From 704a3a87252a456ce34bc8242c86ddec26dbdb1c Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 21 Jan 2021 21:30:59 +0200 Subject: [PATCH 01/39] add info about network boundary https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8880 --- .../md-app-guard-overview.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 98150e0f15..0c47055df2 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -52,3 +52,4 @@ Application Guard has been created to target several types of devices: | [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | | [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| +|[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](https://docs.microsoft.com/en-us/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| From 963bbb8f93de94590c0ed5948d0a965dd92d304e Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 25 Jan 2021 21:09:14 +0500 Subject: [PATCH 02/39] Update TOC.md --- windows/security/threat-protection/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index af35c57f47..122083cfeb 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -114,6 +114,7 @@ ##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) ##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md) ##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) +##### [Troubleshoot exploit protection mitigations](microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md) ##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md ) #### [Network protection]() From 7d9fbb1011a636246f5b8ee1eeda47b309177d71 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 26 Jan 2021 17:28:49 +0500 Subject: [PATCH 03/39] Update network-protection.md --- .../microsoft-defender-atp/network-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 7fd98bd981..0cf3df8758 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -45,7 +45,7 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network ## Requirements -Network protection requires Windows 10 Pro, Enterprise E3, E5, and Microsoft Defender AV real-time protection. +Network protection requires Windows 10 Pro or Enterprise, and Microsoft Defender AV real-time protection. Windows 10 version | Microsoft Defender Antivirus -|- From 930fc4dc29b48afbc9db8b7dc0d2a7c8eb9cd62b Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 26 Jan 2021 17:32:17 +0500 Subject: [PATCH 04/39] Update troubleshoot-np.md --- .../threat-protection/microsoft-defender-atp/troubleshoot-np.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index 4bfdccfe50..82fcbb7ca7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -45,7 +45,7 @@ There are four steps to troubleshooting these problems: Network protection will only work on devices with the following conditions: >[!div class="checklist"] -> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update). +> * Endpoints are running Windows 10 Pro or Enterprise edition, version 1709 or higher. > * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). > * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled. > * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled. From 66e207e995f7d51a6d0f8f2e0301d2c609cfc185 Mon Sep 17 00:00:00 2001 From: Peter Lewis Date: Tue, 26 Jan 2021 17:28:04 +0000 Subject: [PATCH 05/39] fix title fix title which omitted full wording (replace "Set up Microsoft c for macOS device groups in Jamf Pro" with "Set up Microsoft Defender for Endpoint for macOS device groups in Jamf Pro") --- .../microsoft-defender-atp/mac-jamfpro-device-groups.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-device-groups.md b/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-device-groups.md index 3b011e3606..73dc882a2c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-device-groups.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-jamfpro-device-groups.md @@ -20,7 +20,7 @@ ms.topic: conceptual ms.technology: mde --- -# Set up Microsoft c for macOS device groups in Jamf Pro +# Set up Microsoft Defender for Endpoint for macOS device groups in Jamf Pro [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] From 2b73b1d9c583dce0361b9cf4c9f953519d6b4f79 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:00:16 -0800 Subject: [PATCH 06/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 217c0ca4ff..9c411725bb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -31,7 +31,9 @@ ms.custom: FPFN - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) -In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include: +In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution. + +If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include: 1. [Reviewing and classifying alerts](#part-1-review-and-classify-alerts) 2. [Reviewing remediation actions that were taken](#part-2-review-remediation-actions) @@ -40,8 +42,8 @@ In endpoint protection, a false positive is an entity, such as a file or a proce 5. [Reviewing and adjusting your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings) 6. [Getting help if you still have issues with false positives/negatives](#still-need-help) -> [!IMPORTANT] -> This article is intended for security operators and administrators. +> [!NOTE] +> This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md). ## Part 1: Review and classify alerts From 17d43cfd5707c0b32a5c96b5370503a93beed655 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:10:26 -0800 Subject: [PATCH 07/39] Update network-protection.md --- .../microsoft-defender-atp/network-protection.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 0cf3df8758..2a2ebcab64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -45,13 +45,13 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network ## Requirements -Network protection requires Windows 10 Pro or Enterprise, and Microsoft Defender AV real-time protection. +Network protection requires Windows 10 Pro or Enterprise, and Microsoft Defender Antivirus real-time protection. -Windows 10 version | Microsoft Defender Antivirus --|- -Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled +| Windows 10 version | Microsoft Defender Antivirus | +|:---|:---| +| Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled | -After you have enabled the services, you may need to configure your network or firewall to allow the connections between the services and your endpoints. +After you have enabled the services, you might need to configure your network or firewall to allow the connections between the services and your endpoints. - .smartscreen.microsoft.com - .smartscreen-prod.microsoft.com From 8bfa5fd4bf9e6d15aea12d0cd09f0628b01bac3a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:14:51 -0800 Subject: [PATCH 08/39] Update troubleshoot-np.md --- .../microsoft-defender-atp/troubleshoot-np.md | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index 82fcbb7ca7..79cdbc3b60 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium audience: ITPro author: dansimp ms.author: dansimp -ms.date: 03/27/2019 +ms.date: 01/26/2021 ms.reviewer: manager: dansimp ms.technology: mde @@ -24,14 +24,13 @@ ms.technology: mde **Applies to:** -* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - -* IT administrators +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +- IT administrators When you use [Network protection](network-protection.md) you may encounter issues, such as: -* Network protection blocks a website that is safe (false positive) -* Network protection fails to block a suspicious or known malicious website (false negative) +- Network protection blocks a website that is safe (false positive) +- Network protection fails to block a suspicious or known malicious website (false negative) There are four steps to troubleshooting these problems: @@ -45,11 +44,11 @@ There are four steps to troubleshooting these problems: Network protection will only work on devices with the following conditions: >[!div class="checklist"] -> * Endpoints are running Windows 10 Pro or Enterprise edition, version 1709 or higher. -> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). -> * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled. -> * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled. -> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**). +> - Endpoints are running Windows 10 Pro or Enterprise edition, version 1709 or higher. +> - Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [See what happens when you are using a non-Microsoft antivirus solution](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). +> - [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled. +> - [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled. +> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**). ## Use audit mode @@ -61,9 +60,9 @@ You can enable network protection in audit mode and then visit a website that we Set-MpPreference -EnableNetworkProtection AuditMode ``` -1. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block). +2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block). -1. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**. +3. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**. If network protection is not blocking a connection that you are expecting it should block, enable the feature. @@ -75,6 +74,8 @@ You can enable network protection in audit mode and then visit a website that we If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md). +See [Address false positives/negatives in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives). + ## Exclude website from network protection scope To allow the website that is being blocked (false positive), add its URL to the [list of trusted sites](https://blogs.msdn.microsoft.com/asiatech/2014/08/19/how-to-add-web-sites-to-trusted-sites-via-gpo-from-dc-installed-ie10-or-higher-ie-version/). Web resources from this list bypass the network protection check. @@ -89,16 +90,17 @@ When you report a problem with network protection, you are asked to collect and cd c:\program files\windows defender ``` -1. Run this command to generate the diagnostic logs: +2. Run this command to generate the diagnostic logs: ```PowerShell mpcmdrun -getfiles ``` -1. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. +3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. ## Related topics -* [Network protection](network-protection.md) -* [Evaluate network protection](evaluate-network-protection.md) -* [Enable network protection](enable-network-protection.md) +- [Network protection](network-protection.md) +- [Evaluate network protection](evaluate-network-protection.md) +- [Enable network protection](enable-network-protection.md) +- [Address false positives/negatives in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives) From 1bf91a1fd859e054e58303a537815bb4cfbe4c00 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:15:51 -0800 Subject: [PATCH 09/39] Update network-protection.md --- .../microsoft-defender-atp/network-protection.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 2a2ebcab64..29ed5acfbf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -79,11 +79,11 @@ You can review the Windows event log to see events that are created when network 3. This will create a custom view that filters to only show the following events related to network protection: - Event ID | Description - -|- - 5007 | Event when settings are changed - 1125 | Event when network protection fires in audit mode - 1126 | Event when network protection fires in block mode + | Event ID | Description | + |:---|:---| + | 5007 | Event when settings are changed | + | 1125 | Event when network protection fires in audit mode | + | 1126 | Event when network protection fires in block mode | ## Related articles From e2f432e0a8799480ccf021609a4e9d178d294237 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:28:01 -0800 Subject: [PATCH 10/39] Update md-app-guard-overview.md --- .../md-app-guard-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 0c47055df2..576fd34c27 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 12/17/2020 +ms.date: 01/27/2021 ms.reviewer: manager: dansimp ms.custom: asr From e6fb1e9cee0ae3f6ba9216514805cddc6a1c70f6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 12:28:24 -0800 Subject: [PATCH 11/39] Update md-app-guard-overview.md --- .../md-app-guard-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 576fd34c27..1187818d92 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -52,4 +52,4 @@ Application Guard has been created to target several types of devices: | [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | | [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| -|[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](https://docs.microsoft.com/en-us/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| +|[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| From 2cbc3d3d36c30cbefa068412a6d603e077350e91 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 26 Jan 2021 13:00:19 -0800 Subject: [PATCH 12/39] Update customize-windows-10-start-screens-by-using-group-policy.md --- .../customize-windows-10-start-screens-by-using-group-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 3cd4ad2b71..ebadfd9803 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -1,5 +1,5 @@ --- -title: Customize Windows 10 Start and tasbkar with Group Policy (Windows 10) +title: Customize Windows 10 Start and taskbar with Group Policy (Windows 10) description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. ms.assetid: F4A47B36-F1EF-41CD-9CBA-04C83E960545 ms.reviewer: From 8128755e7ef4ff40de3ec3af2895bcdd7ec59206 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 13:08:23 -0800 Subject: [PATCH 13/39] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 39 ++++++++++++++++--- 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 9c411725bb..d40358edae 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -183,13 +183,40 @@ To specify entities as exclusions for Microsoft Defender for Endpoint, you can c - [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) - [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) -You can create indicators for files, IP addresses, URLs, domains, and certificates, as described in the following table: +You can create indicators for files, IP addresses, URLs, domains, and certificates, as described in the following sections: -| Indicator type and considerations | Prerequisites | -|:----|:----| -|**[Create an indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file)**

Helps prevent suspected malware (or potentially malicious files) from being downloaded from the web. Files can include portable executable (PE) files, such as `.exe` and `.dll` files.

The allow or block function cannot be done on a file if the file's classification exists on the device's cache prior to the allow or block action. Trusted, signed files are treated differently. Defender for Endpoint is optimized to handle malicious files. Trying to block trusted, signed files, can have performance implications.

Typically, file blocks are enforced within a few minutes, but can take upwards of 30 minutes. | Microsoft Defender Antivirus with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).)

Antimalware client version: 4.18.1901.x or later

Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019

[Block or allow feature is turned on](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features) | -| **[Create an indicator for an IP address, URL, or domain](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain)**

Full URL path blocks can be applied on the domain level and all unencrypted URLs. IP is supported for all three protocols. Only external IPs can be added to the indicator list; indicators cannot be created for internal IPs.

For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge uses [Network Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS). For all other processes, web protection scenarios use Network Protection for inspection and enforcement.

There might be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked.

Only single IP addresses are supported (no CIDR blocks or IP ranges)

Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge)

Encrypted URLS (FQDN only) can be blocked outside of first party browsers (Internet Explorer, Edge) | Network protection in Defender for Endpoint enabled in block mode (See [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection))

Antimalware client version: 4.18.1906.x or later

Devices are running Windows 10, version 1709 or later

Custom network indicators are turned on in the Microsoft Defender Security Center (See [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features).) | -| **[Create an indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates)**

`.CER` or `.PEM` file extensions are supported. A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine Trusted Root Certification Authorities).

The children or parent of the allow/block certificate IOCs are not included in the allow/block IoC functionality, only leaf certificates are supported.

Microsoft signed certificates cannot be blocked.

It can take up to 3 hours to create and remove a certificate IoC. | Microsoft Defender Antivirus with cloud-based protection is enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).)

