From 37bd1a4e9b0f8406e1f0bcd9e35c9f4cc94461e1 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 31 Oct 2017 13:55:00 -0700 Subject: [PATCH 01/16] safety commit --- .../update/waas-delivery-optimization.md | 55 ++++++++++++------- 1 file changed, 36 insertions(+), 19 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index be0f75a719..b184ae9d5f 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -4,10 +4,10 @@ description: Delivery Optimization is a new peer-to-peer distribution method in ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: DaniHalfin +author: JaimeO ms.localizationpriority: high -ms.author: daniha -ms.date: 07/27/2017 +ms.author: jaimeo +ms.date: 11/01/2017 --- # Configure Delivery Optimization for Windows 10 updates @@ -19,16 +19,16 @@ ms.date: 07/27/2017 > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Delivery Optimization is a self-organizing distributed cache solution for businesses looking to reduce bandwidth consumption for operating system updates, operating system upgrades, and applications by allowing clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. +Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of processor and network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. -Delivery Optimization is a cloud managed solution. Having access to the Delivery Optimization cloud services, is a requirement for it to be enabled. This means that in order to utilize the peer-to-peer functionality of Delivery Optimization, machines need to have access to the internet. +Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. For more details, see [Download mode](#download-mode). >[!NOTE] >WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. -By default in Windows 10 Enterprise and Education, Delivery Optimization allows peer-to-peer sharing on the organization's own network only, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. +By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. ## Delivery Optimization options @@ -58,13 +58,13 @@ Several Delivery Optimization features are configurable: | [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) | DOAllowVPNPeerCaching | 1703 | | [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) | DOMinBatteryPercentageAllowedToUpload | 1703 | -When configuring Delivery Optimization on Windows 10 devices, the first and most important thing to configure, would be [Download mode](#download-mode). Download mode dictates how Delivery Optimization downloads Windows updates. +When configuring Delivery Optimization on Windows 10 devices, the first and most important thing to configure is the [Download mode](#download-mode), which dictates how Delivery Optimization downloads Windows updates. While every other feature setting is optional, they offer enhanced control of the Delivery Optimization behavior. [Group ID](#group-id), combined with Group [Download mode](#download-mode), enables administrators to create custom device groups that will share content between devices in the group. -Delivery Optimization uses locally cached updates. In cases where devices have ample local storage and you would like to cache more content, or if you have limited storage and would like to cache less, use the settings below to adjust the Delivery Optimization cache to suit your scenario: +Delivery Optimization uses locally cached updates. In cases where devices have ample local storage and you would like to cache more content, or if you have limited storage and would like to cache less, use the following settings to adjust the Delivery Optimization cache to suit your scenario: - [Max Cache Size](#max-cache-size) and [Absolute Max Cache Size](#absolute-max-cache-size) control the amount of space the Delivery Optimization cache can use. - [Max Cache Age](#max-cache-age) controls the retention period for each update in the cache. - The system drive is the default location for the Delivery Optimization cache. [Modify Cache Drive](#modify-cache-drive) allows administrators to change that location. @@ -72,22 +72,22 @@ Delivery Optimization uses locally cached updates. In cases where devices have a >[!NOTE] >It is possible to configure preferred cache devices. For more information, see [Set “preferred” cache devices for Delivery Optimization](#set-preferred-cache-devices). -All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services. Administrators may choose to change it, which will result in increased performance, when local storage is sufficient and the network isn't strained or congested. [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size) determines the minimum size of files to be cached. +All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size). -There are additional options available to robustly control the impact Delivery Optimization has on your network: -- [Maximum Download Bandwidth](#maximum-download-bandwidth) and [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) controls the download bandwidth used by Delivery Optimization. +Additional options available that control the impact Delivery Optimization has on your network include the following: +- [Maximum Download Bandwidth](#maximum-download-bandwidth) and [Percentage of Maximum Download Bandwidth](#percentage-of-maximum-download-bandwidth) control the download bandwidth used by Delivery Optimization. - [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage. -- [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers per month. +- [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month. - [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This is achieved by adjusting the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network. -Various controls allow administrators to further customize scenarios where Delivery Optimization will be used: +Administrators can further customize scenarios where Delivery Optimization will be used with the following settings: - [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled. - [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) sets the minimum disk size required for peer caching to be enabled. - [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) allows clients connected through VPN to use peer caching. -- [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. Enabling this policy is required to allow upload while on battery. +- [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. You must enable this policy to allow upload while on battery. ### How Microsoft uses Delivery Optimization -In Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. +At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. @@ -95,7 +95,7 @@ Provided below is a detailed description of every configurable feature setting. ### Download mode -Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. +Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. | Download mode option | Functionality when set | | --- | --- | @@ -107,11 +107,11 @@ Download mode dictates which download sources clients are allowed to use when do |Bypass (100) | Bypass Delivery Optimization and use BITS, instead. For example, select this mode so that clients can use BranchCache. | >[!NOTE] ->Group mode is a best effort optimization and should not be relied on for an authentication of identity of devices participating in the group. +>Group mode is a best-effort optimization and should not be relied on for an authentication of identity of devices participating in the group. ### Group ID -By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to peer. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. +By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. >[!NOTE] >To generate a GUID using Powershell, use [```[guid]::NewGuid()```](https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/) @@ -133,7 +133,7 @@ This setting specifies the required minimum disk size (capacity in GB) for the d ### Max Cache Age -In environments configured for Delivery Optimization, you may want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client computer. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations may choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). +In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client computer. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). ### Max Cache Size @@ -194,6 +194,23 @@ On devices that are not preferred, you can choose to set the following policy to - Set **DOMinBackgroundQoS** with a low value, for example `64` which is the equivalent of 64 KB/s. + +## Windows PowerShell cmdlets for analyzing usage +Starting in Windows 10, version 1703, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization: + +**Get-DeliveryOptimizationStatus** returns a real-time snapshot of all current Delivery Optimization jobs + +| Key | Value | +| --- | --- | +| File ID | A GUID that identifies the file being processed | +| FileSize | Size of the file | +| TotalBytesDownloaded | Amount of the the file processed so far | +| PercentPeerCaching | | +| BytesFromPeers | Total bytes from Peers (sum of bytes from LAN, Group, and Internet Peers) | +| + +- `Get-DeliveryOptimizationPerfSnap` + ## Learn more [Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) From 705628f68e1255e2edd1f2a9be1afb777604bd3c Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 1 Nov 2017 10:57:26 -0700 Subject: [PATCH 02/16] new items for 1709 --- .../update/waas-delivery-optimization.md | 64 +++++++++++++++++-- 1 file changed, 58 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index b184ae9d5f..db9bbb300e 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -100,7 +100,7 @@ Download mode dictates which download sources clients are allowed to use when do | Download mode option | Functionality when set | | --- | --- | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | -| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. | +| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. Delivery Optimization uses the client's public IP address to determine which peers are on the same network. The cloud service matches clients that connect to the Internet using the same public IP and returns to the client a list of private IPs to connect to on that network. The clients then attempt to connect to each other via the private subnet IP. If devices in different branches use different public IPs then there should be no connectivity between branches. | | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | @@ -198,18 +198,70 @@ On devices that are not preferred, you can choose to set the following policy to ## Windows PowerShell cmdlets for analyzing usage Starting in Windows 10, version 1703, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization: -**Get-DeliveryOptimizationStatus** returns a real-time snapshot of all current Delivery Optimization jobs +`Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs. | Key | Value | | --- | --- | | File ID | A GUID that identifies the file being processed | +| Priority | Priority of the download; values are **foreground** or **background** | | FileSize | Size of the file | | TotalBytesDownloaded | Amount of the the file processed so far | -| PercentPeerCaching | | -| BytesFromPeers | Total bytes from Peers (sum of bytes from LAN, Group, and Internet Peers) | -| +| PercentPeerCaching |[???] | +| BytesFromPeers | Total bytes from peer computers participating in Delivery Optimization (sum of bytes from LAN, Group, and Internet Peers) | +| BytesfromHTTP | Total number of bytes received over HTTP | +| DownloadDuration | Total download time in seconds | +| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not seeding yet); **Caching** (download completed successfully and is seeding); **Paused** (download/upload paused by Windows Update) | + +Using the `-Verbose` option returns additional information: + +| Key | Value | +| --- | --- | +| HTTPUrl| The URL where the download originates | +| BytesFromLANPeers | Total bytes from peer computers on the same LAN |  +| BytesFromGroupPeers | Total bytes from peer copmuters in the same Group |  +| BytesFrom IntPeers | Total bytes from [???