From 5e03a04e8b5a0e009b7788317c6e19d4435ba54d Mon Sep 17 00:00:00 2001
From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com>
Date: Wed, 29 Aug 2018 15:59:18 -0400
Subject: [PATCH 01/17] Corrected Jan-Feb links to point to Microsoft not
Kaspersky
Corrected two links that point to Kaspersky reviews instead of Microsoft reviews
I believe this is the correct link: https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2018/microsoft-windows-defender-antivirus-4.12-180674/
---
.../intelligence/top-scoring-industry-antivirus-tests.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
index 662286f60b..0b05818396 100644
--- a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
+++ b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md
@@ -39,8 +39,8 @@ The below scores are the results of AV-TEST's evaluations on **Windows Defender
|Month (2018)|Real-World test score| Prevalent malware test score | AV-TEST report| Microsoft analysis|
|---|---|---|---|---|
-|January| 100.00%| 99.92%| [Report (Jan-Feb)](https://www.av-test.org/en/antivirus/home-windows/windows-7/february-2018/kaspersky-lab-internet-security-18.0-180557/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
-|February| 100.00% | 100.00%|[Report (Jan-Feb)](https://www.av-test.org/en/antivirus/home-windows/windows-7/february-2018/kaspersky-lab-internet-security-18.0-180557/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
+|January| 100.00%| 99.92%| [Report (Jan-Feb)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2018/microsoft-windows-defender-antivirus-4.12-180674/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
+|February| 100.00% | 100.00%|[Report (Jan-Feb)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2018/microsoft-windows-defender-antivirus-4.12-180674/)| [Analysis (Jan-Feb)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE27O5A?ocid=cx-docs-avreports)|
March |98.00%| 100.00%|[Report (Mar-Apr)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2018/microsoft-windows-defender-antivirus-4.12-181574/)|[Analysis (Mar-Apr)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports)|
April|100.00%| 100.00%|[Report (Mar-Apr)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2018/microsoft-windows-defender-antivirus-4.12-181574/)|[Analysis (Mar-Apr)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports)|
May|100.00%| 100.00%| [Report (May-Jun)](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2018/microsoft-windows-defender-antivirus-4.12-182374/) |[Analysis (May-Jun)](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports) **Latest**|
From 2436cef74470475ce5cf0173d432db1a000f6732 Mon Sep 17 00:00:00 2001
From: Bill Mcilhargey <19168174+computeronix@users.noreply.github.com>
Date: Wed, 29 Aug 2018 16:38:11 -0400
Subject: [PATCH 02/17] Update windows-defender-exploit-guard.md
---
.../windows-defender-exploit-guard.md | 1 -
1 file changed, 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
index 99973955de..cb0b0f1a87 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
@@ -68,7 +68,6 @@ This section covers requirements for each feature in Windows Defender EG.
|--------|---------|
|  | Not supported |
|  | Supported |
-|  | Includes advanced exploit protection for the kernel mode via [HVCI](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity) |
|  | Includes automated reporting into the Windows Defender ATP console|
From 70eeefe4f47c7aac43091cdf2d95d9f2778f598c Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:18:46 +0430
Subject: [PATCH 03/17] Typo fix
Typo fix. Windows 10 has a "Pro" edition, but not "Professional" edition.
---
.../windows-defender-application-guard/wd-app-guard-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
index 0fb816ceab..7df9687c2d 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md
@@ -14,7 +14,7 @@ ms.date: 07/09/2018
**Applies to:**
- Windows 10 Enterprise edition, version 1709 or higher
-- Windows 10 Professional edition, version 1803
+- Windows 10 Pro edition, version 1803
Windows Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by rendering current attack methods obsolete.
From d83c45e888b551202b3035535428e61e3eca964e Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:19:39 +0430
Subject: [PATCH 04/17] Typo fix
Typo fix. It is called "Windows 10 Pro", not "Windows 10 Professional".
---
.../windows-defender-application-guard/reqs-wd-app-guard.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
index 413a76b74a..7fec753587 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md
@@ -14,7 +14,7 @@ ms.date: 11/09/2017
**Applies to:**
- Windows 10 Enterprise edition, version 1709 or higher
-- Windows 10 Professional edition, version 1803
+- Windows 10 Pro edition, version 1803
The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. Windows Defender Application Guard is designed to help prevent old, and newly emerging attacks, to help keep employees productive.
From 7378d096321ba3e9cea8f8e4844eb1543f6ba276 Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:22:42 +0430
Subject: [PATCH 05/17] Typo fix
Typo fix. It is called "Windows 10 Pro", not "Windows 10 Professional".
---
.../windows-defender-application-guard/install-wd-app-guard.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
index 037fb26536..a05785d879 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md
@@ -17,7 +17,7 @@ Before you can install and use Windows Defender Application Guard, you must dete
Applies to:
- Windows 10 Enterprise edition, version 1709 or higher
-- Windows 10 Professional edition, version 1803
+- Windows 10 Pro edition, version 1803
Employees can use hardware-isolated browsing sessions without any administrator or management policy configuration. In this mode, you must install Application Guard and then the employee must manually start Microsoft Edge in Application Guard while browsing untrusted sites. For an example of how this works, see the [Application Guard in standalone mode](test-scenarios-wd-app-guard.md) testing scenario.
From d3393141c61e0690cfdafc19b4cbc0cbc652b36f Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:25:21 +0430
Subject: [PATCH 06/17] Typo fix
Typo fix. It is called "Windows 10 Pro", not "Windows 10 Professional".
---
.../configure-wd-app-guard.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
index af72b5b90d..7c6ba31f4d 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md
@@ -38,10 +38,10 @@ These settings, located at **Computer Configuration\Administrative Templates\Win
|Name|Supported versions|Description|Options|
|-----------|------------------|-----------|-------|
-|Configure Windows Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:- Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard.
**Important**
Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.
**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
-|Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.
**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
-|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.
**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
-|Allow Persistence|Windows 10 Enterprise, 1709 or higher
Windows 10 Professional, 1803|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
**Disabled or not configured.** All user data within Application Guard is reset between sessions.
**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**- Open a command-line program and navigate to Windows/System32.
- Type `wdagtool.exe cleanup`.
The container environment is reset, retaining only the employee-generated data. - Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
The container environment is reset, including discarding all employee-generated data.
|
+|Configure Windows Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:- Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard.
**Important**
Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.
**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.|
+|Configure Windows Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.
**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.|
+|Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.**Note** This may also block assets cached by CDNs and references to analytics sites. Please add them to the trusted enterprise resources to avoid broken pages.
**Disabled or not configured.** Allows Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. |
+|Allow Persistence|Windows 10 Enterprise, 1709 or higher
Windows 10 Pro, 1803|Determines whether data persists across different sessions in Windows Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
**Disabled or not configured.** All user data within Application Guard is reset between sessions.
**Note**
If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.
**To reset the container:**- Open a command-line program and navigate to Windows/System32.
- Type `wdagtool.exe cleanup`.
The container environment is reset, retaining only the employee-generated data. - Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`.
The container environment is reset, including discarding all employee-generated data.
|
|Turn on Windows Defender Application Guard in Enterprise Mode|Windows 10 Enterprise, 1709 or higher|Determines whether to turn on Application Guard for Microsoft Edge.|**Enabled.** Turns on Application Guard for Microsoft Edge, honoring the network isolation settings, rendering non-enterprise domains in the Application Guard container. Be aware that Application Guard won't actually be turned On unless the required prerequisites and network isolation settings are already set on the device.
**Disabled.** Turns Off Application Guard, allowing all apps to run in Microsoft Edge.|
|Allow files to download to host operating system|Windows 10 Enterprise, 1803|Determines whether to save downloaded files to the host operating system from the Windows Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Windows Defender Application Guard container to the host operating system.
**Disabled or not configured.** Users are not able to saved downloaded files from Application Guard to the host operating system.|
|Allow hardware-accelerated rendering for Windows Defender Application Guard|Windows 10 Enterprise, version 1803
(experimental only)|Determines whether Windows Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Windows Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Windows Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Windows Defender Application Guard will automatically revert to software-based (CPU) rendering.
**Important**
Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.
**Disabled or not configured.** Windows Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.
**Note**
This is an experimental feature in Windows 10 Enterprise, version 1803 and will not function without the presence of an additional registry key provided by Microsoft. If you would like to evaluate this feature on deployments of Windows 10 Enterprise, version 1803, please contact Microsoft for further information.|
From f8b98f5c93b26fecdd3e67611df691eddd66d56a Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:25:49 +0430
Subject: [PATCH 07/17] Typo fix
Typo fix. It is called "Windows 10 Pro", not "Windows 10 Professional".
---
.../test-scenarios-wd-app-guard.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
index cffffca2da..d697706824 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md
@@ -16,7 +16,7 @@ We've come up with a list of suggested testing scenarios that you can use to tes
**Applies to:**
- Windows 10 Enterpise edition, version 1709 or higher
-- Windows 10 Professional edition, version 1803
+- Windows 10 Pro edition, version 1803
## Application Guard in standalone mode
You can see how an employee would use standalone mode with Application Guard.
From 382743302591c117d44cea1fecf7e8afb868dc15 Mon Sep 17 00:00:00 2001
From: skycommand
Date: Thu, 30 Aug 2018 01:27:02 +0430
Subject: [PATCH 08/17] Typo fix.
Typo fix. It is called "Windows 10 Pro", not "Windows 10 Professional".
---
.../windows-defender-application-guard/faq-wd-app-guard.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
index dcea68cace..7ac04e7b20 100644
--- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
+++ b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md
@@ -14,7 +14,7 @@ ms.date: 11/07/2017
**Applies to:**
- Windows 10 Enterpise edition, version 1709 or higher
-- Windows 10 Professional edition, version 1803
+- Windows 10 Pro edition, version 1803
Answering frequently asked questions about Windows Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration.
@@ -32,7 +32,7 @@ Answering frequently asked questions about Windows Defender Application Guard (A
| | |
|---|----------------------------|
|**Q:** |Can employees download documents from the Application Guard Edge session onto host devices?|
-|**A:** |In Windows 10 Enterprise edition 1803, users will be able to download documents from the isolated Application Guard container to the host PC. This is managed by policy.
In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device.|
+|**A:** |In Windows 10 Enterprise edition 1803, users will be able to download documents from the isolated Application Guard container to the host PC. This is managed by policy.
In Windows 10 Enterprise edition 1709 or Windows 10 Pro edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device.|
| | |
From 1bbeedf456f6d183153ddb742bbc72eed8099398 Mon Sep 17 00:00:00 2001
From: ajjonesycomau
Date: Thu, 30 Aug 2018 10:57:32 +1000
Subject: [PATCH 09/17] Fixed broken link
Reformatted markdown for the download link.
---
.../windows-credential-theft-mitigation-guide-abstract.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
index dca351a7eb..9ad00797a5 100644
--- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
+++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md
@@ -15,7 +15,7 @@ ms.date: 04/19/2017
**Applies to**
- Windows 10
-This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](https://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows 10 credential theft mitigation guide.docx).
+This topic provides a summary of the Windows 10 credential theft mitigation guide, which can be downloaded from the [Microsoft Download Center](https://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows%2010%20credential%20theft%20mitigation%20guide.docx).
This guide explains how credential theft attacks occur and the strategies and countermeasures you can implement to mitigate them, following these security stages:
- Identify high-value assets
From 59c10c2f8ff898c17d78569e8744575763b7218f Mon Sep 17 00:00:00 2001
From: Justin Hall
Date: Thu, 30 Aug 2018 09:19:41 -0700
Subject: [PATCH 10/17] edits
---
...nd-windows-defender-application-control.md | 26 +++++++++----------
.../exploit-protection-exploit-guard.md | 4 +--
2 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
index 805eeff313..d58b132f4f 100644
--- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
+++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
@@ -6,37 +6,37 @@ ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
author: mdsakibMSFT
-ms.date: 08/23/2018
+ms.date: 08/2/2018
---
-# Device Guard: Windows Defender Application Control Configurable Code Integrity and Virtualization-based security
+# Device Guard: Windows Defender Application Control and Virtualization-based security
**Applies to**
- Windows 10
- Windows Server 2016
-Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity (CI), while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI).
+Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity, while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI).
-Configurable CI and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. Starting with the Windows 10 Anniversary Update (1607), this combined "configuration state" of Configurable CI and HVCI has been referred to as Windows Defender Device Guard.
+Configurable code integrity policies and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. This combined "configuration state" of configurable code integrity and HVCI has been referred to as Windows Defender Device Guard.
-Using Configurable CI to restrict devices to only autherized apps has these advantages over other solutions:
+Using configurable code integrity to restrict devices to only authorized apps has these advantages over other solutions:
-1. Configurable CI policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
-2. Configurable CI allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
-3. Customers can protect the configurable CI policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
-4. The entire configurable CI enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable CI or any other application control solution.
+1. onfigurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
+2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
+3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
+4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution.
## (Re-)Introducing Windows Defender Application Control
-When we originally designed the configuration state that we have referred to as Windows Defender Device Guard, we did so with a specific security promise in mind. Although there were no direct dependencies between the two main OS features of the Device Guard configuration, configurable CI and HVCI, we intentionally focused our discussion around the Device Guard lockdown state you achieve when deploying them together.
+When we originally designed the configuration state that we have referred to as Windows Defender Device Guard, we did so with a specific security promise in mind. Although there were no direct dependencies between the two main OS features of the Device Guard configuration, configurable code integrity and HVCI, we intentionally focused our discussion around the Device Guard lockdown state you achieve when deploying them together.
However, the use of the term Device Guard to describe this configuration state has unintentionally left an impression for many IT professionals that the two features were inexorably linked and could not be deployed separately.
Additionally, given that HVCI relies on Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet.
-As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable CI either.
-But configurable CI carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability.
+As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable code integrity either.
+But configurable code integrity carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability.
-Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable CI as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control).
+Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable code integrity as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control).
We hope this change will help us better communicate options for adopting application control within an organization.
Does this mean Windows Defender Device Guard configuration state is going away? Not at all. The term Device Guard will continue to be used as a way to describe the fully locked down state achieved through the use of Windows Defender Application Control (WDAC), HVCI, and hardware and firmware security features. It also allows us to work with our OEM partners to identify specifications for devices that are “Device Guard capable” so that our joint customers can easily purchase devices that meet all of the hardware and firmware requirements of the original "Device Guard" locked down scenario for Windows 10 based devices.
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
index 64d6627554..8223e8a8ce 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 05/30/2018
+ms.date: 08/30/2018
---
@@ -56,7 +56,7 @@ Exploit protection works best with [Windows Defender Advanced Threat Protection]
Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/en-us/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See the [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard topic](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to Exploit protection on Windows 10.
>[!IMPORTANT]
- >If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10. You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
+ >If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10. You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
>[!WARNING]
>Some security mitigation technologies may have compatibility issues with some applications. You should test Exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network.
