{;@Tu&Tb)jpPw}K?KJ#}&}dN-z_8Aeq&L!&^h-h{YJ6AsTcdF2|kJYxk|B!!g4 zcqL^zFFXHYVeo~~y&oJz;e)F(nL|GVM#I$$et`R@^f!5Cc3EjReI89|Gt+z6?jfOX zHsm1qcp=Qgb1U${9~X7keZyMO`O*@cYnP}cucUY8s5I=sPQ;!ErWCJw`gAP}s6+iZ zwBtb>yp(&l)Jd)6@c@+AsmjYPhn`Q?#kcd+t4Uq2^F>Hpvz~!zSINugw&VpyqodW+ zsS>7dSv!!yqP>N(Fy*QYWOF0tm&eo%FO7+d+U#Axy0AGDqVGZi?3bb%R%1%6@MqHb zppj$DIMb1Rc<9Kjllu8fma1%bjZDGp?PVu9>X&Y1A|8|u_t-2E4C?(fTYdyjh<=hW ziaa@(KB(@T#bjG2agXX z%m`4XQ#7^|z!OcsBn(rcNiF@N4esStFpmTdBAbzrnv?fJIYlxvP-p+dRf0iV}0@&*~cE^ePZGMmQ@SijDqjsllo(^%Dz?}1}J$^P8I{b`Df&X zFRk0W(0Ixt*e2eyk~F%W2=^VFQs#FI_YPDrdHS(BsJzy%%i4BlbGU2nN}~YSjJk1w@swD+EvXyGWP2!f3kD-MzXjB+1x8e{haTJ<`24Q{3Hggc)2m_Ca2yq z#MLQcZvPnI8gP4xZQUcT6L?;}^byH1z$(UP(~D5#(7lfs?4NgMUxDxb`5iR*(h!sM zv%#?5)7J52Uq+i(y}|xIdzYm=&a$Q3CA?8`-szS@T9}#!A4EN9-VbKiyRiQK z%sgVR18v?LWZE7cY}#%FBNq9eaf?-_L}jBaGr+SZCCQPaYxx9sEODYF*>FgNa5U^C zgTAQ2kpO#N7egJww2QXMm!HR%F8szKhnsr3hu6UNSYX&Me=dYtqd2K7>GBD_G_scdv&D-sT-*QGq_dQUU`fB_t<2pze=a)*}@3e6vw0-rx zDR;^8yOwMnsYfMQ9@@@t8+0! zzf0dA+`Hm6j|frc-3A>T0bFO~4e7Q#(XLZlJVjV6hatR0jq$wws?`Tez*UG`CoAg0 z{U5{>f!rC>#Uy?;+t<7N%N~5E?ND_Odr$2p0NiR zMDrsY+1v7Km~zdkh!qcA{scH1^_g9D0?P5~*3V03p=PyylsPQ;2Lws$=D8?g1+it1 zlGd+b1%?N<=8${kjjj4^GWYf&g?gI{VJp0VvbWvdY;VV2q@HJ=xHsl>Bt^3jrgz}L zRpoy_O0wEC&yL@Fg)lMl=2zDSpMY<3_psOXh2Ea53oGb=slqwZAOF_}7J!}euS;AH zk{B*e#PN6*t^C&KP3zi}Ss0bFq+ESQYi30@n!4p4ikxUtv7O*Wwe*owPZK}jclma@ z_V2bmG2TUNw}n2@S8Py@hhu-o^?4#{FAy8_XlKeX?M&VhAmF>*Mzvy>h40LfnDHQd zsG|$R%}BJd&Go@MIJGfFitW-0iE-+q@H6Xip4QUiJM!@M8)IyFnKx9T%&F1pxZ&Zi z%^KC+C;Y$0^y*R@2Bco#k{DzbzOR+?XMXZKv!e`$E1?hO+HO5g)o@nHSx?rTHEDTS zBtc%f$#NjH1>g1q{-lu1CwZtT{lRTp+-{i2k(9{S$V590X)D^44O<5`?4s}rzK(6B zbCqnvip2Rc{c__9|nljn&zt0fNHb>Dwq6`|+5!y^R|!{g(a6 zjR>C_L|cH1@hFsz(>g8!ew?oABRml)r}lilGaXUdK?u=)C`Cgc`^PoQ{BVn0in4yL zPo(bF(o%1S1CHva@Sod%)^U6=oP*HesdAid)}CklhqgFFXd!@J6pQBK8(x}EQ(4xu z3F2<3t3{ok&W1km^ozLyh(G)G8FW$eHQiKRAy9zt&ANR!1`yvsX9b4i$0R>}-0scDU6zzHdx8z-y@8GvYRzFWd+CnTG;4=MCTxUb@`}#BK*1f?IQSW_lDLR+sA#Z2u<}NO^1X zf}S8JjPDTm7QXWkGxK|Wh*OUZhS0O&mfkJ+(38LPv0YIg9~_)b))8u{IhOyV-eCDA686=%rP!2KdH z*2c8gb3Nfl--C`hAEK+DpK+b1gas=y7uhS#%LsomwUVXFOl~||+_*KZuJ*!7!1{Tc zmtNrg-cMr$HSxw`e2JQvS2fE$re@;V_*;;RcEgT|0k`f4K*7FiOx6I0i^8?Jv!?h9 zwHnl>SF(J=nN!0g-dV60PN143pQd5FofDj?;S_JOYj5M)L*jCCI1T~;Sntnwu9P6G zp9XJFGpJ-gq3;$3sR~5hh&GevHL;2OH%LcsYMV)k!i=*9Y-n;>h-~2{UAL$Osozz@ zjADThx?BqaL#f&DRVEuJx;&_Cgc!deHLtJ7@9=^xo#eab^31*NUO%=Ux%QQ%y$;oP z?ySs9^Acl~2h(sMR7p)$NkT()DB7A#rUO~7;xox!);N+*@DKm}IaZS02~=~V9k37c z+s)dp$8m1|L;f)++i*m*Ie&F9 zC%q>-YAYNRbgxp1JkBRr+g|7P8l)81gupKWI~tG zxE&Z3PMgUJAu z->@3g<{9K9ybloJ1LeSWV^v;qSatm0`cX-jL5mK}esTvd^sTwb)X)3jz!uwdH4gGP^a(mysx6Z`lvYz(KAU!Mc^SD93y)B|J z?aJN7eO`Y{eQRv?1V6*0LVwprtCFn%cNx%zEy0E;d}A=l>T+V6XMh=u4LOO;v$7si zkrMwH?i?T}4@RneQk_Nt=^{AHojQW@FerWbD7FfOOJT%qSeY%@X@i7=vd%9u9Tqe zoG41WE~GaH-IxT?%KtUmTn&`e81+d0c(-~W=98D%hU9xXJiZX_AQeeW=Xs##w0+zBOck)X<*yI}r76U;q?Md@g0^aH;?W zQo^!97WGb1>68}ilvh5hRLyroNl6r_u6G>cx>DNMW(XnBW=A5D#G{fPix_p??c@Tb zC=>iuf(iB1@N~-WIq#9BuuLJuz+Rn`%E4A?Q=8#BY1&Z5(+pOaKKZOq8+1bHQkK&! zhdMYhz0+MMI%okl=1K|6Q}>lq5D8W*!POahdggID<&^~8t$zsd*t(T$+-zL@&cub! zG2sgQxtj${P1(CLtXk_2fle)OZ@EQlRJL7A^p~0-S#3DD-?aO4L-GuPz1}N;HNRk@ z!OK`jsG&on#L)d-C2!uTgJY`SfaNMJb4Bo^gI?jg+fcd0&)3?7({#_pl*IlFOwx)n zoCBvlnOG@)4q5n>CT+QLUD*@vb0c}+-_l{%S6~tFolE6OK4QKpP4eGV5{7I?4OIc= z#WcjgH%^`z;cVLAORbXf}hL!qk=`2FCc~>hb{rVG?(8ly=T-eFyLYps|`Y1CTPQVgSUa0UI{FYWlUzgeV&wpk;L{dV*|H}z9_=X6+0w39k&>qd zO(TB~=dKk~-yAvmYK)w}U&9&p{YEu_??@V-uVtl@71H~C{;MbKYby#21>n!Bu61r% zjn`3M`akvT4mUJLSU+sz2ZZn$Glnh)4P2Bwik5TR?mcMgLK|O4Q6H9sEz|4^&9e~u zEBX|6Ey+7olWBaCa?OF1r@^SwH}7@iVP!YPd!3$SsXRqL9HkzK7ywdtp(<+R@6Din({-1M0RbVbV}2@Zmv_}~?}r9r0EeVv zLHk9_NSFM9(sTrkTN+)8@(#>SpCls5(w9y4sy1sEsC|YS7LxIyICD`ZbDy| zC1kymSzUnm{K8HHHQ;(F|jI;!kSB&XzxDcfcX zf$ozw5a;I-OR`FZGi(4&+h z6;h53l`l19GU?ko~Wah#ienVR>YaHKn z=0<-t({VhFz0U38;Awr5#6QLVhzJVvyjKGmJwY1^VnE(r_VqU%-C>PEpW@NX5@X)= zuLmZJ?Qeff509yMkpF~h@673PHIwT@GO}(f@2fg%Wh%wQt&Or2bP|V-ZfrSXQI^Z# zG*2Vz-LHrYoVCd6bV4rXZQS3BMe^0s`pG9RgZ|fLdwXHLb{mgx(;&WUOz(J?Xj6{3 zB${L_9a-1P!o|gffAZ?Iyu7@lw-^l!7*h7y@Svda#;Mty)J#+@p9t=RS>x}|v`-~y zo~2LW%Z^iDmj{;y@YVh^Ob{$+R0qN@SZY<BOb947!cBJS}Ie4S3R*$@upMq30vN3cLx4l%L8(UrY>S4|7zoyh{ za#6=M7mxh~i3v1iJZX~30Ktwe*ReL@$540>soE0{YJRhe2Z_=SwGQfn1cX%FUR8i* zlOM$z4}5!mkc+RLOo{$$H2$tN@STq{@GpdJ=#IyD-ssbH>KFu0^grxL}GBpoYg=H)WG};k5WH#FyUsAzEpNmh106x1|s5(LC|mSk__IY_BwU z>B-=s$)=sg^-(OLX+aGST7gV@dSgng-MwKB)uw9ltAXG6_Qz}?q|kSN9#y4$0M;%i z;&6>HA4DTtYzYIgHwx+Hotk3hZJG6kZn{pA{tM~N9`SgxwU4yC_=-wtux1TSIBI z#Nqtc*UAuReB~@R(E0We~Je5q0As;mUy1?pL${YuSP-`JR3sKtj8uV zOm`p79O1m8N%!S^KPEi;iEg0RWB8jkNAxq1n-&hKyd#ICw=jmslu=8P&a{M_so~>v zyG8TSL=)%#(nJ>y>7@TrUGTO3lREszUHz-@HsG+c@=|~crw)Y&Ck`k3|NV&y(?vR+ z6!Smj(CX$q%zDhPnZC~dN55e(*gr0E)iUMa@24k*m2Tv(Uo%t}gy^X?eLk-!k2%to z$;^M@tFSrK9RC4P>S4QMxf=1y=($}CaGT?h7gOppq7ucnW`xpr{)=cwG+l-f2(a~k zMXcTwHZU-tNxx}75sCc{Bk09^!%Y0YFYae?!K>OkJ)G=w| zVoJW*0~ck7#RQTg9rBWum6dbyz4cnj`t;}BNby8e$Kc>cSdCv~WMupINh#Nr#Y@NO zRq?!a2@10EiTHX%q%=4)G9?P#azFbODaShT+~`%rj^qbUkwG%&BU;j@AIe7;^uICX zR8^S1VXns=d?~1ctXVA%jyT5kEy;IB-y?#>*h?aHOc6KLTdbc0uS|>EC2E) z%W|;2>@a4AYZT(puC5|_Te&nlrahxDwq1P~^S}&kYz9wNR_@-nE3$M0!pNYMLeJ93 z#Uqy>xduXnB+R~NAL;pf44p9SM(BxLisOo-{O*^ffnn39-bk&n)$`5{-l>&1foEuQ z`+iKHsI_wG^?_?QgD=)w8<}nf?p$W<9~!=pJ9nV;73rXIwQ8-QV`%H7>M~=Y-R-T# zkjd&U0~Jf$d0P2T)kn|A%+KczAMF}CKVFXEo~U16j^FwdK$tEtGF#_ea^*s})US4- zr41asiyk)jPBt3p=mu|*7C)`}O2;%3coT$H>RXDDjh0N!Z)r*XXzH_FLZJ!oRP8+rr>Cv8LWpBR@Jfq{O_86?pQqzZ*qO|(TuHShe8r#u9>uQnpn5SoR z0Sl*-co4i%7`^OCGB}OBSLmNV?r`b7^IX^#=%MKu#nr9OM2?k2hNbsx33XPI+T;7~ zLty*+oLonWye?2^gZEwQl!0SKwQz&@V*zFdvp2LtyQ`S1_&+SHEZ@7jG#BCjzUZig z+nacAsDC#2@Tfj}kw#?oMkiOcJ$doSw3;mUO7x9uUT4aZ-{e{fG|b7Yg!s6AwLX1= zzK^i#%E`#svLd^ltjzhuPe!X=W1dOTj1u@5?isrO*as}hePxbjZii~rftysO%}*F0 zE6)ulc|#u;o1dd)zixD~dCIy(YdiPUXwk$158EFZ1&7dA*YP^{P4Yf8BJ|+q>eLe^ z8|$^XK}5sa2~gDBaB0^+q^zbh)%XWBWI0svM9xv#$>?yhXv9t%MZ1=lWZLeESzKGDN#`riZA2c>CvBL7o0lsOit&e?qUdck&(E()5H!On z{xyw!1qf^R&Hl={Z(u+SHw$XbDZS0rkIm_V2SIr|=;jo&PYDpA2K@+pp1g&!x+y9xiWpyM|=}ClL`_MK@m##kf`rodd3=f*UR2yJbXQK{Y5TF@o3^P)Y}V%46ezt99(2Nqh@tuQG4c5YF*z_BXZWnHH) zm<0XtMrHH6)OJ&1XG!JM&BsRV0)c{3jm_glsI8kclNg{Y(KA$=?eJ`u8~N~8{>b(L z-`qtvW&r^G)4rO2jZv}q86oP(RFOermoyViA9?r9bImL1FSOQ1s=6*$EQoFIMKjO7 zD1F%VwYPubbDe_0QR80e z&T%^j4#SW(Mx*YS5n$0+wEnX{@5()821=|0+8O6mXy-{;$b>(}dTSI79o9&hoPldd zQ7KbY2-RhYHj0t=`;HcUlvuT?^M|YY&AvUqS#f@QFAL&;9^SJ_j~=ghTs^sM+~;1I zSX^Abko9MGQ5oN!0l9~1z#S-Jv6q;Iq$Q_?gmz1V_1NPZmRP{#PmuX}f_DXiZOSX% zwBh3RbQT2PK70 z?Xt01iw-t~5&~ctw7K%dKEW~{eK~-V58Oj?zoo%v>`MHcwaHD&>TUewd_AEnPP$P< zI&7)qz=z-zoTqwLyar5-gAz&I-18VD(P@HbjhEW=iCSi_2`51% zF~hX$+GMtJ+x)9LP0t$2*`IDt7#pDz{L{iLwf6LEDTb$VKJ6U4uQ=m=)M&-s}UfykBG z6-*3$09*N*=!p<~_M<(xiHSBdpPovRI&QxFBfQ+8OjInN+k!fqNjX$w|2N zo!IP4m7wUbl6W@@t+6jpJ&= zjiG!o3$NIU9?-O7?r@;)Qf1pQb*I84Gbbm1p+wFkfe+z$5Bc@d+KVZqz5=T=wBg!m zId-Az!k)1L;MTcJ{paZ0S-nl>3f}m*%(&OPnDxpP4zO?uamZ=Z_1^MtCCs?^EUac> z>*2)OC0Pqe`-UIY6NFgRTB?^RtAnq$9Kjy$Zi85fem_eCE+H+SZXWNO-I?PI53qZP!&6#`Mz$w<8xh@T3sVENk3r7QR)#frA&mGy=R&+cu`bY0vt2GP(#%tfN8 zRzO#Ngpb5>HT0EL2||~>b4CW)D*Hyyk3Xfqdd;@qphMMrWda*bZka@r@nxObaq8f~?7uUR$=qJhR?S*_|+PNqL;b zfSs^+*Y75IOk585_;rP)c81HVzWYt`W#{akna`+Bt?wq463ch=ekoo+y)oCdqSd{< z{*zUDhmg?Z;^uZw?)Xatue{CMu}INSKzE&@6xwh;bny-Z5L{ufP$$By9z(^kbsC9@NQlK~@vRsvtHR&Y)!_sX9q0vNL1Mh@3O|FMrQ^}SxEu@1u;^iy;L=MA$2;l}2KE-%ou6y-EM zIJH3iPz?S6$t)^zEB6xBhZ3 zvCeV5sVOO||IYZ2D8svkMYre$3foq*BwRmzSksyR^a(U%IL0kae=H)|=~OWrLig%v ze?%n%ereGCAtKra5900{^#2t!Y<=$NU~zT*cNyr2u%hU;svX{ij*fc05EE_v_pV~u zG(W$6u1POJ1Rc%z*?N*E;?p>xvx`NDn!q;F*bc z{|!(m4Pt(HeW=3VeqiET0ScS@himVzevo-^{IB3;R{Q_7_U7SGzJK31MLsA*D6*9$ z*~*%IEjvlbUiMw~FqRhC3Ry$QURg%=!BAu!jD749#xj-|`!IgjnDKe;`+MBSef*x| zc={vPTytG>?(gknpMQgv^ZSf&zlk5d%1|Avjx_D4t$SLQK={@+Fc1MD|>= zO7|AN`=&NvH`TzJi!sTKmNkttz~(o~(WL{|b^JECrI^|(LZzmt_JHj} zIP6B;_t(_zoLMy*8)cM4Zv&;#RX41yt+_=V6JX})g8sW<4~Eq*b{>l#-uc=7yvdtE z;=J=&4!a{7H@8CbTe(8`yNL4Q-dRX-t6jz9YHS?!k1)2Fp`$j3Z zilHLx=2)mkp=1t>Lz|Sr|jR$+3%*v%3Qv>r}&T0X5U0w=rZC{LPQ`d3E zwK>lirMc6J>yRrvS%KN=iRAyV@^=w`Rh^(8ex2CA z2upijWg%#^>}nR@z=T4Z6HC-B3gCudHYzRM)J3QH4}E+;8P28j@uwer4{}R)roT^O z?e;0gbfts%+E`%7vu>I!{Xcw0QQlo^)rPhzK+s!Fw=RMmQ12Mtw5AZLMVOHSy>-*)BXOXmfzepGbcFfXmXPY0W5Mw#nGB0nTL zuLbq_ZAd@b&6Hw@Of8v04`6XzOfa?WIkv3C6ac0!Z7WIpL@X<*>C%3gj{X8c}MYAWB(_a7YQL|%|6G{QV!D<+uA*_3$~Bz7k6+$>d*yt zG+)yeALQ#--UDFwW7&QfIp3L3?g)g-aFXuFqyO+UO(!n7UlAC=OLcy3aiUXwB05TB z)9=@c3)4N-iN*fb*fh}~D8TY+fVx+9-{%3qT z+E$L4AkTL5X~ghSDmCc$d59Kw{K=u^NpzM$dIFDb7cTEGcY6}En6{bZquzw~+>&8)1~z%;HXSaWKH8_gyPQLpjlzR`Kl-Bn|Mz|TBW(AyPR z&>LsIZe%2RKRNEDc!uL`aRbmzC1_0Jv%z#c3vKo&F6)G3XHZtxDIWk*LQ_O5*4WZY4zzeUOzNI44x zhYN^tTQ>X@K-{je)-j1=+?f1;r5BE2Z1$__s(j|U% zuyI;@7Yak@wV<{(+^g#!-FqOrm6&BsUjl$j5-Hok%8f53Wr`gGtqLZ>Cszs#);`q+ z6$Q93Rkqyi9_3j-?AE7kC;Ty{yd$?4+_M@+k)eC`k^_p<~ z?kdyyz}UUcEP5f!odEOE=FRlwdlH7$a*XR3@3+qU;HCPixA65xl0bs0M*j+>V4^{h z&|jdvC@COstRlqg4mNgmF1Cv}#3)9_a)EmD%cpxeHEZR;uQO&TJzcjp>&fPgF=jt2 zR3FU$=yBc3zDDsh|3NqE!u+70UuSqFyEsg~VHfJdV(|K_(-9_pEmQmF(vKe7pX$n0 zu+rG7XwYo`@{IMk*Pq>zMz8X#?>izL&&Mq;7>Cq6E(CenWI4=r+i$oPu|7=uJge*% z`%!vrEAm4yq_?MvbdVZoaBLDQI<}^rtWbAqnuDzlawKEWA)g zqTEGv#p~G!+Q{c6(9AZ_BheY?LL|%?GSY~kuNL1(fWLd!^?_|+YcNIif-S-h{fXg6umm^F z9q@r?|CSq56&Uk|p|XnI?