}] | +| HTTPConnectionCount | Number of active connections over HTTP |  +| LANConnectionCount | Number of active connections over LAN | +| GroupConnectionCount | Number of active connections to other computers in the Group |  +| IntConnectionCount | Number of active connections to [???] |  +| DownloadMode | Indicates [???] | +  + +- `Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: + +- Number of files downloaded  +- Number of files uploaded  +- Total bytes downloaded  +- Total bytes uploaded  +- Average transfer size (download); that is, the number bytes downloaded divided by the number of files  +- Average transfer size (upload); the number of bytes uploaded divided by the number of files +- Peer efficiency: [???] + +Using the `-Verbose` option returns additional information: + +- Bytes from peers (per type)  +- Bytes from CDN  [???] +- Average number of peer connections per download  + +## Frequently asked questions + +**Does Delivery Optimization work with WSUS?**: Yes. Devices must also have an Internet connection. + +**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 or 3544 (Teredo). For client service, it uses port 80/443. + +**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. + +**What hostnames should I allow through my firewall to support Delivery Optimization?**: For the Delivery Optimization service itself: ***.do.dsp.mp.microsoft.com**. + +To allow the download payloads: +- *.download.windowsupdate.com +- *.windowsupdate.com +- *.dl.delivery.mp.microsoft.com +- *.emdl.ws.microsoft.com + + + -- `Get-DeliveryOptimizationPerfSnap` ## Learn more From 70a103c7d1eb8e3d3239b019ffebc1bf740fb580 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Wed, 1 Nov 2017 11:25:15 -0700 Subject: [PATCH 03/16] changed date to retry build --- windows/deployment/update/waas-delivery-optimization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index db9bbb300e..4377977cce 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -7,7 +7,7 @@ ms.sitesec: library author: JaimeO ms.localizationpriority: high ms.author: jaimeo -ms.date: 11/01/2017 +ms.date: 11/02/2017 --- # Configure Delivery Optimization for Windows 10 updates From 279d88d49ab72757c8805f7efab56b29a37e06c8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 7 Nov 2017 13:13:47 -0800 Subject: [PATCH 04/16] new topic about how to opt-in to HVCI --- windows/device-security/TOC.md | 1 + ...w-to-opt-in-to-hvci-for-windows-devices.md | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md diff --git a/windows/device-security/TOC.md b/windows/device-security/TOC.md index 5294ed490a..8682940443 100644 --- a/windows/device-security/TOC.md +++ b/windows/device-security/TOC.md @@ -125,6 +125,7 @@ ## [Encrypted Hard Drive](encrypted-hard-drive.md) +## [How to opt-in to HVCI](how-to-opt-in-to-hvci-for-windows-devices.md) ## [Security auditing](auditing\security-auditing-overview.md) ### [Basic security audit policies](auditing\basic-security-audit-policies.md) diff --git a/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md b/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md new file mode 100644 index 0000000000..d56eddac4b --- /dev/null +++ b/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md @@ -0,0 +1,25 @@ +--- +title: How to opt-in to Hypervisor based Code Integrity (HVCI) protection for Windows devices +description: This article explains the steps to opt in to using HVCI on Windows devices. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: high +ms.author: justinha +author: brianlic-msft +ms.date: 11/07/2017 +--- + +# How to opt-in to Hypervisor based Code Integrity (HVCI) protection for Windows devices + +**Applies to** + +- Windows 10 +- Windows Server 2016 + +Replace this text with an Introduction. + +## Heading + +Intro para. + +### Subheading \ No newline at end of file From 852a317639df0971e567d4870582644fbac7d480 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Mon, 13 Nov 2017 13:24:05 -0800 Subject: [PATCH 05/16] incorp from Narkis review --- .../update/waas-delivery-optimization.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 4377977cce..bbc850f96b 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -7,7 +7,7 @@ ms.sitesec: library author: JaimeO ms.localizationpriority: high ms.author: jaimeo -ms.date: 11/02/2017 +ms.date: 11/13/2017 --- # Configure Delivery Optimization for Windows 10 updates @@ -19,7 +19,7 @@ ms.date: 11/02/2017 > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of processor and network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. +Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or the "Express packages" feature of System Center Configuration Manager. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. @@ -100,7 +100,7 @@ Download mode dictates which download sources clients are allowed to use when do | Download mode option | Functionality when set | | --- | --- | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | -| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. Delivery Optimization uses the client's public IP address to determine which peers are on the same network. The cloud service matches clients that connect to the Internet using the same public IP and returns to the client a list of private IPs to connect to on that network. The clients then attempt to connect to each other via the private subnet IP. If devices in different branches use different public IPs then there should be no connectivity between branches. | +| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. Delivery Optimization finds other clients that connect to the Internet using the same public IP as the target client. It returns a list of private IPs to connect to on that network. These clients then attempt to connect to each other by using the private subnet IP. | | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | @@ -133,11 +133,11 @@ This setting specifies the required minimum disk size (capacity in GB) for the d ### Max Cache Age -In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client computer. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). +In environments configured for Delivery Optimization, you might want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client device. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations might choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). ### Max Cache Size -This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows 10 client computer that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. The default value for this setting is 20. +This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows 10 client device that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. The default value for this setting is 20. ### Absolute Max Cache Size @@ -205,26 +205,26 @@ Starting in Windows 10, version 1703, you can use two new PowerShell cmdlets to | File ID | A GUID that identifies the file being processed | | Priority | Priority of the download; values are **foreground** or **background** | | FileSize | Size of the file | -| TotalBytesDownloaded | Amount of the the file processed so far | -| PercentPeerCaching |[???] | -| BytesFromPeers | Total bytes from peer computers participating in Delivery Optimization (sum of bytes from LAN, Group, and Internet Peers) | +| TotalBytesDownloaded | The number of bytes from any source downloaded so far | +| PercentPeerCaching |The percentage of bytes received that have come from peers | +| BytesFromPeers | Total bytes from peer devices participating in Delivery Optimization (sum of bytes from LAN, Group, and Internet Peers) | | BytesfromHTTP | Total number of bytes received over HTTP | | DownloadDuration | Total download time in seconds | -| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not seeding yet); **Caching** (download completed successfully and is seeding); **Paused** (download/upload paused by Windows Update) | +| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is seeding); **Paused** (download/upload paused by caller) | Using the `-Verbose` option returns additional information: | Key | Value | | --- | --- | | HTTPUrl| The URL where the download originates | -| BytesFromLANPeers | Total bytes from peer computers on the same LAN |  -| BytesFromGroupPeers | Total bytes from peer copmuters in the same Group |  -| BytesFrom IntPeers | Total bytes from [???}] | +| BytesFromLANPeers | Total bytes from peer devices on the same LAN |  +| BytesFromGroupPeers | Total bytes from peer devices in the same Group |  +| BytesFrom IntPeers | Total bytes from internet peers | | HTTPConnectionCount | Number of active connections over HTTP |  | LANConnectionCount | Number of active connections over LAN | -| GroupConnectionCount | Number of active connections to other computers in the Group |  -| IntConnectionCount | Number of active connections to [???] |  -| DownloadMode | Indicates [???] | +| GroupConnectionCount | Number of active connections to other devices in the Group |  +| IntConnectionCount | Number of active connections to internet peers |  +| DownloadMode | Indicates the download mode (see the "Download Mode" section for details) |   - `Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: @@ -235,19 +235,19 @@ Using the `-Verbose` option returns additional information: - Total bytes uploaded  - Average transfer size (download); that is, the number bytes downloaded divided by the number of files  - Average transfer size (upload); the number of bytes uploaded divided by the number of files -- Peer efficiency: [???] +- Peer efficiency; same as PercentPeerCaching Using the `-Verbose` option returns additional information: - Bytes from peers (per type)  -- Bytes from CDN  [???] +- Bytes from CDN  (the number of bytes received over HTTP) - Average number of peer connections per download  ## Frequently asked questions -**Does Delivery Optimization work with WSUS?**: Yes. Devices must also have an Internet connection. +**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Download Optimization cloud service for coordination. -**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 or 3544 (Teredo). For client service, it uses port 80/443. +**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 or 3544 (Teredo). For client-service communication, it uses port 80/443. **What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. From 931b455d50dafc8ceae08ca96d1b195b79674186 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 17 Nov 2017 16:02:56 -0800 Subject: [PATCH 06/16] new file about how to turn HVCI on or off --- ...tion-based-protection-of-code-integrity.md | 69 ++++++++++++++++++ ...w-to-opt-in-to-hvci-for-windows-devices.md | 25 ------- .../turn-windows-features-on-or-off.png | Bin 0 -> 78789 bytes 3 files changed, 69 insertions(+), 25 deletions(-) create mode 100644 windows/device-security/enable-virtualization-based-protection-of-code-integrity.md delete mode 100644 windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md create mode 100644 windows/device-security/images/turn-windows-features-on-or-off.png diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md new file mode 100644 index 0000000000..8450dfa0f6 --- /dev/null +++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md @@ -0,0 +1,69 @@ +--- +title: Enable virtualization-based protection of code integrity +description: This article explains the steps to opt in to using HVCI on Windows devices. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: high +ms.author: justinha +author: brianlic-msft +ms.date: 11/07/2017 +--- + +# Enable virtualization-based protection of code integrity + +**Applies to** + +- Windows 10 +- Windows Server 2016 + +Virtualization-based protection of code integrity (herein refered to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity checks for kernel-mode memory pages are performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. + +Some applications, including device drivers, may be incompatible with HVCI. +This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. +If this happens, see the [Troubleshooting section](#troubleshooting) for remediation steps. + +## How to Turn on virtualization-based protection of code integrity on the Windows 10 Fall Creators Update (version 1709) + +These steps apply to Windows 10 S, Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. + +The following instructions are intended for Windows 10 client systems running the Fall Creators Update (version 1709) that have hypervisor support and that are not already using a [Windows Defender Application Control (WDAC)](https://blogs.technet.microsoft.com/mmpc/2017/10/23/introducing-windows-defender-application-control/) policy. +If your device already has a WDAC policy (SIPolicy.p7b), please contact your IT administrator to request HVCI. + +> [!NOTE] +> You must be an administrator to perform this procedure. + +1. Download the Enable HVCI cabinet file. +2. Open the cabinet file. +3. Right-click the SIPolicy.p7b file and extract it to the following location: + + C:\Windows\System32\CodeIntegrity + + > [!NOTE] + > Do not perform this step if a SIPolicy.p7b file is already in this location. + +4. Turn on the hypervisor: + + a. Click Start, type **Turn Windows Features on or off** and press ENTER. + + b. Select **Hyper-V** > **Hyper-V Platform** > **Hypervisor** and click **OK**. + + ![Turn Windows features on or off](images\turn-windows-features-on-or-off.png) + + c. After the installation completes, restart your computer. + +5. To confirm HVCI was successfully enabled, open **System Information** and check **Virtualization-based security Services Running**, which should now display **Hypervisor enforced Code Integrity**. + + +## Troubleshooting + +A. If a device driver fails to load or crashes at runtime, you may be able to update the driver using **Device Manager**. + +B. If you experience software or device malfunction after using the above procedure to turn on HVCI, but you are able to log in to Windows, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device. + +C. If you experience a critical error during boot or your system is unstable after using the above procedure to turn on HVCI, you can recover using the Windows Recovery Environment (Windows RE). To boot to Windows RE, see [Windows RE Technical Reference](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). After logging in to Windows RE, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device. + +## How to Turn off HVCI on the Windows 10 Fall Creators Update + +1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. +2. Restart the device. +3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. diff --git a/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md b/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md deleted file mode 100644 index d56eddac4b..0000000000 --- a/windows/device-security/how-to-opt-in-to-hvci-for-windows-devices.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: How to opt-in to Hypervisor based Code Integrity (HVCI) protection for Windows devices -description: This article explains the steps to opt in to using HVCI on Windows devices. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: high -ms.author: justinha -author: brianlic-msft -ms.date: 11/07/2017 ---- - -# How to opt-in to Hypervisor based Code Integrity (HVCI) protection for Windows devices - -**Applies to** - -- Windows 10 -- Windows Server 2016 - -Replace this text with an Introduction. - -## Heading - -Intro para. - -### Subheading \ No newline at end of file diff --git a/windows/device-security/images/turn-windows-features-on-or-off.png b/windows/device-security/images/turn-windows-features-on-or-off.png new file mode 100644 index 0000000000000000000000000000000000000000..a2d076366632dfe4d5af99c26da79e78bcd0dfb6 GIT binary patch literal 78789 zcmaI8by!qU*EbAEh>8eGx0G~uNq0#(bO=Ku-JqC&fHVxXp)s$qsYZ{#B=n{LkLccxt5@=J2aScwJrtqo-)%2OG& z)SOy1=q4rF2uzpps1#`yO_0@cc^3R;;ui8c7z+B$HTz4(>Sjbt;^J0<&9Lsw0XCj_ zXICM7XOW>=2FnfO>w)6fUAWC(W|7bwF-q~%_icTp=iZi>59}%`t*>>Q<)1=tc$P?T zf|uY<{R_n8hH-;oMe&ex`}GHq@2Z5Mm&Iz5r3yu_Tq-Gb5?jQF~Oyi&?%?20;4aF zH)24Eja;}Lky7ud*!t4tvmtF6Q#IkkCc+#RFrv?-(CA2N7seuS)w9hP%6)eW5#c5I z?S3RoAw1QQSmBX!mCD6JFsXC~u`SL{KI|BMrzNmhV1w-F<{}0gaF8@P_GH+wlkbWJ z_N*+$=JM?Y?TFWS)$HKIdf6vf-M5@{v5vInbJ5G)shgn>Q2(uTqZ3*|8mO%mr+8CE z9-zQ!ZCl~2YB}`#1FZw1r$Dhpl)r^1WZJw?mu!?SdQ!W4W2~WIAi*P-q0_dqprD`! zTNOe9$!u=cU2N6zIk?Vkg+VeA40aY4GrMoc%BD&bjkdn-dC zFxq_5ckgOxcz)560d`qm~V1#dVKmzUSPCVL)gf4EiB((cRNG%1#H zPzbVB3?fT}ED-j8?ovfH(Cm8_Mf*clWvr92!?E5bWY~lR+v$x~^m2L9Q5KWJ?bv6; z(haipv*)kPd?fW z*IuMA+C5FXSz-(K|+w?2V@Oc+9w34QNoVJTXQJSCe|y zwCuAnm}a*fw~%D|SwDo3JC8aQ)IrExmzh^?vo4`{#_hTmqTNxSugLduJTqtp8mXp~ zz02UjiUyumOzgLPDOn807CYUmW$=UbCMByV<*E!-()pkxg`b%sKBB;$e(r`U$Fq+| z;7F3R`(Seq)S9*gz50FLXi;jymc+xe>(fx8h>P#5n)7gP3H)vi-Mj(4qrcX7GjgKj zrz&^R?I?6&H(F{ym@Ir=Z<&x6*TuQS#!RqmK0|Btut zkqX~Rv0YLA4)^>!JiMc^5?)>$1nDvbX&PM36eWzCa!<1joA|h9WgdBk(;$>l9CitS zH>8k0R_A5QPR6uJ)GbAn=8Bn<28cOdiMQuMQ{{{S431S=AvIz8W7KhUA&Ktm5%UKA zQ&Yuq2CLf-uB%qbs>d~SRFh(3bhKRYD)J>+6<-_p%Cgx$Q^xn6+ZtkhCiVAP5thoU z0bC|b`OXh-7OBv-iw^f^=F8%kE55Wr++ZpJmppZj67_3kJkyPKNKM$A*Gfzys!#V7 zZ4F#k5Q?C&Ow8YOnkwj(93wM=2L}Jhdi8A){GD_q@wD7*vGq%>gHZk2(P)y>P}s~x zuv4)|U;d1kMkr}}luRlJmr~SgE^l8s>9o0zD8<%aiAB~u6Q^ze(J;#_D02S zAdk$PIAUJhPK16S~6)_x6nqEJ`xiz_CWQip|%g`e5a& zo%<)N5|eeuaWX$ASy$}l$*K*2zQnH3Q9T4Wl8=&G85v5Hj0u4 zb<%%jGh1&-;l0~CYOumU^U6uLCTF)imX@upu1MV1b~K(&RnUPR&wg_7(WO(?s`>mh(NVozU#c zxs?4#nSYage~szwr0YujS8OM?2x+bORQo{CNQK?R`5_43?(I zJZNyp>%k99sOS`HFcI@Tk?)L`KNKZpAq-O))k#aGcQ~MEj`utdCuY>TTR?y7MNeh_ zxxlNmiciC}w>&dQNHDlSHK1{NMWFB|1?R7;t|Iv8&8@=3!itf$BX}|6W&Aow)m}P5 zCLwK5s#ipyZ?_*CgY8dy=HUmiJOUjo6v_ZQ_x=S)LWAx@-f!1u+w`yAA>OE4$P>q^ z(3UMk!?BmTz;oXshG#L`ei29m0~0_udB1te`BG^2^~??L_#Y|TZ6zf(S~9H>On={0 z2p@=p#Im!$V(f!jaqz{F|7c|4*C$Cc^@w=Ofm&Xn2dL+$emnz2{TYZ&BhcH?$=o;~ z{HJ#At$Md^Q6rRp@)q6kRu)*|7v%j`Z1|yn7-kz?Fh3IGJ1HkT+h+3v=K>UCL=Z5- zc56NT>Lo&1Lj|2XwexI#y8#ztjR=tEy%YZv2e!S^uV_+1JQMBDw-Mh$@B)%~)qxc% zKu+t`=jAz+e)91+T96H7yUzI@Kz`CCj;}_$MTL)`9w-e+0(?eU@!^^t(*|)lg>f*q z2I}K@AL!4(W|w^RLwe%Zi?I*wytirz{4E0Z0Jb$m_Un)7FdTND0&~|ZP%AC)d+@)j zZSIxAh7neWIaI`2!a655*N|y}`>Oa+YeBkLr0$Vuu4zg8_}!{{Q_2Z>;i^FkgU<`9 z+hJ^E2X8Rrxo}+%{GF8yBo_m7_zD#QSJ$dmo}m6++T)qdwQnUI&~h3lC2lOmgMKZi zH=XEZ3R=?%F(IGbbv?GeauubMFl`VYYS`OxCpXTk_eetHskvD;XaN+J0JBmRWivR) ziN&QrA_?@ppC;)r>f;wbfmvldSJfyX~@y{{wr{x&n?`jF5u5}SeatC*eIsNlYYx&kip*BZ!Wvy&Z_*Rqh`+e zD#!7y0V|PO9e`J0~IVnlS*gIb2%;&c-LXMG$fJY?CR`o}F= zKN8C}&EPacUBYG0dwyuQ8~}|bnFY@Pc*wiTRY_gi`{7~uJKc*m7Q*oouS=8Leanha zlOZViJ^svy&;EjRABB{4?|<)9hH#Ivs0yp>`XNQcD&FpLR|?jiDo-L*a&5q^9@|t+ zTM6#l;jr9Cl$9i(1`T@YY3v^7--=>{`lvw0U|tTB}hf ze_av2MxzjJ7UdIZQdWiWke&8HrH~?;RoIT@)7%7im*mh**O_rq{3v1eq>mH$RoT>%(uVTBc2(nWaa9cJWaIUESmlrxDA*+OP!S|8-?=otRy~Zt z8LPE_!!c~FN}DT>dqg0je@PPfKwU||0X3*MVawiaAmo7q#Y6gjTR2Eqd{2S9fhC=G z*yZVMkAW(hmFh!~n;cgosOB?M(RzAnMp=uB(B|SOf;Pu9vk=LR^FjTZnC|m(l%kUS zpDZqS{41G>nXo5FvX3ho#gpki)Hb@5K8D@jt%o|HWr}SJO&0dlJ&I}{@^aa#bJ2T= z8nVitn4#qZrg`-V$*yJwqx4%k$t_igYB$DrMv|C3dS_1%z}@-h>w@8H2co=RpmSD{%eX4r zq^dXtTN1J|qtJQlhH=a-caW(eqARS?E3ubEY|O(s1mZs7nkIahYk-kvGb!{u!w7llC>oApFHeNl}{&+l@OtE}JpqyL&#_gdSE@XEp)v%&(~ zY4+|w@efbCCHe6FjRbxcjJJ*;!tD@B#Rc%B2!>*d8~(a>-|}OEZt*A7JWtJ{okR4fqiHo09M*| zg}2KqZ(Sq`e-{w^}U zGAfdn?+!r3W8wZ>+gPJ|X|q=jN_2!$yEpW^dgK*G$>Is8K+=*j)k@VH!nWl+dQobn z^<2pEI=?a zn%@6L!@z?|tt1NeD^8du6nzRX0(rnQlwpw9p~Ji0KLGoqsz2?9^bOiy%Fm`h*18dB zPR1_u`}gjrB5eZmrdt-1)mpPh`+H9`zcb_5Yo0 zq4@ZI1#qkJh_Z&f-y%|a<-_tuH5U>eMKXcGD~YjBNX00BdXXAf^KEqG`6&mAzomwa zSS1y2_gL0#_KK`!f&8!Ye*3R5&U9sJkjp|EXcPOrO44N#dLzcvPlw?|8bR zVJTn!`CX`3*es_;5PVNJ3&BgZSfdhBf-mHkVw*9LEAFDwo*h@&(1m*uEOZWgA1muX z#AvGPxs7BzFsDEFs!}Hg<&(IeDgImoWiAVvmyeZh0#g=8Qw^ilTKd z?T06HCm<_c5Ecd3fGk#c`L4;ZW;>Kg?l^1q!F_zn2W9oKJp=T?I0*HLeso^w3Pcq} zNGuxboz2eoi_uA;p`PjQCK+%CfH;~}P9N$yuZPUFjs5eUqL4@e+4`m0HS1B4@AbjK z?7bAkg)f(qPN&toz^l;qDUMfX}F^Kn>$Bj4;&t>B-=3#l4b8 zE*^s{_q35dKw>81bwHgnV6=1KV9(LHf_sQl65gk6pi9 zVM{Qm>UYQYmEw2oH4+ZAmk{4M{oZc&_*7+JrhA0^cXiHWB98%k_)zK57`E$w^G3~~ zM$gEpQfPQ>^;5svv7DT(Df`_ejl-Kqiqi%QhRv^wHSD+7t9k7_mpnca*!09V$Fn36 z12vkohg9T1{6mGs)rL8+DU{pjL$oh+AF3NUDZtqJX9m`^pJwXr%XuQbSeDTIe0F5$gLBIUmHndUGiK*HW+;9eTix=m$}R_{CmCam;)f=D1TPn$ zM8+41CU-uUSn}aJ0k@Ulz>_?6vD1*fU+2@S!Td!k43lfsc2DfEaqCG6_%n{!}gUL_8w`O7t5qeX+iCo(vb)Jn4-filXP2kbo z6bME$H0UuaCwD$ zx$NveEZCC#1qWkG`KqLO%JSGePi$ju^I8o%pQ=0}7cL)HW{GP1wCH9(iH0+6c?EC_QfiERlPfZJwp%kb6em&0`-`wV zOxh$-`;K~}hs(wJAR61=7k!&Ao~@^zHQPjSN1C(-4_Hb0rm56Q^IaL%TMFei*)oXsj zg7nSsR-Z+63gDl`LiCcW-y2-!d2NLb2l^O7ljDbdJlv_be%`O8Fe66{R)$HncrsuMz@L@|Y{Kd=2pZoMND(xOYJE}5mdlxm! zj?%B$qrcB3yIyE@yXca9RcU#5FtZWS7ZaBS%5I&K;dNS1-BC-I;>IUws>%HRk%OX*;x4b83)`wPkL}TsU}hO?fQ38@eL5A$O|?s zD%jq${8wA9U!6Up>10e&fXX7+WA1Wpt52=|vIAz|@2r!@TheI*66_YVEAMF!tdh}6 z#R`Q9GoA--OQpoR)Dx6t(+L$B!M^i^?aMjTa$7xqLUvk%_6vqzYuV$8AkR#rFCt&c zjdT@R@ia$c#{C*}Wr$jhJ0|oEQ`vxNxezM1wP77ybZV6&BgPz4^0Rl`=ah0v6sbnFf2zyLt^+GS1bm^;hmg z#De@oS36j|jdX&_E>uBrupj11@E7lR^r=R#>9O2}lKF9zt8I=dXfJoId$}Y|<$l}0 z$OtOT5ZC+A_!V_Jy6O7SYx%MDM?+ySw4uKjIc2uJnL;n_vy91Yy*d;B^99d9P_J0p z0vp{q``#Yd-SOd%hox5OjT^&y;MoQ@tHCnbQlrJYIB^<1De~8ETI;a47W}U4_SRvr z-k?1XkY}qaLVq@$hQqrUgl&8y8Zd&1KrXUQ(yJ=#>?V(Y|Ev1REmManC$8Y-lF|@w3Wm(MkMwO76g*>=lOD# zDQ^<%K0o-hwB~w}%tWx^5;Gd-HF!)wE1$#1?LFelVmxf&)X8#_=DQ93Q7 zQE68XR`I%N{da@a3;+E zhXxF06}-3TKGE2;cg)Cd7`V3Uq#%wGbY=DER5oHS9({(N#tn!!Sb8rpJ*e5 zyLec(9RH(EjKI)Uw4Ep^J+iY}n%{gaIS9C@DI)oFEy)QnHs{MEDtL&f0MFgl zt`UP%5{1}PH6uinZk4w>pU;*{bLes11i{Ym0RMk74x*A9@cxshb>7un#caw9MAm!j z=*bm<_hAAJVD<}^v8~^)J=Z*efX$sLSQJ>4Hurm(qMDqZQ5eHIZ(f9Qt}DkM8SZpq6XN`-}I8PZ9p6sm?-w&II_d`WXR_*FXi& zx_4#haR{Atj)Rxdh^ix`FCB|&9vc*mlde52oLS6lf>@WkP?AS-f1RYA^Er-9qgoKL zytd@6Z68rPd*%}PxwCU@Od6nP%(6A$7mk0BQu9Kb7 z9iCHNGM=7iz$Sz~`_bPQiNg~3j_AAwlcfRvW(Dnz=As8$dMDB!-v^^2AaFn-(KScz zI}WuXE)tFVxi?ltyYi1sD>c$sUZ2CaO39#bNX=0N`WKhW%*gz^jdE&A`P=2*iwiij z=0|b%0hI!@H~~syw~gNNBxyk2YOvl1m*P|x-14J<*#=c2!0C4_&kpZIl|N{I%ap6dY6R0I$S3~ zpViO6QAOb{KQJ|3)v}WgOaX@%h8mO6@r;5*iv5b6^G+3}=)jrH;rL4`$rkaQgzb4` zIJaMv=Xe8C{wR-lGx80B7}|N0PU1=9&#JStyNevU6)qY+n%%Pt3I+8vv{GGpDO(U> z;a2=$zn3VuKjd4fB+PPlehp zE~;~-09+X$>NkKDVHk!R)$m{|S$aur+s{QtONa@abGM8`TECud6M8$sAZbifoTyeq zxQKMoaOZd!9s-gG6^l_-nAu@4_Zcp4a5eNK3L5)+AR7VD2n#8f54wsZWnoK@a_AV?eL6QMuYwWlom6Y04~fOFoU9(9l{^8bEK@)E z01F3lHedo&Ag^_t$p`XUVh_abbk(Q?igp?@Rm`{2erm+AY95{bQeX;tJ~TopalMGk zhaoJ9>9<{6#qTs%?=;^?Dg+frdGPuRP2d+;(C|W-z#NdZ3@=nn7%K~JA1*VV?+E$r zHw>z%i8nbfr$#fXZ$3q_iXAV~V@x^yGvCy7+4hIuLAV?|ICZ)Wj^hYa_C#4|nKwKb znu&sfjv={^p1ns*JNj?rgxQ7H2d;g%B<*vk5_2rOtRp=t^=tUt$rvg}|K8+yLty}F zQAp+tS+k=_?{(Wv#}>a9SywV|nM|N7Q@CfPtEvHJv5Tw_sjNJ&^io~0I$kdeHDz4Y zaq^B?`8{`j<31Df4D4{&tG)AnX=;x}{`SeNUSajGLw&u_kV8G_PJCK^iCsI@E+@xQ z4?dSTj*S%!@2z6$V{rRMlL75?pLW+Wda@|OLcc?_C&*K;Mo9e9-%a;OJFirTF6Fd8 zk*6tOA=1cq{-%SXFW|PhE#_GL?u2Jb_U8o2oo0lJP|+c$(^J->T?TLF%S3Iuou?0TA6{c_37llQ%REd%u5ygC``Q4Fp;}tC-20}IGsggP z^VpIlB$Kct34vZQq|dZTz09T>^R9Mm(kjx~u2Ylbfb+83WJV?RD&sNLWqhFPd4Ipk z?g)`xe0}<#B{vNO^3q$4@SXi{P-cF`3`IhC<75iVL-YV>YVq++j}aaS?WFZIOQ!1A zEm;n0dmxmJ^Nq;QYBS-s&spQ%odh4pYdoz9t?y@-<=^Cp&G<~25qFq`a6x7pEu}}W%^{=p6NRT4HoGZN?2CEylEzD_?Q<*c4r9LM0N~e^IMNd294U0)ohoDO9auVm>uDVT~1gi*PlJ$N8eG%HJt zy8MZ)anC2ww)jLO%C9Ou(YWAdO{j>Zej}z8nKkSw*LiYMdQpY zQgk>5^+o%V5<9n_TZJfDZbS5d8m=*v8R+S|L;}VtRR5f9@q4$$Wi-m1*{*Z&_|giL z(O31d6T)mlUR6d-gTO}IH3_{=6m^a{pUD|`Nb9#9{SJ9!$1+H-8zjNNfwbVUvX3(T zcsW;Z-BO!DBJY9rB(?g@fyp)9wl2zW3kWs;>Hp-^DF0)N|E~wqE{K92=ey&KkKD#Z zHiZWFhsiL$4`iJ;)|%QwB~p4NdjxqKs7mSyZ7rTdn59!;2q}4UTXPjH%WhJ`U!jye zF6qC6H`)SU=50#~+6~dxCI#4&QU+st$lMoGNL0ZUfu|S2KtEAMNZW!BUJ!O@0xnim zldX(yA+dAGoh}MXqU|wKQ6>I#eD^#u;J_Fk<*I14p`bQe-b2%!B6e5#$RV71wj%^@ zgf>jocaiCsy@yK6bGgat`bP!I9fd$m`Sd#^K4HOb??a@f%T@G=0L`ORzHFP@Wp4M+ z!{{}SNn&>j6D?%AKUB>Bgk6osn2&9>3zDVbkL3P*kNwTAW#FZ4*ORYoqWm<8IY7cU z0#k`n5GkVWNUp(W;7rn5#$;YPD;%%SlEsEZ#jN04Y2h0V6L%*X|CH;@hPP*5gxG5m zkPzd!=?Y`pS|B4~joTe$irN!ZWfdrV`55nPOPIbTnnRy3s+_i;G|;fPx%q!f*Y$f| z186aa-B1z6ggu(|Wc+F8Gu7x@Plj0M5zbF=B`^Nq3Tm(2Nwc>}@jwY`E4c*Nuvm=LqI9CT*`6rhXYfV(-$!=!Sn^6AQ7M^dagH$AW zKSFwyO`5RpD z_aufSEx;`SW6S*I9`v(KaFUC!W%Mon*k_M-4D_@r_Ft37!