From c0f591bc1e933f3e0599f086f7d9194e03f913f8 Mon Sep 17 00:00:00 2001
From: Justin Hall
Date: Thu, 30 Aug 2018 09:23:20 -0700
Subject: [PATCH 11/17] revised eol statement
---
.../emet-exploit-protection-exploit-guard.md | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
index bb57a23872..fb227157b2 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
@@ -32,7 +32,7 @@ ms.date: 04/30/2018
>[!IMPORTANT]
->If you are currently using EMET you should be aware that [EMET will reach end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10.
+>If you are currently using EMET you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with Exploit protection in Windows 10.
>
>You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings.
@@ -42,9 +42,7 @@ This topic describes the differences between the Enhance Mitigation Experience T
Windows Defender Exploit Guard is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options.
- EMET is a stand-alone product that is available on earlier versions of Windows and provides some mitigation against older, known exploit techniques.
-
- After July 31, 2018, it will reach its end of life, which means it will not be supported and no additional development will be made on it.
+ EMET is a stand-alone product that was available on earlier versions of Windows and provides some mitigation against older, known exploit techniques.
For more information about the individual features and mitigations available in Windows Defender Exploit Guard, as well as how to enable, configure, and deploy them to better protect your network, see the following topics:
From 6c0570e59ff277898a6c3c791bb8e5d95de5fbd4 Mon Sep 17 00:00:00 2001
From: Justin Hall
Date: Thu, 30 Aug 2018 09:26:44 -0700
Subject: [PATCH 12/17] edits
---
.../emet-exploit-protection-exploit-guard.md | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
index fb227157b2..9685c9c9fb 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md
@@ -11,7 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: andreabichsel
ms.author: v-anbic
-ms.date: 04/30/2018
+ms.date: 08/30/2018
---
@@ -50,9 +50,6 @@ This topic describes the differences between the Enhance Mitigation Experience T
- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md)
- [Configure and audit Exploit protection mitigations](customize-exploit-protection.md)
-
-
-
## Feature comparison
The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard.
From b90d2b35056472c81e5751f33f528c4993932422 Mon Sep 17 00:00:00 2001
From: Jeanie Decker
Date: Thu, 30 Aug 2018 18:28:03 +0000
Subject: [PATCH 13/17] Merged PR 11035: Update SfB plans (SH) and policy path
in Spotlight
---
...id-deployment-surface-hub-device-accounts.md | 17 +++++++++--------
...es-deployment-surface-hub-device-accounts.md | 3 ++-
windows/configuration/windows-spotlight.md | 17 ++++++++++-------
3 files changed, 21 insertions(+), 16 deletions(-)
diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
index 90479cad66..fde0bb2f8a 100644
--- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
@@ -8,7 +8,7 @@ ms.sitesec: library
author: jdeckerms
ms.author: jdecker
ms.topic: article
-ms.date: 04/12/2018
+ms.date: 08/30/2018
ms.localizationpriority: medium
---
@@ -145,17 +145,17 @@ To enable Skype for Business online, your tenant users must have Exchange mailbo
| --- | --- | --- | --- |
| Join a scheduled meeting | Skype for Business Standalone Plan 1 | E1, 3, 4, or 5 | Skype for Business Server Standard CAL |
| Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL |
-| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with PSTN Conferencing**Note** PSTN consumption billing is optional | E1 or E3 with PSTN Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
-| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Cloud PBX and a PSTN Voice Calling plan | E1 or E3 with Cloud PBX and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
+| Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing**Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
+| Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
The following table lists the Office 365 plans and Skype for Business options.
-| O365 Plan | Skype for Business | Cloud PBX | PSTN Conferencing | PSTN Calling |
+| O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans |
| --- | --- | --- | --- | --- |
| O365 Business Essentials | Included | | | |
| O365 Business Premium | Included | | | |
-| E1 | Included | Add-on | Add-on | Add-on (requires Cloud PBX add-on) |
-| E3 | Included | Add-on | Add-on | Add-on (requires Cloud PBX add-on) |
+| E1 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) |
+| E3 | Included | Add-on | Add-on | Add-on (requires Phone System add-on) |
| E5 | Included | Included | Included | Add-on |
1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment.
@@ -190,7 +190,7 @@ The following table lists the Office 365 plans and Skype for Business options.
- Click **Licenses**.
- - In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
+ - In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
- Click **Save**.
@@ -291,7 +291,8 @@ Use this procedure if you use Exchange online.
- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
- >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
+ >[!IMPORTANT]
+ >Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.

diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
index c62abeb7fa..c599109f4c 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
@@ -107,7 +107,8 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013
## Disable anonymous email and IM
-
+>[!WARNING]
+>This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Surface Hub uses a device account to provide email and collaboration services (IM, video, voice). This device account is used as the originating identity (the “from” party) when sending email, IM, and placing calls. As this account is not coming from an individual, identifiable user, it is deemed “anonymous” because it originated from the Surface Hub's device account.
diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md
index 09a31768aa..aaf7da1a9a 100644
--- a/windows/configuration/windows-spotlight.md
+++ b/windows/configuration/windows-spotlight.md
@@ -58,15 +58,18 @@ To turn off Windows Spotlight locally, go to **Settings** > **Personalization
Windows Spotlight is enabled by default. Windows 10 provides Group Policy and mobile device management (MDM) settings to help you manage Windows Spotlight on enterprise computers.
+>[!NOTE]
+>These policies are in the **User Configuration \Policies\Administrative Templates\Windows Components\Cloud Content** path in the Group Policy Management Console, and in the **User Configuration \Administrative Templates\Windows Components\Cloud Content** path in the Local Group Policy Editor.
+
| Group Policy | MDM | Description | Applies to |
| --- | --- | --- | --- |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Do not suggest third-party content in Windows spotlight** | **Experience/Allow ThirdParty Suggestions In Windows Spotlight** | Enables enterprises to restrict suggestions to Microsoft apps and services | Windows 10 Pro, Enterprise, and Education, version 1607 and later |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off all Windows Spotlight features** | **Experience/Allow Windows Spotlight** | Enables enterprises to completely disable all Windows Spotlight features in a single setting | Windows 10 Enterprise and Education, version 1607 and later |
-| **User Configuration\Administrative Templates\Windows Components\Cloud Content\Configure Spotlight on lock screen** | **Experience/Configure Windows Spotlight On Lock Screen** | Specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled | Windows 10 Enterprise and Education, version 1607 and later |
-| **Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Spotlight on Action Center** | **Experience/Allow Windows Spotlight On Action Center** | Turn off Suggestions from Microsoft that show after each clean install, upgrade, or on an on-going basis to introduce users to what is new or changed | Windows 10 Enterprise and Education, version 1703 |
-| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Do not use diagnostic data for tailored experiences** | **Experience/Allow Tailored Experiences With Diagnostic Data** | Prevent Windows from using diagnostic data to provide tailored experiences to the user | Windows 10 Pro, Enterprise, and Education, version 1703 |
-| **User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Welcome Experience** | **Experience/Allow Windows Spotlight Windows Welcome Experience** | Turn off the Windows Spotlight Windows Welcome experience which helps introduce users to Windows, such as launching Microsoft Edge with a web page highlighting new features | Windows 10 Enterprise and Education, version 1703 |
-**User Configuration \ Administrative Templates \ Windows Components \ Cloud Content \ Turn off the Windows Spotlight on Settings** | **Experience/Allow Windows Spotlight on Settings** | Turn off the Windows Spotlight in the Settings app. | Windows 10 Enterprise and Education, version 1803 |
+| **Do not suggest third-party content in Windows spotlight** | **Experience/Allow ThirdParty Suggestions In Windows Spotlight** | Enables enterprises to restrict suggestions to Microsoft apps and services | Windows 10 Pro, Enterprise, and Education, version 1607 and later |
+| **Turn off all Windows Spotlight features** | **Experience/Allow Windows Spotlight** | Enables enterprises to completely disable all Windows Spotlight features in a single setting | Windows 10 Enterprise and Education, version 1607 and later |
+| **Configure Spotlight on lock screen** | **Experience/Configure Windows Spotlight On Lock Screen** | Specifically controls the use of the dynamic Windows Spotlight image on the lock screen, and can be enabled or disabled | Windows 10 Enterprise and Education, version 1607 and later |
+| **Turn off the Windows Spotlight on Action Center** | **Experience/Allow Windows Spotlight On Action Center** | Turn off Suggestions from Microsoft that show after each clean install, upgrade, or on an on-going basis to introduce users to what is new or changed | Windows 10 Enterprise and Education, version 1703 |
+| **Do not use diagnostic data for tailored experiences** | **Experience/Allow Tailored Experiences With Diagnostic Data** | Prevent Windows from using diagnostic data to provide tailored experiences to the user | Windows 10 Pro, Enterprise, and Education, version 1703 |
+| **Turn off the Windows Welcome Experience** | **Experience/Allow Windows Spotlight Windows Welcome Experience** | Turn off the Windows Spotlight Windows Welcome experience which helps introduce users to Windows, such as launching Microsoft Edge with a web page highlighting new features | Windows 10 Enterprise and Education, version 1703 |
+**Turn off the Windows Spotlight on Settings** | **Experience/Allow Windows Spotlight on Settings** | Turn off the Windows Spotlight in the Settings app. | Windows 10 Enterprise and Education, version 1803 |
From b7263fbb7a4fa3545e792a04c6e964840ce67d8a Mon Sep 17 00:00:00 2001
From: Maricia Alforque
Date: Thu, 30 Aug 2018 20:10:31 +0000
Subject: [PATCH 14/17] Merged PR 11038: Updated the MDM docs change history
table
---
.../client-management/mdm/networkproxy-csp.md | 41 +++++++++++--------
...ew-in-windows-mdm-enrollment-management.md | 18 +++++++-
.../mdm/policy-csp-update.md | 21 +++++++---
.../client-management/mdm/policy-ddf-file.md | 3 +-
4 files changed, 59 insertions(+), 24 deletions(-)
diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md
index fcc6d7386e..563f13334a 100644
--- a/windows/client-management/mdm/networkproxy-csp.md
+++ b/windows/client-management/mdm/networkproxy-csp.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/08/2018
+ms.date: 08/29/2018
---
# NetworkProxy CSP
@@ -31,44 +31,53 @@ The following diagram shows the NetworkProxy configuration service provider in t

**./Vendor/MSFT/NetworkProxy**
-The root node for the NetworkProxy configuration service provider..
+The root node for the NetworkProxy configuration service provider..
**ProxySettingsPerUser**
Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide.
+Supported operations are Add, Get, Replace, and Delete.
+
> [!Note]
> Per user proxy configuration setting is not supported.
**AutoDetect**
-Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
-Valid values:
+Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
+
+Valid values:
- 0 - Disabled
- 1 (default) - Enabled
-The data type is int. Supported operations are Get and Replace.
+
+The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**SetupScriptUrl**
-Address to the PAC script you want to use.
-The data type is string. Supported operations are Get and Replace.
+Address to the PAC script you want to use.
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**ProxyServer**
-Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections.
-Supported operation is Get.
+Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections.
+
+Supported operation is Get.
**ProxyAddress**
-Address to the proxy server. Specify an address in the format <server>[“:”<port>].
-The data type is string. Supported operations are Get and Replace.
+Address to the proxy server. Specify an address in the format <server>[“:”<port>].
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**Exceptions**
-Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.
-The data type is string. Supported operations are Get and Replace.
+Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.
+
+The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
**UseProxyForLocalAddresses**
-Specifies whether the proxy server should be used for local (intranet) addresses.
-Valid values:
+Specifies whether the proxy server should be used for local (intranet) addresses.
+Valid values:
- 0 (default) - Do not use proxy server for local addresses
- 1 - Use proxy server for local addresses
-The data type is int. Supported operations are Get and Replace.
+
+The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index f86a13b620..d02371d2dc 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -10,7 +10,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/14/2018
+ms.date: 08/27/2018
---
# What's new in MDM enrollment and management
@@ -1419,6 +1419,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
Privacy/DisablePrivacyExperience
Privacy/UploadUserActivities
Security/RecoveryEnvironmentAuthentication
+System/AllowDeviceNameInDiagnosticData
+System/ConfigureMicrosoft365UploadEndpoint
+System/DisableDeviceDelete
+System/DisableDiagnosticDataViewer
+Storage/RemovableDiskDenyWriteAccess
TaskManager/AllowEndTask
Update/EngagedRestartDeadlineForFeatureUpdates
Update/EngagedRestartSnoozeScheduleForFeatureUpdates
@@ -1457,7 +1462,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
[BitLocker CSP](bitlocker-csp.md) |
-Added a new node AllowStandardUserEncryption in Windows 10, next major version.
+ | Added a new node AllowStandardUserEncryption in Windows 10, next major version. Added support for Windows 10 Pro.
|
[DevDetail CSP](devdetail-csp.md) |
@@ -1768,6 +1773,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
+[BitLocker CSP](bitlocker-csp.md) |
+Added support for Windows 10 Pro starting in the next major version.
+ |
+
[Office CSP](office-csp.md) |
Added FinalStatus setting in Windows 10, next major version.
|
@@ -1814,6 +1823,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
Privacy/AllowCrossDeviceClipboard
Privacy/DisablePrivacyExperience
Privacy/UploadUserActivities
+System/AllowDeviceNameInDiagnosticData
+System/ConfigureMicrosoft365UploadEndpoint
+System/DisableDeviceDelete
+System/DisableDiagnosticDataViewer
+Storage/RemovableDiskDenyWriteAccess
Update/UpdateNotificationLevel
Start/DisableContextMenus - added in Windows 10, version 1803.
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md
index df68eeee47..867679cd08 100644
--- a/windows/client-management/mdm/policy-csp-update.md
+++ b/windows/client-management/mdm/policy-csp-update.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/10/2018
+ms.date: 08/29/2018
---
# Policy CSP - Update
@@ -715,6 +715,8 @@ The following list shows the supported values:
For Quality Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
Value type is integer. Default is 7 days.
Supported values range: 2-30.
@@ -781,6 +783,8 @@ ADMX Info:
For Feature Updates, this policy specifies the deadline in days before automatically executing a scheduled restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart is scheduled.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
Value type is integer. Default is 7 days.
Supported values range: 2-30.
@@ -1503,6 +1507,11 @@ The following list shows the supported values:
For Quality Updates, this policy specifies the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to automatically executed, within the specified period.
+The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks.
+
+> [!Note]
+> This policy is related to the default values for Update/EngagedRestartTransitionSchedule (default - 3 days) and Update/EngagedRestartSnoozeSchedule (default - 7 days). The default values for these two policies will be used unless these are set to other values.
+
Value type is integer. Default is 14.
Supported value range: 2 - 30.
@@ -1757,11 +1766,11 @@ ADMX Info:
-For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
+For Quality Updates, this policy specifies the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
-Value type is integer.
+Value type is integer. Default value is 7 days.
-Supported value range: 0 - 30.
+Supported value range: 0 - 30.
If you disable or do not configure this policy, the default behaviors will be used.
@@ -1822,7 +1831,7 @@ ADMX Info:
For Feature Updates, this policy specifies the timing before transitioning from Auto restarts scheduled_outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending.
-Value type is integer.