&NP>E8j0*tSy5(=x;1^SRBl4DOjZ;Sngu}Uc*eA5J5v2 ze!dw)q&eMscL`eFWX0Tlw?fw!W`8@AIa$|t#lk>RUL!;so<&y?v)rp582@wNNczs> zV;LDS(cc@bcNQ0PH#`suAO*+LKswPcMeF_#<(OW1c&*C2Q5JCD^1pR`uX*S3cftAw zN-N)ml&tk}mUyB08NWWu7Q5pE*NmPWsgUV@5f{K0*DcCQ`1}?m*kU^i6;itSGiEmy=N9i42_6-?R1Q4(KgEi-&y`ddw%9;sA8g(s9eyf+OY2 z!NB&Ng6AiF7pvqvy5-FLPF`NVPlBwApYR2C`&%59 z#+B@vWHoYcdu%e5Z{5`F4F2dj11pBFzHGS+URQ$fBJpVMHzfleSy{>_}wh7 zp^N9@Y>_O(!7pKq9lmJ_&GgR~I$E~g$6Ib5gWFn3iyx{THbV!ibu)wXqYV$1LO#aI zH&|~CxL|l{8)uG9t|7LI6sP;0C=m3Eg?+^x8SU5JAT2GI1}@HR{p+%yT#=!^p?f*I-dLERztZxwR3>a-S*&JiI~C>4_RDf#K0 zB)XhPC`g4F*=yzFZ+ZgW`_JF|lvc__C0yS{E@GlHu>-4~VoHiT(Xr{x&7xr~b=|Yn z?)y96ZPM*MC$EIMHQkqUb$&xZ8XoY*vez}cO0PXTg3m04$C#1g&aBKx&lRM2jbG=> zn>THHw7TbnR!gSEvF>hn!9`l1O3W+*iKEreWqxf5O+#4PwCIdwSJ~4ev>k%!w?5j% z!O5wJF%jC`cqH@}eKZs!VJU zA-6C|CxFm<*e_JTrC-lWbnxr9E~s?XM~t$km)0q2ffAA5l=Jpnw+p=|Ed_a5@PH0+ z0k4^JtTj_{kX>F`gLBTKaqso76BA}n3)`zT26n=&JRdokhw#q4D{UyaMKUlb&dhJ% zK;hsZk~x~zphVYxUcxW&=$v~<{t0Q8#3RazhP7u!D}h`;PfRR*-8AAqAMfl!u{58Z zh5erNW--d@81&}e=A77r1s*kgZrmBEgL)mCbz2-zOY6+mXU~(d68$JI(>hNx18VPB zw7$Znj!aK{V;LJA|H2$Izi)YY#v`a{^(2bn%69CD+=M}~z(c0>6tp;9#A7zZ(~)l% zXu~W`#Fn=ce1@$mVWoi&w22!=3hr)hg&9`7ui~0Pv@n+1uf)^{mTc+Ch8NHnsfCIy zPLagUB#1*Qov?Aw=mM+g&Yiqa=GZ8t`Sq3?G!FWDPu&!pWihsqF4elOuZ;p~4dYhu@&>6jz6iYf6n-UB z`|p>*cGuZE(*`ACqJmu#vqb~jyd+RA%=}O#_Ff}IlVkB~--M}I&I^7P>E;V0ND-@7 z&VF)5mlO&W&1Td5L_f163Wcn5pVUf~@Q%5>ruSOIc3f#bKJtDu-v0-gn5L<>+oE_c zR+yb_523bv#VO!6e6DiE!u|ck#25JejIAE|xnRytzd2KTp+KV0`|e{G*biQ1x({4& z67Qm8o9QpOf9nM0aqIdOMEp>*ucPy;4`bfpsD+cbcCpm2v}z7kVD9K-zbZ*OpwS_b zY#($btlqr?VHIp^GQI355v@(@;hFWwzRH%xP|&!zqCQi{K_^^&`r`S2M)Hf5!)nJH z9p85{hDgi@z3bx9ex3m*`#N6PYl*&(_`_56fcGNkDzlpN^aq%I8KTmn9-I2=VO;5> zGC0|b9g>xN(SDQk7D#Dim1I8hkvHU=x4`-BB!_u_e#0m3t`ifX@cUCrpQS6#pGcai zc4h&%sUy=yVl^yvIW{|;o1-ehH|Nv86rK019{_BA@Nc3)u+sgF#?{yDpBb{5kzYGNH0h=2!> zH5wD1{WF28cP}*%6l~-_5HkF`>CP}>yT8Z_TII4a2?#Bkv{lE!pXIJXT8-+)a;m%; zfRXai5_XS>_jY0sRu5BT0@_Q&GD^~kf;g&^0ZE1)%*x_uvL3e#DT49jYt$V1I(62D zozpa9EZyOAi}H!S?kmFlLn48XYDI}!y5PBtzE@45+(!D#H|MmmjD`X(Kq@E`_e`{| z?cPtrFBx}KoyP5gcPL(NkN!MNvy`(P!@{|Cq<+ zit&$|J+GT%-KzOh3IiEcT)H^q^SluiAld{2!s%8P@u|JJLO)KFGQ=W8EZ9WA625^x z=3W3aO6eZsAX!})x6R@4*8w@eQr{Lp5pi1H!o1QPa&wO6n+%tUBbI!apUf%mkir`g z)UgM(q>XS$sU9y3aZt9LW;Wojpps_@TO;on-FeuxHmm$HUr&Adz$EEIl%Vor^8)$` zV#vFT$CWi&vc|9G0LZN*74&lv32WYQwGHD;w=v&l3ZYVtwW=_B{M$)rgRAR`pmP0w zK>9&XM-zCr*DfTf^x1K%KbzDy|N9E_F%`Fa$vPR?#TI$4`Ym8+IxRtL+{jOrn8kc(NIeY92Bdvn6RmO_2?Ks{1 zIjhk{N*0pUfTi6rGIzv`1!OI_9KzdXuvfdoxVLK%P_pl=nXqKnuO?N1*RbFu?*wOyRo$ z6-Q=6rEwL8rkQ&Eqj%-5$wGid{Nx{inzo2an(9!3`qKEdDyg#_e+@V^1bZzo5WyBa zIW6~JVg}Xwf(S5tbYg4EBmO_KCsED{lRCICfkHfp=uZw0(G%e<*$2Z?!+lBOK&Fof zUFbs$@l*102$hGm?&EZ1JTB(pM2Pc#HAX_8;-VO8bOhL=N@XK1s2a!MqyYRO%H#H0 zXmWx(3Uo+NqyA~DGQD;FGVXg=r>=#U_Qz?@Su56vxM%ohe=MA(wvk@0V#B>YphTd? z>AQprl7|jG#3!za;bT0H&XU9Ah>Uw9*{y|#5I0#^u65c_=&P#6ZeMzzYM=5sJ2NL} zEv|9d*RxnxDk?@(H@KmTV|f!TRbc+IG^eGhvAyBjQ?1x~APgNViA2U3iP=@xZ_5Co zxS5B;0Cr)BN46D)@v0krGbb_V;a1!R5_}u5?IU7l?H}fRTfesNo5}4(Mj#T_hJ!2e z4>rDVovp(KXFEC~vKHUJyVx;ZD(;w`{jg#GeFr)h>-MRCv4_?}DnG9LPI z%`b5VUrcOxDP1Ug=}X$ zBC{1OmTxNA6Z(c88nh9%<0CZ|1U zmx>Inef3>nz?WLX4WK|V)ui;p(e2285(%>kvY{{)6D2qH)*>Ec;4Z?B%W#Tg|ADpk zHG5Q9iw+Gg1ow-#*FJnfMXH@4%MZ=7&zobCh0V&Z_ z4-w)B@g@^H?J_0(*xjJ5ry&kku7J_LCwv$H8pQCHp@wh1E!~CW1`eWk@BcvbJQf;D zL7A_R0<~;k>ut;Cuf}$vt8K;wB-*YY_AcS&{ny_hpaQi8d#2SMdruqI=xCXSZ1$K}R1KDPl+vU!<%0)pe3_#4Gs;W*~#XaG>y=_qWUP%20E8s%CcQ0p6AaR)% z5?l`OMfr^%fqOi9%5eT&Y8I%0Zr*TGOi9N(y(k8pvf6jcZ)3M9dtT z#Y*n_&l*EBIG(0jD;THJxW|OJ(0Z>e_7AhxqMxYsNub_oD}jTc-;&o{e=X)z%!my$ zv96~~_ri`RQ-N)Q0O-dbi@qV>-~8)WhR*Z1a6bt<*R3t>e7oOJI1HkN2il2=+y(YO z4BeSe{t6&{k|HaTV6p0!s#>&V{tpF~$G-u*q$Yk*B_v;Om4zXVB-FLTd9$d6Zv@tx zO`OCx#5RaSnv-dYhUzMTko`e@)jv(27%6(P+vaaWWZddo4$;Iq$D+S0wBJR=R$Qj7 zq%4WI1Hg7)n`9JE!FH~J%zq&tOF-JDdcOz#bHN7nHN|8l^MHaSQX3JzsGvk_S4|;F z9!By+{ykL`?Dcygvsedmfb9BW3`6o>6FRxlm~F+8&h+I|iq~PBYXfW`liO%Rsf z3|WA{yczhtL1bst*tqr%l-|XKv>@6>EiYb zZ%FMzk2bnja*j0)tsv$6u+E)%M4N$HRCR)pR&=e_%cGYCQD${}5cbZI z=fAKoN)$h#d~2TH9`8Y2u-*Qdel)jIS-@%inqL1O_;9MVuzkj#0lEj>SjWG4{_=ot zlpJ`uH}|4iO49?4!iR(U{;Y)tdjZaq(+`3KSFW5hH+9x;6gqGN6^SB%{i^5zU~+&G zZt7R2`V3NKoiCTja(PBEa0m-3X_}V!g>z|I86PQ&6z2%)IrB}%s?P{;Y*;@&42<4V zbo&|)&T0CwM_sRCCw(a$;iKVvb-(PGLZ4Gm!j1|Gv+uJr$~8IvJB#-p(&gKv7*Hr< z4R+iir%F8B%bd=6I`)6_Z(atr_#_?yB8{liBw4%cc6~s`+yCaF+$CLpCK2}XAl@jS z@w4%5x3>oF=ps9&`z(&rkao6}Pad?&@w{2ux+ zL93eHvi#yIlg#pO&}&ScHjz{2E!{(e0xz3Qt8Rr8u>pVt8k>d$3EFXpjtv&Pwwa&Vp zGQNyZ_PGFwq;R%k@WJrI{x3*s1~Sr9AH$n|=VHFlT~Z_c7bWjBm9U!rf9GCN3luwD zf|c(-!L8wK=sO2c{rn65&BdS*b6xruf#MNPdht;K%E-y(zC4;k#+P}azuHaBpo zvtU-V@jr`JhYB@)Z(P8-w>2<8AS|@aq(FTMP*J0<>6(ryg{9Xt9A7$j$Dlv(UMX!M zB7Lb{E*S9M9~uMu-PZImI_I2`slSk3!Sie5t%ymPZ-#)X++cYYG$F&!S`WT8jv z({2n%-FeD5^MJ`U^C?L>oBbnFx=DJrbF#3oYM=y*zSx{$#0D9exJA`k#FSF%gdMa{YigNfht5P_@xz4p}gVh}icI zi9!E1Q$h~@7VhngedPeoywG~aH$-fZdU^=PRwi$5E5DIc6(iKa+cL1VfnCO)0uda; z)RQV~*LkQ>up49-`Kk^fKgv>{c?1$ka?$DEy@F(PwO($f-)iSO2_9Ut9NR2izP>z^ z!6*6ZKIV~}549m{;dsw;x9-RHs6{f`2VAMzzaGgLX3qR;1V3i#PF3LW9ot7WrZvmG zX-$yESvH`PBc~A^MP*pKNZ(aLy@_IE#~ z#x^YH*i7q=o<4I4gKR=olH83(3-anRE@?k^+Bc}XW2jzpu{ZA5=XMxtGDuFXA3MhN zY1fUVC2#dbxcIS;)7q+#M#JuS{o0eO!}YZ#_mjM=D=|BaPLAHj+C)N@)l-Y#yQ|5- z|JE5W+(8!q&2T4*Pwr=;>5KrO{~8?^kAIT!e^8tY z429zEt7W>MX0;G?-XySM;!pMXmk{Lt!N)dIc1aA*o+skGePbW@H!fLC7|VKkhd<{S z4Ye0 z)2hW1=svB_#l3?N_Ev$!0|KLoKVe(>U;0oFF?JFT+>4KXpQG_SO_9wDC2*viQH%ax z^(KIoWM{|y;K1y^b%K+zU-QFdMi7zb;Jf2r&J!GE=l|amUD6^r6mU=Hah1RROm~{X zt44eV`EgPpq+1iRfW*#PswS+$j(clhHvQ>k{7V*`kc*qAbLz2*3c-iNXGZ<&to?`Y z_J8w{tB}xP0Q(M5u7cBl^xuungVW<&;>!M=PxIgt-^V(srU;T~lhY0%KPrM zazD$d!p`dkTgu&1tt3x=z^-ySWbu`T(>vMJhfFkE3b+<>x~_41o?hj(ld=zm;_m(1 zL0kH4r#BP^9-Mr@SBygEeb-E|Ui~bfVSzmL<4((9z2Kvtv4mvxX=E(6@o1!eT8jwh z4YT{7WK~xoXR7dhF>vPA{_kA_BvT*M18)Os8KA_$W1Rq+oX&m1%^8wt_S0V4IwMd8 zFjUyn7hXj$oF;k=&|U`NZm3ZbAY8!GBrxi{+&D!?0;llA_Yo4^ND1R!>$TWB7I{XV zOMr3x$4F=qDM{dqcy^9v?Oe258Lk}8vnBK&Eu2fhXOR0hp7GlLTj&415B}$G0gzf7 z2d?RH=NLn6RsmH3T;3u?B;FG6XOUlyPwz7j#+5r>ONUcc3@>p2dHDDx?rXJ7-7`6} z1tLG{{`WXz2}}Aeal}Y4AwB`L16Mpzyoj8f8_$1Vh_w;`P{a4eY2wS- zIZKfk025|KcrdblDJOcBaDvi*MmqlI2A_4OAW`R72r*DFyWZuWr>n5CmMQMt@oD}Y zt?jwE>x6N>5wG=@Q19meiBc%8vTBN)*K(+FSIZHcg==7f)Pr-Kq74)%{zJTS=TPFa zYdog@;wG`ezf{EkdmaDhZ|T$p`FwFd6Z$5Vh!fa9eyfbDe_X?o`9?s>(rIt1N0*Nk zpIri3ruTV(Cy3Nc0N4=6S=I}1KGa#(ONM-i1zvFF5%7*@49=GbY*BR3tuDSCI^3@S z>6Z(hXO~+wxLa|xw-P!dPGe(nqGw}>pY4CvPr4W9g%0I32@?Wp+ta!=QpK2n&y)0* zmklxr4pSWX~;l+Xg+0RXXAEk0K1n2<$^d$hAJ zDmJ3c==7}uM>gOPI@;sk82Px6L+swM3+}dBC|ouc=u}%P&?Fr9PH0<&|Kc;wZDfI+ zJTvYICS84bttF2Bx0jf0T5Or8aH-QoY6=xB5q(;W7B8}kO(0!x97Z^_ExK84X`F#C z#TviXIsqVqi$nuc*iytB+)HuSd(L%6M#^+&yi3Pd@A*xdaf>oU~z{i&S5ETI=6#*2ZbH%YWoLnKz)I?feDZ~`n-vHrI~Kcr$P__PMezCVkq*u}|I z2vv}jBif8Tt&Ad&IjsGF8sP5&{>70ngH%4KNX{_e^2Lba{|v}!(O6A9yFVX_`>dwZ zAzdTMK30sPJ^h~cg9x#jI1d2$tPqtD!G|{I=gW;F)6zHtfIKd)^o*?v-17arSvi~} z-W;WqdGrBvf|>F2I$hMn<7>me=JR%6B_#pbT@v_J-FL;-=F$1MXhiXcXrabY!U#CK zxrr;PaekO4tcC#_s~CeKLv`=zDFn~N9%#16H(6j%fk5DaBA!5bj<&%C0AKh zet_pryI!)@f%KH3t-HWRkP|W0bpziOZnPW?&fDWm4~4lgA{(c!omay{1gRwnF*7VE z2Xv8*u*s!A_=kim8Gc=0zm^pRWHtin)qNV&rU$bpn}mvN5l7T36OxA`wYvLO$O~^CWEfQds< z*T&MX8*-?R?*`hrbj$k!0s@3(a=${(Md%5D0iz*2KlZ63@qow4&5eO@W1P}ZJe`XO z*ZXlY%%Kjnb=55c_^i4d;s~9KFL8}w_o(h_*?B{NL(Pv_lpO`(%2!J?3{=S$V8C5- za;aP=bYG?+=p!>;o^+!97YR!B-X(b#s)!)Gpd*-aCY6*H>F1U3OWzUDNqE^wd&a;w z@S(5bUy0bS5vz8dhM?rah;Too;6%{;9@zu0@pt|Z^t52zpC~@U3W;JS{YAol@&cq~ zanGY0pYTTluo8}60?&KK_vjqp2oH(+UYMMZhuLxcpYBypd&>&U7lKWbc!6!4E_scV zFU1y*V(Tmif~9R;DjYm4xc8ZKZ&GFC6ns(7xm7N5I-M^AfM%`9%VJ`5p|}Us3Bed?EG5qyUqKlECqufuf5wxvpJ5m3%UoI}WvGf!?z|JdvqRewij+n_Rf&y;&(f+W_h2Z!Wh$0=`V!BoEOaDq`WpQE>pHV-4t7RTY z*6)l;CRj(Dx@g?=yuePt(yP7xx;$>`K6F;NiimH3ykX3gwVu)F}ri zQGDWe>rhe08v!;I{il`T1;7=RqGI(-aRuCjB^i0+y|gf`I=3obwZDO6`f0NdaHd`) z;2dl!B&EkXUK79-n(b`e!g$ijdB=5saXwm{*#U^5qf@Qw&|oHL%_o=BM^F&)gCARt z*u=!feku?ikO9Q&($zOip`sEJ^`{Fhj%dvvVHmu0J^-Jm%<1Z5TiDsDPLSmBcM}Xj zg#EB9`yL9F@)r2xCpf=;m5jF&0nSYzXx#y+*aB|mP#cxkG`PN2(-2P)8%$K`5zwxd z<|o{d<~3#^hw=`1DBuMHCr<)QgWEcxZ|6h$shm@fNK-K^FQm59- zkDR~Blp?++AkTq;KVHBXsmq@lVobVZ3YOok!fdL8Ki{-}6bW|UCwU1$eSPB+V*eCvqJxc-wW8ff zlO7}d$R6BHVTvoY3;`EA81w3h;Jsbik;x&eaJI^up@c5x6ca<;V>gcM&5-6>Y;QlC zRoV(!pFYKZ;f>1U&7nAzwVuEeJOJShtu4Tr+Buqh>ixt;RM^AQiEK1(uw1m+S)n|e z6}JX>Zz50LY1vi;i{siNI=wPnWV;ZRMEgEA7B*I4PbjB>QmCO%M=vpwlVE9**a~06 z2{Z>!rvW?scs%OOVw3P_&vSkS@a!xQG&1xMZM3i`e*#hAGcoMC&uDR`s>LK~)BqAd zm9&#=*YCKZ*?IM@EZfv|2CWO_dK|Vn;_OhECd-xQePh6ci@zxE%>JH)VAw zG3!*Gzb{l@`k(_b8G`Ow zU5x0iA7P#>5iK$Ksputs;6Bw%3Xg!+XWYE|-uKFcQGSE%cv{9m8+C zH{n|S6!HXs(l;4p?YT8g$Gpw--`I7o63kma)wo1XRck>L_f=0K0L5wB+GT(raL%7% zKcmW#S%Boj;2K91|5=h0lNhK&{11YI z=~*>mHio(pj?7d|prbnzTwQ?3&&b)_L<>J#$5mS4k+2@8wq2CVjejJUa5rf4GAzZ! zBs4j>_d8Tn*m1YwbCXy z;%%m!@-bezP%THHCv*QAYtlJic*{TFG!S6grT2_|=*tC$vhxvshU-b9v($jaa@!c< znV*guEh2!)lq@}mJLOHI(=Y|zp^A_DZoc^d5E(ccp3pa+;^=f`*!@<=xl$|w9D~Pg zS!XtX&>_dJ^03C4*G-m^{mH7)>7es_v$GaY_Dv|_e$S^xvh_O%&Dn7e1e|3Hcy@eC zQ-G9*b(9O`Gn2gCS`6S`m_pyd=7;jK0Ab$8&XalPWxL^6-6E_1QpaWaK}joCd2cxD zm{iek#n-U_%$)<;WV{}{6*^frE%!42*M%IU%nUjXVsRw1(eWXCK2sJsF8negQn^gc zfsSAMTqLJ;4viNO=KK7t@^7tAEV)egagPLS3X_${V;P`su{D^0*+@>8K)q6(&n(#? z0ZyESHPiWhL@ly<`CLUFj-AXW95}aI$m_2AA!5l@0PwV8gkU(SZo1`|>3bDGapMf> zJAMFETlY=#+|<_mOU(R;D=Pn<&XcA!L&(ODgz^)+pgcu2fiSgKu?w^0kd{w2jP>g& zDcw62u0hL@7EQtFkYI}~;MbMb*-4Bq0;`aV&en{m+=>+EQ+!s;TuKRa+4iVdm4EK6 z{#(xp>Qe9CWUL{}8D1cu%s|F=7=7<&d;HEX4ll8*+%Jx|gCxU6u6a!sd_^ zKb06$f4A(u+IcI{peR`Tv&FYS&DGJ@X;Qa2)a9;KD^Gl z10JNJJF=!vxAs(GEz96bT{g!hMcc`mz;cPSDoD>mK(YGLT>*dFz(ouD$XYqb{@xxcfzpnL#D*~y%cZI-+=^7 zt3h?E#NJ@$7(f<_<)MUyBVT3-d>gyB`GW^U*V5yO#wvL>_!j>*Y*H1y&?