Antimalware client version: 4.18.1901.x or later

Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019

Virus and threat protection definitions are up to date | +#### Indicators for files + +When you [create an "allow" indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file), it helps prevent files that your organization is using from being blocked. Files can include portable executable (PE) files, such as `.exe` and `.dll` files. + +Before you create indicators for files, make sure the following requirements are met: +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) +- Antimalware client version is 4.18.1901.x or later +- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 +- The [Block or allow feature is turned on](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features) + +#### Indicators for IP addresses, URLs, or domains + +When you [create an "allow" indicator for an IP address, URL, or domain](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain), it helps prevent the sites or IP addresses your organization uses from being blocked. + +Before you create indicators for IP addresses, URLs, or domains, make sure the following requirements are met: +- Network protection in Defender for Endpoint is enabled in block mode (See [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection)) +- Antimalware client version is 4.18.1906.x or later +- Devices are running Windows 10, version 1709, or later + +Custom network indicators are turned on in the Microsoft Defender Security Center (See [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features).) + +#### Indicators for application certificates + +When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates)**, it helps prevent applications, such as internally developed applications, that you organization uses from being blocked. + +`.CER` or `.PEM` file extensions are supported. A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine Trusted Root Certification Authorities). + +Before you create indicators for application certificates, make sure the following requirements are met: +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) +- Antimalware client version is 4.18.1901.x or later +- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 +- Virus and threat protection definitions are up to date > [!TIP] > When you create indicators, you can define them one by one or import multiple items at once. Keep in mind there's a limit of 15,000 indicators you can have in a single tenant. And, you might need to gather certain details first, such as file hash information. Make sure to review the prerequisites before you [create indicators](manage-indicators.md). From 9462c60ab32a5b72766646a6d88d2259a6688024 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 13:12:57 -0800 Subject: [PATCH 14/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index d40358edae..a055c2e2f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -208,9 +208,7 @@ Custom network indicators are turned on in the Microsoft Defender Security Cente #### Indicators for application certificates -When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates)**, it helps prevent applications, such as internally developed applications, that you organization uses from being blocked. - -`.CER` or `.PEM` file extensions are supported. A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine Trusted Root Certification Authorities). +When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates)**, it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported. Before you create indicators for application certificates, make sure the following requirements are met: - Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) From 474099df034bf4f0f31aa59f9e6095a7d3208864 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 13:14:30 -0800 Subject: [PATCH 15/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index a055c2e2f7..f327f3bbc5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -329,7 +329,7 @@ We recommend using Microsoft Endpoint Manager to edit or set PUA protection sett [Automated investigation and remediation](automated-investigations.md) (AIR) capabilities are designed to examine alerts and take immediate action to resolve breaches. As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. -Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization, as well as other security settings, remediation actions are taken on artifacts deemed Malicious or Suspicious. Remediation actions can occur automatically, or only upon approval by your security operations team. +Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization and other security settings, remediation actions are taken on artifacts deemed Malicious or Suspicious. Remediation actions can occur automatically, or only upon approval by your security operations team. - [Learn more about automation levels](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels); and then - [Configure AIR capabilities in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation). From 2c8970880b66249c95bf2beea131184d0857517f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 13:19:51 -0800 Subject: [PATCH 16/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index f327f3bbc5..f32e43f1a9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -183,7 +183,10 @@ To specify entities as exclusions for Microsoft Defender for Endpoint, you can c - [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) - [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) -You can create indicators for files, IP addresses, URLs, domains, and certificates, as described in the following sections: +You can create indicators for: +- [Files](#indicators-for-files) +- [IP addresses, URLs, and domains](#indicators-for-ip-addresses-urls-or-domains) +- [Application certificates](#indicators-for-application-certificates) #### Indicators for files From d572315a16f509b1a726b333916bf1bd4ef6f822 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 13:21:16 -0800 Subject: [PATCH 17/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index f32e43f1a9..89da6e7ecf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -211,7 +211,7 @@ Custom network indicators are turned on in the Microsoft Defender Security Cente #### Indicators for application certificates -When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates)**, it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported. +When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates), it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported. Before you create indicators for application certificates, make sure the following requirements are met: - Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) From 76d679eb5918639eca7dc1cde370ef7ae0d35f22 Mon Sep 17 00:00:00 2001 From: Samantha Robertson Date: Tue, 26 Jan 2021 14:54:57 -0800 Subject: [PATCH 18/39] Adding art for false positive/negatives for Denise --- ...fender-endpoint-false-positives-negatives.md | 8 ++++++++ .../images/false-positives-indicators.png | Bin 0 -> 14102 bytes .../images/false-positives-overview.png | Bin 0 -> 27939 bytes .../images/false-positives-step-diagram.png | Bin 0 -> 19014 bytes 4 files changed, 8 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/false-positives-indicators.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/false-positives-overview.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/false-positives-step-diagram.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 89da6e7ecf..43eebf368e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -33,8 +33,13 @@ ms.custom: FPFN In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution. +![Definition of false positive and negatives in Windows Defender for Endpoints](images/false-positives-overview.png) + If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include: +![Steps to address false positives and negatives](images/false-positives-step-diagram.png) + + 1. [Reviewing and classifying alerts](#part-1-review-and-classify-alerts) 2. [Reviewing remediation actions that were taken](#part-2-review-remediation-actions) 3. [Reviewing and defining exclusions](#part-3-review-or-define-exclusions) @@ -184,10 +189,13 @@ To specify entities as exclusions for Microsoft Defender for Endpoint, you can c - [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) You can create indicators for: + - [Files](#indicators-for-files) - [IP addresses, URLs, and domains](#indicators-for-ip-addresses-urls-or-domains) - [Application certificates](#indicators-for-application-certificates) +![Indicator types diagram](images/false-positives-indicators.png) + #### Indicators for files When you [create an "allow" indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file), it helps prevent files that your organization is using from being blocked. Files can include portable executable (PE) files, such as `.exe` and `.dll` files. diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..733db3cb46935defdc17fb312d25c927ea95f178 GIT binary patch literal 14102 zcmc(`X*^q7^fw+{)zZ=lEk%dhDvAzTHAQvOQq(-vaI0FOi7_H1p70g38aFzxVoC@atzg;+>Rp9_D;me|`FrW+r?>LgmH*XykCF*qu`yjaM?S zr+#cd+Guv+wuFk$+AF@eUZTb1^}Duh*WELBj_x@jt2Z3-CcNHwguJt0tUZt}G!mM! zDjnqnzni)%4e2%^izbhp7fKz=N(cE=QBhZ9xfSlUE#_J2?)&=NCsSrIa-!nZPBGy2 z<>P;Cx2XB~-f;<0dE)B-uQz{~`HZ|1Y?8@?DB?Iayoj~Q?`>x@gcB1?K5T1jdd&vO z*uq$Dk-lZ8-xP`Cy)V5lHhPtgDWyNdQENA)mHAwYKkho>PVk2 z2p#oedkQ?X*VovaD;SKF=z1p3HoUjw%S2$_E!rlRu8nM(SNedL?AkNEmsV9MUi z+Kg_CZbB!h001#>hU~;P9|jY*gqKX~ofS*8HW$ui=gErR^HZ&GPE-I+d}eB|&mW&0 zoOa*rPGRPB13xWRn@6wE+Wqv4Almbs0ys=H`p0x2v<0Mem@#Y$)XClII6W|g!~&}ZBuuq{+Ziv`7Q#B~~P{VHfibL#HOkx=U6gzvmm+x#g%a5Ua&0&A97| zO5FL7LgUrXHTQ(yS2U9so)Y1W^{=w&(R~dGYF-GxsQY7ns-4-4FF@jIvfR6Sf9AxG zTdh4wj>}oywQYUPD6N4Tj~Gids^psO?wD-;>+bV^6^r+{1);erlC^JHPdtQ|cUno?kc39_;SO-BEm^ zP8J^z41Z$VGoSB5?v1y|3eRmfU+B#RAZHg1&RwRS7pe%q4?-#m!;j@d+t{rDlVT>E z`nOm4X)qr$GB$J{s{jq~Keu*imbN#8@g}~nCMtzNrm~@J!UJ4Fg}Z{N%}&*JVgz@R z{jr{e`(>YJUzjz;3NZj2nRCDSqwkj}>#QAF(j8L?`2L0?5(W6}jc(Z3(REnk zkCLWL%a-5`Px?Z4D*~pU8+K(ahZFBG2J@utrA#d(Dn8~V^xSto(yhid<24BiqnpVc zqMnv^(rhM9wG*4LzP;eDBR&-HPBeEFO1@)_x8S<=A$+>YEdU z0^AI&f}9Ieln2{4dJk;{u_jot3&V!A)n^&K`e#MXtLlb(Y>Lj8LNI>a*d@~K+zta- zg7{6Tm++o4qF_g|^bujMum#2IdeZPC0+@W%r~0pVYi!iRQTqIFiqwy#hZ$Z->xw`|B4sIM@dX%vZZE8acXhi zlB2TM*G%hqQG4iT60{k-*NMUF?T0?LUAe?Ap!_Wt?vr0O^Buoy>3x4qOnM~ug2bCx zUq*G`LBW>(3eg#`IF7F|ZTwlUUGxl7`>OAw!FVXC-;4z51U08qv%=5srVNAC*A#Dm!r}_N}ayUpu9lIdGoqZItx8 zu-OIK>Jv2Ln=AbwTgO<>W7L`>BWBu6TYfm~%4~H7!~UvSI2V+p{pX@U_vT=-6}z!h zw_^jY5x5F#?Eju&n#K<> zoS}NV|EY?I{BdzL6ivM#x&m;?F#|qGXzh)wGyQ;M$j3-pZOf zaOs7W71!wlGQV-FMGnRbo)o17_v zLwV$-!KPJqvA;0#YI*!KY6*;&D>85!{ zY-v~VOIK2_B5}R7S5>|PHbdkbGqtgxaPn`VGdO4Iq-(t^L#Jm7V|RhE^UodgIqVel z#dwB-rP*9#>W7E*yHBks}ryD+;b!`K^3x>O)Ub#QjNmjI=6^A-ACU&Xk zoaNow($!RZ_`<8rUlibOi6K8+^_2V|n+lW!W|bTtc=2&V)opLguhsoRin4be4$v#x9=!ahj3TVJZ)=efJZ(p8XPH9?F^OPZPz`hg-cI!)A5O!NbjnP8_@PE&WoI%9@o*5$Gk(C^)TNu3m3s{?bkjKGc`^9e?MMz^o32tD`K)C4KD`E<&HKqbPX&^sUbeOcuhmAHz8$f0kEdY1`d4Eqs#baj~=o(730=4u&C*w0Qmy>}sKVXEig`i9W1)^=%`O5Wri*M|gRBE{D^rS?gRcUmU zvS3Q-!p~*}D7hbXG?-UcJzF(nhc457hjJDxoMElG_1L@R1zw9Zs@Vv@Hie(>L^H?3 zi$?2I-0Egu;8?k*JO=!QOC6UWakDRka-)3=o^JhktVBaVDx}c=U9f>g;Vj5M5!9hv zzC-N--%EHJsf91u``gYXoOyoIq6TE(nat?aN~%jRx6zf~u%ZlWK9Jf0rd`$@gH({s z?C4JIi66dH>^thz02ZJI7q6fD!^|42Y;nlJYBc*xZ`d9Cq#;@9esbsSf4qoHt3Wq0 zzOn31Is2kbxy*nj;+JoR6$<82OuT4AZTRS5K9A=c4LC}mD$^14!->HO z?8?@a(@k!9jHOl91+TqDNlULdW}tz!GmuC2k8Km6c7E@YmtwcVJxPdJ|3g7&i zI=F|_{j&N>mM^vH@;APzZT@LkNG9C@MY`WJ_$zMLAMW_)fcIF5t5Q#;zrq@)R8mwv zc4xWOA&!Ew!ar$h;O@;I?OFRNb$u-U^h;qkqIuovEs#<-XU+wU8vfDqU?s;p(ZcIv zdW_|h zJIsv|`R^rn^Z7318O7+Lm^S%}B(-iSI!sv{bnw z?~#>!^f!A?R<$#cKfqdr(Hl+|3k&!Iis6Lyv)cCLzDP>VnczRH6@Pr{%|LT-lUs5+ zVbaZM zopt|^5Zj$bM?L&XTjXLDh<@&U%ZNUP7r!s#6dn4C!7WWSy>=-RV9NF>)ta~jyj@cm zcDGIXdrMda;5H?$Mc5kFye@4^@zJX1f4KzJ2>u5<)5>Nx_s7QpDPpA(6tVch!fr$i z4*X2k0_nwk&Rw2J-=}S^?tJEqV>>>+Up;HEB1I1pRsJ_}rhI0A(_lH~4UO0;2FZYL zyPKWSx$E)%i+IvVWIBd~NeWguQ2Qop83~KNJ3OqTI&d}1>j&O@t-+FF_sqgpzEn#| zY6n?KwW}g~ak8g24R!*wNZC1lbGLJi&RSz~!x3dGCM>2%FO@)5&kXreg#2AIFPkp$ z^U&osCpxAXdz0C7j@dk*C@p)7r1bB)bqcq8kC9=tC2SWILfUbW&1fXdxhu}-q2mO0 z5_v3Fw7TarvUvr~H*L_F=Dc(-k=45a=}ck{tdbTuqe;UTZW}^!pCa)1?+U<&mQ~go zo!k@dwpNC6R(fDSNz(0j zeu0gL!+!jpG(T6u9Bn6?iZFtX%w_&m)9J>Ql@O9WS}hbakoP~-xjZTyzJCZtXI9Hi zU7C;L?H%oknn~=~F&ZCM*m+1vQEKZoSh1GyGC^q(d&=e-9qd1xbVF8d-pR)KXX%{7 zdS~dyaN_J91(FyztFE%vM6K6pFIBUqkrUMNJN<5%iefN9M={wj54l+HI9O3=wcXy* zvk1j2jE>JwufM{5LrN8uC1T*|H)9ZJn8~G(F?IOfJ}A#4Rzp`bTSsV{{Lr@?&(PJ! zj4EdN?7n*BR))^_@;f%aV*gqpb?N;wuhJ3h!gj=Ip0hh3#aKGFGL+wYGuYC&xUp&R zele$yQGvRTYk04;e60>V65ot_)Zh@FMUux08s5qL20B*-!>zP^Ag;^WQ2O8iAOHB7 zR#BbB$-3jv1vEQWzfNZ$R)Bc72`R~+%M$hQA}q&n%z)-+W*lgxnCuT-J;d7V4X)%? zUh1TSOAkWNuo?%}Ocd}0I!+EnhnVQ7)yVOIq{+_@)Ae)<_j&JBIJ};CZfCH5W<*98 z!u(|Tf!pzhZ7={Qv`W-r1)*lp6t{G4=#Pp{!$A}9pwH;ibx#;+8S){xTA}+x(z(9R z4GM#tV^-Yb?1z+ETZ-UZ_`sQ^>ep^WodW0xX!Dr9UXo#RGLqNdH|xHDGILs3g+6ZY zGn;w#Smk*`^do1&jWTgdR(Q0h{C+~NvfxEYehAuk%?nJE#VyVSI-Xj*#v*K#9zyhv zOI!l}ObZpmq+FA${J>nW*CuKId$Ov?89qx}s6ARJ0uU~ARL(~B>Q_CQNc#}d?0d_( z8uP{G#Fdmv(oJiUMb-`|@3~&@@wgH_Ml<%oW3%URp{92amsIwmdX1Nk{HeZpE@(w1 z>0_WrD)-vw$_v7gYtp0=0glDR@cYT9p(z>zqf3<_N~p3&>f}2Yov!^SX6`qBdJ{G% zvhfrOJ(!+|m6q1Wp{mYE&_eC?H31}LfCJpO<>enxZ%5u64iuC^emB1VfMO@KZ zrT?ZCU#u*vGgi3*Il0_E%l7k>B)C1wSXlpI4*WbgpDuT<7|Oen94PZs>q_^OT7^58 zIlcA>)$USqCG_mH%+cIC7SwWh+&@de0L|wn7OCzpJZu?q9wp6*^5t6dl_GSl-5gS+ zGh*G*0hES&L3nv8YnhkN79gl_+W@O&_}o6{d%s#4`?J2kbcg5Q?xo#?FA*|Nb|RI; zvcg2}Lg1FLLD5FHI`GIdhMDuq>(CiIz(@M3v7zlkE&zDyq7AU|z1mOf3100+SEMMy zF%;;H31}($AMU=f9mV?erEKFX7-4fcBuW#5Kne%Z{efJ~rsb?KtPo%!q1@csU z;>Xsr@Qul56WsHdR8_hAZ<8T2!ZP0y#0xUVQv4Z&R_TFX1-D)Lcy*}C$DD-#8U)0< zY)(fk+~!=a3q>nxTugl8;qGj81omaw?iIqd2+aPhVx=4U!%NoAJrFb!j7wdwb{nG- z=rt8q@M`&mQM~@buj)sO?w&^M$@)$dt00a{_-52Lal&J-kqbA(;+xle#H;uaLb;xH zv+$IAakU<*Htp$|Wx=Tt=`0&cNKMkPp4t>IqElnHd#2oBCZZ=9!#wipT2I>L%gHT? z?u$OSSA7I7BNBCGD(;+UkpZ*(|Z(R@DmacbXdIV>~3jGQ^O zRB6vt(JHFJfHL&dk~LoS*;`(toP8Jk1&#vcMKCT$+b^9-_vo5#=zpK5-i;fM+JB$G zE5HVLI9S>&m?-fC`z+|XP1JnLoW51aQynyeyPg>s^~gL!F?f~?ez}K_NLRXlsJM4e z4019fbx&T;qv6Kw*;@r7M(**AY}=)Doznu(@5AMiOXczp>sEV?oeT8$kTF3Pf)DBOO7MkvX}A-vh&ZA8F!}`Q$BDV@JUk^ zosY|2bkf zWUtWy5kbUTY+zL`uTLch`ZaY&jdA;!#b_W;C^}k;<{oFG_ScMyn2T2}xv;T!i(eS3 zt0#B<5wQbpliBo*Q)a;b{pa7KYX9-oC$7CF*6#c7fxTv%gEzKW>$7%$@!Su5dmtP0 zv?ua+73tE+_cUCf4e3be&*qTbE=VG;Gq5kk252y6QZ&H>lmjJsA@e20pK*0N#W%$6 z25nWNg^%s`mrCaV)G|#a*OVlpesmdg?21Eij8}FS?Ru&PT zkKZ1{#j;278Ma|DPfq+$(-q&4%!WRx?o#9h(ZIOTI%!v_#~NH6b&=LQjEj3tI;+B`-z<;E$%UhKdMW<3+dbjP ze}wMK%lx@QbyMkOcGKF}m^S}PfgBL4F9a{9L*MCJXG#O0)*c>ePIi5NLG@E zjcC;xbmKh%`n7m{dZvbo;7~GdR+c1shSHI1OHW+^0XoDPHHz2Bl1szNhGG#pkmt)^ zUQ>N{hu=jveFtgUYF{pt%X{m&`A*PBP9DvxM3H6s_R-K*vtrrPWnM!6;o1P|aEI3x zpIV$jST1V){;|>-HzJx$J*$~6R4n)|86~oUhx5wRev+qLKcHD68JN-~WSd&TfXfd2 zA!RgLHDZ|>(9#6Tirp%sZ^SP1O{2Z{|Dms|t6Rq+0c7r!+SX;{HXq_87^V(ZaI*p` zZ!3Bsf+Jb(^ekDU-=8G<3Xg7`)P>(}5G>+rX7pJgsa#--QZaGE0!IxK^wBb>jSh6JINFKa@0i5{vK;N-vM?UvJ0Yir* znbLzZ;NpeA75vhoNvp3vP;xoCf%|+J4dLI2M1%zYY5u_Kl1WC$Mv1%Zg|_nM%uO30 z6OVGCgC7Eg!6X%Z(7;xQGvTdj@8=_htT{Q-G^b5O8F|2qh4%i6qw zHHh3lo-o@qhk4eQxK(Mq35-d!XEiMhRh{rat_(0=UFdQV+!3h0Zy{56r1Kjw)VSzR8&qB00VHBXn(*C%A*s~>6! zAXNaj2)MTTs~c6fezt-?S|&%h{9|hsM?_wUL1VfZp!GZXdqj4<`?>1d0h6zg*UVd=P5n^{2a((jWiuO}~^{v%j5lHgUs?rG{zR_#J(Y zckkQ%OB$WUQh@`CYRw4YFSPL2FsFY{aiSY%;G+2`v~OA9zasU}EQWa9D6d*q$SOoL zYrY>Tq+h{ELUC~=i*-U2hEmVaR zE?A93yR5XhPiH?q{8R=Ilh{ixSrmD2`*{daxH@^Q+Muaw(4u0qzkBW_Ai90IgPCYJ zlWMQP|C&I9;KB0Mvd!Ygfr9FGCvP#mbfJL0wRzh)S4YUacxtl(H)hE5P?X}itShN* z>p%qC%`tPnjwh8gs}m4}O1eZ(GM~a?BpEGcZp?veRb?*}R~js7*9As=Qd9-|F zc{^t*Q2-zwoc0pVDuxX|ujGmiU2dvyYC&enX7fZqgposxOR!Wi1LRMYjhqgs+|2AK zygxE}OSo2T-g8(?)X;^^kjWS77!kOYTwbWeFDm_Bl^CiwZJKC-Uh_pQs*s9FdHjW8 zcYn)GA<^Le`8%@-m5ng){B3h%b(5fW%b^p^v5jj@?A*qhjuw2w_?&rQEtG|VFuHQ3 z{#ut_gvV*~y$`AY4jq!5uVOcPBA|<)XZnzTJ)fo#kFs>TjPg9>&b*F|SZOj{9rB@8 zTo;ShsE;PQkG-uV@aLgurrD?n05eDb_59Cxmv;;g4a~OT*X{rXg^DU}BYQn|e{}Co zgqc>Y{(9yay8QQ?)F&5d4smk@TdXFWGiQo$X#K+quur140gq)yei}rw2kzShCA;?C zc+~#z@G0)|6CH8`+Se#SxqwT_f(frMif-SO2%9-i-H=X^*%d&l%x6N#+NM6J3@?jZ zdNO0kYLM!ic|<(t5iLB-YQsCjazp@3TK;+>8o$U>TA`}flgfAg$#|Up&v~frryu{E z6Wg59+qJhJy*bY|`MkJL^R-vyD#N#wkTpAQWr-6t`w@H5h3Rb%n|$K0N&7TJC!~?I%caHK#BUjjr~6z>*Q!I0WP=lo-kK$ESzpVdNF&U_a6FW``zNMO;DZ!Vnk7U zJLP@z-|dG0hxYxyy?JLu7Q9g1}5RvpeGZLh$~YeVJiTJOuZMAg^y%oINeUZJ+;29Y)0OUjHnuc4PH_`Amwg6;)wwmGxxl+m zO+&b$5?r}?!EJ|`+kp17jBXNWt?gwvn|f2YXoSk}jATwnBTZ4dWBVNLs^IKdof(Yf zNY!Gk_;mefPovd~M4i5=Ren+$VQOVAngP9&G0VMiC2!1*z~B|JTURpr+!{Pol@)T( z{9XbVXdgM5i;GaV-eRrygwMbjS*w;BM1S~Ob|9l78QbU4Vr*(`bB~Z5*FS-1Zd-5U z0!2?5%=%DBHQh^fNTuYZ;mss6H3Yi5HrK}xa&eTAu-TQ&#e^O=HMJz$D@__(INx&u z8x_>~{9>5@RM)mK^@JIB7e-k7o3_?yBFEB=tQUYnGUqp0zkt&{K+{9b;Be84t!Rb-p|RkL5rVSqki0swaMM<|L--1x~bLC6Y5^ z;N4$mSRwmY*cql%Es(m}FOKNMf;GU{!I>~tbcHi3bTa@|L1sASjos5Ardn%%BO7sk zoRHgTmnK_e2}ffX#e>i>IHO|W0OLtI+qcek6XZ2tTxN$F;C!edt{`WMlAG*QTQ~j~ zcSK?BdHXWx;XrSnutug!=opD_312`K`n(T&G7$EPx{6BsvTBCN= zZ)&5JFVsGFA6$hn2hw!6FM0+0y`SqsGNUqzojUWy5mI(VT4ip&?skUHk+FL6n;Ke= z!_LkdRW?r5xD^#LOZR$+&BKs`>6>;Z`@-$Qe&y+KGdN`RSed^W@w)dpSM4c|R}AKC zkI|NqR`V{sYL(2~2CdBDgCs zCsk}FizRBA%sjy`T9PRd3De@)ep(Wr?@Yd9Sm3D z9dX#a0eRj3Wq!S)!t-(Ig`c#t?p$@SZvZGd@|`s<*@U$3+J%n*FQac_P8vJ49qUdO z#noF*pg(`Txy1_X#?qlNMNcivS;4Izi5Jo7l=MwP+AZn=^L(@hv1T(Ofn4!7IR4>? zS1mh$$4BMSYlRcWD=)BDZ<%Jzel0AyYe|W1VcPMb98!!I8KRYw(}e-M`;K`n4Tb#U zT9%)+T1BAgHFas zcD!2uccUYOnBQ;5jEVf9){Y9h z0AH&pA9-HirQ^%GxyC3}c2vx*OamX3`;PfaB(H_mT9BOog$OxocnmQ>%xO3eBaR`9 z(hyLssErqt;Z%Z`=Fp=(yUPRKW0(*Prx@%^N$quz-2|;TXubhl_FeHd;aUnt^0RJ1 zLy+Y&cHT5S)L9O*0*^{6)%rT@t)zcPmRs@iU6350= zm=*MIwsV6Ly)-GiZ*8N=e^^(IT- zL-Y$UJo}SGM4686#;|nfp(AMoHc02Y9eF~0kpb##6Bgq zF|z=x1uL{aS}8MP7lZ9a!cKH$*pStJhbihhdM?3tj;{2r<*?rf9;CaKUnFJ}GnWKQ zPcFiq-2TN$_4Eph@KjMW3?I=Z!(A-gvw#v)Y(tYbY;TZqnl2&W5Sksd_nt+dLkAWS z&DtohMF}=u%oGh4&a8J8b~&o(5@?JX&1AgO4=X`Ys#mQ@tvY!fy7ZH;I2(8K@KG^n zVnG@T#R>H!y;%b(4l4pz{YenYInQA_#(O-%MtUI^b<>J*ow@Ndqqtl6 zDwDAiS^HQ8?G|2fu7q6md(qVG=17|kT!jJk`3JE+Fj{CK*EHBMk1;H~?f%Pc7!7am z*wll<-9Y&8g<;%bQxT2xi%ODrzE{QmUES@umMB`Y0jF<5x&CZ5iDHeK#WObwiHIeGQnY;VX79+udYyh6m0;ROpp zW357WT3uxr>da*0@2D{`4A+iS({XmlMD-B}MX`2Fcy zUy_PZI>FN;tySs~KPZ56oS#%tnmDca5C>zA)jaCX`@$H1m4kAbB$e`ACz`dqgdpgPzjVdC%|H3ac8raNq!(hYnt{O zR8*KDA9AA)*7e4vul(E8){#s70aTLzKE;+@@m26CmOe!&Jp%Z2$p5=nImN_ zHRG&&7WZZ++&*Y*&2jw;{ESaoD0#t{F3qC;p}Zt!`Bg~8%;Yz!B#VZ-OBcTuR31kO za_D#b__V+`Kk27R2d@a%6Cbn@hD6*V&V z5|#=L^vs}kM3P+cW_=Cip01~_9aD0MVLQ3gul8mBoS!T>mJ`NlP4OfKxH09wxurKm z_%*l%s(fPQ+iO)e^sM7iUlIbHnbAmRuD<~u#?Jd$mSSwWt7&(U6{tI7-xs{~NS<2& zk^P{)^_S%Rl7tuO?-8QB)LTuf;hQsWGA1^9lGEw^R8Q7R9u~dP^^#-73g0{}N8>MP zm<&T^lDWs|5XO7VK*L`KfBM7y4YImdHbxOm5C`sOW19>^Q{AbCzKvj{ zrXV$Z=KYj1GF{hs^r+*YA$U=tWWj#Tk1exMhWR{3t61nu=G=nk(;bubTJXVwU>B|Nn5CZ)FAO%>lWxQngF`~Y#UOfO-t zFSeD}=-w}Tse5U;@T(Os%~`=hU9xNQrCAF$=^Dco9Id5R>opZj)n^9?3a$Rr6v#;3 z1Y385M5rS%Bn7H2I=NAXQlmenBY*l5m4gtK;R{y{$km2LA-9-82{@&;`zDooUyN;C zr*|aVnXp4n2fp?%;|kjLzKIR)RFjAhtpP58d0?h?kPbi`%F|XfQmd0p?~NJKPlqZ7 zlI2pEapeb(;9h8F5n?-`9+lSDbI)q}H5iXfri^*)X)r$OW|@%wegz+2T@lkC`KTT1 zW;pqx5?U5yH&H6?bAt6;&;~o@a0|rai-Ngv9cVW~icG3yXQpv5%tmI)TCK3xk+2ER zOA(R2E9vb0gNs-7bMeTI1Ppty;}|YnQ0$~%I%4ZuXs8uf{&7ItgSFuXAE+_O!YtTE zj-EVc#WjL-pONcpTN&)&SJGlymF~o-;qTT*y>$OHI`DxdQNQSn#;Cu;o`wDqgu7?$ zF!n^Zmf5dWu*)1ygA53h3lzKe;=YA)Y5}8TDBQo7+PS6-CtKLW53T{E5brqcFy1x% zl5KR>s^Tjo{?8_5i;Du;cE7)fW=Y)%lmDIXAo&^t zYT}PN3sB7;v_Jh2xw4GqCcyT9)U>k7Snp_VjdlmQu57`0%W~?ik!Px>hSX>c3HW}(?;vm#2P2o z`0BN&YYg=nXm+BzceVX7%vJxiHsOps2cQ6!?>L;+Bpt*xlaHx#>xXA3-;qHfj_q3w zrANgIe(@yzkvH#&_AnH0K-ZK3+>0NdJvM2aa#AFZ~xgj-VF;^h*zq5pe3ETOkn6Vx5;{qnzcQ<*um?lX2`u@%J;jy8HeW+st$6Ix- zaLdp!>ncJ`- z9D=IrP?H!M{F)kCm3%D&legKbEL+ShF5RYHULpL2^{=^Ld-`?~>thy808zp(~F?ki<2s;2h!#K%TRu?WwX z;yP-jo(N_W8YVurdXnwWVj=n-eIpmy{An4H_^ZmTm)E5a$$OVN4w=1oOZRb3b=8Qm zqKvx`1KvTz(9n8oB;CWcf6vL)1>Mdv@DhK-s|lPf-yfi|1bITh%A^9}1#HnW&A^{h zULWURftFcyg#XmzPZRCDidnqLEzrVQ2>!V%iRK>q+&48*Mz3#3z8o{iUNWb|(yHL=dypWD zQwjP{2c2~uqLDf6RpX@N;MVmgxY#fg7bOA7hc&tFUx^_*TnIOEVPAS{#^v7OyY`NV ztk}D-Zu(kXcBl3#rrGnG!}hK!d{?C)K27c9-W<>e&*~{XZ z3Q$zgnAq8l!