+Value type is integer. Default value is 7 days.
Supported value range: 0 - 30.
@@ -3324,6 +3333,8 @@ ADMX Info:
Added in Windows 10, version 1703. For devices in a cart, this policy skips all restart checks to ensure that the reboot will happen at ScheduledInstallTime.
+When you set this policy along with Update/ActiveHoursStart, Update/ActiveHoursEnd, and ShareCartPC, it will defer all the update processes (scan, download, install, and reboot) to a time after Active Hours. After a buffer period after ActiveHoursEnd, the device will wake up several times to complete the processes. All processes are blocked before ActiveHoursStart.
+
ADMX Info:
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md
index 9314464f11..2cb51a98c1 100644
--- a/windows/client-management/mdm/policy-ddf-file.md
+++ b/windows/client-management/mdm/policy-ddf-file.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/09/2018
+ms.date: 08/29/2018
---
# Policy DDF file
@@ -20,6 +20,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy*
You can download the DDF files from the links below:
- [Download the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml)
+- [Download the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml)
- [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
- [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)
- [Download the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml)
From 950d9c0a13fec5b227032dec4b5baee1012eac66 Mon Sep 17 00:00:00 2001
From: Justin Hall
Date: Thu, 30 Aug 2018 13:20:25 -0700
Subject: [PATCH 15/17] C
---
...n-based-security-and-windows-defender-application-control.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
index d58b132f4f..72a7d46264 100644
--- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
+++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md
@@ -21,7 +21,7 @@ Configurable code integrity policies and HVCI are very powerful protections that
Using configurable code integrity to restrict devices to only authorized apps has these advantages over other solutions:
-1. onfigurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
+1. Configurable code integrity policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run.
2. Configurable code integrity allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows.
3. Customers can protect the configurable code integrity policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy.
4. The entire configurable code integrity enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable code integrity or any other application control solution.
From a0b6fbc2ea72b5c1b70000ad1926b0bcc44d6414 Mon Sep 17 00:00:00 2001
From: Maricia Alforque
Date: Thu, 30 Aug 2018 21:55:08 +0000
Subject: [PATCH 16/17] Merged PR 11042: EnterpriseModernAppManagement - added
new settings
---
.../mdm/enterprisemodernappmanagement-csp.md | 41 +++++++++++++++---
.../mdm/enterprisemodernappmanagement-ddf.md | 6 +--
...ning-csp-enterprisemodernappmanagement.png | Bin 135681 -> 137087 bytes
3 files changed, 38 insertions(+), 9 deletions(-)
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
index 65466b03e1..aed90a1771 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 08/21/2018
+ms.date: 08/27/2018
---
# EnterpriseModernAppManagement CSP
@@ -127,8 +127,7 @@ Parameters:
User (optional): Specifies the SID of the particular user for whom to remove the package; only the package for the specified user can be removed.
-
-
+
Supported operation is Execute.
@@ -164,6 +163,39 @@ Required. Used for managing apps from the Microsoft Store.
Supported operations are Get and Delete.
+**AppManagement/AppStore/ReleaseManagement**
+Added in Windows 10, next major version. Interior node for the managing updates through the Microsoft Store. These settings allow the IT admin to specify update channels for apps that they want their users to use for receiving updates. It allows the IT admin to assign a specific release to a smaller group for testing before the large deployment to the rest of the organization.
+
+> [!Note]
+> ReleaseManagement settings only apply to updates through the Microsoft Store.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_**
+Added in Windows 10, next major version. Identifier for the app or set of apps. If there is only one app, it is the PackageFamilyName. If it is for a set of apps, it is the PackageFamilyName of the main app.
+
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/ChannelId**
+Added in Windows 10, next major version. Specifies the app channel ID.
+
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/ReleaseManagementId**
+Added in Windows 10, next major version. The IT admin can specify a release ID to indicate a specific release they would like the user or device to be on.
+
+Value type is string. Supported operations are Add, Get, Replace, and Delete.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease**
+Added in Windows 10, next major version. Interior node used to specify the effective app release to use when multiple user policies are set on the device. The device policy or last user policy is used.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease/ChannelId**
+Added in Windows 10, next major version. Returns the last user channel ID on the device.
+
+Value type is string. Supported operation is Get.
+
+**AppManagement/AppStore/ReleaseManagement/_ReleaseManagementKey_/EffectiveRelease/ReleaseManagementId**
+Added in Windows 10, next major version. Returns the last user release ID on the device.
+
+Value type is string. Supported operation is Get.
+
**.../****_PackageFamilyName_**
Optional. Package family name (PFN) of the app. There is one for each PFN on the device when reporting inventory. These items are rooted under their signing origin.
@@ -222,8 +254,6 @@ Required. Architecture of installed package. Value type is string.
> [!Note]
> Not applicable to XAP files.
-
-
Supported operation is Get.
**.../*PackageFamilyName*/*PackageFullName*/InstallLocation**
@@ -231,7 +261,6 @@ Required. Install location of the app on the device. Value type is string.
> [!Note]
> Not applicable to XAP files.
-
Supported operation is Get.
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
index fe58f406bd..cb7ad9e1c9 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
@@ -7,7 +7,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: MariciaAlforque
-ms.date: 07/23/2018
+ms.date: 07/27/2018
---
# EnterpriseModernAppManagement DDF
@@ -580,7 +580,7 @@ The XML below is for Windows 10, next major version.
- ReleaseId
+ ReleaseManagementId
@@ -642,7 +642,7 @@ The XML below is for Windows 10, next major version.
- ReleaseId
+ ReleaseManagementId
diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png
index 6c5472995b27137a4f911f09f199622c2275c5d0..b33a9020ec666fd714c580af58a0e03fabf840c6 100644
GIT binary patch
literal 137087
zcmc$`cU+TM*Df4&M#q9UHdI7(R8SC5P$Df+EGR81O-eviIs}10sEIQUGJ?oR6#@jr
zh_oOb0tBT>haey&AW}mK5NaAZJ1C>i^Pcmb@4Vmlp6?HTCM3D}Ozcs*r>)dW>s6$9i2kGF=Pc|2IEz|Baei|j0^t*{U%sgCX+Fv0V8n)_$2cR?b?|q>^TJQx
zA38d?t*KkmX2|h2YSF}{t@Poa5fNLreQ3FEb387Bats~gap2`fN5{!e7r%_)U!CkJ
zw0cz4`04Qe*1(=qU0J3#wK}kU-ui)40|dCqFAO
zFsyx-!)3vL8+Q@6LLd*{>zmR^>FK8uolnWh1wc1KAa`y%<)DwhqAY(2niFY`!$-%D
zYwPOh#KkKs!MtA3!<5>UWSs;5hF-I_v>a%PQyFO704}=SR2sRt7XdH!9*H}-IYlId
z&kWEwgk^uY6mqZ-Gri*TV&$OMqxc34514Bv(xs
zTAaGmfCy3ZAiI63OO6`0xKrM<4FWm+K=A}EA|gUzR8pgVrANb}DD#GvcACZtakvP&
z;>zqj32PA8A;N%MfTAh;jZ}sOl->O6nDw0zm4HL%TfKNoogx*c+rgDCNNHgh-O0|{
zVt(AuJb%Tz8yye%4O8yz;=oz+gEQ5@0NVnY)QAQ(^tcx+LPd2BU%+QqAo_%z;Sk8X
z3nxy}Obbw@XWY?SqkEzYi(y%rZ?hBW@3TBS|1!ry?c>0eSo;KKJXS?Tnw!JiM>1sm
zY%Tk_Y#QtN^2H@R_u&3SPCq{Bs1>5hAzw*Ft9|lp@1uoKy#vv4ZWDuZ;^N4^&($`d
z%j;&Cj=k8$r?ijKJhY#5K9o7F=!^)aQT$Z6UoMHqHZWoqo?IK#rB-{-uIp_nFC&d3
zDmwDykp*7WC$P*L7<=1B19B&+F@(Y^@MmY$&=R$iGU(LcXL~v=<zkQ5IJaR8)ez&VGGK#bIrmH!Hv~KQ?hh)
zW847uS}z4lbWAXkNd6d+!IqYK#&V=9Ma4g09V8qWRRE*D0~sQ6T8D*kXIAbX@mAa?
z@|PFiebk8Zn%iVWy-(NLQsC%ryf=i18Ouk&$v5&4{kVbSj7nz5Q;VJACR25#m;DDf
z+U%n&E~~cH_;VXq#12z9J-o)J$?UFFH(8Z|KvrvOsYsuSIMx{0KG*OBt*5}bOzm8L
zdzoQ+iz$t@C&PufCn{FdAWc3y*a9so0z>!YxkaHZ17=5sq?YLU%}aJA$9$yvsw~
zMG2PV7lh=kz4ss8rArJNUOh8z9zT>x2&RbA_2b=YH;c}7S4vx8Sww!Gz?ioZ(eNVn
zY|dcwZdaS6lht|{Ed3mc^QwoMj(!qd6H5p@CA~Q>U1a!#*CiuH4jH}Gy|9rgL#i!X
zd`sZ|q^Z@ZZe0sm$<0oY3oi
z2G_AE4}(y})r00QDp9j54vI+Q4);^gf#GbI+^{-7MPEe0#I~e;I*Rel&^M=OV=DQ@
zM9zobeI!+OfhD;TwFv^bAX-E%bsKGZ(uDW#I4Rm`Y5elK;~r^6^6`^l+|lLiv4(p2
zF3am#dvel;ZlgkF^>O!%ZX4$#3Sj-oQtFt(xBMZkYXsMc9Ar^pgK+Nb{^~R1hct=<
zwK~OKD#jAx&zeg}x6gvCnO(s>`L%^L93WGL*?o}`=Qb-Nk#
z$J;%^oO5W@h?8ogGEt1?XKJ$pHC$hCpO(8MbhCx(QpHhW5%rpQ^|W)!rK%l^uldan
zMCalz38R~I*%rqI;~CP#Oo&t4mo)Hk=7$`7+W0nwjnOeN%rZ^zX*X~tO+$u!>>2BQ
zBl90?BO>*ztX*vequ@9{9C~2C)w6-6=JyS%=re1G3<({9s4xxSf
zQa_Oz$#ItsdP$aYiN&;l8+FS6Z7*pW)1|czP+$B{7OcGG}w>gyF^c=K)QP
z+MG2rE>#DMY9Pw=e~FW6`q04c{Z!~e6ggLCI!x__ILJCt=6k9ndxX2*?TM%*sHrPg3;aGec$G;
zBwV7AhS7H3>w$?d&7qq^VNC=b0C((c$2CBIHS&v4&`ZW$7$y~C;rqoHX>T3xVB|3
z1aAZstS=cquO$oH-o`^}b`Fiw
z*F(Er@0-O2lWdlluO9L$114aRY9Zn!xGxR0?d=A92VmL+qB=crYNaUmZgm9Oz%YRE
z`~IhbIOVo<6&Eibib1$%VRCsHhlVG`-wvMtEs<57b}q2+SF005|{N0f#E6w_bA>-1;0hP_H`F3c8vnMlpPX?!xQM794gIgd`&
zITx*)d+a!GNVUWfOg3{WiDmPt7!mLRHaIF=`v6{hg≫eE&rnzm)rovK#?c-giwjobtl*@)*G_r~rACAIbbOYY`u>?1i$9f%}3lKYqU#
zd>M%Z+qLApib8wzL4qoGyjCP$%;)L|{iv|eJ8o4Ff1>#+&fs3xZZGKKjr@7M#CA+k|DATUu$2jwc&^``r_`
zo8Y!B&onVJ*GB686r?e^`-y2c$l%3>M^u9oNU&snzetx7AgYB|yo2F4B@H&u<8`mzA6u%ncsTXF5qI*pki&H%VQ{W5x
zGCQ@hW;36^GN3LP>+;7!9HuFD+IM-D1CWlD=NuT>
zMrKTUyN~P@WY%bz802NJ)^Z1{mWfhlID0%
zt5gLq7mpDTA_k^FK-y=Em!S<04{x2069-mqyBDIyu1m=K{CC6AO$^>_D;)04CW2+;
zn=e?MCBfg5mVZxcD3i6DT|)m&yA{MGMnv=#))+1d)XPMDChlE6WvoTAkm
z!ITxV_|G>i?d|?+e~HoqW|5Y-`8H=&@Oi=sIb>}wShFu%E;T@!b28zVCf7qAuG70k
zE-RyWI^M-4{`n#%S-}P4ch|ylnDmTW+-NgrR3Qgu=;5MtBqL4*ql@l)Gka<4(Hu8S
zXJ=B^LP?K;hZ~QXen1lpMrf6fCZ2
zDO!ju?l#BbL#MzOQeR#-H8+JC7jz+wmZkyB(8
zqpq%w-t?rKpY0z=b%z?-C^H`0x+bAfj;iU}d&6pdpytyPH_XpNJN6?VIAnL$Ju2U>
zRq*l5RA5`#G0sowO9M=!J(PpSCkN7uBFlOk3*kc1MOj^iXf2Cd>~kKtws8X3wcMZ1
zfi(?bQcJ;ZmB4O^Nqcw08fC4FEp;wFq1JXwe}9ZqH0e5?+G*bV+&-Z8A}@z#dNtqy
z-FU2uT2WLpU@)sit!cF$A7&i)j}<~x*%-K23Q?+;@rKjB03#8+Y^1o^;E8NAZjcL{
z`(dzi<|pD!B%W2-n&lGP(^mAbS?HiMQas5Z()zim;#L)H`7_3oee$qBeGL5$Byt}x
zT-Z{W!~C5~#N(XWvg$83J6|S=EXFz+dsQ+NGP$qYVF3T22djnt35i&+ao{S8myclV
zqm?x=Y82_%-hF*<*3W5A_GLf#rQl+A&nvll;beSr>xN0g5YIv;z@*HsnfXj$3*-yl}-GjPmGG9C*~28ZZP<$
z$u!+M2me2V`c90bt@1r5k$I&(+0xqe(r?Gz$lmpVRG}(k@AJ^vwBEr5-!tq3w1JP-
ztj;g-TL|F~YC_eP71EWzpdv}z*5Lb6TQg~8d?7SH%_?+k8~-LOT6MZENk;$9K^*1o
zpqjqHot-hL?BZ8oavH~<;inXP(m4;<1_S=A;M>T#E+sVYN!FxRm>;>uI63l=OO%!X
zmKM*yFJ3X){52<0gDUUr6Ry(L!uo4~fW%>Zv
z6f%+FjF0+9Tujb~qj+wqZn1=IAmQwukY;Ek>BOB9pzIRhr#doB2aG^eywKxIY%TNr
z-ELu~Qx5D&Lrz_WX+dACs^PVRkDq%j3~dFzTlgy=ACU$zFIl-}>ywJp^1wqzMMjoq
z?gl@~-~R&sy!s=Y`{XQ0H|(#|brGuAnHBZn(+&DIq2j*?22dZth@Oj+6vidpP%7QW
zKU$}W-NER1J(J^=vl$+rG4rVIMPo3xK7=d%H{SqwhnA}(G@QH4BZ&FD+@Y+t@8rj5
z)&cA*rxUa<*j_{%vT#2?w$Jbx`(&lsKZ|3{Xh;*20|ZsGU*f85e9`ao?1bR6N9^9;
z>}oEbjQ91kQ9pp`KLz%@5$V
zjt;0m6&a`+i2}P}m&MS!WZ$i1-sPLp(#L(bO7lW)X_?CoPOsy9lvTS+U!=6=M96n(
z)hX(tWHdO!E}0hl%zNAq%x?Fg6(=X_0*YaIEk`gii;ZIe_b!*K8#Y)W>or-PwIj
z3@gDY@@WLZzc_vtORXWJlOByMX||(ibwc@=GY3$IFa)myNv$q^C2T#RBNIzqe(BV<
zYatWRiB?swWl@_Z3^!8ssJF?$z*b_w;y2&qOrsV!S
z$17~n9={PqikUxIYPu9Kl)X!DSN?Qr&x}c)`BmL!xoV3)nhf33>)Jj=P{sT>&Y4L3
zQkf#~875NUr1Nu4AD1k6-ie+E4j2V@;lh`8dFRU8KyQ+b509Ac)#_ZZ9Y~0HVw_c~
zf~r-cl}FYdD|WJ=!@#PjrMGc;cY(#HnAE8Of|lOws08Awn6HbbA$(8Xo$S%EX}23h
ze5GxEKrjHY&ePiyO%;32tF(J|8<965R@gyuFyXROf`LfOtpYl@GP$5dZ6QQT6;7H9
z6(us>E5eiUYLOdtMAEdNn>%E}QRGs`zo%~KxOyMIZlXbt6wi9jT1m5j&o$|PqkmG-
z&ixeL;>S-Q=*oOVlmgY$;6zR6!Q+0cbmxw7s!Tu3oGyXO
z2%&LLmJ#A2Ny4atiqNMd90>5k^>Ss~$_|4Oc56qF0G-(^9M5%6#Co4sUIsbQ0*d+@
zqH|0h#o@9W31$@L&1E9^Zi{Obb&t4Nyx-!2%@(1LX?B+F5@MS38SNCZA9$(cWul-X-^?f7fr9AH-nK7(=~
z)8J2h5gBj-ZhPN((I^sTs+(ImUu#hcQ=iWFe&xbv=S{~mVhfpcs}=5k@FhpQ3^I#M
zX3t8B14spKy@Kzg)My+qISbM(zD-U1c>sq}nua*yNE2h@&CXH)g?#Q-r&~uxM#@^S
zJOMET@Y}6YDgsa-3j5|VM1*-&&RC<{U3~&?#@r}II6#PrU!ECUa_%kswND*9#F4jg
z)W+T-H;q&ywjJt*>P-F8{c?2
z8IX-Q6vfyXQxo#n2FM-Tn`F&4qR&J}1^`|0$_i&9_5rYSR;?zvnup;uu$s!t%b849
zPXz(=N8GNHp$JgpB0J$HkHyeO36ZltXv`)p{2EFJdmEon&_l(Ry3l@eZWfDxRsdp
z@iy5AUd-g0!llve)op;hreHDHSB2Q19A|7P8V=whinj_1UjS@=9ybc|f(=io2KJ|D
zOGXGJ>F1K$*81|lJn0dqJud5qm3;r3YDO5h!d3Y48B%*rnxw4J|}I!