#h}uyicd z65#Xm=3d8$ZF0RZKr1&FiN>pQEZl z6~%Ns-raFH9s)`q%X_T)dr#@6-35lqN`yqIWrPDJr=w&zjs*|zM6<lT8HT_ zrqfN&rVPq_DL0W$SJ-%+e!D7Ia~L4j&`NOQ-0tH7+`1o=E^*>U7mB7f`^yW2?}LO) zCZZ_)03|`i0kVniT8BvtyOm#jQ^NiEp6Hf zEm~M|M8jk`1C`cQJ1g6{#?$lvSY_vHgad>oH!dlp<$wKpDw#e;?>tgl{<2mxMHiO$ zVIa?^y*%EWGz+on@I{$mFLZ(HIY(5ht+-^74Fs2*a`^nW! zB>U0L>mNW1UBaKCPpc|LA>2>m2fcAU2btInMtC+>Bf0Kto7@h5Bq%iRh-RAcw!K!J zWhvOa;|2Vp2wAFc<+kR+07$8ZSy_eNQ-P}E<#{)XDhDrLo5xO3%#{~}=7S%n+ATT0 zi0o9axWK*$&qzQowjXN&B}k5sBTY9*g@k5)J9R11@vJu*W_YF5O-iTS5vUi} zvp#Z@<%!>)8~NzG5tFmm=PXrxg4~-~Oc~U}YNk|JCxV*Ebj02#Re0Nok;_VR=?z_p zUHut0f)bOCtr{g>w)n=6}m}M$uci07RR(c zJNMxasyzmst($BvkF3K$LC;OL0p?3=9N#uv&qMIhX5f<8+N-GJYGZ?{g~_X2cGbvx z0^nUE@%;`bqJg0y{%fZ`!+X1W=AeO?*ym_FQ(D;Io8RfK%*ThXsSAsf!>XTX#Nvn zjT+G7wtyaQI_Ln`b8c&K-;`p)v7Hfd-Y1hsOrq5=b2vL9lruxt&#>}*v05$-0ehZT z0nSP>vJ5hCR=Ck`hc~IOT$1GGE-=F(+27!`cxQ)BB)LL)0)fsh@$Ge~L)Apsf{G^z zJFb}c+-IsITBUUSo(i~+oL?YgBy8NP5r(Btcm)nml{oFdKzTC>hc>NP`fugHQ<#6~ zFB?zcujem2Q4t{SobPqD)Osf$BkYmPVYo14uhhQ)EWimY=)XioX!NS4)>dbE3J zwPOY;ae=1LJV%~}8$kFhkp&-Vh>!2IQ8Bf=4|(UGx5I%eDURlnLgm)Y0qHbCDDLjd za1?3L*RSen-KUWnwXVnFe5LCxN9m4)K$IspPn#|1s6j;^;-aQ@YJIAxNS(_b33cEO zFeJE_YMNdN#V*Di0Dng=K9Uz1m80evpLC1PQK(@k6j!#IPVjY__bQbgngB+w>! z?HDm1e7K?s9KClL7pthXGj{Xd{<@k6rSAkh7jqlTdeC6{G$*+6P((VeBdy9kUZP?4 zk}oz@#C~;+l+lb`{;(hBYu>|WvfAL{t6^CDgriU=BObj7ht>I@<|hvjJ;IAUa}`^= zA)A_>%lRo?@DQxm!Deg-zYx^>(MYMetz{8$eB&bEgDp%#JnA!6>;XC~2QmwH&>XYv zaFks=76^=t^Cr-t>lh9SH=r)l=y#v|7sQO~ktOBpu1z*07>0wN)FJ!;$TwxMP&eK6 zWBjIvxix2xHeY_ef7O_~#KWk@l*W_1F~%vfslv@o^@==6aU{*MLJam{XP1EhVCa+j zrh6gDgIobRz%is34%=H#)zi?w=)=4tImKgs5@p9olF23k)7BaH`V2;NQjNw(yHq6& zEQnZDck)Z5ri)HUJxlqHax}I@d>#B|P-N330|rNf-bqSI&LZS(bNeV~{ywNE?P#3A zMMS-hEGs7J0*0AaHyeJx0&q$(SrQwz77}7f==RnU_xmu73b%?2XjXmw0GGD4Iv-Q- zle9FEUBfJdbz#CZV$Hjq*M3ImlYWrJ3{S#c%u;MpsU|#Mun4|fUcD!t(Or!a53^oC zF0KYH1qE_kJv6DAS|45Us(WX#w>|>R8rU0XKb(G+ahP^z83REn1bX&Swm;aiD;KKS zuIdrc3!d2tibCWf;-~9AD6mM+m}%B!1RU1}Ih5DT-cz|&qb;@UsgIny##-+xg6_^k zR8Fs;c1C1)uhq-dumsGGkLzM~pJApv`u3u_{RbDk>xbWrl|5gb+O1uS>JH0Ccc)ES zdu1&9E=d_^MhBjhSwO+m zXdP?DcEw^$Vf_V9XE$U23`fTbYjEwD&;Jr)|We=mWPt>)e^kb90NU0oxT{P#-@I z!Hoo)=(p{m+<8|nppntYSpiq+sQ?aC+ zuibOt6OLHfba3)TIDLkP?G0IffdlFN=@W86I^fyPuO9WlaSx5U&sgfT94`K@&i3v) zbfrMV4D3Chk*Jdov;OQYofJ&H1Q`l4th@Bgvc)GS%h`M{PqKG?5`sV-4EY;ZxFkp- zXEAwY;IJk#U*?{MGN?uhWjlNTW#)dgmjjVnMIXwRpn47wD>FgnMo%o;g7oH77}0xb z%YNBGLS8Q0Ubz!BR<;$8of#wK-*MBLTD|R{+X1p+uDuz8L1JUdZ}TRm9;1%OG_QgT=??ciV0_K^U^W1z<{FIo&C3q z*K1ghzbrM7qiY7;qGwoT-Rg9_e8v}6_hK%O=rvMH@dh^h`$#8FFzi7~;iv#_)5*KuDCfI~s9prTzOl)|?^%#9+gjjC)#t2?j>PP3 zkyY**vwf{PpX!hBi0RuICxxoB{Flr*^eWXW$GkeLoM zMzMpyA*3#`MeB(D7yA}IAx+$EQ@bm^Uz+7o=UkQ=b<;Lh{z4EN7tH0HyR2tltjx3( zaC^yg&kp!}E894f956lB8G*0lL5AnP%|H$(zZvkYdITM>7VSd4Gfb$cZN1Tby@QCA z5>_$+)0$$3a!elP8(Jw<;7C?_@6cab-dQf(DSwPDu(#Xib4_YTmLCQ@W>N8}w`Q+r zcjY?;B3`ZjO zko^+yv*BHonNXNoogSsBkSZ zEEQMmf-eAp2$33a>YADDt0alk9Wze(ke%XBhs(V60*CoUmU)Zt<@CA zPhN?ijP4E0Wlt1_2(1Q*EPL)A_ml^??D)&B^Yx^3N6~Y$-`QKMPD8x;{iAeTW@K(H zbI`N`YUf|0{Xus9P*K_)yX5%uQB7{A*~b8_!fq@o5arxlw_}(xsA#)Axx!p)J6V-m zpY1(WCn#(9EW`&IP?W&RHuWH58@l~u`LG4OE_o8>iU4o8kL0$Gve{>>M!!>1oG4MQ z(S*z`mbyz=Hr=DxxQyi83ox&#XUp_MPp0^ej+6!G!za$AP1)_`=S_UA=y@OH+G!Kx z{30XBwRa;n1Ldo}7`~Gl7~II}Z2rw5y(iDhTYl|ez;)D5$GSB? zuTw*-w*x#T<{9p)PO$}Muw{Dbu2e4t)xSpucwy|O^;3M(o#nGWK&ZSkgWH$HCS9;! z-oT5oKPgfDuD7Ojk9ENzm|)~c$&9P2_?6Jr@d!$mU~^Uu`^Ub?^9R3u!gbG)6}q0ql5MUON0YFDYcsgdP_UI zs`WY>-Q)p0eu^REXosm$xml`ZQOO9|+mspTN3{)|^m}U=9gmU+PhwYk#C-IvK@ zI(rnVH9`$Kg=KQ|jT4WbG-0e=Vr$KtECOfuM~}-xVkp}0Z&|84xt{z z`tLUy9R~g0)lTt51Y(0$QIl0g-i?hVnan|LnU?0wYjJZmGgxPAXDXdTQ$=_AdeHXh z(%n9uoe*@^iS>FZd5unxZq2*YBh=){?8u#sg+}Wn)9_3>QwLF$hvsr1WO3@-DqoMX zpEe3|F{Hias4QbW+p-DL?^*@l_gR_)5=eEyS!G!o@Qg;)=v20Im!P}b^`a-|Q>Jt- zz0xKgaH$VwTY(I3SRBiZpqw7TcJ?+10}-xhug-19Nk|(Q`4X z_onM+>ZtsBC*@Xxmz{UG4zVT=d}bEcrM@GerK81s#i}(^tYj6Rbaqu~ri{=`H5sL^ z6l!FT9P(lHK_h#EYkj7e`}RQSGevqsqlPCD%*|~^^lZAPRJAE&N-nLlp~OEw2+Hc3 z0Y0IxfFJOFau2lJ8@qm9w!nm;&l3fh(ML^pDO!a9hFk0r?37$%5udW literal 0 HcmV?d00001 diff --git a/windows/client-management/images/DeviceInstallation_DM_Printer_by_device.png b/windows/client-management/images/DeviceInstallation_DM_Printer_by_device.png new file mode 100644 index 0000000000000000000000000000000000000000..0fe74fbf2d5845dc5347408a8450e0d7da603d5b GIT binary patch literal 123239 zcmX_H2Ut@})5glh2BOGSnkZe00@8~Jiu4Xrqtc{=-dhw@ikBi)YLt!$xzYlG5EYS5 zgwR7kArJzDNCJc;ko-aJ|DESK5A5dbY?(bf?>jRm+1ynB?5QiK*x1<48a&XmWMey~ z$GS8BI?1ZBj^pBI{W%hBsehNPewZK6DjfIJG0|aT`;>lq@9_y%nIqtVeJ~rFK;prD zBz4g$l3_u*u zyu;nluD~SIi-VWr=JPSrv7O)m6$PXQ1vibsDdUzMI%6U$YinOS$@03(U+(Ma>1l*e z6`*JtV(7K}dUuK95qJtu{8%j9a7{YimdVzXGSzC6!uP-@uzngMq)pc3V|%Y5AFIK#J!u z<1&-+$ji*e0r$z8Od8m@k&g7Ic5G^eQ$jp(e0Gyvgo#Ppp=+p!%VKL5*p33P7|r#q zJpyTSQzK|kBY#V?2Rt1*L(fQmJ|7+$-naJYRx@B#VeTk$VC`opS%Wk;d#vNh+<-+W z;$|lfHrDpj2T3U(EbE283xWgl-6qPAk`R5*hRKe`Y4;@&tU}gH+CLz%2$wdO4&-XH zZ;w+ny|EWXXm;HTR`#d|JC{(vM8KSZy{*8pMIT|*Sr>#R7ZrigZ=9cw?KNsRn-c+- zug%xrM}F-3_yT8zUKpAV?MoSV(f~2GJ@(oYaGraYg*Z_IUOUah5yfpooAOb`Gz}8% z1?Gh@ieBIhHMT{$w@10tB(`q#@2E&paR6?!#neK9oBDEV&>nZlb (q>*=6f%(9c zPg%OI|7*PKC{ABXp+^#N-DY84K%>}m66XXFhYHageosUexFCjAz1kKt!#yyfbb{MJdtf4EuwrV$3cR=q?VaCu;Gl* zYh$Y$6FpUvU2;oxn#hJAQySbInLH!|mx~hEQE<`EQ#%L5)_4cLp0(#0mpks$IkBgn3<~d!?XT^Xks`X&y#-zF6SLrz#)#$6;7kN+nW&Cf zMn+!l1c@qx)OU+g(@68Ae>&60Ji`Qbnl%N#Lzdu%VOrloS!3!{$Il>CWMRWaBoY!- z%cWrg0e~Izb@qF-7dw2-DAM-O*x?LdjZe?o@>-Vju%Nb_i-+T03B_n93zq}@9a{kg zt#1w%Xd3Mc68l{Ms`rCqJZ{ZBvu~be^Xzchj>qMxjz`;1#JC~T;o)N!_ZvU7AR#jC zCh&h8(?(>w$g9Eb9<~EKeqC|H3M<z9~-&-fvHwtW8hYY@vDLPW=OPjhskSg z*M@U*xvD4QhO`sQRw=iUx1x7^^YsB`vn1Nz+jRTJt$ieUYH<-6gxdNv75ZCiKw}k* z;rvcK{TA8~8)s_KNQ(8R=%<-)T!>94ZKJgPWy#_9_X(GUvLXrl+2{f))dn0Y^YGuF zkR_219AV;wFPr@;ON)_&roBiR_&<@ZQ`^5o=&g-Gc+;mEw=T&UlicBt-(wxEY< zj+@Y69D08elpXqS7jIVHuiGRJEU&yAvTFGk;Kkmtuc%$lhhg(9WdkCeqref-q)$$N z-A;_D#G!f~8ha?Cvtkzodch_`??AmD)6;k z+DSC19MFTG)e4U(!LnOOwhpf*K4847iHs;FZL4k4CY=?V%Dg&3tXSz5FJ+b&MHV zdro_rb9+uu8!TRus*NL%cDB{Ff~K|AG_(P(FDWw7kUpZ23ooQ+uy&&6SVZswc9tX` zr5at-p+6m)(Pq6s2`ebjKYEmEJntD+;H#UvXm)nalTkI{FJ5bJJxUiJ)L8l*qDqW0 zJ^j0Bp$M=-*>ez526^yw^vUKq+RAw@%2@in<#7tM>2PVwZs_vS?!7A)>>8G zaqVZA7Pz8g^&1-{9X^$lRS))v>^iQ$ld2eHGoLt=BT%^iCkq`jRIMbK#&Z2TBO zI&uhi-3Z=9Y(xaFYi}3W^+TwL_(-Y{a)2xm#@s^w!)UPVEXtM>!d`EbEnIWoCVDAY zd}{o_)34S@@6XS-+d&N?QPdm;-L_TM$tja|p%(gpMz&f3PLDh_J+KC$Jo$1mH<6Io) z*vTOB+FFJq*hL)qeXW7K;zd(%(E=4ZFoN3VtD+o6!XmFAk<7lMZPe|}&5p=1+_YE2 zznwyZV(!k`CKN3k*KZwkqE}RR>2Y#tYy~bGZ_3khO~5AoPh=UM?1da-R(1r z`#Nxp1>xA(1|x3RI(Z(85cqWDPg&(<_Dap{Q1=6;;~ak~eu_BV;yiNx@W(Wu&x>b& z{rR82C+w;)FzH9yVX^2%blajJuKdMe@v}jz`GXIG(+t?5Sbp8fw!-wJOxj<-q(6nvk*)njhL-N<4oe2DawlZ@@7_87rpodwwcj(sQEs^FTZ=-B z3_*}|_m_NGsMJ?_*p4dhN3%cktV2h{tzuU1ij=pi%T|9nfA-y(-V(mz2UY#~*0;rQ z_DxqJo{B4}&};{nSM971=bl*-mlcirMa6}3yg65RIAF0CuBTDPJu($Hvr=^n|B<=~YD1LO&>x!L$VUo(q+Yl$sVe2=II&XYRW_Tf|;;k1Zr}0vOiZ8gY z9f-sAfy8|8#m@*vtxRsEg?D7R#D*gBM^#*MC%>$%>cL(-IHBictjMGM>YV?nWBikN z+0`h|JdwC!*LZP`cU%|$=(q_5*z3MRn?@2V=VNgGw|OpZ%6CXZ5+=u!oxZ)iyUL6_ zaXYKmw`q>8XV@0Ee$ekt@>JN$kXZG6IHEmY7PfnhwylfsQ;}%+!XKji`@i+ivfu0e!gbJNO>1_q zrj}Oy(bA@T#pIMS;hlnlY|HZB>3cr$i&3-}rs|aXv=1iPeRyj5x!&NjzpS`zTL(j^p7M;FAo>r(9})} z>(;dwgn7|#o}jvKy%rctt5R_K_XEK0)@+Pts`pDt7~!>(z3c;J2<(p8(Sud>f;gEg zIwuGZS?6cnCswvrJEsY18bUfqrz$KZX;dW0RGYDx{uGS_-LJvQuG$_!;;X=>{&D0& z{Fs$lPRNW`)yQSfBAu$Dpi@I7n&^)eg!6B>-`Q}VxAB(CDxCrfJNT)e{`sv~{^E8o z*J(U5*Y5R)C&KWU7RCOsyXH0hE-9AY`Aa7R^rRs_HflQeeUm6+uzaLR%(Dr*8+Q~c zbT2wp3@=|_HMV`S^JyjGF0{L!-|SbLLARfRfce`d4LzuhM$7#c*YYPJj!z@M>(t1HllrQD>`_mDsLV1| zGce3=eZe}IN^(PmRD-_xHa8ztyH>h;-JmbHl~+Y>`>fu$u9ltf=~ZvHSxH?m^y)6h zM~+EplVsqC^SR@8Cqy8o{%CYn3-Ckf=FYyi*}}+>_22E|2ykjc56}LSrD5@{K&oU% zN>#FRvppJpa6vG~NG`aJX8B~k({6;7$vlk>l< z3i75eE#`6*Q3L?iIO7u;9qFr49`fhOtg|viZ9lp_l;e?_gr7n-AhsTe#1X#U%Akz| z*Mje8zCUqaUw=GV<*Mi%2qG-$oRF53S4cK{TqtVRHO=bC2tH&v{$-?>&c=4W+K_he z5qKyg-+RU$yIE8fU)H$Ny0|>DJEcO<4tTah)V_)?P@MLD)YSyX8qDh|<6&-!8Ffa> z@7F@H8Ok!^p*WAol^qHIviwmPgno0UZ?ELD$;E#!@XaCb+W_=^;T&S#xluLS)z5_6 z=k43bww8B1kNe9KULu20LokA!!Mlm6umILk_Zac$o8`^SM(g__hJTDo_ad0vM57R%QKZTq=IeCI_ghI zJ#zRrKp1`x9)~J4Ewyj-$ggVw40%6#ZbN$>(^EFhowBYQ6>^$K>m*vXCLttP!0bz^ zb)AogHs7U(R-GXg?=9tS-1{^I3~`jud%rYLQJijf?X_XNHA8W#1&}iaEyiBgsOzUT zin`qs3z_3n100Ofs?6!;H{h%O(59Qf_-j080#U*|Tosb2(&zT=?d@K39gE}1suoen zi?Zu3k?um8`&(90go;>5$H&UHl~&hu8+>cWH=>Q2sW^1zlidzndLSUmrmn22s?b#B z*KswMingBRZLLY~KK=6SF3@v3gkAc-=^H;aOpncd{hr=7X6M0WNzV|hkfENp(5X7s zJO#8nb)0m&9h};qQ;!YTcx(iZSDr6luI>)I_Oqh1^T?H?`vzgL$zB)6}>Lzge}c{qZW>Db^*e}c|&WyVZ0D~q}LbInMI66 z?M}I50Ag$O^@(lw0nrjq`VJVy$=Ii7?rs~&bxNRDEOjnXjC;`D?2gwO%LlDK5eDBq zSw%K4Kb|)Ii*&8Dpn^l@$4Z=1e{S5;N$=E=D1oK%^Q|>p3oYrZrpNalV>MNA2W2{xgAkzcyA^{hYl{vr9?^_HnVx z>ZkEnYPN@?uBU5ACj-b$^|ITMIU)muK1V-f*7TCfkJ0wISI;CaS#ti6lB@oXeNWB} z*r;OMt`r7UgjiYd2|0F4Il`sys|l`Ft?@;jn$t<2__(O_eBbxsvx$|cV0rUeVDus< zq^5Rk!1gl#T*)M(@5lIr!