`{4fDC#jyl;Z@h>TZ8s_J8W@38{TsQqBLy7WRU6^F(h3+`eIbz4EGe G?EeBWzMVb* literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-overview.png b/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..e86ad1454deefca58b80b4c04d171bff693672e6 GIT binary patch literal 27939 zcmd42XH-*9^fnqrL_x(uQz@dNKp-FrN=K9yr1ug!BE5#*6cOnH2_U_NmJoWcDn$Z< z^bQJy5UL~;L%j!o_g(jX_Z%HtX>ZYjK%mP? ziZ3-mAgcEu(3wvc&I2vGiP%iw-$fTi19uRJ?)vH9nZcRBLlEc=Na^KsZSS# zhkIN;ympVXq)X|7mFs(lj~CDQcd&#CHeT1?#l7|_M>f{H6Cq&Mdo z6cm`B-)FQ(+!zXw;wT!KA*2=iuHe(O)Fjn())n4*{rN)Balb=0U9FXUN~>lS;SGqtQLbBkqGbCrduIn?C&+ic-p=8={15 zk2$|%{O$?ZSv20M?&$X;X8VWOqd617A}Uu(=CMixrBzZ)OQN_ZHE>7aVXO3^9z6bgYoS9IWdGreLjdXkX%c}67>X~pUiW4+tuc05j{1?|@jSfzh8gt@ z5J-g1hxa92R>qzed!YY;bblZS6g={1j5pV}$nQBzW6;v5^ik6M8)}U?6XScl(JG@~ z>eM4Jk4&QOw8{%Dy6Y^~Ff&8G>w#Zs;kVmQb`lciRGboN1tySt67(ru2?FdnNU@Sb zC=)VuX?R)xm9lI13IoA}7t%4IErpV}NKhgc_cq{6!f*x^@*O5y+-d_Bug7q2X4G$T z&pGlXqefImK5P3s*+BQc1?_}bi1L&g{=A!LKl6?Ws%GwHABEMKbevK%*@UW*QN|l6 zImEmV9v?5g-=~D$*w@cfZj4(?Izm^fex94^tRBbD?^o>FqKrqXv)9OvEpp>?&H)!X~4!1Lc}h!;qA+9*d?; z&APpm6-_wPP$16n52~PwlTFLN+#y4=CS#7<@`j_eOJny`!s7R-SIAzS{#+J4_6MP2 z{QO@>kp96B`_&Fh?Mp7z{0K_2dAoJA>JNr7F;D>t%;wJXzCN`;{9O5sZ2S2hDbM@U zoMnvV@8>Zq+8x%TLsgd9*KGMQS+Vlp*h-lp%T(RyfuQJoael`lbJDew1Z$}Sgu8Bx zG1ILHy|fDUdVgg$tU*H)bWQj1iyl8wF=nv}cHU zJyYqahJFc$=dBjc7mCd$LWEw@EjYlja$LX@h3I??~-3@dyaH2kZFJ|m)LJiYmURbAK-tIp{Ky<3H4~{@w~C3Uzc!g zCN`%hE(UFRO?+C6gHhM(10rKS5-h{pByO#Ob@x1ptSHP~sB-fv{Mgr_nkDwKeCRL2 zep(BkEffiT?({hvLApIi~Ad;?O%^}QPKcw z>|E-e3CsoCCmkvjXHY-5qRuUacz$Y29*?npMf|wuLGz%G!y}Bl?_RIM(5jfqhJId_ zqW7Xi?RDf*)62fV-Rb>J&jw0b-JmcRVr=}Pc1BK9y`RHe@4d!u0uB2?TTg+LY1iY> zL*kWOl70%!$b;sz!o#|N?<;1D`Am9kDnl`jYiTR31g-p^H}#I%J^4OM29*fZiWpds z{J2hLI$>4zjT*CQrj3tzor@c5(0PeV5pu;Vnzs6n%D<)<^)uK+=~YlB?ohBz_%8`7 z_2A0y>M2R~+Y$rSKH~OZciRn{A_)S_MUE2H{|a?`N|rWp6-#kG;1hH$D~jbeI6X)L zeXFnfO4mFK`nkyTwT2G2n4VqS7bjLsNn?g9&M$j&xL;UEyP2yRC-zjMrnm~~0~?KB zCF7j5^XtWvS6~~FuAE3YJXp_!B*IA{*DJfqeJl8OL{>7_%y+m|%@2=S73+e19F_L^ zx#0ixO-WI%Jq0S-E&eA%VdC{h;YR5+T$ER)$o$TIO--596$g`!H%vEEl67A9>qO(s zs&Z1LG7NnDcrVNU6`c@1am=Ld#AiF}GEsv-Ea#i`FXRe8fT&&*H>*$m+&!aY!{zw~ zUx9xHZ|WPV01t@8_XpVy6+z(dEGQEw_iMdizjiQpvDQt(jL#R2`r3}BMBT15q!z&} zV{N|p%AcdIR;EV|SwqS|YJO3oYZkDi$QZ*2OP0E#~$PRF|$_s9M}= zF@gJ4q&F%4=qAsTeC!>=-Ej;iP)#g%b@i>0fuuEEp?UT|jfo04qz?vVq=in^+g~fy z*1wC(izyl^rMtmwKCm;JE68~McJZR)RAAJMe2HQrMp(te@u?d{J9(LX{DCu%y*Q=i zQ)SJ8=B@ZK+=p5|g9j!v!Z>v|#$8!RB`ysNb1H!Mqo;idj#5qZ=32hEq|Bk?KE2BI zlv9hSt?s=eJ{JbK8lXhAO(t2b3O59zRf_Muj`DU_OhC9n&9y?>T#wiAAiKur2Tj{N zjbiSGGGB9#1|oiS+|4l5&TYvRqtl`Md9d)vR0Y33yizqcckGOgAu|%5`%rm4-V|Yo z0rP4(G9`rnZmhb^b4K%STJ89N^CTS>s_{ebNqSO4O&z!1N}9ik)eX21fv!Nm2;Inx z{`9KyQdaVK%{+T>{Thrsw{*INLEli!p@MUCnFNWrb*Bor<7OVa}kw{m(@;X}8ikchlk?96IJm%?2 z{prt*)WaB|(w(_J+2KYaiHfrcwPxOnh-dTFThn~&4|DuqPOeEN520odD>8d|3xx|s z^~gC%BD-#i*yzKIOqNY+XP$(lv7A4FzFZyOL$1{O>j>%b2j?|>4B-+pDehuL?qO)_ zYC#c*^LH8+TYD;HwmKzp`GA<uZ*&@)1ZNNQ6gd_d?y*Y0Q3 zS9#|W(9o7614JdsRE{O;6~{hjnE0{p8o5t9GBP27JqQ#Q9{vBHg);v`T!f3crx25t zMfz{boit4UM`Eb|;l=;Qqq~A1DeE(hUPG@zpwXy>uGoT-k`mN~BcfW6*o^l=^pk7A zIaEUizi@{t%xr= zCcUwE$N5~2qh(K)pewA;KFyL6YdxR`9Rh({_tUzk>5ouScw{>ut zsy6QL=Ym)JPVP9uSnKi5Y>$x5_dO_cVmf^_w>_W_kB>V-cRPCc^c3?bwEbz{VQ1Kp=5_d;N#K{SF*j zX&O!jch+${qDNCqG~EUMjmFdUWO&5AL^%(tA>l3KZo>(#W8+7OBVUNb+LEiN{iyY? z8~%_;EY=>&5n$xmadTCk*x`?~8l#M}8*@Cm61wAq@3vjssD%r4?2kMgbyiK79w>R1 zU+POf`YllpL9f&mV~gi;n~m{}4(Y60O+612Yx{`$Mf`*()sM7vTDfYw8{ByD%{-+# zZi_@+Ny1&9K)6b;bCE>xBur;^>N{ayV}Es{vq|X`5^1~h^FlqJkq==rb?)$WuJ@Q} z&{6w!n>`sG&2snBYkvXPnC(Vnlo+S3#2R$@8Rk>*&^@}mzHUvgSs#K5RwGP_Eq$+v zAerF4KU&>laxyghj#wtOBnUIUn~Qp)f_#n)C-X%9Qjj9Wb;I{dg|?l$e>EL$ahz-| zCgU_+7p=+RYW^1DO<1pjF-W1RK&?bg^a+3}ta%<@>p+*;?oUC|i#d?>#-{7Ot4+6! z;^DKdh>x_g*q258g(`(k+f#%cBO;GBQMV zXE3{6W&G-&-`}S8GLT8do&)*OIwQ`iFi|Cuu|})C=3#`M*4}h@JHa@{%4I4XLTnjR z-bv2y|DNyp6z#8LeX)n;6nr`#BF4!cy-NU_QlKT?D<6qsq19ir`*gIMJo?hrVk6Ms z-sD}yk1EBQfH8!##g&C~8&yOjwpMIpYwx>3Ju&DIW!O1M>mqy*;S7GIi^y$?pM%zt zQ8DJd&U|BvQ-7!G8gGT_OqTZzU;IHxUJ1Hg`}Y?i0sVfiC=lM4kWrf`<1#4RLtx43BLtNa*$Y_c%d`(lK1ELN!y*G<;Id)c-ovW)vtEMb? zDM;j~!fdZ-dOYPrKIf5!LGTw1qN7Gn~Z zrjKf&`6BS?-C4g)zq!=ey_P){J}B)yRAG#L2l4sWE!8n%C)tp7@jydp_YSu5AFNL=%H@s%Iw$;7aP$dAbfj7gv&|mrN zMy4Os2fU(U<&wkP2ZZZqmg5LR8#BZ*ysoE%@~jtM)&1Sn%~oFIZ{uhgKZTDoa$3c8 zx1`(-f%e zs*BV@{IJ$a={K~PC8+i)(_%3?>p8{j=t-C<>5JVdWE=eacVD>J4@a>W&BQA8w@e9t z&fYadR@zw^LSy*uSJ3*FU(0@m@%E{f3_w%iW1{)NQl(ciFmN~N}p)Ynru~IV^%ksHH{Nz_KefIQj_f2YcArowz}Pz^=Pnmv5u3;i=Xal7tf_N zxM`*ZF4avpF2WNDsxbrs-T=v`^CAK&{Xg?P$HM%}3_V#z-4@&VuCL8DrxsHszkLyQ zr37BSK2_@s(rm-9N(cJeI(cOtZx;+jKb=*CeUYE%r*GKcx{&&o!Ino#^Xinh5NP{L zN$qUIC%5+hK=PkwN=$g^3{BndoYB4bA4o1kw|16qOuK)RTHj0Gn!&7lZKCqw`gFa! zW8_hJ7rU}ehR+h{{uuz3LXF%vCl53|Tk8Ch|5o-wnN{AU4EU&lz0q2%1nD~{@6>Y* zmTI#;1z~|uGS7_joW9W9{%GxJ!}p+Fn;=gRz&!xr83*t~uxgs;tp!Cvhb9`MnGfsN zHcN#!KdeN`PqDt~e{wp^Kj3~jcsC=#ZS-}e!>MQeOCyG#55Vd%->0bn&8xk_wv-_(EPRV~nKFd^db z!>)mAmK>>k!UCe}5q8W&V=cSY3D4$Ej`uPd2!6BVjBe*J4ex-}X}uN_Qj4^6v>6ms zQ93a-yIZsFo#vF%5QP&f+MYy2VoTzA1l%*->zjxw&K5z!py0UR9>D*{Ajo~<&N+8r zfP-~I?qx*p=>eJWGCuyUwF2(bN5YX2fguc0DVBF%DLlSIWlZ^6q<);3|KC50O^7Ev zYMNj3vJ8p_Yx|U4<1aOOuBUv@l29}W4OhH4v~z`n496q&R0kzpe#z{2K5cnauNsj) z|8t8s1&4w@NY|=gO_TDu34|uzKxm@x-a`H({YvN$#n~BUy012;ym>r7m(L+}td?MT ze4a(9LbZF4D=&E(aJ34!;bH4Q~V z{Bu@@x)L4yc!B&Qz@2PiDX{ufL0Co5bQdnfsrk>}D0mNNfo&cdup2>8O}ZL-5J#){ z_(F0Y8ll7UQJ>}vsFMnk3j$kZFp5k25a@?!oDYJA2q#C%gAX_T`Hq%s=$$hUCXZrK zrLe8RZRH@+QzFXdM6qFm*(5o`uk&${9m{=9i@ZWbjmXim2g;^R`6XwEmV8YUN|$*e z4QF;LcvrN<9@f;<7ds~oQ;a|5Q<8+jqeH=8wQhkWn@lI(_GZGGPA0ku?vcbZ#kgSU1aJ_XY%lRw3V*}SU&pss629by{>3oqH z?iU0ZtZpJIP(Oa7yltL)ZlmR0ue@>#hJGTM^z#iieSUaaGJUKI z9h_fOfwI4k?h{q5e-Ay+mM}lU#SxI}R+P}4x@8oIX9j^fyZ;52$y|g+ug&~!P;XoI zi?A9h!0wg8&uJdcOMLMI!Gutu2n@b#iSe62BRC%8Ie|_z))w)RtI| zk5f&a)t}NopgZq+xZ7^IjD^G&Y)Tw1D!ntQI*5|rQwxjJ{5x$U?JiWHp4pi1RB+l? z(5dX|S>l5t{zIM%^zh@nCzbOKN#*nDef3ry3-zJfCNS_@k89lP6EGJ1^xnTz!xjjK;64HDSbB%Pd5hkpkM8W z=;6`R=Bw8KI9}Daa@L^HtB$uh_XbL5PW1QtzMTjfJX=aSUUVKbmHadQ^5)@T>%l;` z@TC8-xZY7uc;i1Q%3PrZ6eRcPVl+d0n%Bvydy&cM3<}SkdRsvGfAhru_bF{K*X;My z@x0mjD{Nv_Y|EI+zT)U#TU{J#Y7$%RSrI;SEdf-Y&c4R~-CD4KfUwV>R`_Fm|dQx zW;PZSg+$I>emX5En!CyJ;4V7r>xBSQA3So(oFVL+V*d4p*)i^>lBj)-e$iQ}PYwgs z!`Am8t%oG&XLKL2)@qM}KxJ1{S`^#EAdrIw5`f%;SZ)Dxr;^7-Pv56!mw4uyj-W%u zF{(ko&o=wj&hVmwm6W#X(bxt%w~e;9R0-Z5#<=9z)f;hKs#_NVz-dYN0GCJp%_-Xm(Fp>#6gI0MsZhDc2*9m1pBg`dGmUSLn~kuj87`Fg3>GwaWgC z_ak1nfu`o~^Z721PPT3lhM=XfU=^ft(OPjI>Q_!mKKu^#fUY!N<3#5QuOEu7C&!+0 zx?-5?fc-yn4=;~PAPUv0{dPb_=!zRKSfhrV>*aTaP1Pe37=#4QSyER(Yeb$wj835X z6V+T*5e@z#$hRe-$Kw&j62*L|tI#Xuh5tmZe-042awmB!k6Y2atb-@>BrzWsict~6 z+G9NOiYgHKkOk-dWIFSjo@x^(VC4kO){1$azT%1XbbX}-PA$ZY4RyP-?I#V-5WY~fXGzq? z##a&_E&+=cLn>Nbr$xsyw%2h-^CzQ7Bb$YoQ&C+CWmAY@{cJlD0)U2E;lM}wowLg@ zOutU`?F&4g8lISa|EcTY->s_Z>guZPKFPglk9}f+06$>mgH`ZfXgG`&`%ce}YZWhj z*zaIyOb|8~aCd-#W%_Ip7usCP;oaU}uIqE;T}rI!0h&Q9XHT`a6C8T_b`alLWBF61 z0nQQt8EuQ-V!A=`JZHEyXe8dw$lqMvw6(O^^V)!@i~MI~w&{URG6RX!ZpA>^Jn-wzLE_dm+1{$vwLgnwLzLLHBSUOOCu#GEDLTLTLy9vFR0xgNY3?7$ zRP5X|Z8y4u-2I@F@@TzWxw?`zXua{&nfR%79s;@^?2It1mNe7TM%--&0U#Ws^p;YjR`h}`72nrO{J zk)U5~ZaBc-}gc> z!#=}5QX2^OoP2GG)_Lx<9Q~^uOf!b?bW=Am?8!>gavFQoBkVKHW&8Q>`S^%d$-7P8 zHEi^Qju(OsV-qC)-WH+b0j(g22KqLfe=6UkH(wfltJ^ikW{a2Py-uN&XNzQcJ=gv; z@<3bu#pJvKsg4agT0`4R%KCDNM@j|o{c849>ga9EVFis@SFsoACAZam=ffX%nq12L z8j&*n`N_)Do{z~UpEUE=0*k#ReA#)T>v+=iM3GZ={@;}zG><=tC?YpNVm=bn1_u=c z90||exC2@lgeR8<)T7^xMjtkkhZZ5{7hdW-NtYDeQ5 ztX@H6yGCXvBk5y&c|YL#;h)C5ST7;d%K6aq)n^O5cV<2OJ)aJH8PUaKB2^VAZsKG! z?7UY~yvkN0R{0BVO+xW?Qoszzh1QX`CcELeHGn5B*A!Oe7?-QGdrvkb^`&sYHs7uu z`p=kod5FVVTlPHCzw-9u&{KcKc*3~fQ^`W-X1wOoTeeXGsDA&Y$HWDWlfSzPCnvw? zkALNzG^mb&SsmClGx7w99b=yC&tsm-)%HZ0WNlF=5)_P$vV?ItF zR$v);4a^ogP>a>j5Ac(gGA&>ZX3yJrsU4l+%V7K)ewnUMM%9V29a?9wOv$l{;CtbF zMVsgSt)_~np@FLtR!NfdyvQZ1#)S>h-hFO%SV1gC_*UH@9PWOFZ59`?IIO@XmpN29 z#P-@W*CvmqYlW0YuGjh5|GM?znjv~2UZ;yu)#qn@!*k)xJu}$GyF!2BP0X{S^}TRL z&sJuV$B~8)uNtI)TkVo1R}Sq6no+hpXHLhjg*W5bvs*OJbqbvB#jEU?Q?y6fLCCb? zFqRglpE}lsVtb;Ew^xiDvo6za?&U1H>_@zyAlG8_Y{9dGaBOa}UdQ@DmJ>*Stj=U@ zKgDllF$8Dl*O%MJqr#)E0YP2ce9^6Mvl9~{{5tWlPEt{-=QY0CwoE+s#rm+1#%FF- z{LCI%%s@fof?jWKtW*l%I3c8ViqupP5=Vi*-qPGcN~Dj$8%%yPn6xr-TuS|0@kG~+ z6c%>8dL}n)x)_;dK)`C(Z~pCAO|njHB%$pch{ER3D>$kFO$`yJGQ8GAxFX|xqEryOpmN7dT?gtH@p2;J6B_Ld{R-ps&VUG&^KpT8djmGw{T+xPgG z*r?P=VD5`Wd(%JdxIwtu*|3_zVS0OY+_BQOtdSv%rgbbJ>sF|X9IKT7vl+J@exlm( zqS^!97J!thKd0f{k^7gSbUw`7LXWxmLN2P89?8l^R)p)V8RAu=*&X)hI*+t%<@IiK znN!wNEGP@#U2Zdsy4K&I5~R}^l>zL)Tk)d-WNCMY#9jQopuimmv>FPd!YujP#aoZ<)9QM_Bg(p6(lD6QAr_)s5Md) zi@(ZWGvKDnoKHKFH2HR=ST+04!E1JjQZ?esy>_|lG_r%khO9kU-hM|c8XS9g{4r6- zs6I?S=@8NP!}7<}`!9A3U%7I9f_>jWG;J#@c#<^vK74DZA9^;gTYD?R#CKr*p6Q1P z@+-IPiqVki`mEqr}ID# z9W)y8u{iF4Rp3dEjp>Yg=SIMQ^^bH{`j12dSZx_Hb3hj$M;@`0y{a6RDa2K%53f(+ z%Qe+fueUVJ>lWxkah1lC>TJ6$_Qo|s&TUY^puKMlST%IL=iO@qi8_5bsb_}FrXD&w zSu#;Zl;JMjE^G+aaSB6Nsh3>ZsD}Hji;cC|fyTEcB;mTo?4GSvk=Dq_&8A`e!%*sv znj%>-*WAcSyv&~gr({|0TjDgSxFm$a(mcJ$nZO_dDd)ODEywcYm8z_AN9xd z>yn?=ayLit^9uBt#mwq~0si&F^>$G9*oajlTC_r)LLJtYbbS*KZWeDV&)#(n^sGAXgMtdASl}BXo{blJtaoz!w?FEK)go-!R9Vc3aLsH?y&MyPSHFqWu0*zJ0QaT@SHVA{UzX2njKS!{U5sh{x zDMO#o1#^`H0R!vfbe|D#{9t)bpz)Ae6B(54YSi@_Y(oGK1Zke6jK~J?KLy!l|^s zEJoX>y_b&ZEA>5Q4Zx);xI z=JZjgJ!3Xglq#P5%~%$2`s`e8!tPXjzw8>@Mv&a}A^vaU7i2iUZ(rZ}khz!MZ!fJ854Y+|S(QKL^r(TD){_ z7Cr`>%Dj$FQ)YQ8UTS$0OtfQcDsG-z`4nHQ^PVeHmuR1mDfLD(zFC%VcTlrQ_gyLj z(LiIW&=BrsQj9nlwlFiB(eE_FOQ^ zc<>}dcKlu#Jx7NBr<PG7X*N79DWtqM0HdWGh z`|Cj(KTUlF`w&SK85c+(%Uk-3LAVSuy(PRNheVUiJ)DPYpB^VpOF<|LAAafVfN!Sf zV|%7FwfFh8QV;VSHVR>v;EvOO#UIiyJb|?&K23T&YAPXMV8OoKh~0p?5roWX z!IATB)2RA(9m>ZyF9OGE=LegY+{!UxOsm3Od$N#_`Is^ABG!zf2ONb?Ix)v|=u*{Uo`XG!mdXm9qy!72` z?vG40&gdy9Rbpci(6Irl7T1!}tl z)v*2a4WASHwegrC)2hNhq7u8&@I8xE+|UK3f;fdhhg=ET_}up^vhXDO3U2-p^n&K> zJ=y}_1Y;k4BpRo@LvSX*=EOGr>YfM+_cUwE>7;tGuWlqIn>0x?^zDVwRQapAjiD}D zt6%Vw1$$x9sLO!WxRfr13CVW`XN&2sU<%3EaeD?#e%w6zDqAb9Vzw(7q}UP}hrObQ zeOCBQcLgLs*ZmOR8S!#WW+iR0xa@PU~*!aqO)ZX zSIIcwqr;BUuV(xB=3YpTQkSx$q|T)}ZU_%+e5Ku^++u%(x<6NFhflSfh;wO-Ud1AQ z-V-9qFpJN6wjCZKfqGkHJ)`WnnKXFxyF%|+>kYvU{F9C0Yeu2rh!gB5t`I=BP|oPt zyGz%7vysKB7O(=BL;w+YE8z3|w6FLrA_wt_#d)R}iM}JCW%Tv1$nXh@p3bH!WnzD6 zVPA3;8lfR_6l1$>zOMcmNixN$jZ{Z|g*x-8jcw&D7Dm)MwaK+QYE*(>=OJRTh5UYH z@=%z^)T<%CQMbfTXRWCPdE4Q14eb^Bqs_xRfd)vgulaz&-dNqpi~>lROGv4bkbE_; zdD>K-s(w+Wb!`;{r>)gg6YO1{Y#;`O+b*|a-qvf@L5D9UQp=E*n;FFy;>QRLgE|I! zG)C#$4PFJbLDq2z zsQ^UglWN-hqO)dTO`acv%B(NV7iEMXQp=f-DeyIBsM!3JSKlqN%hh-$}_$iNNU#WF; z-O(g!1S+F5^Mm(Ao?Tl<b8}W@OLd?nB(<#j0By2UT;)91az^niD02Qk z7}nkv51ju0K+=GvKNa);j(@nL$4u*TPNZRI{ZfkkAS%g3tkNH}8o?ZIuoO`a666T* z>q#CeOri|D6H0B%U!($wgh6zhR!du3+*=r>X*r{=8Te1?M}o}AU#zQW0{?_?U;@|& zJ*qVT4)Z5`Ba1;cXtLsCz{N8kqGq-=f7oS$1R;PaFq8N!@iIs$>z>4AncARov+Gwl6;)U%*i@{4h*)Eq^}2n%tMQ{{w=He zQ^-w599XW`C&x#`L?b5yu#Y+1f7NJiC9MWgc1r$Eo!Eru3XFT6b~S4Tbik&{kZ`Jg z)t_|ey30n+{d=GHb53JWMardsO5g4<`03RLklFMvp@uuNfQM9|7O2OfcFFvF``*~4HJX4i6{VyLGcP{NrdYFL2c~wq72o%f;go5|*ul!DC0`_Kz*v1XR@9!R` zfW3hnM3vna?Y#f#pAG<-fp~0719#95X{V0%=A<>Q93-0-QrlKg=ELx1XW`^; zDItIAWcOw6^vNp4ChtWlUnW3jObuq9P%;JhHc#^h2AxlKodx)S`&_^^90>P&@Jnba z!?S>Y>5y$y^m&^>CkI3z|Eq*Atm2&138jCoMy$fD*SB)vrs4Kp<}LD{UK@!@()8nu z^6}6RW;SUDc7<4WlrA9F^OtCU%l!QMxPoORAwM!?+^*31DCw*%N{vi4q5R*C#HBN# zE?J6{gb_6WPE6&P+KJ_9E~F$LZV`^%@uDR%`&!aFT6ExtlXrpXwY>&%Fa)n+n|}S) zeWyr7TWroYC;UTrWo{>5{ikC1dqvZ_(zOz!8iJPpL+1W)5XehYM~2 zw3k!!u!>-o)J%i^nepE63<*dZ0!u1U#TSlspESozh{c%gt!pvmQv^(h?$0`*Xbx;$4rlW@0=FVgIG z9sS&{{D}e1WiSLs> zIqY*=o2reSJhdsop8*4Qt>o4|N+7@%wUG_`GcO{2LYD3?&inVydy6--2?Rra35nfXsk1jvRM9veP0IDpPX70L z2PypvHZP$GOmP!05d!$l66b(b`6Xw?G$5zPQsCb*>T`0xe|+cZfQk^~jTy$H!=8(?SUe4gW>CyH~lT;Jc_td(&c|`sWi0a%1t@TEE+8a zR;T&}oQpD?4&6zB;oe?MP{W2|0&@MqC;vK^8Dw3pk%1&kRt5BOpVY>J;2w`V^= z8kTdq3DH2F@UAo4m=COA)x6o~@9(f7fV51&w(PG=`hQQw$16jW#68y(lS~7B@bIT| z{_YFHtMAS`9Q5`e^-M%5+o3DD{eRsIkb8r_j{Z@R132jkO9D{jX)@{+r zBDF#53}5^Fg`+lUV5R~II@w8ei(QVsJKxW~;rc_x@mFR)vh{D|_OB3nCj6i)0Ey~e zDZhgi@Qq0e*qyi`hrI%DCA;~lPAUE(*N|_;##F2yfoZO=Ci{_!nrL#2e9_T^3D;^v zn3M1o8seHJDe4(x&s|?~V$Q7oDl+4G|ER*IKcib&VXjQfscEY-ocbknc59(aygPf9 zQS~*BEVE6eB*fewXC-k#*?l{`L5Ehg0S@{WS;=j$tPx>i|Z=RZ36No5qQ z)&)4O)#-I`PFP9)bZz`g6sJxaHFoO2*9o^}t9b-f)1gYsr}AJTQ;Q0=9e?^vH;CE3 z-90!G-BHbaaZEY6`0uoa?zsN>nq;N(0T#)Hf8_GEi(oJ9Q*ke$+LvxfIv|{SlSt^; zK`l|S(ug7WjUJt?1`L@5ftA|BAq^76mpqzEsFif3QLCgFA{yhN>dIp>61u<-vk{%I z*AIk*#7Ek|{GCi)+hn&IjzrU&4i^G$F4(S`tTd1%3&lPj80OZE2y%@58H!t{r}4RQPXt9LTj zi{CnKXO6`bh8mT?>|5Xv zRE;Qo#8=iL;s2EjK#y_>_!)4o=N;ek6$U+?_g>SkU5mF)66HFu?)!?*)r~2Y-`L*x zQ7z|sWA1+^c>);)-EcU0I}foe#>2h!*(l;0ZRk(e?psCiMq?9r>>?A|#n$lkmQh#Z z(nFQZY-oSQOGN*h@*Q{Wy`)WpMl!K=5Sf}jxZ|$Xuh1p%RA(e4a|i(7uT+x=WZKd> zNF-~zUJI8WpJgp|QZp&{a0*WT^(ABq(yePp5-V;n@kt1s8a4JyU-rH|_Kg8!A8)!- zxUCZ#(c`0Q+@LD7>@@J4&gy6Uk>6C`6g?(B-F81}JGzKmN6bVJ{#NRkz ze=wSkyE7Z2L+M_fcKk^yOkXjuF!0|T?f6}l?kugROTnI)hNouJ{;n;A2-_v`o5Yzk( zxoc$Yo%zA?zk@ZbT(~})jfjk6*0Q9$SmS11G zpJa%KfahoFf`gywP1-ICnrZvq&u@9T9F-gxQ7Jaep)uOF#fSP*V0j%^eNHzPNj3Mq z&Ik2qEA@ToRN`&v#s)z2jP~7z)oT0A29Xy#D4`S@4y_JsyeDuoO}aT~dyXk9fAyek)3v+s+0GnQYM++s5Iit; za=*}>HdmtVaK5pIr$q!B+w%=y>cIe+9a7n97kyv8!P>VzNYueUq$jL0JZLEDazX85 zpnfnJPQE|Oxv}|S?7nYY+%8{4#^NqAMY41Imi_1{jt#OQg04R`AYdhfRV6XtVmkTg*iEc8yq+%x$G z%eNG61NV3dv*Z<$4UE}f_~xkltA1VSsk^?3hG(`9aI_Z4PzZ0!KAZTS4!L@&msV96cOJVML{beEH+0=DgRE7M8+i)(lB)kk4r=%czVgVF(^ED2Eh#wio|$Q& zGHXNB=4s=zVC&G%5SfAbvBctM5`qN(#mJoD?)4KLrpE=gTpcHb?pS^gpA_HBaXAsg zc5P=B_G^L6JE&I^>ErIStEBk+jWYQ7y>@GDqyYGfV`*$vK&juSubYNO{;8Nw$I?je zIClE1&i&6^E%C2-5Un$B(dVx&p&-(#(tVd-eQB^S%{eq?ZrGmDrKUAMv(!}`;+Ar` zA4XnumNb)i%J21}%m|^U9O*8Z!d@umyrO+WOQ^Y6}9 zs#mwkWE!O*2EP-|3D`N;NtNSy=HHfx>?JTW6@m5Of9DTPQ3M?}$-O@ECuJ%-xOT^H zie)?xB!5uesqsZ8W&T>1bJFk|jg^$lXFErt|1bGFH_6~$0S1g$ai&vGsXH7An`#{$l*WuUb z@A{>`{lAL)uBfKEw%drG4N*iXA_5{J5C|Y39aIp|AV^E72_PUM1f+!C6p$t$m{6oj z2_+DulNgF9AVGRlsx$+H9+0a1JHFp{{xi-v7yrc>#=6vRiDYf$R zu<@U09Y@daaaX$poG%R&cEry`IbFCX$7`g3pluz&#C2D|L47B z+ET?rMEUeO)6t2~-vuWOLk8TQnW}E898uMs>$}k%Om`K_;S-2i(TLL+_SrPG8C&qY z*io7g$m=bv*QS#@iQetg7<@zb*iiAE0u?yaN_Frl^CejkC?Sj zgs&I?n0bPy3;Oe_xGU9$hlr>0lk+i302=&@orQGWMft|-8jIfA;U0zgu(Ca>gGns{^FNzt2Yn0|5a>eex?4YSoP&6-?NO^zJge1UW5G<)+aP2Hg}K`OlE{&oUj%fgY(`(Y)CWG~%jSmWAoa zPwPS-)@IGpu;L0gvsuT5@A!?)hMd5)W-j>1qs%Zz%G#2)5(GBwXKuLGa=64@YTc-nXSGQxv zs->u9jeXBuu@EKq{QWA&#&WZ1)Q9BcF-`Qc%Kmj1X>_QQ(s1pI@>8L{8ttF-I}Eo; zn2&Xxug7b2LXTX!_WIEvTCxH5I+-XxYjuq!M3N6kvwJ>$;)m(>iJ4g- z)G{U4W=e&`3$i@+erZi6jHZ8s4KFIdu$a*$vX|^W?wXjXPQqrdB zpoei?V!XBX*o;28@`evJf@Nx#KVek3$KX&je{HEFn9E<8D3R;$jBHD4)b$VDy(7RP z#eX&_oWB9as(TC6UnMw`Y}Y=RSA3Mc$gc;taQcpmc+kDtC@Y(-D*#yqH!T>gF|s*r zy(G2Zw|WZG2r5=$cHBF^xv{)*5kt8mu|9!5a_-`B7<39O9{N7O)0H++U2z$(5-FfY zn5+yCeX`nMh%J@g!(t9=BU4^DJo6wOqU3dAfZozA%3J#aSuq4<+Xg*9alo$S?wfDg zDM|ORaP!e`N-D7AM63qT{8amAI0e1@(U*5aEMP&N54s;=pVO~>=ZHth(w`q2)L_Xa z8NS{1Aj-xM{+nL1@@zCtN27-|k6Wzjh`4m*RvBM+3FV7y-@dxlbo-Q;-a46LdT7rp zeg-7=s>{qPkmeUo_aB~9&{3v*8W6QaqbH3euGeU{%&3KoI(wGGc;%|)=Og+>+6ofz zeae%&UGE}~^1QM_!f~5DUDV%s3pzbRFA~%4FM$@q-$j%w>m=-CSJP6a0ePyn+pJ_R zX=f{BNYOjRQ_TyEiDQ?lx7@5S^h3!{|GF71*)Tuj);`4{fW_G*vOu-7$f4QNJ-*@P zOrk_nuVB+c!~!D%FWku zTi|vOduQiFn-WMBkJ-Qlm>R6fbk3VrangRjBP){o24(t~!%VW!+@C#g;9E)(z9i3P z4y|3ci{Zn;ZP?~YGCO=Xiq4eLR)>P}OPiVvyJ7FQtA4ZR=;*`$GB<0V6i6(G>WSH` zlbi8N*q0j!Fc09#qVJ|4DJl}`_|nUm<1y!3O3UY8g;iLG_UWL=4z1tO;25DzRv;ap zBm3+tK2N{hq1fwkY|6L2qT2a?2K8tq%cwq4rKI3k=M3BOC4#(*58R<<1Ub)aB?{2;Jago#@J}t zUH-InZG0+3QjIWqDU5>98a-#88Ofw!?E{b3ZX)2#}v)xp=ufP4YO&YEzV4V#_mo&JY z(|4&|4yp49MM30)>tLUn zF0)#1ojs*y&zS9TVpH5~x!vN*SxHs5+$ z8*~tNbl~S5Wu1e}wCs4RF@!S5%2>WsgwP{jyb|;EBwN_T#_nAy%b<0x;PPr`IP-pr z%r_x~=^3x1o9Y+cZtHH>sr+j?VBx^b;87BXb$y1mWuZoQcHNKIKgsY{#-^)^Cff(Y zG7l&kuPQfL=yJz?&GvY};g@b5Elv5>A(-hziKiG#evjgVghDujQRH_^Xe2D zlWtDmx$U3z8FC4VmdCTO)!ytb^G@|OxRmU0|D#dhx0XTaf`x25EX%Lyb>rAXm98{G z<^I!te=Pll<}z?PID1 zp8P(VdT#MfA=fLbkxc!vy6FxL$^EhL&w>l^It+n8|6`Y#VwJ<*NH7V=3@wa{3_P4s z)7e`kMrCe0Tx-J`+*k9Oa= zeBrN}=8;&%FNQJ@_ukd#6Hi|#tJ=2@4`A~dUbNC$35aS4Z01f~A0-JSrSdo6`rT&$ zpwC*LNg`o}L&3D#AiQ^K@y@4P2O2+Fn+x^*w?UUdELoc1FhJu3YWkt?ur(aCJe+hj zsqYSVSh@A^N8`#7VbH774EqehM+ot-qDMl#4ZSrSBMmvrFE;@Q5Dz*%#oS|gP1l*X z`6@f$Z)9KLe{ItH`m}D-5zxy>OjRE;H1N4JKoW$gn?`ZA^t`x;f{R$lx-X=l#g0H) z4QlV+0yVuZH&mb<2ZE!RQw;Yd5PLH;?hH=8loW`>yEgP6@6ZlVI9cD#(- z>{pp#>ZV#NIfhKtRrT8s#RN>c>P+Ict=Y^eiYwuE`F%EIJ3M$@6920f_=HWA^z)&#u}SS8K;MxBj+bFB><2eAt$B4?<5=-gcI za&|4?l4}n{=z+&EEN;4YJra@tmqY!Q?S0{x)0~3a0M?Kd5BSq%BuzH&T8&#Z4EYGq zCRW{9$z&vD0fZ|ER2dpBr2&VC2KOE_q!_nDMeJ{!hdfde&exAlv=k|Qeg8D=%|0Rakti(NE7YZkQ{Z^4L zRgr?NdDe4tPlPP~gyhv5Gl1c2?!D3O%58tYD)H@${IXM`VTQ-+=k=J|E@$=YryHI` zabq9!GW~_zLHJ`p?Vvg;p2`uMv$}JpxfqQ^!zbk=SwL zSaumAW@JND2tvWr@}*jjxk3w_Ju@0mzl}24lezK}`h<1zyTm5Jw*cfr)cYU4B4n_9 z=1YR0@ZP!LU*PI{Vm8l!>t7Up|%8C;^}z5CVz zVR~QoL^^=80#E{K+WQ2~?YTq@q#!VmtBgi(W|lErfVLhnuQ|69(>pqLpiz%8@+ z`8!{~z@@_)17ZbIk>w7rz7s9@D?lL*?#q2aKPY zydSRuC`j>#J0@K^jpf@!%=k%b21gOH6^athPS{^<%u;^=p9NHoo!xw`K%xS`P^$yL z$Cq)#w6fK2<+dBW6aJ1*!}|~MWet8CrH6Z8ZWm` zd~#GiG38@x8qAKYXt5>1+dS*LXeobmj^_)o*9IxS>T?o2?aU`+-;@1UQ1^-zIQ@v( z4kP_hN^aAi?YdP(LzMV>iS_>5xDLri6@*(0$D2du3lKB|Sid|BVBf03ooC3v;jv#= zeq7dVy()(*$_5)Z4Zp0{v2b6Gw|@(mc63M$(KsS5rbb{?onnN@)i>04BPwlZDXO&x3N#$1|9~`WEz`U8+2? zUz1x_Bpj$IXaOCYJ#=iq3)xcH%`oOm-z&+~X z8RLpkQEo$w-5@2TIak}NZ|EMs zfuB47R*p1Vy9il7j$MI2w9}sNKTp(IZb{>t%-b~Kxvw67K<+@g!GJ|7z|58TkXh}e zn$^P7j_xzYa|!>FM&0!<;YM(k51vdVFB-5P!}1w?pS7)xL8@YcW)J=NT*bmNKM4Nu zD(227bs0v70G!rT`e%;YN8qs~J~8^oI~l@BkuYE;;Uqd#8A{W~fRr!f%rr^9Uh4PW zLrE#Hh-nkBQ9<`JVJ>9>bfql+Tfy_qBK91Xzuf|m&>$Wt zKUCoFjBR=x3jFTl*WCXU1HA^~=@S1>u>v69zIX(IQUAM<} z|1MtqKd!{aVi!DwBOu|(-QYg5NH?)P!Q@x)vSzxzn9x;+kcmM z!{bsX5V-S+UvC@WKeH(g8HHk>-i--sIJ)BPu&Cb@v9k04euZb&qEps#|Lc)r_!ve< zrl(gL5C24^ERy$(2A^+MYuu(}&XM;P@%hdHaXXWxq!Y`N*fo5b_DBrFS5s%d7JM+hE)QUODr{K z6vGp$n?#o8lC6-U4x+rd9?@3R&C;Fz0o9(}FWvWpBHG8@bw}6synN>^Hd>xB8zmap zJJCYp@G9vz%GIAnRLmi%3LQ%;w2Q4!*()@2;5AFNxY#Z~c9y20@bNl~9fq1Ga)8Wu3JV?||mBxUwwM``p*6nJl0?cvHdw3oFM_iYEG9rnwp`?alKG@+L+h7?NJ3EQLMx2D(2Hq*{ zFI5UpxsVoc?T3ccdv4=yZM<*ZuaM`>`AvLcmp;&QJub~9E93j2{b%1%9ot*LT^ITk ziP1#CvcqVrw&K|msP+<|VRSF;DsuKjG3V~P>ly`+x_D*US7&rx>U@2?WrbWbad9-# z#j&k1gw^!!TV5Nh)QWle9Rm;k|O*EBE zgt=iUl&RkV&y?U`4!yQ(54pTe^7H*R>p4|<0{DyhJiDZ|k3HO7_jrI(Km3hSTt99q zU~c?43CL|I;Rj5KWK`)6yCS7(iqC#DMHTEJg+11Oe7pb%3Nq6BwTD}r;(3+5rU8Ae zT6yr{p9_Dv&y=!Q{+0{9u)1yb+*YiDa0g@f>Q1WH|Z?%~AA5 z^pJn`lOaO+kDT;RdjzSGUO~W*UJOp&&n}WEwsQiDh?8hfcyhUi~;`!dtE z1~)BDQu>?lh>CJ?%J&U%9C?>uk%;)tu0;tS!!Eg)RDXFnJ#f=2*ia#md@-z zp)?1OOjQywQl{5G#I)KH)6omxgp4u>eU`PCt?(+Mv4jlixzQB|39EMQ8Qp$Gl&-Y7 zn+P^-oFB$V@kan2TpqRUh8KgqMQiUN(nRv}XV&-Tar3q)`}aBG-?!H5e@MSg2HLYi zCVnU^!c%cRFqfoHTdF$#P>yYHJ;ZqH&hJTybeB*VD*J4K}W6fV8yfKYN& zn$DD*eJAA$j8ZDp*C4*mfll%Rq|fDy{|H#LS=j3fp0moh9lp)P9XA}KUzbaG29pN! z@71Z7w4HLQ6BIzqo8_YIgjbKJO#> zEe?tofuYV7XYgHw3@Jd~)!r2`Gg5tqb5iNCR!JU?p?uy;3P4_Lla}v1wb`s4CyA>+ z*>TPIQ|l(ksa0BTZP`C`OaOIW&1=ZlcF#W7zw@+clXD@xuq#K+k5CvYzTIUuCS((+ z?|`I4u4KHEU~m4d`XDdN?~aH9w;T?LYC@_%jUMqi6?EqDI~EtYiJ;qCUyBoZII6Q6 z#xmZi78t;RD8>GpY>?V40dBs+FURBizC@$mBbb#nlM4?xJTx^$sr}l0*$dC zV3y+fxxCgMS6m{-ry-NCdk&)>(};Ked~QF0@le6B7p)uRC$+qC*KV1vN$fcfG%4jHAXZxbOeY5kJwuIiSZa5smP(in)7;m zSB3W{#mIleERE02P$JyyKlN?&k<{XTLD&0lWL0i`#q%qjY2h(}%bG_4eg}iaap+xX zSPaPLP_8Wcr{~P#%d<|qy zyY2E|KB!tY-(cn9NlkZjVJMk7KbMt!YrGhKKPmZcmY5CrmWKYn$l)D5DVh@X4x?vP zHW69ZCv5$?N9iZB&j9KPg)W(F`nz>Bz;lg8EcKLH~Mx`ne?SqF(BAihA(r*x z*{20dj@9NvX57h3X#?ett@DCk>f;8)z8?MSEb$^Y;co1K?~G-C6P7HS`~c4>Y2?$$1IZeNB7f>t>IUUlq8;z< zVjk9t4o79F?mlw9!3u5bj!2Ag?ytP+(!;-6evoSHcUH4_#rq=LNJ| z9*z9`-Prk$J&B$h(Xs`AAgT~rB)vnyd|O4*_C|%LDj1QRHEY;_;NL5?6~-+rO*S50 z+vSa*+#miqYrjY`ve37TvpBR>j=bk(MWseA4juC9x$Scc62;T{qI~;;11&S7I~qBX zXVBx+E%uJi;bFk%64SYEp*CpyK=LPSfp{P&abePm)VfvV`RF2oc36IZxK23TVuDSg znNhL9?bJPw02kJBwb7r#$#`(=y^?+0GvC0Z5zDB)%BvIJ`Tk3HJ3YQEXRicB*sS+x zutJssV;RT0A!dsh`&0%yXWi-Qh^%1q1U2!Ltz=9nlAy`1lS{X)lkoate&klIg;L;Tna zJm;G}R||E^Rb7vwG)@Ag$Red5!4S6cjAR#j}| zL4Kj%*;LX#Z!0k67*P`PqR8qO?}e|Q^@z&P&{eu(66Wj%1@H_hQA2an5weE9+HyFAMc_?Oew`64mJdH+iNqU%{wRkFs+AwM>Stfwf7rz-@o4#}ew_K0Z z9`q1NF7s^s#4vmdF~~NcnOPM|iIYPTlnnMzVpeZ6JGM(@VHpOlPUlNyqx;()-^a5@ z7^FN&U4p`PNScL;~hrM8SAt#`)Yh=jvsTtReE~Q5qb1{*ktTkVKd-B1hb@8QTmHEY0K4u*G(yNJC zW~thz;{8u(lhnkZ(#EP0k4B27gSMN!-|sSj$R_itV;5%Cg`5(VRFL1ad2J-`+AY1f zZc^UozTa!kjyTUzJ6_=*47>WfThhHT_7gCf`sTMK?sb_g5&!X? z{_<~>rmI?n3k@G7JU*Qk$}T8+(oe5*2H54u+c?WJ_~YW7;TZ9HBj9-0n!(f~2nY{! zAFA!nsz-0if|)^A>0garGZmhV-2Q1XsMQ5Ryf*xyDPnEuv-0D*XsF{`Neh0HgkRvF zwoFY+KctyK^-aZgYlpSok|MGHGGM>$|En=?Nq9763d+Z>8GJrB{c?2PRyyL%j)h`D`IQh(pJReB`1 zZ>o1E1)PU)+4oGZByxww>BEomUBVkvPnZajT`IuR>;CPQJd9lDg!O ze2M;BLF&^s-sDLqa6RsnCX!J`8nj34rzM4jKBC(;)sZC^_>9S`pDAU zcWpmXXmfkj!L}*_&aTc$%3alE#hGH0M)j{LqjT=Ndwlfn#-z7De+S6=WD4K1Mdl5l z7e&_RylNYe#C)rqml|- z8m=AQJ>^m+;@x48N>{ZX1Az`yo}bf$SK7lG$kncnPVKtQhFhk*5cH^6o+=n0SYy2Z zLHs5YNFo0ANnw08_O^*obNrVXygW+WQlk1m*47NFl=-VhUJlP!2++2LBHpN)wO(ll z5UA^&7n5ERcfC?dJ|&XhKnIKu@L8tOq>{nY_1?}H+RtYpN==W6%ZST5FWPR)Ck0b~ zUzDS(pl|D{4t)gJld^&oKDB%5=IWy((tY(e_VgdHf>x>WF$)mDHw^RydIeCAJfZNZ z?