-gOVIIW42;MKWZnrGL9 z=o4!1%(liTx0jx5q806b&v|X~9vsj?q65Y_{<|r2r^GIis>Zg@V({*d^&Eu0CsJu? zxXCF3otSCEA4)a5G; zU5OL9TViGbcT9x%`cGKzxXB!ajO(9KA}m-^RSGO*wnsW!b)QqkrLA*NafyZy5#o7| zUuK+_oVe4{Da5du)-=8 z=?ABBrO0)t>>f3;rdCL~7cxodRT+LrFsOn)?-0jtMDjb5oKCGhMF*0;sGyZw5=Ynn z!C`qVfYU+i4N_$$;zfVI*XWNp0i#cjPtYk|gHb69>y}@6rr7?ZAQ#0z1YT~afm4Gz!ZPJfg?m_z&v zwpX(aRFx=9?r_1CGwDK@>jJ8S4#pofAWH<)!Q_U80%T3fT&9*{7n8u$f#z+e;Q8C! zHIyN2U`$TRY4$g()nDtWw07(gjklrT%ImB(;uYbq>`w1sFXnReqGYZUweYn`{tfy^JBMI7{OczF#Sqh z)Cx4p!gj3sU7ccGwMb1B^Qu8i`p(zDK~!z5zm(mZ?kT$-w&)O1q`>P3mBg9DWfj7! zIq0FZHmG@!D5w3eWuJuOpL=>fQoeMNRtmYO-JZ`!(~@HEg*iey~(Wa4R+))$T#*o`?&5A9! zy5}QIm*`$}9hco+Z zCXWX`MAjrLl+B3oUGx^(*!;5G%WDP6D?F9m2`ZpB(DUr7(Y(^e_ZHZEZS*+fZF1dNf7F*h%2j*Tfw4$&aDg)l)rc7 zF!4V-up2F1Q9qnspwgCE4%>2_z#J&c&%Y{z{5jy$+|r*l(z_IR-aI4i&m(IC9$zoP zfmmwlou*WbwoR-+D{93FXVdStujTpqTF!MBAwbSJ02rK3S{=W2oUGBfCqfO^BpOyr z&%84`N@y7h1InyA?J25UoM6p)6-^}Qw8rj})#^`RG8(fF^-ZBfQF<;&@%L<=7Zkfz z6z7-gqCg$;%JpMT2*7rTm>=6y>>hNW<_avuj^ld_{(D_&V6h4QU<~Syz*CS5!e2t7 z{^|%g5WP5-J86W5@(|z%=rN2^LSj1_EqVR~9<~79ZEsR4MA+b0Hdywe-RPSvwl5Cj zpaTx6Yg5qhE?paOTe2juUTc{yRW8KeDMn_+~7@BzJJ##gxLw=3TeA;DW7hJ)^`g!?k85Fo~lJQ(}Q5R}z} zHFYZBI73f7>6Q-RsVl|bgEwoIYmuhE0#U4v*{}X=pfT;L>p|fxZ_HLSPWUZT~ei=CTt?ux{UzQ9->aQ+zsCodSk|Y?P7;8B1F=t~G zFw7H*Ysb))oaqQNcHcgYG(?~WX&SBpf$U!8y8d+2=^#w^@dVhM2+VGCkuN^Q>o^o* zahReL<%X?J^cDvu%cw32Ev9I4z)sarrX96*K@>a6cbOOi_N?;G^hcNiz?cil#H$!{qG`K}93V zxKkx5kP7t2D<0ogb$zUqJU)(Z{jF|X*2c!Zfbuz=u!g$6Z*qf^xo>q_9!(wSbE5W%bd-v>@N-{oY4LtIC_9 z9gfe{cnORELE>uIS zSUnUd6>3Vq3Rt?t^WpnnXPl+leuruzHMuBKxgZ_7tJTz0#SqkGsCxO!sZS#Ym_dTaYYH+9ixMBQy5iwP)ISJ8_ z8R<)G=uB+4nCyW*=tzk*e$&~gR5fbfYwYex`Xg`DhqRko(nKRoS+nLbG||&>>U1V= z&cL5ZWP3Uhz9m`^z!u0NHxgsb`vAW6C_!)2!@g12GOLG8;}oIAfCWc70UJj@1h%%& zSKL;ueBvVHJkENvWg(Jo0_-69nXn-5aDct3Cl5w8#5tRQ9a^&?;cuI3u|r?YDO@ZJ zV-5FS(Cbj&{Uo7Z*Bd7~c}qp_Y8i{S4)cnHGY5%e)LoMtZkSo}U;by@Uh33&^Pf_q z$SeGh>(I#cfpW;{*IP_h34;OLi;Ap$hv#R9Qt_jec1a~y|y9ue?M{dkjs)jKI-!dqQ4a_sMe*Z#U^^>POQJA`3kAs zM|Xnvw&z8)UxtYsW<#cUe5Mb)*5Yt#w<>2J#*k8xJ8x5vXo8kx7MtNBo z4K92RXoL#_f3yZvNSQFVq2F@ZZ%nVYqIWs&&z=pSr9Z!az61rTG_c%$B|@N|de%Q} zGC}^yuSK8*O3!+VW9u`+X z>djHHAJ<10v@4RyzX%<__W_AmzRiO6aDzGj%gn6p5s7b`$+38z!>erdA_XTCCV1Zu zQpU%t61l*qb2Hj_+P#rr=q`iN9O3*Bq|gJ(7Fi zp^MU+1!zkGt~6|mHjDb&8(8I&w;){cv-=%z^8L+JRa1cwiklR`I{^ZZcp%Ji+)q~ z?W!Y+cd8)OjYB2!+Cm$raV4+FJ&65a`z*Yn=eyFIAZl<}??G&1&AQTELX;-0$AF#d zHghFxo5tX6)@bIS8IcSqZ z%c=JxkpyQ|Nqt_nYA!Xr7u(ghPw?lJd?sFjrLZdNM+ecdY?U5sh48pT&4N{kyJw&( z+iuJ`$t$)%Nl(BuUhP6_%PJ&cE|ZPjK(r;7j)RSujAX^YeAE?v)tQCoNd)+%0z6+Mt6nmXGYur=N)F)w)_4z4s!&ATx+UkRBUh37m8Wti0ov1SDKQ0u>Zu{RFNJX%LV^dd_1OX?{)OqY)eR* z*`D%wX*5hpc7E`h*Zn1q5`#O_>MDl?SzeT8E{*0${3q)mkIRS+C!pVUZ)X$-Z4&_` z%TT0D>+zmhV7FLKWGjrfST+0{RJVMueA#WX^DAn>xk70b=C! zZ$idv8j@EgscULK!hRl3qRONo^O`D%7s=H+RqG5}ukBpkwk9n>$G)p*%1Qg~{vau~ zbRPzN&D|$`(a#>e%wVmKF95d%0vCYRg~z^?wvbB#PWJ&Q?jHTq)D{>@S^MDc9r3R+ z0QmpSt^NaJb)R-nHnL+FiTh5F-L#8~Vp#pllm22{-KX9_kPXT}H%jBb*or+my|k{2 zXD_#yn7CylgC!kbz7#(D>3%|7VIy>D&*x5$tK}+te8C?$XA$R<({zBGlKtm<_qaM% zdai9k=0v-qLA4FeoVX|5(e5uf7|AO;$6EC>KkiaFEMLAZPW5B=K+a=5&Dv*FIri+R zR=EEhORcTSrrNLiO4RkHR(S6A2)_D{dmrVfnBHr1n7YK#GJ32Nq_MIoJA_e1(N` z-tR<9P!z#?V?=-s5BUD$qo?KHta4ucI&wdOr~3JIzXsv#OZ7?;)P+21egzZ*faHSm zcnB&uJWddKc~CJonWy}R70mY7F&s_;kc#m@{1~u14SIZk+$LlMUOO!fV^vhA=ca13Iv-gNCu19o z9$SRMj;xS__^XyYZJ-;GC%gIR`S)v364{o*9q6SwUbJ)9I*)fUOzir2`Duu-G-zq> z_)qWF`&A>BP0 zFriSd3(^?*|JLhT+r*xJ9vjiyRnGYlm6?$dZBLv|>pq_jBT?U+bAcVx6;!U8H}*%X zrqdNnmM7R{9-;E~O+HH97}gP^#71N5Pbo+RHspxlg@Z<9ye!}Pzm?9?j{BXmcXfz9 z8|aE+pRq}LnrFN)iWg^s?rv0onds-c7O5jV%|8ldcq9ZjQRuu$Ju@?uvvOoppv+Ymoao3lJ;s zn~5+NKqs|(Zo@)Fuxg=pg!`5%jQNp+oRCZRaxbafPYGh41S1!j9K1O?T-RdFyj*Hp zA$B|=-OPk_D8w?&{>3`&M5bt<*XLpFy%^DmGt89n6i&=WRIonyx`mEmVslGzPuuQIQ^s>GXGF`r5BzKgB0dBe%x+TMziWgBc> zug9O2`y|(HHip+s9iNnjQHH1kWMTGUBK%r8Niz=tTCEd^0pB7YxjqKGM>Zw47nO7S zZ%ymbYmATo_sPS*4ahb>o6@gXlwPLW&xVb~fF9&m%AO3M7%!F~@A3+W@ah|pudd(7 zbic#OCJ6IlV8$A)su+UXhVl{bXkJc0*{VM#yQ5y(lPC$<6%!8G<017OK5DroNe3=M zT`9z(I^OTS#>RdiEU1wD2435&r8^Po#VJ&TNyET~Ex0`cP%%^K@5OeHClEN8H;)Me zIaPlUjq}Y2lxa(WDXn2xz4B0akEjU;)}es_{RutWLIqQBohUrT5MQ1tlzv@7PI*f}|1`s3j7LY;~R-}5a(6qFCCQ;q(#};NuQ9YuL=i3cNjzk7G0V z?R$PZ>pM4Fb9_VdAKs<^W*eOaFKH#4{a2a{}7qM56h(lGG}!XYeEaV?(EI;@^4zK2gKMNbyz zh2n3wDlJ;M$db6q(nFLq?9SEQ+Vn&?-fX4}iu-JDtIt=T77XtC zEfX*w3`wi=CrQM&iZ_0=y(XjeIK9AOGefR^X+K#@p$E+G}`7 z_sg5{G@jpI?KTEAoinWhpdsnmuP7~h_fs^KV>XqLD(p7g2D)W63D?>o*D^6=udgOl zM_QHIT)(Uen7%Tra}k=;bP|}|FO#uISDDBoiO3#tby@_kwhYmn_enm+`I5Z%RTQ6U zWYqKoiSgz0Y5lRd_n%$Q>y0y!^F4`bo34_a&;Y;n0f~U69vyY@n$$;75RCp6^z(1c zzK%Rr_2Lc28$Yu!IwkrD?H;*m&34j0H?}@w+s`ApT^=v+suYj%4Vnm}@pTDXzGCgt z8J)?MU`^9=e;K!Oad7A#8oT~_nIp|Ih0-sddHhNiUedBCUjP!oQW^%m9ZVKFo(Obp zQLUPpxi&i_uTAcNafEvRtJIVIFH**TY$f~R z5(t_Ehd@GbcMA@|WpMYwVX$C90t8L);10oUupq%@u;4xf2ohX^yWdUT@BPm2-m~sm z-&*INy^>+3yLWYURdx0AR7c-*5BTFH*<}Z-gaK z7T+)DEDBXy<_bk!o$bB9@3wkXYIsH2;(H$5T9S`B8d<4SSFpz8dlx%^E{vZ%|GEbh)0m2M_$lDtn!@I!IFW6f zV?$YmE`|!6dINJvesw|x6zo`@wqT2akC(dlVcs-e1iOq}hak2jm2sE`W-giB%uE!G zh~iZDP8w|ltb|^!4l#h=_k9UYKouJ66dVJN!mp%}nR{qsvZ#5Hek`AhysK?GcprQ9 zyR9*h646AiPZO)xVOgnSGWm`SwX;Sm8)|7Z@d(nttWPAaJ_x3lM*QAOrQ;= zf=asvR+{|-Ni~>Qkz&2>{47B9IDW@`6Bh6En~Ny?#qS@f_bi0;swuKMw;a&-jH!4I zM$%XF+<0(3#2=$dGQ;Qip3rQ#Zem}xdwRO`cy1()s4b_5_Rq=S%7F0*zhhQowKaH_ zM#8eXvD((@@3xCj#8%grV4n5Ont|xq@iKk`!*P}OlryDUMVLKA3`*C+N1pVB7CBIO zpZq~kgk*1>oO3%rb1t(Jw+CNk-%b$Q;ne1`UBE-{r>TKq7 zS@o=N<-MEPESQm<18h-aVQXueiV-yY`_E>=(flt@_Us)mvljZSt07zjr{zWi^`35F zcB`qDrZbDWqRugCpSHx=m-_6Vu2u9RC25QJAaq%7KS1+R>w&qHS1n6q3c=Xe$(<-)hBHzopy@ytM>Rmt`px4-c-P6MY0$u%2o{Bb*j8tNBu1Q-S zImJ~Ua4$QL?pGD#VeI z&ZJoQ;aeOv<5?pic!g(H>ulBDu1s>T$l!)>-9;7AbnU*&fnTl0DJMqi^!f30D;CQ{ z)Ab5ViCAQVXTN-ahX(iM*jI;b1 zT6|SM!Ro!LxK14{{d6^6(Nc(;eF5t3ExiQPkQr)s9&won7M(Pg8P<~YGV+~95A@#5 zb0sI>Ep#Z^`CKfwXmDq+Y?$`86&y=Y#;2Z`7A&?_6oJ*@*zuBKXeF=|HLouBQ9?k$ z{yw;F1#*;PD$}--Jt@I15<`~$^HZf>N}UeOVMaX!twB=qN3uL~hWISDBJUW4QqnX% zk+IR#kKtvNfVFw-*O<~yVrz#5LWw9-L&gaO1A-(uYP~v@QAJfQeFZMERhpRJl;P@W zbt&faMKLh-0bXKq#iKH|PPA5{o{-f}y4d&SsDjRxawFmWbU{6Q^)lSVd^?iUA`Hi< z>$qgLUzdp$q)a3aJ9l9(xioH))dXXQ11wizF;h{w7h}(qL_4U_lMl7B(5 z7mEXP&)fh&rg!yVja?vxkrL!K?pdq$#ug|F^7s+ja7K(?+MQ(c7KNI~I2>$w(lpX? zhP*hi{N%bD$B37#P?;+xB|@(uJi{Pce5cNNm19XenSh{jG5h(#qT2kVOq%B;3JkCvG$>Hiq3sl0= z%}wjb2nmzW>k{hEe*&etVWOniQ#I8QqK7{v$F*hk@|UU#C}abixK8cWoURU4QKE8< zyTNon-~7l?fVf%G;0^dkHxHeo&SqTyfh;#WmtA_4$BDF1O)F}je3IOnd|u?RDyEif z_=~g@Dvs+Ln7Cq|+F4}S#QtjxcehzFrvQ+$;I)7m7EL>Zj{o-;lxs2gS0%$zj4;jzdi+nEq zJJoYk>uFmz@NmtJ+pO)TR+xLWkz<`36%nHxc0*32w7PnC(Uff}qc}ItcJtC3aM|D` zGRXPAn$2voa-Zj@-uDNN&yVh)+GO4<+i|4jg4LI$jeH;3U?BkO*Lti?nsg@;^|q69 z+JT2(js#mPr^|?ZPArv>pkVuC8iRc8puk+71sq5Gy*^@#0)dlXgh{y&nubR6=gTbE zHa`5Dm$PxKeJZy-qBuKUQJaQciSp-D(D7q}`Zp_t^HE&i;Eg+HDH-7pj3cKhsZY}e z?ygtI55yyYhn+QZX2|k|`ZX-a>!e~VQs9RHM4N z=7=)pedqj>UhJ2(o&c0C!NYYTWyhOwAlY1i66@hL=@4hhqnK`eBsKr$chFRrwMoS@ z%$)ZM;tnWIDut187nT@_azDSsVb;6qpQO(6rlIGA))aYd9d_^=Os1^lBZtg?sonCoC5eWvBl=w!Z(QPWZ2Rw+PI8|phtQg*zY zeZaKL1JOGjplIwm4|~=$C9AJA%of23S!VOz`-2^H3&!4SRnrwB0O^bar?y1D7B8Rx(~?B_notY18WUnOpHJ=X$BzkF!IK_~ zOIV{T*gzhLT>v}oj9KuazZ-a&2Qpa3>V{5Rj`t(#-~`bn-e`JNEGCkmyq4awUq;tt zYTNoqTiYV&I4AnFH6KdAIEY5NTi=0rw)|Vg^FL)u)$?}TX|ZM&sRc{@?@2yBVt=OU z&m@5ZxmCX35_MyPHL>7V+4ckS$PZ4?aO-8^65RiAz7|ezE!?|8u$)>`FON8oLL>xomzMqv* zj_SPa)&f`Yt`Z6KS7yAXKC3Y@vicLu0I^#^M;>!W@cW>has5t%a(>%uC*TN$1uxJ| zzGz3{8fRSr*4*26EohE@6rbf@_TFK6DtlvPq zBnUGQ(MPuldAdjwn4)Rpv=cth9YrRlrE(R}OUr)P&v5?2;2ZHu)rlkpvA_BMw6$d= zC0B5fWd|X686Gx+#`ntGw(EsAENlths6dZb)x&sHq&R(Kp5WbsiNgfy6hHmOP8pID zrmLZ;qrm1`hLhz$ycI#Gh*TO&S(jsxesr4DDaRJ3fwSs?p#E%~Z=2A{yU)T5`vt=T z>sQ%JX-s92TSYG5f4RFAkbzzFm=1y*JXkd}PDs3>ocf3ISW5**pFirJl~Oz06BeynbSW*cpqA2&KDJ zG&sVIf@{Nr%OeweoGxQc8g(~Q{o=dD({kKc6J3=87T9wFg5gaF7Kd7HQXRj{QvsUP=_Z0tYNu$%LSAX zY5d&-a6mm>ueMhl4P9(kw3QtD3~GQ{r)dAmngbK=#Tf{&Fm2Hl_#p}V_>zbOBzc{#M#=svb`Lv-21aec zIwz9fuMCZ${P7LpFeZ9TCT@2Ml~*O8JP`6f?_#2v7%1!az->{Ff~HGpX)V?9Pij`{ ze)ml29(2Lk;%V@#?YxLEPpxB(R*T(B2~$Z(wb6RP2ZlC|Sr_c<-6XsjTW;nds=X_n zfa&=!Z3PBb;j=s;frofWa>57`^y^w=`1x*bfrwS;WV>4i(f_Q`AniDiRq03k&oWTx ze7d<)JoRtww8x6a{1d=>J%v`MpohPeCh-$8_z_}T*W8rS9%=`{#?Mu?8CXdDC4^0? zT6e-{aum#yEB_2`Te4$0T6w6bRHG+g=C=oOjr>;`RUkgUrJ3_X_3%3D z6#p8$Zf3Mn*5Hhs>1P#ZEGu;7XZOp1T8X~4H@pvy+uc!i9M*;N+;^6WtRU!I^ITr6 z+h!EWi1LwMThl+g`%<{@nGqR;k^LXK>c;Q~pC2wC`Z!iu(#DANdhY=a=5-qTfTz5= z(xh8xeu%4f7M^$FYvsJU#&6mc5qp0@?lR|^SsD8nia{=iG|KYt5;Y|Z($s=0u|?09 zR>qd>HJVvYD?e@iFy^h^Jic^zYW!xZ)fa$@v3v;-9sMm;^|Hn$C?Q9bR6*}B>=lTT zdzZk)#+K?;NRLzGMHzp3W$F`EDdk7-7j|9fP|D{B&XY_Wf&yO632<`hKF#FYvv#E9 z>VK6cT=%(_A%>t-#lPXd?)Rq{H2(TZ zp#;Cw;frBPGHU<b&t#hM{2;VQnO*^NYOpxWK`!W;Db_R>jAI7Ue*;QC*~Z~%-{ zLQ54VfZ&;N85#6nyV=}1(FEXrhm$>Q832T$kuM78^AHzTuTP8h$lzql&|Pb)x0T*N zbNc#SN=oM#ZCi*yrjgNeEfw%XaH$-88mqucL6SfQmn(UWr{#I&w)m(ys8mGO$q*qQ zDE*o(X z|!)+^t-=Hj(B0pe{{05=l!(2 zaT8cGQA&PyUHUgZWdKO16h$cFgSqr)t@m$a++)6YcC0+jb=44-R(qUO#YkenMy;4` zsXIw_&$D#+hNsXUygwSo2rJk#+RX@n`gzPIP2&d!2}Yh(fDJ=+?{q+8*FZ zH-ArUt8iN$V#{2($gg&M;u}1QCRy-hEPS$SnrJrfKxI5W{zJbV3zt6yG;0P57wAK8 z-By0-xG!A(+x&$oBm`qd2PnxxNwF%tk| zeh5llKYJLwASBXo-D)X`zuJ2yyI3I_fX@L{vB>?7Qy&0I3rDrp`fX)RNFbMo;9N}S zQCI(;mS`ep;ft=?s>h_$S3Cfa_Z+c-7T%2V|VOuHpOAUC&}|R zw3jT@Xzd>)fU!SEfZjm>Ox=hf;H!NdPc1Cbr~Tf{wB8LSrY`~|lq!!(G#0#IeQWg| zex_B#ATfSGi$DOHgmBON4xkc2-$<3O)H&)B`OdUk6?P2+TpIn@ zk=h;GXhQkujXJLZ$J+^5=GGgHDkkgeVrtw<0iRR-iJIwPQgjH{?s8Bu>p0jV8u??) zgHVBiRdME(2s)(9cy2VY8B2=qjJaiPZ0PX$T>e3{yTC%yKPR}y2uWdL#a2ppb$&pCLGlkijftrF&C5`D8YFM3o?_puKTBi z;3<5kt-2qW=y5aVZ{htZdkw={5_8Ycv}AQ^#eKV`B2~ztJR?E0AuqAnW=XvB$AtM2qF_1HrCa!7MeNFN@3|4h_F3s-(^Bt)qM^p%!>Cpodo{ z_ETQun~=%;)UG+-^w+lG?|)9NID=B<6Ol}G9^P~bXU73k3YNjp%XZcH;Jq*{4-U@!Z(Dw;jG+Io!g-?!U)4g0`5@$}k2 zgaKLAag+a-s!r(Y_*l?lLAU0!?|5wl?E-Kx!VnMW^8;f(Fcm>qpZg`fb16LCouJx$ zxj0hZ5^!5O(v;7AwWOUbGT?3&laj`ig0%75u_6%hQ(*NG!z!O9-j#_0yJX#m7ycja zpT&VSNyP-CY8tJ*4+Vd`_@wPqXgrap>(MqY(2hj(`cg$)_K!G^Xxaef`;H{ER47AC3FPCRy#{u3#i*q@{VK3 z9EsIFp8X7&@lsPq&2k7!`yEm9)Djc=E+dB5WcV`w>y1la+4iPCV-y=xS4WMs zz@>U;Q^BUKDkHTKH@Aa3{FK|64+~yLQm6LfI61x!kBUbxH8=gZX2SdpCbi`Y2l>oi zd7&oDuiN4fY*O~IDDtX)R^N*1#gqe zK0I!D|Lv==_`8R2V5?c8B}Tu|Gz=OJ-^;JTzu=Psf;%-c=w};IokvBR|;c z`4CoF=}_LthV0UXc6GXwq?zno5)oG!66eWoTC5@`Gu5 z3)g$h0v=p@$gL1OBwGM`4FVO>0u%ecr}Ip*p`doBe-b#g@|cD@G6L0-`kB+kmkKo? zkTeotj2;qjTGrV+Gq?z?Wv-p=xcfmN&@uMIUkr4Zsz=?_bXuOMaPJCxc9PmqAQ)L3 zNh|}Qj4X1K=CGpf{rM@to}RfNfu*Sq$y3oI`E3zwHVO0Oz||gfzSKt3aBZ(JSH4?eKgt8T0!_8y2H#Rg(AloK<5Lf9@LN=)VFiAR)vhlam)XF%q2}Y@n z^UG}bi0wSdnCA)c*SP%|ij^%#h;fd4;OGhmuZitS7-Do1%hCiD-hy%OH&^cx;W0$8`GN+6M@ zan{oxZ?vf=(k%Z0&5X09H^KRU{2Be*lNeQ!@vI+@{&5w6%%XMvHQ$6dLkg@7LFO9H zXmrJI6(5pP;1_xuBYQ0)es6lc8z(-TELTCKh90sj4med~8XcE^~YT0B%MPh#S z<&NlfzxvJzQHakSwOQx9ad~qo3!~8q8CgY!%io(vjglvWH(Ylmgyl8cKtl?t$6V?x zn?=h-Wgn0zYlrM2*Y~7f)l_E@>Z#g|z~vD~{j$}*GVA9jTLJAn;~mMfmSlV=ZSTob z*?w;~^q_;&9OIL*>O4)`@9+&~&sqQ3l{rDC+{&1$Mr$!1XOSw+QW{U=iTLz;9^q)G zBpazHe0$+4odSo;KbDcbM`a|z#Z>jC8e=k;leV+V#P@onBtD^hqCh}HC!wQW797N5 zC7`IMQ#POO+z=E!^v6W;m6~%pH+xzf1uV=yZ$i;+)tn^7+Nr-4Tb$<~k6mkuX(&@D zzIwZ-=n{jEW85q7`|8Mzp>fo8L-tCYo|YjT zDiI>Bo;$Iyj)J&RTEa*c9aA)fD(Qs&BIxoFq$^yJxQsnm+_rw3dW32H-d7MMLN2%& z<;PY9DT}>zf5&?>@Ql}>WM4{8aKcv~4h}GRhpX{d(+3sHddM?=MFZ3fwE1ur@xMP& zWgjZHY|wM_WSD;ju#;i~LsG7>GeD3@{Q5b9KU9g66o~#FJ%$U=jmcR)f}ogu6w}$D z7U;7BAW~Rg#4&cl^vc{j#|gf@>j==Z@4$|2g^2H>_8GlqlQ|9g{sc9N zoym{k0Hm3#{<9`B$NLzvRss`q3$bm1H;@EKQxh3e;*p)T8g3jb4^Ht6-g7OEa5*Qb zD+SIE{`R(8C~B|%{#F)}VF9$SDMOb6z)wCRAwx3aHmR%qE0Nj7Uc+2)Gt7AbnWCZ< zkC6FpQA>QO9ESWOI?&gVhpp(>k)le6U-dW-li=gOdXi$5DgFRv@sXfHd|&h>{rB@= zBBP?)Pono7es`t&ZHGOiPy|f(EPOHIb_@Id?Ed(fpJ(4QS=Wi1x%(Yku&2uUd&gGo z@kppc!*Xdj`GT94!-qiX3?>uH&z@ad#F0M+z3>?V>^fL@>PFIJiL zBFgmnfJ!>=R(h~Wd7DoW`i{u#vUgz5yW6(=bH9Tpew89YytAR?cL$$RkzXrKw^HoM zq{{WnU0t5dIquKa?zH9pz%^Ybs5T7Um2=-6rwfs} zNdffT_b-X%hE0h%Q?nu1q<=AZf_eF++7%1+@62|G_!fg64g>eUB(@&)GXa+xXze~! z^ZEC)lW~Qe>57V$yQ`hQs{V3(oXE(-U$XWuzH=R@Ec5=?;l($Lk$a%L?fko5$5-BV zLyd0xe|~vxw)<1*p*^4grGigSwz!~(=Ic=jHoF;Tlf~BCCij;!4aXBwwfYoycUejW9)_iT^9)@5Tb1eP3}V;ez-6W(fAa(9Hp6 zc#@FwPFY*yEnW1Y^T3L-@QjG}8I15H+OA$%wj8Mab6jp_ClLauuX{3%jaj_?$#28p zs&tNqff`1ql>Wy3&rk3Dmviq-7CTG*j#qb>qRFzOtj_i_JU22@n)dJ3)RkLGq=bKn z*@I)*d40Tjc50==@9d{+-TJm9?}HP1)W09-V2nFVrHuj6n4t;-ga&tZHn#*9K&7_b ze!rLQ*p4RGIcu47Xxc4r+Hdna#2iR-1Ol-;f+U9-PM3|0xVF1fd6w-l+s|IMjYbvx zw_!F86sQz16dqyeCf!e!