~1E1wfdxil(VlqQk^x(&)6E}zZ)tY&CAO;c-ptNwyJ+t z+&gkU?{~nqdJfCuW?*2drYS3MHDF=VDPA!;%xwG{`J!x|EoyeGtTI@-hZt%+d3P4m zkoHPqZ~Ln^VD9wpFU07S-uOjZxyI+ZvE%&@w}&sM+-9A;WG8=iZ)dYLzNZ&#w5tF0 z-EOpf8ltZBZ%q*6iDSQQY~djJ02SZ7eC6z`kNAg{*yW$siv4T?zKmx^#7d>68<}@4 zviJGqV4Djnq4qLMNFTr&Qsrl6n3>dycXGC$XM+YBLz=v?^W>7y&rg2+np-5byYB5a z!?K0EDq~i4gZ-hyKkUM!`2@?yOiOy>lm=bdy>B~POpc4CL>erx^Eg~=s>_U}SNj3R zxl{ec)#I$&WE-q*oih0B2IEzNaIK2OLTIR1r?@;;kdLqI z)2E4$$3wSHu}gKB3aaE>U{{=Ijf#C}61~4YSu0kOh-+RCDvH1iozM-uvMWKknQKJq z`Zb>Lb76L{nXonqi$$} zE3$Jf^KzmNCu)m6vy_s{J+8pzBZxFXORDl)(|hvth(a~7MjqEf;3XBJ1=DFRVjrX5 zTOCZt#^>jA2k5+8w4k)>pY8mt>o?i`#)Yx4&2HY2bkJT`WxVj~yrt0JFttp{!9W>j znDs^qeWTs1((Id&9Nd^m)=nQ?OFTDXAYNQv8IT?*HzK@UGE}UdXR5k%QEmBc8>uss z#hG|ytCn#~D*vFNM0d5FskRUX6_@YDmL+;$7=Ks&L6=mu_s4S1gXL7~BP~rD1oMaI zwL5<2^gh88yap1Zl_=o;F3@Hgs}VcyW$xZKYXsXFZp(Noow{jnnZ6qM&mOONPQxF% z^7fpu@vmiBsH%iF$2m*4ZWtW|q`I0D@cd*j%1vyS6dYb$)W&wYKASwhIUzqgIY$0b6&CQj6xZnB2eK<**>!ijvf%g_G2!Ymg9=$vK_S zgR}HeX6qQpkLRL{H zCg?0PjOTpKvlY@no=0m>8y$3O)0C$qYE=?OnWL|C^8!jEdxRiIOQ)B!G%iT|v+!)? z=a*w4t2I?W8rwreN3Y2A`Fb>0;H^WV|17I@)~|1gnUs8>FSgIgvoLj^KPL~X zARGckd-w|d`Gu|Or(qB`S74~Bb^f74q3Tz>Fcgis=j`n4!F||zu&VG}&9mzE+Co@+ z^q||H%4hju8=Hrg*X?h>B&@*d;Gc?T3FRm+gN^I@X5b8+zpY_p1kd zgN?1HZ^a>KqhwlhY&`YdAyMXkrEc@{%c19itw;nt;3QUDc}C6Vur>ReXAhSA!t)AY zBma3i_+R++2L>VY6$+R66?%;SkWjX_RF%ICgYS%?6kbO~-Mo3|>fD8R^WUc#L(Ca})!PoFF z_zuNf7P%VK-dAkk`7|VC%y`54)~U^N?RQss*i=r(F<8s^?kr18c(`(CXy{rpkn8kj zf^l;;Gowr}CYRi_6yn%#T=1&_C$4xoJ!)7T(QOHp@n4DI9Zn}#Rjjl`A$3=k9ENfJ zRG_yctG{RGz5(~=|{u3t06 zwB_%fqIUU^;=>LG_4d5=U*Alw&z=hGId!wo7q1(@bHcagUW@`JIjNekTC3!F%vO6F zkiKx0_3*R&@7+vmbL=vcEKyhdetNFl@?yJ8IiEkeDMt0>lVU#SsZn-}Qg^PyH?QFF zB#C=9Z`Dk_e)yq+90Xw|0tml7qQKAQ54X=oG?KA17sk~P%Nn_kplOVh6F@4g5Fhfn zd`TEqcLAcKIlk=sd6ih@q+yMtHulKj-u>2UDpt$}F51)`J4&A}59z#RFGdUYsZUe| zR8Rn(%mYaAOw!}NP*82p$?e}iCoWWpZkspF8pR&7;4$5m{QJy@@{+K{z?7Xx^`_wG zPNAx3+j$lPSQX&q#@N$tN^b>5(Z>Qm+}jT-(h2<*n4+(Yy0kjkBg;uk0f2^Um>LRo zS0aBZ;codM%bb~P+mX~?ql1p$%T{&f(aLw!$1L0^*99w%gq~F+UY^rc#teG42Q{}% z(T;FD+~1$9ZCkULk9}%XwU92d6syH2Qp;Jhi~7nICH9nn1dh&vM%MQy_h76^e7=l5 zZ5{V11m7^oV<$b-G!T$+Ob#Sgq)Rl6c)y)jl>CJqqepq0dA^_HY>6%6 zBLU_+`SJJkC2=Y8_p)+27OjPH`SGl{vags}7vmHzfwkHlgwdtUFi@?uK4X;ZOL@8X zD>JqvDrfjaZD@&DkkEt+d(}epoq4{colvQZ8$Ql8KLwv+V?H@dcE#8>dB_gV5W_~-Y=wwIb6(fs+A5iG0ZIRpG;#p*^94+T~>Rk)GvoS^D zNhO4^;7>nR8vz=~cEAdGikMqI`Nc7-_nbp9_!AtnNxSZDi{;RJa6)<2CcE?Duc#9& zh88)L8x`t-u4codoGWLXd|#^y)vm4?zkg5v;TO)XSpYIM=7B#_krsWReo9Lb(@2-Q z3Mu)aTE4dD-8YyAIjar*^6LQ}`3xsUgUv#VDF-;1O-<)MBe?cwukq8y_{4H2hbLNo zug*#DU39Vf_38G%hT0j#h^D)@n`$2Q2=?3L4K&al$EFaLY~xaW`n&k1{z&Tv8+gAh z{zkC$SFOG9N?$gIv35Wiu6=}V?hpMJ{R)WGqnDf;KNk9ew$ePj5 zn)b^j{(CVtFy!Etx3-x(@u06~#@}(ELJ`R;{UL)Yda0YMkZGTPFep{u$-Z%P{KY&6 z>~{%ov##H?2{0zyD&>~z#WN|Zrw-Qu-z#E+Kdp_%dNmBH(OCL(;72i6O zED&8C=9uyM3Wf{Qa;tA=;u7Ho`i2na1AC3OSrz4+F&9wpncXYpg@u0P@fy;}?)|5l zM|^53H+1=u2)m`nA9tg((|E@c7&MvLpOwypp33`cAU~U%%n|dxpI>6;ckr}yh2Nd5 zjFo4}3y+eR!R;95>^@`Uvm}H;x=85n&&O`UoCdtwqB2g^G&$Y>Ncq5i&FhQiwlTCn zG)L=Vw!`livwbQApw#!K@>({d+#|zEy!nU2wSv_=C*Tr+Rr6cl!sUH%1tD}aki3yLdnC7OXEAXt= z%6cy4I84Fr1QoH!ftD!(9Nz^%p0L-L4=@*0S_~}F2R4_q;KwI~1S{Pt6^30Mr`WP@ zqa$@#+k8Xgc@F-UoIiMG97D_Y-b50%&xaCUwOJ2+)Hhix2ZLAxTG8M?Q^S1YgCD)2 zfHy9P3uNvuUuU_&uih8lC`AiZVs{F!d{{m}P(R6l>un()eqb;%{;VSFD(bqoQBoqf zy7B)po8d3TQUP7U%6aG7Dyg489zK=Y`eWFTR4{8yn z^B<7a4bVPSH0xxJ-MA~qN>*ZBKNY1eEesMCW)6#N!wbt#N;gAh{_8a$6fF~4>44^iVyluWy~>h{*)D8{dSb|vf(o)z_A z#$QSW7h`V#s40<4(kgy$&jo;4wqsE7auCbiaQ#0ls~^}FBBKg5qS^kD&lZqtEM~H? zxz*b7U-^`*uwj(~7WM?sBQG){w?ThN{i~9Da-2C}i9x0GUv9 z=%mYaYRZyU-`aTnS}Z=AC=Z#ruDKS`Cqx_O$y7fPr-fdd<^{ZoaqBtP2LKUn_o2M@ zE1YLyBJ(Uj9dBb1ZU&HH-r^goipy=dk}QoJLj%ToBhrvjpvs&G>=6*BvRw7TZ9R)` z_O?)FdHigTV4HG?`;70cs`8fS|I?T2ijtnw-H@fx!KoFAebN`es+q$&PMg_=RS)0D z*7*C3p%zB3%%YE1&PAF!ZU>Nwto_BeGSRwZ1QMs3fN0{GX#dQ%ht@%4nL9i1{gbd! z+`V~Y2vfUIl)0FWxk{yU()}|*8;u~zNcc=BT#f+;6xzL;F$a-Hrhs0MWYB^XCWsYPCD8^XN}Ypbq?uVdws~*UBx*j65?d<*_H9>=Ga|hd zqQAoqMScB^(Jlh>Ea zCU!^C<3y;?&I-h4!@Oebb}b+$21cFg*;1}y#ZXeP%Cql`PC7VSzThsM_*Ybq2x6wP zc1AdYuGyzv@nWSkUBk_V2Nw9Up6+jylnaRYi1kN2smD%0gkp6`0L>2wgE+=gV4r@^ zRuFT(nA4E)lQJjUX4O>t;%Rp(jq+OHI@;D%P?`F6$b_Rf7V-P+zRCV>7R5j-dPAen z8Ph1Lz12_7Bx*B!`}CKc#i+H~^h#_vsHV{{DNLIjj}=;-)P`>7a=m2iiuH-NzgT&n z4zeUo^C7NN-=y!SVe@7?bx2W~k0wyf7I}*4vFqWYh|(|HV^54;J^Az&+hSr~mnjhU zP@<>aAKe1XL@Vh(zjG%j`{I#1RgRr|-dBXovI=W^L)zN^M^nwB-UhezhW1tDdED>0 z?`V5>3(TZ~Gnr@v-X9i+3*S=q*x{>z#1ecm&6HbStQ-^CeTF@VT8a9H8d%gKlFu@` zn71I6-#>#H?;~xT+YOVnZoflwHKXmmG95{#lESd9aPDQB_Y^ql236I6e110WXE6-g zN{_3E&QaT%d7TMpU%1xCDIk~=^Av^36f!{=keIt8nwi?W`{9OK7N&4BAje2EQ9)FX z1lm45gKg1!+Eo2wrH&rL_vuq!xKZay|9p1L$F;xv0LsnpfQ&8EShy2=2*+ScPl&%C z6TVTFIVo>1s%NHEfo_P|4WAcplMyEE=}|mdO!i%?5b%HP8h?s2jY*sxOn4@=5U3Ec zy9kn^Uam~V96_nAiCS5Pc%^a+I?9K{OI}u+_=vM_EVikVef33B=8xJUM(is+Rr2gY^-S#my<7W4P7;I2`2w&+ZizeYirjE;y3mXH~ljU0P zz=wY@-_AWL*zOWyn3McLbaW2bA%es zeaI{g%i-EzRu3)Su%-5-GG*Hc?sdESpndbazrqYTMv9p=(N-U@CjN1akv2k1_t%3r z>QIJBveENqgSB^w2$#G)es%r4dxK$XnepF{opRK|xtLCD>?D3qU~(nU*>As~vy=WE zlDSt8#@wJDbDX!5a?Hth9h|1R>K;S#X3w%lrvl!Se(F0Z!i`=Qe~`}`7AxB=cf&3%nd zX|v=LLfh_Ov&?dfq8~kJ$!m+H?-=+^XI?{Bu0+qHfKot?^WP-_F+X`df?Rza3)DASbx9Ps+2nqUsO}D5HJyk6kUUta zGIjH`y7&%@Zus2o0YC6D0}lk1_JuR5ni9 z@*y)(z`1&m-LLHw?N%ewLgqU|lzRP(6*vrAHbtEM*Eq;=8x-RNJ+BtE@(%0Vv*Q0s z`{EC{S+P1`9tWb~K{+w&Q#V8r#7UUR$gz1D4e(IVYOF&|o~pvEjS>{zU%WRK);Awj zDf_-8I8#$46`GdIEg3Ti2Rer;XSXq|S{RVS(*A+yyCfst)*thViplfGE^PH|l-f|ob zW>8@-rY2sfgsfy>%``S&V8i&YsUzIywYM@hmPo%J?~^;8bf4-w!lpJv;u(+}f)57X z{C4l&;n8h6g27yWdAt5}v|N8cPFrGJO%G3vU7&vuVjoQ_Y~uxt!L6tLcYF;}&cfD} zAK;r9^+7RCc0r)Uvzi;p`}gtNlYqRv_|vi(dnM5!m`wz=5b>tNqUG$5_PGkgNF2>; z-=tjTQv+SyGffa5yW^{wmWTm4CeBQ}X`%a5=m#E4Z1{ZL+K#fLE~@?ZioG> zzItPi^8jeSS^>?)lgG8ci=%admQG;kwq?G3mQ^`i&I}h!OWhQGo{%@Yb9DQam#ciG zzfTkey%ml&k{i?JWo|Aeiq7u>V>QjTS6n&-JM`yql>MKJnP%BmL@UR;*k}l2-&$Jz z+#A&**DyvRmKW0MLP~I@QC8QM)n=4*TlD&50Y#`-m>!e-p3~ruu0+8xhNN`R!@TS< z$Gcm7+I-o2`$V8gVT*_6Q^S-w>-WcdOBj7pmm50i7^0ycdTT21NZmrFV7fkK)stC2 zjTnfgY~<{*T)J;&rCjD(Zn1J$;>6m3jmO!3c-40UINPtt&^jxb>cN-YImXr)CLE!z|;*ZD4k_Z_aC)j_R?jr5r%E zO{T9wR3{7sWWUfH|80R=cB8YXII?o%Y+p;hcT;(_v#4HA$-C&&1=0}WB>a466o*A) z3R*DKiDN_xQ&~5aN}Qmpdl+)xN71wZac>x^f9-}A7J%o1h#=V&y4Gs!CJ$ZfwQIsMLWFg15nFYJ;er z+I6ddT<7^&0DgWROx^$5B9mim%P~@xzSbg%fI6hNTh+c;8LABLZ3feQ`joX1_ktWR z1rLOR-^4UbyI@VFr6lF6K%<7QKBD~*&McjD{Hq6Tb?b3x4S0{;*_%O3BDHFxk2Ha_ zU+2liF^BwDTfDo`C)idl4%EXe857kJ-Kj3ie_n#m7AoiZ%UR%+^r2SX=}M59hM(4l z;oPR#h%!OquM?=9uW?zPMoGRI?nahr{HoX52zB3E&NmPV%I0BO^ts%R8c)6(6g=e^ z37vEnZ>u{7M2s|u+J_+sn^Uv7e@|0^eHlP2H#GP3K67Y(?0OG+4%fN2BxmGe#4^wf ziH8h67#xZB?_~;?M(fk)$Tfc@@l|jsjjzvCMtF6k>(h^wB{k+8B2UgjGHmfIEcI?x z9+xxK#ks+1-I*AZh}AdocWV*(m8-2{K}yV`70x55{ga~L*bYCVfc3&qV#s18xWSo% z4}8t7{bLbfY+Xlha!H*-TE&8AxJzHp*MYRBiIW6g!VYbU`<;Tz5BT%2{Fc;U-qpFU z-p!X;+ET0snT28?Xf6y%93dVllVx+aY3-J?Je4jq4lI<);hN5T&0xg!F>ll{Mi62ziR!WasHyL~Kgk~){P~H{>LKeXdZzArg^y2MnVD_{ zw}rUK;H$LvYswFREO*`+18Asho`|gEuPs)x+@Qh-J(`K3GE>pl!^c=dpiW|@XD$^Aepl&4-jXc*}Zr^a3PSk{xEis zp^42DHr*jM???MivSwb?>XwuRkDDFf7grZzyHnNgHcE;%I-$3UbX!7bADSA4b0GGf z<|QXyY5dS{Wu5Dsc-XgX8Y@5a8WpscD9GD2vBcPhfMnVTp{YjcZ-K$CM$zlI?#NAC zSevz!C@a^8%NYb0M3l9LtE$hLSDX{`b*%0Y0yzb#4)IRiUklo;w*i)aM^06vSiqp)PdQYOrRWD3-EL!X(p z1m{n@>V=YSurPAPWSkx;Lx2>bMOAE4Z`j?mQ zZEoEYUke?JhiXrq}ln4}|+{1~t?5Izm;Ubt8`*gyF=N54qun%Xz z9}c)R3(w?_App#ui!?0>Kiw^HP${ScfnX+P&V%}6Gf`f&hzIlE?Jp~+k~_3ED8nPb z6b1tt0tuM_<32UHSUVD><( zWCBo}?zyErmM1$ZTIpX<8=W;nx`2sx^GK78{9C;gC!~PMh0~HcAr8)W-H50s-IQM& z*|H-H91l~pZF}7a#`|%B-nQGx9De3^M`@hm1!oZEw~3QNj0cqE?UA^Bx;x%7mY<^8 zq)YNFnVbZU#q@=eIK&^sEp@{)!C~IPiy9^qf!d^MS>aO*mu>EAj$i#Tij#Y@#qU^j zVld8`o3sie1eZ=*)ZIIn8&?Sc=2VFbg zuU_|}dR(pf#Z&6`QuG+?QJbW&e6t&>^6bcWBv`Voc}HlAm>>{s_GY$4_=*A<(P;%0 zhNG=2z<~vtlN@@vjU&TxpMx8c>j); zr;%wrY*ng{*rpF!)W8@e%~6NL4H;cRt1f8{Hu7%GEN26fd5_X>U31o=!hZ~)Nh`&I z;=qDdUa%alaZjfC=Lmo&<_DSROPVC+M^q>=c~R3px9I!!p1(#^Ayzx}o(QZLZpM*@$!9DG%XC2`EHnV#bwcD8bYQEjseR{X6e~j@#2V5>}37Z4T>>T z(moo+5oP=~D@~coK^B1=u*;A4USDE4r!YaUJB74DSBElD94`fqPb=w}0ji=Ufz5!o z+=5WA)7kZ`m7jupXf9Tk_X20QoW~dDmVH@Na(Qw`4I0xXSOd2#yjI()*ISQd#Nuwf zet4BDqo{{;jBUkj_EpmBq* zh-q$QZGR=h^j1>KV1$1JicH?ibCLq=Yitd$FD2L- ziEtnIF12<((eB?TD)K3>o?ilDc5L&`*t5>t0x7HQA$nQ5m?#rUj58yJtwmRDnBY@x zgh1@Jy(g84lPB-e?p2zMKX!(h7}gpkRrXtBs=BrII54@`0-sP~i#h(hYdZ8hEc*RpWwu6=(HMV(oxec0;lFRi^_oJOo1mzTWG zMZZqo3uj_w$%nq>&x2w6+p(~-=fgXTP1nBsNr_6O0ne zUnHS94~r@slbMTHvAox?cG&;if<#tCA|zx>qD@umiay`9Kh`!NqiL%mLzuF=s}guP zp@Uia<-mH2Z-wFx0asBxJ!f%vi4`vhS58d(FRepW{&MlGrl#f?1_Km3d}9VK;kfuKCU#%m@Y;|&>7U6#nTv+7ki)^H(Cw*3zTAgHg5{`7 zMtO!CVQsUp+y4uqGzuHQ^PCF$$`!VFL0VUZrnpPb@+mzy{6gpEc{+ut45=LclE5ws z71f)4_28t(5-fO@UHOmfXQ);x=zr0T7pGsf2CG8r)DL1ftZ>Xlel7!Gn~^Ny8VZFm z0qwB@mqPE(j$mOM%c;vYK2saFd>JUYxWSG;6MuW9cT;RmwysPuF(tVeeU6%ywveVc0lKMFRS&bQsVbG9UQA7r} z;h(G@)@FUeF(R7he1CCq5j$*t^8Y_W3S=cZ;T2DM5ZIih#FoZ@+>{r?$*wjA-X(k4 zwt4@c7#78I=6P>W)dkm2hRvt%y69;EgKF46mHPSQsSv(giTI$Qb zJpI~{fIl~RfK(maA3gfq;jNi=VwV3*YHGfYFaMLdj>r?^$EkX=!AQ-mZx_toN)k}@ zbJ*|34Jbm;&?=GBP>@htw)$sp-{G5jR4t(M2EAm<41W{t>-$d{f26KiXc8-ck}*$| z<49@MO=i)OS>wRgoby+5-%1#+nG^o(9x?ksuCcUt4-Au9=bT)ee*VpW@!+eV=$xBY zTO4h~PWsH1i__c!g}w%9Gfk%6f~GAdKTb>8E`_)`iK}D8+G93D+8N1z>AgyJE&cY> z+gn!5&_bGjR6uU3{OE|eG_=9`A$#SVjx${9*2>WE0Kse>=Z-F&G8Nc+++1T)YKJ@!