_5ztdv;6!{%oqLfEnR`O8zPTpS&-2Z~6VEB?G7Go_KBmd;LC_T$26n390<_ V_oMWV`;0L4zNX$?g1YsK{{qVPsw4ma literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-step-diagram.png b/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-step-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..85a91de789201124a2fe38b75efb5a2c7d059407 GIT binary patch literal 19014 zcmdS>XH-*P)IN$Lf++k1L5k9%6e&^^5$UKj>D^F-D2UXElz^0gs7MEqDlO6>H0eE2 zdXe5F0YVQw^aMhZ6W{lL&bRaFez^B$jO@L}8e`9_`m8yh`Rqg*8){!=1BKg(kJHL2S!AUD{NeoYF51Hn zLngtS*Rpoe_$_5pCIvd=on3RgZU2D?wPDoHe;>`9wf+@8EPnXK@UL*=+U21CskjjO z|K$oEmp`j3S24#cM*|pq?Gg&tim&ontUQO768Cc4e2cj3Y6}R&tPlt&U=YC1|A#cL zGU`UWS;R>JV9)GGJLvJNYCc2#6bJ|sa=RcEIxw@*rgjpuglm8v!Nz$g_*82Q#|#{$ z)q1W%Nt?$%V)4?pxwnGZ%3t@B3Y;K~dK|6dnv~`Oh6SUcCNwmHQ^Fsm83LA&s!pqr z-*E;7XdT|J9hxa7$PrrtCw@e&l6=B(5ntKm}DDBZh)(>y%s+aeVT71?DDHE+Zjv9{kR>tQwffyT5Iv!} z(~lat-X8V^2aza>>ts}NVP~Bv1$Sb0QUNt(&5^qywMDYkT&q<|9*uF;uBz$g#STO} z)SG^RHE@X2KH_2BledD+$g^zmwiSFIcmapmZ+5E4Y}hu&=3st~mrh(di`8Djs%CGX zFO{y_E1k9(D<bGF!paDixO?lC`LC5)E%-e&w9!CN}8t`K4^4MFXiPkJ^z zIR09068p44kWwoK@M13-(Qs+SQg z@fH&^p(m_p)Bv@witn*aQ$0Awaj}m+mdmht2+}~+vD51tRdP*Q>zbi?l|DoiH zx$aSF2%Ihf`<)jdZG_)CgjbT@!#4Ga{RKdCqg)hms&tbV9>Mw|E489yhfDjNA>&8y z=M`u$cywbKB6i=(FAilS@kC(==dObK5p(|gwiaX=!wGiLm9y*-sy90xSuqKn7{}Gc zonZGq!w!!(RhvkY{Pm@U-W8?JlUC8bEM$h^7qtF za;tC;B8N6^r`WP9^1 z*Q~DDY0?;(>EsjDlsHYXWt0pvl#O3-19*Z&4oe@!s$yQq+dObNQY|kTI_MRDvdC+t zT^(d+(T+}9y{K)kYpT(6f|$FKtjXfgX#{3hdI1#~4k;J#HCKFlZkXL;?Moh2ZEgFE z3inW}hmTJ{j}(-k8rTvr5#DW@!UFQ0hk%O?eKO>SDfu7NQX(frPzKZE)47KCL9_n9 z=NpDp5c+7$OhD}u4mPWOL^`1%%rdCbh^Nef4LwRaAvVJtiR)WxLh|RxUeuatkcl;<`HcEU|!;?Sjoob|{;rciAhZU*k zo%in;N%js%SEyhovjWVpE0fQcgC`Zby<jIsk z;feHh4=Q$#zx||`S$JJUb8XVKe|?;a&I7*b6_^-e;LaiMfvctgx?w-sz=0QDm%!{JZ^sU?S*)*Fkd4s`?oFlHsof?Zqjt$sr< zU!c`Q%UcX5cSYH^M5dawv;3V>I<4R#&z5t9-|hJ7)$1Qrnq+aa$0`ut)6VV}f7Txq z(68o#$0FW;r}6w8z?+#`p}g?kDEpb8zd){)+~UI&<(-eYu+cYOXua#?A=7y9f_Zbj zMpd#=Z4Aric>V881h^>1g=E+AHU8V$G}eU0%x~zd#og{HkOI`24$mUID|R(TqI)O|jTxC4=~Xv$%Q)ok2lndJ~!I!%K7L9nQX2Z1jxoA6zkZcO>0 z0i4Vq_Uxsv#A!}XFhGavrp)?U*()cG~AMp?NlabCaPC~oU<+&hh&E9@r95dC*m45 zTj9F}aVEz<@4LXmP=(QrCfcGVa6_xg8#9M>O@<8(kqTx0+*9)AbLa~7b^hP`{@uK9 zr6&^GX`eyOAbh9$RKPnPy_8tkd77DL9F+ilaFwSlR~lX7kdB;|!j2U9297Ie6Qjc} zG@l_S7GN0>$rI1flbg$s{~OgfwHAs@WTh(<-Cn5V!WE5nS4vIapIfC~j^ZkTvt1oB ziklQ&@=K1MDeS;^JXHqGF|+}@`i5D`#V&rAc2COl9t3VE`&Uf%xT?>!?ZJOnjp@xi zi$c%9lIN5vWl-9E3Oj1P^NKhb9`~pA50Gol4f{3XN`C&`p8bHe({oN?$M*a!Tv@!_ zJDnjY@dvl%Qo~hr^{p4=2Y#c>T^4$Bnzm0{8 zvriLQ>K{PAkjsA*yhi88^3rle*r}91_`+JGGO2Jla*c*&p!2Eb-UXVM`=cFB*+muM zV^q(C496EUvC!P(XL``bN%ay#fln(kUX<3Rs!j=Bpt017Shz^@>qX8iUg|oK`shQA ze+Fzl!}40!+75Oy#FuGk9zW2prvDdK+_;v%{_jrn-(@=0fA?P>9#bFx|Bs5l?+AN~ z*JVZjr``8%ePsDpxOeN?zvz#K<|1wA|BqJKFUv|hju#rZV285)4zPKz^d>|~@$-Dt z0r$St8%dS?ZrkE3Nm8+W6UVQT&L6m46}kH%=v&Zr36Y*SK0OwdqY?9ptjqsz)0L*n zj5zEYQa;po|2M_A-t~(W<;U_o;-t{(f10O5XtdFh)&?`izg*>UmbejZW~5U0Q&<5Z zd#3gnIN_2Ve74c0CzsC^e1+ys-%Y1X6KA1Q;d55~j7WNf;#j#&1E*HTVMzx|(VUW8 zQF#Wdi*Y?=L7<5>vrZn=1p3I57609nK~G~-lOZmHsh~?kK!1B zBua~vaz@6bx@YhEQtV&r`}z#xf;E=)t+v7o{=k*Gn0>U3%jKj|p z>A2hZn~gbXl8wG;DZU@>2=k~mLV53|_#8K=2-^k>aqiwfYX8y^&H}sPq|Js`^4+%V z0}z`sSU8ptk#kChMvutrnwRT^b1HUy$R9*|une6tM;{t-N`9}D^t3Wit5IKdW-~zN z3v*$TR)4X@X33HpU6+>+M(UUmXALz&ilsMfWm$Mbl=%o5)E*MEFWZBamM7ZPvXG=B zM`V|trY&F4Oq}dD?Se_)kacx{^>N76o{%2DAZ;v3))NhGC}=<&mv3lF2bcs*mfB4c$xgp} z)X4isCk;rbZDk2uJ(eY+I;WI^-AQg&)i#ME1tP1iy;;@*;Sj{#qlOS-L+L!R(BrJ| z=%`4ojX1wlceccS^KLrgc3JJes&@JVr9UIMwXbWi|4w) zo_A;=>t@3_EJXiN@DfZMDd>5U5<-fJ{B-SL(iO)5P*(Wnzu(2hwKKm;96vf%tekG! zg@hr44l^*bL^4;HVkiG z1H;Nr+v{6^^WT7czqTz~w|UAUfV?=bByr{OT%d~apR;+Es|D{*b99!-{g}pb8CTF3 z(<{eWHo+#Nlh&v8*Ku`Y)_d62-{>QVrG@d^ z(S{lqEB%vkQOTmx#`u`Lgc~NjFss)J`iVodn5GE+in8U@kcHNxFI<@!*+e&(VZ(ge z^Ue~7N!9L1pWc^_jjorq>yJECV@mKVw^k$UWesr23V#TQ_=G$Mou8{}nbpvGs5B*R z$Yuqbg&Us+LMrwT{U5i_%b6d4AZ%h)B-r@2rD@+%3@>o41hrfaGFV>4dJl|x(E*FeUn5gBUU z9!{PfLI=sN`)FD7BJ&iS0zGW zE);(36qbu0dRNSbZvwGxE>BErMm-}_TH7GEqFKB8(o!YD5$h6rb2(G1w;69%#x!2p z(N>6t>KjHeYsMa(O(PN4-gIwpanoAlKR5Z}oObrA_qz+vjvi$i8>dC+xlaEh_}(-q z1X`u0a@w`S5!;73yw5%c(y*SgDw61u^`z%p zHE)N-?IUAnrLj-;-|vm9o@I-Qg>zK3-N3k!h)Z0^#&_9K6WlZN@ua`;9N-+^DNKMg zb5&{Vu~)dLdpybx%+o*_!krJ<+aR$H#Rhx|c5>%GES>ZMp0(~F&yhaZ(dCV}5K6h` z$l_E>d;v=cIrJg=WFtDaT%*NO1D2#4e9=XS5M-ywGEtved<>vO@~-MMDq4#@_!zpgF33YTwI{AbDB{-qG_ z_~#7Bto5a0c-u1R+wBz%!A&8@pI&br8wDq^s3P)Y)iEN=b=$d(Ldeb)Rh)*$nG+Am z$78;Re39>OOk;E0ChKl0K=^>@-tSvImMPOs^M6lE7&R>v!#=lWWm7D)t-qY)Kn*_b zW+}>H9MIa_kPiW%le|F5z-p+%0Xv}9J`kv4T*6lif`Y(#soRFQjR)u|{PHtk&~V-r zDheFFnJ=tqKOLol@IbQDEt_gUwPfETi&6GQXZr}%KH5=)hBQgiX3~i@-e=094TkDY6YScP6@~4!^;#hlM(NM6tOWycdOoE z6S=UZO&pa|d|o>Phe~tbg}xZbWd+}G0yX!zUaxCG3B>)-2H}n;iZ6d*!A! z!^-Q~K2e$6h$8N>OO;=aKi^Vnrw%L3El{aYmhD}@Fs(i@CYeRzCn-BT1Rj^5Wi%J} zb-lo0UFrU2s#Zr{T-*xw)iM`%O0@b$jc@LdTia?}9qWXQ)L(xYR}-$)5kz-Z#EP>S zw`Q@A(VS{C_Dp|=_3px7|Gqmye|#`%gx@R`5eh8cz`C0FB8Mikql@V$f}<7CE%~z- zx%$5Ohx>uPt^>R(R#gR@7icyA9DNn70&%uIYM3Se`YQ%fKhoL%{pgI1&y3a>TLC^t zkC44!HP1S4Js?L+@? zCyhp}9x?ZCPw#UGzyIp}WvIfQdFrRiWsN``L7NH`UVxRW8Xh%YB+&cLOUX@$UZ5SiuTIB3g_T^4E&iSNF6F*6D9+vD z;m;7dDBmt9>d6Ka_dx4Kod-_>CYp7L7wk7~@F-c;Mcb=Gx+NHVT?ysC>9dsyGx5LW8=HNKcWa(z=1h(iEj0O|vvb$RJK@UdMUo_d zoj#b?L}K7_gkaP`=o#W94=?=70hw~=kJsLM-I;Oxy>7A%wupi}Dv-8SVBrHH%aa@x z!+Mw#!+?ss34%MDS9Rp0w1sjcrnmPwMy7Nw%?^f2+ z!h16x%*p2TT3l9U-(_TUOnk%1T4Y}Py9pmvFAhM8>B>pP$!&m03y{hk8hwk58Rksa zMIG&@h6Ry9FwaJ_lNHj&>LO&uJ&0v9Va}a!iWIFk(GKVskP@9A5UKgD!_OJMo|tk~ zdiJl-u5hnxvnb}M&k3rxY-?(Tsi(yhXB~NIn5h=NJ@PZz>u~$y&02rE^)dEM4~p=H7X!uL&Y)y^kH`<&1B(iMUP}yw($B#hU+j(;<_+2#2yNsX0u{Ik*GmRpXdieLq9v z*eW&dged?D7 z$JwafrEXSM7Lk6J^_s%o=B!L$NGJU63OrVIf)oz99U6aAn)dt> z<72q_)w}B6)}n}tkofR%KT|^rD&DKm_Nl%YMH(@LLL_c{=u~F zvN8O|d`y;I@}iHeyb!an#iY2D&9lPI*3uKe-LhJ%h2q^a>Vg8t@mlRHn76#>nHH*_ z^B`?Sjnsx91@A{ppR~bGDwI;H)F8$VCQ#I9o;J`?F8_}-6z>t_yClm;e-9<~3%}qD zrDdHq*;i%;mhLNxi%Gzr%jK>!+z;Uw323o4DEpAtZ+&px?zU=jjOf{mG3R8z9i>Yx z2mLCn9wIHH%8#5B){GE<$Keq#d3Q6MUY<4 zpZ^Pk#Zw(B@_LPk-?2x{v|@h%j;s$z3vG-WLV1q^9=o@Eek36UF`2$0`H!}MSeuKE z3F}_!s1?2rhJ)FWjG8zW@_E6L_r(HjoBBIt5@lMo2J7Ky)0LIX{nxm7n zGuz}{5PVu1OgS0y{&WpLpw1I2y#izJN)16BmcqD|NLvfTAenvM2WcQU9b!a1m!EU| zh5#smNTm#Xojh5hdt~X!V#~oMMhe_fY;atuvNI$JvYN?0IAVOJt=0aYCo;2m>=zV2 z2Ry&4^wk*ItPW49ZxjA|P2y3tuu)u+F|g-vVOeJV=rzS9elPy_3oEWY2luOsDkhU9 zMyL%MAmK5{+=Qg4vhX&!#PUjhaCBq1&P}C{9!YM#Q&vvp=O9*=a#T^6N{sI3zMrXG zGm>bbUd2s;H&I{3&Nd4c)dG4xX+~*Ier*)LA}Y<<)9|7;vf0(#nM%RkjV|e9`5#s% z7DhNo*Li!O8HjY$PT*0g6nsqhx-la65ms%^H#3g7NEvbUd3I93(4#|asYv|6wQ8xJ zEA`RCzWx(oVljL?ba)oHE|kacG`Zaz;72|Q=4$j?hcMA?YDhlT&h zpKX_==F;>e)`3nJfv7uajkSxlL+UlZExPPkbtmddtaA(}#5mXTzKhztF@d4$cJviK zf$yk3+_AB^_#z~Pe?y>uC7enL{z>N0aq4PBh~jUs#p8l|X@5>6^X|@N)5xIb4CX?~4$c@sY_qxqh)*Ti08_+<4V4YxDr&Sm;_noYHN}=?AgLb@L+q@ zfbWXXWP*7AtH9g36uKtcfs><<$eD^<>B>@EvM?m(_QX^w%UM4VVHy!MGf}2E;TdG| zo#lIe`75s^`mQfiz_!HVm*7Y0CNublX@ zgloim-~d*Fmi^9RI6%tIF&aKbXv+^37bD@VPj++p08LvAdfb%Hymq_Cmzg`X$;=Gc^QGHSR^J>_Q zfok@bRqGZDl_GYcc@?#Zo;_A|;5k|;3s{$9s-Wj+Ttz`abEfyr{TJR<{P8z|G0}Q| zuviW*KWpiIY0tGt9hal8@{*yrtz$^H+qRdqLsJF8?!|XG(*_*7;(T+xG}TJi7ou>#M(KuE{amGXC1W!Ch9lvt`ZALL9fWjf(F#>PYiDpHkPw28|KE=Y?6 zvK;n>R&WLCIi~8z;c34~p#LFz%A2Y2W@903EbpNVlzBWG{WH69@bx3Rzq#>(WR}EtdFEd(tzTh>g2OlaZu-7+5n=gD^3O-+thHXKu})t zI^8FCfw{nRr7WmgD|ln&+dLV-62~0}n^aQDA+%0`UtcSub*rLNGkghWPQFckQ@TDj zZ_#r=9yn7yy-%v2Ye+s8Q{NO!`Ccs%rn)Cy|L52ez^S{Sq&>-MCMnIEWfe!4_MgSw zqQ11+*VXj3yve+oe2JeU8%B{3*lN#2(|Y)=j>-L2T^K;ahd(aZ8Q>!Hxmy7%BO$(g zFc@Hj7nhPO$B#ejBvSf!Ak2kBCPUUkDpHGOTjedo(J{LjxYAuebYKa1!qYV)<85x<>C)U$_sav-K!LR%ECS9K7^W}dt1)4@jhlZaznmdYmTv>=N=}NrN3lZ< zk{$JHlMHojLr?03DP4mZ>XYV+w<}=Pj z)u)!vyscFu!sU8Coj%=}JMl{&uWQ?ibM(X^q+`!NYG1NfG@38^bxtTK9L39zz0gv1 zoe&nx*(U53rJpd6s*GtthTThuSoMU9H5aUYxB?6v_5wFWcY1U0KZic|<(2l6C~{_S zODMwgX^zJC^AY5+nSu;kte-5eX!cBb9^1l@Cq)JMhZ9$`5!0Bm)jnb<>d z=y~<1)N*lFeWWk$vUjaW4nr~_BjLx0?|{H9C^8-OXVes&h>=#g)_bQvC_>ZXW_=y| zb}!4CL67>vFu?UX>FpuLC1XK%`lLcJ#eGVSkH`qVn~@URB&rTyH+$(@3}(LGKwSJE4-4~4z|j|egCW`CMzgIE*d|Xr5 z3f>1@)_*e^Z`a}7{ARdf`k{ngupN zep~s!1|H4KpP2ENAL497TBHx;?!n}50jE4BVn>dC%fynUX_s!$BYtYvyDKhedQY=(=>%-n9sI$!BSdd;7C zqAobAd8)R5-Pp2=LmLL)sD%c8bi1A|nxz$ITOxo0O*((@b{{y9GF$sGxvR<$9j-{U z)k4*O->uut0WzO>=pkEN$^=^Hdp^yK0Ry)J4UH!A&*b~$!s!2gvG#d2>Pc=9IWJWM zDxI{+zu_2AJyY|LNc!a$_Cb00r~BBCFYxW+m7`4VL?)Q>SP4!ZgxIX97&5>l=1dz@ z>`b@$5uXGE(voI3_AY5fu+m{K(j*pH(=`7qCR z>70Rk>x^bZf6K&?hwt(*15|_Tt+8^0$?m0`hsD-qeQ_0U?-vDuATSHb|4i5PcYM%O zKi(>0;mbZM7=jhznNjA7QXk7bc-Mu?#!Yd)dh~yDw8y~=XmZ7w zGp-rqHrMWNfU)JQZQsv#6F6%6R=&1XVrw7iKnwzw?Wc=nU*0mYH3}Y_M!!3n!;F8* z){f$%gK+T0-s&6;aeC?u2vDnlE&Uj;_TK(mWj}fB^7AKcNP;m3|IMa5J5m|ynNFcB z(Z2;Q2U-5d`DCGE>7ECz8sK-rhbeXI7k`XH?t*(p{fZnn0wJ^@%%P%&3wsG(z=@M^ z`Z0Rw>ARQXg1uj4zF$5M)6l9o*T$+#Z!vzm9F)dRr+P$B3pjf{PZ!K6C~c4z$)7V= zx=X;pClfQYqB68716oR{-(48bpQQF>3J--JwO)Ahjj9g#C7ZC;OJx#sSDFZM=uY-^ zDU6RE> zf=BPIy$b;v*CS*{BNRtRxT?h}-_0>p8_YOoZeJP*JIHr5gO>ZoVt6j;3O`>9W&HT{ zc`JeX$eml27q>a0ZS9y}n!cdVlitrK^=b9kCg0=)%$UOD!Z19{ulfID@Y=i3{W$Bp zD_LCozLa=w)J3}vnwR_u;D0%;PoVGIQ!MB62RY&D$D!#X1GLVES7-q#oYH&A+?-*a zR+X)?X?dV3{j^M53%btLj&#mAahvyL?rIjW4)Yzs)4!$gL5`- zIQnvPJrcj`$rW!>?`)m#k|SGOxcg|n{wnIMAqaL#EXi%xopnmabO0sq99;Al&Q79= zh#!-pf5D8d5q>5)o5U+qWI<83OV7|{)>$pu&TkGQp;AS*OQmX+kGth}k!W699*Rw_EKe7JRVt?){LTw@!%IWRLiUYz>D!U!gJu68wY51F5 z@KH+MPIDo|Dt4=Sr)?~MXP{>!P|?Vvbf*GIKI5>Fs=>qELMMBfSGN$6Yj zCGdI1XmIU~yp!7*{g{TVi8{Bpi3E68zU%AeZKxJ47C@&eA-wsab;XxEk_}R^`R53s zc)t>b6>f8o)x(w4Bqx@ZZf!B!U?K;?w^}x79)1_g?Hb*F3^i2L<{RcKRMh1&3Q3e! zuyGf0F^4?e38d1@96M`r4dv@9Gbtzwn3em+0|V0|cs#VW{DdntFJ92lah>}pBVu6M zX5_RrW(YXFKbDH9{Ru=jDh8^tYX|liqVocUVY!&rU8`24N#=Cj6W2wIfNS2YmRbEZ z(`nx>;9v?oLCNe9%2H0o_BeRv*-Lc7diC&t*0&q<-2c;~DCLU_!vNojWNDJTcvnOUPo9_wm8RJJ@ zsoYvT%f&{#-wingrvg?5L%~|PW__YCca72}8O8}|Dq`ra&6vTPFkXSR- zVb^3XFYAcSdi5vNrw2Y{x4K?y8+7Bt%*(~q>QAh7<@BkF!jX=UT-OKD#c3jQ*jyP@ zYFHUNqKbiINpU^EBlq0*+-Zn_o^-+!V!-`^_PgEzHucT&fm{d5CyPY!{TO@8!I z!EJ0Y=&8b0O^%gy-qSQEp9-&UyN$>2{?f2xO%o#F@tZ2;Qf3|B9MMWe;7nu~LJ&OO zd5TiZ234Cp?{e>EiDY|NEi#jkn{Rt#8d(B;EyCZXpU0{>USPX#QIqp_rDD+80e0dnJ~3qpO*3?)FC( zJ?(6w1UALb+$6&4b5mkW3A5e3Vpm#Y{p7C~kA-Zo$_=ruinK+qfLM{jFV&g%pqWt% zapqun{kLbPHVT7X2@hr>L^KphIe)a=0gf(LJ=1IwWQ-zW;`Y1+f3qL!wgxXSZAenqAJt*z*@U&;Myui ztv_3hzxWx&S;WsCw6fw>P~I6-vCr z`^{Sw9Uq(`#%~=|e;y6ayy#ISWixuhMy|e)s$9Egly@>D_~K3j2-p;PvTAa1*`Fqu zrq3i&bEe8n+LU0(6^b*ByN|kKQ)Kp53*X0LQw29gD+i2sBQ0_mv=}7pTl`#rL6h$L zy;;H7>?62u;@&jo#GvLW%MC@AqV0SMVG(_}S^?_|j^Oyh+U<*);kf0Kz12N@}#6YL)bw{6C&WGm;(kD;l_pZ#Ce_ z=R7fSG-ES$oa{(PL2g1Psf_EmL%fRIsOn1MO2*kO0F{hOw_Lpw)>nS&oHuRtPB8~v zu?;;Ax3KWpoLb+bkZ86{!06Ix`(Eu(A4!y)v}D^luaa+B@h#b_*9iA4)~psf?0<^V z0@h%f*9bM8dGZqaQ*r*+2?6p0T&2;8t^=H=iOy4(vp)ejH^lDheMf?TcWMl&0?ayC znq1+ifQoWA&J}a&@5=7%%+W+W&3@k6du4i!Fv4~D+)LT0lgT;3bn>6Ul2M0v+Y+j*GlM{E&Px6@ug0}NR)}$2NwZPT-TT~@K?fF<1Vc}GcACstBiay+Y!Jz zP-XqM2DR_=zp}<(%?peMj+31~)c#i`__N~HcF};CIzs-RWblLI#s3d9gDI{#rSZ^h z2k&>BbN;CD?3C=|GAButi?lKx5Td+8sma^uw!s;J8Y!iBQ@uAT23;_ReubsdnELI8 z%QT#Hr!`O<#U4fZg!x(zR!x5MX+9yAkFc%2AqgORp?tebHWr5MECVCvJcvP6S!d&I z!~Sf(GY`sMD`9W#I(_1uOvWiEsX|r=>C0Pfz&RhI+vhCjoe#LP#`c$c##0eT1(24w z!(p|Mxj1^7L!%=nhIn41hSq>b_KX3`BT$f}1}PNHuS=Dzwf-&tXdi%+ln!#;cy;u> zepHXNfndqBrW+JG@$*oN?cTURN9O(12)hbdQau!jM(WwbOfIj9wcBh@UZ}kYJDIvx6Nsx)%P+!TS{QI2?cUa_>Y< z&AJt_#nX@vrMNnw0{0W0^R7Hz7#52l&g9f)-tqK!i`dEW8OUNOx-0!x<}dLAY22xK zfdlyB3DXlv-2syogy9OtADgw29k}~_BepYz>l5{-YS%>^HeGMB?J$1q8xjbpWLCMi z4k6c%Gv-tltNMiN)O%lE3a%Fw7^PQGqWR#jDPSj{cNiX{NhakbMKMV={&-*aYPmbs zWoxRu7XQs_Z*O0Vss@@!Zg$udAS)<-iKAbBLKiahcy>6uK5k&v3k$pyC{6RybHv%6 zuRr|x(S-k)zYv8gs*>y^V$~?8{cY|u)xx&EGmc#t?Rb8JhB;pz&g$3O3Qpco zgVjyy9`E1m;}I-DRpW#9K0!g(2;Ou{!S_9#uF%}mLl7UaKvV;y4klS5#S;Kn!uD)a z&9!qDwOJ_vrj8$_>(2pABreL^GPmgtx)=sAMY9EDP=MZ9i5faR4hm7<$`ah=;#$2z zOCur9cA6gHHUY3&$F7tppzBSf-p~B4af52$rv{5E&{bb9(;}UOb}9I|q9Qav`5|e$ zXZUTMcPA;x(?vVH{h9!cgv^0I)r9#}Ls@NQ?y>G-7_()4|6FsU$fgIx$5R zdruE3MWS1*lJ@K{Aib)xxfT5C_g$Ja2E+4d>_oPv)s>f#L`wthc7(V}k%V>pFOZ=S z0&SSW$CZmu4E=?Rd@&n>83!0p$ln5%sWwE|w!uzRZtGMja-pL==Ub$>Hy$0*)@(mv z!KGI6{#RFFcu)S4szrpq=22ef~RIr&a$r~$o?Z)JK{zWEPF_)GWfp4hvUZrM(wJg*WJDI z$KSxn)i9%1xAQ|s!W)h9bm|;MtK)wGI4isX#K#4zqF&OTm^$tu`C^vmfWUP`Pn0Xf ze`F^`$w+-+`ok~SwNBDKlcFLHR}L{_p$UV}zGqhJwG!Jf z4=j_IDcnqao;V@Osn^5uDQF+z*$K53k5kP!7O)xtob9A0N1xD|Z-oU}*fy69jRrGL zef$NZ=_Kv#?+N`9$cZTD*FF9K*L;Jj_`@5i*Q0mMb%tPHOwJtCIN|zl5;?7&ZCc&U ziZ2QK6}~tEsp_%%_^a|#sM^0+Ee+URu3#I+f9=T2)oA>+VH%6jyzTBmcWRbROsDe( zrD91nS^wvxdOlvApZsp*(?WpOhKME>?)@goQ}Xip{l~LZC3>sF{@aAgXNV1fUEu|X zqHNjd=}1T?>A*z3by(H>&(b6Dxq@OknqLCfG=qVjFkL!?z)yc}27f|y{8_V3-ewfa zEl%6)YG9;iER9$*67NUx%w1N!w^`KJ1sbH7TE?H#g8$ z|ET|q{)6V@TyiJ_zo>0aeWWtQjut~fF?NNQ9Y<69yyZoutShs_omJ81w9{mXJf^vkoex-cPSIJRXOUkDBK? z?p8F~|AX)74yuN%n@hmk_3js!QZg9pVu~)2`o@;1^jYu*m3uho=Jr*s%<^# zJ+s)}kW=mY+qNqo7NSz_)mUifp}8ti55{7}!5e@g#n+s^M~WO6u0?$>|TAGum@wXFzC>lg*FU21WTsnHevB|8(iKeK^V-RmmheM0=QN`3iPx9UFiNClbs zJT6_{w2-ULa~1z0t`yzV$9>{dZ!KRLA6AGm98w{mn8YGyXz7Brqz*(l@c$&70r(b7 zRve$w^HXSKaNGQToL@c=age-$a;x0gkD_@wW9&psOar%|~kI!3WU9@}Uf zI(@#g<5SY7XDH*d>Hr{Gdf>~%=d@iMpiJi^>G{bm@=HWX#!K|2g7=*hSLw+1Ij7DZ zr|(+Aip_0ZOi`%m-3AiW#5$2ZE8rS|vn|jAxn}@b~=`*zG%w?{x@f6s* zyw#j3*0;4WvJNM|9Pk0sFPJ|9{eE}_dTy#f1(XuKfdu*ZB|CH*Rh?oq4Bhpfb}z-- z?MDIgje-vnH>g2_O(el)1&MFNWtDE(U1C2qUnwzQ2PHx+UtC<{Kp*5EYDmr1`ESek z{!A-AX&ZCZpI(P@4;q;!^I`Q??YpV0)s=;R{|k^9u7;UagEKxdG=3a>ryc^7r5!oG zV9IhUFqjlqi#t^k^)aD!lTVE{ZtZu=AY9O4OLx2EK> ziefy0qm!PHA-1!h+yVqX7kEnEl{zi-4hD&Yq{r4L_Qp36Q80n?{LM1ysD2#Pd04&Y zn40rMvt6ob<(no__~(yaEsMdGen0+A*@jLZ+W`JG9(vx1c+#O7#XI0=RQv95U5RpG z0(4`sQoQXc%cc9kv-87YBRmF!o4vLkt^=%|)U8eT9)0-8?rx8fA}E5U)A|~L&l&Dr zX_|Kbp|%V4WN50N#s^cy@67~ij)tVW(s3qWBKRslZfjw2d1C|`UoeM$#K9bssb(qU zK47a!Zm|n^D}7x4O7-2(Cjyj@Oj4q>I-s+$RNY}o*h?GE^{;@5r|R6RChT<*j2YTw zm2X!Ldk|Qhds|c>hxMGT-~!kTD7-78@`js!_2t9-_1gSFf#>NGZb|9mNhxMwh$39- z4%ZYQQc!_qm9PQoRFM$iJOz(IY6rE+gKrfFFR*sCnZODWl1@9Db*oLIY@h2zR-dFU zDhH*7nBTMi=7W&c{hshLb)>SiEN{5hfcnOM)4SDMdp0A!VJOQhSa@kg`g$6?-mD%( z^TCt4^E!{m(vvdu_;y6R)NTm<_4f4W*C3;gG7rv)qHv-AN;OjMylp?PDKEU*lADy_ z(Ykx+g2T;Q#BBF|IU2(R7{QJ$y16_-%wmdHYdP==*i7#sxZlb4%s3(I69Y@dIiH>j zEzMDw_rXJ?5bkB&SB~qh;T=>L7Z`EoJ*?7jl0Ms`U|TduXR~UB9ktUuO7=>~JK`%) zlp9?A!PdWR!XuuFkT$=mU5V&FPVqcmMROg#F}g_?eATv-wAc~uW=-@fuix$WJJhdRd+!1)luW3txy7X!{C_obKK@MSaU9<%NlNl7CqIg; zOny}2xH7UIer=gZDOAqM{HXaEljZj{Y++j{>8yp3mHaxI`H|#TPDHk%W_Vi*In+n| z@UVxL)WmuaB(NdBYvqsSHxV7$I%TF_sE%JetE8?izq(;kuhU$EGW@(_n)B$8u)D;x zI$Y;$lwGsAhrlY2Bc&GklG+EXjxc?8$Uyy+ajZ_u`%3t)J(k6Ho(l~83Xwipa)Ub~ zUBY}&qMK@;{*3Z+C{cWy@6$UzylWYByM=GZJnL3t9Zh{jri_oamz1v7>my0!xA^3S zYrDGTu=d3a8a0(RKTDTEYg?z1uPTxdg%P1nhm)~N%L$J9VrHCQ0*j!Qq8m_IuH|2T zPsM1eX%XXv<}uc(ry&9Msy~1xGA&g02w{yn+ZSxp;tKSN1I^uTbQ#yG5;$Ypa|hM2 zE_68%@U+v-2dtUu7D5$m{kikvjENZAqm&M{sa6&T zR&ARx@?GhqN`t7jw?s91zPuS;Eo=FHpQOGbRUxM@vUFB-Edm7Uhv^Y|S))%ONAAj* zs($h$u`#h|7$z>MN!LPnSiUwm(XuMwvuwOCf8+uH%akpNC1MWLJG|#uX3nov8hz$6 zmb64)Z;tC1B>?Nc4u&MDm8@#R%?V8pgvuUMZB%GR zPEh#%Z$J?@6cc!Y(ygWLt-p+moUV8qt+YJ$j3PtG=Z`qt+Ymg|zfOX!+{3b0!BWFd zdA$zCP?+hP+^i1YG`WClQ+scE_8=2HG;uHlSy=W{GPYQVSJl%{$D7(Te{6Q`cbDc1(@|S8xHpBTjEQr*e0Ho4{%qWFpi>#!>uLtxmTz# z&oQ@3V$<>TD-t6>#rd-731>l>Q~{`--CB^XKKXb-DyTcI74!K@)((_TkTBUI^nGqk=m(+!sOe-8WqZFW+mgt~ z`}2VR8B&w3*_49X^c!crQNweQebJ)dxlugevJJ2F7Zf77b_ z|6_dhax0(bbM?SCs~`e{43{(A6MaP__{oPUo1knRg2Vk P83^PEN5d*kUQGN8TyyO3 literal 0 HcmV?d00001 From f8139e4739e10a76d053cfe274ff02aa46cdf40d Mon Sep 17 00:00:00 2001 From: Samantha Robertson Date: Tue, 26 Jan 2021 15:04:29 -0800 Subject: [PATCH 19/39] Fixing typos and updating --- .../images/false-positives-indicators.png | Bin 14102 -> 15655 bytes .../images/false-positives-overview.png | Bin 27939 -> 27865 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-indicators.png index 733db3cb46935defdc17fb312d25c927ea95f178..e30347f04cfea0fcb937b7a1730202b307750fc9 100644 GIT binary patch literal 15655 zcmd6Ohg(xi*Kfpviim=MQbnYfC`fNd=}ka-7diAMy@Ui5=>jTEy7VRiq?ZJw3(`v{ zfk+7fLMI^*0^D%U``&-x-uv8dKTk4y&n~lO&CDvlwI*8kr7HDJrkel&fLdKm=@kG# zaYR1fyMB%Q5C73gK`w5*RWtPl0H|m$ewW7PAtV6cAwXT}xj{hYR+ihQo3SMZ5w0kyK*?0{1`_OuOtI*d4U%xFo_SJsXiWrK$nRs3NwMZdYpF2^_<@(Ua z{X9qBv99QfSH4r!;_U0~>%kXg=#6*nl>b!R`TtzuId+fk zVCEcW32Li6?i%&M=EzH(fF}u=+3uhdP5U;5Bg%6L7$zh*&=&Gf7fdKA$HGFo8*;?y z=Fis7xf_X-4m)!A`N|WA^`#nXrJ{>*301Gw=az0bTc-oHO@^KSp|hSV3AyMmz-aKX zwvTf#X}B%@_GxdM>@KGNnOgo;VoK8|?FjK`l_z7Qll}Akhd`N&r|E2pubdTC&7XU_ zS|JCNHX=fNw|h=6UEC^!)n?cmv4`98h$hr1Vy&9*Jq@)4FfPXaH= z(_Vc$5E1;DOOop^mnHdL&YK%th!2)v!58DCZreW12q-Z6BnsKGwZ-^s-h}?x@%hK$ zBZ@+oCC6|*lf1?R-a+K}&XXCr?$V|GO~UyOjPa)2uqWNPIpm|KHE8dmwQ1#gjXy1s z5{yAk3*{~ow#=XVYW@gB4+%ehl+WA1zL_vBv&lwuq~IKN))Vx{<$YN#5KHfxfTG zN~>Wy!C+KK+TjX?6#UABl|{-{HE{2z!qExrGj;R{?~%E^uI2jTuChX^(X;+hs&K97 zR_9kN+Mh-c$7`zOHbO1!lCXbN?+T8(aS)MRgQ?H91?fOT2VBg{`-yrbDjXRZYqfpd z?)RF#c;dOc)JvVHAJi zkQxR3S4uuy*?UA6HE?#k3O{F9^n{%!38gum571b0UaLzL44<(X@xO;JluQ76dFc;$ z5g~D|6Wj|IEZY>x-~5@n`yFpjV;Lqt2rAF7s?ejG4zkz8)qexa7gOjeNQL3*>aGs@}ROxQus?x;Io! z3GeX+a-JZH{E@3bJ9(>^42+g1ym2Qa-um~F#dUH6p_Z6`6io~EGr;a|ihM)oC3^#| z+zJ=h%Q+dx7bLX*6q#iUHc?1lVcJ3(i~XZ@08_oZJTo1{5hX;ha>g@>&o++)E*?Ep zq>=Y|G zf38zK$BN$X=P|-~vx4`3t#E}>@Vv}avp$(c7_o^Z$pD^Ahyo~woBJ(?dal54o-cMr zO5g)RD;!wq0qEO+NB`V?emz+0KdR{p1^WeQuV4HtTLIkvshAovZX+5#Iu4x;!FnhOXEj7vD8+!<&P$yfrYsz1j;5r@wMYzc$>UbDhiUuZ!WaUNsGH{xL@`#Sueui zXhem&^k&`?$n_C`fd{U2zQ}&I_}$CkszuOGqd@)3tR% z1T4pa)(tfNA#ddf?&i!{#Jy|Oy>qs`v)%N#8a(2ezh6*mYS&V{&+W-Pka2bUo{y$F znH)^Kan?z6&QUaMxjdc{Hvm!L+|`sbtyq={Do=c(b{SNOG&kC4`bg0!mt~nYDd$)j zj23W6YgsXpO<9F`7U@VjBPO!%CUjqWrocEqc$zc5@s5Q_qRKRBXMVcuu90*prB}b) znr$~LhqLbFH0&U2N6R1SNeMGG?@GF|P^LSVC*J9~l={smqx>L2p6FN&>zlJb-Ek(k zI!S5pnvAIHzuESIQw#VhU?vIQfQm(tm*JDVN$l?eybNaGaig{})96ouAH!=K-LG~KxVxzmoFTyukQxe-q$yef-&Cu-D*cccVUF`$+-T9>Q)T7Fr6@V@9 z*je}i+1|JkwO$b5Jqt{iXeRA2X2~yZ3KVS`BYNS+_}ZLFT1e^0Q$t$a!lR6`>*@!R zo=lBy`m#w~jdRb3JM}HF(=?=ZnoZ4}TsOV=G3Bjt>rK+W%}Nn+%zM05xcUh1O)q>r zx>zD-Jp361iSM*yy|et>y&t>|NE2y-`(j@6xf>eKupSTlZInjVKWUm8J^y00tLc3c zXjq+}>yzc=bRUduT$=OdX7NjHONZ#0jJ3+HA9{b&cMpGk5Z6BJriJH5 zhEqk;YNUyXKV%rMyZLxfG;FIo$%YhBa!}1^;Rh8;q%}VD0xlGPEM=r*)xT!gQ~Ql< zJN|yqD!|g8)NFkgg}C)oj?+suT)-&Bd1YR4<9(4s`KO+$UX?MAA+JgX1bFFMJ!Nr7 zI$PV=C(R2C|$XI`pKm?J%hV1oh;Xq?U-?ZnIv3ukG{F)53c zxH}5oy6qe&NpPR-%Jl&5h(OrJZv1(9OQIG^$W#IEs|=honCvUA!#Upc<5R|_A(Pir zuG-&=uSPU*k(~S3`x6;A!%laHOxU_CA0?R^_qn=j6zemn)~>zr3LmmE&1eW?yy z>6p)FwM0mV$%AO_5Pf7d^W8U%R#cBPUNm>{cnP2rf-3+3iP=8+a zu@v?QK)VuSHMxQX+npBj$7u&B!dbNz! zi~H*)tbr>rd#p)5F7E)^5%39E>M4nQR0|w9GW8s3pnF)9$ZSTH3lHSv$sSgYvZfuU zc++p6Hd@({1!Tzc9P>}zb+Pf+@6%yu(x>O}^r{%|$43mIZG`HcmX286a*EYZs>!AG z8UTU^{`d@bmImj`rs)U|cTPI*SPqrIY3HpZj}#tLm*;i8YJZSVV9!<8DAtvvIa zpXYztu1$M^Sz6$Z-k=HoL3%5(M64gGkR)Hr4nc7|G~ zg_bEXg}m}dP%+2A<;9p8x!j@@;F2%ciY+oj1@9UvL2M6 z#BF4P&@{)x`9^hiu!bzRQ8gjKq2De$=4m z1LnoXaZt1od>n7P?U-5Ho=_jW;dG$eBGFeyZQYwKXveSfqwY=}*uh#>sr;tqaJ^h5 z{|y@QTz_h4P;Xj)>TE2DY{@@&)^b&JF^7oVf;hd6h)ZnpvUpee)^SNAohGNBm2f8| zN)8qyO4EQ)Qpst2H#jcAN;K#iy~6S3JXLL?+A)V21E{^fzwg*)R-p1+Pnw7B(?tGq zyZu8?J3hike;e<=lEbEXW#pad)NH>R&@|p&AIQ6q5F>dW3w?T4>fU;(m1=aR#a}f9 z7$96l+%E)&Q&bBT;4p`MW*vw$aUO(Fw1}r`0{;DYZ#=)kuwXo>^0vio###a zl{C98={%d>FdF$KI~u?Ah>4G9BixQ;I{rjF@r#0GM81>pfPx=lZ(aG0PaM+F5{n5u zGvxnR68Bl1iuBCm?U<}>S3g_~$HL>Nd@`6TUa@B?Mo4;x)LiRW1^HBbsLY<>VQD*x zZEHkeQ-Dv49i;Mm=P3@ZjUbNl9k9~$5cUIZ+rpcJZ~B0L@oViP@;omucQ{RzMZq+Z zK+*HMm_(?-V$ZcHYG3PSD>gjIF?Q$2p9RcplROZ)-HjKuWb3&5k0e{bV`<-S-Pbr_k-p1ep zfj6;YE&66>ua2J@^*5P2S-k`Cn4i?tLhAU0OxI4ikyPn9i84VdTbTy|a4YYd0}QL0 zD$;DYQK{sgjaMvh#2)avBfZ%NMKqi+%jpW=Ji?9b;P(85Z_$3silpzj-7oJ;zhr|C zm((urtNfxl-cM(+1W&OffUAC3XSUH}$I~Rq^w|&n!@uQd^F(%-DF^efEomaln z!qb~rc2s(t4JK5YeQ-7VLzBDHlTyJ533UU!qp9lrSh^T~wpRH3%?w>&Z~OhzTc>~h zxy&L<$+gSl5k>>363Udf<^gMU*nWgWtS?4GE%PP8m6yLt!XS?VaP6tK8BT zypjQ|O1E78$E$v=`q#?NwXbVh_dLw00doUiwJlQSt=IwLl&jL?lt4>OikR+mV3vs9$;Qe zP;aVzFX>X~-owx5U=#rif{_4<-zdqAcBO3ZE_SXj#R7%1&6B}aaSqvm_HOQ%|B^tU z@c!$FZ7}~l7(XzE_df*_N7xnQTQD?dtLr|5FrDI)vs141v2#+m&w5~SK?Vxvw*Fh+ zO6@y^YZU5i3-yvL2XHYru!P`^ zLy{qs^lHN11%0O-6 z1y+HH26>NbOAInh2kd}Q=CVLcOT_=j)XnuoOM> zcb2c`Mrm;om2l&0<1bfU3w%;bHDUCCOnSp04XBXsYhso>&(CX8v(nBwS*JT`~A2`IC*|&nzPHwfL9#}D~$-)X06X8wjZjb}XyL7ruMm&55#Sq^I z!GP(6pcMt?pg)r`A%w7V4{oGOiU0X5yQ~BEZa5Tn7~ea#b>7^1CJzuy2-=BT?Vk@m z7+l{U0HS2LPfl`(r8((o>!cnJQqSgBrLznaX%&np3N^6SWHr#;-@7Mj!O~FnKZAW=Q;YZQ9!&F?=PX%noq<5-S zkW@(Nv><6J9Y_`T2A!dIa zc16=IN9mH~`Q^Vd^yPNjFV|4cdk@QXtJg@)R!