$fH!6cv^59=zfVjJ}#o|x~a_@DE*Ukzg}gPPlrWOL zy2wNnIy8+twTQ2|2c<%W(e%zf?OUxSBRw{HDWOA6x~r`*wtAMv)E_JB3HJ_e+p9VV zr%g@cjP3ZVZN}}=DfUPYe$XJ_Cf2A%Sh``LbWQDhO&SbzXzrNDZlvaSHlwQxyy&*$ zVZr@Z9_NRJT4Y{seNg3Jt-iO1By3HD7Kw|#_ z;cq-nE$b#%{bnLGbu&{=ZMt~?U}W{NbJ4(HA+b5`=Ilcut}oUuaG;5myL?559!e}>A}gb;EuFRjy&eNBM3;5+>)fiP%|!S(TGJ5~^BNzIhUTQX)j{iY z{M#wj(69A^puJ2nHeePp*_xe9mjx9Zjjv9^D?~1r`=`{Q`wgd2`e}T^jW-PmOpBhY zF@@DZn&z_H!Ostmu#)It)Z&zys00X)f|7)JsEC#=k1Ud=5jJJGjpwOmG<(gYVEu%f>dtG7jO2X=6f!gYy7i3DB7S-?VS*T&!2JgC+_iwiFp50z` zJRzU0@?K0ltMj`m^lJp{D;@d8kh-${*UxUJ+huy(=n6*W#qM#Y^2!o|k}xH>M<@Q$ zXJtn!_Hv6@E=J1yV!iF3MXcAA!E7u!jmtP`(^pqMdj;V%< zQEO;!s_J8+?^q-m*V#-INMRB!_}$;KwcU*S2ktv~9nNeOdpox5L>b>5B^cjshkjr9 zRqeh@dLoY%^_r_;z!q-Df7_3z75CM=rQqjqEI+mEOgs^Myr`n*()H zzP;qFhLAOVG6z8X>;pzfgq%$Hs;B3BouemodSU*V@Lg%eFSixo=%L~oZ~?9q0NxsO z1o%_{^z(my%3ubcU-~Zi_K(b_9B)smqVKx9K8f7QuJl;sm62av8&9!%`Wum7lJnUF zE4k9ZCiLm_C)T@7xwE&nidk1-AiRxm=vUn~VwOk6A@OwVsTEs!3 zH=Co^`yHWR&^LBIBn?fd_5oP4;nBeZ&O7L|b7OHB?#0ofMR>zp$^?lt;ZGYsX=g|J zR)Af@FKz3cL6=p`nNLz)sl;NW1r${0YYdRagn-3(4;R(((m>{i*&{;RetI+|dVnC< zeqAZxA^@CxM3F6k8^1pYlhUJ0QhknCC4pzq#>cajju;n{&Lcry`Yih*Lr|p9OGZw zV<>lq-pO?92bPJLA5cbCn0mNw{XBH=>{VOiDq#*s+E%g#%pwjiuyDob?Dlnks9W}X zbhFEKaCb|DdlyW6HO0_E*tTPpW4%1w=aT60E8Rp2Yp%Ij4gnrqQu~19Qv(v0i=4rW z0(_*`;V!J+BH1P6msvNLQ!;nG;MNiZt5<6d{Kc^|)pLi6U;GKK$fB(-*lG|aTbM{J zW%G@Bbf4kjF+ZaX>iSRs9Sy;d>`4e)e($jHdVGwA9ICXHZ(beA1s7$JkJXc{Vd>n7 zG4|#0{R9g6G{Xs7cdlGY4(~b(H2G_mizd@}8)~HeQ&upph=h$K>?@|o&Gh>#K-?$Y zE~1w&aS=f!h!-Qk0$?qR8>kHCaWCi|IZ%N{$qFz~1igS1=Bw- zt3Hu@xIs$hPKs{%6LDcCz_vK^X}mjlDl4ic&ZDoqZ^xB7E_6%ZS{r8oO&6|Lf|J#* z8s4T%y}izj^6^>U+9#3I&+3{07@q^Dw6LVM$0e^#FB|U>k(Q{CoPZYzB%yjzsu($e z?p;jV)7d|5m0pL;d~Zu+_zM_b;DW!9Du({3AM09*FnuIDOA!D|@)&U{Qx%ZWaT(0~ zsmNuKnWLcm32pL}Iqs+aTb*jsP#jMDginc7gk>_jav6Zplsmr+#AzVjniNE zcWx|tA6qe@?G4wIFz3C?-{_F#Z?ex(X8+K`@^V94J(Acm4(Y7S#5oiWI2q0K3knid z{g?RvV5Tb@%y_cjc?VJ@I_8N==)`g54>4CC8!T62F0~9@tm@N_#aQhU=f4Q;e1*#w z{~iU8^R2r&h?>Iwc63oRy|qHV@tBj1w!0vVq5ne8KI`d6ou`8RBlXF?%T>nA((>*9qYQw?Piq8c7o6Tvzo4 z#Sf)%e-vuAdfuLwNzUICfMg}M<)*L6?*`^ZY+$c7fdPw1`rCFqgMGMSgLMV{D#@*$ z+|+Ih($tXV!+)xCL!5Zvf-6j`lm73V(f`PuaXkrkvx8}sM(*_df;c1Sc#KL>{Mt&X zG&pwXY(0#Cih=19ir`q1M((AL2P5&zR^VxeQ5n>gu-iNUJ&w02Hc35o>7f`AZDZT6 z7%@dFuj^pz3^NFx$w{w7#TMC%n3#e+SsC)dLolRPcU)R*Fg)GgR37`vts5bp#d(*a zwhh|~uhbeRxRyJ|*_rJ6>G8WSrUGi)KB}wP@5CL>&j7nb-FH9`5NXN0vm#v>%Sxpe z9Qu!+3Y4sd-BRNsfS9?02$GThl>^T#uGl~ALkNrPD?-g`QwS&BmSF@Rzl*IiTmwzM zFJ5wB1y61+)vo7N2}2)AbPs;1f;#&($!s3BddNGOVRN@_+~40RR&t%+@lVhY=6J65$pW?4i1aO=l`Dk&)H(7cPfQPiLrgRpryl@p|Kf zr(W$15~2Y`n)5z@gFioTCFs3RZnvI1%NM-r^I2UW?32}JR-MjEF)hS$95BCGS;k>6 z5Zk@BnMtEuLVepCn%7e-OGV()?Td@P!!vC#QCm6gG=F0K)TUacpx|3Gwbx>fVvFKZ zU*Wd6>9#AtI-b8QJ$N5bK|xFf5K&DlV~adE{G^+sKF`BV&S9+enA-K&Z6 z!B6@_(hkqTS~3<3?0JM1M@HMKg{l6fX=6%~#ktBU4WFF*UwyE8^6bp%boFcZxLdBS ztBA$VrC4Xy-#EMh?+d!d8IWbTHb&{_a7nF#pn3A;Kb0vVyK7n>)2LT2zXTQ(7Avy7 z)3hs~Kzy@^T}U3BQ<;qIZa_;J7EB*IwajsdQ6J!0c_tnGMP?MO{3WGG9`PTtg>n@c z+r*`2%45B8{vc9Cc-n3G%Slyub4Nqorx&m{QmE)J*WYbkB+EG=4^lhVp)U&_N?!?sHSZ$rz)c2bEe=}gd^qIHKGMd;Gx2LpeYJ6Y>XfmgRT5?i}#Tn2GZj}Gi+ zuo01AZUPoJx_Nz^0fOpiq8YDMGn{f+xMO}6zx*v9g8D#LQNE&r*@?VhGDIE~&1O$K z>b3r!62ZVJ?Fcr*LztN&Mu@b^hijp=p}#&SeCZhVCc0fw%z{Csl^$(yd$Y7{9U6PD z7FAwOFBSBG3kyg%1E8M{gkGyAwWwU5N)znUbB5RKj|}YVIn)2f+WU-(HzY7s`)L{{ znxbTHh{ih3Rf=ICH|$yH29KrJc_CgZ)hWH(?hKqtxrRoiwczb;*XKVb0!{^JFMX2a zBqzQf6x9fP|Jv|$`v(Se*0iHBUh^V;i+yOxsNWUEFjYEMUw98yiWZl=kZMep2hbT; zHrQ8v+Q4$uc9=wCF2gA4a|A?UfBTE33YcDJ5`Po>|3v>hN!bhHIhZf;k2M+?7yhx1 zn;|RWrda=JRyyUUSzBOkWyTYQS-fRe8|>rN6`@wK83xH zrg6}AUT+%d6kdG~q4nIpFb`=`%Yo+^FPm7C|f&sdOHc!J&S5-&Z- z&&IM*zP}a2Gjn1>Kk+B>#cFxnq1h;h0BlV6gGqsDj!X}f!VX)zo#fZ2{+Z^tPX?kv zMdj3JP|9IyD{i^+1m^)X?e5dG_b{6)aY$qcURLWYBRj)LbMrKh?QeH#0@0+2$Ut^O z%u+8>3SYUi?=ng6hWjs1Sd-9>O(o0tMZa&>MnP5fv^ ze1zC!7O9j3=qGR6U+8{n|J|c|U_$Va;St4Qe9q(Oq*-)0+?!fJPN>C~n=^4PlOPgx z$mk%Tn~C}$_00ESP1H}LHzYc~ccBS{QR@=!G>c^Jypd6)sZV+rJ^2L=-@c4iWK?BN zWvESb@IN389Y&gaI<=hdMz$^=jcvL;%8&}62-8Ql)Q5NIm-c+ce#?7llKt*OeS&8( zJ0a+5i$X@lo}4TePfVYv?@GnoCtFnCPo4t7fRujsOAoK>v2_%H*!LZ@YmuvXmgo!(dQ zh*Z%e)IGyVw{v3mrJYVCQ%-|p(QXm@ceoNF4%+KYJt5dH1BjJ$FkdkPX8UxA(#F_6 zu-fH9i)Zx}G_`e3;feHkMi9>%A3qI;pHEA01;qS�d>$V6Fykhm!9nFR-VZ1sfFw zuAEhNvzOJG+`p(7Vh|`c`fK;_n+kMvE1s`M8b=G{)04g0NM=|kM4nnRvU>3QS}uCO%Fd54FBqR=*#bUJQmC6*+0c+lI00Fs!z*$Rvs$jcL> zG0}JCHRKIxC_$62%&>)M(62{-m(9@!Jf`Yg3 z#;?SBFF>G>UuKu zzkYSQB~q%Z0GMp3^Q1Yt8(CX8FNO-%&jQ^`8HNy~w|2bY)|97S`p2f++qIUqPo`{b zIK?V4Kw`jI{@`D_n~u);!ZlEea=)VG=qKsDlXItAA)lY-dB|&vce7&-JhDm7K_O?h zC3qU&#wHVIceNPYZ25LhkGu%MdGm}S!yka1$m&;Q?c_0nzZ@mu>g&CS8nNa>Ycj@d z+g)kX=|IWcc~UqL!1GZvjAOvSAnbEt^Eax13vfwvlokj8nXRwT2NCqc8v$@)dH#O+ z)gPcLqYwM-C7z@2;bZ~Z*1~fJh}-tedQr8wcIU~n@Mrlng?&iY&K1wrY#5^$43p$j zC2$ovOFYwO0O}l=KQe>?{=3k%%y!N}E!v=w76qR#hLFellO#(Defm_~-IRfCN1dF{ znt3B*ylg}qdflV;W^okO;d*htb|Er>X$<)x-?m%K{6rOO8f^gnJYbp=8?7az87LKD?l1G;!=V6)+YE^<2H`NwyX=^^S_ z4$gHI$$RQ$e+H8)h9iC1q3rcJ0yq_1Tb~zjr{Jv)fX}P$q)h6>> zv895gWEo$2b$ziTo;gYgz-Ng;+jD!|$yb;r0vL_FF=`mA*U16hvfkGi*{8qJp_7&l zmaoM<;4g}h+i%2ChGSL6GlNd+<{V1DRPNo34Myn$H7o1RgE8fFqG2t|#F#s^R^Q06 z4o-_K_Fl`U9!a&{4BoW7q88wBVM5r|x>Qz|IMC9?w5_ZWarz~i55~Qc*ifhi%65_K~En^h^H)*U#`*bTN ze=kqvi*US@A5XYsH>076BiS(p{z_&OB~mQ&xj9s&5{-e@W=_daCW!@>xXG{8KcUgg zW)n;Mw$_>RI5+_fPzoUcXvRK;i=edLdZavP=QwP4o$U}%{<_w6+~5mq35b3BVc7>& z-j({DR-iJ%^8W*J{*@R^Dw*ae_gLhE!e4eFE~8U00|o5FuQrIlRjMif95>7l>3cY! z2Q>d_Mg9_8UjhqMF*rz5G<`ehU({)`?O)Vs|6c%8<--cz#Q2B*gbs)UK*cCqIRSU0 z+Mp}QL0+D{osR6{GYuavSm4$T&~i!uDZIBw1~mfU5B5hyh&U2vgL)MOoqqJ4k3@}o z?B0s8P znl5D_Y15Memw^SFwzO9^^fix?ZsV64^)tydMi}ik#C8Fmdfuy%RWGuS1C7Y>W@pI+ zMs^&t3Vy{ZCOA-#7(k!I;BtZpTff<#IKO1;-_q2%t{>$IP14`#D#+OTBGlLTK}jbr z7QbXK24AbK5h_IEBCVqvpy{bgV>pmLV&B7QPsRN>g?4B-4A#%RQ^hh&N%|cX^coX* zA$%Of{RR2`ir?MHeS-pIeqS7?wBT%iAL!%zD9;mj5$VA6w`!>Oc<4|y`oJk++%>#3 zO3&h=#78=W(({}xk{GrFyQkKtyjxtx2CmZNEL7;;}dW6H8y)39r0<6HO(3f;c#5D!ay2K91l zXj6BVmnzak0l|*Deq$8kC+#xj&Z2fOaE^)sNPwiilJJvcHJaWFOv6Y2_&r8ySboRb zY0$^)2fv_72*5yyF@UfBJ#BgNpQ;Wx%o1`Xx3>z9K&1={ zX#J%H;sQhx62re-$^VD9w+^ea``Sepp)?8#2#SbwBdIhp86AMqL@+crX|2qN&mSAn2Rk;Z#?F1@>MMHN6a}rkzgI9{SZESl|HBT zVja5bTslbGGo^p$L5kSBrjKA!5>@ZZ20?bq`&HBj9dh5C$FP!^UUh7(Ur;=Bk4pvn zKM(;r1lFOS#mP3OWX(>JtHd}uWTrDm4k@NGxih%>T3I`QrKkfF{`8e4XIS9DDy)cU zn~539rW%v+wBG1@rNRq0Wn56P^9Ue|%uNGoE=8t9KH8h&SJadaIt%t^jWJSKTtaPF z%c*n;@FfWN2yJZVYe+#>FPaG&D_?5J^!mBBtxosKOHMQhHUej;DuaM%R3J*!G(np{ zT(n94g^3cIA%dWp832)mI3hbCz+_+;kPSaDju3Qs4B)AQrkg=c@7mLRY1*=$dtRn@@dL9dU{bF zw7<|$^B@0WA44C=NmE98J(o@}*zic~kS>|}wKQHdx9fxi5yu5%KvXN54Of-N>u-3} zcO)w+kIt;%GeP{65Kvm6i7AMWgf(TDol>cwIeyG@rDhXZdY7D+e~Kn5V-44~rZC>< zL_2*3g{l8Ec8}!y-y(FN7)G)5s><(b#GMcf)0Ml_XY((jaA7x~borgxZ?NEoY1yC;pisi< zyl&XJNh?AS7hrrKqKIL{2Gl4d%3OS7R{^3SgaGBVLU2};)ndB{) z^6F0_^G|CZ*B?h~kH5EG$^8d;s3K;hSN}G%G%!^Jfk`ih{_@zv(C;`tE>>uE-rkfm zcy)L(`S@8FP(^9Bi1PN!LCQ2pxl$ z%8CW35q_1=rea(`ho^a(<1(&O>E@U5fJ+?mxqLPU;(fstFP>5Fd3mg z2b3O6j#quft1fN=#dhs}|1_iVRlwypxS&*8IN(g15l1X2#$eu z#!qG(Hf}(4M^{|m5yjV-pga5xo-RH5>; zu}+;)qHLTrLdel=M5H(D0J+o6nsWAwMt(F;?a}Nan_OSklOh@395b5ec6zy@tbcue zKTtN>x6AEPz4O+e&HW7*IT|uN^kXYf5Q!m}Hg9d;{AURoEoQ*oAZyM#`mn7PaLQUd zB3O9rcc%v$QZk(Pr7)KDrV_JfMuw&;2Bj|+M`|9?WN+pKWoXp3UEs&#d zAb#}p&_#KjM5!BS*EqD(hF2B%soEh01N;fpRI!Llznn0FP?Rk;|eSTM7h_>5w zPiuSA--|BZc_s)e@@|7$jJA?4OOdxc#jg#w=yUwuq!U`a+}@v`CMX}xDOEmNQefr9 zu1+XcG{IlOe)pzpa6f77vz_A`vsHY1~&b(iWQzp|ImH1Wsy z6U0pnSewrkqk_9$ci>sY5U3lF75bfVKZ9->$1WFsQGfS*BZdX4rKanuhf!>SS)$)AX+f+Le#d!zA75Ek3n(YP;Tv9u$i zdB$-<5W+==9LqsPmCmL&KOTJ%oa!G(5QH8o&+$~bKyr%DD6W>ubXhg9oH}%*;7xy? zQK5)4#bzwth(0%)ue}cew~>Kn)$jWte7pk{{@kAim5s5S!|PhZ6`Dd=8~<{jvt?iI zCq^x2YbjDXA8#=@;C|zzZ7f&*)57XIPxx*)MGg>3LeRMcCI&NU};uQYnQa`xn6wb{$ZT4unS<9X@rv!TuF*@>irKp|H$@IikTg z7w_{tyHwb_G`@@k=8$O&L)`v$9(Vg|aeHNnJD`>f`&0eo;RCBa)?Xd74oX~u{deLZ z5QIfMRM5OYzEey`OnUrD?I|o5%hD?zR|pws$JqOmnF|0e>nDxC%ZegM3K2>(thRhB zNF^1)uQQB5_Y%7!_;q}U5mtEv@w)*QqfUhH$Ba-g1Od+EgpIX14u3r5M8EZlViZ7EFhk9;k9)$`>cZ=vj>1_lnkQE9SEjcAJc=Q03%`!#SjamI&0HLBcXYQLcfzYLdoyUFS+#P zz&}p13}0?88Bnp_N6@O@**p~0B=Jv+NOcxOqF&Q!xLul{6YYzFY$~PdLE@tQ|$zR()_LC;Sg19 za8MgiK}eDkFs6ddJF{PlS$vn6e|r1}$p09vV|H0)8(pXq922npIm2k6r$fJe_cj6_ zBe1sMQjiFk^I+j;gI6t7mjTG=HW4f}6c7S{-DJH#NtvMQfN^!~?@Y|XRewWt-h={& zy{#OC@n(1~e=6rX{mzk+rq2P|TOhMNIac%C`ZI78e)+{HTtdG@G$O#jS^`2J2+qIH zpf4oV>|4*wrA5tFB+yQ7180{_DF5NR(6oB{r$f8Rh5Z!1T5VxYvPj($$O6@aeG7xA z0`L&+n6`K@X>}-l?LVMzGZsDR z7=hZn2*(uapb5w1+UOBlSUjoA)U|3C=P&(_qzbxuxkCNnF|hrn)3-Le?`%UbQ@RQp zJyG`ZyKW$g{D{N3FNM0Ya()Sh8r5^7I5N`d;}{ecgQLZVWpfT*AOKlYmj0@5>IcS` z^6!zcqAarRV6YO7vA64ELf%{w6;Rh%Xy4MJ80Svk}U!B_x`uZX?H#^NJC2~V3 zL}$cUMkz4Kwa~m}k(9}Z^sKLC$FbBv0Iu_E^fK%&|I^3Y;*FdBHAWxiC)t9%HcNWQ z(oP7zkU-)9K8*EHTQfML2w#c#Y~;PG-9k4gX9e-Lm&~x(8mhfBH3=g?cJT7KCN&MU zDdmf!1Sfj+g}JyhHa%2^QJcNxsK-r8dNj}jWA|0P{R^1-;8otgQtWCp_?*7#P~tKh zh1YKGq9cG33TQVJ?(09k#OMg`px;`)W9PNGz#0H|iYqz0KK^5FRrIl3TT0rr&jx*& zoXVE?vr7tf%d1hFv4^Wo7q#vE%Q;3P#$(*STLpk@+Gs^rUC z5z8PMnUU_FRF-n4v86whlQ6R$Bvl<40tGzdg-f9~BwcQr0oj)0Vo)!^1nX_*juLJ( z^OL8p2{%3}%~*b0h)wBE4;338MN3PZS^P3{@_J!F%%Ah7vomXOHUdGY*bYOBfmCs$7yK0jbx|99(BH4_*c-HMd(;%dIA=O&0{Jz%HPRigfWWFVg z0IA@~|1u0<4yYA;UQS>DuB60MM3_76mTI9dRts??qxm~_u;Zx^if2ITHiCe&jA0WT zP#R#~G8wzR8Q@Z-Zg1VVR9#plF2jwz`6O#%WeHAAQV|uG5taB5a)^kK32A;6HS1$^ zV!~F@EOd^Rkt5lv(H2pcQhCfos#x`+J_-V^pZbq>0q-IVWPoB&QKgpHj7BT!Lxi;c zzWBj|$qp<%EUgY{%#BJNoCbaS5$0AA`@LL`1@&yW-K=$@FJ;ignC>7A%K^q*Jf$85 zE{THn%wgjv*aJzVS(7HahU8JTMml!lzJh!-lr~y`N`8cHlUN{|6i|AH!c?Hz%BfF9 zs92a$nY!I_mSJslJg{G8nPgw*(CTq7G(Y)x%!jBn)kURq1d#28DynFGg&2zdM?mrh zz@htl2}JElpVEt82zL;lrKr2{w+W_VnvL?IZ5uer#ZV{NNy^Y> z?Uny{YJ!YH7~1D5*wJSR~_`qt9QJ;7=(~{9c!4+uCLzLa!d$o z+CD0N{4T4fLXIhv(Pig@gvsJvR0immx32Pou+6;LTEW>kB4HFj#?(e|w}XV5Ud24q zhFn8a3)b8M`1>QR7JTm)Eo2${m`fO~${d94m0K|nTumm1>y-~nv==^57b!imId1$; zu@JixRP^B$V1+YUD=Y_&Q-an;BYMuuWMktxP)>!QgSeGz6}L=yc>TQ@CPX+Caw{@H zK@FNNQ)9@$z~KoY#&jEDxHSd{mk4}ERZ{bqJzL(=3WT`;3t>QEe7QA!N&)s{I$)+k zgdoF8%Z;zBAZ?L|KwJ+xoGL+A#FrmLh_0(|K3zaN7z%he${-(~`100M$LIaC1vvcU zRFBtE?DIrb^DfWF&N^Z}I;!uPRwwCp=R8BfS3lENfAi&XaLOU;UfVptU9wUg0W5*eSMvLaCcl`Iw9_7BFFi{{fy zPFl@gV0-s?l|%I4rD-UWfGy$q@+dU8x%LyokEdq|Jwqj@U#!QX9!^U7>NIMT-HT)H z9Mm2eO*WSfxohIF?tKEkj9p_nwMn|%&;Nu~EF{Kxr>z-amRaLMHKn9dYpGS^KKa*x zfygJ);uU7<;de$bd&`YfkFdoEmy1|MkBQGhsn0imf0|(OFJYs>X*9pWQ>Li=*|mH8 z)LFP=tLV=i4${ZIn84v_K!n^KI;20<;@=u1CfIc~3sn7sCW=Z2$;I2?AG-K?8%_C7 zDy*aLd^b` zYE)TlfKY&$5n2@YVj#CV?=^s0?$a?tRin%1ZHZnO)#!P4Y~c*;P#MKxXN~<)0a1h= zgsc+~Ofug7bcYt&TH4T=spAk-4M@6V^F{0!n;aup{%BEO%A_CP$T7n_h-w}6Uq)!*44Bq*LiDb+uEP8Ru& z9dT4F6m{_u0s=Yk8W2D;c}jNiM=hDh1!`eLx)4yh{-GSVLl>e-2!?_PzPUw~TLV5Z z0d#l)v(vUe=dirWC{9&5jG5Dru(k3|G({nIw!98b%D84U5qtIFO3^;KQZ|o^^_WxN z>Knb;lyc=K`ulAqCWb%X_X6Nfwz=**lES2L_5e+Vtv-mdock;D2Yw zkM~uQ`O1Z3`}1Ua_+WM3UWtVycN{%(+um*Xo?`OqDF_)@-(2elAST3R0%iL?IMB!$ zNLfz5kD9JtN+_lcHGDU1#W~1gz8$IA#adCywG4gO;a|%2Glrxju3wU30y#J-FeQ3m zN01gJ!xJnhh;%M&3xjCaLX#)KB%c08qks8%4PE+;R2Zd#CPk-{ay&V7(aZKCAb``l zC1$}%e7w?@5r0w?oH-xHPkpI?u%iFdOq4K4=mNV)M4%2Ef08{pz&C;B3qV&U$5)l+H?uS4eAO+6VbEVQIDd;3(N&Nk0qci*YCN}r0g zK;l-J)6Jqw!Wyymyh37q__wc2xWVRl)kk0S5r-N&gj|D-F*vXHpFcq&8l?GOBT|3= zYi<9v@c*psZvof;(e?<2fm>~Vo1oi?>(T}GCMi*pw^m5lUeus{Z^H={$MlihiyfV} zVK=tns7}AJp2WC(O0z^puyU(SIf94++S9ogZQ@@QCtQq)W# z5qH-U4dCD9(d}Y6EKXgv{XmGx-`54+QkQHcTVpa9xKEcIR`z)GKV3VTmeOoFWoH#d zOhO-GrxxB}bV_A_vQZS8MW{ka7jo}%7f-w6T`0nzC}zcizeq zJN(%!l#-_2jX^3beW*vp-)H6d0UzP5nFbJG>9H#@2?X$Q1{V<*&{_48MYDgJGE{wL znTxu{5xz2NFEO@gd9^t$YZDS{n3Ez+5FB}W?;fYvu-~T3W$Tkg^cV_^d%PS1ObX(x zO{Qa{p@z;&zk~N5#Ny4>{`u%65jpU~I>;PJ8j(HDu~TEQx|M2ZMHX_U5;e8-#kdqj7GM@O^8yaWklJMqb;2Bu2Lb)SHBh@c#sImau1 z!QXAdrGy$X7_R9pG8O-^v&V=gt#%W(o9s!Qlz9}N4kAxy9~f^_3ELg6F$ zO<4)>Cr58H(~5|p(qe&>3^pJj_$SN`MEc+KAJ}da_wsM!?Fe27L`xvvp2c>XfI-+9 zke~Z6LjpAX81cN*n4ETpvND3+Vf$%HI>9WHez<@7(08}!ClE!1V~$ALB((!(pBn$% zFXizd7eg2jcf@hNrr?R%dM1K0`4E!vp~GWf`8L?y9e&IR1@sMROh&e*&;|`NVEq0d zWEtdjz9DEGCBpy7$`Gm_u5SLJ@3d_-OgQ$V)9E|p?rd4j!eP>g5skU_Fqo0|dL^Ke zQ~%2Db!!2$`{m$~rQ~=#wKFjiJ&ER>nQ$$VSU&Yb>M|nQhG@F4;bkrZ2A-}-Y}j(} z*&!tYm8X7ZpMW6-nf3o>HW0~>n2s%(47rN~;gE+6LzsCoNt9|`HuO|Nwxd*X9)F5u z@oEVR6X_{9H`VdqQDpLI^w#`1-H12dmr>SM9cS4*-eAjK)XTG{gsd?k)Jc8$&S}P{ zf9NV#i5fxL)3(cyAT&6GAzho9CnHYP??#GgP4s2WffRON^^l}N&_vOj7s8k{ce9xk zrKSXev#o-O?j4OhZP~Iin$TXj!3B9!g!>Cjtg9z5vDT+Mf73-6OjQocub<=7eVWLV zYD0LAP)YB zVug_f2T}NfaCMH)*3)-I{^7dh{}WIu^GW>2&{ibl_*7%xm)?(_TKgFFI+afm$?XI3)C$aom1t~`-q-5BLl22%x9#nMffj_m|(-4bfmonF}x!J3O#>ng}g{DnahfGr|6azFe6dRN<~&1 zWVf)8$&KXd(%%T5j2h@yQ`MqpZjYNP6VGsPZg))I9pf>>UQRLmSD2WZK%0eQ0DT7H zN-jXh%HUw6sWISD&`2>0OC}Q;zZ(?