*afvN-@UbE;+fY z73U^;H)?aVYwI*`92YH37{e{G2WtALe#&rY8CJSg^RV~$ah)rs_g7bT9Ky4lW9lR3 zOA}(TGEmnTjX5ohX-}S`*m)Z=eG+A=;P_sw#Z|=S-6Danyjo4nK8-J*2Vi8o7_~eW z3A!i=5>N?1p)Q0)doY!V-s|-TQT`e`{;d~XkI9BU_U3M#dZFaM^?C-2eJa&BDY`EF z7jMZ*8df+kZ-y#5zx6E?a%>2WaH^`}#D_!}SM7}onRdhb+*^Rz*qQn)8P$S+KVP|$ zndFvXYZviArkisvRs^}KYry07U6MPw`l1~qt3k_g70Yp^*VBi#eW3{gO3hckd+bPh z!Q=DWB=!-R$ciJ<_Z*ec?28gW$*5ejjjAfX5%9nwlj zcStu3DXr2SLpLZXHI#J6kkVb!-O}AH-SC}3pXc|!?^@sagSDI)=j=JNXP^7Juh+0*F5>ywFZ4y~|-922inx&t` zq!hsqcNf)Ev~*>18x<;!dj9uZ@ClCd{Ok4wRYCc(f0DQ>YJ zrl)FQbskvfi9$~+a7SoiQzAmdZBEVG;}V^N!qd=(HwRf|XVRaqfkl(;Ymfue$TB-4o&=@sLv_Kl)ihmNW(Y`^=MoyaKxX7y=ODlK*IQYv4PP<&E)8RYMm0vbqYH1I(+k;QZVa*WfD4Sv3}tvC(Xqp51j8oj~IxOu`XekXY7<11+sf^2caV|oGNN;oMv|&=jZSl{n)6R5Myi1w)F+?#_ zciY(z_^<9&X1c87Rq6_~ugi#$oS`Mw5y+WJqxJokpA7u@97q&ChFZ{s)0w_4SU&lE zedBjH@X6E*CtE-_7wuS@#|Rjuw`r!@@K}CYpxcaq`z3R27qRXKK)QOqKih{alJZKe zy61<1jHiXGT(YZtz24Zi!&!oIHh@mYv_=xOJ?vCVcZd_ajS0roWxo~e75stVz#BY@ zqac^BcDuks6rPmT6OFPz*LG=w0yNW|BBR+<*LJgYQE9O&Y9sT%h|@P{I^ir4j_!k5 z@PoTnal+STRw{lOSmx?tERy1u_yxev-P3Yw4^R8`g=4<~#=D)fpr4B?{6g>{cMRXo z{{6_7k}*cV+5UWeHRbCS>pZ}4*c*#1!YW?1qaA%s|LUcSw40Q% zW;;8;DP*cE7N`-Qr6V$q(@|q(9cq&@I3znj^|Gc?p-Z`i9Tn78JP3j3s(a)`e6!r5 z5&o+PRQq6yn;)QwFo{&Z4+B=Y{{BN+ya!lqFS{LcA{gGA)i{X)7t{vLRB+8PiZ@D% zw@euc)Bkez$gXu55K)-tRD@aXmVepp^sO-0$h{LB*$%CDAYeD$+vEvN9Iskf+fh+; zuqsGVldaySwK!o_swzT5;U7iLPDAVlH?&yF%ig4GBiv{QJeimgoVKd7getG{u|2O| zL{D&JD&E==)Gd!OjFF9?TJz+F4eGTJlHReJoz1VlleUEb^J|*Y}{kH z{N3$GBD;AkTHyE?xUPd31zgAPb{@@uuUTb*pKL$KZG;wW?Dj;twI|KFzK1g(Z=He5xR z;c=GDw02bQgd?GtCNj-smqbOs8%uFf3!$UCdh~#wV7pjjb+$*Tb!}&K$Jl-0G>1O5 z+HTUG;z9z5@+h23E1Q590-d4Gi)RM{%6ebz@n}3cIIX*5@)aHEOvbYKt_cM<||*+tCHh45s@ui;EMsC>HVp3HJ_(F!~D3m`uekkE)!R0QK@ch%0X^yQQ~(azbJw%tPP1OE?sm5 zzoDfBT5h7Eo;jze>kJ+UI%`#ZLEdK69)dMM6!k5@(J+tg0e89an05e0f1N=O zwp2f|h;gz*Y(u~`B1Ii#7RA{xi9$ZgNty!xWj+}-foiL?N(bwXM+D&+-dShoNdavL zDdZ(;iaHX9nB|VcCTgK9mbr_L97^BW3x=D_*;t&t@F59dTp>!<0mm2}e~W_qv~Jet zajl>1yNXHHC%C1JC{#?fl^Xja4v52eUo5RE!CWe<2h+T&xC*IYG6LWZ;Eh%jON0lhiM?{iw^GEpZKqlD zb31HQKZXGmfvC{$--nO7NEM#pF|sLZ9*#(mvX`LoAGN=PJTxN#ngI4rzn66Q)y0Ds zD`P`ap2vv_QSRrZV(<5jaoq(dE7z`Pu{ZHJJ zDhTvY@$_83t+8Of0QB}53kwTX$Re;=2sa#GH)pl2(K8 z|2Pb=!n=5KR><&wIJoz_tUi~E1?IHcC{Qu0M*t3DDyboX%C4+N2<914#A#>4Bo%Rr zgAnBIcDj+L@p2^u5R7gF|$hm%Y+_Dd0F$XfA{JPzDDK8*KGlGKOABs?G45^t7!VQjP^kStitC0;PnWENn3i;${H*o`II^dSDM^>_ z0rG4Rm=A>?fwnDhfP?RDE)vz1H#oQs<>br((fLl*E`;Gx|!XZJ_TM+JZDKAhBZtRT-|eQ-e3(unXg?A}4H-V%;v9@y12&@;B^K=uS$0sC z&35lVzx2q+7r@;U=IUpy^uQ!?*BJ%OClTXjC=+$uji<)~QZMncn|jc}p!aA2w`*Nd zppd+PRR^V*8xvamTxZG;kwyR^qBTg^hK~ulXdf>NfwT!g zH%;?90IFIWMiNh;FTxs~b5wC~)lauEkf{C~(M}OO#D6jTQi1PNPQ}7OZfXp8@vfOx z7NDGHPVVpZwoXG(EL?>~5wHYkw_Ei99#8L1dQ_y@Q*yMsyM&4=b?S|222ct?ByNTe z5cQ4zM9@4}dIEy@XLXxEWPAXq&x4L7*sfz;KeoC$U7VWyxz!g5l-dMX9~lAEd27qs zv8*O;qVYL{wn&7X!yCU{1mWn@sNllxa0<``Au7nt4X9Iv(A&@J4DK3+`DLv4#YOR! z1n^@9AJiW9!g|;&S;(s_1#(RzObs(hfCg0tn|>0J!TJhi%(I zgW5dwC#GzpUtI#|^KfEv+^p@?P+!&d&t#tH-Sr}i04yUfG=h|yY<{t6{|%&F#XkSj zrtz^WpZUWehiJvA=@0a;I6_C|jss}58&(}t8~rGa+1^X)vU;5p{dUk^A5x_yddolg zp+w@hc~sqRGsipA(A{@t`|8u?2_ka6o{wiX#OF6w_OqpDW1A0joI`cYg zJg(7mbM?O0gv*k~DK19SX@N4qByM}}Svz{*aUwrwAYv3-RlMN1pk2>yYR%J}kq|yu z|6b3%>Ob$XFy}X(;dzIzzWhlbMIrZIOf)6tu1@%JFzcRA!ED#)WVkshSgp(PvO^rf?^Rb`99rs!>v%ZF#`>dcJO<;>MQBash>lHe^g{F*x;uO|4+9YWK+>1 zR<|Z>B?6VrGMi>RrDh_n^RGtXF+;|s$6XzbF)_Nl0_r2J0>`mQw4TEgyHZoTG#IMm zZRf?;#rCD*gH9f&cX@8}s{^~1ySvTtRf=D3CJTGJR5yoYo*{unRZh!Q7d;VwqeB%Y z)&{iR-s=WhF3a;Ddm z_gmrjl8~sq`FhS1>xXmecx#VcEhM^l*#vItgJ#bvozVb+Q*x<8x5XRE#!ddi$kSq{ zMwwBVz5@WTMoQERY+moAx`ZsEhiv=EP z+co307_qYt;w3tuqD&jjb(a{;8`UGva~(jpgHC>eOzVKZ z0%XS*x+f88X&BD^aG$t!W@_-@jJMOw1O#~8>3W<^&?(&Z5B1dP_lU&<3a!B!9meXg z??e{&w^tRPJA!>76pjFPR;FJ+wZ`UW``P18sBJw_`wu=dZOcm+Sr@s!gU!N{+=bwx z8P*R-dOHcaaj_O*k`(_$V19~hcZCNz_xBqXHBg%BJpOCgw#om$v$+eLjV1pkmjggs_Rq zXb~Smg%rI1HAyd66(1L;5UQw34OoM^!}szF2vUk?l&5|R3)=hz)thC$`MjkJ*l^PU z@9*?g485W)CK~Kiz1>Ar43$Ft$W5y=yY5V<+Zq(RK04lTXjp&-R)Ox?s~j6zQSxTJ z8OJFOj;n@{tA5*?TSar^yTVO(&a~2eElZW<8qK?t(L(WyH-r%q)r!m3-*7Br1Qz`& zs=`RWx|S$p-b^0f09BPy(m@JfCj~tj0Sv;X;PL4vBS1uy7@!Rv^J88ASO*4F;@X{X zDL!&_1q%sZUS^xbp&w=W(pc+?Z1|4n%2@0el7Q`6gI$);ib3Q)S2;W-(UdU2?TPQ* zb)di$3@)S%Q~qsZ!T#sdu$mf;Zz2 zkW*;$ZDCgP?cOHU-NdFP7A9vv zD6TH+P_1?Wai2~Eye(4NTbZP5T(QfFoocHrt)RCkl>0iARC2giu26OOZ-|ywPL(-o z`8L|nKW6iP7CA-Rq(~%LGf^(Si<*S0MA2`g3sK6)uh~?M@Nn8}>i$V^y)SfV$}J%1 zny5>SyPkr?uh1KY?gi{?lPBQ4n0VI{pLTsw(s4lrI3c)hziHxyi?Eshez&qF3h4J3 zQ2j64wW09AYX5M24{W$_^P3`cd`5x^FsAu20IE0*SV%)Z3hkRUbyJ8}H1d4sS!N zrO<9SW~n?LiV~?jPQE_8rCT9@oW}ThF__*P(#X`MA13qYl#J!a974b&pG&eF>GF80 zRTbXm>>k7sE@rt@g<_%bA7g-95#peAZI&oNGhnWIVS><0Yg&9sE|pio@uv()o6$A0 z7*E=}AvLZ1Z_V+X7gF(zBQ%9s1Hqq)J<_j>y+jCRJT3PxU7+;MC*g7k(@W{KciqW) zx`U4T*xHF&)(&TSsX?i^9I%OAdA>o=YvNv6xYtaLE)cdxQ><8Z~ zr}51uM!7N)vH5wuDh(~-X3pc&_?%}E?y%lTh<%>873okR&u@zx2Pf6_ENGy@^O;~N zUX?^Q`#qzcYm}gsB7bPh+h>Yj3pVrA$2e(OCSFc_u@tUf=Har!@`mFL|is$X%}3W{xG!w&&^)> zKr~&}`M0Q^<3EYMsLC|Y$?;1nDKOD3+}@BJrAj1XDM?cCqw!%XqJ)cMqLh z)2aNiF=&#KryOt7)^*_StJjc|Q;eQ%ie}pw+{Y4>#oY_%>EU~w<*v05EUZ%ND!)*b zqo-)lT)HW<%mO6;zSJw%C4iJnKHG<(d%I4oTwBhzm~GifO)~iHCvTe=p3xPlHHco>_P;}O3T`PC|4L|U;N0p?PKgk4&^sPuhJm19v+rPP^AuF6%i)+KH5(s z)rhr${OcVv(Yqhj2G1v?5%PlP(n4{&24txx=!4I@Hv13*q*45E&M@0QTK-Xv>BT($ zm^SJi6O*&K^~9u4yQB=^3juq$%m4_?aG7xAx~Cs^71G%G<;DqV$y&IYJ};*1&VKbv+sOt0e^1IX6YW{GKh@ma?IU&~>} z_~KxGBgXM$%!}b_@1>E9uEpsVA*9(>bQ2%9wd_lHB8`i>Q}vql-ejuRQIV_1Z(pQm z{f|VqH?-30!SlpyhltNv@%ZXwQ>LkZb26F!43myC^O;5HH;eY-35M0z+Xr@GVE;sITLzDBp<9&@Z2UzvvTXC3;N7Z=y>)E&M zj!g$w;am?hf?Vm;=8WIusDLmOb~q5OT2(JP`_0XHcJGT1{PVwsP1|n_Cw&Pc$8)OX z2Nv$@Ou^fiS1nSFf0G-8ZX7-{*~jVFep>^vMa%P+|Hn5+T};)*KTvz+<=W5lcWA~- zr5fB)LTh&E7=IaRuCA%6ANz)w^Hz^A-Mic-hFfZ`Pn##||K&swKCfl0Ux9p=X}la$ zxQ}=D*4@wq{A_1Ggx>HvO5R_amq?|^?~;upXX1~QcHqY8(O=!N%16!Vh66oLNzcTMYaJo_dF5~Ap+?H98?~b7hTL3<i^!K_X`N{-#c8d2n z46sj1qK+KiEgbd$RJd8u{7?hgRlv1%bOQ)=L=Z@Hk$H6HS>j_v7L{G##0xTv*=SquOR33L1jIrRQ?jMwlJF8$I zf<~sS&#CJ5H|?Es`)}g~+q7bz9>5Eay_<+lle3|bCnI6Ryg9;um>ocWIcJ$apQBt4 z)qRBM4L5vyGU26A+i!6?w_$1mlP4%J&m|iR%LgEi(eZG>GN(#cQ!FJZxbf3{vg!TD zImf^;AjXEWCl+oXag4$AtXUvyOw~HZKoC%$y`-96r=h0uiI|*~@Ebv-8plZ;q6r$W z7p0K)&}FK<{lspJ#PQ=-)T0$1oP~Z-x8Lu*wH!bis~>2~9QjCdJLDp@Otdy&KaFIP z6ls&PMeflerB0GQ}VjcDVd>1 zezDp*m9pNw{4+T&x>V#apd)xe@HE=x`23Hb3&h`VrxGn#EfeR_)RTi>JqskXSQ($Q zR09(l=oe85zi{FP^n~GwbePd-V|BF6Pe*Osz4P%tIMY7ISF^X1tst<}giSMj&1DU; zs+1BWLP9R^t(9iagM>Ok1eo#p&cLg2 zbI%gc0|hI?5F@UT%MCJ}G!RFV7@cO4TK(Z?3xAOd)S5Z}7jx>zYR$YImO6TUy*HK# zTt8Tnr6ZWClSM1S8}834#`@Lro9>iGubS@U{7xuj+5OgoRMze&tl7u z^`?FLMrv0r9GLyeW0$kJb?1(vthwuXkn&7;sTTWBuap?dT-r#|!nM)~JP(nI93#Hy>iH#Rs)_fVhV?Ik z3nqJ(Jx5DTzHBn#>gI-x_a`!E-%Q3)_37iA2J z;5YMNzks!^(=wsXl4NB0J~BAezp9R)hA^XP)7`$c3>qRl#0XeWw(-x%{|2ad+x2GVLl%Jahp8TK6CBE_k#-gHqpw2d|eqO7Q)!SV1vEPtIGbHiLR(hIi<1h&Z6LfCchQ(%6f~W zQ^V46W;<+6%V`EAb@@wz-GGUL@cv($Qrmi4ZV>Ig+ zJ))w3=B!1_zJYk`OT4SeL+B~*I5)FLZ6#5#~e)$}rzI5iK+f(DUq%6wf|R3v-eij$UCT(Oq1;cDup_nXMT zp`K&yz^-ZIwrqMNcD427wNFD3akF-P%X&4d_FY~Ss0t(v9 znGG{|LREca+BnrRrvlSD$A?<8F4X5c2`ypM~>4~&*7vL!J^xM21n~B>CV15 zgQ*>-y5HbQY}LP^Ft#HcP7-hG&OyuHIPCwTlzaW8j8n-_q`kY!W5#qz(c8 zK-RmuZC0^MfQ8MX4vFda-hKQa?)cU3FNo}#E3vbTD7;9ss*`=Q)gOm`FWv8J=K6lF zY-sXKy1d>6wJzBdl|I%*JhL@u{+(T8gXn>Nwo_wk6u_ zNA4^LVijo@6sPiddfahQjo+jt&`9l!K29m~D!5+`o%qI*@7s&27wAdn08|07p86?# z9B%=L_QC}3oncUmH6+)DZ*CioDY6&-IS`EG3W6ZtwXeZW?1MLYeM=}SAKB>m9bskr+eW68 z!AORBpuDDpm5Fd$Y{^r7fLT|M{K<>I8c?_vTW~H~<{HmxQO?&b89+XY4#-DiwX7oD z4|&gANM&Tizu2)K+p*qFzo|=(^AI#UF27%Q?Kx~Xkq2D7z`-L&6Z>3e%I(F`o9e_H z_2GZg)Q^gWR*->sRtapp5vlh&nsL`QL5jjGW8vR-4HoSIix+RI&SNMd-1yMCW7KS@ zRrTZBwfJb$Biq?48Z5L?uIjFE;YOp`vQP=1-!0oFOH2FryG1{rcq2~k&{lu@NjjeH z?0sJ?EWiyo`q>!c+7L2`c^!vS_}%(>yOH3sdk(RbxPEJJJ*mv1-DC1<;=a1`MElmp z=8&s1k5%U7iM9%xe=V|YU!KG6=iJ}gGEvjC#kZraw-vOAkt3C zj5}4~&KTmFC@E_Cb4aFmm@+0N>oX1}@Z*oBIl4Vb=HEmO#>51rsv}9Hi_28QhL=Xb z&s-pa@IT4G&A((IlBot#Fwr|{&?apZk(zRh$zm2F9kgiIggJrv(1?c=!?Krm@jS^G z5>13@S11~^MdorBrQ^UP6v=fck%Y|m7&qARz4eZ^yQOe&SMd{|AO%tNtfXzFxE-X^ zq&WYQHEp&aq+ncMRsli?#?l|J^XP~s#zYpdm-p8Le(6YJQ1x+n1kdHK3m zmj1s=6SCEz8dKm``q)mo!zx2aMx$D8i{^NZeo>g|_N!DS&ipzu{67YFVo>fD6HvbQWhGYk+h+4&2{ESP0k3HuM z)VI<>U&DP{(11~HiQ^pro6+=~SNPYnZTJ7Gb)N$ja;91O=X!Q7YJjj>2 zzm8a+JUvip=efc5lN44Fv%xB2C7*qs+M54a6IX`xIqo|g z(h%2kIHr_c;0+~ud5kxhtM9k~pBqk-ieI2Oh1Ei6&E|jB!?Of9a)diXHtf_op$wAd za&ceIpQwq6;Pharp&vXagTBGhRA=Ooq|9@wi6`mjV@o56mEqh@kGY1XqM<1rBL?)n z+r&?kD@#Qs(AJZfF9cYv+|NH&sCY}xEsHP_cQq$P*(ykD?Uk*XL0X&z3M$MH499}* zMJq~0mSzd0O1m&ZJ_RW{PnFVxj8PYalms`}OdF0!Ij~CLH-816p*f>^4FUup3Di9e zULO5aP!QnL{xVLYw9{t|!VG2X%LW~S4Np}`2+(`;?kqB`j}`AR;T z?_`%113!2+R~VLBhW9=LWzXn43Yr?IZ+pHPQSHkoa?+1EfJ+Z^kQ2?kSq3<>MTu&h zn5k@&U85lFvQ{hhf33m*aIj8i zHRf+j!+C}M78=q@VWoDtn#{p?Hdn|MZNfCx?0b>usx=AGX-Jalw0<>9{d{k0_V3Gk z7i5l+pA}4?C)`Y#zH{ebMcBO}EpIdOsMMD5Id}Do7bqgL)z(ae=q@uFa$V<`>cFBs z7HOMIAA>%9v9H9&Y%W^8XnHlhr87Rxqr5zk({3hNjk3b=&PdR5HnT^c7d!8VU87LN zSB7}HV$knyJ&43`&51CS)te6I&SoTYOyzNa?2#(0b*5wC1v-M0!NK?x%u&!*@= zRbsZ@$y$oJeNkJ_Wj)3c!`~?OMgGha4YN49MpMR1x|o6mb|Owo)#E8gT8siWLH-KK zV8~+~e*0L5PqHz*0tu(}mQSE3&SA~geyCavdcEzOm#W55QO;g`BRcpJ3*Lf9xjXiC z5#vEGEG|obWlqNmGq48S?Lq|r4qNDlTKz4+GQh4p({;|`Bzu_**>GRyN&c<(W}89p zOp52GK!