zNq{H+q#BG%39z_c+@Sxkve{m74jqdFs9d@?=&7_S0BT^KO1Q$C;QVr&K
zMrGKMxRjZubpZ9M)1}-a7$C!a7LQH2p)dN3V|#I@eb=M=$9zYtt7%i8h7>bYo6K*q
z!ku9SgcJ5w#6O)at+IFVUH9XJKP7w6f7L2j3XabRuQk7w@8as9)Q$Vgho=rF%E_sf
zde+MB?qL=Z#p
z-($$-Z!x5G|JN822V%%85JTRN3t~uilu^97H;geGIif#$9)5fu*x8rpQWP`>23MPJ
z%DD%aT>D2Z!Ebgd@;?6_SU>;x4bF_E-|fr7nw^x`^G3@^haKLR!MWtx^(19;52oG8
zGs8sgX!5AYpxnh#JKyv=aDzjFOzmzs>5Iw&brkn$fLkBn#zCkWeK_f3cFvkVOGBWy
zDhL;6M4G#=s5k%)D=1+^d(Nq&5KiK6l2%?Q+aO*YfGKRx24ah6{RRcFP-B8{bo
zh2u{lqp49w1oNF=Q1ziOQY>)T%pf_+FU}x~+jki3wR?2bwA=w{Q85qur^((>yXVOc
zfqC7X-?*O4j12z*018$Ik%g`T`3!$-tWVv<$*=ncxe8yIagw&iG(86E_&r$13y~zw
zb-Om_RWwBI{xa`FXSa>9pI+QLqM=d7YVubYpaGP&ApmR{;IMOZ=h;Kfn1jXIJi(TL
zc`fe76#<8{;VIaWa>!YbW=bk&;znCG_*3tCxU7s$uiPDvYvbkuCTOE5G41S4@)uCj
zi^~ZEQA7rc!T1S^aW#^{{QBb2LOfXW?|{2|tl253zS(;-8*A?Y_dW+GZ8+dLIvNSV
zE8{&Jf^52D6?gvAJ-L#FIk1Oq`l3w$o$L&-^gi2g64jRO4S47nJYEGi+Y5rIM`LY{
z%@BUhVuemCXB##Uh5L}VZ+{*HxOm$hO(Xh6dVc4Z#yzZ&Nip8(Q@}&aLj|OQkbr}*
z75Q&{c`lN%Dat0f<&aG?A^@zQhlYtD;B?-&M~}xx3#yv}H=ld=m`8=mCcw7~Xb^`4
zbbtroNiJyJ{6BlQua7#V-HRlAGPCkmCgmbL(zoS~X_cprS%W%=AyuL$2bhJ5=@jfG#t{>}m@B2U>$!`u`*Cmv1P=bqdObyb8H@yUw`m}!4&Q82o5__6M+MQI!
zJDgg*+-J|dEwQ!k6)Y#pksXhszp}YSb{YO%z?9`b{5FA|lJ^!9KMmd6U~EXXPhXBD
z6_<&Erti7;i4b9FA^zBpst9Pd#5bGWPOAGl;7Fy14hE%z$`!3s2vIJ-#
za<>S`zsCo(09lx@Nx%`F6Htl?$p2d}0gMr72)0a}@yp-U2PicY|JA7pCix&
zqTz(w0-t{pnm!1DWB|__PWqiH*8P2l{8!&4^0hGcJs6C}*5{;!p4iz||AmEOP^l-!
z)7}@(X)nb#09fS2w*T%i_AOIs&@zCsjv)^UaMBA}m};MbM^4kejG_;C@$Y-$aT=N?
zL@Ua2$-9UYY{M2nQ-iHyVoLU@MtS(@CMZ0|dA=(>)>pkmDoz%qeQA{FmdE8!?x?Mc
z*3A}&dO?k1lO2_y9kb%me+O?3!s4kLB2dPo-&e%n;f!Koh7XQkR3+BLS7yuc2P63A
zA5!8F#uwSW+kys2PE|Y;9^Jp>aa;50562RtQAc|uePmTG=eu|xE`X^)G4Y9pv{#u6
zItP~=N>1phdb1suBF_nbcUuG;OM}l#v0CJ^+tqcad=
z_0B=(#1+m?Ku^)$%9ltvTM4$U>*{o}%h1t}AOCaRjhYzS?|1qC<{j9WOONVvb|P$p
zaz>MX2xVX=17zpD>c%#JIfHbsZkzwEmzRQx#bh%1&&Av3=G(t-#Kh`V0=D3_xhP1(
za_=g)=?%nffFyw62pkF6+N0L52{2|$A8+Y*37bf*qo{YP%D(M6vJt<^SZ}x)*+P
z6PQtrEz-~*qLBAZa@>>RiJt3O<&K%7?E6=(M|+`1;{3bR{DnN^0Uo*YX4PAdU8HLU
zG&X2W>P}90+iSJeQ!{wCNoeP1&z7rz2Qaw@Rq2t5Q~bUQf}==j%67eK_n@6N%Ip-G
zrqAIh8YdZ8|I$}S)kd7yB4?L5c~O2R#qHkUQH6oBk@~^O;}M7}`$vn53WIwNr`8VX
z?dl4?zqFHI`+IpEiC1Zwdi1sQAij;+U6l2#SVLOQ;%}#yyZ)NUC!?hoC*jP2n$i}6
zJ=c-ql3mc6-NxuckT(g;WwL5KUpkg&l=C&cVXQ<;Zs#7}nsWao%ngdkaa`~c*^B&n
zZ&>b73Q2i#i*4Hagv?wEB}po|TtkF=*9=SU2{qRiktPJnlcYE=
zFI7G_+C~|=nr@oj9in?RE`seiSR=njaz`jK<`aTkP`AsixKTHF
z_fP+yZCBzM70qQh`W$@n!S*<1&LboKDb&e0OzmZ;Uebl9K3U8Zop2P^G?#P8en2}k
z%7|f8Of+>_Z{I3*R+XfBW`Dux{l<+qW%ZC`dH?U%1{f`j&?aMe2fbAfgD2-1vp!mD
zLTP=UaH4G%l!^{(+&d!q5~1_q80XaWcXhnNd&8LfVLdPD^~Hq1AVtT|jKpfm
z8zohEtc-!=ULBJPy4HOwR~TDs5kYrrYcpv7;T}fho6*Bzk!c8R3rDX`2|bp6ZbhBC
zj!3a^+*zwn$xr(!-tbzdPFr{vYxk|}S72L)?wBt6B>ItGL{pHJ@E6+ZO4CS-k5x3K9g6
zL4aK0TqH;qE(m`E=mHhQf9p%&IE{>qqFN3Cs{UVn6;OlmJ3cx9-agt;+s0e!U*ORa
z;E=wSEf2lkqj2tu0J{S+L%x7ViMS4gF+y$jU&XnxY=
z+LO|#mZ0y5CozgB?XRpLmsQ;McEXC@flHrl{W*@q*f9YdP^+Ta{_mdE+lWk>dF4Wz
zYKYeD%rT7yNqN`yFw>G!c3}4R3%-wHbmGo&K0Z%ViLJRRhxOsN`N!5--}h*$Fnf}>9Q#|l%S!1hy?eoakwND}ZkC#1;D%IA#Ej8)NBY0}LSE8+a-Av3?
zpdHs4oup=&4~ngu3+0qfkuRYGC_M=riwz&`>cbCthtsof^_tzFAR(
zFE-9+dv6W0n{k@aPekW9G2gidzuBI3x>&LwHZ^(TC+WqcXA!7KS#q+z%hezQ$pp%x
zt@=l@jI?IKcmovE`_B`?%FEZE#UYjkM*GX=S>hh&19ap3#%FLcL;5dfT7NFvC-MTN
z;$EM_Oi`yt5-rhxotF(tjPBjx9%R62C8kmJBw#(uSq&11!*Op%>)PJH<{HHc9KY|Q
zvBpt!m`e79{Y!kx%{NsvL)J$LO=#J~e%i|XY%=2LWR5GmM}`)-YplBg!Q^$lMQb(t
z{_FF5-y$QuqWV!Eosv}aeqe?qee`t|9PW%
zA5TB=6m278#KCtx#W+XU`99tqXIGoW>@2`ju2Otl1)_9GT*$`>Ik6o=$_vb~R3YdPpggUzO
z4~rDt_c2KaUMJnc`U9PqJSP}PopL=$7P}6?M+n-kf
z#JCjl`s+E7J|EtE(LKq2OOrEtaZTOGrD~^Z*~~Oy*uG?q;151Zfd|*q)00la
z7YL6Ou-*Vp6UA1GKUDyXb3vpbCK@gMwh;yV_Sp7Tlpxl6S!qPdb6IQ
zlTtkw(FYhe+003o`~eNP*G!t_G^5rLx^mHfnZ-5OY^*K3ag|({?Ob>Z$%v#Pi+z?t
z_*orZ0aT~9YxF+ul7ZJ?ug$*Hd(hM@RiVKEulk4#w3CQSa}-4}^w1e>>irxva=C0q
z3RB{%9M>2ib&SXmiMVH({{F<(p)LyoSm=F
zInMt)_6T*7Wlm&rC7`$dRBKmklsb29ii7~;e9$XBK~UbEj150@0R|?