=1botkpf5#N*hH6%wsk|i&r5L!JN zjb_MV~yg7C#tOW!F|XKTv4%5UCLFY~Jf( zCTRB$4hBwu&i{nbe0em&Oy(Zvc&hv=aFACb=iyMS|MO9L){6;U|ZQzZx`ACER< z=VS-1GJ{$sQjR3f_kYibqyby@-oa`ZvyO$@5M*Lo5O+ol`(*!b!XL z1E#RkdT=PG^uF!!HVRiHQJCQY4@5oHo;cl4ZPOC@`S1=oGR>(dGoqrOF}I^2E_2wN znru8UHW2zd$i3~n9Mrpj55xRcQUH8sj3%Luvry`Ud4KDm^Aps0tKrVGT%-I=>B{K3 zdYEy7+!7nZRk|!8hfzBbVC!y2)<{8;P7=`4L3z2|A`H!zs z;%JYh>hK4b0I!3{M6=AGSPQ5ZT*yfL=bnFJLys?vC!amCH8E_2i(=lp2wz;-AJY`_ zgr;G+xcnnl0DxuiA{Stoj&_n3L0(;o7g|Qp^F|ejWyOM-9F7;iP7?aSB}~TDi=tD? zVTY8%FUitr!sp;TxV6z=IUSe?UQN@AkL=cM^O|wU*9@io*JKhqm;izu_AZ$%9d4KFa1w0_TSM3Whvfj|-#ua{{h=IB zHnwWonYQ$wPrl76JrTIWm1^*{v>2Rg>fWoxv@R; zCC|heyP$GLn~Z_aOt^ArGygnj2WI|8xpV07`*M~0h(Lb&C5=tF~=yr-mf8z?6;k6dc&=U6H)lK ziB6N73DDS8hEY>lEWOjPS88Sef<$oWovIWT+_YRhoc<`$exNE=WId=QeENZ`iq;fzwN>?8KJxn-nMBvEDVtqfu`B|V z;qIwH3U+(D3$OSjqFmPV9M+b-hcu;uZPRgIs_gH9Z)Yk)ZUR zPeCMjl}{Xg{H%8)*dgN83O18=HygB_MosP1*C?*_{mO*yKAn#2)04^*pEfAMbN-)@ z*N!2#5lu35R5xYY^HMBEP#$;dw83QLI3a|z45DsDB(uP@rDM*cdBTgyb2g}dGAiuv)l>z;gu zEiaoUy+=jn+8jY92l19DaAq5{9w=ShY7pZfXYA<~()6(~aN2o24^tA%XR%+NUFxtV zT?`xid#tr#7X1>%HXCn)5YrP(+V}uRj~oZ6N$q=ry^z<-NL{j7#SX^O%9%#-J5i_K z6SCKdgL_L)RLwB^jnK*5I!U2!9ib3^w0ZcTuXZ{W69NlfYE-&4my~O{gMt>v*J}|@ zTC>@$rOhy2NIiyw)_#q2gf9^oGN2t^rx}Z@aKPQ_9sX4RrmxN^TjHL_%T$w|H|c!| zmx4e;u{8Lp(Q;=X10pxkCcwJkZ+%REj0L3Q%C{x0_we8o9@p>y0R zyA;jSRyP|G6rWxGBKN%c<+jf;3X*a{+-9QKVa}FEq%LU=H$;63F?=v>@!Uq=W(qH6 zMi>Ck=k)pu$*~j@jYuWmu=(E5x2K2hKhtB~iZcWR4WH@l4!99?d9~-SEBkK_8%_6w z_8SU1RR1urXjIhz>fh8a&7ACy=GUe=WpLL@if{U*niJp`mhpaiLxT~+iYZl&%(R_G z7tNPW-uRr0uBYb~vx*6uz2ejaJfEo)R@iH*_>tOzX47a|#0^wdD=fz*WB;1N_JGVW zuZ%EL8zW|!DNDsEZ7us1SY^a|{II;I1!sg?{|J=efzVeqUzHXd9EizAW9o*`(wH_6V(Ksa1m{{5`$TxgMnFPx`Mg0aMMF=5dc2qJZPTPAG-wfolvKDrDW z*cHCti74PULq2TT9gq_{+)w1EXyRyie5-li2vrsLc^W$!GaPjgC*N<|tV*qvbFIR# z$9d27-Hu8ZwGYZ?-Mpu{?_Z|ib%nJ0YrIt3gp3f%_naV7!+Qg&LdYWYF!ag9#>lJ8 zsioqi3kF<$x1XsBAr{Pis@meO#hxpn>IK6|23`%mPZkfVAGh*g zp>n>Sj=!(K`LWaA8r}|PM=l;%eQ|_-rUN-55A>OCk3DU&3_3ZOa|u4YbB^(`o4U_N zuNH~wjH|%vbHPcg8HC%-JoEO_Vr^5~geJ-0w(qCSq^)a`Mb`183e5U3d?C4XzPj`! zOFZznjiJ7JoaxcO2&C3mE)+PgO8AbV5^W)Q3T>~&`WXGD-v*WNwf z4+9$$jF-QDY&W*ot8}SlcaMHT^OIk6nuYTvpcMatZ@fz#667LCPfK&q{mVo6miQ&L z+=tZow(3DM`3J=eY?eFf1zsqMTme#GFyHTHZs@zMh*3EvwjLj@MGj4!0M~hT9x-77 zNm<#oXoEV9!Ok#9_7eA5Y6z=NMSl^!gstkL*IBi?iqLHh^y5{JZjTDe{=M&5{O?z6 zYcUQ@ZYMK#W6A^p6g&U-&zrg6Zbigca)mSpjej}YhI#xOruFn-Ni)x~W$_HBZu}3) z?JS;0P#p{Td<&`Zrd{Q(r1yf|oRw*0%R=k+RobRcfdL0`1M+bnmS2XLs> zzxrc63%>h8@3FJtqY|xIAqdgEV=)Dw*>F;SCK5O~Q|MxAR{F6UGb7u(_jFRu;x?;X zkPoM50ND-ya+_T~_|LH6o1nZ|U1SE*A?hu^Af0uUWN!ky4jE=K54^>u)MQ?iS@K-Z zZcE)9VEf{|PKP5aP#ydFH(u+5->KARY&2AHDDK7$ujqs7VQo|6rU4sPazaWd*Js_@ zV+yhtsRN%6kH(ZQ6*yfXBU-OT1HQN;yt)8Y_k#itX-h^DvP4HO-M_5=K$Z%&xp%gV)wWBZyEbJo7O`T!%YMa^>M&U5Ff+Ji+jo&(@tG&Dy!U5} zi;3mpM$L~)-&3Ka$yDv6M8mrh-BMAk_h9trcZd__ihLEif2aInjQs$_d>f-6*2K#; z3XbZO@1msl=gT&xYM;hE{~Tstv3`QvV(}2$==RCUYxhXj^P0>8|eAy~74D=MG?Tv%8vd4pfZW4IQEuyY~@ld%i zJFzlh*~F7+ye=hY|HobJvQ2l{odoTPrKdYDOR&p5j{9K;F9q0}g`;eE4R?nexSOr} zb-Xy)4tfOptw({!yDizA1Qx_?kB{IO_?p6`EbMh%Qom1y1=?vQnUc||!PeAe(ok3*yszfY zkWVrc;c`Q_+}DX=MB|ZxFEvBPrF#91<*g*hN_u>;l~=h_$BA49s+--1|aCj8r5u!=w}t0D{wJXU!j! zcPA`!&@?RTVw}03Gx**tMvnT%>m2{=UDnM;X1~(eeT3sPcFL}-qxv>xqWG0q33@}S z+fN*b`@N+x7v2kkwUk6^fsrkF8(*RR$G;*CTK03Zg+h3(kGbAlFC-N>^rMJCf1z5m zH9Ii*K}ObkJVO1%_IuH|&FJ0cpG{ZFyhz5ifS^q^B z*gY%tZ-|ba_}Kex)!PU$=}OSO-nuHOEFVk0xPL~eEU8@Hr>+S+=T;1=fO=(5NwK=b zo$-I%YeoK=+aSmPq>ksBl`yWaoD<>CBzDHDXYqF%K38XZrAZX-Pdl4OCJ~@V`zQnr$y`1(IF z!8$Q|6dUk>p<#hzjzh_H|9g^f#45Yxk{;&Nj|s%?(w8%IBs^VMQFkix$I3a+EsGcq}&xi_CVHm|not8swE9lYKp!(cRh7^w-X*reE> zygYquf#^{wP0m?~Segs07x#MeoMj+)ycSR4N?cJ)rA$rC1qK$9?t!9P<;h=D8}Zk6 zM7+%;sIya17AtGz7)8FD#~p670$g7=A)cXKz+9-6B)v*cTWN%NBgwrCaT%4-XtW)ik< z7-g=t&G~lg3wqRH4+7L|7BaD+ytSI>>dE@sd^;6K2Vnm4n8ay$pUJy{_cf*M9A&<& zGL;un+p;p9wyMcnamlo4711?3j&F(bh=61au4ADh=_27GN;$tGpj|!*B04!Y^2FNu zsO3;{k(P9tIHdAY`D%g%N&R|LuUnc!SM6R#-OUmt!XviQ@PiYAw>x#&OAS)i-NdgP z>%H7lU^JCdxSDDNsX+4(a7W7#>WB@0mL5yWffe-EdhkZ0nFX2}^NDdS7hR1de))r? ztG5hUx0a|Au@o={uk}kP9@JL1Y!BASSbE!&-hTt(mQW5$_H0&!+b494_dc~Sd^@z= zA}U9t%ctu7!hhb1ZZm4y)?d}c(EMOEGk9^v)eM8VG6GE~vHg~^Gw zN%*7NoyQdd&DbkrPv?%Q3zPaFoW_zTFAojg8QELvELb*) z%o^UKd#3eI@k+N&cbI4TE!g0%-VlXeb_xf@5A!{rd}5MR_Ie{T8=G4qIa468=Oyt- zoOLbz7Grg&nO~qP4G5H{mU{GS`CQj#-n6$g^2I^GR0yl_rP$6@&-d}!)z|miw&N00 z1RIySI4$!XKmns?(}odA0^QYHK)H#nBj)rRFIgw?mt9{@>QjI72&@P4n;%~ph6Yck znoLdZ_8jq|dB8FuCl>wOKQ@|kHLHZocP4d-UCK8sFhZ|-l?{f_@dwXy_U&r8O68$XHYzR@=%7_uKLIgK>_OUZc6$h6@g!8kD2Ve3c3c^ksRflQ3q) z?}gOn-}%{r{ki$73GRPCU(Pi*1;xEm-VmWq7m1_Y|2E}n&103U*y-^#RWRPz%GB?^ zck)M1szAdx&Lvgm5wx@qoF(O+-xeRfk4>x2OO3X}4?O44Yc7M?6PJ>YCT^!%eV14) z_N|6`rHZDrks3Mf%0{~F+$F@?iqa{qd#SZf8hKHu<-#eZ#gYhaDHLyYKic!mJ!9v7 z9(6h%w9Dof(H*V%t>eiOv7e2;v*6N4D`K8db=PU0y+6RVJ5j)?eDT|ZxaiyM!aql( z0NRO4#;Y;2T$z5=zWzv^BTb*B-ds zGr!yFl9z2qAPJ(_BVlXv9Rv_XZP77at@fwGB2OG!PO<0`ZKDx;tP2?YE2=2SVdS?h?gw9{Z#ROYwgOzseXM$2+zVo6VrCy%j*n4!0X+st)+lF9 zn7Iq8evG?qN|1;e0~A&jMHE$?9K$?|1F_s8K0177c@gVlh6{lRj1M?|NOkbeJmLVk zI(L3yIW4FzOp6i~^4|8z^(sT@SQm_l(_qVdj8xnkrjOBj*Mqk#R&6+`VF5g%Trp=Z zZo%}@cDJ^^l-Qb~WN#W(DwZeEnj)|b4MM_pTAYM!a+DQzYe}mTvys`b32e&MdZge) zDKlSw?xl*r9yhnu9fx;(tD2^HnmE}ZNbs>3-fy4^gTv}TgCTcmP<+|ATgRr51`yNK zxMx!?2=6s|(^_EL%;qW}bp4Ot{3@3_Vluu&?$zAV?eb?5tfRifHMTlqF^RF@T5Gq2 zomBIMkCmFhTHOn&}HS}q&B?uwpr~!o4i%5=&^M#t4Cm_e__JTq&MzM?rsofE7xZ3nhGo?UNm3i z8?E{c*TpiWiKnsdT$xm@&`}uia41IX-A-Ix(jT%hKie_m(Jy?3OJd0zw{?Q1aTu9e zwY(W75$VaXb<;cDgMXRvi;3q(epM|gRlypw89{Pw7;pXZ>iKR-s5P&THeYZ>V|h4v zTKiqDV|C6)TD9c&%B^q5x%u{Y9}aeCy+Cb&Q>`31BsA@TT67y-V);)8P1Ty z;AQuZSIJrVMv5#>DOKJyE~p{)I?%SyE0EnK#3K(%#OUq1XYHS=re<9e3VLtUY-=6# z9ha3J7t-g9@zHKOp9`&yTO6r^Uz2w-;ODrXVc+P*HM(iN_;W(7=}|oNQ25~hcTyz5 zzyxRR-b@)hik9|mqx!a>mhTp_Zq`=45x5<z3qD!e&ZiLE9#y=rwroxfzonhrr`4?>^{*`iYxYxj{MdjTIHG6Z6E5v$ z;`&blb19E5uOf6wNbDtCSEo+20n)23q8Je;tF>~2zal#%oa1F^bXqmNeN(B1QjTQT zL@_02-pM^9nyu~t-TOF}NK`nSo=j<72br1U9jn5}S7ulm__C2qSM5`o8TzZYTa=f3(8z zgI&CQYKOcUajiL*yH#<_fuBV>2)Cxfa7)f>MNK;RX!kLvFK_>E{=b+~V$#_CQkQ!Z zifw!2D`ZI*+aOwWhXe5R+S5p*ajIwS?iZ?{CQSAh0^ zlVaN6<^QS#`+pKMTURcUDDMzJCyP7nm$}Dom%-JJ9vw2bKl&#X<@G(sK&6VP%K*2F zP#pQ7qaf#e007L-$uY#=YDK&vu)W)bW==i5%Mnp#uU-`a&$g&@ed3IY_Fk5bTCyU< z;FU_q;OhF8R*9G&8J-f80nopVI0<4OkcT!$0MmWED|f1Bb|+jaIgsNm1HRCcQo z&MilC`dV;H{eUIBpAASgvn)>b7K}m18<&q>dj;NH16O1x?re~A9_h-5u+m#2{0bW1 zv6)apQ*by7svIp%Ut~7zleMJSYhp*4a`it%FCm#_)t_lbVQoKeWrJ_5e^E;vN&U+|lA6FtXZ_I-(yGL;FgJLqDw>6LioLD%A!Uo?MN{|8Ev`VW+(_2SY! z$^RzBBk(Jnp*OMo z?Eia1(DUSkIPD)-FP;gV{LkzEnZf^;^1Q;6#?C2gjqr_B+|j^`cGQ($DnVboe*eD! DUFA~h literal 14102 zcmc(`X*^q7^fw+{)zZ=lEk%dhDvAzTHAQvOQq(-vaI0FOi7_H1p70g38aFzxVoC@atzg;+>Rp9_D;me|`FrW+r?>LgmH*XykCF*qu`yjaM?S zr+#cd+Guv+wuFk$+AF@eUZTb1^}Duh*WELBj_x@jt2Z3-CcNHwguJt0tUZt}G!mM! zDjnqnzni)%4e2%^izbhp7fKz=N(cE=QBhZ9xfSlUE#_J2?)&=NCsSrIa-!nZPBGy2 z<>P;Cx2XB~-f;<0dE)B-uQz{~`HZ|1Y?8@?DB?Iayoj~Q?`>x@gcB1?K5T1jdd&vO z*uq$Dk-lZ8-xP`Cy)V5lHhPtgDWyNdQENA)mHAwYKkho>PVk2 z2p#oedkQ?X*VovaD;SKF=z1p3HoUjw%S2$_E!rlRu8nM(SNedL?AkNEmsV9MUi z+Kg_CZbB!h001#>hU~;P9|jY*gqKX~ofS*8HW$ui=gErR^HZ&GPE-I+d}eB|&mW&0 zoOa*rPGRPB13xWRn@6wE+Wqv4Almbs0ys=H`p0x2v<0Mem@#Y$)XClII6W|g!~&}ZBuuq{+Ziv`7Q#B~~P{VHfibL#HOkx=U6gzvmm+x#g%a5Ua&0&A97| zO5FL7LgUrXHTQ(yS2U9so)Y1W^{=w&(R~dGYF-GxsQY7ns-4-4FF@jIvfR6Sf9AxG zTdh4wj>}oywQYUPD6N4Tj~Gids^psO?wD-;>+bV^6^r+{1);erlC^JHPdtQ|cUno?kc39_;SO-BEm^ zP8J^z41Z$VGoSB5?v1y|3eRmfU+B#RAZHg1&RwRS7pe%q4?-#m!;j@d+t{rDlVT>E z`nOm4X)qr$GB$J{s{jq~Keu*imbN#8@g}~nCMtzNrm~@J!UJ4Fg}Z{N%}&*JVgz@R z{jr{e`(>YJUzjz;3NZj2nRCDSqwkj}>#QAF(j8L?`2L0?5(W6}jc(Z3(REnk zkCLWL%a-5`Px?Z4D*~pU8+K(ahZFBG2J@utrA#d(Dn8~V^xSto(yhid<24BiqnpVc zqMnv^(rhM9wG*4LzP;eDBR&-HPBeEFO1@)_x8S<=A$+>YEdU z0^AI&f}9Ieln2{4dJk;{u_jot3&V!A)n^&K`e#MXtLlb(Y>Lj8LNI>a*d@~K+zta- zg7{6Tm++o4qF_g|^bujMum#2IdeZPC0+@W%r~0pVYi!iRQTqIFiqwy#hZ$Z->xw`|B4sIM@dX%vZZE8acXhi zlB2TM*G%hqQG4iT60{k-*NMUF?T0?LUAe?Ap!_Wt?vr0O^Buoy>3x4qOnM~ug2bCx zUq*G`LBW>(3eg#`IF7F|ZTwlUUGxl7`>OAw!FVXC-;4z51U08qv%=5srVNAC*A#Dm!r}_N}ayUpu9lIdGoqZItx8 zu-OIK>Jv2Ln=AbwTgO<>W7L`>BWBu6TYfm~%4~H7!~UvSI2V+p{pX@U_vT=-6}z!h zw_^jY5x5F#?Eju&n#K<> zoS}NV|EY?I{BdzL6ivM#x&m;?F#|qGXzh)wGyQ;M$j3-pZOf zaOs7W71!wlGQV-FMGnRbo)o17_v zLwV$-!KPJqvA;0#YI*!KY6*;&D>85!{ zY-v~VOIK2_B5}R7S5>|PHbdkbGqtgxaPn`VGdO4Iq-(t^L#Jm7V|RhE^UodgIqVel z#dwB-rP*9#>W7E*yHBks}ryD+;b!`K^3x>O)Ub#QjNmjI=6^A-ACU&Xk zoaNow($!RZ_`<8rUlibOi6K8+^_2V|n+lW!W|bTtc=2&V)opLguhsoRin4be4$v#x9=!ahj3TVJZ)=efJZ(p8XPH9?F^OPZPz`hg-cI!)A5O!NbjnP8_@PE&WoI%9@o*5$Gk(C^)TNu3m3s{?bkjKGc`^9e?MMz^o32tD`K)C4KD`E<&HKqbPX&^sUbeOcuhmAHz8$f0kEdY1`d4Eqs#baj~=o(730=4u&C*w0Qmy>}sKVXEig`i9W1)^=%`O5Wri*M|gRBE{D^rS?gRcUmU zvS3Q-!p~*}D7hbXG?-UcJzF(nhc457hjJDxoMElG_1L@R1zw9Zs@Vv@Hie(>L^H?3 zi$?2I-0Egu;8?k*JO=!QOC6UWakDRka-)3=o^JhktVBaVDx}c=U9f>g;Vj5M5!9hv zzC-N--%EHJsf91u``gYXoOyoIq6TE(nat?aN~%jRx6zf~u%ZlWK9Jf0rd`$@gH({s z?C4JIi66dH>^thz02ZJI7q6fD!^|42Y;nlJYBc*xZ`d9Cq#;@9esbsSf4qoHt3Wq0 zzOn31Is2kbxy*nj;+JoR6$<82OuT4AZTRS5K9A=c4LC}mD$^14!->HO z?8?@a(@k!9jHOl91+TqDNlULdW}tz!GmuC2k8Km6c7E@YmtwcVJxPdJ|3g7&i zI=F|_{j&N>mM^vH@;APzZT@LkNG9C@MY`WJ_$zMLAMW_)fcIF5t5Q#;zrq@)R8mwv zc4xWOA&!Ew!ar$h;O@;I?OFRNb$u-U^h;qkqIuovEs#<-XU+wU8vfDqU?s;p(ZcIv zdW_|h zJIsv|`R^rn^Z7318O7+Lm^S%}B(-iSI!sv{bnw z?~#>!^f!A?R<$#cKfqdr(Hl+|3k&!Iis6Lyv)cCLzDP>VnczRH6@Pr{%|LT-lUs5+ zVbaZM zopt|^5Zj$bM?L&XTjXLDh<@&U%ZNUP7r!s#6dn4C!7WWSy>=-RV9NF>)ta~jyj@cm zcDGIXdrMda;5H?$Mc5kFye@4^@zJX1f4KzJ2>u5<)5>Nx_s7QpDPpA(6tVch!fr$i z4*X2k0_nwk&Rw2J-=}S^?tJEqV>>>+Up;HEB1I1pRsJ_}rhI0A(_lH~4UO0;2FZYL zyPKWSx$E)%i+IvVWIBd~NeWguQ2Qop83~KNJ3OqTI&d}1>j&O@t-+FF_sqgpzEn#| zY6n?KwW}g~ak8g24R!*wNZC1lbGLJi&RSz~!x3dGCM>2%FO@)5&kXreg#2AIFPkp$ z^U&osCpxAXdz0C7j@dk*C@p)7r1bB)bqcq8kC9=tC2SWILfUbW&1fXdxhu}-q2mO0 z5_v3Fw7TarvUvr~H*L_F=Dc(-k=45a=}ck{tdbTuqe;UTZW}^!pCa)1?+U<&mQ~go zo!k@dwpNC6R(fDSNz(0j zeu0gL!+!jpG(T6u9Bn6?iZFtX%w_&m)9J>Ql@O9WS}hbakoP~-xjZTyzJCZtXI9Hi zU7C;L?H%oknn~=~F&ZCM*m+1vQEKZoSh1GyGC^q(d&=e-9qd1xbVF8d-pR)KXX%{7 zdS~dyaN_J91(FyztFE%vM6K6pFIBUqkrUMNJN<5%iefN9M={wj54l+HI9O3=wcXy* zvk1j2jE>JwufM{5LrN8uC1T*|H)9ZJn8~G(F?IOfJ}A#4Rzp`bTSsV{{Lr@?&(PJ! zj4EdN?7n*BR))^_@;f%aV*gqpb?N;wuhJ3h!gj=Ip0hh3#aKGFGL+wYGuYC&xUp&R zele$yQGvRTYk04;e60>V65ot_)Zh@FMUux08s5qL20B*-!>zP^Ag;^WQ2O8iAOHB7 zR#BbB$-3jv1vEQWzfNZ$R)Bc72`R~+%M$hQA}q&n%z)-+W*lgxnCuT-J;d7V4X)%? zUh1TSOAkWNuo?%}Ocd}0I!+EnhnVQ7)yVOIq{+_@)Ae)<_j&JBIJ};CZfCH5W<*98 z!u(|Tf!pzhZ7={Qv`W-r1)*lp6t{G4=#Pp{!$A}9pwH;ibx#;+8S){xTA}+x(z(9R z4GM#tV^-Yb?1z+ETZ-UZ_`sQ^>ep^WodW0xX!Dr9UXo#RGLqNdH|xHDGILs3g+6ZY zGn;w#Smk*`^do1&jWTgdR(Q0h{C+~NvfxEYehAuk%?nJE#VyVSI-Xj*#v*K#9zyhv zOI!l}ObZpmq+FA${J>nW*CuKId$Ov?89qx}s6ARJ0uU~ARL(~B>Q_CQNc#}d?0d_( z8uP{G#Fdmv(oJiUMb-`|@3~&@@wgH_Ml<%oW3%URp{92amsIwmdX1Nk{HeZpE@(w1 z>0_WrD)-vw$_v7gYtp0=0glDR@cYT9p(z>zqf3<_N~p3&>f}2Yov!^SX6`qBdJ{G% zvhfrOJ(!+|m6q1Wp{mYE&_eC?H31}LfCJpO<>enxZ%5u64iuC^emB1VfMO@KZ zrT?ZCU#u*vGgi3*Il0_E%l7k>B)C1wSXlpI4*WbgpDuT<7|Oen94PZs>q_^OT7^58 zIlcA>)$USqCG_mH%+cIC7SwWh+&@de0L|wn7OCzpJZu?q9wp6*^5t6dl_GSl-5gS+ zGh*G*0hES&L3nv8YnhkN79gl_+W@O&_}o6{d%s#4`?J2kbcg5Q?xo#?FA*|Nb|RI; zvcg2}Lg1FLLD5FHI`GIdhMDuq>(CiIz(@M3v7zlkE&zDyq7AU|z1mOf3100+SEMMy zF%;;H31}($AMU=f9mV?erEKFX7-4fcBuW#5Kne%Z{efJ~rsb?KtPo%!q1@csU z;>Xsr@Qul56WsHdR8_hAZ<8T2!ZP0y#0xUVQv4Z&R_TFX1-D)Lcy*}C$DD-#8U)0< zY)(fk+~!=a3q>nxTugl8;qGj81omaw?iIqd2+aPhVx=4U!%NoAJrFb!j7wdwb{nG- z=rt8q@M`&mQM~@buj)sO?w&^M$@)$dt00a{_-52Lal&J-kqbA(;+xle#H;uaLb;xH zv+$IAakU<*Htp$|Wx=Tt=`0&cNKMkPp4t>IqElnHd#2oBCZZ=9!#wipT2I>L%gHT? z?u$OSSA7I7BNBCGD(;+UkpZ*(|Z(R@DmacbXdIV>~3jGQ^O zRB6vt(JHFJfHL&dk~LoS*;`(toP8Jk1&#vcMKCT$+b^9-_vo5#=zpK5-i;fM+JB$G zE5HVLI9S>&m?-fC`z+|XP1JnLoW51aQynyeyPg>s^~gL!F?f~?ez}K_NLRXlsJM4e z4019fbx&T;qv6Kw*;@r7M(**AY}=)Doznu(@5AMiOXczp>sEV?oeT8$kTF3Pf)DBOO7MkvX}A-vh&ZA8F!}`Q$BDV@JUk^ zosY|2bkf zWUtWy5kbUTY+zL`uTLch`ZaY&jdA;!#b_W;C^}k;<{oFG_ScMyn2T2}xv;T!i(eS3 zt0#B<5wQbpliBo*Q)a;b{pa7KYX9-oC$7CF*6#c7fxTv%gEzKW>$7%$@!Su5dmtP0 zv?ua+73tE+_cUCf4e3be&*qTbE=VG;Gq5kk252y6QZ&H>lmjJsA@e20pK*0N#W%$6 z25nWNg^%s`mrCaV)G|#a*OVlpesmdg?21Eij8}FS?Ru&PT zkKZ1{#j;278Ma|DPfq+$(-q&4%!WRx?o#9h(ZIOTI%!v_#~NH6b&=LQjEj3tI;+B`-z<;E$%UhKdMW<3+dbjP ze}wMK%lx@QbyMkOcGKF}m^S}PfgBL4F9a{9L*MCJXG#O0)*c>ePIi5NLG@E zjcC;xbmKh%`n7m{dZvbo;7~GdR+c1shSHI1OHW+^0XoDPHHz2Bl1szNhGG#pkmt)^ zUQ>N{hu=jveFtgUYF{pt%X{m&`A*PBP9DvxM3H6s_R-K*vtrrPWnM!6;o1P|aEI3x zpIV$jST1V){;|>-HzJx$J*$~6R4n)|86~oUhx5wRev+qLKcHD68JN-~WSd&TfXfd2 zA!RgLHDZ|>(9#6Tirp%sZ^SP1O{2Z{|Dms|t6Rq+0c7r!+SX;{HXq_87^V(ZaI*p` zZ!3Bsf+Jb(^ekDU-=8G<3Xg7`)P>(}5G>+rX7pJgsa#--QZaGE0!IxK^wBb>jSh6JINFKa@0i5{vK;N-vM?UvJ0Yir* znbLzZ;NpeA75vhoNvp3vP;xoCf%|+J4dLI2M1%zYY5u_Kl1WC$Mv1%Zg|_nM%uO30 z6OVGCgC7Eg!6X%Z(7;xQGvTdj@8=_htT{Q-G^b5O8F|2qh4%i6qw zHHh3lo-o@qhk4eQxK(Mq35-d!XEiMhRh{rat_(0=UFdQV+!3h0Zy{56r1Kjw)VSzR8&qB00VHBXn(*C%A*s~>6! zAXNaj2)MTTs~c6fezt-?S|&%h{9|hsM?_wUL1VfZp!GZXdqj4<`?>1d0h6zg*UVd=P5n^{2a((jWiuO}~^{v%j5lHgUs?rG{zR_#J(Y zckkQ%OB$WUQh@`CYRw4YFSPL2FsFY{aiSY%;G+2`v~OA9zasU}EQWa9D6d*q$SOoL zYrY>Tq+h{ELUC~=i*-U2hEmVaR zE?A93yR5XhPiH?q{8R=Ilh{ixSrmD2`*{daxH@^Q+Muaw(4u0qzkBW_Ai90IgPCYJ zlWMQP|C&I9;KB0Mvd!Ygfr9FGCvP#mbfJL0wRzh)S4YUacxtl(H)hE5P?X}itShN* z>p%qC%`tPnjwh8gs}m4}O1eZ(GM~a?BpEGcZp?veRb?*}R~js7*9As=Qd9-|F zc{^t*Q2-zwoc0pVDuxX|ujGmiU2dvyYC&enX7fZqgposxOR!Wi1LRMYjhqgs+|2AK zygxE}OSo2T-g8(?)X;^^kjWS77!kOYTwbWeFDm_Bl^CiwZJKC-Uh_pQs*s9FdHjW8 zcYn)GA<^Le`8%@-m5ng){B3h%b(5fW%b^p^v5jj@?A*qhjuw2w_?&rQEtG|VFuHQ3 z{#ut_gvV*~y$`AY4jq!5uVOcPBA|<)XZnzTJ)fo#kFs>TjPg9>&b*F|SZOj{9rB@8 zTo;ShsE;PQkG-uV@aLgurrD?n05eDb_59Cxmv;;g4a~OT*X{rXg^DU}BYQn|e{}Co zgqc>Y{(9yay8QQ?)F&5d4smk@TdXFWGiQo$X#K+quur140gq)yei}rw2kzShCA;?C zc+~#z@G0)|6CH8`+Se#SxqwT_f(frMif-SO2%9-i-H=X^*%d&l%x6N#+NM6J3@?jZ zdNO0kYLM!ic|<(t5iLB-YQsCjazp@3TK;+>8o$U>TA`}flgfAg$#|Up&v~frryu{E z6Wg59+qJhJy*bY|`MkJL^R-vyD#N#wkTpAQWr-6t`w@H5h3Rb%n|$K0N&7TJC!~?I%caHK#BUjjr~6z>*Q!I0WP=lo-kK$ESzpVdNF&U_a6FW``zNMO;DZ!Vnk7U zJLP@z-|dG0hxYxyy?JLu7Q9g1}5RvpeGZLh$~YeVJiTJOuZMAg^y%oINeUZJ+;29Y)0OUjHnuc4PH_`Amwg6;)wwmGxxl+m zO+&b$5?r}?!EJ|`+kp17jBXNWt?gwvn|f2YXoSk}jATwnBTZ4dWBVNLs^IKdof(Yf zNY!Gk_;mefPovd~M4i5=Ren+$VQOVAngP9&G0VMiC2!1*z~B|JTURpr+!{Pol@)T( z{9XbVXdgM5i;GaV-eRrygwMbjS*w;BM1S~Ob|9l78QbU4Vr*(`bB~Z5*FS-1Zd-5U z0!2?5%=%DBHQh^fNTuYZ;mss6H3Yi5HrK}xa&eTAu-TQ&#e^O=HMJz$D@__(INx&u z8x_>~{9>5@RM)mK^@JIB7e-k7o3_?yBFEB=tQUYnGUqp0zkt&{K+{9b;Be84t!Rb-p|RkL5rVSqki0swaMM<|L--1x~bLC6Y5^ z;N4$mSRwmY*cql%Es(m}FOKNMf;GU{!I>~tbcHi3bTa@|L1sASjos5Ardn%%BO7sk zoRHgTmnK_e2}ffX#e>i>IHO|W0OLtI+qcek6XZ2tTxN$F;C!edt{`WMlAG*QTQ~j~ zcSK?BdHXWx;XrSnutug!=opD_312`K`n(T&G7$EPx{6BsvTBCN= zZ)&5JFVsGFA6$hn2hw!6FM0+0y`SqsGNUqzojUWy5mI(VT4ip&?skUHk+FL6n;Ke= z!_LkdRW?r5xD^#LOZR$+&BKs`>6>;Z`@-$Qe&y+KGdN`RSed^W@w)dpSM4c|R}AKC zkI|NqR`V{sYL(2~2CdBDgCs zCsk}FizRBA%sjy`T9PRd3De@)ep(Wr?@Yd9Sm3D z9dX#a0eRj3Wq!S)!t-(Ig`c#t?p$@SZvZGd@|`s<*@U$3+J%n*FQac_P8vJ49qUdO z#noF*pg(`Txy1_X#?qlNMNcivS;4Izi5Jo7l=MwP+AZn=^L(@hv1T(Ofn4!7IR4>? zS1mh$$4BMSYlRcWD=)BDZ<%Jzel0AyYe|W1VcPMb98!!I8KRYw(}e-M`;K`n4Tb#U zT9%)+T1BAgHFas zcD!2uccUYOnBQ;5jEVf9){Y9h z0AH&pA9-HirQ^%GxyC3}c2vx*OamX3`;PfaB(H_mT9BOog$OxocnmQ>%xO3eBaR`9 z(hyLssErqt;Z%Z`=Fp=(yUPRKW0(*Prx@%^N$quz-2|;TXubhl_FeHd;aUnt^0RJ1 zLy+Y&cHT5S)L9O*0*^{6)%rT@t)zcPmRs@iU6350= zm=*MIwsV6Ly)-GiZ*8N=e^^(IT- zL-Y$UJo}SGM4686#;|nfp(AMoHc02Y9eF~0kpb##6Bgq zF|z=x1uL{aS}8MP7lZ9a!cKH$*pStJhbihhdM?3tj;{2r<*?rf9;CaKUnFJ}GnWKQ zPcFiq-2TN$_4Eph@KjMW3?I=Z!(A-gvw#v)Y(tYbY;TZqnl2&W5Sksd_nt+dLkAWS z&DtohMF}=u%oGh4&a8J8b~&o(5@?JX&1AgO4=X`Ys#mQ@tvY!fy7ZH;I2(8K@KG^n zVnG@T#R>H!y;%b(4l4pz{YenYInQA_#(O-%MtUI^b<>J*ow@Ndqqtl6 zDwDAiS^HQ8?G|2fu7q6md(qVG=17|kT!jJk`3JE+Fj{CK*EHBMk1;H~?f%Pc7!7am z*wll<-9Y&8g<;%bQxT2xi%ODrzE{QmUES@umMB`Y0jF<5x&CZ5iDHeK#WObwiHIeGQnY;VX79+udYyh6m0;ROpp zW357WT3uxr>da*0@2D{`4A+iS({XmlMD-B}MX`2Fcy zUy_PZI>FN;tySs~KPZ56oS#%tnmDca5C>zA)jaCX`@$H1m4kAbB$e`ACz`dqgdpgPzjVdC%|H3ac8raNq!(hYnt{O zR8*KDA9AA)*7e4vul(E8){#s70aTLzKE;+@@m26CmOe!&Jp%Z2$p5=nImN_ zHRG&&7WZZ++&*Y*&2jw;{ESaoD0#t{F3qC;p}Zt!`Bg~8%;Yz!B#VZ-OBcTuR31kO za_D#b__V+`Kk27R2d@a%6Cbn@hD6*V&V z5|#=L^vs}kM3P+cW_=Cip01~_9aD0MVLQ3gul8mBoS!T>mJ`NlP4OfKxH09wxurKm z_%*l%s(fPQ+iO)e^sM7iUlIbHnbAmRuD<~u#?Jd$mSSwWt7&(U6{tI7-xs{~NS<2& zk^P{)^_S%Rl7tuO?-8QB)LTuf;hQsWGA1^9lGEw^R8Q7R9u~dP^^#-73g0{}N8>MP zm<&T^lDWs|5XO7VK*L`KfBM7y4YImdHbxOm5C`sOW19>^Q{AbCzKvj{ zrXV$Z=KYj1GF{hs^r+*YA$U=tWWj#Tk1exMhWR{3t61nu=G=nk(;bubTJXVwU>B|Nn5CZ)FAO%>lWxQngF`~Y#UOfO-t zFSeD}=-w}Tse5U;@T(Os%~`=hU9xNQrCAF$=^Dco9Id5R>opZj)n^9?3a$Rr6v#;3 z1Y385M5rS%Bn7H2I=NAXQlmenBY*l5m4gtK;R{y{$km2LA-9-82{@&;`zDooUyN;C zr*|aVnXp4n2fp?%;|kjLzKIR)RFjAhtpP58d0?h?kPbi`%F|XfQmd0p?~NJKPlqZ7 zlI2pEapeb(;9h8F5n?-`9+lSDbI)q}H5iXfri^*)X)r$OW|@%wegz+2T@lkC`KTT1 zW;pqx5?U5yH&H6?bAt6;&;~o@a0|rai-Ngv9cVW~icG3yXQpv5%tmI)TCK3xk+2ER zOA(R2E9vb0gNs-7bMeTI1Ppty;}|YnQ0$~%I%4ZuXs8uf{&7ItgSFuXAE+_O!YtTE zj-EVc#WjL-pONcpTN&)&SJGlymF~o-;qTT*y>$OHI`DxdQNQSn#;Cu;o`wDqgu7?$ zF!n^Zmf5dWu*)1ygA53h3lzKe;=YA)Y5}8TDBQo7+PS6-CtKLW53T{E5brqcFy1x% zl5KR>s^Tjo{?8_5i;Du;cE7)fW=Y)%lmDIXAo&^t zYT}PN3sB7;v_Jh2xw4GqCcyT9)U>k7Snp_VjdlmQu57`0%W~?ik!Px>hSX>c3HW}(?;vm#2P2o z`0BN&YYg=nXm+BzceVX7%vJxiHsOps2cQ6!?>L;+Bpt*xlaHx#>xXA3-;qHfj_q3w zrANgIe(@yzkvH#&_AnH0K-ZK3+>0NdJvM2aa#AFZ~xgj-VF;^h*zq5pe3ETOkn6Vx5;{qnzcQ<*um?lX2`u@%J;jy8HeW+st$6Ix- zaLdp!>ncJ`- z9D=IrP?H!M{F)kCm3%D&legKbEL+ShF5RYHULpL2^{=^Ld-`?~>thy808zp(~F?ki<2s;2h!#K%TRu?WwX z;yP-jo(N_W8YVurdXnwWVj=n-eIpmy{An4H_^ZmTm)E5a$$OVN4w=1oOZRb3b=8Qm zqKvx`1KvTz(9n8oB;CWcf6vL)1>Mdv@DhK-s|lPf-yfi|1bITh%A^9}1#HnW&A^{h zULWURftFcyg#XmzPZRCDidnqLEzrVQ2>!V%iRK>q+&48*Mz3#3z8o{iUNWb|(yHL=dypWD zQwjP{2c2~uqLDf6RpX@N;MVmgxY#fg7bOA7hc&tFUx^_*TnIOEVPAS{#^v7OyY`NV ztk}D-Zu(kXcBl3#rrGnG!}hK!d{?C)K27c9-W<>e&*~{XZ z3Q$zgnAq8l!`{4fDC#jyl;Z@h>TZ8s_J8W@38{TsQqBLy7WRU6^F(h3+`eIbz4EGe G?EeBWzMVb* diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-overview.png b/windows/security/threat-protection/microsoft-defender-atp/images/false-positives-overview.png index e86ad1454deefca58b80b4c04d171bff693672e6..c2092639aff433aa2ecb5d9318ba7b030d82597d 100644 GIT binary patch literal 27865 zcmc$`cTiN#*Di|k3JM4Yf~bHXIg3gTijrT_ki!rZ1SClqauP%(D==gjavB(N&KZUz zAUR1G1{m^?W=Lm`zwgxjZq@zc)~R#q>?+Eh-o1PGUcGwtTFemPyZPC!MzOHQ2kkOWp$bU{Z+R}HC9M( z(aqoAFE@9{=wxGO%vYMJV0<2(Qs}jbO3_l6QrFp5)Vn&le+w8aaLM;P&v*V?3UCUP zz4^B!2-3KD?Qcn*jEwnjp;hrU^FMz}54bpik0xACZv@}@TQJK`zjOU>DV&;G_HQBJ z=l|BuoM-M-`2HCbP}Xb2Z}sh-MM)*{pRQk3I44d-^k0sWbpdB4LyI? zgR>6*BaM3e)nx;lV&i4Ll<8SZlUX!X8hKu3xhDOss-EPl*{qIxgl{J48z9RNuiTtU zazWIc#8NtKrDun#DTkwnI{ab$m!}t%v0@<%R{9iY{#yefLJ7Go<6mdF`+?D?Y%dn_ z1jhst3sUVHz|Z^@$udYzkFTbNVixGV7F6VKhXUQVZYE4yY71b$i+AOyz3QAOEc{en z+3J&Wv1OG>!GEnvhsOy&pM&-7*zT$Jhd&P&y6Jm|2F`4d`tlP?NmM>X?#9`xVQ!;- zU=qz<4%jgdKt+sHmitYRO00ShA<`x>Jc(iQHYzsbHR3$Ue*)v;pE;z3y|%AHG))<1 zIT|!&jdGxzdaiIX6VF#lg_6?rK-VWnF7!P|&fZNA`vU{?2u-AsZE8fZd<^EVxrFk5 z)xEcEm}FXEN1h?B=cG2u{)1C!_>Wquk**pT}50jeEshMMQ@Y^S`Q7gli^^LJHvnsg2)joFn&#bA}=u42A`njo$ z7;b*`L&0A3JVNamRT5L&Fvpm3s;(bf7*aKBMVxjFWc*Mp%0+-Ce%X#221@&a&34uK z0Jbc7gW@&FdRO8Rn`hlt3OA}uDxiqn6{Z~+{g~&@=;w0}Hk&wlv1fXbuCIoK(^h^* z6;}Tdj&+xZrnRr?N`v8*T5av-bQR<3zKl?^z+7)tMC;fb8>&T4G8GrWs5Atlg!AMFTLi6_lA~ zre^kEo4c{m1Ke5+0#z}U0cf4el%FZ?jV{A(U?}Z&D0-f@VXbBGBKrO;Z1FB2!qSIc z6?by?qNA{+5LIaK-s%m@NWI*wNck)f{%;`?VlWJ!LL7L` z;~7v5xE85$-$wgOt2)!PnR3*|nF$#?EntNL#-GK@CNy|R9aps!nGkvVcrEasCnHwbm#`c;7uavi&;n+$f zkm_}=(v`ko-W5a~Q;t=Rm|Lb+u4LEeFAvz`6p-SJn&v;eGy3HqccCzDYIoO$`)qQ> zZ*{;ui^y--N3*J~-r%N+kuiL+oq9EI*%o+#Wml)U}6m zh^dn00s8LR(+dc^zYF(9msL_cHR?Ei4J3D{k16K#dxle}DFY zaavVcW^anrM0!I5xqY%qxidygjC^n72Tne8&K%u3W`+m-?Eh$dO+*!%IQ4A8e>g) zA^m-#Mf-u7Qd?*Oy5tsA)1hp?`_E>lNZtFPS+|4Nu(PO(H_vWoi6(E>@qjI@-!z&W zP;Prd%f<2-t-oV$y>Cdi`qZsGFHpv-Y)M5h*BNx==9S&nOCcUZDO-m4!+ftDHF2I1 zDGdknNUa`>F<-+yy?HGK9@v}lw*^5D`W=6|d|ZP{v53)p6R&h){7HA-H;+1?p+GPF z7E9nTviaRMD3Mant|yoYvNVwTHpXMq?d)Vix3R|Fj~omAGZZr56o9fhne&(CO0jS# zH!Eyj9XkE3oW)T>&5dG37$=Qc&Dy+a{^(@5+#1rS=VISZTPjR;P@bm8RU09%9?7W( z%|WPMHp~gsPr!?gbG8Ue>-=yzhFT)C?D_pDg)V`5%A=*PbSo-t$>^ir<6Y3DvwI83=wRX+NH!BhN9W01_T3E@ z!?RUppI^)?yFU;D*&bJYztBV!8#Ty+6@uxpSEuGxn~RNarhMr256>FB$ox!dkZoyi zQXNQ`3(K|YJGpj@8JY@QyB0m3U!3^+8dslAjp!6?uQ#vm`#C|*?xZ!Ycl2SG4?Jz{ zLtK33ZuQgTNUzNvvNcH5Ih9oA+f9qpp*wTPx~eO$jP9GPwY-hx8d@wQzfZS2a-^FC z%D^tjFU)zNgI{bOTY8IcX~CuNexc+(oskV!MxQls@y3R!X;78m5aQ?0n%Px;Y{2Ky zio(zm6lejymda0NWS&LA7M42O!z(0!^|ag){wP;&0a1It+R}e%1_3Xe} zqTX!txCu6ic{8XNAD>=q^DH-t`!1&_f@gEnSbKOwcgAquGf68$kQCAnv6KA7+@S6p zY6(Y81ILfVVb&*Xh16esENA30kAJbLLxg%WF7mNUrD4u#YEV(a&I1xZmevyF)n^ z?rq-UYvgO$g8m1q!diST%^Hyg6IkxdGj>o;f?J<|{F$6N%pr<143P61bA@_*3oKpO zthaaB?4$l9HLIRe!%xf0*OnSspv-7Plo9;7$N@0N~aM zawI9})z~yscgZ>E0Sk#pkf&(?h#mrj(wGPVhTz*$AY2&uOf5ZVGk9|6kd{fGgy5<6 zmgZ9cw}BTZwpmjDE&ZR5EdJNSlr2%`)!tj&O#d0EkJ4he5 z5qlCMvq4e6bB~#s8N<+Du*<`|u?Ud`#rwcyt$#LhY=SU%egEGS0+xdOup<7?=OL5e zm|wZj+-VdGS{uN}Wl9r)W5&#G3ddZDN-}g5c+LO-F}-`8DQ7H#&sQ( zZy{C&N?!!g9?BR-N*|X+sY<`;5K>Nj4*K<>?4#mqQ1dwbS+_{@Gfn>FsVdt^t_>=N z_-Uz=x#xvv8j!P@$>wUUglbx}fhKsJ@%*@^rD?PlANyW&-S794j>e)lCRn#gy#;eo zg5n0ePFMRXt}voH+G6Pxwz~74jBcK?<+MvcEpoO>DegH#1$jdIbk*oiqNYul1FSCD z&~L~=E4pvTKTdrEpMb(F-`nuH8W=twIDXbekBYl7ib#nbYq59w;e)K{?