~iGMhW4l5P9dMUb0OWuSo$W;HuQX{^+5qVKp zmuG?PmRSYi{RT7pt4-B#J=ERMu8xx|pvS|o(ZJG^!KN8qjxVZ|{??v-FD{o}ep>du zf4MaQ=6w+I50(^zzCZcMR4+g+uz=lZ@0~b1Ut}DuHs8ql# zt|k|Lp3gU0lwc<~{b5Qq=UQo3s^&9h%FcXc;f^gh+%o)KD0S;hn|!AnkK_;xEe}#l z{oOv($mZyQPLQn_RgJ%v4ySk|pEn0cX*f$zJzLP8t5esg*PUIdUpLEfAwgOYy?T#j z^G=cjr1H_g3IhsZ&@eb##G6A9H6ubKK=?uR1u~=!VLJXxyn#E7$k84mqJv;_JhrPh z%J`q^MKFv=J5-PmRhIvx^1+P$S1SJpdb!@qm=||!2)6L;{`Yl_%Rm}t@`%{66g{?bX6P76zn?~ zixmI#MfsXP!Lj6*ZHES@1((9NX-P_@CZ1b$w*{!h*T`3ucb8Rv?+}@45z%WHdojHU zjbIH;l&sN8VT;WlnwB>!O!m)6k&P1~QRd+5r8kt#o>EsBWZwP|9lb{`=e#6oH@n;L z-u(mSm!OTp46UaC6!_1E5=bk@_05FqXNL1&!heUehSeEZKB=>4*ipfsgU zO^KeUMAEIhm`M>H!sNv_>-t9>{3od<- z@+5YII-)x~Zmc)A2?fiX*Alzd+8>v#;km52O>8u(aLX*u=BB7(XgP>-JbfZNW?XAl<}ul~dE(tdXgzw`HDlA>vpe{(K*Ha+d8zh-(;oSQtX)TyLHtQ7gA zC~1sjP>=0XM(S1dkJU#;#}3sKe-yRm_^@2r@@k1`JnYLmjjIbeCza+31tBSUM)iDC zpF#_-%sIE+i3$KMB*J0>bs6{pOK<&t+~$qQ)Q*3?3iDH5(3|0pBo!7ouhnE@p1e3C zOY!e}NH{rwm#oh>su#qqg{6sS$t%D$+s~dm@MyoDk=Y>RI~66geUf%4)`*X{`)wB< zt%Qnhv_))eep^qyTfdB1;EQ*!536CDNuGqV1=MTm^lhMFcChzFV~i74n5iQQ1IzV1)KdQCxfE?jLxt{6zm z3`HeC4`;1Vb;*K%qvoWw6~(ghq?a=LJ)MQ*h`}w5Rr6Z7%ZZf$kfWw_ja-1jpSq-N?q6j*M;@xJoCO1?yS|xU4=Mu+U^}LioNeIGMCYV zzbVfImyS_HjaCZ-0<>x;?se-X;(PctdPs-O1vG4>oXSbflcqm7%$B}y#=%H;ex*jM z3Mq>^Fnyq(}v}M8|f*+fgnbQ&!YemAx0FVR8OEa6M;wTh$!5w!uEIGL3}m-eff8O z@Y(@36oN?thInRH!8=uk?RSzpp&8h6(U%j}G8&eRFl4ZDo#oUg)T@5A78y| z1t$^-!{)8E0E3<8vp$*g4a!8ZNm+qc?+o&7Nx=6l*#XB>gr=70T`yt&`cIs0C?8GU zhHDWG!{jwn1!lE5PNzxn!yUZ|_qMhF=^f|t)8ds4e)U5<#VlDt;>hyAJaN&GP2*u~ zqt7j=sAhkgr8S~*em3*_NEISe96WNjJ;Pruh}5dso!*an_1FFrqgC0{sMNCrCW;i* zsW^li*8x({!2~kL(yqe4-{)wKo99eO+ZhmlDaT)=Xgr^vz#NrlSGjp=qpc}7t6D=) zXxb^_Jy7^;ibf@D|8G}1N5JtL=bIk_GTKmHp9lEB$YOtE@N5u!i>^bN8BD3F$}PwL8A z&#i5jyFOO~9*+#yG~eqpPMgW`YlC%fxXcpFccIZ)MMcHeyEE%%y&Lw&*XN+0`(|Z* zDDThC;ORAjbZTL5kDY3vevMH2GTrwe7mdtE_8=hlR6sVV8lG&wkY@Q=`r7wqikmLz z+B)89(ATQeY8`fYh7)^8lYSm<{yyrLLBhHT*~Rqk&GoL0H>Bv>^z^j%>B8yJn1bNx zyyL@Cc?E?j+$S%~Ery;F=zzh2r>MQwcFtvcw#I&`l|&5qM-A+MKN#S`Pqv#bHv-f^ zyskUY?db}W!?nTaVzIv;C-PHrq^6|-&ZuS3fHk0(aviF$#{2uB`8^D|DX7*V2<6)? zHaDCAjw%@7wE7=@?0r0;Vc>gp?9!x{4G_$Ph^JV5&qnQiFV@D#Yo`pB8f@p9B*MSA z-CR8&^LqR1TQEo*rV2Q&F}9$Wfculc<0mFE2KcLtj<+Tr7M_rlE6=-+$-(N^)ADy3 z);Duy$b7d7rvO>k@^;;6%^a_RuQz;re2%5HKI-`tAeWiA*fnT)Gjn)4e>ev&dikL5 zx^R57;3{~v_jO1GYnJeDmr>9)hZwbwLc4tq*IwUiImjlf*=aegqfton-ff8q!X=%n z+nrA1?_P9YpRTo~seALP$^B5ai66`#yM6Nuc7FaU^TC1F_i8}dbrVag+eq*OnwnR) zZL{u14OiPE!S^4~&>4FFAR1b98bf*Tz%?Smch&ypq~G_n&fw~|*aL&hUs?9v@cg>@ zgJJ$tKF~iFAQE{A8r$0Z$2;I|*>acdnK^sk<8WT}%k!znfcMMC77Ou;46<<#p_If> zuU`*tj=#bjcRo~9fa|HP)R|SoFjWYO3bek8h>W$~fr8<*Zr26@R;}s%Wp*0*VfgRw zC>QFr1~ZNJ-GwUb-Qk1HH`g;LX!5($@0|MMziywjbK0CJm-Ms1jyLnCTFRx`nd(;X^77`&Cn_r=-e z>(f%NAFV{b4L0kIr*&5cACCpye7C1?%bMJGyEx}+2j9$eC_oo|E{1&0`e~l}dQHf2 z^V8z2Jr~w^HaY&5vsuL&hlBBPoL>#h$m8jLC@ScYq05i^5F{I}SNj`KkbU#d^G4Ua z+1b6`@x9r-@m|^cDK}Tge>u0rcQzklVc=%83OJlj&Ksw|{lG`FCcJ4)@Xt$^mYpog zL)VAgY4unAB~8?MJ20<)!csfr$!^~(I8pLodddk89RGq=cQ8-9;d{8VqS#`?Iq(bG5b? zKd$bDKY3N@J~n4F1)aH=Wx;Lnf-hRM)}3rN={GDZEP8~(3~JuYl=&Q{5XrXj(BZf| zzmM)dV$4G?BT=99O3tcr(ePz2*CNZS*kZ)LpI!3|=rD)7?Dg5_W1A^wP|ZMln(xg5*mv73tniAk^1+N+yxIYHR< z4)0E8;&CUD!8~Br1OIC6m#!}zhXjv?U%Or%Ucu9}&vy=&d{!&S%DkX8F58}}-Uru{ zMH*bPa<+Q)<WS%?yn6tt&amlfUm1{EL3z=c*CFuf}C{(csF{rWv5tMdEI$ryKp>@4Wf z@keKf@5Bh}zYJuf)b63Pa`k8tBc2Z{Hk*}Q%`1=6a={=MNPv)HJyOo*PHe20FURPp z306fRrV7Pj6IKGE1WEKPzosx8%rH^a4k%X>8Pi9ZWViUP>oQ|@1K+)NIXhSdntZ5# z$H3*Vqz>Gv^%m^U?O9L5-KO1^n`!u_-i<4dNn+u?h4}4osGlR%{oX-ww z0283cO4L#*xRZI1+jYThSrB%ylj*uRBenL@=km|ySboh%Y*{{)AvcZ}t`^VgrPpbD z_aw6lM6*dAJ=o-mxtgmCZp}jK?sNRv*x#A;81t{D>>B5J|?CT_TT%I_F(GHU3% zuipIWhrRUpJzWM!|K^s?Pf}$P1P*%2Xnhd27VwQlknx^;4<{Xh?Tx0CU7e?vz}!~$ z^I@*tS-dxAQ>RNXhnwqDgeIgjw5>b!K5aUMYVLQG`Cc9M#i`n?Bd#&|D9iB{BgoL5 zcdSCjoWsP0^6^g=0xN%U-qq!`u)U(e_AdVomV9-fAr?VI)Z6~2xnE+^r^spS2;cpJRJ8kP?nqd0B!FTT-S+Z1lZ z+?t>{gbC6|QU4XryHkG*?RA;}`{yC*q@bogofbUOeewv3hcz}Bb2sZ`2&yRkd zE_xo!5G*yqCsTG{aE3ZBxFfgkRd{Z{>#o3FPg$DJNz#OUOU?S+QtJg!C8R#!Rzbu= zA9}0Qy~D`__jj6tT(^13caD#TTK6uoSYSuzkIMj!=W0Wt#*W*c^`!=j-qT$zhrxUH ze-48cxLcjQi;pkAecOKUKqi63pzs)oBzVe!nqK$g>;Y4V3p?FOOVx3;^|Bp%Tn5#v z+Zjk=Z@hQ=H9u@h4pQ+p5D^8B5Rs&1h#zoV!K3;RLki1mmtGfRkIie``?)uaHW*LTDZBMxW}noGt{DdF;DN4^m3wEzf{l2AYlwn*CU2T8<{5S!4P!S{W%d$oH z9U9mLi@>4gc4fi<{FY=6kkPHDo#I%Frob6)=P`aW&IBudoRE>&-l|L26u#ozZ<>5W zqSLHag;YRz7EUr(><)Yw0v*@i*Bdlt_Z9);Qb2^FKMy;*<3`U&P`ZJ{<`maXhFtI2 zhJja#h?+N`^J)<|I=!c&;tiXi&)ochGCAp>H1VNKDJ1@lzebatw&Mp;LQR1}EhOr) z7`A@uHzr*9Di>GA;b>4Dn(rD|5iE;5oGs2pHPQHu5B!QEcMIOPG@?NueH0^GuM$cn z{fiDDkULPaixhkB72m~`r;q}@lTnFlhhYDbA?VB>Kuh-;(T~fHS409Mr-?v?YBhYd z<~+TOQ%Pnol4a62U*vQ6(7gFhMMyuX?g+E16~)XB4eBv-U+*3^F`V9=hza8Kc6`Rg z1lVGDwD$yyn}Xk z{GerO4T{GG`fptUZ{J$5Us4L0+ZtfkOG8()Nnf3M^_gHC>N0$flB48J+iXRccu25k z{5#>(v?GV@Z}v*EataaYENZeg>n!PvXYz)g*q!b^=$2#eQ=nQ+zpGGt<2}E093A^=5*XO10&pLJfA9FZgmj%VIQ>9>(mErjM@a&C?tZ zVIUD~wtP+~WB-_%n&LNa7G3$bX7@yi_5t3;8L=|ux^}jpqEk6rAN34#`?5Tq?T6*@ zsUk;;Pz(WCg3{alA>D7U&mRCNIQcw779+ir54Eag5)b3_K_B%lg0o}7z7wd}GjGo&N+Lg-He7zKu z!;?`J_{a8u0|Aqbo6VV3$&hKTAZDJLJJn16*=xJt0KfAGP)B-ibVxXesGZ4AG^AgK zix%IUPSmXh6&;-;c*+K?(XNC<#u`Y<0~fLGJiZgCC}A6{0-}DELqb=qRHpE zrz+%1<8Q>6j@ArCDx&D09-1MCw+x=|0_fhi^+v2Dn3t`h-l!RI(qvBH{U&>O# zEDUqf{iA||o+BMzzYJoumF?C1NwSZwaCTAd*3{Rh6q``Wq$AcVJ_)k}#GSfY@qG2a zfIy)b#e8DK%iL{^u`$yoE%wLzNn zAz+#*r`Wy3yvsc1b^6X>zi%J@C&mCLex+tPpCwD+{TnEPvX-*aLRmVN`Kp?eT2jI==ZFNDZAO&XYy7Jot_Qa zlVDa@S1E(5UnMpEsziE)d2{t$6Pu){FEB5!{XQv7od(S{0?8fnN1y6kxjA#uKCVa5 zXQg1}IOJQfP|#^}iz$rls`Q+L7*5qNG_yhu({=Oypq;pPv0vK zYw3GtP?S@-EpCe}Oa-j2B8P?SG2;F5#I>zf^-ge1a?2%)IhoCH(caMB7&9lg!hR5<8X_ zw#NR-;Nr(mB5=)r^Be}`m|``$dR4ebDAbYZuq}M;LIr2aY`x!B?H|7zC>;bwEyULF zwJ1BjYw_>?9X79F&%#^NO5ALdzS&oIxZy%cYMUZ4HMTo$uaJ!l@k937P3uOmLkb=U z+VQM+&>Xy;a1=OBiMX5*q38S5R3w0(ERF>4zTSXOU}|Dqa3y)Y>$DS~G&{cz-@xlc z`&mEyYlz{GX^!F2$vJ*Go7PF}$l4vMBf`gWOvesOnYcd}n?ItQ1U>|q;1rKI-Jb<9 zCTaahFy|_V~U@{H4F&j@>br#HIpIZ*MwED)r`#uoG7vsD0(+-nVi( zcUS=Y4q9Lt^$&i8?AtFM2Wc>#wsL!9Roe)is*Fim@-Vpmb!i|QVgDL%gnRS9 z=X3l&^qu~HYaEx$Fg5v6v9sYDV`;39k7AaM(<}D(_bc|L2Jgg);Z8%z3VYuPteeBD zNm}t_BNk-q;2|ieA7=RP4}_a0St{nmxD>x-%m|@~@XveQ@|E6U{&X481r%np|DhWc z&K_h#QO$jNZ}NV`F}lKNGTl)8WXsW>;F)>F*r_EICOr_ z_Pkw?tgK8 z|2}6!S3)``G$$}}LiIV!Fk-Zvq$m_cmkES}k0p>r-0{*DsxUnCUA`7(la?x&o{MD~ z?W^H%Glt=v@X*@S;=L!AQs+|oDRPC|W!Z_AL|tY7x?_d^X)Dr(HJ2qH3TOhb|@vEi!fK{pDhSKVFDJZ5tjP_isN7 za}L%awTecdqNDsczvhYI%Bep{a#mSXY0jbAu@LU~Y+jrAj3XC06<_QE=UB1p;cYBI z(oIylvPt&!2`i)>Gu}4)?Z;kng5pG88<|WI={B}IMKl(qSv|DKEm#;fM?)`5sp#e# zlw?ls=TN1J?mRLEjKhzIDn&6WQ&?W4ar~ragXe`??MKHW2l38ZnulVDsL&77DOE2i z-ZPVpQmUMO_R(J=C#R{OK5b5xORR|M^Y9P_K69Md*4u~4ZG5VoThBAC2wI(}g4nH8 z90+3;W~h!6DX{`^<7_$9c}z4ruNXx=6elk}GEqm)_CEb0hEJ-}zYO^4ea2R?lNYK+ zEET>#s~T>+!zWx>*?3AKX_udr{6#j5bEFJhfeau~;zW9jdL1^7*{cFGs(OND)o^SqpMce*qjBM)=gAoY3W zwn)ns6i06r-1M4y#9ci1GmL=0KS#G5jh$-h&9JiA1?i^|>^papq{tO$-7E)ac}WZ0 zeA$*&KYwTMd!#I^l4FtjNVKb6I_gE3>aj=_ZZ!A!hwjc%v}J!1!gcJU^=10eXIWkB zq&3+(ed95D(xuvz>(#i?uF(WMa+R5V+A3GVtZ1T#o!?zB|LMuQ+V4U6-S)Pp?4OAY8JQKgKkS(phLZCU}TCo%weL zuW}&s1~#duEC(YY))6-euzllx1b&&u@*`Qvh)hN$MiKCR{@V%vf8R=N-bbF?(>76i z9WM zTX3BpO2H2=bLO@4AOp`4$6&LSZ=~$Sd-1&9HRjzjxl8ZQuhabfYO+lKNT!o!6wu&? zv|b#x5yy7+Rr5Ys>M`AuXP>isB_!@^&Gu1=$D+OYHV|=brKA5LWKt4_a(u;Km~pOp z{dV9Ln^(>duHvHWh0M~G`w#3sW3yS(aC=iWxBMjAx+l-F1v!)2X;Z5V7oTTt?jcV~ zIXaC0iOGL=8fx5Ir3YlbJJu2Qh47-BKI7p6gV(Q|i4hk<^6M)OZXwc=E2Nqu%aE1( z2U-M~=A)k(8Ip$fs~=IFErnALW2pal`-dVbX?m?N%g1{CG+BUNY`|>Y&^9-~*ktUd ze2=K{XDVuPD!rgQFKf;4$Oy_*QJ&938S@VvJbN>yqrlB++|-5lS>>8_@2liQh7!K4 zS2p!hKIe>lch{tXPfl`_X6ac-u=oeu*V|u{;<$x96=j9fV_p4m(--C@z9p%$Brj|K z%5#_{-W#treIFA}YmVv(H6B!ozQGCO3@)~_cx>B6pFr{oLIsW)nn*T12FHx$y!a^s zl?*QU9{I4}+dE!+$rY%Tl^9`RlH5wqXo{EIeDdNP28doK!{>$MJ>N@tevEA)?KXn@ z+a?UiM^M|ve*$J=9KB{pHFpIatD5wgAv1OHSlBO6O2(`@_>Ah~m?Wq2I2+QOf0){v zNUhYh&-3JFSt)l^iSE?V&c-DO?%(7mG<%ja4O6X49+9 z52nE)D2g>!R2hrbI?Ih{J&9qCZ=evDr<;i*QEYr;y#nC3B4ab&lx<5?-_xBBP#=$s zWiQhu1lv3l%@kM3hYHUgKi){pu8fqjU|4-TY;<1o?I(H!<(rWeH&gbMg6r6(JHo&U zWi36<4dY||J$}DsvLH7s#R7xPd|WL*Nu_6tO0FXs13#6B%rwK4jRCg)Np%h{Snm#F zjBP@@CRDUZRD8zo#m&uj%bepwjrg1XGc=Fu&toqluJS&)Z@#qm;j_PT;F+&~b07Ua z_xs3i_Y8d2zfEgCLJq<)`q*vAiyrh2HPf;?EI-@xiOC~4vWVoTQPN0%$|BXq_^o&v z*U~sG_ZeOW_FPrHqbpIdx|8oUQ~I77O2_Z$)udk1WRFB(ak{O$su`tkz+$G1ld1N6b%z*ZcBPUOdK)oAw$C_4utkRcr{?uXu z7A5^hPV#0C`4T0DX8*dWWIlV5npZ%~Ge0sbt-GSvr)fFNw4UYL7bz<+astwx6nozd1L2)zVMs29IY^6wvOD5yER|3GnQ%u4?g}n$u5Ka4%Iu zn?rR^x_f;g^auNtncQ*};vX>XbjplzKcQ(_zwEr}!-$RVJI4gLb4fUd=SKQxrnXZu zVkJ6CA)y_+_5Z@IpLGHRK5z@R5I@ z6mHt38EwN3VS`wQ$G8&)6i4uz`+Y{gh&W1x&Lw{ORPbIOt6rYoUm=st@Krr{whNnk z#((#hhtJ#r6`bgi(i5X=+)(MLX04Ym)(GzGE{&DDS#dG?BYf&v9SqEn=UuIa!8JV$Nh%GcZWC;4qEviqlbmAhGzQTdmVC}#cJP>pfd;^piaD_WW^B>tU8LZMt41V{e=ma3Sc8N3@gHdDg7V6jz0A ztfkF3)C#4%8Fa49wkHxO-PB@7@clgCR3uygVN$tAHYuXUxx2r4a@5 z5Zc$)n4oUsH;0q9+LZhSi}XhX_d7)K|7h+j!>Zi2wh>TDx>KAu%uI@TR{4I7VfiI?&EvTcE9hBZ(aP*bvL-wY<|s+ZUEOa2c#Ps?>_Ck!$hY2i{r^uMcF_abLfQjDyDedNkd%k3{nX&D z{?C3pUpp}Z&w&CfBMZU<0p8hwc>PrNdU`k+A^SE zt?{>K-)j~`X~K~uOt2|b9K;8X#RqK%Uav4)Qkpm!5^iy-OX29UQa}8P!N%^UT9r70 zxmJ)fKXRI+ZWZR%^}ccH5nd@ zD;vAm`ZPl=H)Ce0aCqe_aZ*WSROyXF*6)nKGTcQ~uaYjw;h8szA%)rnjM_=(ItdL~ z4YlVdkI1J_<+Cp5)>>QFKS_Z%I$lk!ta|KO8J_7FuE80DTcO6a=y(CHvCK4bS@(JCNxywfT-^Zl{wV(B7p4z^O zF7RBS%&(?5Sb4)-pq;*u2cruLj@HdwMd9P1m0mBkGe<-nkQnO^a}yJZ=bQtv3|S%f zNI8+kDkt;h7_4?6Bl0Ol;KnKyjd}{bRX+)l%61__CeB@)Zty-Ou)qT*C-hc+!d()E z18(C$sGVABbp`=+7M)yr$`kuW~EM`(Y-p!=3St^p#@oz!wRqQg2^NleOTl&QX9 z>B@BTT<*n;wgaWgW+i#byp1wt*or0aLy3=Q(yD_Pj9+U`FVPRz!sQnB+@Txd4K4_L zfcCol&zZoZ$?%_g37>1O337LL_d2SZRbmMg^`T!(8Wa1HMnLRFY?!a%pC@oB>Tb_I z>S8?q`P@V8gHZYALv>xyBnTwpRfDS;UW9HEQu$&-rm*M638MYoK{LwQhAmZj#xz=` zfl}$Hz9t*;>ec(Cmek2zC#)>)ii*ux9kE8+M+q+<`&fY7sIk-OB6Rn2>1W+O=w=OC ztYx8~rilR?x-_ME9f&~=7?jkuA(@kLl0UN0!c+Ho#!ZQ(O0fNrnH;}&r(?gQP;cmo z0658cD~?kN6zA#B9wWWvP@|mtQ3_`4#_NZ*=^K5J&6tPulZ52GNmEhIlhLa)@|bBB3(lc(MMBCGMtzebKXFS3pm z2(EZ*`HeEk|7%NKg-Ac>{q9%8pD@*dKsAw1bUcpUjO0-j;}N?lAgcJRG(DZ1&h6Jf zMPnyWWS6B|Yj++_fh3;S=X1He<2u*dJr*Or;;1R+U(eQrSxZ-_HEDmjtAuu~wpM)| z#}r-Sfl~Lx+~5J(e8G5jc3J;~L+9a{tAyc#hy9wc`H3g-RX`WI6)hse2AA!brS3SE zo8su;z#W5|4uiMD`T7@JCR(Z{TCA;CC790l!95jf)0!kC(|0VU@8R{;9&E@yFKDjpo9WosW_a--^bm=RS z+*ZjJ1udOyYXyN`<@F)^cc#dg7aIlamCxmfHCO>XBK^5Xtkkw=ON1#12qq6l@xaC7 z>dQrzj{0UOF3L>}4O8w0ZT0sJ9KU}DtJp`e3xf3$SLT%FBV@whssxm@>5bG=$P4Qx z848{_WWQJ=H>vdPDe`HlCpUX^u!0#TS{viQ>9V3)Ficml_i;$CZzGY}z;GmXWOa>w zK_~s21recHQOQsi#I`cLUV(3y_s6XbTg=J=imBLV`tm6W+!GK(wpJUs%7XN7N# z_d_VIte|URN1-&|yN^k46wBQeRSg$d>nvv=H;IJDt}-V)qq3ae5t>|}mle`|MI8C* zsds|7gDG{qLew-DDIEsTk(W>g>nJ7|IQ>nCKOIm#+`N-B?9H}O)!9gY{iA)g8*sgq z-5_T}Ya>I{^Ck5S;nVMgh4A8&ANH%{L%1bxv-VlV`;Ht^;gh_jcZ((zjFSj_JN?SI zG(^qE3>xK zz&KzmZe9P1P!8mREN@}zESXS~)9V5JedLEc1LF)W?h|n?`$B{PU0a=mNY`tscK6H2uN}D?W|Qh= z{G8xOl5KiO~ZJNqj)x!GJ+PX zDOFF33fKBhzOQ^zT>n~P2QD-<-80(s-|cJpay&Fr$CnrRZo4tgqs>$GDIXbR=FSX? zLr`T04(xeQcZ!O3b|R>@qPBp*)~~vcxD+gho*oo2=O=T5fH}WMUjj9{^6X2SskzfREdQLUXH65+6$DH zDO{cOMaXw}vQXB+Io0$+_}~R&4f7M&a8z+If;5<_$I|fq_t_LulP9(eo6G2yckVr; z8T1DsD-iR&Lq=BFjy|pS(t6uF!GdhpWtmw6?0oNMK7X0>aFhQkRtEsFnw8rfqxy2{ ztC)3hkf!E6YmGOiB`xb_C8C2<bS$i16y-9p}E!S_JYs`y*~GSh+92T>gRrCSA#P4!YOwHpitxvKPW-7(Ts z@>f8JA}dtat=SBx>9}%}M#-$drg7}QdU$)E7ScO!E&uBcW$x^EFw@`;&@>xy?(l<1T6}Rk#8~-$8$p3I z3>e?n+vg|KIEdQ$r1c&3kbJ9p6J|@Toy=L{2_385%Pstp-3({PFJHjJ!!=*V&&Fz6 zL^bTSkE)T~(6ej3Z84S{@$2Ak7cnx!>fl#S(z7F*>kWqmMD=1cIb&X9SC;=;x*m37!YKM2e)@G6*( zXi)nk56P0AQVmbNTisOf^OIupVwhCp$Z}fECT_K+gG$CxuV@j-bYy z6QS27?9a4CGT6ppgBh z3Hpk(z~)hmRJN8VQ6TMLW0s$f&Hh<|&Ii>MQiXixl~PUVBp!EIAMb zX}{6Zg`Q2GiANT%%Rb7Z0K9~a!JfLr*);TxQF2#QnE8I9`lbWBsFExlyygMm4>pt3G zE|}V8lAP`dZ?>3qxsV1#o?Ad^k@q|;cM-0b%i*3fKcI;_9D_o#Dabd@|l|Mt73bd(s1f;&k;?uuysX&>dvvUvw_<_HFT zt#*c6nS4bPi>-haNlk{@s}tY>7TGhY`D8&C#g<&w3nNUO~}hnJlmX>_vuwO$No;> ztbA)CX;h)q~X#1817 zo_=O(UqMC7S1U|wa3(9*krc$fhUi$XGgb}HXK2x=4KKUy|A-d{0pIgvkEOhP%-ux)&TUIbwGHUKmpme>)R z+(*-o_o*K@OJJa^9Dsmh1Wu^hr%76$M9fM!6POB9$n(_gOJ+ViPt~$A8f|m4m)po~ z9epR8w6VGh)@3CtO28rOqg}ec%nbT&qH=riomO{w4u!77mnFJnY?mDl)4|;*in6*l zj!vv|f}Irb_=f7pc^VZCECEn2haPIuyIW2!&u1m>DueKiuMnpgf9Kz@o~40Zv}(V` zCiv2XWL|(|{ZIra1zufiDld&X*=SFXR5eaYZWzHyt@BNAc8$)%A5S!^hWykB+j5DV+>^Z?hGn zR$A?--3TZN%7^8V88&QUNF9=BTB|-7v^twRmdy&ckkb16LV7siySuOnL=%~k5q|J2 z6D)CH2&%IdTHI_Hy8pudLp;AC2XYi+B-&U2!pv<`T`12IzWuHWWM#12E7Gr{E;Zk+h7O_Gqr)uT#7BJ~~KPDaH4N|C6SJS=&S$229K_7tINPVI8UWGcHmBs#S_VB6>b36a2 z@LA2v<5L}o-c-jtu|@K{Olo?L?