(c2zc`|Tt5ErH5}d#@LAb3o-FXcfD8QASTr`|E)5KNT`6L%qG}*X5QJz{? zBvX6jJ@d7mV{+s1qFw7iqnFp*qkmmR+xsQ8}`MHaBn7k$q{0x6~6|G?D=J3-Vk7Vs4V~B?Z?E_8pjkz z5-A-vn}3xErqO{9+1 ziL0iy^z06SYj>W`wI&=)Xf@0ihE%itZTCAXp0r1;)})89z>=`k zv_A$RWoi)2J@V#FZ3f~$E@QW_yg&NT3v2l+qt8xS2B}^*>6d`znX%V> zxXvol4U{Hl9OIXm4JmM|Al165Op=X_JFW~1qAw~laIlKaC`j+(=XE3e{l!fbJzfzF zDq2l!)HwfCZ~%|q=IL{*83`67hf8bI|ZX0SC1aJJjuBHhM8# zEQR{w%`3ZjGR1-S(eK6>ILucr*WEWP%Mb4QlApO*j%(wrhh*dE!dy~6tj-S?t###+ zVIc&AA_qT17@MN!tm0UKkPa9?kP~BO%XCJjO&Pc3ci$=HOeYD&nbwdB~4oi+{>~5${@tg$cD3%e%fz4l$L}-Y@w6)a+bY?hI-e zV2;crwpJ5hns-_A@^*N!{aOXwA{-&d<2>AWb3~SnJ2|oDi3oPG4-UU3H0R4wtv~o* zV1Z7Lz~1sQ!QO_gu*y##hIciK3i=pIy?4JO0R`);&FJSJwWYzgM_psTzC9a=?m4N| zYNEWtRcDBsi@oH#IaP)9d0;30+kY@b z*S_Pf!NMa60LO)V!EEdr&#QHpy7imMT^EKAqE^pmtvO4mH&#g>YFr*iGaS!T8duv_ zQUif?(?@z94MlKV1BBKM>7z<2@rhK{nS}F+lKB1K z@_p&4wvK!?xu$c~R}m8twpv)Bd1l(_b-(E)9rkyZtKscO5F{37r}FhbAV{>16$$Y# zYqG=zBwZ7bR{yh~!4Xj=%PaFlRapjVgLm-+XaHB7lH1)f>3#azoOg(=N-wZa2u(DQ zVHi+xV~Wx zC@4)R(sQOxT2rZMUl3{0%whe)+@{Nkso0oDqv+c= zY($j7=W@rkzy}uER3?8eAsl8Qa{8wYONP0fi%TjGWq~Hu9khV(Z1g7@4!1^hyRf#M zhMa1Khb1PcV*IxQwn{}5CWSj&g{k*(8#&{*Klws*=>pF%F_b~R8g2q$p~SV5^ptA* z8n*U=i;qaS0HY8;lp=!q)dkWT3QJ zYLrMrxsoO)>ZDeI$D#`|MeUH>4CPJFjUHEW__x)$mIQJKDpls-&oC0FJ2!=Wl%AV~ zEP>NHMJ2QJ^3&P>!%U=BK;8jH>B*2_Gt{6GNDTNvBNRy~sF9Cy2I$FXm$$(0H3jp0 z1D7;iOa=itYv0(_G9P|!w@@0HMj4;G07b13{VNc#rPl^w2BlyiO7FXlzV;~4=T_m7 zonRk-w026neAd@NMRArlzQVNvq0$HAUG@1Usr+wm&dwI%$6w}rczeJ*1Xr|fPogua z&kp;w{OD16N=E#)COfJ76Z^)icN#*TV~p)9X@R`a&cGr#fJ3|dQ4~ZAnUYez44lKB z21Tkq;TQfv58gR)qs33RdoTA9%3Kt6ZKnN8Nn=K(SHvff@k|oExcJh$$vFm9+zj~% z9a>+fUxnkuXMQN%n~H*8{_Y`-8@R0d9y|HxlN1a!hhRFTFB7n4MavT)*Lw=cuZICV z?%MfU>7T+;RxMupu<4H&^`HR+l7*y3|FHPL0DX%7G3nYGn>LSIM6bZ44O5b=Rf{? zpssOvn4nir$MA_J)mckEUz(d7RQz+qZ*^X3Wu7bw-pb#}Wu&2K-Gh`S%w8gNxR=f- z6Dp)&SxWE3=2V!zTeK$$b(nDS0|6ymRWI>jJjxi~W$xsu-O_pYfPY!x}B z9*obI!cfLzGd$??(6@EZ8a!}RH)9JhIIxMTB;s$1KT$tTe)4zF1lZ_Mu9gvi@9^yY z%XdKYbtpM=Yrf`b-=w)hbi&bTvquenPV~Fqy_KtE)(TGZeY!15R!q27(2lVZRaYvz zPSPa)d!&w5U15wE*MMd2+(;-^Z>;1Eh2BHL9*<>x(w-+e)N;cCKB9-xbYD6?yKbCu zg^?Ytz!y-0ot7_W`u4C-ue+Kmz47sLDn;aFD=V-I`esbkV=8HpQ-&l}m9OhZrI`&{ z)0rr^pm{OTxMRy)0hO&3wm-;oQVPxYDN=S_Wbb<0A*(b4Qm2Fc7W-Ny zafkrjVy0IFp>9F@lLN<_ss+SMj93%g(Z*Gm+IsKy0unTcLfum)R)HvPr^w_d@z&P4KcARA*8BL|HVG>j!kh*}wd^%~C;vh4Q#cBF33_oK#1c0T=> zU7K1P2vvHMjPaw^LbcRvqOy!XCdRyenJ|MsL@ld%do$mFZy4HOAt{Zwt)f_K?^Bhh zI*P3!!jtoEhkPIwlidZAeN45c?)&Jvqk#~7FPxKQGEwZl9U-HaZnA`qSV`W#YTvli zqTG0QmaaZ9uq}ga+XF+)Eog2^hUIKkj0!&xP($Z3Ark*)9m@uPe04|CX>>aGf~O#O zn&g*eH|tNSYM1xfujk@F`tD+B^Ck!teWl7=#d z*5Q7YOoOcC&_9N0%JcCbs@hE)_K$4oE2(uyr#xX-?aorPfD3$B{n&IA>}oVN_%|G+NI!;<@*5=tOX zWUi4j7w{NJ3EpihP~E|J9?6S2`*2Dv76TwHRWFL|%8u&II>D{h^m|u=-MS)S?avib z)s@g(Ekk98{49o`uJ3nkmLCc5o!Pu<6$?A<=B#o{mc6MbUzzh4aekqdtB86s`>H@K zF`;fqB%oly5r%k@sG|n+HobV63)*}${;xT0{Bwcb(Iq=oV^QsFpoNYU}Diq)PNiz3EFTfi#f zvChlOnu<4e2DxZ+YBbINTSj)y{nrmK(TeaF?jr%)nbI!-S*ziK zx})#Ah~5A@lDR-~#Jwq`_?>A5Y3sECGyVs9#ix;a$;vJfYN;G!B0oGd;`BpMo~dGO zkiP`O*b&T1PktS*4ZCen+>#Cd>@kD{Vk8q!Z#8EnjwF_Ywm?=b2eE{HiOO;lIyuJx zRiw4}6dX?L_kzz`Hrw8H^>yp#?!?dG5#<;(91T9-6DqQk*BS|vK>B#Jr=hfQ9dFOj zW$Nm3f)p@*-$`dx>|nLPGH(~xL1k5IuN09VIx`E(dHGyVke%6+5x5xr`ar$gLyZ5N z;bWO7c6saYN8@Cw!*t|9DGeul1&*%c199O6*^DoC2Y zA00`Aqa=@8#L1`FRWg5skYxk^6*HPdSL*6)(U&BF>Db0#T40dlUkL*4@3pPBrBBx^i6%r+V7BI@euEKnm^>k|M5CmEvul*gOF zl8)pLj#0|qr4+-vj{rpR#`lp4QW0AF;}e)8=~##xwKK72rzp+yA#JB|t@RX7YiN}Q z$@Ddq4{(wQnq(;%S_A38=QutuWR(5xKcEFS_^Yx1{UrXT^ZHp) z>P?|+4G?}pwfOUs-`cQldMMTpbxm-4!%xP>js|AWEAEpIeeUaaCyzF?G}isa=Ea5t z9uzE+Xm>#74{^g|5=Q-}JR_72oY`X%xWn(kA{C&#iWHHc^je?rfau*q2OwHr$;?cJ z=AMfU%)k!gCm(j}caeKGi3JsoKk}DT0gN3{Pv*mE_+N9GYzz=B32_uX9!&plu!lFT zIC-2*9oaj1Pp`mVz&5odx@I1px(f=+;&_kf^#@`YMj#M>f{&l>%qL&(bjYEsbqGV| z3&+2&Ao5&Ch*G&puK8K4VcEXmD^oGkgI~W?07jE0_1!kF(;WGB1rWs!-Wn#Ck~_H? z_o9YY2Z=@_-!!bDb)0T0Q{iUXbSrp@!onorhT(b0?53s)u>@~_B8t3=>d6bZL*&0& zi#jIJi11fU>u$}UbO>YV`NXaobk6?#J0dN%dY{n>+tT|eYT8N%Vhr(+UEIg-nyu4c zsF-z-Uje|&1+#TrfQ(N)Y8Ax;)Bj!Zt163WmcP2%-+>*Tv{&C`VkJ}LbE&Fls}4g> zzI*7IHvxaR7Gb*rUP-8Xi5_1AA-Mv$UrT5kzAWjUxyI zxY&S0);g?^rR$Nzfz|j%DnvN*PKzE-gXxb)KU*mp*ap3Dsw3ME28#P_vaxlvNGnqV zUelk4MZdOToJ^BGC?1mtz`la3qvWx#PmMN9>d{gyy$q_``tm&#pkAM*Jx4rW5$SQq zgbjf75md2s!P|%reA$=(DNzzxwbHg&{q7!?rMkPhx#97OGO0G zgGrkGaBP9pkH2#{CM0wpTxU#;%!zT^FDJP1zk_`3W-~>7Gj^slC+S4r%r3V`>*aps z_uA3^(~#&?Y4)hn%R#yNtkLl#3^VZcB>6kc;MZ|D*`R$lN%x`plDLW;epa5xIj5&?O@=_e#33t~Rh0!lcD(g-6G2iwBV0C$3 zxIbjh2R@f&KfD*@Gh_r=UpaazMnT`f8cj5+qyX0Wv4{Hy5qa%|{qCAo?}327SsKAd z(=tefti>{QykN-&!g5seF?KeR%2aY+!u-Z`2|HKdBTco#iaZrsRoDCOrJYw`u?1ic z)5-A7ffQ^0!uPgQ7hkt*-uTbY^7` z5Dn}QTNTsPF3pUt13Dasa7RG1UWt?|DEK@u8c~6SV2X`WC!|`|f`40?T{~wLrLwWo z9So2sf~~G*7*;fN9d4qHA<~-|&cV5`R(`+xt)T#X2Eip|W!qe>y;g$eTWOCgOWB4T zo+Lm}*u#=7*hH?WtQV;mNmfK(uMIQDjT7)Z{{tx0(6H`OVhqqyG${a_#YB(~2EiAA zTR6+!YQg{hE?&LLj?t2_`(gag>w4I1X2pT0SpQc%8`c+A#WLzh>*Atwf$m!hg>j!^ z(9q$BS6J|+_e2316Kg6=F*x5VzRm0UA~(7S8w#%!576Wv?K}U6j$mR^E?tGKN8a(_ zsdwDm0%R-tCIC7x^dnawEO-IzBPO+iNkk3VbJZ*`(N`Oj&s_m12$d^VlvN>+lbs^@ z!~~(J<(YMt$P+8QcE7!ZL7bXZq=N~pM}~n5L+~M-m!E9rAG=Wak6qBG|E{=}KwPYWV^52{7izmx^dMsS)0nu0gNqBM)3dXbrx@0 zu_*6O_JN%=X3z9u*L2*|vw{+u|5!+g=+(=Oc3QhDkN#f%LHW~1#Fs;TC!M@1+ZDHJ zEB1KxK}AEpdIDP3C=L8XKf=ma*UUD3*!5jv8(pt*y>~JYssJRkWmF=4u?(3&gR4u{ zM?QAy!9!2$ex5?Ruv8_8NjYta_7yeN(Vtdsy)CXPLwCr8V z8-3&Zo_lt>vN*h9M|W~FG)l91+nJn;2x`Aa`#3dPI}zx~R_g5Q?vs??{jZv@4Z1`v zKr~Jz5JW3h%ln7tn)(lVI~{i+{Iib{amrFf-%!j#u~fFDn4kA(F#^RKoNrt~*{6k} zEVPPoUjf`eDrfE(Y}A8FYXH%Ttuj@5@RDdkeHrKDd{Y93l85kAPX1iVmT>^1fb07C zBy#t=Jzh_N*5rMR>{3eK)FU0zBQ7q!1?XRMzdgfCpo$oQW@Le1+P*6|- zQBqKlkdT&6rKCe)q=a-1B!_~ebV+x^knR$Y?h?jm7%&<}493m_`uYCOIe+~Q|M+6V zXV0E`-}iN20ZG2SeUFHNS=z8U?iMjKe^*-8Wr>qE{=W?mL?9O)-Hix+85^6o%PqJW zMS$p^>7L)^=inGvIJvl}xhRE|%Lm|aM_;j8D%1dy2ujZl@YysXWc^p#m_-`M)WP5U z!`TVjBzM1uhQ2O`Szm3&uBvoc1+Z0?7Q4}+t4h?)6)k>7d-+bMjM+%!e`J}Dv`?>A zR-DfDjg21Uzf!1090>Z874x-Oz1mdEhnl$B?>3U{OJ#J7fBzh>JC9%HH?72fAI`-q z@_R3wmG(cM!n+_78xN0}*!$_xmqP~t5O|*HLr40TqJzW#UA{wV{ci2RZW23c#isFe zloRv+3G3az@roGenGZiW_*HlK=-}7M3ZjpI^&qCV|F61XpyK~hH+ao15-??6r2m~p z;7|fNIMRSC9zbBPZaz6QdoJp662APFkSgLlM(bGCYcH2q-Ub8y)$kK~>Ur?1=1jkz zpm+xgjJ90Pg}Tj9eX$+`uNDWd>gzoQh!}QzfLp*E_F2lv3p7I;(9m`?@c&Qn*u3ey*Ir(tBo^ zxKz#PRkoK3(y6IV``wXEj-6DIih>v?S${&R$T9B!lO3b101?snE2e+zdsVy<&pQ_? zGd^3oe~pA-#7;=jK9TcD&vXBAb^7T^F^-36G9cE(z)N5|Aq_x_xgWDawXV*>5I-;s zu@0Di`RFWtnT+iN-RooU04H;o!I7tZO6iVee_ZJf0m6Mb!k-?ywh<**~-{V&H*DK`Yo3->mZM1wNfcaS|&U$tFhUHi%1{>MzZ)(U@%7P03MX|oHfZjl5~R^0)vpPJUvvQ|08AtdeX6Y?BV ztqYv3k^Z+P_O*$*Ynt+!biQGf|~69X&+zS7e8h}Ac3rl+-EoNoC=g#7=hKa zaO9mP2e-@iOl;0XkgC2{;**km#Z`h4T5&Af>I})m}GA8sHeA1q`Fy_6f z@sv9$%UEbcooQ%UW*GWlfS7x&pI{X~GCxP_#b65qdF;_!X0c^(Eb_$`_PBRVsAO^w5Ky++myLHunrN~48zAtV{&k`YuEg|w%AoBvwfOCy9FX_=QWfQD0 zNkBU)t%8}Of{M$I{c}L@)fV{xdyzy=RaeDXe(Bn@E(ee9p^6ot{E&$R$`2{VjIT98 z=1+&-;~*~OqJDr}RLiJB0Q7$A68{1Ahp(1WT_`#iq&yaCu;wm$@+Aw>gmIRI)L-;Q zHUzUrbE_PXrLdZ>SyszVpM==TO$$&)EkCd8SNh7!H%2V^tfu`F@x5+S4t`c(b1jFl z5fEnb`4QS1(u_|M^d1Vzw>^LfQV~sSHx&~d$C72>OFke~Irwd4BKM{5y~5=#a1>A7 zmboc)KJr0hb$==?Pq%ew=3{8Y;U?FhjKF7u=Bzk9kPnn`a>~KkB3A+&^6P+tBn(@6Qm`^b?pF-Vx zqf*E=$}DwhTy@#XsTx@UT8mwcg01`2Zdj8z7tGsH-cC3El(2hO*@K@^T#4>MHlqt( z%G_IAND5_6dYV#yRGL&YBCx=k8#>5TfmtiP)Ic%k6-N|@FiYYo8CI~Z{!jFMOt!+?e+_?y>RW*4X-8|q2}JK+ zZOof1UT@VZ_b=9g!hA%0`n|5op%OAM*@ ze*g?1gXe!6V&h3h_F}ItW*kai_a7f`2V8Br#h&wt;*Yf>3#zLk5KGjmoxMmuaAXQz)0_X+^mt_4ss%6K}_-C$%sTV3&E4X7Fr;SD+B=idW|g@xlDR*m!rpW#&|6cALIVrq+TX0QJ zTe;fvPk@=;pagS6XvQiy9Y@;FXP^01P1C02EBS9)qfhli=Q*Tt-4bMgwRtPEHLs4h z=_w#G0(Xqnod~!F)0DmbX`gRNLEls%!eh&k2Q3Co0zM(0jEJ;f@}6a0sYUv%8L?pn zC?(IdS6f|!s7NeP|4{wbZr8V&-z;8c1lfsW^uL-t5NW?uWis#GpQ zt{sKtF8oTmlLjhD&#Du-Y|0-59e~LfUs#b=oE-Q}W(gUb^;L!xx;}dVw&v>IJUR;s zA~H%BA$@$nDO-6_QzV+P{VnTdcv@>HVW`H>r^nWp4BnAw)k*Uxj4QL^gUae}R`>g_ z5$h+i#@JNl?9c#f9j}_9@)aS1(+O!N$~rpi*Y(7xlt#{L0bmT|j+%GB&busu20{iO z^NB?@jCgFU8m&7mc!UY<|6Hcg#XRUnJ|c*azbPpN*pC+Ymxq4#-sA>tb;;ulNSv$HyH@qHuO1r@Z#<$Tt8*iwK8-#-h7P0pZ= zHkuAq(>6O+3bdF{7Lcj0h!D=Hf3c?pRc8!nEnGZb@*bKzRu9&*dAgF?*--&q1al3Tb_6oO4aKgILiod|gbTqgz;$II6Hq6)N+3py7yFdJ46=y`36RU|T~ttQvS z9JdNO+*Dr!P1^Hp0RTiu)gnpz%H(P8_erg_t%w!851;@JWPOqV5W%Dfwa`zK;An5C zsL7kw1gvW+E2br|J)A@f&KTz3h3}oNy_2`5uWe}6*g)9RqmYRq%o8J4CzsdBj~i%r z_e*qD+&|blqTn?N2qrb2LDKOnJLFJu!6D?(`nnxlQ`%)FygCV}oC{b{y|#r8c(}xH zJ<{20BYVG}u82Zn1B&^q`Nn)$x1w<}9|9}$2oD^s(B?v+kS_*S`xbd^BU_pW`oYKy zFkfeo6%2M}Va1_jlz@+k1e7~h-Kb+{Vxe<_OQD3>beR;JUMes^(vsKW39U$XktwyzJ zJ#(r|X%ZjZW-N*Da{3w8pix&oO}`ZbKx9sDab}cL0c)PkgV>#$^3-1aRard=dWtT$ zTc~dD`V_@ifA_1_@&`B*cW!4OnX5C05t_o`6XVX$O2(v%xniwv>$56TrR!E^M7ZI` zj#dTjPdERrQo~+o<&;Q&JIi|i?W|pIki1%HyH38q z3ut)_RzIW0wQ_|3b55;D@I_=WCqn;EA^^855LXuJ#q1A>Wq}eiL8Pg2m6d?+4MiNx zwlx?gXIx(t%jP5RGC~|+?5@EA>x~`hI@*Y{%vBq*X$vSuyxF#Z-HUCQihQw3p{+J@ z_QM1re;3M@zuE!Mm4`(n)G+_prW6<6th@@@ zmY^%gwr&&F&aM8g?Yo7 zv2o_Ngz2X*0@Gzb>tN*-+NZa6rrzvXQdst-h-S4ps5c{wHUo1?y2$9RFG|6@1m!J6jYWi_&P5fO&0$;Bmu@=aJ*O{wGXzLx68y_%jF zv6z)Rc`fg5K8iPnwwqLLr4QN+zQtJ5k*EMA1;FY*GKn`;Fc8!@Zoau+@PXkp_*k44sV389KI})aXW-cMj1_&CX{4 zJnZy^BaS*^|64xcnq}f9baI@Oie67u)xJxh&8s$X5>6Yt#}5>GC%Z~AY4Zh4NC}TV z_*?lu0Id|*wN2@5T7=rSQQ1UOWL0yg4QL22m!|hnG0y31%oZ(Cs*nD0-k8G%meNBj zulH?Y!nee-DzB={LK%*BpYjZ+uK52q$d(+D{-p*#NI~N%_0Q7KU6kO)v4m@~`74L%t9y+jPsEoFO`VS0C z%)c40K6IExVbVm#5JKtDFBReiFCHs@DHmXxdE(vp_Oqxbr9wXPgF}}qjHPCv>>d1$ zlswcC4l}pICaUX$U$c~$wT)lg`MXG)0BoS-1t51sHA6@A%>2~b{q{!