@E<0%@ciR z@K!_+e18~P1O+b-)4VreNJ;aXCDSY%p5oscLYJ>^*0145YAp3q${b=%2K1ENQlqxp zj_$5#=)?5VQsj61j5xH4Onu*7ti9-Cm=ArAFBDm18j8V`7e>N23%L>J%{+De6Mc7w z8+_h*Vp1ZZGtO#SkDlus8965x@#KLPk`D~o6w(~VUHGHXdXt^!amcK~c^yV9!Fsm|-#Fd4*@Z&v4$z$>keR*zKFIZ#dQ*^qk z_3Nb}MFo*6Cus<-uAEA?sG$w5atpn_pOc9@d>7Tr8NxhuluXi%zPkpV1t00`XY_S0 z)_y}{EL@sY+!j?-JzqkGQx$!NP>Liqsq4`@-c8z3Hu!M6kM0#nJ)O8x9|EvsCYXPJ zdBobk`2bq-J2Wpc0imVO^LW!(u1f_yhda!#6%Usu({xBZT(4^P;!hV3!*8o4H;?aQ z>QDQ5Iel}oUZkpDxQRhEI8<@f?G|!kNFH3VtAy$1gYNTg=ZMOPmWT$prhX0s=HJv` zK9L2NHBOHrU2bAAI=e$P%UaD^)=!%kQcqGigOG}zRZv~0&hin*n%&W5B~_s+z6SBS zm8Q&ENOQr(#JE$kcgdH7#p+9EW9cCP&u~`e@7cg61sQYaA?$fe7Wq-smM+tkgWmCI zwE^|W)u@w_m1vNpt<(?;Z27kWdV8J-{!I+P%LE_%Hs51;y2)AlW_A@16(2~(9+g#8 zR8>{^sxdG_w70J39KKuzlcBGwSq~#58aA`V{McAL^! z>4*;h+#;VmapK#I%z&>+VI`=UhK@w z76gUXQ_yD9LO!@VX<1IIKCdjBdk5<=&`|@!H0>=?QFTwlz|v2ivEs}igdL&PY_GSB zrrl@9ETmq|aO~)ETg~io)1-oOhPWo)t>>kB&pz)vHf;kQYDd@4(Ds>$dNUpk8^~bp z0XNi^@k82aL$>XjX50s8hRPYp%4l*HQo}uvsXJ&NJ=^o5RTI>yd@wOyM#?@jQH7M- zS2T}nNRJ&wkeSmACC}YWM!HW3v)6$c>rmB*lp>!VuZ^SAKIe!A;-Q( zIuBmE&0lL>S!g>@a-g3S#-5nsUUP#-6#0#BkgN7wo^IYC-&R4@xyL(aX!$Yt2WGQ& zu!(NPxwbkkpFb>es!DQUvidu!(*8Yuw|oFoLv5uaCO2&?oP#T3Tl3xNY|Q?HG#uwI z+$<}cKVoAlq9q`x52$xi^2g?KS2!(|$Z4#f-4b|`sUrrL&&^rwm1Tja(>=Ny+7TMB zH#=4%uCX&URlbbf{L^QsH@Uy>^RR@)K!l7*?@tV`;U0_ID`@lb0mSfTro%rA6L0g1 zJsN6*`?}O;UyC-)@j(_&;Tqsx&2+G{zllen*;e*+ZN3Otq6W zM2A%&(^E(Ko|=!#hXz8I2lRe!v(&8Wq!!vWJ?f42Mc&Ox;CsL`_58u_L9OadwxDuP#a)r+nH}D5D%aibzT2uNH^Q;dq(o)#sG4Er6+#P?PNpU zUwqzUCE_=Y9qYnDI>schlwR>?-15^KWf2_2ubAe%Fva9t3cUZptQmf7=9H%&y(GP7 z2K_J3r?Qp5)mioE+#~?sq1}<*R#uf3In%dQX^X zFzmg(%o zt{9hLH3Fgy^aI3h0kLD%@_#)iSLmu?PGdG~E|xlxF_%Z>H>d?Ht&dX4WkERltA z0M>UCu(P_~soNnYPSojC*~U#6@UC)+=b$ZnneW-`qFT#|cZ&!vjz$fU0y~>SSJOP( zK0AtZZ+!18t=iGD>$^LvJDMaM8W)zo?CO<+fg+667|=a{6VeC5Mvo!#-Jbbw+nP#* zU@riVN6D!fEw!6??)D&fvS!E^#bYYQX1aKFdBSm))U<8yI2+lskz3H8UlgNUqFT2; z!<~2_bRrhtpS*C$eym4K^x#%)IAC&=#daI9>|~>Ibl?}7Z?k)SfDKYiiIs~B2qp#F<5)ndy z3|iGm_#P_=-rajEkSkF!AcCfI@ZPKTpczY?g(7k9f!`r_h|DDa2$7Y_t{IeJ zW85zVefO%bM0_t7TUdP$hI&RF{f_sJ>q_RY^zkz^0;(;C9R4vTUdK_{7{8_9jXEpI zn8L5GS=i)5L#eB*Z`+n1cG=Ew3)&-2UgAR2%Jav;0`N@f9G7>tws2^;?=RLd@5Qr) zkmO?Hw>iAZ%y!OIfQ=peC-{z8aEj+zV(R_)@m&!I>6FX!S)+|fe|+72Id$E(-gzqN zG{o7k!Wij^jLgLxlaJLqsq^!evysDksrfNt{TGv_{uk9yW#y3A*lHdR!?LhYy;PRz zH80b#3DBCY1^7`YXq+{sD9bsq${P_Y53B%ylIrJdeaLLN2NCfBsE<&poh!PH7+ALaQg=702` zu3qQHz&yrxp0n?yJ2UVxvwadO+2eriO!bwoi+v+{^E&P|m(k2)lhF9JJJoW?bXwn^ z*PqJC^Ee3y$2VjnMyiy@Ty90I&2Xs=&X0NeHj-HbTBS<2tQGQ_~S+55yHiK3O_vACd?3^ZwP4jE2{rk zL;1Bk*Ng66EiFp>8|fQd`kkI!xsH~l#Hab8EUM3 z+bCi5C=ws1dO5CDiD6?6F0kEU5Uj1C})?i{6mpE z0a!pHA~NPy#X8JQhb+R6_oRUOWm~H;6Mlq0BCOIsnRKbo;(y5aoWs<`;u?MukcQS% zGfnz{muBTc)@@xC5t;eL9HXvRZFx}_H^(Unj{9IS~mUfx%zPLhcv4 zbpNiA`t4OS{j2*hg6DhghGg5{g;9TX{yU{((SM9wlK`j?{h`*^CNaA`QhnE%>0;(0 zDrZ;noGK>xz2AoVCHuuVag=Io+wfHbQ>t;+AiBk6yd|YJnIJ`?RbX!{dNu?5rTBWl z^Q1*Oev`0s1t=4|EyDHRIN<-V zg$XCyvm!)XX1b9~GHKP-)to?(OO(+1ST=y>0N6Y=0FoTowS@kk{`GHOi=*I=CsYek z6W}7k_5YV$Hiv2w5$Qibr+GVwUmT8cnE_)L^W1AAr2~BdI{w?&|C`wkXxm$&@)rd= z_p#k~I`r;|WSC`Q@IPJpW<`5cJ?oI%Id=3Ic&wE@2*9^Em~${GE<;Kui~d(g@()*+ z7aN@+_cxl)c9MG`N8@@W#sGy$6rg$?z(&+$LnkHUYUN6;hF7E7Oa5mrK$`2cWqgjr zZet9R@M-IJf!Y6jAIyOgE^w?9CF4@0Gxgb5LPrdNKegS6St&oA|I~3i<~csnoTZ$M zJN(xPRL`W2LEcF;+=4p;;~UXFi_E{;Pg&U}?xO{(fQ6S2`UOg2>o!yTRNP?d1`oL< zcyj9}P|M{dJf?)PWdQmvXqG+Kt9tOKE$IHFQk}*_gZ=C;Tfi*N7K6wVVyR&bn}u+8 zH05Ja!4QR>oN!#N^j(8x>Zo5e?MfuUb;mQd9Fr=vT{JWTSr~?rO45C+f zx5wP^FLXlTNIGD6X4ZiIQ9R({1HCG`sXQX6+nfC*r$C4UwZ4|@nD(XOfP)8G1a`Xt zeV1ihSmYz7tbqKvtOnRuyea5r6K6OdWaLPDX;}JfOG)3iM)PLVR2Z)V86B3X#7VmN z5MMj0T^EZ)Y#NjC7upz-g6`NKX)zv|qSDLtX3BW$;{<>qv~mOa4i5xD4%w24{4QtI zL%N05RWWj!y5bjcwic$?8#$s%%vf1L-6wDh+n|;5qmnOBu#qf0zu!uWe#&q?syH8+ zg#?jhtlkOZ{ws1h02(c|kYrL14WuS9N;$we+7uf1&SbCDcPlF-ajO7qTSBfwq#Inj z_C?i{PR1UYR#j3y4Lz8He(RFU;83Q%MBLYi=%~Ts_0}UJDf__~bwwJ*d>}Q!xH+qKDU_W6Jv@xiqEvQ3uWf{4wy6)C#-$}QHs}p z9UeA16==Y1dJ&1_CWuO7%4xOtXQHmu6aX4RfsbrdNM9=$=Xxgi*x1TY!-`(n`F>9n zle&?Sk&4RhoXfCk9?TCvItp0cDQ!ldy|&<03c}vOtP+d9*6#I3&hu+J1z}mNrpSj7 zQP3I1htu(XK6;HbvuPjz#D7s{L9<2>C-8%)m8JE+gT=h`j?aENDx}j0G*!JZ9vOYq z|H$#O*)9(1po1ece|1IBEoys%C+?cXoHLbr3+x$kE{!45uk;o!k889(JPJi?dy}Vf zzerepT_u_jmsM<*gfO645X#@ITXb#aae7rw#cBlGmutKMvT@YUpkFa`e%|5$;m zR%Ba#Qd;9tj~$XQ%2_}DHJNU2O5EB^g|^9a3ghsv-*K5!@cSM4J588|u;8fPzvL(e5{`s07tGGI%;K0+0AkWf5ehfK2G?;L{?9Fq{(0{u;{5-cN()B z)JX9=GB#cqf_NPUAqF;+Kc^Yua8N#7wgTshVyeP?V}ZBya&CN_iM)8;-hQKr-AJ*{ zB#td_1z$20Hnh?9U?ucva5H*;EVX~7WM z>oQ>z)BUd)tRX)0KXn(fSboBo9(^SCqI-M8z+Tq!MK+%wYt(Fpg+2Ti57ongAIoEa z@AuJr@yppK+6hQKIoVRu-mf=QIUH#o@3y)Gxr_4qQkAm&D#E{S+~BfA?&O8`WTAhK zeot=qglg3lcYjN<7!6a+N)Ru>EPqcJ;^Ol?9Cc%4{Wf}{qM2pSczc}FdcLFc&g=ku8Vyt6mD@+kt*%OZpnw zXgjw$Xt+4~^r%I9%?&fq|D5R@UQxcDn&ozf^d?*K!rf>7&rETD^7G#1pBs~U`u4PG z^wIa1bDQvd3f0?H?Xhxy<6Bepq_2M6HCCYJIn^4sUk}eTwc|!TbZYZDmo}?tdA&( zasDnV`Xu{s9#E$Z6;nJ2KVT&tBYn9a<>-HSMRoayN)2CvacydETVqBkk;Rz!*rV^R zdT6;e46NUHXewy4Nuo)kE0n!)6IOx^d$q&G7%~nKU!yA<)qLQKc^EuibFzYkcwJk6 zy{Yzge7!)SjmBiM^bf`As_yHeFUi4a0$#bjLfPn7P}%%89&fGnnlx3nX>2;kMy*<6 zC#|C>YIy{L?={T&%mdaFLH}ARE>cwU{jGT@CM7X%e*Dr)-s@8lzq&Zg=*ETJv3EP7 zN}S&SV!RYfnhJlUjrF9OK=FS^#;3J~jxGAZ^vzGanbjwmpm_(Y&Y=gLg1Rh)8cl}G zvAlS26&k)A5|rh1M;o#!%rdRb6sK;veNCgU!0Y=Gh6Jqhwa^7t(U8$RPBN3e=O>^{ znO7njYudNt0j*x<1Ea-5J$2@qsWwRhAQ6}@L`hwqnsk0qHCl2rWi<9W4GQ#dUph7% zqPr`q|NcW?)NIgdg`KWRGD!ng^tW0n9W-QFd%;(xBnCnq{HaS4zn--LI8GZ{F#PYg zePg?%j2`KlePf>BJPeK6(vi`ATWN@Z%6m2re~{4JqSNc(WZLb>5)tVM!&|n zrx~wR3+vvFoB-32y0ck5e#?2A=q#nUr8)%-nfTJ*p`1DP{p6FDq!XoiQ3C?EUsV=4 zFANAv#mQsOd!DpV^QKx>-!tDOf5{VHDM)m;sK%eoxg zQxuz%?wV^>b(m+fbhqyv+@$Z}!?94ZAJRIhczw!|caQk2Am)V{z6A{Vh)rs;7RR+V zEIwAvRo$4?=?SZ9aaY+^;lbQmef>f2Zj`k_71Z0>wNHIxPI97A^+Az5v$0STY5uo0 z7N{^!vNKoLJJEm71tXq1K;TOoIdt>V2bKv^!>kGdwo<*@S0z6kFC4S(D9i8O%CCH% zVC*NQ(a`+lFmRN3%7wJ_vW+*kD2Rk-=|j4j6XLgGNdCjR;eFYsUdQ87R$B{n;E6f< zlYoS@aR|8)j^5sK+=X%FnZH8+*ECo&A~rADN~v?_(2LIF(+GbxvSqCD%=A$q?QU5= zf<~6=6L(WCx^`K6s+re1t}7@^XEi7bvM;BnLq*nE3sv{EgKUYf&r}b3A<|~w@0b|H zPa<5l;UobJuz4-3E|mF+N`t;`-RY1D*bk&1z-dW5<4fU|Cni~_dy8!8p5{u7ExPGs zp&|Ay3dHR`>b+BE^@NQ`ULZy^kPiJld&4+jife?pPa1Cm=Jz|?EAYC8n(T>JNrmUG z?&sGw=ahO`)Umd#>`Ri|kH3iYrr699WiZLwsULENT3AHM_S%$Rf5&F*zZFMURz4PsL*w@?Z7(vk*moybO+5{4yAUm=oQBO`RC~jqCWWDPH}36raLBQ$gJmeU ztn%GMTPfK7&?`L5y6n2^8`oxqVH}m>*2@jz9Uea} z{zx9JiYr%vZ)#cQ`^YCkA{O=RNx|Fo`L*!19I@MVUU;cT^K|o(O+S=Eswd?D3nS%$ zxuKm@J;Z5_DV&X82GP42u!&Fxif|o6a7tR9#yw828cNz67BQGrT;)pd&!-%Q#_nVd z?z<*M7LUF<1X^+hvYA{S#Ftns(&|%smDXXeY4ia2DcVhQx4jOXmaHaoaTwgmhgl?* z-uv8*LDa1!xo+gd^S>ntpw<-`Bt0QA(^uR$##3Mvp$Y?yX3WNd&Uc|u2PiUK10Nk! z%p-hXoLNwQ#_+229^klX2g%mH%J#A0U(~1${_!}PH0KV{L~4Cqkk|klkVKqM5|hJ$~fn z8yAvq_2!MMqiMlJL>NUnO!~&Ga{djG7j%}og|zZ}vNyww!(VND)cjW82p!@{p)>l0 zv*c|6k`}^9gFjuf)*03rrni$luvrAKB}mpswLf6@`Kk-9GGyHsrwXiiTv;?iw+%jX zR!qrNU?``5U;}Ly#%%<#vrY53^0V-D*|OCt{Y;~&iYV0KK<6mesq>MLOhi~xQ(t6tu;x3YJppDyh1T+0t;9)GSfD93nUKv~xvG#y}whJ@-<> zE2QwY2q~^ycHuR-QWvU z<56P2b8cjcG%l^=A=gQ>-U!Q6%dM%h_p^_L(MWx*Mw|Md<-dyaWz)`18_jWBOe-AiG#TXj(U3k^qmxq7emY=S_ z@O_zyi;uvn5a*6Z)2N2AgO)fN&v*M@l&7_e07`VxGg*DCxZJn|a-xz{4W6vA3@M)t z7Dk#vV6R^ioI4s;4(P~7#C||fLrKJp`SF~M81;Q6_WnFkKuTd0 z+$DwHMKAs=3+KOJa97ijR?g?wcE>#l8wE9q^P{9PKNX7fLBHwL6*g-7U%D+E6=R#f zsSs;b%&F*TS9zk#cKkv%y3XD#`S^Rh>PNG>gOfB!f=f9nozeA%Gl11-{k72{ZjGC{p(o6;>|1o;ICaS-JSKO@u;9IP$=2p4RA`X6T@K}5`41nELy=-9W%iJg zi4n!`XW<8EvQx=0=ll*kl`y(f4Z~=K^69_{+P>__VsQjnN$JkOY~VXK0lk~WFZ7+< z6ZNlYq&PgnPh3UYe&UkRWvs8{3)b{|EWdOllWRZ&qY*Q@o2rM>4Aq(a{9Rb6HpR8^ z_k>ngK-hA0JF^&^_IV*v;Z~O(NIyl-$O3!3>A|LA!ta2NezOFo41EI=?bUjiU^vnA z``C|bo{8TZB@^t1sJ=e`nt3avP-lDMMsYY9k)SrddXw)Re+Hdl!6xejgv=@gK*ZgV z???-xUKDXE-wN5EC^oDkI}oa38-NwcY2iyh$-@(i9i3 zoO5k(1831;_kk;efO2G^2ZqG>aF+IE!#jCp+-Z@HSm7fn`tR=2n`bcwQL zjcd|Xc*88`RlvLPI-VSM;()@I?OgVq>JhhUY>WZZQF*VsPIdDORNTl-1(W&j%Pw2; z?{r~_Ia%8AUoZO~Ch!Eq-=>-w5V1xr7?nNe_w+^ZfT0jb>9|sfxBF&N;gDDIp^lRj1sz?{j<~7(!(BlHtGbtlVZ64~{7%~6u;m=ha4)xs0;ZBOuhswc!oO1>P>1VW6{(mI*#PmFC2@7d@TN{yAHoJ>4isUtm@9WI+d<@Ap0>r_NgW&5^~4v;cnP zICHmFUrBN@mI+#5@txe?LoE{_z}Fl7P1ASXKSpTn+;HOiYzf$~_#f@@`68jWg(Sv} zoDuz6`_+RAbnlvY2BXi_8nSuee!uw-%Rme?uIWmBg_`RsW6Q2;AZDd&H|uyMN0{}Uv&q7>j+AZ-7- zlk$@nVf^*^ItjLjI(D$vM$Yqo(o%#6bD|~U0XY$Nq^2fZEW#_1iI215mYuRRk(tZ- zyRL>yJVpX-w4ZgS{lU+!yojosM8ZtQ^4@<)Wlq~>(9EiOk8Th>AOoW*m6;Fo_`;^* z@0j&YsS1o29p55axgK0fI^lb1wi?2b_8?M_Nbn==OLsvlgAE`RYS%VjEU#$lCef|n zPkzFKgfCA@nx+(tV?L=A{Z4(@jR(*3#dIE`Fu_H0%W;t@N z`d)b}fEb^xQt^IqIViG{vMojpdk(pzJ?H&QfRu>L%+v22x8~~K5*eKN&#|f_ zLWL(fwdUAU@xP8sWd(_Skt*d1{hiBM{eA@q_IUdD0ZymeaEs8zqieM7j8hd>!+@wV z{sVW1Qv!d8>lj`+9jglM{yBJfG;7bJvzu7CRkSqZLr2jgOhtRf?IJng6cy|%zP=|`E zil)=;scAkc973?gBpOa4U_ z)Law(qrA4)p0oLEemC>4gzfIshV$R4vsA`K-xL0)h=OuHmFDj_;)rS6Z#+d|2;4pX zAigDq(Q7>eip-#q(6@xfRZP0sS#fFfP?dkiYziAwp_~l_+RP{OFNSi zRdiK!{wSeOBBEa4i-bT!l_!hy?u)5A^%z7juV_|XAdrJNVj=UkDDZD9jT>Z3WIv*h zH}zV)GE3+EuP*MRN~3VWNlYF~!E|cEDGGOuWiF$xyd3H;9MxYSFIv+4<;4$?2X(U! z4SW|k*cGn*;1b9mV7WMUygF`QCIz|;Kn2Ry%4Sz8eI7#-(jloN_g>*IPg-C={?{DR znN#Ht7It-R4}VJDT_hrrmLcbVRq%{z*r)qB&#=@AeHd8OV`RT$&FOGm^CKWuv)1%G zl>hKaJ`Kx|wy78WUi=k5;m`F$7ym-$N7FxlIT|^rZkXK(vqnvb$w;xEEWRQdVV>%VgO z?De8zAUr1g4|V&sjA9Oe zrmEJXIl6jWBDkreVBqBXT*G%_km~QmtUsb|r(x+*_oj54_AVvcR?4S&LP$Za-~g-$ za8+Ip{?ymI>3%Zro_Ds}(qes)Ov4p3Gi3sMQN{AH!)x32`_U(<(}tF_hC_h=dV#EW zK@Ta-$9Zg(^^6i0Q!wfTP%l%sQ1Eyr`o|1m*$woJWGSG97{@=$*0N?3Dc_A{`$Vre zt?h;HeaG2VsvHtv{zSywcWsG~N@&Cd{W}oAX6^%syVS<i62oNey)WHY+vOxJmbgT97NSzx-zPYvm2S7W}v?kVB?M{le?;%3NWKl>ZXOg0g9^b54R{;ln;_&uz0P9`^Cny__T*RRawA4Zs}MZdcE;V-F_i z2l--oHZCvDCL4q%5~^p_4!d|vamX?{F`#AZ`fKJC;z7Dtq4lP#2?nkzWK68=8Vx^8 zx;pi5SL@gLvz}*0Hqd^UrndaWDTAa7{cEFJ*MfpS$!EW?xtpl^76-aqz)#dTSX_SX z1af*_96(x4QKd%iu=#K>GZaQ-8DdCP86tKZ}x1ZJSkoQ)~;j{@S0D#)( zfO{8ky!9wKF#DW)kx)fc>Y0A0x|1g~@-8Y_?!(_IVJhnOI3HZUshYYpZq=}NMg&=N zKuD}7B1*nNW=_5;RG>QB6Mhhd`47SI;j`>iYXVr#54zTM?2Sr3oD)_BitA`tnJyFmYb<=!l ze7FGMBnsSKSR_!9E_hlx<4P7Je=w6rE`%IPHavIj6NF@zW`}_=(o?t7~9r9&-Cc1ap3MQqwy7>d(N*wDq za{H|AYtrYt%xlwDIR9z=+-H@_36(><0t~0`Mko(L-vGgyMIx-0BKm9^Z2-~FTLpV> zSH;*K)oqmnM%wX_rSjyuSMVdUdJcd!F@}umxTv63_SE=IDPmJEkCm9~lZYi)`m%?E3a-1D_t*EPe{|IV>m- z?<-bAM*H_0T2E^DTR^!oBHbE?_BkWhtI;c-^^voa-I3lpkE2y5h#6|aV9i>eYz9%f z#*s$EkMVC$^cpnq4;xfxEGty~Vs$BY&rxZNh4GC=ye+>Rc@UcqBuYYu87zY%EX~3a zEq-x)4Iwjqs|=fwtE?{gH~Vdu;7Eu3Mz;@F3!YO7nuRSC1&fp!)0Fg!3+#>_)$5`& z`?HX*dS(rOSR859^Y11!BbCwA@yj}3(S=b++|#r$6k3S0&SRnreN02jOINx=Z<8>Xzi8di_I%9O4 z!WJ+aiG`$vjAm&n%XHODpZvbRl#+~S?;*AH`Pq=Qr0#P~TgnG2A71ieR0b24c_<{% zR0~?l;S+P^&&AX!`;9=26`*PJ0m|mHt8|5BLi!(*vFWE8WRs-xBIUfj_p;TTpt2r4 z4DSCT_8kqhx5V?JsQ>AL%1F$8t`-T94((A6;6j1uR0v zC|SE5ZI{Ddl2wR-iWt<|4^~ZvMAkS-{o7X0j?;-!Ha*I(O|k0A!LSDT>4E9W&ix$4 z!rRf11>xrP?gF3L8`C=_h3@e!7?Fi|?h1VYv9ewBck=}l%ToGKSmV$<318GqK^j|J z*NFr8vDz%|*u@gMgH%nwqZ?pkAr(99{EJwVioHqufV9XoJBRe+WuV#^9lV7>eZ1rO z@;4aM{j6`vrgmPqO3%dgq||F+L#)N zgXlKg*qOqW{k4zv%~a=%@!_FbS5l=LlBgG8^hthklz5&XGN@mm**1CEHtVof()dzY zVQE=vo?1QS%>&HP(j0%PiH_gFr)D+t%w#VLy~5$b%E=ql?boBE@z#I``i+ER@`na4 zKgFzU{c|R1m}w#IjhK$4#)XiUN5kOT8zcKKrCR3_H6HHdD~6P_td3|Hb)MfV@jm@n zIhnN&BpYk43SdXW`YnI-tZ15odHP|dkv~Prw&Uf%Q@Q7|FA4d1?Xj=3PN9?(bnXXP zm^hfd{STD1-Unwk#bFUHX)j&RR?e^cf8wMcnk5AzoGO1dkh$+jmGJvdKz_=lnoIQ@ z+8tH!Wm*-`ylN>adZKHvp1BNPEORk^Y1%Mo{AwHqovc6ka`3BXPPU2a2ocR9F^o*K z*IX!il4mzUZ&XvbYFCdyNFIngChu@>M8igLo-;i^){3id1edlFQ%MSnCVst%s`Qz0 zBLN*pPpE*XI3bispLFfKy=Toxrc?BmSV2dode~%_s?=HD(nj&N8L!|Ob`2}n? zDUH5K$r{V+;L7jK9pe>ePwGjz&Jk5zHGLoFj_beEZR`_$EP@#<^Yq2a;$|6YKN6Xn zY#yu}uFSPk7d0GnBZnawDvS0y>33+&{EQ_y^QQOaUaDVC5O=$bIg9+$Am>?CDLR?8 z@wpJ|#x&lq+4Hh}0rh$mYmi;SoF&w6K_ZvsPCI$kE@BQCp=RCO=Xbrp0Tr^&De=RKL4!m?)oQ9X!Ep-O4%`^=~m< zSr&9-F0OC>g5K8QAypyReV%YCAG2g@!Oos zkK1!!N7SF|r_~C7witUBJXU4G^lIbO*vO}Z(pNK)K_T*SqD@RRkkxb|F!<{9v`417 z%oCIB-i%F6hGwv(lLr2e;=Vha&Gzp*-K`c?yH;^)MZ{{Ut*BCa#VCnYMXd(0Y42*P zMX3={vqq>Oc5GFOqV`Db8nIH;YHaV7`~E%8`y9vn{_+0zUVr2`xRNvHb)DCFp5O2H zGs3HQeP%@c0i(H+#P-Jl>o13`GnkHnZPmi*#vZYhP!0&MxWrGrRHa$yIW3+G;lt{^ z%zcBVVmw=icTb1{D@5_7trJj~xw(nF62# zy;a5i`n(kQXZOAJmE*HV*C_fskx~~y1t6evv{KQ>c~1ERcF^|2jL144qx0RO%Xi(O z_So;ipCvut&eq(iX(qL^L0#}yL_#cY7acAqQSXNhGqGnGA7x%SEy_OWUG1EGHU0E~ z5h`r+^b6%>9sX1ePTkwNDwGic1lr8|a>E4#)_>fse-^{H1$)8jNoobig0#r}d(-SN z{U3p|FC4Q1-Wn(5{Dw&uNXbG%+@Qu@*>>z9&E8txrPaSX= z54(nY{NF8x9(U`VyF6pR(e+gvRlFpZgPp?X2VL@b6z+7z*{)b5=gM(E-;vS&29VOd zZ8kTiTZElo49Jyshe}Zprdz;82+eNQpmFXDuOp~8tcSEeiEv>x(i77gL=4s;W8tnJ zfEnV;w>7Wnj=b1AQd?^!RLid9WbQE&rxSJ?IZWZMy5xzH_{-j^gM#R!Wc^{hqweCF z0#wtQ?ro$B^g{Zn0_J~lU#|zXb$F+5rH<_NV45AR&g)g2{v>E#YmoAXD@ACE7zEf> zn38(RJ!fy4+^x>_4uNo_NF?1&P`pwpiYnIOj2gc(>Rxw;YjrN*Ly-Eh zMl)!4mPWG^4h2P{o=YG=b2$|*^|AK1&KX3cmm2@TN?Bk-@2AOl%4K?rU$G}cG&@t- z86KKoyFdL5Xwu|?tox1LM8Jzn8hZ{<3oc9k69VdHktj~v2uN|R%VNz_7|b#5Cv zUVrI%BmeWp({8$5i-q4HlSzoE-jN&Yjw^F}r&XpNHGAy?Vm;4oXibRqW;=aTL18WO zj5i!>l{x$KrQ_3hK5YKvlT~?2h<$;~cu$M09=4d=O^(`O?+rSI6Sjd*R>tx#RN<}X zr1g6p7pry7K(*DWuBHiY%jVo0N4fQ2Wyat0OZ5XtE3;9sJ2R!uRbg|bMN+pT{);=# zl!_cr&h;v-il<1`wlARE_QosjCh@T}gSKXDEq7cWld{Wd#^@CS@j#<$-4$4gpf-kh0yX{K-sO+@?Dx6is^ZgY(W*eic5NNb z4*J{95XVAjmb%!bNhPiU5kP56k#}IIKUqI5k{Vz=4C`e+Dt>fI20d)&Nbcwz&2sR& zr(|=OI)H>M3Aq-rAQ`XvHyPOdg*A^DK9o|aVhz7=&MlzR5zsDF5lFX{JS6R_%-drb zt6@Nee_PayQ`R63zVSojHlKx|(pL#Q1ouG&tFvVR{|~&RLDgvmKu!4LlAXp^vqVL0 z9miRjrN5Jc#f=%SB$Uju^cF1 zWq6O^2;`_MXL-x`s4g0;Y?J5DqIoQZkF;TQPV)|bxag3lwybq(uuDT6f+P6~de~&| z&PFQpV!07a#xB}7J3jhscPLyGIg@720eK%6=|~Mnui!30(CG#oAIv%3;*|>-dd)XO zxD>W{3nNe*87_Nxf^UDyIVCPu4~!@%dso_UN-I<#B6;O-+g7&ej} z<+5)mhO%Cn^~>uN&r3jw{F=?8I4zsb`+p^kG*~>@K<8qE*Ww&T-5e9H5q?+W7-BMZ z-)1-qnRFQc2zR`Se%A0UBaNu|wc$v6yOi^JMe^w8?A(5l>Zb|E3VI`%qiC1yQfF;~ z;RrczWlUq{OP58ukPzMgKRbM&vwpn}*-piV1|562p!FJJ4%ehZ#WA9PiyW{l@GfYb zhvf2JEq!TG`LRoM)p<(FLj>D672Tf8Qb+BQYl@q=Ymz!7mwv2lXP_n}{(P{dq3L3a|fjq=d#rL8} zrtW-wHm?OspPp;Cy5ldFKKWq$ zn`FTiCJY+dS$ajVA9H)Q^>NlqCrT>j^P7P_O_CWnDWdlvVodGFO#}CFBlhGm0G2j2 z!aG3bgzk<9*IxS02&~I-rC#$)p92a_-R1AO^H!99U9Y*czuP)lX)@CTr}MTDNUXwV z+uF;Sk)as|XIseZ&o|hux}M-lV&uZ$1L$GfyZ6LjF8)x#emp$a}Ve`fwsE(-ctsUPW4M9R^}Qu;Y*ci7bl4 z;c#oHcQS*vS%z}5{iv+p=EV$H~%FfFL{tTJCuL8g9;#M#1L_iu9x669rT8eQVXr1L1 z`E`SZw|hd`8J!L82`Gd`%J3}6KT=svGbf%bRgvyJe%w&{$ zRgwNP*TtVPZ{<>y82cjyze@e){wn#8ng&V~aGeH}flhP>ukY6LEA9RaYv?jXPq|c0 z1yTSyvxPM8D@c*sB~Z&8E#Mj#=K}=>qC}R~S%c&sRyI?qGW`Pl77PWnUg$>4K2cP1Q{_OAUdMR<$G%z-5ig z-70exGUlNL6bwt~O0E(>-5LX5NBBk6G6M|ZH|sPvL!1Pr&T@ln-)KFAtV;i27Y+jo zi^8uk&PG?DZ~C90%QOVB(Uw)$`s}$;I@@PJS2!W)a*rDbG%@KOCs5tK$6t6q;v-8b zAt)dC?G9%U@^`uh+gmvlsaOBmK$ttXbTa{8R<-K+?x?P1rXKGM1*`_Kv#O<)*GIG>~=|L&DW~gXq!sb6edgX zx`wgHShnZnJlxYZ(a_hnu%5C;rVzVSbQpT`HqK8PH{UTgbP?g@iTQEO#c^=NfEk)} zQzXhoBm-DOl$~%RYnA%y+V))LR%D^XQ=ofX^J@VBDNA1&_$~*;*#!Fqa=ne|aKatv0lE(?H>~L0-=%~LhYc7f8-IPA=^9UZ0}Vc&r^64FwVFma zaGfI(qJWlw*thcI)hAk`v8^KJV>yq>ol#ILI>AUwm&+I6*)h#sFLPbl8?^LX__=xF z4-<_N??dvz7W>KXfrq*;axLfC_YFDvRxr9R(Wrw3`u?95OCA|syq!}qPsmI+urMym zVF|EHs1^;hHf$q3RE<+`R3wpzY>2)#Ku4fAtR)$*lMl@>9>}V%MbJ4||IU5Y`GB-M zKB7W?hzu~g4h|_ZU8&zJ+B5+wA71AF;uRJ=3enthUiOJY1vdeZNst|QN`?JE6dJ2- zaAah}cz#6jb3oNwpgS)TqIs2)X;>mU;Vhfl(yPLlvP0T43><|jg;I1yvEz9Y8lwXL z{D-Fddo}XCPJpIt0A}Uo|1IaGLCnBGbHe22NX{d*BSIq7k*7?Nq_CL0#pAUGK$v*^ zUW(QX2iQ%al;4?8&0VHfQN=kd;R|W1Czs(htp)>jp^bba1q4LA` z^!1vP;{)(t&KiU(5z~ji>_h>E8(^_{7G3gU0$RDZAI+n1lW(;Fn`2XX zWHq;z+$)yoH}<0y){!B9evNt$Of&)drQ4G}gL=&D29Us54zp!pkJg!r)N~*dhZk?j z6Hb^qgoV}t?pOTQm<1xh4RYD-JgW1fDwu|$aj^eVPvUP~FY6K;H^T#HvdUiZ+&(l| zKO%vpsDM!W^x%<=;A31ltC5!7?Ff^I^cGl6u=dO#N?#p08NAg!u5A@n{%YPNNnx$p zA?qR?IIjQN4>L9kn=#?A2ilpo|40P^kVj4Sg7K%q$D9yLV>aCPhkJ1t$w%{m5n&XI z3dH-th%(r{YQZF@7Mn1+(XCW}b- z$Mbku2HTM^p7$QS3p;!}PnKPMC1Fs7B%<%&}3;m&saxZ%O{JUNHKv z5q;943{Vbh0*reU7a4CX0+4hArUO9cBH9lO&kO!Csg^5Y1ctt8|BLb~*O%6^j;-Z7 zx0*zjtT=To=uQD0l3`=Rd|Y`&GO*k2;cCjedb){^=1o*hE3?SwEaf1*vczLk+WZRyFSl;9Rgr-i$)c_5E+^z!P zEmzwuafM<(Twmu;Kv(+lf1J?D(B|*F0lcqi0Wjn#$=uFl$@*u;y2;Q!_g(S7PXl_q zl9}&W|2Z9X29VV-^=W|b(>5{?2P5!q!OVBYZ-5E|FpgqBl6YgRak|3L@cWd85s#s8xv8mk33{y&>%jnY(M z%;k?m02)#SC+LOr-0sF4jg10UTOX^0tWMOFSM7S#trC5JH7nKU7a&A*0ko7DQo5|< zAcSBpR{is(&oIm!2Pg<<6PzhMMR7a|zNU$*QZ+NLxdy^j4rhF(L#Xul;E}hrQrw*( zQVD;E+Ge98#r2z=9n`aFg;>bU#6h0)Vb3f=j{xpT8N7Hj7gR#0oO8Hh*_#reEud0rTa za;6wtIE3OZW?k_(4?Jan+w*<4CK`$3nqjzz$g2(R93KEiH4qhg;FvA-a5|XFJC%`E`HCHW`U=(0fE*3f^eCIjwI+2ro5AdojW+bzgl1e8=kU+jquZxph*k|!a=2_q7fm#RBkT=1gy$|(K4VjU|| zb+q<~a94JW{7!j-RSsS+VZck_8BbgA;_`wNKyjmSUw)wu$|^#INcI1mICc-gUYhO}u)Pz? zHcvL%`EGKUDA>m7*tZw=@|LB2DxE{u$JxqXJ@Liw0(vt9#VCiN-?uDx4qvy@G`ApE zv;yPWlC|%s<1%eSk<+Ttd6MjFJ^Z$RBGt9H!PiTd2VdT+9CU3hH^n3QP#hJ_LgMk8 zki10ci6rbG(WGyU3M%q>Mxiz3@VM$aBCM&-mzW z`XK#akMNq)uKnd-sF^FOi=y79zZ3XW+J|m#PfsT@d%j@J(r|nN@MoI#ODij-2X8-5 zj2T#o2mCTp{qgH4sS5y@Sn9Vv)gc$+1F!!B48g4)KwryzKwVcs(s0n|y|G;*MJArQ z<=hlv%#xpO%LD+tkI!IU57f>^KyJ3DB^LL#>_3m18*?pIDs}2je}?pIlS zbEy$IGmB9QGhnss_*?6X#&uFc*j(d|krmb(}TuY)+Zs$L@oR zjQ1AW9psPG+69Lgd=T!WzpfvIZr_c#0c&{ zL7Y-s`)vuO>Iu=!G|7l7igrOUXOKEd=Y_{Jo<`K3}tNKBqQrUXH&pZFSP(z2i zMcl2HYHWN~#QDHs-=24mP4>&y0HYQWAvwxGsbl9zqN81xdWE*BWMotszB<_Se7{<3 zUeSK6h9>zF#k*?k+E$_!EM4CZqlN7N}v$ z=WSRB`y)o zk}o9X@?5VG8pY_@Lfj2aOk}$u(y{jU zg}RSD0_C$7JNB9mfK>u;nJ?oos%aNd@^|Rg4k7s}qujG^4lWnwM-^f+O_H!bK?jO;pr zQguMJkDvi6`T`@pKIJx}!$(}YhhY}6697Pa%~hlVxk*LO-=i}C53C&(EN z4B!RewW8sZ5ECaoe8#D^?F@aJcR<4@-9pcfMKn^>docB$c<}tL{a9p)u9~!)E@R0P zQHL|rjd#EC4BVV?a7w$IYa>%js(*j_`)m1_715RK#R&OtUhAo?@M|L%Pz$)Ir76x8 zHU5d|miyYD*k8Sjw{r*t_CE`SdY%{9pCnth&Yw@_Rxgbjc4XP^rIv0tPLB!^4%-C5H@84tOO~;Y69DX2SdIRn&0FTVmjBnLF#v#N+e<6%?5@I>^$~!gi9aG_W4bUQM+E^*5Sg;+(LD2 zTcrFv*GeF-c1mzlph@MXFvxUn@2Ps#S?}j(6zPFb>_u!G|2a($v%RhY4?zo_@|Uxo zkRZg4sGj-ht@Ab4!BDUTDrGb<|GDQr<3h-1#GYQGqo=&%8+RRvMmo#bL5ctgR3fIV!Z(gL;&VQY1GiNlZIx> z=Vpy_l7wIma~V;ncoAjJxtK+TXG_kiw|+l!(6AoqsF95U{0?A6D;8LBlgf)PsGeJR zXZ^bbkEN2tUdT0(bwo&aR}xoyw$x_XjNaahO}TKYP@8jPvkI+JuCLar+DB|e06j>bE(ZX5Ze{uq5OW+!C=u-%;SKE+cnp6H*cTSXtJul^3HO8Ac(lyq&~glGOLtJ ztyg*u8vDl(VY}%M;z8iw{#&C1&JB0p3?t#pR591Fiz8foLFEV@>Vpb*qiTG&+h9fZ z>UP#S1DC+t?i~m(4cL@hX5{zsFYXgR6wvQVvLoG6O_G|GjT5UNu)P;EAALL1%?cdT zFvyO^hdi$5AM86_bkuHWRs_N=z*$1}`op1b8Fzc6^|-!_HS~AB?`b`8&ma44wj4BN zyQb|JnZu5J%hpkSH8Ofp5LfQ;jN*eTV$a!lJw*JqtRSW}=k3b}dxVI}T_%quFj{aU zGldxA{QnkYp1h{yRlGhS6<4R%8XL+uH6M8uhJy*jw1g=jC3CBPng9}Ld~@DwjZgR< z%g|{q-^^%g7?g28`m!>NCsLTVqtGkbEJ4^{@HAk*KE|=GfTQd`^?KgT9xqZegego) zggZKn7O)ZUSx@Z)6kgS7{ClnB(@Ln77R$QR5|B>)mZzL?(8I_+VK2 zRV0&S-s-k}a6ju%WD3qD#h0tItK#W~6q;Jszgbf>@3?kneEwD^4ErF#V9zJTD{Xf) zUc8NM>!Z(MuyD;c870W<`J)Zqu8fDcMZ=tx&~T>Acgs#dv{1-QLIkb81>)YQ#vXt# z`y_Cochl%mh}Z9*s(ZiEs%bla=@bwk{2MLMdUK(AXCiz${{2iYizJ&^fiWpZHz~K==xN{En1u~b}ecqJL*=h`_##J>c93R zEZ8pC1WyWYs0A-{Yd3+~xTHe<_xd$MR8pKT_Kc)J(>mzar z3YF(t$<;e5#IQGysi@HCPaa3pGb~jZl5t&S;IyP$N2GRge)XXhQVu~1K^T-y1c$(n z7VeL7ecpgyQ(fSRGOW#Sc_ zQV9fDF!6o>p+x!77js7zXduqP{ms-BaJ3H!`kMtl>!7^-xf5FbR1$nd6#BX|bq8DP zGJ{X8Mc1VA9VK#?9`1m<}Y*O{c!ipuF3Ivzr zGAI!$5!Q;rrT zq5s~D4#xKA{z|AjW3D+~F`K2qgnBxBDP90~?k4_|vHsZWVn|r-rqLKOR!H11b2GM} z5?;t^ux!D;8SD%HnGYebLrg_<#JS7eOnuEjb05Png}L$(J0DImFdQ-LgBy86Q=1i= z8edlkMFI$t?}k(!xdbOOa8m{KeQXWioFA>EAwXcV9h;({OqIgD_Oz)AG{ZL#$GPj3 z={sn;mgdVG`OLU!;wEmnCU{!gWSDb@c(Y$STQGH%XheU8xt~_<@LnAN%rFcZw9Ho2rYj$r|GT;dj+qZxtv=RR(x=JvN%`eD9{%cjH#k%Zk!Ql}QO* z8XHxW3^Gt_7;TNYD+VzV)?^0(v(_(0)xOUbY_+=FDm|M+Yx{ql9ej%s0@G=`PTcDSWbzc^z1ydLT%CA0qGKw~++eW)mmY)^c8G*iI-dQv_q5`Fsx;P-UPexpt51m~a$1sc zFF!60DSCWTZwd1394>j5F|8;Ip-8DwXHZbsm(svGg4)N-A8+wt!BM$h1p1raiB&$oYz4A@acLuR+P~YW3?emm3qMTkQ z@hEPcKmKnHu6i`zdqIUn9enS=pg5f+gmQ}x-h5$wu>%-A*`D(c)t!hUx(v=})wgjC zcfP1C8q!W?T}i*yX-tBz^VMzN*+< zX?p{mr5xu4{g^Xpi__gLpBKMWTeYOF^R&@_=2w+~j7~#i7oO+Sy*9m5-@Nj3LTK~5 zaes~XVt=~!&vmAYGnb4LKQQ+ED*fbDX%sztenT3?WL1>e{xfNdd|3J1;n!87pIf45 zs;dpG!EDL|u0{5(u~wdTP(Caex z=D+SclA#55-udLQz8TBYCPkkdaqhvP^c+1_lpYvo7x$6tTy%HWE zP-yzSi?<4f%dR)pS9-b>%-^)jU$Ef8)UML!C|x%@n9Llr!3|vm{Zu^7pIZ3R>@=L7 zDfB+CjrU;N-(9#)18-4Wjzd*dgF|`p8R=ekh3g4*#7DbJ5>7yu?0%h16@>&2C*fW* zsbp!3xbFTQ+bZ~=LqFR<{UN-l=l$ZTZTZ9>v1s*|?f337ob()V$ZW|Ef6V1A*Z@-8 zElyoV@xS6(%Rfdb2D zHHiN@^Y8iphu5L;oxl)kFCeE`YNyTGdnTvnK?y~qEQ2p?+b-zTWq GzWiU&pNFde literal 27939 zcmd42XH-*9^fnqrL_x(uQz@dNKp-FrN=K9yr1ug!BE5#*6cOnH2_U_NmJoWcDn$Z< z^bQJy5UL~;L%j!o_g(jX_Z%HtX>ZYjK%mP? ziZ3-mAgcEu(3wvc&I2vGiP%iw-$fTi19uRJ?)vH9nZcRBLlEc=Na^KsZSS# zhkIN;ympVXq)X|7mFs(lj~CDQcd&#CHeT1?#l7|_M>f{H6Cq&Mdo z6cm`B-)FQ(+!zXw;wT!KA*2=iuHe(O)Fjn())n4*{rN)Balb=0U9FXUN~>lS;SGqtQLbBkqGbCrduIn?C&+ic-p=8={15 zk2$|%{O$?ZSv20M?&$X;X8VWOqd617A}Uu(=CMixrBzZ)OQN_ZHE>7aVXO3^9z6bgYoS9IWdGreLjdXkX%c}67>X~pUiW4+tuc05j{1?|@jSfzh8gt@ z5J-g1hxa92R>qzed!YY;bblZS6g={1j5pV}$nQBzW6;v5^ik6M8)}U?6XScl(JG@~ z>eM4Jk4&QOw8{%Dy6Y^~Ff&8G>w#Zs;kVmQb`lciRGboN1tySt67(ru2?FdnNU@Sb zC=)VuX?R)xm9lI13IoA}7t%4IErpV}NKhgc_cq{6!f*x^@*O5y+-d_Bug7q2X4G$T z&pGlXqefImK5P3s*+BQc1?_}bi1L&g{=A!LKl6?Ws%GwHABEMKbevK%*@UW*QN|l6 zImEmV9v?5g-=~D$*w@cfZj4(?Izm^fex94^tRBbD?