zh<1iT87(=iB*7<7c_Edz0h0g6+CB2nayQ5$zUZ;~1qJ8bhK%m}OXy`|KN&Qx*ft
zGPCW3gN@{7^Jv5!?*(k?MJ}
ztMtNUpPh8Cy-U*`2^O0mpCH7vXYVzbUt8J+Ezv;5eB?hwY)
z2=MtFOq}l;pQ_g?@b$@qm9%7R&b$T9s9*fs@o!RiE#+lug_GAe_Y+t~3i#QU$EE)q
z5o%|370;?($P@AIEIXEZd%>gtmUbyBUrIcTk**vmMYDyYIFpJ_xjM6jwTkp=WOPs7
zrlsLOg?g)%-RgCnMc07Y>JFJBauzHaVeUiY`9NW1gnO`Dmy|Tk>*vU_rxz8g-AxM(
z_Ak77s;Ra=#^)a
zBqkHnP!)^q$pyh{9(RR&Xm5hw%CLCOd>4yr!Jk1{HjYS=FGcqjH82dxB|*|{I=8SY
zr)b>2$Tze?h)d##f#Xprk
zSP1u;@;O@()%Qna_mo|YIGS!V0hZSV9z>O!(uz8MS+ll?eWINUP=gf796PXiO#7U@HVg%9Jj?3FB}L#UDNUK8Tt3-B^%dXFV2$FYHKZ*2qA-w(Tw
z3V$or>ws?zM|}+OIyC~-obw2GxA2>}SO8{^O5?t&f<-lW9ch^4Bak)Rhu({`qI0?zUKOLF_KhLpS@28BOkov?%}c
z>?*lAT~wXAGmN_XUG*Jxi;4Q}FRzt4+N#yn8Cut!to-ec4|4ELBZgI3F+iS>48As2S
zqZtU6JfJoKO9%?IM4UxLX(NtRgWyl~XPR43m>ir9+YQDm7%md6=X<+d>67;wH0)&D
z0`&RbuK+=du6cr2(@pEanemv5xKn-HK@lx!0)HAV@29er&k12t_&wr=D>F5D@RgdF
zKV?%uf#TQI=)Dk*V%|jBNjw2J=7;e8M&ZZ2qA6ltk0Mw67KH2RLP+I*MmJ7QmOk1z
zFP_E-d3`41MMQh?^%3R~P*ka3P21iO(N}gB%i=pihpgDXz5NA$Q>*~X4C>W@WhR4%
zgd{-!6KZ+>H99IPstia%ii(Ori5~`4XgsS12x22jPbUdkEKm;%f30W&OU202M4_ly
zFPm}w(dD2T9BcBE0&cE*DIUh$(Kaurb1`WvHBhXtuf4Cmx1a?Ll+?>j*Mq^XR)B0t
zg1a@xP78F`K&`_T@KnX;1Ud>qBbqCFemYa`@zTa`YKG318+0sdI10#^vCJ9hmiDU2
zj%(A0@Skw3I*kFb^+19Cl`^;~&~~1Oc`dgZF{CT^=1k0iDt+<%K-COv9i&C~>nzKy
z*3sLX!;1V=HtE8kn5niIps#LGU;7xeYs|jy#l~xF@AXNY%ja&r?pXn{X3?)x7Re}+
z#kwqiv^|pX0*eD5WEbLdBzmS;bttQ~c1f*HuM1k^P($;Lk
zeQRZ8bG|Q-mX^4U>U#G4kdBkW!{+r8-+040Bb_!Q$2}w$-PQ6UR)qoI2ycZ+9S`$M
zmzLfO^f^t9etZ9gw=aJCcBb4EF1OntvxfFpgj9qgttn|9dJ2T~7mS7}jaL;qvkoz$$z#`~AaSSy-IEeIm8*nO5xs
zX(L+r!jt`bkw1+l8uP;WCC)4RH$nkL9Tt`B(3>+b42v6#H83S_pdA#eB}^>{l;|@TDb%1X9SQ4;yFiW{!e2f{%F(9EHGZhLaMjo9RuBjcO{3+F%Zp
z>>{r2V&G9_Xj|sKU-Mn`MFZIuT3Uc3)indnocgY
zSB(hndHsw^Ys44&4`hA>47kX*at~))#gK-H;
zfe9gY>(ZXWD3mDkwjWPQgfrd53hVpd)WF=NTTZ-}Y%Y`TTonuYeBG_TRD|@G3EUtYY+3lK
zFVKlXIi~pQQZQ4kBC@JDX4uXgDs!6182=>JCGISFI{yw%zG_gnRl!Uf9qy&@u`J3);gTC9l`G|Gj}u@@!;
zyj=0N)qpBc5|A7~sk5fhfhEu`a{K}R2l>}oC~%DLfVAoPP$>`-OG`@+sDUW8>D$wG
zpaoJ_zXx812bNabMbbAZ$g5zM0N>RKR1i&w6@eg(rsN{<`;Fj-Kdt@HmQEs(;+5d6
z$%*FOTO1Vzm7V?6;sl;=BR+bqZZUDd@9{+5ad(??Txnh`SJ1_9Fy_?oU7Y!i_!okTgoyPLIwRBOK;789Au3Li
z563NugpKOX)*>OcTUXZxuwNn-X>6?IH?q7P7MiBgOdILFN`Kanp4p7vB0Ujftw3H3
z<2NO48nRF=%-IUbxbSUW&)r;WN9LeV@~LxQ5a}a?{e?=(iWYAy`4|7leNv+#Qhu)h
z>Qy)W)>W9D;>SE+W+l4#nV{M9D*JN%lAPpGxdvVNQillTN!A@8x%c*&y`2!jN=O_7WMFJe_tN>v);_lA>UCLi72`vp6)$r
zx3IVAwA$t2m9VL{dnsrJ`?4$Zy!n36w`$KhI{mCfL!k7TKfd-Hi&V8W@h>S~c^D&$
zJU$OVg4R|QtYxQqbu0K9VRNJc)4yfufurLrZ)-cOOSn5v(mbt@vr%I5@Z
zPid;}sHtkj{C%#q?Cm+tXN0;#X;T%b`bSum3MV9F%eaaE&_a`{xA{g?@?L6#R|g
zJp}DHy_dKj%P0R*ZBp-;lA1J=@T%S0d;>Rr!N8TPzjAw#;4C+2e#^tb3op=WCBK#|
z@7V|$gRc!gm}uIjA;PxY@@q+tUSXAK&9??wP@+s|UUNf0D%6h1y1c=
zH`spmU4A1AnOFEW-HlO<57V&HRaRL;m*4~3lK;!QY`5j&YDfZMZOJtw{04BmkMhEB
zzGLE>7b^!@m{8ENB#`F`#u*s$^erTqn#W_%a6X@-qE_Y!FwgN1?P5&@d{%jZFn3A)
z<{6$6@TdRWHv`}VbI)mR$TNn_?mcaUInWn{WPhd!^m*)U-~5r`J^ET#iQulWWuiXg
zpr=d_#K#oAKj=S*4P3|VbER8QP>=wf&F^1Z(xA-yt@Zomc!3Mf2sMzI?DTn5ex474
zQjtJAs|2|~Sc@F?r;ukrpaQ25NMAOvXr!ekTdNO}#Z^H|j8Sz6&qkCRa$OXUfDfI9kq@7oMDeWQ7iIXr+bhI5j>4Vdq2`
zR6pI>%z}gx_WE2MF-g#@=$rx_KZVYZMahsB{@UvA7RbxpLDOrEaG%95>DU)zkG3#I
z($c8hkffq>UihoxeLAU7-r>wT(AwnQJ>JN+DNOvq`?i~t@7mef`7$3QX0a_bVYz?r
z$?&`G`dJ^@UAhDTV)CkD48&yMyT9bH(&P^DuO#Mr
z_>i58b)Q;Y>4|u2w<{Tg3rjXzXCrR(7vYxNbeobVv(v(N*2^;h0`UW4#8p_}@CIE4
z+Co8Dl;c79uiP8h8Mel6xI1OaB0|Rbb}*|I^1E94hF5
z1ud|#c)Xw|O913dMnDr9Q)Un7ncLoP3mLoj&C7@q9VU!dQPpgf$j=!C>0ltQWR-v50pdcv+nf}R(`53;McG4VZ
zJmyV)+7((NVq+5-6;6k`Kgszv30%$RZkZP+Q?3Mqb#js^k%qLaY3dX;J3GwiSVf$>BeO-&1@cR#
zi3IBXtCNz8bRoqvKo>@mYhch#ESep&3kh{D%|z5DQTAK&s1U+k^~48cHF4_)w&pPzso>DI(~paAh~lf_yyVZ)11e
ztgVCBgeLqV9(SOl@hG{FutKzGq0|Dvb2hwwk?NVmP5pgnaNbbW9A-C%loW1~cdc4s7+
zWWm@a!)euwzViLn0WIQv?wol^@yz}&n|uot0oMbLCb$lJyY)`zn%@GLxev6iqE#eg
zxV?YinS0TeG5uHFGw9P#Bm2#Dwk%kq@rJMM0X{s=(f;lH^`7(g#r5Z67^fJhS*C2J
z%TWKNq5iAoq8lN_KP<(CNR%*Y%rHNJ{PRTq=8TjMn_Y}#@-YJ?)BJ!hdaY@77;}TP
zuDCnU*2Fn{G27+nQU0Od_=>;rb$9kDKt6#?Xcd=$jg(e^20%!Z?NIeH#rC2|T;fsW
zWovQ8Yw(*p4skpir<2L0{xWHcHx~8(x>GySIexRiH*zm(douUcDv4X~=6PMc$>mK=|2P!ytDqG=w
zf5z53B0m_tnyThTnG<9>FYQkQ@qsMo*dwxdZ#U>?E)k^HN{}(7Zypk0rS{uoy|!Io
z{>pCXKayu9i)=jXW@WC%DqooB6bR+iH2z6Y6)ng~Z5C#$y5b6F9TC?+de49`aos26
zccXIp5~Wv`jAZ6!;C#DPumnaNjmK{-`vsCPDqxi_3s_~~aJyGVmu>jdHvOC+5jYm0
zw77<_fK1gqz6GU-kJxghYF?nz^jKwDR#WG0ZnB6yI~FCpB9D9>|Fx;I3gEO0|6rii
z8JLQVcb1iVQB834!dZEHH_peMG
z3dedHNjmDk8&8=xcUJU!QPhuHm;lFH0Ai?|^V7dvKqs73_$~MS-{7^H)jqMNlB)j1
ztqF)9ok0rlu+w7jpAmqyHUTD-)a$=2JX(K)m_q7Wj8C(Q$*m6-N&UkYMSYFKy>+0@)u0$NtBL2f|(eyw-a}dfrQNGL>!C7zD&b&^1
zUd?NtIJ&D%67i}U7IR&Ls7#DZ|6LrKFy
z7e9iQzt^uN;VVOzP{ZrTOn>;bG2I(v5MZwW&;alsBGKGNVyM`Ap-pfK)0Tb|WX$M?
zZ@bX*oAfkDbxWh5DeISd$U|k2u$kH22a=*yckq=s(*Ys2i2C8rpFtlD@J=_$0+uWW
zkSVUj=bN{-2)-n+4S;WFf2SG@X&&9RH$m_vfkOdQo9%jH+J}g%5~nT*zV!79kd~h`
zjh;&fYu|pj`lZz?tV`G&PWsL0K=f+D`0WboFYG#jyh1uFFDTuu-bTR0J(T!=F;LK_
zmtk7)S~*P5HmK=Ui4{0Zum$q(!%0g+i-?E-Y=sh>BWU=v#F!cB4;8+!;XjT>tSJ%w
z`|F$k!E&I}gT7t|z`TDm9_BpIQpa5V5B6g`0G%~w0e|^#CZr7jHL&f0f48EL0iA)j
zC@ZE=P8VxrM2pw%4X`M*H94qstEv{0A;}hYSa?_2KhqUzZ=JCpH`=&
z-Oj?BbaI43TzMq(6O<&^*;0&EC};%D3HLdk1bNWS*{a7oA1>Q+_TMLglhYc)h2uP6
ze3p2#pBtaBJ1{jzLm)>YS1}_vb#3@8|y9
z_viQdw|Kj*_xrkD>+|`1@s-F&59=Yn{Oy%L9ga4;up^9u<7iRY8me2@im04HEFjsw
z;9^WHV{L9IKpThPF{CDR;|P=8iJ<%(1)qO-8xe#L;e+0ig~%)Bl#?PZHY%ts>UMCl
z`}B8H5zzpPxB8o&r)>qEc=h`ZBK?~VW0M{ZSS_7vJRUW#V>dls`~4x*HvnaJ!2kRo
zxZeL>J7jFS%;5$s_3f>RhYva#0$+SICvL$g1{4MmSw49Zf5IuaO|$W<&=#;?;JTvX|-q!r87lU9LMs`nl#_P$b2i
z8m1h%uAlEGYe!3sFN~PuK(6)U-SInK6PU==hWWM$?xOQuF4;GNref3fHzmkY6-VQg
zFv{y5M!?7Nel8EKpJ|Lj$2?~D$J@UcFfQm!J!FP?@yT;H_uPg2&}5Hn9BB$I@m6$m
zBb~%45$2fa^&(vQ*C6262pV5qZGkds>?)IpjwhB8pp8zzf|W-66a?>zM2hT-CXv)D
zH>7#-fY*GO6~>Ex_1lz_D9=+Ob8E`#hQkWys)r90G(5t@PCJX4qOu@Vf8%Ju-$@%z
z(yp&`;kV6jRhxF=p!R&05XQi1qeN58(Eg(xwaO8Z@DI=v6g^V7v~16+FZvM{br9g}
zSGy=}Tp6hBuD0v{wo?sUKZ!)zZgj3a_fy~6YXE1rGBN>XY|XDbzyDXz2mE)&EB^|E
z2JEr4l$81ty&fqJCxKr#ejiQ&GxoXb?(&&z+*22dl`QsHvwL;e_cz0qzk4R++c0?B
z;l6pbwfH32k%7)af|
zJM8*6yU^g;ddK~42Tj+ou*fUow1QJo)RF~Y%ODQ#>cTUXz~uzoxRw4(9&|^qzWA(g
z_Mt+#w?NYSJ09
zsP9?N)tM4X;*UBp0@umkgtgXv*&@)EQ0Ce3re*UmAnmXA`k+yh6G#?zbC=_e>NAIy
zWT7`ns7kIJhuOt6mxE#29!hB*ZhoJTDU
zdzUWF@RrVvBLVQE_l?JHbyEzV`~|t=X_u1_d3{^M96;;5Y#9~1|7&c|z(zqMM~PT2
zlh5@7ck{V{h6bIEHl`@+F~ctqVJD^nd4OUU#XrO}3DNC^Yth2J%wCma`0LIsne2Y4
z{1DWoJHqua_!c7VZj?}%pM&0c!1h!C1dE+JR(+74Fnq|tE0*ZM_l1Z&!sdONX3+r2
z$}&RF`oCr705N=2#jX8n@BLolN?E
z)ft(j64#+-#lyD5I<>7)^2uZF(U%Q(sKVIhtr)RZi@9WR&*F*
z`?CNz<>Z63F|%~HG$-ru)jd-+m?n%2QmgE}*m`AqbC%9SVFk6l|7ZCraaG=z_1_;D
z;~`Z*EU!z@1LQu~%!l%!ZFt3Kf7k@UV`%QQMw4=9
z5{FMiQzuKQBFDb6_@K4!CR?3|geHt}o90bL{T($k1VHX3$}6cBoT9Qz-V2xub6lS@
zQd&!3hxc6RY3(LOx{dAZ=mPDI7us}Wr=G(Rii9chEb8$%WArJaCOFhl3lPRxR(oZH
zc2&mwdqe5Z8^U`tm3|2B3%?cho>)Ihd#01)vk5~PR&RUF?i;J`*DF+Z>_%8QkzE?&*OuG|n#CwywXg{A)_0mF`qsk2QqjdXF&_ie(w6Hbli
z;Q6h+O+>iO3R6hx^z0qxJk#AGX(M!oJ3*deV~O@kO+{Fz29w^hTTh1i3?h1-?Z*xO
z7sm;Il@fyn0AnO2Y8f~i@DLJ6+OQk+l2?WTAS?vEwDxEPAj}YBSN=9u_%HJ|00#!G