+UaN4*r1gt4 zAR!~+QZw>*sGPLjibul@!~z2@&+?ap<;lNo=mC2;wcYT)=v7KH4-Zfz6D{3k^TtGz z_751<&L@@+7(lTtHdPPj|HX0n@8d}d{DXk)Vxeq&V6a&ytpwA*A+`T^$t?MR8p)eZ z1y{`@4iME*mcT1@_n%?QJf-UM=84HGrdnl=Ovd=vUmJ706@jzE+OuutxKzp13Y>DJAO%>CfIb}t|vkA z0Zn`3gMf)k7j1VKr2yS2OUZWB`J$3_>uRWbaJKr*{H9>;&g zDD$NGpe`-?{ok&2nEJpqpTwF)4~zQW`_{?^Oa15*p;>#aN~E4*E+rYzv)-HOrgUkv zp8eYPo%;3v8%k|UDe^r3!~Rc?y13c1R&n&~b&%Cc=4|h4pm!xd{rwbv_+o*XXizaC zjRu={fj1=_0X_uM-juyX&Wh6-$WPDRrWs1)wgQWCN*v0|!|slnm5h$I6C0v`l!P^* z?}4q^h(a|yqxUL{rX5auJucZye^C}BoB-#aJ4-TsH<|&JzHzcB^w+(S%As& zb)!AYE-1zuIrhcWi)o0K??t83M~&%-gz00_su^WcaC!5fTbi2 z9(X;-hA z`uW|+U{g9St)n$xfvae}o-Pa#Ikh#XerV8S{Vo;%yK8)wHUu<*{Qze7(EnO}2}*F#%Vf5sort&8u?@$` z`@TBO^%73C_ah zavEXiX5i^%kSQY@cFzW%#;H~v!EnbIzncD95q@;fj--vgBQkins=lFOvCiSFcf3x0 zw`~&p8jNv`gy;79ubsIN4&lZRmLXr%?din-Qe|OOU7cAibW3^h7Ugcfp9Uzw#SR3@ z;%bB0BF!`b8)uy4cfvmbff&)?ZNCkB%`|;2S9I$HIsJ2HyOSV7ZqWzti(bSy9^t_0 zfCd-6;n$!_PO4zfA+=$68v7Mb14!D)bUD|o#d}ZWxu#Y}@l z(di;wZqk58Gn06Kr+P2a$G>xG>L#6Bj_ANgF?h}y%*?=qoslh$&{x@nP+(41$LTCK ztjIb8UoogkT8?5J!lVj~5P_%-q#~=B>z4c)RxEfq*qe)csBSAbxohO%tP+E6AGbX9 z%&dv>@o)heT!`i{{xs9IH}nJ&iED$e8BgD&uJgCvQe#%e%*DtNx|th>Sn@{7C1{O5 zUzeR76mnM`$7NgD?085r@~nR2b2$6fkA;0CX5&0DjNk_n#Jv+2R6-h8v}>l?uT-Kx zXbY1d)x)ZSZQcT{VF)w+n?w=l?;RH)6?Cx1DImmSHZi%m0$;xnN&wKOzCl};Rj)-r zhi?p(R&|`DC$9Y#Q{jOoI928+ir7w5t?-OsXA!{7ra>OG6MH1*v+)Y#a--!Qs+*gG zeO)@FTQYVkR{g_h?>gbNn(NoRIJgdChj))QelA8yKD_U-!x94@&)qTPp2VP3Lg>qX~RmH=|68&c|z+*Mh@au3dS=^1r5Slp6W6bu}py$BmUjAX| z*I>a9lfd#~`Vi3h)!r`X6aRADaONgkX!E%`i(<~*C+iq<w-S zyVfqLi_bLMfvexh&066R5am5pYO2&iRM#{{><&q+&ty2*y6_Gazq?rlF&ePtWn^Q0 zRgm{agB{kEvi+kq1zS@WDvNHnU3cXs{COZ?-=$|J%s!{~ELC6EO-Z;+G1&~d-A#4R zjv3%gh+UOZiBY-``|)u49c+e5^W+0Oa3x!HhtEx#8M8E*55a&n9;pV>?D% zClC*XKFU%e*^$rejLFSDJ~P$@7PKGsHTNFGJp?#mBtHaQY~f}{Xo?@9_Bw-sp>oeL`Iau zBUp+JO`2V+_XUjRE#xozX6(9K5$*Q4B5onUqZnJrp>O^zjU2psP3`$odgAl~pW2Bc zz0YuFjF>*?=Fe8gnKkDPICeV2DazWtt=p_1N|*ZidS82A%=m8O$I2rBfJFjT6W8F$ zXYEMB0A*`Jf!JcV@w+esZQ(zjcHvFvkUSfI2XVbb-#dkwtOSMi!t#YHa&7yC&?)L^ zn{)M#a7F}COM!f2Pn-yFM(ojm15V$m;!xLhQ=DlknomRb`(t3Qvwa=cQdp-Yk z&nod%?58#50kEvbJ4CAmxL?Ys$o?RULgNtKM3iNL_0W{O-_>e!7n9wDJw38Fiy+Ve z%<;~5Cp)H|zXv;l^U3HIZ$Ynk3XsPqD?~jm6{)MlvS!=DQZ1eDOEZh&n~|)e8g`s9 zrDePBHO+fR(V&oS<(5UrFrNZX-u~Q})~+v=w?;Ju^A;E?WR6F79h}ghw~|q zgmzWce@Z6TKyP^Q+xp{pJ}Mjf+FSuxOveM%JVOmYM2Jw8>=L)*GEtdgU4Z6#2BiWjW0o3LKh-^BS_>i@2L@%r$wFpPf8cZLtdagE*MY zM$34*wL+%KrO5U$hHA$b)~3FhZ&_vxkZZs#d-bb>M?^>sn0hd zj}Q?CB+F)*APky6tG81|^~Nry@z+7hRtMBHZgFPeO|7__{PhjcxFj`8?hK~$IJSi{b}qgA7*625xFg)LX{xb#Hm@F!Z3tcmf^ZCR*ze zh2O0$6*3RyTBY@D9rRiAGCHpNZ6Mnai}IFMM2;X7^w8sv#rL_hw8k7#RcA3>u+q7$ zr$Sx-_u0@xx-P`|zTC&>q|=xf5x0^Vd33^_*R+#&PmB%rd2MzyZ70*g*@I z;;BkTA4AY(^hx{KK9sq26I1Lo3|EIkVcDU6$nSOzF$$+aL~%~(uDn4zk=Tf3{PW0^ zQk(OyHtxT&AJ_SF!7C4L$9?yZ6n+jd4rs!He4(r3m67=PybMmT5Ixez-}9{Zjt`a0S4D4r5l6qNk{XaVlg(F`80a`|GIaY<=qj?wQykt0 zk{GCOqSxctlL5RBQ z(fJD{Ee{cVuUL)UB>gj|zc&jb;2is#)**S}wP;(mRJGU9=>E0i`@eYsmi+6!yF?HSoA>}e?1@Re7lm)DB z(|?&r-cfdxSr32Hel4rN zFNI)jQpTk_j&eU5QX3RvA^!WHlEl!lOU#bzd#}hTsA2-Ix?G%rGzmKD9~w8MxuIYG zHoiEyU3p>wQD?ryifKz4z&Zl_*abPcfwH-4-*&z+KV$@m_m?kvJJuK*Xp+^2#dG5%fAFP)^^E|i_<4I3Wr({losb@k4#|g(b6!I@eG*B zuCuOw+v^>SC(~YKiA%g1iqAVG^AkoO&JXBa9RJb5=AW-Sy@>?e0|vqa)+TgpV*sW0 z@?FT@I?zg=?Eb&C(x*uuS7oR%xsYhe98Km&8RN)|=x~63v!LLMyMITF^%Z_CnsIvX z_}$;wOFIakSslm>XU!@3y~MI^!+VEnYlRy_wI^TR9OEuJoH8YGMj?Me`ufWNQL<_N zpmAde)X`75HM}~^hnD8_t2jQo?=WXYKNmlLnVkPa?kt3fl+k~@=``3l;IO=FC~NDA z^pJg#^!aO+nxe4A$dgW0@w)Sh3~m=gLuT}O7NBT8OcvY@cbdMGH3OcCS*!GylV2=8 zVCT%U>mQuE@{SdCblaWD*3!pD%j{+%PN-_Ru4x z%x@uT7RO2IUm2-|d0FCe=sv$Sspc8>>{2OQ1J!Tx#>f5ayLe?lnk!>X|C*=COZ&s> zA2prHVS|e4+Cm1IHhWUz82N|^^_uuU7vP|QI;^T;Gutcmu#nbtL%E(c_|f!wL_^fy zd9i6j#@UZSJQ`65$(H3)psfX`bYXUqkeiw5?_4Jb_1dmdTkc%&?;fBf!56}%l;IqMP_N~D~kK^`SXt_n~}PaBKu#6WYFcJr^K=lRP%-Eh%Mz=R#r95K~0t*R7MuP zY7!w z?Rq)BAJ@Gdj7T=h$6q`nX#u>}T^~h|q&&YA5h#$=41BxthVnuVQQvM!udACGgO7L6 zOPS)gIL%X~Ri2Z*d?kY{^vpMt^JlCH!mWtv(PAqN$z{=qpMTRyyHCbFG=491#n$Z7 z3yNWmEr;<@Sx8jyWUdH7oW9bEU!xm91xP&i!jFRw-67bU?$1`SRFAn0QJur<9tTwzJPZm?js^ zqGB7d2{jke2eI&62O}LP!TR~>M_Si7&op*C_3fH^^7jrbrpK47I;^FP9Qw6;<%17` zlM(R*BdlY$IGksY~g;l(;=^hQJvB_6ykmei< ztEb?vE~^(gftXwE6ehd;D)XwYD4#{$xV;%%0aKkH&5aPaU)@q+-kO@r8g|1vJ=3q- zZ-}{-`egEJnpchQe?l(Tf~;eo#B2Ir?{Hu=4->{ld>3q2mr`?0i4 z(vIeLvyDPc+mwrJW4#gUSy;`JY9Cq#b?P-L3%iFEapbK&+M%9X0?FwfS5a)D+~I@A5R{PsUB*c5(UC~W z@#qC#zRuvyW29&TMCqEh%aQ->>1M2$HMR*;sRTifs(S6efT-eIS)ZQo$hoeZOEa-I zdg%2;JbUY>eX)E1VP2^nO^w@MhX}G~i^gaRNbsNl5Ba*qqb6y3T{Wz1z6xE*9D?|~ zsQC9;oyR*&uCiyWa!JzWQT`(pWW{zyq|)TR(CGGyhbn5-A4_4m+7g{L=O4@oBTuNd7WQ}uy3I(&IBuOP3bR@SC&l5=3+isADgwD zZ3=BKcwyn+7exxK8O9o_wrY2Jk;l_#$IVe9gOwOjd&GobsI)e%)l!Tx)Hs++AqnflIVUJZQ;zkYNtD4OL~stm1cqU4DLn+$nac z?v>Z9n3$zc|KsF{JyQ*2*x!2MzroZz?p(%3b>wPLf(~nT8&7(kK_@Co{O)`8)`zX? zSGGf2C4m8GC1;)Wq$=iDFfWY6Xn7q3lHVu|WkFypkrZPq^`i?S0`&V+N2O%x<_U4g z%?r=NGTj#?$B_90CmwO@dWs=!2z&jGlCHli28k)q0Q1o&MjKS25{_L{ll{<`9gEM$ zAE4F~D?8%-sYxRcqJcMLC3BX8b66E5(u;RsYHO#st|m=H1*@Hupe|4T?EIJn=X0(R zo%U)LJ_`#=MOm4Zsm~l7ut<<(eMX!({N$@PUYjOY7EMW1j<|a-3SODj)^rH@Q||&J zcvtlz@OI)g{MuUMNq;=TI?OOK+F1~`Ai8+Rp?Rzd0)eXeCOqjr+FATFy zKp+-HLXct|@#~qr64*0}mesW^E;YK)mH$veztDCbHdcT%g2u& zRTYy3DhrINx#W(>YJdA^6FAK{nSIdZ7|jjbyXI4(C_&Qu2qpPcL;8EY%r1`3fIua* z`G*ZB?}Im;BLeuIYsbTD?)4ZrwrQ~Z+l6$~ssBv_R@USXq_;aHl6O|}nnWczH_t%* zlw7Q)<~>@6*LAnR3HH{J2k1sU7z8^-ea%|;@K#MK%2zZrAWutv$nW%+#5?RJKO>-h z#sj>B;eEJ&6pXl+9tRtAK9m~a+Jb*T^Ap$z#r?%r!(3zVfdqX7ecy%+uXyDSW zSV)&lDv_e@>uKKfZa&YQJEda6Zm6Y3?z414-pQTpwyA1b9yeWA9Z5a+jaI_0nq|FQ zB~bOte)VX9pUP!D7v8+>^Re*&Xa)^nP&m&C*{JJ*I{1vE%g_d5`Q$_J+ql*(-iXdm z&~g}tX3^EJue?!4gTKE#_7w3U@ga?XbTGZ!hcuw8X)2C;>1gg#)Nq=z1@HB zm*X|?O&ntM1V)&AsFT4J|gUXYoT{?dpVD*a3rdeOFy ztv7pr{FiZ*ano z`_W?_qFlvggueho(S^(UNyI=g!SUaFagkAG#0Kv^(dhu(1x~-xtB;P1W{J~}+DB>W z$Lx2od#T7ZZ@SH$|K`gAH9AQ5OkSK9s&3aJY?#`NS)}&m=lVF%!tIPYr74#oP5(T@FMivG$EB{pqJOms84fB;ecb zw-%+{6Bdhi_~y0IePuiwq0+2O*1{B~!4 zk|I*9FotWZmdckMnLk;kr-ye+}5+gGm$4LMT|a#Ve~`)(eynBtUoyA928Hdu>o89_-Tf3pn_p8Kf`}p+Q*Ci z^og`9>B(9$@<5B7_!OTsR}gYda&)5xHnG&Kp=V3rOr|?Nhp^i&Z(1GrsO%!=iD0gL z`EEm+vcaq5?EKdBo`Z!X_b;unftB!YjV2Gp+04-W7R%2|{nA?cxcJt=Vpm(BMy;OPFl zL7N7U0cEggLA#LfdY4}A^LfMgTb;kZa{lu)8^UKZ1W?`k0Il<2lrK3Pl?z7_sV)#U^oE${6yI!?~D2~em;gD z4*^PM6VtyFeJfAO`=#@tRIokDzwpFvjGI`ydG!{><3`c5&1e$Kv7IY4B8|#l4D>bf z11;m!U(aG351)_eE&6DANWSyZZ;C@=(TM2yT*c(b^+4hm#`uLFbu7IOMZGj~EVIvH z5M#ZotrV4TnGO8VLM{!ZOSX3}|JjDuo473tHc68EeVv5r<`!y|^jzr{aBxKD?>e#+ z+?Yi{UB&^&6-7~$nkYR@+P6>K3|?#Q#&riR)jbuNZeIxwekoe523O_B|2QsztRp!w zeMHS_Idd0HH{-9+m7=(iKN3!#jU+aPT7i7c#BIREIsUI<^E_S>C{&)~F{NdNNXwAx z0Qz^en2nFC;fsygE{r(~Yih|4BfH-F+JC7KGw>!)`4||jpRxcm;CMudqz5j|%kCO;H0^Hxuj;Kf)Jl*5`eqi8 z{C)uxPU;J>v}`k+?ca3#YJe|BM)tSn6wAPeH){AsVsuR~Q?11XajG!K3repRXv_Wa=C-B*Nka@h|X&-Z%) zhk&p9%*x9KD)@LhF%1cY%ZnuaY1vn|0dF}MaFnHq6%8*t5mqOe{EyYu!86TAgb zlc#tdeQ;aPj_XTWFt^Nq#VUCu-OMV+OSd`xL-OeqOv|4ldan$0TEQn3CTl>Ntm+1`_AgNHAkJ%GE>VvTxHryuS%oPs-X{4s@Gu(9sHzu3oA#&7?>^9X zVe_fFyZ4lX4HZjEXj}VOl14I1oy##=ZM19b`M1ND#X@f#Yj0<>@WOOsjrPA3{P9;~ z=6))-%wpjcQ8raXqBy49?U-k7I$j4Z-5PwXQ+n z4DNTofPKvv%~c|zXPiD9TivE81yd6YM>T`92nOgEf;tyOEtM5Bb`tk!0;Ou7xIn# zpn;8V_w)l5G;#9k47SW$>r~@L;&2 zwKSO}_+x+riA$*NokSbmh#T1~Rj5wd$ej49_$nis^a_~&n@%mElD)&l zXkT&QrocXFa#ortpz+yNwu*}PdYXe{H}qp1uoG*iQjNr?nt)0 z6LP{@cr=$yuR%sh6jO2IsUjeVxcyCoV_yC!y$JM>`F@X9o@!rJrKyux56BJQuJ;0!mgB{ zx3tu-b{Nsm$W>OLWUr6k5~aK=446AYTa`cEhDS|z-sjQwuem$TX)NDp(q%LH9{xBZ z7O&h?<0%P2C0MsG@$t_26#36PWCF2F!izHB$Vry=q|d`YL}hssv){-lW__g>r;{Bz zX&rKO`5ouY3O4%USHHqEINC`aMC31SqZ{K&}+(HX$?#^5*`=VWyLB_fAyh8 z=4W?iuhUDYaWU+P<#NI~2?J?3Eh9)UY?Sg;!nykF z@6YoA9$H9$9ga(z6fQH=w6=wnJR#p|o&#p}9uubOuIEyvyec`2tK;(P7~URUjxJ~y zj3lqgXJeCzt?Dv_@eIS<6v8T*h9#cixun+6o9dMfgCT#4E|1;Z(+27nm*?wqw*UM4 z$0LgdUHaFCPY)2fI)0a_#R9<0BmR0JX+p}l>^+CQSj08+^C6AuK5*k?uMD$wJ&1{P zo8z}%`4auRX=_xSvYol^t3l0zgSwe{AS>?p-vz18FV!j*jyrdnJjc|Jk6oj|JUjKK zk?T=R;-?)gUIT1f)!F3VGPJf10S;4&m!?CGezuGLO>c9KXR*%l6XlareRiv!o?aM7 z;e5z!nFsQmLaU_vkW2JjG5%;$uAS({iqwreJ(H>QV>d;kqf^_Wy3|-r*0e% zGrFgI@i}EYbK(}B`uK!4Oe;O>+O11^wRQ>~LtIK?a15T#B()eS&%<}TTta-lrUHiO zkwoW162|r{!%*G&PjgM4rUScEdy=APnr7xv_ogjtPAcc#a5vg0ijui-^HTup%eg$u zI7sVfRrjep3_xaXny(%d|Bc*9LNXC_Tsr6KfHfQxt>W!`-b3B&HqLFdXwf$)gUAAVnZ=H8#T`_MO!2!kFudkLt z9335R9e;HW63_>|bf8k?D8H(>aH>RX9xochzU-i(J5admWbz>vs8f3JyvQXhVy!Gg ztXauXR~k+45Tj?Iv;y2B&Qu*vt3ZDjw(r{HAexpCdj{WWe?MZ*6&U?XqO-?X5Nkp3+VE+4W7H)!@bP=Dd zU0vfZF6OYZ@n2p#W};R~Jk@em%FRsB=;*ya$UWVqz-s+>&Pc8L!Snd{6mlc-GgyJl;&hGrd!Rr~gw@`uH)Ea>@qD zt<0!osK}WXn8x?#iOIgsWwhQHeJlV1XgWB%B~L}u$HVv^GspF+zkIX~DH{QbM{CHC{hDT4m7(agQ# zEN1kj$6~{AH7-gX1 zCk5en<{yABPsg90nvx{;>lw*{E^^$T>^rbPo>6w3o?Ca{lVrt@0c;*SH<^whI~Y~% zMz2##)uV=w_0jd!bFpQIGiKSK6Rej~PpivB76`j~lgX1QDJv;KYUCg~q;~AP2De{coUSdLb!D+bE8C+pT`xm2L4rDmtS{N@%@ZnZ&p zxJ`Eh{s2)lARjs#CSXKO)<;Pb*sq*W{vukHB-AwTqtK`?S9JXIyFy2d5z5lmzQi2u zZEU2DjUN0qk-S~|cPdQ-&^+^nTw6QCj~PTl7FqiiRjI-@fU&xh&%_ ztIW%!(W#=4On9v(Aekbmt;hK@n|V1HoL*w$#0 zZ@SEsm1azan{LE>LA1cC%*y6_k%-(Ne39TX56wtk^?kK0qwsN-!C?@a#CnjIvs!WN z7XLOANn$K!P+?EDa48|-6(T&_ocb+k!t>L-F{bw{;q7D*-2I2&+0~yum1R-q_$A8{ z#5x)5;9xzCvQKuWD#7ns6{0DbJR6@oPD_aA`Z#_FS_13Agb^C0tEvU5JX8SNeSt06-2s6I;5pLh7=^E8|fT6q`O2Ix*K8W zZWub=9r%3f_ujkzG2FR%=A6CuT6=AZAfF7tvAT?rme2j-Sll}!M8=r7V7V6e9mv3r zi^X4YJtiQnuzylplEk2~G5n?