^o>FqKrqXv)9OvEpp>?&H)!X~4!1Lc}h!;qA+9*d?; z&APpm6-_wPP$16n52~PwlTFLN+#y4=CS#7<@`j_eOJny`!s7R-SIAzS{#+J4_6MP2 z{QO@>kp96B`_&Fh?Mp7z{0K_2dAoJA>JNr7F;D>t%;wJXzCN`;{9O5sZ2S2hDbM@U zoMnvV@8>Zq+8x%TLsgd9*KGMQS+Vlp*h-lp%T(RyfuQJoael`lbJDew1Z$}Sgu8Bx zG1ILHy|fDUdVgg$tU*H)bWQj1iyl8wF=nv}cHU zJyYqahJFc$=dBjc7mCd$LWEw@EjYlja$LX@h3I??~-3@dyaH2kZFJ|m)LJiYmURbAK-tIp{Ky<3H4~{@w~C3Uzc!g zCN`%hE(UFRO?+C6gHhM(10rKS5-h{pByO#Ob@x1ptSHP~sB-fv{Mgr_nkDwKeCRL2 zep(BkEffiT?({hvLApIi~Ad;?O%^}QPKcw z>|E-e3CsoCCmkvjXHY-5qRuUacz$Y29*?npMf|wuLGz%G!y}Bl?_RIM(5jfqhJId_ zqW7Xi?RDf*)62fV-Rb>J&jw0b-JmcRVr=}Pc1BK9y`RHe@4d!u0uB2?TTg+LY1iY> zL*kWOl70%!$b;sz!o#|N?<;1D`Am9kDnl`jYiTR31g-p^H}#I%J^4OM29*fZiWpds z{J2hLI$>4zjT*CQrj3tzor@c5(0PeV5pu;Vnzs6n%D<)<^)uK+=~YlB?ohBz_%8`7 z_2A0y>M2R~+Y$rSKH~OZciRn{A_)S_MUE2H{|a?`N|rWp6-#kG;1hH$D~jbeI6X)L zeXFnfO4mFK`nkyTwT2G2n4VqS7bjLsNn?g9&M$j&xL;UEyP2yRC-zjMrnm~~0~?KB zCF7j5^XtWvS6~~FuAE3YJXp_!B*IA{*DJfqeJl8OL{>7_%y+m|%@2=S73+e19F_L^ zx#0ixO-WI%Jq0S-E&eA%VdC{h;YR5+T$ER)$o$TIO--596$g`!H%vEEl67A9>qO(s zs&Z1LG7NnDcrVNU6`c@1am=Ld#AiF}GEsv-Ea#i`FXRe8fT&&*H>*$m+&!aY!{zw~ zUx9xHZ|WPV01t@8_XpVy6+z(dEGQEw_iMdizjiQpvDQt(jL#R2`r3}BMBT15q!z&} zV{N|p%AcdIR;EV|SwqS|YJO3oYZkDi$QZ*2OP0E#~$PRF|$_s9M}= zF@gJ4q&F%4=qAsTeC!>=-Ej;iP)#g%b@i>0fuuEEp?UT|jfo04qz?vVq=in^+g~fy z*1wC(izyl^rMtmwKCm;JE68~McJZR)RAAJMe2HQrMp(te@u?d{J9(LX{DCu%y*Q=i zQ)SJ8=B@ZK+=p5|g9j!v!Z>v|#$8!RB`ysNb1H!Mqo;idj#5qZ=32hEq|Bk?KE2BI zlv9hSt?s=eJ{JbK8lXhAO(t2b3O59zRf_Muj`DU_OhC9n&9y?>T#wiAAiKur2Tj{N zjbiSGGGB9#1|oiS+|4l5&TYvRqtl`Md9d)vR0Y33yizqcckGOgAu|%5`%rm4-V|Yo z0rP4(G9`rnZmhb^b4K%STJ89N^CTS>s_{ebNqSO4O&z!1N}9ik)eX21fv!Nm2;Inx z{`9KyQdaVK%{+T>{Thrsw{*INLEli!p@MUCnFNWrb*Bor<7OVa}kw{m(@;X}8ikchlk?96IJm%?2 z{prt*)WaB|(w(_J+2KYaiHfrcwPxOnh-dTFThn~&4|DuqPOeEN520odD>8d|3xx|s z^~gC%BD-#i*yzKIOqNY+XP$(lv7A4FzFZyOL$1{O>j>%b2j?|>4B-+pDehuL?qO)_ zYC#c*^LH8+TYD;HwmKzp`GA<uZ*&@)1ZNNQ6gd_d?y*Y0Q3 zS9#|W(9o7614JdsRE{O;6~{hjnE0{p8o5t9GBP27JqQ#Q9{vBHg);v`T!f3crx25t zMfz{boit4UM`Eb|;l=;Qqq~A1DeE(hUPG@zpwXy>uGoT-k`mN~BcfW6*o^l=^pk7A zIaEUizi@{t%xr= zCcUwE$N5~2qh(K)pewA;KFyL6YdxR`9Rh({_tUzk>5ouScw{>ut zsy6QL=Ym)JPVP9uSnKi5Y>$x5_dO_cVmf^_w>_W_kB>V-cRPCc^c3?bwEbz{VQ1Kp=5_d;N#K{SF*j zX&O!jch+${qDNCqG~EUMjmFdUWO&5AL^%(tA>l3KZo>(#W8+7OBVUNb+LEiN{iyY? z8~%_;EY=>&5n$xmadTCk*x`?~8l#M}8*@Cm61wAq@3vjssD%r4?2kMgbyiK79w>R1 zU+POf`YllpL9f&mV~gi;n~m{}4(Y60O+612Yx{`$Mf`*()sM7vTDfYw8{ByD%{-+# zZi_@+Ny1&9K)6b;bCE>xBur;^>N{ayV}Es{vq|X`5^1~h^FlqJkq==rb?)$WuJ@Q} z&{6w!n>`sG&2snBYkvXPnC(Vnlo+S3#2R$@8Rk>*&^@}mzHUvgSs#K5RwGP_Eq$+v zAerF4KU&>laxyghj#wtOBnUIUn~Qp)f_#n)C-X%9Qjj9Wb;I{dg|?l$e>EL$ahz-| zCgU_+7p=+RYW^1DO<1pjF-W1RK&?bg^a+3}ta%<@>p+*;?oUC|i#d?>#-{7Ot4+6! z;^DKdh>x_g*q258g(`(k+f#%cBO;GBQMV zXE3{6W&G-&-`}S8GLT8do&)*OIwQ`iFi|Cuu|})C=3#`M*4}h@JHa@{%4I4XLTnjR z-bv2y|DNyp6z#8LeX)n;6nr`#BF4!cy-NU_QlKT?D<6qsq19ir`*gIMJo?hrVk6Ms z-sD}yk1EBQfH8!##g&C~8&yOjwpMIpYwx>3Ju&DIW!O1M>mqy*;S7GIi^y$?pM%zt zQ8DJd&U|BvQ-7!G8gGT_OqTZzU;IHxUJ1Hg`}Y?i0sVfiC=lM4kWrf`<1#4RLtx43BLtNa*$Y_c%d`(lK1ELN!y*G<;Id)c-ovW)vtEMb? zDM;j~!fdZ-dOYPrKIf5!LGTw1qN7Gn~Z zrjKf&`6BS?-C4g)zq!=ey_P){J}B)yRAG#L2l4sWE!8n%C)tp7@jydp_YSu5AFNL=%H@s%Iw$;7aP$dAbfj7gv&|mrN zMy4Os2fU(U<&wkP2ZZZqmg5LR8#BZ*ysoE%@~jtM)&1Sn%~oFIZ{uhgKZTDoa$3c8 zx1`(-f%e zs*BV@{IJ$a={K~PC8+i)(_%3?>p8{j=t-C<>5JVdWE=eacVD>J4@a>W&BQA8w@e9t z&fYadR@zw^LSy*uSJ3*FU(0@m@%E{f3_w%iW1{)NQl(ciFmN~N}p)Ynru~IV^%ksHH{Nz_KefIQj_f2YcArowz}Pz^=Pnmv5u3;i=Xal7tf_N zxM`*ZF4avpF2WNDsxbrs-T=v`^CAK&{Xg?P$HM%}3_V#z-4@&VuCL8DrxsHszkLyQ zr37BSK2_@s(rm-9N(cJeI(cOtZx;+jKb=*CeUYE%r*GKcx{&&o!Ino#^Xinh5NP{L zN$qUIC%5+hK=PkwN=$g^3{BndoYB4bA4o1kw|16qOuK)RTHj0Gn!&7lZKCqw`gFa! zW8_hJ7rU}ehR+h{{uuz3LXF%vCl53|Tk8Ch|5o-wnN{AU4EU&lz0q2%1nD~{@6>Y* zmTI#;1z~|uGS7_joW9W9{%GxJ!}p+Fn;=gRz&!xr83*t~uxgs;tp!Cvhb9`MnGfsN zHcN#!KdeN`PqDt~e{wp^Kj3~jcsC=#ZS-}e!>MQeOCyG#55Vd%->0bn&8xk_wv-_(EPRV~nKFd^db z!>)mAmK>>k!UCe}5q8W&V=cSY3D4$Ej`uPd2!6BVjBe*J4ex-}X}uN_Qj4^6v>6ms zQ93a-yIZsFo#vF%5QP&f+MYy2VoTzA1l%*->zjxw&K5z!py0UR9>D*{Ajo~<&N+8r zfP-~I?qx*p=>eJWGCuyUwF2(bN5YX2fguc0DVBF%DLlSIWlZ^6q<);3|KC50O^7Ev zYMNj3vJ8p_Yx|U4<1aOOuBUv@l29}W4OhH4v~z`n496q&R0kzpe#z{2K5cnauNsj) z|8t8s1&4w@NY|=gO_TDu34|uzKxm@x-a`H({YvN$#n~BUy012;ym>r7m(L+}td?MT ze4a(9LbZF4D=&E(aJ34!;bH4Q~V z{Bu@@x)L4yc!B&Qz@2PiDX{ufL0Co5bQdnfsrk>}D0mNNfo&cdup2>8O}ZL-5J#){ z_(F0Y8ll7UQJ>}vsFMnk3j$kZFp5k25a@?!oDYJA2q#C%gAX_T`Hq%s=$$hUCXZrK zrLe8RZRH@+QzFXdM6qFm*(5o`uk&${9m{=9i@ZWbjmXim2g;^R`6XwEmV8YUN|$*e z4QF;LcvrN<9@f;<7ds~oQ;a|5Q<8+jqeH=8wQhkWn@lI(_GZGGPA0ku?vcbZ#kgSU1aJ_XY%lRw3V*}SU&pss629by{>3oqH z?iU0ZtZpJIP(Oa7yltL)ZlmR0ue@>#hJGTM^z#iieSUaaGJUKI z9h_fOfwI4k?h{q5e-Ay+mM}lU#SxI}R+P}4x@8oIX9j^fyZ;52$y|g+ug&~!P;XoI zi?A9h!0wg8&uJdcOMLMI!Gutu2n@b#iSe62BRC%8Ie|_z))w)RtI| zk5f&a)t}NopgZq+xZ7^IjD^G&Y)Tw1D!ntQI*5|rQwxjJ{5x$U?JiWHp4pi1RB+l? z(5dX|S>l5t{zIM%^zh@nCzbOKN#*nDef3ry3-zJfCNS_@k89lP6EGJ1^xnTz!xjjK;64HDSbB%Pd5hkpkM8W z=;6`R=Bw8KI9}Daa@L^HtB$uh_XbL5PW1QtzMTjfJX=aSUUVKbmHadQ^5)@T>%l;` z@TC8-xZY7uc;i1Q%3PrZ6eRcPVl+d0n%Bvydy&cM3<}SkdRsvGfAhru_bF{K*X;My z@x0mjD{Nv_Y|EI+zT)U#TU{J#Y7$%RSrI;SEdf-Y&c4R~-CD4KfUwV>R`_Fm|dQx zW;PZSg+$I>emX5En!CyJ;4V7r>xBSQA3So(oFVL+V*d4p*)i^>lBj)-e$iQ}PYwgs z!`Am8t%oG&XLKL2)@qM}KxJ1{S`^#EAdrIw5`f%;SZ)Dxr;^7-Pv56!mw4uyj-W%u zF{(ko&o=wj&hVmwm6W#X(bxt%w~e;9R0-Z5#<=9z)f;hKs#_NVz-dYN0GCJp%_-Xm(Fp>#6gI0MsZhDc2*9m1pBg`dGmUSLn~kuj87`Fg3>GwaWgC z_ak1nfu`o~^Z721PPT3lhM=XfU=^ft(OPjI>Q_!mKKu^#fUY!N<3#5QuOEu7C&!+0 zx?-5?fc-yn4=;~PAPUv0{dPb_=!zRKSfhrV>*aTaP1Pe37=#4QSyER(Yeb$wj835X z6V+T*5e@z#$hRe-$Kw&j62*L|tI#Xuh5tmZe-042awmB!k6Y2atb-@>BrzWsict~6 z+G9NOiYgHKkOk-dWIFSjo@x^(VC4kO){1$azT%1XbbX}-PA$ZY4RyP-?I#V-5WY~fXGzq? z##a&_E&+=cLn>Nbr$xsyw%2h-^CzQ7Bb$YoQ&C+CWmAY@{cJlD0)U2E;lM}wowLg@ zOutU`?F&4g8lISa|EcTY->s_Z>guZPKFPglk9}f+06$>mgH`ZfXgG`&`%ce}YZWhj z*zaIyOb|8~aCd-#W%_Ip7usCP;oaU}uIqE;T}rI!0h&Q9XHT`a6C8T_b`alLWBF61 z0nQQt8EuQ-V!A=`JZHEyXe8dw$lqMvw6(O^^V)!@i~MI~w&{URG6RX!ZpA>^Jn-wzLE_dm+1{$vwLgnwLzLLHBSUOOCu#GEDLTLTLy9vFR0xgNY3?7$ zRP5X|Z8y4u-2I@F@@TzWxw?`zXua{&nfR%79s;@^?2It1mNe7TM%--&0U#Ws^p;YjR`h}`72nrO{J zk)U5~ZaBc-}gc> z!#=}5QX2^OoP2GG)_Lx<9Q~^uOf!b?bW=Am?8!>gavFQoBkVKHW&8Q>`S^%d$-7P8 zHEi^Qju(OsV-qC)-WH+b0j(g22KqLfe=6UkH(wfltJ^ikW{a2Py-uN&XNzQcJ=gv; z@<3bu#pJvKsg4agT0`4R%KCDNM@j|o{c849>ga9EVFis@SFsoACAZam=ffX%nq12L z8j&*n`N_)Do{z~UpEUE=0*k#ReA#)T>v+=iM3GZ={@;}zG><=tC?YpNVm=bn1_u=c z90||exC2@lgeR8<)T7^xMjtkkhZZ5{7hdW-NtYDeQ5 ztX@H6yGCXvBk5y&c|YL#;h)C5ST7;d%K6aq)n^O5cV<2OJ)aJH8PUaKB2^VAZsKG! z?7UY~yvkN0R{0BVO+xW?Qoszzh1QX`CcELeHGn5B*A!Oe7?-QGdrvkb^`&sYHs7uu z`p=kod5FVVTlPHCzw-9u&{KcKc*3~fQ^`W-X1wOoTeeXGsDA&Y$HWDWlfSzPCnvw? zkALNzG^mb&SsmClGx7w99b=yC&tsm-)%HZ0WNlF=5)_P$vV?ItF zR$v);4a^ogP>a>j5Ac(gGA&>ZX3yJrsU4l+%V7K)ewnUMM%9V29a?9wOv$l{;CtbF zMVsgSt)_~np@FLtR!NfdyvQZ1#)S>h-hFO%SV1gC_*UH@9PWOFZ59`?IIO@XmpN29 z#P-@W*CvmqYlW0YuGjh5|GM?znjv~2UZ;yu)#qn@!*k)xJu}$GyF!2BP0X{S^}TRL z&sJuV$B~8)uNtI)TkVo1R}Sq6no+hpXHLhjg*W5bvs*OJbqbvB#jEU?Q?y6fLCCb? zFqRglpE}lsVtb;Ew^xiDvo6za?&U1H>_@zyAlG8_Y{9dGaBOa}UdQ@DmJ>*Stj=U@ zKgDllF$8Dl*O%MJqr#)E0YP2ce9^6Mvl9~{{5tWlPEt{-=QY0CwoE+s#rm+1#%FF- z{LCI%%s@fof?jWKtW*l%I3c8ViqupP5=Vi*-qPGcN~Dj$8%%yPn6xr-TuS|0@kG~+ z6c%>8dL}n)x)_;dK)`C(Z~pCAO|njHB%$pch{ER3D>$kFO$`yJGQ8GAxFX|xqEryOpmN7dT?gtH@p2;J6B_Ld{R-ps&VUG&^KpT8djmGw{T+xPgG z*r?P=VD5`Wd(%JdxIwtu*|3_zVS0OY+_BQOtdSv%rgbbJ>sF|X9IKT7vl+J@exlm( zqS^!97J!thKd0f{k^7gSbUw`7LXWxmLN2P89?8l^R)p)V8RAu=*&X)hI*+t%<@IiK znN!wNEGP@#U2Zdsy4K&I5~R}^l>zL)Tk)d-WNCMY#9jQopuimmv>FPd!YujP#aoZ<)9QM_Bg(p6(lD6QAr_)s5Md) zi@(ZWGvKDnoKHKFH2HR=ST+04!E1JjQZ?esy>_|lG_r%khO9kU-hM|c8XS9g{4r6- zs6I?S=@8NP!}7<}`!9A3U%7I9f_>jWG;J#@c#<^vK74DZA9^;gTYD?R#CKr*p6Q1P z@+-IPiqVki`mEqr}ID# z9W)y8u{iF4Rp3dEjp>Yg=SIMQ^^bH{`j12dSZx_Hb3hj$M;@`0y{a6RDa2K%53f(+ z%Qe+fueUVJ>lWxkah1lC>TJ6$_Qo|s&TUY^puKMlST%IL=iO@qi8_5bsb_}FrXD&w zSu#;Zl;JMjE^G+aaSB6Nsh3>ZsD}Hji;cC|fyTEcB;mTo?4GSvk=Dq_&8A`e!%*sv znj%>-*WAcSyv&~gr({|0TjDgSxFm$a(mcJ$nZO_dDd)ODEywcYm8z_AN9xd z>yn?=ayLit^9uBt#mwq~0si&F^>$G9*oajlTC_r)LLJtYbbS*KZWeDV&)#(n^sGAXgMtdASl}BXo{blJtaoz!w?FEK)go-!R9Vc3aLsH?y&MyPSHFqWu0*zJ0QaT@SHVA{UzX2njKS!{U5sh{x zDMO#o1#^`H0R!vfbe|D#{9t)bpz)Ae6B(54YSi@_Y(oGK1Zke6jK~J?KLy!l|^s zEJoX>y_b&ZEA>5Q4Zx);xI z=JZjgJ!3Xglq#P5%~%$2`s`e8!tPXjzw8>@Mv&a}A^vaU7i2iUZ(rZ}khz!MZ!fJ854Y+|S(QKL^r(TD){_ z7Cr`>%Dj$FQ)YQ8UTS$0OtfQcDsG-z`4nHQ^PVeHmuR1mDfLD(zFC%VcTlrQ_gyLj z(LiIW&=BrsQj9nlwlFiB(eE_FOQ^ zc<>}dcKlu#Jx7NBr<PG7X*N79DWtqM0HdWGh z`|Cj(KTUlF`w&SK85c+(%Uk-3LAVSuy(PRNheVUiJ)DPYpB^VpOF<|LAAafVfN!Sf zV|%7FwfFh8QV;VSHVR>v;EvOO#UIiyJb|?&K23T&YAPXMV8OoKh~0p?5roWX z!IATB)2RA(9m>ZyF9OGE=LegY+{!UxOsm3Od$N#_`Is^ABG!zf2ONb?Ix)v|=u*{Uo`XG!mdXm9qy!72` z?vG40&gdy9Rbpci(6Irl7T1!}tl z)v*2a4WASHwegrC)2hNhq7u8&@I8xE+|UK3f;fdhhg=ET_}up^vhXDO3U2-p^n&K> zJ=y}_1Y;k4BpRo@LvSX*=EOGr>YfM+_cUwE>7;tGuWlqIn>0x?^zDVwRQapAjiD}D zt6%Vw1$$x9sLO!WxRfr13CVW`XN&2sU<%3EaeD?#e%w6zDqAb9Vzw(7q}UP}hrObQ zeOCBQcLgLs*ZmOR8S!#WW+iR0xa@PU~*!aqO)ZX zSIIcwqr;BUuV(xB=3YpTQkSx$q|T)}ZU_%+e5Ku^++u%(x<6NFhflSfh;wO-Ud1AQ z-V-9qFpJN6wjCZKfqGkHJ)`WnnKXFxyF%|+>kYvU{F9C0Yeu2rh!gB5t`I=BP|oPt zyGz%7vysKB7O(=BL;w+YE8z3|w6FLrA_wt_#d)R}iM}JCW%Tv1$nXh@p3bH!WnzD6 zVPA3;8lfR_6l1$>zOMcmNixN$jZ{Z|g*x-8jcw&D7Dm)MwaK+QYE*(>=OJRTh5UYH z@=%z^)T<%CQMbfTXRWCPdE4Q14eb^Bqs_xRfd)vgulaz&-dNqpi~>lROGv4bkbE_; zdD>K-s(w+Wb!`;{r>)gg6YO1{Y#;`O+b*|a-qvf@L5D9UQp=E*n;FFy;>QRLgE|I! zG)C#$4PFJbLDq2z zsQ^UglWN-hqO)dTO`acv%B(NV7iEMXQp=f-DeyIBsM!3JSKlqN%hh-$}_$iNNU#WF; z-O(g!1S+F5^Mm(Ao?Tl<b8}W@OLd?nB(<#j0By2UT;)91az^niD02Qk z7}nkv51ju0K+=GvKNa);j(@nL$4u*TPNZRI{ZfkkAS%g3tkNH}8o?ZIuoO`a666T* z>q#CeOri|D6H0B%U!($wgh6zhR!du3+*=r>X*r{=8Te1?M}o}AU#zQW0{?_?U;@|& zJ*qVT4)Z5`Ba1;cXtLsCz{N8kqGq-=f7oS$1R;PaFq8N!@iIs$>z>4AncARov+Gwl6;)U%*i@{4h*)Eq^}2n%tMQ{{w=He zQ^-w599XW`C&x#`L?b5yu#Y+1f7NJiC9MWgc1r$Eo!Eru3XFT6b~S4Tbik&{kZ`Jg z)t_|ey30n+{d=GHb53JWMardsO5g4<`03RLklFMvp@uuNfQM9|7O2OfcFFvF``*~4HJX4i6{VyLGcP{NrdYFL2c~wq72o%f;go5|*ul!DC0`_Kz*v1XR@9!R` zfW3hnM3vna?Y#f#pAG<-fp~0719#95X{V0%=A<>Q93-0-QrlKg=ELx1XW`^; zDItIAWcOw6^vNp4ChtWlUnW3jObuq9P%;JhHc#^h2AxlKodx)S`&_^^90>P&@Jnba z!?S>Y>5y$y^m&^>CkI3z|Eq*Atm2&138jCoMy$fD*SB)vrs4Kp<}LD{UK@!@()8nu z^6}6RW;SUDc7<4WlrA9F^OtCU%l!QMxPoORAwM!?+^*31DCw*%N{vi4q5R*C#HBN# zE?J6{gb_6WPE6&P+KJ_9E~F$LZV`^%@uDR%`&!aFT6ExtlXrpXwY>&%Fa)n+n|}S) zeWyr7TWroYC;UTrWo{>5{ikC1dqvZ_(zOz!8iJPpL+1W)5XehYM~2 zw3k!!u!>-o)J%i^nepE63<*dZ0!u1U#TSlspESozh{c%gt!pvmQv^(h?$0`*Xbx;$4rlW@0=FVgIG z9sS&{{D}e1WiSLs> zIqY*=o2reSJhdsop8*4Qt>o4|N+7@%wUG_`GcO{2LYD3?&inVydy6--2?Rra35nfXsk1jvRM9veP0IDpPX70L z2PypvHZP$GOmP!05d!$l66b(b`6Xw?G$5zPQsCb*>T`0xe|+cZfQk^~jTy$H!=8(?SUe4gW>CyH~lT;Jc_td(&c|`sWi0a%1t@TEE+8a zR;T&}oQpD?4&6zB;oe?MP{W2|0&@MqC;vK^8Dw3pk%1&kRt5BOpVY>J;2w`V^= z8kTdq3DH2F@UAo4m=COA)x6o~@9(f7fV51&w(PG=`hQQw$16jW#68y(lS~7B@bIT| z{_YFHtMAS`9Q5`e^-M%5+o3DD{eRsIkb8r_j{Z@R132jkO9D{jX)@{+r zBDF#53}5^Fg`+lUV5R~II@w8ei(QVsJKxW~;rc_x@mFR)vh{D|_OB3nCj6i)0Ey~e zDZhgi@Qq0e*qyi`hrI%DCA;~lPAUE(*N|_;##F2yfoZO=Ci{_!nrL#2e9_T^3D;^v zn3M1o8seHJDe4(x&s|?~V$Q7oDl+4G|ER*IKcib&VXjQfscEY-ocbknc59(aygPf9 zQS~*BEVE6eB*fewXC-k#*?l{`L5Ehg0S@{WS;=j$tPx>i|Z=RZ36No5qQ z)&)4O)#-I`PFP9)bZz`g6sJxaHFoO2*9o^}t9b-f)1gYsr}AJTQ;Q0=9e?^vH;CE3 z-90!G-BHbaaZEY6`0uoa?zsN>nq;N(0T#)Hf8_GEi(oJ9Q*ke$+LvxfIv|{SlSt^; zK`l|S(ug7WjUJt?1`L@5ftA|BAq^76mpqzEsFif3QLCgFA{yhN>dIp>61u<-vk{%I z*AIk*#7Ek|{GCi)+hn&IjzrU&4i^G$F4(S`tTd1%3&lPj80OZE2y%@58H!t{r}4RQPXt9LTj zi{CnKXO6`bh8mT?>|5Xv zRE;Qo#8=iL;s2EjK#y_>_!)4o=N;ek6$U+?_g>SkU5mF)66HFu?)!?*)r~2Y-`L*x zQ7z|sWA1+^c>);)-EcU0I}foe#>2h!*(l;0ZRk(e?psCiMq?9r>>?A|#n$lkmQh#Z z(nFQZY-oSQOGN*h@*Q{Wy`)WpMl!K=5Sf}jxZ|$Xuh1p%RA(e4a|i(7uT+x=WZKd> zNF-~zUJI8WpJgp|QZp&{a0*WT^(ABq(yePp5-V;n@kt1s8a4JyU-rH|_Kg8!A8)!- zxUCZ#(c`0Q+@LD7>@@J4&gy6Uk>6C`6g?(B-F81}JGzKmN6bVJ{#NRkz ze=wSkyE7Z2L+M_fcKk^yOkXjuF!0|T?f6}l?kugROTnI)hNouJ{;n;A2-_v`o5Yzk( zxoc$Yo%zA?zk@ZbT(~})jfjk6*0Q9$SmS11G zpJa%KfahoFf`gywP1-ICnrZvq&u@9T9F-gxQ7Jaep)uOF#fSP*V0j%^eNHzPNj3Mq z&Ik2qEA@ToRN`&v#s)z2jP~7z)oT0A29Xy#D4`S@4y_JsyeDuoO}aT~dyXk9fAyek)3v+s+0GnQYM++s5Iit; za=*}>HdmtVaK5pIr$q!B+w%=y>cIe+9a7n97kyv8!P>VzNYueUq$jL0JZLEDazX85 zpnfnJPQE|Oxv}|S?7nYY+%8{4#^NqAMY41Imi_1{jt#OQg04R`AYdhfRV6XtVmkTg*iEc8yq+%x$G z%eNG61NV3dv*Z<$4UE}f_~xkltA1VSsk^?3hG(`9aI_Z4PzZ0!KAZTS4!L@&msV96cOJVML{beEH+0=DgRE7M8+i)(lB)kk4r=%czVgVF(^ED2Eh#wio|$Q& zGHXNB=4s=zVC&G%5SfAbvBctM5`qN(#mJoD?)4KLrpE=gTpcHb?pS^gpA_HBaXAsg zc5P=B_G^L6JE&I^>ErIStEBk+jWYQ7y>@GDqyYGfV`*$vK&juSubYNO{;8Nw$I?je zIClE1&i&6^E%C2-5Un$B(dVx&p&-(#(tVd-eQB^S%{eq?ZrGmDrKUAMv(!}`;+Ar` zA4XnumNb)i%J21}%m|^U9O*8Z!d@umyrO+WOQ^Y6}9 zs#mwkWE!O*2EP-|3D`N;NtNSy=HHfx>?JTW6@m5Of9DTPQ3M?}$-O@ECuJ%-xOT^H zie)?xB!5uesqsZ8W&T>1bJFk|jg^$lXFErt|1bGFH_6~$0S1g$ai&vGsXH7An`#{$l*WuUb z@A{>`{lAL)uBfKEw%drG4N*iXA_5{J5C|Y39aIp|AV^E72_PUM1f+!C6p$t$m{6oj z2_+DulNgF9AVGRlsx$+H9+0a1JHFp{{xi-v7yrc>#=6vRiDYf$R zu<@U09Y@daaaX$poG%R&cEry`IbFCX$7`g3pluz&#C2D|L47B z+ET?rMEUeO)6t2~-vuWOLk8TQnW}E898uMs>$}k%Om`K_;S-2i(TLL+_SrPG8C&qY z*io7g$m=bv*QS#@iQetg7<@zb*iiAE0u?yaN_Frl^CejkC?Sj zgs&I?n0bPy3;Oe_xGU9$hlr>0lk+i302=&@orQGWMft|-8jIfA;U0zgu(Ca>gGns{^FNzt2Yn0|5a>eex?4YSoP&6-?NO^zJge1UW5G<)+aP2Hg}K`OlE{&oUj%fgY(`(Y)CWG~%jSmWAoa zPwPS-)@IGpu;L0gvsuT5@A!?)hMd5)W-j>1qs%Zz%G#2)5(GBwXKuLGa=64@YTc-nXSGQxv zs->u9jeXBuu@EKq{QWA&#&WZ1)Q9BcF-`Qc%Kmj1X>_QQ(s1pI@>8L{8ttF-I}Eo; zn2&Xxug7b2LXTX!_WIEvTCxH5I+-XxYjuq!M3N6kvwJ>$;)m(>iJ4g- z)G{U4W=e&`3$i@+erZi6jHZ8s4KFIdu$a*$vX|^W?wXjXPQqrdB zpoei?V!XBX*o;28@`evJf@Nx#KVek3$KX&je{HEFn9E<8D3R;$jBHD4)b$VDy(7RP z#eX&_oWB9as(TC6UnMw`Y}Y=RSA3Mc$gc;taQcpmc+kDtC@Y(-D*#yqH!T>gF|s*r zy(G2Zw|WZG2r5=$cHBF^xv{)*5kt8mu|9!5a_-`B7<39O9{N7O)0H++U2z$(5-FfY zn5+yCeX`nMh%J@g!(t9=BU4^DJo6wOqU3dAfZozA%3J#aSuq4<+Xg*9alo$S?wfDg zDM|ORaP!e`N-D7AM63qT{8amAI0e1@(U*5aEMP&N54s;=pVO~>=ZHth(w`q2)L_Xa z8NS{1Aj-xM{+nL1@@zCtN27-|k6Wzjh`4m*RvBM+3FV7y-@dxlbo-Q;-a46LdT7rp zeg-7=s>{qPkmeUo_aB~9&{3v*8W6QaqbH3euGeU{%&3KoI(wGGc;%|)=Og+>+6ofz zeae%&UGE}~^1QM_!f~5DUDV%s3pzbRFA~%4FM$@q-$j%w>m=-CSJP6a0ePyn+pJ_R zX=f{BNYOjRQ_TyEiDQ?lx7@5S^h3!{|GF71*)Tuj);`4{fW_G*vOu-7$f4QNJ-*@P zOrk_nuVB+c!~!D%FWku zTi|vOduQiFn-WMBkJ-Qlm>R6fbk3VrangRjBP){o24(t~!%VW!+@C#g;9E)(z9i3P z4y|3ci{Zn;ZP?~YGCO=Xiq4eLR)>P}OPiVvyJ7FQtA4ZR=;*`$GB<0V6i6(G>WSH` zlbi8N*q0j!Fc09#qVJ|4DJl}`_|nUm<1y!3O3UY8g;iLG_UWL=4z1tO;25DzRv;ap zBm3+tK2N{hq1fwkY|6L2qT2a?2K8tq%cwq4rKI3k=M3BOC4#(*58R<<1Ub)aB?{2;Jago#@J}t zUH-InZG0+3QjIWqDU5>98a-#88Ofw!?E{b3ZX)2#}v)xp=ufP4YO&YEzV4V#_mo&JY z(|4&|4yp49MM30)>tLUn zF0)#1ojs*y&zS9TVpH5~x!vN*SxHs5+$ z8*~tNbl~S5Wu1e}wCs4RF@!S5%2>WsgwP{jyb|;EBwN_T#_nAy%b<0x;PPr`IP-pr z%r_x~=^3x1o9Y+cZtHH>sr+j?VBx^b;87BXb$y1mWuZoQcHNKIKgsY{#-^)^Cff(Y zG7l&kuPQfL=yJz?&GvY};g@b5Elv5>A(-hziKiG#evjgVghDujQRH_^Xe2D zlWtDmx$U3z8FC4VmdCTO)!ytb^G@|OxRmU0|D#dhx0XTaf`x25EX%Lyb>rAXm98{G z<^I!te=Pll<}z?PID1 zp8P(VdT#MfA=fLbkxc!vy6FxL$^EhL&w>l^It+n8|6`Y#VwJ<*NH7V=3@wa{3_P4s z)7e`kMrCe0Tx-J`+*k9Oa= zeBrN}=8;&%FNQJ@_ukd#6Hi|#tJ=2@4`A~dUbNC$35aS4Z01f~A0-JSrSdo6`rT&$ zpwC*LNg`o}L&3D#AiQ^K@y@4P2O2+Fn+x^*w?UUdELoc1FhJu3YWkt?ur(aCJe+hj zsqYSVSh@A^N8`#7VbH774EqehM+ot-qDMl#4ZSrSBMmvrFE;@Q5Dz*%#oS|gP1l*X z`6@f$Z)9KLe{ItH`m}D-5zxy>OjRE;H1N4JKoW$gn?`ZA^t`x;f{R$lx-X=l#g0H) z4QlV+0yVuZH&mb<2ZE!RQw;Yd5PLH;?hH=8loW`>yEgP6@6ZlVI9cD#(- z>{pp#>ZV#NIfhKtRrT8s#RN>c>P+Ict=Y^eiYwuE`F%EIJ3M$@6920f_=HWA^z)&#u}SS8K;MxBj+bFB><2eAt$B4?<5=-gcI za&|4?l4}n{=z+&EEN;4YJra@tmqY!Q?S0{x)0~3a0M?Kd5BSq%BuzH&T8&#Z4EYGq zCRW{9$z&vD0fZ|ER2dpBr2&VC2KOE_q!_nDMeJ{!hdfde&exAlv=k|Qeg8D=%|0Rakti(NE7YZkQ{Z^4L zRgr?NdDe4tPlPP~gyhv5Gl1c2?!D3O%58tYD)H@${IXM`VTQ-+=k=J|E@$=YryHI` zabq9!GW~_zLHJ`p?Vvg;p2`uMv$}JpxfqQ^!zbk=SwL zSaumAW@JND2tvWr@}*jjxk3w_Ju@0mzl}24lezK}`h<1zyTm5Jw*cfr)cYU4B4n_9 z=1YR0@ZP!LU*PI{Vm8l!>t7Up|%8C;^}z5CVz zVR~QoL^^=80#E{K+WQ2~?YTq@q#!VmtBgi(W|lErfVLhnuQ|69(>pqLpiz%8@+ z`8!{~z@@_)17ZbIk>w7rz7s9@D?lL*?#q2aKPY zydSRuC`j>#J0@K^jpf@!%=k%b21gOH6^athPS{^<%u;^=p9NHoo!xw`K%xS`P^$yL z$Cq)#w6fK2<+dBW6aJ1*!}|~MWet8CrH6Z8ZWm` zd~#GiG38@x8qAKYXt5>1+dS*LXeobmj^_)o*9IxS>T?o2?aU`+-;@1UQ1^-zIQ@v( z4kP_hN^aAi?YdP(LzMV>iS_>5xDLri6@*(0$D2du3lKB|Sid|BVBf03ooC3v;jv#= zeq7dVy()(*$_5)Z4Zp0{v2b6Gw|@(mc63M$(KsS5rbb{?onnN@)i>04BPwlZDXO&x3N#$1|9~`WEz`U8+2? zUz1x_Bpj$IXaOCYJ#=iq3)xcH%`oOm-z&+~X z8RLpkQEo$w-5@2TIak}NZ|EMs zfuB47R*p1Vy9il7j$MI2w9}sNKTp(IZb{>t%-b~Kxvw67K<+@g!GJ|7z|58TkXh}e zn$^P7j_xzYa|!>FM&0!<;YM(k51vdVFB-5P!}1w?pS7)xL8@YcW)J=NT*bmNKM4Nu zD(227bs0v70G!rT`e%;YN8qs~J~8^oI~l@BkuYE;;Uqd#8A{W~fRr!f%rr^9Uh4PW zLrE#Hh-nkBQ9<`JVJ>9>bfql+Tfy_qBK91Xzuf|m&>$Wt zKUCoFjBR=x3jFTl*WCXU1HA^~=@S1>u>v69zIX(IQUAM<} z|1MtqKd!{aVi!DwBOu|(-QYg5NH?)P!Q@x)vSzxzn9x;+kcmM z!{bsX5V-S+UvC@WKeH(g8HHk>-i--sIJ)BPu&Cb@v9k04euZb&qEps#|Lc)r_!ve< zrl(gL5C24^ERy$(2A^+MYuu(}&XM;P@%hdHaXXWxq!Y`N*fo5b_DBrFS5s%d7JM+hE)QUODr{K z6vGp$n?#o8lC6-U4x+rd9?@3R&C;Fz0o9(}FWvWpBHG8@bw}6synN>^Hd>xB8zmap zJJCYp@G9vz%GIAnRLmi%3LQ%;w2Q4!*()@2;5AFNxY#Z~c9y20@bNl~9fq1Ga)8Wu3JV?||mBxUwwM``p*6nJl0?cvHdw3oFM_iYEG9rnwp`?alKG@+L+h7?NJ3EQLMx2D(2Hq*{ zFI5UpxsVoc?T3ccdv4=yZM<*ZuaM`>`AvLcmp;&QJub~9E93j2{b%1%9ot*LT^ITk ziP1#CvcqVrw&K|msP+<|VRSF;DsuKjG3V~P>ly`+x_D*US7&rx>U@2?WrbWbad9-# z#j&k1gw^!!TV5Nh)QWle9Rm;k|O*EBE zgt=iUl&RkV&y?U`4!yQ(54pTe^7H*R>p4|<0{DyhJiDZ|k3HO7_jrI(Km3hSTt99q zU~c?43CL|I;Rj5KWK`)6yCS7(iqC#DMHTEJg+11Oe7pb%3Nq6BwTD}r;(3+5rU8Ae zT6yr{p9_Dv&y=!Q{+0{9u)1yb+*YiDa0g@f>Q1WH|Z?%~AA5 z^pJn`lOaO+kDT;RdjzSGUO~W*UJOp&&n}WEwsQiDh?8hfcyhUi~;`!dtE z1~)BDQu>?lh>CJ?%J&U%9C?>uk%;)tu0;tS!!Eg)RDXFnJ#f=2*ia#md@-z zp)?1OOjQywQl{5G#I)KH)6omxgp4u>eU`PCt?(+Mv4jlixzQB|39EMQ8Qp$Gl&-Y7 zn+P^-oFB$V@kan2TpqRUh8KgqMQiUN(nRv}XV&-Tar3q)`}aBG-?!H5e@MSg2HLYi zCVnU^!c%cRFqfoHTdF$#P>yYHJ;ZqH&hJTybeB*VD*J4K}W6fV8yfKYN& zn$DD*eJAA$j8ZDp*C4*mfll%Rq|fDy{|H#LS=j3fp0moh9lp)P9XA}KUzbaG29pN! z@71Z7w4HLQ6BIzqo8_YIgjbKJO#> zEe?tofuYV7XYgHw3@Jd~)!r2`Gg5tqb5iNCR!JU?p?uy;3P4_Lla}v1wb`s4CyA>+ z*>TPIQ|l(ksa0BTZP`C`OaOIW&1=ZlcF#W7zw@+clXD@xuq#K+k5CvYzTIUuCS((+ z?|`I4u4KHEU~m4d`XDdN?~aH9w;T?LYC@_%jUMqi6?EqDI~EtYiJ;qCUyBoZII6Q6 z#xmZi78t;RD8>GpY>?V40dBs+FURBizC@$mBbb#nlM4?xJTx^$sr}l0*$dC zV3y+fxxCgMS6m{-ry-NCdk&)>(};Ked~QF0@le6B7p)uRC$+qC*KV1vN$fcfG%4jHAXZxbOeY5kJwuIiSZa5smP(in)7;m zSB3W{#mIleERE02P$JyyKlN?&k<{XTLD&0lWL0i`#q%qjY2h(}%bG_4eg}iaap+xX zSPaPLP_8Wcr{~P#%d<|qy zyY2E|KB!tY-(cn9NlkZjVJMk7KbMt!YrGhKKPmZcmY5CrmWKYn$l)D5DVh@X4x?vP zHW69ZCv5$?N9iZB&j9KPg)W(F`nz>Bz;lg8EcKLH~Mx`ne?SqF(BAihA(r*x z*{20dj@9NvX57h3X#?ett@DCk>f;8)z8?MSEb$^Y;co1K?~G-C6P7HS`~c4>Y2?$$1IZeNB7f>t>IUUlq8;z< zVjk9t4o79F?mlw9!3u5bj!2Ag?ytP+(!;-6evoSHcUH4_#rq=LNJ| z9*z9`-Prk$J&B$h(Xs`AAgT~rB)vnyd|O4*_C|%LDj1QRHEY;_;NL5?6~-+rO*S50 z+vSa*+#miqYrjY`ve37TvpBR>j=bk(MWseA4juC9x$Scc62;T{qI~;;11&S7I~qBX zXVBx+E%uJi;bFk%64SYEp*CpyK=LPSfp{P&abePm)VfvV`RF2oc36IZxK23TVuDSg znNhL9?bJPw02kJBwb7r#$#`(=y^?+0GvC0Z5zDB)%BvIJ`Tk3HJ3YQEXRicB*sS+x zutJssV;RT0A!dsh`&0%yXWi-Qh^%1q1U2!Ltz=9nlAy`1lS{X)lkoate&klIg;L;Tna zJm;G}R||E^Rb7vwG)@Ag$Red5!4S6cjAR#j}| zL4Kj%*;LX#Z!0k67*P`PqR8qO?}e|Q^@z&P&{eu(66Wj%1@H_hQA2an5weE9+HyFAMc_?Oew`64mJdH+iNqU%{wRkFs+AwM>Stfwf7rz-@o4#}ew_K0Z z9`q1NF7s^s#4vmdF~~NcnOPM|iIYPTlnnMzVpeZ6JGM(@VHpOlPUlNyqx;()-^a5@ z7^FN&U4p`PNScL;~hrM8SAt#`)Yh=jvsTtReE~Q5qb1{*ktTkVKd-B1hb@8QTmHEY0K4u*G(yNJC zW~thz;{8u(lhnkZ(#EP0k4B27gSMN!-|sSj$R_itV;5%Cg`5(VRFL1ad2J-`+AY1f zZc^UozTa!kjyTUzJ6_=*47>WfThhHT_7gCf`sTMK?sb_g5&!X? z{_<~>rmI?n3k@G7JU*Qk$}T8+(oe5*2H54u+c?WJ_~YW7;TZ9HBj9-0n!(f~2nY{! zAFA!nsz-0if|)^A>0garGZmhV-2Q1XsMQ5Ryf*xyDPnEuv-0D*XsF{`Neh0HgkRvF zwoFY+KctyK^-aZgYlpSok|MGHGGM>$|En=?Nq9763d+Z>8GJrB{c?2PRyyL%j)h`D`IQh(pJReB`1 zZ>o1E1)PU)+4oGZByxww>BEomUBVkvPnZajT`IuR>;CPQJd9lDg!O ze2M;BLF&^s-sDLqa6RsnCX!J`8nj34rzM4jKBC(;)sZC^_>9S`pDAU zcWpmXXmfkj!L}*_&aTc$%3alE#hGH0M)j{LqjT=Ndwlfn#-z7De+S6=WD4K1Mdl5l z7e&_RylNYe#C)rqml|- z8m=AQJ>^m+;@x48N>{ZX1Az`yo}bf$SK7lG$kncnPVKtQhFhk*5cH^6o+=n0SYy2Z zLHs5YNFo0ANnw08_O^*obNrVXygW+WQlk1m*47NFl=-VhUJlP!2++2LBHpN)wO(ll z5UA^&7n5ERcfC?dJ|&XhKnIKu@L8tOq>{nY_1?}H+RtYpN==W6%ZST5FWPR)Ck0b~ zUzDS(pl|D{4t)gJld^&oKDB%5=IWy((tY(e_VgdHf>x>WF$)mDHw^RydIeCAJfZNZ z?_5ztdv;6!{%oqLfEnR`O8zPTpS&-2Z~6VEB?G7Go_KBmd;LC_T$26n390<_ V_oMWV`;0L4zNX$?g1YsK{{qVPsw4ma From 0fc5c1575c45368487396bb4cef1ffe83d54c36e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:09:47 -0800 Subject: [PATCH 20/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 89da6e7ecf..99428b624b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -63,7 +63,7 @@ Before you classify or suppress an alert, determine whether the alert is accurat | Alert status | What to do | |:---|:---| | The alert is accurate | Assign the alert, and then [investigate it](investigate-alerts.md) further. | - | The alert is a false positive | 1. Proceed to [classify the alert](#classify-an-alert) as a false positive, and then [suppress the alert](#suppress-an-alert).

2. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint.

3. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). | + | The alert is a false positive | 1. [Classify the alert](#classify-an-alert) as a false positive.
2. [Suppress the alert](#suppress-an-alert).
3. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint.
4. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). | | The alert is accurate, but benign (unimportant) | [Classify the alert](#classify-an-alert) as a true positive, and then [suppress the alert](#suppress-an-alert). | ### Classify an alert From 71ce32654daec644b5ddbd198d5fa7f167bacedf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:11:16 -0800 Subject: [PATCH 21/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 99428b624b..65a56a8421 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -85,7 +85,7 @@ If you have alerts that are either false positives or that are true positives bu 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. In the navigation pane, select **Alerts queue**. 3. Select an alert that you want to suppress to open its **Details** pane. -4. In the **Details** pane, choose the ellipsis (**...**), and then choose **Create a suppression rule**. +4. In the **Details** pane, choose the ellipsis (**...**), and then **Create a suppression rule**. 5. Specify all the settings for your suppression rule, and then choose **Save**. > [!TIP] From 5db57d8657c4b511930d491c3010cd25ef049736 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:11:44 -0800 Subject: [PATCH 22/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 65a56a8421..3cdec79594 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -268,7 +268,7 @@ Microsoft Defender for Endpoint offers a wide variety of options, including the ### Cloud-delivered protection -Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, this is set to **Not configured**, which corresponds to a normal level of protection for most organizations. If your cloud-delivered protection is set to **High**, **High +**, or **Zero tolerance**, you might experience a higher number of false positives. +Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, cloud-delivered protection is set to **Not configured**, which corresponds to a normal level of protection for most organizations. If your cloud-delivered protection is set to **High**, **High +**, or **Zero tolerance**, you might experience a higher number of false positives. > [!TIP] > To learn more about configuring your cloud-delivered protection, see [Specify the cloud-delivered protection level](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus). From 98147f674b436cc6716e980e2869d013fe4e21bf Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:12:09 -0800 Subject: [PATCH 23/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 3cdec79594..f749263f1b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -280,7 +280,7 @@ We recommend using Microsoft Endpoint Manager to edit or set your cloud-delivere 1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. 2. Choose **Endpoint security** > **Antivirus** and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-set-cloud-delivered-protection-settings-for-a-new-policy)). 3. Under **Manage**, select **Properties**. Then, next to **Configuration settings**, choose **Edit**. -4. Expand **Cloud protection**, and review your current setting in the **Cloud-delivered protection level** row. We recommend setting this to **Not configured**, which provides strong protection while reducing the chances of getting false positives. +4. Expand **Cloud protection**, and review your current setting in the **Cloud-delivered protection level** row. We recommend setting cloud-delivered protection to **Not configured**, which provides strong protection while reducing the chances of getting false positives. 5. Choose **Review + save**, and then **Save**. #### Use Microsoft Endpoint Manager to set cloud-delivered protection settings (for a new policy) From 4dce3eb74897b63e1b9d8093282a41702e395c25 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:12:47 -0800 Subject: [PATCH 24/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index f749263f1b..731967a11e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -300,7 +300,7 @@ We recommend using Microsoft Endpoint Manager to edit or set your cloud-delivere Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA is not considered malware, some kinds of software are PUA based on their behavior and reputation. -Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If this is happening, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. +Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. We recommend using Microsoft Endpoint Manager to edit or set PUA protection settings. From 37c3f8535612fc56170dfa2c61bdf3befbfbb465 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:17:47 -0800 Subject: [PATCH 25/39] Update defender-endpoint-false-positives-negatives.md --- ...fender-endpoint-false-positives-negatives.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 731967a11e..251443c99e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -31,16 +31,17 @@ ms.custom: FPFN - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) -In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution. +In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, includling [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). -If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include: +Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives: -1. [Reviewing and classifying alerts](#part-1-review-and-classify-alerts) -2. [Reviewing remediation actions that were taken](#part-2-review-remediation-actions) -3. [Reviewing and defining exclusions](#part-3-review-or-define-exclusions) -4. [Submitting an entity for analysis](#part-4-submit-a-file-for-analysis) -5. [Reviewing and adjusting your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings) -6. [Getting help if you still have issues with false positives/negatives](#still-need-help) +1. [Review and classify alerts](#part-1-review-and-classify-alerts) +2. [Review remediation actions that were taken](#part-2-review-remediation-actions) +3. [Review and define exclusions](#part-3-review-or-define-exclusions) +4. [Submit an entity for analysis](#part-4-submit-a-file-for-analysis) +5. [Review and adjust your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings) + +And, you can [get help if you still have issues with false positives/negatives](#still-need-help) after performing the tasks described in this article. > [!NOTE] > This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md). From 2124e871d4e374b3206bd09300c846ed9e118495 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 15:18:18 -0800 Subject: [PATCH 26/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 251443c99e..9fef03cef6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -31,7 +31,7 @@ ms.custom: FPFN - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) -In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, includling [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). +In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives: From 8c5574fd668f3c09831eb4f953c3f0fa40ffe846 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 26 Jan 2021 15:23:49 -0800 Subject: [PATCH 27/39] Re-labeled code blocks As written, the commands in the code blocks that I re-labeled work from the Windows command line, but not from the PowerShell command line. --- .../microsoft-defender-atp/troubleshoot-np.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index 79cdbc3b60..05563e45c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -86,13 +86,13 @@ When you report a problem with network protection, you are asked to collect and 1. Open an elevated command prompt and change to the Windows Defender directory: - ```PowerShell + ```console cd c:\program files\windows defender ``` 2. Run this command to generate the diagnostic logs: - ```PowerShell + ```console mpcmdrun -getfiles ``` From 4948f6d7dc91d0958c655165d21a17b11b80f142 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 16:16:46 -0800 Subject: [PATCH 28/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 9fef03cef6..784067032a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -33,7 +33,7 @@ ms.custom: FPFN In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection). -Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives: +Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address them by using the following process: 1. [Review and classify alerts](#part-1-review-and-classify-alerts) 2. [Review remediation actions that were taken](#part-2-review-remediation-actions) @@ -59,7 +59,7 @@ Before you classify or suppress an alert, determine whether the alert is accurat 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. In the navigation pane, choose **Alerts queue**. 3. Select an alert to more details about the alert. (See [Review alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts).) -4. Depending on the alert status, take the steps described in the following table:
+4. Depending on the alert status, take the steps described in the following table: | Alert status | What to do | |:---|:---| @@ -69,7 +69,7 @@ Before you classify or suppress an alert, determine whether the alert is accurat ### Classify an alert -Your security team can classify an alert as a false positive or a true positive in the Microsoft Defender Security Center, in the **Alerts queue**. +You can classify an alert as a false positive or a true positive in the Microsoft Defender Security Center, in the **Alerts queue**. Classifying alerts helps train Microsoft Defender for Endpoint so that, over time, you'll see more true alerts and fewer false alerts. 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. Select **Alerts queue**, and then select an alert that is a false positive. @@ -81,7 +81,7 @@ Your security team can classify an alert as a false positive or a true positive ### Suppress an alert -If you have alerts that are either false positives or that are true positives but are for unimportant events, you can suppress those alerts in the Microsoft Defender Security Center. Suppressing alerts helps reduce noise in your security operations dashboard. +If you have alerts that are either false positives or that are true positives but for unimportant events, you can suppress those alerts in the Microsoft Defender Security Center. Suppressing alerts helps reduce noise in your security operations dashboard. 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. In the navigation pane, select **Alerts queue**. @@ -104,8 +104,7 @@ If you have alerts that are either false positives or that are true positives bu Other actions, such as starting an antivirus scan or collecting an investigation package, can occur through [Live Response](live-response.md). Those actions cannot be undone. -> [!TIP] -> See [Review remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation). +After you have reviewed your alerts, your next step is to [review remediation actions](manage-auto-investigation.md). If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. After that, proceed to [review or define exclusions](#part-3-review-or-define-exclusions). ### Review completed actions From f0b5db42db04991d4d0a921afa3a23012134e131 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 16:36:30 -0800 Subject: [PATCH 29/39] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 784067032a..18ee9960a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -104,28 +104,26 @@ If you have alerts that are either false positives or that are true positives bu Other actions, such as starting an antivirus scan or collecting an investigation package, can occur through [Live Response](live-response.md). Those actions cannot be undone. -After you have reviewed your alerts, your next step is to [review remediation actions](manage-auto-investigation.md). If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. After that, proceed to [review or define exclusions](#part-3-review-or-define-exclusions). +After you have reviewed your alerts, your next step is to [review remediation actions](manage-auto-investigation.md). If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. Specifically, you can: +- [undo one action at a time](#undo-an-action); +- [undo multiple actions at one time](#undo-multiple-actions-at-one-time); and +- [remove a file from quarantine across multiple devices](#remove-a-file-from-quarantine-across-multiple-devices). + +When you're done reviewing and undoing actions that were taken as a result of false positives, proceed to [review or define exclusions](#part-3-review-or-define-exclusions). ### Review completed actions 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. -2. Select the **History** tab. +2. Select the **History** tab to view a list of actions that were taken.
![Action center](images/autoir-action-center-1.png) 3. Select an item to view more details about the remediation action that was taken. -If you find that a remediation action was taken automatically on an entity that is not actually a threat, you can undo the action. You can undo the following remediation actions: -- Isolate device -- Restrict code execution -- Quarantine a file -- Remove a registry key -- Stop a service -- Disable a driver -- Remove a scheduled task - ### Undo an action +If you find that a remediation action was taken automatically on an entity that is not actually a threat, you can undo the action. You can undo most remediation actions. + 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select an action that you want to undo. -3. In the flyout pane, select **Undo**. (If the action cannot be undone with this method, you will not see an **Undo** button.) +3. In the flyout pane, select **Undo**. If the action cannot be undone with this method, you will not see an **Undo** button. (To learn more, see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions).) ### Undo multiple actions at one time @@ -133,6 +131,13 @@ If you find that a remediation action was taken automatically on an entity that 2. On the **History** tab, select the actions that you want to undo. 3. In the pane on the right side of the screen, select **Undo**. +### Remove a file from quarantine across multiple devices + +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. On the **History** tab, select a file that has the Action type **Quarantine file**. +3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**.
![Quarantine file](images/autoir-quarantine-file-1.png) + + ## Part 3: Review or define exclusions An exclusion is an entity that you specify as an exception to remediation actions. The excluded entity might still get detected, but no remediation actions are taken on that entity. That is, the detected file or process won’t be stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint. @@ -142,7 +147,7 @@ To define exclusions across Microsoft Defender for Endpoint, perform the followi - [Create “allow” indicators for Microsoft Defender for Endpoint](#indicators-for-microsoft-defender-for-endpoint) > [!NOTE] -> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response), [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction), and [controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders). Files that you exclude using the methods described in this article can still trigger alerts and other detections. To exclude files broadly, use [custom indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators), such as "allow" indicators for Microsoft Defender for Endpoint. +> Microsoft Defender Antivirus exclusions apply only to antivirus protection, not across other Microsoft Defender for Endpoint capabilities. To exclude files broadly, use exclusions for Microsoft Defender Antivirus and [custom indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) for Microsoft Defender for Endpoint. The procedures in this section describe how to define exclusions and indicators. From 88c2ccb91f9599910eb8929a0bbd30971f2eda0f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 16:38:56 -0800 Subject: [PATCH 30/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 18ee9960a2..f61361d92e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -182,7 +182,7 @@ In general, you should not need to define exclusions for Microsoft Defender Anti [Indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) (specifically, indicators of compromise, or IoCs) enable your security operations team to define the detection, prevention, and exclusion of entities. For example, you can specify certain files to be omitted from scans and remediation actions in Microsoft Defender for Endpoint. Or, indicators can be used to generate alerts for certain files, IP addresses, or URLs. -To specify entities as exclusions for Microsoft Defender for Endpoint, you can create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to: +To specify entities as exclusions for Microsoft Defender for Endpoint, you can create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to the following capabilities: - [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) - [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) From 5a95a0a2fcf9286ed70efb477fd1cfa21e7cae1d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 26 Jan 2021 19:12:31 -0800 Subject: [PATCH 31/39] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index caeb8f45d2..780fb5a960 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -117,8 +117,10 @@ When you're done reviewing and undoing actions that were taken as a result of fa ### Review completed actions +![Action center](images/autoir-action-center-1.png) + 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. -2. Select the **History** tab to view a list of actions that were taken.
![Action center](images/autoir-action-center-1.png) +2. Select the **History** tab to view a list of actions that were taken. 3. Select an item to view more details about the remediation action that was taken. ### Undo an action @@ -137,10 +139,11 @@ If you find that a remediation action was taken automatically on an entity that ### Remove a file from quarantine across multiple devices +![Quarantine file](images/autoir-quarantine-file-1.png) + 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select a file that has the Action type **Quarantine file**. -3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**.
![Quarantine file](images/autoir-quarantine-file-1.png) - +3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**. ## Part 3: Review or define exclusions @@ -352,7 +355,6 @@ Depending on the [level of automation](https://docs.microsoft.com/windows/securi > [!TIP] > We recommend using *Full automation* for automated investigation and remediation. Don't turn these capabilities off because of a false positive. Instead, use ["allow" indicators to define exceptions](#indicators-for-microsoft-defender-for-endpoint), and keep automated investigation and remediation set to take appropriate actions automatically. Following [this guidance](automation-levels.md#levels-of-automation) helps reduce the number of alerts your security operations team must handle. - ## Still need help? If you have worked through all the steps in this article and still need help, your best bet is to contact technical support. @@ -365,4 +367,4 @@ If you have worked through all the steps in this article and still need help, yo [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md) -[Overview of Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) \ No newline at end of file +[Overview of Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use) From 95b12a62beb0830130ecb66f9d3e8155e26d8e31 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 07:37:27 -0800 Subject: [PATCH 32/39] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 47 ++++++++++--------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index caeb8f45d2..851be0216d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -11,7 +11,7 @@ ms.sitesec: library ms.pagetype: security ms.author: deniseb author: denisebmsft -ms.date: 01/26/2021 +ms.date: 01/27/2021 ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -52,7 +52,7 @@ And, you can [get help if you still have issues with false positives/negatives]( ## Part 1: Review and classify alerts -If you see an alert that was triggered because something was detected as malicious or suspicious that should not have been, you can suppress the alert for that entity. You can also suppress alerts that are not necessarily false positives, but are unimportant. We recommend that you classify alerts as well. +If you see an [alert](alerts.md) that was triggered because something was detected as malicious or suspicious that should not have been, you can suppress the alert for that entity. You can also suppress alerts that are not necessarily false positives, but are unimportant. We recommend that you classify alerts as well. Managing your alerts and classifying true/false positives helps to train your threat protection solution and can reduce the number of false positives or false negatives over time. Taking these steps also helps reduce noise in your security operations dashboard so that your security team can focus on higher priority work items. @@ -73,7 +73,7 @@ Before you classify or suppress an alert, determine whether the alert is accurat ### Classify an alert -You can classify an alert as a false positive or a true positive in the Microsoft Defender Security Center, in the **Alerts queue**. Classifying alerts helps train Microsoft Defender for Endpoint so that, over time, you'll see more true alerts and fewer false alerts. +Alerts can be classified as false positives or true positives in the Microsoft Defender Security Center. Classifying alerts helps train Microsoft Defender for Endpoint so that, over time, you'll see more true alerts and fewer false alerts. 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. Select **Alerts queue**, and then select an alert that is a false positive. @@ -98,7 +98,7 @@ If you have alerts that are either false positives or that are true positives bu ## Part 2: Review remediation actions -[Remediation actions](manage-auto-investigation.md#remediation-actions), such as sending a file to quarantine or stopping a process, can be taken on entities that are detected as threats. Several types of remediation actions can occur automatically through automated investigation and Microsoft Defender Antivirus. Examples of such actions include: +[Remediation actions](manage-auto-investigation.md#remediation-actions), such as sending a file to quarantine or stopping a process, are taken on entities (such as files) that are detected as threats. Several types of remediation actions occur automatically through automated investigation and Microsoft Defender Antivirus: - Quarantine a file - Remove a registry key - Kill a process @@ -106,25 +106,25 @@ If you have alerts that are either false positives or that are true positives bu - Disable a driver - Remove a scheduled task -Other actions, such as starting an antivirus scan or collecting an investigation package, can occur through [Live Response](live-response.md). Those actions cannot be undone. +Other actions, such as starting an antivirus scan or collecting an investigation package, occur manually or through [Live Response](live-response.md). Actions taken through Live Response cannot be undone. After you have reviewed your alerts, your next step is to [review remediation actions](manage-auto-investigation.md). If any actions were taken as a result of false positives, you can undo most kinds of remediation actions. Specifically, you can: -- [undo one action at a time](#undo-an-action); -- [undo multiple actions at one time](#undo-multiple-actions-at-one-time); and -- [remove a file from quarantine across multiple devices](#remove-a-file-from-quarantine-across-multiple-devices). +- [Undo one action at a time](#undo-an-action); +- [Undo multiple actions at one time](#undo-multiple-actions-at-one-time); and +- [Remove a file from quarantine across multiple devices](#remove-a-file-from-quarantine-across-multiple-devices). When you're done reviewing and undoing actions that were taken as a result of false positives, proceed to [review or define exclusions](#part-3-review-or-define-exclusions). ### Review completed actions +![Action center](images/autoir-action-center-1.png) + 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. -2. Select the **History** tab to view a list of actions that were taken.
![Action center](images/autoir-action-center-1.png) +2. Select the **History** tab to view a list of actions that were taken. 3. Select an item to view more details about the remediation action that was taken. ### Undo an action -If you find that a remediation action was taken automatically on an entity that is not actually a threat, you can undo the action. You can undo most remediation actions. - 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select an action that you want to undo. 3. In the flyout pane, select **Undo**. If the action cannot be undone with this method, you will not see an **Undo** button. (To learn more, see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions).) @@ -137,14 +137,15 @@ If you find that a remediation action was taken automatically on an entity that ### Remove a file from quarantine across multiple devices +![Quarantine file](images/autoir-quarantine-file-1.png) + 1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select a file that has the Action type **Quarantine file**. -3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**.
![Quarantine file](images/autoir-quarantine-file-1.png) - +3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**. ## Part 3: Review or define exclusions -An exclusion is an entity that you specify as an exception to remediation actions. The excluded entity might still get detected, but no remediation actions are taken on that entity. That is, the detected file or process won’t be stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint. +An exclusion is an entity, such as a file or URL, that you specify as an exception to remediation actions. The excluded entity can still get detected, but no remediation actions are taken on that entity. That is, the detected file or process won’t be stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint. To define exclusions across Microsoft Defender for Endpoint, perform the following tasks: - [Define exclusions for Microsoft Defender Antivirus](#exclusions-for-microsoft-defender-antivirus) @@ -157,7 +158,7 @@ The procedures in this section describe how to define exclusions and indicators. ### Exclusions for Microsoft Defender Antivirus -In general, you should not need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using Microsoft Endpoint Manager to define or edit your antivirus exclusions; however, you can use other methods, such as Group Policy as well. +In general, you should not need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to define or edit your antivirus exclusions; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). > [!TIP] > Need help with antivirus exclusions? See [Configure and validate exclusions for Microsoft Defender Antivirus scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus). @@ -186,13 +187,13 @@ In general, you should not need to define exclusions for Microsoft Defender Anti [Indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) (specifically, indicators of compromise, or IoCs) enable your security operations team to define the detection, prevention, and exclusion of entities. For example, you can specify certain files to be omitted from scans and remediation actions in Microsoft Defender for Endpoint. Or, indicators can be used to generate alerts for certain files, IP addresses, or URLs. -To specify entities as exclusions for Microsoft Defender for Endpoint, you can create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to the following capabilities: +To specify entities as exclusions for Microsoft Defender for Endpoint, create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to the following capabilities: - [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) - [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) - [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) -You can create indicators for: +"Allow" indicators can be created for: - [Files](#indicators-for-files) - [IP addresses, URLs, and domains](#indicators-for-ip-addresses-urls-or-domains) @@ -205,7 +206,7 @@ You can create indicators for: When you [create an "allow" indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file), it helps prevent files that your organization is using from being blocked. Files can include portable executable (PE) files, such as `.exe` and `.dll` files. Before you create indicators for files, make sure the following requirements are met: -- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus)) - Antimalware client version is 4.18.1901.x or later - Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 - The [Block or allow feature is turned on](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features) @@ -215,28 +216,28 @@ Before you create indicators for files, make sure the following requirements are When you [create an "allow" indicator for an IP address, URL, or domain](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain), it helps prevent the sites or IP addresses your organization uses from being blocked. Before you create indicators for IP addresses, URLs, or domains, make sure the following requirements are met: -- Network protection in Defender for Endpoint is enabled in block mode (See [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection)) +- Network protection in Defender for Endpoint is enabled in block mode (see [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection)) - Antimalware client version is 4.18.1906.x or later - Devices are running Windows 10, version 1709, or later -Custom network indicators are turned on in the Microsoft Defender Security Center (See [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features).) +Custom network indicators are turned on in the Microsoft Defender Security Center (see [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features)) #### Indicators for application certificates When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates), it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported. Before you create indicators for application certificates, make sure the following requirements are met: -- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).) +- Microsoft Defender Antivirus is configured with cloud-based protection enabled (see [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus)) - Antimalware client version is 4.18.1901.x or later - Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019 - Virus and threat protection definitions are up to date > [!TIP] -> When you create indicators, you can define them one by one or import multiple items at once. Keep in mind there's a limit of 15,000 indicators you can have in a single tenant. And, you might need to gather certain details first, such as file hash information. Make sure to review the prerequisites before you [create indicators](manage-indicators.md). +> When you create indicators, you can define them one by one, or import multiple items at once. Keep in mind there's a limit of 15,000 indicators for a single tenant. And, you might need to gather certain details first, such as file hash information. Make sure to review the prerequisites before you [create indicators](manage-indicators.md). ## Part 4: Submit a file for analysis -You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions. When you sign in at the submission site, you can track your submissions. +You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions, and . When you sign in at the submission site, you can track your submissions. ### Submit a file for analysis From 592c3d4fe02ed21e25325b56985c93471c329682 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 07:51:06 -0800 Subject: [PATCH 33/39] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 26 +++++++++---------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 851be0216d..80c64fb69d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -187,11 +187,7 @@ In general, you should not need to define exclusions for Microsoft Defender Anti [Indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) (specifically, indicators of compromise, or IoCs) enable your security operations team to define the detection, prevention, and exclusion of entities. For example, you can specify certain files to be omitted from scans and remediation actions in Microsoft Defender for Endpoint. Or, indicators can be used to generate alerts for certain files, IP addresses, or URLs. -To specify entities as exclusions for Microsoft Defender for Endpoint, create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to the following capabilities: - -- [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) -- [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) -- [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) +To specify entities as exclusions for Microsoft Defender for Endpoint, create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to [next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10), [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response), and [automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations). "Allow" indicators can be created for: @@ -237,7 +233,7 @@ Before you create indicators for application certificates, make sure the followi ## Part 4: Submit a file for analysis -You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions, and . When you sign in at the submission site, you can track your submissions. +You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions, and their results help inform Microsoft Defender for Endpoint threat protection capabilities. When you sign in at the submission site, you can track your submissions. ### Submit a file for analysis @@ -273,7 +269,7 @@ To check for updates regarding your submission, sign in at the [Microsoft Securi ## Part 5: Review and adjust your threat protection settings -Microsoft Defender for Endpoint offers a wide variety of options, including the ability to fine-tune settings for various features and capabilities. If you’re getting numerous false positives, make sure to review your organization’s threat protection settings. You might need to make some adjustments to the following settings in particular: +Microsoft Defender for Endpoint offers a wide variety of options, including the ability to fine-tune settings for various features and capabilities. If you’re getting numerous false positives, make sure to review your organization’s threat protection settings. You might need to make some adjustments to: - [Cloud-delivered protection](#cloud-delivered-protection) - [Remediation for potentially unwanted applications](#remediation-for-potentially-unwanted-applications) @@ -288,6 +284,8 @@ Check your cloud-delivered protection level for Microsoft Defender Antivirus. By We recommend using Microsoft Endpoint Manager to edit or set your cloud-delivered protection settings. +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to edit or set your cloud-delivered protection settings; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). + #### Use Microsoft Endpoint Manager to review and edit cloud-delivered protection settings (for existing policies) 1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in. @@ -312,13 +310,13 @@ We recommend using Microsoft Endpoint Manager to edit or set your cloud-delivere ### Remediation for potentially unwanted applications Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA is not considered malware, some kinds of software are PUA based on their behavior and reputation. - -Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. - -We recommend using Microsoft Endpoint Manager to edit or set PUA protection settings. > [!TIP] > To learn more about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). + +Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus. + +We recommend using [Microsoft Endpoint Manager](https://docs.microsoft.com/mem/endpoint-manager-overview) to edit or set PUA protection settings; however, you can use other methods, such as [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy) (see [Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)). #### Use Microsoft Endpoint Manager to edit PUA protection (for existing configuration profiles) @@ -345,18 +343,18 @@ We recommend using Microsoft Endpoint Manager to edit or set PUA protection sett [Automated investigation and remediation](automated-investigations.md) (AIR) capabilities are designed to examine alerts and take immediate action to resolve breaches. As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. -Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization and other security settings, remediation actions are taken on artifacts deemed Malicious or Suspicious. Remediation actions can occur automatically, or only upon approval by your security operations team. +Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization and other security settings, remediation actions are taken on artifacts that are considered to be *Malicious* or *Suspicious*. In some cases, remediation actions occur automatically; in other cases, remediation actions are taken manually or only upon approval by your security operations team. - [Learn more about automation levels](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels); and then - [Configure AIR capabilities in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation). -> [!TIP] +> [!IMPORTANT] > We recommend using *Full automation* for automated investigation and remediation. Don't turn these capabilities off because of a false positive. Instead, use ["allow" indicators to define exceptions](#indicators-for-microsoft-defender-for-endpoint), and keep automated investigation and remediation set to take appropriate actions automatically. Following [this guidance](automation-levels.md#levels-of-automation) helps reduce the number of alerts your security operations team must handle. ## Still need help? -If you have worked through all the steps in this article and still need help, your best bet is to contact technical support. +If you have worked through all the steps in this article and still need help, contact technical support. 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. In the upper right corner, select the question mark (**?**), and then select **Microsoft support**. From 37c50b4ecc433f63043aa1b2f004097c4173000b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 08:04:19 -0800 Subject: [PATCH 34/39] yanking AV false positives article --- windows/security/threat-protection/TOC.md | 1 - .../antivirus-false-positives-negatives.md | 83 ------------------- 2 files changed, 84 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 76bfdf55f4..0e49e0f09b 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -176,7 +176,6 @@ ###### [Use PowerShell cmdlets to manage next-generation protection](microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md) ###### [Use Windows Management Instrumentation (WMI) to manage next-generation protection](microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md) ###### [Use the mpcmdrun.exe command line tool to manage next-generation protection](microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus.md) -###### [Handle false positives/negatives in Microsoft Defender Antivirus](microsoft-defender-antivirus/antivirus-false-positives-negatives.md) ##### [Deploy, manage updates, and report on antivirus]() ###### [Preparing to deploy](microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md deleted file mode 100644 index e99e915192..0000000000 --- a/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md +++ /dev/null @@ -1,83 +0,0 @@ ---- -title: What to do with false positives/negatives in Microsoft Defender Antivirus -description: Did Microsoft Defender Antivirus miss or wrongly detect something? Find out what you can do. -keywords: Microsoft Defender Antivirus, false positives, false negatives, exclusions -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.custom: nextgen -ms.date: 01/26/2021 -ms.reviewer: shwetaj -manager: dansimp -audience: ITPro -ms.topic: article -ms.technology: mde ---- - -# What to do with false positives/negatives in Microsoft Defender Antivirus - -[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - - -**Applies to:** - -- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - -Microsoft Defender Antivirus is designed to keep your PC safe with built-in, trusted antivirus protection. With Microsoft Defender Antivirus, you get comprehensive, ongoing, and real-time protection against software threats like viruses, malware, and spyware across email, apps, the cloud, and the web. - -What if something gets detected wrongly as malware, or something is missed? We call these false positives and false negatives. Fortunately, there are some steps you can take to deal with these issues. You can: -- [Submit a file to Microsoft for analysis](#submit-a-file-to-microsoft-for-analysis) -- [Create an "Allow" indicator to prevent a false positive from recurring](#create-an-allow-indicator-to-prevent-a-false-positive-from-recurring) -- [Define an exclusion on an individual Windows device to prevent an item from being scanned](#define-an-exclusion-on-an-individual-windows-device-to-prevent-an-item-from-being-scanned) - -> [!TIP] -> This article focuses on false positives in Microsoft Defender Antivirus. If you want guidance for Microsoft Defender for Endpoint, which includes next-generation protection, endpoint detection and response, automated investigation and remediation, and more, see [Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md). - -## Submit a file to Microsoft for analysis - -1. Review the [submission guidelines](../intelligence/submission-guide.md). -2. [Submit your file or sample](https://www.microsoft.com/wdsi/filesubmission). - -> [!TIP] -> We recommend signing in at the submission portal so you can track the results of your submissions. - -## Create an "Allow" indicator to prevent a false positive from recurring - -If a file, IP address, URL, or domain is treated as malware on a device, even though it's safe, you can create an "Allow" indicator. This indicator tells Microsoft Defender Antivirus (and Microsoft Defender for Endpoint) that the item is safe. - -To set up your "Allow" indicator, follow the guidance in [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators). - -## Define an exclusion on an individual Windows device to prevent an item from being scanned - -When you define an exclusion for Microsoft Defender Antivirus, you configure your antivirus to skip that item. - -1. On your Windows 10 device, open the Windows Security app. -2. Select **Virus & threat protection** > **Virus & threat protection settings**. -3. Under **Exclusions**, select **Add or remove exclusions**. -4. Select **+ Add an exclusion**, and specify its type (**File**, **Folder**, **File type**, or **Process**). - -The following table summarizes exclusion types, how they're defined, and what happens when they're in effect. - -|Exclusion type |Defined by |What happens | -|---------|---------|---------| -|**File** |Location
Example: `c:\sample\sample.test` |The specified file is skipped by Microsoft Defender Antivirus. | -|**Folder** |Location
Example: `c:\test\sample` |All items in the specified folder are skipped by Microsoft Defender Antivirus. | -|**File type** |File extension
Example: `.test` |All files with the specified extension anywhere on your device are skipped by Microsoft Defender Antivirus. | -|**Process** |Executable file path
Example: `c:\test\process.exe` |The specified process and any files that are opened by that process are skipped by Microsoft Defender Antivirus. | - -To learn more, see: -- [Configure and validate exclusions based on file extension and folder location](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus) -- [Configure exclusions for files opened by processes](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus) - -## Related articles - -[What is Microsoft Defender for Endpoint?](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) - -[Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection) - -[Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md) \ No newline at end of file From 79c75450d4907cafbac4d82e359b16256cc089f8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 08:06:27 -0800 Subject: [PATCH 35/39] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 7bcd7f8d15..6c6cd0335b 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -16519,6 +16519,11 @@ "source_path": "windows/hub/windows-10.yml", "redirect_url": "https://docs.microsoft.com/windows/windows-10", "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives", + "redirect_document_id": true } ] } From cc757691fac0332d41ab38cd26ad2eb471bb0c98 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 27 Jan 2021 10:56:07 -0800 Subject: [PATCH 36/39] Release notes for MDE for Mac 101.19.48 --- .../microsoft-defender-atp/mac-whatsnew.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 617e8532aa..9053de5168 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -30,6 +30,14 @@ ms.technology: mde > [!IMPORTANT] > Support for macOS 10.13 (High Sierra) will be discontinued on February 15th, 2021. +## 101.19.48 + +> [!NOTE] +> The old command-line tool syntax has been deprecated with this release. + +- Added a new command-line switch to disable the network extension: `mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint for Mac +- Performance improvements & bug fixes + ## 101.19.21 - Bug fixes From 560702cef3489eefad29fff075b4fdae0f92ce31 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 11:32:53 -0800 Subject: [PATCH 37/39] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 8b351b1709..6a64647a0c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -61,24 +61,24 @@ Managing your alerts and classifying true/false positives helps to train your th Before you classify or suppress an alert, determine whether the alert is accurate, a false positive, or benign. 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. -2. In the navigation pane, choose **Alerts queue**. -3. Select an alert to more details about the alert. (See [Review alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts).) -4. Depending on the alert status, take the steps described in the following table: +2. In the navigation pane, choose **Alerts queue**. +3. Select an alert to more details about the alert. (See [Review alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts).) +4. Depending on the alert status, take the steps described in the following table: - | Alert status | What to do | - |:---|:---| - | The alert is accurate | Assign the alert, and then [investigate it](investigate-alerts.md) further. | - | The alert is a false positive | 1. [Classify the alert](#classify-an-alert) as a false positive.
2. [Suppress the alert](#suppress-an-alert).
3. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint.
4. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). | - | The alert is accurate, but benign (unimportant) | [Classify the alert](#classify-an-alert) as a true positive, and then [suppress the alert](#suppress-an-alert). | +| Alert status | What to do | +|:---|:---| +| The alert is accurate | Assign the alert, and then [investigate it](investigate-alerts.md) further. | +| The alert is a false positive | 1. [Classify the alert](#classify-an-alert) as a false positive.
2. [Suppress the alert](#suppress-an-alert).
3. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint.
4. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). | +| The alert is accurate, but benign (unimportant) | [Classify the alert](#classify-an-alert) as a true positive, and then [suppress the alert](#suppress-an-alert). | ### Classify an alert Alerts can be classified as false positives or true positives in the Microsoft Defender Security Center. Classifying alerts helps train Microsoft Defender for Endpoint so that, over time, you'll see more true alerts and fewer false alerts. -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. -2. Select **Alerts queue**, and then select an alert that is a false positive. -3. For the selected alert, select **Actions** > **Manage alert**. A flyout pane opens. -4. In the **Manage alert** section, select either **True alert** or **False alert**. (Use **False alert** to classify a false positive.) +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. Select **Alerts queue**, and then select an alert. +3. For the selected alert, select **Actions** > **Manage alert**. A flyout pane opens. +4. In the **Manage alert** section, select either **True alert** or **False alert**. (Use **False alert** to classify a false positive.) > [!TIP] > For more information about suppressing alerts, see [Manage Microsoft Defender for Endpoint alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts). And, if your organization is using a security information and event management (SIEM) server, make sure to define a suppression rule there, too. @@ -87,11 +87,11 @@ Alerts can be classified as false positives or true positives in the Microsoft D If you have alerts that are either false positives or that are true positives but for unimportant events, you can suppress those alerts in the Microsoft Defender Security Center. Suppressing alerts helps reduce noise in your security operations dashboard. -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. -2. In the navigation pane, select **Alerts queue**. -3. Select an alert that you want to suppress to open its **Details** pane. -4. In the **Details** pane, choose the ellipsis (**...**), and then **Create a suppression rule**. -5. Specify all the settings for your suppression rule, and then choose **Save**. +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +2. In the navigation pane, select **Alerts queue**. +3. Select an alert that you want to suppress to open its **Details** pane. +4. In the **Details** pane, choose the ellipsis (**...**), and then **Create a suppression rule**. +5. Specify all the settings for your suppression rule, and then choose **Save**. > [!TIP] > Need help with suppression rules? See [Suppress an alert and create a new suppression rule](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts#suppress-an-alert-and-create-a-new-suppression-rule). @@ -123,15 +123,15 @@ When you're done reviewing and undoing actions that were taken as a result of fa ### Undo an action -1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select an action that you want to undo. -3. In the flyout pane, select **Undo**. If the action cannot be undone with this method, you will not see an **Undo** button. (To learn more, see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions).) +3. In the flyout pane, select **Undo**. If the action cannot be undone with this method, you will not see an **Undo** button. (To learn more, see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions).) ### Undo multiple actions at one time -1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. -2. On the **History** tab, select the actions that you want to undo. -3. In the pane on the right side of the screen, select **Undo**. +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. +2. On the **History** tab, select the actions that you want to undo. +3. In the pane on the right side of the screen, select **Undo**. ### Remove a file from quarantine across multiple devices From 87a43c486a27d80811f79d30915204bd20dbcb0a Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 27 Jan 2021 11:37:23 -0800 Subject: [PATCH 38/39] Add link to new syntax --- .../threat-protection/microsoft-defender-atp/mac-whatsnew.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 9053de5168..2ae1e83837 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -33,7 +33,7 @@ ms.technology: mde ## 101.19.48 > [!NOTE] -> The old command-line tool syntax has been deprecated with this release. +> The old command-line tool syntax has been deprecated with this release. For information on the new syntax, see [Resources](mac-resources.md#configuring-from-the-command-line). - Added a new command-line switch to disable the network extension: `mdatp system-extension network-filter disable`. This command can be useful to troubleshoot networking issues that could be related to Microsoft Defender for Endpoint for Mac - Performance improvements & bug fixes From 5db9bdd39f5af3eb34f60c0c86b8656fe6d0032b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 27 Jan 2021 13:59:44 -0800 Subject: [PATCH 39/39] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index ad505f776b..20419165db 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: tewchen, pahuijbr, shwjha manager: dansimp -ms.date: 01/22/2021 +ms.date: 01/27/2021 ms.technology: mde --- @@ -89,10 +89,12 @@ The table in this section summarizes the functionality and features that are ava | [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | Yes | See note [[4](#fn4)] | Yes | No | | [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | Yes | Yes | Yes | No | -(3) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode. However, if [Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) (Endpoint DLP) is configured and in effect, protective actions are enforced. Endpoint DLP works with real-time protection and behavior monitoring. +(3) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode. (4) When Microsoft Defender Antivirus is in passive mode, threat remediation features are active only during scheduled or on-demand scans. +> [!NOTE] +> [Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) protection continues to operate normally when Microsoft Defender Antivirus is in active or passive mode. ## Keep the following points in mind