zyC3*#aNj<5t&iVJK9jw7{R@;$br?z^?GRyO$3az7xtthW+Ukx8IsJ@AwU;d
z9pcWBl-$N}Z|E8}U8KdVj#>46$!>DKq`FJQjG05np*XE(6!jN{#)BT>UVE}6C8#|E
zV`*JJLCvBnEweXF1N)ZnguxiLcN8_RDLBiD{FWN?cnQmqU+eUCBiWkD9%!c1DR+Vk
zNZT)?HJ%*o_CF&}k!&x0ikK*ybKc}Cs?*Ri7A{b)S$a92S)GMT_>zjR$Yq^I2$CIW
zC&9u+79BTwv~;||-P|YdfsSId7-vwQ#9YXN?=!W~_fBDIrWoUh1U`Q7ybH8-EK$0Z
zH%{nM?}AIp1~iCn#T}toxp^*zp^gYOx};#t3m1DV4(wHHZ2Y7TBNN1_ds~YX({7b01|SQs5gSfrFm!Myy;eECKrqeWt+MC?rw2XHfR;vE
zx%~%_W4N8h*yf%>JigWK&9(15<7|FvbJXxD{>&TtW2Ynl8-Cr$sxmLq7^jxR&bP>`
z{x=nd|L!dUP^zWr_b?zNeUEi%0RcP+bh}q3L%;^q$19H3#sN{iPk=T;gqe_<>r+au8WR@H^!u+`*)|FkH=CF-N9DZJxw%!a*su1o7C=sF2$F
zIhVI?`G6enFk0W}r0?1m+Q@-Xq&N5DQ@z*)f6b*N*UguI)B@>c?)~GJfEtnHWM)UL
zW0--%r8JuM_{$(-^5Gm=8Sa9MTu;mf^i!`|CyRz9Sd>LeuzewddrHS&%5+4Gl9pTo
z6{F43#q-1VG9Xl|IC#hI$+|G_TG2W~taW68uRpy!wJvdeIm8;zVQd!Bac`>sz=9f`
zb0O+!%kEL3;&+0X3zMNywYb`h<0H5)M)(WZ9CXa4KTWU<@OwGtR4+40OV>4M%e$w)
zggxh^rJ(DcNeG8|VLZ51Lqr>pF-mvL1IfshRQFNKlW
zz_VZ5YYU@U-d!lhc6tNc)dx8~`1Z+F-?&ugYUAc}PXk}8N5Dfv*jP0x#hu;X`Ky58U!LOw6Vj33
zNn^pmSXnw)oA&p$3sy-EjKcwgS=wrk09h~y?Eg@a66D~3zy@e=@_vyI{?X1sYr8uc
zwE*aFY7*z$CI713bd|<}IxdSd{l)A4*B=GABTKp#nj_;;?BoOFPwsgZ5ZQ)Zw+(P^
z)}RteH8m#!@ET~up8dYi0~)C;jt0;)Toz~JcFJY|dh+TYD}-U2h1fpeC5+r;JAcYo
z=!V{BIY%O5kpom4Y6U7=2FZ9lp~{C9o;q5ED&3jN)58o+KS((L;R=~;i4e3zq|dlM
zazklA2n2f|+FA(jpBJ`knBPv9rrwI};_o$O+p}hb+%{OuLNoezxXV@6oA}U1eDKM}
zTpHD#WAVJ(nkB`ST&RG42$&y;dgwS2Zcg53qDlo3%MnR9t%9)rCokIo>JSkL=R
zHC>!sxhDVi(bPV{D<3>*6(LiJ(x#|&b3I;^k}ppo=zh~$8Qrt^hB<$*Er~if*{ejo
zW^xzzAtMigbLowR=*
z81Q%FzrTAEjDs+WKJ!>WjQ}d7J#~qQ-_EZJmqGiWxcG#h{=>iM8vOq;Oavibety0^
zInx(?IIvXoFMGP5>y3Z_J>8OH`;VX{pmd=G5I`jhqd>-leF6Ai?zqHEuYSe?`wRY5
z%eLgxgrOjQjf~9nDi$EVfihC{*&f!rc?ihdYoKvzHnf8b6tT-JX%6EzO4wQnZCr&_
zY&pf9(40}EaC}?F!CDb6at+(N^*EdkBxi?M3HB%d-v>nOZTB;u{x+nIwJsI$^uWn6
zkDM-G9@B&6x_Tq_DO*|?VEl&KYqN%_?6%_gKotUlm-Y@TJ3lSQpiGR0O9o?04|N4>EwhOrHOU(Ivd(R45vzA5YWXBNomR#x7uN|qYr
z!%^{<{9KZt$$0ib^I93xna9K2>n?`kBC2Yrb>!^2whzN^DnJuSg*}uGzpd|yC1Mz3l-u`8kjCak?t5IS9
z%OQ2r%AAF+vvx1p_NV}nV$V0P?XT*Gpr7+i@sM2|;@?&yY5rU)#Fr-2f!q6fBk~vv
z9aA6D6OuGR05P7XQ`;mvlaf)60p-OvGN7^YVxL
zjV9v$%*)*vNRO??wXC0@`MyvOt5!Q8*OC78KvSf&(wT@>3}2{HB$+nmrsPf_}IR5M79`eS?{^HTNn4
zOH=Pn=9O;@%+%_yuyHrRVJcIhYw-wb%&^3DA9lH-{0-E8b);H>_v!m0*jwF`YVJEn
zq*|V(BBpYB^bEzK5>CD_o;oH8-#L)aK5$DylsUF)1zfc66BM`r^7IE;YW7Wj4swG&
z*9&|s(KTJEBu@L+0^>KO6n~?W>L3F&stNldvK>uM@h?2(zXxE$qQEXrI)MRAcmF}j
z5U^xN0O{Z5+UEaTeQBI3U`QTaj5B<3=PzJ=|Eog4jR5-lr7JB5XLnPYv8+xrgYGF0
zEL%CCe5ps$X9rGudOF^>W7oi#a;4RW%vJ*6FC~Bq=GXwMg#?X-@yo$-IWmTV=)6Nf
zBCvs-)iIV(B}er($L8m-SWK|$Ski_EtAIN@A~T1`lRBK8HrJhzw=8sVReqd__-t#h
zd(a0D?mM-Rf~a!?MnRB3w0Lnb;xJZDX1xBa&)%71)Y-m)d*+6fYz;XNW=OzqR!4iM
zW7u}97sy<7oU=h+Pc<`(bqM2qN{J;_rYc=fy=z*Yy6e=H__BM`#x<&B1Dl(arm0?sxa0=)mQSx|&Fo0&RTX+(
z_nPtAGPPvCjq0Qp&Fzmbw&Ega(NThF_IU$6qSHmTVM&E|rzNOQ`*i@3eKqVV!wH71
z3=^_Lh~`fo_+kAKb{`@M!6+mJLAAAh>iCV1-CfYe(ZW%x7FujQ{eM@O3piGq>hY|3
zQvWDnFDNLu^M5U22SPPqPEUMn^gq$q#wMG20u6-!n7Sht1IA&oWR(}Mu+QD7Qq+en
zML-^_MY5KD&>_2K1p+3NyX)b=tmwbx6`LALQ>(t=~|8FxY9_9mN|
zEP`Du+r)T^lFUmoQXiM*EWDO?tHh~NDk3wWygCVt4flNU$>GCG!OX!Ec%5Uz?=rHW
zsvq`JEjot+fNIFl2t<+Hl^se}ez@c4wVZWfl$_klm(jcztk}TQzG)6IG9iO4h*zj*+m5weeD_`VzTmIf#%i!5Qpwx(a;ACu=XOC{`lxTmfXTW
zpxm)aEG8z4-=MnwvQ>5&2S~$MmY@QwTLc{NDon`VJs^L#T29H1_|i?Ej#%5%9I->?A-I_brO`Ha6f!xKll
zFJ;;l+`T9Vq51$Ky87jV)MMT-a|)SlJ>n^%gTY*62s1UG@Yh48mCRZE>xl#qV1xN1
zb9v=H>hNCNIc%?*sIg%4bMo|`NJpWsTomI=xGAg5TIO6@*fI?K`C!^1m_bEHy1H`M
zM^y;pe}Jm3|H&{77&Nb&vW%@bh!xYOG_Z2N|bqV4``lsL+35CdkXzWGNGC?Lx98#nRG
za4+_N)Bmo(J_)hlew^E#EIQ4j-^?}vu|K!W5>`~cbU8Z6%S|bES+S224>b0Ix?73O
ztR@CfY5b1YvKJI873CBS%!h#tZ^5cFz7gQm>4KmYji&Vw3vPj$K;8FoWCjv5G%v$Q
ze+^hLX^7r27XM`*Q}+xIgeyJ~aslgSWndv{XW8dPKYs0&-ZA(boG~9AtcdAJnYD2#
zhgC3IMEHo8a3=#-wH84_=X+(WY_l^BSLwk&|E6|FQ$OeXNNKA)Dz0va&CDG~tA*U#
zeZ<{(P6a-*p@c0F>1JI}XYJh58{@1YV5@CKtD7cy3Qg3Sawz07x^M>Tymawym*3hh
z+X-9{US0`ab!x&E(&|{Xd3&RwS*YZWX5JYSw)9&d={1?d>?hXuKjanpESaHKa~31f
zeMxR{2HBKk(S5CJ-~|jq$k|P`2%0fDacyZ>9!4IO62ux>7<~Q`U0K{;sqQ0qzszMo
z=2t3Csx`pu_&y%0H&TU^pi^64SP^MpeHm2vcmn)5i0wB1$P&-~3jLw*mCR3`K4QlU
zFF=HqJHTdAC)*thY%F{%_XX61DybZbf!YrjBqGA5tow)Ec#!uj<4GG@m&HDpwJjaP
z;ZBp!5vG!Z%r5iRB#SK=zUDhoL$$8m?gBv9u4wr2Tpr!I37)13IT0~(*j#WO#IRcc
zfG7bze|a+HGUjAQB+un7}f0y>h}*F3$O<*+{o_FrvHoXXR8>sz0kS4
z;#)f4pZ^6c-RQUL->_y<;H&ZrOWXcGs{
zU4uuLXAOD)St=ku4Y-frDztodDQkzNze=Hej*5Pz{vo@@Qe#+#r)J~7{ZcFz`U*W5
zF=|EfXFi+-7_kY6sqSB2Vg~UuDtqdde8l}FJwQi$A2avR!8xpvkvcLAob0dCU$rUh
zPtnd>M+*(NeYjP6iY64BBH3>BByvxtCi~mB1HgxC-EWja6pr}&G(o^6P!cF9UsIy1Xyw}=>W}(`i1jL0dHakfjTj5*eNig-(ODiB`i7i
z$1X6RYUwJ*(VJ_}+|YTon;w$NIAV(PWmE>vCGQReFwJYRR*6aP4}&=M+Y@1qlbVmq
zH11yS9QJBZKGygilq)-*q=(*f!;X*9YmGzX{UFm8Ubi($$f1DoY?LMsrqzA>fC9IO
zOygRKcRbgp9ZWFudR30pYc-r^JChwr&kS2d&~JkH-j6Dz`$Ln5rUk!@E_D%8hUZcS
z(%`J|Hs2lrDKS%n0NR^fgCex@%wz=ZSy4)B&Z4i~qw{>W_HA$6f45##qBvP#Ie-~4l)xnggCpHf||nta%IhvDVRKROAlncVZ$
z7J-R3U;@g&Nhpt{p8PjN`haL%Yilc*k`BfY(ZLjEmP~>t#>MSYX+H-C2MEMAJ8fJu
z$@$d|9W}zCQBY+C=G2}ps0jYm&}wbhOEE6C?CXUM!|t7O#Z`SufF2(}{-zOSqO1A?ty+r4QN9S4&|5;-oz=owpQR}z&Nhjt9C!MIKWNM%{7r$Zuj(qToO8Mv$)}gq;!Jy%
z1t>HWSvN0397~bEf7lA74p$)G$TtBH6BxP861lvWsvd;@MM7_Ii<1h(lIkO0>J?LW
z9)nM6z~9^qN7)?}@I362>Jmq=;C(6m^=`57W=EBBN(f41>bTl|8LtQT?_^n}*}uu;
zTBEBJk$#X?-Xm@I;X}tj5P3EVk#(@$Hl7w9uQuu7Kbta08iDSDj7`tyH%w0)pr?SW
znU>b(E@{-ZxCbCayY{1`IbVWcUakv}Fy5TmF>Ux=1S>LIsX^PcQb#Y&n-d#**1D
zKSpiq9w5x}ItA*V=oPW+II=%b(C$G{(iQasBuxwTC&wnv6eiHyi&`s6nmg{*)eHGp
zJX);nKGPo(C@RB^3{*{^4xdn*u5H_+EcbbjU%dcj$_vL5;D<*o3-E7I3y}5DI(F9G
zWd2~f{|*UNh{EJuFde1kI&BBmJ&YO|JgVvBT9~}Tp99)C9jSqpxHMt*-Z|ws>6SPj
zR^15K3xVRVzQ`6adZCK_`JE3)ub$oY!pSY^&4(8p^VV2l{=lcj#}mAs^dwjtJ+Hbg
zh138nn=aBwi_-HvV|1*pyPk>zLolWo2~jE
zleY)tJw=qY*m%`r4>CxhRT}uzRF15m0-`>S`*|y~qO1e#`db0T3KF$}ctK(pe-xNI
z>3Mu!BTxLJP4fJKU9r1-&hK8K5w{y=a6$RvIUd|~d}Amnh+ea!44ZRsk2{Q|_$->N
znU#^@3zVh5)f60*GNmOS?iXe0kDWGkv^UbiEvda$;b@!exeLGf?h`N60U4}5%w)JO
zNrFEHm^NS713-|@Koa1`k54oMEq?tUC7%iQL7bRVqG+Ez?c!@bD1D8s(n^-~WPy>>
zZj1-IegDA1#em5GKEyT{V>
zN};u&$jr;e#&{5&W4PJ@=SZn3I_`R`6T=25$8PF4!5v9SV&gTwsfHRiVkmB4j;weG
z8dSCSNv>ZrxLUg6e~V(--zsPPS2|46($e2zp%Pvpp$9fsnvOQDVa&D&Kpjw#Mj*(!NRx1^Rqe40LZlRIB`pJ<^@dlFk}ur34-7q-s^SaqSfslx=|mo)mwqFGC`
zpB@56JCxp>B6P*uzFF_;j`%UrAB1*wQ!;(apT;6p=PNi3qeUIIrPE*m4>O>B12G-E>L8zk10X6S8N+0j^r?$tGYt;`mk0^Ml62y;RGbtPE9=O+J4qN|a7pRBd00%~8+UCl~?0xxOP#&>3
zRCyf&;yt=o!!}w!Z}-kUf?(`skeRP7!y~B3=ocx2NdNnz~=lYl%XhEO210Pw7S&Hl;le&yjXoq2*-rc8!x#xG=R*YK6+f
zN)OI{ugoQ*m@mcnKU02c`?W#@X7^OdB|%?0^ctf7s35ZAMd9Vbu$UR^rJ{A@cnc!D
z*K^V1wpA$S4)~yAmMI`31rZN>rcay9_q2VW;v?CDtHp
zP@SxTd6dazueu{F-ij;KplGi~&C#L*vBN+NOUMWv%+W|E2<$^Osfps;B}4@scddia
zu6V==-)dsJ?`{k}HVNt^yYtJd{xhSX@U7R!0dUQrzWrFc4?^*ZNStcQVd-AchJ{?~Hn@K`@yK>-Z?X4qIY07hA
zk_t5Ef&yFHH1me7g=cs|BI0hmOKSX9%@h2x#om&skGE~wca342q$N9i0+j~kL(1e2
zR%9NnS^_k5h60DHBvzhrysNV8n}`q;k%1&ZL_pi!Z!ity4mI#8e
zYZ%NYzDr|_D5cr}$%Dn8?r0XI7p5izkSi4ryF~=XNVhCQl48J}^y>=s}0;?Z%j
zBE4aBRdAPlu$$2-!Ph01`EzdAoME-czk7PBD&(R>ouA&m@vidJWYy`26Bfhb+cN4c
z4{7I={78Ju#2nfwFc|d|)`V}O^auJ*c`8uj7YPf>9@3J%v4tbtO*ux#?s&X;avDq!