={y7u~fZL4!g!m-bdg(xSNrM`W*F2kHSPi>rB%h zeBPgYh(BVx?wC-&#sClO=*w(kB#vb4?1|SlnbZ_>v)Y+08FsIwr>}==b0#N_-Q$iS zvYwQ#T>iwfx2W6JiPE-u6x7eMcORm@y`dGLe@TEieLQBwvSxic(=-#)j4t68PTxt6 ziS^FPNrWAEV_0R})Vjvl{ds-*efvf(=XY%90^wKQ6|_DczJ(8F&?wSDh62@o4~jun zeF17*7n%*Xj%(RH zAINI;KYWS?_eMr*D<~{SneH1cBV+5f4IEXIpEaKAE3Ue3Dj&N`_6fes_KP#n|RO6DL^j%?ho2^0LyrnT}y0Wk$1l)_tX;xtA?@1@Drph#<}@)LOsa z^>^l{WG5{M_@4u;hEs6|vd_MzO_JE|66d5on%|5$oL!D z8HQ&j*z}w?<@djgZ?sbBMrl@y9I#%{=07fiBBPKb4&?-bSU zYfVoXq8{1c2lCX?jR_4A8Ak(s8WDt26@>aA6^JXL^?Lx1SgvfymulHQ(TIk2LZby) zvyW1yF2uR2StP2#)&;d(EI8}Uo`*^?566dx3ll6`o*v}8EK+ty5!r3M#MY>PSX?hJ z=K97H*zk(WKkp7*L_pL2jaO`aoBrVs^}$3(hOw}!obn^o!cydVI|cn3gX3FeC^>sFF! zNS5$l+!(bz?Zx<>6tm3CraX%n@MmWos0a3Hv&PLkEdT_y!YCJbUIgQx56TJC{%UkK z7kL+p>kp-4^*QNE=R7)4PaMOgCK7YxeHOFSfhPGWp}IAf=@lFDeor>7$W`2V5!%$< z^*<1k%wsHQQ7=YT^SpRn~*L2XH8X-U9^18}(vC?`DnHPXoA z5$lg^1g45&#OYK=(3CP{B zzWlyhBijLUI5JRuJ)B+uQZotT&UL(lte_%ThYc<@f34XU;h+>yH-ia#d@VntM>ev* zK#v}b^uF(E;Tdd5tty|M=13_Ktd0BVV!*`6UUOo3`6$Mc0ZGH__>tx3XN}GWlO&;a zf=lh)#Fy+_-+wjn9b&`yad}vKe8OtZh7FkwC(`cDGVY$XHJ5W;AKn32!@)bFgw}Q- z>gSklT?256L?!I^_`;D}^f17cky)2LL2YOaP6xxjVbqt7Eu-5W8#fK74}LX+rNLP? zX*}P`adPvp4*5)0rt)n5Lp+w#`_FjnqnGprugD%~F}uwcy)?24WN9m`3{jGsWhS86 zxs6xGKP!FHo_sfj;S-V)ob8<$vM2@0fZM1Cyv`QP++A*hB9WG{J}AjF6Zf9@N7KjVgf zt#IzN(nZ9?oA)XwIqT<2IIYb^kGtx~c#rrZS1RLm>Sf{+Bz-pP@_yYV8McNAEhRN1 zickp<({J%~&d0%2H}odcDG!NlLyqmJ+2p09O*tQe_NBWJ&qyQ7LNoVM8{>+!!k^8i z(6;Sl;-JXC>=n5-=aFg*k;L+6IoIT2%8Pi@EAG1SPA!TbKR^tHR*>vC)O`+kJ2dK zo*?OS&i!TI90u72Dh_~R1`M3^WPb-f8*{m7bs1iCdlMVk>}-x(TMCU*YTZua*fzxk zorDbKTS;s#C~R*K@zjXw9SKfb&OKExF3Onxrmn9J8u@w1zYt|V(B=QEKyIBmcLs@r*6X){!O)1F813#RMWG`bKGC;GuN6=Lm-;)t8i#vnRm&n)7+G$^vBSO#R? zsiTH|S^8SVv4QHXoWyQk9=oh(HVh1Fu9WB_)nD!9E5znMD3C~HJg_z2NYN7{%{lD1 zq2E7T`p0iNFoKLHB0 z!FYeTCb=LRPVeJzR2**)uR1ZuEhbxIX@Z(`rI_C|MIG)JHqaZ7rI13ZyurW+{25sX zP`NR4C&SUq8<)YCh2Tp-hald9)**m0`k9~k3(6*>x0hNLfph;fpqr|6O^twPr+=VH zApJDM`T5}d6LJnj)&8|R|Jq^yJ<{-Cj=yM%vMvEA3-WoydM2+!4gkbZ)EZd~JxKCi zcVWVYVXbIX9ZqH%5xpc28;sy9|&>IKk*x0sDq<(CPx9h(+vI>6M>$j zJ!Dv2s;U&oX-1=?r@5+5gG9^ z2J4k&Pja!F4UD{AiR}CGGRjYhfZQ#rkL?z3bFMmAsCKQ%fJI3?60ssPDw9%-xxJuB zCngW8+R+JNOb3|EIvA+!1fCFMj-QWQ*8Kjr1U#C0E%IwmX{u)?B20i!z`O9LPY_2B z@d@}9sJxVAt45X;oVq>TwexrUFt==Md%tEB@o$v|vB7!dN6DpZNKGUF{m6sf*8l29 z>F@Dwf@C!|B*XH1I%m>3g#QidIyOq|#u0J8mucmWI}=22Yu=^?Ul8=f!IA}HDtbem zIm^u-jJ=-UVAtdt`wT70Cq%u9)QY_q$f&72$D^@QQEtpB5gVBZ&z{A$oDmSda`Qu^ z-D&;+Qg!B1vp~(u4{Df)!LX#ofCs_~Ehq|ge~=ox{|?aP{a(B%7IxHLCO3qHZ{`ad z58+kFBR9tsx8y4lmp)a&65&P%eF0?_Or~mPW)Ii?UcXgyI(B&ty^Is?FzZm=Z z((35~@~~79)u<@CoU6I^vHb%KgAU7&_pt(3oKoGg`tfQ!UzPP@>CAWeevHY!HTBJS z{FNF=o1S5isQ`96<5T|@L8!c#+P&t$UQ?u6!2V^2{lzvk)NaV=^(f$7pJK6%Dq%iF zwxo~gT5`x#eii)@Avdh2kkK#(VphWlDgJz*er4!CdfHNaRgV}TTS7m*<%XOvadx!o z#1q$TuTX*E_15S@YrJ3L3ZMCa_5sT5g_!=3XvlAVWxj~WaA`gGzX*@ys9pCMh;=W0 z;`k?^4sdx|eW6ZFzTzkl>|Qe})~QM3T>1-r9>cTl z;#csEiywIqyUY8fF6Blm@Uji|>+w$y zx2!3v2`5YZrVt*By?;DSkQa-nLesVt{|FpjqMXT7TSLg16SHml0fL^n<6iqCgeo9s z?9q2AnUZQTCChXo%j(YmDf|(<`e*nfP~%M(KUnG^gmaT^Mf}xG5<#BbJ_OI@X%#B| z>)!k0tuIu?Q(>*X%i*NT&EY(ooOCKQH8e*|Y9<3|QP0YE*xZ8I4cnP8XC0lfa@0v4Kte6<3UiR`D}R1Y<^ zna7h!wrOP(S>$zT<(m4_A^nH3fRa-AjsgECWS%^^vi6g-3$xj7Aan}D#&|7h)FnX9 z2)%)#*F2%WU^2gC^gQ^+Uxc`b@`l`9tt?yHrF`P@Bn!jY##ZF}h0?)ssQRAn&}Q8; z2Kw2u?)rl}RZowb;PYw$dt?A~y*OIzhP_?i&q=fo5I7T6wL#8mqy7i6hieR*qfDCz z4NDik3~+(qTiW2jFl#iD{; z(GIMS9Ob5RSs|)Y&qo5CvNU&OAY{!xWvXB`t@A=?Xfq<;*rkQPrb^Lma}71OK2cGd zrv2SA);PB0zMFb0QBi{$5*o}eZdqF zy%|Nr*dz`LIP-Zv(fs_=wKdc@aXz`VHQ~fk>K>bxc!L_f?rmcSQGi)T}H; zj9KYEo0Dp*l;k?$tUH*#t0Xq9BHvaGvMO3~Zy&cGUA?O<-k5BlsO(r$!}T1@ull^9 z2EEh5k?ErswiB#|*cc14cRei3U8w9vfVFi+q>HaSSqO6N(bKPQ5Cc;5ELC#XhfwX>OTfgZl-4Akq-}qIIg{| z;Wfl{AY(`0?7lc4)xOHQPg zg!S~XNTMgKZPF8!hkRqIJVE1AngyNaHtCTohw>($xLu?wJs8q29fYlu0EWN`BRnTR zMZ;aVI^Bw{&LnAr%pUc-AmOF-Wp6Q8g!80UoxzkA{ynL3 zr?ApaTl+*w=CYpM(OS&~+%CZxpv4*JUv9(C8x7FPLtOBv`{S}^mXuN_#%$id+V)29 zMsz4g6n1NRH9`Fy_Qu%ywf6Wef`8E1jH$>EMdcNYrnJl<$hbNqc5s|aHA^+!m|vB) z*PGT;r)zH+XPuRoFqbuC$q4>z@Xc#)6hpm>GHJxayc2D&Gy)f1Kb2%b(53B*-=Y}F zXGi1@Mb{?EKgtOxE$j~f2@<$O0BUTzwM_4+sCe&aBP;BHtLn3~1rPG7NZ#+mH4R?A z@~SmCcUy1rBbdvsh~3gpg^kxJrU^4e^Vaf#_R14`b-lOo=KRF0sZ zdV4hO+-|$(3sUCj%lAuh4c1|j+Q=U&p-;?jBp27)MvqX;)Nk01pV=>Y5Ngy{AOtU= zou7mM^p?iK0klsRZWp1$ox}On)wJH-DyONmDH0-Gtt=MWmZ_#W!lN(NZ6J$@!?sxe z@`j}BS@n=Z<}qLXJlf|Odc4i8LmMCNTu1zG{a)qPx4x@WB?yd1zvpbQ`-;pJb<4Ah z9!!BUfV2n8s(-tP-j#hua@>X&CHnJ1GqwcL>siMEUblg9UzUMj&ICa)>+&6puS`^P zX+XZ`wHtJm$o`ut%nP3GvGs=7pKi3fzx}q^OZa4gFU`aDHpCZeX+U*1Mb`=!;)t%5 zSMccISMtk8mOuRFwEj49K(OH>my6;DE3(-1f{&c9?k(zMb$lhxkzeA&dTdKKGP4-A z8)lDLLLc8**nq28#nKrXVUgZohPvUTZwI9 z+eHMbVI}FzozYT}TsyxQ-PhmIwX?=CwskWu562V84pvFrptNllr#0Q=1je{*m-F2Y zFpd>HQCsblW=>)IIMYYo81e+m;~D#>I?lD9Vk3)b?z|qkXT=RDDaiHU z^!Vj>Dl*RQR^083LFAnTNeQ)Vzoan?)07X|+2gNoqjSWBJ?3!1vvi1`H0uyZ?B!Z! z?u@lH`KB+QQ@F2~ESlm!mt~q!MQk$(ODC?3B2ux|(S_WIl>8?MsjK=~a)4Izt>3rm zdac3tZ8vk;dyGEr1b^(3g9{Bfx+&hzO;RZq6k859sOz;p5U57nfoDLwmB{}c)>D$_ z5;15liz2j&vV8STa7zYD?xrmrjM863&wt>sK_JYZ5a3_By^x1;w4n@%dxq0gP}n8J zb%PNi`dxJLn&f>AYhJ8KqtUR_)z?RE*=lZC_T9dx!JJ9E{r-xIb!X;|0~=7XeJz@(~QkNo{0KpvhHN;cgMt8}V*@9JV*t-`gQ9$V3z zzAnpa3*rNESUr}380^?`7Hsc^^D-WMv zwyU2vqtXDxQQhAo6|~P_t2ZJUr6F+O5`Mdi@51a{FR%HipR?|j*D>NGR}dnHed8|K|&k@$dBRAFF*@-x2#&P}QP z;bTtZVRLDx?%`MasbQM_HzMu2OkRc^7i2y5hIgqbb6DkANTZ&t(O!Rg76y2(uRNv*)&N1%gduGc52Fuo+qc!1zXO7(A&(EJ&N z=?Vfesz3VL-BSw8-J@}TR_p92H^xj{;nNZFnjNX03>WV)=>aX(nwT4Fr;K{fGOBv< z*xSdaRIAldIgVYhaFipF%!xeHm$<+NH3)}t@qq>YM{Z?=Scj^V0e1lGg-MA5))5(N z`r^@0A8CpeN1~F&x`U7}eLK=wcSL6*P4QzM+b1b|n}IEHlqgR>DfI;@l*)hbgKcX; z-2haP-VGRo?VmgJ_X*G+W?y*pw%)1^!-ztP~ZmgCGoa#CbH2c1UKxkEhw;*%9DC2`ygR(UAPLy`^pz;j}-+ zz~89-!7w1O7@TwuL~a=Hl5{a6!Ocf@fmXZ<)8u`8t-Fr$WB>6qtmz_BB1mY8`6hWF zmfvu4#{PCNq74sqWE@$1pLBg6b?RV{je8qk{Uj*N+Ei3VV1i4vhH|`7(&FIjmr8y{ zX<-VY^B4k`UHB)X^U0ilIRrpvI@gbi5o78s=By;^eLP3q36urhjV2n!>Dq8`ikLXP<$Q3 z0#Kt_*Tqn;(<-m@KTxAVS7=f~yzkWDNoetTzXjLhb_}ogM)CusQ3w#|v_#{Y1n}OT z89?hGpXO^>|3?igAT#Jcxuoyy{bK%CWCWQ1tL$L7erB$V zn`+XdSr7m1aEQZx2>;V7pm9`~+B{-DS49%{r7qkCy1$)?9(3PU3TI9`rt2MVZk(Rs z=7TMt_pJJRA7?AYs>&QN!pUjeYq90NKc@%YE_CxJ30x2|ds(XHW!EZo@1MobNcFAK zv`tRl;(4mkwzV-7@OCnLHPdZVUt#fzP+ROzwd9ATJ}v6JVoIm1Mz!JAHBh5At-jne z^3~QNSTMsK-S{LygM?U*kdIux3@zpUR`)Y%!RJL>gPrLuO6rU}1azDd>u(-*a8=NT z5xm5H^U&N;>=o%afx7(wJ3>+|4#I7~D;+|bg2w}s9-NK}b=x&#GbBxw4>=e|^|A5> z-eee3GE%8>(E{co_1U#e4Z)S))bGaGdJx}x-3gDcE+c+$d0>$ro`)rVx47haZzYe5 zZo;Xsc6Id0=H}829K%=t8vy06Dmf^+0H`9iAc_Fg#L@&M2~L)r#)?v}mRP>w#0?z@ zeAXIbvo*Ne7YXR7DOshwK$w=hB^N^M9o=bq?OB+}hSo!&!!f>SsXSjL+|PGk=&nce%pzThl=n6i$F@8ic=S zk*0)bCrjCv42oiYY#le3u#i_M=Rt}~Cvx;7q$=X$SOopjON+jEQt7K7*@5mUCO}Qx zbx9*X*lB@3vU)&^R-Ii!@mPq`xUOa_` zg(KZ$k*Qs-G*>?ql7nhm6Lh(nav|lSzP1!0sc2GE~b>=EqT z5tRO;W+I^I-H*0(8$FJd4Zaz8BBHDRsQ&VMdISeCeA6cDdzvROa#C^7^vH^|wB4ki zJE7h`j>k=+zNVi-@4{P)-~n!PEDB1u#M6q+zJR33l)g}}IOm`8eR(N9SBT-V{BSOI zM*iE#dbd>2dVnSGt`8lF-DWbsO}5_K`D8|;iWmB`FYsVt%xFQ=9)_&!I~)wx^`-td z4iAE-4%=W7-?_l(3TxcL-PLqI&JPU^VpXsCn*zxm;EL7U^q`nDsMFtfJ-41@xwBSW z&(FKl6>?~Nlj*+MJ($#YKtVwmhCHOBTi!oP)d7}$Q8%gKQb6=w4E5H(sePJB%ugh4 zdG2%w#uXSvk&aepY#wd!$Sv`%4<|nMbN>2CAhFN-?lkNJ#ixzENsW`bk23kbN|X|L zQW#HPq~uP{inP#z?y(N6$1qNMjmCuWaEewGSJLOa+{6A#DcNk}>b~Tz`iUru{?Ykf zzT#vU&1;IJ0G_H{pLfKw_?gX5Y0`Fs3{8v;#fyS)Z|Ndpo^dlZl~Q^O-H|h z2J-dMmA02DewG((~}x#y0mlGjC?mFi!XLbni*N@GbeG8rqoT z?!kPohjyGUk|=VAl!Z?Q_+V$n+-oz(j68?wjv~hv$>{1;Tq@b~&Cj6sBd#{u zTlWRk3^y4NJbHZF^_HWu1y2eO+_ufFeCu{>=?7_ij}A+N_(tT^B=zp|WU;LJE?q9Y zEAM@UBT}!JS}yATSl@@`qgqfl-BJM~+{v?HDrjQf{Sdmufu_DAH+jPp?~dl3hsR&( zO-H#7W?a>{M>V<%_Den{t{f6Ki`x@Nbbb6E82L>+<$HI#jj~A2j-8)qD@f-~Qx^s% zPmx6>cO;G8&6~B-1@-*QuThXraA?;Lwn+VB-7EQT!jM9nh;sidQ#R-bb?oBnmRtH! z<9=P;R0=%S7qSbuBoacu?;hAj@Fq$qZ`+Bf7hwvC+1X|UXmeAIaX-?|_9b#vk9dCHMfTS8;MkY>!&djzdZN*P6L z=|q~0M>i*0?>mmavoCW--jJYDNFY$$$|RK{aQeW(XVH9nSta~Pc7+K{>0r&9tQhoQ zj8#20>J;`OUBy6jVsGn%Xg$f=fjdXYJ2xLyrsf)q@rTCW<;|%g#Wy>E?gQ-YKkGOC zle!R@uIX7ewoP9s7`sSof5V9)= zCJE_O%(&m}bkxlut9-wzaQ+F;F|gfYhgG}>C7lS94uz-G?i4~2Y7HWM&gsHGV`|X8 zW>FrPEJGn23+X`$-O1Y85@HcFhm00B)al8hd_O3;ZFt+Q`E~aLm!hesw`aCQsVk8R z>1r~oGBw`a5#eL4My$th&pDw>y(4uldyEtZuE17-f$@Q|;GO;0(S8t6D@SD}dfIEt z`_A{Mk=DzKOR|)6b(l5iW4MrDCdKF;mKyBe%0(U}2rc9aqUm;RQyo$RN=W!$TN2e* z?g600h@O4~>JM(!|0rV&Q$hhL>U0$x6$%x;DvJ!!@$ASz@vJMFCCmuzzv>UeD5n4I zhY#8zDOYRXniUKs8xfpQ1pSr%sGXc6DCwE?NVinZaEURs$or};Zk-Tl9TRb#7#?Dy z7;M8D76RA1yJJ8|_}&dDeig(oO12(Bk_dph&KTfl@GZ3nSB0F%{>Bg0eF?oLviGwI zr>3m`Xu_GHz-#+tn8Z);&RMfJA&=L}32&h0S%b{IqkE|~wkVARsK{M78TMnc;) zi588;wG~EEN&;dVnr2r{qBk>+NiIf~u%;cvDMnrn?cRFmg-_#RjdUPnnn)4Kwbl27 zE0rhOfW+Wt3S({;%v5zLDzDs>eSCXO4g`0h5zsbUck$&}Ks|vZiNEH=uyUd!eR=;| z@+opZbX7t1oPG+BmI#J)xO&E~+$@%MJhZ zVowK`eHho4!Ya%4kGUL4D7ocK60XDbNr^%z{%+=sAA4fyUU~XuyFXJRPb*5kX(FK` z$8<>M>wKue27Y|RiQs<$YB3U&PYM(0QwaoXxwPbAyH;iDb@ZFN8peb;k-3?4DD_qI z0{7kn{nK4j0-=tH+zw%pa5(c1`)s17)k3VskN!%SA36WUm+p>weM=Mm3a|U}?sr24 zoe7dK{nQknmnuqknFsIQvYSjs_+vq8al!m@)5r`j(I9*E!_3VVAS?ztBE8DJaK}fq zGD+YVmBPPBXk>J{rdhmgWeM_M&2_PaJ51f58#y{E2{*S zEZn^+`3|8gVY&6_&}1n+)ocN4gh9C9f;PzuX)czC!!nI8a^ zpx(Pka_PD=*ZkqbhsN>o@!VXxwJQo9P|v*D>+-q2{_Nb`+$H+Mkk7<+TiF1=2?j<= MOkT7|*udxi0op?g(EtDd literal 0 HcmV?d00001 From 0771d79753350650bdaadb219a4cc6bc22ee0f68 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 17 Nov 2017 18:05:24 -0800 Subject: [PATCH 07/16] fixed toc --- windows/device-security/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/TOC.md b/windows/device-security/TOC.md index 8682940443..13af847a45 100644 --- a/windows/device-security/TOC.md +++ b/windows/device-security/TOC.md @@ -125,7 +125,7 @@ ## [Encrypted Hard Drive](encrypted-hard-drive.md) -## [How to opt-in to HVCI](how-to-opt-in-to-hvci-for-windows-devices.md) +## [Enable HVCI](enable-virtualization-based-protection-of-code-integrity.md) ## [Security auditing](auditing\security-auditing-overview.md) ### [Basic security audit policies](auditing\basic-security-audit-policies.md) From ac3d2a272af206f7e41ab8c68ab75c5b66c0a968 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 17 Nov 2017 18:19:16 -0800 Subject: [PATCH 08/16] revised UI step --- .../enable-virtualization-based-protection-of-code-integrity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md index 8450dfa0f6..2a98cf928d 100644 --- a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md @@ -45,7 +45,7 @@ If your device already has a WDAC policy (SIPolicy.p7b), please contact your IT a. Click Start, type **Turn Windows Features on or off** and press ENTER. - b. Select **Hyper-V** > **Hyper-V Platform** > **Hypervisor** and click **OK**. + b. Select **Hyper-V** > **Hyper-V Platform** > **Hyper-V Hypervisor** and click **OK**. ![Turn Windows features on or off](images\turn-windows-features-on-or-off.png) From 1fc8e3c92d1ebc8cbe2262e0bf5da819871a9f5b Mon Sep 17 00:00:00 2001 From: zTemplar85 Date: Mon, 20 Nov 2017 14:17:08 +0800 Subject: [PATCH 09/16] Referencing wrong event id Believe it should read 4634 instead of 4647 --- windows/device-security/auditing/event-4634.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/auditing/event-4634.md b/windows/device-security/auditing/event-4634.md index ed2fc54241..a6b32d39a0 100644 --- a/windows/device-security/auditing/event-4634.md +++ b/windows/device-security/auditing/event-4634.md @@ -23,7 +23,7 @@ author: Mir0sh This event shows that logon session was terminated and no longer exists. -The main difference between “[4647](event-4647.md): User initiated logoff.” and 4647 event is that 4647 event is generated when logoff procedure was initiated by specific account using logoff function, and 4634 event shows that session was terminated and no longer exists. +The main difference between “[4647](event-4647.md): User initiated logoff.” and 4634 event is that 4647 event is generated when logoff procedure was initiated by specific account using logoff function, and 4634 event shows that session was terminated and no longer exists. 