_VirtrTU)l>KYVdt9WP@#E?jTXt=d zzeuC4Fz1w`P|Grq!S zZM!VXD%u4oK-wSwcw{mzatwL+jcKB%YPVwjl+Qog*x$B6drzeqiZ4_s$HpCZJjsYy zuyoI2LBv%00f4zlp7t@!*Nmao`G7+3`gr6|Yx)RaO7~&Gda~gtQ(lmzd&|Q<8g1s= zDQH+?!#PD?*9{RtV}FU08_ZowUkDmfAo(&VVfU6HjbWFh7o~e?&U){G;ybv>mE=Ntui)GvEi)VH2TUGxPXFr;CLa`uU z1SJ(%z&vtr>fB|zcM`3{$+eC4QF1X6DSQxhtj?NA@mDW_G1O_Nw@Jymi~xV+u&2(L zSonG^fCUW-7cu9r3dT?qo|u9=yH+k2MxHK>z}|QamdIqc{J?*pP(c7ppe@r2Yo(zU zGh(ekl4e+@Sp0GjFi)EHCJ)6Sb3Y!6cqEdjCC$w*zoGf@+B3jDcK3-)-_LIc$=wxp zR}%4Dh7_zb$whO|`e>AXW^^?*(a-ibe=u?mY4e(>^=PomPF$i5jeB+>DE~n~Tjq^Y zZZ!dknas+a1Kz7h`ETe>@j#cdg!mmYVhmi6VJ{;ALT?ez?p8S+7!4|zjkUd=en!Xa zab6W&KX+xJC`MO?uJ|6a0Uo=(N_wDqQVx}$}_H;Pf~&$zb?rmlKtFDsQ%P9noO z$y7^v4}8;F`&!Gmz^2hfFmW(FbqNk`M&TEFW67GpO$QsuyYI?(ys5Q%*0<6VXPB*% z1SDfB4H15PnLuZW1l}8^J}Sev{$`a`>S+d=2?QqH9ITVAmscz!{a7$*p!kCWCx*7&2lRkl7>k`)j>Fq< z6$|~aniz?g9et{mUH%7(marNMLl#5A9_-H(l+S@|g(+Gy*4DR!h~oyzWQX7~T=vht zP_KQy{KZ6N>Q^fk`)%BYe;S8WQy2zhdJ5dXFQJ23%ZgZycuDO6BQQF$PrS+FxNveb z8QCryi51~)Xx7OT-lLxek0HurT~CQWjBu1BzPEqiec`gPr6IfKz#x(6QBrOgrXmcZ zjZE3tb0)dm@o2u_Z-Vgls}itG#0S-t&>VcANZmO?3^^o}HsqnhL$=4Lg!9c)B)qnw zXn=9-&GqF8S+UZt?H80atv7ZkAucTP^qcPmh& zpK?%7L8a>1Vx>gf1l8eD$N^*NThJl>euM~J7hBzLO$8{6H`OyYO|Etx)aS(SYqmS8 z4y~o8UUxnHF!C|(Xwh!%Xftx?7w}3ZZFKr$8=IUPbyC8ZMWg5^$7*qo+1!dKBfhI= ze^3(@0j~O&nE5-Ln%kR8Gl8EbmX@+YJPw=D(sFm;t5B0^azg}b{Xj-4^%9@WeMH4mBwGsKfdS^!v?ttYKfyo2Q=X`! z%#QOcNBLcNw&c*3^PN43C%@fluuG*7&!?6chC2MQyZq{F0VW4)LXl*3#_O z=jI-KV_fivB*ZX6;-cSWq+t}jT8;BO2L^VkdcgR|nX@M&kCc?uYK)Oazys!Mvv`kl zq8_%7=tH!)v~>DfFQQAn6e2RqUMfVTzU%W3vARbm7)6n;f8`Zi%E{gxmq_Lvu55h> zUIu4}+RSI4)Z{;w@zS>Ko~Ne<;QfeZ#u33iaEbI6aWsj*?tMPl=V>$q{0Ou$SdGZn znq2*o_W72^@dEiBYSOb1pLB7Gu)9_$y66j^Gg<&PS%rvbMvUw{;I`~uFW0he@dqzs z(1$O`&iXQxq@rQF1hxDwopZl~GVTUr#%r`PK=L-({4L zbc59L#!TWLW^h~1Wo=Cq$4}kujC6yosjZ!DrCnz*cYnMy5wFy{)(;cjt*?PnguS@< zPPXc*rmIS;?h3b)LTR05Fen=!zrpGwBh!H%&b!Ho3@|0uMj-*}=`6F--8F=miWtQc z3BPsN)s-15=dHg#wpWQY`cSKnzp2xl3#$A4L$Yue6LNJ8{N}@aY0tCuEa_@17}JRM z4ZQg}SQ?788%2jWSc_OC0KqUr$i~%H=Pt&p2jN@X2LAvovPo^**6QXZl4C~LA*Rbi zvoNJ=n+4#`C-LC)s~AFi4&5)o4E)va12w;uGigAk(OK1zr zBju--uqGd%mDY%z+bWQKu)n!-Il=_8q@6quah3jo9OUw?@;oV-igX_$M7>{Nvy*ZC zd_cWY{~YpV&I34%7u~?lw3=#o zBv%ko`5eg7KKo9WviQ!I_Ju+#8vc!RUne9KE6*WAGQKt`L5x<5PLVYcV$LeXdQHwv zqJY32rt`pQkXR^QJfE#|2m-Fy(CEAk=!3!B`g|!!UJ>^?PRB!S?o#7h=qKiZ6@K>19=-e@(nY#*b@1$*)k_=A`kX^T1A8-&>s#Ia)wC|!Y{ z8-u0xlfw};on}XwfrB3iID*d-#BehpbosXNcv#A)e|m$%Z~gbFcDU{B=^QfzmyA6w zoj!@`Yq`XL64$EY(X)0FKK@ygcEk*cG?|sfR3vG=*W_-$CwSA%Rt=cZ2a07{yvG)f zK556-;jp{Psms#nL+p!G#aDcLG#E3#GND}{Tr?&JBuy88yrCLPX~$myN>epP(sD-# zGE$tA-;Zxma0ro)4F9HpbK620p90ooT^P9P+*JC}qie&Qa&!<{^YMj)4`acY%5C?^ zVWN8D>aT-&#H=I7h{x4Qc@_!sibrpkbUL)ov@uJ_@5J27C=tGs_xlI!G}8wxqbud5 zn$h!o_tQDay=(kPBiGpuBiu+J1yl(jl&T53`s6xhnW+c0>zA;GIFI76rv9Ry{24?% z1mrkQ*IqQ(Z*bN*FL=lAFas@eZ2)&%$ht4SHjAAb6_?1@{*;#YfoSvsV@rvVETXin zQ;W)gVQ@~gl!8Dnu6B7LK@Oc-M|QMXAv{Le!UEA?X*OCL`XSx2()B2h1RFgZ=?4g?C<2RNhX3y?HN@j^00;B{5 z8n2`-pbgoxmiS=f;n(m!^u0eFvh~T~2New|@sV<4P!!t%3l@AIDQc)oB#MqzqU-9 zrwvUNmv71_)*T{ce-oO!?#05rmZDt;Wc+#i19LoOa>vSy1aMJRZ6XP1b{a50!qu(H z0pvq&=+FbVCr&i~lpN=p@TNLP)e=lh*jJ2&L@iIuP01}`Qr zue8OWNGi(#UA%Uq?SVw*r)3u3l}5BHW$OCta1oBY%*VE0y%fu(I3k?7Dn0{Hs149a z>CO0?>Xh@bNR#aSJ^WLrBUhR1;%;eiG3~iTJR1tF%KDg1GZrbxbD9`Z$vDtjlq8lq z@d>qr-iX9XhYN4hMH#pSq`Ak+y7ot_GIb7H+3^pHYN&Oi&0*~!em;bjtY06A*`QSm z{8UoWq>SDjj+WnB96zne>eqXL9b?iu^e3I+@F^c(k;c1(6XWu=O3-0}GOYn^l(Zt- zs~A=m$L+`h%p#h)Aho!y=luDh(saxYjVOX8ITo{DhxTqnM#?YTp`WWB^?^G9;i8$= zfAG$@#U0*3ViQxleu-G_%!H)sXEztygN~0!zt?!n}&TzWM6-rg?guE!gv*gW(5U^XadJcvi3 zZMgF)_8tJm=wOv!&ZPaO3V8xweu}%;5!3l)gj}|4Wy;cuM%7jTsVadt`z595Fqk-^ zF8pwR%3L3Kjz11!@v@D$(%(TT)F{PrQm<#0(Re?Jj+Rp!$25?o-ZUNfcv-MLmTh<* zkkO7HH~l(CAwCl&TA9_&*A^Ga1DZhdW=4WVok9dY;(Y4IMKlWvS$e*Plo(qoP?Rr~ z4Tre043Y6;c2ro4$MJkZ5C8gpIL7_u+p+o{&N|VLRFbSKtT+i$}!5_VFOaf6_A7?|ab^72>51hG@rPJs1?0cype85GuyzZrx z@QKrQl~I?t^7A3L#I;8E!zAG|SPj-Ls-iGtA7W&kMP1W?zrVwzjQelF#3^Vg6 ztm?iW{KR4R$Yp&8W6b?!ep-C9&dS`UpKxLP(4T3Bb#2)6*ERPpS&8vWJ_L~Ri41L+ z^{l$sYGV{TqM>$km2?13?=|+sRzrb>$7t@N?f=jmOTuH)iXEmkpEU{|OLjn>rq8_? zAxI)~a_`3!E>wC$x6dUG3z<3c`);uSn3fV_alVlbA1@q!KqB0Q9cq^pv|(wi5x42A zIm9aHmo0a~w=ZJAFKoau#lGWsP59oDu5N3hc{c5`q@>z9DKzmjyIdG48yI#Qyj|YB zq*Q`#iIu*C*NKR^Fqn9_sw_q-HyL zePRCamQ!)?T!bT^*i>NAAAdMsQmG8Cwm;c;7qW6)B%DROIo<*}vfDAbnh;{31eu|c zqs10pFOOhpeM0uxPAYn-^n;AV1M?mfD?Z(-K4=ftgXFXd4w2&m8xn)Upd&ufbM?b2 zK@LIR?62C~KI@MjCEa&NpJ-0%-vTm7KD)4rteE4Y5Q>d>p*^LN%jPuvt)sKpRi4Z* zOLO~;)j#lGoZmD{0k?-_Y3|NfQ&uKDQ@zJhe!b8cL8ci6u{R9S(f%MYJt zOq=dh=`WvG2!0X+Ee7EVcKAFDSCj=6gBBcK*ReJ^aZ`+b6w+w?xBu}PY>M<`ShgTPBhzIj_ zav2YO)PqK}>PRqaJo%Y=rw%9LEKh}nVe1|1=V!_-d#i#Jte8|>NtJTZ~#EnBu?w7qumDS4bYImFf zc&X!Ad{yPm&r_#42wBD@(66oQI30D|vH>yQ0Y8uaBwl^(BCLLF>y>U?mqyo9%XrdP z6U|kq50NdYBPN>I0mxL`ifE67gj87Kg@$IDq)Z-@5KHJ`NgMRwH;Ik2>LI%O9+L1=`kf_^Zr`M|rIqW<%muxp;N3q6f(_#98yn33g)1I% zW7s?uI35(K1PUbpg))qpOc&!`41_TvMl8Z{v){%BdO!3t;f$m24)GzKy$}YA*Y(wlW8+W$GyLob#w>$hveCBMn|hO-#nwU0v{zp{<;n{%G@9C!XF`X0=9j@isu$Ao`>fHQnmIQk*;-bS8H8i>!b8tQXnKeXlL1r~dB`k$O_t?Gahj-j zvkJRlr7O{DqG+$eXoMG8#pqq~9NJ|jJ@!kNjHk`fl2&Z(o%+euV^fT;Nv0a|fO^c6 zV5V6(dG#SuixKodo+bAIg|JgR|G$(q|E58P|Diz$36k=4yDCFoFd;bGmJ2i#AAJt4 zs=fv|*8i$&hDM&*iCTF=tHo!3xZp*!jls8rs^c)!<^ef8;eyPpCmdp64rZD~-*#w1lz>628Je z+&&gRLk(6uLs#lj;WGNQ2{f8BU_b?sTP@ zVzGAPw6b5mb)>E7i+dcRgoVH%Mfpc}FD+3^ru~uVdyR#YDBw4w$nnYoJrEEWe`Ibt z%ZLZ2dg@uzyHWUSY|7@a)v4(y`8d?6p{@4>>mLzL$Uh>SaVlEA+inIKAk*s!>gEPn zcdraXCJai0|nVdgWU!MA&2{7^Aj1UUg|y z<(QJ|N51^|LPoK}!QYQCZjh(Li?8ED>e_T+ILFKe*LZsP=w(5wRahbDAz4l>Rw$eb z5H_0)ueon^yK8g>&)8V~x}2;MY(i;hv{c(d;enZm2^Hk;i7b&;Qqe0whaDODQdFBy z>t8x#yGb*y{f7ChGQuz2H*SSg*e`^>E7c*$`eJ6CTOzZIQ-8kfi$=3XxogtBG=Vu( zIcU*ZwWXAM5ir;vnGY1sR{;}8d)UeL)Y2;)8>u05<_6u>GjVgj;UvLyz!W;a!6l!A zgZfK=JViwKi}V*UwsZjHpr;#4l0gl!L4ztO(=;}JCw2-|Jot5abH>wVBgjOq7p6pF z$W+`9=SgM{f-`VM#eRP|>)i=JkO1*$p3U^~g%)TR?pHfNM)*@r?!}i}vthhn&)`iq z^Mg%RbDxJ^D4ps+s8? z&Gm%aLN#REsNrCbu9WHv*~2Ql*oHYd0QaEY?o-*^C3%((H{?9kyX9_{kGWFPW$kX5PNofl_YQa*-(Q9c}IL5T$;c#{9i= zR=4x1XlSF!A?qYUz6TJ=jZ{w2p4#9}xXvG0@V>dcW`V$O#!5bpz$BL@8)o-piDwjM ztY#GFZg#LPfF~=&Eo3Gv47uUP1!`W7Gd^ zUTGGhh6!l$3)p1gVW4>bX&-Rho0CD{Atfnne)kIwP=Uv#p{(&cr5F^&+XJrV>^dij ze4|yWr#|_GwKQLzw3lVwP?l(~nDiepkIzvV&9GPaW*bX@G)Ld_drW<|t^rizSHvn^0H1TqpYQZbj($Qe&uDH!HyT7Yp^hMC7s zbC1<yKsV;+SewYmszfv*d+&cAeTC8MP+iYgOo;4m&M%r)`&%E^DCOQ+c=drvL z?ChiV7w7x75pQ-cYQd3L~VR>TiW z6Vbw?O2uqo+eim2?Mrl$E4Eoqt@^JGzL680xNG*Epa{S^zii&ZXuhz)4KiVuvp;5K zb9CEZwVxVBk8e8rJCMElFmiMOD~BXibYsQ722wN^tpoav?w4GTEzo^+Y*>za*#~M+ zMAESxm1=BP%3Ny!kCL$oow&mbU}c%BaZ$n_Q8eh8exmSJL;1FJb)s$WrV4lR9&R1s zFO!!)T;#{AR@e}c?;{?0_=obYo}_>IOViZbzQXJc3!iD)wR-JS*S4PoR#plcsO~WT zP-xMuphm&+Ru>Kr>qFxu5zR+PEU)S)RlU3qrDA&zQ-P_Z;<1REASr^pLJ>&>^&VT% zaXt&DRhoDtK1O}Cbq-e1t|Kw_&5G+Yo!kZ0@{Sb!ddEka0I*lG4X`DQi2hj8^t|}D zh9F3Te!OGoOTuw?Gkf%2eE83oZ)V-U{`7MvyPTa6x4NB9=wJGZn3B-E}}IZPdU1*9MA7 z_g5LZ0#MKihjr0Fc3P^Ie96yput=jCGO7_Mt%eoR_V*yil?}NdMfu(M*CDRe4%(#c zf&vMrszt>NUs=j(|FY%|`26+cx7i<4vG0#bo_QpJx8KLX6EGH)kP{lfG!361aBg;eLG|!#f=TL;V6|mT>B^9SW}jBiR#U(%emWJktp{8ZUIjW+ZS>zX2TeKCHY6h9f-EzN6~W zE4752`Vhvg;utK|b4E9{2H-zaag?So5{#!K7uO&CuFl1Gln-#hOIf?^1)xjkkMO6Hk_Nz9`QKx3{W21O6{ z)2DPfaxq!ou}GrzH2mhAm$IW*R%R3}XB(!J{R#>y0D&oTCesNj%VbZ8J8~iBTj&v~8CE&t7No?0J@X8@@fCU|#DvR2NBM z;q9R*d)9S#JAKcHHTQyfR@3UX%cQi5OJppg`K^)GcQYDoM?1N|&sCyiuhm=IJQs#< z^=hL7Bu_b^I!j~~;am0@%3pYy#@J^=Gtl7_I50(HB);tLWPuF$Fc?B;o>4WqAq@fL zoLMYH7(i1zow-Xj6WiF~A5T6yzbnb7ij~aHJ&pKI`fl!|;Tb6J?Pq%(r)wN%T#Ve` zTU5%vWr}8=bAI#2-6u3xRqfGSSVOB_*y49p$aE!;}#vkxEppD;UvcG zxJ-NBltpf#Upw99anHst<;zZsSA;OYFwJ#+u8k>P0_7P6B88dG;Vf+f6O<+)5{$CO zNX;%(bsk}j_i!LG?YbOaWzIkoiR)sq9wc=wYN&tM8@tw46tBj+p$py{T?e9Hp- z0Q&Sdrq)xSamKp@NujF+tRB>V*Dln>#Pk>fF)#kkO!YwT6pzQ{@?PihacWY;hR+gK zC!l@X4>L4%Uxi&s9ijOZypyv=ViLP?Gx%_rhe85Z48A`UVyUO6CxRmK3;E|;79kt=bwkRRQ`3T~2nE+T9yf*rpfp^nu9!*e3cDIqpi37)h3q%l;vo_I ztpz-I`!VdgOq6KKL_IpY5P1<@k%esXrvcj{fS1J;r5JnU7p4!`iC>shG9uBwoBOdW zj{rMO)@7w?7KwcWIPmeBnIy9Ef0J>YZ|(f;@r*}4EVt#{^Kf2PMWd#CJ;afKH5;%2 zTf^pTDl_q8ENXQF~V#MRH!V-U$S;FMx@y^p=$&jJ%SVw-w-`W06U|@Sw$}xDKaXJG`w%RgwNk7BKp!uo)7v9 zQLO+hK{(C%Yn2BwC3>aeB@Ksx@%(&_(ugG_3sDAQNmy1S zvi-?p`BRn~f_OaC7e3KfY}&hQlI!mLhf?cS$P>l+A!@%cFdD46$%AX~K2tqSnoUyS zk!0dagcCc`nWjAS!;L99_+Gk4j1jB+@pdInC-(H_bD9CqM{3*~szcmbE@Bo*g%YzE z0mw`LzA|+On@~kwT;A5~?+8K04UwXHp;)s=5$Aa` za9ayZ$hdU)O#l-~cD?=ya@AdO6&S5^JqDBjZZ+R*DK;IBl}McX+=8MHU2m7{01;6$ zdHcn-u`mOK**7X$DM}oiQdSzCvW62lWbgP&pC33mlJ3Zob&Gxc2=ceo?b-S`pt?sx z{?AkDvoCobAg$pdBg8&P8YIvM#F)8W0UG{S+EfZOl#cwwkmnEu z*7^2snAM}pJrN+>j!F{`*!rL?Jt}mRGd7m6uI+-R6#69H-|+c*1y}kS9e)6-x-?Sp z6ESCoHLG{Z57%09NW{nD3eF14oqmJ6HuxMmlQnpFI&UlYREj0 zPg+mKQT+_?zZ4fst9}`pXnQbp&L6XF51gyQ6 zy5K<;4I(XZ@|i_FU0Ov_9AKV0`V4zIH~u?v;u2B&m8f<7X~_Bv`77x~ZR%yX+dOpb zxmJU7M2gEQp$kjYowO@Gyhk+wS+gl4l{rgeIY8(XdMlMpc6$ajG)?6`jwx~bm`!#y zk7@`WaN3U9Xm*>^C@Q2uzMY;Bef}Q;ea8Bu6_5{p^k14f9%?f~ z&uxCirC14(x`vHP$U}H$8}=+uOV->~{|8sn3qSbdcZ>+=ke(48@QPvy9EXqI8e&9{ z)%Wrqd~`un)kI1q3ArcagPO1Ph%?Pg#bN|*y9YwhuNXXA>>0P@IN5U;Ht3&N10yrg zFpok;kvGBa(zh891~zE?!p_(z%x9_ZO-+i-%(lZ7^mh=(tSmaONHRzQN>&Y349e7WPhNlgCyP*C8kx8Ehc|hGX3E(_3iLWAXF*3 zdqsRN5bE9e0FyK36hG_o12Bq%bzrArt+5fDl-1Jz9 zpI5TqN_6+ZuD#7lQ^P(7=uKthiym%)96dLof1EW=**+ui+6n@%on4xdzE12L4%Sc_ zpr3m5gd|7<&$}qA&0W>(9<4PGT%~