z#5(`U%&d{UeTWA`;khLJK2)+s;MUk(Jx!iw+xw>H5}W87=63Khv$)%X
zRQ-61v3H&d!=nSYmoVc`m(p+4mt+nr9@ye17I)FY`4PYhFdg^&iTRhSy`ttp+X2(C
za^z`>HWtm5N=s1Pfm0;5>Pa8x#cG$HtGf8?b$enmp4_7->t^hF7mh5@d+{)8_|vO_
zs~q%hT*E#&_?fBdxZ|7;_dubRRrI?+&vmw=;?E+rbe{j*z`Lj++jg;ZtJHoF(GS6t
zWzrpPslu>Fo{qm)6%fYJ_4J_;$`3D)`S7aeM3b=DH;JQ=;0uKFj%fPJwhUCf&apFC
z(|0^+^H)3%ddA-i-agQOuE2fh9_w&@{SpPHl2o+0A<#VanW;9hU|{QI@Kff}KCmou
zcWc^0J|#wdL_E&%QSTWUUdXk|!gZ92nL07*?v8usZTOtxy!@8}aAXHrBq&aIfc%n4
zIrc@k3ZP!FJAZJoZ6;?Si%eiNxU^P5aoW>z<6Zc1y||*>pdTr^G`Pa1q?RiCv`U6i
zfcp?r_Ew$7SzH0+^+
z7A`hs_tn#*)xx?9OZH1Ofn*b(T`fjOV?C=hN-6oa==&5~a#kWK!j}e(mO=|)I2=|S
z#saD|Rlz-0N}S8^V5jlrUGP13nQQph?ccJY!=j4w1Y`+rzZiP#U_nmWYk4_mT6K5t
z8K(a_;n||!s{n`UpPI3xV8;^Hp
zR)i*;Ukpl}9elq8Gam|h1V{UIpSMjb-P|CM>x>WOh0pR>o1eA_D%O&h_Ik3w>yPN2
zJ52+#gv{D%vGxGZl4uI#ZkY00zZ4x8XhSz6N+x+_d_GG*2o}#*adDY^BIrRBo(Px-
zJ}r6xZN>~Goh7916uh+2LKKdiZ@tE+JT+Xc)O?OdO2kX7BX{V5BNA!++A`O9dT)F{R;CrRH>*xjFCx>mVBTxz$iCQ5`A&lp
z)gneoW&>M!HAJ96q2}BAvT)vc4na#&*(pyD4WRhkh2jIVYL_*Nkqa-anG0z%VP-Vy
zhIZ7iuS}_75+%;j#02p-Duz6+m3LyKMyq=R(SXV!rT-e!Cp+cJ%d3$FB
zGR0%fozWmuTc3PmcR5xBoont|rHkCxvXPGy6X*tN6kiYQh*LWNVeX7y>H^BmAF67-
z=X+sJ#oeeh_|0(%ql?%o*8tYCqMGO-bD8{aDGV?MP1tPt<+wPb;
zetwDOkN7d4&hhMk%<35wsLKiWn*$hXD-g>5_O3GH;N!=tdS{?{o
zeYcz?F>244XX#~AoHU{!GTAwI_=bUVRFBTJEGz67IRgDF#bZ&o(*@V7v-_llbrW!=
zx{^g!ZBN2Hhgu7}PQVCKKI;iNOP1EDrMP7=qz=c~$h!yNHwvzYVikR=M-F=*&d7R8
zkX?9uZ=vZCVMA3Xsk|p;@y%=4qH`X_Q^&7zptr{~*U
zQW0k~g$_zm;@nZ3hClj#8XvsAx$dFhH46TcZQ3(@iFdSc(xvmtJp6~!ox}Fj^Fz#c
zxtZZ|7cZCVh%3##AmNDS&u)No)_JSnv}0sEt6rTv^Q0%gMINT?PMjx4CO9@}TP3cq
z>gm`&Bylq=J|uSbAoH~Yc21^sKzM93{vbmS8{tHLcK7=Q76f8yWTp1RzhxX5k)ih3
zj<_+ks3WRAJ#Y*6F|L6ibT#Tywvk|#K$jqe^79HiC}w)M1>|>iDLII|#F6S2gfC@(
z5ILYS7a55i6L}6)C04kTG6!oh>W&``2bW}|O-tgWiq-`0FUWo*PX9>}R6D+Rol4SF
ztuTv&(yw}&?H=SmIl%zax2K3tWn5$~3J)Ow5WOQJFN8r7Hou7OYpBdokG
zphn|`!XO)0TvD1m^t&vFy20;NzpK7>$mlT2x12N)xvrLv?kV@#XDB%OqA=vb3w$`L
zD6B+-zskQ}vZJ{0z%VGtuiV8?6_bmN9KQS21kMj_+ZOASgFgjUM6
z67uDlyiyav#f#&p&LS(*V#6`}3x&vCey`WHsj0_Do6ZUx>*bdi4Td0p;KBRaksDAl*<6Bj+*U`Q%ne*F*uUZVP
z2rSp_JROPxGnikAK}|&?H#}+aw=+4GJ0Q%h&&nLqil=E8p)d6oTC0RoE5ky@O6F+zF1$^e@kOV6O15$3}}
zUWbMW*xGx!70mOD{HmxscDZWvCZ*#+P}TtJ@4`N%T9EO2#AA5rR_A84gQ2sY5>Hl$yUnmT
z?@`lSr&iD=sf?SAHn{v=R{voo(7=omki7T>RTUB?V1>
zVoQ(N#-CSyJ32f_hRTYRL&(F~2!hFCq`9|;womzt4uISQX3=m{B(m_2aP&OuI|^?V$9R0CJwiPf{+>C_!gI4>ZK4PYDwklBg`4T*s>
zg}iA8cGNrETVYMk)9B4YzF09v)YP?j48?uJMX+5x;Cmwa%2I#!7_)5B5nfPDkagqn
z*SF1i^!$U_9orrzY3EN|Q!o-{kUBUrQU2PqB#y4J)WJZX;EfztZ=3cXyezfn^@%R6
z@6HA_W3%r}#U(dm0|**cHktI}9J1rcuKxNv$&p+odlKYeScDT?v?0?9SzuU7Nj>bm
z5VDmQxer4zNSN*`y>8Q;0@#obZa#^$GMs)H2ub%$&4ylOC0%YZZ?Rx$v;2ZV1$46m
zB!1n|g2A5x{hDhmP%46xG7+Lvw!SWOSL=>l+Q-gzs%;4@TM%86PmHakN$@se&BSoYg^RBqY3PX~qw};yu$0Ss-
z?)?ww$%X1w9&)iU<0PrbxVNq1sfV!|R>t~D5t0b^g#0uUgfu+KJ1{g%&9~&7rh8VE
z`;}p^Nb0;p+O-2REuFU;DtEM1x+a~mYP&laq2RiEzk;{-n@}p}h851!n-;8ra;8lv
z4_nzl8RIXFM`t@yYi&eiijVA?ikS_5MwlBEObfq{RU2<;x;}RId0P9T!1Y`RVdtp4
zbp16fU;M?{fpcR&TO=AaCG(GnD#LqOizbnzI8#pKhpPBzdPPKN_G$`|rYbToHB=2q
zrMFEi1RWq{X;YFFW!;C&`?uG>bL2&or$Qf@1(=B@9@sGN@o7JI(}MpOQGf0y%Wc8nGt7J(UzD7Sd{
zq&vt1A<^hNN6DFzrZv|u11*o%=Lqbif~if~_lXR^8`1SuA~0&Cdkrx{+>GaiZ4NXM
zO>680al+%BOQX4Mus$Z=7;*@@siuy{!qSL4@yq4Ydc*K<@KC8$aaYk9Br
zU9t!uPc^c5fZ1IcwU(Ts$<@-guG)|m?x#FFo5e|&4b%T0AARA^aHEfDF*=$sR9Jt8
z3PHWb)mlr>U}Q{j)$s-qE>FbK;>pz#2lc#9`#NjXI@(e$y(r#ODSmJh1s2(LO<~$n
zGP*#xb=$#9PcLl#S$K>?@P~^(KfQ1vQS8#Xy>DgD2s{u8s#|xjF{yHZJ~lnk0ytJx0~K09
zC5UF`0!QPa?!Q?)3a)+c3!9-+T{<2(+Ik+*U~1zS0VEzVQ@|Mj(D=Otw=jWVkmQ!|
z%-=~(Kxj^jX!5kp?QQt=YJzu+83B=dpC{_FW5;}K{&Xf)qysgMC`HmPIW~0;8(}S`
zHq!P9+?s!Yyfmy6=kPiq&_lN=?TIRT4lwt=
z$sEt;Sr|*G@#xogSEYHPl6#RaS3EU0{T{x!yZT|&iH9=J#-@KY@Ms@0x@SAc`vdbM
z-Pz+Rs>nxWDPi0%U(jgCr*=20@obK^$Aovwp2xQmU9&D|<3IuDF~SuzmENaS$>rfB
zJ8GeZspT`Sz@{Lmpq6sOc*$cG^V_bBBD6Wq(QE2YAp*m)f
z<6;TNpigaBpI-U--nt3v(aW1%vu@x2`k5Y^nMOuW>G|rXLnt=o1Im$S2b!esB}I#l
zmqgp5gjA>C1$Vg2TThqowIvnlD
zH(aTBCGq+Jr@*f8+WKA*%dBiMQ!v>`3wIoZo1ReyxB-dqOwdgfGvxzDDFZm|XNBz`K~%FmO9hZ^Im6x*dn8GcdS3l$8Bs5QXijC`nKE@@gzDrTF4FUMOVQ7gjk1>
z_@I2EZJm&+0dEpww5@1j`osHavq=WD$UG+Wezr_!FOFd
zz*?ov@+vc1Na~^1!;?qcd*%4hqB9A2*)pss?*04sy4&yoGX#DbRNb;sSN{0v_*mxT
z9OO94iJoUbrklr0Wmw_d+IK5?_1E*y9Q^?Sw#1y&WKN2p_N`xDBYMZ@H5MQ$MMU@r
zPMr-Yy$kmCbG4eL(vI(rJBpdQ-0Sf+3ht_(?(0grsgzXf?xTdHQ+KhRhQ@aIED)B+
z%xWe4HBr_=j6N^q6>IF^aqq=+#&w4qYKncGv*VUG6Nf6`3##spG{YPpH#vop*!Imc
z
zbsd_SX&Xw%X67NLM;9F-+NQ}p%DvDPs{_>0=n|U;RKeS9JHw^av*XvdVy3T_v^#g~
z)yCmA!e)j&CcM@T8(h7e6iM%WdUV8;bE#L)DRz+aI$1PjP`}T8?=`<`N?0Lpm_*w2
zm1Z@8L%hE>M${~r*F!Sf+D&Wg^+m!6Psb-~6G|AOLlbrKH_`_iC$J8s?&ubjo10rR
zQg|(O5PuNt0i5~Dr7w>_
zjYIUN##MKvc-2_l`ZRInwy^MjiXy#&nWkp5Xx}P~&Cs%y=gq_k3)+R_mU6G4u
zRN*9Tw9IyLa?YvbM!U~Z`D13so{@J?+&l6lk~cfHs~RIg9ptRm^^3n>H?K7?r&buEO^+RGJm!ybkc`^ZPAKrZwmnHOgXlzDyulzTUPft(3AFSD$Rk1Ny
z7iV{?*I<96J}e9ItkIK}-gxSvYt(|Da)B34x?G
z);icoxk3}snH!&Pgq>+~Fl?waMvo{HWZeeuFUYO){DEn=J24TlVIkSq_}8zr^
zeayw)Ip&PZs0h>8h11@WW3~*OVe_RL)Ws#T)OyY*
zpJOPu+n{;a@}B0xi?dxCc~Dfef3Ab%`D{#KhORbFClZMhg6Jnqu=&NRrZfZUx_7|2
zv3$Pt;IKm8BX36`=1}C?D-&X-Z%%%8yypOa_~bEF-a}fSLm+L?8vi+%bnd4w-uyj4
z@ZL#6{IdRYe97wyg1F9q-LEG*V({Vf!+FHvtg{s-b4HhdH*PanKM%tFonHcu=iK<^
zAr?zr3*Fq@ej#Xe8}g?j+iA4*M#o`1%F^LxSM8)|p3CQ00bsGd?#17LMQl<)(qES*
z>2!F}+RW+RWFJ4d^-x70kIrPj`uMnGN)Tqs!s%1ykC*rSK`@DRMgxyORGq;F5)|b;
zr;TOeupN(n>L!{qhPx)5;$m^KW#v==$luR8Y|1C8;N0-KT87gj?DM?Z6S|H|ClP1N
zjxR?86fg&q_2#Ell3CX)Q3C)LUc5le&KfQ--pbAk3I0t*VEv#97Ew7f|A%JZ)eQ#HQP%gYVmBQ#BhFpE>
zfw(@mR9CKI+#@_{0m1Ct`lN9cEkKaJ&9
zpEq8i`N%2GG@gkqeJoKu)muL2x}Wq$pHI9ouBonfE;1EXBV$OA_c)tA8e&&sMlVsc
z>#Hb=DP{EYf(zhmettkbT-p+Z_zT>PQYRA;+R3j-Ai#Lt$27{hRFuh=n-@0nT+M5D
zVDHuFpUvA*LX3{6k|~Cq6uD*sd%&`<)x&;r7=Q)Z47Pdx{AIsj7W?u`%0^Ub#J4O>
za7-&Ym+6R;1J1b{+^&zTI=t32lns$Av!NITVe^EIzb*^h|IQ*sN_;bu^er*bYZuL5Hm
zq9;0$vmWN8Zc6Z>B88u9`tor@V4pv3zoztu(fCih1O;U>3{h%VdZ`Bk#T~OG6LJUC
zwyAc!6i%Wf*Qwxx++W>vBh}!Wm3p3tWIEeO)Il2~TsNs=Yn6X~_^YeT7?~1d|k#Ve~$9c)@Y1l~7Y@F9nZ-Q+g!@z{k47Jof{BM1<=6LEZsp^-W&4dIN9BVpU%e4=8n7Q3?IDd)eA^1E0LT4;TttE0Q
zp#&?U%v7%p;nJuhih7;SO8j!uqLy!({La`%i$neLGhPj?0>Y0zC5$7sPxvwkzLhi?wzhnX#Hqk
z(in!8INZ|z%KPoOFppQgc{>grR2%4|Atfz8VL*Ly;LCNa#4KM&PLX=G(b?W-^hQUi
z0?FC4CA~?ezakn#k%kv-ub!4tQl$#KF~q3ERhxyTr}z}1_Kpg{S`22kd5E0TBPUqY
z>2k0X}B-=pdBKCeO7!#sRrBcTfr6{uBC`%fhtdOvD|5vtP`G^s>2d