4647 is more typical for **Interactive** and **RemoteInteractive** logon types when user was logged off using standard methods. You will typically see both 4647 and 4634 events when logoff procedure was initiated by user. From 309abb0c7162be54e59395853ffc6b374d84c5be Mon Sep 17 00:00:00 2001 From: Maira Wenzel Date: Tue, 21 Nov 2017 11:07:40 -0800 Subject: [PATCH 10/16] removing duplicate text --- windows/configuration/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 88c44d0c4c..cad65095b0 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -41,7 +41,7 @@ ## [Cortana integration in your business or enterprise](cortana-at-work/cortana-at-work-overview.md) ### [Testing scenarios using Cortana in your business or organization](cortana-at-work/cortana-at-work-testing-scenarios.md) #### [Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook](cortana-at-work/cortana-at-work-scenario-1.md) -#### [Test scenario 2 - Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/cortana-at-work-scenario-2.md) +#### [Test scenario 2 - Perform a quick search with Cortana at work](cortana-at-work/cortana-at-work-scenario-2.md) #### [Test scenario 3 - Set a reminder for a specific location using Cortana at work](cortana-at-work/cortana-at-work-scenario-3.md) #### [Test scenario 4 - Use Cortana at work to find your upcoming meetings](cortana-at-work/cortana-at-work-scenario-4.md) #### [Test scenario 5 - Use Cortana to send email to a co-worker](cortana-at-work/cortana-at-work-scenario-5.md) From 7bbe8bc4fcb31384d45936661947b5d1f602ca16 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 21 Nov 2017 11:10:52 -0800 Subject: [PATCH 11/16] incorp of additional feedback --- .../update/waas-delivery-optimization.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index bbc850f96b..98d29579ad 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -19,17 +19,18 @@ ms.date: 11/13/2017 > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or the "Express packages" feature of System Center Configuration Manager. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. +Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager when installation Express Updates is enabled. Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. -For more details, see [Download mode](#download-mode). >[!NOTE] >WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. +For more details, see [Download mode](#download-mode). + ## Delivery Optimization options You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization. @@ -100,7 +101,7 @@ Download mode dictates which download sources clients are allowed to use when do | Download mode option | Functionality when set | | --- | --- | | HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | -| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. Delivery Optimization finds other clients that connect to the Internet using the same public IP as the target client. It returns a list of private IPs to connect to on that network. These clients then attempt to connect to each other by using the private subnet IP. | +| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. The Delivery Optimization cloud service finds other clients that connect to the Internet using the same public IP as the target client. These clients then attempts to connect to other peers on the same network by using their private subnet IP.| | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | | Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | @@ -206,11 +207,11 @@ Starting in Windows 10, version 1703, you can use two new PowerShell cmdlets to | Priority | Priority of the download; values are **foreground** or **background** | | FileSize | Size of the file | | TotalBytesDownloaded | The number of bytes from any source downloaded so far | -| PercentPeerCaching |The percentage of bytes received that have come from peers | -| BytesFromPeers | Total bytes from peer devices participating in Delivery Optimization (sum of bytes from LAN, Group, and Internet Peers) | +| PercentPeerCaching |The percentage of bytes downloaded from peers versus over HTTP | +| BytesFromPeers | Total bytes downloaded from peer devices (sum of bytes downloaded from LAN, Group, and Internet Peers) | | BytesfromHTTP | Total number of bytes received over HTTP | | DownloadDuration | Total download time in seconds | -| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is seeding); **Paused** (download/upload paused by caller) | +| Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | Using the `-Verbose` option returns additional information: @@ -245,13 +246,13 @@ Using the `-Verbose` option returns additional information: ## Frequently asked questions -**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Download Optimization cloud service for coordination. +**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. **Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 or 3544 (Teredo). For client-service communication, it uses port 80/443. **What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. -**What hostnames should I allow through my firewall to support Delivery Optimization?**: For the Delivery Optimization service itself: ***.do.dsp.mp.microsoft.com**. +**What hostnames should I allow through my firewall to support Delivery Optimization?**: For the Delivery Optimization service itself: **\*.do.dsp.mp.microsoft.com**. To allow the download payloads: - *.download.windowsupdate.com From 867fd410873c8e0f6f68318b7216cd62e7d1a329 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 21 Nov 2017 12:42:25 -0800 Subject: [PATCH 12/16] further tweaks --- .../update/waas-delivery-optimization.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 98d29579ad..f4ad73d713 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -19,7 +19,7 @@ ms.date: 11/13/2017 > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can be very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these elements among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager when installation Express Updates is enabled. +Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager when installation of Express Updates is enabled. Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. @@ -252,14 +252,20 @@ Using the `-Verbose` option returns additional information: **What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. -**What hostnames should I allow through my firewall to support Delivery Optimization?**: For the Delivery Optimization service itself: **\*.do.dsp.mp.microsoft.com**. +**What hostnames should I allow through my firewall to support Delivery Optimization?**: + +For communication between clients and the Delivery Optimization cloud service: **\*.do.dsp.mp.microsoft.com**. + +For Delivery Optimization metadata: -To allow the download payloads: -- *.download.windowsupdate.com -- *.windowsupdate.com - *.dl.delivery.mp.microsoft.com - *.emdl.ws.microsoft.com +For the payloads (optional): + +- *.download.windowsupdate.com +- *.windowsupdate.com + From b3053aef0c8d08293bc4eeb1e798894a727d5a8a Mon Sep 17 00:00:00 2001 From: Jeffrey Sutherland Date: Wed, 22 Nov 2017 22:07:42 +0000 Subject: [PATCH 13/16] Updated enable-virtualization-based-protection-of-code-integrity.md --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md index 2a98cf928d..b96f6d2368 100644 --- a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md @@ -16,7 +16,7 @@ ms.date: 11/07/2017 - Windows 10 - Windows Server 2016 -Virtualization-based protection of code integrity (herein refered to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity checks for kernel-mode memory pages are performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. +Virtualization-based protection of code integrity (herein referred to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode memory against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. @@ -34,7 +34,7 @@ If your device already has a WDAC policy (SIPolicy.p7b), please contact your IT 1. Download the Enable HVCI cabinet file. 2. Open the cabinet file. -3. Right-click the SIPolicy.p7b file and extract it to the following location: +3. Right-click the SIPolicy.p7b file and extract it. Then move it to the following location: C:\Windows\System32\CodeIntegrity From 293f1bfe02b2135696f5842e2195879720c338c5 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Wed, 22 Nov 2017 23:30:20 +0000 Subject: [PATCH 14/16] Revert "Merged PR 4645: Updated enable-virtualization-based-protection-of-code-integrity.md Updated enable-virtualization-based-protection-of-code-integrity.md" --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md index b96f6d2368..2a98cf928d 100644 --- a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md @@ -16,7 +16,7 @@ ms.date: 11/07/2017 - Windows 10 - Windows Server 2016 -Virtualization-based protection of code integrity (herein referred to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode memory against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. +Virtualization-based protection of code integrity (herein refered to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity checks for kernel-mode memory pages are performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. @@ -34,7 +34,7 @@ If your device already has a WDAC policy (SIPolicy.p7b), please contact your IT 1. Download the Enable HVCI cabinet file. 2. Open the cabinet file. -3. Right-click the SIPolicy.p7b file and extract it. Then move it to the following location: +3. Right-click the SIPolicy.p7b file and extract it to the following location: C:\Windows\System32\CodeIntegrity From 405750bd75543adec3005db4db2ccadc06c781bb Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Wed, 22 Nov 2017 23:37:06 +0000 Subject: [PATCH 15/16] Revert "Merged PR 4650: Revert "Updated enable-virtualization-based-protection-of-code-integrity.md" Revert !4645" --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md index 2a98cf928d..b96f6d2368 100644 --- a/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/device-security/enable-virtualization-based-protection-of-code-integrity.md @@ -16,7 +16,7 @@ ms.date: 11/07/2017 - Windows 10 - Windows Server 2016 -Virtualization-based protection of code integrity (herein refered to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity checks for kernel-mode memory pages are performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. +Virtualization-based protection of code integrity (herein referred to as HVCI) is a powerful system mitigation, which leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode memory against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Some applications, including device drivers, may be incompatible with HVCI. This can cause devices or software to malfunction and in rare cases may result in a Blue Screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. @@ -34,7 +34,7 @@ If your device already has a WDAC policy (SIPolicy.p7b), please contact your IT 1. Download the Enable HVCI cabinet file. 2. Open the cabinet file. -3. Right-click the SIPolicy.p7b file and extract it to the following location: +3. Right-click the SIPolicy.p7b file and extract it. Then move it to the following location: C:\Windows\System32\CodeIntegrity From 62ace027221af3ef85b5bbe3d3820178fd386186 Mon Sep 17 00:00:00 2001 From: Kaushik Ainapure Date: Thu, 23 Nov 2017 18:36:05 +0530 Subject: [PATCH 16/16] Update or Remove MDOP Video Link The MDOP Video fwlink is routing to TechNet page which is replica of this page. Either update or remove the Video link. --- mdop/agpm/index.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md index cc29f75805..d4a053a9f6 100644 --- a/mdop/agpm/index.md +++ b/mdop/agpm/index.md @@ -41,10 +41,6 @@ In addition to the product documentation available online, supplemental product - -

MDOP Videos

-

For a list of available MDOP videos, go to [Microsoft Desktop Optimization Pack Technologies Videos](https://go.microsoft.com/fwlink/?LinkId=234275) (https://go.microsoft.com/fwlink/?LinkId=234275).

-

MDOP Virtual Labs

For a list of available MDOP virtual labs, go to [Microsoft Desktop Optimization Pack (MDOP) Virtual Labs](https://go.microsoft.com/fwlink/?LinkId=234276) (https://go.microsoft.com/fwlink/?LinkId=234276).