zywN*YNi05YP2h&eC*nxuk&h9Y`RVBr;*G}el8fiv56Sr#NY;;Qr8&xt9&rfKZ@;O9
z+>58|{~@m?an3%?jFj76@|6CQ@mB3Pv!(ZU&12)u8uD9aM}x_|tqCPz9kq*1MCo7+
zwam;+5LZm@U2$8l-3E9XF7&ah;IAJs>%<(elqd;)6d4wc$g}bqH4ij!crfxNGw#GC
z)qYasQ7>6rVdHFs7WOi7uhV*LP}KO*{=N(>(=Mv8Z%{)fy86tll6XSvOZ#$~HDv+q
zxA;@JWpBbrw5~bb)TwlaR5Zcc;lApEHwf4g&Alhf?H20ZI@m3)qo<_coAJMO$~2Cw
zUttLv1TJO?HCYmNMRV3C>C|+ox;fY7`&F2{i-0IQAnuwexYKS+&^dlo3jA`kuPq<#
z*1qndInx6s&D8hX-DM_i`XWciKFlssGdZp%6P^9wf?w=CI(GRKx_Qo&aG?+%;~0@v
zk8l^|W(M9&j*sUq;7-YWc7`7W<3Ar)uhH=)-Vik=Fw8BoYAjzqSykm?1@HLdfeFh$
zH@#p*Zw%v3W|CjIpa2{IRVCd>oQP8FV6?;fS*aME8XXbAGn4;&yULfNaenz|@IQQ7
zt3rnEQdXJ*abZ+@jHeB=rJ(LAKACy5zg)1G)O=g6dJ)79o!z#Tq9XO?-e`i|6QA?qs|PLnPG%c6vhTB0xC_Z
zHbki^C?bR?QltfeP(!g75KwwY#elRR1PCMqEFjV$^pc?T00}}Mp(fux0Tj72_nYtj
z?tS0;{i&Rsv(MRkul1~FJ!|cXf$XWNDGX*8d)3Xt^5X^9uIg-)p
zpZUM~-QS^FTAlg1fao04TA({roVR7X=Ntv1JNo>(p1&2SH_ZOe-azI&AvHCX$z(DF
z+e|O-wD%ZmB1(N{JMR{G^u+Hn+Pw1(6%&GMhE*%pHWYZzj(2rEpV|Hz9PkG@+4->p
zhb64y-NbRbvf9$b)5(`i`E6m3jP^ht4SIY2gCPuXT{$IueR~Sdn9EZ0@2)Yq}r>(iV%REEqCn
zrnPIeXw^Cb&NiYCE2fewLXaPU%0_KrWyL|*R`9mP5sl^-Jv@Y@96F3V}0=~ugMP#K31t_bCn0i$e59y
zZ}eKcfk3xu3f~Z0oNDkc9b?oMM-*HDkZ(8(uNJlQ9Jr6Bmv=li|4<5*^jKor+^|FK
zaW&}N-+o%b1vf~Rz)1YbS3ODdO$$lbXkA#CZ$l`#uI;*i*@D>gnC#qqfz%>9YAqmt
zjzF8sG7_htyv)rE!jT?n;~AG_lZGqkwa-JLr3-82
z3_%MVUA269+#{PGyGN#g4j~{oxHb3B_kqAt%u#(lJE4`@KA04L;f$L_m7!QAbSdsP-DXh6~9c=%YBV}CLM
z#VD3iazo(={)izHfC3V
zrR{YoV6eYz)(C^AL5mHMG>o&g6{kSsaOd!sV&2
z?8)3*Z|DK`SM`fT-9t?F=GOG69}q$-rf=JD#bjT=MFku<`*GFGGJ`#6OG~uc)%t3$
zT3pdZwth(=Su6zZUeM^iFVQ+zH_tMNTVYxY;AmOcpsP4uN!`(s>#Qg
z^5eWxR4!=VKNFa@=TDr(RtZYj6``1?xi)j8PB>Qkl=5?gM9BkiSShM4IE{%NTD?FH=u
zm2?7io1?|?(ehh|{7-neaUbNUBi1bOUG-I%nc>Eq83RjA@kmzH6U>Z_W=+_Ia^SI2
zZ)1$GY5Gqt(Gv74a?0D1e8tYSdYBt*8Zqk;2(_fO%uTPj*8G5u+xn82lOe5Pc`euJ
z(lI?@ElKwbO*eJN9_B;Okw$eHn>`c>oa%zhO0>hw3^a_*<>YwwB}sK0NoSOMFDDRYWTE3$yHf$-Q0Q{tS`2^HMH#tG?oi
zq5NH+fV0n8gR>ZWkPnN&8dJHBg$}(ehN(;L!N}QNp-GmkVY;eeynXJ?tLNk6iZCw6ND@!(npiNlF4L1CjXT7|3W6WM=c|h!~8hd
z*@Wix0N9+SFo#k7^}@AsC)9n2_qx-jKBhnxu`
zIA^3QD>H9q_c#&;L{cG|)WC>cL+dGu1C+!U3r2j+Lu0of1V?_
z)F$MT&B>J$Z!?Wkl@9~NyiSJ}CG21C6M__n2(pEpe2;9`t`Fath*~qx?JcqCcz->w
zHEOyWz&azHA@ptU%{`u|ugB@FAD_kqo2TU!ThBCgrscTO<)%2nNldzCxOM7!%Vxs5
zRQXdIMqk(89}YH+?=s_O8CNEh!_NbO$LI+Hw&ng=kgv_^(`y5r1DaRI2?)rUd%{G_N
zjP#a3wsEy0o}j1EJfkQvvg5ZUpJD-pT^KR0cji+o4c#H-z8#^}O<$2QR?wXDGsrFf
zzncLTtsvGxV2z$T_yh%wNl#fim!z4yN9G)jX3YiAY+q|HdEU$H`)J5?%)QdV8kj{
z4U2kH)j<`prVpBfJTQ@@oVavn70%?OX)2Hf#)2JYaL|$X?UR1Pmvog_UvO{{N=HN<2?&x&>Cw|Kyse67SKz(WA
zg4li=NUs<9{_pM1aE_oDt%;
z?<@qp9Z-Hna<%p&vi46FgKsN!*T>FO#L7tODFaGN8DzA}%YA2_Z~A?~QR=;)kA^o(
zQFc1%YQrZ1140knd@niLo-;T*Kx5t(01fYW?Nhdi_i%Th2DXvAn)=5$(MCVklHIH4v*vS`2xUsl!G_RO
z5u#Lr_ae<>I3J8B0)iXO=}M5&X^-C@yIJqCyr77kAvbh~rrJcVB+~7Yqx4f0lPS|m
z@*ZY6&^Um(>P|}P2tQl2KuE>!o2L^1lM$e+g__OSSg+BHKwRqhEE5`yVRn2#&g7wj
z4_{D=JhdFo?0aN|6SkqMCd+lien$NMO{$Sp#Oc0L8D>!5Z_#?(9Ybz>{pl%VZl
z)s$YDG2tOzWx`Le@lDwBlXrr6jP?sgyB{ywcn)eP@7v9&Bmoz_q=-qZkC
zE{dQzVv(W~pZ_9EW^g>ReS)e=@|fV!29eFGN}g$&8MLUg8u*S|xZtv`CxcwG^juWE
z3yR&=r{#?p|*#XKH>fGWQQ{Wcl0-Jz6QQh#-S7UW@I(MUve;6qCKmrrRHowKKZI
zR5q%8Y!b%okUmqyAF(j6S-g3DWiF5GXmQPcSM*cMZ!adp$EcmEXN(ACFM18U&vT^a
zNV~Oc$cS!0fz)N|KMqAB_c$`&&ThAv&@8?gLLtaj%p{Qm>*CJIO>OKXD5K2ce7ZY2
zW|J5dFFP0b6SEPt5Uc&{%Z@VU?Wi9d`m1B{
zCu`b74z9&L*%VXc{AQ7OlZ4g<-}lpQNblxT_kG0n*NZbNQ|m|I!fC^cyGe?7&7J7N
z@fDdBX^N-&;^GPq9b!vd{KhohJn5+=v~sTGU>mOw=l|g+*8VDoVE`C
zNOJ!lMXR*ujSY{}s1*qs>FPlro(gcOIO00bQbW=~!GR4Sl7uCE?Gc}+s5$_37gNQn
zrdMM87)uD=T9C~|fq-c-cYKp`g!X(1Bg{9xMnjMS@|TOw<*Di!!oU&=`MWt_zFp^M
zR36uPg22n_z^)z;M{MShyApxzhimT&xiq6Ro)+o7}FvS{M1JD{Jcf-S?s
z!a4+xCM+HN@!J?k4#X-Il|JMIcnS?c!@BE1=2*skbFvAR#Uj<3lmCx<&CA?SF^w_gtw+ZXK9F%6e
z6Z^Z`-Alh{(OfUOj6KF}ah}po
z3E!@vBRq!pU%K6KJzl%*?yE^bj4P|HPnL>-A|86-51Z$0)`FRc+Dj?^b+zt`O6{+S
z60qA=YYJYQPpR{O@PCDsSZ=7G7X+eb>3%8@4SXkkM%wuknS?&eIq;1!0@))V4xFK?
z%%lreORtm#%4%G8c2D6CQBKUhDpgLmDhJRTAH#0mTM)4&;+!yv3$nTE>BDinX5M)JwLJw8alzOfJkePl1zVB1_O4il<1)AxZqmxBQmTyODiN(~U*LBiG*
zps)8=qj0=kgZ+^9p=Y
z(lNwWuRiD3cu7tn@M}*%0-Qxl{F&?iX|4zD-aKH5uHJXAQYrv3gTLKB99UIuMM7U0
zd*B767-`wFRaxJqw!aRGF{Ihqx|(dfRlaRD+$_)>^!yj6*s+e`9AoMA(c6bht~vxc
zCt2=j%uVFGK&)xHdY)9k8qZ=L2<&}cB+ebk0qC3q-n=T%XBL?2;-gE3^2)9m&9a0~
z&X!cWYTC>mSk)&fQ0~3=zSXZ6O=5O6o-ewoiaGL|>y9+^gY3`4nw8$<2Byo!xZyp_
z6eY`0pXQNV`(z__TU))f$SF<9BtK53HNph#kpl>)^Fkvg5m8ao9sMf(0yjV&@~c04
zkKLy%J9`?0y#jrLr5SUVJG1994G#lFrr>&@$aD_nDKgE^U7ipMiQoISLB^DDke&^_dXkkz6`Tri^gn30Z0lv-Udk!ZuR?)W7QYT`X+3W}J&SIJ|Q
z=7pZ}2tfShq@qOJd!C5Jdy*w!2fi*jSm6!s_NwnAMNFp5+8b>Dus-Pjp^5BF%VliK
zDlOB=DwziLHaTy|Rk^xy*OZS-J15~Y$?0D1bXp|b-Li|`x}}ad7~^>iqv!Tso)NiGw7rTZkMqAvrM@1nPe09l4kP;D`aLU@CYqE_&_c?^
zjGfckLeg5P2&+Uly9t`zD^zf@r~4c&-`833H*|HphMZjBT!OyVW!jjZPaWtrz33)x
z*i)8}XWKwn_W9EqpmYZ#x^1+&>+6Pud4@0uKwjx~UDMUpb{L4ab<2#iH!bENd+){tIsD=zC!oLu7YVAI(ZJx!*vLqSiX->GT1Qyn
zP;-Weh+-&e1F+2sD(;XDUF}Rav2%_A_D1LD=6z3v7HsZ{kbPG^r$y&KjGisE9N4@d
zON7B{0V?A;AQA~q`UL{4j&8#K_wp6gux&X
z$MbbC803LL^+KC5RI&*;sHn&tP&nvv
zT-S#6^vS9^uCmAAiAQLt~DfO@CN&MZ*TzW=V|U}ZQ38L8|L9h8}{VBHqg}(CIWpbIv(6o
zn|Dj#aPnPiW^2vuU&m}IloHFV2nEfBba|t#bEA2WkKUImWEN@MEJ4*kcM(ex
z?I5m#9oYb&qJ}}8Ess{}Db57LH%-PyV57nV=Sq{}tMft6z8fYy#_V}3nKVhA@#jd^Buw(TEsdJ$|ABM^XwLo*}m+2hW}dmkaaqozLHpwacw+O|ub_1M9Uj(j_Ww
zbw%t&3S|l6XzS*Vwz>Rgwm6g6<6;PcL-##&KX@IGMFW$yc^~CPOpy29jps80@}DXy
zDv`4a5gP2scb$df93mrjCG2SuZ(&?}g|f7?bY1VtvKMGq@wBn?cxxP>J)-bguTja|
zUM;Wag7MRIpVNdy<7|%3n58&7rohw1?Jbr2cm&7TqOiXcJ@Kpz*S+M9uP`&UH5S6E
zZW7m7B8tp}cd?|?&519>HJwH$ni$VKy~5HhyncytmYRAS@bIh=rd4?@vPYIeP;N&_
zia8hd)>hg&Jk_b(F;ghxZQbDY3s}y2yyfia!Q^Jf$A6yc{alu`-V3L%Pv5E+T;ii_
zaZc8*YWAj3@UvD6S*f!3JCkiMfY1TW+VDhY%H_fMbNkGeo0~-XqaLovZC3TwnL;I%GFfOb
z%un@4F9HzOsH%?XC%9i+$hFx
zuJr=!4;PAxJF@?9%zdCgHAYazhaf$kn#RY*#qQAcM$wP6t5+<(Fd)$$j_M_VWpQp#
zO536GRc$h-=?}QSrLlI28c{TRa$06pz7J0ajDZBjjNDQsFCcikUAas(cqiAaiz)~9
z^H0!z_5}*r^2UlHw;|d&{R0%a*^O6WH{wo01^_Ha*&a;4IZQL<;eFd2SG=2|iz~An&=^Nhox49ot?MC^WXjx>f+A
zTEAdlp#rZP$OSGODiMUCgy!ugR7eJU+P+|Xq2f6hWr3N8Y71clAUFG^B)TMI{AV~emLXINj)UBAky=Kfq?7iV3D@7R(MhP+1jBT4P{FEfH4hxA;`K5JrwJ
zHcrWTIB7?x?)J10^GwTY7A#IW<+#KU+VneJj!}lvWd%h
zEW|ud%$6i0NOK7<2pU^+84=Y+Mimw=ZZ8VnoV1uXdgSuNlX0IeT|KRQz*?1hQit=z
z3(@8}D;Tbl_j(Qt=J?`Z+%RZBkvzmDaHps7n)IAEql!{?<#lk!+v_S>pNwqyq}z>}
zj;y>!Fh7EvXK;8twUqJF4WoMUR$k}LM*98tMIYm10VH9OZ
zxpK;9FSRxlR}H+^